diff --git a/.github/ISSUE_TEMPLATE/bug-report.yml b/.github/ISSUE_TEMPLATE/bug-report.yml
index 37fc048a0e..9304447079 100644
--- a/.github/ISSUE_TEMPLATE/bug-report.yml
+++ b/.github/ISSUE_TEMPLATE/bug-report.yml
@@ -8,6 +8,8 @@ body:
       value: |
         Thanks for helping improve the Supabase CLI. Please include the exact command and output whenever possible so maintainers can reproduce the issue quickly.
 
+        Open this issue **before** starting work — a maintainer will add the `open-for-contribution` label once it is triaged and ready. Pull requests from external contributors that don't link an open, `open-for-contribution` issue are closed automatically. See [CONTRIBUTING.md](../blob/develop/CONTRIBUTING.md).
+
   - type: dropdown
     id: affected-area
     attributes:
diff --git a/.github/ISSUE_TEMPLATE/config.yml b/.github/ISSUE_TEMPLATE/config.yml
index 8c49825527..00644d304d 100644
--- a/.github/ISSUE_TEMPLATE/config.yml
+++ b/.github/ISSUE_TEMPLATE/config.yml
@@ -1,5 +1,8 @@
 blank_issues_enabled: false
 contact_links:
+  - name: 📖 Contribution workflow
+    url: https://github.com/supabase/cli/blob/develop/CONTRIBUTING.md
+    about: Read this before opening an issue or pull request — PRs must link a labeled, open issue.
   - name: Supabase support
     url: https://supabase.com/support
     about: Get help with your Supabase project, account, billing, or hosted services.
diff --git a/.github/ISSUE_TEMPLATE/docs.yml b/.github/ISSUE_TEMPLATE/docs.yml
index 57501fd9d3..aa04c9c2d3 100644
--- a/.github/ISSUE_TEMPLATE/docs.yml
+++ b/.github/ISSUE_TEMPLATE/docs.yml
@@ -3,6 +3,11 @@ description: Suggest an improvement to Supabase CLI documentation.
 labels:
   - 📘 Docs
 body:
+  - type: markdown
+    attributes:
+      value: |
+        Thanks for helping improve the docs! Open this issue **before** starting work — a maintainer will add the `open-for-contribution` label once it is triaged and ready. Pull requests from external contributors that don't link an open, `open-for-contribution` issue are closed automatically. See [CONTRIBUTING.md](../blob/develop/CONTRIBUTING.md).
+
   - type: input
     id: link
     attributes:
diff --git a/.github/ISSUE_TEMPLATE/feature-request.yml b/.github/ISSUE_TEMPLATE/feature-request.yml
index 12bb26e54e..fd3a0eda1d 100644
--- a/.github/ISSUE_TEMPLATE/feature-request.yml
+++ b/.github/ISSUE_TEMPLATE/feature-request.yml
@@ -3,6 +3,11 @@ description: Suggest an improvement or new capability for the Supabase CLI.
 labels:
   - ✨ Feature
 body:
+  - type: markdown
+    attributes:
+      value: |
+        Thanks for the suggestion! Open this issue **before** starting work — a maintainer will add the `open-for-contribution` label once it is triaged and ready. Pull requests from external contributors that don't link an open, `open-for-contribution` issue are closed automatically. See [CONTRIBUTING.md](../blob/develop/CONTRIBUTING.md).
+
   - type: checkboxes
     id: existing-issues
     attributes:
diff --git a/.github/MAINTAINERS.md b/.github/MAINTAINERS.md
new file mode 100644
index 0000000000..e8321dd3b9
--- /dev/null
+++ b/.github/MAINTAINERS.md
@@ -0,0 +1,58 @@
+# Maintainers guide
+
+Internal notes for maintaining the Supabase CLI contribution workflow. See
+[`CONTRIBUTING.md`](../CONTRIBUTING.md) for the contributor-facing version.
+
+## The `open-for-contribution` gate
+
+External pull requests are only accepted when they link to an **open** GitHub issue
+that carries the **`open-for-contribution`** label. This is enforced by the
+[`Contribution Gate`](./workflows/contribution-gate.yml) workflow, whose decision logic
+lives in [`scripts/contribution-gate.ts`](./scripts/contribution-gate.ts).
+
+The gate runs **reactively on each PR** so a non-conforming PR is closed right away, and
+can also be **swept across every open PR on demand** via the workflow's *Run workflow*
+button.
+
+A pull request is **auto-closed with an explanatory comment** when the author is external
+and any of these is true:
+
+- no issue is linked (via a closing keyword such as `Closes #123`, or the PR's
+  Development sidebar), or
+- the linked issue is closed, or
+- the linked issue is missing the `open-for-contribution` label.
+
+Authors whose `author_association` is `OWNER`, `MEMBER`, or `COLLABORATOR`, and bot
+accounts, are **exempt** — Supabase maintainers can keep working from Linear tickets that
+aren't public on GitHub.
+
+### Running the gate manually
+
+Use **Actions → Contribution Gate → Run workflow** to sweep all open PRs on demand — for
+example right after bulk-applying `open-for-contribution` labels, so the whole backlog is
+re-evaluated at once instead of waiting for each PR's next edit. Set the **`dry_run`**
+input to `true` first to log each PR's decision in the run output without commenting on or
+closing anything; run again with `dry_run` unchecked to apply the decisions.
+
+## Triage: applying the label (manual)
+
+During triage:
+
+1. Categorize the issue with one of `✨ Feature`, `🐛 Bug`, or `📘 Docs`. Issues opened
+   via the templates start with their category label already applied.
+2. When the issue is ready to be worked on, add the **`open-for-contribution`** label.
+
+The `open-for-contribution` label must exist as a repository label for this workflow to
+function; create it once from **Issues → Labels** if it is missing.
+
+Applying `open-for-contribution` is currently a **manual step** — do it on the GitHub
+issue directly (from the GitHub UI, or from the Linear-linked issue).
+
+## Deferred: automatic Linear → GitHub label sync
+
+We considered auto-applying `open-for-contribution` when a Linear issue moves out of
+Triage/Backlog (e.g. to Todo). Linear's native GitHub automations are one-directional
+(GitHub events update Linear status) and cannot push a GitHub label, so this would need an
+external bridge (a scheduled job polling the Linear API, a Zapier/Make zap, or a Linear
+webhook → relay). It is **out of scope for now** and tracked separately; until then, apply
+the label manually as above.
diff --git a/.github/PULL_REQUEST_TEMPLATE.md b/.github/PULL_REQUEST_TEMPLATE.md
new file mode 100644
index 0000000000..2c8e119819
--- /dev/null
+++ b/.github/PULL_REQUEST_TEMPLATE.md
@@ -0,0 +1,22 @@
+<!--
+Before opening this PR, confirm the linked issue is open and carries the
+`open-for-contribution` label. PRs from external contributors that don't follow
+the workflow in CONTRIBUTING.md are closed automatically.
+@supabase members working from Linear tickets are exempt.
+-->
+
+## Summary
+
+<!-- What does this change and why? -->
+
+## Linked issue
+
+Closes #
+
+- [ ] The linked issue is **open** and carries the `open-for-contribution` label (or I'm a Supabase maintainer).
+
+## Checklist
+
+- [ ] The PR title follows [Conventional Commits](https://www.conventionalcommits.org/) (e.g. `fix(cli): …`).
+- [ ] Tests added or updated for the change.
+- [ ] `pnpm check:all` and `pnpm test` pass for the workspace(s) I touched.
diff --git a/.github/scripts/contribution-gate.test.ts b/.github/scripts/contribution-gate.test.ts
new file mode 100644
index 0000000000..7951de817a
--- /dev/null
+++ b/.github/scripts/contribution-gate.test.ts
@@ -0,0 +1,297 @@
+import { afterEach, describe, expect, spyOn, test } from "bun:test";
+import {
+  evaluateAllOpenPrs,
+  evaluateGate,
+  fetchAuthorPermission,
+  GATE_LABEL,
+  type GateIo,
+  isInternalAuthor,
+  type LinkedIssue,
+  type OpenPr,
+} from "./contribution-gate.ts";
+
+const REPO = "supabase/cli";
+
+describe("isInternalAuthor", () => {
+  test.each(["OWNER", "MEMBER", "COLLABORATOR"])(
+    "treats internal association %s as internal without a permission lookup",
+    (authorAssociation) => {
+      expect(isInternalAuthor(authorAssociation, undefined)).toBe(true);
+    },
+  );
+
+  test.each(["admin", "write"])("treats push-capable permission %s as internal", (permission) => {
+    // A private org member surfaces only as CONTRIBUTOR/NONE via
+    // author_association, but their effective repo permission gives them
+    // away as a maintainer.
+    expect(isInternalAuthor("CONTRIBUTOR", permission)).toBe(true);
+    expect(isInternalAuthor("NONE", permission)).toBe(true);
+  });
+
+  test.each(["read", "none", undefined])(
+    "treats external author with permission %s as external",
+    (permission) => {
+      expect(isInternalAuthor("CONTRIBUTOR", permission)).toBe(false);
+      expect(isInternalAuthor("NONE", permission)).toBe(false);
+    },
+  );
+});
+
+describe("evaluateGate", () => {
+  test("skips bot authors", () => {
+    const result = evaluateGate({
+      repository: REPO,
+      isInternal: false,
+      isBot: true,
+      linkedIssues: [],
+    });
+    expect(result.pass).toBe(true);
+    expect(result.reason).toBe("bot");
+  });
+
+  test("skips internal authors", () => {
+    const result = evaluateGate({
+      repository: REPO,
+      isInternal: true,
+      isBot: false,
+      linkedIssues: [],
+    });
+    expect(result.pass).toBe(true);
+    expect(result.reason).toBe("internal");
+  });
+
+  test("fails when no issue is linked", () => {
+    const result = evaluateGate({
+      repository: REPO,
+      isInternal: false,
+      isBot: false,
+      linkedIssues: [],
+    });
+    expect(result.pass).toBe(false);
+    expect(result.reason).toBe("no-linked-issue");
+    expect(result.message).toContain(GATE_LABEL);
+    expect(result.message).toContain("CONTRIBUTING.md");
+  });
+
+  test("fails when the linked issue is open but not labeled", () => {
+    const result = evaluateGate({
+      repository: REPO,
+      isInternal: false,
+      isBot: false,
+      linkedIssues: [{ repository: REPO, number: 12, state: "OPEN", labels: ["🐛 Bug"] }],
+    });
+    expect(result.pass).toBe(false);
+    expect(result.reason).toBe("missing-label");
+    expect(result.message).toContain(GATE_LABEL);
+  });
+
+  test("fails when the only labeled issue is closed", () => {
+    const result = evaluateGate({
+      repository: REPO,
+      isInternal: false,
+      isBot: false,
+      linkedIssues: [{ repository: REPO, number: 7, state: "CLOSED", labels: [GATE_LABEL] }],
+    });
+    expect(result.pass).toBe(false);
+    expect(result.reason).toBe("issue-closed");
+  });
+
+  test("passes when a linked issue is open and carries the gate label", () => {
+    const result = evaluateGate({
+      repository: REPO,
+      isInternal: false,
+      isBot: false,
+      linkedIssues: [
+        {
+          repository: REPO,
+          number: 42,
+          state: "OPEN",
+          labels: [GATE_LABEL, "🐛 Bug"],
+        },
+      ],
+    });
+    expect(result.pass).toBe(true);
+    expect(result.reason).toBe("ok");
+  });
+
+  test("passes when any one of several linked issues qualifies", () => {
+    const result = evaluateGate({
+      repository: REPO,
+      isInternal: false,
+      isBot: false,
+      linkedIssues: [
+        { repository: REPO, number: 1, state: "CLOSED", labels: [GATE_LABEL] },
+        { repository: REPO, number: 2, state: "OPEN", labels: ["✨ Feature"] },
+        { repository: REPO, number: 3, state: "OPEN", labels: [GATE_LABEL] },
+      ],
+    });
+    expect(result.pass).toBe(true);
+    expect(result.reason).toBe("ok");
+  });
+
+  test("ignores an open, labeled issue from a different repository", () => {
+    // Cross-repo closing keyword (e.g. `Closes attacker/repo#1`): the issue is
+    // controlled by the contributor, so it must not satisfy the gate.
+    const result = evaluateGate({
+      repository: REPO,
+      isInternal: false,
+      isBot: false,
+      linkedIssues: [
+        {
+          repository: "attacker/repo",
+          number: 1,
+          state: "OPEN",
+          labels: [GATE_LABEL],
+        },
+      ],
+    });
+    expect(result.pass).toBe(false);
+    expect(result.reason).toBe("no-linked-issue");
+  });
+
+  test("matches the repository case-insensitively", () => {
+    const result = evaluateGate({
+      repository: REPO,
+      isInternal: false,
+      isBot: false,
+      linkedIssues: [
+        {
+          repository: "Supabase/CLI",
+          number: 5,
+          state: "OPEN",
+          labels: [GATE_LABEL],
+        },
+      ],
+    });
+    expect(result.pass).toBe(true);
+    expect(result.reason).toBe("ok");
+  });
+});
+
+describe("evaluateAllOpenPrs", () => {
+  function makeIo(
+    openPrs: OpenPr[],
+    linkedByPr: Record<number, LinkedIssue[]>,
+    permissionByLogin: Record<string, string> = {},
+  ): {
+    io: GateIo;
+    closed: Array<{ number: number; message: string }>;
+    permissionLookups: string[];
+  } {
+    const closed: Array<{ number: number; message: string }> = [];
+    const permissionLookups: string[] = [];
+    const io: GateIo = {
+      listOpenPrs: () => Promise.resolve(openPrs),
+      fetchPermission: (login) => {
+        permissionLookups.push(login);
+        return Promise.resolve(permissionByLogin[login]);
+      },
+      fetchLinkedIssues: (prNumber) => Promise.resolve(linkedByPr[prNumber] ?? []),
+      closePr: (prNumber, message) => {
+        closed.push({ number: prNumber, message });
+        return Promise.resolve();
+      },
+    };
+    return { io, closed, permissionLookups };
+  }
+
+  test("closes only non-conforming external PRs and leaves the rest", async () => {
+    const { io, closed, permissionLookups } = makeIo(
+      [
+        // no issue -> close
+        { number: 1, authorLogin: "ext-a", authorAssociation: "NONE", isBot: false },
+        // public member -> skip (no permission lookup needed)
+        { number: 2, authorLogin: "maint", authorAssociation: "MEMBER", isBot: false },
+        // bot -> skip
+        { number: 3, authorLogin: "dependabot", authorAssociation: "NONE", isBot: true },
+        // conforming external -> keep
+        { number: 4, authorLogin: "ext-b", authorAssociation: "CONTRIBUTOR", isBot: false },
+        // missing label -> close
+        { number: 5, authorLogin: "ext-c", authorAssociation: "NONE", isBot: false },
+        // private-membership maintainer (CONTRIBUTOR + write access) -> skip
+        { number: 6, authorLogin: "hidden-maint", authorAssociation: "CONTRIBUTOR", isBot: false },
+      ],
+      {
+        4: [{ repository: REPO, number: 40, state: "OPEN", labels: [GATE_LABEL] }],
+        5: [{ repository: REPO, number: 50, state: "OPEN", labels: ["🐛 Bug"] }],
+      },
+      { "hidden-maint": "write" },
+    );
+
+    const entries = await evaluateAllOpenPrs(io, REPO);
+
+    expect(closed.map((c) => c.number).sort((a, b) => a - b)).toEqual([1, 5]);
+    const byNumber = Object.fromEntries(entries.map((entry) => [entry.number, entry.result]));
+    expect(byNumber[1]?.reason).toBe("no-linked-issue");
+    expect(byNumber[2]?.pass).toBe(true);
+    expect(byNumber[2]?.reason).toBe("internal");
+    expect(byNumber[3]?.reason).toBe("bot");
+    expect(byNumber[4]?.pass).toBe(true);
+    expect(byNumber[5]?.reason).toBe("missing-label");
+    expect(byNumber[6]?.pass).toBe(true);
+    expect(byNumber[6]?.reason).toBe("internal");
+    expect(closed.find((c) => c.number === 1)?.message).toContain(GATE_LABEL);
+    // Bots and public members are settled without a permission lookup.
+    expect(permissionLookups).not.toContain("maint");
+    expect(permissionLookups).not.toContain("dependabot");
+  });
+
+  test("returns an entry per PR and closes none when all conform", async () => {
+    const { io, closed } = makeIo(
+      [{ number: 9, authorLogin: "ext", authorAssociation: "NONE", isBot: false }],
+      {
+        9: [{ repository: REPO, number: 90, state: "OPEN", labels: [GATE_LABEL] }],
+      },
+    );
+
+    const entries = await evaluateAllOpenPrs(io, REPO);
+
+    expect(entries).toHaveLength(1);
+    expect(closed).toHaveLength(0);
+    expect(entries[0]?.result.pass).toBe(true);
+  });
+});
+
+describe("fetchAuthorPermission", () => {
+  const fetchSpy = spyOn(globalThis, "fetch");
+  afterEach(() => {
+    fetchSpy.mockReset();
+  });
+
+  function stubFetch(status: number, body: unknown): void {
+    // `typeof fetch` carries a static `preconnect`, so attach a no-op to keep
+    // the implementation assignable without casting.
+    fetchSpy.mockImplementation(
+      Object.assign(() => Promise.resolve(new Response(JSON.stringify(body), { status })), {
+        preconnect: () => {},
+      }),
+    );
+  }
+
+  test("returns the effective permission for a collaborator", async () => {
+    stubFetch(200, { permission: "admin" });
+    const permission = await fetchAuthorPermission("t", "supabase", "cli", "maint");
+    expect(permission).toBe("admin");
+  });
+
+  test("maps a 404 (non-collaborator fork author) to undefined", async () => {
+    // The endpoint 404s for users who are not collaborators — the common case
+    // for the external contributors the gate targets. It must map to external,
+    // not abort the run.
+    stubFetch(404, { message: "Not Found" });
+    const permission = await fetchAuthorPermission("t", "supabase", "cli", "ext");
+    expect(permission).toBeUndefined();
+  });
+
+  test("throws on other API failures so the run aborts without closing PRs", async () => {
+    stubFetch(403, { message: "Forbidden" });
+    await expect(fetchAuthorPermission("t", "supabase", "cli", "ext")).rejects.toThrow(/403/);
+  });
+
+  test("skips the network call for a blank login", async () => {
+    stubFetch(200, { permission: "admin" });
+    const permission = await fetchAuthorPermission("t", "supabase", "cli", "");
+    expect(permission).toBeUndefined();
+    expect(fetchSpy).not.toHaveBeenCalled();
+  });
+});
diff --git a/.github/scripts/contribution-gate.ts b/.github/scripts/contribution-gate.ts
new file mode 100644
index 0000000000..a2b62ee08f
--- /dev/null
+++ b/.github/scripts/contribution-gate.ts
@@ -0,0 +1,505 @@
+/**
+ * Contribution gate: enforces the Supabase CLI contribution workflow across all
+ * OPEN pull requests opened by external contributors.
+ *
+ * A PR passes only when it links to an OPEN GitHub issue that carries the
+ * `open-for-contribution` label. Maintainers (recognised by their effective
+ * repository permission, so private org members count too — not just the
+ * `author_association` GitHub exposes for public members) and bots are exempt
+ * (they work from Linear tickets or automation). PRs that do not follow the
+ * process are commented on and closed.
+ *
+ * Two modes, both driven from `main()`:
+ *   - single-PR (default): reacts to one PR on `pull_request_target`
+ *     (`opened`/`reopened`/`edited`), using the PR_* env vars from the event.
+ *   - all-PRs sweep (`GATE_MODE=all`, or the `--all` flag): evaluates every
+ *     open PR, for on-demand `workflow_dispatch` runs. Set `DRY_RUN=true` to
+ *     log decisions without commenting/closing.
+ *
+ * In both modes the workflow checks out the base branch, so this only ever
+ * executes trusted repository code — it never runs a fork's code.
+ *
+ * Run in CI as: `bun .github/scripts/contribution-gate.ts`.
+ * The pure `evaluateGate` decision and the `evaluateAllOpenPrs` orchestrator
+ * (I/O injected) are unit-tested in `contribution-gate.test.ts`; `main()` wires
+ * up the real GitHub I/O.
+ */
+
+export const GATE_LABEL = "open-for-contribution";
+
+/**
+ * Author associations treated as internal (exempt from the gate).
+ *
+ * NOTE: `author_association` only reports `MEMBER` when a user's organization
+ * membership is *public*. A private org member (or a team member who keeps
+ * their membership private) is reported as `CONTRIBUTOR`/`NONE`, so this set
+ * alone is not enough to identify internal maintainers — see
+ * `isInternalAuthor`, which also consults the author's effective repository
+ * permission.
+ */
+export const INTERNAL_ASSOCIATIONS = new Set(["OWNER", "MEMBER", "COLLABORATOR"]);
+
+/**
+ * Effective repository permissions that mark an author as internal. A user who
+ * can push to the repository (directly, or via a team/org grant that
+ * `author_association` does not surface) is a trusted maintainer, not an
+ * external contributor. The legacy REST `permission` field collapses the
+ * `maintain` role to `write`, so `admin`/`write` covers every push-capable
+ * role.
+ */
+const WRITE_PERMISSIONS = new Set(["admin", "write"]);
+
+/**
+ * Decide whether a PR author is internal (exempt from the gate). Combines the
+ * cheap `author_association` signal with the author's effective repository
+ * `permission` (undefined when it could not be resolved), so private org
+ * members whose association is merely `CONTRIBUTOR` are still recognised.
+ */
+export function isInternalAuthor(
+  authorAssociation: string,
+  permission: string | undefined,
+): boolean {
+  return (
+    INTERNAL_ASSOCIATIONS.has(authorAssociation) ||
+    (permission !== undefined && WRITE_PERMISSIONS.has(permission))
+  );
+}
+
+export interface LinkedIssue {
+  /** `owner/name` of the repo the issue lives in (from GraphQL nameWithOwner). */
+  repository: string;
+  number: number;
+  state: "OPEN" | "CLOSED";
+  labels: string[];
+}
+
+export interface GateInput {
+  /** `owner/name` of this repository (from GITHUB_REPOSITORY). */
+  repository: string;
+  /** Whether the author is a trusted maintainer (see `isInternalAuthor`). */
+  isInternal: boolean;
+  isBot: boolean;
+  linkedIssues: LinkedIssue[];
+}
+
+export type GateReason =
+  | "bot"
+  | "internal"
+  | "ok"
+  | "no-linked-issue"
+  | "missing-label"
+  | "issue-closed";
+
+export interface GateResult {
+  pass: boolean;
+  reason: GateReason;
+  /** Explanatory comment body, present only when `pass` is false. */
+  message?: string;
+}
+
+const DOCS_FOOTER =
+  `\nSee [CONTRIBUTING.md](../blob/develop/CONTRIBUTING.md) for the full workflow. ` +
+  `Once a maintainer adds the \`${GATE_LABEL}\` label to a linked open issue, ` +
+  `reopen or open a new pull request and it will be accepted.`;
+
+function buildMessage(reason: GateReason): string {
+  switch (reason) {
+    case "no-linked-issue":
+      return (
+        `👋 Thanks for the contribution! This pull request isn't linked to a ` +
+        `tracked issue, so it's being closed automatically.\n\n` +
+        `Please open an issue first, wait for a maintainer to add the ` +
+        `\`${GATE_LABEL}\` label, then open a pull request that links the issue ` +
+        `with a closing keyword (e.g. \`Closes #123\`).${DOCS_FOOTER}`
+      );
+    case "missing-label":
+      return (
+        `👋 Thanks! The linked issue hasn't been marked \`${GATE_LABEL}\` yet, ` +
+        `so this pull request is being closed automatically.\n\n` +
+        `A maintainer adds that label once an issue is triaged and ready to be ` +
+        `worked on. Please wait for the label before opening a pull ` +
+        `request.${DOCS_FOOTER}`
+      );
+    case "issue-closed":
+      return (
+        `👋 The issue linked to this pull request is closed, so it's being ` +
+        `closed automatically.\n\n` +
+        `Please link an open issue that carries the \`${GATE_LABEL}\` ` +
+        `label.${DOCS_FOOTER}`
+      );
+    default:
+      return "";
+  }
+}
+
+/**
+ * Pure decision function for the contribution gate. Given the PR author context
+ * and its linked issues, returns whether the PR is allowed and why.
+ */
+export function evaluateGate(input: GateInput): GateResult {
+  if (input.isBot) {
+    return { pass: true, reason: "bot" };
+  }
+  if (input.isInternal) {
+    return { pass: true, reason: "internal" };
+  }
+
+  // Only issues in THIS repository count. A cross-repository closing keyword
+  // (e.g. `Closes attacker/repo#1`) links an issue the contributor controls,
+  // so it must never satisfy the gate.
+  const repo = input.repository.toLowerCase();
+  const repoIssues = input.linkedIssues.filter((issue) => issue.repository.toLowerCase() === repo);
+
+  if (repoIssues.length === 0) {
+    return {
+      pass: false,
+      reason: "no-linked-issue",
+      message: buildMessage("no-linked-issue"),
+    };
+  }
+
+  const qualifies = repoIssues.some(
+    (issue) => issue.state === "OPEN" && issue.labels.includes(GATE_LABEL),
+  );
+  if (qualifies) {
+    return { pass: true, reason: "ok" };
+  }
+
+  const hasOpenIssue = repoIssues.some((issue) => issue.state === "OPEN");
+  const reason: GateReason = hasOpenIssue ? "missing-label" : "issue-closed";
+  return { pass: false, reason, message: buildMessage(reason) };
+}
+
+/** Minimal open-PR shape the gate needs to decide exemption. */
+export interface OpenPr {
+  number: number;
+  authorLogin: string;
+  authorAssociation: string;
+  isBot: boolean;
+}
+
+/** Injected GitHub I/O so the sweep can be unit-tested without the network. */
+export interface GateIo {
+  /** List every open pull request in the repository. */
+  listOpenPrs: () => Promise<OpenPr[]>;
+  /**
+   * Resolve an author's effective repository permission (`admin`/`write`/
+   * `read`/`none`), or `undefined` when it could not be determined. Used to
+   * recognise maintainers whose org membership is private.
+   */
+  fetchPermission: (login: string) => Promise<string | undefined>;
+  /** Fetch the issues a PR closes (via `closingIssuesReferences`). */
+  fetchLinkedIssues: (prNumber: number) => Promise<LinkedIssue[]>;
+  /** Comment with `message` then close the PR. Called only for failing PRs. */
+  closePr: (prNumber: number, message: string) => Promise<void>;
+}
+
+export interface SweepEntry {
+  number: number;
+  result: GateResult;
+}
+
+/**
+ * Evaluate the gate against every open PR, closing the ones that fail. Pure
+ * orchestration over the injected `io`; returns each PR's decision so the
+ * caller can log a summary.
+ */
+export async function evaluateAllOpenPrs(io: GateIo, repository: string): Promise<SweepEntry[]> {
+  const openPrs = await io.listOpenPrs();
+  const entries: SweepEntry[] = [];
+  for (const pr of openPrs) {
+    // Only pay for a permission lookup when the cheap signals are inconclusive:
+    // bots are exempt outright, and a public internal association already
+    // proves membership.
+    let isInternal = pr.isBot || INTERNAL_ASSOCIATIONS.has(pr.authorAssociation);
+    if (!isInternal) {
+      const permission = await io.fetchPermission(pr.authorLogin);
+      isInternal = isInternalAuthor(pr.authorAssociation, permission);
+    }
+    const linkedIssues = await io.fetchLinkedIssues(pr.number);
+    const result = evaluateGate({
+      repository,
+      isInternal,
+      isBot: pr.isBot,
+      linkedIssues,
+    });
+    if (!result.pass && result.message) {
+      await io.closePr(pr.number, result.message);
+    }
+    entries.push({ number: pr.number, result });
+  }
+  return entries;
+}
+
+// --- GitHub I/O (only runs when executed directly) ---
+
+interface GraphQLIssueNode {
+  number: number;
+  state: "OPEN" | "CLOSED";
+  repository: { nameWithOwner: string };
+  labels: { nodes: Array<{ name: string }> };
+}
+
+function requireEnv(name: string): string {
+  const value = process.env[name];
+  if (!value) {
+    throw new Error(`Missing required environment variable: ${name}`);
+  }
+  return value;
+}
+
+async function githubFetch(
+  url: string,
+  token: string,
+  init: Omit<RequestInit, "headers"> = {},
+  /** Non-OK statuses to return to the caller instead of throwing on. */
+  allowStatuses: readonly number[] = [],
+): Promise<Response> {
+  const response = await fetch(url, {
+    ...init,
+    headers: {
+      Authorization: `Bearer ${token}`,
+      Accept: "application/vnd.github+json",
+      "X-GitHub-Api-Version": "2022-11-28",
+      "Content-Type": "application/json",
+    },
+  });
+  if (!response.ok && !allowStatuses.includes(response.status)) {
+    const body = await response.text();
+    throw new Error(`GitHub request failed (${response.status}) for ${url}: ${body}`);
+  }
+  return response;
+}
+
+async function fetchLinkedIssues(
+  token: string,
+  owner: string,
+  repo: string,
+  prNumber: number,
+): Promise<LinkedIssue[]> {
+  const query = `
+    query($owner: String!, $repo: String!, $number: Int!) {
+      repository(owner: $owner, name: $repo) {
+        pullRequest(number: $number) {
+          closingIssuesReferences(first: 20) {
+            nodes {
+              number
+              state
+              repository { nameWithOwner }
+              labels(first: 50) { nodes { name } }
+            }
+          }
+        }
+      }
+    }`;
+  const response = await githubFetch("https://api.github.com/graphql", token, {
+    method: "POST",
+    body: JSON.stringify({
+      query,
+      variables: { owner, repo, number: prNumber },
+    }),
+  });
+  const payload = (await response.json()) as {
+    errors?: Array<{ message: string }>;
+    data?: {
+      repository?: {
+        pullRequest?: {
+          closingIssuesReferences?: { nodes?: GraphQLIssueNode[] };
+        };
+      };
+    };
+  };
+  if (payload.errors?.length) {
+    throw new Error(`GraphQL errors: ${payload.errors.map((e) => e.message).join("; ")}`);
+  }
+  const nodes = payload.data?.repository?.pullRequest?.closingIssuesReferences?.nodes ?? [];
+  return nodes.map((node) => ({
+    repository: node.repository.nameWithOwner,
+    number: node.number,
+    state: node.state,
+    labels: node.labels.nodes.map((label) => label.name),
+  }));
+}
+
+interface RestPullRequest {
+  number: number;
+  author_association: string;
+  user: { login: string; type: string } | null;
+}
+
+async function fetchOpenPullRequests(
+  token: string,
+  owner: string,
+  repo: string,
+): Promise<OpenPr[]> {
+  const prs: OpenPr[] = [];
+  for (let page = 1; ; page++) {
+    const url =
+      `https://api.github.com/repos/${owner}/${repo}/pulls` +
+      `?state=open&per_page=100&page=${page}`;
+    const response = await githubFetch(url, token);
+    const batch = (await response.json()) as RestPullRequest[];
+    for (const pr of batch) {
+      prs.push({
+        number: pr.number,
+        authorLogin: pr.user?.login ?? "",
+        authorAssociation: pr.author_association,
+        isBot: pr.user?.type === "Bot",
+      });
+    }
+    if (batch.length < 100) {
+      break;
+    }
+  }
+  return prs;
+}
+
+/**
+ * Resolve an author's effective permission on the repository. Reflects access
+ * granted directly or through a team/org membership, so it recognises private
+ * org members that `author_association` reports only as `CONTRIBUTOR`. This
+ * endpoint needs just `Metadata: read` (covered by the workflow's
+ * `contents: read`).
+ *
+ * A 404 means the author is not a collaborator at all — the common case for
+ * external fork contributors, who are exactly who the gate targets — so it maps
+ * to `undefined` (external) rather than throwing. Other failures still throw so
+ * a transient API error aborts the run without wrongly closing PRs.
+ */
+export async function fetchAuthorPermission(
+  token: string,
+  owner: string,
+  repo: string,
+  login: string,
+): Promise<string | undefined> {
+  if (!login) {
+    return undefined;
+  }
+  const url =
+    `https://api.github.com/repos/${owner}/${repo}/collaborators/` +
+    `${encodeURIComponent(login)}/permission`;
+  const response = await githubFetch(url, token, {}, [404]);
+  if (response.status === 404) {
+    return undefined;
+  }
+  const payload = (await response.json()) as { permission?: string };
+  return payload.permission;
+}
+
+/**
+ * Build the "comment then close" action for a repo. In dry-run mode it logs the
+ * intended action instead of mutating the PR.
+ */
+function makeCloser(
+  token: string,
+  base: string,
+  dryRun: boolean,
+): (prNumber: number, message: string) => Promise<void> {
+  return async (prNumber, message) => {
+    if (dryRun) {
+      console.log(`[dry-run] would comment on and close PR #${prNumber}`);
+      return;
+    }
+    await githubFetch(`${base}/issues/${prNumber}/comments`, token, {
+      method: "POST",
+      body: JSON.stringify({ body: message }),
+    });
+    await githubFetch(`${base}/issues/${prNumber}`, token, {
+      method: "PATCH",
+      body: JSON.stringify({ state: "closed", state_reason: "not_planned" }),
+    });
+  };
+}
+
+/** Single-PR mode: react to the PR carried by a `pull_request_target` event. */
+async function runSinglePr(
+  token: string,
+  owner: string,
+  repo: string,
+  repository: string,
+): Promise<void> {
+  const prNumber = Number(requireEnv("PR_NUMBER"));
+  const authorAssociation = process.env.PR_AUTHOR_ASSOCIATION ?? "NONE";
+  const authorLogin = process.env.PR_AUTHOR_LOGIN ?? "";
+  const isBot = (process.env.PR_AUTHOR_TYPE ?? "User") === "Bot";
+
+  // Resolve maintainer status from the effective repository permission unless a
+  // cheaper signal already settles it. `author_association` only exposes public
+  // org membership, so a private member must be confirmed via permission.
+  let permission: string | undefined;
+  let isInternal = isBot || INTERNAL_ASSOCIATIONS.has(authorAssociation);
+  if (!isInternal) {
+    permission = await fetchAuthorPermission(token, owner, repo, authorLogin);
+    isInternal = isInternalAuthor(authorAssociation, permission);
+  }
+
+  const linkedIssues = await fetchLinkedIssues(token, owner, repo, prNumber);
+  const result = evaluateGate({
+    repository,
+    isInternal,
+    isBot,
+    linkedIssues,
+  });
+
+  console.log(
+    `Contribution gate for PR #${prNumber}: pass=${result.pass} reason=${result.reason} ` +
+      `(author_association=${authorAssociation}, permission=${permission ?? "n/a"}, ` +
+      `bot=${isBot}, linked_issues=${linkedIssues.length})`,
+  );
+
+  if (result.pass || !result.message) {
+    return;
+  }
+
+  const base = `https://api.github.com/repos/${owner}/${repo}`;
+  await makeCloser(token, base, false)(prNumber, result.message);
+  console.log(`Closed PR #${prNumber} (reason=${result.reason}).`);
+}
+
+/** All-PRs mode: sweep every open PR, for on-demand `workflow_dispatch` runs. */
+async function runSweep(
+  token: string,
+  owner: string,
+  repo: string,
+  repository: string,
+  dryRun: boolean,
+): Promise<void> {
+  const base = `https://api.github.com/repos/${owner}/${repo}`;
+  const io: GateIo = {
+    listOpenPrs: () => fetchOpenPullRequests(token, owner, repo),
+    fetchPermission: (login) => fetchAuthorPermission(token, owner, repo, login),
+    fetchLinkedIssues: (prNumber) => fetchLinkedIssues(token, owner, repo, prNumber),
+    closePr: makeCloser(token, base, dryRun),
+  };
+
+  const entries = await evaluateAllOpenPrs(io, repository);
+  const failing = entries.filter((entry) => !entry.result.pass);
+  console.log(
+    `Contribution gate sweep: ${entries.length} open PR(s) evaluated, ` +
+      `${failing.length} ${dryRun ? "would be " : ""}closed.`,
+  );
+  for (const entry of entries) {
+    console.log(`  PR #${entry.number}: pass=${entry.result.pass} reason=${entry.result.reason}`);
+  }
+}
+
+async function main(): Promise<void> {
+  const token = requireEnv("GITHUB_TOKEN");
+  const repository = requireEnv("GITHUB_REPOSITORY");
+  const [owner, repo] = repository.split("/");
+
+  const allMode = process.env.GATE_MODE === "all" || process.argv.includes("--all");
+  if (allMode) {
+    const dryRun = /^(1|true)$/i.test(process.env.DRY_RUN ?? "");
+    await runSweep(token, owner!, repo!, repository, dryRun);
+  } else {
+    await runSinglePr(token, owner!, repo!, repository);
+  }
+}
+
+if (import.meta.main) {
+  main().catch((error) => {
+    console.error(error);
+    process.exit(1);
+  });
+}
diff --git a/.github/workflows/api-package-sync.yml b/.github/workflows/api-package-sync.yml
index bb1117b38a..cdba3fd3c7 100644
--- a/.github/workflows/api-package-sync.yml
+++ b/.github/workflows/api-package-sync.yml
@@ -13,7 +13,7 @@ jobs:
     name: Sync API package
     runs-on: blacksmith-8vcpu-ubuntu-2404
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
diff --git a/.github/workflows/build-cli-artifacts.yml b/.github/workflows/build-cli-artifacts.yml
index 8faf9d0377..d4024a5ae8 100644
--- a/.github/workflows/build-cli-artifacts.yml
+++ b/.github/workflows/build-cli-artifacts.yml
@@ -66,7 +66,7 @@ jobs:
       SUPABASE_CLI_REQUIRE_SIGNING: "1"
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.ref }}
           persist-credentials: false
@@ -81,10 +81,18 @@ jobs:
         run: go mod download -x
 
       - name: Install nfpm
+        env:
+          NFPM_VERSION: "2.47.0"
+          NFPM_SHA256: "0660ca602b2d2d2ae4781a06c692b3eeb9d437ffea05b831d76e41f4a3188783"
         run: |
-          echo 'deb [trusted=yes] https://repo.goreleaser.com/apt/ /' | sudo tee /etc/apt/sources.list.d/goreleaser.list
-          sudo apt-get update
-          sudo apt-get install -y nfpm
+          set -euo pipefail
+          asset="nfpm_${NFPM_VERSION}_Linux_x86_64.tar.gz"
+          curl -fsSL -o /tmp/nfpm.tar.gz \
+            "https://github.com/goreleaser/nfpm/releases/download/v${NFPM_VERSION}/${asset}"
+          echo "${NFPM_SHA256}  /tmp/nfpm.tar.gz" | sha256sum -c
+          tar -xzf /tmp/nfpm.tar.gz -C /tmp nfpm
+          sudo install -m 0755 /tmp/nfpm /usr/local/bin/nfpm
+          nfpm --version
 
       - name: Install rcodesign
         env:
diff --git a/.github/workflows/cli-go-api-sync.yml b/.github/workflows/cli-go-api-sync.yml
index 4c7d3a7fbe..7efdb8a4c4 100644
--- a/.github/workflows/cli-go-api-sync.yml
+++ b/.github/workflows/cli-go-api-sync.yml
@@ -14,11 +14,11 @@ jobs:
     name: Sync API Types
     runs-on: blacksmith-2vcpu-ubuntu-2404
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
-      - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version-file: apps/cli-go/go.mod
           cache: true
diff --git a/.github/workflows/cli-go-ci.yml b/.github/workflows/cli-go-ci.yml
index 0d497ffc99..ed7f07b7a9 100644
--- a/.github/workflows/cli-go-ci.yml
+++ b/.github/workflows/cli-go-ci.yml
@@ -19,11 +19,11 @@ jobs:
     name: Test
     runs-on: blacksmith-8vcpu-ubuntu-2404
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
-      - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version-file: apps/cli-go/go.mod
           cache: true
@@ -74,11 +74,11 @@ jobs:
     name: Lint
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
-      - uses: jdx/mise-action@e6a8b3978addb5a52f2b4cd9d91eafa7f0ab959d # v4
+      - uses: jdx/mise-action@dad1bfd3df957f44999b559dd69dc1671cb4e9ea # v4
         with:
           version: 2026.7.0
           install: true
@@ -97,10 +97,10 @@ jobs:
     name: Start
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version-file: apps/cli-go/go.mod
           cache: true
@@ -123,10 +123,10 @@ jobs:
       'pull_request' && !github.event.pull_request.head.repo.fork) }}
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version-file: apps/cli-go/go.mod
           cache: true
@@ -140,11 +140,11 @@ jobs:
     name: Codegen
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
-      - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version-file: apps/cli-go/go.mod
           cache: true
diff --git a/.github/workflows/cli-go-codeql.yml b/.github/workflows/cli-go-codeql.yml
index 3a7c41cbed..b1e1adf123 100644
--- a/.github/workflows/cli-go-codeql.yml
+++ b/.github/workflows/cli-go-codeql.yml
@@ -61,13 +61,13 @@ jobs:
         # your codebase is analyzed, see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/codeql-code-scanning-for-compiled-languages
     steps:
       - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
       # Initializes the CodeQL tools for scanning.
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
+        uses: github/codeql-action/init@7188fc363630916deb702c7fdcf4e481b751f97a # v4.37.1
         with:
           languages: ${{ matrix.language }}
           build-mode: ${{ matrix.build-mode }}
@@ -95,7 +95,7 @@ jobs:
           exit 1
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
+        uses: github/codeql-action/analyze@7188fc363630916deb702c7fdcf4e481b751f97a # v4.37.1
         with:
           category: "/language:${{matrix.language}}"
 defaults:
diff --git a/.github/workflows/cli-go-mirror-image.yml b/.github/workflows/cli-go-mirror-image.yml
index 3c9484e266..2844079487 100644
--- a/.github/workflows/cli-go-mirror-image.yml
+++ b/.github/workflows/cli-go-mirror-image.yml
@@ -34,19 +34,19 @@ jobs:
         run: |
           echo "image=${TAG##*/}" >> $GITHUB_OUTPUT
       - name: configure aws credentials
-        uses: aws-actions/configure-aws-credentials@254c19bd240aabef8777f48595e9d2d7b972184b # v6.2.1
+        uses: aws-actions/configure-aws-credentials@517a711dbcd0e402f90c77e7e2f81e849156e31d # v6.2.2
         with:
           role-to-assume: ${{ secrets.PROD_AWS_ROLE }}
           aws-region: us-east-1
-      - uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
+      - uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
         with:
           registry: public.ecr.aws
-      - uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
+      - uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
-      - uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
+      - uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
       - name: Mirror image
         env:
           SOURCE_IMAGE: docker.io/${{ github.event.client_payload.image || inputs.image }}
diff --git a/.github/workflows/cli-go-mirror.yml b/.github/workflows/cli-go-mirror.yml
index 1e5d3224e9..cb302c411f 100644
--- a/.github/workflows/cli-go-mirror.yml
+++ b/.github/workflows/cli-go-mirror.yml
@@ -23,10 +23,10 @@ jobs:
       tags: ${{ steps.list.outputs.tags }}
       curr: ${{ steps.curr.outputs.tags }}
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version-file: apps/cli-go/go.mod
           cache: true
diff --git a/.github/workflows/cli-go-pg-prove.yml b/.github/workflows/cli-go-pg-prove.yml
index 14202acc5c..323758c1c0 100644
--- a/.github/workflows/cli-go-pg-prove.yml
+++ b/.github/workflows/cli-go-pg-prove.yml
@@ -11,8 +11,8 @@ jobs:
     outputs:
       image_tag: supabase/pg_prove:${{ steps.version.outputs.pg_prove }}
     steps:
-      - uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
-      - uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
+      - uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
+      - uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
         with:
           load: true
           context: https://github.com/horrendo/pg_prove.git
@@ -42,15 +42,15 @@ jobs:
       image_digest: ${{ steps.build.outputs.digest }}
     steps:
       - run: docker context create builders
-      - uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
+      - uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
         with:
           endpoint: builders
-      - uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
+      - uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
         with:
           username: ${{ secrets.DOCKER_USERNAME }}
           password: ${{ secrets.DOCKER_PASSWORD }}
       - id: build
-        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
         with:
           push: true
           context: https://github.com/horrendo/pg_prove.git
@@ -66,8 +66,8 @@ jobs:
       - build_image
     runs-on: ubuntu-latest
     steps:
-      - uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
-      - uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
+      - uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
+      - uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
         with:
           username: ${{ secrets.DOCKER_USERNAME }}
           password: ${{ secrets.DOCKER_PASSWORD }}
diff --git a/.github/workflows/cli-go-publish-migra.yml b/.github/workflows/cli-go-publish-migra.yml
index 5220a0562d..11b6437666 100644
--- a/.github/workflows/cli-go-publish-migra.yml
+++ b/.github/workflows/cli-go-publish-migra.yml
@@ -11,8 +11,8 @@ jobs:
     outputs:
       image_tag: supabase/migra:${{ steps.version.outputs.migra }}
     steps:
-      - uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
-      - uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
+      - uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
+      - uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
         with:
           load: true
           context: https://github.com/djrobstep/migra.git
@@ -42,15 +42,15 @@ jobs:
       image_digest: ${{ steps.build.outputs.digest }}
     steps:
       - run: docker context create builders
-      - uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
+      - uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
         with:
           endpoint: builders
-      - uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
+      - uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
         with:
           username: ${{ secrets.DOCKER_USERNAME }}
           password: ${{ secrets.DOCKER_PASSWORD }}
       - id: build
-        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
         with:
           push: true
           context: https://github.com/djrobstep/migra.git
@@ -66,8 +66,8 @@ jobs:
       - build_image
     runs-on: ubuntu-latest
     steps:
-      - uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
-      - uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
+      - uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
+      - uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
         with:
           username: ${{ secrets.DOCKER_USERNAME }}
           password: ${{ secrets.DOCKER_PASSWORD }}
diff --git a/.github/workflows/cli-go-tag-pkg.yml b/.github/workflows/cli-go-tag-pkg.yml
index a07f87f1ae..9185ad5771 100644
--- a/.github/workflows/cli-go-tag-pkg.yml
+++ b/.github/workflows/cli-go-tag-pkg.yml
@@ -16,7 +16,7 @@ jobs:
     name: Create pkg tag
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: develop
           fetch-depth: 0
diff --git a/.github/workflows/contribution-gate.yml b/.github/workflows/contribution-gate.yml
new file mode 100644
index 0000000000..68d3f3b639
--- /dev/null
+++ b/.github/workflows/contribution-gate.yml
@@ -0,0 +1,75 @@
+name: Contribution Gate
+
+on:
+  pull_request_target:
+    types:
+      - opened
+      - reopened
+      - edited
+  # Manual sweep over every open PR — e.g. after bulk-applying the
+  # `open-for-contribution` label. Set `dry_run` to log decisions without
+  # commenting or closing.
+  workflow_dispatch:
+    inputs:
+      dry_run:
+        description: "Evaluate and log decisions only; do not comment or close"
+        type: boolean
+        default: false
+
+permissions:
+  pull-requests: write
+  issues: read
+  contents: read
+
+concurrency:
+  # Per-PR for pull_request_target; unique per run for manual sweeps (which
+  # carry no pull_request payload) so two sweeps never cancel each other.
+  group: contribution-gate-${{ github.event.pull_request.number || github.run_id }}
+  cancel-in-progress: true
+
+jobs:
+  gate-single:
+    name: Contribution Gate
+    runs-on: ubuntu-latest
+    # Exempt maintainers/collaborators and bots. External contributors are gated.
+    if: >
+      github.event_name == 'pull_request_target' &&
+      github.event.pull_request.author_association != 'OWNER' &&
+      github.event.pull_request.author_association != 'MEMBER' &&
+      github.event.pull_request.author_association != 'COLLABORATOR' &&
+      github.event.pull_request.user.type != 'Bot'
+    steps:
+      # Checks out the base repo (default for pull_request_target), so the gate
+      # runs trusted code from the base branch, never the untrusted PR head.
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
+        with:
+          bun-version: "1.3.13"
+      - name: Evaluate contribution gate
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GITHUB_REPOSITORY: ${{ github.repository }}
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+          PR_AUTHOR_ASSOCIATION: ${{ github.event.pull_request.author_association }}
+          PR_AUTHOR_LOGIN: ${{ github.event.pull_request.user.login }}
+          PR_AUTHOR_TYPE: ${{ github.event.pull_request.user.type }}
+        run: bun .github/scripts/contribution-gate.ts
+
+  gate-all:
+    name: Contribution Gate (all open PRs)
+    runs-on: ubuntu-latest
+    if: github.event_name == 'workflow_dispatch'
+    steps:
+      # Base-branch checkout only — the sweep makes API calls and never runs
+      # any PR's code.
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
+        with:
+          bun-version: "1.3.13"
+      - name: Evaluate contribution gate across all open PRs
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GITHUB_REPOSITORY: ${{ github.repository }}
+          GATE_MODE: all
+          DRY_RUN: ${{ inputs.dry_run || 'false' }}
+        run: bun .github/scripts/contribution-gate.ts
diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index 5291036c16..f371693622 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -13,7 +13,7 @@ jobs:
   deploy:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
           persist-credentials: false
diff --git a/.github/workflows/live-e2e.yml b/.github/workflows/live-e2e.yml
index efdb4a8374..2d402865ef 100644
--- a/.github/workflows/live-e2e.yml
+++ b/.github/workflows/live-e2e.yml
@@ -106,7 +106,7 @@ jobs:
       CLI_HARNESS_TARGET: ${{ matrix.target }}
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
diff --git a/.github/workflows/mirror-template-images.yml b/.github/workflows/mirror-template-images.yml
index 40fa3be500..975e2fa618 100644
--- a/.github/workflows/mirror-template-images.yml
+++ b/.github/workflows/mirror-template-images.yml
@@ -40,7 +40,7 @@ jobs:
       missing: ${{ steps.detect.outputs.missing }}
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
@@ -50,7 +50,7 @@ jobs:
           dependency-firewall-token: ${{ secrets.DF_FIREWALL_TOKEN }}
 
       - name: Log in to ghcr.io
-        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
+        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
diff --git a/.github/workflows/publish-preview-cli-packages.yml b/.github/workflows/publish-preview-cli-packages.yml
index e7486fc5f7..afbc6ec537 100644
--- a/.github/workflows/publish-preview-cli-packages.yml
+++ b/.github/workflows/publish-preview-cli-packages.yml
@@ -48,7 +48,7 @@ jobs:
       PR_NUMBER: ${{ github.event.pull_request.number }}
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
diff --git a/.github/workflows/release-shared.yml b/.github/workflows/release-shared.yml
index 79a3175805..c46250985e 100644
--- a/.github/workflows/release-shared.yml
+++ b/.github/workflows/release-shared.yml
@@ -104,7 +104,7 @@ jobs:
       VERSION: ${{ inputs.version }}
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
@@ -160,7 +160,7 @@ jobs:
 
       - name: Setup QEMU for cross-platform Docker
         if: runner.os == 'Linux'
-        uses: docker/setup-qemu-action@06116385d9baf250c9f4dcb4858b16962ea869c3 # v4.1.0
+        uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0
 
       - name: Verify linux/arm64 emulation is registered
         if: runner.os == 'Linux'
@@ -240,7 +240,7 @@ jobs:
       VERSION: ${{ inputs.version }}
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
@@ -300,7 +300,7 @@ jobs:
           permission-workflows: write
 
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: true
           fetch-depth: 0
@@ -389,7 +389,7 @@ jobs:
           done
 
       - name: Create draft GitHub Release
-        uses: softprops/action-gh-release@718ea10b132b3b2eba29c1007bb80653f286566b # v3.0.1
+        uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3.0.2
         with:
           tag_name: v${{ inputs.version }}
           name: v${{ inputs.version }}
@@ -488,7 +488,7 @@ jobs:
       VERSION: ${{ inputs.version }}
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
@@ -551,7 +551,7 @@ jobs:
       VERSION: ${{ inputs.version }}
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
diff --git a/.github/workflows/sync-stack-service-versions.yml b/.github/workflows/sync-stack-service-versions.yml
index 0650e3e233..d54cb756d4 100644
--- a/.github/workflows/sync-stack-service-versions.yml
+++ b/.github/workflows/sync-stack-service-versions.yml
@@ -23,7 +23,7 @@ jobs:
     if: github.event.pull_request.user.login == 'dependabot[bot]' && github.repository == github.event.pull_request.head.repo.full_name
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ github.event.pull_request.head.ref }}
           persist-credentials: false
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 571fb5fc62..df96410d79 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -35,7 +35,7 @@ jobs:
     runs-on: blacksmith-8vcpu-ubuntu-2404
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
@@ -58,7 +58,7 @@ jobs:
     runs-on: blacksmith-8vcpu-ubuntu-2404
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 4312076c56..0394f608a2 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -2,6 +2,18 @@
 
 Bun monorepo for exploring the next generation of the Supabase CLI and local development stack.
 
+## Contribution workflow
+
+Before you open a pull request:
+
+1. **Open an issue first**, using one of the [issue templates](https://github.com/supabase/cli/issues/new/choose).
+2. **Wait for maintainer triage.** A maintainer categorizes the issue (`✨ Feature`, `🐛 Bug`, or `📘 Docs`) and adds the **`open-for-contribution`** label once it is ready to be worked on.
+3. **Open a pull request only after the `open-for-contribution` label is set**, and link the issue with a closing keyword (for example `Closes #123`).
+
+Until the `open-for-contribution` label is present, the issue is still in triage, so work should not start and a pull request should not be opened.
+
+Pull requests from external contributors that do not follow this workflow are commented on and closed automatically by the [Contribution Gate](.github/workflows/contribution-gate.yml). Supabase members are exempt, so they can work from Linear tickets that are not public on GitHub. Maintainers: see [`.github/MAINTAINERS.md`](.github/MAINTAINERS.md).
+
 ## Setup
 
 ### Tool versions
@@ -258,7 +270,7 @@ Test a real end-to-end publish and install of the CLI against a local npm regist
 pnpm local-registry
 ```
 
-This starts Verdaccio on `http://localhost:4873`, creates a publish user, and redirects the global `npm` and `pnpm` registry config to `localhost`. Press **Ctrl+C** when done — the original registry settings are restored automatically.
+This starts Verdaccio on `http://localhost:4873` and creates a publish user. Your global `npm` and `pnpm` registry config is never modified — every command that talks to the local registry passes `--registry` explicitly. Press **Ctrl+C** when done.
 
 **Terminal 2 — build and publish:**
 
@@ -298,7 +310,7 @@ supabase --version
 | `Error: Something is already running on port 4873` | Kill the leftover Verdaccio process (`lsof -ti:4873 \| xargs kill`) and retry |
 | `go not found in PATH` (legacy only) | Install Go from https://go.dev/dl/ |
 | `Error: Go CLI source not found` (legacy only) | Run `pnpm repos:install` to clone `apps/cli-go` |
-| Registry not restored after crash | Run `npm config set registry https://registry.npmjs.org/` and `pnpm config set registry https://registry.npmjs.org/` |
+| `npm` / `pnpm` tries to fetch from `localhost:4873` when no registry is running | Stale global registry override left behind by an older version of `local-registry.ts` (the current script never modifies global config). Run `npm config delete registry` and `pnpm config delete registry`. Note that pnpm stores the override in its own global config (`~/Library/Preferences/pnpm/auth.ini` on macOS, `~/.config/pnpm/` on Linux), not `~/.npmrc` — check there if the delete command fails |
 | `npx` resolves from npm instead of local | Pass `--registry http://localhost:4873` explicitly to `npx` / `npm install` |
 
 ## Using Nx
diff --git a/README.md b/README.md
index 1e0b1d528e..9652d3738b 100644
--- a/README.md
+++ b/README.md
@@ -149,7 +149,11 @@ pnpm repos:install
 
 ## Contributing
 
-We love focused pull requests with a clear problem, a small surface area, and tests that match the user-facing behavior. Before opening a PR, run the checks for the workspace you touched.
+We love focused pull requests with a clear problem, a small surface area, and tests that match the user-facing behavior.
+
+Open an issue first and wait for a maintainer to add the `open-for-contribution` label before starting work — external pull requests that don't link a labeled, open issue are closed automatically. See [CONTRIBUTING.md](./CONTRIBUTING.md#contribution-workflow) for the full workflow.
+
+Before opening a PR, run the checks for the workspace you touched.
 
 ```sh
 pnpm check:all
diff --git a/apps/cli-e2e/src/tests/live/db-reset-start.live.e2e.test.ts b/apps/cli-e2e/src/tests/live/db-reset-start.live.e2e.test.ts
new file mode 100644
index 0000000000..9c2ec6f8e7
--- /dev/null
+++ b/apps/cli-e2e/src/tests/live/db-reset-start.live.e2e.test.ts
@@ -0,0 +1,81 @@
+import { mkdirSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { describe, expect } from "vitest";
+import { TARGET } from "../env.ts";
+import { testLive } from "./live-context.ts";
+
+// Real-backend live coverage for the native `db start` / `db reset` ports.
+//
+// `db start` / `db reset` live only in the `go` reference and the `ts-legacy`
+// port (the `next` shell has no `db` group), so skip the `ts-next` target.
+//
+// The live suite runs serially (`fileParallelism: false`, `maxWorkers: 1`), so the
+// destructive remote reset below is safe against the throwaway per-run project.
+
+// --- Local leg: db start + db reset --local against the real Docker socket -----
+// Exercises the hidden `db __db-bootstrap` Go seam end-to-end — the boundary the
+// in-process integration suites mock. The start → already-running → reset cycle
+// runs in one test so it shares a single booted stack, and `finally` stops it
+// (legacy proxies `stop` to Go) so the run never leaves containers behind.
+describe.skipIf(TARGET === "ts-next")("db start / db reset --local (live, local Docker)", () => {
+  testLive(
+    "db start boots, is idempotent, and db reset --local recreates",
+    { timeout: 600_000 },
+    async ({ run }) => {
+      try {
+        const start = await run(["db", "start"]);
+        expect(start.exitCode, start.stderr).toBe(0);
+        // Go tees bootstrap progress to stderr (mode-independent).
+        expect(`${start.stdout}${start.stderr}`).toMatch(/Starting database|Initialising schema/i);
+
+        // Second start is a no-op: the db is already running, exit 0.
+        const again = await run(["db", "start"]);
+        expect(again.exitCode, again.stderr).toBe(0);
+        expect(`${again.stdout}${again.stderr}`).toMatch(/already[\s-]running/i);
+
+        // Local reset recreates the container and prints the git-branch line.
+        const reset = await run(["db", "reset", "--local"]);
+        expect(reset.exitCode, reset.stderr).toBe(0);
+        expect(reset.stderr).toContain("on branch ");
+      } finally {
+        await run(["stop", "--no-backup"]).catch(() => undefined);
+      }
+    },
+  );
+});
+
+// --- Remote leg: db reset against the staging project over the session pooler ---
+// Exercises the native remote reset path (drop user schemas → apply local
+// migrations → seed) against a real Postgres, no Docker. `--yes` auto-accepts the
+// confirmation prompt (the non-interactive default is decline). Mutates the
+// throwaway project's schema — deleted on teardown. The IPv4 session pooler
+// `dbUrl` is used because the direct host is IPv6-only and unreachable from
+// IPv4-only CI runners.
+describe.skipIf(TARGET === "ts-next")("db reset (live, remote session pooler)", () => {
+  testLive(
+    "resets the remote schema and re-applies a local migration",
+    { timeout: 600_000 },
+    async ({ run, dbUrl, workspace }) => {
+      const migrations = join(workspace.path, "supabase", "migrations");
+      mkdirSync(migrations, { recursive: true });
+      writeFileSync(
+        join(migrations, "20240101000000_e2e_reset.sql"),
+        "create table if not exists e2e_reset (id int);\n",
+      );
+
+      const reset = await run(["db", "reset", "--db-url", dbUrl, "--yes"]);
+      expect(reset.exitCode, reset.stderr).toBe(0);
+      expect(reset.stderr).toContain("Resetting remote database");
+      // A real connection failure must never be mistaken for a benign outcome.
+      expect(`${reset.stdout}${reset.stderr}`, "db reset hit a connection error").not.toMatch(
+        /dial|no route|connection refused|could not connect|server closed the connection|i\/o timeout/i,
+      );
+
+      // The migration history shows the re-applied version → proves the drop +
+      // migrate ran against the remote database.
+      const listed = await run(["migration", "list", "--db-url", dbUrl]);
+      expect(listed.exitCode, listed.stderr).toBe(0);
+      expect(listed.stdout).toContain("20240101000000");
+    },
+  );
+});
diff --git a/apps/cli-e2e/src/tests/migrations.e2e.test.ts b/apps/cli-e2e/src/tests/migrations.e2e.test.ts
index 0e3dbc932f..45b02ef3bc 100644
--- a/apps/cli-e2e/src/tests/migrations.e2e.test.ts
+++ b/apps/cli-e2e/src/tests/migrations.e2e.test.ts
@@ -45,7 +45,10 @@ describe("migrations", () => {
     testBehaviour("exits non-zero without name argument", async ({ run }) => {
       const result = await run(["migration", "new"]);
       expect(result.exitCode).not.toBe(0);
-      expect(result.stdout).toContain("migration name");
+      // CLI-1901: a missing positional argument's usage block now prints to
+      // stderr (never stdout) instead of being duplicated across both.
+      expect(result.stdout).toBe("");
+      expect(result.stderr).toContain("migration name");
     });
   });
 
@@ -90,7 +93,11 @@ describe("migrations", () => {
     testBehaviour("exits non-zero when --status flag is missing", async ({ run }) => {
       const result = await run(["migration", "repair", "--local", "20230101000000"]);
       expect(result.exitCode).not.toBe(0);
-      expect(result.stderr).toContain("--status");
+      // CLI-1901: a missing required flag now drops the vendored library's
+      // duplicate usage dump entirely (Go's cobra suppresses usage for this
+      // case too), leaving only this repo's existing Go-parity error line,
+      // which spells the flag name without its `--` prefix.
+      expect(result.stderr).toContain('"status" not set');
     });
 
     testBehaviour("exits non-zero on connection refused", async ({ run }) => {
diff --git a/apps/cli-go/cmd/db.go b/apps/cli-go/cmd/db.go
index df04364e44..66df4311cc 100644
--- a/apps/cli-go/cmd/db.go
+++ b/apps/cli-go/cmd/db.go
@@ -1,6 +1,7 @@
 package cmd
 
 import (
+	"context"
 	"errors"
 	"fmt"
 	"os"
@@ -270,6 +271,71 @@ var (
 		},
 	}
 
+	bootstrapMode       string
+	bootstrapSqlPaths   []string
+	bootstrapFromBackup string
+	bootstrapVersion    string
+	bootstrapNoSeed     bool
+
+	// dbBootstrapCmd is a hidden seam used by the native-TypeScript `db start` and
+	// `db reset --local` commands to drive the container-bootstrap primitives that
+	// are not yet ported to TypeScript: creating/recreating the local Postgres
+	// container, applying the initial schema, and the storage health gate. The TS
+	// caller orchestrates everything else (the "already running?" check and its
+	// message, version/last resolution, bucket seeding, the git-branch "Finished…"
+	// line, telemetry, and --output-format shaping); the seam stays in Go only for
+	// the Docker lifecycle. It mirrors the existing db __shadow seam: it carries no
+	// db-url/local/linked target flags, so it loads supabase/config.toml explicitly
+	// (the root PersistentPreRunE only loads it when a target flag is set). Progress
+	// goes to stderr; the only stdout output is a single machine-parseable marker
+	// for --mode await-storage ("ready" or "absent").
+	dbBootstrapCmd = &cobra.Command{
+		Use:    "__db-bootstrap",
+		Hidden: true,
+		Short:  "Internal: container bootstrap for the native db start / db reset commands",
+		RunE: func(cmd *cobra.Command, args []string) error {
+			fsys := afero.NewOsFs()
+			if err := flags.LoadConfig(fsys); err != nil {
+				return err
+			}
+			switch bootstrapMode {
+			case "start":
+				// Mirror start.Run minus the "already running?" check, which the TS
+				// caller performs (and prints "Postgres database is already running.").
+				if err := start.StartDatabase(cmd.Context(), bootstrapFromBackup, fsys, os.Stderr); err != nil {
+					if rmErr := utils.DockerRemoveAll(context.Background(), os.Stderr, utils.Config.ProjectId); rmErr != nil {
+						fmt.Fprintln(os.Stderr, rmErr)
+					}
+					return err
+				}
+				return nil
+			case "recreate":
+				// The PG14/PG15 container-recreate half of local db reset. The TS
+				// caller has already printed "Resetting local database…" and validated
+				// the flags. Apply the same seed handling as `db reset` (dbResetCmd):
+				// `--no-seed` disables the seed, `--sql-paths` overrides the seed paths,
+				// before MigrateAndSeed runs inside the recreate.
+				if err := applyDbResetSeedFlags(bootstrapNoSeed, bootstrapSqlPaths); err != nil {
+					return err
+				}
+				return reset.RecreateLocalDatabase(cmd.Context(), bootstrapVersion, fsys)
+			case "await-storage":
+				ready, err := reset.AwaitStorageReady(cmd.Context())
+				if err != nil {
+					return err
+				}
+				if ready {
+					fmt.Println("ready")
+				} else {
+					fmt.Println("absent")
+				}
+				return nil
+			default:
+				return fmt.Errorf("unknown bootstrap mode: %s", bootstrapMode)
+			}
+		},
+	}
+
 	dbRemoteCmd = &cobra.Command{
 		Hidden: true,
 		Use:    "remote",
@@ -620,6 +686,14 @@ func init() {
 	shadowFlags.StringSliceVarP(&shadowSchema, "schema", "s", []string{}, "Comma separated list of schema to include.")
 	shadowFlags.StringVar(&shadowProjectRef, "project-ref", "", "Linked project ref, so the shadow merges the matching [remotes.<ref>] config override.")
 	dbCmd.AddCommand(dbShadowCmd)
+	// Build hidden container-bootstrap seam command (native db start / db reset)
+	bootstrapFlags := dbBootstrapCmd.Flags()
+	bootstrapFlags.StringVar(&bootstrapMode, "mode", "start", "Bootstrap mode: start, recreate, or await-storage.")
+	bootstrapFlags.StringVar(&bootstrapFromBackup, "from-backup", "", "Path to a logical backup file (start mode).")
+	bootstrapFlags.StringVar(&bootstrapVersion, "version", "", "Reset up to the specified version (recreate mode).")
+	bootstrapFlags.BoolVar(&bootstrapNoSeed, "no-seed", false, "Skip the seed script after recreate (recreate mode).")
+	bootstrapFlags.StringArrayVar(&bootstrapSqlPaths, "sql-paths", nil, "Override [db.seed].sql_paths for the recreate (recreate mode).")
+	dbCmd.AddCommand(dbBootstrapCmd)
 	// Build remote command
 	remoteFlags := dbRemoteCmd.PersistentFlags()
 	remoteFlags.StringSliceVarP(&schema, "schema", "s", []string{}, "Comma separated list of schema to include.")
diff --git a/apps/cli-go/docs/supabase/db/diff.md b/apps/cli-go/docs/supabase/db/diff.md
index 822c752485..0c0cf05a4d 100644
--- a/apps/cli-go/docs/supabase/db/diff.md
+++ b/apps/cli-go/docs/supabase/db/diff.md
@@ -10,6 +10,8 @@ By default, all schemas in the target database are diffed. Use the `--schema pub
 
 Projects created by a recent `supabase init` default to the pg-delta diff engine (`[experimental.pgdelta] enabled = true` in `config.toml`). Existing projects are unaffected and keep using migra unless they opt in. To fall back to the legacy migra engine, set `enabled = false` under `[experimental.pgdelta]`, or pass `--use-migra` for a single run.
 
+With the pg-delta engine the diff SQL is formatted by default with the same settings the declarative export uses (uppercase keywords, wrapped at a max width of 180, indented and column-aligned); execution-aware transaction boundaries are preserved as per-unit header comments in the output. Configure overrides with `[experimental.pgdelta] format_options`, or set `format_options = "null"` to emit raw, unformatted statements.
+
 While the diff command is able to capture most schema changes, there are cases where it is known to fail. Currently, this could happen if you schema contains:
 
 - Changes to publication
diff --git a/apps/cli-go/docs/supabase/db/pull.md b/apps/cli-go/docs/supabase/db/pull.md
index ff35019715..e10c0679f7 100644
--- a/apps/cli-go/docs/supabase/db/pull.md
+++ b/apps/cli-go/docs/supabase/db/pull.md
@@ -12,6 +12,10 @@ If no entries exist in the migration history table, the default diff engine uses
 
 Pass `--diff-engine pg-delta` to keep the migration-file `db pull` workflow while using pg-delta for the shadow diff step. On initial pull, pg-delta replaces `pg_dump` and produces the full migration from the shadow diff alone. Pass `--declarative` to switch to the declarative pg-delta export workflow instead.
 
+pg-delta plans are execution-aware: when a plan crosses a transaction boundary — for example `ALTER TYPE ... ADD VALUE` followed by a statement that uses the new enum value, which cannot run in the same transaction — `db pull` writes one ordered migration file per plan unit instead of a single file (for example `<ts>_remote_schema_schema_changes.sql` and `<ts+1s>_remote_schema_after_enum_values.sql`), each recorded in the migration history. The common case (a single unit) still produces exactly one `<ts>_remote_schema.sql` file.
+
+By default the emitted SQL is formatted with the same settings the declarative export uses (uppercase keywords, wrapped at a max width of 180, indented and column-aligned). Configure overrides with `[experimental.pgdelta] format_options` in `config.toml`, or set `format_options = "null"` to opt out and emit raw, unformatted statements.
+
 When `[experimental.pgdelta] enabled = true` (the default for projects created by a recent `supabase init`), the migration-file `db pull` workflow uses pg-delta for the shadow diff step by default; it does not switch to declarative output. Existing projects without the section are unaffected and keep using migra. To fall back to the legacy migra engine, set `enabled = false` under `[experimental.pgdelta]`, or pass `--diff-engine migra` for a single run.
 
 When pulling from a remote database with `--db-url`, prefer a direct connection (`db.<project-ref>.supabase.co:5432`) over the connection pooler so pg-delta can introspect the full catalog reliably.
diff --git a/apps/cli-go/go.mod b/apps/cli-go/go.mod
index 82b8ea4526..25a5818bf1 100644
--- a/apps/cli-go/go.mod
+++ b/apps/cli-go/go.mod
@@ -20,7 +20,7 @@ require (
 	github.com/docker/go-connections v0.7.0
 	github.com/docker/go-units v0.5.0
 	github.com/fsnotify/fsnotify v1.10.1
-	github.com/getsentry/sentry-go v0.47.0
+	github.com/getsentry/sentry-go v0.48.0
 	github.com/go-errors/errors v1.5.1
 	github.com/go-git/go-git/v5 v5.19.1
 	github.com/go-playground/validator/v10 v10.30.3
@@ -42,23 +42,23 @@ require (
 	github.com/multigres/multigres v0.0.0-20260126223308-f5a52171bbc4
 	github.com/oapi-codegen/nullable v1.2.0
 	github.com/olekukonko/tablewriter v1.1.4
-	github.com/posthog/posthog-go v1.17.2
+	github.com/posthog/posthog-go v1.19.0
 	github.com/spf13/afero v1.15.0
 	github.com/spf13/cobra v1.10.2
 	github.com/spf13/pflag v1.0.10
 	github.com/spf13/viper v1.21.0
 	github.com/stretchr/testify v1.11.1
-	github.com/stripe/pg-schema-diff v1.0.5
+	github.com/stripe/pg-schema-diff v1.0.7
 	github.com/supabase/cli/pkg v1.0.0
 	github.com/tidwall/jsonc v0.3.3
 	github.com/withfig/autocomplete-tools/packages/cobra v1.2.0
 	github.com/zalando/go-keyring v0.2.8
 	go.opentelemetry.io/otel v1.44.0
-	golang.org/x/mod v0.37.0
-	golang.org/x/net v0.56.0
+	golang.org/x/mod v0.38.0
+	golang.org/x/net v0.57.0
 	golang.org/x/oauth2 v0.36.0
-	golang.org/x/term v0.44.0
-	google.golang.org/grpc v1.81.1
+	golang.org/x/term v0.45.0
+	google.golang.org/grpc v1.82.1
 	gopkg.in/yaml.v3 v3.0.1
 )
 
@@ -189,7 +189,7 @@ require (
 	github.com/fxamacker/cbor/v2 v2.9.0 // indirect
 	github.com/fzipp/gocyclo v0.6.0 // indirect
 	github.com/gabriel-vasile/mimetype v1.4.13 // indirect
-	github.com/getkin/kin-openapi v0.131.0 // indirect
+	github.com/getkin/kin-openapi v0.135.0 // indirect
 	github.com/ghostiam/protogetter v0.3.20 // indirect
 	github.com/go-critic/go-critic v0.14.3 // indirect
 	github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376 // indirect
@@ -301,7 +301,7 @@ require (
 	github.com/lib/pq v1.12.3 // indirect
 	github.com/lucasb-eyer/go-colorful v1.4.0 // indirect
 	github.com/macabu/inamedparam v0.2.0 // indirect
-	github.com/mailru/easyjson v0.9.0 // indirect
+	github.com/mailru/easyjson v0.9.1 // indirect
 	github.com/manuelarte/embeddedstructfieldcheck v0.4.0 // indirect
 	github.com/manuelarte/funcorder v0.6.0 // indirect
 	github.com/maratori/testableexamples v1.0.1 // indirect
@@ -350,10 +350,10 @@ require (
 	github.com/nishanths/exhaustive v0.12.0 // indirect
 	github.com/nishanths/predeclared v0.2.2 // indirect
 	github.com/nunnatsa/ginkgolinter v0.23.0 // indirect
-	github.com/oapi-codegen/oapi-codegen/v2 v2.4.1 // indirect
-	github.com/oapi-codegen/runtime v1.4.2 // indirect
-	github.com/oasdiff/yaml v0.0.0-20250309154309-f31be36b4037 // indirect
-	github.com/oasdiff/yaml3 v0.0.0-20250309153720-d2182401db90 // indirect
+	github.com/oapi-codegen/oapi-codegen/v2 v2.7.1 // indirect
+	github.com/oapi-codegen/runtime v1.6.0 // indirect
+	github.com/oasdiff/yaml v0.0.9 // indirect
+	github.com/oasdiff/yaml3 v0.0.9 // indirect
 	github.com/olekukonko/cat v0.0.0-20250911104152-50322a0618f6 // indirect
 	github.com/olekukonko/errors v1.2.0 // indirect
 	github.com/olekukonko/ll v0.1.6 // indirect
@@ -398,7 +398,8 @@ require (
 	github.com/skratchdot/open-golang v0.0.0-20200116055534-eef842397966 // indirect
 	github.com/sonatard/noctx v0.5.1 // indirect
 	github.com/sourcegraph/go-diff v0.8.0 // indirect
-	github.com/speakeasy-api/openapi-overlay v0.9.0 // indirect
+	github.com/speakeasy-api/jsonpath v0.6.3 // indirect
+	github.com/speakeasy-api/openapi v1.19.2 // indirect
 	github.com/spf13/cast v1.10.0 // indirect
 	github.com/ssgreg/nlreturn/v2 v2.2.1 // indirect
 	github.com/stbenjam/no-sprintf-host-port v0.3.1 // indirect
@@ -421,6 +422,7 @@ require (
 	github.com/uudashr/gocognit v1.2.1 // indirect
 	github.com/uudashr/iface v1.4.2 // indirect
 	github.com/vmware-labs/yaml-jsonpath v0.3.2 // indirect
+	github.com/woodsbury/decimal128 v1.4.0 // indirect
 	github.com/x448/float16 v0.8.4 // indirect
 	github.com/xanzy/ssh-agent v0.3.3 // indirect
 	github.com/xeipuuv/gojsonpointer v0.0.0-20180127040702-4e3ac2762d5f // indirect
@@ -458,13 +460,13 @@ require (
 	go.uber.org/zap v1.27.0 // indirect
 	go.yaml.in/yaml/v2 v2.4.3 // indirect
 	go.yaml.in/yaml/v3 v3.0.4 // indirect
-	golang.org/x/crypto v0.53.0 // indirect
+	golang.org/x/crypto v0.54.0 // indirect
 	golang.org/x/exp/typeparams v0.0.0-20260209203927-2842357ff358 // indirect
-	golang.org/x/sync v0.21.0 // indirect
-	golang.org/x/sys v0.46.0 // indirect
-	golang.org/x/text v0.38.0 // indirect
+	golang.org/x/sync v0.22.0 // indirect
+	golang.org/x/sys v0.47.0 // indirect
+	golang.org/x/text v0.40.0 // indirect
 	golang.org/x/time v0.14.0 // indirect
-	golang.org/x/tools v0.45.0 // indirect
+	golang.org/x/tools v0.47.0 // indirect
 	google.golang.org/genproto/googleapis/api v0.0.0-20260526163538-3dc84a4a5aaa // indirect
 	google.golang.org/genproto/googleapis/rpc v0.0.0-20260526163538-3dc84a4a5aaa // indirect
 	google.golang.org/protobuf v1.36.11 // indirect
@@ -472,7 +474,6 @@ require (
 	gopkg.in/inf.v0 v0.9.1 // indirect
 	gopkg.in/ini.v1 v1.67.0 // indirect
 	gopkg.in/warnings.v0 v0.1.2 // indirect
-	gopkg.in/yaml.v2 v2.4.0 // indirect
 	gotest.tools/gotestsum v1.12.2 // indirect
 	honnef.co/go/tools v0.7.0 // indirect
 	k8s.io/api v0.34.1 // indirect
diff --git a/apps/cli-go/go.sum b/apps/cli-go/go.sum
index f929d36494..d7fb2d5bee 100644
--- a/apps/cli-go/go.sum
+++ b/apps/cli-go/go.sum
@@ -371,10 +371,10 @@ github.com/fzipp/gocyclo v0.6.0 h1:lsblElZG7d3ALtGMx9fmxeTKZaLLpU8mET09yN4BBLo=
 github.com/fzipp/gocyclo v0.6.0/go.mod h1:rXPyn8fnlpa0R2csP/31uerbiVBugk5whMdlyaLkLoA=
 github.com/gabriel-vasile/mimetype v1.4.13 h1:46nXokslUBsAJE/wMsp5gtO500a4F3Nkz9Ufpk2AcUM=
 github.com/gabriel-vasile/mimetype v1.4.13/go.mod h1:d+9Oxyo1wTzWdyVUPMmXFvp4F9tea18J8ufA774AB3s=
-github.com/getkin/kin-openapi v0.131.0 h1:NO2UeHnFKRYhZ8wg6Nyh5Cq7dHk4suQQr72a4pMrDxE=
-github.com/getkin/kin-openapi v0.131.0/go.mod h1:3OlG51PCYNsPByuiMB0t4fjnNlIDnaEDsjiKUV8nL58=
-github.com/getsentry/sentry-go v0.47.0 h1:AnSMSyrYA5qZCIN/2xpgAAwv63sVULV+vBq37ajouc8=
-github.com/getsentry/sentry-go v0.47.0/go.mod h1:h+b4VHpKnK7aUXB5wc+KDnPgp9ZtfliRD4eV85FbiSA=
+github.com/getkin/kin-openapi v0.135.0 h1:751SjYfbiwqukYuVjwYEIKNfrSwS5YpA7DZnKSwQgtg=
+github.com/getkin/kin-openapi v0.135.0/go.mod h1:6dd5FJl6RdX4usBtFBaQhk9q62Yb2J0Mk5IhUO/QqFI=
+github.com/getsentry/sentry-go v0.48.0 h1:FRZNr7Uk1C86ev1bSJmYlUkL9oyivQA6YOcdYfaaMmY=
+github.com/getsentry/sentry-go v0.48.0/go.mod h1:E5UkA5wp1qR2+MDydNYlVeUiNN2xEdjYMidkgf0Qoss=
 github.com/ghostiam/protogetter v0.3.20 h1:oW7OPFit2FxZOpmMRPP9FffU4uUpfeE/rEdE1f+MzD0=
 github.com/ghostiam/protogetter v0.3.20/go.mod h1:FjIu5Yfs6FT391m+Fjp3fbAYJ6rkL/J6ySpZBfnODuI=
 github.com/gliderlabs/ssh v0.3.8 h1:a4YXD1V7xMF9g5nTkdfnja3Sxy1PVDCj1Zg4Wb8vY6c=
@@ -765,8 +765,8 @@ github.com/lucasb-eyer/go-colorful v1.4.0/go.mod h1:R4dSotOR9KMtayYi1e77YzuveK+i
 github.com/macabu/inamedparam v0.2.0 h1:VyPYpOc10nkhI2qeNUdh3Zket4fcZjEWe35poddBCpE=
 github.com/macabu/inamedparam v0.2.0/go.mod h1:+Pee9/YfGe5LJ62pYXqB89lJ+0k5bsR8Wgz/C0Zlq3U=
 github.com/magiconair/properties v1.5.3/go.mod h1:PppfXfuXeibc/6YijjN8zIbojt8czPbwD3XqdrwzmxQ=
-github.com/mailru/easyjson v0.9.0 h1:PrnmzHw7262yW8sTBwxi1PdJA3Iw/EKBa8psRf7d9a4=
-github.com/mailru/easyjson v0.9.0/go.mod h1:1+xMtQp2MRNVL/V1bOzuP3aP8VNwRW55fQUto+XFtTU=
+github.com/mailru/easyjson v0.9.1 h1:LbtsOm5WAswyWbvTEOqhypdPeZzHavpZx96/n553mR8=
+github.com/mailru/easyjson v0.9.1/go.mod h1:1+xMtQp2MRNVL/V1bOzuP3aP8VNwRW55fQUto+XFtTU=
 github.com/manuelarte/embeddedstructfieldcheck v0.4.0 h1:3mAIyaGRtjK6EO9E73JlXLtiy7ha80b2ZVGyacxgfww=
 github.com/manuelarte/embeddedstructfieldcheck v0.4.0/go.mod h1:z8dFSyXqp+fC6NLDSljRJeNQJJDWnY7RoWFzV3PC6UM=
 github.com/manuelarte/funcorder v0.6.0 h1:0hBngc4fa1IgNiI65A7sFGkMvoMCc878RjqB5V7rWP0=
@@ -894,14 +894,14 @@ github.com/nxadm/tail v1.4.8 h1:nPr65rt6Y5JFSKQO7qToXr7pePgD6Gwiw05lkbyAQTE=
 github.com/nxadm/tail v1.4.8/go.mod h1:+ncqLTQzXmGhMZNUePPaPqPvBxHAIsmXswZKocGu+AU=
 github.com/oapi-codegen/nullable v1.2.0 h1:VflFkDW980KhBPiFF7nWSyjg+r4Obqj8lXipV0UkP5w=
 github.com/oapi-codegen/nullable v1.2.0/go.mod h1:KUZ3vUzkmEKY90ksAmit2+5juDIhIZhfDl+0PwOQlFY=
-github.com/oapi-codegen/oapi-codegen/v2 v2.4.1 h1:ykgG34472DWey7TSjd8vIfNykXgjOgYJZoQbKfEeY/Q=
-github.com/oapi-codegen/oapi-codegen/v2 v2.4.1/go.mod h1:N5+lY1tiTDV3V1BeHtOxeWXHoPVeApvsvjJqegfoaz8=
-github.com/oapi-codegen/runtime v1.4.2 h1:GMxFVYLzoYLua+/KvzgSphkyK1lLTReQI9Vf4hvATKE=
-github.com/oapi-codegen/runtime v1.4.2/go.mod h1:GwV7hC2hviaMzj+ITfHVRESK5J2W/GefVwIND/bMGvU=
-github.com/oasdiff/yaml v0.0.0-20250309154309-f31be36b4037 h1:G7ERwszslrBzRxj//JalHPu/3yz+De2J+4aLtSRlHiY=
-github.com/oasdiff/yaml v0.0.0-20250309154309-f31be36b4037/go.mod h1:2bpvgLBZEtENV5scfDFEtB/5+1M4hkQhDQrccEJ/qGw=
-github.com/oasdiff/yaml3 v0.0.0-20250309153720-d2182401db90 h1:bQx3WeLcUWy+RletIKwUIt4x3t8n2SxavmoclizMb8c=
-github.com/oasdiff/yaml3 v0.0.0-20250309153720-d2182401db90/go.mod h1:y5+oSEHCPT/DGrS++Wc/479ERge0zTFxaF8PbGKcg2o=
+github.com/oapi-codegen/oapi-codegen/v2 v2.7.1 h1:a7Ab7YlpqkVG5HKrTaeFstm32Z5QOnyjnbsCO0jiMYM=
+github.com/oapi-codegen/oapi-codegen/v2 v2.7.1/go.mod h1:qzFy6iuobJw/hD1aRILee4G87/ShmhR0xYCwcUtZMCw=
+github.com/oapi-codegen/runtime v1.6.0 h1:7Xx+GlueD6nRuyKoCPzL434Jfi3BetbiJOrzCHp/VPU=
+github.com/oapi-codegen/runtime v1.6.0/go.mod h1:GwV7hC2hviaMzj+ITfHVRESK5J2W/GefVwIND/bMGvU=
+github.com/oasdiff/yaml v0.0.9 h1:zQOvd2UKoozsSsAknnWoDJlSK4lC0mpmjfDsfqNwX48=
+github.com/oasdiff/yaml v0.0.9/go.mod h1:8lvhgJG4xiKPj3HN5lDow4jZHPlx1i7dIwzkdAo6oAM=
+github.com/oasdiff/yaml3 v0.0.9 h1:rWPrKccrdUm8J0F3sGuU+fuh9+1K/RdJlWF7O/9yw2g=
+github.com/oasdiff/yaml3 v0.0.9/go.mod h1:y5+oSEHCPT/DGrS++Wc/479ERge0zTFxaF8PbGKcg2o=
 github.com/olekukonko/cat v0.0.0-20250911104152-50322a0618f6 h1:zrbMGy9YXpIeTnGj4EljqMiZsIcE09mmF8XsD5AYOJc=
 github.com/olekukonko/cat v0.0.0-20250911104152-50322a0618f6/go.mod h1:rEKTHC9roVVicUIfZK7DYrdIoM0EOr8mK1Hj5s3JjH0=
 github.com/olekukonko/errors v1.2.0 h1:10Zcn4GeV59t/EGqJc8fUjtFT/FuUh5bTMzZ1XwmCRo=
@@ -970,8 +970,8 @@ github.com/planetscale/vtprotobuf v0.6.1-0.20240319094008-0393e58bdf10/go.mod h1
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRIccs7FGNTlIRMkT8wgtp5eCXdBlqhYGL6U=
 github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
-github.com/posthog/posthog-go v1.17.2 h1:w0TaCAd+Z3WoEgVyR/nlcXlqNN2tpoBfIyxuGssDgCE=
-github.com/posthog/posthog-go v1.17.2/go.mod h1://M430hNH3e8CDv4i8SJesb26816Mpa6GIZaiP4pNQU=
+github.com/posthog/posthog-go v1.19.0 h1:GsPilbAfQo8dbIo2yheTZ8pbmE5yYW3G289kXrxZxFA=
+github.com/posthog/posthog-go v1.19.0/go.mod h1://M430hNH3e8CDv4i8SJesb26816Mpa6GIZaiP4pNQU=
 github.com/prometheus/client_golang v0.9.0-pre1.0.20180209125602-c332b6f63c06/go.mod h1:7SWBe2y4D6OKWSNQJUaRYU/AaXPKyh/dDVn+NZz0KFw=
 github.com/prometheus/client_golang v0.9.1/go.mod h1:7SWBe2y4D6OKWSNQJUaRYU/AaXPKyh/dDVn+NZz0KFw=
 github.com/prometheus/client_golang v1.0.0/go.mod h1:db9x61etRT2tGnBNRi70OPL5FsnadC4Ky3P0J6CfImo=
@@ -1070,8 +1070,10 @@ github.com/sourcegraph/go-diff v0.8.0 h1:ipIyu4cTsLbIrln4l0qtHA3r0a7gyK4ntKjtQyt
 github.com/sourcegraph/go-diff v0.8.0/go.mod h1:hWlcO7Al+UZStZAP8rBumHpCK5ZHQ5BXsMls8p4+F5E=
 github.com/spdx/tools-golang v0.5.5 h1:61c0KLfAcNqAjlg6UNMdkwpMernhw3zVRwDZ2x9XOmk=
 github.com/spdx/tools-golang v0.5.5/go.mod h1:MVIsXx8ZZzaRWNQpUDhC4Dud34edUYJYecciXgrw5vE=
-github.com/speakeasy-api/openapi-overlay v0.9.0 h1:Wrz6NO02cNlLzx1fB093lBlYxSI54VRhy1aSutx0PQg=
-github.com/speakeasy-api/openapi-overlay v0.9.0/go.mod h1:f5FloQrHA7MsxYg9djzMD5h6dxrHjVVByWKh7an8TRc=
+github.com/speakeasy-api/jsonpath v0.6.3 h1:c+QPwzAOdrWvzycuc9HFsIZcxKIaWcNpC+xhOW9rJxU=
+github.com/speakeasy-api/jsonpath v0.6.3/go.mod h1:2cXloNuQ+RSXi5HTRaeBh7JEmjRXTiaKpFTdZiL7URI=
+github.com/speakeasy-api/openapi v1.19.2 h1:md90tE71/M8jS3cuRlsuWP5Aed4xoG5PSRvXeZgCv/M=
+github.com/speakeasy-api/openapi v1.19.2/go.mod h1:UfKa7FqE4jgexJZuj51MmdHAFGmDv0Zaw3+yOd81YKU=
 github.com/spf13/afero v1.15.0 h1:b/YBCLWAJdFWJTN9cLhiXXcD7mzKn9Dm86dNnfyQw1I=
 github.com/spf13/afero v1.15.0/go.mod h1:NC2ByUVxtQs4b3sIUphxK0NioZnmxgyCrfzeuq8lxMg=
 github.com/spf13/cast v0.0.0-20150508191742-4d07383ffe94/go.mod h1:r2rcYCSwa1IExKTDiTfzaxqT2FNHs8hODu4LnUfgKEg=
@@ -1111,8 +1113,8 @@ github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO
 github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
 github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
 github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
-github.com/stripe/pg-schema-diff v1.0.5 h1:TNHkiRNMn7ttiBd+YBypAbx9v0SfVls+NQZFtamy1K4=
-github.com/stripe/pg-schema-diff v1.0.5/go.mod h1:3IctPaAqm+0LtWw/GiwyRoRlU1/N/+00+eXVk0KZIHs=
+github.com/stripe/pg-schema-diff v1.0.7 h1:aVMFqjsnPSeh46hlJnexGPm28nZJUvZK0bEyk6rdFVE=
+github.com/stripe/pg-schema-diff v1.0.7/go.mod h1:3IctPaAqm+0LtWw/GiwyRoRlU1/N/+00+eXVk0KZIHs=
 github.com/subosito/gotenv v1.6.0 h1:9NlTDc1FTs4qu0DDq7AEtTPNw6SVm7uBMsUCUjABIf8=
 github.com/subosito/gotenv v1.6.0/go.mod h1:Dk4QP5c2W3ibzajGcXpNraDfq2IrhjMIvMSWPKKo0FU=
 github.com/tenntenn/modver v1.0.1 h1:2klLppGhDgzJrScMpkj9Ujy3rXPUspSjAcev9tSEBgA=
@@ -1161,6 +1163,8 @@ github.com/vmware-labs/yaml-jsonpath v0.3.2 h1:/5QKeCBGdsInyDCyVNLbXyilb61MXGi9N
 github.com/vmware-labs/yaml-jsonpath v0.3.2/go.mod h1:U6whw1z03QyqgWdgXxvVnQ90zN1BWz5V+51Ewf8k+rQ=
 github.com/withfig/autocomplete-tools/packages/cobra v1.2.0 h1:MzD3XeOOSO3mAjOPpF07jFteSKZxsRHvlIcAR9RQzKM=
 github.com/withfig/autocomplete-tools/packages/cobra v1.2.0/go.mod h1:RoXh7+7qknOXL65uTzdzE1mPxqcPwS7FLCE9K5GfmKo=
+github.com/woodsbury/decimal128 v1.4.0 h1:xJATj7lLu4f2oObouMt2tgGiElE5gO6mSWUjQsBgUlc=
+github.com/woodsbury/decimal128 v1.4.0/go.mod h1:BP46FUrVjVhdTbKT+XuQh2xfQaGki9LMIRJSFuh6THU=
 github.com/x448/float16 v0.8.4 h1:qLwI1I70+NjRFUR3zs1JPUCgaCXSh3SW62uAKT1mSBM=
 github.com/x448/float16 v0.8.4/go.mod h1:14CWIYCyZA/cWjXOioeEpHeN/83MdbZDRQHoFcYsOfg=
 github.com/xanzy/ssh-agent v0.3.3 h1:+/15pJfg/RsTxqYcX6fHqOXZwwMP+2VyYWJeWM2qQFM=
@@ -1286,8 +1290,8 @@ golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5y
 golang.org/x/crypto v0.0.0-20220622213112-05595931fe9d/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
 golang.org/x/crypto v0.19.0/go.mod h1:Iy9bg/ha4yyC70EfRS8jz+B6ybOBKMaSxLj6P6oBDfU=
 golang.org/x/crypto v0.20.0/go.mod h1:Xwo95rrVNIoSMx9wa1JroENMToLWn3RNVrTBpLHgZPQ=
-golang.org/x/crypto v0.53.0 h1:QZ4Muo8THX6CizN2vPPd5fBGHyogrdK9fG4wLPFUsto=
-golang.org/x/crypto v0.53.0/go.mod h1:DNLU434OwVakk9PzuwV8w62mAJpRJL3vsgcfp4Qnsio=
+golang.org/x/crypto v0.54.0 h1:YLIA59K4fiNzHzjnZt2tUJQjQtUWfWbeHBqKtk3eScw=
+golang.org/x/crypto v0.54.0/go.mod h1:KWL8ny2AZdGR2cWmzeHrp2azQPGogOv+HeQaVEXC2dk=
 golang.org/x/exp v0.0.0-20260410095643-746e56fc9e2f h1:W3F4c+6OLc6H2lb//N1q4WpJkhzJCK5J6kUi1NTVXfM=
 golang.org/x/exp v0.0.0-20260410095643-746e56fc9e2f/go.mod h1:J1xhfL/vlindoeF/aINzNzt2Bket5bjo9sdOYzOsU80=
 golang.org/x/exp/typeparams v0.0.0-20220428152302-39d4317da171/go.mod h1:AbB0pIl9nAr9wVwH+Z2ZpaocVmF5I4GyWCDIsVjR0bk=
@@ -1303,8 +1307,8 @@ golang.org/x/mod v0.4.1/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.6.0-dev.0.20220106191415-9b9b3d81d5e3/go.mod h1:3p9vT2HGsQu2K1YbXdKPJLVgG5VJdoTa1poYQBtP1AY=
 golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
 golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
-golang.org/x/mod v0.37.0 h1:vF1DjpVEshcIqoEaauuHebaLk1O1forxjxBaVn884JQ=
-golang.org/x/mod v0.37.0/go.mod h1:m8S8VeM9r4dzDwjrKO0a1sZP3YjeMamRRlD+fmR2Q/0=
+golang.org/x/mod v0.38.0 h1:MECBjubtXD7yj4HrhIUcywNaGeNVUdfVnxmPajOk4yk=
+golang.org/x/mod v0.38.0/go.mod h1:V6Xz0pq8TQ3dGqVQ1FVHuelZpAL0uNhSkk9ogYP3c40=
 golang.org/x/net v0.0.0-20180906233101-161cd47e91fd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20181114220301-adae6a3d119a/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20190311183353-d8887717615a/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
@@ -1325,8 +1329,8 @@ golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug
 golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
 golang.org/x/net v0.10.0/go.mod h1:0qNGK6F8kojg2nk9dLZ2mShWaEBan6FAoqfSigmmuDg=
 golang.org/x/net v0.21.0/go.mod h1:bIjVDfnllIU7BJ2DNgfnXvpSvtn8VRwhlsaeUTyUS44=
-golang.org/x/net v0.56.0 h1:Rw8j/hFzGvJUZwNBXnAtf5sVDVt+65SK2C7IxCxZt5o=
-golang.org/x/net v0.56.0/go.mod h1:D3Ku6r+V6JROoZK144D2XfMHFcMq/0zSfLelVTCFKec=
+golang.org/x/net v0.57.0 h1:K5+3DljvIuDG9/Jv9rvyMywYNFCQ9RSUY6OOTTkT+tE=
+golang.org/x/net v0.57.0/go.mod h1:KpXc8iv+r3XplLAG/f7Jsf9RPszJzdR0f58q9vGOuEU=
 golang.org/x/oauth2 v0.36.0 h1:peZ/1z27fi9hUOFCAZaHyrpWG5lwe0RJEEEeH0ThlIs=
 golang.org/x/oauth2 v0.36.0/go.mod h1:YDBUJMTkDnJS+A4BP4eZBjCqtokkg1hODuPjwiGPO7Q=
 golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
@@ -1339,8 +1343,8 @@ golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJ
 golang.org/x/sync v0.0.0-20210220032951-036812b2e83c/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.21.0 h1:HLII4xRRTtCRkxYp4HNFF0Js/Og6q2i++KXbg0gHCwM=
-golang.org/x/sync v0.21.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
+golang.org/x/sync v0.22.0 h1:SZjpbeLmrCk4xhRSZFNZW5gFUeCeFgjekvI/+gfScek=
+golang.org/x/sync v0.22.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
 golang.org/x/sys v0.0.0-20180905080454-ebe1bf3edb33/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20180909124046-d0be0721c37e/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20181116152217-5ac8a444bdc5/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
@@ -1380,16 +1384,16 @@ golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.8.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.17.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
-golang.org/x/sys v0.46.0 h1:noSf2Fq6F8DBgS+LysIkx7rIExoNHJsxOAtPp4rthXw=
-golang.org/x/sys v0.46.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
+golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=
+golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
 golang.org/x/term v0.0.0-20201117132131-f5c789dd3221/go.mod h1:Nr5EML6q2oocZ2LXRh80K7BxOlk5/8JxuGnuhpl+muw=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
 golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k=
 golang.org/x/term v0.8.0/go.mod h1:xPskH00ivmX89bAKVGSKKtLOWNx2+17Eiy94tnKShWo=
 golang.org/x/term v0.17.0/go.mod h1:lLRBjIVuehSbZlaOtGMbcMncT+aqLLLmKrsjNrUguwk=
-golang.org/x/term v0.44.0 h1:0rLvDRCtNj0gZkyIXhCyOb2OAzEhLVqc4B+hrsBhrmc=
-golang.org/x/term v0.44.0/go.mod h1:7ze4MdzUzLXpSAoFP1H0bOI9aXDqveSvatT5vKcFh2Y=
+golang.org/x/term v0.45.0 h1:NwWyBmoJCbfTHpxrWoZ9C6/VxOf7ic219I8xZZFdrf0=
+golang.org/x/term v0.45.0/go.mod h1:9aqxs0blBcrm/n0L9QW0aRVD+ktan8ssZromtqJC43w=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
@@ -1399,8 +1403,8 @@ golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
 golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
 golang.org/x/text v0.9.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
 golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
-golang.org/x/text v0.38.0 h1:sXmwo9DwP3OK9EZ7PqAdaooSGozfl/3a6/xJcbzPRhE=
-golang.org/x/text v0.38.0/go.mod h1:YXZt3QhHUKYT53r2lLKFIVi6Ao1jdzrTR/KQ09qyxF4=
+golang.org/x/text v0.40.0 h1:Ub2Z6/xjgF1WrYQz2nuITOEegKFtiIy+rieRJ5lHZKs=
+golang.org/x/text v0.40.0/go.mod h1:hpnzDAfGV753zIKo+wk3u1bVKCGPbrnF7+7LBF/UHVY=
 golang.org/x/time v0.14.0 h1:MRx4UaLrDotUKUdCIqzPC48t1Y9hANFKIRpNx+Te8PI=
 golang.org/x/time v0.14.0/go.mod h1:eL/Oa2bBBK0TkX57Fyni+NgnyQQN4LitPmob2Hjnqw4=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
@@ -1422,8 +1426,8 @@ golang.org/x/tools v0.1.1-0.20210302220138-2ac05c832e1a/go.mod h1:9bzcO0MWcOuT0t
 golang.org/x/tools v0.1.10/go.mod h1:Uh6Zz+xoGYZom868N8YTex3t7RhtHDBrE8Gzo9bV56E=
 golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
 golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU=
-golang.org/x/tools v0.45.0 h1:18qN3FAooORvApf5XjCXgsuayZOEtXf6JK18I3+ONa8=
-golang.org/x/tools v0.45.0/go.mod h1:LuUGqqaXcXMEFEruIVJVm5mgDD8vww/z/SR1gQ4uE/0=
+golang.org/x/tools v0.47.0 h1:7Kn5x/d1svx/PzryTsqeoZN4TZwqeH5pGWjefhLi/1Q=
+golang.org/x/tools v0.47.0/go.mod h1:dFHnyTvFWY212G+h7ZY4Vsp/K3U4/7W9TyVaAul8uCA=
 golang.org/x/tools/go/expect v0.1.1-deprecated h1:jpBZDwmgPhXsKZC6WhL20P4b/wmnpsEAGHaNy0n/rJM=
 golang.org/x/tools/go/expect v0.1.1-deprecated/go.mod h1:eihoPOH+FgIqa3FpoTwguz/bVUSGBlGQU67vpBeOrBY=
 golang.org/x/tools/go/packages/packagestest v0.1.1-deprecated h1:1h2MnaIAIXISqTFKdENegdpAgUXz6NrPEsbIeWaBRvM=
@@ -1441,8 +1445,8 @@ google.golang.org/genproto/googleapis/api v0.0.0-20260526163538-3dc84a4a5aaa/go.
 google.golang.org/genproto/googleapis/rpc v0.0.0-20260526163538-3dc84a4a5aaa h1:mZHHdPZl0dbGHCflZgAq/Q468DWVFcU2whhB2KAo8fk=
 google.golang.org/genproto/googleapis/rpc v0.0.0-20260526163538-3dc84a4a5aaa/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8=
 google.golang.org/grpc v1.0.5/go.mod h1:yo6s7OP7yaDglbqo1J04qKzAhqBH6lvTonzMVmEdcZw=
-google.golang.org/grpc v1.81.1 h1:VnnIIZ88UzOOKLukQi+ImGz8O1Wdp8nAGGnvOfEIWQQ=
-google.golang.org/grpc v1.81.1/go.mod h1:xGH9GfzOyMTGIOXBJmXt+BX/V0kcdQbdcuwQ/zNw42I=
+google.golang.org/grpc v1.82.1 h1:NnAxzGRA0677vCa4BUkOAnO5+FfQqVl9iUXeD0IqcGE=
+google.golang.org/grpc v1.82.1/go.mod h1:yzTZ1TB1Z3SG+LIYaI+WiE8D5+PZ3ArnrSp8zF3+/ZA=
 google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8=
 google.golang.org/protobuf v0.0.0-20200221191635-4d8936d0db64/go.mod h1:kwYJMbMJ01Woi6D6+Kah6886xMZcty6N08ah7+eCXa0=
 google.golang.org/protobuf v0.0.0-20200228230310-ab0ca4ff8a60/go.mod h1:cfTl7dwQJ+fmap5saPgwCLgHXTUD7jkjRqWcaiX5VyM=
@@ -1484,7 +1488,6 @@ gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.2.4/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.2.8/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.3.0/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
-gopkg.in/yaml.v2 v2.4.0 h1:D8xgwECY7CYvx+Y2n4sBz93Jn9JRvxdiyyo8CTfuKaY=
 gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=
 gopkg.in/yaml.v3 v3.0.0-20191026110619-0b21df46bc1d/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
diff --git a/apps/cli-go/internal/db/advisors/templates/lints.sql b/apps/cli-go/internal/db/advisors/templates/lints.sql
index c8a54a3a7f..c8c96de64c 100644
--- a/apps/cli-go/internal/db/advisors/templates/lints.sql
+++ b/apps/cli-go/internal/db/advisors/templates/lints.sql
@@ -117,7 +117,7 @@ where
       pg_catalog.has_table_privilege('anon', c.oid, 'SELECT')
       or pg_catalog.has_table_privilege('authenticated', c.oid, 'SELECT')
     )
-    and n.nspname = any(array(select trim(unnest(string_to_array(current_setting('pgrst.db_schemas', 't'), ',')))))
+    and n.nspname = any(array(select trim(unnest(string_to_array(coalesce(current_setting('pgrst.db_schemas', 't'), 'public'), ',')))))
     -- Exclude self
     and c.relname <> '0002_auth_users_exposed'
     -- There are 3 insecure configurations
@@ -610,7 +610,7 @@ where
         or pg_catalog.has_table_privilege('authenticated', c.oid, 'SELECT')
     )
     and substring(pg_catalog.version() from 'PostgreSQL ([0-9]+)') >= '15' -- security invoker was added in pg15
-    and n.nspname = any(array(select trim(unnest(string_to_array(current_setting('pgrst.db_schemas', 't'), ',')))))
+    and n.nspname = any(array(select trim(unnest(string_to_array(coalesce(current_setting('pgrst.db_schemas', 't'), 'public'), ',')))))
     and n.nspname not in (
         '_timescaledb_cache', '_timescaledb_catalog', '_timescaledb_config', '_timescaledb_internal', 'auth', 'cron', 'extensions', 'graphql', 'graphql_public', 'information_schema', 'net', 'pgmq', 'pgroonga', 'pgsodium', 'pgsodium_masks', 'pgtle', 'pgbouncer', 'pg_catalog', 'pgtle', 'realtime', 'repack', 'storage', 'supabase_functions', 'supabase_migrations', 'tiger', 'topology', 'vault'
     )
@@ -705,7 +705,7 @@ where
         pg_catalog.has_table_privilege('anon', c.oid, 'SELECT')
         or pg_catalog.has_table_privilege('authenticated', c.oid, 'SELECT')
     )
-    and n.nspname = any(array(select trim(unnest(string_to_array(current_setting('pgrst.db_schemas', 't'), ',')))))
+    and n.nspname = any(array(select trim(unnest(string_to_array(coalesce(current_setting('pgrst.db_schemas', 't'), 'public'), ',')))))
     and n.nspname not in (
         '_timescaledb_cache', '_timescaledb_catalog', '_timescaledb_config', '_timescaledb_internal', 'auth', 'cron', 'extensions', 'graphql', 'graphql_public', 'information_schema', 'net', 'pgmq', 'pgroonga', 'pgsodium', 'pgsodium_masks', 'pgtle', 'pgbouncer', 'pg_catalog', 'pgtle', 'realtime', 'repack', 'storage', 'supabase_functions', 'supabase_migrations', 'tiger', 'topology', 'vault'
     ))
@@ -836,7 +836,7 @@ where
         pg_catalog.has_table_privilege('anon', c.oid, 'SELECT')
         or pg_catalog.has_table_privilege('authenticated', c.oid, 'SELECT')
     )
-    and n.nspname = any(array(select trim(unnest(string_to_array(current_setting('pgrst.db_schemas', 't'), ',')))))
+    and n.nspname = any(array(select trim(unnest(string_to_array(coalesce(current_setting('pgrst.db_schemas', 't'), 'public'), ',')))))
     and n.nspname not in (
         '_timescaledb_cache', '_timescaledb_catalog', '_timescaledb_config', '_timescaledb_internal', 'auth', 'cron', 'extensions', 'graphql', 'graphql_public', 'information_schema', 'net', 'pgmq', 'pgroonga', 'pgsodium', 'pgsodium_masks', 'pgtle', 'pgbouncer', 'pg_catalog', 'pgtle', 'realtime', 'repack', 'storage', 'supabase_functions', 'supabase_migrations', 'tiger', 'topology', 'vault'
     )
@@ -879,7 +879,7 @@ where
         pg_catalog.has_table_privilege('anon', c.oid, 'SELECT')
         or pg_catalog.has_table_privilege('authenticated', c.oid, 'SELECT')
     )
-    and n.nspname = any(array(select trim(unnest(string_to_array(current_setting('pgrst.db_schemas', 't'), ',')))))
+    and n.nspname = any(array(select trim(unnest(string_to_array(coalesce(current_setting('pgrst.db_schemas', 't'), 'public'), ',')))))
     and n.nspname not in (
         '_timescaledb_cache', '_timescaledb_catalog', '_timescaledb_config', '_timescaledb_internal', 'auth', 'cron', 'extensions', 'graphql', 'graphql_public', 'information_schema', 'net', 'pgmq', 'pgroonga', 'pgsodium', 'pgsodium_masks', 'pgtle', 'pgbouncer', 'pg_catalog', 'pgtle', 'realtime', 'repack', 'storage', 'supabase_functions', 'supabase_migrations', 'tiger', 'topology', 'vault'
     )
@@ -966,7 +966,7 @@ where
     and n.nspname = 'pgmq' -- tables in the pgmq schema
     and c.relname like 'q_%' -- only queue tables
     -- Constant requirements
-    and 'pgmq_public' = any(array(select trim(unnest(string_to_array(current_setting('pgrst.db_schemas', 't'), ','))))))
+    and 'pgmq_public' = any(array(select trim(unnest(string_to_array(coalesce(current_setting('pgrst.db_schemas', 't'), 'public'), ','))))))
 union all
 (
 with constants as (
@@ -1198,7 +1198,7 @@ exposed_tables as (
             pg_catalog.has_table_privilege('anon', c.oid, 'SELECT')
             or pg_catalog.has_table_privilege('authenticated', c.oid, 'SELECT')
         )
-        and n.nspname = any(array(select trim(unnest(string_to_array(current_setting('pgrst.db_schemas', 't'), ',')))))
+        and n.nspname = any(array(select trim(unnest(string_to_array(coalesce(current_setting('pgrst.db_schemas', 't'), 'public'), ',')))))
         and n.nspname not in (
             '_timescaledb_cache', '_timescaledb_catalog', '_timescaledb_config', '_timescaledb_internal', 'auth', 'cron', 'extensions', 'graphql', 'graphql_public', 'information_schema', 'net', 'pgmq', 'pgroonga', 'pgsodium', 'pgsodium_masks', 'pgtle', 'pgbouncer', 'pg_catalog', 'pgtle', 'realtime', 'repack', 'storage', 'supabase_functions', 'supabase_migrations', 'tiger', 'topology', 'vault'
         )
diff --git a/apps/cli-go/internal/db/declarative/declarative.go b/apps/cli-go/internal/db/declarative/declarative.go
index c79df6289f..b84087bf9f 100644
--- a/apps/cli-go/internal/db/declarative/declarative.go
+++ b/apps/cli-go/internal/db/declarative/declarative.go
@@ -204,7 +204,7 @@ func SyncToMigrations(ctx context.Context, schema []string, file string, noCache
 	if len(strings.TrimSpace(file)) == 0 {
 		file = "declarative_sync"
 	}
-	if err := diff.SaveDiff(result.DiffSQL, file, fsys); err != nil {
+	if err := diff.SaveDiff(diff.DatabaseDiff{SQL: result.DiffSQL}, file, fsys); err != nil {
 		return err
 	}
 	if len(result.DropWarnings) > 0 {
diff --git a/apps/cli-go/internal/db/diff/diff.go b/apps/cli-go/internal/db/diff/diff.go
index 85c9c09c9c..32fabb2c21 100644
--- a/apps/cli-go/internal/db/diff/diff.go
+++ b/apps/cli-go/internal/db/diff/diff.go
@@ -38,7 +38,7 @@ func Run(ctx context.Context, schema []string, file string, config pgconn.Config
 	out := result.SQL
 	branch := utils.GetGitBranch(fsys)
 	fmt.Fprintln(os.Stderr, "Finished "+utils.Aqua("supabase db diff")+" on branch "+utils.Aqua(branch)+".\n")
-	if err := SaveDiff(out, file, fsys); err != nil {
+	if err := SaveDiff(result, file, fsys); err != nil {
 		return err
 	}
 	drops := findDropStatements(out)
@@ -225,22 +225,31 @@ func DiffDatabase(ctx context.Context, schema []string, config pgconn.Config, w
 	} else {
 		fmt.Fprintln(w, "Diffing schemas...")
 	}
-	if IsPgDeltaDebugEnabled() && usePgDelta {
-		// Capture the shadow baseline catalog and edge-runtime stderr so an
-		// empty diff can be inspected later. DiffPgDeltaRefDetailed mirrors the
-		// pg-delta differ but additionally surfaces stderr, which differ() drops.
-		debugCapture := &PgDeltaDebugCapture{}
-		if snapshot, exportErr := exportCatalogPgDelta(ctx, utils.ToPostgresURL(shadowConfig), "postgres", options...); exportErr == nil {
-			debugCapture.SourceCatalog = snapshot
-		} else {
-			fmt.Fprintf(w, "Warning: failed to export shadow pg-delta catalog: %v\n", exportErr)
+	if usePgDelta {
+		// pg-delta always goes through the diffPgDeltaRefDetailed seam so callers get
+		// the execution-aware per-unit files (db pull writes one migration file each);
+		// db diff/declarative flatten them back via SQL. This mirrors the config-based
+		// differ (DiffPgDelta) exactly, so it is safe to bypass the injected differ()
+		// here — differ() remains the migra engine path below.
+		var debugCapture *PgDeltaDebugCapture
+		if IsPgDeltaDebugEnabled() {
+			// Capture the shadow baseline catalog and edge-runtime stderr so an
+			// empty diff can be inspected later.
+			debugCapture = &PgDeltaDebugCapture{}
+			if snapshot, exportErr := exportCatalogPgDelta(ctx, utils.ToPostgresURL(shadowConfig), "postgres", options...); exportErr == nil {
+				debugCapture.SourceCatalog = snapshot
+			} else {
+				fmt.Fprintf(w, "Warning: failed to export shadow pg-delta catalog: %v\n", exportErr)
+			}
 		}
-		result, err := DiffPgDeltaRefDetailed(ctx, utils.ToPostgresURL(shadowConfig), utils.ToPostgresURL(config), schema, pgDeltaFormatOptions(), options...)
+		result, err := diffPgDeltaRefDetailed(ctx, utils.ToPostgresURL(shadowConfig), utils.ToPostgresURL(config), schema, pgDeltaFormatOptions(), options...)
 		if err != nil {
 			return DatabaseDiff{}, err
 		}
-		debugCapture.Stderr = result.Stderr
-		return DatabaseDiff{SQL: result.SQL, Debug: debugCapture}, nil
+		if debugCapture != nil {
+			debugCapture.Stderr = result.Stderr
+		}
+		return DatabaseDiff{SQL: joinPgDeltaFiles(result.Files), Files: result.Files, Debug: debugCapture}, nil
 	}
 	output, err := differ(ctx, shadowConfig, config, schema, options...)
 	if err != nil {
diff --git a/apps/cli-go/internal/db/diff/diff_test.go b/apps/cli-go/internal/db/diff/diff_test.go
index 92fd01164b..aff3242699 100644
--- a/apps/cli-go/internal/db/diff/diff_test.go
+++ b/apps/cli-go/internal/db/diff/diff_test.go
@@ -224,12 +224,23 @@ func TestRun(t *testing.T) {
 			Reply("CREATE FUNCTION").
 			Query(tableSQL).
 			Reply("CREATE TABLE")
+		// pg-delta bypasses the injected DiffFunc and runs the real edge-runtime
+		// pipeline, so stub the seam DiffDatabase uses (mirrors exportCatalogPgDelta).
+		// The migra differ must never be reached on this path.
+		originalDiffPgDelta := diffPgDeltaRefDetailed
+		t.Cleanup(func() { diffPgDeltaRefDetailed = originalDiffPgDelta })
 		diffCalled := false
-		differ := func(_ context.Context, _, target pgconn.Config, schema []string, _ ...func(*pgx.ConnConfig)) (string, error) {
+		diffPgDeltaRefDetailed = func(_ context.Context, _, targetRef string, schema []string, _ string, _ ...func(*pgx.ConnConfig)) (PgDeltaDiffResult, error) {
 			diffCalled = true
-			assert.Equal(t, "contrib_regression", target.Database)
+			assert.Contains(t, targetRef, "contrib_regression")
 			assert.Equal(t, []string{"public"}, schema)
-			return generated, nil
+			return PgDeltaDiffResult{
+				Files: []PgDeltaPlanFile{{Order: 1, Name: "schema_changes", TransactionMode: "transactional", SQL: generated}},
+			}, nil
+		}
+		differ := func(context.Context, pgconn.Config, pgconn.Config, []string, ...func(*pgx.ConnConfig)) (string, error) {
+			t.Fatal("migra differ must not be called on the pg-delta path")
+			return "", nil
 		}
 		localConfig := pgconn.Config{
 			Host:     utils.Config.Hostname,
diff --git a/apps/cli-go/internal/db/diff/pgadmin.go b/apps/cli-go/internal/db/diff/pgadmin.go
index d53cd4660e..9f1a692971 100644
--- a/apps/cli-go/internal/db/diff/pgadmin.go
+++ b/apps/cli-go/internal/db/diff/pgadmin.go
@@ -5,6 +5,7 @@ import (
 	_ "embed"
 	"fmt"
 	"os"
+	"time"
 
 	"github.com/jackc/pgconn"
 	"github.com/spf13/afero"
@@ -17,13 +18,26 @@ import (
 var warnDiff = `WARNING: The diff tool is not foolproof, so you may need to manually rearrange and modify the generated migration.
 Run ` + utils.Aqua("supabase db reset") + ` to verify that the new migration does not generate errors.`
 
-func SaveDiff(out, file string, fsys afero.Fs) error {
+func SaveDiff(result DatabaseDiff, file string, fsys afero.Fs) error {
+	out := result.SQL
 	if len(out) < 2 {
 		fmt.Fprintln(os.Stderr, "No schema changes found")
 	} else if len(file) > 0 {
-		path := new.GetMigrationPath(utils.GetCurrentTimestamp(), file)
-		if err := utils.WriteFile(path, []byte(out), fsys); err != nil {
-			return err
+		// A pg-delta plan that crosses a transaction boundary yields more than one
+		// ordered unit; writing them into a single migration file would later fail
+		// when `db push`/`reset` applies it as one transaction. Write one migration
+		// file per unit in that case (Go's `WritePgDeltaMigrations`). The migra /
+		// pgadmin engines and single-unit pg-delta plans keep the exact single-file
+		// path, byte-identical to before.
+		if len(result.Files) > 1 {
+			if _, err := WritePgDeltaMigrations(result.Files, time.Now(), file, fsys); err != nil {
+				return err
+			}
+		} else {
+			path := new.GetMigrationPath(utils.GetCurrentTimestamp(), file)
+			if err := utils.WriteFile(path, []byte(out), fsys); err != nil {
+				return err
+			}
 		}
 		fmt.Fprintln(os.Stderr, warnDiff)
 	} else {
@@ -44,7 +58,7 @@ func RunPgAdmin(ctx context.Context, schema []string, file string, config pgconn
 		return err
 	}
 
-	return SaveDiff(output, file, fsys)
+	return SaveDiff(DatabaseDiff{SQL: output}, file, fsys)
 }
 
 var output string
diff --git a/apps/cli-go/internal/db/diff/pgadmin_test.go b/apps/cli-go/internal/db/diff/pgadmin_test.go
new file mode 100644
index 0000000000..7bf65e7d78
--- /dev/null
+++ b/apps/cli-go/internal/db/diff/pgadmin_test.go
@@ -0,0 +1,88 @@
+package diff
+
+import (
+	"testing"
+
+	"github.com/spf13/afero"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"github.com/supabase/cli/internal/utils"
+)
+
+func TestSaveDiff(t *testing.T) {
+	t.Run("reports no changes on empty diff", func(t *testing.T) {
+		fsys := afero.NewMemMapFs()
+		require.NoError(t, SaveDiff(DatabaseDiff{SQL: ""}, "my_diff", fsys))
+		// Nothing written when there are no schema changes.
+		entries, err := afero.ReadDir(fsys, utils.MigrationsDir)
+		assert.Error(t, err)
+		assert.Empty(t, entries)
+	})
+
+	t.Run("writes a single migration file for a single-unit plan", func(t *testing.T) {
+		fsys := afero.NewMemMapFs()
+		files := []PgDeltaPlanFile{
+			{Order: 1, Name: "schema_changes", TransactionMode: "transactional", SQL: "create table a ();"},
+		}
+		result := DatabaseDiff{SQL: joinPgDeltaFiles(files), Files: files}
+		require.NoError(t, SaveDiff(result, "my_diff", fsys))
+		entries, err := afero.ReadDir(fsys, utils.MigrationsDir)
+		require.NoError(t, err)
+		require.Len(t, entries, 1)
+		// A single-unit plan keeps the plain `<ts>_<name>.sql` name and the exact
+		// diff SQL, byte-identical to the pre-multi-file behavior (no trailing newline
+		// added, no unit-name suffix).
+		assert.Regexp(t, `^\d{14}_my_diff\.sql$`, entries[0].Name())
+		contents, err := afero.ReadFile(fsys, utils.MigrationsDir+"/"+entries[0].Name())
+		require.NoError(t, err)
+		assert.Equal(t, "create table a ();", string(contents))
+	})
+
+	t.Run("writes one migration file per unit for a multi-unit plan", func(t *testing.T) {
+		fsys := afero.NewMemMapFs()
+		files := []PgDeltaPlanFile{
+			{Order: 1, Name: "schema_changes", TransactionMode: "transactional", SQL: "alter type mood add value 'ok';"},
+			{Order: 2, Name: "after_enum_values", TransactionMode: "transactional", SQL: "insert into t values ('ok');"},
+		}
+		result := DatabaseDiff{SQL: joinPgDeltaFiles(files), Files: files}
+		require.NoError(t, SaveDiff(result, "my_diff", fsys))
+		entries, err := afero.ReadDir(fsys, utils.MigrationsDir)
+		require.NoError(t, err)
+		require.Len(t, entries, 2)
+		// Multi-unit plans split into one ordered file per unit, each suffixed with the
+		// unit name, so `db push`/`reset` applies each unit as its own transaction.
+		assert.Regexp(t, `^\d{14}_my_diff_schema_changes\.sql$`, entries[0].Name())
+		assert.Regexp(t, `^\d{14}_my_diff_after_enum_values\.sql$`, entries[1].Name())
+	})
+
+	t.Run("prints diff to stdout when no file is given", func(t *testing.T) {
+		fsys := afero.NewMemMapFs()
+		require.NoError(t, SaveDiff(DatabaseDiff{SQL: "create table a ();"}, "", fsys))
+		entries, _ := afero.ReadDir(fsys, utils.MigrationsDir)
+		assert.Empty(t, entries)
+	})
+
+	t.Run("creates nested parent directories for a nested single-unit name", func(t *testing.T) {
+		fsys := afero.NewMemMapFs()
+		require.NoError(t, SaveDiff(DatabaseDiff{SQL: "create table a ();"}, "snapshots/remote", fsys))
+		matches, err := afero.Glob(fsys, utils.MigrationsDir+"/*_snapshots/remote.sql")
+		require.NoError(t, err)
+		require.Len(t, matches, 1)
+		contents, err := afero.ReadFile(fsys, matches[0])
+		require.NoError(t, err)
+		assert.Equal(t, "create table a ();", string(contents))
+	})
+
+	t.Run("creates nested parent directories for a nested multi-unit name", func(t *testing.T) {
+		fsys := afero.NewMemMapFs()
+		files := []PgDeltaPlanFile{
+			{Order: 1, Name: "schema_changes", TransactionMode: "transactional", SQL: "alter type mood add value 'ok';"},
+			{Order: 2, Name: "after_enum_values", TransactionMode: "transactional", SQL: "insert into t values ('ok');"},
+		}
+		result := DatabaseDiff{SQL: joinPgDeltaFiles(files), Files: files}
+		require.NoError(t, SaveDiff(result, "snapshots/remote", fsys))
+		matches, err := afero.Glob(fsys, utils.MigrationsDir+"/*_snapshots/remote_*.sql")
+		require.NoError(t, err)
+		require.Len(t, matches, 2)
+	})
+}
diff --git a/apps/cli-go/internal/db/diff/pgdelta.go b/apps/cli-go/internal/db/diff/pgdelta.go
index d9d5edfc46..5267f0c6dd 100644
--- a/apps/cli-go/internal/db/diff/pgdelta.go
+++ b/apps/cli-go/internal/db/diff/pgdelta.go
@@ -43,6 +43,34 @@ type DeclarativeOutput struct {
 	Files   []DeclarativeFile `json:"files"`
 }
 
+// PgDeltaPlanFile is one execution-aware migration unit rendered by pg-delta's
+// renderPlanFiles: a numbered SQL file whose header comments record the unit
+// number, transaction mode and boundary reason.
+type PgDeltaPlanFile struct {
+	Order           int    `json:"order"`
+	Name            string `json:"name"`
+	TransactionMode string `json:"transactionMode"`
+	SQL             string `json:"sql"`
+}
+
+// PgDeltaDiffOutput is the top-level diff envelope emitted by templates/pgdelta.ts.
+type PgDeltaDiffOutput struct {
+	Version int               `json:"version"`
+	Files   []PgDeltaPlanFile `json:"files"`
+}
+
+// joinPgDeltaFiles flattens the per-unit files back into a single SQL string for
+// callers (db diff, declarative sync) that consume one blob. The per-unit header
+// comments keep the transaction boundaries visible in the reviewed output; empty
+// files produce an empty string, preserving "no changes" detection.
+func joinPgDeltaFiles(files []PgDeltaPlanFile) string {
+	blocks := make([]string, len(files))
+	for i, file := range files {
+		blocks[i] = file.SQL
+	}
+	return strings.Join(blocks, "\n\n")
+}
+
 func isPostgresURL(ref string) bool {
 	return strings.HasPrefix(ref, "postgres://") || strings.HasPrefix(ref, "postgresql://")
 }
@@ -101,7 +129,7 @@ func DiffPgDeltaRef(ctx context.Context, sourceRef, targetRef string, schema []s
 	if err != nil {
 		return "", err
 	}
-	return result.SQL, nil
+	return joinPgDeltaFiles(result.Files), nil
 }
 
 // DiffPgDeltaRefDetailed is like DiffPgDeltaRef but also returns edge-runtime stderr.
@@ -136,15 +164,37 @@ func DiffPgDeltaRefDetailed(ctx context.Context, sourceRef, targetRef string, sc
 	if err := utils.RunEdgeRuntimeScript(ctx, env, script, binds, "error diffing schema", &stdout, &stderr, utils.PgDeltaNpmRegistryOption()); err != nil {
 		return PgDeltaDiffResult{}, err
 	}
-	return PgDeltaDiffResult{
-		SQL:    stdout.String(),
-		Stderr: stderr.String(),
-	}, nil
+	return parsePgDeltaDiffOutput(stdout.String(), stderr.String())
+}
+
+// parsePgDeltaDiffOutput turns the pg-delta diff script's stdout envelope into a
+// result. The template always prints the envelope on the success path, even for
+// an empty plan (`{"version":1,"files":[]}`); a truly empty stdout means no
+// envelope was produced, which we surface as "no changes" (empty Files) rather
+// than an error. Non-empty stdout that is not valid envelope JSON is a parse
+// error carrying the edge-runtime stderr for diagnosis.
+func parsePgDeltaDiffOutput(stdout, stderr string) (PgDeltaDiffResult, error) {
+	result := PgDeltaDiffResult{Stderr: stderr}
+	if len(strings.TrimSpace(stdout)) == 0 {
+		return result, nil
+	}
+	var envelope PgDeltaDiffOutput
+	if err := json.Unmarshal([]byte(stdout), &envelope); err != nil {
+		return PgDeltaDiffResult{}, errors.Errorf("failed to parse pg-delta diff output: %w:\n%s", err, stderr)
+	}
+	result.Files = envelope.Files
+	return result, nil
 }
 
 // exportCatalogPgDelta is overridden in tests to mock catalog export.
 var exportCatalogPgDelta = ExportCatalogPgDelta
 
+// diffPgDeltaRefDetailed is the seam DiffDatabase uses for the pg-delta engine.
+// Tests override it to stub the real edge-runtime pipeline (which the injected
+// DiffFunc differ cannot, since pg-delta bypasses differ), the same pattern as
+// exportCatalogPgDelta above.
+var diffPgDeltaRefDetailed = DiffPgDeltaRefDetailed
+
 // DeclarativeExportPgDelta exports target schema as declarative file payloads
 // while keeping a config-based API for existing call sites.
 func DeclarativeExportPgDelta(ctx context.Context, source, target pgconn.Config, schema []string, formatOptions string, options ...func(*pgx.ConnConfig)) (DeclarativeOutput, error) {
diff --git a/apps/cli-go/internal/db/diff/pgdelta_debug.go b/apps/cli-go/internal/db/diff/pgdelta_debug.go
index b901edd5f7..1439018e80 100644
--- a/apps/cli-go/internal/db/diff/pgdelta_debug.go
+++ b/apps/cli-go/internal/db/diff/pgdelta_debug.go
@@ -17,9 +17,10 @@ func IsPgDeltaDebugEnabled() bool {
 	}
 }
 
-// PgDeltaDiffResult holds pg-delta diff output and edge-runtime stderr.
+// PgDeltaDiffResult holds the parsed pg-delta diff envelope (one file per
+// execution-aware plan unit) and the edge-runtime stderr.
 type PgDeltaDiffResult struct {
-	SQL    string
+	Files  []PgDeltaPlanFile
 	Stderr string
 }
 
@@ -31,7 +32,10 @@ type PgDeltaDebugCapture struct {
 
 // DatabaseDiff is the result of diffing a target database against a shadow baseline.
 type DatabaseDiff struct {
-	SQL   string
+	SQL string
+	// Files carries the per-unit pg-delta plan files (empty for the migra engine).
+	// SQL is the flattened join of these, kept for callers that consume one blob.
+	Files []PgDeltaPlanFile
 	Debug *PgDeltaDebugCapture
 }
 
diff --git a/apps/cli-go/internal/db/diff/pgdelta_migrations.go b/apps/cli-go/internal/db/diff/pgdelta_migrations.go
new file mode 100644
index 0000000000..c8f4a8b244
--- /dev/null
+++ b/apps/cli-go/internal/db/diff/pgdelta_migrations.go
@@ -0,0 +1,108 @@
+package diff
+
+import (
+	"os"
+	"path/filepath"
+	"time"
+
+	"github.com/go-errors/errors"
+	"github.com/spf13/afero"
+	"github.com/supabase/cli/internal/migration/new"
+	"github.com/supabase/cli/internal/utils"
+)
+
+// maxVersionCollisionAttempts bounds the base-timestamp bump retry so a directory
+// already full of same-second migrations can't spin forever.
+const maxVersionCollisionAttempts = 60
+
+// WrittenMigration is a migration file produced by a diff/pull, paired with the
+// version to record in the remote migration history.
+type WrittenMigration struct {
+	Path    string
+	Version string
+}
+
+// WritePgDeltaMigrations writes one ordered migration file per plan unit. A
+// single-unit plan (the common case) keeps the exact `<ts>_<name>.sql` filename;
+// multi-unit plans append the unit name and give each file a strictly increasing
+// timestamp (real time arithmetic on the base, never string increment) so their
+// execution order and migration-history order stay stable.
+//
+// Before writing anything, the FULL set of generated filenames is collision-checked
+// against the filesystem: if any target path already exists the base is advanced by
+// one second and every version recomputed, so the set stays strictly ascending AND
+// unique against pre-existing migrations. The base only ever moves forward — never
+// backdated below the caller's wall clock, since backdating could sort a new file
+// before pre-existing migrations. The resulting ≤N−1s future-dating is inherent to
+// second-granularity versions and acceptable once uniqueness is enforced.
+func WritePgDeltaMigrations(files []PgDeltaPlanFile, base time.Time, name string, fsys afero.Fs) (_ []WrittenMigration, err error) {
+	single := len(files) == 1
+	buildSet := func(b time.Time) []WrittenMigration {
+		set := make([]WrittenMigration, len(files))
+		for i, file := range files {
+			version := utils.GetVersionTimestamp(b.Add(time.Duration(i) * time.Second))
+			fileName := name
+			if !single {
+				fileName = name + "_" + file.Name
+			}
+			set[i] = WrittenMigration{Path: new.GetMigrationPath(version, fileName), Version: version}
+		}
+		return set
+	}
+
+	set := buildSet(base)
+	for attempt := 0; ; attempt++ {
+		collision := false
+		for _, w := range set {
+			exists, err := afero.Exists(fsys, w.Path)
+			if err != nil {
+				return nil, errors.Errorf("failed to check migration file: %w", err)
+			}
+			if exists {
+				collision = true
+				break
+			}
+		}
+		if !collision {
+			break
+		}
+		if attempt+1 >= maxVersionCollisionAttempts {
+			return nil, errors.Errorf("failed to find a unique migration version after %d attempts", maxVersionCollisionAttempts)
+		}
+		base = base.Add(time.Second)
+		set = buildSet(base)
+	}
+
+	written := make([]WrittenMigration, 0, len(files))
+	// Best-effort cleanup: if any open/write fails mid-loop, remove every file this
+	// invocation already wrote so a partial multi-file migration isn't left behind.
+	// A removal failure never masks the original error.
+	defer func() {
+		if err != nil {
+			for _, w := range written {
+				_ = fsys.Remove(w.Path)
+			}
+		}
+	}()
+	for i, file := range files {
+		w := set[i]
+		if err = utils.MkdirIfNotExistFS(fsys, filepath.Dir(w.Path)); err != nil {
+			return nil, err
+		}
+		// O_EXCL (not O_TRUNC): a race that created the file between the collision
+		// check and here must never silently overwrite an existing migration.
+		f, openErr := fsys.OpenFile(w.Path, os.O_WRONLY|os.O_CREATE|os.O_EXCL, 0644)
+		if openErr != nil {
+			err = errors.Errorf("failed to open migration file: %w", openErr)
+			return nil, err
+		}
+		if _, writeErr := f.WriteString(file.SQL + "\n"); writeErr != nil {
+			f.Close()
+			err = errors.Errorf("failed to write migration file: %w", writeErr)
+			return nil, err
+		}
+		f.Close()
+		written = append(written, w)
+	}
+	return written, nil
+}
diff --git a/apps/cli-go/internal/db/diff/pgdelta_migrations_test.go b/apps/cli-go/internal/db/diff/pgdelta_migrations_test.go
new file mode 100644
index 0000000000..16ace1b7ff
--- /dev/null
+++ b/apps/cli-go/internal/db/diff/pgdelta_migrations_test.go
@@ -0,0 +1,133 @@
+package diff
+
+import (
+	"os"
+	"testing"
+	"time"
+
+	"github.com/go-errors/errors"
+	"github.com/spf13/afero"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"github.com/supabase/cli/internal/migration/new"
+)
+
+// failOnNthOpenFs fails the Nth create-for-write OpenFile so a mid-loop write
+// failure can be exercised deterministically. Stat/mkdir/read calls pass through.
+type failOnNthOpenFs struct {
+	afero.Fs
+	failOn int
+	count  int
+}
+
+func (f *failOnNthOpenFs) OpenFile(name string, flag int, perm os.FileMode) (afero.File, error) {
+	if flag&os.O_CREATE != 0 {
+		f.count++
+		if f.count == f.failOn {
+			return nil, errors.New("simulated open failure")
+		}
+	}
+	return f.Fs.OpenFile(name, flag, perm)
+}
+
+func TestWritePgDeltaMigrations(t *testing.T) {
+	base := time.Date(2026, 7, 17, 15, 18, 48, 0, time.UTC)
+
+	t.Run("writes a single unit with the unchanged name", func(t *testing.T) {
+		fsys := afero.NewMemMapFs()
+		files := []PgDeltaPlanFile{
+			{Order: 1, Name: "schema_changes", TransactionMode: "transactional", SQL: "-- unit 1\n\ncreate table a ();"},
+		}
+		written, err := WritePgDeltaMigrations(files, base, "remote_schema", fsys)
+		require.NoError(t, err)
+		require.Len(t, written, 1)
+		assert.Equal(t, "20260717151848", written[0].Version)
+		expectedPath := new.GetMigrationPath("20260717151848", "remote_schema")
+		assert.Equal(t, expectedPath, written[0].Path)
+		contents, err := afero.ReadFile(fsys, expectedPath)
+		require.NoError(t, err)
+		assert.Equal(t, "-- unit 1\n\ncreate table a ();\n", string(contents))
+	})
+
+	t.Run("writes one ordered file per unit with strictly increasing versions", func(t *testing.T) {
+		fsys := afero.NewMemMapFs()
+		files := []PgDeltaPlanFile{
+			{Order: 1, Name: "schema_changes", TransactionMode: "transactional", SQL: "-- unit 1\n\nalter type mood add value 'ok';"},
+			{Order: 2, Name: "after_enum_values", TransactionMode: "transactional", SQL: "-- unit 2\n\ninsert into t values ('ok');"},
+			{Order: 3, Name: "non_transactional", TransactionMode: "none", SQL: "-- unit 3\n\ncreate index concurrently i on t (c);"},
+		}
+		written, err := WritePgDeltaMigrations(files, base, "remote_schema", fsys)
+		require.NoError(t, err)
+		require.Len(t, written, 3)
+
+		wantVersions := []string{"20260717151848", "20260717151849", "20260717151850"}
+		wantNames := []string{"remote_schema_schema_changes", "remote_schema_after_enum_values", "remote_schema_non_transactional"}
+		for i, w := range written {
+			assert.Equal(t, wantVersions[i], w.Version)
+			assert.Equal(t, new.GetMigrationPath(wantVersions[i], wantNames[i]), w.Path)
+			contents, err := afero.ReadFile(fsys, w.Path)
+			require.NoError(t, err)
+			assert.Equal(t, files[i].SQL+"\n", string(contents))
+		}
+		// Versions are strictly increasing so history + execution order stay stable.
+		assert.True(t, written[0].Version < written[1].Version)
+		assert.True(t, written[1].Version < written[2].Version)
+	})
+
+	t.Run("creates nested parent directories for a nested migration name", func(t *testing.T) {
+		fsys := afero.NewMemMapFs()
+		files := []PgDeltaPlanFile{
+			{Order: 1, Name: "schema_changes", TransactionMode: "transactional", SQL: "create table a ();"},
+			{Order: 2, Name: "after_enum_values", TransactionMode: "transactional", SQL: "insert into t values ('ok');"},
+		}
+		written, err := WritePgDeltaMigrations(files, base, "snapshots/remote", fsys)
+		require.NoError(t, err)
+		require.Len(t, written, 2)
+		for i, w := range written {
+			contents, err := afero.ReadFile(fsys, w.Path)
+			require.NoError(t, err)
+			assert.Equal(t, files[i].SQL+"\n", string(contents))
+		}
+	})
+
+	t.Run("bumps the base version when a target file already exists", func(t *testing.T) {
+		fsys := afero.NewMemMapFs()
+		files := []PgDeltaPlanFile{
+			{Order: 1, Name: "schema_changes", TransactionMode: "transactional", SQL: "create table a ();"},
+			{Order: 2, Name: "after_enum_values", TransactionMode: "transactional", SQL: "insert into t values ('ok');"},
+		}
+		// Pre-existing migration at the first version the base would otherwise use.
+		existing := new.GetMigrationPath("20260717151848", "remote_schema_schema_changes")
+		require.NoError(t, afero.WriteFile(fsys, existing, []byte("-- pre-existing\n"), 0644))
+
+		written, err := WritePgDeltaMigrations(files, base, "remote_schema", fsys)
+		require.NoError(t, err)
+		require.Len(t, written, 2)
+		// The whole set advances one second so it skips the colliding version and
+		// stays strictly ascending against the pre-existing file.
+		assert.Equal(t, "20260717151849", written[0].Version)
+		assert.Equal(t, "20260717151850", written[1].Version)
+		assert.True(t, written[0].Version < written[1].Version)
+		// The pre-existing file is untouched (never overwritten).
+		contents, err := afero.ReadFile(fsys, existing)
+		require.NoError(t, err)
+		assert.Equal(t, "-- pre-existing\n", string(contents))
+	})
+
+	t.Run("removes already-written files when a later write fails", func(t *testing.T) {
+		fsys := &failOnNthOpenFs{Fs: afero.NewMemMapFs(), failOn: 2}
+		files := []PgDeltaPlanFile{
+			{Order: 1, Name: "schema_changes", TransactionMode: "transactional", SQL: "create table a ();"},
+			{Order: 2, Name: "after_enum_values", TransactionMode: "transactional", SQL: "insert into t values ('ok');"},
+		}
+		written, err := WritePgDeltaMigrations(files, base, "remote_schema", fsys)
+		require.Error(t, err)
+		assert.Nil(t, written)
+		// The first unit's file was written then removed on the failure, so nothing
+		// from this invocation is left behind.
+		first := new.GetMigrationPath("20260717151848", "remote_schema_schema_changes")
+		exists, statErr := afero.Exists(fsys, first)
+		require.NoError(t, statErr)
+		assert.False(t, exists)
+	})
+}
diff --git a/apps/cli-go/internal/db/diff/pgdelta_test.go b/apps/cli-go/internal/db/diff/pgdelta_test.go
index 671414a069..ad312273c5 100644
--- a/apps/cli-go/internal/db/diff/pgdelta_test.go
+++ b/apps/cli-go/internal/db/diff/pgdelta_test.go
@@ -32,3 +32,40 @@ func TestContainerRef(t *testing.T) {
 		assert.Equal(t, "/workspace/supabase/.temp/pgdelta/catalog-baseline-17.6.1.106.json", containerRef(ref))
 	})
 }
+
+func TestParsePgDeltaDiffOutput(t *testing.T) {
+	t.Run("parses a multi-file envelope", func(t *testing.T) {
+		stdout := `{"version":1,"files":[` +
+			`{"order":1,"name":"schema_changes","transactionMode":"transactional","sql":"-- unit 1\n\nCREATE TABLE a ();"},` +
+			`{"order":2,"name":"after_enum_values","transactionMode":"transactional","sql":"-- unit 2\n\nINSERT INTO a VALUES (1);"}` +
+			`]}`
+		result, err := parsePgDeltaDiffOutput(stdout, "debug stderr")
+		assert.NoError(t, err)
+		assert.Equal(t, "debug stderr", result.Stderr)
+		assert.Len(t, result.Files, 2)
+		assert.Equal(t, PgDeltaPlanFile{Order: 1, Name: "schema_changes", TransactionMode: "transactional", SQL: "-- unit 1\n\nCREATE TABLE a ();"}, result.Files[0])
+		assert.Equal(t, "after_enum_values", result.Files[1].Name)
+		// The flattened join keeps unit boundaries visible via header comments.
+		assert.Equal(t, "-- unit 1\n\nCREATE TABLE a ();\n\n-- unit 2\n\nINSERT INTO a VALUES (1);", joinPgDeltaFiles(result.Files))
+	})
+
+	t.Run("treats an empty envelope as no changes", func(t *testing.T) {
+		result, err := parsePgDeltaDiffOutput(`{"version":1,"files":[]}`, "")
+		assert.NoError(t, err)
+		assert.Empty(t, result.Files)
+		assert.Equal(t, "", joinPgDeltaFiles(result.Files))
+	})
+
+	t.Run("treats empty stdout as no changes", func(t *testing.T) {
+		result, err := parsePgDeltaDiffOutput("   \n", "")
+		assert.NoError(t, err)
+		assert.Empty(t, result.Files)
+	})
+
+	t.Run("fails on malformed json and embeds stderr", func(t *testing.T) {
+		_, err := parsePgDeltaDiffOutput("not json", "boom on the edge runtime")
+		assert.Error(t, err)
+		assert.ErrorContains(t, err, "failed to parse pg-delta diff output")
+		assert.ErrorContains(t, err, "boom on the edge runtime")
+	})
+}
diff --git a/apps/cli-go/internal/db/diff/templates/pgdelta.ts b/apps/cli-go/internal/db/diff/templates/pgdelta.ts
index 0fd9d00e30..2a9d2d3f2a 100644
--- a/apps/cli-go/internal/db/diff/templates/pgdelta.ts
+++ b/apps/cli-go/internal/db/diff/templates/pgdelta.ts
@@ -1,7 +1,7 @@
 import {
   createPlan,
   deserializeCatalog,
-  formatSqlStatements,
+  renderPlanFiles,
 } from "npm:@supabase/pg-delta@1.0.0-alpha.20";
 import { supabase } from "npm:@supabase/pg-delta@1.0.0-alpha.20/integrations/supabase";
 
@@ -32,10 +32,19 @@ if (includedSchemas) {
 }
 
 const formatOptionsRaw = Deno.env.get("FORMAT_OPTIONS");
-let formatOptions = undefined;
-if (formatOptionsRaw) {
-  formatOptions = JSON.parse(formatOptionsRaw);
-}
+const parsedFormatOptions = formatOptionsRaw ? JSON.parse(formatOptionsRaw) : undefined;
+// Format the emitted SQL by default with the same sensible settings the
+// declarative export uses (`exportDeclarativeSchema` in @supabase/pg-delta:
+// `{ ...DEFAULT_OPTIONS, maxWidth: 180, keywordCase: "upper", ...userOptions }`),
+// so `db pull` / `db diff` produce readable migrations even when config sets no
+// `[experimental.pgdelta] format_options`. The formatter fills DEFAULT_OPTIONS
+// for missing keys itself, so only the two overrides are passed here. Setting
+// `format_options = "null"` (parsed to `null`) is the explicit opt-out: raw,
+// unformatted statements, mirroring declarative export's `formatOptions === null`.
+const sqlFormatOptions =
+  parsedFormatOptions === null
+    ? undefined
+    : { maxWidth: 180, keywordCase: "upper", ...parsedFormatOptions };
 
 try {
   const result = await createPlan(
@@ -46,14 +55,32 @@ try {
       skipDefaultPrivilegeSubtraction: true,
     },
   );
-  let statements = result?.plan.statements ?? [];
-  if (formatOptions != null) {
-    statements = formatSqlStatements(statements, formatOptions);
-  }
+  // pg-delta >= 1.0.0-alpha.32 groups plan statements into execution-aware
+  // `units` with transaction boundaries. `renderPlanFiles` turns those into one
+  // numbered SQL file per unit (header comments included). `includeTransactions:
+  // false` because the CLI appliers already wrap each migration file in a single
+  // transaction (Go's implicit ExecBatch / the TS BEGIN/COMMIT wrap), so embedded
+  // BEGIN/COMMIT would nest; format options are applied per unit here instead of a
+  // manual `formatSqlStatements` pass.
+  const files = result
+    ? renderPlanFiles(result.plan, {
+        includeTransactions: false,
+        sqlFormatOptions,
+      })
+    : [];
+  const envelope = files.map((file, index) => ({
+    order: index + 1,
+    // The unit name is the rendered path minus its numeric prefix and `.sql`
+    // extension (e.g. `001_after_enum_values.sql` -> `after_enum_values`).
+    name: file.path.replace(/^\d+_/, "").replace(/\.sql$/, ""),
+    transactionMode: file.unit.transactionMode,
+    sql: file.sql,
+  }));
   if (Deno.env.get("PGDELTA_DEBUG")) {
     console.error(
       JSON.stringify({
-        statementCount: statements.length,
+        statementCount: files.reduce((total, file) => total + file.unit.statements.length, 0),
+        fileCount: files.length,
         source: source ? "connected" : "null",
         target: target ? "connected" : "null",
         includedSchemas: includedSchemas ?? null,
@@ -61,11 +88,13 @@ try {
       }),
     );
   }
-  for (const sql of statements) {
-    console.log(`${sql};`);
-  }
+  console.log(JSON.stringify({ version: 1, files: envelope }));
 } catch (e) {
   console.error(e);
+  // Emit a sentinel so the CLI runner can distinguish a real script crash from a
+  // successful empty diff, even though the forced-exit non-zero code below is
+  // suppressed by the "main worker has been destroyed" handling.
+  console.error("PGDELTA_SCRIPT_ERROR");
   // Force close event loop
   throw new Error("");
 }
diff --git a/apps/cli-go/internal/db/diff/templates/pgdelta_catalog_export.ts b/apps/cli-go/internal/db/diff/templates/pgdelta_catalog_export.ts
index 6b7d426ce1..dfecc58da1 100644
--- a/apps/cli-go/internal/db/diff/templates/pgdelta_catalog_export.ts
+++ b/apps/cli-go/internal/db/diff/templates/pgdelta_catalog_export.ts
@@ -12,6 +12,10 @@ const role = Deno.env.get("ROLE") ?? undefined;
 
 if (!target) {
   console.error("TARGET is required");
+  // Emit a sentinel so the CLI runner treats this as a real script crash rather
+  // than a successful empty catalog, even though the forced-exit non-zero code is
+  // suppressed by the "main worker has been destroyed" handling.
+  console.error("PGDELTA_SCRIPT_ERROR");
   throw new Error("");
 }
 const { pool, close } = await createManagedPool(target, { role });
@@ -21,6 +25,10 @@ try {
   console.log(stringifyCatalogSnapshot(serializeCatalog(catalog)));
 } catch (e) {
   console.error(e);
+  // Emit a sentinel so the CLI runner can distinguish a real script crash from a
+  // successful empty catalog, even though the forced-exit non-zero code below is
+  // suppressed by the "main worker has been destroyed" handling.
+  console.error("PGDELTA_SCRIPT_ERROR");
   // Force close event loop
   throw new Error("");
 } finally {
diff --git a/apps/cli-go/internal/db/diff/templates/pgdelta_declarative_export.ts b/apps/cli-go/internal/db/diff/templates/pgdelta_declarative_export.ts
index 4656e4690e..18820ff7b9 100644
--- a/apps/cli-go/internal/db/diff/templates/pgdelta_declarative_export.ts
+++ b/apps/cli-go/internal/db/diff/templates/pgdelta_declarative_export.ts
@@ -68,6 +68,10 @@ try {
   }
 } catch (e) {
   console.error(e);
+  // Emit a sentinel so the CLI runner can distinguish a real script crash from a
+  // successful empty export, even though the forced-exit non-zero code below is
+  // suppressed by the "main worker has been destroyed" handling.
+  console.error("PGDELTA_SCRIPT_ERROR");
   // Force close event loop
   throw new Error("");
 }
diff --git a/apps/cli-go/internal/db/pgcache/cache.go b/apps/cli-go/internal/db/pgcache/cache.go
index 52960c9b06..3cc1ccd4b4 100644
--- a/apps/cli-go/internal/db/pgcache/cache.go
+++ b/apps/cli-go/internal/db/pgcache/cache.go
@@ -6,6 +6,7 @@ import (
 	"crypto/sha256"
 	"encoding/hex"
 	"fmt"
+	"os"
 	"path/filepath"
 	"regexp"
 	"sort"
@@ -261,6 +262,9 @@ func exportCatalog(ctx context.Context, targetRef string, options ...func(*pgx.C
 	}
 	env := append([]string{"TARGET=" + preparedRef, "ROLE=postgres"}, sslEnv...)
 	binds := []string{utils.EdgeRuntimeId + ":/root/.cache/deno:rw"}
+	if cwd, err := os.Getwd(); err == nil {
+		binds = append(binds, cwd+":/workspace")
+	}
 	var stdout, stderr bytes.Buffer
 	script := config.InterpolatePgDeltaScript(config.Config(&utils.Config), pgDeltaCatalogExportTS)
 	if err := utils.RunEdgeRuntimeScript(ctx, env, script, binds, "error exporting pg-delta catalog", &stdout, &stderr, utils.PgDeltaNpmRegistryOption()); err != nil {
diff --git a/apps/cli-go/internal/db/pull/pull.go b/apps/cli-go/internal/db/pull/pull.go
index 07503687a7..21e0db87f0 100644
--- a/apps/cli-go/internal/db/pull/pull.go
+++ b/apps/cli-go/internal/db/pull/pull.go
@@ -11,6 +11,7 @@ import (
 	"path/filepath"
 	"strconv"
 	"strings"
+	"time"
 
 	"github.com/go-errors/errors"
 	"github.com/jackc/pgconn"
@@ -59,21 +60,26 @@ func Run(ctx context.Context, schema []string, config pgconn.Config, name string
 		// TODO: handle managed schemas
 		return format.WriteStructuredSchemas(ctx, &buf, fsys)
 	}
-	// 2. Pull schema
-	timestamp := utils.GetCurrentTimestamp()
-	path := new.GetMigrationPath(timestamp, name)
-	if err := run(ctx, schema, path, conn, usePgDeltaDiff, differ, fsys, options...); err != nil {
+	// 2. Pull schema. pg-delta plans with transaction boundaries produce more than
+	// one ordered migration file; migra always produces exactly one.
+	base := time.Now().UTC()
+	written, err := run(ctx, schema, base, name, conn, usePgDeltaDiff, differ, fsys, options...)
+	if err != nil {
 		return err
 	}
-	if err := ensureMigrationWritten(fsys, path); err != nil {
-		return err
+	if len(written) == 0 {
+		return errors.New(errInSync)
+	}
+	// 3. Insert a row to `schema_migrations` for every file written.
+	versions := make([]string, len(written))
+	for i, w := range written {
+		fmt.Fprintln(os.Stderr, "Schema written to "+utils.Bold(w.Path))
+		versions[i] = w.Version
 	}
-	// 3. Insert a row to `schema_migrations`
-	fmt.Fprintln(os.Stderr, "Schema written to "+utils.Bold(path))
 	if shouldUpdate, err := utils.NewConsole().PromptYesNo(ctx, "Update remote migration history table?", true); err != nil {
 		return err
 	} else if shouldUpdate {
-		return repair.UpdateMigrationTable(ctx, conn, []string{timestamp}, repair.Applied, false, fsys)
+		return repair.UpdateMigrationTable(ctx, conn, versions, repair.Applied, false, fsys)
 	}
 	return nil
 }
@@ -114,8 +120,10 @@ func pullDeclarativePgDelta(ctx context.Context, schema []string, config pgconn.
 	return nil
 }
 
-func run(ctx context.Context, schema []string, path string, conn *pgx.Conn, usePgDeltaDiff bool, differ diff.DiffFunc, fsys afero.Fs, options ...func(*pgx.ConnConfig)) error {
+func run(ctx context.Context, schema []string, base time.Time, name string, conn *pgx.Conn, usePgDeltaDiff bool, differ diff.DiffFunc, fsys afero.Fs, options ...func(*pgx.ConnConfig)) ([]diff.WrittenMigration, error) {
 	config := conn.Config().Config
+	timestamp := utils.GetVersionTimestamp(base)
+	path := new.GetMigrationPath(timestamp, name)
 	// 1. Assert `supabase/migrations` and `schema_migrations` are in sync.
 	if err := assertRemoteInSync(ctx, conn, fsys); errors.Is(err, errMissing) {
 		// pg_dump strips ownership when restored as a non-superuser, so platform
@@ -126,19 +134,27 @@ func run(ctx context.Context, schema []string, path string, conn *pgx.Conn, useP
 		if !usePgDeltaDiff {
 			// Ignore schemas flag when working on the initial pull
 			if err = dumpRemoteSchema(ctx, path, config, fsys); err != nil {
-				return err
+				return nil, err
 			}
 		}
 		// For the legacy path this is a second pass that captures changes
 		// pg_dump cannot emit (default privileges, managed schemas). For the
 		// pg-delta path this is the only pass and produces the full schema.
-		err = swallowInitialInSync(diffRemoteSchema(ctx, nil, path, config, usePgDeltaDiff, differ, fsys, options...), fsys, path)
-		return err
+		written, err := diffRemoteSchema(ctx, nil, base, name, config, usePgDeltaDiff, differ, fsys, options...)
+		if err = swallowInitialInSync(err, fsys, path); err != nil {
+			return nil, err
+		}
+		// The migra initial pull seeds `path` with a pg_dump even when the follow-up
+		// diff is empty and swallowed above, so record that single migration.
+		if !usePgDeltaDiff && len(written) == 0 {
+			written = []diff.WrittenMigration{{Path: path, Version: timestamp}}
+		}
+		return written, nil
 	} else if err != nil {
-		return err
+		return nil, err
 	}
 	// 2. Fetch remote schema changes
-	return diffRemoteSchema(ctx, schema, path, config, usePgDeltaDiff, differ, fsys, options...)
+	return diffRemoteSchema(ctx, schema, base, name, config, usePgDeltaDiff, differ, fsys, options...)
 }
 
 func dumpRemoteSchema(ctx context.Context, path string, config pgconn.Config, fsys afero.Fs) error {
@@ -157,7 +173,7 @@ func dumpRemoteSchema(ctx context.Context, path string, config pgconn.Config, fs
 	})
 }
 
-func diffRemoteSchema(ctx context.Context, schema []string, path string, config pgconn.Config, usePgDeltaDiff bool, differ diff.DiffFunc, fsys afero.Fs, options ...func(*pgx.ConnConfig)) error {
+func diffRemoteSchema(ctx context.Context, schema []string, base time.Time, name string, config pgconn.Config, usePgDeltaDiff bool, differ diff.DiffFunc, fsys afero.Fs, options ...func(*pgx.ConnConfig)) ([]diff.WrittenMigration, error) {
 	// Diff remote db (source) & shadow db (target) and write it as a new migration.
 	result, err := diff.DiffDatabase(ctx, schema, config, os.Stderr, fsys, differ, usePgDeltaDiff, options...)
 	if err != nil {
@@ -166,37 +182,47 @@ func diffRemoteSchema(ctx context.Context, schema []string, path string, config
 		// so the whole db pull workflow is self-healing, not just the dump pass.
 		poolerConfig, ok := dump.PoolerFallbackConfig(ctx, config, err)
 		if !ok {
-			return err
+			return nil, err
 		}
 		if result, err = diff.DiffDatabase(ctx, schema, poolerConfig, os.Stderr, fsys, differ, usePgDeltaDiff, options...); err != nil {
-			return err
+			return nil, err
 		}
 	}
-	output := result.SQL
-	if trimmed := strings.TrimSpace(output); len(trimmed) == 0 {
-		if usePgDeltaDiff && diff.IsPgDeltaDebugEnabled() {
-			if debugDir, debugErr := saveEmptyPgDeltaPullDebug(ctx, config, result.Debug, fsys, options...); debugErr != nil {
-				fmt.Fprintf(os.Stderr, "Warning: failed to save pg-delta debug bundle: %v\n", debugErr)
-			} else if len(debugDir) > 0 {
-				return errors.Errorf("%w (debug bundle: %s)", errInSync, debugDir)
+	// pg-delta path: one migration file per execution-aware plan unit.
+	if usePgDeltaDiff {
+		if len(result.Files) == 0 {
+			if diff.IsPgDeltaDebugEnabled() {
+				if debugDir, debugErr := saveEmptyPgDeltaPullDebug(ctx, config, result.Debug, fsys, options...); debugErr != nil {
+					fmt.Fprintf(os.Stderr, "Warning: failed to save pg-delta debug bundle: %v\n", debugErr)
+				} else if len(debugDir) > 0 {
+					return nil, errors.Errorf("%w (debug bundle: %s)", errInSync, debugDir)
+				}
 			}
+			return nil, errors.New(errInSync)
 		}
-		return errors.New(errInSync)
+		return diff.WritePgDeltaMigrations(result.Files, base, name, fsys)
 	}
+	// migra path: a single migration file, appended when seeded by dumpRemoteSchema.
+	output := result.SQL
+	if trimmed := strings.TrimSpace(output); len(trimmed) == 0 {
+		return nil, errors.New(errInSync)
+	}
+	timestamp := utils.GetVersionTimestamp(base)
+	path := new.GetMigrationPath(timestamp, name)
 	if err := utils.MkdirIfNotExistFS(fsys, filepath.Dir(path)); err != nil {
-		return err
+		return nil, err
 	}
 	// Append to existing migration file when we run this after dumpRemoteSchema;
-	// for the pg-delta path this is the only writer and creates the file fresh.
+	// for a non-initial pull this creates the file fresh.
 	f, err := fsys.OpenFile(path, os.O_WRONLY|os.O_CREATE|os.O_APPEND, 0644)
 	if err != nil {
-		return errors.Errorf("failed to open migration file: %w", err)
+		return nil, errors.Errorf("failed to open migration file: %w", err)
 	}
 	defer f.Close()
 	if _, err := f.WriteString(output); err != nil {
-		return errors.Errorf("failed to write migration file: %w", err)
+		return nil, errors.Errorf("failed to write migration file: %w", err)
 	}
-	return nil
+	return []diff.WrittenMigration{{Path: path, Version: timestamp}}, nil
 }
 
 func assertRemoteInSync(ctx context.Context, conn *pgx.Conn, fsys afero.Fs) error {
diff --git a/apps/cli-go/internal/db/pull/pull_test.go b/apps/cli-go/internal/db/pull/pull_test.go
index e9fbae9198..ec3e784f83 100644
--- a/apps/cli-go/internal/db/pull/pull_test.go
+++ b/apps/cli-go/internal/db/pull/pull_test.go
@@ -6,6 +6,7 @@ import (
 	"os"
 	"path/filepath"
 	"testing"
+	"time"
 
 	"github.com/h2non/gock"
 	"github.com/jackc/pgconn"
@@ -14,6 +15,7 @@ import (
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	"github.com/supabase/cli/internal/db/diff"
+	"github.com/supabase/cli/internal/migration/new"
 	"github.com/supabase/cli/internal/testing/apitest"
 	"github.com/supabase/cli/internal/testing/fstest"
 	"github.com/supabase/cli/internal/utils"
@@ -75,11 +77,13 @@ func TestPullSchema(t *testing.T) {
 		conn.Query(migration.LIST_MIGRATION_VERSION).
 			Reply("SELECT 0")
 		// Run test
-		err := run(context.Background(), nil, "0_test.sql", conn.MockClient(t), false, diff.DiffSchemaMigra, fsys)
+		base := time.Date(2024, 1, 1, 0, 0, 0, 0, time.UTC)
+		path := new.GetMigrationPath(utils.GetVersionTimestamp(base), "test")
+		_, err := run(context.Background(), nil, base, "test", conn.MockClient(t), false, diff.DiffSchemaMigra, fsys)
 		// Check error
 		assert.ErrorIs(t, err, errNetwork)
 		assert.Empty(t, apitest.ListUnmatchedRequests())
-		contents, err := afero.ReadFile(fsys, "0_test.sql")
+		contents, err := afero.ReadFile(fsys, path)
 		assert.NoError(t, err)
 		assert.Equal(t, []byte("test"), contents)
 	})
@@ -102,12 +106,14 @@ func TestPullSchema(t *testing.T) {
 		conn.Query(migration.LIST_MIGRATION_VERSION).
 			Reply("SELECT 0")
 		// Run test with usePgDeltaDiff=true
-		err := run(context.Background(), nil, "0_test.sql", conn.MockClient(t), true, diff.DiffPgDelta, fsys)
+		base := time.Date(2024, 1, 1, 0, 0, 0, 0, time.UTC)
+		path := new.GetMigrationPath(utils.GetVersionTimestamp(base), "test")
+		_, err := run(context.Background(), nil, base, "test", conn.MockClient(t), true, diff.DiffPgDelta, fsys)
 		// Failure must come from shadow-creation image inspect (proving we
 		// reached the diff step), not from pg_dump.
 		assert.ErrorIs(t, err, errNetwork)
 		assert.Empty(t, apitest.ListUnmatchedRequests())
-		exists, err := afero.Exists(fsys, "0_test.sql")
+		exists, err := afero.Exists(fsys, path)
 		assert.NoError(t, err)
 		assert.False(t, exists, "pg_dump should be skipped for pg-delta diff engine")
 	})
@@ -129,7 +135,8 @@ func TestPullSchema(t *testing.T) {
 		conn.Query(migration.LIST_MIGRATION_VERSION).
 			Reply("SELECT 1", []any{"0"})
 		// Run test
-		err := run(context.Background(), []string{"public"}, "", conn.MockClient(t), false, diff.DiffSchemaMigra, fsys)
+		base := time.Date(2024, 1, 1, 0, 0, 0, 0, time.UTC)
+		_, err := run(context.Background(), []string{"public"}, base, "test", conn.MockClient(t), false, diff.DiffSchemaMigra, fsys)
 		// Check error
 		assert.ErrorContains(t, err, "network error")
 		assert.Empty(t, apitest.ListUnmatchedRequests())
diff --git a/apps/cli-go/internal/db/reset/reset.go b/apps/cli-go/internal/db/reset/reset.go
index 7d841f4ba3..765153d6d7 100644
--- a/apps/cli-go/internal/db/reset/reset.go
+++ b/apps/cli-go/internal/db/reset/reset.go
@@ -92,6 +92,38 @@ func toLogMessage(version string) string {
 	return "..."
 }
 
+// RecreateLocalDatabase is the container-lifecycle half of a local `db reset`,
+// exposed for the native-TypeScript `db reset --local` seam (cmd db __db-bootstrap).
+// It performs the PG14/PG15 branch — recreate the db container/volume, init schema,
+// migrate + seed, and restart the satellite containers — WITHOUT the leading
+// "Resetting local database…" line, which the TS caller prints itself. Mirrors
+// resetDatabase (above) minus that message.
+func RecreateLocalDatabase(ctx context.Context, version string, fsys afero.Fs, options ...func(*pgx.ConnConfig)) error {
+	if utils.Config.Db.MajorVersion <= 14 {
+		return resetDatabase14(ctx, version, fsys, options...)
+	}
+	return resetDatabase15(ctx, version, fsys, options...)
+}
+
+// AwaitStorageReady mirrors the storage-health gate that local `db reset` runs
+// before seeding buckets (Run, above): if the storage container exists but is not
+// healthy, wait up to 30s for it. It reports whether the storage container exists
+// so the native-TypeScript caller knows whether to run the (already-ported) bucket
+// seeding. Any inspect error is treated as "storage not running" → false, matching
+// Go's `err == nil` gate, which silently skips buckets on any inspect failure.
+func AwaitStorageReady(ctx context.Context) (bool, error) {
+	resp, err := utils.Docker.ContainerInspect(ctx, utils.StorageId)
+	if err != nil {
+		return false, nil
+	}
+	if resp.State.Health == nil || resp.State.Health.Status != types.Healthy {
+		if err := start.WaitForHealthyService(ctx, 30*time.Second, utils.StorageId); err != nil {
+			return false, err
+		}
+	}
+	return true, nil
+}
+
 func resetDatabase14(ctx context.Context, version string, fsys afero.Fs, options ...func(*pgx.ConnConfig)) error {
 	if err := recreateDatabase(ctx, options...); err != nil {
 		return err
diff --git a/apps/cli-go/internal/functions/download/download.go b/apps/cli-go/internal/functions/download/download.go
index 74d0c13e4d..3e3737ba1e 100644
--- a/apps/cli-go/internal/functions/download/download.go
+++ b/apps/cli-go/internal/functions/download/download.go
@@ -23,6 +23,7 @@ import (
 	"github.com/docker/docker/api/types/network"
 	"github.com/docker/go-units"
 	"github.com/go-errors/errors"
+	"github.com/google/uuid"
 	"github.com/spf13/afero"
 	"github.com/spf13/viper"
 	"github.com/supabase/cli/internal/utils"
@@ -35,6 +36,15 @@ var (
 	legacyImportMapPath  = "file:///src/import_map.json"
 )
 
+// ErrUnsafeDownloadPath is returned when a downloaded Function file's path,
+// as reported by the server via the Supabase-Path header or the
+// Content-Disposition filename, would resolve outside utils.FunctionsDir
+// once joined and cleaned, or would require following an existing symlink
+// to get there. The server response is not trusted input, so any path that
+// looks like it's trying to escape the functions directory is rejected
+// rather than sanitized.
+var ErrUnsafeDownloadPath = errors.New("invalid path in server response")
+
 func RunLegacy(ctx context.Context, slug string, projectRef string, fsys afero.Fs) error {
 	// 1. Sanity checks.
 	{
@@ -160,6 +170,22 @@ func downloadAll(ctx context.Context, projectRef string, fsys afero.Fs, download
 
 	fmt.Fprintf(os.Stderr, "Found %d function(s) to download\n", len(functions))
 	for _, f := range functions {
+		// f.Slug comes straight from the Management API response, which
+		// this threat model treats as untrusted: a malicious or corrupted
+		// response (or a MITM) could return a slug containing ".." or "/"
+		// segments. Every downloader below joins this value into a
+		// filesystem path (utils.TempDir for downloadOne, utils.FunctionsDir
+		// for downloadWithServerSideUnbundle) before any validation of its
+		// own, so it must be rejected here -- the single point where it
+		// enters this dispatch logic -- rather than relying on each
+		// downstream path-construction site to defend itself.
+		if err := utils.ValidateFunctionSlug(f.Slug); err != nil {
+			utils.CmdSuggestion = fmt.Sprintf(
+				"The Supabase API returned an unexpected function slug (%s). Retry the command, and if this keeps happening, verify your network connection is not being intercepted before contacting Supabase support.",
+				utils.Aqua(f.Slug),
+			)
+			return errors.Errorf("failed to download function %s: %w", f.Slug, err)
+		}
 		if err := downloader(ctx, f.Slug, projectRef, fsys); err != nil {
 			return err
 		}
@@ -289,6 +315,10 @@ func suggestLegacyBundle(slug string) string {
 	return fmt.Sprintf("\nIf your function is deployed using CLI < 1.120.0, trying running %s instead.", utils.Aqua("supabase functions download --legacy-bundle "+slug))
 }
 
+func suggestUnsafeDownloadPath() string {
+	return "This usually indicates a malformed or unexpected API response. If you're using a self-hosted instance, verify your API URL is correct."
+}
+
 type bundleMetadata struct {
 	EntrypointPath string `json:"deno2_entrypoint_path,omitempty"`
 }
@@ -401,17 +431,196 @@ func saveFile(file *multipart.FileHeader, entrypointPath, funcDir string, fsys a
 
 	relPath, err := filepath.Rel(filepath.FromSlash(entrypointPath), filepath.FromSlash(partPath))
 	if err != nil {
-		// Continue extracting without entrypoint
-		fmt.Fprintln(os.Stderr, utils.Yellow("WARNING:"), err)
+		// Continue extracting without entrypoint. Go's Rel error embeds
+		// both paths verbatim ("Rel: can't make <target> relative to
+		// <base>"), and partPath is server-controlled, so this is gated
+		// behind --debug like the "Resolving file path" log above rather
+		// than printed unconditionally to stderr.
+		fmt.Fprintln(logger, "WARNING:", err)
 		relPath = filepath.FromSlash(path.Join("..", partPath))
 	}
 
+	// partPath (and therefore relPath and dstPath) is derived from
+	// server-controlled multipart metadata (Supabase-Path header or
+	// Content-Disposition filename), so it must be validated before it
+	// touches the filesystem below.
 	dstPath := filepath.Join(funcDir, path.Base(entrypointPath), relPath)
+
+	// Containment is enforced against the shared functions directory
+	// rather than funcDir: the entrypoint-mismatch fallback above can
+	// legitimately resolve one level above funcDir (into a sibling
+	// function's directory), but must never resolve outside
+	// utils.FunctionsDir entirely, e.g. via a "../../../etc/passwd" style
+	// payload.
+	root := utils.FunctionsDir
+	if err := validateDownloadPath(root, dstPath); err != nil {
+		utils.CmdSuggestion = suggestUnsafeDownloadPath()
+		return err
+	}
+
+	// A previous part could have planted a symlink at an intermediate
+	// directory component, which would otherwise let MkdirAll/OpenFile
+	// silently follow it out of root even though dstPath itself looks
+	// clean. Check before creating the directory, and again after the
+	// write lands in case a symlink was swapped in between the two checks.
+	dstDir := filepath.Dir(dstPath)
+	if err := ensureNoSymlinkInPath(fsys, root, dstDir); err != nil {
+		utils.CmdSuggestion = suggestUnsafeDownloadPath()
+		return err
+	}
+	if err := utils.MkdirIfNotExistFS(fsys, dstDir); err != nil {
+		return err
+	}
+
 	fmt.Fprintln(os.Stderr, "Extracting file:", dstPath)
-	if err := afero.WriteReader(fsys, dstPath, part); err != nil {
+	if err := writeFileNoFollowSymlink(fsys, dstPath, part); err != nil {
+		return err
+	}
+
+	if err := ensureNoSymlinkInPath(fsys, root, dstPath); err != nil {
+		utils.CmdSuggestion = suggestUnsafeDownloadPath()
+		return err
+	}
+	return nil
+}
+
+// validateDownloadPath rejects dstPath if, once lexically cleaned, it does
+// not resolve inside root. This is the primary defense against a hostile
+// "../../etc/passwd" style Supabase-Path/filename escaping the functions
+// directory: filepath.Join already cleans ".." segments away, so this
+// check must run against the cleaned result rather than by scanning the
+// raw, attacker-controlled path for "..".
+func validateDownloadPath(root, dstPath string) error {
+	rel, err := filepath.Rel(root, filepath.Clean(dstPath))
+	if err != nil || rel == ".." || strings.HasPrefix(rel, ".."+string(filepath.Separator)) || filepath.IsAbs(rel) {
+		return errors.Errorf("failed to save file: %w", ErrUnsafeDownloadPath)
+	}
+	return nil
+}
+
+// ensureNoSymlinkInPath rejects dir if resolving the symlinks along it would
+// land outside root.
+//
+// Earlier versions of this check rejected the mere presence of a symlink
+// anywhere under root, which also broke legitimate setups such as a
+// monorepo symlinking a shared directory into place inside the functions
+// tree. Instead, this resolves both root and dir the same way -- walking up
+// to the deepest ancestor that already exists on disk, following any chain
+// of symlinks there via filepath.EvalSymlinks (this also naturally covers
+// root itself being a symlink, since dir's walk passes through root), and
+// re-joining the still-nonexistent remainder back on -- and re-validates
+// the two resolved paths against each other with validateDownloadPath.
+// Resolving root the same way dir is resolved, rather than comparing a
+// resolved dir against a literal root, matters in practice: it is what
+// keeps an OS-level symlink that sits above both of them (e.g. macOS's
+// /var -> /private/var, which every path under a t.TempDir() passes
+// through) from producing a spurious mismatch. Only a resolved dir that
+// escapes the resolved root is rejected; a symlink whose target still
+// lands inside root, however deeply nested, is now allowed.
+//
+// This only has an effect on filesystems that expose real symlink
+// semantics through afero.LinkReader, i.e. afero.NewOsFs in production
+// (afero.Lstater is not a reliable enough signal on its own: afero.MemMapFs
+// also implements it, just by delegating straight to Stat). The in-memory
+// filesystem used in tests implements neither, so this check is
+// effectively a no-op there -- there is nothing to protect against on a
+// filesystem that cannot contain symlinks in the first place. That same
+// guard is also why it is safe for filepath.EvalSymlinks below to hit the
+// real OS filesystem directly instead of going through fsys: the only
+// afero.Fs implementation used in production, afero.NewOsFs, delegates to
+// the real OS filesystem for every operation, so the two agree.
+func ensureNoSymlinkInPath(fsys afero.Fs, root, dir string) error {
+	if _, ok := fsys.(afero.LinkReader); !ok {
+		return nil
+	}
+
+	// filepath.EvalSymlinks returns an absolute result as soon as it
+	// crosses one absolute symlink, but stays relative otherwise (per its
+	// doc comment), so root and dir must both start out absolute here --
+	// otherwise root (no symlink crossed) and dir (crossing one) could
+	// resolve to a relative and an absolute path respectively, which
+	// filepath.Rel below cannot meaningfully compare.
+	absRoot, err := filepath.Abs(root)
+	if err != nil {
+		return errors.Errorf("failed to inspect extraction path: %w", err)
+	}
+	absDir, err := filepath.Abs(dir)
+	if err != nil {
+		return errors.Errorf("failed to inspect extraction path: %w", err)
+	}
+
+	resolvedRoot, err := resolveExistingPath(fsys, absRoot)
+	if err != nil {
+		return errors.Errorf("failed to inspect extraction path: %w", err)
+	}
+	resolvedDir, err := resolveExistingPath(fsys, absDir)
+	if err != nil {
+		return errors.Errorf("failed to inspect extraction path: %w", err)
+	}
+
+	return validateDownloadPath(resolvedRoot, resolvedDir)
+}
+
+// resolveExistingPath resolves p by walking up to the deepest ancestor of it
+// that already exists -- a path component that does not exist yet cannot
+// itself be a symlink, so there is nothing there for EvalSymlinks to
+// resolve -- following any chain of symlinks in that ancestor to its real
+// target, then re-joining the still-nonexistent remainder of p back onto
+// the result.
+func resolveExistingPath(fsys afero.Fs, p string) (string, error) {
+	existing := p
+	var suffix []string
+	for {
+		if _, err := fsys.Stat(existing); err == nil {
+			break
+		} else if !os.IsNotExist(err) {
+			return "", err
+		}
+		parent := filepath.Dir(existing)
+		if parent == existing {
+			// Reached the filesystem root without finding anything that
+			// exists yet, so there is nothing left to resolve.
+			return filepath.Join(append([]string{existing}, suffix...)...), nil
+		}
+		suffix = append([]string{filepath.Base(existing)}, suffix...)
+		existing = parent
+	}
+
+	resolved, err := filepath.EvalSymlinks(existing)
+	if err != nil {
+		return "", err
+	}
+	return filepath.Join(append([]string{resolved}, suffix...)...), nil
+}
+
+// writeFileNoFollowSymlink writes r to dstPath without following a symlink
+// that might already occupy that path. It creates a randomly named
+// temporary file next to dstPath with O_EXCL, refusing to write through
+// anything already there, then atomically renames it onto dstPath.
+// Rename replaces whatever directory entry currently exists at dstPath --
+// including a symlink -- rather than dereferencing it, which is exactly
+// what a plain fs.Create/afero.WriteReader would otherwise do.
+func writeFileNoFollowSymlink(fsys afero.Fs, dstPath string, r io.Reader) error {
+	tmpPath := filepath.Join(filepath.Dir(dstPath), fmt.Sprintf(".supabase-download-%s.tmp", uuid.NewString()))
+	tmp, err := fsys.OpenFile(tmpPath, os.O_WRONLY|os.O_CREATE|os.O_EXCL, 0o644)
+	if err != nil {
 		return errors.Errorf("failed to save file: %w", err)
 	}
 
+	if _, err := io.Copy(tmp, r); err != nil {
+		_ = tmp.Close()
+		_ = fsys.Remove(tmpPath)
+		return errors.Errorf("failed to save file: %w", err)
+	}
+	if err := tmp.Close(); err != nil {
+		_ = fsys.Remove(tmpPath)
+		return errors.Errorf("failed to save file: %w", err)
+	}
+
+	if err := fsys.Rename(tmpPath, dstPath); err != nil {
+		_ = fsys.Remove(tmpPath)
+		return errors.Errorf("failed to save file: %w", err)
+	}
 	return nil
 }
 
diff --git a/apps/cli-go/internal/functions/download/download_test.go b/apps/cli-go/internal/functions/download/download_test.go
index 6ec601d928..355b0ec39c 100644
--- a/apps/cli-go/internal/functions/download/download_test.go
+++ b/apps/cli-go/internal/functions/download/download_test.go
@@ -308,6 +308,93 @@ func TestRunDockerUnbundle(t *testing.T) {
 	})
 }
 
+// TestDownloadAllRejectsMaliciousSlug is a regression test for CLI-1891: the
+// per-function loop in downloadAll must reject a path-traversal payload in
+// a function's Slug -- as returned by V1ListAllFunctionsWithResponse, which
+// this threat model treats as untrusted (a malicious/compromised Management
+// API response, or a MITM) -- before handing it to any downloader that
+// joins it into a filesystem path.
+//
+// This mirrors an exploit independently confirmed against downloadOne: with
+// slug = "../../../../../poc-escaped-outside-project", downloadOne's
+// eszipPath := filepath.Join(utils.TempDir, fmt.Sprintf("output_%s.eszip",
+// slug)) resolves (after filepath.Clean) to "../poc-escaped-outside-project.eszip",
+// i.e. one directory level above the project root, and
+// afero.WriteReader happily MkdirAll's its way there and writes the
+// server-controlled response body outside the sandbox.
+func TestDownloadAllRejectsMaliciousSlug(t *testing.T) {
+	const maliciousSlug = "../../../../../poc-escaped-outside-project"
+
+	// Use a real OS filesystem rooted at an isolated temp directory so an
+	// escape can actually be observed landing outside the project root,
+	// exactly as in the reviewer's PoC.
+	tmpDir := t.TempDir()
+	t.Chdir(tmpDir)
+	fsys := afero.NewOsFs()
+	require.NoError(t, utils.WriteConfig(fsys, false))
+
+	project := apitest.RandomProjectRef()
+	token := apitest.RandomAccessToken(t)
+	t.Setenv("SUPABASE_ACCESS_TOKEN", string(token))
+
+	utils.CmdSuggestion = ""
+	t.Cleanup(func() { utils.CmdSuggestion = "" })
+
+	defer gock.OffAll()
+	gock.New(utils.DefaultApiHost).
+		Get("/v1/projects/" + project + "/functions").
+		Reply(http.StatusOK).
+		JSON([]api.FunctionResponse{{
+			Id:   "poc-id",
+			Name: "poc",
+			Slug: maliciousSlug,
+		}})
+	// Mocked so that, if the fix is removed, the malicious slug's request
+	// still succeeds and downloadOne proceeds all the way to writing the
+	// escaped file -- proving the escape, rather than masking it behind an
+	// unrelated network error. With the fix in place this mock is never hit.
+	gock.New(utils.DefaultApiHost).
+		Get("/v1/projects/" + project + "/functions/.*/body").
+		Reply(http.StatusOK).
+		BodyString("fake eszip payload")
+
+	// downloadOne is the exact sink the reviewer's PoC targeted directly;
+	// wrap it as a downloader so downloadAll's dispatch is exercised against
+	// the real vulnerable code, without also pulling in downloadWithDockerUnbundle's
+	// unrelated Docker extraction step (and its defer-cleanup of the eszip
+	// file, which would otherwise remove the escaped file before this test
+	// can observe it).
+	downloaderCalled := false
+	downloader := func(ctx context.Context, slug, projectRef string, fsys afero.Fs) error {
+		downloaderCalled = true
+		_, err := downloadOne(ctx, slug, projectRef, fsys)
+		return err
+	}
+
+	err := downloadAll(context.Background(), project, fsys, downloader)
+
+	// Check for the escape before any assertion below that could halt the
+	// test on failure (e.g. require.Error), so this is verified regardless
+	// of whether downloadAll happened to return an error for some other
+	// reason. t.TempDir()'s own cleanup RemoveAll's tmpDir's parent, which
+	// would otherwise sweep away the evidence once the test returns.
+	//
+	// The exploit resolves to "../poc-escaped-outside-project.eszip"
+	// relative to utils.TempDir, i.e. one level above the project root.
+	escapedPath := filepath.Join(tmpDir, "..", "poc-escaped-outside-project.eszip")
+	t.Cleanup(func() { _ = os.Remove(escapedPath) })
+	exists, existsErr := afero.Exists(fsys, escapedPath)
+	require.NoError(t, existsErr)
+	assert.False(t, exists, "malicious slug must not be able to write outside the project directory")
+
+	require.Error(t, err)
+	assert.ErrorIs(t, err, utils.ErrInvalidSlug)
+	assert.Contains(t, utils.CmdSuggestion, "unexpected function slug")
+	assert.False(t, downloaderCalled, "downloader must not be invoked with an unvalidated slug")
+
+	assert.Empty(t, apitest.ListUnmatchedRequests())
+}
+
 func TestRunServerSideUnbundle(t *testing.T) {
 	const slug = "test-func"
 	token := apitest.RandomAccessToken(t)
@@ -453,6 +540,216 @@ func TestRunServerSideUnbundle(t *testing.T) {
 
 		assert.Empty(t, apitest.ListUnmatchedRequests())
 	})
+
+	t.Run("rejects a path traversal payload in Supabase-Path", func(t *testing.T) {
+		fsys := afero.NewMemMapFs()
+		require.NoError(t, utils.WriteConfig(fsys, false))
+
+		utils.CmdSuggestion = ""
+		t.Cleanup(func() { utils.CmdSuggestion = "" })
+
+		defer gock.OffAll()
+		mockMultipartBody(t, project, slug, bundleMetadata{EntrypointPath: "source/index.ts"}, []multipartPart{
+			{filename: "source/index.ts", contents: "console.log('hello')"},
+			{filename: "leftover.ts", supabasePath: "../../../../../../etc/passwd", contents: "root:x:0:0::/root:/bin/bash"},
+		})
+
+		err := Run(context.Background(), slug, project, false, false, fsys)
+		require.Error(t, err)
+		assert.ErrorIs(t, err, ErrUnsafeDownloadPath)
+
+		// The generic "invalid path in server response" message on its own
+		// gives users nothing actionable, so this must carry a specific
+		// suggestion (DX finding on CLI-1891) rather than falling through
+		// to the generic --debug suggestion.
+		assert.Contains(t, utils.CmdSuggestion, "malformed or unexpected API response")
+
+		// Nothing should have escaped the functions directory.
+		exists, err := afero.Exists(fsys, "/etc/passwd")
+		require.NoError(t, err)
+		assert.False(t, exists, "path traversal payload must not be written outside the functions directory")
+
+		assert.Empty(t, apitest.ListUnmatchedRequests())
+	})
+
+	t.Run("writes deeply nested legitimate paths", func(t *testing.T) {
+		fsys := afero.NewMemMapFs()
+		require.NoError(t, utils.WriteConfig(fsys, false))
+
+		defer gock.OffAll()
+		mockMultipartBody(t, project, slug, bundleMetadata{EntrypointPath: "source/index.ts"}, []multipartPart{
+			{filename: "source/index.ts", contents: "console.log('hello')"},
+			{filename: "source/a/b/c/d/deep.ts", contents: "export const deep = true;"},
+		})
+
+		err := Run(context.Background(), slug, project, false, false, fsys)
+		require.NoError(t, err)
+
+		root := filepath.Join(utils.FunctionsDir, slug)
+		data, err := afero.ReadFile(fsys, filepath.Join(root, "index.ts"))
+		require.NoError(t, err)
+		assert.Equal(t, "console.log('hello')", string(data))
+
+		data, err = afero.ReadFile(fsys, filepath.Join(root, "a", "b", "c", "d", "deep.ts"))
+		require.NoError(t, err)
+		assert.Equal(t, "export const deep = true;", string(data))
+
+		assert.Empty(t, apitest.ListUnmatchedRequests())
+	})
+
+	t.Run("does not write through a pre-existing symlink at the destination", func(t *testing.T) {
+		// Symlink semantics only exist on a real filesystem, so this test
+		// exercises afero.NewOsFs against an isolated temp directory rather
+		// than the in-memory fs used elsewhere in this file.
+		tmpDir := t.TempDir()
+		t.Chdir(tmpDir)
+		fsys := afero.NewOsFs()
+		require.NoError(t, utils.WriteConfig(fsys, false))
+
+		// A file living outside the sandboxed functions directory that must
+		// never be touched by the download.
+		outsideDir := filepath.Join(tmpDir, "outside")
+		require.NoError(t, os.MkdirAll(outsideDir, 0o755))
+		secretPath := filepath.Join(outsideDir, "secret.txt")
+		require.NoError(t, os.WriteFile(secretPath, []byte("original"), 0o600))
+
+		// Plant a symlink inside the function directory, before the
+		// download runs, pointing at the file outside the sandbox. A
+		// server response that resolves to this exact path must not be
+		// allowed to write through it.
+		funcDir := filepath.Join(utils.FunctionsDir, slug)
+		require.NoError(t, os.MkdirAll(funcDir, 0o755))
+		linkPath := filepath.Join(funcDir, "evil.ts")
+		require.NoError(t, os.Symlink(secretPath, linkPath))
+
+		defer gock.OffAll()
+		mockMultipartBody(t, project, slug, bundleMetadata{EntrypointPath: "source/index.ts"}, []multipartPart{
+			{filename: "source/index.ts", contents: "console.log('hello')"},
+			{filename: "source/evil.ts", contents: "overwritten"},
+		})
+
+		err := Run(context.Background(), slug, project, false, false, fsys)
+		require.NoError(t, err)
+
+		// The symlink target outside the sandbox must be untouched.
+		data, err := os.ReadFile(secretPath)
+		require.NoError(t, err)
+		assert.Equal(t, "original", string(data), "file outside the functions directory must not be modified")
+
+		// The destination itself should now be a plain file with the
+		// downloaded contents: the atomic rename replaces the symlink
+		// directory entry rather than following it.
+		info, err := os.Lstat(linkPath)
+		require.NoError(t, err)
+		assert.Zero(t, info.Mode()&os.ModeSymlink, "planted symlink should have been replaced, not written through")
+
+		data, err = os.ReadFile(linkPath)
+		require.NoError(t, err)
+		assert.Equal(t, "overwritten", string(data))
+
+		assert.Empty(t, apitest.ListUnmatchedRequests())
+	})
+
+	// Regression test for the DX finding on CLI-1891: ensureNoSymlinkInPath
+	// used to reject the mere presence of a symlink anywhere under
+	// utils.FunctionsDir, which would also have broken a legitimate
+	// monorepo pattern like this one, where a function directory
+	// symlinks in a shared directory that itself lives inside the
+	// functions tree. That symlink's target still resolves inside root,
+	// so it must be allowed end-to-end.
+	t.Run("writes through a symlink pointing to a legitimate location inside the functions directory", func(t *testing.T) {
+		tmpDir := t.TempDir()
+		t.Chdir(tmpDir)
+		fsys := afero.NewOsFs()
+		require.NoError(t, utils.WriteConfig(fsys, false))
+
+		sharedDir := filepath.Join(utils.FunctionsDir, "_shared")
+		require.NoError(t, os.MkdirAll(sharedDir, 0o755))
+		// os.Symlink resolves a relative target against the symlink's own
+		// containing directory, not the process cwd, so the target must be
+		// made absolute here for the link to actually point at sharedDir.
+		absSharedDir, err := filepath.Abs(sharedDir)
+		require.NoError(t, err)
+
+		funcDir := filepath.Join(utils.FunctionsDir, slug)
+		require.NoError(t, os.MkdirAll(funcDir, 0o755))
+		require.NoError(t, os.Symlink(absSharedDir, filepath.Join(funcDir, "_shared")))
+
+		defer gock.OffAll()
+		mockMultipartBody(t, project, slug, bundleMetadata{EntrypointPath: "source/index.ts"}, []multipartPart{
+			{filename: "source/index.ts", contents: "console.log('hello')"},
+			{filename: "source/_shared/util.ts", contents: "export const util = 2;"},
+		})
+
+		err = Run(context.Background(), slug, project, false, false, fsys)
+		require.NoError(t, err)
+
+		data, err := afero.ReadFile(fsys, filepath.Join(funcDir, "index.ts"))
+		require.NoError(t, err)
+		assert.Equal(t, "console.log('hello')", string(data))
+
+		// The write landed through the symlink, in the real shared
+		// directory rather than being rejected.
+		data, err = os.ReadFile(filepath.Join(sharedDir, "util.ts"))
+		require.NoError(t, err)
+		assert.Equal(t, "export const util = 2;", string(data))
+
+		assert.Empty(t, apitest.ListUnmatchedRequests())
+	})
+}
+
+// TestEnsureNoSymlinkInPath exercises ensureNoSymlinkInPath's resolve-then-check
+// policy directly: it must still reject a symlink whose target escapes root,
+// but must now allow one whose target resolves to a legitimate, even deeply
+// nested, location that is still inside root.
+func TestEnsureNoSymlinkInPath(t *testing.T) {
+	t.Run("rejects a symlink whose target resolves outside root", func(t *testing.T) {
+		tmpDir := t.TempDir()
+		fsys := afero.NewOsFs()
+
+		root := filepath.Join(tmpDir, "supabase", "functions")
+		require.NoError(t, os.MkdirAll(root, 0o755))
+
+		outsideDir := filepath.Join(tmpDir, "outside")
+		require.NoError(t, os.MkdirAll(outsideDir, 0o755))
+
+		// Plant a symlink inside root whose target lives outside it
+		// entirely -- the actual attack this check defends against.
+		linkDir := filepath.Join(root, "escape")
+		require.NoError(t, os.Symlink(outsideDir, linkDir))
+
+		dir := filepath.Join(linkDir, "nested")
+		err := ensureNoSymlinkInPath(fsys, root, dir)
+		require.Error(t, err)
+		assert.ErrorIs(t, err, ErrUnsafeDownloadPath)
+	})
+
+	t.Run("allows a symlink whose target resolves to a nested location inside root", func(t *testing.T) {
+		tmpDir := t.TempDir()
+		fsys := afero.NewOsFs()
+
+		root := filepath.Join(tmpDir, "supabase", "functions")
+		require.NoError(t, os.MkdirAll(root, 0o755))
+
+		// A legitimate monorepo-style symlink: a shared directory that
+		// lives elsewhere inside the functions tree, symlinked into place
+		// from a function's own directory.
+		sharedDir := filepath.Join(root, "_shared")
+		require.NoError(t, os.MkdirAll(sharedDir, 0o755))
+
+		funcDir := filepath.Join(root, "my-func")
+		require.NoError(t, os.MkdirAll(funcDir, 0o755))
+		linkDir := filepath.Join(funcDir, "_shared")
+		require.NoError(t, os.Symlink(sharedDir, linkDir))
+
+		// dir itself does not exist yet -- ensureNoSymlinkInPath is called
+		// before MkdirIfNotExistFS creates it -- so this also proves the
+		// still-nonexistent remainder is correctly re-joined onto the
+		// resolved ancestor.
+		dir := filepath.Join(linkDir, "nested", "deeper")
+		err := ensureNoSymlinkInPath(fsys, root, dir)
+		assert.NoError(t, err, "a symlink resolving to a legitimate location inside root must be allowed")
+	})
 }
 
 func TestDownloadFunction(t *testing.T) {
diff --git a/apps/cli-go/internal/sso/create/create.go b/apps/cli-go/internal/sso/create/create.go
index acf3eb14e5..3716e5ee73 100644
--- a/apps/cli-go/internal/sso/create/create.go
+++ b/apps/cli-go/internal/sso/create/create.go
@@ -52,15 +52,7 @@ func Run(ctx context.Context, params RunParams) error {
 	}
 
 	if params.AttributeMapping != "" {
-		body.AttributeMapping = &struct {
-			Keys map[string]struct {
-				Array   *bool     "json:\"array,omitempty\""
-				Default *any      "json:\"default,omitempty\""
-				Name    *string   "json:\"name,omitempty\""
-				Names   *[]string "json:\"names,omitempty\""
-			} "json:\"keys\""
-		}{}
-		if err := saml.ReadAttributeMappingFile(Fs, params.AttributeMapping, body.AttributeMapping); err != nil {
+		if err := saml.ReadAttributeMappingFile(Fs, params.AttributeMapping, &body.AttributeMapping); err != nil {
 			return err
 		}
 	}
diff --git a/apps/cli-go/internal/sso/internal/saml/files_test.go b/apps/cli-go/internal/sso/internal/saml/files_test.go
index cc5c59b854..cd512a599e 100644
--- a/apps/cli-go/internal/sso/internal/saml/files_test.go
+++ b/apps/cli-go/internal/sso/internal/saml/files_test.go
@@ -22,7 +22,7 @@ func TestReadAttributeMappingFile(t *testing.T) {
 		fs := afero.NewMemMapFs()
 		require.NoError(t, afero.WriteFile(fs, "/not-valid-json", []byte("not-valid-JSON"), 0755))
 		var body api.CreateProviderBody
-		err := ReadAttributeMappingFile(fs, "/not-valid-json", body.AttributeMapping)
+		err := ReadAttributeMappingFile(fs, "/not-valid-json", &body.AttributeMapping)
 		assert.ErrorContains(t, err, "failed to parse attribute mapping")
 	})
 
@@ -30,24 +30,16 @@ func TestReadAttributeMappingFile(t *testing.T) {
 		fs := afero.NewMemMapFs()
 		data := `{"keys":{"abc":{"names":["x","y","z"],"default":2,"name":"k"}}}`
 		require.NoError(t, afero.WriteFile(fs, "/valid-json", []byte(data), 0755))
-		body := api.CreateProviderBody{
-			AttributeMapping: &struct {
-				Keys map[string]struct {
-					Array   *bool     "json:\"array,omitempty\""
-					Default *any      "json:\"default,omitempty\""
-					Name    *string   "json:\"name,omitempty\""
-					Names   *[]string "json:\"names,omitempty\""
-				} "json:\"keys\""
-			}{},
-		}
-		err := ReadAttributeMappingFile(fs, "/valid-json", body.AttributeMapping)
+		var body api.CreateProviderBody
+		err := ReadAttributeMappingFile(fs, "/valid-json", &body.AttributeMapping)
 		assert.NoError(t, err)
+		require.NotNil(t, body.AttributeMapping)
 		assert.Len(t, body.AttributeMapping.Keys, 1)
 		value := body.AttributeMapping.Keys["abc"]
 		assert.Equal(t, cast.Ptr("k"), value.Name)
 		assert.Equal(t, &[]string{"x", "y", "z"}, value.Names)
 		assert.NotNil(t, value.Default)
-		assert.Equal(t, float64(2), *value.Default)
+		assert.Equal(t, float64(2), value.Default)
 	})
 }
 
diff --git a/apps/cli-go/internal/sso/update/update.go b/apps/cli-go/internal/sso/update/update.go
index 4e54b8961e..6a4dc9b294 100644
--- a/apps/cli-go/internal/sso/update/update.go
+++ b/apps/cli-go/internal/sso/update/update.go
@@ -74,15 +74,7 @@ func Run(ctx context.Context, params RunParams) error {
 	}
 
 	if params.AttributeMapping != "" {
-		body.AttributeMapping = &struct {
-			Keys map[string]struct {
-				Array   *bool     "json:\"array,omitempty\""
-				Default *any      "json:\"default,omitempty\""
-				Name    *string   "json:\"name,omitempty\""
-				Names   *[]string "json:\"names,omitempty\""
-			} "json:\"keys\""
-		}{}
-		if err := saml.ReadAttributeMappingFile(Fs, params.AttributeMapping, body.AttributeMapping); err != nil {
+		if err := saml.ReadAttributeMappingFile(Fs, params.AttributeMapping, &body.AttributeMapping); err != nil {
 			return err
 		}
 	}
diff --git a/apps/cli-go/internal/start/start.go b/apps/cli-go/internal/start/start.go
index 23aa631e3b..6264016e79 100644
--- a/apps/cli-go/internal/start/start.go
+++ b/apps/cli-go/internal/start/start.go
@@ -128,6 +128,13 @@ type vectorConfig struct {
 	DbId          string
 }
 
+func shouldMountRootDockerSocket(host string) bool {
+	return strings.HasSuffix(host, "/.docker/run/docker.sock") ||
+		strings.HasSuffix(host, "/.docker/desktop/docker.sock") ||
+		(strings.Contains(host, "/.colima/") && strings.HasSuffix(host, "/docker.sock")) ||
+		strings.HasSuffix(host, "/.colima/docker.sock")
+}
+
 var (
 	//go:embed templates/vector.yaml
 	vectorConfigEmbed    string
@@ -424,8 +431,7 @@ EOF
 		case "unix":
 			if dindHost, err = client.ParseHostURL(client.DefaultDockerHost); err != nil {
 				return errors.Errorf("failed to parse default host: %w", err)
-			} else if strings.HasSuffix(parsed.Host, "/.docker/run/docker.sock") ||
-				strings.HasSuffix(parsed.Host, "/.docker/desktop/docker.sock") {
+			} else if shouldMountRootDockerSocket(parsed.Host) {
 				// Docker will not mount rootless socket directly;
 				// instead, specify root socket to have it handled under the hood
 				binds = append(binds, fmt.Sprintf("%[1]s:%[1]s:ro", dindHost.Host))
diff --git a/apps/cli-go/internal/start/start_test.go b/apps/cli-go/internal/start/start_test.go
index 2977c5ed79..a69f7bd8bc 100644
--- a/apps/cli-go/internal/start/start_test.go
+++ b/apps/cli-go/internal/start/start_test.go
@@ -162,6 +162,20 @@ func TestStartCommand(t *testing.T) {
 	})
 }
 
+func TestShouldMountRootDockerSocket(t *testing.T) {
+	t.Run("returns true for Docker Desktop and Colima sockets", func(t *testing.T) {
+		assert.True(t, shouldMountRootDockerSocket("/Users/test/.docker/run/docker.sock"))
+		assert.True(t, shouldMountRootDockerSocket("/Users/test/.docker/desktop/docker.sock"))
+		assert.True(t, shouldMountRootDockerSocket("/Users/test/.colima/default/docker.sock"))
+		assert.True(t, shouldMountRootDockerSocket("/Users/test/.colima/local/docker.sock"))
+		assert.True(t, shouldMountRootDockerSocket("/Users/test/.colima/docker.sock"))
+	})
+
+	t.Run("returns false for directly mountable sockets", func(t *testing.T) {
+		assert.False(t, shouldMountRootDockerSocket("/Users/test/.orbstack/run/docker.sock"))
+	})
+}
+
 func TestDatabaseStart(t *testing.T) {
 	t.Run("starts database locally", func(t *testing.T) {
 		// Setup in-memory fs
diff --git a/apps/cli-go/internal/telemetry/client.go b/apps/cli-go/internal/telemetry/client.go
index 34b529a3b3..717e4af181 100644
--- a/apps/cli-go/internal/telemetry/client.go
+++ b/apps/cli-go/internal/telemetry/client.go
@@ -1,11 +1,14 @@
 package telemetry
 
 import (
+	"log"
 	"net/http"
 	"strings"
+	"time"
 
 	"github.com/go-errors/errors"
 	"github.com/posthog/posthog-go"
+	"github.com/supabase/cli/internal/utils"
 )
 
 type Analytics interface {
@@ -24,6 +27,8 @@ type queueClient interface {
 
 type constructor func(apiKey string, config posthog.Config) (queueClient, error)
 
+const shutdownTimeout = 2 * time.Second
+
 type Client struct {
 	client         queueClient
 	baseProperties posthog.Properties
@@ -38,7 +43,15 @@ func NewClient(apiKey string, endpoint string, baseProperties map[string]any, fa
 			return posthog.NewWithConfig(apiKey, config)
 		}
 	}
-	config := posthog.Config{}
+	// Without a positive ShutdownTimeout, Close blocks indefinitely when the
+	// endpoint is unreachable, hanging every command on networks that block
+	// PostHog; keep it tight because blackholed networks pay the whole timeout
+	// at exit. The default logger prints delivery failures to stderr even for
+	// commands that succeeded, so route them to the --debug logger instead.
+	config := posthog.Config{
+		ShutdownTimeout: shutdownTimeout,
+		Logger:          posthog.StdLogger(log.New(utils.GetDebugLogger(), "posthog ", log.LstdFlags), true),
+	}
 	if endpoint != "" {
 		config.Endpoint = endpoint
 	}
diff --git a/apps/cli-go/internal/telemetry/client_test.go b/apps/cli-go/internal/telemetry/client_test.go
index 6ee8ccb27a..bcc8db7d24 100644
--- a/apps/cli-go/internal/telemetry/client_test.go
+++ b/apps/cli-go/internal/telemetry/client_test.go
@@ -1,10 +1,14 @@
 package telemetry
 
 import (
+	"io"
 	"net/http"
+	"os"
 	"testing"
+	"time"
 
 	"github.com/posthog/posthog-go"
+	"github.com/spf13/viper"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	"github.com/supabase/cli/internal/debug"
@@ -40,6 +44,8 @@ func TestNewClient(t *testing.T) {
 		assert.True(t, client.Enabled())
 		assert.Equal(t, "phc_test", gotKey)
 		assert.Equal(t, "https://eu.i.posthog.com", gotConfig.Endpoint)
+		assert.Equal(t, 2*time.Second, gotConfig.ShutdownTimeout)
+		assert.NotNil(t, gotConfig.Logger)
 	})
 
 	t.Run("becomes a no-op when key is empty", func(t *testing.T) {
@@ -53,6 +59,37 @@ func TestNewClient(t *testing.T) {
 		assert.NoError(t, client.Capture("device-1", EventCommandExecuted, map[string]any{"command": "login"}, nil))
 		assert.NoError(t, client.Close())
 	})
+	t.Run("routes posthog logs to stderr only in debug mode", func(t *testing.T) {
+		originalStderr := os.Stderr
+		originalDebug := viper.GetBool("DEBUG")
+		reader, writer, err := os.Pipe()
+		require.NoError(t, err)
+		os.Stderr = writer
+		t.Cleanup(func() {
+			os.Stderr = originalStderr
+			viper.Set("DEBUG", originalDebug)
+		})
+
+		configFor := func(debugEnabled bool) posthog.Config {
+			viper.Set("DEBUG", debugEnabled)
+			var gotConfig posthog.Config
+			_, err := NewClient("phc_test", "", nil, func(apiKey string, config posthog.Config) (queueClient, error) {
+				gotConfig = config
+				return &fakeQueue{}, nil
+			})
+			require.NoError(t, err)
+			return gotConfig
+		}
+
+		configFor(false).Logger.Errorf("dropped %d messages", 1)
+		configFor(true).Logger.Errorf("dropped %d messages", 2)
+
+		require.NoError(t, writer.Close())
+		output, err := io.ReadAll(reader)
+		require.NoError(t, err)
+		assert.NotContains(t, string(output), "dropped 1 messages")
+		assert.Contains(t, string(output), "dropped 2 messages")
+	})
 	t.Run("works when debug wraps the default transport", func(t *testing.T) {
 		original := http.DefaultTransport
 		http.DefaultTransport = debug.NewTransport()
diff --git a/apps/cli-go/internal/utils/edgeruntime.go b/apps/cli-go/internal/utils/edgeruntime.go
index c81169ea6f..8e54afa628 100644
--- a/apps/cli-go/internal/utils/edgeruntime.go
+++ b/apps/cli-go/internal/utils/edgeruntime.go
@@ -13,6 +13,18 @@ import (
 	"github.com/spf13/viper"
 )
 
+// EdgeRuntimeScriptErrorSentinel is printed to stderr by the pg-delta Deno
+// templates when their body throws (see the `catch` blocks in
+// internal/db/diff/templates/*.ts). The templates force the edge-runtime worker
+// to exit by throwing on both the success and failure paths, and that non-zero
+// exit is otherwise suppressed here when stderr contains "main worker has been
+// destroyed". Without a distinct marker a crashed script would be
+// indistinguishable from a successful empty diff, so `db pull` would report "No
+// schema changes found" while the real error (e.g. a permission-denied catalog
+// query) was silently swallowed. Templates and tests must reference this exact
+// string. See supabase/cli#5826.
+const EdgeRuntimeScriptErrorSentinel = "PGDELTA_SCRIPT_ERROR"
+
 // edgeRuntimeFile is a single file dropped into the edge-runtime container's
 // working directory before the configured command is run.
 type edgeRuntimeFile struct {
@@ -119,6 +131,14 @@ func RunEdgeRuntimeScript(ctx context.Context, env []string, script string, bind
 	); err != nil && !strings.Contains(stderr.String(), "main worker has been destroyed") {
 		return errors.Errorf("%s: %w:\n%s", errPrefix, err, stderr.String())
 	}
+	// The templates suppress their own non-zero exit (they throw to force the
+	// worker to exit, which surfaces as "main worker has been destroyed"), so a
+	// script crash can slip past the check above. Treat the sentinel — printed
+	// only by the templates' catch blocks — as a hard failure so the real error,
+	// collected in stderr, reaches the user instead of looking like an empty diff.
+	if strings.Contains(stderr.String(), EdgeRuntimeScriptErrorSentinel) {
+		return errors.Errorf("%s: error running script:\n%s", errPrefix, stderr.String())
+	}
 	return nil
 }
 
diff --git a/apps/cli-go/internal/utils/edgeruntime_test.go b/apps/cli-go/internal/utils/edgeruntime_test.go
index 471a518ee6..2497630255 100644
--- a/apps/cli-go/internal/utils/edgeruntime_test.go
+++ b/apps/cli-go/internal/utils/edgeruntime_test.go
@@ -1,14 +1,97 @@
 package utils
 
 import (
+	"bytes"
+	"context"
+	"io"
+	"net/http"
 	"strconv"
 	"strings"
 	"testing"
 
+	"github.com/docker/docker/api/types/container"
+	"github.com/docker/docker/pkg/stdcopy"
+	"github.com/h2non/gock"
+	"github.com/spf13/viper"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
+	"github.com/supabase/cli/internal/testing/apitest"
 )
 
+// mockEdgeRuntimeLogs registers the docker responses RunEdgeRuntimeScript needs:
+// a one-shot log read multiplexing stdout+stderr, an inspect reporting the exit
+// code, and the container delete. Mirrors apitest.MockDockerErrorLogs but also
+// carries stdout so we can assert the success path preserves the script output.
+func mockEdgeRuntimeLogs(t *testing.T, containerID, stdout, stderr string, exitCode int) {
+	t.Helper()
+	var body bytes.Buffer
+	if len(stdout) > 0 {
+		_, err := io.Copy(stdcopy.NewStdWriter(&body, stdcopy.Stdout), strings.NewReader(stdout))
+		require.NoError(t, err)
+	}
+	if len(stderr) > 0 {
+		_, err := io.Copy(stdcopy.NewStdWriter(&body, stdcopy.Stderr), strings.NewReader(stderr))
+		require.NoError(t, err)
+	}
+	gock.New(Docker.DaemonHost()).
+		Get("/v"+Docker.ClientVersion()+"/containers/"+containerID+"/logs").
+		Reply(http.StatusOK).
+		SetHeader("Content-Type", "application/vnd.docker.raw-stream").
+		Body(&body)
+	gock.New(Docker.DaemonHost()).
+		Get("/v" + Docker.ClientVersion() + "/containers/" + containerID + "/json").
+		Reply(http.StatusOK).
+		JSON(container.InspectResponse{ContainerJSONBase: &container.ContainerJSONBase{
+			State: &container.State{ExitCode: exitCode},
+		}})
+	gock.New(Docker.DaemonHost()).
+		Delete("/v" + Docker.ClientVersion() + "/containers/" + containerID).
+		Reply(http.StatusOK)
+}
+
+func TestRunEdgeRuntimeScript(t *testing.T) {
+	const containerID = "test-edge-runtime"
+	imageUrl := GetRegistryImageUrl(Config.EdgeRuntime.Image)
+
+	t.Run("surfaces the real error when the script crashes behind the worker-destroyed message", func(t *testing.T) {
+		viper.Set("INTERNAL_IMAGE_REGISTRY", "docker.io")
+		t.Cleanup(func() { viper.Set("INTERNAL_IMAGE_REGISTRY", "") })
+		require.NoError(t, apitest.MockDocker(Docker))
+		defer gock.OffAll()
+		apitest.MockDockerStart(Docker, imageUrl, containerID)
+		// The pg-delta template throws to force the worker to exit (surfacing as a
+		// non-zero exit + "main worker has been destroyed"), and its catch block
+		// prints the real error and the sentinel. This must NOT look like an empty diff.
+		stderr := "error: permission denied for table pg_user_mapping\n" +
+			EdgeRuntimeScriptErrorSentinel + "\n" +
+			"worker boot error\nmain worker has been destroyed\n"
+		mockEdgeRuntimeLogs(t, containerID, "", stderr, 1)
+
+		var stdout, stderrBuf bytes.Buffer
+		err := RunEdgeRuntimeScript(context.Background(), nil, "console.log('x')", nil, "error diffing schema", &stdout, &stderrBuf)
+		require.Error(t, err)
+		assert.Contains(t, err.Error(), "error diffing schema: error running script:")
+		// The real, actionable error must reach the user, not "No schema changes found".
+		assert.Contains(t, err.Error(), "permission denied for table pg_user_mapping")
+	})
+
+	t.Run("still ignores a worker-destroyed exit when no sentinel is present", func(t *testing.T) {
+		viper.Set("INTERNAL_IMAGE_REGISTRY", "docker.io")
+		t.Cleanup(func() { viper.Set("INTERNAL_IMAGE_REGISTRY", "") })
+		require.NoError(t, apitest.MockDocker(Docker))
+		defer gock.OffAll()
+		apitest.MockDockerStart(Docker, imageUrl, containerID)
+		// Success path: the template forces the worker to exit after writing output,
+		// so the exit is non-zero with "main worker has been destroyed" but no sentinel.
+		mockEdgeRuntimeLogs(t, containerID, "ALTER TABLE x;\n", "main worker has been destroyed\n", 1)
+
+		var stdout, stderrBuf bytes.Buffer
+		err := RunEdgeRuntimeScript(context.Background(), nil, "console.log('x')", nil, "error diffing schema", &stdout, &stderrBuf)
+		require.NoError(t, err)
+		assert.Equal(t, "ALTER TABLE x;\n", stdout.String())
+	})
+}
+
 func TestBuildEdgeRuntimeEntrypoint(t *testing.T) {
 	t.Run("emits a single heredoc when only the script is provided", func(t *testing.T) {
 		got := buildEdgeRuntimeEntrypoint(
diff --git a/apps/cli-go/internal/utils/misc.go b/apps/cli-go/internal/utils/misc.go
index 8e9870531b..3faf385966 100644
--- a/apps/cli-go/internal/utils/misc.go
+++ b/apps/cli-go/internal/utils/misc.go
@@ -129,7 +129,14 @@ func IsPgDeltaEnabled() bool {
 
 func GetCurrentTimestamp() string {
 	// Magic number: https://stackoverflow.com/q/45160822.
-	return time.Now().UTC().Format(layoutVersion)
+	return GetVersionTimestamp(time.Now())
+}
+
+// GetVersionTimestamp formats t as a migration version (UTC `YYYYMMDDHHMMSS`).
+// Callers that write several ordered migration files in one pass add real time
+// offsets to a shared base rather than incrementing the formatted string.
+func GetVersionTimestamp(t time.Time) string {
+	return t.UTC().Format(layoutVersion)
 }
 
 func GetCurrentBranchFS(fsys afero.Fs) (string, error) {
diff --git a/apps/cli-go/pkg/api/client.gen.go b/apps/cli-go/pkg/api/client.gen.go
index 7ff5b0a26c..b8684b994f 100644
--- a/apps/cli-go/pkg/api/client.gen.go
+++ b/apps/cli-go/pkg/api/client.gen.go
@@ -1,6 +1,6 @@
 // Package api provides primitives to interact with the openapi HTTP API.
 //
-// Code generated by github.com/oapi-codegen/oapi-codegen/v2 version v2.4.1 DO NOT EDIT.
+// Code generated by github.com/oapi-codegen/oapi-codegen/v2 version v2.7.1 DO NOT EDIT.
 package api
 
 import (
@@ -221,6 +221,9 @@ type ClientInterface interface {
 	// V1GetProjectLogsAll request
 	V1GetProjectLogsAll(ctx context.Context, ref string, params *V1GetProjectLogsAllParams, reqEditors ...RequestEditorFn) (*http.Response, error)
 
+	// V1ScrapeProjectMetrics request
+	V1ScrapeProjectMetrics(ctx context.Context, ref string, reqEditors ...RequestEditorFn) (*http.Response, error)
+
 	// V1GetProjectUsageApiCount request
 	V1GetProjectUsageApiCount(ctx context.Context, ref string, params *V1GetProjectUsageApiCountParams, reqEditors ...RequestEditorFn) (*http.Response, error)
 
@@ -1282,6 +1285,18 @@ func (c *Client) V1GetProjectLogsAll(ctx context.Context, ref string, params *V1
 	return c.Client.Do(req)
 }
 
+func (c *Client) V1ScrapeProjectMetrics(ctx context.Context, ref string, reqEditors ...RequestEditorFn) (*http.Response, error) {
+	req, err := NewV1ScrapeProjectMetricsRequest(c.Server, ref)
+	if err != nil {
+		return nil, err
+	}
+	req = req.WithContext(ctx)
+	if err := c.applyEditors(ctx, req, reqEditors); err != nil {
+		return nil, err
+	}
+	return c.Client.Do(req)
+}
+
 func (c *Client) V1GetProjectUsageApiCount(ctx context.Context, ref string, params *V1GetProjectUsageApiCountParams, reqEditors ...RequestEditorFn) (*http.Response, error) {
 	req, err := NewV1GetProjectUsageApiCountRequest(c.Server, ref, params)
 	if err != nil {
@@ -3462,7 +3477,7 @@ func NewV1DeleteABranchRequest(server string, branchIdOrRef string, params *V1De
 
 	var pathParam0 string
 
-	pathParam0, err = runtime.StyleParamWithLocation("simple", false, "branch_id_or_ref", runtime.ParamLocationPath, branchIdOrRef)
+	pathParam0, err = runtime.StyleParamWithOptions("simple", false, "branch_id_or_ref", branchIdOrRef, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationPath, Type: "string", Format: ""})
 	if err != nil {
 		return nil, err
 	}
@@ -3483,28 +3498,33 @@ func NewV1DeleteABranchRequest(server string, branchIdOrRef string, params *V1De
 	}
 
 	if params != nil {
+		// queryValues collects non-styled parameters (passthrough, JSON)
+		// that are safe to round-trip through url.Values.Encode().
 		queryValues := queryURL.Query()
+		// rawQueryFragments collects pre-encoded query fragments from
+		// styled parameters, preserving literal commas as delimiters
+		// per the OpenAPI spec (e.g. "color=blue,black,brown").
+		var rawQueryFragments []string
 
 		if params.Force != nil {
 
-			if queryFrag, err := runtime.StyleParamWithLocation("form", true, "force", runtime.ParamLocationQuery, *params.Force); err != nil {
-				return nil, err
-			} else if parsed, err := url.ParseQuery(queryFrag); err != nil {
+			if queryFrag, err := runtime.StyleParamWithOptions("form", true, "force", *params.Force, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationQuery, Type: "boolean", Format: ""}); err != nil {
 				return nil, err
 			} else {
-				for k, v := range parsed {
-					for _, v2 := range v {
-						queryValues.Add(k, v2)
-					}
+				for _, qp := range strings.Split(queryFrag, "&") {
+					rawQueryFragments = append(rawQueryFragments, qp)
 				}
 			}
 
 		}
 
-		queryURL.RawQuery = queryValues.Encode()
+		if encoded := queryValues.Encode(); encoded != "" {
+			rawQueryFragments = append(rawQueryFragments, encoded)
+		}
+		queryURL.RawQuery = strings.Join(rawQueryFragments, "&")
 	}
 
-	req, err := http.NewRequest("DELETE", queryURL.String(), nil)
+	req, err := http.NewRequest(http.MethodDelete, queryURL.String(), nil)
 	if err != nil {
 		return nil, err
 	}
@@ -3518,7 +3538,7 @@ func NewV1GetABranchConfigRequest(server string, branchIdOrRef string) (*http.Re
 
 	var pathParam0 string
 
-	pathParam0, err = runtime.StyleParamWithLocation("simple", false, "branch_id_or_ref", runtime.ParamLocationPath, branchIdOrRef)
+	pathParam0, err = runtime.StyleParamWithOptions("simple", false, "branch_id_or_ref", branchIdOrRef, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationPath, Type: "string", Format: ""})
 	if err != nil {
 		return nil, err
 	}
@@ -3538,7 +3558,7 @@ func NewV1GetABranchConfigRequest(server string, branchIdOrRef string) (*http.Re
 		return nil, err
 	}
 
-	req, err := http.NewRequest("GET", queryURL.String(), nil)
+	req, err := http.NewRequest(http.MethodGet, queryURL.String(), nil)
 	if err != nil {
 		return nil, err
 	}
@@ -3563,7 +3583,7 @@ func NewV1UpdateABranchConfigRequestWithBody(server string, branchIdOrRef string
 
 	var pathParam0 string
 
-	pathParam0, err = runtime.StyleParamWithLocation("simple", false, "branch_id_or_ref", runtime.ParamLocationPath, branchIdOrRef)
+	pathParam0, err = runtime.StyleParamWithOptions("simple", false, "branch_id_or_ref", branchIdOrRef, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationPath, Type: "string", Format: ""})
 	if err != nil {
 		return nil, err
 	}
@@ -3583,7 +3603,7 @@ func NewV1UpdateABranchConfigRequestWithBody(server string, branchIdOrRef string
 		return nil, err
 	}
 
-	req, err := http.NewRequest("PATCH", queryURL.String(), body)
+	req, err := http.NewRequest(http.MethodPatch, queryURL.String(), body)
 	if err != nil {
 		return nil, err
 	}
@@ -3599,7 +3619,7 @@ func NewV1DiffABranchRequest(server string, branchIdOrRef string, params *V1Diff
 
 	var pathParam0 string
 
-	pathParam0, err = runtime.StyleParamWithLocation("simple", false, "branch_id_or_ref", runtime.ParamLocationPath, branchIdOrRef)
+	pathParam0, err = runtime.StyleParamWithOptions("simple", false, "branch_id_or_ref", branchIdOrRef, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationPath, Type: "string", Format: ""})
 	if err != nil {
 		return nil, err
 	}
@@ -3620,19 +3640,21 @@ func NewV1DiffABranchRequest(server string, branchIdOrRef string, params *V1Diff
 	}
 
 	if params != nil {
+		// queryValues collects non-styled parameters (passthrough, JSON)
+		// that are safe to round-trip through url.Values.Encode().
 		queryValues := queryURL.Query()
+		// rawQueryFragments collects pre-encoded query fragments from
+		// styled parameters, preserving literal commas as delimiters
+		// per the OpenAPI spec (e.g. "color=blue,black,brown").
+		var rawQueryFragments []string
 
 		if params.IncludedSchemas != nil {
 
-			if queryFrag, err := runtime.StyleParamWithLocation("form", true, "included_schemas", runtime.ParamLocationQuery, *params.IncludedSchemas); err != nil {
-				return nil, err
-			} else if parsed, err := url.ParseQuery(queryFrag); err != nil {
+			if queryFrag, err := runtime.StyleParamWithOptions("form", true, "included_schemas", *params.IncludedSchemas, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationQuery, Type: "string", Format: ""}); err != nil {
 				return nil, err
 			} else {
-				for k, v := range parsed {
-					for _, v2 := range v {
-						queryValues.Add(k, v2)
-					}
+				for _, qp := range strings.Split(queryFrag, "&") {
+					rawQueryFragments = append(rawQueryFragments, qp)
 				}
 			}
 
@@ -3640,24 +3662,23 @@ func NewV1DiffABranchRequest(server string, branchIdOrRef string, params *V1Diff
 
 		if params.Pgdelta != nil {
 
-			if queryFrag, err := runtime.StyleParamWithLocation("form", true, "pgdelta", runtime.ParamLocationQuery, *params.Pgdelta); err != nil {
-				return nil, err
-			} else if parsed, err := url.ParseQuery(queryFrag); err != nil {
+			if queryFrag, err := runtime.StyleParamWithOptions("form", true, "pgdelta", *params.Pgdelta, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationQuery, Type: "boolean", Format: ""}); err != nil {
 				return nil, err
 			} else {
-				for k, v := range parsed {
-					for _, v2 := range v {
-						queryValues.Add(k, v2)
-					}
+				for _, qp := range strings.Split(queryFrag, "&") {
+					rawQueryFragments = append(rawQueryFragments, qp)
 				}
 			}
 
 		}
 
-		queryURL.RawQuery = queryValues.Encode()
+		if encoded := queryValues.Encode(); encoded != "" {
+			rawQueryFragments = append(rawQueryFragments, encoded)
+		}
+		queryURL.RawQuery = strings.Join(rawQueryFragments, "&")
 	}
 
-	req, err := http.NewRequest("GET", queryURL.String(), nil)
+	req, err := http.NewRequest(http.MethodGet, queryURL.String(), nil)
 	if err != nil {
 		return nil, err
 	}
@@ -3682,7 +3703,7 @@ func NewV1MergeABranchRequestWithBody(server string, branchIdOrRef string, conte
 
 	var pathParam0 string
 
-	pathParam0, err = runtime.StyleParamWithLocation("simple", false, "branch_id_or_ref", runtime.ParamLocationPath, branchIdOrRef)
+	pathParam0, err = runtime.StyleParamWithOptions("simple", false, "branch_id_or_ref", branchIdOrRef, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationPath, Type: "string", Format: ""})
 	if err != nil {
 		return nil, err
 	}
@@ -3702,7 +3723,7 @@ func NewV1MergeABranchRequestWithBody(server string, branchIdOrRef string, conte
 		return nil, err
 	}
 
-	req, err := http.NewRequest("POST", queryURL.String(), body)
+	req, err := http.NewRequest(http.MethodPost, queryURL.String(), body)
 	if err != nil {
 		return nil, err
 	}
@@ -3729,7 +3750,7 @@ func NewV1PushABranchRequestWithBody(server string, branchIdOrRef string, conten
 
 	var pathParam0 string
 
-	pathParam0, err = runtime.StyleParamWithLocation("simple", false, "branch_id_or_ref", runtime.ParamLocationPath, branchIdOrRef)
+	pathParam0, err = runtime.StyleParamWithOptions("simple", false, "branch_id_or_ref", branchIdOrRef, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationPath, Type: "string", Format: ""})
 	if err != nil {
 		return nil, err
 	}
@@ -3749,7 +3770,7 @@ func NewV1PushABranchRequestWithBody(server string, branchIdOrRef string, conten
 		return nil, err
 	}
 
-	req, err := http.NewRequest("POST", queryURL.String(), body)
+	req, err := http.NewRequest(http.MethodPost, queryURL.String(), body)
 	if err != nil {
 		return nil, err
 	}
@@ -3776,7 +3797,7 @@ func NewV1ResetABranchRequestWithBody(server string, branchIdOrRef string, conte
 
 	var pathParam0 string
 
-	pathParam0, err = runtime.StyleParamWithLocation("simple", false, "branch_id_or_ref", runtime.ParamLocationPath, branchIdOrRef)
+	pathParam0, err = runtime.StyleParamWithOptions("simple", false, "branch_id_or_ref", branchIdOrRef, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationPath, Type: "string", Format: ""})
 	if err != nil {
 		return nil, err
 	}
@@ -3796,7 +3817,7 @@ func NewV1ResetABranchRequestWithBody(server string, branchIdOrRef string, conte
 		return nil, err
 	}
 
-	req, err := http.NewRequest("POST", queryURL.String(), body)
+	req, err := http.NewRequest(http.MethodPost, queryURL.String(), body)
 	if err != nil {
 		return nil, err
 	}
@@ -3812,7 +3833,7 @@ func NewV1RestoreABranchRequest(server string, branchIdOrRef string) (*http.Requ
 
 	var pathParam0 string
 
-	pathParam0, err = runtime.StyleParamWithLocation("simple", false, "branch_id_or_ref", runtime.ParamLocationPath, branchIdOrRef)
+	pathParam0, err = runtime.StyleParamWithOptions("simple", false, "branch_id_or_ref", branchIdOrRef, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationPath, Type: "string", Format: ""})
 	if err != nil {
 		return nil, err
 	}
@@ -3832,7 +3853,7 @@ func NewV1RestoreABranchRequest(server string, branchIdOrRef string) (*http.Requ
 		return nil, err
 	}
 
-	req, err := http.NewRequest("POST", queryURL.String(), nil)
+	req, err := http.NewRequest(http.MethodPost, queryURL.String(), nil)
 	if err != nil {
 		return nil, err
 	}
@@ -3860,55 +3881,45 @@ func NewV1AuthorizeUserRequest(server string, params *V1AuthorizeUserParams) (*h
 	}
 
 	if params != nil {
+		// queryValues collects non-styled parameters (passthrough, JSON)
+		// that are safe to round-trip through url.Values.Encode().
 		queryValues := queryURL.Query()
+		// rawQueryFragments collects pre-encoded query fragments from
+		// styled parameters, preserving literal commas as delimiters
+		// per the OpenAPI spec (e.g. "color=blue,black,brown").
+		var rawQueryFragments []string
 
-		if queryFrag, err := runtime.StyleParamWithLocation("form", true, "client_id", runtime.ParamLocationQuery, params.ClientId); err != nil {
-			return nil, err
-		} else if parsed, err := url.ParseQuery(queryFrag); err != nil {
+		if queryFrag, err := runtime.StyleParamWithOptions("form", true, "client_id", params.ClientId, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationQuery, Type: "string", Format: "uuid"}); err != nil {
 			return nil, err
 		} else {
-			for k, v := range parsed {
-				for _, v2 := range v {
-					queryValues.Add(k, v2)
-				}
+			for _, qp := range strings.Split(queryFrag, "&") {
+				rawQueryFragments = append(rawQueryFragments, qp)
 			}
 		}
 
-		if queryFrag, err := runtime.StyleParamWithLocation("form", true, "response_type", runtime.ParamLocationQuery, params.ResponseType); err != nil {
-			return nil, err
-		} else if parsed, err := url.ParseQuery(queryFrag); err != nil {
+		if queryFrag, err := runtime.StyleParamWithOptions("form", true, "response_type", params.ResponseType, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationQuery, Type: "string", Format: ""}); err != nil {
 			return nil, err
 		} else {
-			for k, v := range parsed {
-				for _, v2 := range v {
-					queryValues.Add(k, v2)
-				}
+			for _, qp := range strings.Split(queryFrag, "&") {
+				rawQueryFragments = append(rawQueryFragments, qp)
 			}
 		}
 
-		if queryFrag, err := runtime.StyleParamWithLocation("form", true, "redirect_uri", runtime.ParamLocationQuery, params.RedirectUri); err != nil {
-			return nil, err
-		} else if parsed, err := url.ParseQuery(queryFrag); err != nil {
+		if queryFrag, err := runtime.StyleParamWithOptions("form", true, "redirect_uri", params.RedirectUri, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationQuery, Type: "string", Format: ""}); err != nil {
 			return nil, err
 		} else {
-			for k, v := range parsed {
-				for _, v2 := range v {
-					queryValues.Add(k, v2)
-				}
+			for _, qp := range strings.Split(queryFrag, "&") {
+				rawQueryFragments = append(rawQueryFragments, qp)
 			}
 		}
 
 		if params.Scope != nil {
 
-			if queryFrag, err := runtime.StyleParamWithLocation("form", true, "scope", runtime.ParamLocationQuery, *params.Scope); err != nil {
-				return nil, err
-			} else if parsed, err := url.ParseQuery(queryFrag); err != nil {
+			if queryFrag, err := runtime.StyleParamWithOptions("form", true, "scope", *params.Scope, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationQuery, Type: "string", Format: ""}); err != nil {
 				return nil, err
 			} else {
-				for k, v := range parsed {
-					for _, v2 := range v {
-						queryValues.Add(k, v2)
-					}
+				for _, qp := range strings.Split(queryFrag, "&") {
+					rawQueryFragments = append(rawQueryFragments, qp)
 				}
 			}
 
@@ -3916,15 +3927,11 @@ func NewV1AuthorizeUserRequest(server string, params *V1AuthorizeUserParams) (*h
 
 		if params.State != nil {
 
-			if queryFrag, err := runtime.StyleParamWithLocation("form", true, "state", runtime.ParamLocationQuery, *params.State); err != nil {
-				return nil, err
-			} else if parsed, err := url.ParseQuery(queryFrag); err != nil {
+			if queryFrag, err := runtime.StyleParamWithOptions("form", true, "state", *params.State, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationQuery, Type: "string", Format: ""}); err != nil {
 				return nil, err
 			} else {
-				for k, v := range parsed {
-					for _, v2 := range v {
-						queryValues.Add(k, v2)
-					}
+				for _, qp := range strings.Split(queryFrag, "&") {
+					rawQueryFragments = append(rawQueryFragments, qp)
 				}
 			}
 
@@ -3932,15 +3939,11 @@ func NewV1AuthorizeUserRequest(server string, params *V1AuthorizeUserParams) (*h
 
 		if params.ResponseMode != nil {
 
-			if queryFrag, err := runtime.StyleParamWithLocation("form", true, "response_mode", runtime.ParamLocationQuery, *params.ResponseMode); err != nil {
-				return nil, err
-			} else if parsed, err := url.ParseQuery(queryFrag); err != nil {
+			if queryFrag, err := runtime.StyleParamWithOptions("form", true, "response_mode", *params.ResponseMode, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationQuery, Type: "string", Format: ""}); err != nil {
 				return nil, err
 			} else {
-				for k, v := range parsed {
-					for _, v2 := range v {
-						queryValues.Add(k, v2)
-					}
+				for _, qp := range strings.Split(queryFrag, "&") {
+					rawQueryFragments = append(rawQueryFragments, qp)
 				}
 			}
 
@@ -3948,15 +3951,11 @@ func NewV1AuthorizeUserRequest(server string, params *V1AuthorizeUserParams) (*h
 
 		if params.CodeChallenge != nil {
 
-			if queryFrag, err := runtime.StyleParamWithLocation("form", true, "code_challenge", runtime.ParamLocationQuery, *params.CodeChallenge); err != nil {
-				return nil, err
-			} else if parsed, err := url.ParseQuery(queryFrag); err != nil {
+			if queryFrag, err := runtime.StyleParamWithOptions("form", true, "code_challenge", *params.CodeChallenge, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationQuery, Type: "string", Format: ""}); err != nil {
 				return nil, err
 			} else {
-				for k, v := range parsed {
-					for _, v2 := range v {
-						queryValues.Add(k, v2)
-					}
+				for _, qp := range strings.Split(queryFrag, "&") {
+					rawQueryFragments = append(rawQueryFragments, qp)
 				}
 			}
 
@@ -3964,15 +3963,11 @@ func NewV1AuthorizeUserRequest(server string, params *V1AuthorizeUserParams) (*h
 
 		if params.CodeChallengeMethod != nil {
 
-			if queryFrag, err := runtime.StyleParamWithLocation("form", true, "code_challenge_method", runtime.ParamLocationQuery, *params.CodeChallengeMethod); err != nil {
-				return nil, err
-			} else if parsed, err := url.ParseQuery(queryFrag); err != nil {
+			if queryFrag, err := runtime.StyleParamWithOptions("form", true, "code_challenge_method", *params.CodeChallengeMethod, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationQuery, Type: "string", Format: ""}); err != nil {
 				return nil, err
 			} else {
-				for k, v := range parsed {
-					for _, v2 := range v {
-						queryValues.Add(k, v2)
-					}
+				for _, qp := range strings.Split(queryFrag, "&") {
+					rawQueryFragments = append(rawQueryFragments, qp)
 				}
 			}
 
@@ -3980,15 +3975,11 @@ func NewV1AuthorizeUserRequest(server string, params *V1AuthorizeUserParams) (*h
 
 		if params.OrganizationSlug != nil {
 
-			if queryFrag, err := runtime.StyleParamWithLocation("form", true, "organization_slug", runtime.ParamLocationQuery, *params.OrganizationSlug); err != nil {
-				return nil, err
-			} else if parsed, err := url.ParseQuery(queryFrag); err != nil {
+			if queryFrag, err := runtime.StyleParamWithOptions("form", true, "organization_slug", *params.OrganizationSlug, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationQuery, Type: "string", Format: ""}); err != nil {
 				return nil, err
 			} else {
-				for k, v := range parsed {
-					for _, v2 := range v {
-						queryValues.Add(k, v2)
-					}
+				for _, qp := range strings.Split(queryFrag, "&") {
+					rawQueryFragments = append(rawQueryFragments, qp)
 				}
 			}
 
@@ -3996,15 +3987,11 @@ func NewV1AuthorizeUserRequest(server string, params *V1AuthorizeUserParams) (*h
 
 		if params.TargetFlow != nil {
 
-			if queryFrag, err := runtime.StyleParamWithLocation("form", true, "target_flow", runtime.ParamLocationQuery, *params.TargetFlow); err != nil {
-				return nil, err
-			} else if parsed, err := url.ParseQuery(queryFrag); err != nil {
+			if queryFrag, err := runtime.StyleParamWithOptions("form", true, "target_flow", *params.TargetFlow, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationQuery, Type: "string", Format: ""}); err != nil {
 				return nil, err
 			} else {
-				for k, v := range parsed {
-					for _, v2 := range v {
-						queryValues.Add(k, v2)
-					}
+				for _, qp := range strings.Split(queryFrag, "&") {
+					rawQueryFragments = append(rawQueryFragments, qp)
 				}
 			}
 
@@ -4012,24 +3999,23 @@ func NewV1AuthorizeUserRequest(server string, params *V1AuthorizeUserParams) (*h
 
 		if params.Resource != nil {
 
-			if queryFrag, err := runtime.StyleParamWithLocation("form", true, "resource", runtime.ParamLocationQuery, *params.Resource); err != nil {
-				return nil, err
-			} else if parsed, err := url.ParseQuery(queryFrag); err != nil {
+			if queryFrag, err := runtime.StyleParamWithOptions("form", true, "resource", *params.Resource, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationQuery, Type: "string", Format: "uri"}); err != nil {
 				return nil, err
 			} else {
-				for k, v := range parsed {
-					for _, v2 := range v {
-						queryValues.Add(k, v2)
-					}
+				for _, qp := range strings.Split(queryFrag, "&") {
+					rawQueryFragments = append(rawQueryFragments, qp)
 				}
 			}
 
 		}
 
-		queryURL.RawQuery = queryValues.Encode()
+		if encoded := queryValues.Encode(); encoded != "" {
+			rawQueryFragments = append(rawQueryFragments, encoded)
+		}
+		queryURL.RawQuery = strings.Join(rawQueryFragments, "&")
 	}
 
-	req, err := http.NewRequest("GET", queryURL.String(), nil)
+	req, err := http.NewRequest(http.MethodGet, queryURL.String(), nil)
 	if err != nil {
 		return nil, err
 	}
@@ -4057,67 +4043,53 @@ func NewV1OauthAuthorizeProjectClaimRequest(server string, params *V1OauthAuthor
 	}
 
 	if params != nil {
+		// queryValues collects non-styled parameters (passthrough, JSON)
+		// that are safe to round-trip through url.Values.Encode().
 		queryValues := queryURL.Query()
+		// rawQueryFragments collects pre-encoded query fragments from
+		// styled parameters, preserving literal commas as delimiters
+		// per the OpenAPI spec (e.g. "color=blue,black,brown").
+		var rawQueryFragments []string
 
-		if queryFrag, err := runtime.StyleParamWithLocation("form", true, "project_ref", runtime.ParamLocationQuery, params.ProjectRef); err != nil {
-			return nil, err
-		} else if parsed, err := url.ParseQuery(queryFrag); err != nil {
+		if queryFrag, err := runtime.StyleParamWithOptions("form", true, "project_ref", params.ProjectRef, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationQuery, Type: "string", Format: ""}); err != nil {
 			return nil, err
 		} else {
-			for k, v := range parsed {
-				for _, v2 := range v {
-					queryValues.Add(k, v2)
-				}
+			for _, qp := range strings.Split(queryFrag, "&") {
+				rawQueryFragments = append(rawQueryFragments, qp)
 			}
 		}
 
-		if queryFrag, err := runtime.StyleParamWithLocation("form", true, "client_id", runtime.ParamLocationQuery, params.ClientId); err != nil {
-			return nil, err
-		} else if parsed, err := url.ParseQuery(queryFrag); err != nil {
+		if queryFrag, err := runtime.StyleParamWithOptions("form", true, "client_id", params.ClientId, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationQuery, Type: "string", Format: "uuid"}); err != nil {
 			return nil, err
 		} else {
-			for k, v := range parsed {
-				for _, v2 := range v {
-					queryValues.Add(k, v2)
-				}
+			for _, qp := range strings.Split(queryFrag, "&") {
+				rawQueryFragments = append(rawQueryFragments, qp)
 			}
 		}
 
-		if queryFrag, err := runtime.StyleParamWithLocation("form", true, "response_type", runtime.ParamLocationQuery, params.ResponseType); err != nil {
-			return nil, err
-		} else if parsed, err := url.ParseQuery(queryFrag); err != nil {
+		if queryFrag, err := runtime.StyleParamWithOptions("form", true, "response_type", params.ResponseType, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationQuery, Type: "string", Format: ""}); err != nil {
 			return nil, err
 		} else {
-			for k, v := range parsed {
-				for _, v2 := range v {
-					queryValues.Add(k, v2)
-				}
+			for _, qp := range strings.Split(queryFrag, "&") {
+				rawQueryFragments = append(rawQueryFragments, qp)
 			}
 		}
 
-		if queryFrag, err := runtime.StyleParamWithLocation("form", true, "redirect_uri", runtime.ParamLocationQuery, params.RedirectUri); err != nil {
-			return nil, err
-		} else if parsed, err := url.ParseQuery(queryFrag); err != nil {
+		if queryFrag, err := runtime.StyleParamWithOptions("form", true, "redirect_uri", params.RedirectUri, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationQuery, Type: "string", Format: ""}); err != nil {
 			return nil, err
 		} else {
-			for k, v := range parsed {
-				for _, v2 := range v {
-					queryValues.Add(k, v2)
-				}
+			for _, qp := range strings.Split(queryFrag, "&") {
+				rawQueryFragments = append(rawQueryFragments, qp)
 			}
 		}
 
 		if params.State != nil {
 
-			if queryFrag, err := runtime.StyleParamWithLocation("form", true, "state", runtime.ParamLocationQuery, *params.State); err != nil {
-				return nil, err
-			} else if parsed, err := url.ParseQuery(queryFrag); err != nil {
+			if queryFrag, err := runtime.StyleParamWithOptions("form", true, "state", *params.State, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationQuery, Type: "string", Format: ""}); err != nil {
 				return nil, err
 			} else {
-				for k, v := range parsed {
-					for _, v2 := range v {
-						queryValues.Add(k, v2)
-					}
+				for _, qp := range strings.Split(queryFrag, "&") {
+					rawQueryFragments = append(rawQueryFragments, qp)
 				}
 			}
 
@@ -4125,15 +4097,11 @@ func NewV1OauthAuthorizeProjectClaimRequest(server string, params *V1OauthAuthor
 
 		if params.ResponseMode != nil {
 
-			if queryFrag, err := runtime.StyleParamWithLocation("form", true, "response_mode", runtime.ParamLocationQuery, *params.ResponseMode); err != nil {
-				return nil, err
-			} else if parsed, err := url.ParseQuery(queryFrag); err != nil {
+			if queryFrag, err := runtime.StyleParamWithOptions("form", true, "response_mode", *params.ResponseMode, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationQuery, Type: "string", Format: ""}); err != nil {
 				return nil, err
 			} else {
-				for k, v := range parsed {
-					for _, v2 := range v {
-						queryValues.Add(k, v2)
-					}
+				for _, qp := range strings.Split(queryFrag, "&") {
+					rawQueryFragments = append(rawQueryFragments, qp)
 				}
 			}
 
@@ -4141,15 +4109,11 @@ func NewV1OauthAuthorizeProjectClaimRequest(server string, params *V1OauthAuthor
 
 		if params.CodeChallenge != nil {
 
-			if queryFrag, err := runtime.StyleParamWithLocation("form", true, "code_challenge", runtime.ParamLocationQuery, *params.CodeChallenge); err != nil {
-				return nil, err
-			} else if parsed, err := url.ParseQuery(queryFrag); err != nil {
+			if queryFrag, err := runtime.StyleParamWithOptions("form", true, "code_challenge", *params.CodeChallenge, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationQuery, Type: "string", Format: ""}); err != nil {
 				return nil, err
 			} else {
-				for k, v := range parsed {
-					for _, v2 := range v {
-						queryValues.Add(k, v2)
-					}
+				for _, qp := range strings.Split(queryFrag, "&") {
+					rawQueryFragments = append(rawQueryFragments, qp)
 				}
 			}
 
@@ -4157,24 +4121,23 @@ func NewV1OauthAuthorizeProjectClaimRequest(server string, params *V1OauthAuthor
 
 		if params.CodeChallengeMethod != nil {
 
-			if queryFrag, err := runtime.StyleParamWithLocation("form", true, "code_challenge_method", runtime.ParamLocationQuery, *params.CodeChallengeMethod); err != nil {
-				return nil, err
-			} else if parsed, err := url.ParseQuery(queryFrag); err != nil {
+			if queryFrag, err := runtime.StyleParamWithOptions("form", true, "code_challenge_method", *params.CodeChallengeMethod, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationQuery, Type: "string", Format: ""}); err != nil {
 				return nil, err
 			} else {
-				for k, v := range parsed {
-					for _, v2 := range v {
-						queryValues.Add(k, v2)
-					}
+				for _, qp := range strings.Split(queryFrag, "&") {
+					rawQueryFragments = append(rawQueryFragments, qp)
 				}
 			}
 
 		}
 
-		queryURL.RawQuery = queryValues.Encode()
+		if encoded := queryValues.Encode(); encoded != "" {
+			rawQueryFragments = append(rawQueryFragments, encoded)
+		}
+		queryURL.RawQuery = strings.Join(rawQueryFragments, "&")
 	}
 
-	req, err := http.NewRequest("GET", queryURL.String(), nil)
+	req, err := http.NewRequest(http.MethodGet, queryURL.String(), nil)
 	if err != nil {
 		return nil, err
 	}
@@ -4212,7 +4175,7 @@ func NewV1RevokeTokenRequestWithBody(server string, contentType string, body io.
 		return nil, err
 	}
 
-	req, err := http.NewRequest("POST", queryURL.String(), body)
+	req, err := http.NewRequest(http.MethodPost, queryURL.String(), body)
 	if err != nil {
 		return nil, err
 	}
@@ -4252,7 +4215,7 @@ func NewV1ExchangeOauthTokenRequestWithBody(server string, contentType string, b
 		return nil, err
 	}
 
-	req, err := http.NewRequest("POST", queryURL.String(), body)
+	req, err := http.NewRequest(http.MethodPost, queryURL.String(), body)
 	if err != nil {
 		return nil, err
 	}
@@ -4281,7 +4244,7 @@ func NewV1ListAllOrganizationsRequest(server string) (*http.Request, error) {
 		return nil, err
 	}
 
-	req, err := http.NewRequest("GET", queryURL.String(), nil)
+	req, err := http.NewRequest(http.MethodGet, queryURL.String(), nil)
 	if err != nil {
 		return nil, err
 	}
@@ -4319,7 +4282,7 @@ func NewV1CreateAnOrganizationRequestWithBody(server string, contentType string,
 		return nil, err
 	}
 
-	req, err := http.NewRequest("POST", queryURL.String(), body)
+	req, err := http.NewRequest(http.MethodPost, queryURL.String(), body)
 	if err != nil {
 		return nil, err
 	}
@@ -4335,7 +4298,7 @@ func NewV1GetAnOrganizationRequest(server string, slug string) (*http.Request, e
 
 	var pathParam0 string
 
-	pathParam0, err = runtime.StyleParamWithLocation("simple", false, "slug", runtime.ParamLocationPath, slug)
+	pathParam0, err = runtime.StyleParamWithOptions("simple", false, "slug", slug, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationPath, Type: "string", Format: ""})
 	if err != nil {
 		return nil, err
 	}
@@ -4355,7 +4318,7 @@ func NewV1GetAnOrganizationRequest(server string, slug string) (*http.Request, e
 		return nil, err
 	}
 
-	req, err := http.NewRequest("GET", queryURL.String(), nil)
+	req, err := http.NewRequest(http.MethodGet, queryURL.String(), nil)
 	if err != nil {
 		return nil, err
 	}
@@ -4369,7 +4332,7 @@ func NewV1GetOrganizationEntitlementsRequest(server string, slug string) (*http.
 
 	var pathParam0 string
 
-	pathParam0, err = runtime.StyleParamWithLocation("simple", false, "slug", runtime.ParamLocationPath, slug)
+	pathParam0, err = runtime.StyleParamWithOptions("simple", false, "slug", slug, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationPath, Type: "string", Format: ""})
 	if err != nil {
 		return nil, err
 	}
@@ -4389,7 +4352,7 @@ func NewV1GetOrganizationEntitlementsRequest(server string, slug string) (*http.
 		return nil, err
 	}
 
-	req, err := http.NewRequest("GET", queryURL.String(), nil)
+	req, err := http.NewRequest(http.MethodGet, queryURL.String(), nil)
 	if err != nil {
 		return nil, err
 	}
@@ -4403,7 +4366,7 @@ func NewV1ListOrganizationMembersRequest(server string, slug string) (*http.Requ
 
 	var pathParam0 string
 
-	pathParam0, err = runtime.StyleParamWithLocation("simple", false, "slug", runtime.ParamLocationPath, slug)
+	pathParam0, err = runtime.StyleParamWithOptions("simple", false, "slug", slug, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationPath, Type: "string", Format: ""})
 	if err != nil {
 		return nil, err
 	}
@@ -4423,7 +4386,7 @@ func NewV1ListOrganizationMembersRequest(server string, slug string) (*http.Requ
 		return nil, err
 	}
 
-	req, err := http.NewRequest("GET", queryURL.String(), nil)
+	req, err := http.NewRequest(http.MethodGet, queryURL.String(), nil)
 	if err != nil {
 		return nil, err
 	}
@@ -4437,14 +4400,14 @@ func NewV1GetOrganizationProjectClaimRequest(server string, slug string, token s
 
 	var pathParam0 string
 
-	pathParam0, err = runtime.StyleParamWithLocation("simple", false, "slug", runtime.ParamLocationPath, slug)
+	pathParam0, err = runtime.StyleParamWithOptions("simple", false, "slug", slug, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationPath, Type: "string", Format: ""})
 	if err != nil {
 		return nil, err
 	}
 
 	var pathParam1 string
 
-	pathParam1, err = runtime.StyleParamWithLocation("simple", false, "token", runtime.ParamLocationPath, token)
+	pathParam1, err = runtime.StyleParamWithOptions("simple", false, "token", token, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationPath, Type: "string", Format: ""})
 	if err != nil {
 		return nil, err
 	}
@@ -4464,7 +4427,7 @@ func NewV1GetOrganizationProjectClaimRequest(server string, slug string, token s
 		return nil, err
 	}
 
-	req, err := http.NewRequest("GET", queryURL.String(), nil)
+	req, err := http.NewRequest(http.MethodGet, queryURL.String(), nil)
 	if err != nil {
 		return nil, err
 	}
@@ -4478,14 +4441,14 @@ func NewV1ClaimProjectForOrganizationRequest(server string, slug string, token s
 
 	var pathParam0 string
 
-	pathParam0, err = runtime.StyleParamWithLocation("simple", false, "slug", runtime.ParamLocationPath, slug)
+	pathParam0, err = runtime.StyleParamWithOptions("simple", false, "slug", slug, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationPath, Type: "string", Format: ""})
 	if err != nil {
 		return nil, err
 	}
 
 	var pathParam1 string
 
-	pathParam1, err = runtime.StyleParamWithLocation("simple", false, "token", runtime.ParamLocationPath, token)
+	pathParam1, err = runtime.StyleParamWithOptions("simple", false, "token", token, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationPath, Type: "string", Format: ""})
 	if err != nil {
 		return nil, err
 	}
@@ -4505,7 +4468,7 @@ func NewV1ClaimProjectForOrganizationRequest(server string, slug string, token s
 		return nil, err
 	}
 
-	req, err := http.NewRequest("POST", queryURL.String(), nil)
+	req, err := http.NewRequest(http.MethodPost, queryURL.String(), nil)
 	if err != nil {
 		return nil, err
 	}
@@ -4519,7 +4482,7 @@ func NewV1GetAllProjectsForOrganizationRequest(server string, slug string, param
 
 	var pathParam0 string
 
-	pathParam0, err = runtime.StyleParamWithLocation("simple", false, "slug", runtime.ParamLocationPath, slug)
+	pathParam0, err = runtime.StyleParamWithOptions("simple", false, "slug", slug, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationPath, Type: "string", Format: ""})
 	if err != nil {
 		return nil, err
 	}
@@ -4540,19 +4503,21 @@ func NewV1GetAllProjectsForOrganizationRequest(server string, slug string, param
 	}
 
 	if params != nil {
+		// queryValues collects non-styled parameters (passthrough, JSON)
+		// that are safe to round-trip through url.Values.Encode().
 		queryValues := queryURL.Query()
+		// rawQueryFragments collects pre-encoded query fragments from
+		// styled parameters, preserving literal commas as delimiters
+		// per the OpenAPI spec (e.g. "color=blue,black,brown").
+		var rawQueryFragments []string
 
 		if params.Offset != nil {
 
-			if queryFrag, err := runtime.StyleParamWithLocation("form", true, "offset", runtime.ParamLocationQuery, *params.Offset); err != nil {
-				return nil, err
-			} else if parsed, err := url.ParseQuery(queryFrag); err != nil {
+			if queryFrag, err := runtime.StyleParamWithOptions("form", true, "offset", *params.Offset, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationQuery, Type: "integer", Format: ""}); err != nil {
 				return nil, err
 			} else {
-				for k, v := range parsed {
-					for _, v2 := range v {
-						queryValues.Add(k, v2)
-					}
+				for _, qp := range strings.Split(queryFrag, "&") {
+					rawQueryFragments = append(rawQueryFragments, qp)
 				}
 			}
 
@@ -4560,15 +4525,11 @@ func NewV1GetAllProjectsForOrganizationRequest(server string, slug string, param
 
 		if params.Limit != nil {
 
-			if queryFrag, err := runtime.StyleParamWithLocation("form", true, "limit", runtime.ParamLocationQuery, *params.Limit); err != nil {
-				return nil, err
-			} else if parsed, err := url.ParseQuery(queryFrag); err != nil {
+			if queryFrag, err := runtime.StyleParamWithOptions("form", true, "limit", *params.Limit, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationQuery, Type: "integer", Format: ""}); err != nil {
 				return nil, err
 			} else {
-				for k, v := range parsed {
-					for _, v2 := range v {
-						queryValues.Add(k, v2)
-					}
+				for _, qp := range strings.Split(queryFrag, "&") {
+					rawQueryFragments = append(rawQueryFragments, qp)
 				}
 			}
 
@@ -4576,15 +4537,11 @@ func NewV1GetAllProjectsForOrganizationRequest(server string, slug string, param
 
 		if params.Search != nil {
 
-			if queryFrag, err := runtime.StyleParamWithLocation("form", true, "search", runtime.ParamLocationQuery, *params.Search); err != nil {
-				return nil, err
-			} else if parsed, err := url.ParseQuery(queryFrag); err != nil {
+			if queryFrag, err := runtime.StyleParamWithOptions("form", true, "search", *params.Search, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationQuery, Type: "string", Format: ""}); err != nil {
 				return nil, err
 			} else {
-				for k, v := range parsed {
-					for _, v2 := range v {
-						queryValues.Add(k, v2)
-					}
+				for _, qp := range strings.Split(queryFrag, "&") {
+					rawQueryFragments = append(rawQueryFragments, qp)
 				}
 			}
 
@@ -4592,15 +4549,11 @@ func NewV1GetAllProjectsForOrganizationRequest(server string, slug string, param
 
 		if params.Sort != nil {
 
-			if queryFrag, err := runtime.StyleParamWithLocation("form", true, "sort", runtime.ParamLocationQuery, *params.Sort); err != nil {
-				return nil, err
-			} else if parsed, err := url.ParseQuery(queryFrag); err != nil {
+			if queryFrag, err := runtime.StyleParamWithOptions("form", true, "sort", *params.Sort, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationQuery, Type: "string", Format: ""}); err != nil {
 				return nil, err
 			} else {
-				for k, v := range parsed {
-					for _, v2 := range v {
-						queryValues.Add(k, v2)
-					}
+				for _, qp := range strings.Split(queryFrag, "&") {
+					rawQueryFragments = append(rawQueryFragments, qp)
 				}
 			}
 
@@ -4608,24 +4561,23 @@ func NewV1GetAllProjectsForOrganizationRequest(server string, slug string, param
 
 		if params.Statuses != nil {
 
-			if queryFrag, err := runtime.StyleParamWithLocation("form", true, "statuses", runtime.ParamLocationQuery, *params.Statuses); err != nil {
-				return nil, err
-			} else if parsed, err := url.ParseQuery(queryFrag); err != nil {
+			if queryFrag, err := runtime.StyleParamWithOptions("form", true, "statuses", *params.Statuses, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationQuery, Type: "string", Format: ""}); err != nil {
 				return nil, err
 			} else {
-				for k, v := range parsed {
-					for _, v2 := range v {
-						queryValues.Add(k, v2)
-					}
+				for _, qp := range strings.Split(queryFrag, "&") {
+					rawQueryFragments = append(rawQueryFragments, qp)
 				}
 			}
 
 		}
 
-		queryURL.RawQuery = queryValues.Encode()
+		if encoded := queryValues.Encode(); encoded != "" {
+			rawQueryFragments = append(rawQueryFragments, encoded)
+		}
+		queryURL.RawQuery = strings.Join(rawQueryFragments, "&")
 	}
 
-	req, err := http.NewRequest("GET", queryURL.String(), nil)
+	req, err := http.NewRequest(http.MethodGet, queryURL.String(), nil)
 	if err != nil {
 		return nil, err
 	}
@@ -4652,7 +4604,7 @@ func NewV1GetProfileRequest(server string) (*http.Request, error) {
 		return nil, err
 	}
 
-	req, err := http.NewRequest("GET", queryURL.String(), nil)
+	req, err := http.NewRequest(http.MethodGet, queryURL.String(), nil)
 	if err != nil {
 		return nil, err
 	}
@@ -4679,7 +4631,7 @@ func NewV1ListAllProjectsRequest(server string) (*http.Request, error) {
 		return nil, err
 	}
 
-	req, err := http.NewRequest("GET", queryURL.String(), nil)
+	req, err := http.NewRequest(http.MethodGet, queryURL.String(), nil)
 	if err != nil {
 		return nil, err
 	}
@@ -4717,7 +4669,7 @@ func NewV1CreateAProjectRequestWithBody(server string, contentType string, body
 		return nil, err
 	}
 
-	req, err := http.NewRequest("POST", queryURL.String(), body)
+	req, err := http.NewRequest(http.MethodPost, queryURL.String(), body)
 	if err != nil {
 		return nil, err
 	}
@@ -4747,31 +4699,29 @@ func NewV1GetAvailableRegionsRequest(server string, params *V1GetAvailableRegion
 	}
 
 	if params != nil {
+		// queryValues collects non-styled parameters (passthrough, JSON)
+		// that are safe to round-trip through url.Values.Encode().
 		queryValues := queryURL.Query()
+		// rawQueryFragments collects pre-encoded query fragments from
+		// styled parameters, preserving literal commas as delimiters
+		// per the OpenAPI spec (e.g. "color=blue,black,brown").
+		var rawQueryFragments []string
 
-		if queryFrag, err := runtime.StyleParamWithLocation("form", true, "organization_slug", runtime.ParamLocationQuery, params.OrganizationSlug); err != nil {
-			return nil, err
-		} else if parsed, err := url.ParseQuery(queryFrag); err != nil {
+		if queryFrag, err := runtime.StyleParamWithOptions("form", true, "organization_slug", params.OrganizationSlug, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationQuery, Type: "string", Format: ""}); err != nil {
 			return nil, err
 		} else {
-			for k, v := range parsed {
-				for _, v2 := range v {
-					queryValues.Add(k, v2)
-				}
+			for _, qp := range strings.Split(queryFrag, "&") {
+				rawQueryFragments = append(rawQueryFragments, qp)
 			}
 		}
 
 		if params.Continent != nil {
 
-			if queryFrag, err := runtime.StyleParamWithLocation("form", true, "continent", runtime.ParamLocationQuery, *params.Continent); err != nil {
-				return nil, err
-			} else if parsed, err := url.ParseQuery(queryFrag); err != nil {
+			if queryFrag, err := runtime.StyleParamWithOptions("form", true, "continent", *params.Continent, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationQuery, Type: "string", Format: ""}); err != nil {
 				return nil, err
 			} else {
-				for k, v := range parsed {
-					for _, v2 := range v {
-						queryValues.Add(k, v2)
-					}
+				for _, qp := range strings.Split(queryFrag, "&") {
+					rawQueryFragments = append(rawQueryFragments, qp)
 				}
 			}
 
@@ -4779,24 +4729,23 @@ func NewV1GetAvailableRegionsRequest(server string, params *V1GetAvailableRegion
 
 		if params.DesiredInstanceSize != nil {
 
-			if queryFrag, err := runtime.StyleParamWithLocation("form", true, "desired_instance_size", runtime.ParamLocationQuery, *params.DesiredInstanceSize); err != nil {
-				return nil, err
-			} else if parsed, err := url.ParseQuery(queryFrag); err != nil {
+			if queryFrag, err := runtime.StyleParamWithOptions("form", true, "desired_instance_size", *params.DesiredInstanceSize, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationQuery, Type: "string", Format: ""}); err != nil {
 				return nil, err
 			} else {
-				for k, v := range parsed {
-					for _, v2 := range v {
-						queryValues.Add(k, v2)
-					}
+				for _, qp := range strings.Split(queryFrag, "&") {
+					rawQueryFragments = append(rawQueryFragments, qp)
 				}
 			}
 
 		}
 
-		queryURL.RawQuery = queryValues.Encode()
+		if encoded := queryValues.Encode(); encoded != "" {
+			rawQueryFragments = append(rawQueryFragments, encoded)
+		}
+		queryURL.RawQuery = strings.Join(rawQueryFragments, "&")
 	}
 
-	req, err := http.NewRequest("GET", queryURL.String(), nil)
+	req, err := http.NewRequest(http.MethodGet, queryURL.String(), nil)
 	if err != nil {
 		return nil, err
 	}
@@ -4810,7 +4759,7 @@ func NewV1DeleteAProjectRequest(server string, ref string) (*http.Request, error
 
 	var pathParam0 string
 
-	pathParam0, err = runtime.StyleParamWithLocation("simple", false, "ref", runtime.ParamLocationPath, ref)
+	pathParam0, err = runtime.StyleParamWithOptions("simple", false, "ref", ref, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationPath, Type: "string", Format: ""})
 	if err != nil {
 		return nil, err
 	}
@@ -4830,7 +4779,7 @@ func NewV1DeleteAProjectRequest(server string, ref string) (*http.Request, error
 		return nil, err
 	}
 
-	req, err := http.NewRequest("DELETE", queryURL.String(), nil)
+	req, err := http.NewRequest(http.MethodDelete, queryURL.String(), nil)
 	if err != nil {
 		return nil, err
 	}
@@ -4844,7 +4793,7 @@ func NewV1GetProjectRequest(server string, ref string) (*http.Request, error) {
 
 	var pathParam0 string
 
-	pathParam0, err = runtime.StyleParamWithLocation("simple", false, "ref", runtime.ParamLocationPath, ref)
+	pathParam0, err = runtime.StyleParamWithOptions("simple", false, "ref", ref, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationPath, Type: "string", Format: ""})
 	if err != nil {
 		return nil, err
 	}
@@ -4864,7 +4813,7 @@ func NewV1GetProjectRequest(server string, ref string) (*http.Request, error) {
 		return nil, err
 	}
 
-	req, err := http.NewRequest("GET", queryURL.String(), nil)
+	req, err := http.NewRequest(http.MethodGet, queryURL.String(), nil)
 	if err != nil {
 		return nil, err
 	}
@@ -4889,7 +4838,7 @@ func NewV1UpdateAProjectRequestWithBody(server string, ref string, contentType s
 
 	var pathParam0 string
 
-	pathParam0, err = runtime.StyleParamWithLocation("simple", false, "ref", runtime.ParamLocationPath, ref)
+	pathParam0, err = runtime.StyleParamWithOptions("simple", false, "ref", ref, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationPath, Type: "string", Format: ""})
 	if err != nil {
 		return nil, err
 	}
@@ -4909,7 +4858,7 @@ func NewV1UpdateAProjectRequestWithBody(server string, ref string, contentType s
 		return nil, err
 	}
 
-	req, err := http.NewRequest("PATCH", queryURL.String(), body)
+	req, err := http.NewRequest(http.MethodPatch, queryURL.String(), body)
 	if err != nil {
 		return nil, err
 	}
@@ -4925,7 +4874,7 @@ func NewV1ListActionRunsRequest(server string, ref string, params *V1ListActionR
 
 	var pathParam0 string
 
-	pathParam0, err = runtime.StyleParamWithLocation("simple", false, "ref", runtime.ParamLocationPath, ref)
+	pathParam0, err = runtime.StyleParamWithOptions("simple", false, "ref", ref, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationPath, Type: "string", Format: ""})
 	if err != nil {
 		return nil, err
 	}
@@ -4946,19 +4895,21 @@ func NewV1ListActionRunsRequest(server string, ref string, params *V1ListActionR
 	}
 
 	if params != nil {
+		// queryValues collects non-styled parameters (passthrough, JSON)
+		// that are safe to round-trip through url.Values.Encode().
 		queryValues := queryURL.Query()
+		// rawQueryFragments collects pre-encoded query fragments from
+		// styled parameters, preserving literal commas as delimiters
+		// per the OpenAPI spec (e.g. "color=blue,black,brown").
+		var rawQueryFragments []string
 
 		if params.Offset != nil {
 
-			if queryFrag, err := runtime.StyleParamWithLocation("form", true, "offset", runtime.ParamLocationQuery, *params.Offset); err != nil {
-				return nil, err
-			} else if parsed, err := url.ParseQuery(queryFrag); err != nil {
+			if queryFrag, err := runtime.StyleParamWithOptions("form", true, "offset", *params.Offset, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationQuery, Type: "number", Format: ""}); err != nil {
 				return nil, err
 			} else {
-				for k, v := range parsed {
-					for _, v2 := range v {
-						queryValues.Add(k, v2)
-					}
+				for _, qp := range strings.Split(queryFrag, "&") {
+					rawQueryFragments = append(rawQueryFragments, qp)
 				}
 			}
 
@@ -4966,24 +4917,23 @@ func NewV1ListActionRunsRequest(server string, ref string, params *V1ListActionR
 
 		if params.Limit != nil {
 
-			if queryFrag, err := runtime.StyleParamWithLocation("form", true, "limit", runtime.ParamLocationQuery, *params.Limit); err != nil {
-				return nil, err
-			} else if parsed, err := url.ParseQuery(queryFrag); err != nil {
+			if queryFrag, err := runtime.StyleParamWithOptions("form", true, "limit", *params.Limit, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationQuery, Type: "number", Format: ""}); err != nil {
 				return nil, err
 			} else {
-				for k, v := range parsed {
-					for _, v2 := range v {
-						queryValues.Add(k, v2)
-					}
+				for _, qp := range strings.Split(queryFrag, "&") {
+					rawQueryFragments = append(rawQueryFragments, qp)
 				}
 			}
 
 		}
 
-		queryURL.RawQuery = queryValues.Encode()
+		if encoded := queryValues.Encode(); encoded != "" {
+			rawQueryFragments = append(rawQueryFragments, encoded)
+		}
+		queryURL.RawQuery = strings.Join(rawQueryFragments, "&")
 	}
 
-	req, err := http.NewRequest("GET", queryURL.String(), nil)
+	req, err := http.NewRequest(http.MethodGet, queryURL.String(), nil)
 	if err != nil {
 		return nil, err
 	}
@@ -4997,7 +4947,7 @@ func NewV1CountActionRunsRequest(server string, ref string) (*http.Request, erro
 
 	var pathParam0 string
 
-	pathParam0, err = runtime.StyleParamWithLocation("simple", false, "ref", runtime.ParamLocationPath, ref)
+	pathParam0, err = runtime.StyleParamWithOptions("simple", false, "ref", ref, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationPath, Type: "string", Format: ""})
 	if err != nil {
 		return nil, err
 	}
@@ -5017,7 +4967,7 @@ func NewV1CountActionRunsRequest(server string, ref string) (*http.Request, erro
 		return nil, err
 	}
 
-	req, err := http.NewRequest("HEAD", queryURL.String(), nil)
+	req, err := http.NewRequest(http.MethodHead, queryURL.String(), nil)
 	if err != nil {
 		return nil, err
 	}
@@ -5031,14 +4981,14 @@ func NewV1GetActionRunRequest(server string, ref string, runId string) (*http.Re
 
 	var pathParam0 string
 
-	pathParam0, err = runtime.StyleParamWithLocation("simple", false, "ref", runtime.ParamLocationPath, ref)
+	pathParam0, err = runtime.StyleParamWithOptions("simple", false, "ref", ref, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationPath, Type: "string", Format: ""})
 	if err != nil {
 		return nil, err
 	}
 
 	var pathParam1 string
 
-	pathParam1, err = runtime.StyleParamWithLocation("simple", false, "run_id", runtime.ParamLocationPath, runId)
+	pathParam1, err = runtime.StyleParamWithOptions("simple", false, "run_id", runId, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationPath, Type: "string", Format: ""})
 	if err != nil {
 		return nil, err
 	}
@@ -5058,7 +5008,7 @@ func NewV1GetActionRunRequest(server string, ref string, runId string) (*http.Re
 		return nil, err
 	}
 
-	req, err := http.NewRequest("GET", queryURL.String(), nil)
+	req, err := http.NewRequest(http.MethodGet, queryURL.String(), nil)
 	if err != nil {
 		return nil, err
 	}
@@ -5072,14 +5022,14 @@ func NewV1GetActionRunLogsRequest(server string, ref string, runId string) (*htt
 
 	var pathParam0 string
 
-	pathParam0, err = runtime.StyleParamWithLocation("simple", false, "ref", runtime.ParamLocationPath, ref)
+	pathParam0, err = runtime.StyleParamWithOptions("simple", false, "ref", ref, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationPath, Type: "string", Format: ""})
 	if err != nil {
 		return nil, err
 	}
 
 	var pathParam1 string
 
-	pathParam1, err = runtime.StyleParamWithLocation("simple", false, "run_id", runtime.ParamLocationPath, runId)
+	pathParam1, err = runtime.StyleParamWithOptions("simple", false, "run_id", runId, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationPath, Type: "string", Format: ""})
 	if err != nil {
 		return nil, err
 	}
@@ -5099,7 +5049,7 @@ func NewV1GetActionRunLogsRequest(server string, ref string, runId string) (*htt
 		return nil, err
 	}
 
-	req, err := http.NewRequest("GET", queryURL.String(), nil)
+	req, err := http.NewRequest(http.MethodGet, queryURL.String(), nil)
 	if err != nil {
 		return nil, err
 	}
@@ -5124,14 +5074,14 @@ func NewV1UpdateActionRunStatusRequestWithBody(server string, ref string, runId
 
 	var pathParam0 string
 
-	pathParam0, err = runtime.StyleParamWithLocation("simple", false, "ref", runtime.ParamLocationPath, ref)
+	pathParam0, err = runtime.StyleParamWithOptions("simple", false, "ref", ref, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationPath, Type: "string", Format: ""})
 	if err != nil {
 		return nil, err
 	}
 
 	var pathParam1 string
 
-	pathParam1, err = runtime.StyleParamWithLocation("simple", false, "run_id", runtime.ParamLocationPath, runId)
+	pathParam1, err = runtime.StyleParamWithOptions("simple", false, "run_id", runId, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationPath, Type: "string", Format: ""})
 	if err != nil {
 		return nil, err
 	}
@@ -5151,7 +5101,7 @@ func NewV1UpdateActionRunStatusRequestWithBody(server string, ref string, runId
 		return nil, err
 	}
 
-	req, err := http.NewRequest("PATCH", queryURL.String(), body)
+	req, err := http.NewRequest(http.MethodPatch, queryURL.String(), body)
 	if err != nil {
 		return nil, err
 	}
@@ -5167,7 +5117,7 @@ func NewV1GetPerformanceAdvisorsRequest(server string, ref string) (*http.Reques
 
 	var pathParam0 string
 
-	pathParam0, err = runtime.StyleParamWithLocation("simple", false, "ref", runtime.ParamLocationPath, ref)
+	pathParam0, err = runtime.StyleParamWithOptions("simple", false, "ref", ref, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationPath, Type: "string", Format: ""})
 	if err != nil {
 		return nil, err
 	}
@@ -5187,7 +5137,7 @@ func NewV1GetPerformanceAdvisorsRequest(server string, ref string) (*http.Reques
 		return nil, err
 	}
 
-	req, err := http.NewRequest("GET", queryURL.String(), nil)
+	req, err := http.NewRequest(http.MethodGet, queryURL.String(), nil)
 	if err != nil {
 		return nil, err
 	}
@@ -5201,7 +5151,7 @@ func NewV1GetSecurityAdvisorsRequest(server string, ref string, params *V1GetSec
 
 	var pathParam0 string
 
-	pathParam0, err = runtime.StyleParamWithLocation("simple", false, "ref", runtime.ParamLocationPath, ref)
+	pathParam0, err = runtime.StyleParamWithOptions("simple", false, "ref", ref, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationPath, Type: "string", Format: ""})
 	if err != nil {
 		return nil, err
 	}
@@ -5222,28 +5172,33 @@ func NewV1GetSecurityAdvisorsRequest(server string, ref string, params *V1GetSec
 	}
 
 	if params != nil {
+		// queryValues collects non-styled parameters (passthrough, JSON)
+		// that are safe to round-trip through url.Values.Encode().
 		queryValues := queryURL.Query()
+		// rawQueryFragments collects pre-encoded query fragments from
+		// styled parameters, preserving literal commas as delimiters
+		// per the OpenAPI spec (e.g. "color=blue,black,brown").
+		var rawQueryFragments []string
 
 		if params.LintType != nil {
 
-			if queryFrag, err := runtime.StyleParamWithLocation("form", true, "lint_type", runtime.ParamLocationQuery, *params.LintType); err != nil {
-				return nil, err
-			} else if parsed, err := url.ParseQuery(queryFrag); err != nil {
+			if queryFrag, err := runtime.StyleParamWithOptions("form", true, "lint_type", *params.LintType, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationQuery, Type: "string", Format: ""}); err != nil {
 				return nil, err
 			} else {
-				for k, v := range parsed {
-					for _, v2 := range v {
-						queryValues.Add(k, v2)
-					}
+				for _, qp := range strings.Split(queryFrag, "&") {
+					rawQueryFragments = append(rawQueryFragments, qp)
 				}
 			}
 
 		}
 
-		queryURL.RawQuery = queryValues.Encode()
+		if encoded := queryValues.Encode(); encoded != "" {
+			rawQueryFragments = append(rawQueryFragments, encoded)
+		}
+		queryURL.RawQuery = strings.Join(rawQueryFragments, "&")
 	}
 
-	req, err := http.NewRequest("GET", queryURL.String(), nil)
+	req, err := http.NewRequest(http.MethodGet, queryURL.String(), nil)
 	if err != nil {
 		return nil, err
 	}
@@ -5257,7 +5212,7 @@ func NewV1GetProjectFunctionCombinedStatsRequest(server string, ref string, para
 
 	var pathParam0 string
 
-	pathParam0, err = runtime.StyleParamWithLocation("simple", false, "ref", runtime.ParamLocationPath, ref)
+	pathParam0, err = runtime.StyleParamWithOptions("simple", false, "ref", ref, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationPath, Type: "string", Format: ""})
 	if err != nil {
 		return nil, err
 	}
@@ -5278,36 +5233,37 @@ func NewV1GetProjectFunctionCombinedStatsRequest(server string, ref string, para
 	}
 
 	if params != nil {
+		// queryValues collects non-styled parameters (passthrough, JSON)
+		// that are safe to round-trip through url.Values.Encode().
 		queryValues := queryURL.Query()
+		// rawQueryFragments collects pre-encoded query fragments from
+		// styled parameters, preserving literal commas as delimiters
+		// per the OpenAPI spec (e.g. "color=blue,black,brown").
+		var rawQueryFragments []string
 
-		if queryFrag, err := runtime.StyleParamWithLocation("form", true, "interval", runtime.ParamLocationQuery, params.Interval); err != nil {
-			return nil, err
-		} else if parsed, err := url.ParseQuery(queryFrag); err != nil {
+		if queryFrag, err := runtime.StyleParamWithOptions("form", true, "interval", params.Interval, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationQuery, Type: "string", Format: ""}); err != nil {
 			return nil, err
 		} else {
-			for k, v := range parsed {
-				for _, v2 := range v {
-					queryValues.Add(k, v2)
-				}
+			for _, qp := range strings.Split(queryFrag, "&") {
+				rawQueryFragments = append(rawQueryFragments, qp)
 			}
 		}
 
-		if queryFrag, err := runtime.StyleParamWithLocation("form", true, "function_id", runtime.ParamLocationQuery, params.FunctionId); err != nil {
-			return nil, err
-		} else if parsed, err := url.ParseQuery(queryFrag); err != nil {
+		if queryFrag, err := runtime.StyleParamWithOptions("form", true, "function_id", params.FunctionId, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationQuery, Type: "string", Format: ""}); err != nil {
 			return nil, err
 		} else {
-			for k, v := range parsed {
-				for _, v2 := range v {
-					queryValues.Add(k, v2)
-				}
+			for _, qp := range strings.Split(queryFrag, "&") {
+				rawQueryFragments = append(rawQueryFragments, qp)
 			}
 		}
 
-		queryURL.RawQuery = queryValues.Encode()
+		if encoded := queryValues.Encode(); encoded != "" {
+			rawQueryFragments = append(rawQueryFragments, encoded)
+		}
+		queryURL.RawQuery = strings.Join(rawQueryFragments, "&")
 	}
 
-	req, err := http.NewRequest("GET", queryURL.String(), nil)
+	req, err := http.NewRequest(http.MethodGet, queryURL.String(), nil)
 	if err != nil {
 		return nil, err
 	}
@@ -5321,7 +5277,7 @@ func NewV1GetProjectLogsRequest(server string, ref string, params *V1GetProjectL
 
 	var pathParam0 string
 
-	pathParam0, err = runtime.StyleParamWithLocation("simple", false, "ref", runtime.ParamLocationPath, ref)
+	pathParam0, err = runtime.StyleParamWithOptions("simple", false, "ref", ref, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationPath, Type: "string", Format: ""})
 	if err != nil {
 		return nil, err
 	}
@@ -5342,19 +5298,21 @@ func NewV1GetProjectLogsRequest(server string, ref string, params *V1GetProjectL
 	}
 
 	if params != nil {
+		// queryValues collects non-styled parameters (passthrough, JSON)
+		// that are safe to round-trip through url.Values.Encode().
 		queryValues := queryURL.Query()
+		// rawQueryFragments collects pre-encoded query fragments from
+		// styled parameters, preserving literal commas as delimiters
+		// per the OpenAPI spec (e.g. "color=blue,black,brown").
+		var rawQueryFragments []string
 
 		if params.Sql != nil {
 
-			if queryFrag, err := runtime.StyleParamWithLocation("form", true, "sql", runtime.ParamLocationQuery, *params.Sql); err != nil {
-				return nil, err
-			} else if parsed, err := url.ParseQuery(queryFrag); err != nil {
+			if queryFrag, err := runtime.StyleParamWithOptions("form", true, "sql", *params.Sql, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationQuery, Type: "string", Format: ""}); err != nil {
 				return nil, err
 			} else {
-				for k, v := range parsed {
-					for _, v2 := range v {
-						queryValues.Add(k, v2)
-					}
+				for _, qp := range strings.Split(queryFrag, "&") {
+					rawQueryFragments = append(rawQueryFragments, qp)
 				}
 			}
 
@@ -5362,15 +5320,11 @@ func NewV1GetProjectLogsRequest(server string, ref string, params *V1GetProjectL
 
 		if params.IsoTimestampStart != nil {
 
-			if queryFrag, err := runtime.StyleParamWithLocation("form", true, "iso_timestamp_start", runtime.ParamLocationQuery, *params.IsoTimestampStart); err != nil {
-				return nil, err
-			} else if parsed, err := url.ParseQuery(queryFrag); err != nil {
+			if queryFrag, err := runtime.StyleParamWithOptions("form", true, "iso_timestamp_start", *params.IsoTimestampStart, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationQuery, Type: "string", Format: "date-time"}); err != nil {
 				return nil, err
 			} else {
-				for k, v := range parsed {
-					for _, v2 := range v {
-						queryValues.Add(k, v2)
-					}
+				for _, qp := range strings.Split(queryFrag, "&") {
+					rawQueryFragments = append(rawQueryFragments, qp)
 				}
 			}
 
@@ -5378,24 +5332,23 @@ func NewV1GetProjectLogsRequest(server string, ref string, params *V1GetProjectL
 
 		if params.IsoTimestampEnd != nil {
 
-			if queryFrag, err := runtime.StyleParamWithLocation("form", true, "iso_timestamp_end", runtime.ParamLocationQuery, *params.IsoTimestampEnd); err != nil {
-				return nil, err
-			} else if parsed, err := url.ParseQuery(queryFrag); err != nil {
+			if queryFrag, err := runtime.StyleParamWithOptions("form", true, "iso_timestamp_end", *params.IsoTimestampEnd, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationQuery, Type: "string", Format: "date-time"}); err != nil {
 				return nil, err
 			} else {
-				for k, v := range parsed {
-					for _, v2 := range v {
-						queryValues.Add(k, v2)
-					}
+				for _, qp := range strings.Split(queryFrag, "&") {
+					rawQueryFragments = append(rawQueryFragments, qp)
 				}
 			}
 
 		}
 
-		queryURL.RawQuery = queryValues.Encode()
+		if encoded := queryValues.Encode(); encoded != "" {
+			rawQueryFragments = append(rawQueryFragments, encoded)
+		}
+		queryURL.RawQuery = strings.Join(rawQueryFragments, "&")
 	}
 
-	req, err := http.NewRequest("GET", queryURL.String(), nil)
+	req, err := http.NewRequest(http.MethodGet, queryURL.String(), nil)
 	if err != nil {
 		return nil, err
 	}
@@ -5409,7 +5362,7 @@ func NewV1GetProjectLogsAllRequest(server string, ref string, params *V1GetProje
 
 	var pathParam0 string
 
-	pathParam0, err = runtime.StyleParamWithLocation("simple", false, "ref", runtime.ParamLocationPath, ref)
+	pathParam0, err = runtime.StyleParamWithOptions("simple", false, "ref", ref, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationPath, Type: "string", Format: ""})
 	if err != nil {
 		return nil, err
 	}
@@ -5430,19 +5383,21 @@ func NewV1GetProjectLogsAllRequest(server string, ref string, params *V1GetProje
 	}
 
 	if params != nil {
+		// queryValues collects non-styled parameters (passthrough, JSON)
+		// that are safe to round-trip through url.Values.Encode().
 		queryValues := queryURL.Query()
+		// rawQueryFragments collects pre-encoded query fragments from
+		// styled parameters, preserving literal commas as delimiters
+		// per the OpenAPI spec (e.g. "color=blue,black,brown").
+		var rawQueryFragments []string
 
 		if params.Sql != nil {
 
-			if queryFrag, err := runtime.StyleParamWithLocation("form", true, "sql", runtime.ParamLocationQuery, *params.Sql); err != nil {
-				return nil, err
-			} else if parsed, err := url.ParseQuery(queryFrag); err != nil {
+			if queryFrag, err := runtime.StyleParamWithOptions("form", true, "sql", *params.Sql, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationQuery, Type: "string", Format: ""}); err != nil {
 				return nil, err
 			} else {
-				for k, v := range parsed {
-					for _, v2 := range v {
-						queryValues.Add(k, v2)
-					}
+				for _, qp := range strings.Split(queryFrag, "&") {
+					rawQueryFragments = append(rawQueryFragments, qp)
 				}
 			}
 
@@ -5450,15 +5405,11 @@ func NewV1GetProjectLogsAllRequest(server string, ref string, params *V1GetProje
 
 		if params.IsoTimestampStart != nil {
 
-			if queryFrag, err := runtime.StyleParamWithLocation("form", true, "iso_timestamp_start", runtime.ParamLocationQuery, *params.IsoTimestampStart); err != nil {
-				return nil, err
-			} else if parsed, err := url.ParseQuery(queryFrag); err != nil {
+			if queryFrag, err := runtime.StyleParamWithOptions("form", true, "iso_timestamp_start", *params.IsoTimestampStart, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationQuery, Type: "string", Format: "date-time"}); err != nil {
 				return nil, err
 			} else {
-				for k, v := range parsed {
-					for _, v2 := range v {
-						queryValues.Add(k, v2)
-					}
+				for _, qp := range strings.Split(queryFrag, "&") {
+					rawQueryFragments = append(rawQueryFragments, qp)
 				}
 			}
 
@@ -5466,24 +5417,57 @@ func NewV1GetProjectLogsAllRequest(server string, ref string, params *V1GetProje
 
 		if params.IsoTimestampEnd != nil {
 
-			if queryFrag, err := runtime.StyleParamWithLocation("form", true, "iso_timestamp_end", runtime.ParamLocationQuery, *params.IsoTimestampEnd); err != nil {
-				return nil, err
-			} else if parsed, err := url.ParseQuery(queryFrag); err != nil {
+			if queryFrag, err := runtime.StyleParamWithOptions("form", true, "iso_timestamp_end", *params.IsoTimestampEnd, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationQuery, Type: "string", Format: "date-time"}); err != nil {
 				return nil, err
 			} else {
-				for k, v := range parsed {
-					for _, v2 := range v {
-						queryValues.Add(k, v2)
-					}
+				for _, qp := range strings.Split(queryFrag, "&") {
+					rawQueryFragments = append(rawQueryFragments, qp)
 				}
 			}
 
 		}
 
-		queryURL.RawQuery = queryValues.Encode()
+		if encoded := queryValues.Encode(); encoded != "" {
+			rawQueryFragments = append(rawQueryFragments, encoded)
+		}
+		queryURL.RawQuery = strings.Join(rawQueryFragments, "&")
+	}
+
+	req, err := http.NewRequest(http.MethodGet, queryURL.String(), nil)
+	if err != nil {
+		return nil, err
+	}
+
+	return req, nil
+}
+
+// NewV1ScrapeProjectMetricsRequest generates requests for V1ScrapeProjectMetrics
+func NewV1ScrapeProjectMetricsRequest(server string, ref string) (*http.Request, error) {
+	var err error
+
+	var pathParam0 string
+
+	pathParam0, err = runtime.StyleParamWithOptions("simple", false, "ref", ref, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationPath, Type: "string", Format: ""})
+	if err != nil {
+		return nil, err
+	}
+
+	serverURL, err := url.Parse(server)
+	if err != nil {
+		return nil, err
+	}
+
+	operationPath := fmt.Sprintf("/v1/projects/%s/analytics/endpoints/metrics", pathParam0)
+	if operationPath[0] == '/' {
+		operationPath = "." + operationPath
+	}
+
+	queryURL, err := serverURL.Parse(operationPath)
+	if err != nil {
+		return nil, err
 	}
 
-	req, err := http.NewRequest("GET", queryURL.String(), nil)
+	req, err := http.NewRequest(http.MethodGet, queryURL.String(), nil)
 	if err != nil {
 		return nil, err
 	}
@@ -5497,7 +5481,7 @@ func NewV1GetProjectUsageApiCountRequest(server string, ref string, params *V1Ge
 
 	var pathParam0 string
 
-	pathParam0, err = runtime.StyleParamWithLocation("simple", false, "ref", runtime.ParamLocationPath, ref)
+	pathParam0, err = runtime.StyleParamWithOptions("simple", false, "ref", ref, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationPath, Type: "string", Format: ""})
 	if err != nil {
 		return nil, err
 	}
@@ -5518,28 +5502,33 @@ func NewV1GetProjectUsageApiCountRequest(server string, ref string, params *V1Ge
 	}
 
 	if params != nil {
+		// queryValues collects non-styled parameters (passthrough, JSON)
+		// that are safe to round-trip through url.Values.Encode().
 		queryValues := queryURL.Query()
+		// rawQueryFragments collects pre-encoded query fragments from
+		// styled parameters, preserving literal commas as delimiters
+		// per the OpenAPI spec (e.g. "color=blue,black,brown").
+		var rawQueryFragments []string
 
 		if params.Interval != nil {
 
-			if queryFrag, err := runtime.StyleParamWithLocation("form", true, "interval", runtime.ParamLocationQuery, *params.Interval); err != nil {
-				return nil, err
-			} else if parsed, err := url.ParseQuery(queryFrag); err != nil {
+			if queryFrag, err := runtime.StyleParamWithOptions("form", true, "interval", *params.Interval, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationQuery, Type: "string", Format: ""}); err != nil {
 				return nil, err
 			} else {
-				for k, v := range parsed {
-					for _, v2 := range v {
-						queryValues.Add(k, v2)
-					}
+				for _, qp := range strings.Split(queryFrag, "&") {
+					rawQueryFragments = append(rawQueryFragments, qp)
 				}
 			}
 
 		}
 
-		queryURL.RawQuery = queryValues.Encode()
+		if encoded := queryValues.Encode(); encoded != "" {
+			rawQueryFragments = append(rawQueryFragments, encoded)
+		}
+		queryURL.RawQuery = strings.Join(rawQueryFragments, "&")
 	}
 
-	req, err := http.NewRequest("GET", queryURL.String(), nil)
+	req, err := http.NewRequest(http.MethodGet, queryURL.String(), nil)
 	if err != nil {
 		return nil, err
 	}
@@ -5553,7 +5542,7 @@ func NewV1GetProjectUsageRequestCountRequest(server string, ref string) (*http.R
 
 	var pathParam0 string
 
-	pathParam0, err = runtime.StyleParamWithLocation("simple", false, "ref", runtime.ParamLocationPath, ref)
+	pathParam0, err = runtime.StyleParamWithOptions("simple", false, "ref", ref, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationPath, Type: "string", Format: ""})
 	if err != nil {
 		return nil, err
 	}
@@ -5573,7 +5562,7 @@ func NewV1GetProjectUsageRequestCountRequest(server string, ref string) (*http.R
 		return nil, err
 	}
 
-	req, err := http.NewRequest("GET", queryURL.String(), nil)
+	req, err := http.NewRequest(http.MethodGet, queryURL.String(), nil)
 	if err != nil {
 		return nil, err
 	}
@@ -5587,7 +5576,7 @@ func NewV1GetProjectApiKeysRequest(server string, ref string, params *V1GetProje
 
 	var pathParam0 string
 
-	pathParam0, err = runtime.StyleParamWithLocation("simple", false, "ref", runtime.ParamLocationPath, ref)
+	pathParam0, err = runtime.StyleParamWithOptions("simple", false, "ref", ref, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationPath, Type: "string", Format: ""})
 	if err != nil {
 		return nil, err
 	}
@@ -5608,28 +5597,33 @@ func NewV1GetProjectApiKeysRequest(server string, ref string, params *V1GetProje
 	}
 
 	if params != nil {
+		// queryValues collects non-styled parameters (passthrough, JSON)
+		// that are safe to round-trip through url.Values.Encode().
 		queryValues := queryURL.Query()
+		// rawQueryFragments collects pre-encoded query fragments from
+		// styled parameters, preserving literal commas as delimiters
+		// per the OpenAPI spec (e.g. "color=blue,black,brown").
+		var rawQueryFragments []string
 
 		if params.Reveal != nil {
 
-			if queryFrag, err := runtime.StyleParamWithLocation("form", true, "reveal", runtime.ParamLocationQuery, *params.Reveal); err != nil {
-				return nil, err
-			} else if parsed, err := url.ParseQuery(queryFrag); err != nil {
+			if queryFrag, err := runtime.StyleParamWithOptions("form", true, "reveal", *params.Reveal, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationQuery, Type: "boolean", Format: ""}); err != nil {
 				return nil, err
 			} else {
-				for k, v := range parsed {
-					for _, v2 := range v {
-						queryValues.Add(k, v2)
-					}
+				for _, qp := range strings.Split(queryFrag, "&") {
+					rawQueryFragments = append(rawQueryFragments, qp)
 				}
 			}
 
 		}
 
-		queryURL.RawQuery = queryValues.Encode()
+		if encoded := queryValues.Encode(); encoded != "" {
+			rawQueryFragments = append(rawQueryFragments, encoded)
+		}
+		queryURL.RawQuery = strings.Join(rawQueryFragments, "&")
 	}
 
-	req, err := http.NewRequest("GET", queryURL.String(), nil)
+	req, err := http.NewRequest(http.MethodGet, queryURL.String(), nil)
 	if err != nil {
 		return nil, err
 	}
@@ -5654,7 +5648,7 @@ func NewV1CreateProjectApiKeyRequestWithBody(server string, ref string, params *
 
 	var pathParam0 string
 
-	pathParam0, err = runtime.StyleParamWithLocation("simple", false, "ref", runtime.ParamLocationPath, ref)
+	pathParam0, err = runtime.StyleParamWithOptions("simple", false, "ref", ref, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationPath, Type: "string", Format: ""})
 	if err != nil {
 		return nil, err
 	}
@@ -5675,28 +5669,33 @@ func NewV1CreateProjectApiKeyRequestWithBody(server string, ref string, params *
 	}
 
 	if params != nil {
+		// queryValues collects non-styled parameters (passthrough, JSON)
+		// that are safe to round-trip through url.Values.Encode().
 		queryValues := queryURL.Query()
+		// rawQueryFragments collects pre-encoded query fragments from
+		// styled parameters, preserving literal commas as delimiters
+		// per the OpenAPI spec (e.g. "color=blue,black,brown").
+		var rawQueryFragments []string
 
 		if params.Reveal != nil {
 
-			if queryFrag, err := runtime.StyleParamWithLocation("form", true, "reveal", runtime.ParamLocationQuery, *params.Reveal); err != nil {
-				return nil, err
-			} else if parsed, err := url.ParseQuery(queryFrag); err != nil {
+			if queryFrag, err := runtime.StyleParamWithOptions("form", true, "reveal", *params.Reveal, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationQuery, Type: "boolean", Format: ""}); err != nil {
 				return nil, err
 			} else {
-				for k, v := range parsed {
-					for _, v2 := range v {
-						queryValues.Add(k, v2)
-					}
+				for _, qp := range strings.Split(queryFrag, "&") {
+					rawQueryFragments = append(rawQueryFragments, qp)
 				}
 			}
 
 		}
 
-		queryURL.RawQuery = queryValues.Encode()
+		if encoded := queryValues.Encode(); encoded != "" {
+			rawQueryFragments = append(rawQueryFragments, encoded)
+		}
+		queryURL.RawQuery = strings.Join(rawQueryFragments, "&")
 	}
 
-	req, err := http.NewRequest("POST", queryURL.String(), body)
+	req, err := http.NewRequest(http.MethodPost, queryURL.String(), body)
 	if err != nil {
 		return nil, err
 	}
@@ -5712,7 +5711,7 @@ func NewV1GetProjectLegacyApiKeysRequest(server string, ref string) (*http.Reque
 
 	var pathParam0 string
 
-	pathParam0, err = runtime.StyleParamWithLocation("simple", false, "ref", runtime.ParamLocationPath, ref)
+	pathParam0, err = runtime.StyleParamWithOptions("simple", false, "ref", ref, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationPath, Type: "string", Format: ""})
 	if err != nil {
 		return nil, err
 	}
@@ -5732,7 +5731,7 @@ func NewV1GetProjectLegacyApiKeysRequest(server string, ref string) (*http.Reque
 		return nil, err
 	}
 
-	req, err := http.NewRequest("GET", queryURL.String(), nil)
+	req, err := http.NewRequest(http.MethodGet, queryURL.String(), nil)
 	if err != nil {
 		return nil, err
 	}
@@ -5746,7 +5745,7 @@ func NewV1UpdateProjectLegacyApiKeysRequest(server string, ref string, params *V
 
 	var pathParam0 string
 
-	pathParam0, err = runtime.StyleParamWithLocation("simple", false, "ref", runtime.ParamLocationPath, ref)
+	pathParam0, err = runtime.StyleParamWithOptions("simple", false, "ref", ref, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationPath, Type: "string", Format: ""})
 	if err != nil {
 		return nil, err
 	}
@@ -5767,24 +5766,29 @@ func NewV1UpdateProjectLegacyApiKeysRequest(server string, ref string, params *V
 	}
 
 	if params != nil {
+		// queryValues collects non-styled parameters (passthrough, JSON)
+		// that are safe to round-trip through url.Values.Encode().
 		queryValues := queryURL.Query()
+		// rawQueryFragments collects pre-encoded query fragments from
+		// styled parameters, preserving literal commas as delimiters
+		// per the OpenAPI spec (e.g. "color=blue,black,brown").
+		var rawQueryFragments []string
 
-		if queryFrag, err := runtime.StyleParamWithLocation("form", true, "enabled", runtime.ParamLocationQuery, params.Enabled); err != nil {
-			return nil, err
-		} else if parsed, err := url.ParseQuery(queryFrag); err != nil {
+		if queryFrag, err := runtime.StyleParamWithOptions("form", true, "enabled", params.Enabled, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationQuery, Type: "boolean", Format: ""}); err != nil {
 			return nil, err
 		} else {
-			for k, v := range parsed {
-				for _, v2 := range v {
-					queryValues.Add(k, v2)
-				}
+			for _, qp := range strings.Split(queryFrag, "&") {
+				rawQueryFragments = append(rawQueryFragments, qp)
 			}
 		}
 
-		queryURL.RawQuery = queryValues.Encode()
+		if encoded := queryValues.Encode(); encoded != "" {
+			rawQueryFragments = append(rawQueryFragments, encoded)
+		}
+		queryURL.RawQuery = strings.Join(rawQueryFragments, "&")
 	}
 
-	req, err := http.NewRequest("PUT", queryURL.String(), nil)
+	req, err := http.NewRequest(http.MethodPut, queryURL.String(), nil)
 	if err != nil {
 		return nil, err
 	}
@@ -5798,14 +5802,14 @@ func NewV1DeleteProjectApiKeyRequest(server string, ref string, id openapi_types
 
 	var pathParam0 string
 
-	pathParam0, err = runtime.StyleParamWithLocation("simple", false, "ref", runtime.ParamLocationPath, ref)
+	pathParam0, err = runtime.StyleParamWithOptions("simple", false, "ref", ref, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationPath, Type: "string", Format: ""})
 	if err != nil {
 		return nil, err
 	}
 
 	var pathParam1 string
 
-	pathParam1, err = runtime.StyleParamWithLocation("simple", false, "id", runtime.ParamLocationPath, id)
+	pathParam1, err = runtime.StyleParamWithOptions("simple", false, "id", id, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationPath, Type: "string", Format: "uuid"})
 	if err != nil {
 		return nil, err
 	}
@@ -5826,19 +5830,21 @@ func NewV1DeleteProjectApiKeyRequest(server string, ref string, id openapi_types
 	}
 
 	if params != nil {
+		// queryValues collects non-styled parameters (passthrough, JSON)
+		// that are safe to round-trip through url.Values.Encode().
 		queryValues := queryURL.Query()
+		// rawQueryFragments collects pre-encoded query fragments from
+		// styled parameters, preserving literal commas as delimiters
+		// per the OpenAPI spec (e.g. "color=blue,black,brown").
+		var rawQueryFragments []string
 
 		if params.Reveal != nil {
 
-			if queryFrag, err := runtime.StyleParamWithLocation("form", true, "reveal", runtime.ParamLocationQuery, *params.Reveal); err != nil {
-				return nil, err
-			} else if parsed, err := url.ParseQuery(queryFrag); err != nil {
+			if queryFrag, err := runtime.StyleParamWithOptions("form", true, "reveal", *params.Reveal, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationQuery, Type: "boolean", Format: ""}); err != nil {
 				return nil, err
 			} else {
-				for k, v := range parsed {
-					for _, v2 := range v {
-						queryValues.Add(k, v2)
-					}
+				for _, qp := range strings.Split(queryFrag, "&") {
+					rawQueryFragments = append(rawQueryFragments, qp)
 				}
 			}
 
@@ -5846,15 +5852,11 @@ func NewV1DeleteProjectApiKeyRequest(server string, ref string, id openapi_types
 
 		if params.WasCompromised != nil {
 
-			if queryFrag, err := runtime.StyleParamWithLocation("form", true, "was_compromised", runtime.ParamLocationQuery, *params.WasCompromised); err != nil {
-				return nil, err
-			} else if parsed, err := url.ParseQuery(queryFrag); err != nil {
+			if queryFrag, err := runtime.StyleParamWithOptions("form", true, "was_compromised", *params.WasCompromised, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationQuery, Type: "boolean", Format: ""}); err != nil {
 				return nil, err
 			} else {
-				for k, v := range parsed {
-					for _, v2 := range v {
-						queryValues.Add(k, v2)
-					}
+				for _, qp := range strings.Split(queryFrag, "&") {
+					rawQueryFragments = append(rawQueryFragments, qp)
 				}
 			}
 
@@ -5862,24 +5864,23 @@ func NewV1DeleteProjectApiKeyRequest(server string, ref string, id openapi_types
 
 		if params.Reason != nil {
 
-			if queryFrag, err := runtime.StyleParamWithLocation("form", true, "reason", runtime.ParamLocationQuery, *params.Reason); err != nil {
-				return nil, err
-			} else if parsed, err := url.ParseQuery(queryFrag); err != nil {
+			if queryFrag, err := runtime.StyleParamWithOptions("form", true, "reason", *params.Reason, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationQuery, Type: "string", Format: ""}); err != nil {
 				return nil, err
 			} else {
-				for k, v := range parsed {
-					for _, v2 := range v {
-						queryValues.Add(k, v2)
-					}
+				for _, qp := range strings.Split(queryFrag, "&") {
+					rawQueryFragments = append(rawQueryFragments, qp)
 				}
 			}
 
 		}
 
-		queryURL.RawQuery = queryValues.Encode()
+		if encoded := queryValues.Encode(); encoded != "" {
+			rawQueryFragments = append(rawQueryFragments, encoded)
+		}
+		queryURL.RawQuery = strings.Join(rawQueryFragments, "&")
 	}
 
-	req, err := http.NewRequest("DELETE", queryURL.String(), nil)
+	req, err := http.NewRequest(http.MethodDelete, queryURL.String(), nil)
 	if err != nil {
 		return nil, err
 	}
@@ -5893,14 +5894,14 @@ func NewV1GetProjectApiKeyRequest(server string, ref string, id openapi_types.UU
 
 	var pathParam0 string
 
-	pathParam0, err = runtime.StyleParamWithLocation("simple", false, "ref", runtime.ParamLocationPath, ref)
+	pathParam0, err = runtime.StyleParamWithOptions("simple", false, "ref", ref, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationPath, Type: "string", Format: ""})
 	if err != nil {
 		return nil, err
 	}
 
 	var pathParam1 string
 
-	pathParam1, err = runtime.StyleParamWithLocation("simple", false, "id", runtime.ParamLocationPath, id)
+	pathParam1, err = runtime.StyleParamWithOptions("simple", false, "id", id, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationPath, Type: "string", Format: "uuid"})
 	if err != nil {
 		return nil, err
 	}
@@ -5921,28 +5922,33 @@ func NewV1GetProjectApiKeyRequest(server string, ref string, id openapi_types.UU
 	}
 
 	if params != nil {
+		// queryValues collects non-styled parameters (passthrough, JSON)
+		// that are safe to round-trip through url.Values.Encode().
 		queryValues := queryURL.Query()
+		// rawQueryFragments collects pre-encoded query fragments from
+		// styled parameters, preserving literal commas as delimiters
+		// per the OpenAPI spec (e.g. "color=blue,black,brown").
+		var rawQueryFragments []string
 
 		if params.Reveal != nil {
 
-			if queryFrag, err := runtime.StyleParamWithLocation("form", true, "reveal", runtime.ParamLocationQuery, *params.Reveal); err != nil {
-				return nil, err
-			} else if parsed, err := url.ParseQuery(queryFrag); err != nil {
+			if queryFrag, err := runtime.StyleParamWithOptions("form", true, "reveal", *params.Reveal, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationQuery, Type: "boolean", Format: ""}); err != nil {
 				return nil, err
 			} else {
-				for k, v := range parsed {
-					for _, v2 := range v {
-						queryValues.Add(k, v2)
-					}
+				for _, qp := range strings.Split(queryFrag, "&") {
+					rawQueryFragments = append(rawQueryFragments, qp)
 				}
 			}
 
 		}
 
-		queryURL.RawQuery = queryValues.Encode()
+		if encoded := queryValues.Encode(); encoded != "" {
+			rawQueryFragments = append(rawQueryFragments, encoded)
+		}
+		queryURL.RawQuery = strings.Join(rawQueryFragments, "&")
 	}
 
-	req, err := http.NewRequest("GET", queryURL.String(), nil)
+	req, err := http.NewRequest(http.MethodGet, queryURL.String(), nil)
 	if err != nil {
 		return nil, err
 	}
@@ -5967,14 +5973,14 @@ func NewV1UpdateProjectApiKeyRequestWithBody(server string, ref string, id opena
 
 	var pathParam0 string
 
-	pathParam0, err = runtime.StyleParamWithLocation("simple", false, "ref", runtime.ParamLocationPath, ref)
+	pathParam0, err = runtime.StyleParamWithOptions("simple", false, "ref", ref, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationPath, Type: "string", Format: ""})
 	if err != nil {
 		return nil, err
 	}
 
 	var pathParam1 string
 
-	pathParam1, err = runtime.StyleParamWithLocation("simple", false, "id", runtime.ParamLocationPath, id)
+	pathParam1, err = runtime.StyleParamWithOptions("simple", false, "id", id, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationPath, Type: "string", Format: "uuid"})
 	if err != nil {
 		return nil, err
 	}
@@ -5995,28 +6001,33 @@ func NewV1UpdateProjectApiKeyRequestWithBody(server string, ref string, id opena
 	}
 
 	if params != nil {
+		// queryValues collects non-styled parameters (passthrough, JSON)
+		// that are safe to round-trip through url.Values.Encode().
 		queryValues := queryURL.Query()
+		// rawQueryFragments collects pre-encoded query fragments from
+		// styled parameters, preserving literal commas as delimiters
+		// per the OpenAPI spec (e.g. "color=blue,black,brown").
+		var rawQueryFragments []string
 
 		if params.Reveal != nil {
 
-			if queryFrag, err := runtime.StyleParamWithLocation("form", true, "reveal", runtime.ParamLocationQuery, *params.Reveal); err != nil {
-				return nil, err
-			} else if parsed, err := url.ParseQuery(queryFrag); err != nil {
+			if queryFrag, err := runtime.StyleParamWithOptions("form", true, "reveal", *params.Reveal, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationQuery, Type: "boolean", Format: ""}); err != nil {
 				return nil, err
 			} else {
-				for k, v := range parsed {
-					for _, v2 := range v {
-						queryValues.Add(k, v2)
-					}
+				for _, qp := range strings.Split(queryFrag, "&") {
+					rawQueryFragments = append(rawQueryFragments, qp)
 				}
 			}
 
 		}
 
-		queryURL.RawQuery = queryValues.Encode()
+		if encoded := queryValues.Encode(); encoded != "" {
+			rawQueryFragments = append(rawQueryFragments, encoded)
+		}
+		queryURL.RawQuery = strings.Join(rawQueryFragments, "&")
 	}
 
-	req, err := http.NewRequest("PATCH", queryURL.String(), body)
+	req, err := http.NewRequest(http.MethodPatch, queryURL.String(), body)
 	if err != nil {
 		return nil, err
 	}
@@ -6032,7 +6043,7 @@ func NewV1ListProjectAddonsRequest(server string, ref string) (*http.Request, er
 
 	var pathParam0 string
 
-	pathParam0, err = runtime.StyleParamWithLocation("simple", false, "ref", runtime.ParamLocationPath, ref)
+	pathParam0, err = runtime.StyleParamWithOptions("simple", false, "ref", ref, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationPath, Type: "string", Format: ""})
 	if err != nil {
 		return nil, err
 	}
@@ -6052,7 +6063,7 @@ func NewV1ListProjectAddonsRequest(server string, ref string) (*http.Request, er
 		return nil, err
 	}
 
-	req, err := http.NewRequest("GET", queryURL.String(), nil)
+	req, err := http.NewRequest(http.MethodGet, queryURL.String(), nil)
 	if err != nil {
 		return nil, err
 	}
@@ -6077,7 +6088,7 @@ func NewV1ApplyProjectAddonRequestWithBody(server string, ref string, contentTyp
 
 	var pathParam0 string
 
-	pathParam0, err = runtime.StyleParamWithLocation("simple", false, "ref", runtime.ParamLocationPath, ref)
+	pathParam0, err = runtime.StyleParamWithOptions("simple", false, "ref", ref, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationPath, Type: "string", Format: ""})
 	if err != nil {
 		return nil, err
 	}
@@ -6097,7 +6108,7 @@ func NewV1ApplyProjectAddonRequestWithBody(server string, ref string, contentTyp
 		return nil, err
 	}
 
-	req, err := http.NewRequest("PATCH", queryURL.String(), body)
+	req, err := http.NewRequest(http.MethodPatch, queryURL.String(), body)
 	if err != nil {
 		return nil, err
 	}
@@ -6115,14 +6126,14 @@ func NewV1RemoveProjectAddonRequest(server string, ref string, addonVariant stru
 
 	var pathParam0 string
 
-	pathParam0, err = runtime.StyleParamWithLocation("simple", false, "ref", runtime.ParamLocationPath, ref)
+	pathParam0, err = runtime.StyleParamWithOptions("simple", false, "ref", ref, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationPath, Type: "string", Format: ""})
 	if err != nil {
 		return nil, err
 	}
 
 	var pathParam1 string
 
-	pathParam1, err = runtime.StyleParamWithLocation("simple", false, "addon_variant", runtime.ParamLocationPath, addonVariant)
+	pathParam1, err = runtime.StyleParamWithOptions("simple", false, "addon_variant", addonVariant, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationPath, Type: "", Format: ""})
 	if err != nil {
 		return nil, err
 	}
@@ -6142,7 +6153,7 @@ func NewV1RemoveProjectAddonRequest(server string, ref string, addonVariant stru
 		return nil, err
 	}
 
-	req, err := http.NewRequest("DELETE", queryURL.String(), nil)
+	req, err := http.NewRequest(http.MethodDelete, queryURL.String(), nil)
 	if err != nil {
 		return nil, err
 	}
@@ -6156,7 +6167,7 @@ func NewV1DisablePreviewBranchingRequest(server string, ref string) (*http.Reque
 
 	var pathParam0 string
 
-	pathParam0, err = runtime.StyleParamWithLocation("simple", false, "ref", runtime.ParamLocationPath, ref)
+	pathParam0, err = runtime.StyleParamWithOptions("simple", false, "ref", ref, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationPath, Type: "string", Format: ""})
 	if err != nil {
 		return nil, err
 	}
@@ -6176,7 +6187,7 @@ func NewV1DisablePreviewBranchingRequest(server string, ref string) (*http.Reque
 		return nil, err
 	}
 
-	req, err := http.NewRequest("DELETE", queryURL.String(), nil)
+	req, err := http.NewRequest(http.MethodDelete, queryURL.String(), nil)
 	if err != nil {
 		return nil, err
 	}
@@ -6190,7 +6201,7 @@ func NewV1ListAllBranchesRequest(server string, ref string) (*http.Request, erro
 
 	var pathParam0 string
 
-	pathParam0, err = runtime.StyleParamWithLocation("simple", false, "ref", runtime.ParamLocationPath, ref)
+	pathParam0, err = runtime.StyleParamWithOptions("simple", false, "ref", ref, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationPath, Type: "string", Format: ""})
 	if err != nil {
 		return nil, err
 	}
@@ -6210,7 +6221,7 @@ func NewV1ListAllBranchesRequest(server string, ref string) (*http.Request, erro
 		return nil, err
 	}
 
-	req, err := http.NewRequest("GET", queryURL.String(), nil)
+	req, err := http.NewRequest(http.MethodGet, queryURL.String(), nil)
 	if err != nil {
 		return nil, err
 	}
@@ -6235,7 +6246,7 @@ func NewV1CreateABranchRequestWithBody(server string, ref string, contentType st
 
 	var pathParam0 string
 
-	pathParam0, err = runtime.StyleParamWithLocation("simple", false, "ref", runtime.ParamLocationPath, ref)
+	pathParam0, err = runtime.StyleParamWithOptions("simple", false, "ref", ref, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationPath, Type: "string", Format: ""})
 	if err != nil {
 		return nil, err
 	}
@@ -6255,7 +6266,7 @@ func NewV1CreateABranchRequestWithBody(server string, ref string, contentType st
 		return nil, err
 	}
 
-	req, err := http.NewRequest("POST", queryURL.String(), body)
+	req, err := http.NewRequest(http.MethodPost, queryURL.String(), body)
 	if err != nil {
 		return nil, err
 	}
@@ -6271,14 +6282,14 @@ func NewV1GetABranchRequest(server string, ref string, name string) (*http.Reque
 
 	var pathParam0 string
 
-	pathParam0, err = runtime.StyleParamWithLocation("simple", false, "ref", runtime.ParamLocationPath, ref)
+	pathParam0, err = runtime.StyleParamWithOptions("simple", false, "ref", ref, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationPath, Type: "string", Format: ""})
 	if err != nil {
 		return nil, err
 	}
 
 	var pathParam1 string
 
-	pathParam1, err = runtime.StyleParamWithLocation("simple", false, "name", runtime.ParamLocationPath, name)
+	pathParam1, err = runtime.StyleParamWithOptions("simple", false, "name", name, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationPath, Type: "string", Format: ""})
 	if err != nil {
 		return nil, err
 	}
@@ -6298,7 +6309,7 @@ func NewV1GetABranchRequest(server string, ref string, name string) (*http.Reque
 		return nil, err
 	}
 
-	req, err := http.NewRequest("GET", queryURL.String(), nil)
+	req, err := http.NewRequest(http.MethodGet, queryURL.String(), nil)
 	if err != nil {
 		return nil, err
 	}
@@ -6312,7 +6323,7 @@ func NewV1DeleteProjectClaimTokenRequest(server string, ref string) (*http.Reque
 
 	var pathParam0 string
 
-	pathParam0, err = runtime.StyleParamWithLocation("simple", false, "ref", runtime.ParamLocationPath, ref)
+	pathParam0, err = runtime.StyleParamWithOptions("simple", false, "ref", ref, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationPath, Type: "string", Format: ""})
 	if err != nil {
 		return nil, err
 	}
@@ -6332,7 +6343,7 @@ func NewV1DeleteProjectClaimTokenRequest(server string, ref string) (*http.Reque
 		return nil, err
 	}
 
-	req, err := http.NewRequest("DELETE", queryURL.String(), nil)
+	req, err := http.NewRequest(http.MethodDelete, queryURL.String(), nil)
 	if err != nil {
 		return nil, err
 	}
@@ -6346,7 +6357,7 @@ func NewV1GetProjectClaimTokenRequest(server string, ref string) (*http.Request,
 
 	var pathParam0 string
 
-	pathParam0, err = runtime.StyleParamWithLocation("simple", false, "ref", runtime.ParamLocationPath, ref)
+	pathParam0, err = runtime.StyleParamWithOptions("simple", false, "ref", ref, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationPath, Type: "string", Format: ""})
 	if err != nil {
 		return nil, err
 	}
@@ -6366,7 +6377,7 @@ func NewV1GetProjectClaimTokenRequest(server string, ref string) (*http.Request,
 		return nil, err
 	}
 
-	req, err := http.NewRequest("GET", queryURL.String(), nil)
+	req, err := http.NewRequest(http.MethodGet, queryURL.String(), nil)
 	if err != nil {
 		return nil, err
 	}
@@ -6380,7 +6391,7 @@ func NewV1CreateProjectClaimTokenRequest(server string, ref string) (*http.Reque
 
 	var pathParam0 string
 
-	pathParam0, err = runtime.StyleParamWithLocation("simple", false, "ref", runtime.ParamLocationPath, ref)
+	pathParam0, err = runtime.StyleParamWithOptions("simple", false, "ref", ref, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationPath, Type: "string", Format: ""})
 	if err != nil {
 		return nil, err
 	}
@@ -6400,7 +6411,7 @@ func NewV1CreateProjectClaimTokenRequest(server string, ref string) (*http.Reque
 		return nil, err
 	}
 
-	req, err := http.NewRequest("POST", queryURL.String(), nil)
+	req, err := http.NewRequest(http.MethodPost, queryURL.String(), nil)
 	if err != nil {
 		return nil, err
 	}
@@ -6414,7 +6425,7 @@ func NewV1DeleteLoginRolesRequest(server string, ref string) (*http.Request, err
 
 	var pathParam0 string
 
-	pathParam0, err = runtime.StyleParamWithLocation("simple", false, "ref", runtime.ParamLocationPath, ref)
+	pathParam0, err = runtime.StyleParamWithOptions("simple", false, "ref", ref, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationPath, Type: "string", Format: ""})
 	if err != nil {
 		return nil, err
 	}
@@ -6434,7 +6445,7 @@ func NewV1DeleteLoginRolesRequest(server string, ref string) (*http.Request, err
 		return nil, err
 	}
 
-	req, err := http.NewRequest("DELETE", queryURL.String(), nil)
+	req, err := http.NewRequest(http.MethodDelete, queryURL.String(), nil)
 	if err != nil {
 		return nil, err
 	}
@@ -6459,7 +6470,7 @@ func NewV1CreateLoginRoleRequestWithBody(server string, ref string, contentType
 
 	var pathParam0 string
 
-	pathParam0, err = runtime.StyleParamWithLocation("simple", false, "ref", runtime.ParamLocationPath, ref)
+	pathParam0, err = runtime.StyleParamWithOptions("simple", false, "ref", ref, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationPath, Type: "string", Format: ""})
 	if err != nil {
 		return nil, err
 	}
@@ -6479,7 +6490,7 @@ func NewV1CreateLoginRoleRequestWithBody(server string, ref string, contentType
 		return nil, err
 	}
 
-	req, err := http.NewRequest("POST", queryURL.String(), body)
+	req, err := http.NewRequest(http.MethodPost, queryURL.String(), body)
 	if err != nil {
 		return nil, err
 	}
@@ -6495,7 +6506,7 @@ func NewV1GetAuthServiceConfigRequest(server string, ref string) (*http.Request,
 
 	var pathParam0 string
 
-	pathParam0, err = runtime.StyleParamWithLocation("simple", false, "ref", runtime.ParamLocationPath, ref)
+	pathParam0, err = runtime.StyleParamWithOptions("simple", false, "ref", ref, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationPath, Type: "string", Format: ""})
 	if err != nil {
 		return nil, err
 	}
@@ -6515,7 +6526,7 @@ func NewV1GetAuthServiceConfigRequest(server string, ref string) (*http.Request,
 		return nil, err
 	}
 
-	req, err := http.NewRequest("GET", queryURL.String(), nil)
+	req, err := http.NewRequest(http.MethodGet, queryURL.String(), nil)
 	if err != nil {
 		return nil, err
 	}
@@ -6540,7 +6551,7 @@ func NewV1UpdateAuthServiceConfigRequestWithBody(server string, ref string, cont
 
 	var pathParam0 string
 
-	pathParam0, err = runtime.StyleParamWithLocation("simple", false, "ref", runtime.ParamLocationPath, ref)
+	pathParam0, err = runtime.StyleParamWithOptions("simple", false, "ref", ref, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationPath, Type: "string", Format: ""})
 	if err != nil {
 		return nil, err
 	}
@@ -6560,7 +6571,7 @@ func NewV1UpdateAuthServiceConfigRequestWithBody(server string, ref string, cont
 		return nil, err
 	}
 
-	req, err := http.NewRequest("PATCH", queryURL.String(), body)
+	req, err := http.NewRequest(http.MethodPatch, queryURL.String(), body)
 	if err != nil {
 		return nil, err
 	}
@@ -6576,7 +6587,7 @@ func NewV1GetProjectSigningKeysRequest(server string, ref string) (*http.Request
 
 	var pathParam0 string
 
-	pathParam0, err = runtime.StyleParamWithLocation("simple", false, "ref", runtime.ParamLocationPath, ref)
+	pathParam0, err = runtime.StyleParamWithOptions("simple", false, "ref", ref, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationPath, Type: "string", Format: ""})
 	if err != nil {
 		return nil, err
 	}
@@ -6596,7 +6607,7 @@ func NewV1GetProjectSigningKeysRequest(server string, ref string) (*http.Request
 		return nil, err
 	}
 
-	req, err := http.NewRequest("GET", queryURL.String(), nil)
+	req, err := http.NewRequest(http.MethodGet, queryURL.String(), nil)
 	if err != nil {
 		return nil, err
 	}
@@ -6621,7 +6632,7 @@ func NewV1CreateProjectSigningKeyRequestWithBody(server string, ref string, cont
 
 	var pathParam0 string
 
-	pathParam0, err = runtime.StyleParamWithLocation("simple", false, "ref", runtime.ParamLocationPath, ref)
+	pathParam0, err = runtime.StyleParamWithOptions("simple", false, "ref", ref, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationPath, Type: "string", Format: ""})
 	if err != nil {
 		return nil, err
 	}
@@ -6641,7 +6652,7 @@ func NewV1CreateProjectSigningKeyRequestWithBody(server string, ref string, cont
 		return nil, err
 	}
 
-	req, err := http.NewRequest("POST", queryURL.String(), body)
+	req, err := http.NewRequest(http.MethodPost, queryURL.String(), body)
 	if err != nil {
 		return nil, err
 	}
@@ -6657,7 +6668,7 @@ func NewV1GetLegacySigningKeyRequest(server string, ref string) (*http.Request,
 
 	var pathParam0 string
 
-	pathParam0, err = runtime.StyleParamWithLocation("simple", false, "ref", runtime.ParamLocationPath, ref)
+	pathParam0, err = runtime.StyleParamWithOptions("simple", false, "ref", ref, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationPath, Type: "string", Format: ""})
 	if err != nil {
 		return nil, err
 	}
@@ -6677,7 +6688,7 @@ func NewV1GetLegacySigningKeyRequest(server string, ref string) (*http.Request,
 		return nil, err
 	}
 
-	req, err := http.NewRequest("GET", queryURL.String(), nil)
+	req, err := http.NewRequest(http.MethodGet, queryURL.String(), nil)
 	if err != nil {
 		return nil, err
 	}
@@ -6691,7 +6702,7 @@ func NewV1CreateLegacySigningKeyRequest(server string, ref string) (*http.Reques
 
 	var pathParam0 string
 
-	pathParam0, err = runtime.StyleParamWithLocation("simple", false, "ref", runtime.ParamLocationPath, ref)
+	pathParam0, err = runtime.StyleParamWithOptions("simple", false, "ref", ref, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationPath, Type: "string", Format: ""})
 	if err != nil {
 		return nil, err
 	}
@@ -6711,7 +6722,7 @@ func NewV1CreateLegacySigningKeyRequest(server string, ref string) (*http.Reques
 		return nil, err
 	}
 
-	req, err := http.NewRequest("POST", queryURL.String(), nil)
+	req, err := http.NewRequest(http.MethodPost, queryURL.String(), nil)
 	if err != nil {
 		return nil, err
 	}
@@ -6725,14 +6736,14 @@ func NewV1RemoveProjectSigningKeyRequest(server string, ref string, id openapi_t
 
 	var pathParam0 string
 
-	pathParam0, err = runtime.StyleParamWithLocation("simple", false, "ref", runtime.ParamLocationPath, ref)
+	pathParam0, err = runtime.StyleParamWithOptions("simple", false, "ref", ref, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationPath, Type: "string", Format: ""})
 	if err != nil {
 		return nil, err
 	}
 
 	var pathParam1 string
 
-	pathParam1, err = runtime.StyleParamWithLocation("simple", false, "id", runtime.ParamLocationPath, id)
+	pathParam1, err = runtime.StyleParamWithOptions("simple", false, "id", id, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationPath, Type: "string", Format: "uuid"})
 	if err != nil {
 		return nil, err
 	}
@@ -6752,7 +6763,7 @@ func NewV1RemoveProjectSigningKeyRequest(server string, ref string, id openapi_t
 		return nil, err
 	}
 
-	req, err := http.NewRequest("DELETE", queryURL.String(), nil)
+	req, err := http.NewRequest(http.MethodDelete, queryURL.String(), nil)
 	if err != nil {
 		return nil, err
 	}
@@ -6766,14 +6777,14 @@ func NewV1GetProjectSigningKeyRequest(server string, ref string, id openapi_type
 
 	var pathParam0 string
 
-	pathParam0, err = runtime.StyleParamWithLocation("simple", false, "ref", runtime.ParamLocationPath, ref)
+	pathParam0, err = runtime.StyleParamWithOptions("simple", false, "ref", ref, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationPath, Type: "string", Format: ""})
 	if err != nil {
 		return nil, err
 	}
 
 	var pathParam1 string
 
-	pathParam1, err = runtime.StyleParamWithLocation("simple", false, "id", runtime.ParamLocationPath, id)
+	pathParam1, err = runtime.StyleParamWithOptions("simple", false, "id", id, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationPath, Type: "string", Format: "uuid"})
 	if err != nil {
 		return nil, err
 	}
@@ -6793,7 +6804,7 @@ func NewV1GetProjectSigningKeyRequest(server string, ref string, id openapi_type
 		return nil, err
 	}
 
-	req, err := http.NewRequest("GET", queryURL.String(), nil)
+	req, err := http.NewRequest(http.MethodGet, queryURL.String(), nil)
 	if err != nil {
 		return nil, err
 	}
@@ -6818,14 +6829,14 @@ func NewV1UpdateProjectSigningKeyRequestWithBody(server string, ref string, id o
 
 	var pathParam0 string
 
-	pathParam0, err = runtime.StyleParamWithLocation("simple", false, "ref", runtime.ParamLocationPath, ref)
+	pathParam0, err = runtime.StyleParamWithOptions("simple", false, "ref", ref, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationPath, Type: "string", Format: ""})
 	if err != nil {
 		return nil, err
 	}
 
 	var pathParam1 string
 
-	pathParam1, err = runtime.StyleParamWithLocation("simple", false, "id", runtime.ParamLocationPath, id)
+	pathParam1, err = runtime.StyleParamWithOptions("simple", false, "id", id, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationPath, Type: "string", Format: "uuid"})
 	if err != nil {
 		return nil, err
 	}
@@ -6845,7 +6856,7 @@ func NewV1UpdateProjectSigningKeyRequestWithBody(server string, ref string, id o
 		return nil, err
 	}
 
-	req, err := http.NewRequest("PATCH", queryURL.String(), body)
+	req, err := http.NewRequest(http.MethodPatch, queryURL.String(), body)
 	if err != nil {
 		return nil, err
 	}
@@ -6861,7 +6872,7 @@ func NewV1ListAllSsoProviderRequest(server string, ref string) (*http.Request, e
 
 	var pathParam0 string
 
-	pathParam0, err = runtime.StyleParamWithLocation("simple", false, "ref", runtime.ParamLocationPath, ref)
+	pathParam0, err = runtime.StyleParamWithOptions("simple", false, "ref", ref, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationPath, Type: "string", Format: ""})
 	if err != nil {
 		return nil, err
 	}
@@ -6881,7 +6892,7 @@ func NewV1ListAllSsoProviderRequest(server string, ref string) (*http.Request, e
 		return nil, err
 	}
 
-	req, err := http.NewRequest("GET", queryURL.String(), nil)
+	req, err := http.NewRequest(http.MethodGet, queryURL.String(), nil)
 	if err != nil {
 		return nil, err
 	}
@@ -6906,7 +6917,7 @@ func NewV1CreateASsoProviderRequestWithBody(server string, ref string, contentTy
 
 	var pathParam0 string
 
-	pathParam0, err = runtime.StyleParamWithLocation("simple", false, "ref", runtime.ParamLocationPath, ref)
+	pathParam0, err = runtime.StyleParamWithOptions("simple", false, "ref", ref, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationPath, Type: "string", Format: ""})
 	if err != nil {
 		return nil, err
 	}
@@ -6926,7 +6937,7 @@ func NewV1CreateASsoProviderRequestWithBody(server string, ref string, contentTy
 		return nil, err
 	}
 
-	req, err := http.NewRequest("POST", queryURL.String(), body)
+	req, err := http.NewRequest(http.MethodPost, queryURL.String(), body)
 	if err != nil {
 		return nil, err
 	}
@@ -6942,14 +6953,14 @@ func NewV1DeleteASsoProviderRequest(server string, ref string, providerId openap
 
 	var pathParam0 string
 
-	pathParam0, err = runtime.StyleParamWithLocation("simple", false, "ref", runtime.ParamLocationPath, ref)
+	pathParam0, err = runtime.StyleParamWithOptions("simple", false, "ref", ref, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationPath, Type: "string", Format: ""})
 	if err != nil {
 		return nil, err
 	}
 
 	var pathParam1 string
 
-	pathParam1, err = runtime.StyleParamWithLocation("simple", false, "provider_id", runtime.ParamLocationPath, providerId)
+	pathParam1, err = runtime.StyleParamWithOptions("simple", false, "provider_id", providerId, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationPath, Type: "string", Format: "uuid"})
 	if err != nil {
 		return nil, err
 	}
@@ -6969,7 +6980,7 @@ func NewV1DeleteASsoProviderRequest(server string, ref string, providerId openap
 		return nil, err
 	}
 
-	req, err := http.NewRequest("DELETE", queryURL.String(), nil)
+	req, err := http.NewRequest(http.MethodDelete, queryURL.String(), nil)
 	if err != nil {
 		return nil, err
 	}
@@ -6983,14 +6994,14 @@ func NewV1GetASsoProviderRequest(server string, ref string, providerId openapi_t
 
 	var pathParam0 string
 
-	pathParam0, err = runtime.StyleParamWithLocation("simple", false, "ref", runtime.ParamLocationPath, ref)
+	pathParam0, err = runtime.StyleParamWithOptions("simple", false, "ref", ref, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationPath, Type: "string", Format: ""})
 	if err != nil {
 		return nil, err
 	}
 
 	var pathParam1 string
 
-	pathParam1, err = runtime.StyleParamWithLocation("simple", false, "provider_id", runtime.ParamLocationPath, providerId)
+	pathParam1, err = runtime.StyleParamWithOptions("simple", false, "provider_id", providerId, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationPath, Type: "string", Format: "uuid"})
 	if err != nil {
 		return nil, err
 	}
@@ -7010,7 +7021,7 @@ func NewV1GetASsoProviderRequest(server string, ref string, providerId openapi_t
 		return nil, err
 	}
 
-	req, err := http.NewRequest("GET", queryURL.String(), nil)
+	req, err := http.NewRequest(http.MethodGet, queryURL.String(), nil)
 	if err != nil {
 		return nil, err
 	}
@@ -7035,14 +7046,14 @@ func NewV1UpdateASsoProviderRequestWithBody(server string, ref string, providerI
 
 	var pathParam0 string
 
-	pathParam0, err = runtime.StyleParamWithLocation("simple", false, "ref", runtime.ParamLocationPath, ref)
+	pathParam0, err = runtime.StyleParamWithOptions("simple", false, "ref", ref, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationPath, Type: "string", Format: ""})
 	if err != nil {
 		return nil, err
 	}
 
 	var pathParam1 string
 
-	pathParam1, err = runtime.StyleParamWithLocation("simple", false, "provider_id", runtime.ParamLocationPath, providerId)
+	pathParam1, err = runtime.StyleParamWithOptions("simple", false, "provider_id", providerId, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationPath, Type: "string", Format: "uuid"})
 	if err != nil {
 		return nil, err
 	}
@@ -7062,7 +7073,7 @@ func NewV1UpdateASsoProviderRequestWithBody(server string, ref string, providerI
 		return nil, err
 	}
 
-	req, err := http.NewRequest("PUT", queryURL.String(), body)
+	req, err := http.NewRequest(http.MethodPut, queryURL.String(), body)
 	if err != nil {
 		return nil, err
 	}
@@ -7078,7 +7089,7 @@ func NewV1ListProjectTpaIntegrationsRequest(server string, ref string) (*http.Re
 
 	var pathParam0 string
 
-	pathParam0, err = runtime.StyleParamWithLocation("simple", false, "ref", runtime.ParamLocationPath, ref)
+	pathParam0, err = runtime.StyleParamWithOptions("simple", false, "ref", ref, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationPath, Type: "string", Format: ""})
 	if err != nil {
 		return nil, err
 	}
@@ -7098,7 +7109,7 @@ func NewV1ListProjectTpaIntegrationsRequest(server string, ref string) (*http.Re
 		return nil, err
 	}
 
-	req, err := http.NewRequest("GET", queryURL.String(), nil)
+	req, err := http.NewRequest(http.MethodGet, queryURL.String(), nil)
 	if err != nil {
 		return nil, err
 	}
@@ -7123,7 +7134,7 @@ func NewV1CreateProjectTpaIntegrationRequestWithBody(server string, ref string,
 
 	var pathParam0 string
 
-	pathParam0, err = runtime.StyleParamWithLocation("simple", false, "ref", runtime.ParamLocationPath, ref)
+	pathParam0, err = runtime.StyleParamWithOptions("simple", false, "ref", ref, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationPath, Type: "string", Format: ""})
 	if err != nil {
 		return nil, err
 	}
@@ -7143,7 +7154,7 @@ func NewV1CreateProjectTpaIntegrationRequestWithBody(server string, ref string,
 		return nil, err
 	}
 
-	req, err := http.NewRequest("POST", queryURL.String(), body)
+	req, err := http.NewRequest(http.MethodPost, queryURL.String(), body)
 	if err != nil {
 		return nil, err
 	}
@@ -7159,14 +7170,14 @@ func NewV1DeleteProjectTpaIntegrationRequest(server string, ref string, tpaId op
 
 	var pathParam0 string
 
-	pathParam0, err = runtime.StyleParamWithLocation("simple", false, "ref", runtime.ParamLocationPath, ref)
+	pathParam0, err = runtime.StyleParamWithOptions("simple", false, "ref", ref, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationPath, Type: "string", Format: ""})
 	if err != nil {
 		return nil, err
 	}
 
 	var pathParam1 string
 
-	pathParam1, err = runtime.StyleParamWithLocation("simple", false, "tpa_id", runtime.ParamLocationPath, tpaId)
+	pathParam1, err = runtime.StyleParamWithOptions("simple", false, "tpa_id", tpaId, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationPath, Type: "string", Format: "uuid"})
 	if err != nil {
 		return nil, err
 	}
@@ -7186,7 +7197,7 @@ func NewV1DeleteProjectTpaIntegrationRequest(server string, ref string, tpaId op
 		return nil, err
 	}
 
-	req, err := http.NewRequest("DELETE", queryURL.String(), nil)
+	req, err := http.NewRequest(http.MethodDelete, queryURL.String(), nil)
 	if err != nil {
 		return nil, err
 	}
@@ -7200,14 +7211,14 @@ func NewV1GetProjectTpaIntegrationRequest(server string, ref string, tpaId opena
 
 	var pathParam0 string
 
-	pathParam0, err = runtime.StyleParamWithLocation("simple", false, "ref", runtime.ParamLocationPath, ref)
+	pathParam0, err = runtime.StyleParamWithOptions("simple", false, "ref", ref, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationPath, Type: "string", Format: ""})
 	if err != nil {
 		return nil, err
 	}
 
 	var pathParam1 string
 
-	pathParam1, err = runtime.StyleParamWithLocation("simple", false, "tpa_id", runtime.ParamLocationPath, tpaId)
+	pathParam1, err = runtime.StyleParamWithOptions("simple", false, "tpa_id", tpaId, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationPath, Type: "string", Format: "uuid"})
 	if err != nil {
 		return nil, err
 	}
@@ -7227,7 +7238,7 @@ func NewV1GetProjectTpaIntegrationRequest(server string, ref string, tpaId opena
 		return nil, err
 	}
 
-	req, err := http.NewRequest("GET", queryURL.String(), nil)
+	req, err := http.NewRequest(http.MethodGet, queryURL.String(), nil)
 	if err != nil {
 		return nil, err
 	}
@@ -7241,7 +7252,7 @@ func NewV1GetProjectPgbouncerConfigRequest(server string, ref string) (*http.Req
 
 	var pathParam0 string
 
-	pathParam0, err = runtime.StyleParamWithLocation("simple", false, "ref", runtime.ParamLocationPath, ref)
+	pathParam0, err = runtime.StyleParamWithOptions("simple", false, "ref", ref, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationPath, Type: "string", Format: ""})
 	if err != nil {
 		return nil, err
 	}
@@ -7261,7 +7272,7 @@ func NewV1GetProjectPgbouncerConfigRequest(server string, ref string) (*http.Req
 		return nil, err
 	}
 
-	req, err := http.NewRequest("GET", queryURL.String(), nil)
+	req, err := http.NewRequest(http.MethodGet, queryURL.String(), nil)
 	if err != nil {
 		return nil, err
 	}
@@ -7275,7 +7286,7 @@ func NewV1GetPoolerConfigRequest(server string, ref string) (*http.Request, erro
 
 	var pathParam0 string
 
-	pathParam0, err = runtime.StyleParamWithLocation("simple", false, "ref", runtime.ParamLocationPath, ref)
+	pathParam0, err = runtime.StyleParamWithOptions("simple", false, "ref", ref, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationPath, Type: "string", Format: ""})
 	if err != nil {
 		return nil, err
 	}
@@ -7295,7 +7306,7 @@ func NewV1GetPoolerConfigRequest(server string, ref string) (*http.Request, erro
 		return nil, err
 	}
 
-	req, err := http.NewRequest("GET", queryURL.String(), nil)
+	req, err := http.NewRequest(http.MethodGet, queryURL.String(), nil)
 	if err != nil {
 		return nil, err
 	}
@@ -7320,7 +7331,7 @@ func NewV1UpdatePoolerConfigRequestWithBody(server string, ref string, contentTy
 
 	var pathParam0 string
 
-	pathParam0, err = runtime.StyleParamWithLocation("simple", false, "ref", runtime.ParamLocationPath, ref)
+	pathParam0, err = runtime.StyleParamWithOptions("simple", false, "ref", ref, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationPath, Type: "string", Format: ""})
 	if err != nil {
 		return nil, err
 	}
@@ -7340,7 +7351,7 @@ func NewV1UpdatePoolerConfigRequestWithBody(server string, ref string, contentTy
 		return nil, err
 	}
 
-	req, err := http.NewRequest("PATCH", queryURL.String(), body)
+	req, err := http.NewRequest(http.MethodPatch, queryURL.String(), body)
 	if err != nil {
 		return nil, err
 	}
@@ -7356,7 +7367,7 @@ func NewV1GetPostgresConfigRequest(server string, ref string) (*http.Request, er
 
 	var pathParam0 string
 
-	pathParam0, err = runtime.StyleParamWithLocation("simple", false, "ref", runtime.ParamLocationPath, ref)
+	pathParam0, err = runtime.StyleParamWithOptions("simple", false, "ref", ref, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationPath, Type: "string", Format: ""})
 	if err != nil {
 		return nil, err
 	}
@@ -7376,7 +7387,7 @@ func NewV1GetPostgresConfigRequest(server string, ref string) (*http.Request, er
 		return nil, err
 	}
 
-	req, err := http.NewRequest("GET", queryURL.String(), nil)
+	req, err := http.NewRequest(http.MethodGet, queryURL.String(), nil)
 	if err != nil {
 		return nil, err
 	}
@@ -7401,7 +7412,7 @@ func NewV1UpdatePostgresConfigRequestWithBody(server string, ref string, content
 
 	var pathParam0 string
 
-	pathParam0, err = runtime.StyleParamWithLocation("simple", false, "ref", runtime.ParamLocationPath, ref)
+	pathParam0, err = runtime.StyleParamWithOptions("simple", false, "ref", ref, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationPath, Type: "string", Format: ""})
 	if err != nil {
 		return nil, err
 	}
@@ -7421,7 +7432,7 @@ func NewV1UpdatePostgresConfigRequestWithBody(server string, ref string, content
 		return nil, err
 	}
 
-	req, err := http.NewRequest("PUT", queryURL.String(), body)
+	req, err := http.NewRequest(http.MethodPut, queryURL.String(), body)
 	if err != nil {
 		return nil, err
 	}
@@ -7437,7 +7448,7 @@ func NewV1GetDatabaseDiskRequest(server string, ref string) (*http.Request, erro
 
 	var pathParam0 string
 
-	pathParam0, err = runtime.StyleParamWithLocation("simple", false, "ref", runtime.ParamLocationPath, ref)
+	pathParam0, err = runtime.StyleParamWithOptions("simple", false, "ref", ref, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationPath, Type: "string", Format: ""})
 	if err != nil {
 		return nil, err
 	}
@@ -7457,7 +7468,7 @@ func NewV1GetDatabaseDiskRequest(server string, ref string) (*http.Request, erro
 		return nil, err
 	}
 
-	req, err := http.NewRequest("GET", queryURL.String(), nil)
+	req, err := http.NewRequest(http.MethodGet, queryURL.String(), nil)
 	if err != nil {
 		return nil, err
 	}
@@ -7482,7 +7493,7 @@ func NewV1ModifyDatabaseDiskRequestWithBody(server string, ref string, contentTy
 
 	var pathParam0 string
 
-	pathParam0, err = runtime.StyleParamWithLocation("simple", false, "ref", runtime.ParamLocationPath, ref)
+	pathParam0, err = runtime.StyleParamWithOptions("simple", false, "ref", ref, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationPath, Type: "string", Format: ""})
 	if err != nil {
 		return nil, err
 	}
@@ -7502,7 +7513,7 @@ func NewV1ModifyDatabaseDiskRequestWithBody(server string, ref string, contentTy
 		return nil, err
 	}
 
-	req, err := http.NewRequest("POST", queryURL.String(), body)
+	req, err := http.NewRequest(http.MethodPost, queryURL.String(), body)
 	if err != nil {
 		return nil, err
 	}
@@ -7518,7 +7529,7 @@ func NewV1GetProjectDiskAutoscaleConfigRequest(server string, ref string) (*http
 
 	var pathParam0 string
 
-	pathParam0, err = runtime.StyleParamWithLocation("simple", false, "ref", runtime.ParamLocationPath, ref)
+	pathParam0, err = runtime.StyleParamWithOptions("simple", false, "ref", ref, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationPath, Type: "string", Format: ""})
 	if err != nil {
 		return nil, err
 	}
@@ -7538,7 +7549,7 @@ func NewV1GetProjectDiskAutoscaleConfigRequest(server string, ref string) (*http
 		return nil, err
 	}
 
-	req, err := http.NewRequest("GET", queryURL.String(), nil)
+	req, err := http.NewRequest(http.MethodGet, queryURL.String(), nil)
 	if err != nil {
 		return nil, err
 	}
@@ -7552,7 +7563,7 @@ func NewV1GetDiskUtilizationRequest(server string, ref string) (*http.Request, e
 
 	var pathParam0 string
 
-	pathParam0, err = runtime.StyleParamWithLocation("simple", false, "ref", runtime.ParamLocationPath, ref)
+	pathParam0, err = runtime.StyleParamWithOptions("simple", false, "ref", ref, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationPath, Type: "string", Format: ""})
 	if err != nil {
 		return nil, err
 	}
@@ -7572,7 +7583,7 @@ func NewV1GetDiskUtilizationRequest(server string, ref string) (*http.Request, e
 		return nil, err
 	}
 
-	req, err := http.NewRequest("GET", queryURL.String(), nil)
+	req, err := http.NewRequest(http.MethodGet, queryURL.String(), nil)
 	if err != nil {
 		return nil, err
 	}
@@ -7586,7 +7597,7 @@ func NewV1GetRealtimeConfigRequest(server string, ref string) (*http.Request, er
 
 	var pathParam0 string
 
-	pathParam0, err = runtime.StyleParamWithLocation("simple", false, "ref", runtime.ParamLocationPath, ref)
+	pathParam0, err = runtime.StyleParamWithOptions("simple", false, "ref", ref, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationPath, Type: "string", Format: ""})
 	if err != nil {
 		return nil, err
 	}
@@ -7606,7 +7617,7 @@ func NewV1GetRealtimeConfigRequest(server string, ref string) (*http.Request, er
 		return nil, err
 	}
 
-	req, err := http.NewRequest("GET", queryURL.String(), nil)
+	req, err := http.NewRequest(http.MethodGet, queryURL.String(), nil)
 	if err != nil {
 		return nil, err
 	}
@@ -7631,7 +7642,7 @@ func NewV1UpdateRealtimeConfigRequestWithBody(server string, ref string, content
 
 	var pathParam0 string
 
-	pathParam0, err = runtime.StyleParamWithLocation("simple", false, "ref", runtime.ParamLocationPath, ref)
+	pathParam0, err = runtime.StyleParamWithOptions("simple", false, "ref", ref, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationPath, Type: "string", Format: ""})
 	if err != nil {
 		return nil, err
 	}
@@ -7651,7 +7662,7 @@ func NewV1UpdateRealtimeConfigRequestWithBody(server string, ref string, content
 		return nil, err
 	}
 
-	req, err := http.NewRequest("PATCH", queryURL.String(), body)
+	req, err := http.NewRequest(http.MethodPatch, queryURL.String(), body)
 	if err != nil {
 		return nil, err
 	}
@@ -7667,7 +7678,7 @@ func NewV1ShutdownRealtimeRequest(server string, ref string) (*http.Request, err
 
 	var pathParam0 string
 
-	pathParam0, err = runtime.StyleParamWithLocation("simple", false, "ref", runtime.ParamLocationPath, ref)
+	pathParam0, err = runtime.StyleParamWithOptions("simple", false, "ref", ref, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationPath, Type: "string", Format: ""})
 	if err != nil {
 		return nil, err
 	}
@@ -7687,7 +7698,7 @@ func NewV1ShutdownRealtimeRequest(server string, ref string) (*http.Request, err
 		return nil, err
 	}
 
-	req, err := http.NewRequest("POST", queryURL.String(), nil)
+	req, err := http.NewRequest(http.MethodPost, queryURL.String(), nil)
 	if err != nil {
 		return nil, err
 	}
@@ -7701,7 +7712,7 @@ func NewV1GetStorageConfigRequest(server string, ref string) (*http.Request, err
 
 	var pathParam0 string
 
-	pathParam0, err = runtime.StyleParamWithLocation("simple", false, "ref", runtime.ParamLocationPath, ref)
+	pathParam0, err = runtime.StyleParamWithOptions("simple", false, "ref", ref, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationPath, Type: "string", Format: ""})
 	if err != nil {
 		return nil, err
 	}
@@ -7721,7 +7732,7 @@ func NewV1GetStorageConfigRequest(server string, ref string) (*http.Request, err
 		return nil, err
 	}
 
-	req, err := http.NewRequest("GET", queryURL.String(), nil)
+	req, err := http.NewRequest(http.MethodGet, queryURL.String(), nil)
 	if err != nil {
 		return nil, err
 	}
@@ -7746,7 +7757,7 @@ func NewV1UpdateStorageConfigRequestWithBody(server string, ref string, contentT
 
 	var pathParam0 string
 
-	pathParam0, err = runtime.StyleParamWithLocation("simple", false, "ref", runtime.ParamLocationPath, ref)
+	pathParam0, err = runtime.StyleParamWithOptions("simple", false, "ref", ref, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationPath, Type: "string", Format: ""})
 	if err != nil {
 		return nil, err
 	}
@@ -7766,7 +7777,7 @@ func NewV1UpdateStorageConfigRequestWithBody(server string, ref string, contentT
 		return nil, err
 	}
 
-	req, err := http.NewRequest("PATCH", queryURL.String(), body)
+	req, err := http.NewRequest(http.MethodPatch, queryURL.String(), body)
 	if err != nil {
 		return nil, err
 	}
@@ -7782,7 +7793,7 @@ func NewV1DeleteHostnameConfigRequest(server string, ref string, params *V1Delet
 
 	var pathParam0 string
 
-	pathParam0, err = runtime.StyleParamWithLocation("simple", false, "ref", runtime.ParamLocationPath, ref)
+	pathParam0, err = runtime.StyleParamWithOptions("simple", false, "ref", ref, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationPath, Type: "string", Format: ""})
 	if err != nil {
 		return nil, err
 	}
@@ -7803,28 +7814,33 @@ func NewV1DeleteHostnameConfigRequest(server string, ref string, params *V1Delet
 	}
 
 	if params != nil {
+		// queryValues collects non-styled parameters (passthrough, JSON)
+		// that are safe to round-trip through url.Values.Encode().
 		queryValues := queryURL.Query()
+		// rawQueryFragments collects pre-encoded query fragments from
+		// styled parameters, preserving literal commas as delimiters
+		// per the OpenAPI spec (e.g. "color=blue,black,brown").
+		var rawQueryFragments []string
 
 		if params.RemoveAddon != nil {
 
-			if queryFrag, err := runtime.StyleParamWithLocation("form", true, "remove_addon", runtime.ParamLocationQuery, *params.RemoveAddon); err != nil {
-				return nil, err
-			} else if parsed, err := url.ParseQuery(queryFrag); err != nil {
+			if queryFrag, err := runtime.StyleParamWithOptions("form", true, "remove_addon", *params.RemoveAddon, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationQuery, Type: "boolean", Format: ""}); err != nil {
 				return nil, err
 			} else {
-				for k, v := range parsed {
-					for _, v2 := range v {
-						queryValues.Add(k, v2)
-					}
+				for _, qp := range strings.Split(queryFrag, "&") {
+					rawQueryFragments = append(rawQueryFragments, qp)
 				}
 			}
 
 		}
 
-		queryURL.RawQuery = queryValues.Encode()
+		if encoded := queryValues.Encode(); encoded != "" {
+			rawQueryFragments = append(rawQueryFragments, encoded)
+		}
+		queryURL.RawQuery = strings.Join(rawQueryFragments, "&")
 	}
 
-	req, err := http.NewRequest("DELETE", queryURL.String(), nil)
+	req, err := http.NewRequest(http.MethodDelete, queryURL.String(), nil)
 	if err != nil {
 		return nil, err
 	}
@@ -7838,7 +7854,7 @@ func NewV1GetHostnameConfigRequest(server string, ref string) (*http.Request, er
 
 	var pathParam0 string
 
-	pathParam0, err = runtime.StyleParamWithLocation("simple", false, "ref", runtime.ParamLocationPath, ref)
+	pathParam0, err = runtime.StyleParamWithOptions("simple", false, "ref", ref, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationPath, Type: "string", Format: ""})
 	if err != nil {
 		return nil, err
 	}
@@ -7858,7 +7874,7 @@ func NewV1GetHostnameConfigRequest(server string, ref string) (*http.Request, er
 		return nil, err
 	}
 
-	req, err := http.NewRequest("GET", queryURL.String(), nil)
+	req, err := http.NewRequest(http.MethodGet, queryURL.String(), nil)
 	if err != nil {
 		return nil, err
 	}
@@ -7872,7 +7888,7 @@ func NewV1ActivateCustomHostnameRequest(server string, ref string) (*http.Reques
 
 	var pathParam0 string
 
-	pathParam0, err = runtime.StyleParamWithLocation("simple", false, "ref", runtime.ParamLocationPath, ref)
+	pathParam0, err = runtime.StyleParamWithOptions("simple", false, "ref", ref, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationPath, Type: "string", Format: ""})
 	if err != nil {
 		return nil, err
 	}
@@ -7892,7 +7908,7 @@ func NewV1ActivateCustomHostnameRequest(server string, ref string) (*http.Reques
 		return nil, err
 	}
 
-	req, err := http.NewRequest("POST", queryURL.String(), nil)
+	req, err := http.NewRequest(http.MethodPost, queryURL.String(), nil)
 	if err != nil {
 		return nil, err
 	}
@@ -7917,7 +7933,7 @@ func NewV1UpdateHostnameConfigRequestWithBody(server string, ref string, content
 
 	var pathParam0 string
 
-	pathParam0, err = runtime.StyleParamWithLocation("simple", false, "ref", runtime.ParamLocationPath, ref)
+	pathParam0, err = runtime.StyleParamWithOptions("simple", false, "ref", ref, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationPath, Type: "string", Format: ""})
 	if err != nil {
 		return nil, err
 	}
@@ -7937,7 +7953,7 @@ func NewV1UpdateHostnameConfigRequestWithBody(server string, ref string, content
 		return nil, err
 	}
 
-	req, err := http.NewRequest("POST", queryURL.String(), body)
+	req, err := http.NewRequest(http.MethodPost, queryURL.String(), body)
 	if err != nil {
 		return nil, err
 	}
@@ -7953,7 +7969,7 @@ func NewV1VerifyDnsConfigRequest(server string, ref string) (*http.Request, erro
 
 	var pathParam0 string
 
-	pathParam0, err = runtime.StyleParamWithLocation("simple", false, "ref", runtime.ParamLocationPath, ref)
+	pathParam0, err = runtime.StyleParamWithOptions("simple", false, "ref", ref, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationPath, Type: "string", Format: ""})
 	if err != nil {
 		return nil, err
 	}
@@ -7973,7 +7989,7 @@ func NewV1VerifyDnsConfigRequest(server string, ref string) (*http.Request, erro
 		return nil, err
 	}
 
-	req, err := http.NewRequest("POST", queryURL.String(), nil)
+	req, err := http.NewRequest(http.MethodPost, queryURL.String(), nil)
 	if err != nil {
 		return nil, err
 	}
@@ -7987,7 +8003,7 @@ func NewV1ListAllBackupsRequest(server string, ref string) (*http.Request, error
 
 	var pathParam0 string
 
-	pathParam0, err = runtime.StyleParamWithLocation("simple", false, "ref", runtime.ParamLocationPath, ref)
+	pathParam0, err = runtime.StyleParamWithOptions("simple", false, "ref", ref, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationPath, Type: "string", Format: ""})
 	if err != nil {
 		return nil, err
 	}
@@ -8007,7 +8023,7 @@ func NewV1ListAllBackupsRequest(server string, ref string) (*http.Request, error
 		return nil, err
 	}
 
-	req, err := http.NewRequest("GET", queryURL.String(), nil)
+	req, err := http.NewRequest(http.MethodGet, queryURL.String(), nil)
 	if err != nil {
 		return nil, err
 	}
@@ -8032,7 +8048,7 @@ func NewV1RestorePhysicalBackupRequestWithBody(server string, ref string, conten
 
 	var pathParam0 string
 
-	pathParam0, err = runtime.StyleParamWithLocation("simple", false, "ref", runtime.ParamLocationPath, ref)
+	pathParam0, err = runtime.StyleParamWithOptions("simple", false, "ref", ref, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationPath, Type: "string", Format: ""})
 	if err != nil {
 		return nil, err
 	}
@@ -8052,7 +8068,7 @@ func NewV1RestorePhysicalBackupRequestWithBody(server string, ref string, conten
 		return nil, err
 	}
 
-	req, err := http.NewRequest("POST", queryURL.String(), body)
+	req, err := http.NewRequest(http.MethodPost, queryURL.String(), body)
 	if err != nil {
 		return nil, err
 	}
@@ -8079,7 +8095,7 @@ func NewV1RestorePitrBackupRequestWithBody(server string, ref string, contentTyp
 
 	var pathParam0 string
 
-	pathParam0, err = runtime.StyleParamWithLocation("simple", false, "ref", runtime.ParamLocationPath, ref)
+	pathParam0, err = runtime.StyleParamWithOptions("simple", false, "ref", ref, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationPath, Type: "string", Format: ""})
 	if err != nil {
 		return nil, err
 	}
@@ -8099,7 +8115,7 @@ func NewV1RestorePitrBackupRequestWithBody(server string, ref string, contentTyp
 		return nil, err
 	}
 
-	req, err := http.NewRequest("POST", queryURL.String(), body)
+	req, err := http.NewRequest(http.MethodPost, queryURL.String(), body)
 	if err != nil {
 		return nil, err
 	}
@@ -8115,7 +8131,7 @@ func NewV1GetRestorePointRequest(server string, ref string, params *V1GetRestore
 
 	var pathParam0 string
 
-	pathParam0, err = runtime.StyleParamWithLocation("simple", false, "ref", runtime.ParamLocationPath, ref)
+	pathParam0, err = runtime.StyleParamWithOptions("simple", false, "ref", ref, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationPath, Type: "string", Format: ""})
 	if err != nil {
 		return nil, err
 	}
@@ -8136,28 +8152,33 @@ func NewV1GetRestorePointRequest(server string, ref string, params *V1GetRestore
 	}
 
 	if params != nil {
+		// queryValues collects non-styled parameters (passthrough, JSON)
+		// that are safe to round-trip through url.Values.Encode().
 		queryValues := queryURL.Query()
+		// rawQueryFragments collects pre-encoded query fragments from
+		// styled parameters, preserving literal commas as delimiters
+		// per the OpenAPI spec (e.g. "color=blue,black,brown").
+		var rawQueryFragments []string
 
 		if params.Name != nil {
 
-			if queryFrag, err := runtime.StyleParamWithLocation("form", true, "name", runtime.ParamLocationQuery, *params.Name); err != nil {
-				return nil, err
-			} else if parsed, err := url.ParseQuery(queryFrag); err != nil {
+			if queryFrag, err := runtime.StyleParamWithOptions("form", true, "name", *params.Name, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationQuery, Type: "string", Format: ""}); err != nil {
 				return nil, err
 			} else {
-				for k, v := range parsed {
-					for _, v2 := range v {
-						queryValues.Add(k, v2)
-					}
+				for _, qp := range strings.Split(queryFrag, "&") {
+					rawQueryFragments = append(rawQueryFragments, qp)
 				}
 			}
 
 		}
 
-		queryURL.RawQuery = queryValues.Encode()
+		if encoded := queryValues.Encode(); encoded != "" {
+			rawQueryFragments = append(rawQueryFragments, encoded)
+		}
+		queryURL.RawQuery = strings.Join(rawQueryFragments, "&")
 	}
 
-	req, err := http.NewRequest("GET", queryURL.String(), nil)
+	req, err := http.NewRequest(http.MethodGet, queryURL.String(), nil)
 	if err != nil {
 		return nil, err
 	}
@@ -8182,7 +8203,7 @@ func NewV1CreateRestorePointRequestWithBody(server string, ref string, contentTy
 
 	var pathParam0 string
 
-	pathParam0, err = runtime.StyleParamWithLocation("simple", false, "ref", runtime.ParamLocationPath, ref)
+	pathParam0, err = runtime.StyleParamWithOptions("simple", false, "ref", ref, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationPath, Type: "string", Format: ""})
 	if err != nil {
 		return nil, err
 	}
@@ -8202,7 +8223,7 @@ func NewV1CreateRestorePointRequestWithBody(server string, ref string, contentTy
 		return nil, err
 	}
 
-	req, err := http.NewRequest("POST", queryURL.String(), body)
+	req, err := http.NewRequest(http.MethodPost, queryURL.String(), body)
 	if err != nil {
 		return nil, err
 	}
@@ -8218,7 +8239,7 @@ func NewV1GetBackupScheduleRequest(server string, ref string) (*http.Request, er
 
 	var pathParam0 string
 
-	pathParam0, err = runtime.StyleParamWithLocation("simple", false, "ref", runtime.ParamLocationPath, ref)
+	pathParam0, err = runtime.StyleParamWithOptions("simple", false, "ref", ref, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationPath, Type: "string", Format: ""})
 	if err != nil {
 		return nil, err
 	}
@@ -8238,7 +8259,7 @@ func NewV1GetBackupScheduleRequest(server string, ref string) (*http.Request, er
 		return nil, err
 	}
 
-	req, err := http.NewRequest("GET", queryURL.String(), nil)
+	req, err := http.NewRequest(http.MethodGet, queryURL.String(), nil)
 	if err != nil {
 		return nil, err
 	}
@@ -8263,7 +8284,7 @@ func NewV1UpdateBackupScheduleRequestWithBody(server string, ref string, content
 
 	var pathParam0 string
 
-	pathParam0, err = runtime.StyleParamWithLocation("simple", false, "ref", runtime.ParamLocationPath, ref)
+	pathParam0, err = runtime.StyleParamWithOptions("simple", false, "ref", ref, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationPath, Type: "string", Format: ""})
 	if err != nil {
 		return nil, err
 	}
@@ -8283,7 +8304,7 @@ func NewV1UpdateBackupScheduleRequestWithBody(server string, ref string, content
 		return nil, err
 	}
 
-	req, err := http.NewRequest("PATCH", queryURL.String(), body)
+	req, err := http.NewRequest(http.MethodPatch, queryURL.String(), body)
 	if err != nil {
 		return nil, err
 	}
@@ -8310,7 +8331,7 @@ func NewV1UndoRequestWithBody(server string, ref string, contentType string, bod
 
 	var pathParam0 string
 
-	pathParam0, err = runtime.StyleParamWithLocation("simple", false, "ref", runtime.ParamLocationPath, ref)
+	pathParam0, err = runtime.StyleParamWithOptions("simple", false, "ref", ref, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationPath, Type: "string", Format: ""})
 	if err != nil {
 		return nil, err
 	}
@@ -8330,7 +8351,7 @@ func NewV1UndoRequestWithBody(server string, ref string, contentType string, bod
 		return nil, err
 	}
 
-	req, err := http.NewRequest("POST", queryURL.String(), body)
+	req, err := http.NewRequest(http.MethodPost, queryURL.String(), body)
 	if err != nil {
 		return nil, err
 	}
@@ -8346,7 +8367,7 @@ func NewV1GetDatabaseMetadataRequest(server string, ref string) (*http.Request,
 
 	var pathParam0 string
 
-	pathParam0, err = runtime.StyleParamWithLocation("simple", false, "ref", runtime.ParamLocationPath, ref)
+	pathParam0, err = runtime.StyleParamWithOptions("simple", false, "ref", ref, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationPath, Type: "string", Format: ""})
 	if err != nil {
 		return nil, err
 	}
@@ -8366,7 +8387,7 @@ func NewV1GetDatabaseMetadataRequest(server string, ref string) (*http.Request,
 		return nil, err
 	}
 
-	req, err := http.NewRequest("GET", queryURL.String(), nil)
+	req, err := http.NewRequest(http.MethodGet, queryURL.String(), nil)
 	if err != nil {
 		return nil, err
 	}
@@ -8380,7 +8401,7 @@ func NewV1GetJitAccessRequest(server string, ref string) (*http.Request, error)
 
 	var pathParam0 string
 
-	pathParam0, err = runtime.StyleParamWithLocation("simple", false, "ref", runtime.ParamLocationPath, ref)
+	pathParam0, err = runtime.StyleParamWithOptions("simple", false, "ref", ref, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationPath, Type: "string", Format: ""})
 	if err != nil {
 		return nil, err
 	}
@@ -8400,7 +8421,7 @@ func NewV1GetJitAccessRequest(server string, ref string) (*http.Request, error)
 		return nil, err
 	}
 
-	req, err := http.NewRequest("GET", queryURL.String(), nil)
+	req, err := http.NewRequest(http.MethodGet, queryURL.String(), nil)
 	if err != nil {
 		return nil, err
 	}
@@ -8425,7 +8446,7 @@ func NewV1AuthorizeJitAccessRequestWithBody(server string, ref string, contentTy
 
 	var pathParam0 string
 
-	pathParam0, err = runtime.StyleParamWithLocation("simple", false, "ref", runtime.ParamLocationPath, ref)
+	pathParam0, err = runtime.StyleParamWithOptions("simple", false, "ref", ref, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationPath, Type: "string", Format: ""})
 	if err != nil {
 		return nil, err
 	}
@@ -8445,7 +8466,7 @@ func NewV1AuthorizeJitAccessRequestWithBody(server string, ref string, contentTy
 		return nil, err
 	}
 
-	req, err := http.NewRequest("POST", queryURL.String(), body)
+	req, err := http.NewRequest(http.MethodPost, queryURL.String(), body)
 	if err != nil {
 		return nil, err
 	}
@@ -8472,7 +8493,7 @@ func NewV1UpdateJitAccessRequestWithBody(server string, ref string, contentType
 
 	var pathParam0 string
 
-	pathParam0, err = runtime.StyleParamWithLocation("simple", false, "ref", runtime.ParamLocationPath, ref)
+	pathParam0, err = runtime.StyleParamWithOptions("simple", false, "ref", ref, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationPath, Type: "string", Format: ""})
 	if err != nil {
 		return nil, err
 	}
@@ -8492,7 +8513,7 @@ func NewV1UpdateJitAccessRequestWithBody(server string, ref string, contentType
 		return nil, err
 	}
 
-	req, err := http.NewRequest("PUT", queryURL.String(), body)
+	req, err := http.NewRequest(http.MethodPut, queryURL.String(), body)
 	if err != nil {
 		return nil, err
 	}
@@ -8519,7 +8540,7 @@ func NewV1InviteExternalJitAccessRequestWithBody(server string, ref string, cont
 
 	var pathParam0 string
 
-	pathParam0, err = runtime.StyleParamWithLocation("simple", false, "ref", runtime.ParamLocationPath, ref)
+	pathParam0, err = runtime.StyleParamWithOptions("simple", false, "ref", ref, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationPath, Type: "string", Format: ""})
 	if err != nil {
 		return nil, err
 	}
@@ -8539,7 +8560,7 @@ func NewV1InviteExternalJitAccessRequestWithBody(server string, ref string, cont
 		return nil, err
 	}
 
-	req, err := http.NewRequest("POST", queryURL.String(), body)
+	req, err := http.NewRequest(http.MethodPost, queryURL.String(), body)
 	if err != nil {
 		return nil, err
 	}
@@ -8566,7 +8587,7 @@ func NewV1AcceptInviteExternalJitAccessRequestWithBody(server string, ref string
 
 	var pathParam0 string
 
-	pathParam0, err = runtime.StyleParamWithLocation("simple", false, "ref", runtime.ParamLocationPath, ref)
+	pathParam0, err = runtime.StyleParamWithOptions("simple", false, "ref", ref, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationPath, Type: "string", Format: ""})
 	if err != nil {
 		return nil, err
 	}
@@ -8586,7 +8607,7 @@ func NewV1AcceptInviteExternalJitAccessRequestWithBody(server string, ref string
 		return nil, err
 	}
 
-	req, err := http.NewRequest("POST", queryURL.String(), body)
+	req, err := http.NewRequest(http.MethodPost, queryURL.String(), body)
 	if err != nil {
 		return nil, err
 	}
@@ -8602,14 +8623,14 @@ func NewV1DeleteInviteExternalJitAccessRequest(server string, ref string, invite
 
 	var pathParam0 string
 
-	pathParam0, err = runtime.StyleParamWithLocation("simple", false, "ref", runtime.ParamLocationPath, ref)
+	pathParam0, err = runtime.StyleParamWithOptions("simple", false, "ref", ref, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationPath, Type: "string", Format: ""})
 	if err != nil {
 		return nil, err
 	}
 
 	var pathParam1 string
 
-	pathParam1, err = runtime.StyleParamWithLocation("simple", false, "invite_id", runtime.ParamLocationPath, inviteId)
+	pathParam1, err = runtime.StyleParamWithOptions("simple", false, "invite_id", inviteId, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationPath, Type: "string", Format: "uuid"})
 	if err != nil {
 		return nil, err
 	}
@@ -8629,7 +8650,7 @@ func NewV1DeleteInviteExternalJitAccessRequest(server string, ref string, invite
 		return nil, err
 	}
 
-	req, err := http.NewRequest("DELETE", queryURL.String(), nil)
+	req, err := http.NewRequest(http.MethodDelete, queryURL.String(), nil)
 	if err != nil {
 		return nil, err
 	}
@@ -8643,7 +8664,7 @@ func NewV1ListJitAccessRequest(server string, ref string) (*http.Request, error)
 
 	var pathParam0 string
 
-	pathParam0, err = runtime.StyleParamWithLocation("simple", false, "ref", runtime.ParamLocationPath, ref)
+	pathParam0, err = runtime.StyleParamWithOptions("simple", false, "ref", ref, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationPath, Type: "string", Format: ""})
 	if err != nil {
 		return nil, err
 	}
@@ -8663,7 +8684,7 @@ func NewV1ListJitAccessRequest(server string, ref string) (*http.Request, error)
 		return nil, err
 	}
 
-	req, err := http.NewRequest("GET", queryURL.String(), nil)
+	req, err := http.NewRequest(http.MethodGet, queryURL.String(), nil)
 	if err != nil {
 		return nil, err
 	}
@@ -8677,14 +8698,14 @@ func NewV1DeleteJitAccessRequest(server string, ref string, userId openapi_types
 
 	var pathParam0 string
 
-	pathParam0, err = runtime.StyleParamWithLocation("simple", false, "ref", runtime.ParamLocationPath, ref)
+	pathParam0, err = runtime.StyleParamWithOptions("simple", false, "ref", ref, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationPath, Type: "string", Format: ""})
 	if err != nil {
 		return nil, err
 	}
 
 	var pathParam1 string
 
-	pathParam1, err = runtime.StyleParamWithLocation("simple", false, "user_id", runtime.ParamLocationPath, userId)
+	pathParam1, err = runtime.StyleParamWithOptions("simple", false, "user_id", userId, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationPath, Type: "string", Format: "uuid"})
 	if err != nil {
 		return nil, err
 	}
@@ -8704,7 +8725,7 @@ func NewV1DeleteJitAccessRequest(server string, ref string, userId openapi_types
 		return nil, err
 	}
 
-	req, err := http.NewRequest("DELETE", queryURL.String(), nil)
+	req, err := http.NewRequest(http.MethodDelete, queryURL.String(), nil)
 	if err != nil {
 		return nil, err
 	}
@@ -8718,7 +8739,7 @@ func NewV1RollbackMigrationsRequest(server string, ref string, params *V1Rollbac
 
 	var pathParam0 string
 
-	pathParam0, err = runtime.StyleParamWithLocation("simple", false, "ref", runtime.ParamLocationPath, ref)
+	pathParam0, err = runtime.StyleParamWithOptions("simple", false, "ref", ref, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationPath, Type: "string", Format: ""})
 	if err != nil {
 		return nil, err
 	}
@@ -8739,24 +8760,29 @@ func NewV1RollbackMigrationsRequest(server string, ref string, params *V1Rollbac
 	}
 
 	if params != nil {
+		// queryValues collects non-styled parameters (passthrough, JSON)
+		// that are safe to round-trip through url.Values.Encode().
 		queryValues := queryURL.Query()
+		// rawQueryFragments collects pre-encoded query fragments from
+		// styled parameters, preserving literal commas as delimiters
+		// per the OpenAPI spec (e.g. "color=blue,black,brown").
+		var rawQueryFragments []string
 
-		if queryFrag, err := runtime.StyleParamWithLocation("form", true, "gte", runtime.ParamLocationQuery, params.Gte); err != nil {
-			return nil, err
-		} else if parsed, err := url.ParseQuery(queryFrag); err != nil {
+		if queryFrag, err := runtime.StyleParamWithOptions("form", true, "gte", params.Gte, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationQuery, Type: "string", Format: ""}); err != nil {
 			return nil, err
 		} else {
-			for k, v := range parsed {
-				for _, v2 := range v {
-					queryValues.Add(k, v2)
-				}
+			for _, qp := range strings.Split(queryFrag, "&") {
+				rawQueryFragments = append(rawQueryFragments, qp)
 			}
 		}
 
-		queryURL.RawQuery = queryValues.Encode()
+		if encoded := queryValues.Encode(); encoded != "" {
+			rawQueryFragments = append(rawQueryFragments, encoded)
+		}
+		queryURL.RawQuery = strings.Join(rawQueryFragments, "&")
 	}
 
-	req, err := http.NewRequest("DELETE", queryURL.String(), nil)
+	req, err := http.NewRequest(http.MethodDelete, queryURL.String(), nil)
 	if err != nil {
 		return nil, err
 	}
@@ -8770,7 +8796,7 @@ func NewV1ListMigrationHistoryRequest(server string, ref string) (*http.Request,
 
 	var pathParam0 string
 
-	pathParam0, err = runtime.StyleParamWithLocation("simple", false, "ref", runtime.ParamLocationPath, ref)
+	pathParam0, err = runtime.StyleParamWithOptions("simple", false, "ref", ref, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationPath, Type: "string", Format: ""})
 	if err != nil {
 		return nil, err
 	}
@@ -8790,7 +8816,7 @@ func NewV1ListMigrationHistoryRequest(server string, ref string) (*http.Request,
 		return nil, err
 	}
 
-	req, err := http.NewRequest("GET", queryURL.String(), nil)
+	req, err := http.NewRequest(http.MethodGet, queryURL.String(), nil)
 	if err != nil {
 		return nil, err
 	}
@@ -8815,7 +8841,7 @@ func NewV1ApplyAMigrationRequestWithBody(server string, ref string, params *V1Ap
 
 	var pathParam0 string
 
-	pathParam0, err = runtime.StyleParamWithLocation("simple", false, "ref", runtime.ParamLocationPath, ref)
+	pathParam0, err = runtime.StyleParamWithOptions("simple", false, "ref", ref, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationPath, Type: "string", Format: ""})
 	if err != nil {
 		return nil, err
 	}
@@ -8835,7 +8861,7 @@ func NewV1ApplyAMigrationRequestWithBody(server string, ref string, params *V1Ap
 		return nil, err
 	}
 
-	req, err := http.NewRequest("POST", queryURL.String(), body)
+	req, err := http.NewRequest(http.MethodPost, queryURL.String(), body)
 	if err != nil {
 		return nil, err
 	}
@@ -8847,7 +8873,7 @@ func NewV1ApplyAMigrationRequestWithBody(server string, ref string, params *V1Ap
 		if params.IdempotencyKey != nil {
 			var headerParam0 string
 
-			headerParam0, err = runtime.StyleParamWithLocation("simple", false, "Idempotency-Key", runtime.ParamLocationHeader, *params.IdempotencyKey)
+			headerParam0, err = runtime.StyleParamWithOptions("simple", false, "Idempotency-Key", *params.IdempotencyKey, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationHeader, Type: "string", Format: ""})
 			if err != nil {
 				return nil, err
 			}
@@ -8877,7 +8903,7 @@ func NewV1UpsertAMigrationRequestWithBody(server string, ref string, params *V1U
 
 	var pathParam0 string
 
-	pathParam0, err = runtime.StyleParamWithLocation("simple", false, "ref", runtime.ParamLocationPath, ref)
+	pathParam0, err = runtime.StyleParamWithOptions("simple", false, "ref", ref, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationPath, Type: "string", Format: ""})
 	if err != nil {
 		return nil, err
 	}
@@ -8897,7 +8923,7 @@ func NewV1UpsertAMigrationRequestWithBody(server string, ref string, params *V1U
 		return nil, err
 	}
 
-	req, err := http.NewRequest("PUT", queryURL.String(), body)
+	req, err := http.NewRequest(http.MethodPut, queryURL.String(), body)
 	if err != nil {
 		return nil, err
 	}
@@ -8909,7 +8935,7 @@ func NewV1UpsertAMigrationRequestWithBody(server string, ref string, params *V1U
 		if params.IdempotencyKey != nil {
 			var headerParam0 string
 
-			headerParam0, err = runtime.StyleParamWithLocation("simple", false, "Idempotency-Key", runtime.ParamLocationHeader, *params.IdempotencyKey)
+			headerParam0, err = runtime.StyleParamWithOptions("simple", false, "Idempotency-Key", *params.IdempotencyKey, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationHeader, Type: "string", Format: ""})
 			if err != nil {
 				return nil, err
 			}
@@ -8928,14 +8954,14 @@ func NewV1GetAMigrationRequest(server string, ref string, version string) (*http
 
 	var pathParam0 string
 
-	pathParam0, err = runtime.StyleParamWithLocation("simple", false, "ref", runtime.ParamLocationPath, ref)
+	pathParam0, err = runtime.StyleParamWithOptions("simple", false, "ref", ref, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationPath, Type: "string", Format: ""})
 	if err != nil {
 		return nil, err
 	}
 
 	var pathParam1 string
 
-	pathParam1, err = runtime.StyleParamWithLocation("simple", false, "version", runtime.ParamLocationPath, version)
+	pathParam1, err = runtime.StyleParamWithOptions("simple", false, "version", version, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationPath, Type: "string", Format: ""})
 	if err != nil {
 		return nil, err
 	}
@@ -8955,7 +8981,7 @@ func NewV1GetAMigrationRequest(server string, ref string, version string) (*http
 		return nil, err
 	}
 
-	req, err := http.NewRequest("GET", queryURL.String(), nil)
+	req, err := http.NewRequest(http.MethodGet, queryURL.String(), nil)
 	if err != nil {
 		return nil, err
 	}
@@ -8980,14 +9006,14 @@ func NewV1PatchAMigrationRequestWithBody(server string, ref string, version stri
 
 	var pathParam0 string
 
-	pathParam0, err = runtime.StyleParamWithLocation("simple", false, "ref", runtime.ParamLocationPath, ref)
+	pathParam0, err = runtime.StyleParamWithOptions("simple", false, "ref", ref, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationPath, Type: "string", Format: ""})
 	if err != nil {
 		return nil, err
 	}
 
 	var pathParam1 string
 
-	pathParam1, err = runtime.StyleParamWithLocation("simple", false, "version", runtime.ParamLocationPath, version)
+	pathParam1, err = runtime.StyleParamWithOptions("simple", false, "version", version, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationPath, Type: "string", Format: ""})
 	if err != nil {
 		return nil, err
 	}
@@ -9007,7 +9033,7 @@ func NewV1PatchAMigrationRequestWithBody(server string, ref string, version stri
 		return nil, err
 	}
 
-	req, err := http.NewRequest("PATCH", queryURL.String(), body)
+	req, err := http.NewRequest(http.MethodPatch, queryURL.String(), body)
 	if err != nil {
 		return nil, err
 	}
@@ -9023,7 +9049,7 @@ func NewV1GetDatabaseOpenapiRequest(server string, ref string, params *V1GetData
 
 	var pathParam0 string
 
-	pathParam0, err = runtime.StyleParamWithLocation("simple", false, "ref", runtime.ParamLocationPath, ref)
+	pathParam0, err = runtime.StyleParamWithOptions("simple", false, "ref", ref, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationPath, Type: "string", Format: ""})
 	if err != nil {
 		return nil, err
 	}
@@ -9044,28 +9070,33 @@ func NewV1GetDatabaseOpenapiRequest(server string, ref string, params *V1GetData
 	}
 
 	if params != nil {
+		// queryValues collects non-styled parameters (passthrough, JSON)
+		// that are safe to round-trip through url.Values.Encode().
 		queryValues := queryURL.Query()
+		// rawQueryFragments collects pre-encoded query fragments from
+		// styled parameters, preserving literal commas as delimiters
+		// per the OpenAPI spec (e.g. "color=blue,black,brown").
+		var rawQueryFragments []string
 
 		if params.Schema != nil {
 
-			if queryFrag, err := runtime.StyleParamWithLocation("form", true, "schema", runtime.ParamLocationQuery, *params.Schema); err != nil {
-				return nil, err
-			} else if parsed, err := url.ParseQuery(queryFrag); err != nil {
+			if queryFrag, err := runtime.StyleParamWithOptions("form", true, "schema", *params.Schema, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationQuery, Type: "string", Format: ""}); err != nil {
 				return nil, err
 			} else {
-				for k, v := range parsed {
-					for _, v2 := range v {
-						queryValues.Add(k, v2)
-					}
+				for _, qp := range strings.Split(queryFrag, "&") {
+					rawQueryFragments = append(rawQueryFragments, qp)
 				}
 			}
 
 		}
 
-		queryURL.RawQuery = queryValues.Encode()
+		if encoded := queryValues.Encode(); encoded != "" {
+			rawQueryFragments = append(rawQueryFragments, encoded)
+		}
+		queryURL.RawQuery = strings.Join(rawQueryFragments, "&")
 	}
 
-	req, err := http.NewRequest("GET", queryURL.String(), nil)
+	req, err := http.NewRequest(http.MethodGet, queryURL.String(), nil)
 	if err != nil {
 		return nil, err
 	}
@@ -9090,7 +9121,7 @@ func NewV1UpdateDatabasePasswordRequestWithBody(server string, ref string, conte
 
 	var pathParam0 string
 
-	pathParam0, err = runtime.StyleParamWithLocation("simple", false, "ref", runtime.ParamLocationPath, ref)
+	pathParam0, err = runtime.StyleParamWithOptions("simple", false, "ref", ref, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationPath, Type: "string", Format: ""})
 	if err != nil {
 		return nil, err
 	}
@@ -9110,7 +9141,7 @@ func NewV1UpdateDatabasePasswordRequestWithBody(server string, ref string, conte
 		return nil, err
 	}
 
-	req, err := http.NewRequest("PATCH", queryURL.String(), body)
+	req, err := http.NewRequest(http.MethodPatch, queryURL.String(), body)
 	if err != nil {
 		return nil, err
 	}
@@ -9137,7 +9168,7 @@ func NewV1RunAQueryRequestWithBody(server string, ref string, contentType string
 
 	var pathParam0 string
 
-	pathParam0, err = runtime.StyleParamWithLocation("simple", false, "ref", runtime.ParamLocationPath, ref)
+	pathParam0, err = runtime.StyleParamWithOptions("simple", false, "ref", ref, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationPath, Type: "string", Format: ""})
 	if err != nil {
 		return nil, err
 	}
@@ -9157,7 +9188,7 @@ func NewV1RunAQueryRequestWithBody(server string, ref string, contentType string
 		return nil, err
 	}
 
-	req, err := http.NewRequest("POST", queryURL.String(), body)
+	req, err := http.NewRequest(http.MethodPost, queryURL.String(), body)
 	if err != nil {
 		return nil, err
 	}
@@ -9184,7 +9215,7 @@ func NewV1ReadOnlyQueryRequestWithBody(server string, ref string, contentType st
 
 	var pathParam0 string
 
-	pathParam0, err = runtime.StyleParamWithLocation("simple", false, "ref", runtime.ParamLocationPath, ref)
+	pathParam0, err = runtime.StyleParamWithOptions("simple", false, "ref", ref, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationPath, Type: "string", Format: ""})
 	if err != nil {
 		return nil, err
 	}
@@ -9204,7 +9235,7 @@ func NewV1ReadOnlyQueryRequestWithBody(server string, ref string, contentType st
 		return nil, err
 	}
 
-	req, err := http.NewRequest("POST", queryURL.String(), body)
+	req, err := http.NewRequest(http.MethodPost, queryURL.String(), body)
 	if err != nil {
 		return nil, err
 	}
@@ -9220,7 +9251,7 @@ func NewV1EnableDatabaseWebhookRequest(server string, ref string) (*http.Request
 
 	var pathParam0 string
 
-	pathParam0, err = runtime.StyleParamWithLocation("simple", false, "ref", runtime.ParamLocationPath, ref)
+	pathParam0, err = runtime.StyleParamWithOptions("simple", false, "ref", ref, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationPath, Type: "string", Format: ""})
 	if err != nil {
 		return nil, err
 	}
@@ -9240,7 +9271,7 @@ func NewV1EnableDatabaseWebhookRequest(server string, ref string) (*http.Request
 		return nil, err
 	}
 
-	req, err := http.NewRequest("POST", queryURL.String(), nil)
+	req, err := http.NewRequest(http.MethodPost, queryURL.String(), nil)
 	if err != nil {
 		return nil, err
 	}
@@ -9254,7 +9285,7 @@ func NewV1ListAllFunctionsRequest(server string, ref string) (*http.Request, err
 
 	var pathParam0 string
 
-	pathParam0, err = runtime.StyleParamWithLocation("simple", false, "ref", runtime.ParamLocationPath, ref)
+	pathParam0, err = runtime.StyleParamWithOptions("simple", false, "ref", ref, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationPath, Type: "string", Format: ""})
 	if err != nil {
 		return nil, err
 	}
@@ -9274,7 +9305,7 @@ func NewV1ListAllFunctionsRequest(server string, ref string) (*http.Request, err
 		return nil, err
 	}
 
-	req, err := http.NewRequest("GET", queryURL.String(), nil)
+	req, err := http.NewRequest(http.MethodGet, queryURL.String(), nil)
 	if err != nil {
 		return nil, err
 	}
@@ -9299,7 +9330,7 @@ func NewV1CreateAFunctionRequestWithBody(server string, ref string, params *V1Cr
 
 	var pathParam0 string
 
-	pathParam0, err = runtime.StyleParamWithLocation("simple", false, "ref", runtime.ParamLocationPath, ref)
+	pathParam0, err = runtime.StyleParamWithOptions("simple", false, "ref", ref, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationPath, Type: "string", Format: ""})
 	if err != nil {
 		return nil, err
 	}
@@ -9320,19 +9351,21 @@ func NewV1CreateAFunctionRequestWithBody(server string, ref string, params *V1Cr
 	}
 
 	if params != nil {
+		// queryValues collects non-styled parameters (passthrough, JSON)
+		// that are safe to round-trip through url.Values.Encode().
 		queryValues := queryURL.Query()
+		// rawQueryFragments collects pre-encoded query fragments from
+		// styled parameters, preserving literal commas as delimiters
+		// per the OpenAPI spec (e.g. "color=blue,black,brown").
+		var rawQueryFragments []string
 
 		if params.Slug != nil {
 
-			if queryFrag, err := runtime.StyleParamWithLocation("form", true, "slug", runtime.ParamLocationQuery, *params.Slug); err != nil {
-				return nil, err
-			} else if parsed, err := url.ParseQuery(queryFrag); err != nil {
+			if queryFrag, err := runtime.StyleParamWithOptions("form", true, "slug", *params.Slug, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationQuery, Type: "string", Format: ""}); err != nil {
 				return nil, err
 			} else {
-				for k, v := range parsed {
-					for _, v2 := range v {
-						queryValues.Add(k, v2)
-					}
+				for _, qp := range strings.Split(queryFrag, "&") {
+					rawQueryFragments = append(rawQueryFragments, qp)
 				}
 			}
 
@@ -9340,15 +9373,11 @@ func NewV1CreateAFunctionRequestWithBody(server string, ref string, params *V1Cr
 
 		if params.Name != nil {
 
-			if queryFrag, err := runtime.StyleParamWithLocation("form", true, "name", runtime.ParamLocationQuery, *params.Name); err != nil {
-				return nil, err
-			} else if parsed, err := url.ParseQuery(queryFrag); err != nil {
+			if queryFrag, err := runtime.StyleParamWithOptions("form", true, "name", *params.Name, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationQuery, Type: "string", Format: ""}); err != nil {
 				return nil, err
 			} else {
-				for k, v := range parsed {
-					for _, v2 := range v {
-						queryValues.Add(k, v2)
-					}
+				for _, qp := range strings.Split(queryFrag, "&") {
+					rawQueryFragments = append(rawQueryFragments, qp)
 				}
 			}
 
@@ -9356,15 +9385,11 @@ func NewV1CreateAFunctionRequestWithBody(server string, ref string, params *V1Cr
 
 		if params.VerifyJwt != nil {
 
-			if queryFrag, err := runtime.StyleParamWithLocation("form", true, "verify_jwt", runtime.ParamLocationQuery, *params.VerifyJwt); err != nil {
-				return nil, err
-			} else if parsed, err := url.ParseQuery(queryFrag); err != nil {
+			if queryFrag, err := runtime.StyleParamWithOptions("form", true, "verify_jwt", *params.VerifyJwt, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationQuery, Type: "boolean", Format: ""}); err != nil {
 				return nil, err
 			} else {
-				for k, v := range parsed {
-					for _, v2 := range v {
-						queryValues.Add(k, v2)
-					}
+				for _, qp := range strings.Split(queryFrag, "&") {
+					rawQueryFragments = append(rawQueryFragments, qp)
 				}
 			}
 
@@ -9372,15 +9397,11 @@ func NewV1CreateAFunctionRequestWithBody(server string, ref string, params *V1Cr
 
 		if params.ImportMap != nil {
 
-			if queryFrag, err := runtime.StyleParamWithLocation("form", true, "import_map", runtime.ParamLocationQuery, *params.ImportMap); err != nil {
-				return nil, err
-			} else if parsed, err := url.ParseQuery(queryFrag); err != nil {
+			if queryFrag, err := runtime.StyleParamWithOptions("form", true, "import_map", *params.ImportMap, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationQuery, Type: "boolean", Format: ""}); err != nil {
 				return nil, err
 			} else {
-				for k, v := range parsed {
-					for _, v2 := range v {
-						queryValues.Add(k, v2)
-					}
+				for _, qp := range strings.Split(queryFrag, "&") {
+					rawQueryFragments = append(rawQueryFragments, qp)
 				}
 			}
 
@@ -9388,15 +9409,11 @@ func NewV1CreateAFunctionRequestWithBody(server string, ref string, params *V1Cr
 
 		if params.EntrypointPath != nil {
 
-			if queryFrag, err := runtime.StyleParamWithLocation("form", true, "entrypoint_path", runtime.ParamLocationQuery, *params.EntrypointPath); err != nil {
-				return nil, err
-			} else if parsed, err := url.ParseQuery(queryFrag); err != nil {
+			if queryFrag, err := runtime.StyleParamWithOptions("form", true, "entrypoint_path", *params.EntrypointPath, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationQuery, Type: "string", Format: ""}); err != nil {
 				return nil, err
 			} else {
-				for k, v := range parsed {
-					for _, v2 := range v {
-						queryValues.Add(k, v2)
-					}
+				for _, qp := range strings.Split(queryFrag, "&") {
+					rawQueryFragments = append(rawQueryFragments, qp)
 				}
 			}
 
@@ -9404,15 +9421,11 @@ func NewV1CreateAFunctionRequestWithBody(server string, ref string, params *V1Cr
 
 		if params.ImportMapPath != nil {
 
-			if queryFrag, err := runtime.StyleParamWithLocation("form", true, "import_map_path", runtime.ParamLocationQuery, *params.ImportMapPath); err != nil {
-				return nil, err
-			} else if parsed, err := url.ParseQuery(queryFrag); err != nil {
+			if queryFrag, err := runtime.StyleParamWithOptions("form", true, "import_map_path", *params.ImportMapPath, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationQuery, Type: "string", Format: ""}); err != nil {
 				return nil, err
 			} else {
-				for k, v := range parsed {
-					for _, v2 := range v {
-						queryValues.Add(k, v2)
-					}
+				for _, qp := range strings.Split(queryFrag, "&") {
+					rawQueryFragments = append(rawQueryFragments, qp)
 				}
 			}
 
@@ -9420,24 +9433,23 @@ func NewV1CreateAFunctionRequestWithBody(server string, ref string, params *V1Cr
 
 		if params.EzbrSha256 != nil {
 
-			if queryFrag, err := runtime.StyleParamWithLocation("form", true, "ezbr_sha256", runtime.ParamLocationQuery, *params.EzbrSha256); err != nil {
-				return nil, err
-			} else if parsed, err := url.ParseQuery(queryFrag); err != nil {
+			if queryFrag, err := runtime.StyleParamWithOptions("form", true, "ezbr_sha256", *params.EzbrSha256, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationQuery, Type: "string", Format: ""}); err != nil {
 				return nil, err
 			} else {
-				for k, v := range parsed {
-					for _, v2 := range v {
-						queryValues.Add(k, v2)
-					}
+				for _, qp := range strings.Split(queryFrag, "&") {
+					rawQueryFragments = append(rawQueryFragments, qp)
 				}
 			}
 
 		}
 
-		queryURL.RawQuery = queryValues.Encode()
+		if encoded := queryValues.Encode(); encoded != "" {
+			rawQueryFragments = append(rawQueryFragments, encoded)
+		}
+		queryURL.RawQuery = strings.Join(rawQueryFragments, "&")
 	}
 
-	req, err := http.NewRequest("POST", queryURL.String(), body)
+	req, err := http.NewRequest(http.MethodPost, queryURL.String(), body)
 	if err != nil {
 		return nil, err
 	}
@@ -9464,7 +9476,7 @@ func NewV1BulkUpdateFunctionsRequestWithBody(server string, ref string, contentT
 
 	var pathParam0 string
 
-	pathParam0, err = runtime.StyleParamWithLocation("simple", false, "ref", runtime.ParamLocationPath, ref)
+	pathParam0, err = runtime.StyleParamWithOptions("simple", false, "ref", ref, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationPath, Type: "string", Format: ""})
 	if err != nil {
 		return nil, err
 	}
@@ -9484,7 +9496,7 @@ func NewV1BulkUpdateFunctionsRequestWithBody(server string, ref string, contentT
 		return nil, err
 	}
 
-	req, err := http.NewRequest("PUT", queryURL.String(), body)
+	req, err := http.NewRequest(http.MethodPut, queryURL.String(), body)
 	if err != nil {
 		return nil, err
 	}
@@ -9500,7 +9512,7 @@ func NewV1DeployAFunctionRequestWithBody(server string, ref string, params *V1De
 
 	var pathParam0 string
 
-	pathParam0, err = runtime.StyleParamWithLocation("simple", false, "ref", runtime.ParamLocationPath, ref)
+	pathParam0, err = runtime.StyleParamWithOptions("simple", false, "ref", ref, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationPath, Type: "string", Format: ""})
 	if err != nil {
 		return nil, err
 	}
@@ -9521,19 +9533,21 @@ func NewV1DeployAFunctionRequestWithBody(server string, ref string, params *V1De
 	}
 
 	if params != nil {
+		// queryValues collects non-styled parameters (passthrough, JSON)
+		// that are safe to round-trip through url.Values.Encode().
 		queryValues := queryURL.Query()
+		// rawQueryFragments collects pre-encoded query fragments from
+		// styled parameters, preserving literal commas as delimiters
+		// per the OpenAPI spec (e.g. "color=blue,black,brown").
+		var rawQueryFragments []string
 
 		if params.Slug != nil {
 
-			if queryFrag, err := runtime.StyleParamWithLocation("form", true, "slug", runtime.ParamLocationQuery, *params.Slug); err != nil {
-				return nil, err
-			} else if parsed, err := url.ParseQuery(queryFrag); err != nil {
+			if queryFrag, err := runtime.StyleParamWithOptions("form", true, "slug", *params.Slug, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationQuery, Type: "string", Format: ""}); err != nil {
 				return nil, err
 			} else {
-				for k, v := range parsed {
-					for _, v2 := range v {
-						queryValues.Add(k, v2)
-					}
+				for _, qp := range strings.Split(queryFrag, "&") {
+					rawQueryFragments = append(rawQueryFragments, qp)
 				}
 			}
 
@@ -9541,24 +9555,23 @@ func NewV1DeployAFunctionRequestWithBody(server string, ref string, params *V1De
 
 		if params.BundleOnly != nil {
 
-			if queryFrag, err := runtime.StyleParamWithLocation("form", true, "bundleOnly", runtime.ParamLocationQuery, *params.BundleOnly); err != nil {
-				return nil, err
-			} else if parsed, err := url.ParseQuery(queryFrag); err != nil {
+			if queryFrag, err := runtime.StyleParamWithOptions("form", true, "bundleOnly", *params.BundleOnly, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationQuery, Type: "boolean", Format: ""}); err != nil {
 				return nil, err
 			} else {
-				for k, v := range parsed {
-					for _, v2 := range v {
-						queryValues.Add(k, v2)
-					}
+				for _, qp := range strings.Split(queryFrag, "&") {
+					rawQueryFragments = append(rawQueryFragments, qp)
 				}
 			}
 
 		}
 
-		queryURL.RawQuery = queryValues.Encode()
+		if encoded := queryValues.Encode(); encoded != "" {
+			rawQueryFragments = append(rawQueryFragments, encoded)
+		}
+		queryURL.RawQuery = strings.Join(rawQueryFragments, "&")
 	}
 
-	req, err := http.NewRequest("POST", queryURL.String(), body)
+	req, err := http.NewRequest(http.MethodPost, queryURL.String(), body)
 	if err != nil {
 		return nil, err
 	}
@@ -9574,14 +9587,14 @@ func NewV1DeleteAFunctionRequest(server string, ref string, functionSlug string)
 
 	var pathParam0 string
 
-	pathParam0, err = runtime.StyleParamWithLocation("simple", false, "ref", runtime.ParamLocationPath, ref)
+	pathParam0, err = runtime.StyleParamWithOptions("simple", false, "ref", ref, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationPath, Type: "string", Format: ""})
 	if err != nil {
 		return nil, err
 	}
 
 	var pathParam1 string
 
-	pathParam1, err = runtime.StyleParamWithLocation("simple", false, "function_slug", runtime.ParamLocationPath, functionSlug)
+	pathParam1, err = runtime.StyleParamWithOptions("simple", false, "function_slug", functionSlug, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationPath, Type: "string", Format: ""})
 	if err != nil {
 		return nil, err
 	}
@@ -9601,7 +9614,7 @@ func NewV1DeleteAFunctionRequest(server string, ref string, functionSlug string)
 		return nil, err
 	}
 
-	req, err := http.NewRequest("DELETE", queryURL.String(), nil)
+	req, err := http.NewRequest(http.MethodDelete, queryURL.String(), nil)
 	if err != nil {
 		return nil, err
 	}
@@ -9615,14 +9628,14 @@ func NewV1GetAFunctionRequest(server string, ref string, functionSlug string) (*
 
 	var pathParam0 string
 
-	pathParam0, err = runtime.StyleParamWithLocation("simple", false, "ref", runtime.ParamLocationPath, ref)
+	pathParam0, err = runtime.StyleParamWithOptions("simple", false, "ref", ref, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationPath, Type: "string", Format: ""})
 	if err != nil {
 		return nil, err
 	}
 
 	var pathParam1 string
 
-	pathParam1, err = runtime.StyleParamWithLocation("simple", false, "function_slug", runtime.ParamLocationPath, functionSlug)
+	pathParam1, err = runtime.StyleParamWithOptions("simple", false, "function_slug", functionSlug, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationPath, Type: "string", Format: ""})
 	if err != nil {
 		return nil, err
 	}
@@ -9642,7 +9655,7 @@ func NewV1GetAFunctionRequest(server string, ref string, functionSlug string) (*
 		return nil, err
 	}
 
-	req, err := http.NewRequest("GET", queryURL.String(), nil)
+	req, err := http.NewRequest(http.MethodGet, queryURL.String(), nil)
 	if err != nil {
 		return nil, err
 	}
@@ -9667,14 +9680,14 @@ func NewV1UpdateAFunctionRequestWithBody(server string, ref string, functionSlug
 
 	var pathParam0 string
 
-	pathParam0, err = runtime.StyleParamWithLocation("simple", false, "ref", runtime.ParamLocationPath, ref)
+	pathParam0, err = runtime.StyleParamWithOptions("simple", false, "ref", ref, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationPath, Type: "string", Format: ""})
 	if err != nil {
 		return nil, err
 	}
 
 	var pathParam1 string
 
-	pathParam1, err = runtime.StyleParamWithLocation("simple", false, "function_slug", runtime.ParamLocationPath, functionSlug)
+	pathParam1, err = runtime.StyleParamWithOptions("simple", false, "function_slug", functionSlug, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationPath, Type: "string", Format: ""})
 	if err != nil {
 		return nil, err
 	}
@@ -9695,19 +9708,21 @@ func NewV1UpdateAFunctionRequestWithBody(server string, ref string, functionSlug
 	}
 
 	if params != nil {
+		// queryValues collects non-styled parameters (passthrough, JSON)
+		// that are safe to round-trip through url.Values.Encode().
 		queryValues := queryURL.Query()
+		// rawQueryFragments collects pre-encoded query fragments from
+		// styled parameters, preserving literal commas as delimiters
+		// per the OpenAPI spec (e.g. "color=blue,black,brown").
+		var rawQueryFragments []string
 
 		if params.Slug != nil {
 
-			if queryFrag, err := runtime.StyleParamWithLocation("form", true, "slug", runtime.ParamLocationQuery, *params.Slug); err != nil {
-				return nil, err
-			} else if parsed, err := url.ParseQuery(queryFrag); err != nil {
+			if queryFrag, err := runtime.StyleParamWithOptions("form", true, "slug", *params.Slug, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationQuery, Type: "string", Format: ""}); err != nil {
 				return nil, err
 			} else {
-				for k, v := range parsed {
-					for _, v2 := range v {
-						queryValues.Add(k, v2)
-					}
+				for _, qp := range strings.Split(queryFrag, "&") {
+					rawQueryFragments = append(rawQueryFragments, qp)
 				}
 			}
 
@@ -9715,15 +9730,11 @@ func NewV1UpdateAFunctionRequestWithBody(server string, ref string, functionSlug
 
 		if params.Name != nil {
 
-			if queryFrag, err := runtime.StyleParamWithLocation("form", true, "name", runtime.ParamLocationQuery, *params.Name); err != nil {
-				return nil, err
-			} else if parsed, err := url.ParseQuery(queryFrag); err != nil {
+			if queryFrag, err := runtime.StyleParamWithOptions("form", true, "name", *params.Name, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationQuery, Type: "string", Format: ""}); err != nil {
 				return nil, err
 			} else {
-				for k, v := range parsed {
-					for _, v2 := range v {
-						queryValues.Add(k, v2)
-					}
+				for _, qp := range strings.Split(queryFrag, "&") {
+					rawQueryFragments = append(rawQueryFragments, qp)
 				}
 			}
 
@@ -9731,15 +9742,11 @@ func NewV1UpdateAFunctionRequestWithBody(server string, ref string, functionSlug
 
 		if params.VerifyJwt != nil {
 
-			if queryFrag, err := runtime.StyleParamWithLocation("form", true, "verify_jwt", runtime.ParamLocationQuery, *params.VerifyJwt); err != nil {
-				return nil, err
-			} else if parsed, err := url.ParseQuery(queryFrag); err != nil {
+			if queryFrag, err := runtime.StyleParamWithOptions("form", true, "verify_jwt", *params.VerifyJwt, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationQuery, Type: "boolean", Format: ""}); err != nil {
 				return nil, err
 			} else {
-				for k, v := range parsed {
-					for _, v2 := range v {
-						queryValues.Add(k, v2)
-					}
+				for _, qp := range strings.Split(queryFrag, "&") {
+					rawQueryFragments = append(rawQueryFragments, qp)
 				}
 			}
 
@@ -9747,15 +9754,11 @@ func NewV1UpdateAFunctionRequestWithBody(server string, ref string, functionSlug
 
 		if params.ImportMap != nil {
 
-			if queryFrag, err := runtime.StyleParamWithLocation("form", true, "import_map", runtime.ParamLocationQuery, *params.ImportMap); err != nil {
-				return nil, err
-			} else if parsed, err := url.ParseQuery(queryFrag); err != nil {
+			if queryFrag, err := runtime.StyleParamWithOptions("form", true, "import_map", *params.ImportMap, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationQuery, Type: "boolean", Format: ""}); err != nil {
 				return nil, err
 			} else {
-				for k, v := range parsed {
-					for _, v2 := range v {
-						queryValues.Add(k, v2)
-					}
+				for _, qp := range strings.Split(queryFrag, "&") {
+					rawQueryFragments = append(rawQueryFragments, qp)
 				}
 			}
 
@@ -9763,15 +9766,11 @@ func NewV1UpdateAFunctionRequestWithBody(server string, ref string, functionSlug
 
 		if params.EntrypointPath != nil {
 
-			if queryFrag, err := runtime.StyleParamWithLocation("form", true, "entrypoint_path", runtime.ParamLocationQuery, *params.EntrypointPath); err != nil {
-				return nil, err
-			} else if parsed, err := url.ParseQuery(queryFrag); err != nil {
+			if queryFrag, err := runtime.StyleParamWithOptions("form", true, "entrypoint_path", *params.EntrypointPath, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationQuery, Type: "string", Format: ""}); err != nil {
 				return nil, err
 			} else {
-				for k, v := range parsed {
-					for _, v2 := range v {
-						queryValues.Add(k, v2)
-					}
+				for _, qp := range strings.Split(queryFrag, "&") {
+					rawQueryFragments = append(rawQueryFragments, qp)
 				}
 			}
 
@@ -9779,15 +9778,11 @@ func NewV1UpdateAFunctionRequestWithBody(server string, ref string, functionSlug
 
 		if params.ImportMapPath != nil {
 
-			if queryFrag, err := runtime.StyleParamWithLocation("form", true, "import_map_path", runtime.ParamLocationQuery, *params.ImportMapPath); err != nil {
-				return nil, err
-			} else if parsed, err := url.ParseQuery(queryFrag); err != nil {
+			if queryFrag, err := runtime.StyleParamWithOptions("form", true, "import_map_path", *params.ImportMapPath, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationQuery, Type: "string", Format: ""}); err != nil {
 				return nil, err
 			} else {
-				for k, v := range parsed {
-					for _, v2 := range v {
-						queryValues.Add(k, v2)
-					}
+				for _, qp := range strings.Split(queryFrag, "&") {
+					rawQueryFragments = append(rawQueryFragments, qp)
 				}
 			}
 
@@ -9795,24 +9790,23 @@ func NewV1UpdateAFunctionRequestWithBody(server string, ref string, functionSlug
 
 		if params.EzbrSha256 != nil {
 
-			if queryFrag, err := runtime.StyleParamWithLocation("form", true, "ezbr_sha256", runtime.ParamLocationQuery, *params.EzbrSha256); err != nil {
-				return nil, err
-			} else if parsed, err := url.ParseQuery(queryFrag); err != nil {
+			if queryFrag, err := runtime.StyleParamWithOptions("form", true, "ezbr_sha256", *params.EzbrSha256, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationQuery, Type: "string", Format: ""}); err != nil {
 				return nil, err
 			} else {
-				for k, v := range parsed {
-					for _, v2 := range v {
-						queryValues.Add(k, v2)
-					}
+				for _, qp := range strings.Split(queryFrag, "&") {
+					rawQueryFragments = append(rawQueryFragments, qp)
 				}
 			}
 
 		}
 
-		queryURL.RawQuery = queryValues.Encode()
+		if encoded := queryValues.Encode(); encoded != "" {
+			rawQueryFragments = append(rawQueryFragments, encoded)
+		}
+		queryURL.RawQuery = strings.Join(rawQueryFragments, "&")
 	}
 
-	req, err := http.NewRequest("PATCH", queryURL.String(), body)
+	req, err := http.NewRequest(http.MethodPatch, queryURL.String(), body)
 	if err != nil {
 		return nil, err
 	}
@@ -9828,14 +9822,14 @@ func NewV1GetAFunctionBodyRequest(server string, ref string, functionSlug string
 
 	var pathParam0 string
 
-	pathParam0, err = runtime.StyleParamWithLocation("simple", false, "ref", runtime.ParamLocationPath, ref)
+	pathParam0, err = runtime.StyleParamWithOptions("simple", false, "ref", ref, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationPath, Type: "string", Format: ""})
 	if err != nil {
 		return nil, err
 	}
 
 	var pathParam1 string
 
-	pathParam1, err = runtime.StyleParamWithLocation("simple", false, "function_slug", runtime.ParamLocationPath, functionSlug)
+	pathParam1, err = runtime.StyleParamWithOptions("simple", false, "function_slug", functionSlug, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationPath, Type: "string", Format: ""})
 	if err != nil {
 		return nil, err
 	}
@@ -9855,7 +9849,7 @@ func NewV1GetAFunctionBodyRequest(server string, ref string, functionSlug string
 		return nil, err
 	}
 
-	req, err := http.NewRequest("GET", queryURL.String(), nil)
+	req, err := http.NewRequest(http.MethodGet, queryURL.String(), nil)
 	if err != nil {
 		return nil, err
 	}
@@ -9869,7 +9863,7 @@ func NewV1GetServicesHealthRequest(server string, ref string, params *V1GetServi
 
 	var pathParam0 string
 
-	pathParam0, err = runtime.StyleParamWithLocation("simple", false, "ref", runtime.ParamLocationPath, ref)
+	pathParam0, err = runtime.StyleParamWithOptions("simple", false, "ref", ref, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationPath, Type: "string", Format: ""})
 	if err != nil {
 		return nil, err
 	}
@@ -9890,40 +9884,45 @@ func NewV1GetServicesHealthRequest(server string, ref string, params *V1GetServi
 	}
 
 	if params != nil {
+		// queryValues collects non-styled parameters (passthrough, JSON)
+		// that are safe to round-trip through url.Values.Encode().
 		queryValues := queryURL.Query()
+		// rawQueryFragments collects pre-encoded query fragments from
+		// styled parameters, preserving literal commas as delimiters
+		// per the OpenAPI spec (e.g. "color=blue,black,brown").
+		var rawQueryFragments []string
 
-		if queryFrag, err := runtime.StyleParamWithLocation("form", true, "services", runtime.ParamLocationQuery, params.Services); err != nil {
-			return nil, err
-		} else if parsed, err := url.ParseQuery(queryFrag); err != nil {
-			return nil, err
-		} else {
-			for k, v := range parsed {
-				for _, v2 := range v {
-					queryValues.Add(k, v2)
+		if params.Services != nil {
+
+			if queryFrag, err := runtime.StyleParamWithOptions("form", true, "services", params.Services, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationQuery, Type: "array", Format: ""}); err != nil {
+				return nil, err
+			} else {
+				for _, qp := range strings.Split(queryFrag, "&") {
+					rawQueryFragments = append(rawQueryFragments, qp)
 				}
 			}
+
 		}
 
 		if params.TimeoutMs != nil {
 
-			if queryFrag, err := runtime.StyleParamWithLocation("form", true, "timeout_ms", runtime.ParamLocationQuery, *params.TimeoutMs); err != nil {
-				return nil, err
-			} else if parsed, err := url.ParseQuery(queryFrag); err != nil {
+			if queryFrag, err := runtime.StyleParamWithOptions("form", true, "timeout_ms", *params.TimeoutMs, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationQuery, Type: "integer", Format: ""}); err != nil {
 				return nil, err
 			} else {
-				for k, v := range parsed {
-					for _, v2 := range v {
-						queryValues.Add(k, v2)
-					}
+				for _, qp := range strings.Split(queryFrag, "&") {
+					rawQueryFragments = append(rawQueryFragments, qp)
 				}
 			}
 
 		}
 
-		queryURL.RawQuery = queryValues.Encode()
+		if encoded := queryValues.Encode(); encoded != "" {
+			rawQueryFragments = append(rawQueryFragments, encoded)
+		}
+		queryURL.RawQuery = strings.Join(rawQueryFragments, "&")
 	}
 
-	req, err := http.NewRequest("GET", queryURL.String(), nil)
+	req, err := http.NewRequest(http.MethodGet, queryURL.String(), nil)
 	if err != nil {
 		return nil, err
 	}
@@ -9937,7 +9936,7 @@ func NewV1GetJitAccessConfigRequest(server string, ref string) (*http.Request, e
 
 	var pathParam0 string
 
-	pathParam0, err = runtime.StyleParamWithLocation("simple", false, "ref", runtime.ParamLocationPath, ref)
+	pathParam0, err = runtime.StyleParamWithOptions("simple", false, "ref", ref, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationPath, Type: "string", Format: ""})
 	if err != nil {
 		return nil, err
 	}
@@ -9957,7 +9956,7 @@ func NewV1GetJitAccessConfigRequest(server string, ref string) (*http.Request, e
 		return nil, err
 	}
 
-	req, err := http.NewRequest("GET", queryURL.String(), nil)
+	req, err := http.NewRequest(http.MethodGet, queryURL.String(), nil)
 	if err != nil {
 		return nil, err
 	}
@@ -9982,7 +9981,7 @@ func NewV1UpdateJitAccessConfigRequestWithBody(server string, ref string, conten
 
 	var pathParam0 string
 
-	pathParam0, err = runtime.StyleParamWithLocation("simple", false, "ref", runtime.ParamLocationPath, ref)
+	pathParam0, err = runtime.StyleParamWithOptions("simple", false, "ref", ref, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationPath, Type: "string", Format: ""})
 	if err != nil {
 		return nil, err
 	}
@@ -10002,7 +10001,7 @@ func NewV1UpdateJitAccessConfigRequestWithBody(server string, ref string, conten
 		return nil, err
 	}
 
-	req, err := http.NewRequest("PUT", queryURL.String(), body)
+	req, err := http.NewRequest(http.MethodPut, queryURL.String(), body)
 	if err != nil {
 		return nil, err
 	}
@@ -10029,7 +10028,7 @@ func NewV1DeleteNetworkBansRequestWithBody(server string, ref string, contentTyp
 
 	var pathParam0 string
 
-	pathParam0, err = runtime.StyleParamWithLocation("simple", false, "ref", runtime.ParamLocationPath, ref)
+	pathParam0, err = runtime.StyleParamWithOptions("simple", false, "ref", ref, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationPath, Type: "string", Format: ""})
 	if err != nil {
 		return nil, err
 	}
@@ -10049,7 +10048,7 @@ func NewV1DeleteNetworkBansRequestWithBody(server string, ref string, contentTyp
 		return nil, err
 	}
 
-	req, err := http.NewRequest("DELETE", queryURL.String(), body)
+	req, err := http.NewRequest(http.MethodDelete, queryURL.String(), body)
 	if err != nil {
 		return nil, err
 	}
@@ -10065,7 +10064,7 @@ func NewV1ListAllNetworkBansRequest(server string, ref string) (*http.Request, e
 
 	var pathParam0 string
 
-	pathParam0, err = runtime.StyleParamWithLocation("simple", false, "ref", runtime.ParamLocationPath, ref)
+	pathParam0, err = runtime.StyleParamWithOptions("simple", false, "ref", ref, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationPath, Type: "string", Format: ""})
 	if err != nil {
 		return nil, err
 	}
@@ -10085,7 +10084,7 @@ func NewV1ListAllNetworkBansRequest(server string, ref string) (*http.Request, e
 		return nil, err
 	}
 
-	req, err := http.NewRequest("POST", queryURL.String(), nil)
+	req, err := http.NewRequest(http.MethodPost, queryURL.String(), nil)
 	if err != nil {
 		return nil, err
 	}
@@ -10099,7 +10098,7 @@ func NewV1ListAllNetworkBansEnrichedRequest(server string, ref string) (*http.Re
 
 	var pathParam0 string
 
-	pathParam0, err = runtime.StyleParamWithLocation("simple", false, "ref", runtime.ParamLocationPath, ref)
+	pathParam0, err = runtime.StyleParamWithOptions("simple", false, "ref", ref, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationPath, Type: "string", Format: ""})
 	if err != nil {
 		return nil, err
 	}
@@ -10119,7 +10118,7 @@ func NewV1ListAllNetworkBansEnrichedRequest(server string, ref string) (*http.Re
 		return nil, err
 	}
 
-	req, err := http.NewRequest("POST", queryURL.String(), nil)
+	req, err := http.NewRequest(http.MethodPost, queryURL.String(), nil)
 	if err != nil {
 		return nil, err
 	}
@@ -10133,7 +10132,7 @@ func NewV1GetNetworkRestrictionsRequest(server string, ref string) (*http.Reques
 
 	var pathParam0 string
 
-	pathParam0, err = runtime.StyleParamWithLocation("simple", false, "ref", runtime.ParamLocationPath, ref)
+	pathParam0, err = runtime.StyleParamWithOptions("simple", false, "ref", ref, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationPath, Type: "string", Format: ""})
 	if err != nil {
 		return nil, err
 	}
@@ -10153,7 +10152,7 @@ func NewV1GetNetworkRestrictionsRequest(server string, ref string) (*http.Reques
 		return nil, err
 	}
 
-	req, err := http.NewRequest("GET", queryURL.String(), nil)
+	req, err := http.NewRequest(http.MethodGet, queryURL.String(), nil)
 	if err != nil {
 		return nil, err
 	}
@@ -10178,7 +10177,7 @@ func NewV1PatchNetworkRestrictionsRequestWithBody(server string, ref string, con
 
 	var pathParam0 string
 
-	pathParam0, err = runtime.StyleParamWithLocation("simple", false, "ref", runtime.ParamLocationPath, ref)
+	pathParam0, err = runtime.StyleParamWithOptions("simple", false, "ref", ref, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationPath, Type: "string", Format: ""})
 	if err != nil {
 		return nil, err
 	}
@@ -10198,7 +10197,7 @@ func NewV1PatchNetworkRestrictionsRequestWithBody(server string, ref string, con
 		return nil, err
 	}
 
-	req, err := http.NewRequest("PATCH", queryURL.String(), body)
+	req, err := http.NewRequest(http.MethodPatch, queryURL.String(), body)
 	if err != nil {
 		return nil, err
 	}
@@ -10225,7 +10224,7 @@ func NewV1UpdateNetworkRestrictionsRequestWithBody(server string, ref string, co
 
 	var pathParam0 string
 
-	pathParam0, err = runtime.StyleParamWithLocation("simple", false, "ref", runtime.ParamLocationPath, ref)
+	pathParam0, err = runtime.StyleParamWithOptions("simple", false, "ref", ref, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationPath, Type: "string", Format: ""})
 	if err != nil {
 		return nil, err
 	}
@@ -10245,7 +10244,7 @@ func NewV1UpdateNetworkRestrictionsRequestWithBody(server string, ref string, co
 		return nil, err
 	}
 
-	req, err := http.NewRequest("POST", queryURL.String(), body)
+	req, err := http.NewRequest(http.MethodPost, queryURL.String(), body)
 	if err != nil {
 		return nil, err
 	}
@@ -10261,7 +10260,7 @@ func NewV1PauseAProjectRequest(server string, ref string) (*http.Request, error)
 
 	var pathParam0 string
 
-	pathParam0, err = runtime.StyleParamWithLocation("simple", false, "ref", runtime.ParamLocationPath, ref)
+	pathParam0, err = runtime.StyleParamWithOptions("simple", false, "ref", ref, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationPath, Type: "string", Format: ""})
 	if err != nil {
 		return nil, err
 	}
@@ -10281,7 +10280,7 @@ func NewV1PauseAProjectRequest(server string, ref string) (*http.Request, error)
 		return nil, err
 	}
 
-	req, err := http.NewRequest("POST", queryURL.String(), nil)
+	req, err := http.NewRequest(http.MethodPost, queryURL.String(), nil)
 	if err != nil {
 		return nil, err
 	}
@@ -10295,7 +10294,7 @@ func NewV1GetPgsodiumConfigRequest(server string, ref string) (*http.Request, er
 
 	var pathParam0 string
 
-	pathParam0, err = runtime.StyleParamWithLocation("simple", false, "ref", runtime.ParamLocationPath, ref)
+	pathParam0, err = runtime.StyleParamWithOptions("simple", false, "ref", ref, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationPath, Type: "string", Format: ""})
 	if err != nil {
 		return nil, err
 	}
@@ -10315,7 +10314,7 @@ func NewV1GetPgsodiumConfigRequest(server string, ref string) (*http.Request, er
 		return nil, err
 	}
 
-	req, err := http.NewRequest("GET", queryURL.String(), nil)
+	req, err := http.NewRequest(http.MethodGet, queryURL.String(), nil)
 	if err != nil {
 		return nil, err
 	}
@@ -10340,7 +10339,7 @@ func NewV1UpdatePgsodiumConfigRequestWithBody(server string, ref string, content
 
 	var pathParam0 string
 
-	pathParam0, err = runtime.StyleParamWithLocation("simple", false, "ref", runtime.ParamLocationPath, ref)
+	pathParam0, err = runtime.StyleParamWithOptions("simple", false, "ref", ref, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationPath, Type: "string", Format: ""})
 	if err != nil {
 		return nil, err
 	}
@@ -10360,7 +10359,7 @@ func NewV1UpdatePgsodiumConfigRequestWithBody(server string, ref string, content
 		return nil, err
 	}
 
-	req, err := http.NewRequest("PUT", queryURL.String(), body)
+	req, err := http.NewRequest(http.MethodPut, queryURL.String(), body)
 	if err != nil {
 		return nil, err
 	}
@@ -10376,7 +10375,7 @@ func NewV1GetPostgrestServiceConfigRequest(server string, ref string) (*http.Req
 
 	var pathParam0 string
 
-	pathParam0, err = runtime.StyleParamWithLocation("simple", false, "ref", runtime.ParamLocationPath, ref)
+	pathParam0, err = runtime.StyleParamWithOptions("simple", false, "ref", ref, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationPath, Type: "string", Format: ""})
 	if err != nil {
 		return nil, err
 	}
@@ -10396,7 +10395,7 @@ func NewV1GetPostgrestServiceConfigRequest(server string, ref string) (*http.Req
 		return nil, err
 	}
 
-	req, err := http.NewRequest("GET", queryURL.String(), nil)
+	req, err := http.NewRequest(http.MethodGet, queryURL.String(), nil)
 	if err != nil {
 		return nil, err
 	}
@@ -10421,7 +10420,7 @@ func NewV1UpdatePostgrestServiceConfigRequestWithBody(server string, ref string,
 
 	var pathParam0 string
 
-	pathParam0, err = runtime.StyleParamWithLocation("simple", false, "ref", runtime.ParamLocationPath, ref)
+	pathParam0, err = runtime.StyleParamWithOptions("simple", false, "ref", ref, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationPath, Type: "string", Format: ""})
 	if err != nil {
 		return nil, err
 	}
@@ -10441,7 +10440,7 @@ func NewV1UpdatePostgrestServiceConfigRequestWithBody(server string, ref string,
 		return nil, err
 	}
 
-	req, err := http.NewRequest("PATCH", queryURL.String(), body)
+	req, err := http.NewRequest(http.MethodPatch, queryURL.String(), body)
 	if err != nil {
 		return nil, err
 	}
@@ -10468,7 +10467,7 @@ func NewV1RemoveAReadReplicaRequestWithBody(server string, ref string, contentTy
 
 	var pathParam0 string
 
-	pathParam0, err = runtime.StyleParamWithLocation("simple", false, "ref", runtime.ParamLocationPath, ref)
+	pathParam0, err = runtime.StyleParamWithOptions("simple", false, "ref", ref, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationPath, Type: "string", Format: ""})
 	if err != nil {
 		return nil, err
 	}
@@ -10488,7 +10487,7 @@ func NewV1RemoveAReadReplicaRequestWithBody(server string, ref string, contentTy
 		return nil, err
 	}
 
-	req, err := http.NewRequest("POST", queryURL.String(), body)
+	req, err := http.NewRequest(http.MethodPost, queryURL.String(), body)
 	if err != nil {
 		return nil, err
 	}
@@ -10515,7 +10514,7 @@ func NewV1SetupAReadReplicaRequestWithBody(server string, ref string, contentTyp
 
 	var pathParam0 string
 
-	pathParam0, err = runtime.StyleParamWithLocation("simple", false, "ref", runtime.ParamLocationPath, ref)
+	pathParam0, err = runtime.StyleParamWithOptions("simple", false, "ref", ref, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationPath, Type: "string", Format: ""})
 	if err != nil {
 		return nil, err
 	}
@@ -10535,7 +10534,7 @@ func NewV1SetupAReadReplicaRequestWithBody(server string, ref string, contentTyp
 		return nil, err
 	}
 
-	req, err := http.NewRequest("POST", queryURL.String(), body)
+	req, err := http.NewRequest(http.MethodPost, queryURL.String(), body)
 	if err != nil {
 		return nil, err
 	}
@@ -10551,7 +10550,7 @@ func NewV1GetReadonlyModeStatusRequest(server string, ref string) (*http.Request
 
 	var pathParam0 string
 
-	pathParam0, err = runtime.StyleParamWithLocation("simple", false, "ref", runtime.ParamLocationPath, ref)
+	pathParam0, err = runtime.StyleParamWithOptions("simple", false, "ref", ref, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationPath, Type: "string", Format: ""})
 	if err != nil {
 		return nil, err
 	}
@@ -10571,7 +10570,7 @@ func NewV1GetReadonlyModeStatusRequest(server string, ref string) (*http.Request
 		return nil, err
 	}
 
-	req, err := http.NewRequest("GET", queryURL.String(), nil)
+	req, err := http.NewRequest(http.MethodGet, queryURL.String(), nil)
 	if err != nil {
 		return nil, err
 	}
@@ -10585,7 +10584,7 @@ func NewV1DisableReadonlyModeTemporarilyRequest(server string, ref string) (*htt
 
 	var pathParam0 string
 
-	pathParam0, err = runtime.StyleParamWithLocation("simple", false, "ref", runtime.ParamLocationPath, ref)
+	pathParam0, err = runtime.StyleParamWithOptions("simple", false, "ref", ref, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationPath, Type: "string", Format: ""})
 	if err != nil {
 		return nil, err
 	}
@@ -10605,7 +10604,7 @@ func NewV1DisableReadonlyModeTemporarilyRequest(server string, ref string) (*htt
 		return nil, err
 	}
 
-	req, err := http.NewRequest("POST", queryURL.String(), nil)
+	req, err := http.NewRequest(http.MethodPost, queryURL.String(), nil)
 	if err != nil {
 		return nil, err
 	}
@@ -10619,7 +10618,7 @@ func NewV1RestartAProjectRequest(server string, ref string) (*http.Request, erro
 
 	var pathParam0 string
 
-	pathParam0, err = runtime.StyleParamWithLocation("simple", false, "ref", runtime.ParamLocationPath, ref)
+	pathParam0, err = runtime.StyleParamWithOptions("simple", false, "ref", ref, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationPath, Type: "string", Format: ""})
 	if err != nil {
 		return nil, err
 	}
@@ -10639,7 +10638,7 @@ func NewV1RestartAProjectRequest(server string, ref string) (*http.Request, erro
 		return nil, err
 	}
 
-	req, err := http.NewRequest("POST", queryURL.String(), nil)
+	req, err := http.NewRequest(http.MethodPost, queryURL.String(), nil)
 	if err != nil {
 		return nil, err
 	}
@@ -10653,7 +10652,7 @@ func NewV1ListAvailableRestoreVersionsRequest(server string, ref string) (*http.
 
 	var pathParam0 string
 
-	pathParam0, err = runtime.StyleParamWithLocation("simple", false, "ref", runtime.ParamLocationPath, ref)
+	pathParam0, err = runtime.StyleParamWithOptions("simple", false, "ref", ref, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationPath, Type: "string", Format: ""})
 	if err != nil {
 		return nil, err
 	}
@@ -10673,7 +10672,7 @@ func NewV1ListAvailableRestoreVersionsRequest(server string, ref string) (*http.
 		return nil, err
 	}
 
-	req, err := http.NewRequest("GET", queryURL.String(), nil)
+	req, err := http.NewRequest(http.MethodGet, queryURL.String(), nil)
 	if err != nil {
 		return nil, err
 	}
@@ -10687,7 +10686,7 @@ func NewV1RestoreAProjectRequest(server string, ref string) (*http.Request, erro
 
 	var pathParam0 string
 
-	pathParam0, err = runtime.StyleParamWithLocation("simple", false, "ref", runtime.ParamLocationPath, ref)
+	pathParam0, err = runtime.StyleParamWithOptions("simple", false, "ref", ref, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationPath, Type: "string", Format: ""})
 	if err != nil {
 		return nil, err
 	}
@@ -10707,7 +10706,7 @@ func NewV1RestoreAProjectRequest(server string, ref string) (*http.Request, erro
 		return nil, err
 	}
 
-	req, err := http.NewRequest("POST", queryURL.String(), nil)
+	req, err := http.NewRequest(http.MethodPost, queryURL.String(), nil)
 	if err != nil {
 		return nil, err
 	}
@@ -10721,7 +10720,7 @@ func NewV1CancelAProjectRestorationRequest(server string, ref string) (*http.Req
 
 	var pathParam0 string
 
-	pathParam0, err = runtime.StyleParamWithLocation("simple", false, "ref", runtime.ParamLocationPath, ref)
+	pathParam0, err = runtime.StyleParamWithOptions("simple", false, "ref", ref, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationPath, Type: "string", Format: ""})
 	if err != nil {
 		return nil, err
 	}
@@ -10741,7 +10740,7 @@ func NewV1CancelAProjectRestorationRequest(server string, ref string) (*http.Req
 		return nil, err
 	}
 
-	req, err := http.NewRequest("POST", queryURL.String(), nil)
+	req, err := http.NewRequest(http.MethodPost, queryURL.String(), nil)
 	if err != nil {
 		return nil, err
 	}
@@ -10766,7 +10765,7 @@ func NewV1BulkDeleteSecretsRequestWithBody(server string, ref string, contentTyp
 
 	var pathParam0 string
 
-	pathParam0, err = runtime.StyleParamWithLocation("simple", false, "ref", runtime.ParamLocationPath, ref)
+	pathParam0, err = runtime.StyleParamWithOptions("simple", false, "ref", ref, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationPath, Type: "string", Format: ""})
 	if err != nil {
 		return nil, err
 	}
@@ -10786,7 +10785,7 @@ func NewV1BulkDeleteSecretsRequestWithBody(server string, ref string, contentTyp
 		return nil, err
 	}
 
-	req, err := http.NewRequest("DELETE", queryURL.String(), body)
+	req, err := http.NewRequest(http.MethodDelete, queryURL.String(), body)
 	if err != nil {
 		return nil, err
 	}
@@ -10802,7 +10801,7 @@ func NewV1ListAllSecretsRequest(server string, ref string) (*http.Request, error
 
 	var pathParam0 string
 
-	pathParam0, err = runtime.StyleParamWithLocation("simple", false, "ref", runtime.ParamLocationPath, ref)
+	pathParam0, err = runtime.StyleParamWithOptions("simple", false, "ref", ref, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationPath, Type: "string", Format: ""})
 	if err != nil {
 		return nil, err
 	}
@@ -10822,7 +10821,7 @@ func NewV1ListAllSecretsRequest(server string, ref string) (*http.Request, error
 		return nil, err
 	}
 
-	req, err := http.NewRequest("GET", queryURL.String(), nil)
+	req, err := http.NewRequest(http.MethodGet, queryURL.String(), nil)
 	if err != nil {
 		return nil, err
 	}
@@ -10847,7 +10846,7 @@ func NewV1BulkCreateSecretsRequestWithBody(server string, ref string, contentTyp
 
 	var pathParam0 string
 
-	pathParam0, err = runtime.StyleParamWithLocation("simple", false, "ref", runtime.ParamLocationPath, ref)
+	pathParam0, err = runtime.StyleParamWithOptions("simple", false, "ref", ref, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationPath, Type: "string", Format: ""})
 	if err != nil {
 		return nil, err
 	}
@@ -10867,7 +10866,7 @@ func NewV1BulkCreateSecretsRequestWithBody(server string, ref string, contentTyp
 		return nil, err
 	}
 
-	req, err := http.NewRequest("POST", queryURL.String(), body)
+	req, err := http.NewRequest(http.MethodPost, queryURL.String(), body)
 	if err != nil {
 		return nil, err
 	}
@@ -10883,7 +10882,7 @@ func NewV1GetSslEnforcementConfigRequest(server string, ref string) (*http.Reque
 
 	var pathParam0 string
 
-	pathParam0, err = runtime.StyleParamWithLocation("simple", false, "ref", runtime.ParamLocationPath, ref)
+	pathParam0, err = runtime.StyleParamWithOptions("simple", false, "ref", ref, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationPath, Type: "string", Format: ""})
 	if err != nil {
 		return nil, err
 	}
@@ -10903,7 +10902,7 @@ func NewV1GetSslEnforcementConfigRequest(server string, ref string) (*http.Reque
 		return nil, err
 	}
 
-	req, err := http.NewRequest("GET", queryURL.String(), nil)
+	req, err := http.NewRequest(http.MethodGet, queryURL.String(), nil)
 	if err != nil {
 		return nil, err
 	}
@@ -10928,7 +10927,7 @@ func NewV1UpdateSslEnforcementConfigRequestWithBody(server string, ref string, c
 
 	var pathParam0 string
 
-	pathParam0, err = runtime.StyleParamWithLocation("simple", false, "ref", runtime.ParamLocationPath, ref)
+	pathParam0, err = runtime.StyleParamWithOptions("simple", false, "ref", ref, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationPath, Type: "string", Format: ""})
 	if err != nil {
 		return nil, err
 	}
@@ -10948,7 +10947,7 @@ func NewV1UpdateSslEnforcementConfigRequestWithBody(server string, ref string, c
 		return nil, err
 	}
 
-	req, err := http.NewRequest("PUT", queryURL.String(), body)
+	req, err := http.NewRequest(http.MethodPut, queryURL.String(), body)
 	if err != nil {
 		return nil, err
 	}
@@ -10964,7 +10963,7 @@ func NewV1ListAllBucketsRequest(server string, ref string) (*http.Request, error
 
 	var pathParam0 string
 
-	pathParam0, err = runtime.StyleParamWithLocation("simple", false, "ref", runtime.ParamLocationPath, ref)
+	pathParam0, err = runtime.StyleParamWithOptions("simple", false, "ref", ref, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationPath, Type: "string", Format: ""})
 	if err != nil {
 		return nil, err
 	}
@@ -10984,7 +10983,7 @@ func NewV1ListAllBucketsRequest(server string, ref string) (*http.Request, error
 		return nil, err
 	}
 
-	req, err := http.NewRequest("GET", queryURL.String(), nil)
+	req, err := http.NewRequest(http.MethodGet, queryURL.String(), nil)
 	if err != nil {
 		return nil, err
 	}
@@ -10998,7 +10997,7 @@ func NewV1GenerateTypescriptTypesRequest(server string, ref string, params *V1Ge
 
 	var pathParam0 string
 
-	pathParam0, err = runtime.StyleParamWithLocation("simple", false, "ref", runtime.ParamLocationPath, ref)
+	pathParam0, err = runtime.StyleParamWithOptions("simple", false, "ref", ref, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationPath, Type: "string", Format: ""})
 	if err != nil {
 		return nil, err
 	}
@@ -11019,28 +11018,33 @@ func NewV1GenerateTypescriptTypesRequest(server string, ref string, params *V1Ge
 	}
 
 	if params != nil {
+		// queryValues collects non-styled parameters (passthrough, JSON)
+		// that are safe to round-trip through url.Values.Encode().
 		queryValues := queryURL.Query()
+		// rawQueryFragments collects pre-encoded query fragments from
+		// styled parameters, preserving literal commas as delimiters
+		// per the OpenAPI spec (e.g. "color=blue,black,brown").
+		var rawQueryFragments []string
 
 		if params.IncludedSchemas != nil {
 
-			if queryFrag, err := runtime.StyleParamWithLocation("form", true, "included_schemas", runtime.ParamLocationQuery, *params.IncludedSchemas); err != nil {
-				return nil, err
-			} else if parsed, err := url.ParseQuery(queryFrag); err != nil {
+			if queryFrag, err := runtime.StyleParamWithOptions("form", true, "included_schemas", *params.IncludedSchemas, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationQuery, Type: "string", Format: ""}); err != nil {
 				return nil, err
 			} else {
-				for k, v := range parsed {
-					for _, v2 := range v {
-						queryValues.Add(k, v2)
-					}
+				for _, qp := range strings.Split(queryFrag, "&") {
+					rawQueryFragments = append(rawQueryFragments, qp)
 				}
 			}
 
 		}
 
-		queryURL.RawQuery = queryValues.Encode()
+		if encoded := queryValues.Encode(); encoded != "" {
+			rawQueryFragments = append(rawQueryFragments, encoded)
+		}
+		queryURL.RawQuery = strings.Join(rawQueryFragments, "&")
 	}
 
-	req, err := http.NewRequest("GET", queryURL.String(), nil)
+	req, err := http.NewRequest(http.MethodGet, queryURL.String(), nil)
 	if err != nil {
 		return nil, err
 	}
@@ -11065,7 +11069,7 @@ func NewV1UpgradePostgresVersionRequestWithBody(server string, ref string, conte
 
 	var pathParam0 string
 
-	pathParam0, err = runtime.StyleParamWithLocation("simple", false, "ref", runtime.ParamLocationPath, ref)
+	pathParam0, err = runtime.StyleParamWithOptions("simple", false, "ref", ref, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationPath, Type: "string", Format: ""})
 	if err != nil {
 		return nil, err
 	}
@@ -11085,7 +11089,7 @@ func NewV1UpgradePostgresVersionRequestWithBody(server string, ref string, conte
 		return nil, err
 	}
 
-	req, err := http.NewRequest("POST", queryURL.String(), body)
+	req, err := http.NewRequest(http.MethodPost, queryURL.String(), body)
 	if err != nil {
 		return nil, err
 	}
@@ -11101,7 +11105,7 @@ func NewV1GetPostgresUpgradeEligibilityRequest(server string, ref string) (*http
 
 	var pathParam0 string
 
-	pathParam0, err = runtime.StyleParamWithLocation("simple", false, "ref", runtime.ParamLocationPath, ref)
+	pathParam0, err = runtime.StyleParamWithOptions("simple", false, "ref", ref, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationPath, Type: "string", Format: ""})
 	if err != nil {
 		return nil, err
 	}
@@ -11121,7 +11125,7 @@ func NewV1GetPostgresUpgradeEligibilityRequest(server string, ref string) (*http
 		return nil, err
 	}
 
-	req, err := http.NewRequest("GET", queryURL.String(), nil)
+	req, err := http.NewRequest(http.MethodGet, queryURL.String(), nil)
 	if err != nil {
 		return nil, err
 	}
@@ -11135,7 +11139,7 @@ func NewV1GetPostgresUpgradeStatusRequest(server string, ref string, params *V1G
 
 	var pathParam0 string
 
-	pathParam0, err = runtime.StyleParamWithLocation("simple", false, "ref", runtime.ParamLocationPath, ref)
+	pathParam0, err = runtime.StyleParamWithOptions("simple", false, "ref", ref, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationPath, Type: "string", Format: ""})
 	if err != nil {
 		return nil, err
 	}
@@ -11156,28 +11160,33 @@ func NewV1GetPostgresUpgradeStatusRequest(server string, ref string, params *V1G
 	}
 
 	if params != nil {
+		// queryValues collects non-styled parameters (passthrough, JSON)
+		// that are safe to round-trip through url.Values.Encode().
 		queryValues := queryURL.Query()
+		// rawQueryFragments collects pre-encoded query fragments from
+		// styled parameters, preserving literal commas as delimiters
+		// per the OpenAPI spec (e.g. "color=blue,black,brown").
+		var rawQueryFragments []string
 
 		if params.TrackingId != nil {
 
-			if queryFrag, err := runtime.StyleParamWithLocation("form", true, "tracking_id", runtime.ParamLocationQuery, *params.TrackingId); err != nil {
-				return nil, err
-			} else if parsed, err := url.ParseQuery(queryFrag); err != nil {
+			if queryFrag, err := runtime.StyleParamWithOptions("form", true, "tracking_id", *params.TrackingId, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationQuery, Type: "string", Format: ""}); err != nil {
 				return nil, err
 			} else {
-				for k, v := range parsed {
-					for _, v2 := range v {
-						queryValues.Add(k, v2)
-					}
+				for _, qp := range strings.Split(queryFrag, "&") {
+					rawQueryFragments = append(rawQueryFragments, qp)
 				}
 			}
 
 		}
 
-		queryURL.RawQuery = queryValues.Encode()
+		if encoded := queryValues.Encode(); encoded != "" {
+			rawQueryFragments = append(rawQueryFragments, encoded)
+		}
+		queryURL.RawQuery = strings.Join(rawQueryFragments, "&")
 	}
 
-	req, err := http.NewRequest("GET", queryURL.String(), nil)
+	req, err := http.NewRequest(http.MethodGet, queryURL.String(), nil)
 	if err != nil {
 		return nil, err
 	}
@@ -11191,7 +11200,7 @@ func NewV1DeactivateVanitySubdomainConfigRequest(server string, ref string) (*ht
 
 	var pathParam0 string
 
-	pathParam0, err = runtime.StyleParamWithLocation("simple", false, "ref", runtime.ParamLocationPath, ref)
+	pathParam0, err = runtime.StyleParamWithOptions("simple", false, "ref", ref, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationPath, Type: "string", Format: ""})
 	if err != nil {
 		return nil, err
 	}
@@ -11211,7 +11220,7 @@ func NewV1DeactivateVanitySubdomainConfigRequest(server string, ref string) (*ht
 		return nil, err
 	}
 
-	req, err := http.NewRequest("DELETE", queryURL.String(), nil)
+	req, err := http.NewRequest(http.MethodDelete, queryURL.String(), nil)
 	if err != nil {
 		return nil, err
 	}
@@ -11225,7 +11234,7 @@ func NewV1GetVanitySubdomainConfigRequest(server string, ref string) (*http.Requ
 
 	var pathParam0 string
 
-	pathParam0, err = runtime.StyleParamWithLocation("simple", false, "ref", runtime.ParamLocationPath, ref)
+	pathParam0, err = runtime.StyleParamWithOptions("simple", false, "ref", ref, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationPath, Type: "string", Format: ""})
 	if err != nil {
 		return nil, err
 	}
@@ -11245,7 +11254,7 @@ func NewV1GetVanitySubdomainConfigRequest(server string, ref string) (*http.Requ
 		return nil, err
 	}
 
-	req, err := http.NewRequest("GET", queryURL.String(), nil)
+	req, err := http.NewRequest(http.MethodGet, queryURL.String(), nil)
 	if err != nil {
 		return nil, err
 	}
@@ -11270,7 +11279,7 @@ func NewV1ActivateVanitySubdomainConfigRequestWithBody(server string, ref string
 
 	var pathParam0 string
 
-	pathParam0, err = runtime.StyleParamWithLocation("simple", false, "ref", runtime.ParamLocationPath, ref)
+	pathParam0, err = runtime.StyleParamWithOptions("simple", false, "ref", ref, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationPath, Type: "string", Format: ""})
 	if err != nil {
 		return nil, err
 	}
@@ -11290,7 +11299,7 @@ func NewV1ActivateVanitySubdomainConfigRequestWithBody(server string, ref string
 		return nil, err
 	}
 
-	req, err := http.NewRequest("POST", queryURL.String(), body)
+	req, err := http.NewRequest(http.MethodPost, queryURL.String(), body)
 	if err != nil {
 		return nil, err
 	}
@@ -11317,7 +11326,7 @@ func NewV1CheckVanitySubdomainAvailabilityRequestWithBody(server string, ref str
 
 	var pathParam0 string
 
-	pathParam0, err = runtime.StyleParamWithLocation("simple", false, "ref", runtime.ParamLocationPath, ref)
+	pathParam0, err = runtime.StyleParamWithOptions("simple", false, "ref", ref, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationPath, Type: "string", Format: ""})
 	if err != nil {
 		return nil, err
 	}
@@ -11337,7 +11346,7 @@ func NewV1CheckVanitySubdomainAvailabilityRequestWithBody(server string, ref str
 		return nil, err
 	}
 
-	req, err := http.NewRequest("POST", queryURL.String(), body)
+	req, err := http.NewRequest(http.MethodPost, queryURL.String(), body)
 	if err != nil {
 		return nil, err
 	}
@@ -11367,19 +11376,21 @@ func NewV1ListAllSnippetsRequest(server string, params *V1ListAllSnippetsParams)
 	}
 
 	if params != nil {
+		// queryValues collects non-styled parameters (passthrough, JSON)
+		// that are safe to round-trip through url.Values.Encode().
 		queryValues := queryURL.Query()
+		// rawQueryFragments collects pre-encoded query fragments from
+		// styled parameters, preserving literal commas as delimiters
+		// per the OpenAPI spec (e.g. "color=blue,black,brown").
+		var rawQueryFragments []string
 
 		if params.ProjectRef != nil {
 
-			if queryFrag, err := runtime.StyleParamWithLocation("form", true, "project_ref", runtime.ParamLocationQuery, *params.ProjectRef); err != nil {
-				return nil, err
-			} else if parsed, err := url.ParseQuery(queryFrag); err != nil {
+			if queryFrag, err := runtime.StyleParamWithOptions("form", true, "project_ref", *params.ProjectRef, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationQuery, Type: "string", Format: ""}); err != nil {
 				return nil, err
 			} else {
-				for k, v := range parsed {
-					for _, v2 := range v {
-						queryValues.Add(k, v2)
-					}
+				for _, qp := range strings.Split(queryFrag, "&") {
+					rawQueryFragments = append(rawQueryFragments, qp)
 				}
 			}
 
@@ -11387,15 +11398,11 @@ func NewV1ListAllSnippetsRequest(server string, params *V1ListAllSnippetsParams)
 
 		if params.Cursor != nil {
 
-			if queryFrag, err := runtime.StyleParamWithLocation("form", true, "cursor", runtime.ParamLocationQuery, *params.Cursor); err != nil {
-				return nil, err
-			} else if parsed, err := url.ParseQuery(queryFrag); err != nil {
+			if queryFrag, err := runtime.StyleParamWithOptions("form", true, "cursor", *params.Cursor, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationQuery, Type: "string", Format: ""}); err != nil {
 				return nil, err
 			} else {
-				for k, v := range parsed {
-					for _, v2 := range v {
-						queryValues.Add(k, v2)
-					}
+				for _, qp := range strings.Split(queryFrag, "&") {
+					rawQueryFragments = append(rawQueryFragments, qp)
 				}
 			}
 
@@ -11403,15 +11410,11 @@ func NewV1ListAllSnippetsRequest(server string, params *V1ListAllSnippetsParams)
 
 		if params.Limit != nil {
 
-			if queryFrag, err := runtime.StyleParamWithLocation("form", true, "limit", runtime.ParamLocationQuery, *params.Limit); err != nil {
-				return nil, err
-			} else if parsed, err := url.ParseQuery(queryFrag); err != nil {
+			if queryFrag, err := runtime.StyleParamWithOptions("form", true, "limit", *params.Limit, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationQuery, Type: "string", Format: ""}); err != nil {
 				return nil, err
 			} else {
-				for k, v := range parsed {
-					for _, v2 := range v {
-						queryValues.Add(k, v2)
-					}
+				for _, qp := range strings.Split(queryFrag, "&") {
+					rawQueryFragments = append(rawQueryFragments, qp)
 				}
 			}
 
@@ -11419,15 +11422,11 @@ func NewV1ListAllSnippetsRequest(server string, params *V1ListAllSnippetsParams)
 
 		if params.SortBy != nil {
 
-			if queryFrag, err := runtime.StyleParamWithLocation("form", true, "sort_by", runtime.ParamLocationQuery, *params.SortBy); err != nil {
-				return nil, err
-			} else if parsed, err := url.ParseQuery(queryFrag); err != nil {
+			if queryFrag, err := runtime.StyleParamWithOptions("form", true, "sort_by", *params.SortBy, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationQuery, Type: "string", Format: ""}); err != nil {
 				return nil, err
 			} else {
-				for k, v := range parsed {
-					for _, v2 := range v {
-						queryValues.Add(k, v2)
-					}
+				for _, qp := range strings.Split(queryFrag, "&") {
+					rawQueryFragments = append(rawQueryFragments, qp)
 				}
 			}
 
@@ -11435,24 +11434,23 @@ func NewV1ListAllSnippetsRequest(server string, params *V1ListAllSnippetsParams)
 
 		if params.SortOrder != nil {
 
-			if queryFrag, err := runtime.StyleParamWithLocation("form", true, "sort_order", runtime.ParamLocationQuery, *params.SortOrder); err != nil {
-				return nil, err
-			} else if parsed, err := url.ParseQuery(queryFrag); err != nil {
+			if queryFrag, err := runtime.StyleParamWithOptions("form", true, "sort_order", *params.SortOrder, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationQuery, Type: "string", Format: ""}); err != nil {
 				return nil, err
 			} else {
-				for k, v := range parsed {
-					for _, v2 := range v {
-						queryValues.Add(k, v2)
-					}
+				for _, qp := range strings.Split(queryFrag, "&") {
+					rawQueryFragments = append(rawQueryFragments, qp)
 				}
 			}
 
 		}
 
-		queryURL.RawQuery = queryValues.Encode()
+		if encoded := queryValues.Encode(); encoded != "" {
+			rawQueryFragments = append(rawQueryFragments, encoded)
+		}
+		queryURL.RawQuery = strings.Join(rawQueryFragments, "&")
 	}
 
-	req, err := http.NewRequest("GET", queryURL.String(), nil)
+	req, err := http.NewRequest(http.MethodGet, queryURL.String(), nil)
 	if err != nil {
 		return nil, err
 	}
@@ -11466,7 +11464,7 @@ func NewV1GetASnippetRequest(server string, id openapi_types.UUID) (*http.Reques
 
 	var pathParam0 string
 
-	pathParam0, err = runtime.StyleParamWithLocation("simple", false, "id", runtime.ParamLocationPath, id)
+	pathParam0, err = runtime.StyleParamWithOptions("simple", false, "id", id, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationPath, Type: "string", Format: "uuid"})
 	if err != nil {
 		return nil, err
 	}
@@ -11486,7 +11484,7 @@ func NewV1GetASnippetRequest(server string, id openapi_types.UUID) (*http.Reques
 		return nil, err
 	}
 
-	req, err := http.NewRequest("GET", queryURL.String(), nil)
+	req, err := http.NewRequest(http.MethodGet, queryURL.String(), nil)
 	if err != nil {
 		return nil, err
 	}
@@ -11668,6 +11666,9 @@ type ClientWithResponsesInterface interface {
 	// V1GetProjectLogsAllWithResponse request
 	V1GetProjectLogsAllWithResponse(ctx context.Context, ref string, params *V1GetProjectLogsAllParams, reqEditors ...RequestEditorFn) (*V1GetProjectLogsAllResponse, error)
 
+	// V1ScrapeProjectMetricsWithResponse request
+	V1ScrapeProjectMetricsWithResponse(ctx context.Context, ref string, reqEditors ...RequestEditorFn) (*V1ScrapeProjectMetricsResponse, error)
+
 	// V1GetProjectUsageApiCountWithResponse request
 	V1GetProjectUsageApiCountWithResponse(ctx context.Context, ref string, params *V1GetProjectUsageApiCountParams, reqEditors ...RequestEditorFn) (*V1GetProjectUsageApiCountResponse, error)
 
@@ -12187,6 +12188,14 @@ func (r V1DeleteABranchResponse) StatusCode() int {
 	return 0
 }
 
+// ContentType is a convenience method to retrieve the Content-Type value from the HTTP response headers
+func (r V1DeleteABranchResponse) ContentType() string {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.Header.Get("Content-Type")
+	}
+	return ""
+}
+
 type V1GetABranchConfigResponse struct {
 	Body         []byte
 	HTTPResponse *http.Response
@@ -12209,6 +12218,14 @@ func (r V1GetABranchConfigResponse) StatusCode() int {
 	return 0
 }
 
+// ContentType is a convenience method to retrieve the Content-Type value from the HTTP response headers
+func (r V1GetABranchConfigResponse) ContentType() string {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.Header.Get("Content-Type")
+	}
+	return ""
+}
+
 type V1UpdateABranchConfigResponse struct {
 	Body         []byte
 	HTTPResponse *http.Response
@@ -12231,6 +12248,14 @@ func (r V1UpdateABranchConfigResponse) StatusCode() int {
 	return 0
 }
 
+// ContentType is a convenience method to retrieve the Content-Type value from the HTTP response headers
+func (r V1UpdateABranchConfigResponse) ContentType() string {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.Header.Get("Content-Type")
+	}
+	return ""
+}
+
 type V1DiffABranchResponse struct {
 	Body         []byte
 	HTTPResponse *http.Response
@@ -12252,6 +12277,14 @@ func (r V1DiffABranchResponse) StatusCode() int {
 	return 0
 }
 
+// ContentType is a convenience method to retrieve the Content-Type value from the HTTP response headers
+func (r V1DiffABranchResponse) ContentType() string {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.Header.Get("Content-Type")
+	}
+	return ""
+}
+
 type V1MergeABranchResponse struct {
 	Body         []byte
 	HTTPResponse *http.Response
@@ -12274,6 +12307,14 @@ func (r V1MergeABranchResponse) StatusCode() int {
 	return 0
 }
 
+// ContentType is a convenience method to retrieve the Content-Type value from the HTTP response headers
+func (r V1MergeABranchResponse) ContentType() string {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.Header.Get("Content-Type")
+	}
+	return ""
+}
+
 type V1PushABranchResponse struct {
 	Body         []byte
 	HTTPResponse *http.Response
@@ -12296,6 +12337,14 @@ func (r V1PushABranchResponse) StatusCode() int {
 	return 0
 }
 
+// ContentType is a convenience method to retrieve the Content-Type value from the HTTP response headers
+func (r V1PushABranchResponse) ContentType() string {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.Header.Get("Content-Type")
+	}
+	return ""
+}
+
 type V1ResetABranchResponse struct {
 	Body         []byte
 	HTTPResponse *http.Response
@@ -12318,6 +12367,14 @@ func (r V1ResetABranchResponse) StatusCode() int {
 	return 0
 }
 
+// ContentType is a convenience method to retrieve the Content-Type value from the HTTP response headers
+func (r V1ResetABranchResponse) ContentType() string {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.Header.Get("Content-Type")
+	}
+	return ""
+}
+
 type V1RestoreABranchResponse struct {
 	Body         []byte
 	HTTPResponse *http.Response
@@ -12340,6 +12397,14 @@ func (r V1RestoreABranchResponse) StatusCode() int {
 	return 0
 }
 
+// ContentType is a convenience method to retrieve the Content-Type value from the HTTP response headers
+func (r V1RestoreABranchResponse) ContentType() string {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.Header.Get("Content-Type")
+	}
+	return ""
+}
+
 type V1AuthorizeUserResponse struct {
 	Body         []byte
 	HTTPResponse *http.Response
@@ -12361,6 +12426,14 @@ func (r V1AuthorizeUserResponse) StatusCode() int {
 	return 0
 }
 
+// ContentType is a convenience method to retrieve the Content-Type value from the HTTP response headers
+func (r V1AuthorizeUserResponse) ContentType() string {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.Header.Get("Content-Type")
+	}
+	return ""
+}
+
 type V1OauthAuthorizeProjectClaimResponse struct {
 	Body         []byte
 	HTTPResponse *http.Response
@@ -12382,6 +12455,14 @@ func (r V1OauthAuthorizeProjectClaimResponse) StatusCode() int {
 	return 0
 }
 
+// ContentType is a convenience method to retrieve the Content-Type value from the HTTP response headers
+func (r V1OauthAuthorizeProjectClaimResponse) ContentType() string {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.Header.Get("Content-Type")
+	}
+	return ""
+}
+
 type V1RevokeTokenResponse struct {
 	Body         []byte
 	HTTPResponse *http.Response
@@ -12403,6 +12484,14 @@ func (r V1RevokeTokenResponse) StatusCode() int {
 	return 0
 }
 
+// ContentType is a convenience method to retrieve the Content-Type value from the HTTP response headers
+func (r V1RevokeTokenResponse) ContentType() string {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.Header.Get("Content-Type")
+	}
+	return ""
+}
+
 type V1ExchangeOauthTokenResponse struct {
 	Body         []byte
 	HTTPResponse *http.Response
@@ -12425,6 +12514,14 @@ func (r V1ExchangeOauthTokenResponse) StatusCode() int {
 	return 0
 }
 
+// ContentType is a convenience method to retrieve the Content-Type value from the HTTP response headers
+func (r V1ExchangeOauthTokenResponse) ContentType() string {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.Header.Get("Content-Type")
+	}
+	return ""
+}
+
 type V1ListAllOrganizationsResponse struct {
 	Body         []byte
 	HTTPResponse *http.Response
@@ -12447,6 +12544,14 @@ func (r V1ListAllOrganizationsResponse) StatusCode() int {
 	return 0
 }
 
+// ContentType is a convenience method to retrieve the Content-Type value from the HTTP response headers
+func (r V1ListAllOrganizationsResponse) ContentType() string {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.Header.Get("Content-Type")
+	}
+	return ""
+}
+
 type V1CreateAnOrganizationResponse struct {
 	Body         []byte
 	HTTPResponse *http.Response
@@ -12469,6 +12574,14 @@ func (r V1CreateAnOrganizationResponse) StatusCode() int {
 	return 0
 }
 
+// ContentType is a convenience method to retrieve the Content-Type value from the HTTP response headers
+func (r V1CreateAnOrganizationResponse) ContentType() string {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.Header.Get("Content-Type")
+	}
+	return ""
+}
+
 type V1GetAnOrganizationResponse struct {
 	Body         []byte
 	HTTPResponse *http.Response
@@ -12491,6 +12604,14 @@ func (r V1GetAnOrganizationResponse) StatusCode() int {
 	return 0
 }
 
+// ContentType is a convenience method to retrieve the Content-Type value from the HTTP response headers
+func (r V1GetAnOrganizationResponse) ContentType() string {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.Header.Get("Content-Type")
+	}
+	return ""
+}
+
 type V1GetOrganizationEntitlementsResponse struct {
 	Body         []byte
 	HTTPResponse *http.Response
@@ -12513,6 +12634,14 @@ func (r V1GetOrganizationEntitlementsResponse) StatusCode() int {
 	return 0
 }
 
+// ContentType is a convenience method to retrieve the Content-Type value from the HTTP response headers
+func (r V1GetOrganizationEntitlementsResponse) ContentType() string {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.Header.Get("Content-Type")
+	}
+	return ""
+}
+
 type V1ListOrganizationMembersResponse struct {
 	Body         []byte
 	HTTPResponse *http.Response
@@ -12535,6 +12664,14 @@ func (r V1ListOrganizationMembersResponse) StatusCode() int {
 	return 0
 }
 
+// ContentType is a convenience method to retrieve the Content-Type value from the HTTP response headers
+func (r V1ListOrganizationMembersResponse) ContentType() string {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.Header.Get("Content-Type")
+	}
+	return ""
+}
+
 type V1GetOrganizationProjectClaimResponse struct {
 	Body         []byte
 	HTTPResponse *http.Response
@@ -12557,6 +12694,14 @@ func (r V1GetOrganizationProjectClaimResponse) StatusCode() int {
 	return 0
 }
 
+// ContentType is a convenience method to retrieve the Content-Type value from the HTTP response headers
+func (r V1GetOrganizationProjectClaimResponse) ContentType() string {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.Header.Get("Content-Type")
+	}
+	return ""
+}
+
 type V1ClaimProjectForOrganizationResponse struct {
 	Body         []byte
 	HTTPResponse *http.Response
@@ -12578,6 +12723,14 @@ func (r V1ClaimProjectForOrganizationResponse) StatusCode() int {
 	return 0
 }
 
+// ContentType is a convenience method to retrieve the Content-Type value from the HTTP response headers
+func (r V1ClaimProjectForOrganizationResponse) ContentType() string {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.Header.Get("Content-Type")
+	}
+	return ""
+}
+
 type V1GetAllProjectsForOrganizationResponse struct {
 	Body         []byte
 	HTTPResponse *http.Response
@@ -12600,6 +12753,14 @@ func (r V1GetAllProjectsForOrganizationResponse) StatusCode() int {
 	return 0
 }
 
+// ContentType is a convenience method to retrieve the Content-Type value from the HTTP response headers
+func (r V1GetAllProjectsForOrganizationResponse) ContentType() string {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.Header.Get("Content-Type")
+	}
+	return ""
+}
+
 type V1GetProfileResponse struct {
 	Body         []byte
 	HTTPResponse *http.Response
@@ -12622,6 +12783,14 @@ func (r V1GetProfileResponse) StatusCode() int {
 	return 0
 }
 
+// ContentType is a convenience method to retrieve the Content-Type value from the HTTP response headers
+func (r V1GetProfileResponse) ContentType() string {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.Header.Get("Content-Type")
+	}
+	return ""
+}
+
 type V1ListAllProjectsResponse struct {
 	Body         []byte
 	HTTPResponse *http.Response
@@ -12644,6 +12813,14 @@ func (r V1ListAllProjectsResponse) StatusCode() int {
 	return 0
 }
 
+// ContentType is a convenience method to retrieve the Content-Type value from the HTTP response headers
+func (r V1ListAllProjectsResponse) ContentType() string {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.Header.Get("Content-Type")
+	}
+	return ""
+}
+
 type V1CreateAProjectResponse struct {
 	Body         []byte
 	HTTPResponse *http.Response
@@ -12666,7 +12843,15 @@ func (r V1CreateAProjectResponse) StatusCode() int {
 	return 0
 }
 
-type V1GetAvailableRegionsResponse struct {
+// ContentType is a convenience method to retrieve the Content-Type value from the HTTP response headers
+func (r V1CreateAProjectResponse) ContentType() string {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.Header.Get("Content-Type")
+	}
+	return ""
+}
+
+type V1GetAvailableRegionsResponse struct {
 	Body         []byte
 	HTTPResponse *http.Response
 	JSON200      *RegionsInfo
@@ -12688,6 +12873,14 @@ func (r V1GetAvailableRegionsResponse) StatusCode() int {
 	return 0
 }
 
+// ContentType is a convenience method to retrieve the Content-Type value from the HTTP response headers
+func (r V1GetAvailableRegionsResponse) ContentType() string {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.Header.Get("Content-Type")
+	}
+	return ""
+}
+
 type V1DeleteAProjectResponse struct {
 	Body         []byte
 	HTTPResponse *http.Response
@@ -12710,6 +12903,14 @@ func (r V1DeleteAProjectResponse) StatusCode() int {
 	return 0
 }
 
+// ContentType is a convenience method to retrieve the Content-Type value from the HTTP response headers
+func (r V1DeleteAProjectResponse) ContentType() string {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.Header.Get("Content-Type")
+	}
+	return ""
+}
+
 type V1GetProjectResponse struct {
 	Body         []byte
 	HTTPResponse *http.Response
@@ -12732,6 +12933,14 @@ func (r V1GetProjectResponse) StatusCode() int {
 	return 0
 }
 
+// ContentType is a convenience method to retrieve the Content-Type value from the HTTP response headers
+func (r V1GetProjectResponse) ContentType() string {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.Header.Get("Content-Type")
+	}
+	return ""
+}
+
 type V1UpdateAProjectResponse struct {
 	Body         []byte
 	HTTPResponse *http.Response
@@ -12754,6 +12963,14 @@ func (r V1UpdateAProjectResponse) StatusCode() int {
 	return 0
 }
 
+// ContentType is a convenience method to retrieve the Content-Type value from the HTTP response headers
+func (r V1UpdateAProjectResponse) ContentType() string {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.Header.Get("Content-Type")
+	}
+	return ""
+}
+
 type V1ListActionRunsResponse struct {
 	Body         []byte
 	HTTPResponse *http.Response
@@ -12776,6 +12993,14 @@ func (r V1ListActionRunsResponse) StatusCode() int {
 	return 0
 }
 
+// ContentType is a convenience method to retrieve the Content-Type value from the HTTP response headers
+func (r V1ListActionRunsResponse) ContentType() string {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.Header.Get("Content-Type")
+	}
+	return ""
+}
+
 type V1CountActionRunsResponse struct {
 	Body         []byte
 	HTTPResponse *http.Response
@@ -12797,6 +13022,14 @@ func (r V1CountActionRunsResponse) StatusCode() int {
 	return 0
 }
 
+// ContentType is a convenience method to retrieve the Content-Type value from the HTTP response headers
+func (r V1CountActionRunsResponse) ContentType() string {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.Header.Get("Content-Type")
+	}
+	return ""
+}
+
 type V1GetActionRunResponse struct {
 	Body         []byte
 	HTTPResponse *http.Response
@@ -12819,6 +13052,14 @@ func (r V1GetActionRunResponse) StatusCode() int {
 	return 0
 }
 
+// ContentType is a convenience method to retrieve the Content-Type value from the HTTP response headers
+func (r V1GetActionRunResponse) ContentType() string {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.Header.Get("Content-Type")
+	}
+	return ""
+}
+
 type V1GetActionRunLogsResponse struct {
 	Body         []byte
 	HTTPResponse *http.Response
@@ -12840,6 +13081,14 @@ func (r V1GetActionRunLogsResponse) StatusCode() int {
 	return 0
 }
 
+// ContentType is a convenience method to retrieve the Content-Type value from the HTTP response headers
+func (r V1GetActionRunLogsResponse) ContentType() string {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.Header.Get("Content-Type")
+	}
+	return ""
+}
+
 type V1UpdateActionRunStatusResponse struct {
 	Body         []byte
 	HTTPResponse *http.Response
@@ -12862,6 +13111,14 @@ func (r V1UpdateActionRunStatusResponse) StatusCode() int {
 	return 0
 }
 
+// ContentType is a convenience method to retrieve the Content-Type value from the HTTP response headers
+func (r V1UpdateActionRunStatusResponse) ContentType() string {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.Header.Get("Content-Type")
+	}
+	return ""
+}
+
 type V1GetPerformanceAdvisorsResponse struct {
 	Body         []byte
 	HTTPResponse *http.Response
@@ -12884,6 +13141,14 @@ func (r V1GetPerformanceAdvisorsResponse) StatusCode() int {
 	return 0
 }
 
+// ContentType is a convenience method to retrieve the Content-Type value from the HTTP response headers
+func (r V1GetPerformanceAdvisorsResponse) ContentType() string {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.Header.Get("Content-Type")
+	}
+	return ""
+}
+
 type V1GetSecurityAdvisorsResponse struct {
 	Body         []byte
 	HTTPResponse *http.Response
@@ -12906,6 +13171,14 @@ func (r V1GetSecurityAdvisorsResponse) StatusCode() int {
 	return 0
 }
 
+// ContentType is a convenience method to retrieve the Content-Type value from the HTTP response headers
+func (r V1GetSecurityAdvisorsResponse) ContentType() string {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.Header.Get("Content-Type")
+	}
+	return ""
+}
+
 type V1GetProjectFunctionCombinedStatsResponse struct {
 	Body         []byte
 	HTTPResponse *http.Response
@@ -12928,6 +13201,14 @@ func (r V1GetProjectFunctionCombinedStatsResponse) StatusCode() int {
 	return 0
 }
 
+// ContentType is a convenience method to retrieve the Content-Type value from the HTTP response headers
+func (r V1GetProjectFunctionCombinedStatsResponse) ContentType() string {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.Header.Get("Content-Type")
+	}
+	return ""
+}
+
 type V1GetProjectLogsResponse struct {
 	Body         []byte
 	HTTPResponse *http.Response
@@ -12950,6 +13231,14 @@ func (r V1GetProjectLogsResponse) StatusCode() int {
 	return 0
 }
 
+// ContentType is a convenience method to retrieve the Content-Type value from the HTTP response headers
+func (r V1GetProjectLogsResponse) ContentType() string {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.Header.Get("Content-Type")
+	}
+	return ""
+}
+
 type V1GetProjectLogsAllResponse struct {
 	Body         []byte
 	HTTPResponse *http.Response
@@ -12972,6 +13261,43 @@ func (r V1GetProjectLogsAllResponse) StatusCode() int {
 	return 0
 }
 
+// ContentType is a convenience method to retrieve the Content-Type value from the HTTP response headers
+func (r V1GetProjectLogsAllResponse) ContentType() string {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.Header.Get("Content-Type")
+	}
+	return ""
+}
+
+type V1ScrapeProjectMetricsResponse struct {
+	Body         []byte
+	HTTPResponse *http.Response
+}
+
+// Status returns HTTPResponse.Status
+func (r V1ScrapeProjectMetricsResponse) Status() string {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.Status
+	}
+	return http.StatusText(0)
+}
+
+// StatusCode returns HTTPResponse.StatusCode
+func (r V1ScrapeProjectMetricsResponse) StatusCode() int {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.StatusCode
+	}
+	return 0
+}
+
+// ContentType is a convenience method to retrieve the Content-Type value from the HTTP response headers
+func (r V1ScrapeProjectMetricsResponse) ContentType() string {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.Header.Get("Content-Type")
+	}
+	return ""
+}
+
 type V1GetProjectUsageApiCountResponse struct {
 	Body         []byte
 	HTTPResponse *http.Response
@@ -12994,6 +13320,14 @@ func (r V1GetProjectUsageApiCountResponse) StatusCode() int {
 	return 0
 }
 
+// ContentType is a convenience method to retrieve the Content-Type value from the HTTP response headers
+func (r V1GetProjectUsageApiCountResponse) ContentType() string {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.Header.Get("Content-Type")
+	}
+	return ""
+}
+
 type V1GetProjectUsageRequestCountResponse struct {
 	Body         []byte
 	HTTPResponse *http.Response
@@ -13016,6 +13350,14 @@ func (r V1GetProjectUsageRequestCountResponse) StatusCode() int {
 	return 0
 }
 
+// ContentType is a convenience method to retrieve the Content-Type value from the HTTP response headers
+func (r V1GetProjectUsageRequestCountResponse) ContentType() string {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.Header.Get("Content-Type")
+	}
+	return ""
+}
+
 type V1GetProjectApiKeysResponse struct {
 	Body         []byte
 	HTTPResponse *http.Response
@@ -13038,6 +13380,14 @@ func (r V1GetProjectApiKeysResponse) StatusCode() int {
 	return 0
 }
 
+// ContentType is a convenience method to retrieve the Content-Type value from the HTTP response headers
+func (r V1GetProjectApiKeysResponse) ContentType() string {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.Header.Get("Content-Type")
+	}
+	return ""
+}
+
 type V1CreateProjectApiKeyResponse struct {
 	Body         []byte
 	HTTPResponse *http.Response
@@ -13060,6 +13410,14 @@ func (r V1CreateProjectApiKeyResponse) StatusCode() int {
 	return 0
 }
 
+// ContentType is a convenience method to retrieve the Content-Type value from the HTTP response headers
+func (r V1CreateProjectApiKeyResponse) ContentType() string {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.Header.Get("Content-Type")
+	}
+	return ""
+}
+
 type V1GetProjectLegacyApiKeysResponse struct {
 	Body         []byte
 	HTTPResponse *http.Response
@@ -13082,6 +13440,14 @@ func (r V1GetProjectLegacyApiKeysResponse) StatusCode() int {
 	return 0
 }
 
+// ContentType is a convenience method to retrieve the Content-Type value from the HTTP response headers
+func (r V1GetProjectLegacyApiKeysResponse) ContentType() string {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.Header.Get("Content-Type")
+	}
+	return ""
+}
+
 type V1UpdateProjectLegacyApiKeysResponse struct {
 	Body         []byte
 	HTTPResponse *http.Response
@@ -13104,6 +13470,14 @@ func (r V1UpdateProjectLegacyApiKeysResponse) StatusCode() int {
 	return 0
 }
 
+// ContentType is a convenience method to retrieve the Content-Type value from the HTTP response headers
+func (r V1UpdateProjectLegacyApiKeysResponse) ContentType() string {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.Header.Get("Content-Type")
+	}
+	return ""
+}
+
 type V1DeleteProjectApiKeyResponse struct {
 	Body         []byte
 	HTTPResponse *http.Response
@@ -13126,6 +13500,14 @@ func (r V1DeleteProjectApiKeyResponse) StatusCode() int {
 	return 0
 }
 
+// ContentType is a convenience method to retrieve the Content-Type value from the HTTP response headers
+func (r V1DeleteProjectApiKeyResponse) ContentType() string {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.Header.Get("Content-Type")
+	}
+	return ""
+}
+
 type V1GetProjectApiKeyResponse struct {
 	Body         []byte
 	HTTPResponse *http.Response
@@ -13148,6 +13530,14 @@ func (r V1GetProjectApiKeyResponse) StatusCode() int {
 	return 0
 }
 
+// ContentType is a convenience method to retrieve the Content-Type value from the HTTP response headers
+func (r V1GetProjectApiKeyResponse) ContentType() string {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.Header.Get("Content-Type")
+	}
+	return ""
+}
+
 type V1UpdateProjectApiKeyResponse struct {
 	Body         []byte
 	HTTPResponse *http.Response
@@ -13170,6 +13560,14 @@ func (r V1UpdateProjectApiKeyResponse) StatusCode() int {
 	return 0
 }
 
+// ContentType is a convenience method to retrieve the Content-Type value from the HTTP response headers
+func (r V1UpdateProjectApiKeyResponse) ContentType() string {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.Header.Get("Content-Type")
+	}
+	return ""
+}
+
 type V1ListProjectAddonsResponse struct {
 	Body         []byte
 	HTTPResponse *http.Response
@@ -13192,6 +13590,14 @@ func (r V1ListProjectAddonsResponse) StatusCode() int {
 	return 0
 }
 
+// ContentType is a convenience method to retrieve the Content-Type value from the HTTP response headers
+func (r V1ListProjectAddonsResponse) ContentType() string {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.Header.Get("Content-Type")
+	}
+	return ""
+}
+
 type V1ApplyProjectAddonResponse struct {
 	Body         []byte
 	HTTPResponse *http.Response
@@ -13213,6 +13619,14 @@ func (r V1ApplyProjectAddonResponse) StatusCode() int {
 	return 0
 }
 
+// ContentType is a convenience method to retrieve the Content-Type value from the HTTP response headers
+func (r V1ApplyProjectAddonResponse) ContentType() string {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.Header.Get("Content-Type")
+	}
+	return ""
+}
+
 type V1RemoveProjectAddonResponse struct {
 	Body         []byte
 	HTTPResponse *http.Response
@@ -13234,6 +13648,14 @@ func (r V1RemoveProjectAddonResponse) StatusCode() int {
 	return 0
 }
 
+// ContentType is a convenience method to retrieve the Content-Type value from the HTTP response headers
+func (r V1RemoveProjectAddonResponse) ContentType() string {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.Header.Get("Content-Type")
+	}
+	return ""
+}
+
 type V1DisablePreviewBranchingResponse struct {
 	Body         []byte
 	HTTPResponse *http.Response
@@ -13255,6 +13677,14 @@ func (r V1DisablePreviewBranchingResponse) StatusCode() int {
 	return 0
 }
 
+// ContentType is a convenience method to retrieve the Content-Type value from the HTTP response headers
+func (r V1DisablePreviewBranchingResponse) ContentType() string {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.Header.Get("Content-Type")
+	}
+	return ""
+}
+
 type V1ListAllBranchesResponse struct {
 	Body         []byte
 	HTTPResponse *http.Response
@@ -13277,6 +13707,14 @@ func (r V1ListAllBranchesResponse) StatusCode() int {
 	return 0
 }
 
+// ContentType is a convenience method to retrieve the Content-Type value from the HTTP response headers
+func (r V1ListAllBranchesResponse) ContentType() string {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.Header.Get("Content-Type")
+	}
+	return ""
+}
+
 type V1CreateABranchResponse struct {
 	Body         []byte
 	HTTPResponse *http.Response
@@ -13299,6 +13737,14 @@ func (r V1CreateABranchResponse) StatusCode() int {
 	return 0
 }
 
+// ContentType is a convenience method to retrieve the Content-Type value from the HTTP response headers
+func (r V1CreateABranchResponse) ContentType() string {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.Header.Get("Content-Type")
+	}
+	return ""
+}
+
 type V1GetABranchResponse struct {
 	Body         []byte
 	HTTPResponse *http.Response
@@ -13321,6 +13767,14 @@ func (r V1GetABranchResponse) StatusCode() int {
 	return 0
 }
 
+// ContentType is a convenience method to retrieve the Content-Type value from the HTTP response headers
+func (r V1GetABranchResponse) ContentType() string {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.Header.Get("Content-Type")
+	}
+	return ""
+}
+
 type V1DeleteProjectClaimTokenResponse struct {
 	Body         []byte
 	HTTPResponse *http.Response
@@ -13342,6 +13796,14 @@ func (r V1DeleteProjectClaimTokenResponse) StatusCode() int {
 	return 0
 }
 
+// ContentType is a convenience method to retrieve the Content-Type value from the HTTP response headers
+func (r V1DeleteProjectClaimTokenResponse) ContentType() string {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.Header.Get("Content-Type")
+	}
+	return ""
+}
+
 type V1GetProjectClaimTokenResponse struct {
 	Body         []byte
 	HTTPResponse *http.Response
@@ -13364,6 +13826,14 @@ func (r V1GetProjectClaimTokenResponse) StatusCode() int {
 	return 0
 }
 
+// ContentType is a convenience method to retrieve the Content-Type value from the HTTP response headers
+func (r V1GetProjectClaimTokenResponse) ContentType() string {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.Header.Get("Content-Type")
+	}
+	return ""
+}
+
 type V1CreateProjectClaimTokenResponse struct {
 	Body         []byte
 	HTTPResponse *http.Response
@@ -13386,6 +13856,14 @@ func (r V1CreateProjectClaimTokenResponse) StatusCode() int {
 	return 0
 }
 
+// ContentType is a convenience method to retrieve the Content-Type value from the HTTP response headers
+func (r V1CreateProjectClaimTokenResponse) ContentType() string {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.Header.Get("Content-Type")
+	}
+	return ""
+}
+
 type V1DeleteLoginRolesResponse struct {
 	Body         []byte
 	HTTPResponse *http.Response
@@ -13408,6 +13886,14 @@ func (r V1DeleteLoginRolesResponse) StatusCode() int {
 	return 0
 }
 
+// ContentType is a convenience method to retrieve the Content-Type value from the HTTP response headers
+func (r V1DeleteLoginRolesResponse) ContentType() string {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.Header.Get("Content-Type")
+	}
+	return ""
+}
+
 type V1CreateLoginRoleResponse struct {
 	Body         []byte
 	HTTPResponse *http.Response
@@ -13430,6 +13916,14 @@ func (r V1CreateLoginRoleResponse) StatusCode() int {
 	return 0
 }
 
+// ContentType is a convenience method to retrieve the Content-Type value from the HTTP response headers
+func (r V1CreateLoginRoleResponse) ContentType() string {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.Header.Get("Content-Type")
+	}
+	return ""
+}
+
 type V1GetAuthServiceConfigResponse struct {
 	Body         []byte
 	HTTPResponse *http.Response
@@ -13452,6 +13946,14 @@ func (r V1GetAuthServiceConfigResponse) StatusCode() int {
 	return 0
 }
 
+// ContentType is a convenience method to retrieve the Content-Type value from the HTTP response headers
+func (r V1GetAuthServiceConfigResponse) ContentType() string {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.Header.Get("Content-Type")
+	}
+	return ""
+}
+
 type V1UpdateAuthServiceConfigResponse struct {
 	Body         []byte
 	HTTPResponse *http.Response
@@ -13474,6 +13976,14 @@ func (r V1UpdateAuthServiceConfigResponse) StatusCode() int {
 	return 0
 }
 
+// ContentType is a convenience method to retrieve the Content-Type value from the HTTP response headers
+func (r V1UpdateAuthServiceConfigResponse) ContentType() string {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.Header.Get("Content-Type")
+	}
+	return ""
+}
+
 type V1GetProjectSigningKeysResponse struct {
 	Body         []byte
 	HTTPResponse *http.Response
@@ -13496,6 +14006,14 @@ func (r V1GetProjectSigningKeysResponse) StatusCode() int {
 	return 0
 }
 
+// ContentType is a convenience method to retrieve the Content-Type value from the HTTP response headers
+func (r V1GetProjectSigningKeysResponse) ContentType() string {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.Header.Get("Content-Type")
+	}
+	return ""
+}
+
 type V1CreateProjectSigningKeyResponse struct {
 	Body         []byte
 	HTTPResponse *http.Response
@@ -13518,6 +14036,14 @@ func (r V1CreateProjectSigningKeyResponse) StatusCode() int {
 	return 0
 }
 
+// ContentType is a convenience method to retrieve the Content-Type value from the HTTP response headers
+func (r V1CreateProjectSigningKeyResponse) ContentType() string {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.Header.Get("Content-Type")
+	}
+	return ""
+}
+
 type V1GetLegacySigningKeyResponse struct {
 	Body         []byte
 	HTTPResponse *http.Response
@@ -13540,6 +14066,14 @@ func (r V1GetLegacySigningKeyResponse) StatusCode() int {
 	return 0
 }
 
+// ContentType is a convenience method to retrieve the Content-Type value from the HTTP response headers
+func (r V1GetLegacySigningKeyResponse) ContentType() string {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.Header.Get("Content-Type")
+	}
+	return ""
+}
+
 type V1CreateLegacySigningKeyResponse struct {
 	Body         []byte
 	HTTPResponse *http.Response
@@ -13562,6 +14096,14 @@ func (r V1CreateLegacySigningKeyResponse) StatusCode() int {
 	return 0
 }
 
+// ContentType is a convenience method to retrieve the Content-Type value from the HTTP response headers
+func (r V1CreateLegacySigningKeyResponse) ContentType() string {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.Header.Get("Content-Type")
+	}
+	return ""
+}
+
 type V1RemoveProjectSigningKeyResponse struct {
 	Body         []byte
 	HTTPResponse *http.Response
@@ -13584,6 +14126,14 @@ func (r V1RemoveProjectSigningKeyResponse) StatusCode() int {
 	return 0
 }
 
+// ContentType is a convenience method to retrieve the Content-Type value from the HTTP response headers
+func (r V1RemoveProjectSigningKeyResponse) ContentType() string {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.Header.Get("Content-Type")
+	}
+	return ""
+}
+
 type V1GetProjectSigningKeyResponse struct {
 	Body         []byte
 	HTTPResponse *http.Response
@@ -13606,6 +14156,14 @@ func (r V1GetProjectSigningKeyResponse) StatusCode() int {
 	return 0
 }
 
+// ContentType is a convenience method to retrieve the Content-Type value from the HTTP response headers
+func (r V1GetProjectSigningKeyResponse) ContentType() string {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.Header.Get("Content-Type")
+	}
+	return ""
+}
+
 type V1UpdateProjectSigningKeyResponse struct {
 	Body         []byte
 	HTTPResponse *http.Response
@@ -13628,6 +14186,14 @@ func (r V1UpdateProjectSigningKeyResponse) StatusCode() int {
 	return 0
 }
 
+// ContentType is a convenience method to retrieve the Content-Type value from the HTTP response headers
+func (r V1UpdateProjectSigningKeyResponse) ContentType() string {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.Header.Get("Content-Type")
+	}
+	return ""
+}
+
 type V1ListAllSsoProviderResponse struct {
 	Body         []byte
 	HTTPResponse *http.Response
@@ -13650,6 +14216,14 @@ func (r V1ListAllSsoProviderResponse) StatusCode() int {
 	return 0
 }
 
+// ContentType is a convenience method to retrieve the Content-Type value from the HTTP response headers
+func (r V1ListAllSsoProviderResponse) ContentType() string {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.Header.Get("Content-Type")
+	}
+	return ""
+}
+
 type V1CreateASsoProviderResponse struct {
 	Body         []byte
 	HTTPResponse *http.Response
@@ -13672,6 +14246,14 @@ func (r V1CreateASsoProviderResponse) StatusCode() int {
 	return 0
 }
 
+// ContentType is a convenience method to retrieve the Content-Type value from the HTTP response headers
+func (r V1CreateASsoProviderResponse) ContentType() string {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.Header.Get("Content-Type")
+	}
+	return ""
+}
+
 type V1DeleteASsoProviderResponse struct {
 	Body         []byte
 	HTTPResponse *http.Response
@@ -13694,6 +14276,14 @@ func (r V1DeleteASsoProviderResponse) StatusCode() int {
 	return 0
 }
 
+// ContentType is a convenience method to retrieve the Content-Type value from the HTTP response headers
+func (r V1DeleteASsoProviderResponse) ContentType() string {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.Header.Get("Content-Type")
+	}
+	return ""
+}
+
 type V1GetASsoProviderResponse struct {
 	Body         []byte
 	HTTPResponse *http.Response
@@ -13716,6 +14306,14 @@ func (r V1GetASsoProviderResponse) StatusCode() int {
 	return 0
 }
 
+// ContentType is a convenience method to retrieve the Content-Type value from the HTTP response headers
+func (r V1GetASsoProviderResponse) ContentType() string {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.Header.Get("Content-Type")
+	}
+	return ""
+}
+
 type V1UpdateASsoProviderResponse struct {
 	Body         []byte
 	HTTPResponse *http.Response
@@ -13738,6 +14336,14 @@ func (r V1UpdateASsoProviderResponse) StatusCode() int {
 	return 0
 }
 
+// ContentType is a convenience method to retrieve the Content-Type value from the HTTP response headers
+func (r V1UpdateASsoProviderResponse) ContentType() string {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.Header.Get("Content-Type")
+	}
+	return ""
+}
+
 type V1ListProjectTpaIntegrationsResponse struct {
 	Body         []byte
 	HTTPResponse *http.Response
@@ -13760,6 +14366,14 @@ func (r V1ListProjectTpaIntegrationsResponse) StatusCode() int {
 	return 0
 }
 
+// ContentType is a convenience method to retrieve the Content-Type value from the HTTP response headers
+func (r V1ListProjectTpaIntegrationsResponse) ContentType() string {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.Header.Get("Content-Type")
+	}
+	return ""
+}
+
 type V1CreateProjectTpaIntegrationResponse struct {
 	Body         []byte
 	HTTPResponse *http.Response
@@ -13782,6 +14396,14 @@ func (r V1CreateProjectTpaIntegrationResponse) StatusCode() int {
 	return 0
 }
 
+// ContentType is a convenience method to retrieve the Content-Type value from the HTTP response headers
+func (r V1CreateProjectTpaIntegrationResponse) ContentType() string {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.Header.Get("Content-Type")
+	}
+	return ""
+}
+
 type V1DeleteProjectTpaIntegrationResponse struct {
 	Body         []byte
 	HTTPResponse *http.Response
@@ -13804,6 +14426,14 @@ func (r V1DeleteProjectTpaIntegrationResponse) StatusCode() int {
 	return 0
 }
 
+// ContentType is a convenience method to retrieve the Content-Type value from the HTTP response headers
+func (r V1DeleteProjectTpaIntegrationResponse) ContentType() string {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.Header.Get("Content-Type")
+	}
+	return ""
+}
+
 type V1GetProjectTpaIntegrationResponse struct {
 	Body         []byte
 	HTTPResponse *http.Response
@@ -13826,6 +14456,14 @@ func (r V1GetProjectTpaIntegrationResponse) StatusCode() int {
 	return 0
 }
 
+// ContentType is a convenience method to retrieve the Content-Type value from the HTTP response headers
+func (r V1GetProjectTpaIntegrationResponse) ContentType() string {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.Header.Get("Content-Type")
+	}
+	return ""
+}
+
 type V1GetProjectPgbouncerConfigResponse struct {
 	Body         []byte
 	HTTPResponse *http.Response
@@ -13848,6 +14486,14 @@ func (r V1GetProjectPgbouncerConfigResponse) StatusCode() int {
 	return 0
 }
 
+// ContentType is a convenience method to retrieve the Content-Type value from the HTTP response headers
+func (r V1GetProjectPgbouncerConfigResponse) ContentType() string {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.Header.Get("Content-Type")
+	}
+	return ""
+}
+
 type V1GetPoolerConfigResponse struct {
 	Body         []byte
 	HTTPResponse *http.Response
@@ -13870,6 +14516,14 @@ func (r V1GetPoolerConfigResponse) StatusCode() int {
 	return 0
 }
 
+// ContentType is a convenience method to retrieve the Content-Type value from the HTTP response headers
+func (r V1GetPoolerConfigResponse) ContentType() string {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.Header.Get("Content-Type")
+	}
+	return ""
+}
+
 type V1UpdatePoolerConfigResponse struct {
 	Body         []byte
 	HTTPResponse *http.Response
@@ -13892,6 +14546,14 @@ func (r V1UpdatePoolerConfigResponse) StatusCode() int {
 	return 0
 }
 
+// ContentType is a convenience method to retrieve the Content-Type value from the HTTP response headers
+func (r V1UpdatePoolerConfigResponse) ContentType() string {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.Header.Get("Content-Type")
+	}
+	return ""
+}
+
 type V1GetPostgresConfigResponse struct {
 	Body         []byte
 	HTTPResponse *http.Response
@@ -13914,6 +14576,14 @@ func (r V1GetPostgresConfigResponse) StatusCode() int {
 	return 0
 }
 
+// ContentType is a convenience method to retrieve the Content-Type value from the HTTP response headers
+func (r V1GetPostgresConfigResponse) ContentType() string {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.Header.Get("Content-Type")
+	}
+	return ""
+}
+
 type V1UpdatePostgresConfigResponse struct {
 	Body         []byte
 	HTTPResponse *http.Response
@@ -13936,6 +14606,14 @@ func (r V1UpdatePostgresConfigResponse) StatusCode() int {
 	return 0
 }
 
+// ContentType is a convenience method to retrieve the Content-Type value from the HTTP response headers
+func (r V1UpdatePostgresConfigResponse) ContentType() string {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.Header.Get("Content-Type")
+	}
+	return ""
+}
+
 type V1GetDatabaseDiskResponse struct {
 	Body         []byte
 	HTTPResponse *http.Response
@@ -13958,6 +14636,14 @@ func (r V1GetDatabaseDiskResponse) StatusCode() int {
 	return 0
 }
 
+// ContentType is a convenience method to retrieve the Content-Type value from the HTTP response headers
+func (r V1GetDatabaseDiskResponse) ContentType() string {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.Header.Get("Content-Type")
+	}
+	return ""
+}
+
 type V1ModifyDatabaseDiskResponse struct {
 	Body         []byte
 	HTTPResponse *http.Response
@@ -13979,6 +14665,14 @@ func (r V1ModifyDatabaseDiskResponse) StatusCode() int {
 	return 0
 }
 
+// ContentType is a convenience method to retrieve the Content-Type value from the HTTP response headers
+func (r V1ModifyDatabaseDiskResponse) ContentType() string {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.Header.Get("Content-Type")
+	}
+	return ""
+}
+
 type V1GetProjectDiskAutoscaleConfigResponse struct {
 	Body         []byte
 	HTTPResponse *http.Response
@@ -14001,6 +14695,14 @@ func (r V1GetProjectDiskAutoscaleConfigResponse) StatusCode() int {
 	return 0
 }
 
+// ContentType is a convenience method to retrieve the Content-Type value from the HTTP response headers
+func (r V1GetProjectDiskAutoscaleConfigResponse) ContentType() string {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.Header.Get("Content-Type")
+	}
+	return ""
+}
+
 type V1GetDiskUtilizationResponse struct {
 	Body         []byte
 	HTTPResponse *http.Response
@@ -14023,6 +14725,14 @@ func (r V1GetDiskUtilizationResponse) StatusCode() int {
 	return 0
 }
 
+// ContentType is a convenience method to retrieve the Content-Type value from the HTTP response headers
+func (r V1GetDiskUtilizationResponse) ContentType() string {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.Header.Get("Content-Type")
+	}
+	return ""
+}
+
 type V1GetRealtimeConfigResponse struct {
 	Body         []byte
 	HTTPResponse *http.Response
@@ -14045,6 +14755,14 @@ func (r V1GetRealtimeConfigResponse) StatusCode() int {
 	return 0
 }
 
+// ContentType is a convenience method to retrieve the Content-Type value from the HTTP response headers
+func (r V1GetRealtimeConfigResponse) ContentType() string {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.Header.Get("Content-Type")
+	}
+	return ""
+}
+
 type V1UpdateRealtimeConfigResponse struct {
 	Body         []byte
 	HTTPResponse *http.Response
@@ -14066,6 +14784,14 @@ func (r V1UpdateRealtimeConfigResponse) StatusCode() int {
 	return 0
 }
 
+// ContentType is a convenience method to retrieve the Content-Type value from the HTTP response headers
+func (r V1UpdateRealtimeConfigResponse) ContentType() string {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.Header.Get("Content-Type")
+	}
+	return ""
+}
+
 type V1ShutdownRealtimeResponse struct {
 	Body         []byte
 	HTTPResponse *http.Response
@@ -14087,6 +14813,14 @@ func (r V1ShutdownRealtimeResponse) StatusCode() int {
 	return 0
 }
 
+// ContentType is a convenience method to retrieve the Content-Type value from the HTTP response headers
+func (r V1ShutdownRealtimeResponse) ContentType() string {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.Header.Get("Content-Type")
+	}
+	return ""
+}
+
 type V1GetStorageConfigResponse struct {
 	Body         []byte
 	HTTPResponse *http.Response
@@ -14109,6 +14843,14 @@ func (r V1GetStorageConfigResponse) StatusCode() int {
 	return 0
 }
 
+// ContentType is a convenience method to retrieve the Content-Type value from the HTTP response headers
+func (r V1GetStorageConfigResponse) ContentType() string {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.Header.Get("Content-Type")
+	}
+	return ""
+}
+
 type V1UpdateStorageConfigResponse struct {
 	Body         []byte
 	HTTPResponse *http.Response
@@ -14130,6 +14872,14 @@ func (r V1UpdateStorageConfigResponse) StatusCode() int {
 	return 0
 }
 
+// ContentType is a convenience method to retrieve the Content-Type value from the HTTP response headers
+func (r V1UpdateStorageConfigResponse) ContentType() string {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.Header.Get("Content-Type")
+	}
+	return ""
+}
+
 type V1DeleteHostnameConfigResponse struct {
 	Body         []byte
 	HTTPResponse *http.Response
@@ -14151,6 +14901,14 @@ func (r V1DeleteHostnameConfigResponse) StatusCode() int {
 	return 0
 }
 
+// ContentType is a convenience method to retrieve the Content-Type value from the HTTP response headers
+func (r V1DeleteHostnameConfigResponse) ContentType() string {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.Header.Get("Content-Type")
+	}
+	return ""
+}
+
 type V1GetHostnameConfigResponse struct {
 	Body         []byte
 	HTTPResponse *http.Response
@@ -14173,6 +14931,14 @@ func (r V1GetHostnameConfigResponse) StatusCode() int {
 	return 0
 }
 
+// ContentType is a convenience method to retrieve the Content-Type value from the HTTP response headers
+func (r V1GetHostnameConfigResponse) ContentType() string {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.Header.Get("Content-Type")
+	}
+	return ""
+}
+
 type V1ActivateCustomHostnameResponse struct {
 	Body         []byte
 	HTTPResponse *http.Response
@@ -14195,6 +14961,14 @@ func (r V1ActivateCustomHostnameResponse) StatusCode() int {
 	return 0
 }
 
+// ContentType is a convenience method to retrieve the Content-Type value from the HTTP response headers
+func (r V1ActivateCustomHostnameResponse) ContentType() string {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.Header.Get("Content-Type")
+	}
+	return ""
+}
+
 type V1UpdateHostnameConfigResponse struct {
 	Body         []byte
 	HTTPResponse *http.Response
@@ -14217,6 +14991,14 @@ func (r V1UpdateHostnameConfigResponse) StatusCode() int {
 	return 0
 }
 
+// ContentType is a convenience method to retrieve the Content-Type value from the HTTP response headers
+func (r V1UpdateHostnameConfigResponse) ContentType() string {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.Header.Get("Content-Type")
+	}
+	return ""
+}
+
 type V1VerifyDnsConfigResponse struct {
 	Body         []byte
 	HTTPResponse *http.Response
@@ -14239,6 +15021,14 @@ func (r V1VerifyDnsConfigResponse) StatusCode() int {
 	return 0
 }
 
+// ContentType is a convenience method to retrieve the Content-Type value from the HTTP response headers
+func (r V1VerifyDnsConfigResponse) ContentType() string {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.Header.Get("Content-Type")
+	}
+	return ""
+}
+
 type V1ListAllBackupsResponse struct {
 	Body         []byte
 	HTTPResponse *http.Response
@@ -14261,6 +15051,14 @@ func (r V1ListAllBackupsResponse) StatusCode() int {
 	return 0
 }
 
+// ContentType is a convenience method to retrieve the Content-Type value from the HTTP response headers
+func (r V1ListAllBackupsResponse) ContentType() string {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.Header.Get("Content-Type")
+	}
+	return ""
+}
+
 type V1RestorePhysicalBackupResponse struct {
 	Body         []byte
 	HTTPResponse *http.Response
@@ -14282,6 +15080,14 @@ func (r V1RestorePhysicalBackupResponse) StatusCode() int {
 	return 0
 }
 
+// ContentType is a convenience method to retrieve the Content-Type value from the HTTP response headers
+func (r V1RestorePhysicalBackupResponse) ContentType() string {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.Header.Get("Content-Type")
+	}
+	return ""
+}
+
 type V1RestorePitrBackupResponse struct {
 	Body         []byte
 	HTTPResponse *http.Response
@@ -14303,6 +15109,14 @@ func (r V1RestorePitrBackupResponse) StatusCode() int {
 	return 0
 }
 
+// ContentType is a convenience method to retrieve the Content-Type value from the HTTP response headers
+func (r V1RestorePitrBackupResponse) ContentType() string {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.Header.Get("Content-Type")
+	}
+	return ""
+}
+
 type V1GetRestorePointResponse struct {
 	Body         []byte
 	HTTPResponse *http.Response
@@ -14325,6 +15139,14 @@ func (r V1GetRestorePointResponse) StatusCode() int {
 	return 0
 }
 
+// ContentType is a convenience method to retrieve the Content-Type value from the HTTP response headers
+func (r V1GetRestorePointResponse) ContentType() string {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.Header.Get("Content-Type")
+	}
+	return ""
+}
+
 type V1CreateRestorePointResponse struct {
 	Body         []byte
 	HTTPResponse *http.Response
@@ -14347,10 +15169,19 @@ func (r V1CreateRestorePointResponse) StatusCode() int {
 	return 0
 }
 
+// ContentType is a convenience method to retrieve the Content-Type value from the HTTP response headers
+func (r V1CreateRestorePointResponse) ContentType() string {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.Header.Get("Content-Type")
+	}
+	return ""
+}
+
 type V1GetBackupScheduleResponse struct {
 	Body         []byte
 	HTTPResponse *http.Response
 	JSON200      *V1BackupScheduleResponse
+	JSON402      *PlanGateErrorBody
 }
 
 // Status returns HTTPResponse.Status
@@ -14369,10 +15200,19 @@ func (r V1GetBackupScheduleResponse) StatusCode() int {
 	return 0
 }
 
+// ContentType is a convenience method to retrieve the Content-Type value from the HTTP response headers
+func (r V1GetBackupScheduleResponse) ContentType() string {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.Header.Get("Content-Type")
+	}
+	return ""
+}
+
 type V1UpdateBackupScheduleResponse struct {
 	Body         []byte
 	HTTPResponse *http.Response
 	JSON200      *V1BackupScheduleResponse
+	JSON402      *PlanGateErrorBody
 }
 
 // Status returns HTTPResponse.Status
@@ -14391,6 +15231,14 @@ func (r V1UpdateBackupScheduleResponse) StatusCode() int {
 	return 0
 }
 
+// ContentType is a convenience method to retrieve the Content-Type value from the HTTP response headers
+func (r V1UpdateBackupScheduleResponse) ContentType() string {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.Header.Get("Content-Type")
+	}
+	return ""
+}
+
 type V1UndoResponse struct {
 	Body         []byte
 	HTTPResponse *http.Response
@@ -14412,6 +15260,14 @@ func (r V1UndoResponse) StatusCode() int {
 	return 0
 }
 
+// ContentType is a convenience method to retrieve the Content-Type value from the HTTP response headers
+func (r V1UndoResponse) ContentType() string {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.Header.Get("Content-Type")
+	}
+	return ""
+}
+
 type V1GetDatabaseMetadataResponse struct {
 	Body         []byte
 	HTTPResponse *http.Response
@@ -14434,6 +15290,14 @@ func (r V1GetDatabaseMetadataResponse) StatusCode() int {
 	return 0
 }
 
+// ContentType is a convenience method to retrieve the Content-Type value from the HTTP response headers
+func (r V1GetDatabaseMetadataResponse) ContentType() string {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.Header.Get("Content-Type")
+	}
+	return ""
+}
+
 type V1GetJitAccessResponse struct {
 	Body         []byte
 	HTTPResponse *http.Response
@@ -14456,6 +15320,14 @@ func (r V1GetJitAccessResponse) StatusCode() int {
 	return 0
 }
 
+// ContentType is a convenience method to retrieve the Content-Type value from the HTTP response headers
+func (r V1GetJitAccessResponse) ContentType() string {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.Header.Get("Content-Type")
+	}
+	return ""
+}
+
 type V1AuthorizeJitAccessResponse struct {
 	Body         []byte
 	HTTPResponse *http.Response
@@ -14478,6 +15350,14 @@ func (r V1AuthorizeJitAccessResponse) StatusCode() int {
 	return 0
 }
 
+// ContentType is a convenience method to retrieve the Content-Type value from the HTTP response headers
+func (r V1AuthorizeJitAccessResponse) ContentType() string {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.Header.Get("Content-Type")
+	}
+	return ""
+}
+
 type V1UpdateJitAccessResponse struct {
 	Body         []byte
 	HTTPResponse *http.Response
@@ -14500,6 +15380,14 @@ func (r V1UpdateJitAccessResponse) StatusCode() int {
 	return 0
 }
 
+// ContentType is a convenience method to retrieve the Content-Type value from the HTTP response headers
+func (r V1UpdateJitAccessResponse) ContentType() string {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.Header.Get("Content-Type")
+	}
+	return ""
+}
+
 type V1InviteExternalJitAccessResponse struct {
 	Body         []byte
 	HTTPResponse *http.Response
@@ -14522,6 +15410,14 @@ func (r V1InviteExternalJitAccessResponse) StatusCode() int {
 	return 0
 }
 
+// ContentType is a convenience method to retrieve the Content-Type value from the HTTP response headers
+func (r V1InviteExternalJitAccessResponse) ContentType() string {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.Header.Get("Content-Type")
+	}
+	return ""
+}
+
 type V1AcceptInviteExternalJitAccessResponse struct {
 	Body         []byte
 	HTTPResponse *http.Response
@@ -14544,6 +15440,14 @@ func (r V1AcceptInviteExternalJitAccessResponse) StatusCode() int {
 	return 0
 }
 
+// ContentType is a convenience method to retrieve the Content-Type value from the HTTP response headers
+func (r V1AcceptInviteExternalJitAccessResponse) ContentType() string {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.Header.Get("Content-Type")
+	}
+	return ""
+}
+
 type V1DeleteInviteExternalJitAccessResponse struct {
 	Body         []byte
 	HTTPResponse *http.Response
@@ -14565,6 +15469,14 @@ func (r V1DeleteInviteExternalJitAccessResponse) StatusCode() int {
 	return 0
 }
 
+// ContentType is a convenience method to retrieve the Content-Type value from the HTTP response headers
+func (r V1DeleteInviteExternalJitAccessResponse) ContentType() string {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.Header.Get("Content-Type")
+	}
+	return ""
+}
+
 type V1ListJitAccessResponse struct {
 	Body         []byte
 	HTTPResponse *http.Response
@@ -14587,6 +15499,14 @@ func (r V1ListJitAccessResponse) StatusCode() int {
 	return 0
 }
 
+// ContentType is a convenience method to retrieve the Content-Type value from the HTTP response headers
+func (r V1ListJitAccessResponse) ContentType() string {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.Header.Get("Content-Type")
+	}
+	return ""
+}
+
 type V1DeleteJitAccessResponse struct {
 	Body         []byte
 	HTTPResponse *http.Response
@@ -14608,6 +15528,14 @@ func (r V1DeleteJitAccessResponse) StatusCode() int {
 	return 0
 }
 
+// ContentType is a convenience method to retrieve the Content-Type value from the HTTP response headers
+func (r V1DeleteJitAccessResponse) ContentType() string {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.Header.Get("Content-Type")
+	}
+	return ""
+}
+
 type V1RollbackMigrationsResponse struct {
 	Body         []byte
 	HTTPResponse *http.Response
@@ -14629,6 +15557,14 @@ func (r V1RollbackMigrationsResponse) StatusCode() int {
 	return 0
 }
 
+// ContentType is a convenience method to retrieve the Content-Type value from the HTTP response headers
+func (r V1RollbackMigrationsResponse) ContentType() string {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.Header.Get("Content-Type")
+	}
+	return ""
+}
+
 type V1ListMigrationHistoryResponse struct {
 	Body         []byte
 	HTTPResponse *http.Response
@@ -14651,6 +15587,14 @@ func (r V1ListMigrationHistoryResponse) StatusCode() int {
 	return 0
 }
 
+// ContentType is a convenience method to retrieve the Content-Type value from the HTTP response headers
+func (r V1ListMigrationHistoryResponse) ContentType() string {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.Header.Get("Content-Type")
+	}
+	return ""
+}
+
 type V1ApplyAMigrationResponse struct {
 	Body         []byte
 	HTTPResponse *http.Response
@@ -14672,6 +15616,14 @@ func (r V1ApplyAMigrationResponse) StatusCode() int {
 	return 0
 }
 
+// ContentType is a convenience method to retrieve the Content-Type value from the HTTP response headers
+func (r V1ApplyAMigrationResponse) ContentType() string {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.Header.Get("Content-Type")
+	}
+	return ""
+}
+
 type V1UpsertAMigrationResponse struct {
 	Body         []byte
 	HTTPResponse *http.Response
@@ -14693,6 +15645,14 @@ func (r V1UpsertAMigrationResponse) StatusCode() int {
 	return 0
 }
 
+// ContentType is a convenience method to retrieve the Content-Type value from the HTTP response headers
+func (r V1UpsertAMigrationResponse) ContentType() string {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.Header.Get("Content-Type")
+	}
+	return ""
+}
+
 type V1GetAMigrationResponse struct {
 	Body         []byte
 	HTTPResponse *http.Response
@@ -14710,9 +15670,17 @@ func (r V1GetAMigrationResponse) Status() string {
 // StatusCode returns HTTPResponse.StatusCode
 func (r V1GetAMigrationResponse) StatusCode() int {
 	if r.HTTPResponse != nil {
-		return r.HTTPResponse.StatusCode
+		return r.HTTPResponse.StatusCode
+	}
+	return 0
+}
+
+// ContentType is a convenience method to retrieve the Content-Type value from the HTTP response headers
+func (r V1GetAMigrationResponse) ContentType() string {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.Header.Get("Content-Type")
 	}
-	return 0
+	return ""
 }
 
 type V1PatchAMigrationResponse struct {
@@ -14736,6 +15704,14 @@ func (r V1PatchAMigrationResponse) StatusCode() int {
 	return 0
 }
 
+// ContentType is a convenience method to retrieve the Content-Type value from the HTTP response headers
+func (r V1PatchAMigrationResponse) ContentType() string {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.Header.Get("Content-Type")
+	}
+	return ""
+}
+
 type V1GetDatabaseOpenapiResponse struct {
 	Body         []byte
 	HTTPResponse *http.Response
@@ -14758,6 +15734,14 @@ func (r V1GetDatabaseOpenapiResponse) StatusCode() int {
 	return 0
 }
 
+// ContentType is a convenience method to retrieve the Content-Type value from the HTTP response headers
+func (r V1GetDatabaseOpenapiResponse) ContentType() string {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.Header.Get("Content-Type")
+	}
+	return ""
+}
+
 type V1UpdateDatabasePasswordResponse struct {
 	Body         []byte
 	HTTPResponse *http.Response
@@ -14780,6 +15764,14 @@ func (r V1UpdateDatabasePasswordResponse) StatusCode() int {
 	return 0
 }
 
+// ContentType is a convenience method to retrieve the Content-Type value from the HTTP response headers
+func (r V1UpdateDatabasePasswordResponse) ContentType() string {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.Header.Get("Content-Type")
+	}
+	return ""
+}
+
 type V1RunAQueryResponse struct {
 	Body         []byte
 	HTTPResponse *http.Response
@@ -14801,6 +15793,14 @@ func (r V1RunAQueryResponse) StatusCode() int {
 	return 0
 }
 
+// ContentType is a convenience method to retrieve the Content-Type value from the HTTP response headers
+func (r V1RunAQueryResponse) ContentType() string {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.Header.Get("Content-Type")
+	}
+	return ""
+}
+
 type V1ReadOnlyQueryResponse struct {
 	Body         []byte
 	HTTPResponse *http.Response
@@ -14822,6 +15822,14 @@ func (r V1ReadOnlyQueryResponse) StatusCode() int {
 	return 0
 }
 
+// ContentType is a convenience method to retrieve the Content-Type value from the HTTP response headers
+func (r V1ReadOnlyQueryResponse) ContentType() string {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.Header.Get("Content-Type")
+	}
+	return ""
+}
+
 type V1EnableDatabaseWebhookResponse struct {
 	Body         []byte
 	HTTPResponse *http.Response
@@ -14843,6 +15851,14 @@ func (r V1EnableDatabaseWebhookResponse) StatusCode() int {
 	return 0
 }
 
+// ContentType is a convenience method to retrieve the Content-Type value from the HTTP response headers
+func (r V1EnableDatabaseWebhookResponse) ContentType() string {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.Header.Get("Content-Type")
+	}
+	return ""
+}
+
 type V1ListAllFunctionsResponse struct {
 	Body         []byte
 	HTTPResponse *http.Response
@@ -14865,6 +15881,14 @@ func (r V1ListAllFunctionsResponse) StatusCode() int {
 	return 0
 }
 
+// ContentType is a convenience method to retrieve the Content-Type value from the HTTP response headers
+func (r V1ListAllFunctionsResponse) ContentType() string {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.Header.Get("Content-Type")
+	}
+	return ""
+}
+
 type V1CreateAFunctionResponse struct {
 	Body         []byte
 	HTTPResponse *http.Response
@@ -14887,6 +15911,14 @@ func (r V1CreateAFunctionResponse) StatusCode() int {
 	return 0
 }
 
+// ContentType is a convenience method to retrieve the Content-Type value from the HTTP response headers
+func (r V1CreateAFunctionResponse) ContentType() string {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.Header.Get("Content-Type")
+	}
+	return ""
+}
+
 type V1BulkUpdateFunctionsResponse struct {
 	Body         []byte
 	HTTPResponse *http.Response
@@ -14909,6 +15941,14 @@ func (r V1BulkUpdateFunctionsResponse) StatusCode() int {
 	return 0
 }
 
+// ContentType is a convenience method to retrieve the Content-Type value from the HTTP response headers
+func (r V1BulkUpdateFunctionsResponse) ContentType() string {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.Header.Get("Content-Type")
+	}
+	return ""
+}
+
 type V1DeployAFunctionResponse struct {
 	Body         []byte
 	HTTPResponse *http.Response
@@ -14931,6 +15971,14 @@ func (r V1DeployAFunctionResponse) StatusCode() int {
 	return 0
 }
 
+// ContentType is a convenience method to retrieve the Content-Type value from the HTTP response headers
+func (r V1DeployAFunctionResponse) ContentType() string {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.Header.Get("Content-Type")
+	}
+	return ""
+}
+
 type V1DeleteAFunctionResponse struct {
 	Body         []byte
 	HTTPResponse *http.Response
@@ -14952,6 +16000,14 @@ func (r V1DeleteAFunctionResponse) StatusCode() int {
 	return 0
 }
 
+// ContentType is a convenience method to retrieve the Content-Type value from the HTTP response headers
+func (r V1DeleteAFunctionResponse) ContentType() string {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.Header.Get("Content-Type")
+	}
+	return ""
+}
+
 type V1GetAFunctionResponse struct {
 	Body         []byte
 	HTTPResponse *http.Response
@@ -14974,6 +16030,14 @@ func (r V1GetAFunctionResponse) StatusCode() int {
 	return 0
 }
 
+// ContentType is a convenience method to retrieve the Content-Type value from the HTTP response headers
+func (r V1GetAFunctionResponse) ContentType() string {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.Header.Get("Content-Type")
+	}
+	return ""
+}
+
 type V1UpdateAFunctionResponse struct {
 	Body         []byte
 	HTTPResponse *http.Response
@@ -14996,6 +16060,14 @@ func (r V1UpdateAFunctionResponse) StatusCode() int {
 	return 0
 }
 
+// ContentType is a convenience method to retrieve the Content-Type value from the HTTP response headers
+func (r V1UpdateAFunctionResponse) ContentType() string {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.Header.Get("Content-Type")
+	}
+	return ""
+}
+
 type V1GetAFunctionBodyResponse struct {
 	Body         []byte
 	HTTPResponse *http.Response
@@ -15018,6 +16090,14 @@ func (r V1GetAFunctionBodyResponse) StatusCode() int {
 	return 0
 }
 
+// ContentType is a convenience method to retrieve the Content-Type value from the HTTP response headers
+func (r V1GetAFunctionBodyResponse) ContentType() string {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.Header.Get("Content-Type")
+	}
+	return ""
+}
+
 type V1GetServicesHealthResponse struct {
 	Body         []byte
 	HTTPResponse *http.Response
@@ -15040,6 +16120,14 @@ func (r V1GetServicesHealthResponse) StatusCode() int {
 	return 0
 }
 
+// ContentType is a convenience method to retrieve the Content-Type value from the HTTP response headers
+func (r V1GetServicesHealthResponse) ContentType() string {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.Header.Get("Content-Type")
+	}
+	return ""
+}
+
 type V1GetJitAccessConfigResponse struct {
 	Body         []byte
 	HTTPResponse *http.Response
@@ -15062,6 +16150,14 @@ func (r V1GetJitAccessConfigResponse) StatusCode() int {
 	return 0
 }
 
+// ContentType is a convenience method to retrieve the Content-Type value from the HTTP response headers
+func (r V1GetJitAccessConfigResponse) ContentType() string {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.Header.Get("Content-Type")
+	}
+	return ""
+}
+
 type V1UpdateJitAccessConfigResponse struct {
 	Body         []byte
 	HTTPResponse *http.Response
@@ -15084,6 +16180,14 @@ func (r V1UpdateJitAccessConfigResponse) StatusCode() int {
 	return 0
 }
 
+// ContentType is a convenience method to retrieve the Content-Type value from the HTTP response headers
+func (r V1UpdateJitAccessConfigResponse) ContentType() string {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.Header.Get("Content-Type")
+	}
+	return ""
+}
+
 type V1DeleteNetworkBansResponse struct {
 	Body         []byte
 	HTTPResponse *http.Response
@@ -15105,6 +16209,14 @@ func (r V1DeleteNetworkBansResponse) StatusCode() int {
 	return 0
 }
 
+// ContentType is a convenience method to retrieve the Content-Type value from the HTTP response headers
+func (r V1DeleteNetworkBansResponse) ContentType() string {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.Header.Get("Content-Type")
+	}
+	return ""
+}
+
 type V1ListAllNetworkBansResponse struct {
 	Body         []byte
 	HTTPResponse *http.Response
@@ -15127,6 +16239,14 @@ func (r V1ListAllNetworkBansResponse) StatusCode() int {
 	return 0
 }
 
+// ContentType is a convenience method to retrieve the Content-Type value from the HTTP response headers
+func (r V1ListAllNetworkBansResponse) ContentType() string {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.Header.Get("Content-Type")
+	}
+	return ""
+}
+
 type V1ListAllNetworkBansEnrichedResponse struct {
 	Body         []byte
 	HTTPResponse *http.Response
@@ -15149,6 +16269,14 @@ func (r V1ListAllNetworkBansEnrichedResponse) StatusCode() int {
 	return 0
 }
 
+// ContentType is a convenience method to retrieve the Content-Type value from the HTTP response headers
+func (r V1ListAllNetworkBansEnrichedResponse) ContentType() string {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.Header.Get("Content-Type")
+	}
+	return ""
+}
+
 type V1GetNetworkRestrictionsResponse struct {
 	Body         []byte
 	HTTPResponse *http.Response
@@ -15171,6 +16299,14 @@ func (r V1GetNetworkRestrictionsResponse) StatusCode() int {
 	return 0
 }
 
+// ContentType is a convenience method to retrieve the Content-Type value from the HTTP response headers
+func (r V1GetNetworkRestrictionsResponse) ContentType() string {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.Header.Get("Content-Type")
+	}
+	return ""
+}
+
 type V1PatchNetworkRestrictionsResponse struct {
 	Body         []byte
 	HTTPResponse *http.Response
@@ -15193,6 +16329,14 @@ func (r V1PatchNetworkRestrictionsResponse) StatusCode() int {
 	return 0
 }
 
+// ContentType is a convenience method to retrieve the Content-Type value from the HTTP response headers
+func (r V1PatchNetworkRestrictionsResponse) ContentType() string {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.Header.Get("Content-Type")
+	}
+	return ""
+}
+
 type V1UpdateNetworkRestrictionsResponse struct {
 	Body         []byte
 	HTTPResponse *http.Response
@@ -15215,6 +16359,14 @@ func (r V1UpdateNetworkRestrictionsResponse) StatusCode() int {
 	return 0
 }
 
+// ContentType is a convenience method to retrieve the Content-Type value from the HTTP response headers
+func (r V1UpdateNetworkRestrictionsResponse) ContentType() string {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.Header.Get("Content-Type")
+	}
+	return ""
+}
+
 type V1PauseAProjectResponse struct {
 	Body         []byte
 	HTTPResponse *http.Response
@@ -15236,6 +16388,14 @@ func (r V1PauseAProjectResponse) StatusCode() int {
 	return 0
 }
 
+// ContentType is a convenience method to retrieve the Content-Type value from the HTTP response headers
+func (r V1PauseAProjectResponse) ContentType() string {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.Header.Get("Content-Type")
+	}
+	return ""
+}
+
 type V1GetPgsodiumConfigResponse struct {
 	Body         []byte
 	HTTPResponse *http.Response
@@ -15258,6 +16418,14 @@ func (r V1GetPgsodiumConfigResponse) StatusCode() int {
 	return 0
 }
 
+// ContentType is a convenience method to retrieve the Content-Type value from the HTTP response headers
+func (r V1GetPgsodiumConfigResponse) ContentType() string {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.Header.Get("Content-Type")
+	}
+	return ""
+}
+
 type V1UpdatePgsodiumConfigResponse struct {
 	Body         []byte
 	HTTPResponse *http.Response
@@ -15280,6 +16448,14 @@ func (r V1UpdatePgsodiumConfigResponse) StatusCode() int {
 	return 0
 }
 
+// ContentType is a convenience method to retrieve the Content-Type value from the HTTP response headers
+func (r V1UpdatePgsodiumConfigResponse) ContentType() string {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.Header.Get("Content-Type")
+	}
+	return ""
+}
+
 type V1GetPostgrestServiceConfigResponse struct {
 	Body         []byte
 	HTTPResponse *http.Response
@@ -15302,6 +16478,14 @@ func (r V1GetPostgrestServiceConfigResponse) StatusCode() int {
 	return 0
 }
 
+// ContentType is a convenience method to retrieve the Content-Type value from the HTTP response headers
+func (r V1GetPostgrestServiceConfigResponse) ContentType() string {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.Header.Get("Content-Type")
+	}
+	return ""
+}
+
 type V1UpdatePostgrestServiceConfigResponse struct {
 	Body         []byte
 	HTTPResponse *http.Response
@@ -15324,6 +16508,14 @@ func (r V1UpdatePostgrestServiceConfigResponse) StatusCode() int {
 	return 0
 }
 
+// ContentType is a convenience method to retrieve the Content-Type value from the HTTP response headers
+func (r V1UpdatePostgrestServiceConfigResponse) ContentType() string {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.Header.Get("Content-Type")
+	}
+	return ""
+}
+
 type V1RemoveAReadReplicaResponse struct {
 	Body         []byte
 	HTTPResponse *http.Response
@@ -15345,9 +16537,18 @@ func (r V1RemoveAReadReplicaResponse) StatusCode() int {
 	return 0
 }
 
+// ContentType is a convenience method to retrieve the Content-Type value from the HTTP response headers
+func (r V1RemoveAReadReplicaResponse) ContentType() string {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.Header.Get("Content-Type")
+	}
+	return ""
+}
+
 type V1SetupAReadReplicaResponse struct {
 	Body         []byte
 	HTTPResponse *http.Response
+	JSON402      *PlanGateErrorBody
 }
 
 // Status returns HTTPResponse.Status
@@ -15366,6 +16567,14 @@ func (r V1SetupAReadReplicaResponse) StatusCode() int {
 	return 0
 }
 
+// ContentType is a convenience method to retrieve the Content-Type value from the HTTP response headers
+func (r V1SetupAReadReplicaResponse) ContentType() string {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.Header.Get("Content-Type")
+	}
+	return ""
+}
+
 type V1GetReadonlyModeStatusResponse struct {
 	Body         []byte
 	HTTPResponse *http.Response
@@ -15388,6 +16597,14 @@ func (r V1GetReadonlyModeStatusResponse) StatusCode() int {
 	return 0
 }
 
+// ContentType is a convenience method to retrieve the Content-Type value from the HTTP response headers
+func (r V1GetReadonlyModeStatusResponse) ContentType() string {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.Header.Get("Content-Type")
+	}
+	return ""
+}
+
 type V1DisableReadonlyModeTemporarilyResponse struct {
 	Body         []byte
 	HTTPResponse *http.Response
@@ -15409,6 +16626,14 @@ func (r V1DisableReadonlyModeTemporarilyResponse) StatusCode() int {
 	return 0
 }
 
+// ContentType is a convenience method to retrieve the Content-Type value from the HTTP response headers
+func (r V1DisableReadonlyModeTemporarilyResponse) ContentType() string {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.Header.Get("Content-Type")
+	}
+	return ""
+}
+
 type V1RestartAProjectResponse struct {
 	Body         []byte
 	HTTPResponse *http.Response
@@ -15430,6 +16655,14 @@ func (r V1RestartAProjectResponse) StatusCode() int {
 	return 0
 }
 
+// ContentType is a convenience method to retrieve the Content-Type value from the HTTP response headers
+func (r V1RestartAProjectResponse) ContentType() string {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.Header.Get("Content-Type")
+	}
+	return ""
+}
+
 type V1ListAvailableRestoreVersionsResponse struct {
 	Body         []byte
 	HTTPResponse *http.Response
@@ -15452,6 +16685,14 @@ func (r V1ListAvailableRestoreVersionsResponse) StatusCode() int {
 	return 0
 }
 
+// ContentType is a convenience method to retrieve the Content-Type value from the HTTP response headers
+func (r V1ListAvailableRestoreVersionsResponse) ContentType() string {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.Header.Get("Content-Type")
+	}
+	return ""
+}
+
 type V1RestoreAProjectResponse struct {
 	Body         []byte
 	HTTPResponse *http.Response
@@ -15473,6 +16714,14 @@ func (r V1RestoreAProjectResponse) StatusCode() int {
 	return 0
 }
 
+// ContentType is a convenience method to retrieve the Content-Type value from the HTTP response headers
+func (r V1RestoreAProjectResponse) ContentType() string {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.Header.Get("Content-Type")
+	}
+	return ""
+}
+
 type V1CancelAProjectRestorationResponse struct {
 	Body         []byte
 	HTTPResponse *http.Response
@@ -15494,6 +16743,14 @@ func (r V1CancelAProjectRestorationResponse) StatusCode() int {
 	return 0
 }
 
+// ContentType is a convenience method to retrieve the Content-Type value from the HTTP response headers
+func (r V1CancelAProjectRestorationResponse) ContentType() string {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.Header.Get("Content-Type")
+	}
+	return ""
+}
+
 type V1BulkDeleteSecretsResponse struct {
 	Body         []byte
 	HTTPResponse *http.Response
@@ -15515,6 +16772,14 @@ func (r V1BulkDeleteSecretsResponse) StatusCode() int {
 	return 0
 }
 
+// ContentType is a convenience method to retrieve the Content-Type value from the HTTP response headers
+func (r V1BulkDeleteSecretsResponse) ContentType() string {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.Header.Get("Content-Type")
+	}
+	return ""
+}
+
 type V1ListAllSecretsResponse struct {
 	Body         []byte
 	HTTPResponse *http.Response
@@ -15537,6 +16802,14 @@ func (r V1ListAllSecretsResponse) StatusCode() int {
 	return 0
 }
 
+// ContentType is a convenience method to retrieve the Content-Type value from the HTTP response headers
+func (r V1ListAllSecretsResponse) ContentType() string {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.Header.Get("Content-Type")
+	}
+	return ""
+}
+
 type V1BulkCreateSecretsResponse struct {
 	Body         []byte
 	HTTPResponse *http.Response
@@ -15558,6 +16831,14 @@ func (r V1BulkCreateSecretsResponse) StatusCode() int {
 	return 0
 }
 
+// ContentType is a convenience method to retrieve the Content-Type value from the HTTP response headers
+func (r V1BulkCreateSecretsResponse) ContentType() string {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.Header.Get("Content-Type")
+	}
+	return ""
+}
+
 type V1GetSslEnforcementConfigResponse struct {
 	Body         []byte
 	HTTPResponse *http.Response
@@ -15580,6 +16861,14 @@ func (r V1GetSslEnforcementConfigResponse) StatusCode() int {
 	return 0
 }
 
+// ContentType is a convenience method to retrieve the Content-Type value from the HTTP response headers
+func (r V1GetSslEnforcementConfigResponse) ContentType() string {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.Header.Get("Content-Type")
+	}
+	return ""
+}
+
 type V1UpdateSslEnforcementConfigResponse struct {
 	Body         []byte
 	HTTPResponse *http.Response
@@ -15602,6 +16891,14 @@ func (r V1UpdateSslEnforcementConfigResponse) StatusCode() int {
 	return 0
 }
 
+// ContentType is a convenience method to retrieve the Content-Type value from the HTTP response headers
+func (r V1UpdateSslEnforcementConfigResponse) ContentType() string {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.Header.Get("Content-Type")
+	}
+	return ""
+}
+
 type V1ListAllBucketsResponse struct {
 	Body         []byte
 	HTTPResponse *http.Response
@@ -15624,6 +16921,14 @@ func (r V1ListAllBucketsResponse) StatusCode() int {
 	return 0
 }
 
+// ContentType is a convenience method to retrieve the Content-Type value from the HTTP response headers
+func (r V1ListAllBucketsResponse) ContentType() string {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.Header.Get("Content-Type")
+	}
+	return ""
+}
+
 type V1GenerateTypescriptTypesResponse struct {
 	Body         []byte
 	HTTPResponse *http.Response
@@ -15646,6 +16951,14 @@ func (r V1GenerateTypescriptTypesResponse) StatusCode() int {
 	return 0
 }
 
+// ContentType is a convenience method to retrieve the Content-Type value from the HTTP response headers
+func (r V1GenerateTypescriptTypesResponse) ContentType() string {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.Header.Get("Content-Type")
+	}
+	return ""
+}
+
 type V1UpgradePostgresVersionResponse struct {
 	Body         []byte
 	HTTPResponse *http.Response
@@ -15668,6 +16981,14 @@ func (r V1UpgradePostgresVersionResponse) StatusCode() int {
 	return 0
 }
 
+// ContentType is a convenience method to retrieve the Content-Type value from the HTTP response headers
+func (r V1UpgradePostgresVersionResponse) ContentType() string {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.Header.Get("Content-Type")
+	}
+	return ""
+}
+
 type V1GetPostgresUpgradeEligibilityResponse struct {
 	Body         []byte
 	HTTPResponse *http.Response
@@ -15690,6 +17011,14 @@ func (r V1GetPostgresUpgradeEligibilityResponse) StatusCode() int {
 	return 0
 }
 
+// ContentType is a convenience method to retrieve the Content-Type value from the HTTP response headers
+func (r V1GetPostgresUpgradeEligibilityResponse) ContentType() string {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.Header.Get("Content-Type")
+	}
+	return ""
+}
+
 type V1GetPostgresUpgradeStatusResponse struct {
 	Body         []byte
 	HTTPResponse *http.Response
@@ -15712,6 +17041,14 @@ func (r V1GetPostgresUpgradeStatusResponse) StatusCode() int {
 	return 0
 }
 
+// ContentType is a convenience method to retrieve the Content-Type value from the HTTP response headers
+func (r V1GetPostgresUpgradeStatusResponse) ContentType() string {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.Header.Get("Content-Type")
+	}
+	return ""
+}
+
 type V1DeactivateVanitySubdomainConfigResponse struct {
 	Body         []byte
 	HTTPResponse *http.Response
@@ -15733,10 +17070,19 @@ func (r V1DeactivateVanitySubdomainConfigResponse) StatusCode() int {
 	return 0
 }
 
+// ContentType is a convenience method to retrieve the Content-Type value from the HTTP response headers
+func (r V1DeactivateVanitySubdomainConfigResponse) ContentType() string {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.Header.Get("Content-Type")
+	}
+	return ""
+}
+
 type V1GetVanitySubdomainConfigResponse struct {
 	Body         []byte
 	HTTPResponse *http.Response
 	JSON200      *VanitySubdomainConfigResponse
+	JSON400      *PlanGateErrorBody
 }
 
 // Status returns HTTPResponse.Status
@@ -15755,10 +17101,19 @@ func (r V1GetVanitySubdomainConfigResponse) StatusCode() int {
 	return 0
 }
 
+// ContentType is a convenience method to retrieve the Content-Type value from the HTTP response headers
+func (r V1GetVanitySubdomainConfigResponse) ContentType() string {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.Header.Get("Content-Type")
+	}
+	return ""
+}
+
 type V1ActivateVanitySubdomainConfigResponse struct {
 	Body         []byte
 	HTTPResponse *http.Response
 	JSON201      *ActivateVanitySubdomainResponse
+	JSON400      *PlanGateErrorBody
 }
 
 // Status returns HTTPResponse.Status
@@ -15777,10 +17132,19 @@ func (r V1ActivateVanitySubdomainConfigResponse) StatusCode() int {
 	return 0
 }
 
+// ContentType is a convenience method to retrieve the Content-Type value from the HTTP response headers
+func (r V1ActivateVanitySubdomainConfigResponse) ContentType() string {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.Header.Get("Content-Type")
+	}
+	return ""
+}
+
 type V1CheckVanitySubdomainAvailabilityResponse struct {
 	Body         []byte
 	HTTPResponse *http.Response
 	JSON201      *SubdomainAvailabilityResponse
+	JSON400      *PlanGateErrorBody
 }
 
 // Status returns HTTPResponse.Status
@@ -15799,6 +17163,14 @@ func (r V1CheckVanitySubdomainAvailabilityResponse) StatusCode() int {
 	return 0
 }
 
+// ContentType is a convenience method to retrieve the Content-Type value from the HTTP response headers
+func (r V1CheckVanitySubdomainAvailabilityResponse) ContentType() string {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.Header.Get("Content-Type")
+	}
+	return ""
+}
+
 type V1ListAllSnippetsResponse struct {
 	Body         []byte
 	HTTPResponse *http.Response
@@ -15821,6 +17193,14 @@ func (r V1ListAllSnippetsResponse) StatusCode() int {
 	return 0
 }
 
+// ContentType is a convenience method to retrieve the Content-Type value from the HTTP response headers
+func (r V1ListAllSnippetsResponse) ContentType() string {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.Header.Get("Content-Type")
+	}
+	return ""
+}
+
 type V1GetASnippetResponse struct {
 	Body         []byte
 	HTTPResponse *http.Response
@@ -15843,6 +17223,14 @@ func (r V1GetASnippetResponse) StatusCode() int {
 	return 0
 }
 
+// ContentType is a convenience method to retrieve the Content-Type value from the HTTP response headers
+func (r V1GetASnippetResponse) ContentType() string {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.Header.Get("Content-Type")
+	}
+	return ""
+}
+
 // V1DeleteABranchWithResponse request returning *V1DeleteABranchResponse
 func (c *ClientWithResponses) V1DeleteABranchWithResponse(ctx context.Context, branchIdOrRef string, params *V1DeleteABranchParams, reqEditors ...RequestEditorFn) (*V1DeleteABranchResponse, error) {
 	rsp, err := c.V1DeleteABranch(ctx, branchIdOrRef, params, reqEditors...)
@@ -16256,6 +17644,15 @@ func (c *ClientWithResponses) V1GetProjectLogsAllWithResponse(ctx context.Contex
 	return ParseV1GetProjectLogsAllResponse(rsp)
 }
 
+// V1ScrapeProjectMetricsWithResponse request returning *V1ScrapeProjectMetricsResponse
+func (c *ClientWithResponses) V1ScrapeProjectMetricsWithResponse(ctx context.Context, ref string, reqEditors ...RequestEditorFn) (*V1ScrapeProjectMetricsResponse, error) {
+	rsp, err := c.V1ScrapeProjectMetrics(ctx, ref, reqEditors...)
+	if err != nil {
+		return nil, err
+	}
+	return ParseV1ScrapeProjectMetricsResponse(rsp)
+}
+
 // V1GetProjectUsageApiCountWithResponse request returning *V1GetProjectUsageApiCountResponse
 func (c *ClientWithResponses) V1GetProjectUsageApiCountWithResponse(ctx context.Context, ref string, params *V1GetProjectUsageApiCountParams, reqEditors ...RequestEditorFn) (*V1GetProjectUsageApiCountResponse, error) {
 	rsp, err := c.V1GetProjectUsageApiCount(ctx, ref, params, reqEditors...)
@@ -18730,6 +20127,22 @@ func ParseV1GetProjectLogsAllResponse(rsp *http.Response) (*V1GetProjectLogsAllR
 	return response, nil
 }
 
+// ParseV1ScrapeProjectMetricsResponse parses an HTTP response from a V1ScrapeProjectMetricsWithResponse call
+func ParseV1ScrapeProjectMetricsResponse(rsp *http.Response) (*V1ScrapeProjectMetricsResponse, error) {
+	bodyBytes, err := io.ReadAll(rsp.Body)
+	defer func() { _ = rsp.Body.Close() }()
+	if err != nil {
+		return nil, err
+	}
+
+	response := &V1ScrapeProjectMetricsResponse{
+		Body:         bodyBytes,
+		HTTPResponse: rsp,
+	}
+
+	return response, nil
+}
+
 // ParseV1GetProjectUsageApiCountResponse parses an HTTP response from a V1GetProjectUsageApiCountWithResponse call
 func ParseV1GetProjectUsageApiCountResponse(rsp *http.Response) (*V1GetProjectUsageApiCountResponse, error) {
 	bodyBytes, err := io.ReadAll(rsp.Body)
@@ -20279,6 +21692,13 @@ func ParseV1GetBackupScheduleResponse(rsp *http.Response) (*V1GetBackupScheduleR
 		}
 		response.JSON200 = &dest
 
+	case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 402:
+		var dest PlanGateErrorBody
+		if err := json.Unmarshal(bodyBytes, &dest); err != nil {
+			return nil, err
+		}
+		response.JSON402 = &dest
+
 	}
 
 	return response, nil
@@ -20305,6 +21725,13 @@ func ParseV1UpdateBackupScheduleResponse(rsp *http.Response) (*V1UpdateBackupSch
 		}
 		response.JSON200 = &dest
 
+	case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 402:
+		var dest PlanGateErrorBody
+		if err := json.Unmarshal(bodyBytes, &dest); err != nil {
+			return nil, err
+		}
+		response.JSON402 = &dest
+
 	}
 
 	return response, nil
@@ -21327,6 +22754,16 @@ func ParseV1SetupAReadReplicaResponse(rsp *http.Response) (*V1SetupAReadReplicaR
 		HTTPResponse: rsp,
 	}
 
+	switch {
+	case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 402:
+		var dest PlanGateErrorBody
+		if err := json.Unmarshal(bodyBytes, &dest); err != nil {
+			return nil, err
+		}
+		response.JSON402 = &dest
+
+	}
+
 	return response, nil
 }
 
@@ -21723,6 +23160,13 @@ func ParseV1GetVanitySubdomainConfigResponse(rsp *http.Response) (*V1GetVanitySu
 		}
 		response.JSON200 = &dest
 
+	case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 400:
+		var dest PlanGateErrorBody
+		if err := json.Unmarshal(bodyBytes, &dest); err != nil {
+			return nil, err
+		}
+		response.JSON400 = &dest
+
 	}
 
 	return response, nil
@@ -21749,6 +23193,13 @@ func ParseV1ActivateVanitySubdomainConfigResponse(rsp *http.Response) (*V1Activa
 		}
 		response.JSON201 = &dest
 
+	case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 400:
+		var dest PlanGateErrorBody
+		if err := json.Unmarshal(bodyBytes, &dest); err != nil {
+			return nil, err
+		}
+		response.JSON400 = &dest
+
 	}
 
 	return response, nil
@@ -21775,6 +23226,13 @@ func ParseV1CheckVanitySubdomainAvailabilityResponse(rsp *http.Response) (*V1Che
 		}
 		response.JSON201 = &dest
 
+	case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 400:
+		var dest PlanGateErrorBody
+		if err := json.Unmarshal(bodyBytes, &dest); err != nil {
+			return nil, err
+		}
+		response.JSON400 = &dest
+
 	}
 
 	return response, nil
diff --git a/apps/cli-go/pkg/api/types.gen.go b/apps/cli-go/pkg/api/types.gen.go
index 743af52366..315c1560c9 100644
--- a/apps/cli-go/pkg/api/types.gen.go
+++ b/apps/cli-go/pkg/api/types.gen.go
@@ -1,6 +1,6 @@
 // Package api provides primitives to interact with the openapi HTTP API.
 //
-// Code generated by github.com/oapi-codegen/oapi-codegen/v2 version v2.4.1 DO NOT EDIT.
+// Code generated by github.com/oapi-codegen/oapi-codegen/v2 version v2.7.1 DO NOT EDIT.
 package api
 
 import (
@@ -14,9 +14,7 @@ import (
 )
 
 const (
-	BearerScopes          = "bearer.Scopes"
-	Fga_permissionsScopes = "fga_permissions.Scopes"
-	Oauth2Scopes          = "oauth2.Scopes"
+	BearerScopes bearerContextKey = "bearer.Scopes"
 )
 
 // Defines values for ActionRunResponseRunStepsName.
@@ -30,6 +28,28 @@ const (
 	ActionRunResponseRunStepsNameSeed      ActionRunResponseRunStepsName = "seed"
 )
 
+// Valid indicates whether the value is a known member of the ActionRunResponseRunStepsName enum.
+func (e ActionRunResponseRunStepsName) Valid() bool {
+	switch e {
+	case ActionRunResponseRunStepsNameClone:
+		return true
+	case ActionRunResponseRunStepsNameConfigure:
+		return true
+	case ActionRunResponseRunStepsNameDeploy:
+		return true
+	case ActionRunResponseRunStepsNameHealth:
+		return true
+	case ActionRunResponseRunStepsNameMigrate:
+		return true
+	case ActionRunResponseRunStepsNamePull:
+		return true
+	case ActionRunResponseRunStepsNameSeed:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for ActionRunResponseRunStepsStatus.
 const (
 	ActionRunResponseRunStepsStatusCREATED    ActionRunResponseRunStepsStatus = "CREATED"
@@ -41,6 +61,28 @@ const (
 	ActionRunResponseRunStepsStatusRUNNING    ActionRunResponseRunStepsStatus = "RUNNING"
 )
 
+// Valid indicates whether the value is a known member of the ActionRunResponseRunStepsStatus enum.
+func (e ActionRunResponseRunStepsStatus) Valid() bool {
+	switch e {
+	case ActionRunResponseRunStepsStatusCREATED:
+		return true
+	case ActionRunResponseRunStepsStatusDEAD:
+		return true
+	case ActionRunResponseRunStepsStatusEXITED:
+		return true
+	case ActionRunResponseRunStepsStatusPAUSED:
+		return true
+	case ActionRunResponseRunStepsStatusREMOVING:
+		return true
+	case ActionRunResponseRunStepsStatusRESTARTING:
+		return true
+	case ActionRunResponseRunStepsStatusRUNNING:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for ApiKeyResponseType.
 const (
 	ApiKeyResponseTypeLegacy      ApiKeyResponseType = "legacy"
@@ -48,6 +90,20 @@ const (
 	ApiKeyResponseTypeSecret      ApiKeyResponseType = "secret"
 )
 
+// Valid indicates whether the value is a known member of the ApiKeyResponseType enum.
+func (e ApiKeyResponseType) Valid() bool {
+	switch e {
+	case ApiKeyResponseTypeLegacy:
+		return true
+	case ApiKeyResponseTypePublishable:
+		return true
+	case ApiKeyResponseTypeSecret:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for ApplyProjectAddonBodyAddonType.
 const (
 	ApplyProjectAddonBodyAddonTypeAuthMfaPhone    ApplyProjectAddonBodyAddonType = "auth_mfa_phone"
@@ -60,6 +116,30 @@ const (
 	ApplyProjectAddonBodyAddonTypePitr            ApplyProjectAddonBodyAddonType = "pitr"
 )
 
+// Valid indicates whether the value is a known member of the ApplyProjectAddonBodyAddonType enum.
+func (e ApplyProjectAddonBodyAddonType) Valid() bool {
+	switch e {
+	case ApplyProjectAddonBodyAddonTypeAuthMfaPhone:
+		return true
+	case ApplyProjectAddonBodyAddonTypeAuthMfaWebAuthn:
+		return true
+	case ApplyProjectAddonBodyAddonTypeComputeInstance:
+		return true
+	case ApplyProjectAddonBodyAddonTypeCustomDomain:
+		return true
+	case ApplyProjectAddonBodyAddonTypeEtlPipeline:
+		return true
+	case ApplyProjectAddonBodyAddonTypeIpv4:
+		return true
+	case ApplyProjectAddonBodyAddonTypeLogDrain:
+		return true
+	case ApplyProjectAddonBodyAddonTypePitr:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for ApplyProjectAddonBodyAddonVariant0.
 const (
 	ApplyProjectAddonBodyAddonVariant0Ci12xlarge                ApplyProjectAddonBodyAddonVariant0 = "ci_12xlarge"
@@ -82,11 +162,65 @@ const (
 	ApplyProjectAddonBodyAddonVariant0CiXlarge                  ApplyProjectAddonBodyAddonVariant0 = "ci_xlarge"
 )
 
+// Valid indicates whether the value is a known member of the ApplyProjectAddonBodyAddonVariant0 enum.
+func (e ApplyProjectAddonBodyAddonVariant0) Valid() bool {
+	switch e {
+	case ApplyProjectAddonBodyAddonVariant0Ci12xlarge:
+		return true
+	case ApplyProjectAddonBodyAddonVariant0Ci16xlarge:
+		return true
+	case ApplyProjectAddonBodyAddonVariant0Ci24xlarge:
+		return true
+	case ApplyProjectAddonBodyAddonVariant0Ci24xlargeHighMemory:
+		return true
+	case ApplyProjectAddonBodyAddonVariant0Ci24xlargeOptimizedCpu:
+		return true
+	case ApplyProjectAddonBodyAddonVariant0Ci24xlargeOptimizedMemory:
+		return true
+	case ApplyProjectAddonBodyAddonVariant0Ci2xlarge:
+		return true
+	case ApplyProjectAddonBodyAddonVariant0Ci48xlarge:
+		return true
+	case ApplyProjectAddonBodyAddonVariant0Ci48xlargeHighMemory:
+		return true
+	case ApplyProjectAddonBodyAddonVariant0Ci48xlargeOptimizedCpu:
+		return true
+	case ApplyProjectAddonBodyAddonVariant0Ci48xlargeOptimizedMemory:
+		return true
+	case ApplyProjectAddonBodyAddonVariant0Ci4xlarge:
+		return true
+	case ApplyProjectAddonBodyAddonVariant0Ci8xlarge:
+		return true
+	case ApplyProjectAddonBodyAddonVariant0CiLarge:
+		return true
+	case ApplyProjectAddonBodyAddonVariant0CiMedium:
+		return true
+	case ApplyProjectAddonBodyAddonVariant0CiMicro:
+		return true
+	case ApplyProjectAddonBodyAddonVariant0CiSmall:
+		return true
+	case ApplyProjectAddonBodyAddonVariant0CiXlarge:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for ApplyProjectAddonBodyAddonVariant1.
 const (
 	ApplyProjectAddonBodyAddonVariant1CdDefault ApplyProjectAddonBodyAddonVariant1 = "cd_default"
 )
 
+// Valid indicates whether the value is a known member of the ApplyProjectAddonBodyAddonVariant1 enum.
+func (e ApplyProjectAddonBodyAddonVariant1) Valid() bool {
+	switch e {
+	case ApplyProjectAddonBodyAddonVariant1CdDefault:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for ApplyProjectAddonBodyAddonVariant2.
 const (
 	ApplyProjectAddonBodyAddonVariant2Pitr14 ApplyProjectAddonBodyAddonVariant2 = "pitr_14"
@@ -94,17 +228,53 @@ const (
 	ApplyProjectAddonBodyAddonVariant2Pitr7  ApplyProjectAddonBodyAddonVariant2 = "pitr_7"
 )
 
+// Valid indicates whether the value is a known member of the ApplyProjectAddonBodyAddonVariant2 enum.
+func (e ApplyProjectAddonBodyAddonVariant2) Valid() bool {
+	switch e {
+	case ApplyProjectAddonBodyAddonVariant2Pitr14:
+		return true
+	case ApplyProjectAddonBodyAddonVariant2Pitr28:
+		return true
+	case ApplyProjectAddonBodyAddonVariant2Pitr7:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for ApplyProjectAddonBodyAddonVariant3.
 const (
 	ApplyProjectAddonBodyAddonVariant3Ipv4Default ApplyProjectAddonBodyAddonVariant3 = "ipv4_default"
 )
 
+// Valid indicates whether the value is a known member of the ApplyProjectAddonBodyAddonVariant3 enum.
+func (e ApplyProjectAddonBodyAddonVariant3) Valid() bool {
+	switch e {
+	case ApplyProjectAddonBodyAddonVariant3Ipv4Default:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for AuthConfigResponseDbMaxPoolSizeUnit.
 const (
 	AuthConfigResponseDbMaxPoolSizeUnitConnections AuthConfigResponseDbMaxPoolSizeUnit = "connections"
 	AuthConfigResponseDbMaxPoolSizeUnitPercent     AuthConfigResponseDbMaxPoolSizeUnit = "percent"
 )
 
+// Valid indicates whether the value is a known member of the AuthConfigResponseDbMaxPoolSizeUnit enum.
+func (e AuthConfigResponseDbMaxPoolSizeUnit) Valid() bool {
+	switch e {
+	case AuthConfigResponseDbMaxPoolSizeUnitConnections:
+		return true
+	case AuthConfigResponseDbMaxPoolSizeUnitPercent:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for AuthConfigResponsePasswordRequiredCharacters.
 const (
 	AuthConfigResponsePasswordRequiredCharactersAbcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789  AuthConfigResponsePasswordRequiredCharacters = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ:0123456789"
@@ -113,12 +283,40 @@ const (
 	AuthConfigResponsePasswordRequiredCharactersEmpty                                                           AuthConfigResponsePasswordRequiredCharacters = ""
 )
 
+// Valid indicates whether the value is a known member of the AuthConfigResponsePasswordRequiredCharacters enum.
+func (e AuthConfigResponsePasswordRequiredCharacters) Valid() bool {
+	switch e {
+	case AuthConfigResponsePasswordRequiredCharactersAbcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789:
+		return true
+	case AuthConfigResponsePasswordRequiredCharactersAbcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ01234567891:
+		return true
+	case AuthConfigResponsePasswordRequiredCharactersAbcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ01234567892:
+		return true
+	case AuthConfigResponsePasswordRequiredCharactersEmpty:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for AuthConfigResponseSecurityCaptchaProvider.
 const (
 	AuthConfigResponseSecurityCaptchaProviderHcaptcha  AuthConfigResponseSecurityCaptchaProvider = "hcaptcha"
 	AuthConfigResponseSecurityCaptchaProviderTurnstile AuthConfigResponseSecurityCaptchaProvider = "turnstile"
 )
 
+// Valid indicates whether the value is a known member of the AuthConfigResponseSecurityCaptchaProvider enum.
+func (e AuthConfigResponseSecurityCaptchaProvider) Valid() bool {
+	switch e {
+	case AuthConfigResponseSecurityCaptchaProviderHcaptcha:
+		return true
+	case AuthConfigResponseSecurityCaptchaProviderTurnstile:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for AuthConfigResponseSmsProvider.
 const (
 	AuthConfigResponseSmsProviderMessagebird  AuthConfigResponseSmsProvider = "messagebird"
@@ -128,11 +326,39 @@ const (
 	AuthConfigResponseSmsProviderVonage       AuthConfigResponseSmsProvider = "vonage"
 )
 
+// Valid indicates whether the value is a known member of the AuthConfigResponseSmsProvider enum.
+func (e AuthConfigResponseSmsProvider) Valid() bool {
+	switch e {
+	case AuthConfigResponseSmsProviderMessagebird:
+		return true
+	case AuthConfigResponseSmsProviderTextlocal:
+		return true
+	case AuthConfigResponseSmsProviderTwilio:
+		return true
+	case AuthConfigResponseSmsProviderTwilioVerify:
+		return true
+	case AuthConfigResponseSmsProviderVonage:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for BranchDeleteResponseMessage.
 const (
 	BranchDeleteResponseMessageOk BranchDeleteResponseMessage = "ok"
 )
 
+// Valid indicates whether the value is a known member of the BranchDeleteResponseMessage enum.
+func (e BranchDeleteResponseMessage) Valid() bool {
+	switch e {
+	case BranchDeleteResponseMessageOk:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for BranchDetailResponseStatus.
 const (
 	BranchDetailResponseStatusACTIVEHEALTHY   BranchDetailResponseStatus = "ACTIVE_HEALTHY"
@@ -152,6 +378,44 @@ const (
 	BranchDetailResponseStatusUPGRADING       BranchDetailResponseStatus = "UPGRADING"
 )
 
+// Valid indicates whether the value is a known member of the BranchDetailResponseStatus enum.
+func (e BranchDetailResponseStatus) Valid() bool {
+	switch e {
+	case BranchDetailResponseStatusACTIVEHEALTHY:
+		return true
+	case BranchDetailResponseStatusACTIVEUNHEALTHY:
+		return true
+	case BranchDetailResponseStatusCOMINGUP:
+		return true
+	case BranchDetailResponseStatusGOINGDOWN:
+		return true
+	case BranchDetailResponseStatusINACTIVE:
+		return true
+	case BranchDetailResponseStatusINITFAILED:
+		return true
+	case BranchDetailResponseStatusPAUSEFAILED:
+		return true
+	case BranchDetailResponseStatusPAUSING:
+		return true
+	case BranchDetailResponseStatusREMOVED:
+		return true
+	case BranchDetailResponseStatusRESIZING:
+		return true
+	case BranchDetailResponseStatusRESTARTING:
+		return true
+	case BranchDetailResponseStatusRESTOREFAILED:
+		return true
+	case BranchDetailResponseStatusRESTORING:
+		return true
+	case BranchDetailResponseStatusUNKNOWN:
+		return true
+	case BranchDetailResponseStatusUPGRADING:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for BranchResponsePreviewProjectStatus.
 const (
 	BranchResponsePreviewProjectStatusACTIVEHEALTHY   BranchResponsePreviewProjectStatus = "ACTIVE_HEALTHY"
@@ -171,6 +435,44 @@ const (
 	BranchResponsePreviewProjectStatusUPGRADING       BranchResponsePreviewProjectStatus = "UPGRADING"
 )
 
+// Valid indicates whether the value is a known member of the BranchResponsePreviewProjectStatus enum.
+func (e BranchResponsePreviewProjectStatus) Valid() bool {
+	switch e {
+	case BranchResponsePreviewProjectStatusACTIVEHEALTHY:
+		return true
+	case BranchResponsePreviewProjectStatusACTIVEUNHEALTHY:
+		return true
+	case BranchResponsePreviewProjectStatusCOMINGUP:
+		return true
+	case BranchResponsePreviewProjectStatusGOINGDOWN:
+		return true
+	case BranchResponsePreviewProjectStatusINACTIVE:
+		return true
+	case BranchResponsePreviewProjectStatusINITFAILED:
+		return true
+	case BranchResponsePreviewProjectStatusPAUSEFAILED:
+		return true
+	case BranchResponsePreviewProjectStatusPAUSING:
+		return true
+	case BranchResponsePreviewProjectStatusREMOVED:
+		return true
+	case BranchResponsePreviewProjectStatusRESIZING:
+		return true
+	case BranchResponsePreviewProjectStatusRESTARTING:
+		return true
+	case BranchResponsePreviewProjectStatusRESTOREFAILED:
+		return true
+	case BranchResponsePreviewProjectStatusRESTORING:
+		return true
+	case BranchResponsePreviewProjectStatusUNKNOWN:
+		return true
+	case BranchResponsePreviewProjectStatusUPGRADING:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for BranchResponseStatus.
 const (
 	BranchResponseStatusCREATINGPROJECT   BranchResponseStatus = "CREATING_PROJECT"
@@ -181,16 +483,56 @@ const (
 	BranchResponseStatusRUNNINGMIGRATIONS BranchResponseStatus = "RUNNING_MIGRATIONS"
 )
 
+// Valid indicates whether the value is a known member of the BranchResponseStatus enum.
+func (e BranchResponseStatus) Valid() bool {
+	switch e {
+	case BranchResponseStatusCREATINGPROJECT:
+		return true
+	case BranchResponseStatusFUNCTIONSDEPLOYED:
+		return true
+	case BranchResponseStatusFUNCTIONSFAILED:
+		return true
+	case BranchResponseStatusMIGRATIONSFAILED:
+		return true
+	case BranchResponseStatusMIGRATIONSPASSED:
+		return true
+	case BranchResponseStatusRUNNINGMIGRATIONS:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for BranchRestoreResponseMessage.
 const (
 	BranchRestorationInitiated BranchRestoreResponseMessage = "Branch restoration initiated"
 )
 
+// Valid indicates whether the value is a known member of the BranchRestoreResponseMessage enum.
+func (e BranchRestoreResponseMessage) Valid() bool {
+	switch e {
+	case BranchRestorationInitiated:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for BranchUpdateResponseMessage.
 const (
 	BranchUpdateResponseMessageOk BranchUpdateResponseMessage = "ok"
 )
 
+// Valid indicates whether the value is a known member of the BranchUpdateResponseMessage enum.
+func (e BranchUpdateResponseMessage) Valid() bool {
+	switch e {
+	case BranchUpdateResponseMessageOk:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for BulkUpdateFunctionBodyStatus.
 const (
 	BulkUpdateFunctionBodyStatusACTIVE    BulkUpdateFunctionBodyStatus = "ACTIVE"
@@ -198,6 +540,20 @@ const (
 	BulkUpdateFunctionBodyStatusTHROTTLED BulkUpdateFunctionBodyStatus = "THROTTLED"
 )
 
+// Valid indicates whether the value is a known member of the BulkUpdateFunctionBodyStatus enum.
+func (e BulkUpdateFunctionBodyStatus) Valid() bool {
+	switch e {
+	case BulkUpdateFunctionBodyStatusACTIVE:
+		return true
+	case BulkUpdateFunctionBodyStatusREMOVED:
+		return true
+	case BulkUpdateFunctionBodyStatusTHROTTLED:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for BulkUpdateFunctionResponseFunctionsStatus.
 const (
 	BulkUpdateFunctionResponseFunctionsStatusACTIVE    BulkUpdateFunctionResponseFunctionsStatus = "ACTIVE"
@@ -205,12 +561,38 @@ const (
 	BulkUpdateFunctionResponseFunctionsStatusTHROTTLED BulkUpdateFunctionResponseFunctionsStatus = "THROTTLED"
 )
 
+// Valid indicates whether the value is a known member of the BulkUpdateFunctionResponseFunctionsStatus enum.
+func (e BulkUpdateFunctionResponseFunctionsStatus) Valid() bool {
+	switch e {
+	case BulkUpdateFunctionResponseFunctionsStatusACTIVE:
+		return true
+	case BulkUpdateFunctionResponseFunctionsStatusREMOVED:
+		return true
+	case BulkUpdateFunctionResponseFunctionsStatusTHROTTLED:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for CreateApiKeyBodyType.
 const (
 	CreateApiKeyBodyTypePublishable CreateApiKeyBodyType = "publishable"
 	CreateApiKeyBodyTypeSecret      CreateApiKeyBodyType = "secret"
 )
 
+// Valid indicates whether the value is a known member of the CreateApiKeyBodyType enum.
+func (e CreateApiKeyBodyType) Valid() bool {
+	switch e {
+	case CreateApiKeyBodyTypePublishable:
+		return true
+	case CreateApiKeyBodyTypeSecret:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for CreateBranchBodyDesiredInstanceSize.
 const (
 	CreateBranchBodyDesiredInstanceSizeLarge                    CreateBranchBodyDesiredInstanceSize = "large"
@@ -235,6 +617,54 @@ const (
 	CreateBranchBodyDesiredInstanceSizeXlarge                   CreateBranchBodyDesiredInstanceSize = "xlarge"
 )
 
+// Valid indicates whether the value is a known member of the CreateBranchBodyDesiredInstanceSize enum.
+func (e CreateBranchBodyDesiredInstanceSize) Valid() bool {
+	switch e {
+	case CreateBranchBodyDesiredInstanceSizeLarge:
+		return true
+	case CreateBranchBodyDesiredInstanceSizeMedium:
+		return true
+	case CreateBranchBodyDesiredInstanceSizeMicro:
+		return true
+	case CreateBranchBodyDesiredInstanceSizeN12xlarge:
+		return true
+	case CreateBranchBodyDesiredInstanceSizeN16xlarge:
+		return true
+	case CreateBranchBodyDesiredInstanceSizeN24xlarge:
+		return true
+	case CreateBranchBodyDesiredInstanceSizeN24xlargeHighMemory:
+		return true
+	case CreateBranchBodyDesiredInstanceSizeN24xlargeOptimizedCpu:
+		return true
+	case CreateBranchBodyDesiredInstanceSizeN24xlargeOptimizedMemory:
+		return true
+	case CreateBranchBodyDesiredInstanceSizeN2xlarge:
+		return true
+	case CreateBranchBodyDesiredInstanceSizeN48xlarge:
+		return true
+	case CreateBranchBodyDesiredInstanceSizeN48xlargeHighMemory:
+		return true
+	case CreateBranchBodyDesiredInstanceSizeN48xlargeOptimizedCpu:
+		return true
+	case CreateBranchBodyDesiredInstanceSizeN48xlargeOptimizedMemory:
+		return true
+	case CreateBranchBodyDesiredInstanceSizeN4xlarge:
+		return true
+	case CreateBranchBodyDesiredInstanceSizeN8xlarge:
+		return true
+	case CreateBranchBodyDesiredInstanceSizeNano:
+		return true
+	case CreateBranchBodyDesiredInstanceSizePico:
+		return true
+	case CreateBranchBodyDesiredInstanceSizeSmall:
+		return true
+	case CreateBranchBodyDesiredInstanceSizeXlarge:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for CreateBranchBodyPostgresEngine.
 const (
 	CreateBranchBodyPostgresEngineN15       CreateBranchBodyPostgresEngine = "15"
@@ -242,6 +672,20 @@ const (
 	CreateBranchBodyPostgresEngineN17Oriole CreateBranchBodyPostgresEngine = "17-oriole"
 )
 
+// Valid indicates whether the value is a known member of the CreateBranchBodyPostgresEngine enum.
+func (e CreateBranchBodyPostgresEngine) Valid() bool {
+	switch e {
+	case CreateBranchBodyPostgresEngineN15:
+		return true
+	case CreateBranchBodyPostgresEngineN17:
+		return true
+	case CreateBranchBodyPostgresEngineN17Oriole:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for CreateBranchBodyReleaseChannel.
 const (
 	CreateBranchBodyReleaseChannelAlpha     CreateBranchBodyReleaseChannel = "alpha"
@@ -252,6 +696,26 @@ const (
 	CreateBranchBodyReleaseChannelWithdrawn CreateBranchBodyReleaseChannel = "withdrawn"
 )
 
+// Valid indicates whether the value is a known member of the CreateBranchBodyReleaseChannel enum.
+func (e CreateBranchBodyReleaseChannel) Valid() bool {
+	switch e {
+	case CreateBranchBodyReleaseChannelAlpha:
+		return true
+	case CreateBranchBodyReleaseChannelBeta:
+		return true
+	case CreateBranchBodyReleaseChannelGa:
+		return true
+	case CreateBranchBodyReleaseChannelInternal:
+		return true
+	case CreateBranchBodyReleaseChannelPreview:
+		return true
+	case CreateBranchBodyReleaseChannelWithdrawn:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for CreateProviderBodyNameIdFormat.
 const (
 	CreateProviderBodyNameIdFormatUrnOasisNamesTcSAML11NameidFormatEmailAddress CreateProviderBodyNameIdFormat = "urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"
@@ -260,11 +724,37 @@ const (
 	CreateProviderBodyNameIdFormatUrnOasisNamesTcSAML20NameidFormatTransient    CreateProviderBodyNameIdFormat = "urn:oasis:names:tc:SAML:2.0:nameid-format:transient"
 )
 
+// Valid indicates whether the value is a known member of the CreateProviderBodyNameIdFormat enum.
+func (e CreateProviderBodyNameIdFormat) Valid() bool {
+	switch e {
+	case CreateProviderBodyNameIdFormatUrnOasisNamesTcSAML11NameidFormatEmailAddress:
+		return true
+	case CreateProviderBodyNameIdFormatUrnOasisNamesTcSAML11NameidFormatUnspecified:
+		return true
+	case CreateProviderBodyNameIdFormatUrnOasisNamesTcSAML20NameidFormatPersistent:
+		return true
+	case CreateProviderBodyNameIdFormatUrnOasisNamesTcSAML20NameidFormatTransient:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for CreateProviderBodyType.
 const (
 	Saml CreateProviderBodyType = "saml"
 )
 
+// Valid indicates whether the value is a known member of the CreateProviderBodyType enum.
+func (e CreateProviderBodyType) Valid() bool {
+	switch e {
+	case Saml:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for CreateSigningKeyBodyAlgorithm.
 const (
 	CreateSigningKeyBodyAlgorithmES256 CreateSigningKeyBodyAlgorithm = "ES256"
@@ -273,131 +763,397 @@ const (
 	CreateSigningKeyBodyAlgorithmRS256 CreateSigningKeyBodyAlgorithm = "RS256"
 )
 
+// Valid indicates whether the value is a known member of the CreateSigningKeyBodyAlgorithm enum.
+func (e CreateSigningKeyBodyAlgorithm) Valid() bool {
+	switch e {
+	case CreateSigningKeyBodyAlgorithmES256:
+		return true
+	case CreateSigningKeyBodyAlgorithmEdDSA:
+		return true
+	case CreateSigningKeyBodyAlgorithmHS256:
+		return true
+	case CreateSigningKeyBodyAlgorithmRS256:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for CreateSigningKeyBodyPrivateJwk0Alg.
 const (
 	CreateSigningKeyBodyPrivateJwk0AlgRS256 CreateSigningKeyBodyPrivateJwk0Alg = "RS256"
 )
 
+// Valid indicates whether the value is a known member of the CreateSigningKeyBodyPrivateJwk0Alg enum.
+func (e CreateSigningKeyBodyPrivateJwk0Alg) Valid() bool {
+	switch e {
+	case CreateSigningKeyBodyPrivateJwk0AlgRS256:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for CreateSigningKeyBodyPrivateJwk0E.
 const (
 	AQAB CreateSigningKeyBodyPrivateJwk0E = "AQAB"
 )
 
+// Valid indicates whether the value is a known member of the CreateSigningKeyBodyPrivateJwk0E enum.
+func (e CreateSigningKeyBodyPrivateJwk0E) Valid() bool {
+	switch e {
+	case AQAB:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for CreateSigningKeyBodyPrivateJwk0Ext.
 const (
 	CreateSigningKeyBodyPrivateJwk0ExtTrue CreateSigningKeyBodyPrivateJwk0Ext = true
 )
 
+// Valid indicates whether the value is a known member of the CreateSigningKeyBodyPrivateJwk0Ext enum.
+func (e CreateSigningKeyBodyPrivateJwk0Ext) Valid() bool {
+	switch e {
+	case CreateSigningKeyBodyPrivateJwk0ExtTrue:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for CreateSigningKeyBodyPrivateJwk0KeyOps.
 const (
 	CreateSigningKeyBodyPrivateJwk0KeyOpsSign   CreateSigningKeyBodyPrivateJwk0KeyOps = "sign"
 	CreateSigningKeyBodyPrivateJwk0KeyOpsVerify CreateSigningKeyBodyPrivateJwk0KeyOps = "verify"
 )
 
+// Valid indicates whether the value is a known member of the CreateSigningKeyBodyPrivateJwk0KeyOps enum.
+func (e CreateSigningKeyBodyPrivateJwk0KeyOps) Valid() bool {
+	switch e {
+	case CreateSigningKeyBodyPrivateJwk0KeyOpsSign:
+		return true
+	case CreateSigningKeyBodyPrivateJwk0KeyOpsVerify:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for CreateSigningKeyBodyPrivateJwk0Kty.
 const (
 	RSA CreateSigningKeyBodyPrivateJwk0Kty = "RSA"
 )
 
+// Valid indicates whether the value is a known member of the CreateSigningKeyBodyPrivateJwk0Kty enum.
+func (e CreateSigningKeyBodyPrivateJwk0Kty) Valid() bool {
+	switch e {
+	case RSA:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for CreateSigningKeyBodyPrivateJwk0Use.
 const (
 	CreateSigningKeyBodyPrivateJwk0UseSig CreateSigningKeyBodyPrivateJwk0Use = "sig"
 )
 
+// Valid indicates whether the value is a known member of the CreateSigningKeyBodyPrivateJwk0Use enum.
+func (e CreateSigningKeyBodyPrivateJwk0Use) Valid() bool {
+	switch e {
+	case CreateSigningKeyBodyPrivateJwk0UseSig:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for CreateSigningKeyBodyPrivateJwk1Alg.
 const (
 	CreateSigningKeyBodyPrivateJwk1AlgES256 CreateSigningKeyBodyPrivateJwk1Alg = "ES256"
 )
 
+// Valid indicates whether the value is a known member of the CreateSigningKeyBodyPrivateJwk1Alg enum.
+func (e CreateSigningKeyBodyPrivateJwk1Alg) Valid() bool {
+	switch e {
+	case CreateSigningKeyBodyPrivateJwk1AlgES256:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for CreateSigningKeyBodyPrivateJwk1Crv.
 const (
 	P256 CreateSigningKeyBodyPrivateJwk1Crv = "P-256"
 )
 
+// Valid indicates whether the value is a known member of the CreateSigningKeyBodyPrivateJwk1Crv enum.
+func (e CreateSigningKeyBodyPrivateJwk1Crv) Valid() bool {
+	switch e {
+	case P256:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for CreateSigningKeyBodyPrivateJwk1Ext.
 const (
 	CreateSigningKeyBodyPrivateJwk1ExtTrue CreateSigningKeyBodyPrivateJwk1Ext = true
 )
 
+// Valid indicates whether the value is a known member of the CreateSigningKeyBodyPrivateJwk1Ext enum.
+func (e CreateSigningKeyBodyPrivateJwk1Ext) Valid() bool {
+	switch e {
+	case CreateSigningKeyBodyPrivateJwk1ExtTrue:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for CreateSigningKeyBodyPrivateJwk1KeyOps.
 const (
 	CreateSigningKeyBodyPrivateJwk1KeyOpsSign   CreateSigningKeyBodyPrivateJwk1KeyOps = "sign"
 	CreateSigningKeyBodyPrivateJwk1KeyOpsVerify CreateSigningKeyBodyPrivateJwk1KeyOps = "verify"
 )
 
+// Valid indicates whether the value is a known member of the CreateSigningKeyBodyPrivateJwk1KeyOps enum.
+func (e CreateSigningKeyBodyPrivateJwk1KeyOps) Valid() bool {
+	switch e {
+	case CreateSigningKeyBodyPrivateJwk1KeyOpsSign:
+		return true
+	case CreateSigningKeyBodyPrivateJwk1KeyOpsVerify:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for CreateSigningKeyBodyPrivateJwk1Kty.
 const (
 	EC CreateSigningKeyBodyPrivateJwk1Kty = "EC"
 )
 
+// Valid indicates whether the value is a known member of the CreateSigningKeyBodyPrivateJwk1Kty enum.
+func (e CreateSigningKeyBodyPrivateJwk1Kty) Valid() bool {
+	switch e {
+	case EC:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for CreateSigningKeyBodyPrivateJwk1Use.
 const (
 	CreateSigningKeyBodyPrivateJwk1UseSig CreateSigningKeyBodyPrivateJwk1Use = "sig"
 )
 
+// Valid indicates whether the value is a known member of the CreateSigningKeyBodyPrivateJwk1Use enum.
+func (e CreateSigningKeyBodyPrivateJwk1Use) Valid() bool {
+	switch e {
+	case CreateSigningKeyBodyPrivateJwk1UseSig:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for CreateSigningKeyBodyPrivateJwk2Alg.
 const (
 	CreateSigningKeyBodyPrivateJwk2AlgEdDSA CreateSigningKeyBodyPrivateJwk2Alg = "EdDSA"
 )
 
+// Valid indicates whether the value is a known member of the CreateSigningKeyBodyPrivateJwk2Alg enum.
+func (e CreateSigningKeyBodyPrivateJwk2Alg) Valid() bool {
+	switch e {
+	case CreateSigningKeyBodyPrivateJwk2AlgEdDSA:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for CreateSigningKeyBodyPrivateJwk2Crv.
 const (
 	Ed25519 CreateSigningKeyBodyPrivateJwk2Crv = "Ed25519"
 )
 
+// Valid indicates whether the value is a known member of the CreateSigningKeyBodyPrivateJwk2Crv enum.
+func (e CreateSigningKeyBodyPrivateJwk2Crv) Valid() bool {
+	switch e {
+	case Ed25519:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for CreateSigningKeyBodyPrivateJwk2Ext.
 const (
 	CreateSigningKeyBodyPrivateJwk2ExtTrue CreateSigningKeyBodyPrivateJwk2Ext = true
 )
 
+// Valid indicates whether the value is a known member of the CreateSigningKeyBodyPrivateJwk2Ext enum.
+func (e CreateSigningKeyBodyPrivateJwk2Ext) Valid() bool {
+	switch e {
+	case CreateSigningKeyBodyPrivateJwk2ExtTrue:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for CreateSigningKeyBodyPrivateJwk2KeyOps.
 const (
 	CreateSigningKeyBodyPrivateJwk2KeyOpsSign   CreateSigningKeyBodyPrivateJwk2KeyOps = "sign"
 	CreateSigningKeyBodyPrivateJwk2KeyOpsVerify CreateSigningKeyBodyPrivateJwk2KeyOps = "verify"
 )
 
+// Valid indicates whether the value is a known member of the CreateSigningKeyBodyPrivateJwk2KeyOps enum.
+func (e CreateSigningKeyBodyPrivateJwk2KeyOps) Valid() bool {
+	switch e {
+	case CreateSigningKeyBodyPrivateJwk2KeyOpsSign:
+		return true
+	case CreateSigningKeyBodyPrivateJwk2KeyOpsVerify:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for CreateSigningKeyBodyPrivateJwk2Kty.
 const (
 	OKP CreateSigningKeyBodyPrivateJwk2Kty = "OKP"
 )
 
+// Valid indicates whether the value is a known member of the CreateSigningKeyBodyPrivateJwk2Kty enum.
+func (e CreateSigningKeyBodyPrivateJwk2Kty) Valid() bool {
+	switch e {
+	case OKP:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for CreateSigningKeyBodyPrivateJwk2Use.
 const (
 	CreateSigningKeyBodyPrivateJwk2UseSig CreateSigningKeyBodyPrivateJwk2Use = "sig"
 )
 
+// Valid indicates whether the value is a known member of the CreateSigningKeyBodyPrivateJwk2Use enum.
+func (e CreateSigningKeyBodyPrivateJwk2Use) Valid() bool {
+	switch e {
+	case CreateSigningKeyBodyPrivateJwk2UseSig:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for CreateSigningKeyBodyPrivateJwk3Alg.
 const (
 	HS256 CreateSigningKeyBodyPrivateJwk3Alg = "HS256"
 )
 
+// Valid indicates whether the value is a known member of the CreateSigningKeyBodyPrivateJwk3Alg enum.
+func (e CreateSigningKeyBodyPrivateJwk3Alg) Valid() bool {
+	switch e {
+	case HS256:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for CreateSigningKeyBodyPrivateJwk3Ext.
 const (
 	CreateSigningKeyBodyPrivateJwk3ExtTrue CreateSigningKeyBodyPrivateJwk3Ext = true
 )
 
+// Valid indicates whether the value is a known member of the CreateSigningKeyBodyPrivateJwk3Ext enum.
+func (e CreateSigningKeyBodyPrivateJwk3Ext) Valid() bool {
+	switch e {
+	case CreateSigningKeyBodyPrivateJwk3ExtTrue:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for CreateSigningKeyBodyPrivateJwk3KeyOps.
 const (
 	CreateSigningKeyBodyPrivateJwk3KeyOpsSign   CreateSigningKeyBodyPrivateJwk3KeyOps = "sign"
 	CreateSigningKeyBodyPrivateJwk3KeyOpsVerify CreateSigningKeyBodyPrivateJwk3KeyOps = "verify"
 )
 
+// Valid indicates whether the value is a known member of the CreateSigningKeyBodyPrivateJwk3KeyOps enum.
+func (e CreateSigningKeyBodyPrivateJwk3KeyOps) Valid() bool {
+	switch e {
+	case CreateSigningKeyBodyPrivateJwk3KeyOpsSign:
+		return true
+	case CreateSigningKeyBodyPrivateJwk3KeyOpsVerify:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for CreateSigningKeyBodyPrivateJwk3Kty.
 const (
 	Oct CreateSigningKeyBodyPrivateJwk3Kty = "oct"
 )
 
+// Valid indicates whether the value is a known member of the CreateSigningKeyBodyPrivateJwk3Kty enum.
+func (e CreateSigningKeyBodyPrivateJwk3Kty) Valid() bool {
+	switch e {
+	case Oct:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for CreateSigningKeyBodyPrivateJwk3Use.
 const (
 	CreateSigningKeyBodyPrivateJwk3UseSig CreateSigningKeyBodyPrivateJwk3Use = "sig"
 )
 
+// Valid indicates whether the value is a known member of the CreateSigningKeyBodyPrivateJwk3Use enum.
+func (e CreateSigningKeyBodyPrivateJwk3Use) Valid() bool {
+	switch e {
+	case CreateSigningKeyBodyPrivateJwk3UseSig:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for CreateSigningKeyBodyStatus.
 const (
 	CreateSigningKeyBodyStatusInUse   CreateSigningKeyBodyStatus = "in_use"
 	CreateSigningKeyBodyStatusStandby CreateSigningKeyBodyStatus = "standby"
 )
 
+// Valid indicates whether the value is a known member of the CreateSigningKeyBodyStatus enum.
+func (e CreateSigningKeyBodyStatus) Valid() bool {
+	switch e {
+	case CreateSigningKeyBodyStatusInUse:
+		return true
+	case CreateSigningKeyBodyStatusStandby:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for DatabaseUpgradeStatusResponseDatabaseUpgradeStatusError.
 const (
 	N1UpgradedInstanceLaunchFailed                 DatabaseUpgradeStatusResponseDatabaseUpgradeStatusError = "1_upgraded_instance_launch_failed"
@@ -411,6 +1167,32 @@ const (
 	N9PostPhysicalBackupFailed                     DatabaseUpgradeStatusResponseDatabaseUpgradeStatusError = "9_post_physical_backup_failed"
 )
 
+// Valid indicates whether the value is a known member of the DatabaseUpgradeStatusResponseDatabaseUpgradeStatusError enum.
+func (e DatabaseUpgradeStatusResponseDatabaseUpgradeStatusError) Valid() bool {
+	switch e {
+	case N1UpgradedInstanceLaunchFailed:
+		return true
+	case N2VolumeDetachchmentFromUpgradedInstanceFailed:
+		return true
+	case N3VolumeAttachmentToOriginalInstanceFailed:
+		return true
+	case N4DataUpgradeInitiationFailed:
+		return true
+	case N5DataUpgradeCompletionFailed:
+		return true
+	case N6VolumeDetachchmentFromOriginalInstanceFailed:
+		return true
+	case N7VolumeAttachmentToUpgradedInstanceFailed:
+		return true
+	case N8UpgradeCompletionFailed:
+		return true
+	case N9PostPhysicalBackupFailed:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for DatabaseUpgradeStatusResponseDatabaseUpgradeStatusProgress.
 const (
 	N0Requested                          DatabaseUpgradeStatusResponseDatabaseUpgradeStatusProgress = "0_requested"
@@ -426,11 +1208,51 @@ const (
 	N9CompletedUpgrade                   DatabaseUpgradeStatusResponseDatabaseUpgradeStatusProgress = "9_completed_upgrade"
 )
 
+// Valid indicates whether the value is a known member of the DatabaseUpgradeStatusResponseDatabaseUpgradeStatusProgress enum.
+func (e DatabaseUpgradeStatusResponseDatabaseUpgradeStatusProgress) Valid() bool {
+	switch e {
+	case N0Requested:
+		return true
+	case N10CompletedPostPhysicalBackup:
+		return true
+	case N1Started:
+		return true
+	case N2LaunchedUpgradedInstance:
+		return true
+	case N3DetachedVolumeFromUpgradedInstance:
+		return true
+	case N4AttachedVolumeToOriginalInstance:
+		return true
+	case N5InitiatedDataUpgrade:
+		return true
+	case N6CompletedDataUpgrade:
+		return true
+	case N7DetachedVolumeFromOriginalInstance:
+		return true
+	case N8AttachedVolumeToUpgradedInstance:
+		return true
+	case N9CompletedUpgrade:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for DeleteRolesResponseMessage.
 const (
 	DeleteRolesResponseMessageOk DeleteRolesResponseMessage = "ok"
 )
 
+// Valid indicates whether the value is a known member of the DeleteRolesResponseMessage enum.
+func (e DeleteRolesResponseMessage) Valid() bool {
+	switch e {
+	case DeleteRolesResponseMessageOk:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for DeployFunctionResponseStatus.
 const (
 	DeployFunctionResponseStatusACTIVE    DeployFunctionResponseStatus = "ACTIVE"
@@ -438,26 +1260,80 @@ const (
 	DeployFunctionResponseStatusTHROTTLED DeployFunctionResponseStatus = "THROTTLED"
 )
 
+// Valid indicates whether the value is a known member of the DeployFunctionResponseStatus enum.
+func (e DeployFunctionResponseStatus) Valid() bool {
+	switch e {
+	case DeployFunctionResponseStatusACTIVE:
+		return true
+	case DeployFunctionResponseStatusREMOVED:
+		return true
+	case DeployFunctionResponseStatusTHROTTLED:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for DiskRequestBodyAttributes0Type.
 const (
 	DiskRequestBodyAttributes0TypeGp3 DiskRequestBodyAttributes0Type = "gp3"
 )
 
+// Valid indicates whether the value is a known member of the DiskRequestBodyAttributes0Type enum.
+func (e DiskRequestBodyAttributes0Type) Valid() bool {
+	switch e {
+	case DiskRequestBodyAttributes0TypeGp3:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for DiskRequestBodyAttributes1Type.
 const (
 	DiskRequestBodyAttributes1TypeIo2 DiskRequestBodyAttributes1Type = "io2"
 )
 
+// Valid indicates whether the value is a known member of the DiskRequestBodyAttributes1Type enum.
+func (e DiskRequestBodyAttributes1Type) Valid() bool {
+	switch e {
+	case DiskRequestBodyAttributes1TypeIo2:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for DiskResponseAttributes0Type.
 const (
 	DiskResponseAttributes0TypeGp3 DiskResponseAttributes0Type = "gp3"
 )
 
+// Valid indicates whether the value is a known member of the DiskResponseAttributes0Type enum.
+func (e DiskResponseAttributes0Type) Valid() bool {
+	switch e {
+	case DiskResponseAttributes0TypeGp3:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for DiskResponseAttributes1Type.
 const (
 	DiskResponseAttributes1TypeIo2 DiskResponseAttributes1Type = "io2"
 )
 
+// Valid indicates whether the value is a known member of the DiskResponseAttributes1Type enum.
+func (e DiskResponseAttributes1Type) Valid() bool {
+	switch e {
+	case DiskResponseAttributes1TypeIo2:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for FunctionResponseStatus.
 const (
 	FunctionResponseStatusACTIVE    FunctionResponseStatus = "ACTIVE"
@@ -465,6 +1341,20 @@ const (
 	FunctionResponseStatusTHROTTLED FunctionResponseStatus = "THROTTLED"
 )
 
+// Valid indicates whether the value is a known member of the FunctionResponseStatus enum.
+func (e FunctionResponseStatus) Valid() bool {
+	switch e {
+	case FunctionResponseStatusACTIVE:
+		return true
+	case FunctionResponseStatusREMOVED:
+		return true
+	case FunctionResponseStatusTHROTTLED:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for FunctionSlugResponseStatus.
 const (
 	FunctionSlugResponseStatusACTIVE    FunctionSlugResponseStatus = "ACTIVE"
@@ -472,6 +1362,20 @@ const (
 	FunctionSlugResponseStatusTHROTTLED FunctionSlugResponseStatus = "THROTTLED"
 )
 
+// Valid indicates whether the value is a known member of the FunctionSlugResponseStatus enum.
+func (e FunctionSlugResponseStatus) Valid() bool {
+	switch e {
+	case FunctionSlugResponseStatusACTIVE:
+		return true
+	case FunctionSlugResponseStatusREMOVED:
+		return true
+	case FunctionSlugResponseStatusTHROTTLED:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for GetProjectAvailableRestoreVersionsResponseAvailableVersionsPostgresEngine.
 const (
 	GetProjectAvailableRestoreVersionsResponseAvailableVersionsPostgresEngineN13       GetProjectAvailableRestoreVersionsResponseAvailableVersionsPostgresEngine = "13"
@@ -481,6 +1385,24 @@ const (
 	GetProjectAvailableRestoreVersionsResponseAvailableVersionsPostgresEngineN17Oriole GetProjectAvailableRestoreVersionsResponseAvailableVersionsPostgresEngine = "17-oriole"
 )
 
+// Valid indicates whether the value is a known member of the GetProjectAvailableRestoreVersionsResponseAvailableVersionsPostgresEngine enum.
+func (e GetProjectAvailableRestoreVersionsResponseAvailableVersionsPostgresEngine) Valid() bool {
+	switch e {
+	case GetProjectAvailableRestoreVersionsResponseAvailableVersionsPostgresEngineN13:
+		return true
+	case GetProjectAvailableRestoreVersionsResponseAvailableVersionsPostgresEngineN14:
+		return true
+	case GetProjectAvailableRestoreVersionsResponseAvailableVersionsPostgresEngineN15:
+		return true
+	case GetProjectAvailableRestoreVersionsResponseAvailableVersionsPostgresEngineN17:
+		return true
+	case GetProjectAvailableRestoreVersionsResponseAvailableVersionsPostgresEngineN17Oriole:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for GetProjectAvailableRestoreVersionsResponseAvailableVersionsReleaseChannel.
 const (
 	GetProjectAvailableRestoreVersionsResponseAvailableVersionsReleaseChannelAlpha     GetProjectAvailableRestoreVersionsResponseAvailableVersionsReleaseChannel = "alpha"
@@ -491,29 +1413,98 @@ const (
 	GetProjectAvailableRestoreVersionsResponseAvailableVersionsReleaseChannelWithdrawn GetProjectAvailableRestoreVersionsResponseAvailableVersionsReleaseChannel = "withdrawn"
 )
 
+// Valid indicates whether the value is a known member of the GetProjectAvailableRestoreVersionsResponseAvailableVersionsReleaseChannel enum.
+func (e GetProjectAvailableRestoreVersionsResponseAvailableVersionsReleaseChannel) Valid() bool {
+	switch e {
+	case GetProjectAvailableRestoreVersionsResponseAvailableVersionsReleaseChannelAlpha:
+		return true
+	case GetProjectAvailableRestoreVersionsResponseAvailableVersionsReleaseChannelBeta:
+		return true
+	case GetProjectAvailableRestoreVersionsResponseAvailableVersionsReleaseChannelGa:
+		return true
+	case GetProjectAvailableRestoreVersionsResponseAvailableVersionsReleaseChannelInternal:
+		return true
+	case GetProjectAvailableRestoreVersionsResponseAvailableVersionsReleaseChannelPreview:
+		return true
+	case GetProjectAvailableRestoreVersionsResponseAvailableVersionsReleaseChannelWithdrawn:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for JitAccessRequestRequestState.
 const (
 	JitAccessRequestRequestStateDisabled JitAccessRequestRequestState = "disabled"
 	JitAccessRequestRequestStateEnabled  JitAccessRequestRequestState = "enabled"
 )
 
+// Valid indicates whether the value is a known member of the JitAccessRequestRequestState enum.
+func (e JitAccessRequestRequestState) Valid() bool {
+	switch e {
+	case JitAccessRequestRequestStateDisabled:
+		return true
+	case JitAccessRequestRequestStateEnabled:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for JitStateResponse0State.
 const (
 	JitStateResponse0StateDisabled JitStateResponse0State = "disabled"
 	JitStateResponse0StateEnabled  JitStateResponse0State = "enabled"
 )
 
+// Valid indicates whether the value is a known member of the JitStateResponse0State enum.
+func (e JitStateResponse0State) Valid() bool {
+	switch e {
+	case JitStateResponse0StateDisabled:
+		return true
+	case JitStateResponse0StateEnabled:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for JitStateResponse1State.
 const (
 	Unavailable JitStateResponse1State = "unavailable"
 )
 
+// Valid indicates whether the value is a known member of the JitStateResponse1State enum.
+func (e JitStateResponse1State) Valid() bool {
+	switch e {
+	case Unavailable:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for JitStateResponse1UnavailableReason.
 const (
 	PostgresUpgradeRequired JitStateResponse1UnavailableReason = "postgres_upgrade_required"
+	SslEnforcementRequired  JitStateResponse1UnavailableReason = "ssl_enforcement_required"
 	TemporarilyUnavailable  JitStateResponse1UnavailableReason = "temporarily_unavailable"
 )
 
+// Valid indicates whether the value is a known member of the JitStateResponse1UnavailableReason enum.
+func (e JitStateResponse1UnavailableReason) Valid() bool {
+	switch e {
+	case PostgresUpgradeRequired:
+		return true
+	case SslEnforcementRequired:
+		return true
+	case TemporarilyUnavailable:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for ListActionRunResponseRunStepsName.
 const (
 	ListActionRunResponseRunStepsNameClone     ListActionRunResponseRunStepsName = "clone"
@@ -525,6 +1516,28 @@ const (
 	ListActionRunResponseRunStepsNameSeed      ListActionRunResponseRunStepsName = "seed"
 )
 
+// Valid indicates whether the value is a known member of the ListActionRunResponseRunStepsName enum.
+func (e ListActionRunResponseRunStepsName) Valid() bool {
+	switch e {
+	case ListActionRunResponseRunStepsNameClone:
+		return true
+	case ListActionRunResponseRunStepsNameConfigure:
+		return true
+	case ListActionRunResponseRunStepsNameDeploy:
+		return true
+	case ListActionRunResponseRunStepsNameHealth:
+		return true
+	case ListActionRunResponseRunStepsNameMigrate:
+		return true
+	case ListActionRunResponseRunStepsNamePull:
+		return true
+	case ListActionRunResponseRunStepsNameSeed:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for ListActionRunResponseRunStepsStatus.
 const (
 	ListActionRunResponseRunStepsStatusCREATED    ListActionRunResponseRunStepsStatus = "CREATED"
@@ -536,6 +1549,28 @@ const (
 	ListActionRunResponseRunStepsStatusRUNNING    ListActionRunResponseRunStepsStatus = "RUNNING"
 )
 
+// Valid indicates whether the value is a known member of the ListActionRunResponseRunStepsStatus enum.
+func (e ListActionRunResponseRunStepsStatus) Valid() bool {
+	switch e {
+	case ListActionRunResponseRunStepsStatusCREATED:
+		return true
+	case ListActionRunResponseRunStepsStatusDEAD:
+		return true
+	case ListActionRunResponseRunStepsStatusEXITED:
+		return true
+	case ListActionRunResponseRunStepsStatusPAUSED:
+		return true
+	case ListActionRunResponseRunStepsStatusREMOVING:
+		return true
+	case ListActionRunResponseRunStepsStatusRESTARTING:
+		return true
+	case ListActionRunResponseRunStepsStatusRUNNING:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for ListProjectAddonsResponseAvailableAddonsType.
 const (
 	ListProjectAddonsResponseAvailableAddonsTypeAuthMfaPhone    ListProjectAddonsResponseAvailableAddonsType = "auth_mfa_phone"
@@ -548,6 +1583,30 @@ const (
 	ListProjectAddonsResponseAvailableAddonsTypePitr            ListProjectAddonsResponseAvailableAddonsType = "pitr"
 )
 
+// Valid indicates whether the value is a known member of the ListProjectAddonsResponseAvailableAddonsType enum.
+func (e ListProjectAddonsResponseAvailableAddonsType) Valid() bool {
+	switch e {
+	case ListProjectAddonsResponseAvailableAddonsTypeAuthMfaPhone:
+		return true
+	case ListProjectAddonsResponseAvailableAddonsTypeAuthMfaWebAuthn:
+		return true
+	case ListProjectAddonsResponseAvailableAddonsTypeComputeInstance:
+		return true
+	case ListProjectAddonsResponseAvailableAddonsTypeCustomDomain:
+		return true
+	case ListProjectAddonsResponseAvailableAddonsTypeEtlPipeline:
+		return true
+	case ListProjectAddonsResponseAvailableAddonsTypeIpv4:
+		return true
+	case ListProjectAddonsResponseAvailableAddonsTypeLogDrain:
+		return true
+	case ListProjectAddonsResponseAvailableAddonsTypePitr:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for ListProjectAddonsResponseAvailableAddonsVariantsId0.
 const (
 	ListProjectAddonsResponseAvailableAddonsVariantsId0Ci12xlarge                ListProjectAddonsResponseAvailableAddonsVariantsId0 = "ci_12xlarge"
@@ -570,11 +1629,65 @@ const (
 	ListProjectAddonsResponseAvailableAddonsVariantsId0CiXlarge                  ListProjectAddonsResponseAvailableAddonsVariantsId0 = "ci_xlarge"
 )
 
+// Valid indicates whether the value is a known member of the ListProjectAddonsResponseAvailableAddonsVariantsId0 enum.
+func (e ListProjectAddonsResponseAvailableAddonsVariantsId0) Valid() bool {
+	switch e {
+	case ListProjectAddonsResponseAvailableAddonsVariantsId0Ci12xlarge:
+		return true
+	case ListProjectAddonsResponseAvailableAddonsVariantsId0Ci16xlarge:
+		return true
+	case ListProjectAddonsResponseAvailableAddonsVariantsId0Ci24xlarge:
+		return true
+	case ListProjectAddonsResponseAvailableAddonsVariantsId0Ci24xlargeHighMemory:
+		return true
+	case ListProjectAddonsResponseAvailableAddonsVariantsId0Ci24xlargeOptimizedCpu:
+		return true
+	case ListProjectAddonsResponseAvailableAddonsVariantsId0Ci24xlargeOptimizedMemory:
+		return true
+	case ListProjectAddonsResponseAvailableAddonsVariantsId0Ci2xlarge:
+		return true
+	case ListProjectAddonsResponseAvailableAddonsVariantsId0Ci48xlarge:
+		return true
+	case ListProjectAddonsResponseAvailableAddonsVariantsId0Ci48xlargeHighMemory:
+		return true
+	case ListProjectAddonsResponseAvailableAddonsVariantsId0Ci48xlargeOptimizedCpu:
+		return true
+	case ListProjectAddonsResponseAvailableAddonsVariantsId0Ci48xlargeOptimizedMemory:
+		return true
+	case ListProjectAddonsResponseAvailableAddonsVariantsId0Ci4xlarge:
+		return true
+	case ListProjectAddonsResponseAvailableAddonsVariantsId0Ci8xlarge:
+		return true
+	case ListProjectAddonsResponseAvailableAddonsVariantsId0CiLarge:
+		return true
+	case ListProjectAddonsResponseAvailableAddonsVariantsId0CiMedium:
+		return true
+	case ListProjectAddonsResponseAvailableAddonsVariantsId0CiMicro:
+		return true
+	case ListProjectAddonsResponseAvailableAddonsVariantsId0CiSmall:
+		return true
+	case ListProjectAddonsResponseAvailableAddonsVariantsId0CiXlarge:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for ListProjectAddonsResponseAvailableAddonsVariantsId1.
 const (
 	ListProjectAddonsResponseAvailableAddonsVariantsId1CdDefault ListProjectAddonsResponseAvailableAddonsVariantsId1 = "cd_default"
 )
 
+// Valid indicates whether the value is a known member of the ListProjectAddonsResponseAvailableAddonsVariantsId1 enum.
+func (e ListProjectAddonsResponseAvailableAddonsVariantsId1) Valid() bool {
+	switch e {
+	case ListProjectAddonsResponseAvailableAddonsVariantsId1CdDefault:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for ListProjectAddonsResponseAvailableAddonsVariantsId2.
 const (
 	ListProjectAddonsResponseAvailableAddonsVariantsId2Pitr14 ListProjectAddonsResponseAvailableAddonsVariantsId2 = "pitr_14"
@@ -582,43 +1695,131 @@ const (
 	ListProjectAddonsResponseAvailableAddonsVariantsId2Pitr7  ListProjectAddonsResponseAvailableAddonsVariantsId2 = "pitr_7"
 )
 
+// Valid indicates whether the value is a known member of the ListProjectAddonsResponseAvailableAddonsVariantsId2 enum.
+func (e ListProjectAddonsResponseAvailableAddonsVariantsId2) Valid() bool {
+	switch e {
+	case ListProjectAddonsResponseAvailableAddonsVariantsId2Pitr14:
+		return true
+	case ListProjectAddonsResponseAvailableAddonsVariantsId2Pitr28:
+		return true
+	case ListProjectAddonsResponseAvailableAddonsVariantsId2Pitr7:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for ListProjectAddonsResponseAvailableAddonsVariantsId3.
 const (
 	ListProjectAddonsResponseAvailableAddonsVariantsId3Ipv4Default ListProjectAddonsResponseAvailableAddonsVariantsId3 = "ipv4_default"
 )
 
+// Valid indicates whether the value is a known member of the ListProjectAddonsResponseAvailableAddonsVariantsId3 enum.
+func (e ListProjectAddonsResponseAvailableAddonsVariantsId3) Valid() bool {
+	switch e {
+	case ListProjectAddonsResponseAvailableAddonsVariantsId3Ipv4Default:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for ListProjectAddonsResponseAvailableAddonsVariantsId4.
 const (
 	ListProjectAddonsResponseAvailableAddonsVariantsId4AuthMfaPhoneDefault ListProjectAddonsResponseAvailableAddonsVariantsId4 = "auth_mfa_phone_default"
 )
 
+// Valid indicates whether the value is a known member of the ListProjectAddonsResponseAvailableAddonsVariantsId4 enum.
+func (e ListProjectAddonsResponseAvailableAddonsVariantsId4) Valid() bool {
+	switch e {
+	case ListProjectAddonsResponseAvailableAddonsVariantsId4AuthMfaPhoneDefault:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for ListProjectAddonsResponseAvailableAddonsVariantsId5.
 const (
 	ListProjectAddonsResponseAvailableAddonsVariantsId5AuthMfaWebAuthnDefault ListProjectAddonsResponseAvailableAddonsVariantsId5 = "auth_mfa_web_authn_default"
 )
 
+// Valid indicates whether the value is a known member of the ListProjectAddonsResponseAvailableAddonsVariantsId5 enum.
+func (e ListProjectAddonsResponseAvailableAddonsVariantsId5) Valid() bool {
+	switch e {
+	case ListProjectAddonsResponseAvailableAddonsVariantsId5AuthMfaWebAuthnDefault:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for ListProjectAddonsResponseAvailableAddonsVariantsId6.
 const (
 	ListProjectAddonsResponseAvailableAddonsVariantsId6LogDrainDefault ListProjectAddonsResponseAvailableAddonsVariantsId6 = "log_drain_default"
 )
 
+// Valid indicates whether the value is a known member of the ListProjectAddonsResponseAvailableAddonsVariantsId6 enum.
+func (e ListProjectAddonsResponseAvailableAddonsVariantsId6) Valid() bool {
+	switch e {
+	case ListProjectAddonsResponseAvailableAddonsVariantsId6LogDrainDefault:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for ListProjectAddonsResponseAvailableAddonsVariantsId7.
 const (
 	ListProjectAddonsResponseAvailableAddonsVariantsId7EtlPipelineDefault ListProjectAddonsResponseAvailableAddonsVariantsId7 = "etl_pipeline_default"
 )
 
+// Valid indicates whether the value is a known member of the ListProjectAddonsResponseAvailableAddonsVariantsId7 enum.
+func (e ListProjectAddonsResponseAvailableAddonsVariantsId7) Valid() bool {
+	switch e {
+	case ListProjectAddonsResponseAvailableAddonsVariantsId7EtlPipelineDefault:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for ListProjectAddonsResponseAvailableAddonsVariantsPriceInterval.
 const (
 	ListProjectAddonsResponseAvailableAddonsVariantsPriceIntervalHourly  ListProjectAddonsResponseAvailableAddonsVariantsPriceInterval = "hourly"
 	ListProjectAddonsResponseAvailableAddonsVariantsPriceIntervalMonthly ListProjectAddonsResponseAvailableAddonsVariantsPriceInterval = "monthly"
 )
 
+// Valid indicates whether the value is a known member of the ListProjectAddonsResponseAvailableAddonsVariantsPriceInterval enum.
+func (e ListProjectAddonsResponseAvailableAddonsVariantsPriceInterval) Valid() bool {
+	switch e {
+	case ListProjectAddonsResponseAvailableAddonsVariantsPriceIntervalHourly:
+		return true
+	case ListProjectAddonsResponseAvailableAddonsVariantsPriceIntervalMonthly:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for ListProjectAddonsResponseAvailableAddonsVariantsPriceType.
 const (
 	ListProjectAddonsResponseAvailableAddonsVariantsPriceTypeFixed ListProjectAddonsResponseAvailableAddonsVariantsPriceType = "fixed"
 	ListProjectAddonsResponseAvailableAddonsVariantsPriceTypeUsage ListProjectAddonsResponseAvailableAddonsVariantsPriceType = "usage"
 )
 
+// Valid indicates whether the value is a known member of the ListProjectAddonsResponseAvailableAddonsVariantsPriceType enum.
+func (e ListProjectAddonsResponseAvailableAddonsVariantsPriceType) Valid() bool {
+	switch e {
+	case ListProjectAddonsResponseAvailableAddonsVariantsPriceTypeFixed:
+		return true
+	case ListProjectAddonsResponseAvailableAddonsVariantsPriceTypeUsage:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for ListProjectAddonsResponseSelectedAddonsType.
 const (
 	ListProjectAddonsResponseSelectedAddonsTypeAuthMfaPhone    ListProjectAddonsResponseSelectedAddonsType = "auth_mfa_phone"
@@ -631,6 +1832,30 @@ const (
 	ListProjectAddonsResponseSelectedAddonsTypePitr            ListProjectAddonsResponseSelectedAddonsType = "pitr"
 )
 
+// Valid indicates whether the value is a known member of the ListProjectAddonsResponseSelectedAddonsType enum.
+func (e ListProjectAddonsResponseSelectedAddonsType) Valid() bool {
+	switch e {
+	case ListProjectAddonsResponseSelectedAddonsTypeAuthMfaPhone:
+		return true
+	case ListProjectAddonsResponseSelectedAddonsTypeAuthMfaWebAuthn:
+		return true
+	case ListProjectAddonsResponseSelectedAddonsTypeComputeInstance:
+		return true
+	case ListProjectAddonsResponseSelectedAddonsTypeCustomDomain:
+		return true
+	case ListProjectAddonsResponseSelectedAddonsTypeEtlPipeline:
+		return true
+	case ListProjectAddonsResponseSelectedAddonsTypeIpv4:
+		return true
+	case ListProjectAddonsResponseSelectedAddonsTypeLogDrain:
+		return true
+	case ListProjectAddonsResponseSelectedAddonsTypePitr:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for ListProjectAddonsResponseSelectedAddonsVariantId0.
 const (
 	ListProjectAddonsResponseSelectedAddonsVariantId0Ci12xlarge                ListProjectAddonsResponseSelectedAddonsVariantId0 = "ci_12xlarge"
@@ -653,11 +1878,65 @@ const (
 	ListProjectAddonsResponseSelectedAddonsVariantId0CiXlarge                  ListProjectAddonsResponseSelectedAddonsVariantId0 = "ci_xlarge"
 )
 
+// Valid indicates whether the value is a known member of the ListProjectAddonsResponseSelectedAddonsVariantId0 enum.
+func (e ListProjectAddonsResponseSelectedAddonsVariantId0) Valid() bool {
+	switch e {
+	case ListProjectAddonsResponseSelectedAddonsVariantId0Ci12xlarge:
+		return true
+	case ListProjectAddonsResponseSelectedAddonsVariantId0Ci16xlarge:
+		return true
+	case ListProjectAddonsResponseSelectedAddonsVariantId0Ci24xlarge:
+		return true
+	case ListProjectAddonsResponseSelectedAddonsVariantId0Ci24xlargeHighMemory:
+		return true
+	case ListProjectAddonsResponseSelectedAddonsVariantId0Ci24xlargeOptimizedCpu:
+		return true
+	case ListProjectAddonsResponseSelectedAddonsVariantId0Ci24xlargeOptimizedMemory:
+		return true
+	case ListProjectAddonsResponseSelectedAddonsVariantId0Ci2xlarge:
+		return true
+	case ListProjectAddonsResponseSelectedAddonsVariantId0Ci48xlarge:
+		return true
+	case ListProjectAddonsResponseSelectedAddonsVariantId0Ci48xlargeHighMemory:
+		return true
+	case ListProjectAddonsResponseSelectedAddonsVariantId0Ci48xlargeOptimizedCpu:
+		return true
+	case ListProjectAddonsResponseSelectedAddonsVariantId0Ci48xlargeOptimizedMemory:
+		return true
+	case ListProjectAddonsResponseSelectedAddonsVariantId0Ci4xlarge:
+		return true
+	case ListProjectAddonsResponseSelectedAddonsVariantId0Ci8xlarge:
+		return true
+	case ListProjectAddonsResponseSelectedAddonsVariantId0CiLarge:
+		return true
+	case ListProjectAddonsResponseSelectedAddonsVariantId0CiMedium:
+		return true
+	case ListProjectAddonsResponseSelectedAddonsVariantId0CiMicro:
+		return true
+	case ListProjectAddonsResponseSelectedAddonsVariantId0CiSmall:
+		return true
+	case ListProjectAddonsResponseSelectedAddonsVariantId0CiXlarge:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for ListProjectAddonsResponseSelectedAddonsVariantId1.
 const (
 	ListProjectAddonsResponseSelectedAddonsVariantId1CdDefault ListProjectAddonsResponseSelectedAddonsVariantId1 = "cd_default"
 )
 
+// Valid indicates whether the value is a known member of the ListProjectAddonsResponseSelectedAddonsVariantId1 enum.
+func (e ListProjectAddonsResponseSelectedAddonsVariantId1) Valid() bool {
+	switch e {
+	case ListProjectAddonsResponseSelectedAddonsVariantId1CdDefault:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for ListProjectAddonsResponseSelectedAddonsVariantId2.
 const (
 	ListProjectAddonsResponseSelectedAddonsVariantId2Pitr14 ListProjectAddonsResponseSelectedAddonsVariantId2 = "pitr_14"
@@ -665,79 +1944,239 @@ const (
 	ListProjectAddonsResponseSelectedAddonsVariantId2Pitr7  ListProjectAddonsResponseSelectedAddonsVariantId2 = "pitr_7"
 )
 
+// Valid indicates whether the value is a known member of the ListProjectAddonsResponseSelectedAddonsVariantId2 enum.
+func (e ListProjectAddonsResponseSelectedAddonsVariantId2) Valid() bool {
+	switch e {
+	case ListProjectAddonsResponseSelectedAddonsVariantId2Pitr14:
+		return true
+	case ListProjectAddonsResponseSelectedAddonsVariantId2Pitr28:
+		return true
+	case ListProjectAddonsResponseSelectedAddonsVariantId2Pitr7:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for ListProjectAddonsResponseSelectedAddonsVariantId3.
 const (
 	ListProjectAddonsResponseSelectedAddonsVariantId3Ipv4Default ListProjectAddonsResponseSelectedAddonsVariantId3 = "ipv4_default"
 )
 
+// Valid indicates whether the value is a known member of the ListProjectAddonsResponseSelectedAddonsVariantId3 enum.
+func (e ListProjectAddonsResponseSelectedAddonsVariantId3) Valid() bool {
+	switch e {
+	case ListProjectAddonsResponseSelectedAddonsVariantId3Ipv4Default:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for ListProjectAddonsResponseSelectedAddonsVariantId4.
 const (
 	ListProjectAddonsResponseSelectedAddonsVariantId4AuthMfaPhoneDefault ListProjectAddonsResponseSelectedAddonsVariantId4 = "auth_mfa_phone_default"
 )
 
+// Valid indicates whether the value is a known member of the ListProjectAddonsResponseSelectedAddonsVariantId4 enum.
+func (e ListProjectAddonsResponseSelectedAddonsVariantId4) Valid() bool {
+	switch e {
+	case ListProjectAddonsResponseSelectedAddonsVariantId4AuthMfaPhoneDefault:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for ListProjectAddonsResponseSelectedAddonsVariantId5.
 const (
 	ListProjectAddonsResponseSelectedAddonsVariantId5AuthMfaWebAuthnDefault ListProjectAddonsResponseSelectedAddonsVariantId5 = "auth_mfa_web_authn_default"
 )
 
+// Valid indicates whether the value is a known member of the ListProjectAddonsResponseSelectedAddonsVariantId5 enum.
+func (e ListProjectAddonsResponseSelectedAddonsVariantId5) Valid() bool {
+	switch e {
+	case ListProjectAddonsResponseSelectedAddonsVariantId5AuthMfaWebAuthnDefault:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for ListProjectAddonsResponseSelectedAddonsVariantId6.
 const (
 	ListProjectAddonsResponseSelectedAddonsVariantId6LogDrainDefault ListProjectAddonsResponseSelectedAddonsVariantId6 = "log_drain_default"
 )
 
+// Valid indicates whether the value is a known member of the ListProjectAddonsResponseSelectedAddonsVariantId6 enum.
+func (e ListProjectAddonsResponseSelectedAddonsVariantId6) Valid() bool {
+	switch e {
+	case ListProjectAddonsResponseSelectedAddonsVariantId6LogDrainDefault:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for ListProjectAddonsResponseSelectedAddonsVariantId7.
 const (
 	ListProjectAddonsResponseSelectedAddonsVariantId7EtlPipelineDefault ListProjectAddonsResponseSelectedAddonsVariantId7 = "etl_pipeline_default"
 )
 
+// Valid indicates whether the value is a known member of the ListProjectAddonsResponseSelectedAddonsVariantId7 enum.
+func (e ListProjectAddonsResponseSelectedAddonsVariantId7) Valid() bool {
+	switch e {
+	case ListProjectAddonsResponseSelectedAddonsVariantId7EtlPipelineDefault:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for ListProjectAddonsResponseSelectedAddonsVariantPriceInterval.
 const (
 	ListProjectAddonsResponseSelectedAddonsVariantPriceIntervalHourly  ListProjectAddonsResponseSelectedAddonsVariantPriceInterval = "hourly"
 	ListProjectAddonsResponseSelectedAddonsVariantPriceIntervalMonthly ListProjectAddonsResponseSelectedAddonsVariantPriceInterval = "monthly"
 )
 
+// Valid indicates whether the value is a known member of the ListProjectAddonsResponseSelectedAddonsVariantPriceInterval enum.
+func (e ListProjectAddonsResponseSelectedAddonsVariantPriceInterval) Valid() bool {
+	switch e {
+	case ListProjectAddonsResponseSelectedAddonsVariantPriceIntervalHourly:
+		return true
+	case ListProjectAddonsResponseSelectedAddonsVariantPriceIntervalMonthly:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for ListProjectAddonsResponseSelectedAddonsVariantPriceType.
 const (
 	ListProjectAddonsResponseSelectedAddonsVariantPriceTypeFixed ListProjectAddonsResponseSelectedAddonsVariantPriceType = "fixed"
 	ListProjectAddonsResponseSelectedAddonsVariantPriceTypeUsage ListProjectAddonsResponseSelectedAddonsVariantPriceType = "usage"
 )
 
+// Valid indicates whether the value is a known member of the ListProjectAddonsResponseSelectedAddonsVariantPriceType enum.
+func (e ListProjectAddonsResponseSelectedAddonsVariantPriceType) Valid() bool {
+	switch e {
+	case ListProjectAddonsResponseSelectedAddonsVariantPriceTypeFixed:
+		return true
+	case ListProjectAddonsResponseSelectedAddonsVariantPriceTypeUsage:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for NetworkRestrictionsResponseEntitlement.
 const (
 	NetworkRestrictionsResponseEntitlementAllowed    NetworkRestrictionsResponseEntitlement = "allowed"
 	NetworkRestrictionsResponseEntitlementDisallowed NetworkRestrictionsResponseEntitlement = "disallowed"
 )
 
+// Valid indicates whether the value is a known member of the NetworkRestrictionsResponseEntitlement enum.
+func (e NetworkRestrictionsResponseEntitlement) Valid() bool {
+	switch e {
+	case NetworkRestrictionsResponseEntitlementAllowed:
+		return true
+	case NetworkRestrictionsResponseEntitlementDisallowed:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for NetworkRestrictionsResponseStatus.
 const (
 	NetworkRestrictionsResponseStatusApplied NetworkRestrictionsResponseStatus = "applied"
 	NetworkRestrictionsResponseStatusStored  NetworkRestrictionsResponseStatus = "stored"
 )
 
+// Valid indicates whether the value is a known member of the NetworkRestrictionsResponseStatus enum.
+func (e NetworkRestrictionsResponseStatus) Valid() bool {
+	switch e {
+	case NetworkRestrictionsResponseStatusApplied:
+		return true
+	case NetworkRestrictionsResponseStatusStored:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for NetworkRestrictionsV2ResponseConfigDbAllowedCidrsType.
 const (
 	NetworkRestrictionsV2ResponseConfigDbAllowedCidrsTypeV4 NetworkRestrictionsV2ResponseConfigDbAllowedCidrsType = "v4"
 	NetworkRestrictionsV2ResponseConfigDbAllowedCidrsTypeV6 NetworkRestrictionsV2ResponseConfigDbAllowedCidrsType = "v6"
 )
 
+// Valid indicates whether the value is a known member of the NetworkRestrictionsV2ResponseConfigDbAllowedCidrsType enum.
+func (e NetworkRestrictionsV2ResponseConfigDbAllowedCidrsType) Valid() bool {
+	switch e {
+	case NetworkRestrictionsV2ResponseConfigDbAllowedCidrsTypeV4:
+		return true
+	case NetworkRestrictionsV2ResponseConfigDbAllowedCidrsTypeV6:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for NetworkRestrictionsV2ResponseEntitlement.
 const (
 	NetworkRestrictionsV2ResponseEntitlementAllowed    NetworkRestrictionsV2ResponseEntitlement = "allowed"
 	NetworkRestrictionsV2ResponseEntitlementDisallowed NetworkRestrictionsV2ResponseEntitlement = "disallowed"
 )
 
+// Valid indicates whether the value is a known member of the NetworkRestrictionsV2ResponseEntitlement enum.
+func (e NetworkRestrictionsV2ResponseEntitlement) Valid() bool {
+	switch e {
+	case NetworkRestrictionsV2ResponseEntitlementAllowed:
+		return true
+	case NetworkRestrictionsV2ResponseEntitlementDisallowed:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for NetworkRestrictionsV2ResponseOldConfigDbAllowedCidrsType.
 const (
 	NetworkRestrictionsV2ResponseOldConfigDbAllowedCidrsTypeV4 NetworkRestrictionsV2ResponseOldConfigDbAllowedCidrsType = "v4"
 	NetworkRestrictionsV2ResponseOldConfigDbAllowedCidrsTypeV6 NetworkRestrictionsV2ResponseOldConfigDbAllowedCidrsType = "v6"
 )
 
+// Valid indicates whether the value is a known member of the NetworkRestrictionsV2ResponseOldConfigDbAllowedCidrsType enum.
+func (e NetworkRestrictionsV2ResponseOldConfigDbAllowedCidrsType) Valid() bool {
+	switch e {
+	case NetworkRestrictionsV2ResponseOldConfigDbAllowedCidrsTypeV4:
+		return true
+	case NetworkRestrictionsV2ResponseOldConfigDbAllowedCidrsTypeV6:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for NetworkRestrictionsV2ResponseStatus.
 const (
 	NetworkRestrictionsV2ResponseStatusApplied NetworkRestrictionsV2ResponseStatus = "applied"
 	NetworkRestrictionsV2ResponseStatusStored  NetworkRestrictionsV2ResponseStatus = "stored"
 )
 
+// Valid indicates whether the value is a known member of the NetworkRestrictionsV2ResponseStatus enum.
+func (e NetworkRestrictionsV2ResponseStatus) Valid() bool {
+	switch e {
+	case NetworkRestrictionsV2ResponseStatusApplied:
+		return true
+	case NetworkRestrictionsV2ResponseStatusStored:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for OAuthTokenBodyGrantType.
 const (
 	AuthorizationCode                    OAuthTokenBodyGrantType = "authorization_code"
@@ -745,11 +2184,35 @@ const (
 	UrnIetfParamsOauthGrantTypeJwtBearer OAuthTokenBodyGrantType = "urn:ietf:params:oauth:grant-type:jwt-bearer"
 )
 
+// Valid indicates whether the value is a known member of the OAuthTokenBodyGrantType enum.
+func (e OAuthTokenBodyGrantType) Valid() bool {
+	switch e {
+	case AuthorizationCode:
+		return true
+	case RefreshToken:
+		return true
+	case UrnIetfParamsOauthGrantTypeJwtBearer:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for OAuthTokenResponseTokenType.
 const (
 	Bearer OAuthTokenResponseTokenType = "Bearer"
 )
 
+// Valid indicates whether the value is a known member of the OAuthTokenResponseTokenType enum.
+func (e OAuthTokenResponseTokenType) Valid() bool {
+	switch e {
+	case Bearer:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for OrganizationProjectClaimResponsePreviewSourceSubscriptionPlan.
 const (
 	OrganizationProjectClaimResponsePreviewSourceSubscriptionPlanEnterprise OrganizationProjectClaimResponsePreviewSourceSubscriptionPlan = "enterprise"
@@ -759,6 +2222,24 @@ const (
 	OrganizationProjectClaimResponsePreviewSourceSubscriptionPlanTeam       OrganizationProjectClaimResponsePreviewSourceSubscriptionPlan = "team"
 )
 
+// Valid indicates whether the value is a known member of the OrganizationProjectClaimResponsePreviewSourceSubscriptionPlan enum.
+func (e OrganizationProjectClaimResponsePreviewSourceSubscriptionPlan) Valid() bool {
+	switch e {
+	case OrganizationProjectClaimResponsePreviewSourceSubscriptionPlanEnterprise:
+		return true
+	case OrganizationProjectClaimResponsePreviewSourceSubscriptionPlanFree:
+		return true
+	case OrganizationProjectClaimResponsePreviewSourceSubscriptionPlanPlatform:
+		return true
+	case OrganizationProjectClaimResponsePreviewSourceSubscriptionPlanPro:
+		return true
+	case OrganizationProjectClaimResponsePreviewSourceSubscriptionPlanTeam:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for OrganizationProjectClaimResponsePreviewTargetSubscriptionPlan.
 const (
 	OrganizationProjectClaimResponsePreviewTargetSubscriptionPlanEnterprise OrganizationProjectClaimResponsePreviewTargetSubscriptionPlan = "enterprise"
@@ -768,12 +2249,42 @@ const (
 	OrganizationProjectClaimResponsePreviewTargetSubscriptionPlanTeam       OrganizationProjectClaimResponsePreviewTargetSubscriptionPlan = "team"
 )
 
+// Valid indicates whether the value is a known member of the OrganizationProjectClaimResponsePreviewTargetSubscriptionPlan enum.
+func (e OrganizationProjectClaimResponsePreviewTargetSubscriptionPlan) Valid() bool {
+	switch e {
+	case OrganizationProjectClaimResponsePreviewTargetSubscriptionPlanEnterprise:
+		return true
+	case OrganizationProjectClaimResponsePreviewTargetSubscriptionPlanFree:
+		return true
+	case OrganizationProjectClaimResponsePreviewTargetSubscriptionPlanPlatform:
+		return true
+	case OrganizationProjectClaimResponsePreviewTargetSubscriptionPlanPro:
+		return true
+	case OrganizationProjectClaimResponsePreviewTargetSubscriptionPlanTeam:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for OrganizationProjectsResponseProjectsDatabasesDiskType.
 const (
 	Gp3 OrganizationProjectsResponseProjectsDatabasesDiskType = "gp3"
 	Io2 OrganizationProjectsResponseProjectsDatabasesDiskType = "io2"
 )
 
+// Valid indicates whether the value is a known member of the OrganizationProjectsResponseProjectsDatabasesDiskType enum.
+func (e OrganizationProjectsResponseProjectsDatabasesDiskType) Valid() bool {
+	switch e {
+	case Gp3:
+		return true
+	case Io2:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for OrganizationProjectsResponseProjectsDatabasesInfraComputeSize.
 const (
 	OrganizationProjectsResponseProjectsDatabasesInfraComputeSizeLarge                    OrganizationProjectsResponseProjectsDatabasesInfraComputeSize = "large"
@@ -798,6 +2309,54 @@ const (
 	OrganizationProjectsResponseProjectsDatabasesInfraComputeSizeXlarge                   OrganizationProjectsResponseProjectsDatabasesInfraComputeSize = "xlarge"
 )
 
+// Valid indicates whether the value is a known member of the OrganizationProjectsResponseProjectsDatabasesInfraComputeSize enum.
+func (e OrganizationProjectsResponseProjectsDatabasesInfraComputeSize) Valid() bool {
+	switch e {
+	case OrganizationProjectsResponseProjectsDatabasesInfraComputeSizeLarge:
+		return true
+	case OrganizationProjectsResponseProjectsDatabasesInfraComputeSizeMedium:
+		return true
+	case OrganizationProjectsResponseProjectsDatabasesInfraComputeSizeMicro:
+		return true
+	case OrganizationProjectsResponseProjectsDatabasesInfraComputeSizeN12xlarge:
+		return true
+	case OrganizationProjectsResponseProjectsDatabasesInfraComputeSizeN16xlarge:
+		return true
+	case OrganizationProjectsResponseProjectsDatabasesInfraComputeSizeN24xlarge:
+		return true
+	case OrganizationProjectsResponseProjectsDatabasesInfraComputeSizeN24xlargeHighMemory:
+		return true
+	case OrganizationProjectsResponseProjectsDatabasesInfraComputeSizeN24xlargeOptimizedCpu:
+		return true
+	case OrganizationProjectsResponseProjectsDatabasesInfraComputeSizeN24xlargeOptimizedMemory:
+		return true
+	case OrganizationProjectsResponseProjectsDatabasesInfraComputeSizeN2xlarge:
+		return true
+	case OrganizationProjectsResponseProjectsDatabasesInfraComputeSizeN48xlarge:
+		return true
+	case OrganizationProjectsResponseProjectsDatabasesInfraComputeSizeN48xlargeHighMemory:
+		return true
+	case OrganizationProjectsResponseProjectsDatabasesInfraComputeSizeN48xlargeOptimizedCpu:
+		return true
+	case OrganizationProjectsResponseProjectsDatabasesInfraComputeSizeN48xlargeOptimizedMemory:
+		return true
+	case OrganizationProjectsResponseProjectsDatabasesInfraComputeSizeN4xlarge:
+		return true
+	case OrganizationProjectsResponseProjectsDatabasesInfraComputeSizeN8xlarge:
+		return true
+	case OrganizationProjectsResponseProjectsDatabasesInfraComputeSizeNano:
+		return true
+	case OrganizationProjectsResponseProjectsDatabasesInfraComputeSizePico:
+		return true
+	case OrganizationProjectsResponseProjectsDatabasesInfraComputeSizeSmall:
+		return true
+	case OrganizationProjectsResponseProjectsDatabasesInfraComputeSizeXlarge:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for OrganizationProjectsResponseProjectsDatabasesStatus.
 const (
 	OrganizationProjectsResponseProjectsDatabasesStatusACTIVEHEALTHY         OrganizationProjectsResponseProjectsDatabasesStatus = "ACTIVE_HEALTHY"
@@ -814,12 +2373,56 @@ const (
 	OrganizationProjectsResponseProjectsDatabasesStatusUNKNOWN               OrganizationProjectsResponseProjectsDatabasesStatus = "UNKNOWN"
 )
 
+// Valid indicates whether the value is a known member of the OrganizationProjectsResponseProjectsDatabasesStatus enum.
+func (e OrganizationProjectsResponseProjectsDatabasesStatus) Valid() bool {
+	switch e {
+	case OrganizationProjectsResponseProjectsDatabasesStatusACTIVEHEALTHY:
+		return true
+	case OrganizationProjectsResponseProjectsDatabasesStatusACTIVEUNHEALTHY:
+		return true
+	case OrganizationProjectsResponseProjectsDatabasesStatusCOMINGUP:
+		return true
+	case OrganizationProjectsResponseProjectsDatabasesStatusGOINGDOWN:
+		return true
+	case OrganizationProjectsResponseProjectsDatabasesStatusINITFAILED:
+		return true
+	case OrganizationProjectsResponseProjectsDatabasesStatusINITREADREPLICA:
+		return true
+	case OrganizationProjectsResponseProjectsDatabasesStatusINITREADREPLICAFAILED:
+		return true
+	case OrganizationProjectsResponseProjectsDatabasesStatusREMOVED:
+		return true
+	case OrganizationProjectsResponseProjectsDatabasesStatusRESIZING:
+		return true
+	case OrganizationProjectsResponseProjectsDatabasesStatusRESTARTING:
+		return true
+	case OrganizationProjectsResponseProjectsDatabasesStatusRESTORING:
+		return true
+	case OrganizationProjectsResponseProjectsDatabasesStatusUNKNOWN:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for OrganizationProjectsResponseProjectsDatabasesType.
 const (
 	OrganizationProjectsResponseProjectsDatabasesTypePRIMARY     OrganizationProjectsResponseProjectsDatabasesType = "PRIMARY"
 	OrganizationProjectsResponseProjectsDatabasesTypeREADREPLICA OrganizationProjectsResponseProjectsDatabasesType = "READ_REPLICA"
 )
 
+// Valid indicates whether the value is a known member of the OrganizationProjectsResponseProjectsDatabasesType enum.
+func (e OrganizationProjectsResponseProjectsDatabasesType) Valid() bool {
+	switch e {
+	case OrganizationProjectsResponseProjectsDatabasesTypePRIMARY:
+		return true
+	case OrganizationProjectsResponseProjectsDatabasesTypeREADREPLICA:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for OrganizationProjectsResponseProjectsStatus.
 const (
 	OrganizationProjectsResponseProjectsStatusACTIVEHEALTHY   OrganizationProjectsResponseProjectsStatus = "ACTIVE_HEALTHY"
@@ -839,6 +2442,59 @@ const (
 	OrganizationProjectsResponseProjectsStatusUPGRADING       OrganizationProjectsResponseProjectsStatus = "UPGRADING"
 )
 
+// Valid indicates whether the value is a known member of the OrganizationProjectsResponseProjectsStatus enum.
+func (e OrganizationProjectsResponseProjectsStatus) Valid() bool {
+	switch e {
+	case OrganizationProjectsResponseProjectsStatusACTIVEHEALTHY:
+		return true
+	case OrganizationProjectsResponseProjectsStatusACTIVEUNHEALTHY:
+		return true
+	case OrganizationProjectsResponseProjectsStatusCOMINGUP:
+		return true
+	case OrganizationProjectsResponseProjectsStatusGOINGDOWN:
+		return true
+	case OrganizationProjectsResponseProjectsStatusINACTIVE:
+		return true
+	case OrganizationProjectsResponseProjectsStatusINITFAILED:
+		return true
+	case OrganizationProjectsResponseProjectsStatusPAUSEFAILED:
+		return true
+	case OrganizationProjectsResponseProjectsStatusPAUSING:
+		return true
+	case OrganizationProjectsResponseProjectsStatusREMOVED:
+		return true
+	case OrganizationProjectsResponseProjectsStatusRESIZING:
+		return true
+	case OrganizationProjectsResponseProjectsStatusRESTARTING:
+		return true
+	case OrganizationProjectsResponseProjectsStatusRESTOREFAILED:
+		return true
+	case OrganizationProjectsResponseProjectsStatusRESTORING:
+		return true
+	case OrganizationProjectsResponseProjectsStatusUNKNOWN:
+		return true
+	case OrganizationProjectsResponseProjectsStatusUPGRADING:
+		return true
+	default:
+		return false
+	}
+}
+
+// Defines values for PlanGateErrorBodyErrorCode.
+const (
+	EntitlementRequired PlanGateErrorBodyErrorCode = "entitlement_required"
+)
+
+// Valid indicates whether the value is a known member of the PlanGateErrorBodyErrorCode enum.
+func (e PlanGateErrorBodyErrorCode) Valid() bool {
+	switch e {
+	case EntitlementRequired:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for PostgresConfigResponseSessionReplicationRole.
 const (
 	PostgresConfigResponseSessionReplicationRoleLocal   PostgresConfigResponseSessionReplicationRole = "local"
@@ -846,6 +2502,20 @@ const (
 	PostgresConfigResponseSessionReplicationRoleReplica PostgresConfigResponseSessionReplicationRole = "replica"
 )
 
+// Valid indicates whether the value is a known member of the PostgresConfigResponseSessionReplicationRole enum.
+func (e PostgresConfigResponseSessionReplicationRole) Valid() bool {
+	switch e {
+	case PostgresConfigResponseSessionReplicationRoleLocal:
+		return true
+	case PostgresConfigResponseSessionReplicationRoleOrigin:
+		return true
+	case PostgresConfigResponseSessionReplicationRoleReplica:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for ProjectUpgradeEligibilityResponseCurrentAppVersionReleaseChannel.
 const (
 	ProjectUpgradeEligibilityResponseCurrentAppVersionReleaseChannelAlpha     ProjectUpgradeEligibilityResponseCurrentAppVersionReleaseChannel = "alpha"
@@ -856,6 +2526,26 @@ const (
 	ProjectUpgradeEligibilityResponseCurrentAppVersionReleaseChannelWithdrawn ProjectUpgradeEligibilityResponseCurrentAppVersionReleaseChannel = "withdrawn"
 )
 
+// Valid indicates whether the value is a known member of the ProjectUpgradeEligibilityResponseCurrentAppVersionReleaseChannel enum.
+func (e ProjectUpgradeEligibilityResponseCurrentAppVersionReleaseChannel) Valid() bool {
+	switch e {
+	case ProjectUpgradeEligibilityResponseCurrentAppVersionReleaseChannelAlpha:
+		return true
+	case ProjectUpgradeEligibilityResponseCurrentAppVersionReleaseChannelBeta:
+		return true
+	case ProjectUpgradeEligibilityResponseCurrentAppVersionReleaseChannelGa:
+		return true
+	case ProjectUpgradeEligibilityResponseCurrentAppVersionReleaseChannelInternal:
+		return true
+	case ProjectUpgradeEligibilityResponseCurrentAppVersionReleaseChannelPreview:
+		return true
+	case ProjectUpgradeEligibilityResponseCurrentAppVersionReleaseChannelWithdrawn:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for ProjectUpgradeEligibilityResponseTargetUpgradeVersionsPostgresVersion.
 const (
 	N13       ProjectUpgradeEligibilityResponseTargetUpgradeVersionsPostgresVersion = "13"
@@ -865,6 +2555,24 @@ const (
 	N17Oriole ProjectUpgradeEligibilityResponseTargetUpgradeVersionsPostgresVersion = "17-oriole"
 )
 
+// Valid indicates whether the value is a known member of the ProjectUpgradeEligibilityResponseTargetUpgradeVersionsPostgresVersion enum.
+func (e ProjectUpgradeEligibilityResponseTargetUpgradeVersionsPostgresVersion) Valid() bool {
+	switch e {
+	case N13:
+		return true
+	case N14:
+		return true
+	case N15:
+		return true
+	case N17:
+		return true
+	case N17Oriole:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for ProjectUpgradeEligibilityResponseTargetUpgradeVersionsReleaseChannel.
 const (
 	ProjectUpgradeEligibilityResponseTargetUpgradeVersionsReleaseChannelAlpha     ProjectUpgradeEligibilityResponseTargetUpgradeVersionsReleaseChannel = "alpha"
@@ -875,77 +2583,239 @@ const (
 	ProjectUpgradeEligibilityResponseTargetUpgradeVersionsReleaseChannelWithdrawn ProjectUpgradeEligibilityResponseTargetUpgradeVersionsReleaseChannel = "withdrawn"
 )
 
+// Valid indicates whether the value is a known member of the ProjectUpgradeEligibilityResponseTargetUpgradeVersionsReleaseChannel enum.
+func (e ProjectUpgradeEligibilityResponseTargetUpgradeVersionsReleaseChannel) Valid() bool {
+	switch e {
+	case ProjectUpgradeEligibilityResponseTargetUpgradeVersionsReleaseChannelAlpha:
+		return true
+	case ProjectUpgradeEligibilityResponseTargetUpgradeVersionsReleaseChannelBeta:
+		return true
+	case ProjectUpgradeEligibilityResponseTargetUpgradeVersionsReleaseChannelGa:
+		return true
+	case ProjectUpgradeEligibilityResponseTargetUpgradeVersionsReleaseChannelInternal:
+		return true
+	case ProjectUpgradeEligibilityResponseTargetUpgradeVersionsReleaseChannelPreview:
+		return true
+	case ProjectUpgradeEligibilityResponseTargetUpgradeVersionsReleaseChannelWithdrawn:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for ProjectUpgradeEligibilityResponseValidationErrors0Type.
 const (
 	ObjectsDependingOnPgCron ProjectUpgradeEligibilityResponseValidationErrors0Type = "objects_depending_on_pg_cron"
 )
 
+// Valid indicates whether the value is a known member of the ProjectUpgradeEligibilityResponseValidationErrors0Type enum.
+func (e ProjectUpgradeEligibilityResponseValidationErrors0Type) Valid() bool {
+	switch e {
+	case ObjectsDependingOnPgCron:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for ProjectUpgradeEligibilityResponseValidationErrors1Type.
 const (
 	IndexesReferencingLlToEarth ProjectUpgradeEligibilityResponseValidationErrors1Type = "indexes_referencing_ll_to_earth"
 )
 
+// Valid indicates whether the value is a known member of the ProjectUpgradeEligibilityResponseValidationErrors1Type enum.
+func (e ProjectUpgradeEligibilityResponseValidationErrors1Type) Valid() bool {
+	switch e {
+	case IndexesReferencingLlToEarth:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for ProjectUpgradeEligibilityResponseValidationErrors2Type.
 const (
 	FunctionUsingObsoleteLang ProjectUpgradeEligibilityResponseValidationErrors2Type = "function_using_obsolete_lang"
 )
 
+// Valid indicates whether the value is a known member of the ProjectUpgradeEligibilityResponseValidationErrors2Type enum.
+func (e ProjectUpgradeEligibilityResponseValidationErrors2Type) Valid() bool {
+	switch e {
+	case FunctionUsingObsoleteLang:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for ProjectUpgradeEligibilityResponseValidationErrors3Type.
 const (
 	UnsupportedExtension ProjectUpgradeEligibilityResponseValidationErrors3Type = "unsupported_extension"
 )
 
+// Valid indicates whether the value is a known member of the ProjectUpgradeEligibilityResponseValidationErrors3Type enum.
+func (e ProjectUpgradeEligibilityResponseValidationErrors3Type) Valid() bool {
+	switch e {
+	case UnsupportedExtension:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for ProjectUpgradeEligibilityResponseValidationErrors4Type.
 const (
 	UnsupportedFdwHandler ProjectUpgradeEligibilityResponseValidationErrors4Type = "unsupported_fdw_handler"
 )
 
+// Valid indicates whether the value is a known member of the ProjectUpgradeEligibilityResponseValidationErrors4Type enum.
+func (e ProjectUpgradeEligibilityResponseValidationErrors4Type) Valid() bool {
+	switch e {
+	case UnsupportedFdwHandler:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for ProjectUpgradeEligibilityResponseValidationErrors5Type.
 const (
 	UnloggedTableWithPersistentSequence ProjectUpgradeEligibilityResponseValidationErrors5Type = "unlogged_table_with_persistent_sequence"
 )
 
+// Valid indicates whether the value is a known member of the ProjectUpgradeEligibilityResponseValidationErrors5Type enum.
+func (e ProjectUpgradeEligibilityResponseValidationErrors5Type) Valid() bool {
+	switch e {
+	case UnloggedTableWithPersistentSequence:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for ProjectUpgradeEligibilityResponseValidationErrors6ObjType.
 const (
 	ProjectUpgradeEligibilityResponseValidationErrors6ObjTypeFunction ProjectUpgradeEligibilityResponseValidationErrors6ObjType = "function"
 	ProjectUpgradeEligibilityResponseValidationErrors6ObjTypeTable    ProjectUpgradeEligibilityResponseValidationErrors6ObjType = "table"
 )
 
+// Valid indicates whether the value is a known member of the ProjectUpgradeEligibilityResponseValidationErrors6ObjType enum.
+func (e ProjectUpgradeEligibilityResponseValidationErrors6ObjType) Valid() bool {
+	switch e {
+	case ProjectUpgradeEligibilityResponseValidationErrors6ObjTypeFunction:
+		return true
+	case ProjectUpgradeEligibilityResponseValidationErrors6ObjTypeTable:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for ProjectUpgradeEligibilityResponseValidationErrors6Type.
 const (
 	UserDefinedObjectsInInternalSchemas ProjectUpgradeEligibilityResponseValidationErrors6Type = "user_defined_objects_in_internal_schemas"
 )
 
+// Valid indicates whether the value is a known member of the ProjectUpgradeEligibilityResponseValidationErrors6Type enum.
+func (e ProjectUpgradeEligibilityResponseValidationErrors6Type) Valid() bool {
+	switch e {
+	case UserDefinedObjectsInInternalSchemas:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for ProjectUpgradeEligibilityResponseValidationErrors7Type.
 const (
 	ActiveReplicationSlot ProjectUpgradeEligibilityResponseValidationErrors7Type = "active_replication_slot"
 )
 
+// Valid indicates whether the value is a known member of the ProjectUpgradeEligibilityResponseValidationErrors7Type enum.
+func (e ProjectUpgradeEligibilityResponseValidationErrors7Type) Valid() bool {
+	switch e {
+	case ActiveReplicationSlot:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for ProjectUpgradeEligibilityResponseValidationErrors8Type.
 const (
 	X86Architecture ProjectUpgradeEligibilityResponseValidationErrors8Type = "x86_architecture"
 )
 
+// Valid indicates whether the value is a known member of the ProjectUpgradeEligibilityResponseValidationErrors8Type enum.
+func (e ProjectUpgradeEligibilityResponseValidationErrors8Type) Valid() bool {
+	switch e {
+	case X86Architecture:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for ProjectUpgradeEligibilityResponseValidationErrors9Type.
 const (
 	ProjectHibernating ProjectUpgradeEligibilityResponseValidationErrors9Type = "project_hibernating"
 )
 
+// Valid indicates whether the value is a known member of the ProjectUpgradeEligibilityResponseValidationErrors9Type enum.
+func (e ProjectUpgradeEligibilityResponseValidationErrors9Type) Valid() bool {
+	switch e {
+	case ProjectHibernating:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for ProjectUpgradeEligibilityResponseWarnings0Type.
 const (
 	PgGraphqlIntrospectionChange ProjectUpgradeEligibilityResponseWarnings0Type = "pg_graphql_introspection_change"
 )
 
+// Valid indicates whether the value is a known member of the ProjectUpgradeEligibilityResponseWarnings0Type enum.
+func (e ProjectUpgradeEligibilityResponseWarnings0Type) Valid() bool {
+	switch e {
+	case PgGraphqlIntrospectionChange:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for ProjectUpgradeEligibilityResponseWarnings1Type.
 const (
 	LtreeReindexRequired ProjectUpgradeEligibilityResponseWarnings1Type = "ltree_reindex_required"
 )
 
+// Valid indicates whether the value is a known member of the ProjectUpgradeEligibilityResponseWarnings1Type enum.
+func (e ProjectUpgradeEligibilityResponseWarnings1Type) Valid() bool {
+	switch e {
+	case LtreeReindexRequired:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for ProjectUpgradeEligibilityResponseWarnings2Type.
 const (
 	OperatorEstimatorGate ProjectUpgradeEligibilityResponseWarnings2Type = "operator_estimator_gate"
 )
 
+// Valid indicates whether the value is a known member of the ProjectUpgradeEligibilityResponseWarnings2Type enum.
+func (e ProjectUpgradeEligibilityResponseWarnings2Type) Valid() bool {
+	switch e {
+	case OperatorEstimatorGate:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for RegionsInfoAllSmartGroupCode.
 const (
 	RegionsInfoAllSmartGroupCodeAmericas RegionsInfoAllSmartGroupCode = "americas"
@@ -953,11 +2823,35 @@ const (
 	RegionsInfoAllSmartGroupCodeEmea     RegionsInfoAllSmartGroupCode = "emea"
 )
 
+// Valid indicates whether the value is a known member of the RegionsInfoAllSmartGroupCode enum.
+func (e RegionsInfoAllSmartGroupCode) Valid() bool {
+	switch e {
+	case RegionsInfoAllSmartGroupCodeAmericas:
+		return true
+	case RegionsInfoAllSmartGroupCodeApac:
+		return true
+	case RegionsInfoAllSmartGroupCodeEmea:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for RegionsInfoAllSmartGroupType.
 const (
 	RegionsInfoAllSmartGroupTypeSmartGroup RegionsInfoAllSmartGroupType = "smartGroup"
 )
 
+// Valid indicates whether the value is a known member of the RegionsInfoAllSmartGroupType enum.
+func (e RegionsInfoAllSmartGroupType) Valid() bool {
+	switch e {
+	case RegionsInfoAllSmartGroupTypeSmartGroup:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for RegionsInfoAllSpecificCode.
 const (
 	RegionsInfoAllSpecificCodeApEast1      RegionsInfoAllSpecificCode = "ap-east-1"
@@ -980,6 +2874,50 @@ const (
 	RegionsInfoAllSpecificCodeUsWest2      RegionsInfoAllSpecificCode = "us-west-2"
 )
 
+// Valid indicates whether the value is a known member of the RegionsInfoAllSpecificCode enum.
+func (e RegionsInfoAllSpecificCode) Valid() bool {
+	switch e {
+	case RegionsInfoAllSpecificCodeApEast1:
+		return true
+	case RegionsInfoAllSpecificCodeApNortheast1:
+		return true
+	case RegionsInfoAllSpecificCodeApNortheast2:
+		return true
+	case RegionsInfoAllSpecificCodeApSouth1:
+		return true
+	case RegionsInfoAllSpecificCodeApSoutheast1:
+		return true
+	case RegionsInfoAllSpecificCodeApSoutheast2:
+		return true
+	case RegionsInfoAllSpecificCodeCaCentral1:
+		return true
+	case RegionsInfoAllSpecificCodeEuCentral1:
+		return true
+	case RegionsInfoAllSpecificCodeEuCentral2:
+		return true
+	case RegionsInfoAllSpecificCodeEuNorth1:
+		return true
+	case RegionsInfoAllSpecificCodeEuWest1:
+		return true
+	case RegionsInfoAllSpecificCodeEuWest2:
+		return true
+	case RegionsInfoAllSpecificCodeEuWest3:
+		return true
+	case RegionsInfoAllSpecificCodeSaEast1:
+		return true
+	case RegionsInfoAllSpecificCodeUsEast1:
+		return true
+	case RegionsInfoAllSpecificCodeUsEast2:
+		return true
+	case RegionsInfoAllSpecificCodeUsWest1:
+		return true
+	case RegionsInfoAllSpecificCodeUsWest2:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for RegionsInfoAllSpecificProvider.
 const (
 	RegionsInfoAllSpecificProviderAWS       RegionsInfoAllSpecificProvider = "AWS"
@@ -988,17 +2926,55 @@ const (
 	RegionsInfoAllSpecificProviderFLY       RegionsInfoAllSpecificProvider = "FLY"
 )
 
+// Valid indicates whether the value is a known member of the RegionsInfoAllSpecificProvider enum.
+func (e RegionsInfoAllSpecificProvider) Valid() bool {
+	switch e {
+	case RegionsInfoAllSpecificProviderAWS:
+		return true
+	case RegionsInfoAllSpecificProviderAWSK8S:
+		return true
+	case RegionsInfoAllSpecificProviderAWSNIMBUS:
+		return true
+	case RegionsInfoAllSpecificProviderFLY:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for RegionsInfoAllSpecificStatus.
 const (
 	RegionsInfoAllSpecificStatusCapacity RegionsInfoAllSpecificStatus = "capacity"
 	RegionsInfoAllSpecificStatusOther    RegionsInfoAllSpecificStatus = "other"
 )
 
+// Valid indicates whether the value is a known member of the RegionsInfoAllSpecificStatus enum.
+func (e RegionsInfoAllSpecificStatus) Valid() bool {
+	switch e {
+	case RegionsInfoAllSpecificStatusCapacity:
+		return true
+	case RegionsInfoAllSpecificStatusOther:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for RegionsInfoAllSpecificType.
 const (
 	RegionsInfoAllSpecificTypeSpecific RegionsInfoAllSpecificType = "specific"
 )
 
+// Valid indicates whether the value is a known member of the RegionsInfoAllSpecificType enum.
+func (e RegionsInfoAllSpecificType) Valid() bool {
+	switch e {
+	case RegionsInfoAllSpecificTypeSpecific:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for RegionsInfoRecommendationsSmartGroupCode.
 const (
 	RegionsInfoRecommendationsSmartGroupCodeAmericas RegionsInfoRecommendationsSmartGroupCode = "americas"
@@ -1006,11 +2982,35 @@ const (
 	RegionsInfoRecommendationsSmartGroupCodeEmea     RegionsInfoRecommendationsSmartGroupCode = "emea"
 )
 
+// Valid indicates whether the value is a known member of the RegionsInfoRecommendationsSmartGroupCode enum.
+func (e RegionsInfoRecommendationsSmartGroupCode) Valid() bool {
+	switch e {
+	case RegionsInfoRecommendationsSmartGroupCodeAmericas:
+		return true
+	case RegionsInfoRecommendationsSmartGroupCodeApac:
+		return true
+	case RegionsInfoRecommendationsSmartGroupCodeEmea:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for RegionsInfoRecommendationsSmartGroupType.
 const (
 	RegionsInfoRecommendationsSmartGroupTypeSmartGroup RegionsInfoRecommendationsSmartGroupType = "smartGroup"
 )
 
+// Valid indicates whether the value is a known member of the RegionsInfoRecommendationsSmartGroupType enum.
+func (e RegionsInfoRecommendationsSmartGroupType) Valid() bool {
+	switch e {
+	case RegionsInfoRecommendationsSmartGroupTypeSmartGroup:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for RegionsInfoRecommendationsSpecificCode.
 const (
 	RegionsInfoRecommendationsSpecificCodeApEast1      RegionsInfoRecommendationsSpecificCode = "ap-east-1"
@@ -1033,6 +3033,50 @@ const (
 	RegionsInfoRecommendationsSpecificCodeUsWest2      RegionsInfoRecommendationsSpecificCode = "us-west-2"
 )
 
+// Valid indicates whether the value is a known member of the RegionsInfoRecommendationsSpecificCode enum.
+func (e RegionsInfoRecommendationsSpecificCode) Valid() bool {
+	switch e {
+	case RegionsInfoRecommendationsSpecificCodeApEast1:
+		return true
+	case RegionsInfoRecommendationsSpecificCodeApNortheast1:
+		return true
+	case RegionsInfoRecommendationsSpecificCodeApNortheast2:
+		return true
+	case RegionsInfoRecommendationsSpecificCodeApSouth1:
+		return true
+	case RegionsInfoRecommendationsSpecificCodeApSoutheast1:
+		return true
+	case RegionsInfoRecommendationsSpecificCodeApSoutheast2:
+		return true
+	case RegionsInfoRecommendationsSpecificCodeCaCentral1:
+		return true
+	case RegionsInfoRecommendationsSpecificCodeEuCentral1:
+		return true
+	case RegionsInfoRecommendationsSpecificCodeEuCentral2:
+		return true
+	case RegionsInfoRecommendationsSpecificCodeEuNorth1:
+		return true
+	case RegionsInfoRecommendationsSpecificCodeEuWest1:
+		return true
+	case RegionsInfoRecommendationsSpecificCodeEuWest2:
+		return true
+	case RegionsInfoRecommendationsSpecificCodeEuWest3:
+		return true
+	case RegionsInfoRecommendationsSpecificCodeSaEast1:
+		return true
+	case RegionsInfoRecommendationsSpecificCodeUsEast1:
+		return true
+	case RegionsInfoRecommendationsSpecificCodeUsEast2:
+		return true
+	case RegionsInfoRecommendationsSpecificCodeUsWest1:
+		return true
+	case RegionsInfoRecommendationsSpecificCodeUsWest2:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for RegionsInfoRecommendationsSpecificProvider.
 const (
 	RegionsInfoRecommendationsSpecificProviderAWS       RegionsInfoRecommendationsSpecificProvider = "AWS"
@@ -1041,17 +3085,55 @@ const (
 	RegionsInfoRecommendationsSpecificProviderFLY       RegionsInfoRecommendationsSpecificProvider = "FLY"
 )
 
+// Valid indicates whether the value is a known member of the RegionsInfoRecommendationsSpecificProvider enum.
+func (e RegionsInfoRecommendationsSpecificProvider) Valid() bool {
+	switch e {
+	case RegionsInfoRecommendationsSpecificProviderAWS:
+		return true
+	case RegionsInfoRecommendationsSpecificProviderAWSK8S:
+		return true
+	case RegionsInfoRecommendationsSpecificProviderAWSNIMBUS:
+		return true
+	case RegionsInfoRecommendationsSpecificProviderFLY:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for RegionsInfoRecommendationsSpecificStatus.
 const (
 	RegionsInfoRecommendationsSpecificStatusCapacity RegionsInfoRecommendationsSpecificStatus = "capacity"
 	RegionsInfoRecommendationsSpecificStatusOther    RegionsInfoRecommendationsSpecificStatus = "other"
 )
 
+// Valid indicates whether the value is a known member of the RegionsInfoRecommendationsSpecificStatus enum.
+func (e RegionsInfoRecommendationsSpecificStatus) Valid() bool {
+	switch e {
+	case RegionsInfoRecommendationsSpecificStatusCapacity:
+		return true
+	case RegionsInfoRecommendationsSpecificStatusOther:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for RegionsInfoRecommendationsSpecificType.
 const (
 	RegionsInfoRecommendationsSpecificTypeSpecific RegionsInfoRecommendationsSpecificType = "specific"
 )
 
+// Valid indicates whether the value is a known member of the RegionsInfoRecommendationsSpecificType enum.
+func (e RegionsInfoRecommendationsSpecificType) Valid() bool {
+	switch e {
+	case RegionsInfoRecommendationsSpecificTypeSpecific:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for SetUpReadReplicaBodyReadReplicaRegion.
 const (
 	SetUpReadReplicaBodyReadReplicaRegionApEast1      SetUpReadReplicaBodyReadReplicaRegion = "ap-east-1"
@@ -1074,6 +3156,50 @@ const (
 	SetUpReadReplicaBodyReadReplicaRegionUsWest2      SetUpReadReplicaBodyReadReplicaRegion = "us-west-2"
 )
 
+// Valid indicates whether the value is a known member of the SetUpReadReplicaBodyReadReplicaRegion enum.
+func (e SetUpReadReplicaBodyReadReplicaRegion) Valid() bool {
+	switch e {
+	case SetUpReadReplicaBodyReadReplicaRegionApEast1:
+		return true
+	case SetUpReadReplicaBodyReadReplicaRegionApNortheast1:
+		return true
+	case SetUpReadReplicaBodyReadReplicaRegionApNortheast2:
+		return true
+	case SetUpReadReplicaBodyReadReplicaRegionApSouth1:
+		return true
+	case SetUpReadReplicaBodyReadReplicaRegionApSoutheast1:
+		return true
+	case SetUpReadReplicaBodyReadReplicaRegionApSoutheast2:
+		return true
+	case SetUpReadReplicaBodyReadReplicaRegionCaCentral1:
+		return true
+	case SetUpReadReplicaBodyReadReplicaRegionEuCentral1:
+		return true
+	case SetUpReadReplicaBodyReadReplicaRegionEuCentral2:
+		return true
+	case SetUpReadReplicaBodyReadReplicaRegionEuNorth1:
+		return true
+	case SetUpReadReplicaBodyReadReplicaRegionEuWest1:
+		return true
+	case SetUpReadReplicaBodyReadReplicaRegionEuWest2:
+		return true
+	case SetUpReadReplicaBodyReadReplicaRegionEuWest3:
+		return true
+	case SetUpReadReplicaBodyReadReplicaRegionSaEast1:
+		return true
+	case SetUpReadReplicaBodyReadReplicaRegionUsEast1:
+		return true
+	case SetUpReadReplicaBodyReadReplicaRegionUsEast2:
+		return true
+	case SetUpReadReplicaBodyReadReplicaRegionUsWest1:
+		return true
+	case SetUpReadReplicaBodyReadReplicaRegionUsWest2:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for SigningKeyResponseAlgorithm.
 const (
 	SigningKeyResponseAlgorithmES256 SigningKeyResponseAlgorithm = "ES256"
@@ -1082,6 +3208,22 @@ const (
 	SigningKeyResponseAlgorithmRS256 SigningKeyResponseAlgorithm = "RS256"
 )
 
+// Valid indicates whether the value is a known member of the SigningKeyResponseAlgorithm enum.
+func (e SigningKeyResponseAlgorithm) Valid() bool {
+	switch e {
+	case SigningKeyResponseAlgorithmES256:
+		return true
+	case SigningKeyResponseAlgorithmEdDSA:
+		return true
+	case SigningKeyResponseAlgorithmHS256:
+		return true
+	case SigningKeyResponseAlgorithmRS256:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for SigningKeyResponseStatus.
 const (
 	SigningKeyResponseStatusInUse          SigningKeyResponseStatus = "in_use"
@@ -1090,6 +3232,22 @@ const (
 	SigningKeyResponseStatusStandby        SigningKeyResponseStatus = "standby"
 )
 
+// Valid indicates whether the value is a known member of the SigningKeyResponseStatus enum.
+func (e SigningKeyResponseStatus) Valid() bool {
+	switch e {
+	case SigningKeyResponseStatusInUse:
+		return true
+	case SigningKeyResponseStatusPreviouslyUsed:
+		return true
+	case SigningKeyResponseStatusRevoked:
+		return true
+	case SigningKeyResponseStatusStandby:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for SigningKeysResponseKeysAlgorithm.
 const (
 	SigningKeysResponseKeysAlgorithmES256 SigningKeysResponseKeysAlgorithm = "ES256"
@@ -1098,6 +3256,22 @@ const (
 	SigningKeysResponseKeysAlgorithmRS256 SigningKeysResponseKeysAlgorithm = "RS256"
 )
 
+// Valid indicates whether the value is a known member of the SigningKeysResponseKeysAlgorithm enum.
+func (e SigningKeysResponseKeysAlgorithm) Valid() bool {
+	switch e {
+	case SigningKeysResponseKeysAlgorithmES256:
+		return true
+	case SigningKeysResponseKeysAlgorithmEdDSA:
+		return true
+	case SigningKeysResponseKeysAlgorithmHS256:
+		return true
+	case SigningKeysResponseKeysAlgorithmRS256:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for SigningKeysResponseKeysStatus.
 const (
 	SigningKeysResponseKeysStatusInUse          SigningKeysResponseKeysStatus = "in_use"
@@ -1106,11 +3280,37 @@ const (
 	SigningKeysResponseKeysStatusStandby        SigningKeysResponseKeysStatus = "standby"
 )
 
+// Valid indicates whether the value is a known member of the SigningKeysResponseKeysStatus enum.
+func (e SigningKeysResponseKeysStatus) Valid() bool {
+	switch e {
+	case SigningKeysResponseKeysStatusInUse:
+		return true
+	case SigningKeysResponseKeysStatusPreviouslyUsed:
+		return true
+	case SigningKeysResponseKeysStatusRevoked:
+		return true
+	case SigningKeysResponseKeysStatusStandby:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for SnippetListDataType.
 const (
 	SnippetListDataTypeSql SnippetListDataType = "sql"
 )
 
+// Valid indicates whether the value is a known member of the SnippetListDataType enum.
+func (e SnippetListDataType) Valid() bool {
+	switch e {
+	case SnippetListDataTypeSql:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for SnippetListDataVisibility.
 const (
 	SnippetListDataVisibilityOrg     SnippetListDataVisibility = "org"
@@ -1119,11 +3319,37 @@ const (
 	SnippetListDataVisibilityUser    SnippetListDataVisibility = "user"
 )
 
+// Valid indicates whether the value is a known member of the SnippetListDataVisibility enum.
+func (e SnippetListDataVisibility) Valid() bool {
+	switch e {
+	case SnippetListDataVisibilityOrg:
+		return true
+	case SnippetListDataVisibilityProject:
+		return true
+	case SnippetListDataVisibilityPublic:
+		return true
+	case SnippetListDataVisibilityUser:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for SnippetResponseType.
 const (
 	SnippetResponseTypeSql SnippetResponseType = "sql"
 )
 
+// Valid indicates whether the value is a known member of the SnippetResponseType enum.
+func (e SnippetResponseType) Valid() bool {
+	switch e {
+	case SnippetResponseTypeSql:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for SnippetResponseVisibility.
 const (
 	SnippetResponseVisibilityOrg     SnippetResponseVisibility = "org"
@@ -1132,30 +3358,94 @@ const (
 	SnippetResponseVisibilityUser    SnippetResponseVisibility = "user"
 )
 
+// Valid indicates whether the value is a known member of the SnippetResponseVisibility enum.
+func (e SnippetResponseVisibility) Valid() bool {
+	switch e {
+	case SnippetResponseVisibilityOrg:
+		return true
+	case SnippetResponseVisibilityProject:
+		return true
+	case SnippetResponseVisibilityPublic:
+		return true
+	case SnippetResponseVisibilityUser:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for StorageConfigResponseExternalUpstreamTarget.
 const (
 	StorageConfigResponseExternalUpstreamTargetCanary StorageConfigResponseExternalUpstreamTarget = "canary"
 	StorageConfigResponseExternalUpstreamTargetMain   StorageConfigResponseExternalUpstreamTarget = "main"
 )
 
+// Valid indicates whether the value is a known member of the StorageConfigResponseExternalUpstreamTarget enum.
+func (e StorageConfigResponseExternalUpstreamTarget) Valid() bool {
+	switch e {
+	case StorageConfigResponseExternalUpstreamTargetCanary:
+		return true
+	case StorageConfigResponseExternalUpstreamTargetMain:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for SupavisorConfigResponseDatabaseType.
 const (
 	SupavisorConfigResponseDatabaseTypePRIMARY     SupavisorConfigResponseDatabaseType = "PRIMARY"
 	SupavisorConfigResponseDatabaseTypeREADREPLICA SupavisorConfigResponseDatabaseType = "READ_REPLICA"
 )
 
+// Valid indicates whether the value is a known member of the SupavisorConfigResponseDatabaseType enum.
+func (e SupavisorConfigResponseDatabaseType) Valid() bool {
+	switch e {
+	case SupavisorConfigResponseDatabaseTypePRIMARY:
+		return true
+	case SupavisorConfigResponseDatabaseTypeREADREPLICA:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for SupavisorConfigResponsePoolMode.
 const (
 	SupavisorConfigResponsePoolModeSession     SupavisorConfigResponsePoolMode = "session"
 	SupavisorConfigResponsePoolModeTransaction SupavisorConfigResponsePoolMode = "transaction"
 )
 
+// Valid indicates whether the value is a known member of the SupavisorConfigResponsePoolMode enum.
+func (e SupavisorConfigResponsePoolMode) Valid() bool {
+	switch e {
+	case SupavisorConfigResponsePoolModeSession:
+		return true
+	case SupavisorConfigResponsePoolModeTransaction:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for UpdateAuthConfigBodyDbMaxPoolSizeUnit.
 const (
 	UpdateAuthConfigBodyDbMaxPoolSizeUnitConnections UpdateAuthConfigBodyDbMaxPoolSizeUnit = "connections"
 	UpdateAuthConfigBodyDbMaxPoolSizeUnitPercent     UpdateAuthConfigBodyDbMaxPoolSizeUnit = "percent"
 )
 
+// Valid indicates whether the value is a known member of the UpdateAuthConfigBodyDbMaxPoolSizeUnit enum.
+func (e UpdateAuthConfigBodyDbMaxPoolSizeUnit) Valid() bool {
+	switch e {
+	case UpdateAuthConfigBodyDbMaxPoolSizeUnitConnections:
+		return true
+	case UpdateAuthConfigBodyDbMaxPoolSizeUnitPercent:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for UpdateAuthConfigBodyPasswordRequiredCharacters.
 const (
 	UpdateAuthConfigBodyPasswordRequiredCharactersAbcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789  UpdateAuthConfigBodyPasswordRequiredCharacters = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ:0123456789"
@@ -1164,12 +3454,40 @@ const (
 	UpdateAuthConfigBodyPasswordRequiredCharactersEmpty                                                           UpdateAuthConfigBodyPasswordRequiredCharacters = ""
 )
 
+// Valid indicates whether the value is a known member of the UpdateAuthConfigBodyPasswordRequiredCharacters enum.
+func (e UpdateAuthConfigBodyPasswordRequiredCharacters) Valid() bool {
+	switch e {
+	case UpdateAuthConfigBodyPasswordRequiredCharactersAbcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789:
+		return true
+	case UpdateAuthConfigBodyPasswordRequiredCharactersAbcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ01234567891:
+		return true
+	case UpdateAuthConfigBodyPasswordRequiredCharactersAbcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ01234567892:
+		return true
+	case UpdateAuthConfigBodyPasswordRequiredCharactersEmpty:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for UpdateAuthConfigBodySecurityCaptchaProvider.
 const (
 	UpdateAuthConfigBodySecurityCaptchaProviderHcaptcha  UpdateAuthConfigBodySecurityCaptchaProvider = "hcaptcha"
 	UpdateAuthConfigBodySecurityCaptchaProviderTurnstile UpdateAuthConfigBodySecurityCaptchaProvider = "turnstile"
 )
 
+// Valid indicates whether the value is a known member of the UpdateAuthConfigBodySecurityCaptchaProvider enum.
+func (e UpdateAuthConfigBodySecurityCaptchaProvider) Valid() bool {
+	switch e {
+	case UpdateAuthConfigBodySecurityCaptchaProviderHcaptcha:
+		return true
+	case UpdateAuthConfigBodySecurityCaptchaProviderTurnstile:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for UpdateAuthConfigBodySmsProvider.
 const (
 	UpdateAuthConfigBodySmsProviderMessagebird  UpdateAuthConfigBodySmsProvider = "messagebird"
@@ -1179,6 +3497,24 @@ const (
 	UpdateAuthConfigBodySmsProviderVonage       UpdateAuthConfigBodySmsProvider = "vonage"
 )
 
+// Valid indicates whether the value is a known member of the UpdateAuthConfigBodySmsProvider enum.
+func (e UpdateAuthConfigBodySmsProvider) Valid() bool {
+	switch e {
+	case UpdateAuthConfigBodySmsProviderMessagebird:
+		return true
+	case UpdateAuthConfigBodySmsProviderTextlocal:
+		return true
+	case UpdateAuthConfigBodySmsProviderTwilio:
+		return true
+	case UpdateAuthConfigBodySmsProviderTwilioVerify:
+		return true
+	case UpdateAuthConfigBodySmsProviderVonage:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for UpdateBranchBodyStatus.
 const (
 	UpdateBranchBodyStatusCREATINGPROJECT   UpdateBranchBodyStatus = "CREATING_PROJECT"
@@ -1189,6 +3525,26 @@ const (
 	UpdateBranchBodyStatusRUNNINGMIGRATIONS UpdateBranchBodyStatus = "RUNNING_MIGRATIONS"
 )
 
+// Valid indicates whether the value is a known member of the UpdateBranchBodyStatus enum.
+func (e UpdateBranchBodyStatus) Valid() bool {
+	switch e {
+	case UpdateBranchBodyStatusCREATINGPROJECT:
+		return true
+	case UpdateBranchBodyStatusFUNCTIONSDEPLOYED:
+		return true
+	case UpdateBranchBodyStatusFUNCTIONSFAILED:
+		return true
+	case UpdateBranchBodyStatusMIGRATIONSFAILED:
+		return true
+	case UpdateBranchBodyStatusMIGRATIONSPASSED:
+		return true
+	case UpdateBranchBodyStatusRUNNINGMIGRATIONS:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for UpdateCustomHostnameResponseStatus.
 const (
 	N1NotStarted           UpdateCustomHostnameResponseStatus = "1_not_started"
@@ -1198,6 +3554,24 @@ const (
 	N5ServicesReconfigured UpdateCustomHostnameResponseStatus = "5_services_reconfigured"
 )
 
+// Valid indicates whether the value is a known member of the UpdateCustomHostnameResponseStatus enum.
+func (e UpdateCustomHostnameResponseStatus) Valid() bool {
+	switch e {
+	case N1NotStarted:
+		return true
+	case N2Initiated:
+		return true
+	case N3ChallengeVerified:
+		return true
+	case N4OriginSetupCompleted:
+		return true
+	case N5ServicesReconfigured:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for UpdatePostgresConfigBodySessionReplicationRole.
 const (
 	UpdatePostgresConfigBodySessionReplicationRoleLocal   UpdatePostgresConfigBodySessionReplicationRole = "local"
@@ -1205,6 +3579,20 @@ const (
 	UpdatePostgresConfigBodySessionReplicationRoleReplica UpdatePostgresConfigBodySessionReplicationRole = "replica"
 )
 
+// Valid indicates whether the value is a known member of the UpdatePostgresConfigBodySessionReplicationRole enum.
+func (e UpdatePostgresConfigBodySessionReplicationRole) Valid() bool {
+	switch e {
+	case UpdatePostgresConfigBodySessionReplicationRoleLocal:
+		return true
+	case UpdatePostgresConfigBodySessionReplicationRoleOrigin:
+		return true
+	case UpdatePostgresConfigBodySessionReplicationRoleReplica:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for UpdateProviderBodyNameIdFormat.
 const (
 	UpdateProviderBodyNameIdFormatUrnOasisNamesTcSAML11NameidFormatEmailAddress UpdateProviderBodyNameIdFormat = "urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"
@@ -1213,6 +3601,22 @@ const (
 	UpdateProviderBodyNameIdFormatUrnOasisNamesTcSAML20NameidFormatTransient    UpdateProviderBodyNameIdFormat = "urn:oasis:names:tc:SAML:2.0:nameid-format:transient"
 )
 
+// Valid indicates whether the value is a known member of the UpdateProviderBodyNameIdFormat enum.
+func (e UpdateProviderBodyNameIdFormat) Valid() bool {
+	switch e {
+	case UpdateProviderBodyNameIdFormatUrnOasisNamesTcSAML11NameidFormatEmailAddress:
+		return true
+	case UpdateProviderBodyNameIdFormatUrnOasisNamesTcSAML11NameidFormatUnspecified:
+		return true
+	case UpdateProviderBodyNameIdFormatUrnOasisNamesTcSAML20NameidFormatPersistent:
+		return true
+	case UpdateProviderBodyNameIdFormatUrnOasisNamesTcSAML20NameidFormatTransient:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for UpdateRunStatusBodyClone.
 const (
 	UpdateRunStatusBodyCloneCREATED    UpdateRunStatusBodyClone = "CREATED"
@@ -1224,6 +3628,28 @@ const (
 	UpdateRunStatusBodyCloneRUNNING    UpdateRunStatusBodyClone = "RUNNING"
 )
 
+// Valid indicates whether the value is a known member of the UpdateRunStatusBodyClone enum.
+func (e UpdateRunStatusBodyClone) Valid() bool {
+	switch e {
+	case UpdateRunStatusBodyCloneCREATED:
+		return true
+	case UpdateRunStatusBodyCloneDEAD:
+		return true
+	case UpdateRunStatusBodyCloneEXITED:
+		return true
+	case UpdateRunStatusBodyClonePAUSED:
+		return true
+	case UpdateRunStatusBodyCloneREMOVING:
+		return true
+	case UpdateRunStatusBodyCloneRESTARTING:
+		return true
+	case UpdateRunStatusBodyCloneRUNNING:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for UpdateRunStatusBodyConfigure.
 const (
 	UpdateRunStatusBodyConfigureCREATED    UpdateRunStatusBodyConfigure = "CREATED"
@@ -1235,6 +3661,28 @@ const (
 	UpdateRunStatusBodyConfigureRUNNING    UpdateRunStatusBodyConfigure = "RUNNING"
 )
 
+// Valid indicates whether the value is a known member of the UpdateRunStatusBodyConfigure enum.
+func (e UpdateRunStatusBodyConfigure) Valid() bool {
+	switch e {
+	case UpdateRunStatusBodyConfigureCREATED:
+		return true
+	case UpdateRunStatusBodyConfigureDEAD:
+		return true
+	case UpdateRunStatusBodyConfigureEXITED:
+		return true
+	case UpdateRunStatusBodyConfigurePAUSED:
+		return true
+	case UpdateRunStatusBodyConfigureREMOVING:
+		return true
+	case UpdateRunStatusBodyConfigureRESTARTING:
+		return true
+	case UpdateRunStatusBodyConfigureRUNNING:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for UpdateRunStatusBodyDeploy.
 const (
 	UpdateRunStatusBodyDeployCREATED    UpdateRunStatusBodyDeploy = "CREATED"
@@ -1246,6 +3694,28 @@ const (
 	UpdateRunStatusBodyDeployRUNNING    UpdateRunStatusBodyDeploy = "RUNNING"
 )
 
+// Valid indicates whether the value is a known member of the UpdateRunStatusBodyDeploy enum.
+func (e UpdateRunStatusBodyDeploy) Valid() bool {
+	switch e {
+	case UpdateRunStatusBodyDeployCREATED:
+		return true
+	case UpdateRunStatusBodyDeployDEAD:
+		return true
+	case UpdateRunStatusBodyDeployEXITED:
+		return true
+	case UpdateRunStatusBodyDeployPAUSED:
+		return true
+	case UpdateRunStatusBodyDeployREMOVING:
+		return true
+	case UpdateRunStatusBodyDeployRESTARTING:
+		return true
+	case UpdateRunStatusBodyDeployRUNNING:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for UpdateRunStatusBodyHealth.
 const (
 	UpdateRunStatusBodyHealthCREATED    UpdateRunStatusBodyHealth = "CREATED"
@@ -1257,6 +3727,28 @@ const (
 	UpdateRunStatusBodyHealthRUNNING    UpdateRunStatusBodyHealth = "RUNNING"
 )
 
+// Valid indicates whether the value is a known member of the UpdateRunStatusBodyHealth enum.
+func (e UpdateRunStatusBodyHealth) Valid() bool {
+	switch e {
+	case UpdateRunStatusBodyHealthCREATED:
+		return true
+	case UpdateRunStatusBodyHealthDEAD:
+		return true
+	case UpdateRunStatusBodyHealthEXITED:
+		return true
+	case UpdateRunStatusBodyHealthPAUSED:
+		return true
+	case UpdateRunStatusBodyHealthREMOVING:
+		return true
+	case UpdateRunStatusBodyHealthRESTARTING:
+		return true
+	case UpdateRunStatusBodyHealthRUNNING:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for UpdateRunStatusBodyMigrate.
 const (
 	UpdateRunStatusBodyMigrateCREATED    UpdateRunStatusBodyMigrate = "CREATED"
@@ -1268,6 +3760,28 @@ const (
 	UpdateRunStatusBodyMigrateRUNNING    UpdateRunStatusBodyMigrate = "RUNNING"
 )
 
+// Valid indicates whether the value is a known member of the UpdateRunStatusBodyMigrate enum.
+func (e UpdateRunStatusBodyMigrate) Valid() bool {
+	switch e {
+	case UpdateRunStatusBodyMigrateCREATED:
+		return true
+	case UpdateRunStatusBodyMigrateDEAD:
+		return true
+	case UpdateRunStatusBodyMigrateEXITED:
+		return true
+	case UpdateRunStatusBodyMigratePAUSED:
+		return true
+	case UpdateRunStatusBodyMigrateREMOVING:
+		return true
+	case UpdateRunStatusBodyMigrateRESTARTING:
+		return true
+	case UpdateRunStatusBodyMigrateRUNNING:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for UpdateRunStatusBodyPull.
 const (
 	UpdateRunStatusBodyPullCREATED    UpdateRunStatusBodyPull = "CREATED"
@@ -1279,6 +3793,28 @@ const (
 	UpdateRunStatusBodyPullRUNNING    UpdateRunStatusBodyPull = "RUNNING"
 )
 
+// Valid indicates whether the value is a known member of the UpdateRunStatusBodyPull enum.
+func (e UpdateRunStatusBodyPull) Valid() bool {
+	switch e {
+	case UpdateRunStatusBodyPullCREATED:
+		return true
+	case UpdateRunStatusBodyPullDEAD:
+		return true
+	case UpdateRunStatusBodyPullEXITED:
+		return true
+	case UpdateRunStatusBodyPullPAUSED:
+		return true
+	case UpdateRunStatusBodyPullREMOVING:
+		return true
+	case UpdateRunStatusBodyPullRESTARTING:
+		return true
+	case UpdateRunStatusBodyPullRUNNING:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for UpdateRunStatusBodySeed.
 const (
 	UpdateRunStatusBodySeedCREATED    UpdateRunStatusBodySeed = "CREATED"
@@ -1290,11 +3826,43 @@ const (
 	UpdateRunStatusBodySeedRUNNING    UpdateRunStatusBodySeed = "RUNNING"
 )
 
+// Valid indicates whether the value is a known member of the UpdateRunStatusBodySeed enum.
+func (e UpdateRunStatusBodySeed) Valid() bool {
+	switch e {
+	case UpdateRunStatusBodySeedCREATED:
+		return true
+	case UpdateRunStatusBodySeedDEAD:
+		return true
+	case UpdateRunStatusBodySeedEXITED:
+		return true
+	case UpdateRunStatusBodySeedPAUSED:
+		return true
+	case UpdateRunStatusBodySeedREMOVING:
+		return true
+	case UpdateRunStatusBodySeedRESTARTING:
+		return true
+	case UpdateRunStatusBodySeedRUNNING:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for UpdateRunStatusResponseMessage.
 const (
 	UpdateRunStatusResponseMessageOk UpdateRunStatusResponseMessage = "ok"
 )
 
+// Valid indicates whether the value is a known member of the UpdateRunStatusResponseMessage enum.
+func (e UpdateRunStatusResponseMessage) Valid() bool {
+	switch e {
+	case UpdateRunStatusResponseMessageOk:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for UpdateSigningKeyBodyStatus.
 const (
 	UpdateSigningKeyBodyStatusInUse          UpdateSigningKeyBodyStatus = "in_use"
@@ -1303,18 +3871,58 @@ const (
 	UpdateSigningKeyBodyStatusStandby        UpdateSigningKeyBodyStatus = "standby"
 )
 
+// Valid indicates whether the value is a known member of the UpdateSigningKeyBodyStatus enum.
+func (e UpdateSigningKeyBodyStatus) Valid() bool {
+	switch e {
+	case UpdateSigningKeyBodyStatusInUse:
+		return true
+	case UpdateSigningKeyBodyStatusPreviouslyUsed:
+		return true
+	case UpdateSigningKeyBodyStatusRevoked:
+		return true
+	case UpdateSigningKeyBodyStatusStandby:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for UpdateStorageConfigBodyExternalUpstreamTarget.
 const (
 	UpdateStorageConfigBodyExternalUpstreamTargetCanary UpdateStorageConfigBodyExternalUpstreamTarget = "canary"
 	UpdateStorageConfigBodyExternalUpstreamTargetMain   UpdateStorageConfigBodyExternalUpstreamTarget = "main"
 )
 
+// Valid indicates whether the value is a known member of the UpdateStorageConfigBodyExternalUpstreamTarget enum.
+func (e UpdateStorageConfigBodyExternalUpstreamTarget) Valid() bool {
+	switch e {
+	case UpdateStorageConfigBodyExternalUpstreamTargetCanary:
+		return true
+	case UpdateStorageConfigBodyExternalUpstreamTargetMain:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for UpdateSupavisorConfigBodyPoolMode.
 const (
 	UpdateSupavisorConfigBodyPoolModeSession     UpdateSupavisorConfigBodyPoolMode = "session"
 	UpdateSupavisorConfigBodyPoolModeTransaction UpdateSupavisorConfigBodyPoolMode = "transaction"
 )
 
+// Valid indicates whether the value is a known member of the UpdateSupavisorConfigBodyPoolMode enum.
+func (e UpdateSupavisorConfigBodyPoolMode) Valid() bool {
+	switch e {
+	case UpdateSupavisorConfigBodyPoolModeSession:
+		return true
+	case UpdateSupavisorConfigBodyPoolModeTransaction:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for UpgradeDatabaseBodyReleaseChannel.
 const (
 	UpgradeDatabaseBodyReleaseChannelAlpha     UpgradeDatabaseBodyReleaseChannel = "alpha"
@@ -1325,6 +3933,26 @@ const (
 	UpgradeDatabaseBodyReleaseChannelWithdrawn UpgradeDatabaseBodyReleaseChannel = "withdrawn"
 )
 
+// Valid indicates whether the value is a known member of the UpgradeDatabaseBodyReleaseChannel enum.
+func (e UpgradeDatabaseBodyReleaseChannel) Valid() bool {
+	switch e {
+	case UpgradeDatabaseBodyReleaseChannelAlpha:
+		return true
+	case UpgradeDatabaseBodyReleaseChannelBeta:
+		return true
+	case UpgradeDatabaseBodyReleaseChannelGa:
+		return true
+	case UpgradeDatabaseBodyReleaseChannelInternal:
+		return true
+	case UpgradeDatabaseBodyReleaseChannelPreview:
+		return true
+	case UpgradeDatabaseBodyReleaseChannelWithdrawn:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for V1BackupsResponseBackupsStatus.
 const (
 	V1BackupsResponseBackupsStatusARCHIVED  V1BackupsResponseBackupsStatus = "ARCHIVED"
@@ -1335,6 +3963,26 @@ const (
 	V1BackupsResponseBackupsStatusREMOVED   V1BackupsResponseBackupsStatus = "REMOVED"
 )
 
+// Valid indicates whether the value is a known member of the V1BackupsResponseBackupsStatus enum.
+func (e V1BackupsResponseBackupsStatus) Valid() bool {
+	switch e {
+	case V1BackupsResponseBackupsStatusARCHIVED:
+		return true
+	case V1BackupsResponseBackupsStatusCANCELLED:
+		return true
+	case V1BackupsResponseBackupsStatusCOMPLETED:
+		return true
+	case V1BackupsResponseBackupsStatusFAILED:
+		return true
+	case V1BackupsResponseBackupsStatusPENDING:
+		return true
+	case V1BackupsResponseBackupsStatusREMOVED:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for V1CreateProjectBodyDesiredInstanceSize.
 const (
 	V1CreateProjectBodyDesiredInstanceSizeLarge                    V1CreateProjectBodyDesiredInstanceSize = "large"
@@ -1358,12 +4006,70 @@ const (
 	V1CreateProjectBodyDesiredInstanceSizeXlarge                   V1CreateProjectBodyDesiredInstanceSize = "xlarge"
 )
 
+// Valid indicates whether the value is a known member of the V1CreateProjectBodyDesiredInstanceSize enum.
+func (e V1CreateProjectBodyDesiredInstanceSize) Valid() bool {
+	switch e {
+	case V1CreateProjectBodyDesiredInstanceSizeLarge:
+		return true
+	case V1CreateProjectBodyDesiredInstanceSizeMedium:
+		return true
+	case V1CreateProjectBodyDesiredInstanceSizeMicro:
+		return true
+	case V1CreateProjectBodyDesiredInstanceSizeN12xlarge:
+		return true
+	case V1CreateProjectBodyDesiredInstanceSizeN16xlarge:
+		return true
+	case V1CreateProjectBodyDesiredInstanceSizeN24xlarge:
+		return true
+	case V1CreateProjectBodyDesiredInstanceSizeN24xlargeHighMemory:
+		return true
+	case V1CreateProjectBodyDesiredInstanceSizeN24xlargeOptimizedCpu:
+		return true
+	case V1CreateProjectBodyDesiredInstanceSizeN24xlargeOptimizedMemory:
+		return true
+	case V1CreateProjectBodyDesiredInstanceSizeN2xlarge:
+		return true
+	case V1CreateProjectBodyDesiredInstanceSizeN48xlarge:
+		return true
+	case V1CreateProjectBodyDesiredInstanceSizeN48xlargeHighMemory:
+		return true
+	case V1CreateProjectBodyDesiredInstanceSizeN48xlargeOptimizedCpu:
+		return true
+	case V1CreateProjectBodyDesiredInstanceSizeN48xlargeOptimizedMemory:
+		return true
+	case V1CreateProjectBodyDesiredInstanceSizeN4xlarge:
+		return true
+	case V1CreateProjectBodyDesiredInstanceSizeN8xlarge:
+		return true
+	case V1CreateProjectBodyDesiredInstanceSizeNano:
+		return true
+	case V1CreateProjectBodyDesiredInstanceSizeSmall:
+		return true
+	case V1CreateProjectBodyDesiredInstanceSizeXlarge:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for V1CreateProjectBodyPlan.
 const (
 	V1CreateProjectBodyPlanFree V1CreateProjectBodyPlan = "free"
 	V1CreateProjectBodyPlanPro  V1CreateProjectBodyPlan = "pro"
 )
 
+// Valid indicates whether the value is a known member of the V1CreateProjectBodyPlan enum.
+func (e V1CreateProjectBodyPlan) Valid() bool {
+	switch e {
+	case V1CreateProjectBodyPlanFree:
+		return true
+	case V1CreateProjectBodyPlanPro:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for V1CreateProjectBodyRegion.
 const (
 	V1CreateProjectBodyRegionApEast1      V1CreateProjectBodyRegion = "ap-east-1"
@@ -1386,6 +4092,50 @@ const (
 	V1CreateProjectBodyRegionUsWest2      V1CreateProjectBodyRegion = "us-west-2"
 )
 
+// Valid indicates whether the value is a known member of the V1CreateProjectBodyRegion enum.
+func (e V1CreateProjectBodyRegion) Valid() bool {
+	switch e {
+	case V1CreateProjectBodyRegionApEast1:
+		return true
+	case V1CreateProjectBodyRegionApNortheast1:
+		return true
+	case V1CreateProjectBodyRegionApNortheast2:
+		return true
+	case V1CreateProjectBodyRegionApSouth1:
+		return true
+	case V1CreateProjectBodyRegionApSoutheast1:
+		return true
+	case V1CreateProjectBodyRegionApSoutheast2:
+		return true
+	case V1CreateProjectBodyRegionCaCentral1:
+		return true
+	case V1CreateProjectBodyRegionEuCentral1:
+		return true
+	case V1CreateProjectBodyRegionEuCentral2:
+		return true
+	case V1CreateProjectBodyRegionEuNorth1:
+		return true
+	case V1CreateProjectBodyRegionEuWest1:
+		return true
+	case V1CreateProjectBodyRegionEuWest2:
+		return true
+	case V1CreateProjectBodyRegionEuWest3:
+		return true
+	case V1CreateProjectBodyRegionSaEast1:
+		return true
+	case V1CreateProjectBodyRegionUsEast1:
+		return true
+	case V1CreateProjectBodyRegionUsEast2:
+		return true
+	case V1CreateProjectBodyRegionUsWest1:
+		return true
+	case V1CreateProjectBodyRegionUsWest2:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for V1CreateProjectBodyRegionSelection0Code.
 const (
 	ApEast1      V1CreateProjectBodyRegionSelection0Code = "ap-east-1"
@@ -1408,11 +4158,65 @@ const (
 	UsWest2      V1CreateProjectBodyRegionSelection0Code = "us-west-2"
 )
 
+// Valid indicates whether the value is a known member of the V1CreateProjectBodyRegionSelection0Code enum.
+func (e V1CreateProjectBodyRegionSelection0Code) Valid() bool {
+	switch e {
+	case ApEast1:
+		return true
+	case ApNortheast1:
+		return true
+	case ApNortheast2:
+		return true
+	case ApSouth1:
+		return true
+	case ApSoutheast1:
+		return true
+	case ApSoutheast2:
+		return true
+	case CaCentral1:
+		return true
+	case EuCentral1:
+		return true
+	case EuCentral2:
+		return true
+	case EuNorth1:
+		return true
+	case EuWest1:
+		return true
+	case EuWest2:
+		return true
+	case EuWest3:
+		return true
+	case SaEast1:
+		return true
+	case UsEast1:
+		return true
+	case UsEast2:
+		return true
+	case UsWest1:
+		return true
+	case UsWest2:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for V1CreateProjectBodyRegionSelection0Type.
 const (
 	Specific V1CreateProjectBodyRegionSelection0Type = "specific"
 )
 
+// Valid indicates whether the value is a known member of the V1CreateProjectBodyRegionSelection0Type enum.
+func (e V1CreateProjectBodyRegionSelection0Type) Valid() bool {
+	switch e {
+	case Specific:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for V1CreateProjectBodyRegionSelection1Code.
 const (
 	Americas V1CreateProjectBodyRegionSelection1Code = "americas"
@@ -1420,11 +4224,35 @@ const (
 	Emea     V1CreateProjectBodyRegionSelection1Code = "emea"
 )
 
+// Valid indicates whether the value is a known member of the V1CreateProjectBodyRegionSelection1Code enum.
+func (e V1CreateProjectBodyRegionSelection1Code) Valid() bool {
+	switch e {
+	case Americas:
+		return true
+	case Apac:
+		return true
+	case Emea:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for V1CreateProjectBodyRegionSelection1Type.
 const (
 	SmartGroup V1CreateProjectBodyRegionSelection1Type = "smartGroup"
 )
 
+// Valid indicates whether the value is a known member of the V1CreateProjectBodyRegionSelection1Type enum.
+func (e V1CreateProjectBodyRegionSelection1Type) Valid() bool {
+	switch e {
+	case SmartGroup:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for V1ListEntitlementsResponseEntitlementsFeatureKey.
 const (
 	V1ListEntitlementsResponseEntitlementsFeatureKeyApiMembersInvitations                 V1ListEntitlementsResponseEntitlementsFeatureKey = "api.members.invitations"
@@ -1492,6 +4320,140 @@ const (
 	V1ListEntitlementsResponseEntitlementsFeatureKeyVanitySubdomain                       V1ListEntitlementsResponseEntitlementsFeatureKey = "vanity_subdomain"
 )
 
+// Valid indicates whether the value is a known member of the V1ListEntitlementsResponseEntitlementsFeatureKey enum.
+func (e V1ListEntitlementsResponseEntitlementsFeatureKey) Valid() bool {
+	switch e {
+	case V1ListEntitlementsResponseEntitlementsFeatureKeyApiMembersInvitations:
+		return true
+	case V1ListEntitlementsResponseEntitlementsFeatureKeyApiMembersRoles:
+		return true
+	case V1ListEntitlementsResponseEntitlementsFeatureKeyAssistantAdvanceModel:
+		return true
+	case V1ListEntitlementsResponseEntitlementsFeatureKeyAuditLogDrains:
+		return true
+	case V1ListEntitlementsResponseEntitlementsFeatureKeyAuthAdvancedAuthSettings:
+		return true
+	case V1ListEntitlementsResponseEntitlementsFeatureKeyAuthCustomJwtTemplate:
+		return true
+	case V1ListEntitlementsResponseEntitlementsFeatureKeyAuthCustomOauthMaxProviders:
+		return true
+	case V1ListEntitlementsResponseEntitlementsFeatureKeyAuthHooks:
+		return true
+	case V1ListEntitlementsResponseEntitlementsFeatureKeyAuthLeakedPasswordProtection:
+		return true
+	case V1ListEntitlementsResponseEntitlementsFeatureKeyAuthMfaEnhancedSecurity:
+		return true
+	case V1ListEntitlementsResponseEntitlementsFeatureKeyAuthMfaPhone:
+		return true
+	case V1ListEntitlementsResponseEntitlementsFeatureKeyAuthMfaWebAuthn:
+		return true
+	case V1ListEntitlementsResponseEntitlementsFeatureKeyAuthPasswordHibp:
+		return true
+	case V1ListEntitlementsResponseEntitlementsFeatureKeyAuthPerformanceSettings:
+		return true
+	case V1ListEntitlementsResponseEntitlementsFeatureKeyAuthPlatformSso:
+		return true
+	case V1ListEntitlementsResponseEntitlementsFeatureKeyAuthSaml2:
+		return true
+	case V1ListEntitlementsResponseEntitlementsFeatureKeyAuthUserSessions:
+		return true
+	case V1ListEntitlementsResponseEntitlementsFeatureKeyBackupRestoreToNewProject:
+		return true
+	case V1ListEntitlementsResponseEntitlementsFeatureKeyBackupRetentionDays:
+		return true
+	case V1ListEntitlementsResponseEntitlementsFeatureKeyBackupSchedule:
+		return true
+	case V1ListEntitlementsResponseEntitlementsFeatureKeyBranchingLimit:
+		return true
+	case V1ListEntitlementsResponseEntitlementsFeatureKeyBranchingPersistent:
+		return true
+	case V1ListEntitlementsResponseEntitlementsFeatureKeyCustomDomain:
+		return true
+	case V1ListEntitlementsResponseEntitlementsFeatureKeyDedicatedPooler:
+		return true
+	case V1ListEntitlementsResponseEntitlementsFeatureKeyFunctionMaxCount:
+		return true
+	case V1ListEntitlementsResponseEntitlementsFeatureKeyFunctionSizeLimitMb:
+		return true
+	case V1ListEntitlementsResponseEntitlementsFeatureKeyInstancesComputeUpdateAvailableSizes:
+		return true
+	case V1ListEntitlementsResponseEntitlementsFeatureKeyInstancesDiskModifications:
+		return true
+	case V1ListEntitlementsResponseEntitlementsFeatureKeyInstancesHighAvailability:
+		return true
+	case V1ListEntitlementsResponseEntitlementsFeatureKeyInstancesOrioledb:
+		return true
+	case V1ListEntitlementsResponseEntitlementsFeatureKeyInstancesReadReplicas:
+		return true
+	case V1ListEntitlementsResponseEntitlementsFeatureKeyIntegrationsGithubConnections:
+		return true
+	case V1ListEntitlementsResponseEntitlementsFeatureKeyIpv4:
+		return true
+	case V1ListEntitlementsResponseEntitlementsFeatureKeyLogDrains:
+		return true
+	case V1ListEntitlementsResponseEntitlementsFeatureKeyLogRetentionDays:
+		return true
+	case V1ListEntitlementsResponseEntitlementsFeatureKeyObservabilityDashboardAdvancedMetrics:
+		return true
+	case V1ListEntitlementsResponseEntitlementsFeatureKeyPitrAvailableVariants:
+		return true
+	case V1ListEntitlementsResponseEntitlementsFeatureKeyProjectCloning:
+		return true
+	case V1ListEntitlementsResponseEntitlementsFeatureKeyProjectPausing:
+		return true
+	case V1ListEntitlementsResponseEntitlementsFeatureKeyProjectRestoreAfterExpiry:
+		return true
+	case V1ListEntitlementsResponseEntitlementsFeatureKeyProjectScopedRoles:
+		return true
+	case V1ListEntitlementsResponseEntitlementsFeatureKeyRealtimeMaxBytesPerSecond:
+		return true
+	case V1ListEntitlementsResponseEntitlementsFeatureKeyRealtimeMaxChannelsPerClient:
+		return true
+	case V1ListEntitlementsResponseEntitlementsFeatureKeyRealtimeMaxConcurrentUsers:
+		return true
+	case V1ListEntitlementsResponseEntitlementsFeatureKeyRealtimeMaxEventsPerSecond:
+		return true
+	case V1ListEntitlementsResponseEntitlementsFeatureKeyRealtimeMaxJoinsPerSecond:
+		return true
+	case V1ListEntitlementsResponseEntitlementsFeatureKeyRealtimeMaxPayloadSizeInKb:
+		return true
+	case V1ListEntitlementsResponseEntitlementsFeatureKeyRealtimeMaxPresenceEventsPerSecond:
+		return true
+	case V1ListEntitlementsResponseEntitlementsFeatureKeyReplicationEtl:
+		return true
+	case V1ListEntitlementsResponseEntitlementsFeatureKeySecurityAuditLogsDays:
+		return true
+	case V1ListEntitlementsResponseEntitlementsFeatureKeySecurityEnforceMfa:
+		return true
+	case V1ListEntitlementsResponseEntitlementsFeatureKeySecurityIso27001Certificate:
+		return true
+	case V1ListEntitlementsResponseEntitlementsFeatureKeySecurityMemberRoles:
+		return true
+	case V1ListEntitlementsResponseEntitlementsFeatureKeySecurityPrivateLink:
+		return true
+	case V1ListEntitlementsResponseEntitlementsFeatureKeySecurityQuestionnaire:
+		return true
+	case V1ListEntitlementsResponseEntitlementsFeatureKeySecuritySoc2Report:
+		return true
+	case V1ListEntitlementsResponseEntitlementsFeatureKeyStorageIcebergCatalog:
+		return true
+	case V1ListEntitlementsResponseEntitlementsFeatureKeyStorageImageTransformations:
+		return true
+	case V1ListEntitlementsResponseEntitlementsFeatureKeyStorageMaxFileSize:
+		return true
+	case V1ListEntitlementsResponseEntitlementsFeatureKeyStorageMaxFileSizeConfigurable:
+		return true
+	case V1ListEntitlementsResponseEntitlementsFeatureKeyStoragePurgeCache:
+		return true
+	case V1ListEntitlementsResponseEntitlementsFeatureKeyStorageVectorBuckets:
+		return true
+	case V1ListEntitlementsResponseEntitlementsFeatureKeyVanitySubdomain:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for V1ListEntitlementsResponseEntitlementsFeatureType.
 const (
 	V1ListEntitlementsResponseEntitlementsFeatureTypeBoolean V1ListEntitlementsResponseEntitlementsFeatureType = "boolean"
@@ -1499,6 +4461,20 @@ const (
 	V1ListEntitlementsResponseEntitlementsFeatureTypeSet     V1ListEntitlementsResponseEntitlementsFeatureType = "set"
 )
 
+// Valid indicates whether the value is a known member of the V1ListEntitlementsResponseEntitlementsFeatureType enum.
+func (e V1ListEntitlementsResponseEntitlementsFeatureType) Valid() bool {
+	switch e {
+	case V1ListEntitlementsResponseEntitlementsFeatureTypeBoolean:
+		return true
+	case V1ListEntitlementsResponseEntitlementsFeatureTypeNumeric:
+		return true
+	case V1ListEntitlementsResponseEntitlementsFeatureTypeSet:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for V1ListEntitlementsResponseEntitlementsType.
 const (
 	V1ListEntitlementsResponseEntitlementsTypeBoolean V1ListEntitlementsResponseEntitlementsType = "boolean"
@@ -1506,6 +4482,20 @@ const (
 	V1ListEntitlementsResponseEntitlementsTypeSet     V1ListEntitlementsResponseEntitlementsType = "set"
 )
 
+// Valid indicates whether the value is a known member of the V1ListEntitlementsResponseEntitlementsType enum.
+func (e V1ListEntitlementsResponseEntitlementsType) Valid() bool {
+	switch e {
+	case V1ListEntitlementsResponseEntitlementsTypeBoolean:
+		return true
+	case V1ListEntitlementsResponseEntitlementsTypeNumeric:
+		return true
+	case V1ListEntitlementsResponseEntitlementsTypeSet:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for V1OrganizationSlugResponseAllowedReleaseChannels.
 const (
 	V1OrganizationSlugResponseAllowedReleaseChannelsAlpha     V1OrganizationSlugResponseAllowedReleaseChannels = "alpha"
@@ -1516,6 +4506,26 @@ const (
 	V1OrganizationSlugResponseAllowedReleaseChannelsWithdrawn V1OrganizationSlugResponseAllowedReleaseChannels = "withdrawn"
 )
 
+// Valid indicates whether the value is a known member of the V1OrganizationSlugResponseAllowedReleaseChannels enum.
+func (e V1OrganizationSlugResponseAllowedReleaseChannels) Valid() bool {
+	switch e {
+	case V1OrganizationSlugResponseAllowedReleaseChannelsAlpha:
+		return true
+	case V1OrganizationSlugResponseAllowedReleaseChannelsBeta:
+		return true
+	case V1OrganizationSlugResponseAllowedReleaseChannelsGa:
+		return true
+	case V1OrganizationSlugResponseAllowedReleaseChannelsInternal:
+		return true
+	case V1OrganizationSlugResponseAllowedReleaseChannelsPreview:
+		return true
+	case V1OrganizationSlugResponseAllowedReleaseChannelsWithdrawn:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for V1OrganizationSlugResponseOptInTags.
 const (
 	AIDATAGENERATOROPTIN V1OrganizationSlugResponseOptInTags = "AI_DATA_GENERATOR_OPT_IN"
@@ -1523,6 +4533,20 @@ const (
 	AISQLGENERATOROPTIN  V1OrganizationSlugResponseOptInTags = "AI_SQL_GENERATOR_OPT_IN"
 )
 
+// Valid indicates whether the value is a known member of the V1OrganizationSlugResponseOptInTags enum.
+func (e V1OrganizationSlugResponseOptInTags) Valid() bool {
+	switch e {
+	case AIDATAGENERATOROPTIN:
+		return true
+	case AILOGGENERATOROPTIN:
+		return true
+	case AISQLGENERATOROPTIN:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for V1OrganizationSlugResponsePlan.
 const (
 	V1OrganizationSlugResponsePlanEnterprise V1OrganizationSlugResponsePlan = "enterprise"
@@ -1532,6 +4556,24 @@ const (
 	V1OrganizationSlugResponsePlanTeam       V1OrganizationSlugResponsePlan = "team"
 )
 
+// Valid indicates whether the value is a known member of the V1OrganizationSlugResponsePlan enum.
+func (e V1OrganizationSlugResponsePlan) Valid() bool {
+	switch e {
+	case V1OrganizationSlugResponsePlanEnterprise:
+		return true
+	case V1OrganizationSlugResponsePlanFree:
+		return true
+	case V1OrganizationSlugResponsePlanPlatform:
+		return true
+	case V1OrganizationSlugResponsePlanPro:
+		return true
+	case V1OrganizationSlugResponsePlanTeam:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for V1PgbouncerConfigResponsePoolMode.
 const (
 	Session     V1PgbouncerConfigResponsePoolMode = "session"
@@ -1539,17 +4581,53 @@ const (
 	Transaction V1PgbouncerConfigResponsePoolMode = "transaction"
 )
 
+// Valid indicates whether the value is a known member of the V1PgbouncerConfigResponsePoolMode enum.
+func (e V1PgbouncerConfigResponsePoolMode) Valid() bool {
+	switch e {
+	case Session:
+		return true
+	case Statement:
+		return true
+	case Transaction:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for V1ProjectAdvisorsResponseLintsCategories.
 const (
 	PERFORMANCE V1ProjectAdvisorsResponseLintsCategories = "PERFORMANCE"
 	SECURITY    V1ProjectAdvisorsResponseLintsCategories = "SECURITY"
 )
 
+// Valid indicates whether the value is a known member of the V1ProjectAdvisorsResponseLintsCategories enum.
+func (e V1ProjectAdvisorsResponseLintsCategories) Valid() bool {
+	switch e {
+	case PERFORMANCE:
+		return true
+	case SECURITY:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for V1ProjectAdvisorsResponseLintsFacing.
 const (
 	EXTERNAL V1ProjectAdvisorsResponseLintsFacing = "EXTERNAL"
 )
 
+// Valid indicates whether the value is a known member of the V1ProjectAdvisorsResponseLintsFacing enum.
+func (e V1ProjectAdvisorsResponseLintsFacing) Valid() bool {
+	switch e {
+	case EXTERNAL:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for V1ProjectAdvisorsResponseLintsLevel.
 const (
 	ERROR V1ProjectAdvisorsResponseLintsLevel = "ERROR"
@@ -1557,6 +4635,20 @@ const (
 	WARN  V1ProjectAdvisorsResponseLintsLevel = "WARN"
 )
 
+// Valid indicates whether the value is a known member of the V1ProjectAdvisorsResponseLintsLevel enum.
+func (e V1ProjectAdvisorsResponseLintsLevel) Valid() bool {
+	switch e {
+	case ERROR:
+		return true
+	case INFO:
+		return true
+	case WARN:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for V1ProjectAdvisorsResponseLintsMetadataType.
 const (
 	V1ProjectAdvisorsResponseLintsMetadataTypeAuth       V1ProjectAdvisorsResponseLintsMetadataType = "auth"
@@ -1567,6 +4659,26 @@ const (
 	V1ProjectAdvisorsResponseLintsMetadataTypeView       V1ProjectAdvisorsResponseLintsMetadataType = "view"
 )
 
+// Valid indicates whether the value is a known member of the V1ProjectAdvisorsResponseLintsMetadataType enum.
+func (e V1ProjectAdvisorsResponseLintsMetadataType) Valid() bool {
+	switch e {
+	case V1ProjectAdvisorsResponseLintsMetadataTypeAuth:
+		return true
+	case V1ProjectAdvisorsResponseLintsMetadataTypeCompliance:
+		return true
+	case V1ProjectAdvisorsResponseLintsMetadataTypeExtension:
+		return true
+	case V1ProjectAdvisorsResponseLintsMetadataTypeFunction:
+		return true
+	case V1ProjectAdvisorsResponseLintsMetadataTypeTable:
+		return true
+	case V1ProjectAdvisorsResponseLintsMetadataTypeView:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for V1ProjectAdvisorsResponseLintsName.
 const (
 	AuthInsufficientMfaOptions    V1ProjectAdvisorsResponseLintsName = "auth_insufficient_mfa_options"
@@ -1600,6 +4712,72 @@ const (
 	VulnerablePostgresVersion     V1ProjectAdvisorsResponseLintsName = "vulnerable_postgres_version"
 )
 
+// Valid indicates whether the value is a known member of the V1ProjectAdvisorsResponseLintsName enum.
+func (e V1ProjectAdvisorsResponseLintsName) Valid() bool {
+	switch e {
+	case AuthInsufficientMfaOptions:
+		return true
+	case AuthLeakedPasswordProtection:
+		return true
+	case AuthOtpLongExpiry:
+		return true
+	case AuthOtpShortLength:
+		return true
+	case AuthPasswordPolicyMissing:
+		return true
+	case AuthRlsInitplan:
+		return true
+	case AuthUsersExposed:
+		return true
+	case DuplicateIndex:
+		return true
+	case ExtensionInPublic:
+		return true
+	case ForeignTableInApi:
+		return true
+	case FunctionSearchPathMutable:
+		return true
+	case LeakedServiceKey:
+		return true
+	case MaterializedViewInApi:
+		return true
+	case MultiplePermissivePolicies:
+		return true
+	case NetworkRestrictionsNotSet:
+		return true
+	case NoBackupAdmin:
+		return true
+	case NoPrimaryKey:
+		return true
+	case PasswordRequirementsMinLength:
+		return true
+	case PitrNotEnabled:
+		return true
+	case PolicyExistsRlsDisabled:
+		return true
+	case RlsDisabledInPublic:
+		return true
+	case RlsEnabledNoPolicy:
+		return true
+	case RlsReferencesUserMetadata:
+		return true
+	case SecurityDefinerView:
+		return true
+	case SslNotEnforced:
+		return true
+	case UnindexedForeignKeys:
+		return true
+	case UnsupportedRegTypes:
+		return true
+	case UnusedIndex:
+		return true
+	case VulnerablePostgresVersion:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for V1ProjectResponseStatus.
 const (
 	V1ProjectResponseStatusACTIVEHEALTHY   V1ProjectResponseStatus = "ACTIVE_HEALTHY"
@@ -1619,6 +4797,44 @@ const (
 	V1ProjectResponseStatusUPGRADING       V1ProjectResponseStatus = "UPGRADING"
 )
 
+// Valid indicates whether the value is a known member of the V1ProjectResponseStatus enum.
+func (e V1ProjectResponseStatus) Valid() bool {
+	switch e {
+	case V1ProjectResponseStatusACTIVEHEALTHY:
+		return true
+	case V1ProjectResponseStatusACTIVEUNHEALTHY:
+		return true
+	case V1ProjectResponseStatusCOMINGUP:
+		return true
+	case V1ProjectResponseStatusGOINGDOWN:
+		return true
+	case V1ProjectResponseStatusINACTIVE:
+		return true
+	case V1ProjectResponseStatusINITFAILED:
+		return true
+	case V1ProjectResponseStatusPAUSEFAILED:
+		return true
+	case V1ProjectResponseStatusPAUSING:
+		return true
+	case V1ProjectResponseStatusREMOVED:
+		return true
+	case V1ProjectResponseStatusRESIZING:
+		return true
+	case V1ProjectResponseStatusRESTARTING:
+		return true
+	case V1ProjectResponseStatusRESTOREFAILED:
+		return true
+	case V1ProjectResponseStatusRESTORING:
+		return true
+	case V1ProjectResponseStatusUNKNOWN:
+		return true
+	case V1ProjectResponseStatusUPGRADING:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for V1ProjectWithDatabaseResponseStatus.
 const (
 	V1ProjectWithDatabaseResponseStatusACTIVEHEALTHY   V1ProjectWithDatabaseResponseStatus = "ACTIVE_HEALTHY"
@@ -1638,6 +4854,44 @@ const (
 	V1ProjectWithDatabaseResponseStatusUPGRADING       V1ProjectWithDatabaseResponseStatus = "UPGRADING"
 )
 
+// Valid indicates whether the value is a known member of the V1ProjectWithDatabaseResponseStatus enum.
+func (e V1ProjectWithDatabaseResponseStatus) Valid() bool {
+	switch e {
+	case V1ProjectWithDatabaseResponseStatusACTIVEHEALTHY:
+		return true
+	case V1ProjectWithDatabaseResponseStatusACTIVEUNHEALTHY:
+		return true
+	case V1ProjectWithDatabaseResponseStatusCOMINGUP:
+		return true
+	case V1ProjectWithDatabaseResponseStatusGOINGDOWN:
+		return true
+	case V1ProjectWithDatabaseResponseStatusINACTIVE:
+		return true
+	case V1ProjectWithDatabaseResponseStatusINITFAILED:
+		return true
+	case V1ProjectWithDatabaseResponseStatusPAUSEFAILED:
+		return true
+	case V1ProjectWithDatabaseResponseStatusPAUSING:
+		return true
+	case V1ProjectWithDatabaseResponseStatusREMOVED:
+		return true
+	case V1ProjectWithDatabaseResponseStatusRESIZING:
+		return true
+	case V1ProjectWithDatabaseResponseStatusRESTARTING:
+		return true
+	case V1ProjectWithDatabaseResponseStatusRESTOREFAILED:
+		return true
+	case V1ProjectWithDatabaseResponseStatusRESTORING:
+		return true
+	case V1ProjectWithDatabaseResponseStatusUNKNOWN:
+		return true
+	case V1ProjectWithDatabaseResponseStatusUPGRADING:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for V1RestorePointResponseStatus.
 const (
 	V1RestorePointResponseStatusAVAILABLE V1RestorePointResponseStatus = "AVAILABLE"
@@ -1646,11 +4900,37 @@ const (
 	V1RestorePointResponseStatusREMOVED   V1RestorePointResponseStatus = "REMOVED"
 )
 
+// Valid indicates whether the value is a known member of the V1RestorePointResponseStatus enum.
+func (e V1RestorePointResponseStatus) Valid() bool {
+	switch e {
+	case V1RestorePointResponseStatusAVAILABLE:
+		return true
+	case V1RestorePointResponseStatusFAILED:
+		return true
+	case V1RestorePointResponseStatusPENDING:
+		return true
+	case V1RestorePointResponseStatusREMOVED:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for V1ServiceHealthResponseInfo0Name.
 const (
 	GoTrue V1ServiceHealthResponseInfo0Name = "GoTrue"
 )
 
+// Valid indicates whether the value is a known member of the V1ServiceHealthResponseInfo0Name enum.
+func (e V1ServiceHealthResponseInfo0Name) Valid() bool {
+	switch e {
+	case GoTrue:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for V1ServiceHealthResponseName.
 const (
 	V1ServiceHealthResponseNameAuth           V1ServiceHealthResponseName = "auth"
@@ -1663,6 +4943,30 @@ const (
 	V1ServiceHealthResponseNameStorage        V1ServiceHealthResponseName = "storage"
 )
 
+// Valid indicates whether the value is a known member of the V1ServiceHealthResponseName enum.
+func (e V1ServiceHealthResponseName) Valid() bool {
+	switch e {
+	case V1ServiceHealthResponseNameAuth:
+		return true
+	case V1ServiceHealthResponseNameDb:
+		return true
+	case V1ServiceHealthResponseNameDbPostgresUser:
+		return true
+	case V1ServiceHealthResponseNamePgBouncer:
+		return true
+	case V1ServiceHealthResponseNamePooler:
+		return true
+	case V1ServiceHealthResponseNameRealtime:
+		return true
+	case V1ServiceHealthResponseNameRest:
+		return true
+	case V1ServiceHealthResponseNameStorage:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for V1ServiceHealthResponseStatus.
 const (
 	ACTIVEHEALTHY V1ServiceHealthResponseStatus = "ACTIVE_HEALTHY"
@@ -1670,6 +4974,20 @@ const (
 	UNHEALTHY     V1ServiceHealthResponseStatus = "UNHEALTHY"
 )
 
+// Valid indicates whether the value is a known member of the V1ServiceHealthResponseStatus enum.
+func (e V1ServiceHealthResponseStatus) Valid() bool {
+	switch e {
+	case ACTIVEHEALTHY:
+		return true
+	case COMINGUP:
+		return true
+	case UNHEALTHY:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for VanitySubdomainConfigResponseStatus.
 const (
 	Active           VanitySubdomainConfigResponseStatus = "active"
@@ -1677,6 +4995,20 @@ const (
 	NotUsed          VanitySubdomainConfigResponseStatus = "not-used"
 )
 
+// Valid indicates whether the value is a known member of the VanitySubdomainConfigResponseStatus enum.
+func (e VanitySubdomainConfigResponseStatus) Valid() bool {
+	switch e {
+	case Active:
+		return true
+	case CustomDomainUsed:
+		return true
+	case NotUsed:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for V1AuthorizeUserParamsResponseType.
 const (
 	V1AuthorizeUserParamsResponseTypeCode         V1AuthorizeUserParamsResponseType = "code"
@@ -1684,6 +5016,20 @@ const (
 	V1AuthorizeUserParamsResponseTypeToken        V1AuthorizeUserParamsResponseType = "token"
 )
 
+// Valid indicates whether the value is a known member of the V1AuthorizeUserParamsResponseType enum.
+func (e V1AuthorizeUserParamsResponseType) Valid() bool {
+	switch e {
+	case V1AuthorizeUserParamsResponseTypeCode:
+		return true
+	case V1AuthorizeUserParamsResponseTypeIdTokenToken:
+		return true
+	case V1AuthorizeUserParamsResponseTypeToken:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for V1AuthorizeUserParamsCodeChallengeMethod.
 const (
 	V1AuthorizeUserParamsCodeChallengeMethodPlain  V1AuthorizeUserParamsCodeChallengeMethod = "plain"
@@ -1691,6 +5037,20 @@ const (
 	V1AuthorizeUserParamsCodeChallengeMethodSha256 V1AuthorizeUserParamsCodeChallengeMethod = "sha256"
 )
 
+// Valid indicates whether the value is a known member of the V1AuthorizeUserParamsCodeChallengeMethod enum.
+func (e V1AuthorizeUserParamsCodeChallengeMethod) Valid() bool {
+	switch e {
+	case V1AuthorizeUserParamsCodeChallengeMethodPlain:
+		return true
+	case V1AuthorizeUserParamsCodeChallengeMethodS256:
+		return true
+	case V1AuthorizeUserParamsCodeChallengeMethodSha256:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for V1OauthAuthorizeProjectClaimParamsResponseType.
 const (
 	V1OauthAuthorizeProjectClaimParamsResponseTypeCode         V1OauthAuthorizeProjectClaimParamsResponseType = "code"
@@ -1698,6 +5058,20 @@ const (
 	V1OauthAuthorizeProjectClaimParamsResponseTypeToken        V1OauthAuthorizeProjectClaimParamsResponseType = "token"
 )
 
+// Valid indicates whether the value is a known member of the V1OauthAuthorizeProjectClaimParamsResponseType enum.
+func (e V1OauthAuthorizeProjectClaimParamsResponseType) Valid() bool {
+	switch e {
+	case V1OauthAuthorizeProjectClaimParamsResponseTypeCode:
+		return true
+	case V1OauthAuthorizeProjectClaimParamsResponseTypeIdTokenToken:
+		return true
+	case V1OauthAuthorizeProjectClaimParamsResponseTypeToken:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for V1OauthAuthorizeProjectClaimParamsCodeChallengeMethod.
 const (
 	V1OauthAuthorizeProjectClaimParamsCodeChallengeMethodPlain  V1OauthAuthorizeProjectClaimParamsCodeChallengeMethod = "plain"
@@ -1705,6 +5079,20 @@ const (
 	V1OauthAuthorizeProjectClaimParamsCodeChallengeMethodSha256 V1OauthAuthorizeProjectClaimParamsCodeChallengeMethod = "sha256"
 )
 
+// Valid indicates whether the value is a known member of the V1OauthAuthorizeProjectClaimParamsCodeChallengeMethod enum.
+func (e V1OauthAuthorizeProjectClaimParamsCodeChallengeMethod) Valid() bool {
+	switch e {
+	case V1OauthAuthorizeProjectClaimParamsCodeChallengeMethodPlain:
+		return true
+	case V1OauthAuthorizeProjectClaimParamsCodeChallengeMethodS256:
+		return true
+	case V1OauthAuthorizeProjectClaimParamsCodeChallengeMethodSha256:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for V1GetAllProjectsForOrganizationParamsSort.
 const (
 	CreatedAsc  V1GetAllProjectsForOrganizationParamsSort = "created_asc"
@@ -1713,6 +5101,22 @@ const (
 	NameDesc    V1GetAllProjectsForOrganizationParamsSort = "name_desc"
 )
 
+// Valid indicates whether the value is a known member of the V1GetAllProjectsForOrganizationParamsSort enum.
+func (e V1GetAllProjectsForOrganizationParamsSort) Valid() bool {
+	switch e {
+	case CreatedAsc:
+		return true
+	case CreatedDesc:
+		return true
+	case NameAsc:
+		return true
+	case NameDesc:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for V1GetAvailableRegionsParamsContinent.
 const (
 	AF V1GetAvailableRegionsParamsContinent = "AF"
@@ -1724,6 +5128,28 @@ const (
 	SA V1GetAvailableRegionsParamsContinent = "SA"
 )
 
+// Valid indicates whether the value is a known member of the V1GetAvailableRegionsParamsContinent enum.
+func (e V1GetAvailableRegionsParamsContinent) Valid() bool {
+	switch e {
+	case AF:
+		return true
+	case AN:
+		return true
+	case AS:
+		return true
+	case EU:
+		return true
+	case NA:
+		return true
+	case OC:
+		return true
+	case SA:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for V1GetAvailableRegionsParamsDesiredInstanceSize.
 const (
 	V1GetAvailableRegionsParamsDesiredInstanceSizeLarge                    V1GetAvailableRegionsParamsDesiredInstanceSize = "large"
@@ -1747,11 +5173,67 @@ const (
 	V1GetAvailableRegionsParamsDesiredInstanceSizeXlarge                   V1GetAvailableRegionsParamsDesiredInstanceSize = "xlarge"
 )
 
+// Valid indicates whether the value is a known member of the V1GetAvailableRegionsParamsDesiredInstanceSize enum.
+func (e V1GetAvailableRegionsParamsDesiredInstanceSize) Valid() bool {
+	switch e {
+	case V1GetAvailableRegionsParamsDesiredInstanceSizeLarge:
+		return true
+	case V1GetAvailableRegionsParamsDesiredInstanceSizeMedium:
+		return true
+	case V1GetAvailableRegionsParamsDesiredInstanceSizeMicro:
+		return true
+	case V1GetAvailableRegionsParamsDesiredInstanceSizeN12xlarge:
+		return true
+	case V1GetAvailableRegionsParamsDesiredInstanceSizeN16xlarge:
+		return true
+	case V1GetAvailableRegionsParamsDesiredInstanceSizeN24xlarge:
+		return true
+	case V1GetAvailableRegionsParamsDesiredInstanceSizeN24xlargeHighMemory:
+		return true
+	case V1GetAvailableRegionsParamsDesiredInstanceSizeN24xlargeOptimizedCpu:
+		return true
+	case V1GetAvailableRegionsParamsDesiredInstanceSizeN24xlargeOptimizedMemory:
+		return true
+	case V1GetAvailableRegionsParamsDesiredInstanceSizeN2xlarge:
+		return true
+	case V1GetAvailableRegionsParamsDesiredInstanceSizeN48xlarge:
+		return true
+	case V1GetAvailableRegionsParamsDesiredInstanceSizeN48xlargeHighMemory:
+		return true
+	case V1GetAvailableRegionsParamsDesiredInstanceSizeN48xlargeOptimizedCpu:
+		return true
+	case V1GetAvailableRegionsParamsDesiredInstanceSizeN48xlargeOptimizedMemory:
+		return true
+	case V1GetAvailableRegionsParamsDesiredInstanceSizeN4xlarge:
+		return true
+	case V1GetAvailableRegionsParamsDesiredInstanceSizeN8xlarge:
+		return true
+	case V1GetAvailableRegionsParamsDesiredInstanceSizeNano:
+		return true
+	case V1GetAvailableRegionsParamsDesiredInstanceSizeSmall:
+		return true
+	case V1GetAvailableRegionsParamsDesiredInstanceSizeXlarge:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for V1GetSecurityAdvisorsParamsLintType.
 const (
 	Sql V1GetSecurityAdvisorsParamsLintType = "sql"
 )
 
+// Valid indicates whether the value is a known member of the V1GetSecurityAdvisorsParamsLintType enum.
+func (e V1GetSecurityAdvisorsParamsLintType) Valid() bool {
+	switch e {
+	case Sql:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for V1GetProjectFunctionCombinedStatsParamsInterval.
 const (
 	V1GetProjectFunctionCombinedStatsParamsIntervalN15min V1GetProjectFunctionCombinedStatsParamsInterval = "15min"
@@ -1760,6 +5242,22 @@ const (
 	V1GetProjectFunctionCombinedStatsParamsIntervalN3hr   V1GetProjectFunctionCombinedStatsParamsInterval = "3hr"
 )
 
+// Valid indicates whether the value is a known member of the V1GetProjectFunctionCombinedStatsParamsInterval enum.
+func (e V1GetProjectFunctionCombinedStatsParamsInterval) Valid() bool {
+	switch e {
+	case V1GetProjectFunctionCombinedStatsParamsIntervalN15min:
+		return true
+	case V1GetProjectFunctionCombinedStatsParamsIntervalN1day:
+		return true
+	case V1GetProjectFunctionCombinedStatsParamsIntervalN1hr:
+		return true
+	case V1GetProjectFunctionCombinedStatsParamsIntervalN3hr:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for V1GetProjectUsageApiCountParamsInterval.
 const (
 	V1GetProjectUsageApiCountParamsIntervalN15min V1GetProjectUsageApiCountParamsInterval = "15min"
@@ -1771,6 +5269,28 @@ const (
 	V1GetProjectUsageApiCountParamsIntervalN7day  V1GetProjectUsageApiCountParamsInterval = "7day"
 )
 
+// Valid indicates whether the value is a known member of the V1GetProjectUsageApiCountParamsInterval enum.
+func (e V1GetProjectUsageApiCountParamsInterval) Valid() bool {
+	switch e {
+	case V1GetProjectUsageApiCountParamsIntervalN15min:
+		return true
+	case V1GetProjectUsageApiCountParamsIntervalN1day:
+		return true
+	case V1GetProjectUsageApiCountParamsIntervalN1hr:
+		return true
+	case V1GetProjectUsageApiCountParamsIntervalN30min:
+		return true
+	case V1GetProjectUsageApiCountParamsIntervalN3day:
+		return true
+	case V1GetProjectUsageApiCountParamsIntervalN3hr:
+		return true
+	case V1GetProjectUsageApiCountParamsIntervalN7day:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for V1RemoveProjectAddonParamsAddonVariant0.
 const (
 	V1RemoveProjectAddonParamsAddonVariant0Ci12xlarge                V1RemoveProjectAddonParamsAddonVariant0 = "ci_12xlarge"
@@ -1793,11 +5313,65 @@ const (
 	V1RemoveProjectAddonParamsAddonVariant0CiXlarge                  V1RemoveProjectAddonParamsAddonVariant0 = "ci_xlarge"
 )
 
+// Valid indicates whether the value is a known member of the V1RemoveProjectAddonParamsAddonVariant0 enum.
+func (e V1RemoveProjectAddonParamsAddonVariant0) Valid() bool {
+	switch e {
+	case V1RemoveProjectAddonParamsAddonVariant0Ci12xlarge:
+		return true
+	case V1RemoveProjectAddonParamsAddonVariant0Ci16xlarge:
+		return true
+	case V1RemoveProjectAddonParamsAddonVariant0Ci24xlarge:
+		return true
+	case V1RemoveProjectAddonParamsAddonVariant0Ci24xlargeHighMemory:
+		return true
+	case V1RemoveProjectAddonParamsAddonVariant0Ci24xlargeOptimizedCpu:
+		return true
+	case V1RemoveProjectAddonParamsAddonVariant0Ci24xlargeOptimizedMemory:
+		return true
+	case V1RemoveProjectAddonParamsAddonVariant0Ci2xlarge:
+		return true
+	case V1RemoveProjectAddonParamsAddonVariant0Ci48xlarge:
+		return true
+	case V1RemoveProjectAddonParamsAddonVariant0Ci48xlargeHighMemory:
+		return true
+	case V1RemoveProjectAddonParamsAddonVariant0Ci48xlargeOptimizedCpu:
+		return true
+	case V1RemoveProjectAddonParamsAddonVariant0Ci48xlargeOptimizedMemory:
+		return true
+	case V1RemoveProjectAddonParamsAddonVariant0Ci4xlarge:
+		return true
+	case V1RemoveProjectAddonParamsAddonVariant0Ci8xlarge:
+		return true
+	case V1RemoveProjectAddonParamsAddonVariant0CiLarge:
+		return true
+	case V1RemoveProjectAddonParamsAddonVariant0CiMedium:
+		return true
+	case V1RemoveProjectAddonParamsAddonVariant0CiMicro:
+		return true
+	case V1RemoveProjectAddonParamsAddonVariant0CiSmall:
+		return true
+	case V1RemoveProjectAddonParamsAddonVariant0CiXlarge:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for V1RemoveProjectAddonParamsAddonVariant1.
 const (
 	V1RemoveProjectAddonParamsAddonVariant1CdDefault V1RemoveProjectAddonParamsAddonVariant1 = "cd_default"
 )
 
+// Valid indicates whether the value is a known member of the V1RemoveProjectAddonParamsAddonVariant1 enum.
+func (e V1RemoveProjectAddonParamsAddonVariant1) Valid() bool {
+	switch e {
+	case V1RemoveProjectAddonParamsAddonVariant1CdDefault:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for V1RemoveProjectAddonParamsAddonVariant2.
 const (
 	V1RemoveProjectAddonParamsAddonVariant2Pitr14 V1RemoveProjectAddonParamsAddonVariant2 = "pitr_14"
@@ -1805,11 +5379,35 @@ const (
 	V1RemoveProjectAddonParamsAddonVariant2Pitr7  V1RemoveProjectAddonParamsAddonVariant2 = "pitr_7"
 )
 
+// Valid indicates whether the value is a known member of the V1RemoveProjectAddonParamsAddonVariant2 enum.
+func (e V1RemoveProjectAddonParamsAddonVariant2) Valid() bool {
+	switch e {
+	case V1RemoveProjectAddonParamsAddonVariant2Pitr14:
+		return true
+	case V1RemoveProjectAddonParamsAddonVariant2Pitr28:
+		return true
+	case V1RemoveProjectAddonParamsAddonVariant2Pitr7:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for V1RemoveProjectAddonParamsAddonVariant3.
 const (
 	V1RemoveProjectAddonParamsAddonVariant3Ipv4Default V1RemoveProjectAddonParamsAddonVariant3 = "ipv4_default"
 )
 
+// Valid indicates whether the value is a known member of the V1RemoveProjectAddonParamsAddonVariant3 enum.
+func (e V1RemoveProjectAddonParamsAddonVariant3) Valid() bool {
+	switch e {
+	case V1RemoveProjectAddonParamsAddonVariant3Ipv4Default:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for V1GetServicesHealthParamsServices.
 const (
 	V1GetServicesHealthParamsServicesAuth           V1GetServicesHealthParamsServices = "auth"
@@ -1822,18 +5420,66 @@ const (
 	V1GetServicesHealthParamsServicesStorage        V1GetServicesHealthParamsServices = "storage"
 )
 
+// Valid indicates whether the value is a known member of the V1GetServicesHealthParamsServices enum.
+func (e V1GetServicesHealthParamsServices) Valid() bool {
+	switch e {
+	case V1GetServicesHealthParamsServicesAuth:
+		return true
+	case V1GetServicesHealthParamsServicesDb:
+		return true
+	case V1GetServicesHealthParamsServicesDbPostgresUser:
+		return true
+	case V1GetServicesHealthParamsServicesPgBouncer:
+		return true
+	case V1GetServicesHealthParamsServicesPooler:
+		return true
+	case V1GetServicesHealthParamsServicesRealtime:
+		return true
+	case V1GetServicesHealthParamsServicesRest:
+		return true
+	case V1GetServicesHealthParamsServicesStorage:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for V1ListAllSnippetsParamsSortBy.
 const (
 	InsertedAt V1ListAllSnippetsParamsSortBy = "inserted_at"
 	Name       V1ListAllSnippetsParamsSortBy = "name"
 )
 
+// Valid indicates whether the value is a known member of the V1ListAllSnippetsParamsSortBy enum.
+func (e V1ListAllSnippetsParamsSortBy) Valid() bool {
+	switch e {
+	case InsertedAt:
+		return true
+	case Name:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for V1ListAllSnippetsParamsSortOrder.
 const (
 	Asc  V1ListAllSnippetsParamsSortOrder = "asc"
 	Desc V1ListAllSnippetsParamsSortOrder = "desc"
 )
 
+// Valid indicates whether the value is a known member of the V1ListAllSnippetsParamsSortOrder enum.
+func (e V1ListAllSnippetsParamsSortOrder) Valid() bool {
+	switch e {
+	case Asc:
+		return true
+	case Desc:
+		return true
+	default:
+		return false
+	}
+}
+
 // AcceptInviteExternalUserJitAccessBody defines model for AcceptInviteExternalUserJitAccessBody.
 type AcceptInviteExternalUserJitAccessBody struct {
 	Email openapi_types.Email `json:"email"`
@@ -2237,7 +5883,7 @@ type BranchResponse struct {
 	IsDefault           bool               `json:"is_default"`
 
 	// LatestCheckRunId This field is deprecated and will not be populated.
-	// Deprecated:
+	// Deprecated: this property has been marked as deprecated upstream, but no `x-deprecated-reason` was set
 	LatestCheckRunId     *float32                            `json:"latest_check_run_id,omitempty"`
 	Name                 string                              `json:"name"`
 	NotifyUrl            *string                             `json:"notify_url,omitempty"`
@@ -2249,7 +5895,7 @@ type BranchResponse struct {
 	ReviewRequestedAt    *time.Time                          `json:"review_requested_at,omitempty"`
 
 	// Status This field is deprecated. List action runs to get branch status instead.
-	// Deprecated:
+	// Deprecated: this property has been marked as deprecated upstream, but no `x-deprecated-reason` was set
 	Status    BranchResponseStatus `json:"status"`
 	UpdatedAt time.Time            `json:"updated_at"`
 	WithData  bool                 `json:"with_data"`
@@ -2376,10 +6022,10 @@ type CreateProjectClaimTokenResponse struct {
 type CreateProviderBody struct {
 	AttributeMapping *struct {
 		Keys map[string]struct {
-			Array   *bool        `json:"array,omitempty"`
-			Default *interface{} `json:"default,omitempty"`
-			Name    *string      `json:"name,omitempty"`
-			Names   *[]string    `json:"names,omitempty"`
+			Array   *bool       `json:"array,omitempty"`
+			Default interface{} `json:"default,omitempty"`
+			Name    *string     `json:"name,omitempty"`
+			Names   *[]string   `json:"names,omitempty"`
 		} `json:"keys"`
 	} `json:"attribute_mapping,omitempty"`
 	Domains      *[]string                       `json:"domains,omitempty"`
@@ -2403,21 +6049,19 @@ type CreateProviderResponse struct {
 	Domains   *[]struct {
 		CreatedAt *string `json:"created_at,omitempty"`
 		Domain    *string `json:"domain,omitempty"`
-		Id        string  `json:"id"`
 		UpdatedAt *string `json:"updated_at,omitempty"`
 	} `json:"domains,omitempty"`
 	Id   string `json:"id"`
 	Saml *struct {
 		AttributeMapping *struct {
 			Keys map[string]struct {
-				Array   *bool        `json:"array,omitempty"`
-				Default *interface{} `json:"default,omitempty"`
-				Name    *string      `json:"name,omitempty"`
-				Names   *[]string    `json:"names,omitempty"`
+				Array   *bool       `json:"array,omitempty"`
+				Default interface{} `json:"default,omitempty"`
+				Name    *string     `json:"name,omitempty"`
+				Names   *[]string   `json:"names,omitempty"`
 			} `json:"keys"`
 		} `json:"attribute_mapping,omitempty"`
 		EntityId     string  `json:"entity_id"`
-		Id           string  `json:"id"`
 		MetadataUrl  *string `json:"metadata_url,omitempty"`
 		MetadataXml  *string `json:"metadata_xml,omitempty"`
 		NameIdFormat *string `json:"name_id_format,omitempty"`
@@ -2589,9 +6233,9 @@ type CreateSigningKeyBodyStatus string
 
 // CreateThirdPartyAuthBody defines model for CreateThirdPartyAuthBody.
 type CreateThirdPartyAuthBody struct {
-	CustomJwks    *interface{} `json:"custom_jwks,omitempty"`
-	JwksUrl       *string      `json:"jwks_url,omitempty"`
-	OidcIssuerUrl *string      `json:"oidc_issuer_url,omitempty"`
+	CustomJwks    interface{} `json:"custom_jwks,omitempty"`
+	JwksUrl       *string     `json:"jwks_url,omitempty"`
+	OidcIssuerUrl *string     `json:"oidc_issuer_url,omitempty"`
 }
 
 // DatabaseUpgradeStatusResponse defines model for DatabaseUpgradeStatusResponse.
@@ -2618,21 +6262,19 @@ type DeleteProviderResponse struct {
 	Domains   *[]struct {
 		CreatedAt *string `json:"created_at,omitempty"`
 		Domain    *string `json:"domain,omitempty"`
-		Id        string  `json:"id"`
 		UpdatedAt *string `json:"updated_at,omitempty"`
 	} `json:"domains,omitempty"`
 	Id   string `json:"id"`
 	Saml *struct {
 		AttributeMapping *struct {
 			Keys map[string]struct {
-				Array   *bool        `json:"array,omitempty"`
-				Default *interface{} `json:"default,omitempty"`
-				Name    *string      `json:"name,omitempty"`
-				Names   *[]string    `json:"names,omitempty"`
+				Array   *bool       `json:"array,omitempty"`
+				Default interface{} `json:"default,omitempty"`
+				Name    *string     `json:"name,omitempty"`
+				Names   *[]string   `json:"names,omitempty"`
 			} `json:"keys"`
 		} `json:"attribute_mapping,omitempty"`
 		EntityId     string  `json:"entity_id"`
-		Id           string  `json:"id"`
 		MetadataUrl  *string `json:"metadata_url,omitempty"`
 		MetadataXml  *string `json:"metadata_xml,omitempty"`
 		NameIdFormat *string `json:"name_id_format,omitempty"`
@@ -2844,21 +6486,19 @@ type GetProviderResponse struct {
 	Domains   *[]struct {
 		CreatedAt *string `json:"created_at,omitempty"`
 		Domain    *string `json:"domain,omitempty"`
-		Id        string  `json:"id"`
 		UpdatedAt *string `json:"updated_at,omitempty"`
 	} `json:"domains,omitempty"`
 	Id   string `json:"id"`
 	Saml *struct {
 		AttributeMapping *struct {
 			Keys map[string]struct {
-				Array   *bool        `json:"array,omitempty"`
-				Default *interface{} `json:"default,omitempty"`
-				Name    *string      `json:"name,omitempty"`
-				Names   *[]string    `json:"names,omitempty"`
+				Array   *bool       `json:"array,omitempty"`
+				Default interface{} `json:"default,omitempty"`
+				Name    *string     `json:"name,omitempty"`
+				Names   *[]string   `json:"names,omitempty"`
 			} `json:"keys"`
 		} `json:"attribute_mapping,omitempty"`
 		EntityId     string  `json:"entity_id"`
-		Id           string  `json:"id"`
 		MetadataUrl  *string `json:"metadata_url,omitempty"`
 		MetadataXml  *string `json:"metadata_xml,omitempty"`
 		NameIdFormat *string `json:"name_id_format,omitempty"`
@@ -3062,8 +6702,8 @@ type ListProjectAddonsResponse struct {
 			Id ListProjectAddonsResponse_AvailableAddons_Variants_Id `json:"id"`
 
 			// Meta Any JSON-serializable value
-			Meta  *interface{} `json:"meta,omitempty"`
-			Name  string       `json:"name"`
+			Meta  interface{} `json:"meta,omitempty"`
+			Name  string      `json:"name"`
 			Price struct {
 				Amount      float32                                                       `json:"amount"`
 				Description string                                                        `json:"description"`
@@ -3078,8 +6718,8 @@ type ListProjectAddonsResponse struct {
 			Id ListProjectAddonsResponse_SelectedAddons_Variant_Id `json:"id"`
 
 			// Meta Any JSON-serializable value
-			Meta  *interface{} `json:"meta,omitempty"`
-			Name  string       `json:"name"`
+			Meta  interface{} `json:"meta,omitempty"`
+			Name  string      `json:"name"`
 			Price struct {
 				Amount      float32                                                     `json:"amount"`
 				Description string                                                      `json:"description"`
@@ -3173,21 +6813,19 @@ type ListProvidersResponse struct {
 		Domains   *[]struct {
 			CreatedAt *string `json:"created_at,omitempty"`
 			Domain    *string `json:"domain,omitempty"`
-			Id        string  `json:"id"`
 			UpdatedAt *string `json:"updated_at,omitempty"`
 		} `json:"domains,omitempty"`
 		Id   string `json:"id"`
 		Saml *struct {
 			AttributeMapping *struct {
 				Keys map[string]struct {
-					Array   *bool        `json:"array,omitempty"`
-					Default *interface{} `json:"default,omitempty"`
-					Name    *string      `json:"name,omitempty"`
-					Names   *[]string    `json:"names,omitempty"`
+					Array   *bool       `json:"array,omitempty"`
+					Default interface{} `json:"default,omitempty"`
+					Name    *string     `json:"name,omitempty"`
+					Names   *[]string   `json:"names,omitempty"`
 				} `json:"keys"`
 			} `json:"attribute_mapping,omitempty"`
 			EntityId     string  `json:"entity_id"`
-			Id           string  `json:"id"`
 			MetadataUrl  *string `json:"metadata_url,omitempty"`
 			MetadataXml  *string `json:"metadata_xml,omitempty"`
 			NameIdFormat *string `json:"name_id_format,omitempty"`
@@ -3421,7 +7059,7 @@ type OrganizationProjectsResponseProjectsStatus string
 // OrganizationResponseV1 defines model for OrganizationResponseV1.
 type OrganizationResponseV1 struct {
 	// Id Deprecated: Use `slug` instead.
-	// Deprecated:
+	// Deprecated: this property has been marked as deprecated upstream, but no `x-deprecated-reason` was set
 	Id   string `json:"id"`
 	Name string `json:"name"`
 
@@ -3431,9 +7069,31 @@ type OrganizationResponseV1 struct {
 
 // PgsodiumConfigResponse defines model for PgsodiumConfigResponse.
 type PgsodiumConfigResponse struct {
+	// RootKey The pgsodium root key: 32 bytes, hex-encoded (64 characters).
 	RootKey string `json:"root_key"`
 }
 
+// PlanGateErrorBody defines model for PlanGateErrorBody.
+type PlanGateErrorBody struct {
+	// Error Present on entitlement denials. Other errors with this status code (validation, billing state) carry only message.
+	Error *struct {
+		// Code Machine-readable marker for plan-gated denials
+		Code PlanGateErrorBodyErrorCode `json:"code"`
+
+		// Feature Entitlement feature key that failed the check
+		Feature string `json:"feature"`
+
+		// UpgradeUrl Billing page URL for the organization, present when the org is resolvable
+		UpgradeUrl *string `json:"upgrade_url,omitempty"`
+	} `json:"error,omitempty"`
+
+	// Message Human-readable explanation of the plan gate
+	Message string `json:"message"`
+}
+
+// PlanGateErrorBodyErrorCode Machine-readable marker for plan-gated denials
+type PlanGateErrorBodyErrorCode string
+
 // PostgresConfigResponse defines model for PostgresConfigResponse.
 type PostgresConfigResponse struct {
 	// CheckpointTimeout Default unit: s
@@ -3520,7 +7180,7 @@ type ProjectUpgradeEligibilityResponse struct {
 	LegacyAuthCustomRoles           []string                                                         `json:"legacy_auth_custom_roles"`
 
 	// ObjectsToBeDropped Use validation_errors instead.
-	// Deprecated:
+	// Deprecated: this property has been marked as deprecated upstream, but no `x-deprecated-reason` was set
 	ObjectsToBeDropped    []string `json:"objects_to_be_dropped"`
 	TargetUpgradeVersions []struct {
 		AppVersion      string                                                                `json:"app_version"`
@@ -3529,11 +7189,11 @@ type ProjectUpgradeEligibilityResponse struct {
 	} `json:"target_upgrade_versions"`
 
 	// UnsupportedExtensions Use validation_errors instead.
-	// Deprecated:
+	// Deprecated: this property has been marked as deprecated upstream, but no `x-deprecated-reason` was set
 	UnsupportedExtensions []string `json:"unsupported_extensions"`
 
 	// UserDefinedObjectsInInternalSchemas Use validation_errors instead.
-	// Deprecated:
+	// Deprecated: this property has been marked as deprecated upstream, but no `x-deprecated-reason` was set
 	UserDefinedObjectsInInternalSchemas []string                                                  `json:"user_defined_objects_in_internal_schemas"`
 	ValidationErrors                    []ProjectUpgradeEligibilityResponse_ValidationErrors_Item `json:"validation_errors"`
 	Warnings                            []ProjectUpgradeEligibilityResponse_Warnings_Item         `json:"warnings"`
@@ -3901,7 +7561,7 @@ type SnippetListDataVisibility string
 type SnippetResponse struct {
 	Content struct {
 		// Favorite Deprecated: Rely on root-level favorite property instead.
-		// Deprecated:
+		// Deprecated: this property has been marked as deprecated upstream, but no `x-deprecated-reason` was set
 		Favorite      *bool  `json:"favorite,omitempty"`
 		SchemaVersion string `json:"schema_version"`
 		Sql           string `json:"sql"`
@@ -4303,7 +7963,7 @@ type UpdateBranchBody struct {
 	RequestReview *bool   `json:"request_review,omitempty"`
 
 	// ResetOnPush This field is deprecated and will be ignored. Use v1-reset-a-branch endpoint directly instead.
-	// Deprecated:
+	// Deprecated: this property has been marked as deprecated upstream, but no `x-deprecated-reason` was set
 	ResetOnPush *bool                   `json:"reset_on_push,omitempty"`
 	Status      *UpdateBranchBodyStatus `json:"status,omitempty"`
 }
@@ -4372,6 +8032,7 @@ type UpdateJitAccessBody struct {
 
 // UpdatePgsodiumConfigBody defines model for UpdatePgsodiumConfigBody.
 type UpdatePgsodiumConfigBody struct {
+	// RootKey The pgsodium root key: 32 bytes, hex-encoded (64 characters).
 	RootKey string `json:"root_key"`
 }
 
@@ -4434,10 +8095,10 @@ type UpdatePostgresConfigBodySessionReplicationRole string
 type UpdateProviderBody struct {
 	AttributeMapping *struct {
 		Keys map[string]struct {
-			Array   *bool        `json:"array,omitempty"`
-			Default *interface{} `json:"default,omitempty"`
-			Name    *string      `json:"name,omitempty"`
-			Names   *[]string    `json:"names,omitempty"`
+			Array   *bool       `json:"array,omitempty"`
+			Default interface{} `json:"default,omitempty"`
+			Name    *string     `json:"name,omitempty"`
+			Names   *[]string   `json:"names,omitempty"`
 		} `json:"keys"`
 	} `json:"attribute_mapping,omitempty"`
 	Domains      *[]string                       `json:"domains,omitempty"`
@@ -4455,21 +8116,19 @@ type UpdateProviderResponse struct {
 	Domains   *[]struct {
 		CreatedAt *string `json:"created_at,omitempty"`
 		Domain    *string `json:"domain,omitempty"`
-		Id        string  `json:"id"`
 		UpdatedAt *string `json:"updated_at,omitempty"`
 	} `json:"domains,omitempty"`
 	Id   string `json:"id"`
 	Saml *struct {
 		AttributeMapping *struct {
 			Keys map[string]struct {
-				Array   *bool        `json:"array,omitempty"`
-				Default *interface{} `json:"default,omitempty"`
-				Name    *string      `json:"name,omitempty"`
-				Names   *[]string    `json:"names,omitempty"`
+				Array   *bool       `json:"array,omitempty"`
+				Default interface{} `json:"default,omitempty"`
+				Name    *string     `json:"name,omitempty"`
+				Names   *[]string   `json:"names,omitempty"`
 			} `json:"keys"`
 		} `json:"attribute_mapping,omitempty"`
 		EntityId     string  `json:"entity_id"`
-		Id           string  `json:"id"`
 		MetadataUrl  *string `json:"metadata_url,omitempty"`
 		MetadataXml  *string `json:"metadata_xml,omitempty"`
 		NameIdFormat *string `json:"name_id_format,omitempty"`
@@ -4676,25 +8335,25 @@ type V1CreateProjectBody struct {
 	HighAvailability *bool `json:"high_availability,omitempty"`
 
 	// KpsEnabled This field is deprecated and is ignored in this request
-	// Deprecated:
+	// Deprecated: this property has been marked as deprecated upstream, but no `x-deprecated-reason` was set
 	KpsEnabled *bool `json:"kps_enabled,omitempty"`
 
 	// Name Name of your project
 	Name string `json:"name"`
 
 	// OrganizationId Deprecated: Use `organization_slug` instead.
-	// Deprecated:
+	// Deprecated: this property has been marked as deprecated upstream, but no `x-deprecated-reason` was set
 	OrganizationId *string `json:"organization_id,omitempty"`
 
 	// OrganizationSlug Organization slug
 	OrganizationSlug string `json:"organization_slug"`
 
 	// Plan Subscription Plan is now set on organization level and is ignored in this request
-	// Deprecated:
+	// Deprecated: this property has been marked as deprecated upstream, but no `x-deprecated-reason` was set
 	Plan *V1CreateProjectBodyPlan `json:"plan,omitempty"`
 
 	// Region Region you want your server to reside in. Use region_selection instead.
-	// Deprecated:
+	// Deprecated: this property has been marked as deprecated upstream, but no `x-deprecated-reason` was set
 	Region *V1CreateProjectBodyRegion `json:"region,omitempty"`
 
 	// RegionSelection Region selection. Only one of region or region_selection can be specified.
@@ -4991,14 +8650,14 @@ type V1ProjectResponse struct {
 	CreatedAt string `json:"created_at"`
 
 	// Id Deprecated: Use `ref` instead.
-	// Deprecated:
+	// Deprecated: this property has been marked as deprecated upstream, but no `x-deprecated-reason` was set
 	Id string `json:"id"`
 
 	// Name Name of your project
 	Name string `json:"name"`
 
 	// OrganizationId Deprecated: Use `organization_slug` instead.
-	// Deprecated:
+	// Deprecated: this property has been marked as deprecated upstream, but no `x-deprecated-reason` was set
 	OrganizationId string `json:"organization_id"`
 
 	// OrganizationSlug Organization slug
@@ -5034,14 +8693,14 @@ type V1ProjectWithDatabaseResponse struct {
 	} `json:"database"`
 
 	// Id Deprecated: Use `ref` instead.
-	// Deprecated:
+	// Deprecated: this property has been marked as deprecated upstream, but no `x-deprecated-reason` was set
 	Id string `json:"id"`
 
 	// Name Name of your project
 	Name string `json:"name"`
 
 	// OrganizationId Deprecated: Use `organization_slug` instead.
-	// Deprecated:
+	// Deprecated: this property has been marked as deprecated upstream, but no `x-deprecated-reason` was set
 	OrganizationId string `json:"organization_id"`
 
 	// OrganizationSlug Organization slug
@@ -5101,7 +8760,7 @@ type V1ServiceHealthResponse struct {
 	Error *string `json:"error,omitempty"`
 
 	// Healthy Deprecated. Use `status` instead.
-	// Deprecated:
+	// Deprecated: this property has been marked as deprecated upstream, but no `x-deprecated-reason` was set
 	Healthy bool                          `json:"healthy"`
 	Info    *V1ServiceHealthResponse_Info `json:"info,omitempty"`
 	Name    V1ServiceHealthResponseName   `json:"name"`
@@ -5124,7 +8783,7 @@ type V1ServiceHealthResponseInfo1 struct {
 	DbConnected      bool `json:"db_connected"`
 
 	// Healthy Deprecated. Use `status` instead.
-	// Deprecated:
+	// Deprecated: this property has been marked as deprecated upstream, but no `x-deprecated-reason` was set
 	Healthy              bool `json:"healthy"`
 	ReplicationConnected bool `json:"replication_connected"`
 }
@@ -5218,6 +8877,9 @@ type VanitySubdomainConfigResponse struct {
 // VanitySubdomainConfigResponseStatus defines model for VanitySubdomainConfigResponse.Status.
 type VanitySubdomainConfigResponseStatus string
 
+// bearerContextKey is the context key for bearer security scheme
+type bearerContextKey string
+
 // V1DeleteABranchParams defines parameters for V1DeleteABranch.
 type V1DeleteABranchParams struct {
 	// Force If set to false, schedule deletion with 1-hour grace period (only when soft deletion is enabled).
@@ -5835,9 +9497,11 @@ func (a GetProjectDbMetadataResponse_Databases_Item) MarshalJSON() ([]byte, erro
 		return nil, fmt.Errorf("error marshaling 'name': %w", err)
 	}
 
-	object["schemas"], err = json.Marshal(a.Schemas)
-	if err != nil {
-		return nil, fmt.Errorf("error marshaling 'schemas': %w", err)
+	if a.Schemas != nil {
+		object["schemas"], err = json.Marshal(a.Schemas)
+		if err != nil {
+			return nil, fmt.Errorf("error marshaling 'schemas': %w", err)
+		}
 	}
 
 	for fieldName, field := range a.AdditionalProperties {
diff --git a/apps/cli-go/pkg/config/pgdelta_version.go b/apps/cli-go/pkg/config/pgdelta_version.go
index 26be07f8a0..a38641ae7c 100644
--- a/apps/cli-go/pkg/config/pgdelta_version.go
+++ b/apps/cli-go/pkg/config/pgdelta_version.go
@@ -4,7 +4,7 @@ import "strings"
 
 // DefaultPgDeltaNpmVersion is the npm dist-tag/version used for @supabase/pg-delta
 // when supabase/.temp/pgdelta-version is absent or empty.
-const DefaultPgDeltaNpmVersion = "1.0.0-alpha.27"
+const DefaultPgDeltaNpmVersion = "1.0.0-alpha.32"
 
 const pgDeltaNpmVersionPlaceholder = "1.0.0-alpha.20"
 
diff --git a/apps/cli-go/pkg/config/templates/Dockerfile b/apps/cli-go/pkg/config/templates/Dockerfile
index ec7e643391..19f01f35b7 100644
--- a/apps/cli-go/pkg/config/templates/Dockerfile
+++ b/apps/cli-go/pkg/config/templates/Dockerfile
@@ -3,17 +3,17 @@ FROM supabase/postgres:17.6.1.143 AS pg
 # Append to ServiceImages when adding new dependencies below
 FROM library/kong:2.8.1 AS kong
 FROM axllent/mailpit:v1.30.2 AS mailpit
-FROM postgrest/postgrest:v14.14 AS postgrest
+FROM postgrest/postgrest:v14.15 AS postgrest
 FROM supabase/postgres-meta:v0.96.6 AS pgmeta
-FROM supabase/studio:2026.07.06-sha-66cf431 AS studio
+FROM supabase/studio:2026.07.13-sha-b5ada96 AS studio
 FROM darthsim/imgproxy:v3.8.0 AS imgproxy
 FROM supabase/edge-runtime:v1.74.2 AS edgeruntime
 FROM timberio/vector:0.53.0-alpine AS vector
 FROM supabase/supavisor:2.9.7 AS supavisor
-FROM supabase/gotrue:v2.192.0 AS gotrue
-FROM supabase/realtime:v2.112.6 AS realtime
-FROM supabase/storage-api:v1.62.5 AS storage
-FROM supabase/logflare:1.46.0 AS logflare
+FROM supabase/gotrue:v2.193.0 AS gotrue
+FROM supabase/realtime:v2.113.4 AS realtime
+FROM supabase/storage-api:v1.66.4 AS storage
+FROM supabase/logflare:1.47.1 AS logflare
 # Append to JobImages when adding new dependencies below
 FROM supabase/pgadmin-schema-diff:cli-0.0.5 AS differ
 FROM supabase/migra:3.0.1663481299 AS migra
diff --git a/apps/cli-go/pkg/go.mod b/apps/cli-go/pkg/go.mod
index 3de3c61ae8..f05555c352 100644
--- a/apps/cli-go/pkg/go.mod
+++ b/apps/cli-go/pkg/go.mod
@@ -20,13 +20,13 @@ require (
 	github.com/jackc/pgx/v4 v4.18.3
 	github.com/joho/godotenv v1.5.1
 	github.com/oapi-codegen/nullable v1.2.0
-	github.com/oapi-codegen/runtime v1.4.2
+	github.com/oapi-codegen/runtime v1.6.0
 	github.com/spf13/afero v1.15.0
 	github.com/spf13/viper v1.21.0
 	github.com/stretchr/testify v1.11.1
 	github.com/tidwall/jsonc v0.3.3
-	golang.org/x/mod v0.37.0
-	google.golang.org/grpc v1.81.1
+	golang.org/x/mod v0.38.0
+	google.golang.org/grpc v1.82.1
 )
 
 require (
@@ -51,8 +51,8 @@ require (
 	github.com/stretchr/objx v0.5.2 // indirect
 	github.com/subosito/gotenv v1.6.0 // indirect
 	go.yaml.in/yaml/v3 v3.0.4 // indirect
-	golang.org/x/crypto v0.48.0 // indirect
-	golang.org/x/sys v0.42.0 // indirect
-	golang.org/x/text v0.34.0 // indirect
+	golang.org/x/crypto v0.52.0 // indirect
+	golang.org/x/sys v0.45.0 // indirect
+	golang.org/x/text v0.37.0 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
 )
diff --git a/apps/cli-go/pkg/go.sum b/apps/cli-go/pkg/go.sum
index 8394b09a98..afa34b3b68 100644
--- a/apps/cli-go/pkg/go.sum
+++ b/apps/cli-go/pkg/go.sum
@@ -132,8 +132,8 @@ github.com/nbio/st v0.0.0-20140626010706-e9e8d9816f32 h1:W6apQkHrMkS0Muv8G/TipAy
 github.com/nbio/st v0.0.0-20140626010706-e9e8d9816f32/go.mod h1:9wM+0iRr9ahx58uYLpLIr5fm8diHn0JbqRycJi6w0Ms=
 github.com/oapi-codegen/nullable v1.2.0 h1:VflFkDW980KhBPiFF7nWSyjg+r4Obqj8lXipV0UkP5w=
 github.com/oapi-codegen/nullable v1.2.0/go.mod h1:KUZ3vUzkmEKY90ksAmit2+5juDIhIZhfDl+0PwOQlFY=
-github.com/oapi-codegen/runtime v1.4.2 h1:GMxFVYLzoYLua+/KvzgSphkyK1lLTReQI9Vf4hvATKE=
-github.com/oapi-codegen/runtime v1.4.2/go.mod h1:GwV7hC2hviaMzj+ITfHVRESK5J2W/GefVwIND/bMGvU=
+github.com/oapi-codegen/runtime v1.6.0 h1:7Xx+GlueD6nRuyKoCPzL434Jfi3BetbiJOrzCHp/VPU=
+github.com/oapi-codegen/runtime v1.6.0/go.mod h1:GwV7hC2hviaMzj+ITfHVRESK5J2W/GefVwIND/bMGvU=
 github.com/pelletier/go-toml/v2 v2.2.4 h1:mye9XuhQ6gvn5h28+VilKrrPoQVanw5PMw/TB0t5Ec4=
 github.com/pelletier/go-toml/v2 v2.2.4/go.mod h1:2gIqNv+qfxSVS7cM2xJQKtLSTLUE9V8t9Stt+h56mCY=
 github.com/pkg/errors v0.8.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
@@ -217,15 +217,15 @@ golang.org/x/crypto v0.0.0-20210711020723-a769d52b0f97/go.mod h1:GvvjBRRGRdwPK5y
 golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
 golang.org/x/crypto v0.19.0/go.mod h1:Iy9bg/ha4yyC70EfRS8jz+B6ybOBKMaSxLj6P6oBDfU=
 golang.org/x/crypto v0.20.0/go.mod h1:Xwo95rrVNIoSMx9wa1JroENMToLWn3RNVrTBpLHgZPQ=
-golang.org/x/crypto v0.48.0 h1:/VRzVqiRSggnhY7gNRxPauEQ5Drw9haKdM0jqfcCFts=
-golang.org/x/crypto v0.48.0/go.mod h1:r0kV5h3qnFPlQnBSrULhlsRfryS2pmewsg+XfMgkVos=
+golang.org/x/crypto v0.52.0 h1:RMs7fP2rXdep0CftQlK8Uf+kibLm7qkCcradZWYz988=
+golang.org/x/crypto v0.52.0/go.mod h1:1QgfPxDqh0T2M/elOJtp9RvuR95kVjir0e6/BvEmGbc=
 golang.org/x/lint v0.0.0-20190930215403-16217165b5de/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc=
 golang.org/x/mod v0.0.0-20190513183733-4bf6d317e70e/go.mod h1:mXi4GBBbnImb6dmsKGUJ2LatrhH/nqhxcFungHvyanc=
 golang.org/x/mod v0.1.1-0.20191105210325-c90efee705ee/go.mod h1:QqPTAvyqsEbceGzBzNggFXnrqF1CaUcvgkdR5Ot7KZg=
 golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
 golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
-golang.org/x/mod v0.37.0 h1:vF1DjpVEshcIqoEaauuHebaLk1O1forxjxBaVn884JQ=
-golang.org/x/mod v0.37.0/go.mod h1:m8S8VeM9r4dzDwjrKO0a1sZP3YjeMamRRlD+fmR2Q/0=
+golang.org/x/mod v0.38.0 h1:MECBjubtXD7yj4HrhIUcywNaGeNVUdfVnxmPajOk4yk=
+golang.org/x/mod v0.38.0/go.mod h1:V6Xz0pq8TQ3dGqVQ1FVHuelZpAL0uNhSkk9ogYP3c40=
 golang.org/x/net v0.0.0-20190311183353-d8887717615a/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
 golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
 golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
@@ -255,8 +255,8 @@ golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBc
 golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.8.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.17.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
-golang.org/x/sys v0.42.0 h1:omrd2nAlyT5ESRdCLYdm3+fMfNFE/+Rf4bDIQImRJeo=
-golang.org/x/sys v0.42.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
+golang.org/x/sys v0.45.0 h1:dO4czNzziLiiXplLQgBCEpCvXQ3dnkn0SdaZSYdQ+FY=
+golang.org/x/sys v0.45.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
 golang.org/x/term v0.0.0-20201117132131-f5c789dd3221/go.mod h1:Nr5EML6q2oocZ2LXRh80K7BxOlk5/8JxuGnuhpl+muw=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
@@ -272,8 +272,8 @@ golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
 golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
 golang.org/x/text v0.9.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
 golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
-golang.org/x/text v0.34.0 h1:oL/Qq0Kdaqxa1KbNeMKwQq0reLCCaFtqu2eNuSeNHbk=
-golang.org/x/text v0.34.0/go.mod h1:homfLqTYRFyVYemLBFl5GgL/DWEiH5wcsQ5gSh1yziA=
+golang.org/x/text v0.37.0 h1:Cqjiwd9eSg8e0QAkyCaQTNHFIIzWtidPahFWR83rTrc=
+golang.org/x/text v0.37.0/go.mod h1:a5sjxXGs9hsn/AJVwuElvCAo9v8QYLzvavO5z2PiM38=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20190311212946-11955173bddd/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
 golang.org/x/tools v0.0.0-20190425163242-31fd60d6bfdc/go.mod h1:RgjU9mgBXZiqYHBnxXauZ1Gv1EHHAz9KjViQ78xBX0Q=
@@ -290,8 +290,8 @@ golang.org/x/xerrors v0.0.0-20190513163551-3ee3066db522/go.mod h1:I/5z698sn9Ka8T
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-google.golang.org/grpc v1.81.1 h1:VnnIIZ88UzOOKLukQi+ImGz8O1Wdp8nAGGnvOfEIWQQ=
-google.golang.org/grpc v1.81.1/go.mod h1:xGH9GfzOyMTGIOXBJmXt+BX/V0kcdQbdcuwQ/zNw42I=
+google.golang.org/grpc v1.82.1 h1:NnAxzGRA0677vCa4BUkOAnO5+FfQqVl9iUXeD0IqcGE=
+google.golang.org/grpc v1.82.1/go.mod h1:yzTZ1TB1Z3SG+LIYaI+WiE8D5+PZ3ArnrSp8zF3+/ZA=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
diff --git a/apps/cli/AGENTS.md b/apps/cli/AGENTS.md
index c30465cd85..d4830ccc9e 100644
--- a/apps/cli/AGENTS.md
+++ b/apps/cli/AGENTS.md
@@ -90,14 +90,14 @@ Always check `src/shared/` before writing new infrastructure. Do not duplicate w
 
 Also check the following `legacy/` infrastructure before writing equivalent helpers from scratch:
 
-| Path                                                    | What it provides                                                                                                                                                                            |
-| ------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `legacy/config/legacy-cli-config.layer.ts`              | `LegacyCliConfig` — resolves `SUPABASE_PROFILE` (built-in name **or** YAML file path), `--workdir`, `--experimental`, project-id from `supabase/config.toml`                                |
-| `legacy/config/legacy-project-ref.layer.ts`             | `LegacyProjectRefResolver` — `--project-ref` flag → env → linked-project.json → config fallback chain; matches Go's resolver order                                                          |
-| `legacy/telemetry/legacy-telemetry-state.layer.ts`      | `LegacyTelemetryState.flush` — writes `~/.supabase/telemetry.json`, runs in every command's `Effect.ensuring`                                                                               |
-| `legacy/telemetry/legacy-linked-project-cache.layer.ts` | `LegacyLinkedProjectCache.cache(ref)` — writes `~/.supabase/<workdir-hash>/linked-project.json` after `--project-ref` resolves; bypasses generated schema validation (uses raw HTTP client) |
-| `legacy/auth/legacy-http-debug.layer.ts`                | `legacyHttpClientLayer` — wraps the HTTP transport with a `--debug` stderr logger in Go's `log.LstdFlags` format                                                                            |
-| `legacy/output/legacy-glamour-table.ts`                 | `renderGlamourTable(headers, rows)` — byte-exact ASCII match for Go's `glamour.RenderTable(..., AsciiStyle)`                                                                                |
+| Path                                                    | What it provides                                                                                                                                                                          |
+| ------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `legacy/config/legacy-cli-config.layer.ts`              | `LegacyCliConfig` — resolves `SUPABASE_PROFILE` (built-in name **or** YAML file path), `--workdir`, `--experimental`, project-id from `supabase/config.toml`                              |
+| `legacy/config/legacy-project-ref.layer.ts`             | `LegacyProjectRefResolver` — `--project-ref` flag → env → `supabase/.temp/project-ref` file → prompt; matches Go's resolver order                                                         |
+| `legacy/telemetry/legacy-telemetry-state.layer.ts`      | `LegacyTelemetryState.flush` — writes `~/.supabase/telemetry.json`, runs in every command's `Effect.ensuring`                                                                             |
+| `legacy/telemetry/legacy-linked-project-cache.layer.ts` | `LegacyLinkedProjectCache.cache(ref)` — writes `<workdir>/supabase/.temp/linked-project.json` after `--project-ref` resolves; bypasses generated schema validation (uses raw HTTP client) |
+| `legacy/auth/legacy-http-debug.layer.ts`                | `legacyHttpClientLayer` — wraps the HTTP transport with a `--debug` stderr logger in Go's `log.LstdFlags` format                                                                          |
+| `legacy/output/legacy-glamour-table.ts`                 | `renderGlamourTable(headers, rows)` — byte-exact ASCII match for Go's `glamour.RenderTable(..., AsciiStyle)`                                                                              |
 
 ---
 
@@ -237,6 +237,10 @@ Concrete examples worth watching for as more commands land:
 
 This rule is consistent with the repo-wide **Refactoring Policy** ("delete obsolete helpers, shims, and parallel code paths as part of the refactor") — it just makes the policy concrete for the legacy-port workflow.
 
+### `Config.Validate` parity has one home
+
+Go's `Config.Validate` (`apps/cli-go/pkg/config/config.go:989-1190`) is ported exactly once: `src/legacy/shared/legacy-config-validate.ts` (`legacyValidateResolvedConfig`). Both the db/migration loader (`legacy-db-config.toml-read.ts`) and the status/stop resolver (`legacy-local-config-values.ts`) build a `LegacyConfigValidationInput` from their own pipelines and call it — do not add per-command reimplementations of these checks. When a Go validation branch or message changes, change it there. `legacy-config-validate.parity.unit.test.ts` feeds the same broken configs through both real pipelines and asserts identical error strings; extend it when adding a branch both callers share.
+
 ---
 
 ## Legacy Port: Go CLI Output Parity
@@ -281,12 +285,19 @@ The legacy shell sends the same PostHog events to the same product analytics pip
 - **Native legacy commands wrap with `withLegacyCommandInstrumentation`** (from `legacy/telemetry/legacy-command-instrumentation.ts`) — _not_ the shared `withCommandInstrumentation`. The legacy variant emits Go-shape properties: a single `flags` map (vs `flags_used`/`flag_values`), `is_agent: boolean` (vs `ai_tool: string`), and `env_signals`.
 - **Pass `flags` to the wrapper** so boolean flag values can be detected and logged verbatim: `handler(flags).pipe(withLegacyCommandInstrumentation({ flags }), ...)`. Sensitive values become the literal string `"<redacted>"` to match Go.
 - **Use `safeFlags: ["flag-name"]`** to whitelist flags that Go marks with `markFlagTelemetrySafe` (grep `apps/cli-go/cmd/*.go`). Today these are `--project-ref` (sso, branches, link, functions, projects/api-keys), `--project-id` (gen/types), `--org-id` (projects/create), and `--version` (migration/squash).
+- **Pass `config` (the command's own flag config record) to the wrapper** if it has any `Flag.choice`/`Flag.choiceWithValue` flags: `withLegacyCommandInstrumentation({ flags, config })`. Every choice flag declared in that command's own `config` is auto-detected and treated as safe, mirroring Go's `isEnumFlag` (`cmd/root_analytics.go:110-116`), which checks `flag.Value.(*utils.EnumFlag)` unconditionally — no per-flag `safeFlags` entry needed, and it stays correct as choices are added or removed. A command's own `config` only ever contains its own locally-declared flags, so this cannot cover the 3 global choice flags (`--output`, `--dns-resolver`, `--agent` in `shared/legacy/global-flags.ts`) — those are handled separately, see below.
+- **Global/persistent flags (`shared/legacy/global-flags.ts`) resolve automatically** — the wrapper reads `legacyGlobalFlagValues` (via `Effect.serviceOption`, so it's a no-op outside the real CLI tree) and falls back to it whenever a changed flag name isn't in the handler's own `flags` record, mirroring Go's `changedFlags()` walking `cmd.Parent()`'s `PersistentFlags()` (`cmd/root_analytics.go:53-76`). No per-command wiring needed. This gives two flag families their real value automatically, via the existing boolean-is-safe rule and a new choice-is-safe rule (`GLOBAL_CHOICE_FLAG_NAMES` — CLI-1904) respectively:
+  - Boolean globals: `--debug`, `--yes`, `--experimental`, `--create-ticket`.
+  - Choice globals: `--output`, `--dns-resolver`, `--agent`.
+
+  Both rules apply ONLY when a command's own `flags` record doesn't already declare that CLI name — a command's own flag always wins. Example: `db diff` declares its own local `output: Flag.string("output")` (a file path, not a choice) in its `flags` record, so `db diff --output diff.sql` stays redacted — matching Go, where `isEnumFlag` type-asserts `db diff`'s own non-enum local flag object instead of root's persistent `*utils.EnumFlag`.
+
 - **Proxy handlers (`LegacyGoProxy.exec`) must NOT wrap with any instrumentation.** The Go subprocess fires its own telemetry; a TS wrapper would double-count `cli_command_executed`.
 - **When promoting a command from proxy to native, reproduce every `phtelemetry.*` call in the Go counterpart.** Grep `apps/cli-go/internal/<command>/` for `service.Capture`, `service.Alias`, `service.Identify`, `service.GroupIdentify`, and `TrackUpgradeSuggested`. The current Go custom events that legacy ports must reproduce when natively ported:
 
   | Command                                                       | Event                   | Identity / groups                                                                                                  | Go source                                     |
   | ------------------------------------------------------------- | ----------------------- | ------------------------------------------------------------------------------------------------------------------ | --------------------------------------------- |
-  | `login`                                                       | `cli_login_completed`   | `analytics.alias(gotrueId, deviceId)` + `analytics.identify(gotrueId)` after token persists                        | `internal/login/login.go:283-296`             |
+  | `login`                                                       | `cli_login_completed`   | `analytics.alias(gotrueId, deviceId)` after token persists                                                         | `internal/login/login.go:283-296`             |
   | `link`                                                        | `cli_project_linked`    | `analytics.groupIdentify("organization", slug, …)` + `analytics.groupIdentify("project", ref, …)` after link write | `internal/link/link.go:60`                    |
   | `start`                                                       | `cli_stack_started`     | none — fired after stack health check passes                                                                       | `internal/start/start.go:1245`                |
   | `sso/{list,create,update,remove}`, `branches/{create,update}` | `cli_upgrade_suggested` | none — payload is `{feature_key, org_slug}`, fired inside billing-gate error branch                                | 7 call-sites under `internal/{sso,branches}/` |
@@ -402,6 +413,7 @@ Read https://www.effect.solutions/testing for Effect testing patterns. Note that
 - `*.unit.test.ts` belongs to the `unit` Vitest project and is the default for unit-style and other fast in-process tests.
 - `*.integration.test.ts` belongs to the `integration` project and is for in-process integration tests that exercise real handler or service behavior with layered dependency replacement.
 - `*.e2e.test.ts` belongs to the `e2e` Vitest project and is for black-box CLI subprocess tests.
+- `*.live.test.ts` belongs to the `live` Vitest project and is for black-box CLI subprocess tests that run against a **real, running Supabase platform or local Docker stack** — see "Live tests" below.
 
 ### Testing policy
 
@@ -416,6 +428,21 @@ Read https://www.effect.solutions/testing for Effect testing patterns. Note that
 - Keep `*.e2e.test.ts` focused on golden paths, CLI surface behavior, and subprocess correctness, not branch-by-branch coverage.
 - **Forbidden pattern (do not add):** spawning the CLI to assert that `--help` renders a flag. Help text is dynamic over flag wiring and is exercised by the integration test's flag parser. The two backups e2e files removed alongside this guidance update are the canonical example of what not to write.
 
+### Live tests (`*.live.test.ts`)
+
+Live tests are black-box CLI subprocess tests — like `*.e2e.test.ts`, but run against a **real backend** instead of local fakes/mocks: either the real Management API (a full [supabox](https://github.com/supabase/supabox) platform stack) or a real local Docker dev stack (`supabase start`'s actual containers). They are the highest-fidelity, most expensive tier — reserved for the small set of behaviors that only a genuinely running backend can prove (auth round-trips, real Docker label filtering, real container lifecycle), not for anything an integration test can already cover with mocks.
+
+- **Where they run:** authored in this repo, but executed by the [`supabase/cli-e2e-ci`](https://github.com/supabase/cli-e2e-ci) harness, which builds this CLI, brings up a full supabox stack (and has a real Docker daemon, since that's how supabox itself runs), and invokes the `live` Vitest project (`nx run-many -t test:live`). They never run as part of the default unit/integration/e2e loop, and locally they no-op unless the live environment is configured (see below) — there is no need to stand up supabox yourself to develop other code.
+- **Add one whenever you add or change a command whose correctness genuinely depends on a real backend** — a new Management API command, or a change to `start`/`stop`/`status`'s real Docker interaction. Colocate it with the command, same as `*.e2e.test.ts`: `src/legacy/commands/<command>/[<subcommand>/]<subcommand>.live.test.ts`.
+- **Gating:** every live suite must be wrapped in one of `tests/helpers/live.ts`'s `describe.skipIf` gates so the file is inert (skipped, not failed) outside the cli-e2e-ci runner:
+  - `describeLive` — runs whenever `SUPABASE_ACCESS_TOKEN` is set (the live env is configured at all). Reuse this even for commands that don't call the Management API themselves (e.g. `stop`/`status`) — it doubles as the "we're in the full cli-e2e-ci runner, which also has a real Docker daemon" signal, and there is no dedicated Docker-availability gate today.
+  - `describeLiveProject` — additionally requires a provisioned project (`SUPABASE_LIVE_PROJECT_REF`); use for project-scoped Management API commands (branches, functions, project-scoped db).
+  - `describeLiveDataPlane` — additionally requires the project's own Postgres instance to be `ACTIVE_HEALTHY`; use for commands that talk to the project's data plane (migration, db, storage).
+- **Invocation:** use `runSupabaseLive(args, options?)` (wraps `runSupabase` with the `legacy` entrypoint and the live profile/timeout defaults) rather than calling `runSupabase` directly, so every live test picks up the same environment plumbing.
+- **Local-dev-stack live tests** (`start`/`stop`/`status`, and anything else that manages real Docker containers rather than calling the Management API) follow the same file/gating convention but don't need `SUPABASE_PROFILE`/project-ref machinery. Pattern: `mkdtemp` a project dir, `runSupabaseLive(["init"], { cwd })` to generate a real Go-schema `config.toml`, `runSupabaseLive(["start", ...])` to bring up (a lightweight subset of) the real stack, exercise the command under test, then clean up in `afterEach` (best-effort `stop --no-backup` + `rm` the temp dir) so a failed assertion never leaks containers onto the CI runner. See `commands/stop/stop.live.test.ts` and `commands/status/status.live.test.ts` for the canonical example.
+- **Keep the suite small and golden-path only** — same philosophy as `*.e2e.test.ts`, but even more so given the cost of a real backend. One or two scenarios per command is normal; branch-by-branch coverage belongs in `*.integration.test.ts`.
+- Timeouts are generous by default (`testTimeout`/`hookTimeout: 300_000` for the whole `live` project) because real platform/Docker operations are slow — pass an explicit per-`test()` timeout when a scenario needs less (or, for a real local-stack `start`, close to the full budget).
+
 ---
 
 ## Go CLI Parity Tracking
diff --git a/apps/cli/docs/go-cli-porting-status.md b/apps/cli/docs/go-cli-porting-status.md
index 42d783057c..3eeb785c83 100644
--- a/apps/cli/docs/go-cli-porting-status.md
+++ b/apps/cli/docs/go-cli-porting-status.md
@@ -80,51 +80,51 @@ These commands exist in the TS CLI today but have no direct top-level equivalent
 
 ## Database
 
-| Old command                       | TS status | TS command path or `missing`                       | Missing flags/params | Extra TS flags/params | Notes                                                                                                                                                                                                                                                                                                                                                        |
-| --------------------------------- | --------- | -------------------------------------------------- | -------------------- | --------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
-| `db diff`                         | `ported`  | `legacy/commands/db/diff/`                         | `n/a`                | `n/a`                 | Native TS port. Native pg-delta / migra diff via edge-runtime against a Go-seam-provisioned live shadow (`db __shadow`); `--use-pgadmin` / `--use-pg-schema` delegate to the Go binary.                                                                                                                                                                      |
-| `db dump`                         | `ported`  | `legacy/commands/db/dump/`                         | `n/a`                | `n/a`                 | Native TS port. Streams `pg_dump`/`pg_dumpall` via a Docker container (`LegacyDockerRun`); schema/data/role modes, `--dry-run` script print, IPv4 transaction-pooler fallback.                                                                                                                                                                               |
-| `db lint`                         | `ported`  | `legacy/commands/db/lint/`                         | `n/a`                | `n/a`                 | Native TS port. Runs `plpgsql_check` in a rolled-back transaction via LegacyDbConnection; emits Go-parity pretty JSON.                                                                                                                                                                                                                                       |
-| `db pull`                         | `ported`  | `legacy/commands/db/pull/`                         | `n/a`                | `n/a`                 | Native TS port. Native pg-delta / migra migration + `--declarative` pg-delta export; reconciles `schema_migrations`. The initial-migra pull dumps the remote schema natively (`pg_dump`) then appends the migra diff. Only `--experimental` (structured dump) still delegates to Go, pending a TS PostgreSQL DDL parser for `format.WriteStructuredSchemas`. |
-| `db push`                         | `missing` | `missing`                                          | `n/a`                | `n/a`                 | No native TS implementation yet. Wrapped in legacy shell.                                                                                                                                                                                                                                                                                                    |
-| `db reset`                        | `missing` | `missing`                                          | `n/a`                | `n/a`                 | No native TS implementation yet. Wrapped in legacy shell.                                                                                                                                                                                                                                                                                                    |
-| `db start`                        | `missing` | `missing`                                          | `n/a`                | `n/a`                 | No native TS implementation yet. Wrapped in legacy shell.                                                                                                                                                                                                                                                                                                    |
-| `inspect report`                  | `ported`  | `legacy/commands/inspect/report/`                  | `n/a`                | `n/a`                 | Native TS port. Runs every inspect query via server-side `COPY ... CSV`, writes 14 CSVs under `<output-dir>/<date>/`, then renders a Go-parity Glamour rules summary (bounded csvq-subset evaluator; custom `[experimental.inspect.rules]` supported).                                                                                                       |
-| `inspect db db-stats`             | `ported`  | `legacy/commands/inspect/db/db-stats/`             | `n/a`                | `n/a`                 | Native TS port. Queries Postgres directly via LegacyDbConnection; renders Go-parity Glamour tables.                                                                                                                                                                                                                                                          |
-| `inspect db replication-slots`    | `ported`  | `legacy/commands/inspect/db/replication-slots/`    | `n/a`                | `n/a`                 | Native TS port. Queries Postgres directly via LegacyDbConnection; renders Go-parity Glamour tables.                                                                                                                                                                                                                                                          |
-| `inspect db locks`                | `ported`  | `legacy/commands/inspect/db/locks/`                | `n/a`                | `n/a`                 | Native TS port. Queries Postgres directly via LegacyDbConnection; renders Go-parity Glamour tables.                                                                                                                                                                                                                                                          |
-| `inspect db blocking`             | `ported`  | `legacy/commands/inspect/db/blocking/`             | `n/a`                | `n/a`                 | Native TS port. Queries Postgres directly via LegacyDbConnection; renders Go-parity Glamour tables.                                                                                                                                                                                                                                                          |
-| `inspect db outliers`             | `ported`  | `legacy/commands/inspect/db/outliers/`             | `n/a`                | `n/a`                 | Native TS port. Queries Postgres directly via LegacyDbConnection; renders Go-parity Glamour tables.                                                                                                                                                                                                                                                          |
-| `inspect db calls`                | `ported`  | `legacy/commands/inspect/db/calls/`                | `n/a`                | `n/a`                 | Native TS port. Queries Postgres directly via LegacyDbConnection; renders Go-parity Glamour tables.                                                                                                                                                                                                                                                          |
-| `inspect db index-stats`          | `ported`  | `legacy/commands/inspect/db/index-stats/`          | `n/a`                | `n/a`                 | Native TS port. Queries Postgres directly via LegacyDbConnection; renders Go-parity Glamour tables.                                                                                                                                                                                                                                                          |
-| `inspect db long-running-queries` | `ported`  | `legacy/commands/inspect/db/long-running-queries/` | `n/a`                | `n/a`                 | Native TS port. Queries Postgres directly via LegacyDbConnection; renders Go-parity Glamour tables.                                                                                                                                                                                                                                                          |
-| `inspect db bloat`                | `ported`  | `legacy/commands/inspect/db/bloat/`                | `n/a`                | `n/a`                 | Native TS port. Queries Postgres directly via LegacyDbConnection; renders Go-parity Glamour tables.                                                                                                                                                                                                                                                          |
-| `inspect db role-stats`           | `ported`  | `legacy/commands/inspect/db/role-stats/`           | `n/a`                | `n/a`                 | Native TS port. Queries Postgres directly via LegacyDbConnection; renders Go-parity Glamour tables.                                                                                                                                                                                                                                                          |
-| `inspect db vacuum-stats`         | `ported`  | `legacy/commands/inspect/db/vacuum-stats/`         | `n/a`                | `n/a`                 | Native TS port. Queries Postgres directly via LegacyDbConnection; renders Go-parity Glamour tables.                                                                                                                                                                                                                                                          |
-| `inspect db table-stats`          | `ported`  | `legacy/commands/inspect/db/table-stats/`          | `n/a`                | `n/a`                 | Native TS port. Queries Postgres directly via LegacyDbConnection; renders Go-parity Glamour tables.                                                                                                                                                                                                                                                          |
-| `inspect db traffic-profile`      | `ported`  | `legacy/commands/inspect/db/traffic-profile/`      | `n/a`                | `n/a`                 | Native TS port. Queries Postgres directly via LegacyDbConnection; renders Go-parity Glamour tables.                                                                                                                                                                                                                                                          |
-| `inspect db cache-hit`            | `ported`  | `legacy/commands/inspect/db/cache-hit/`            | `n/a`                | `n/a`                 | Native TS port. Deprecated (use db-stats); routes to the active query.                                                                                                                                                                                                                                                                                       |
-| `inspect db index-usage`          | `ported`  | `legacy/commands/inspect/db/index-usage/`          | `n/a`                | `n/a`                 | Native TS port. Deprecated (use index-stats); routes to the active query.                                                                                                                                                                                                                                                                                    |
-| `inspect db total-index-size`     | `ported`  | `legacy/commands/inspect/db/total-index-size/`     | `n/a`                | `n/a`                 | Native TS port. Deprecated (use index-stats); routes to the active query.                                                                                                                                                                                                                                                                                    |
-| `inspect db index-sizes`          | `ported`  | `legacy/commands/inspect/db/index-sizes/`          | `n/a`                | `n/a`                 | Native TS port. Deprecated (use index-stats); routes to the active query.                                                                                                                                                                                                                                                                                    |
-| `inspect db table-sizes`          | `ported`  | `legacy/commands/inspect/db/table-sizes/`          | `n/a`                | `n/a`                 | Native TS port. Deprecated (use table-stats); routes to the active query.                                                                                                                                                                                                                                                                                    |
-| `inspect db table-index-sizes`    | `ported`  | `legacy/commands/inspect/db/table-index-sizes/`    | `n/a`                | `n/a`                 | Native TS port. Deprecated (use table-stats); routes to the active query.                                                                                                                                                                                                                                                                                    |
-| `inspect db total-table-sizes`    | `ported`  | `legacy/commands/inspect/db/total-table-sizes/`    | `n/a`                | `n/a`                 | Native TS port. Deprecated (use table-stats); routes to the active query.                                                                                                                                                                                                                                                                                    |
-| `inspect db unused-indexes`       | `ported`  | `legacy/commands/inspect/db/unused-indexes/`       | `n/a`                | `n/a`                 | Native TS port. Deprecated (use index-stats); routes to the active query.                                                                                                                                                                                                                                                                                    |
-| `inspect db table-record-counts`  | `ported`  | `legacy/commands/inspect/db/table-record-counts/`  | `n/a`                | `n/a`                 | Native TS port. Deprecated (use table-stats); routes to the active query.                                                                                                                                                                                                                                                                                    |
-| `inspect db seq-scans`            | `ported`  | `legacy/commands/inspect/db/seq-scans/`            | `n/a`                | `n/a`                 | Native TS port. Deprecated (use index-stats); routes to the active query.                                                                                                                                                                                                                                                                                    |
-| `inspect db role-configs`         | `ported`  | `legacy/commands/inspect/db/role-configs/`         | `n/a`                | `n/a`                 | Native TS port. Deprecated (use role-stats); routes to the active query.                                                                                                                                                                                                                                                                                     |
-| `inspect db role-connections`     | `ported`  | `legacy/commands/inspect/db/role-connections/`     | `n/a`                | `n/a`                 | Native TS port. Deprecated (use role-stats); routes to the active query.                                                                                                                                                                                                                                                                                     |
-| `migration down`                  | `ported`  | `legacy/commands/migration/down/`                  | `n/a`                | `n/a`                 | Native TS port. Revert prompt → drop user schemas → vault upsert → migrate&seed to the target version; defaults to `--local`. Skips Go's pgcache catalog write.                                                                                                                                                                                              |
-| `migration fetch`                 | `ported`  | `legacy/commands/migration/fetch/`                 | `n/a`                | `n/a`                 | Native TS port. Reads `schema_migrations` and writes `supabase/migrations/<version>_<name>.sql`; overwrite prompt for a non-empty dir.                                                                                                                                                                                                                       |
-| `migration list`                  | `ported`  | `legacy/commands/migration/list/`                  | `n/a`                | `n/a`                 | Native TS port. Merges remote `schema_migrations` with local files into a Glamour ASCII table (Local / Remote / Time-UTC columns); defaults to `--linked`.                                                                                                                                                                                                   |
-| `migration new`                   | `ported`  | `legacy/commands/migration/new/`                   | `n/a`                | `n/a`                 | Native TS port. Writes `supabase/migrations/<timestamp>_<name>.sql` (mode 0644) from piped stdin; no DB/API.                                                                                                                                                                                                                                                 |
-| `migration repair`                | `ported`  | `legacy/commands/migration/repair/`                | `n/a`                | `n/a`                 | Native TS port. Transactional create-table + TRUNCATE/UPSERT/DELETE; applied mode reads local files; repair-all prompt; defaults to `--linked`.                                                                                                                                                                                                              |
-| `migration squash`                | `missing` | `missing`                                          | `n/a`                | `n/a`                 | No native TS implementation yet. Wrapped in legacy shell.                                                                                                                                                                                                                                                                                                    |
-| `migration up`                    | `ported`  | `legacy/commands/migration/up/`                    | `n/a`                | `n/a`                 | Native TS port. Computes pending migrations, upserts `[db.vault]`, applies each transactionally; `--include-all` for out-of-order; defaults to `--local`. Does not seed (matches Go).                                                                                                                                                                        |
-| `seed buckets`                    | `ported`  | `legacy/commands/seed/buckets/`                    | `n/a`                | `n/a`                 | Native TS port. Local-only (Go's `seed` defines no `--project-ref`, so the ref is always empty): seeds `[storage.buckets]` + `[storage.vector]` against the local Storage service gateway; remote/analytics paths are unreachable and omitted. `--linked`/`--local` accepted for surface parity (both seed local). Vector graceful-skip WARNINGs ported.     |
-| `test db`                         | `ported`  | `legacy/commands/test/db/`                         | `n/a`                | `n/a`                 | Native TS port. `--db-url`/`--local`/`--linked` + variadic paths; runs `supabase/pg_prove:3.36` via `docker run`; pgTAP enable/disable via `@effect/sql-pg`. `--network-id` override and `[images]` config override not modeled (documented divergences).                                                                                                    |
-| `test new`                        | `ported`  | `legacy/commands/test/new/`                        | `n/a`                | `n/a`                 | Native TS port. Writes `supabase/tests/<name>_test.sql` from the embedded pgtap template; `--template` (pgtap).                                                                                                                                                                                                                                              |
+| Old command                       | TS status | TS command path or `missing`                       | Missing flags/params | Extra TS flags/params | Notes                                                                                                                                                                                                                                                                                                                                                                                                                               |
+| --------------------------------- | --------- | -------------------------------------------------- | -------------------- | --------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `db diff`                         | `ported`  | `legacy/commands/db/diff/`                         | `n/a`                | `n/a`                 | Native TS port. Native pg-delta / migra diff via edge-runtime against a Go-seam-provisioned live shadow (`db __shadow`); `--use-pgadmin` / `--use-pg-schema` delegate to the Go binary.                                                                                                                                                                                                                                             |
+| `db dump`                         | `ported`  | `legacy/commands/db/dump/`                         | `n/a`                | `n/a`                 | Native TS port. Streams `pg_dump`/`pg_dumpall` via a Docker container (`LegacyDockerRun`); schema/data/role modes, `--dry-run` script print, IPv4 transaction-pooler fallback.                                                                                                                                                                                                                                                      |
+| `db lint`                         | `ported`  | `legacy/commands/db/lint/`                         | `n/a`                | `n/a`                 | Native TS port. Runs `plpgsql_check` in a rolled-back transaction via LegacyDbConnection; emits Go-parity pretty JSON.                                                                                                                                                                                                                                                                                                              |
+| `db pull`                         | `ported`  | `legacy/commands/db/pull/`                         | `n/a`                | `n/a`                 | Native TS port. Native pg-delta / migra migration + `--declarative` pg-delta export; reconciles `schema_migrations`. The initial-migra pull dumps the remote schema natively (`pg_dump`) then appends the migra diff. Only `--experimental` (structured dump) still delegates to Go, pending a TS PostgreSQL DDL parser for `format.WriteStructuredSchemas`.                                                                        |
+| `db push`                         | `ported`  | `legacy/commands/db/push/`                         | `n/a`                | `n/a`                 | Native TS port. Connects local/linked/`--db-url`; pushes pending migrations, `--include-seed` seeds (`seed_files` hash tracking), `--include-roles`, `[db.vault]` secrets including decrypted `encrypted:` values; `--dry-run`; best-effort pg-delta migrations-catalog cache (warning-only on failure).                                                                                                                            |
+| `db reset`                        | `ported`  | `legacy/commands/db/reset/`                        | `n/a`                | `n/a`                 | Remote path native (drop user schemas, vault upsert, MigrateAndSeed, `--version`/`--last`, `--sql-paths` seed override). Local path native: running check, recreate + migrate + seed via the hidden Go `db __db-bootstrap` seam, storage-gated bucket seeding (reuses `seed buckets`), git-branch `Finished…` line. Only the niche `--experimental` remote schema-files path still delegates to the Go binary (telemetry-disabled). |
+| `db start`                        | `ported`  | `legacy/commands/db/start/`                        | `n/a`                | `n/a`                 | Native TS port. Validates config, checks "already running" (prints Go's line), else delegates the container bootstrap (create + health + initial schema/roles/migrations/seed + `_current_branch`) to the hidden Go `db __db-bootstrap --mode start` seam. No status table / `cli_stack_started` (those are `supabase start`). `--from-backup` supported.                                                                           |
+| `inspect report`                  | `ported`  | `legacy/commands/inspect/report/`                  | `n/a`                | `n/a`                 | Native TS port. Runs every inspect query via server-side `COPY ... CSV`, writes 14 CSVs under `<output-dir>/<date>/`, then renders a Go-parity Glamour rules summary (bounded csvq-subset evaluator; custom `[experimental.inspect.rules]` supported).                                                                                                                                                                              |
+| `inspect db db-stats`             | `ported`  | `legacy/commands/inspect/db/db-stats/`             | `n/a`                | `n/a`                 | Native TS port. Queries Postgres directly via LegacyDbConnection; renders Go-parity Glamour tables.                                                                                                                                                                                                                                                                                                                                 |
+| `inspect db replication-slots`    | `ported`  | `legacy/commands/inspect/db/replication-slots/`    | `n/a`                | `n/a`                 | Native TS port. Queries Postgres directly via LegacyDbConnection; renders Go-parity Glamour tables.                                                                                                                                                                                                                                                                                                                                 |
+| `inspect db locks`                | `ported`  | `legacy/commands/inspect/db/locks/`                | `n/a`                | `n/a`                 | Native TS port. Queries Postgres directly via LegacyDbConnection; renders Go-parity Glamour tables.                                                                                                                                                                                                                                                                                                                                 |
+| `inspect db blocking`             | `ported`  | `legacy/commands/inspect/db/blocking/`             | `n/a`                | `n/a`                 | Native TS port. Queries Postgres directly via LegacyDbConnection; renders Go-parity Glamour tables.                                                                                                                                                                                                                                                                                                                                 |
+| `inspect db outliers`             | `ported`  | `legacy/commands/inspect/db/outliers/`             | `n/a`                | `n/a`                 | Native TS port. Queries Postgres directly via LegacyDbConnection; renders Go-parity Glamour tables.                                                                                                                                                                                                                                                                                                                                 |
+| `inspect db calls`                | `ported`  | `legacy/commands/inspect/db/calls/`                | `n/a`                | `n/a`                 | Native TS port. Queries Postgres directly via LegacyDbConnection; renders Go-parity Glamour tables.                                                                                                                                                                                                                                                                                                                                 |
+| `inspect db index-stats`          | `ported`  | `legacy/commands/inspect/db/index-stats/`          | `n/a`                | `n/a`                 | Native TS port. Queries Postgres directly via LegacyDbConnection; renders Go-parity Glamour tables.                                                                                                                                                                                                                                                                                                                                 |
+| `inspect db long-running-queries` | `ported`  | `legacy/commands/inspect/db/long-running-queries/` | `n/a`                | `n/a`                 | Native TS port. Queries Postgres directly via LegacyDbConnection; renders Go-parity Glamour tables.                                                                                                                                                                                                                                                                                                                                 |
+| `inspect db bloat`                | `ported`  | `legacy/commands/inspect/db/bloat/`                | `n/a`                | `n/a`                 | Native TS port. Queries Postgres directly via LegacyDbConnection; renders Go-parity Glamour tables.                                                                                                                                                                                                                                                                                                                                 |
+| `inspect db role-stats`           | `ported`  | `legacy/commands/inspect/db/role-stats/`           | `n/a`                | `n/a`                 | Native TS port. Queries Postgres directly via LegacyDbConnection; renders Go-parity Glamour tables.                                                                                                                                                                                                                                                                                                                                 |
+| `inspect db vacuum-stats`         | `ported`  | `legacy/commands/inspect/db/vacuum-stats/`         | `n/a`                | `n/a`                 | Native TS port. Queries Postgres directly via LegacyDbConnection; renders Go-parity Glamour tables.                                                                                                                                                                                                                                                                                                                                 |
+| `inspect db table-stats`          | `ported`  | `legacy/commands/inspect/db/table-stats/`          | `n/a`                | `n/a`                 | Native TS port. Queries Postgres directly via LegacyDbConnection; renders Go-parity Glamour tables.                                                                                                                                                                                                                                                                                                                                 |
+| `inspect db traffic-profile`      | `ported`  | `legacy/commands/inspect/db/traffic-profile/`      | `n/a`                | `n/a`                 | Native TS port. Queries Postgres directly via LegacyDbConnection; renders Go-parity Glamour tables.                                                                                                                                                                                                                                                                                                                                 |
+| `inspect db cache-hit`            | `ported`  | `legacy/commands/inspect/db/cache-hit/`            | `n/a`                | `n/a`                 | Native TS port. Deprecated (use db-stats); routes to the active query.                                                                                                                                                                                                                                                                                                                                                              |
+| `inspect db index-usage`          | `ported`  | `legacy/commands/inspect/db/index-usage/`          | `n/a`                | `n/a`                 | Native TS port. Deprecated (use index-stats); routes to the active query.                                                                                                                                                                                                                                                                                                                                                           |
+| `inspect db total-index-size`     | `ported`  | `legacy/commands/inspect/db/total-index-size/`     | `n/a`                | `n/a`                 | Native TS port. Deprecated (use index-stats); routes to the active query.                                                                                                                                                                                                                                                                                                                                                           |
+| `inspect db index-sizes`          | `ported`  | `legacy/commands/inspect/db/index-sizes/`          | `n/a`                | `n/a`                 | Native TS port. Deprecated (use index-stats); routes to the active query.                                                                                                                                                                                                                                                                                                                                                           |
+| `inspect db table-sizes`          | `ported`  | `legacy/commands/inspect/db/table-sizes/`          | `n/a`                | `n/a`                 | Native TS port. Deprecated (use table-stats); routes to the active query.                                                                                                                                                                                                                                                                                                                                                           |
+| `inspect db table-index-sizes`    | `ported`  | `legacy/commands/inspect/db/table-index-sizes/`    | `n/a`                | `n/a`                 | Native TS port. Deprecated (use table-stats); routes to the active query.                                                                                                                                                                                                                                                                                                                                                           |
+| `inspect db total-table-sizes`    | `ported`  | `legacy/commands/inspect/db/total-table-sizes/`    | `n/a`                | `n/a`                 | Native TS port. Deprecated (use table-stats); routes to the active query.                                                                                                                                                                                                                                                                                                                                                           |
+| `inspect db unused-indexes`       | `ported`  | `legacy/commands/inspect/db/unused-indexes/`       | `n/a`                | `n/a`                 | Native TS port. Deprecated (use index-stats); routes to the active query.                                                                                                                                                                                                                                                                                                                                                           |
+| `inspect db table-record-counts`  | `ported`  | `legacy/commands/inspect/db/table-record-counts/`  | `n/a`                | `n/a`                 | Native TS port. Deprecated (use table-stats); routes to the active query.                                                                                                                                                                                                                                                                                                                                                           |
+| `inspect db seq-scans`            | `ported`  | `legacy/commands/inspect/db/seq-scans/`            | `n/a`                | `n/a`                 | Native TS port. Deprecated (use index-stats); routes to the active query.                                                                                                                                                                                                                                                                                                                                                           |
+| `inspect db role-configs`         | `ported`  | `legacy/commands/inspect/db/role-configs/`         | `n/a`                | `n/a`                 | Native TS port. Deprecated (use role-stats); routes to the active query.                                                                                                                                                                                                                                                                                                                                                            |
+| `inspect db role-connections`     | `ported`  | `legacy/commands/inspect/db/role-connections/`     | `n/a`                | `n/a`                 | Native TS port. Deprecated (use role-stats); routes to the active query.                                                                                                                                                                                                                                                                                                                                                            |
+| `migration down`                  | `ported`  | `legacy/commands/migration/down/`                  | `n/a`                | `n/a`                 | Native TS port. Revert prompt → drop user schemas → vault upsert → migrate&seed to the target version; defaults to `--local`. Skips Go's pgcache catalog write.                                                                                                                                                                                                                                                                     |
+| `migration fetch`                 | `ported`  | `legacy/commands/migration/fetch/`                 | `n/a`                | `n/a`                 | Native TS port. Reads `schema_migrations` and writes `supabase/migrations/<version>_<name>.sql`; overwrite prompt for a non-empty dir.                                                                                                                                                                                                                                                                                              |
+| `migration list`                  | `ported`  | `legacy/commands/migration/list/`                  | `n/a`                | `n/a`                 | Native TS port. Merges remote `schema_migrations` with local files into a Glamour ASCII table (Local / Remote / Time-UTC columns); defaults to `--linked`.                                                                                                                                                                                                                                                                          |
+| `migration new`                   | `ported`  | `legacy/commands/migration/new/`                   | `n/a`                | `n/a`                 | Native TS port. Writes `supabase/migrations/<timestamp>_<name>.sql` (mode 0644) from piped stdin; no DB/API.                                                                                                                                                                                                                                                                                                                        |
+| `migration repair`                | `ported`  | `legacy/commands/migration/repair/`                | `n/a`                | `n/a`                 | Native TS port. Transactional create-table + TRUNCATE/UPSERT/DELETE; applied mode reads local files; repair-all prompt; defaults to `--linked`.                                                                                                                                                                                                                                                                                     |
+| `migration squash`                | `missing` | `missing`                                          | `n/a`                | `n/a`                 | No native TS implementation yet. Wrapped in legacy shell.                                                                                                                                                                                                                                                                                                                                                                           |
+| `migration up`                    | `ported`  | `legacy/commands/migration/up/`                    | `n/a`                | `n/a`                 | Native TS port. Computes pending migrations, upserts `[db.vault]`, applies each transactionally; `--include-all` for out-of-order; defaults to `--local`. Does not seed (matches Go).                                                                                                                                                                                                                                               |
+| `seed buckets`                    | `ported`  | `legacy/commands/seed/buckets/`                    | `n/a`                | `n/a`                 | Native TS port. Local-only (Go's `seed` defines no `--project-ref`, so the ref is always empty): seeds `[storage.buckets]` + `[storage.vector]` against the local Storage service gateway; remote/analytics paths are unreachable and omitted. `--linked`/`--local` accepted for surface parity (both seed local). Vector graceful-skip WARNINGs ported.                                                                            |
+| `test db`                         | `ported`  | `legacy/commands/test/db/`                         | `n/a`                | `n/a`                 | Native TS port. `--db-url`/`--local`/`--linked` + variadic paths; runs `supabase/pg_prove:3.36` via `docker run`; pgTAP enable/disable via `@effect/sql-pg`. `--network-id` override and `[images]` config override not modeled (documented divergences).                                                                                                                                                                           |
+| `test new`                        | `ported`  | `legacy/commands/test/new/`                        | `n/a`                | `n/a`                 | Native TS port. Writes `supabase/tests/<name>_test.sql` from the embedded pgtap template; `--template` (pgtap).                                                                                                                                                                                                                                                                                                                     |
 
 ## Code Generation
 
@@ -211,111 +211,111 @@ Legend:
 - `wrapped`: Phase 0 proxy wrapper exists in the legacy shell
 - `missing`: no legacy shell command yet
 
-| Command                                | Legacy status | Legacy command path                                                                                                                                                                                                                                                                                                                                                                                                               |
-| -------------------------------------- | ------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `orgs list`                            | `ported`      | [`../src/legacy/commands/orgs/list/list.command.ts`](../src/legacy/commands/orgs/list/list.command.ts)                                                                                                                                                                                                                                                                                                                            |
-| `orgs create`                          | `ported`      | [`../src/legacy/commands/orgs/create/create.command.ts`](../src/legacy/commands/orgs/create/create.command.ts)                                                                                                                                                                                                                                                                                                                    |
-| `projects list`                        | `ported`      | [`../src/legacy/commands/projects/list/list.command.ts`](../src/legacy/commands/projects/list/list.command.ts)                                                                                                                                                                                                                                                                                                                    |
-| `projects create`                      | `ported`      | [`../src/legacy/commands/projects/create/create.command.ts`](../src/legacy/commands/projects/create/create.command.ts)                                                                                                                                                                                                                                                                                                            |
-| `projects delete`                      | `ported`      | [`../src/legacy/commands/projects/delete/delete.command.ts`](../src/legacy/commands/projects/delete/delete.command.ts)                                                                                                                                                                                                                                                                                                            |
-| `projects api-keys`                    | `ported`      | [`../src/legacy/commands/projects/api-keys/api-keys.command.ts`](../src/legacy/commands/projects/api-keys/api-keys.command.ts)                                                                                                                                                                                                                                                                                                    |
-| `branches list`                        | `ported`      | [`../src/legacy/commands/branches/list/list.command.ts`](../src/legacy/commands/branches/list/list.command.ts)                                                                                                                                                                                                                                                                                                                    |
-| `branches create`                      | `ported`      | [`../src/legacy/commands/branches/create/create.command.ts`](../src/legacy/commands/branches/create/create.command.ts)                                                                                                                                                                                                                                                                                                            |
-| `branches get`                         | `ported`      | [`../src/legacy/commands/branches/get/get.command.ts`](../src/legacy/commands/branches/get/get.command.ts)                                                                                                                                                                                                                                                                                                                        |
-| `branches update`                      | `ported`      | [`../src/legacy/commands/branches/update/update.command.ts`](../src/legacy/commands/branches/update/update.command.ts)                                                                                                                                                                                                                                                                                                            |
-| `branches pause`                       | `ported`      | [`../src/legacy/commands/branches/pause/pause.command.ts`](../src/legacy/commands/branches/pause/pause.command.ts)                                                                                                                                                                                                                                                                                                                |
-| `branches unpause`                     | `ported`      | [`../src/legacy/commands/branches/unpause/unpause.command.ts`](../src/legacy/commands/branches/unpause/unpause.command.ts)                                                                                                                                                                                                                                                                                                        |
-| `branches delete`                      | `ported`      | [`../src/legacy/commands/branches/delete/delete.command.ts`](../src/legacy/commands/branches/delete/delete.command.ts)                                                                                                                                                                                                                                                                                                            |
-| `branches disable`                     | `ported`      | [`../src/legacy/commands/branches/disable/disable.command.ts`](../src/legacy/commands/branches/disable/disable.command.ts)                                                                                                                                                                                                                                                                                                        |
-| `secrets list`                         | `ported`      | [`../src/legacy/commands/secrets/list/list.command.ts`](../src/legacy/commands/secrets/list/list.command.ts)                                                                                                                                                                                                                                                                                                                      |
-| `secrets set`                          | `ported`      | [`../src/legacy/commands/secrets/set/set.command.ts`](../src/legacy/commands/secrets/set/set.command.ts)                                                                                                                                                                                                                                                                                                                          |
-| `secrets unset`                        | `ported`      | [`../src/legacy/commands/secrets/unset/unset.command.ts`](../src/legacy/commands/secrets/unset/unset.command.ts)                                                                                                                                                                                                                                                                                                                  |
-| `config push`                          | `ported`      | [`../src/legacy/commands/config/push/push.command.ts`](../src/legacy/commands/config/push/push.command.ts)                                                                                                                                                                                                                                                                                                                        |
-| `backups list`                         | `ported`      | [`../src/legacy/commands/backups/list/list.command.ts`](../src/legacy/commands/backups/list/list.command.ts)                                                                                                                                                                                                                                                                                                                      |
-| `backups restore`                      | `ported`      | [`../src/legacy/commands/backups/restore/restore.command.ts`](../src/legacy/commands/backups/restore/restore.command.ts)                                                                                                                                                                                                                                                                                                          |
-| `snippets list`                        | `ported`      | [`../src/legacy/commands/snippets/list/list.command.ts`](../src/legacy/commands/snippets/list/list.command.ts)                                                                                                                                                                                                                                                                                                                    |
-| `snippets download`                    | `ported`      | [`../src/legacy/commands/snippets/download/download.command.ts`](../src/legacy/commands/snippets/download/download.command.ts)                                                                                                                                                                                                                                                                                                    |
-| `sso list`                             | `ported`      | [`../src/legacy/commands/sso/list/list.command.ts`](../src/legacy/commands/sso/list/list.command.ts)                                                                                                                                                                                                                                                                                                                              |
-| `sso add`                              | `ported`      | [`../src/legacy/commands/sso/add/add.command.ts`](../src/legacy/commands/sso/add/add.command.ts)                                                                                                                                                                                                                                                                                                                                  |
-| `sso remove`                           | `ported`      | [`../src/legacy/commands/sso/remove/remove.command.ts`](../src/legacy/commands/sso/remove/remove.command.ts)                                                                                                                                                                                                                                                                                                                      |
-| `sso update`                           | `ported`      | [`../src/legacy/commands/sso/update/update.command.ts`](../src/legacy/commands/sso/update/update.command.ts)                                                                                                                                                                                                                                                                                                                      |
-| `sso show`                             | `ported`      | [`../src/legacy/commands/sso/show/show.command.ts`](../src/legacy/commands/sso/show/show.command.ts)                                                                                                                                                                                                                                                                                                                              |
-| `sso info`                             | `ported`      | [`../src/legacy/commands/sso/info/info.command.ts`](../src/legacy/commands/sso/info/info.command.ts)                                                                                                                                                                                                                                                                                                                              |
-| `domains create`                       | `ported`      | [`../src/legacy/commands/domains/create/create.command.ts`](../src/legacy/commands/domains/create/create.command.ts)                                                                                                                                                                                                                                                                                                              |
-| `domains get`                          | `ported`      | [`../src/legacy/commands/domains/get/get.command.ts`](../src/legacy/commands/domains/get/get.command.ts)                                                                                                                                                                                                                                                                                                                          |
-| `domains reverify`                     | `ported`      | [`../src/legacy/commands/domains/reverify/reverify.command.ts`](../src/legacy/commands/domains/reverify/reverify.command.ts)                                                                                                                                                                                                                                                                                                      |
-| `domains activate`                     | `ported`      | [`../src/legacy/commands/domains/activate/activate.command.ts`](../src/legacy/commands/domains/activate/activate.command.ts)                                                                                                                                                                                                                                                                                                      |
-| `domains delete`                       | `ported`      | [`../src/legacy/commands/domains/delete/delete.command.ts`](../src/legacy/commands/domains/delete/delete.command.ts)                                                                                                                                                                                                                                                                                                              |
-| `vanity-subdomains get`                | `ported`      | [`../src/legacy/commands/vanity-subdomains/get/get.command.ts`](../src/legacy/commands/vanity-subdomains/get/get.command.ts)                                                                                                                                                                                                                                                                                                      |
-| `vanity-subdomains check-availability` | `ported`      | [`../src/legacy/commands/vanity-subdomains/check-availability/check-availability.command.ts`](../src/legacy/commands/vanity-subdomains/check-availability/check-availability.command.ts)                                                                                                                                                                                                                                          |
-| `vanity-subdomains activate`           | `ported`      | [`../src/legacy/commands/vanity-subdomains/activate/activate.command.ts`](../src/legacy/commands/vanity-subdomains/activate/activate.command.ts)                                                                                                                                                                                                                                                                                  |
-| `vanity-subdomains delete`             | `ported`      | [`../src/legacy/commands/vanity-subdomains/delete/delete.command.ts`](../src/legacy/commands/vanity-subdomains/delete/delete.command.ts)                                                                                                                                                                                                                                                                                          |
-| `network-bans get`                     | `ported`      | [`../src/legacy/commands/network-bans/get/get.command.ts`](../src/legacy/commands/network-bans/get/get.command.ts)                                                                                                                                                                                                                                                                                                                |
-| `network-bans remove`                  | `ported`      | [`../src/legacy/commands/network-bans/remove/remove.command.ts`](../src/legacy/commands/network-bans/remove/remove.command.ts)                                                                                                                                                                                                                                                                                                    |
-| `network-restrictions get`             | `ported`      | [`../src/legacy/commands/network-restrictions/get/get.command.ts`](../src/legacy/commands/network-restrictions/get/get.command.ts)                                                                                                                                                                                                                                                                                                |
-| `network-restrictions update`          | `ported`      | [`../src/legacy/commands/network-restrictions/update/update.command.ts`](../src/legacy/commands/network-restrictions/update/update.command.ts)                                                                                                                                                                                                                                                                                    |
-| `encryption get-root-key`              | `ported`      | [`../src/legacy/commands/encryption/get-root-key/get-root-key.command.ts`](../src/legacy/commands/encryption/get-root-key/get-root-key.command.ts)                                                                                                                                                                                                                                                                                |
-| `encryption update-root-key`           | `ported`      | [`../src/legacy/commands/encryption/update-root-key/update-root-key.command.ts`](../src/legacy/commands/encryption/update-root-key/update-root-key.command.ts)                                                                                                                                                                                                                                                                    |
-| `ssl-enforcement get`                  | `ported`      | [`../src/legacy/commands/ssl-enforcement/get/get.command.ts`](../src/legacy/commands/ssl-enforcement/get/get.command.ts)                                                                                                                                                                                                                                                                                                          |
-| `ssl-enforcement update`               | `ported`      | [`../src/legacy/commands/ssl-enforcement/update/update.command.ts`](../src/legacy/commands/ssl-enforcement/update/update.command.ts)                                                                                                                                                                                                                                                                                              |
-| `postgres-config get`                  | `ported`      | [`../src/legacy/commands/postgres-config/get/get.command.ts`](../src/legacy/commands/postgres-config/get/get.command.ts)                                                                                                                                                                                                                                                                                                          |
-| `postgres-config update`               | `ported`      | [`../src/legacy/commands/postgres-config/update/update.command.ts`](../src/legacy/commands/postgres-config/update/update.command.ts)                                                                                                                                                                                                                                                                                              |
-| `postgres-config delete`               | `ported`      | [`../src/legacy/commands/postgres-config/delete/delete.command.ts`](../src/legacy/commands/postgres-config/delete/delete.command.ts)                                                                                                                                                                                                                                                                                              |
-| `login`                                | `ported`      | [`../src/legacy/commands/login/login.command.ts`](../src/legacy/commands/login/login.command.ts)                                                                                                                                                                                                                                                                                                                                  |
-| `logout`                               | `ported`      | [`../src/legacy/commands/logout/logout.command.ts`](../src/legacy/commands/logout/logout.command.ts)                                                                                                                                                                                                                                                                                                                              |
-| `link`                                 | `ported`      | [`../src/legacy/commands/link/link.command.ts`](../src/legacy/commands/link/link.command.ts)                                                                                                                                                                                                                                                                                                                                      |
-| `unlink`                               | `ported`      | [`../src/legacy/commands/unlink/unlink.command.ts`](../src/legacy/commands/unlink/unlink.command.ts)                                                                                                                                                                                                                                                                                                                              |
-| `bootstrap`                            | `ported`      | [`../src/legacy/commands/bootstrap/bootstrap.command.ts`](../src/legacy/commands/bootstrap/bootstrap.command.ts) (native; `db push` step delegated to the Go binary — interim)                                                                                                                                                                                                                                                    |
-| `init`                                 | `ported`      | [`../src/legacy/commands/init/init.command.ts`](../src/legacy/commands/init/init.command.ts)                                                                                                                                                                                                                                                                                                                                      |
-| `services`                             | `ported`      | [`../src/legacy/commands/services/services.command.ts`](../src/legacy/commands/services/services.command.ts)                                                                                                                                                                                                                                                                                                                      |
-| `start`                                | `wrapped`     | [`../src/legacy/commands/start/start.command.ts`](../src/legacy/commands/start/start.command.ts)                                                                                                                                                                                                                                                                                                                                  |
-| `stop`                                 | `wrapped`     | [`../src/legacy/commands/stop/stop.command.ts`](../src/legacy/commands/stop/stop.command.ts)                                                                                                                                                                                                                                                                                                                                      |
-| `status`                               | `wrapped`     | [`../src/legacy/commands/status/status.command.ts`](../src/legacy/commands/status/status.command.ts)                                                                                                                                                                                                                                                                                                                              |
-| `telemetry enable`                     | `ported`      | [`../src/legacy/commands/telemetry/enable/enable.command.ts`](../src/legacy/commands/telemetry/enable/enable.command.ts)                                                                                                                                                                                                                                                                                                          |
-| `telemetry disable`                    | `ported`      | [`../src/legacy/commands/telemetry/disable/disable.command.ts`](../src/legacy/commands/telemetry/disable/disable.command.ts)                                                                                                                                                                                                                                                                                                      |
-| `telemetry status`                     | `ported`      | [`../src/legacy/commands/telemetry/status/status.command.ts`](../src/legacy/commands/telemetry/status/status.command.ts)                                                                                                                                                                                                                                                                                                          |
-| `migration list`                       | `ported`      | [`../src/legacy/commands/migration/list/list.command.ts`](../src/legacy/commands/migration/list/list.command.ts) — native; merged Local/Remote/Time-UTC Glamour table                                                                                                                                                                                                                                                             |
-| `migration new`                        | `ported`      | [`../src/legacy/commands/migration/new/new.command.ts`](../src/legacy/commands/migration/new/new.command.ts) — native; writes `supabase/migrations/<timestamp>_<name>.sql` from piped stdin                                                                                                                                                                                                                                       |
-| `migration repair`                     | `ported`      | [`../src/legacy/commands/migration/repair/repair.command.ts`](../src/legacy/commands/migration/repair/repair.command.ts) — native; transactional TRUNCATE/UPSERT/DELETE, repair-all prompt                                                                                                                                                                                                                                        |
-| `migration squash`                     | `wrapped`     | [`../src/legacy/commands/migration/squash/squash.command.ts`](../src/legacy/commands/migration/squash/squash.command.ts)                                                                                                                                                                                                                                                                                                          |
-| `migration up`                         | `ported`      | [`../src/legacy/commands/migration/up/up.command.ts`](../src/legacy/commands/migration/up/up.command.ts) — native; pending compute + vault upsert + per-file apply                                                                                                                                                                                                                                                                |
-| `migration down`                       | `ported`      | [`../src/legacy/commands/migration/down/down.command.ts`](../src/legacy/commands/migration/down/down.command.ts) — native; drop + vault + migrate&seed to target version                                                                                                                                                                                                                                                          |
-| `migration fetch`                      | `ported`      | [`../src/legacy/commands/migration/fetch/fetch.command.ts`](../src/legacy/commands/migration/fetch/fetch.command.ts) — native; writes history rows to `supabase/migrations/`                                                                                                                                                                                                                                                      |
-| `gen types`                            | `ported`      | [`../src/legacy/commands/gen/types/types.command.ts`](../src/legacy/commands/gen/types/types.command.ts) - native; non-TypeScript project refs use pg-meta with IPv4 pooler retry instead of Go's "Try using --db-url" failure; `--swift-access-control` requires `--lang swift`; explicit source flags with `--query-timeout` on the remote TypeScript path error, while the implicit linked TypeScript path warns and continues |
-| `gen signing-key`                      | `ported`      | [`../src/legacy/commands/gen/signing-key/signing-key.command.ts`](../src/legacy/commands/gen/signing-key/signing-key.command.ts)                                                                                                                                                                                                                                                                                                  |
-| `gen bearer-jwt`                       | `wrapped`     | [`../src/legacy/commands/gen/bearer-jwt/bearer-jwt.command.ts`](../src/legacy/commands/gen/bearer-jwt/bearer-jwt.command.ts)                                                                                                                                                                                                                                                                                                      |
-| `gen keys`                             | `wrapped`     | [`../src/legacy/commands/gen/keys/keys.command.ts`](../src/legacy/commands/gen/keys/keys.command.ts)                                                                                                                                                                                                                                                                                                                              |
-| `functions list`                       | `wrapped`     | [`../src/legacy/commands/functions/list/list.command.ts`](../src/legacy/commands/functions/list/list.command.ts)                                                                                                                                                                                                                                                                                                                  |
-| `functions delete`                     | `ported`      | [`../src/legacy/commands/functions/delete/delete.command.ts`](../src/legacy/commands/functions/delete/delete.command.ts)                                                                                                                                                                                                                                                                                                          |
-| `functions download`                   | `ported`      | [`../src/legacy/commands/functions/download/download.command.ts`](../src/legacy/commands/functions/download/download.command.ts)                                                                                                                                                                                                                                                                                                  |
-| `functions deploy`                     | `ported`      | [`../src/legacy/commands/functions/deploy/deploy.command.ts`](../src/legacy/commands/functions/deploy/deploy.command.ts)                                                                                                                                                                                                                                                                                                          |
-| `functions new`                        | `ported`      | [`../src/legacy/commands/functions/new/new.command.ts`](../src/legacy/commands/functions/new/new.command.ts)                                                                                                                                                                                                                                                                                                                      |
-| `functions serve`                      | `ported`      | [`../src/legacy/commands/functions/serve/serve.command.ts`](../src/legacy/commands/functions/serve/serve.command.ts)                                                                                                                                                                                                                                                                                                              |
-| `storage ls`                           | `ported`      | [`../src/legacy/commands/storage/ls/ls.command.ts`](../src/legacy/commands/storage/ls/ls.command.ts)                                                                                                                                                                                                                                                                                                                              |
-| `storage cp`                           | `ported`      | [`../src/legacy/commands/storage/cp/cp.command.ts`](../src/legacy/commands/storage/cp/cp.command.ts)                                                                                                                                                                                                                                                                                                                              |
-| `storage mv`                           | `ported`      | [`../src/legacy/commands/storage/mv/mv.command.ts`](../src/legacy/commands/storage/mv/mv.command.ts)                                                                                                                                                                                                                                                                                                                              |
-| `storage rm`                           | `ported`      | [`../src/legacy/commands/storage/rm/rm.command.ts`](../src/legacy/commands/storage/rm/rm.command.ts)                                                                                                                                                                                                                                                                                                                              |
-| `test db`                              | `ported`      | [`../src/legacy/commands/test/db/db.command.ts`](../src/legacy/commands/test/db/db.command.ts)                                                                                                                                                                                                                                                                                                                                    |
-| `test new`                             | `ported`      | [`../src/legacy/commands/test/new/new.command.ts`](../src/legacy/commands/test/new/new.command.ts)                                                                                                                                                                                                                                                                                                                                |
-| `seed buckets`                         | `ported`      | [`../src/legacy/commands/seed/buckets/buckets.command.ts`](../src/legacy/commands/seed/buckets/buckets.command.ts)                                                                                                                                                                                                                                                                                                                |
-| `db diff`                              | `ported`      | [`../src/legacy/commands/db/diff/diff.command.ts`](../src/legacy/commands/db/diff/diff.command.ts) — native pg-delta / migra; `--use-pgadmin` / `--use-pg-schema` delegate to Go                                                                                                                                                                                                                                                  |
-| `db dump`                              | `ported`      | [`../src/legacy/commands/db/dump/dump.command.ts`](../src/legacy/commands/db/dump/dump.command.ts)                                                                                                                                                                                                                                                                                                                                |
-| `db push`                              | `wrapped`     | [`../src/legacy/commands/db/push/push.command.ts`](../src/legacy/commands/db/push/push.command.ts)                                                                                                                                                                                                                                                                                                                                |
-| `db pull`                              | `ported`      | [`../src/legacy/commands/db/pull/pull.command.ts`](../src/legacy/commands/db/pull/pull.command.ts) — native pg-delta / migra; `--declarative` (deprecated alias `--use-pg-delta`) + `--diff-engine` (migra\|pg-delta); initial-migra pull dumps the schema natively (`pg_dump`) + appends the diff; only `--experimental` structured dump still delegates to Go (needs a TS DDL parser for `WriteStructuredSchemas`)              |
-| `db reset`                             | `wrapped`     | [`../src/legacy/commands/db/reset/reset.command.ts`](../src/legacy/commands/db/reset/reset.command.ts) — includes Go-parity `--sql-paths` override for `[db.seed].sql_paths`                                                                                                                                                                                                                                                      |
-| `db lint`                              | `ported`      | [`../src/legacy/commands/db/lint/lint.command.ts`](../src/legacy/commands/db/lint/lint.command.ts)                                                                                                                                                                                                                                                                                                                                |
-| `db start`                             | `wrapped`     | [`../src/legacy/commands/db/start/start.command.ts`](../src/legacy/commands/db/start/start.command.ts)                                                                                                                                                                                                                                                                                                                            |
-| `db query`                             | `ported`      | [`../src/legacy/commands/db/query/query.command.ts`](../src/legacy/commands/db/query/query.command.ts)                                                                                                                                                                                                                                                                                                                            |
-| `db advisors`                          | `ported`      | [`../src/legacy/commands/db/advisors/advisors.command.ts`](../src/legacy/commands/db/advisors/advisors.command.ts)                                                                                                                                                                                                                                                                                                                |
-| `db test`                              | `wrapped`     | [`../src/legacy/commands/db/test/test.command.ts`](../src/legacy/commands/db/test/test.command.ts)                                                                                                                                                                                                                                                                                                                                |
-| `db branch create`                     | `wrapped`     | [`../src/legacy/commands/db/branch/create/create.command.ts`](../src/legacy/commands/db/branch/create/create.command.ts)                                                                                                                                                                                                                                                                                                          |
-| `db branch delete`                     | `wrapped`     | [`../src/legacy/commands/db/branch/delete/delete.command.ts`](../src/legacy/commands/db/branch/delete/delete.command.ts)                                                                                                                                                                                                                                                                                                          |
-| `db branch list`                       | `wrapped`     | [`../src/legacy/commands/db/branch/list/list.command.ts`](../src/legacy/commands/db/branch/list/list.command.ts)                                                                                                                                                                                                                                                                                                                  |
-| `db branch switch`                     | `wrapped`     | [`../src/legacy/commands/db/branch/switch/switch.command.ts`](../src/legacy/commands/db/branch/switch/switch.command.ts)                                                                                                                                                                                                                                                                                                          |
-| `db remote changes`                    | `wrapped`     | [`../src/legacy/commands/db/remote/changes/changes.command.ts`](../src/legacy/commands/db/remote/changes/changes.command.ts)                                                                                                                                                                                                                                                                                                      |
-| `db remote commit`                     | `wrapped`     | [`../src/legacy/commands/db/remote/commit/commit.command.ts`](../src/legacy/commands/db/remote/commit/commit.command.ts)                                                                                                                                                                                                                                                                                                          |
-| `db schema declarative sync`           | `ported`      | [`../src/legacy/commands/db/schema/declarative/sync/sync.command.ts`](../src/legacy/commands/db/schema/declarative/sync/sync.command.ts)                                                                                                                                                                                                                                                                                          |
-| `db schema declarative generate`       | `ported`      | [`../src/legacy/commands/db/schema/declarative/generate/generate.command.ts`](../src/legacy/commands/db/schema/declarative/generate/generate.command.ts)                                                                                                                                                                                                                                                                          |
+| Command                                | Legacy status | Legacy command path                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           |
+| -------------------------------------- | ------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `orgs list`                            | `ported`      | [`../src/legacy/commands/orgs/list/list.command.ts`](../src/legacy/commands/orgs/list/list.command.ts)                                                                                                                                                                                                                                                                                                                                                                                                                                        |
+| `orgs create`                          | `ported`      | [`../src/legacy/commands/orgs/create/create.command.ts`](../src/legacy/commands/orgs/create/create.command.ts)                                                                                                                                                                                                                                                                                                                                                                                                                                |
+| `projects list`                        | `ported`      | [`../src/legacy/commands/projects/list/list.command.ts`](../src/legacy/commands/projects/list/list.command.ts)                                                                                                                                                                                                                                                                                                                                                                                                                                |
+| `projects create`                      | `ported`      | [`../src/legacy/commands/projects/create/create.command.ts`](../src/legacy/commands/projects/create/create.command.ts)                                                                                                                                                                                                                                                                                                                                                                                                                        |
+| `projects delete`                      | `ported`      | [`../src/legacy/commands/projects/delete/delete.command.ts`](../src/legacy/commands/projects/delete/delete.command.ts)                                                                                                                                                                                                                                                                                                                                                                                                                        |
+| `projects api-keys`                    | `ported`      | [`../src/legacy/commands/projects/api-keys/api-keys.command.ts`](../src/legacy/commands/projects/api-keys/api-keys.command.ts)                                                                                                                                                                                                                                                                                                                                                                                                                |
+| `branches list`                        | `ported`      | [`../src/legacy/commands/branches/list/list.command.ts`](../src/legacy/commands/branches/list/list.command.ts)                                                                                                                                                                                                                                                                                                                                                                                                                                |
+| `branches create`                      | `ported`      | [`../src/legacy/commands/branches/create/create.command.ts`](../src/legacy/commands/branches/create/create.command.ts)                                                                                                                                                                                                                                                                                                                                                                                                                        |
+| `branches get`                         | `ported`      | [`../src/legacy/commands/branches/get/get.command.ts`](../src/legacy/commands/branches/get/get.command.ts)                                                                                                                                                                                                                                                                                                                                                                                                                                    |
+| `branches update`                      | `ported`      | [`../src/legacy/commands/branches/update/update.command.ts`](../src/legacy/commands/branches/update/update.command.ts)                                                                                                                                                                                                                                                                                                                                                                                                                        |
+| `branches pause`                       | `ported`      | [`../src/legacy/commands/branches/pause/pause.command.ts`](../src/legacy/commands/branches/pause/pause.command.ts)                                                                                                                                                                                                                                                                                                                                                                                                                            |
+| `branches unpause`                     | `ported`      | [`../src/legacy/commands/branches/unpause/unpause.command.ts`](../src/legacy/commands/branches/unpause/unpause.command.ts)                                                                                                                                                                                                                                                                                                                                                                                                                    |
+| `branches delete`                      | `ported`      | [`../src/legacy/commands/branches/delete/delete.command.ts`](../src/legacy/commands/branches/delete/delete.command.ts)                                                                                                                                                                                                                                                                                                                                                                                                                        |
+| `branches disable`                     | `ported`      | [`../src/legacy/commands/branches/disable/disable.command.ts`](../src/legacy/commands/branches/disable/disable.command.ts)                                                                                                                                                                                                                                                                                                                                                                                                                    |
+| `secrets list`                         | `ported`      | [`../src/legacy/commands/secrets/list/list.command.ts`](../src/legacy/commands/secrets/list/list.command.ts)                                                                                                                                                                                                                                                                                                                                                                                                                                  |
+| `secrets set`                          | `ported`      | [`../src/legacy/commands/secrets/set/set.command.ts`](../src/legacy/commands/secrets/set/set.command.ts)                                                                                                                                                                                                                                                                                                                                                                                                                                      |
+| `secrets unset`                        | `ported`      | [`../src/legacy/commands/secrets/unset/unset.command.ts`](../src/legacy/commands/secrets/unset/unset.command.ts)                                                                                                                                                                                                                                                                                                                                                                                                                              |
+| `config push`                          | `ported`      | [`../src/legacy/commands/config/push/push.command.ts`](../src/legacy/commands/config/push/push.command.ts)                                                                                                                                                                                                                                                                                                                                                                                                                                    |
+| `backups list`                         | `ported`      | [`../src/legacy/commands/backups/list/list.command.ts`](../src/legacy/commands/backups/list/list.command.ts)                                                                                                                                                                                                                                                                                                                                                                                                                                  |
+| `backups restore`                      | `ported`      | [`../src/legacy/commands/backups/restore/restore.command.ts`](../src/legacy/commands/backups/restore/restore.command.ts)                                                                                                                                                                                                                                                                                                                                                                                                                      |
+| `snippets list`                        | `ported`      | [`../src/legacy/commands/snippets/list/list.command.ts`](../src/legacy/commands/snippets/list/list.command.ts)                                                                                                                                                                                                                                                                                                                                                                                                                                |
+| `snippets download`                    | `ported`      | [`../src/legacy/commands/snippets/download/download.command.ts`](../src/legacy/commands/snippets/download/download.command.ts)                                                                                                                                                                                                                                                                                                                                                                                                                |
+| `sso list`                             | `ported`      | [`../src/legacy/commands/sso/list/list.command.ts`](../src/legacy/commands/sso/list/list.command.ts)                                                                                                                                                                                                                                                                                                                                                                                                                                          |
+| `sso add`                              | `ported`      | [`../src/legacy/commands/sso/add/add.command.ts`](../src/legacy/commands/sso/add/add.command.ts)                                                                                                                                                                                                                                                                                                                                                                                                                                              |
+| `sso remove`                           | `ported`      | [`../src/legacy/commands/sso/remove/remove.command.ts`](../src/legacy/commands/sso/remove/remove.command.ts)                                                                                                                                                                                                                                                                                                                                                                                                                                  |
+| `sso update`                           | `ported`      | [`../src/legacy/commands/sso/update/update.command.ts`](../src/legacy/commands/sso/update/update.command.ts)                                                                                                                                                                                                                                                                                                                                                                                                                                  |
+| `sso show`                             | `ported`      | [`../src/legacy/commands/sso/show/show.command.ts`](../src/legacy/commands/sso/show/show.command.ts)                                                                                                                                                                                                                                                                                                                                                                                                                                          |
+| `sso info`                             | `ported`      | [`../src/legacy/commands/sso/info/info.command.ts`](../src/legacy/commands/sso/info/info.command.ts)                                                                                                                                                                                                                                                                                                                                                                                                                                          |
+| `domains create`                       | `ported`      | [`../src/legacy/commands/domains/create/create.command.ts`](../src/legacy/commands/domains/create/create.command.ts)                                                                                                                                                                                                                                                                                                                                                                                                                          |
+| `domains get`                          | `ported`      | [`../src/legacy/commands/domains/get/get.command.ts`](../src/legacy/commands/domains/get/get.command.ts)                                                                                                                                                                                                                                                                                                                                                                                                                                      |
+| `domains reverify`                     | `ported`      | [`../src/legacy/commands/domains/reverify/reverify.command.ts`](../src/legacy/commands/domains/reverify/reverify.command.ts)                                                                                                                                                                                                                                                                                                                                                                                                                  |
+| `domains activate`                     | `ported`      | [`../src/legacy/commands/domains/activate/activate.command.ts`](../src/legacy/commands/domains/activate/activate.command.ts)                                                                                                                                                                                                                                                                                                                                                                                                                  |
+| `domains delete`                       | `ported`      | [`../src/legacy/commands/domains/delete/delete.command.ts`](../src/legacy/commands/domains/delete/delete.command.ts)                                                                                                                                                                                                                                                                                                                                                                                                                          |
+| `vanity-subdomains get`                | `ported`      | [`../src/legacy/commands/vanity-subdomains/get/get.command.ts`](../src/legacy/commands/vanity-subdomains/get/get.command.ts)                                                                                                                                                                                                                                                                                                                                                                                                                  |
+| `vanity-subdomains check-availability` | `ported`      | [`../src/legacy/commands/vanity-subdomains/check-availability/check-availability.command.ts`](../src/legacy/commands/vanity-subdomains/check-availability/check-availability.command.ts)                                                                                                                                                                                                                                                                                                                                                      |
+| `vanity-subdomains activate`           | `ported`      | [`../src/legacy/commands/vanity-subdomains/activate/activate.command.ts`](../src/legacy/commands/vanity-subdomains/activate/activate.command.ts)                                                                                                                                                                                                                                                                                                                                                                                              |
+| `vanity-subdomains delete`             | `ported`      | [`../src/legacy/commands/vanity-subdomains/delete/delete.command.ts`](../src/legacy/commands/vanity-subdomains/delete/delete.command.ts)                                                                                                                                                                                                                                                                                                                                                                                                      |
+| `network-bans get`                     | `ported`      | [`../src/legacy/commands/network-bans/get/get.command.ts`](../src/legacy/commands/network-bans/get/get.command.ts)                                                                                                                                                                                                                                                                                                                                                                                                                            |
+| `network-bans remove`                  | `ported`      | [`../src/legacy/commands/network-bans/remove/remove.command.ts`](../src/legacy/commands/network-bans/remove/remove.command.ts)                                                                                                                                                                                                                                                                                                                                                                                                                |
+| `network-restrictions get`             | `ported`      | [`../src/legacy/commands/network-restrictions/get/get.command.ts`](../src/legacy/commands/network-restrictions/get/get.command.ts)                                                                                                                                                                                                                                                                                                                                                                                                            |
+| `network-restrictions update`          | `ported`      | [`../src/legacy/commands/network-restrictions/update/update.command.ts`](../src/legacy/commands/network-restrictions/update/update.command.ts)                                                                                                                                                                                                                                                                                                                                                                                                |
+| `encryption get-root-key`              | `ported`      | [`../src/legacy/commands/encryption/get-root-key/get-root-key.command.ts`](../src/legacy/commands/encryption/get-root-key/get-root-key.command.ts)                                                                                                                                                                                                                                                                                                                                                                                            |
+| `encryption update-root-key`           | `ported`      | [`../src/legacy/commands/encryption/update-root-key/update-root-key.command.ts`](../src/legacy/commands/encryption/update-root-key/update-root-key.command.ts)                                                                                                                                                                                                                                                                                                                                                                                |
+| `ssl-enforcement get`                  | `ported`      | [`../src/legacy/commands/ssl-enforcement/get/get.command.ts`](../src/legacy/commands/ssl-enforcement/get/get.command.ts)                                                                                                                                                                                                                                                                                                                                                                                                                      |
+| `ssl-enforcement update`               | `ported`      | [`../src/legacy/commands/ssl-enforcement/update/update.command.ts`](../src/legacy/commands/ssl-enforcement/update/update.command.ts)                                                                                                                                                                                                                                                                                                                                                                                                          |
+| `postgres-config get`                  | `ported`      | [`../src/legacy/commands/postgres-config/get/get.command.ts`](../src/legacy/commands/postgres-config/get/get.command.ts)                                                                                                                                                                                                                                                                                                                                                                                                                      |
+| `postgres-config update`               | `ported`      | [`../src/legacy/commands/postgres-config/update/update.command.ts`](../src/legacy/commands/postgres-config/update/update.command.ts)                                                                                                                                                                                                                                                                                                                                                                                                          |
+| `postgres-config delete`               | `ported`      | [`../src/legacy/commands/postgres-config/delete/delete.command.ts`](../src/legacy/commands/postgres-config/delete/delete.command.ts)                                                                                                                                                                                                                                                                                                                                                                                                          |
+| `login`                                | `ported`      | [`../src/legacy/commands/login/login.command.ts`](../src/legacy/commands/login/login.command.ts)                                                                                                                                                                                                                                                                                                                                                                                                                                              |
+| `logout`                               | `ported`      | [`../src/legacy/commands/logout/logout.command.ts`](../src/legacy/commands/logout/logout.command.ts)                                                                                                                                                                                                                                                                                                                                                                                                                                          |
+| `link`                                 | `ported`      | [`../src/legacy/commands/link/link.command.ts`](../src/legacy/commands/link/link.command.ts)                                                                                                                                                                                                                                                                                                                                                                                                                                                  |
+| `unlink`                               | `ported`      | [`../src/legacy/commands/unlink/unlink.command.ts`](../src/legacy/commands/unlink/unlink.command.ts)                                                                                                                                                                                                                                                                                                                                                                                                                                          |
+| `bootstrap`                            | `ported`      | [`../src/legacy/commands/bootstrap/bootstrap.command.ts`](../src/legacy/commands/bootstrap/bootstrap.command.ts) (native; `db push` step delegated to the Go binary — interim)                                                                                                                                                                                                                                                                                                                                                                |
+| `init`                                 | `ported`      | [`../src/legacy/commands/init/init.command.ts`](../src/legacy/commands/init/init.command.ts)                                                                                                                                                                                                                                                                                                                                                                                                                                                  |
+| `services`                             | `ported`      | [`../src/legacy/commands/services/services.command.ts`](../src/legacy/commands/services/services.command.ts)                                                                                                                                                                                                                                                                                                                                                                                                                                  |
+| `start`                                | `ported`      | [`../src/legacy/commands/start/start.command.ts`](../src/legacy/commands/start/start.command.ts) — native; orchestrates the 14-container local dev stack via direct Docker/Podman subprocess spawning (no Docker Compose), mirroring Go's sequential per-container `DockerStart`. Edge Runtime container bring-up, the fresh-volume DB schema/migration/seed setup pipeline, and fresh-volume storage bucket seeding are all implemented; only the linked-project version-check suggestion is out of scope for this port (tracked follow-up). |
+| `stop`                                 | `ported`      | [`../src/legacy/commands/stop/stop.command.ts`](../src/legacy/commands/stop/stop.command.ts) — native; talks directly to Docker/Podman via subprocess, replicating Go's label-filter and container-naming scheme                                                                                                                                                                                                                                                                                                                              |
+| `status`                               | `ported`      | [`../src/legacy/commands/status/status.command.ts`](../src/legacy/commands/status/status.command.ts) — native; talks directly to Docker/Podman via subprocess, replicating Go's label-filter and container-naming scheme                                                                                                                                                                                                                                                                                                                      |
+| `telemetry enable`                     | `ported`      | [`../src/legacy/commands/telemetry/enable/enable.command.ts`](../src/legacy/commands/telemetry/enable/enable.command.ts)                                                                                                                                                                                                                                                                                                                                                                                                                      |
+| `telemetry disable`                    | `ported`      | [`../src/legacy/commands/telemetry/disable/disable.command.ts`](../src/legacy/commands/telemetry/disable/disable.command.ts)                                                                                                                                                                                                                                                                                                                                                                                                                  |
+| `telemetry status`                     | `ported`      | [`../src/legacy/commands/telemetry/status/status.command.ts`](../src/legacy/commands/telemetry/status/status.command.ts)                                                                                                                                                                                                                                                                                                                                                                                                                      |
+| `migration list`                       | `ported`      | [`../src/legacy/commands/migration/list/list.command.ts`](../src/legacy/commands/migration/list/list.command.ts) — native; merged Local/Remote/Time-UTC Glamour table                                                                                                                                                                                                                                                                                                                                                                         |
+| `migration new`                        | `ported`      | [`../src/legacy/commands/migration/new/new.command.ts`](../src/legacy/commands/migration/new/new.command.ts) — native; writes `supabase/migrations/<timestamp>_<name>.sql` from piped stdin                                                                                                                                                                                                                                                                                                                                                   |
+| `migration repair`                     | `ported`      | [`../src/legacy/commands/migration/repair/repair.command.ts`](../src/legacy/commands/migration/repair/repair.command.ts) — native; transactional TRUNCATE/UPSERT/DELETE, repair-all prompt                                                                                                                                                                                                                                                                                                                                                    |
+| `migration squash`                     | `wrapped`     | [`../src/legacy/commands/migration/squash/squash.command.ts`](../src/legacy/commands/migration/squash/squash.command.ts)                                                                                                                                                                                                                                                                                                                                                                                                                      |
+| `migration up`                         | `ported`      | [`../src/legacy/commands/migration/up/up.command.ts`](../src/legacy/commands/migration/up/up.command.ts) — native; pending compute + vault upsert + per-file apply                                                                                                                                                                                                                                                                                                                                                                            |
+| `migration down`                       | `ported`      | [`../src/legacy/commands/migration/down/down.command.ts`](../src/legacy/commands/migration/down/down.command.ts) — native; drop + vault + migrate&seed to target version                                                                                                                                                                                                                                                                                                                                                                      |
+| `migration fetch`                      | `ported`      | [`../src/legacy/commands/migration/fetch/fetch.command.ts`](../src/legacy/commands/migration/fetch/fetch.command.ts) — native; writes history rows to `supabase/migrations/`                                                                                                                                                                                                                                                                                                                                                                  |
+| `gen types`                            | `ported`      | [`../src/legacy/commands/gen/types/types.command.ts`](../src/legacy/commands/gen/types/types.command.ts)                                                                                                                                                                                                                                                                                                                                                                                                                                      |
+| `gen signing-key`                      | `ported`      | [`../src/legacy/commands/gen/signing-key/signing-key.command.ts`](../src/legacy/commands/gen/signing-key/signing-key.command.ts)                                                                                                                                                                                                                                                                                                                                                                                                              |
+| `gen bearer-jwt`                       | `wrapped`     | [`../src/legacy/commands/gen/bearer-jwt/bearer-jwt.command.ts`](../src/legacy/commands/gen/bearer-jwt/bearer-jwt.command.ts)                                                                                                                                                                                                                                                                                                                                                                                                                  |
+| `gen keys`                             | `wrapped`     | [`../src/legacy/commands/gen/keys/keys.command.ts`](../src/legacy/commands/gen/keys/keys.command.ts)                                                                                                                                                                                                                                                                                                                                                                                                                                          |
+| `functions list`                       | `wrapped`     | [`../src/legacy/commands/functions/list/list.command.ts`](../src/legacy/commands/functions/list/list.command.ts)                                                                                                                                                                                                                                                                                                                                                                                                                              |
+| `functions delete`                     | `ported`      | [`../src/legacy/commands/functions/delete/delete.command.ts`](../src/legacy/commands/functions/delete/delete.command.ts)                                                                                                                                                                                                                                                                                                                                                                                                                      |
+| `functions download`                   | `ported`      | [`../src/legacy/commands/functions/download/download.command.ts`](../src/legacy/commands/functions/download/download.command.ts)                                                                                                                                                                                                                                                                                                                                                                                                              |
+| `functions deploy`                     | `ported`      | [`../src/legacy/commands/functions/deploy/deploy.command.ts`](../src/legacy/commands/functions/deploy/deploy.command.ts)                                                                                                                                                                                                                                                                                                                                                                                                                      |
+| `functions new`                        | `ported`      | [`../src/legacy/commands/functions/new/new.command.ts`](../src/legacy/commands/functions/new/new.command.ts)                                                                                                                                                                                                                                                                                                                                                                                                                                  |
+| `functions serve`                      | `ported`      | [`../src/legacy/commands/functions/serve/serve.command.ts`](../src/legacy/commands/functions/serve/serve.command.ts)                                                                                                                                                                                                                                                                                                                                                                                                                          |
+| `storage ls`                           | `ported`      | [`../src/legacy/commands/storage/ls/ls.command.ts`](../src/legacy/commands/storage/ls/ls.command.ts)                                                                                                                                                                                                                                                                                                                                                                                                                                          |
+| `storage cp`                           | `ported`      | [`../src/legacy/commands/storage/cp/cp.command.ts`](../src/legacy/commands/storage/cp/cp.command.ts)                                                                                                                                                                                                                                                                                                                                                                                                                                          |
+| `storage mv`                           | `ported`      | [`../src/legacy/commands/storage/mv/mv.command.ts`](../src/legacy/commands/storage/mv/mv.command.ts)                                                                                                                                                                                                                                                                                                                                                                                                                                          |
+| `storage rm`                           | `ported`      | [`../src/legacy/commands/storage/rm/rm.command.ts`](../src/legacy/commands/storage/rm/rm.command.ts)                                                                                                                                                                                                                                                                                                                                                                                                                                          |
+| `test db`                              | `ported`      | [`../src/legacy/commands/test/db/db.command.ts`](../src/legacy/commands/test/db/db.command.ts)                                                                                                                                                                                                                                                                                                                                                                                                                                                |
+| `test new`                             | `ported`      | [`../src/legacy/commands/test/new/new.command.ts`](../src/legacy/commands/test/new/new.command.ts)                                                                                                                                                                                                                                                                                                                                                                                                                                            |
+| `seed buckets`                         | `ported`      | [`../src/legacy/commands/seed/buckets/buckets.command.ts`](../src/legacy/commands/seed/buckets/buckets.command.ts)                                                                                                                                                                                                                                                                                                                                                                                                                            |
+| `db diff`                              | `ported`      | [`../src/legacy/commands/db/diff/diff.command.ts`](../src/legacy/commands/db/diff/diff.command.ts) — native pg-delta / migra; `--use-pgadmin` / `--use-pg-schema` delegate to Go                                                                                                                                                                                                                                                                                                                                                              |
+| `db dump`                              | `ported`      | [`../src/legacy/commands/db/dump/dump.command.ts`](../src/legacy/commands/db/dump/dump.command.ts)                                                                                                                                                                                                                                                                                                                                                                                                                                            |
+| `db push`                              | `ported`      | [`../src/legacy/commands/db/push/push.command.ts`](../src/legacy/commands/db/push/push.command.ts)                                                                                                                                                                                                                                                                                                                                                                                                                                            |
+| `db pull`                              | `ported`      | [`../src/legacy/commands/db/pull/pull.command.ts`](../src/legacy/commands/db/pull/pull.command.ts) — native pg-delta / migra; `--declarative` (deprecated alias `--use-pg-delta`) + `--diff-engine` (migra\|pg-delta); initial-migra pull dumps the schema natively (`pg_dump`) + appends the diff; only `--experimental` structured dump still delegates to Go (needs a TS DDL parser for `WriteStructuredSchemas`)                                                                                                                          |
+| `db reset`                             | `ported`      | [`../src/legacy/commands/db/reset/reset.command.ts`](../src/legacy/commands/db/reset/reset.command.ts) — includes Go-parity `--sql-paths` override for `[db.seed].sql_paths`                                                                                                                                                                                                                                                                                                                                                                  |
+| `db lint`                              | `ported`      | [`../src/legacy/commands/db/lint/lint.command.ts`](../src/legacy/commands/db/lint/lint.command.ts)                                                                                                                                                                                                                                                                                                                                                                                                                                            |
+| `db start`                             | `ported`      | [`../src/legacy/commands/db/start/start.command.ts`](../src/legacy/commands/db/start/start.command.ts)                                                                                                                                                                                                                                                                                                                                                                                                                                        |
+| `db query`                             | `ported`      | [`../src/legacy/commands/db/query/query.command.ts`](../src/legacy/commands/db/query/query.command.ts)                                                                                                                                                                                                                                                                                                                                                                                                                                        |
+| `db advisors`                          | `ported`      | [`../src/legacy/commands/db/advisors/advisors.command.ts`](../src/legacy/commands/db/advisors/advisors.command.ts)                                                                                                                                                                                                                                                                                                                                                                                                                            |
+| `db test`                              | `wrapped`     | [`../src/legacy/commands/db/test/test.command.ts`](../src/legacy/commands/db/test/test.command.ts)                                                                                                                                                                                                                                                                                                                                                                                                                                            |
+| `db branch create`                     | `wrapped`     | [`../src/legacy/commands/db/branch/create/create.command.ts`](../src/legacy/commands/db/branch/create/create.command.ts)                                                                                                                                                                                                                                                                                                                                                                                                                      |
+| `db branch delete`                     | `wrapped`     | [`../src/legacy/commands/db/branch/delete/delete.command.ts`](../src/legacy/commands/db/branch/delete/delete.command.ts)                                                                                                                                                                                                                                                                                                                                                                                                                      |
+| `db branch list`                       | `wrapped`     | [`../src/legacy/commands/db/branch/list/list.command.ts`](../src/legacy/commands/db/branch/list/list.command.ts)                                                                                                                                                                                                                                                                                                                                                                                                                              |
+| `db branch switch`                     | `wrapped`     | [`../src/legacy/commands/db/branch/switch/switch.command.ts`](../src/legacy/commands/db/branch/switch/switch.command.ts)                                                                                                                                                                                                                                                                                                                                                                                                                      |
+| `db remote changes`                    | `wrapped`     | [`../src/legacy/commands/db/remote/changes/changes.command.ts`](../src/legacy/commands/db/remote/changes/changes.command.ts)                                                                                                                                                                                                                                                                                                                                                                                                                  |
+| `db remote commit`                     | `wrapped`     | [`../src/legacy/commands/db/remote/commit/commit.command.ts`](../src/legacy/commands/db/remote/commit/commit.command.ts)                                                                                                                                                                                                                                                                                                                                                                                                                      |
+| `db schema declarative sync`           | `ported`      | [`../src/legacy/commands/db/schema/declarative/sync/sync.command.ts`](../src/legacy/commands/db/schema/declarative/sync/sync.command.ts)                                                                                                                                                                                                                                                                                                                                                                                                      |
+| `db schema declarative generate`       | `ported`      | [`../src/legacy/commands/db/schema/declarative/generate/generate.command.ts`](../src/legacy/commands/db/schema/declarative/generate/generate.command.ts)                                                                                                                                                                                                                                                                                                                                                                                      |
 
 Flag divergences from the Go reference:
 
@@ -323,3 +323,18 @@ Flag divergences from the Go reference:
   `reveal=true` so the Management API returns the full secret keys (`sb_secret_...`) in
   full instead of redacting them, addressing issue #4775. Default behavior (omitted flag)
   matches Go exactly.
+- `projects create` has a TS-only `--high-availability` flag (no Go equivalent). It sets
+  `high_availability` in the create request body. Default behavior (omitted flag) matches
+  Go exactly.
+
+Behavioral divergences from the Go reference:
+
+- `services` warns on a malformed linked project ref (matching Go's
+  `flags.LoadProjectRef` validation message) but, unlike Go, does not then use
+  that ref for the remote lookup. Go's `cmd/services.go` treats the validation
+  failure as non-fatal and still calls `listRemoteImages` with the malformed
+  value; TS skips the remote lookup instead, since the ref is embedded
+  unescaped into the tenant gateway hostname and a malformed value could
+  redirect the service-role key to an attacker-controlled host. Intentional
+  TS-only hardening, not a parity bug — see
+  [`services/SIDE_EFFECTS.md`](../src/legacy/commands/services/SIDE_EFFECTS.md).
diff --git a/apps/cli/package.json b/apps/cli/package.json
index c184c44d66..b04c7fab9d 100644
--- a/apps/cli/package.json
+++ b/apps/cli/package.json
@@ -43,9 +43,9 @@
     "jose": "^6.2.3"
   },
   "devDependencies": {
-    "@anthropic-ai/claude-agent-sdk": "^0.3.196",
-    "@anthropic-ai/sdk": "^0.107.0",
-    "@clack/prompts": "^1.6.0",
+    "@anthropic-ai/claude-agent-sdk": "^0.3.207",
+    "@anthropic-ai/sdk": "^0.111.0",
+    "@clack/prompts": "^1.7.0",
     "@effect/atom-react": "catalog:",
     "@effect/platform-bun": "catalog:",
     "@effect/sql-pg": "catalog:",
@@ -76,10 +76,10 @@
     "oxlint-tsgolint": "catalog:",
     "pg": "^8.22.0",
     "pg-copy-streams": "^7.0.0",
-    "posthog-node": "^5.38.8",
+    "posthog-node": "^5.41.0",
     "react": "^19.2.7",
     "react-devtools-core": "^7.0.1",
-    "semantic-release": "^25.0.5",
+    "semantic-release": "^25.0.6",
     "smol-toml": "^1.7.0",
     "tldts": "catalog:",
     "vitest": "catalog:",
diff --git a/apps/cli/src/legacy/SIDE_EFFECTS_TEMPLATE.md b/apps/cli/src/legacy/SIDE_EFFECTS_TEMPLATE.md
index a27b7f3ab6..9ab7ef9ade 100644
--- a/apps/cli/src/legacy/SIDE_EFFECTS_TEMPLATE.md
+++ b/apps/cli/src/legacy/SIDE_EFFECTS_TEMPLATE.md
@@ -61,7 +61,7 @@
 | Variable                | Purpose                                              | Required?                                               |
 | ----------------------- | ---------------------------------------------------- | ------------------------------------------------------- |
 | `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `~/.supabase/access-token`) |
-| `SUPABASE_API_URL`      | override Management API base URL                     | no (defaults to `https://api.supabase.com`)             |
+| `SUPABASE_PROFILE`      | built-in profile name or YAML file path              | no (falls back to `~/.supabase/profile` -> `supabase`)  |
 
 ## Exit Codes
 
diff --git a/apps/cli/src/legacy/auth/legacy-credentials.layer.ts b/apps/cli/src/legacy/auth/legacy-credentials.layer.ts
index 2d78ea2ec8..ffddf8b017 100644
--- a/apps/cli/src/legacy/auth/legacy-credentials.layer.ts
+++ b/apps/cli/src/legacy/auth/legacy-credentials.layer.ts
@@ -1,4 +1,4 @@
-import { Effect, FileSystem, Layer, Option, Path, Redacted } from "effect";
+import { Effect, FileSystem, Layer, Option, Path, Redacted, Result } from "effect";
 
 import { RuntimeInfo } from "../../shared/runtime/runtime-info.service.ts";
 import { normalizeKeyringToken } from "../../shared/auth/keyring-token.ts";
@@ -92,7 +92,7 @@ const tryKeyringDelete = (
         deleted = true;
       }
 
-      if (platform === "win32" && readGoWindowsTarget(module, account)) {
+      if (platform === "win32" && probeWindowsTarget(module, account) !== "absent") {
         deleted = deleteGoWindowsTarget(module, account) || deleted;
       }
 
@@ -123,6 +123,45 @@ function readGoWindowsTarget(module: KeyringModule, account: string): string | n
   }
 }
 
+// `Entry.withTarget` is avoided as a probe — its constructor writes an empty
+// placeholder. A `findCredentials` throw is ambiguous (an undecodable Go blob or
+// a real enumeration failure), so reported as `"unknown"`, never assumed present.
+type WindowsTargetProbe = "present" | "absent" | "unknown";
+
+function probeWindowsTarget(module: KeyringModule, account: string): WindowsTargetProbe {
+  try {
+    const credentials = module.findCredentials(KEYRING_SERVICE, goWindowsCredentialTarget(account));
+    // An empty password is an orphaned placeholder, not a real credential.
+    const credential = credentials.find(
+      (item) => item.account === account && item.password.length > 0,
+    );
+    return credential ? "present" : "absent";
+  } catch {
+    return "unknown";
+  }
+}
+
+// Constructing `withTarget` always leaves something at that target — the real
+// credential, or the placeholder — so a delete that follows is never a
+// legitimate "nothing to delete": any non-success is surfaced.
+const deleteProbedWindowsTarget = <E>(
+  module: KeyringModule,
+  account: string,
+  onFailure: (cause: unknown) => E,
+): Effect.Effect<boolean, E> =>
+  Effect.gen(function* () {
+    const result = yield* Effect.try(() =>
+      module.Entry.withTarget(
+        goWindowsCredentialTarget(account),
+        KEYRING_SERVICE,
+        account,
+      ).deleteCredential(),
+    ).pipe(Effect.result);
+    if (Result.isSuccess(result) && result.success) return true;
+    const cause = Result.isFailure(result) ? result.failure : "credential was not removed";
+    return yield* Effect.fail(onFailure(cause));
+  });
+
 function normalizeGoWindowsPassword(value: string): string {
   const direct = normalizeKeyringToken(value);
   if (LEGACY_ACCESS_TOKEN_PATTERN.test(direct)) return direct;
@@ -172,11 +211,10 @@ function deleteGoWindowsTarget(module: KeyringModule, account: string): boolean
 // (backend unavailable) and only surfaces other errors (`unlink.go:36-40`).
 //
 // The plain `Entry(service, projectRef)` is the macOS/Linux form and the Windows
-// default. On Windows, Go also writes a separate target-shaped credential; it is
-// detected via `findCredentials` (a plain `getPassword` does not read the Go
-// target reliably) and deleted through the `withTarget` entry. The `withTarget`
-// entry is only constructed on Windows — on macOS its first argument is an
-// invalid keychain domain and throws.
+// default. On Windows, Go also writes a separate target-shaped credential,
+// deleted through the `withTarget` entry. The `withTarget` entry is only
+// constructed on Windows — on macOS its first argument is an invalid keychain
+// domain and throws.
 //
 // Each entry is probed before `deleteCredential()`: on macOS deleting an absent
 // entry blocks on a Keychain authorization prompt, and an absent read means
@@ -204,22 +242,16 @@ const deleteKeyringEntryStrict = (
       deleted = true;
     }
 
-    if (platform === "win32" && readGoWindowsTarget(module, account)) {
-      const target = module.Entry.withTarget(
-        goWindowsCredentialTarget(account),
-        KEYRING_SERVICE,
+    if (platform === "win32" && probeWindowsTarget(module, account) !== "absent") {
+      const removed = yield* deleteProbedWindowsTarget(
+        module,
         account,
-      );
-      yield* Effect.try({
-        try: () => {
-          target.deleteCredential();
-        },
-        catch: (cause) =>
+        (cause) =>
           new LegacyCredentialDeleteError({
             message: `failed to delete project credential: ${String(cause)}`,
           }),
-      });
-      deleted = true;
+      );
+      deleted ||= removed;
     }
 
     return deleted;
@@ -256,43 +288,48 @@ const deleteProfileKeyringEntry = (
       found = true;
     }
 
-    if (platform === "win32" && readGoWindowsTarget(module, account)) {
-      const target = module.Entry.withTarget(
-        goWindowsCredentialTarget(account),
-        KEYRING_SERVICE,
+    if (platform === "win32" && probeWindowsTarget(module, account) !== "absent") {
+      const removed = yield* deleteProbedWindowsTarget(
+        module,
         account,
-      );
-      yield* Effect.try({
-        try: () => {
-          target.deleteCredential();
-        },
-        catch: (cause) =>
+        (cause) =>
           new LegacyDeleteTokenError({
             message: `failed to delete access token from keyring: ${String(cause)}`,
           }),
-      });
-      found = true;
+      );
+      found ||= removed;
     }
 
     return found ? "deleted" : "notFound";
   });
 
-// Best-effort wipe of every entry in the `"Supabase CLI"` keyring namespace —
-// the project database-password credentials `link` writes. Mirrors Go's
-// `keyring.DeleteAll(namespace)` (`store.go:71`). Never fails: per-entry delete
-// errors are swallowed so a single stuck credential can't abort logout.
+// Best-effort wipe of the `"Supabase CLI"` keyring namespace, mirroring Go's
+// `keyring.DeleteAll` (`store.go:71`); errors are swallowed so one stuck
+// credential can't abort logout, matching Go's own handling (`logout.go:35`).
 //
-// On Windows, Go stores credentials under the target-shaped name
-// `Supabase CLI:<account>` rather than the plain `Entry(service, account)` form
-// (see `writeGoWindowsTarget`). So each discovered account is deleted in BOTH
-// forms — the plain entry and, on win32, the Go target entry — mirroring the
-// individual deletes in `deleteProfileKeyringEntry`. Without this, a Go-written
-// project credential would survive `logout` on Windows.
+// Go writes Windows credentials under the target-shaped form
+// (`Supabase CLI:<account>`), invisible to the plain enumeration below, so
+// it's swept separately. `findCredentials` decodes every matched blob and
+// aborts entirely on one undecodable entry, unlike Go's raw-byte `wincred.List`.
 const deleteAllKeyringEntries = (
   module: KeyringModule,
   platform: RuntimePlatform,
 ): Effect.Effect<void> =>
   Effect.sync(() => {
+    if (platform === "win32") {
+      try {
+        const entries = module.findCredentials(
+          KEYRING_SERVICE,
+          `${goWindowsCredentialTarget("")}*`,
+        );
+        for (const { account } of entries) {
+          deleteGoWindowsTarget(module, account);
+        }
+      } catch {
+        // best-effort
+      }
+    }
+
     let entries: ReadonlyArray<{ account: string }>;
     try {
       entries = module.findCredentials(KEYRING_SERVICE);
@@ -305,9 +342,6 @@ const deleteAllKeyringEntries = (
       } catch {
         // best-effort per entry
       }
-      if (platform === "win32" && readGoWindowsTarget(module, account)) {
-        deleteGoWindowsTarget(module, account);
-      }
     }
   });
 
diff --git a/apps/cli/src/legacy/auth/legacy-credentials.layer.unit.test.ts b/apps/cli/src/legacy/auth/legacy-credentials.layer.unit.test.ts
index 06dad317de..f5320dba28 100644
--- a/apps/cli/src/legacy/auth/legacy-credentials.layer.unit.test.ts
+++ b/apps/cli/src/legacy/auth/legacy-credentials.layer.unit.test.ts
@@ -32,24 +32,29 @@ let throwOnSetPassword = false;
 let throwOnSetSecret = false;
 const throwOnGetPasswordAccounts = new Set<string>();
 const throwOnDeleteAccounts = new Set<string>();
+const failDeleteAccounts = new Set<string>();
 const withTargetCalls: string[] = [];
+const opaqueAccounts = new Set<string>();
+let throwOnFindCredentials = false;
 
 vi.mock("@napi-rs/keyring", () => ({
-  findCredentials: (service: string, target?: string) =>
-    Array.from(passwords.entries())
-      .filter(([key]) =>
-        // No target → model the Windows `CredEnumerate("<service>*")` sweep,
-        // which matches both the plain (`<service>/…`) and the Go target-shaped
-        // (`<service>:<account>/…`) entries by the leading segment. With a
-        // target → narrow to that specific Go target (used by readGoWindowsTarget).
-        target === undefined
-          ? key.split("/")[0]!.startsWith(service)
-          : key.startsWith(`${target}/`),
-      )
-      .map(([key, password]) => ({
-        account: key.split("/").at(-1)!,
-        password,
-      })),
+  findCredentials: (service: string, target?: string) => {
+    if (throwOnFindCredentials) throw new Error("CredEnumerate failed");
+    const targetName = (key: string) => key.split("/")[0]!;
+    const matchesFilter = (key: string): boolean => {
+      if (target === undefined) return targetName(key) === service;
+      if (target.endsWith("*")) return targetName(key).startsWith(target.slice(0, -1));
+      return targetName(key) === target;
+    };
+    const matches = Array.from(passwords.entries()).filter(([key]) => matchesFilter(key));
+    if (matches.some(([key]) => opaqueAccounts.has(key))) {
+      throw new Error("BadEncoding: invalid UTF-8 data in secure storage");
+    }
+    return matches.map(([key, password]) => ({
+      account: key.split("/").at(-1)!,
+      password,
+    }));
+  },
   Entry: class Entry {
     service: string;
     account: string;
@@ -61,7 +66,9 @@ vi.mock("@napi-rs/keyring", () => ({
     }
     static withTarget(target: string, service: string, account: string) {
       withTargetCalls.push(`${target}/${service}/${account}`);
-      return new this(service, account, target);
+      const entry = new this(service, account, target);
+      if (!passwords.has(entry.key())) passwords.set(entry.key(), "");
+      return entry;
     }
     key(): string {
       return this.target === undefined
@@ -86,6 +93,7 @@ vi.mock("@napi-rs/keyring", () => ({
     deleteCredential(): boolean {
       const key = this.key();
       if (throwOnDeleteAccounts.has(key)) throw new Error("Keyring delete failed");
+      if (failDeleteAccounts.has(key)) return false;
       if (!passwords.has(key)) throw new Error("not found");
       passwords.delete(key);
       return true;
@@ -140,6 +148,9 @@ beforeEach(() => {
   throwOnGetPasswordAccounts.clear();
   throwOnDeleteAccounts.clear();
   withTargetCalls.length = 0;
+  opaqueAccounts.clear();
+  failDeleteAccounts.clear();
+  throwOnFindCredentials = false;
   tempHome = mkdtempSync(join(tmpdir(), "supabase-legacy-creds-"));
 });
 
@@ -337,7 +348,7 @@ describe("legacyCredentialsLayer.saveAccessToken", () => {
     return Effect.gen(function* () {
       const { saveAccessToken } = yield* LegacyCredentials;
       yield* saveAccessToken(VALID_TOKEN);
-      expect(passwords.has(goWindowsKey("supabase"))).toBe(false);
+      expect(passwords.get(goWindowsKey("supabase")) ?? "").toBe("");
       expect(passwords.has("Supabase CLI/supabase")).toBe(false);
       const content = readFileSync(join(tempHome, ".supabase", "access-token"), "utf-8");
       expect(content).toBe(VALID_TOKEN);
@@ -423,6 +434,31 @@ describe("legacyCredentialsLayer.deleteAccessToken", () => {
     },
   );
 
+  it.effect("win32: no Go target credential → LegacyNotLoggedInError, nothing fabricated", () => {
+    return Effect.gen(function* () {
+      const { deleteAccessToken } = yield* LegacyCredentials;
+      const exit = yield* Effect.exit(deleteAccessToken);
+      expect(exit._tag).toBe("Failure");
+      if (exit._tag === "Failure") {
+        expect(JSON.stringify(exit.cause)).toContain("LegacyNotLoggedInError");
+      }
+      expect(passwords.has(goWindowsKey("supabase"))).toBe(false);
+      expect(withTargetCalls).toEqual([]);
+    }).pipe(Effect.provide(makeLayer({ platform: "win32" })));
+  });
+
+  it.effect("win32: an empty placeholder Go target → LegacyNotLoggedInError", () => {
+    passwords.set(goWindowsKey("supabase"), "");
+    return Effect.gen(function* () {
+      const { deleteAccessToken } = yield* LegacyCredentials;
+      const exit = yield* Effect.exit(deleteAccessToken);
+      expect(exit._tag).toBe("Failure");
+      if (exit._tag === "Failure") {
+        expect(JSON.stringify(exit.cause)).toContain("LegacyNotLoggedInError");
+      }
+    }).pipe(Effect.provide(makeLayer({ platform: "win32" })));
+  });
+
   it.effect(
     "keyring unavailable (SUPABASE_NO_KEYRING) with token in file → removes file, still NotLoggedIn",
     () => {
@@ -521,6 +557,61 @@ describe("legacyCredentialsLayer.deleteAccessToken", () => {
     }).pipe(Effect.provide(makeLayer({ platform: "win32" })));
   });
 
+  it.effect(
+    "win32: deletes a Go target whose blob getPassword/findCredentials can't decode",
+    () => {
+      passwords.set(goWindowsKey("supabase"), VALID_TOKEN);
+      opaqueAccounts.add(goWindowsKey("supabase"));
+      return Effect.gen(function* () {
+        const { deleteAccessToken } = yield* LegacyCredentials;
+        yield* deleteAccessToken;
+        expect(passwords.has(goWindowsKey("supabase"))).toBe(false);
+      }).pipe(Effect.provide(makeLayer({ platform: "win32" })));
+    },
+  );
+
+  it.effect(
+    "win32: a confirmed Go target whose delete returns false → LegacyDeleteTokenError",
+    () => {
+      passwords.set(goWindowsKey("supabase"), VALID_TOKEN);
+      failDeleteAccounts.add(goWindowsKey("supabase"));
+      return Effect.gen(function* () {
+        const { deleteAccessToken } = yield* LegacyCredentials;
+        const exit = yield* Effect.exit(deleteAccessToken);
+        expect(exit._tag).toBe("Failure");
+        if (exit._tag === "Failure") {
+          expect(JSON.stringify(exit.cause)).toContain("LegacyDeleteTokenError");
+        }
+        expect(passwords.has(goWindowsKey("supabase"))).toBe(true);
+      }).pipe(Effect.provide(makeLayer({ platform: "win32" })));
+    },
+  );
+
+  it.effect("win32: an enumeration hiccup alone does not block logout", () => {
+    throwOnFindCredentials = true;
+    return Effect.gen(function* () {
+      const { deleteAccessToken } = yield* LegacyCredentials;
+      const exit = yield* Effect.exit(deleteAccessToken);
+      expect(exit._tag).toBe("Success");
+    }).pipe(Effect.provide(makeLayer({ platform: "win32" })));
+  });
+
+  it.effect(
+    "win32: an enumeration failure whose target also fails to delete → LegacyDeleteTokenError",
+    () => {
+      throwOnFindCredentials = true;
+      failDeleteAccounts.add(goWindowsKey("supabase"));
+      return Effect.gen(function* () {
+        const { deleteAccessToken } = yield* LegacyCredentials;
+        const exit = yield* Effect.exit(deleteAccessToken);
+        expect(exit._tag).toBe("Failure");
+        if (exit._tag === "Failure") {
+          expect(JSON.stringify(exit.cause)).toContain("LegacyDeleteTokenError");
+        }
+      }).pipe(Effect.provide(makeLayer({ platform: "win32" })));
+    },
+  );
+
   it.effect("legacy-keyring delete error is swallowed and does not change the outcome", () => {
     passwords.set("Supabase CLI/supabase", VALID_TOKEN);
     passwords.set("Supabase CLI/access-token", VALID_OAUTH_TOKEN);
@@ -554,26 +645,71 @@ describe("legacyCredentialsLayer.deleteAllProjectCredentials", () => {
     }).pipe(Effect.provide(makeLayer({ env: { SUPABASE_NO_KEYRING: "1" } })));
   });
 
+  it.effect("never fails even when an individual delete throws", () => {
+    passwords.set("Supabase CLI/abcdefghijklmnopqrs1", "secret-1");
+    throwOnDeleteAccounts.add("Supabase CLI/abcdefghijklmnopqrs1");
+    return Effect.gen(function* () {
+      const { deleteAllProjectCredentials } = yield* LegacyCredentials;
+      const exit = yield* Effect.exit(deleteAllProjectCredentials);
+      expect(exit._tag).toBe("Success");
+    }).pipe(Effect.provide(makeLayer()));
+  });
+
   it.effect("win32: deletes Go target-shaped project credentials", () => {
-    // Go stores Windows project credentials under `Supabase CLI:<ref>`, not the
-    // plain `Supabase CLI/<ref>` form. The sweep must delete the target form too.
     passwords.set(goWindowsKey("abcdefghijklmnopqrs1"), "secret-1");
+    passwords.set(goWindowsKey("abcdefghijklmnopqrs2"), "secret-2");
     return Effect.gen(function* () {
       const { deleteAllProjectCredentials } = yield* LegacyCredentials;
       yield* deleteAllProjectCredentials;
       expect(passwords.has(goWindowsKey("abcdefghijklmnopqrs1"))).toBe(false);
+      expect(passwords.has(goWindowsKey("abcdefghijklmnopqrs2"))).toBe(false);
     }).pipe(Effect.provide(makeLayer({ platform: "win32" })));
   });
 
-  it.effect("never fails even when an individual delete throws", () => {
-    passwords.set("Supabase CLI/abcdefghijklmnopqrs1", "secret-1");
-    throwOnDeleteAccounts.add("Supabase CLI/abcdefghijklmnopqrs1");
+  it.effect(
+    "win32: a single undecodable entry aborts the Go target sweep without failing logout",
+    () => {
+      passwords.set(goWindowsKey("abcdefghijklmnopqrs1"), "secret-1");
+      passwords.set(goWindowsKey("abcdefghijklmnopqrs2"), "secret-2");
+      opaqueAccounts.add(goWindowsKey("abcdefghijklmnopqrs1"));
+      return Effect.gen(function* () {
+        const { deleteAllProjectCredentials } = yield* LegacyCredentials;
+        const exit = yield* Effect.exit(deleteAllProjectCredentials);
+        expect(exit._tag).toBe("Success");
+        // One undecodable entry aborts the whole findCredentials call.
+        expect(passwords.has(goWindowsKey("abcdefghijklmnopqrs1"))).toBe(true);
+        expect(passwords.has(goWindowsKey("abcdefghijklmnopqrs2"))).toBe(true);
+      }).pipe(Effect.provide(makeLayer({ platform: "win32" })));
+    },
+  );
+});
+
+describe("legacyCredentialsLayer.deleteProjectCredential", () => {
+  it.effect("win32: deletes a Go target-shaped project credential", () => {
+    passwords.set(goWindowsKey("abcdefghijklmnopqrs1"), "db-password");
     return Effect.gen(function* () {
-      const { deleteAllProjectCredentials } = yield* LegacyCredentials;
-      const exit = yield* Effect.exit(deleteAllProjectCredentials);
-      expect(exit._tag).toBe("Success");
-    }).pipe(Effect.provide(makeLayer()));
+      const { deleteProjectCredential } = yield* LegacyCredentials;
+      const deleted = yield* deleteProjectCredential("abcdefghijklmnopqrs1");
+      expect(deleted).toBe(true);
+      expect(passwords.has(goWindowsKey("abcdefghijklmnopqrs1"))).toBe(false);
+    }).pipe(Effect.provide(makeLayer({ platform: "win32" })));
   });
+
+  it.effect(
+    "win32: a confirmed project credential whose delete fails → LegacyCredentialDeleteError",
+    () => {
+      passwords.set(goWindowsKey("abcdefghijklmnopqrs1"), "db-password");
+      throwOnDeleteAccounts.add(goWindowsKey("abcdefghijklmnopqrs1"));
+      return Effect.gen(function* () {
+        const { deleteProjectCredential } = yield* LegacyCredentials;
+        const exit = yield* Effect.exit(deleteProjectCredential("abcdefghijklmnopqrs1"));
+        expect(exit._tag).toBe("Failure");
+        if (exit._tag === "Failure") {
+          expect(JSON.stringify(exit.cause)).toContain("LegacyCredentialDeleteError");
+        }
+      }).pipe(Effect.provide(makeLayer({ platform: "win32" })));
+    },
+  );
 });
 
 // Suppress unused-import nag — referenced in JSDoc / used in assertions above.
diff --git a/apps/cli/src/legacy/auth/legacy-platform-api.layer.unit.test.ts b/apps/cli/src/legacy/auth/legacy-platform-api.layer.unit.test.ts
index df39fcba27..8e69052093 100644
--- a/apps/cli/src/legacy/auth/legacy-platform-api.layer.unit.test.ts
+++ b/apps/cli/src/legacy/auth/legacy-platform-api.layer.unit.test.ts
@@ -37,6 +37,7 @@ function mockCliConfig(opts: {
     apiUrl: opts.apiUrl ?? "https://api.supabase.com",
     projectHost: opts.projectHost ?? "supabase.co",
     poolerHost: "supabase.com",
+    dashboardUrl: "https://supabase.com/dashboard",
     accessToken:
       opts.accessToken === undefined ? Option.none() : Option.some(Redacted.make(opts.accessToken)),
     projectId: Option.none(),
diff --git a/apps/cli/src/legacy/cli/agent-output.e2e.test.ts b/apps/cli/src/legacy/cli/agent-output.e2e.test.ts
index d6625c88f7..15c124caa2 100644
--- a/apps/cli/src/legacy/cli/agent-output.e2e.test.ts
+++ b/apps/cli/src/legacy/cli/agent-output.e2e.test.ts
@@ -38,19 +38,18 @@ describe("legacy CLI agent output", () => {
     });
 
     expect(exitCode).toBe(1);
+    // CLI-1901: the vendored effect CLI library's own duplicate JSON render
+    // (the old `{_tag:"Help"}` + `{_tag:"Error", error:{code:"ShowHelp"}}`
+    // pair on stdout, `{_tag:"Errors"}` on stderr) is gone. stdout carries
+    // exactly this repo's single Go-parity error line; the library's help
+    // doc is redirected to stderr instead of being dropped or duplicated.
     expect(parseJsonLines(stdout)).toEqual([
-      expect.objectContaining({ _tag: "Help" }),
       expect.objectContaining({
         _tag: "Error",
-        error: expect.objectContaining({ code: "ShowHelp" }),
-      }),
-    ]);
-    expect(parseJsonLines(stderr)).toEqual([
-      expect.objectContaining({
-        _tag: "Errors",
-        errors: [expect.objectContaining({ code: "UnknownSubcommand" })],
+        error: expect.objectContaining({ code: "UnknownSubcommand" }),
       }),
     ]);
+    expect(parseJsonLines(stderr)).toEqual([expect.objectContaining({ _tag: "Help" })]);
   });
 
   test("keeps parse errors in text mode when --output-format=text is explicit", async () => {
@@ -63,7 +62,9 @@ describe("legacy CLI agent output", () => {
     );
 
     expect(exitCode).toBe(1);
-    expect(stdout).toContain("DESCRIPTION");
+    // CLI-1901: the help doc no longer prints to stdout at all.
+    expect(stdout).toBe("");
+    expect(stderr).toContain("DESCRIPTION");
     expect(stderr).toContain('Unknown subcommand "definitely-not-a-command"');
   });
 
@@ -77,7 +78,8 @@ describe("legacy CLI agent output", () => {
     );
 
     expect(exitCode).toBe(1);
-    expect(stdout).toContain("DESCRIPTION");
+    expect(stdout).toBe("");
+    expect(stderr).toContain("DESCRIPTION");
     expect(stderr).toContain('Unknown subcommand "definitely-not-a-command"');
   });
 
@@ -92,18 +94,12 @@ describe("legacy CLI agent output", () => {
 
     expect(exitCode).toBe(1);
     expect(parseJsonLines(stdout)).toEqual([
-      expect.objectContaining({ _tag: "Help" }),
       expect.objectContaining({
         _tag: "Error",
-        error: expect.objectContaining({ code: "ShowHelp" }),
-      }),
-    ]);
-    expect(parseJsonLines(stderr)).toEqual([
-      expect.objectContaining({
-        _tag: "Errors",
-        errors: [expect.objectContaining({ code: "UnknownSubcommand" })],
+        error: expect.objectContaining({ code: "UnknownSubcommand" }),
       }),
     ]);
+    expect(parseJsonLines(stderr)).toEqual([expect.objectContaining({ _tag: "Help" })]);
   });
 
   test("keeps built-in version and help in text mode for detected coding agents", async () => {
diff --git a/apps/cli/src/legacy/commands/backups/list/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/backups/list/SIDE_EFFECTS.md
index f69b0219d6..cff8a366c1 100644
--- a/apps/cli/src/legacy/commands/backups/list/SIDE_EFFECTS.md
+++ b/apps/cli/src/legacy/commands/backups/list/SIDE_EFFECTS.md
@@ -31,7 +31,6 @@
 | `SUPABASE_PROFILE`      | selects API base URL: `supabase` → `api.supabase.com`, `supabase-staging` → `api.supabase.green`, `supabase-local` → `http://localhost:8080`. May alternatively be a filesystem path to a YAML profile with at least `api_url:` and optional `name:` (Go parity — used by the cli-e2e test harness). | no (defaults to `supabase`)                                                |
 | `SUPABASE_PROJECT_ID`   | project ref fallback when `--project-ref` is unset                                                                                                                                                                                                                                                   | no (also reads `<workdir>/supabase/.temp/project-ref` then prompts on TTY) |
 | `SUPABASE_WORKDIR`      | base directory for the `.temp/project-ref` lookup                                                                                                                                                                                                                                                    | no (walks up from CWD looking for `supabase/config.toml`)                  |
-| ~~`SUPABASE_API_URL`~~  | **not honored** — Go parity. Use `SUPABASE_PROFILE` to override the API base URL.                                                                                                                                                                                                                    | —                                                                          |
 
 ## Exit Codes
 
diff --git a/apps/cli/src/legacy/commands/backups/restore/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/backups/restore/SIDE_EFFECTS.md
index 8b08e2727b..768bb9b728 100644
--- a/apps/cli/src/legacy/commands/backups/restore/SIDE_EFFECTS.md
+++ b/apps/cli/src/legacy/commands/backups/restore/SIDE_EFFECTS.md
@@ -31,7 +31,6 @@
 | `SUPABASE_PROFILE`      | selects API base URL: `supabase` → `api.supabase.com`, `supabase-staging` → `api.supabase.green`, `supabase-local` → `http://localhost:8080`. May alternatively be a filesystem path to a YAML profile with at least `api_url:` and optional `name:` (Go parity — used by the cli-e2e test harness). | no (defaults to `supabase`)                                                |
 | `SUPABASE_PROJECT_ID`   | project ref fallback when `--project-ref` is unset                                                                                                                                                                                                                                                   | no (also reads `<workdir>/supabase/.temp/project-ref` then prompts on TTY) |
 | `SUPABASE_WORKDIR`      | base directory for the `.temp/project-ref` lookup                                                                                                                                                                                                                                                    | no (walks up from CWD looking for `supabase/config.toml`)                  |
-| ~~`SUPABASE_API_URL`~~  | **not honored** — Go parity. Use `SUPABASE_PROFILE` to override the API base URL.                                                                                                                                                                                                                    | —                                                                          |
 
 ## Exit Codes
 
diff --git a/apps/cli/src/legacy/commands/bootstrap/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/bootstrap/SIDE_EFFECTS.md
index a6428d8f47..2a28897a48 100644
--- a/apps/cli/src/legacy/commands/bootstrap/SIDE_EFFECTS.md
+++ b/apps/cli/src/legacy/commands/bootstrap/SIDE_EFFECTS.md
@@ -46,13 +46,13 @@ leaking the change to the surrounding process.
 
 ## Environment Variables
 
-| Variable                               | Purpose                                            | Required? |
-| -------------------------------------- | -------------------------------------------------- | --------- |
-| `SUPABASE_WORKDIR`                     | target dir (`--workdir` flag → env → prompt → cwd) | no        |
-| `SUPABASE_DB_PASSWORD`                 | DB password (`-p` flag → env → prompt/generate)    | no        |
-| `GITHUB_TOKEN`                         | raise the GitHub API rate limit for template fetch | no        |
-| `SUPABASE_ACCESS_TOKEN`                | auth bypass for ensure-login                       | no        |
-| `SUPABASE_API_URL`, `SUPABASE_PROFILE` | API host / profile                                 | no        |
+| Variable                | Purpose                                                      | Required? |
+| ----------------------- | ------------------------------------------------------------ | --------- |
+| `SUPABASE_WORKDIR`      | target dir (`--workdir` flag → env → prompt → cwd)           | no        |
+| `SUPABASE_DB_PASSWORD`  | DB password (`-p` flag → env → prompt/generate)              | no        |
+| `GITHUB_TOKEN`          | raise the GitHub API rate limit for template fetch           | no        |
+| `SUPABASE_ACCESS_TOKEN` | auth bypass for ensure-login                                 | no        |
+| `SUPABASE_PROFILE`      | profile name/path (env → `~/.supabase/profile` → `supabase`) | no        |
 
 ## Exit Codes
 
@@ -99,10 +99,11 @@ Human banners are suppressed; a single structured result is emitted:
 - **Interim Go-proxy delegation for migration push.** The push step shells out to the bundled
   Go binary (`db push --include-roles --include-seed`) until `db push` gets its own native port
   (separate Linear issue). The sub-step is **not** instrumentation-wrapped (the subprocess fires
-  its own push telemetry). Known divergence: `LegacyGoProxy.exec` propagates the exit code, so Go's
-  push backoff is **not** reproduced (single attempt) — to be restored when `db push` is natively
-  ported. (`LegacyGoProxy.exec` exits the process on a non-zero exit rather than returning a
-  failure, so the step cannot be wrapped in `Effect.retry`.)
+  its own push telemetry). Known divergence: Go's push backoff is **not** reproduced (single
+  attempt) — to be restored when `db push` is natively ported. (`LegacyGoProxy.exec` fails with a
+  typed `LegacyGoChildExitError` on a non-zero exit rather than exiting the process — CLI-1879 — so
+  the step COULD now be wrapped in `Effect.retry`; leaving that unimplemented here is a deliberate
+  scope decision for the native `db push` port, not a technical blocker.)
 - **DB password is forwarded on the same channel the user supplied it (CLI-1617).** The proxy must
   be called 1:1 with the user's input: a flag stays a flag, an env var stays an env var. So when the
   user passed `-p/--password`, the push sub-step receives `--password <value>` (flag → flag); when
diff --git a/apps/cli/src/legacy/commands/bootstrap/bootstrap.retry.ts b/apps/cli/src/legacy/commands/bootstrap/bootstrap.retry.ts
index 6ea685fafe..7b8d1fe290 100644
--- a/apps/cli/src/legacy/commands/bootstrap/bootstrap.retry.ts
+++ b/apps/cli/src/legacy/commands/bootstrap/bootstrap.retry.ts
@@ -23,16 +23,15 @@ const MAX_INTERVAL = Duration.seconds(60);
  *  - `MaxElapsedTime` 15m (intersected via `during`; in practice the 8-retry cap
  *    always trips first, but reproduced for completeness)
  */
-export const legacyBootstrapBackoff: Schedule.Schedule<[Duration.Duration, Duration.Duration]> =
-  Schedule.exponential("3 seconds", 1.5).pipe(
-    Schedule.modifyDelay((_, delay) => Effect.succeed(Duration.min(delay, MAX_INTERVAL))),
-    Schedule.modifyDelay((_, delay) =>
-      Random.next.pipe(
-        Effect.map((random) => Duration.millis(Duration.toMillis(delay) * (0.5 + random))),
-      ),
+export const legacyBootstrapBackoff = Schedule.exponential("3 seconds", 1.5).pipe(
+  Schedule.modifyDelay(({ duration }) => Effect.succeed(Duration.min(duration, MAX_INTERVAL))),
+  Schedule.modifyDelay(({ duration }) =>
+    Random.next.pipe(
+      Effect.map((random) => Duration.millis(Duration.toMillis(duration) * (0.5 + random))),
     ),
-    Schedule.both(Schedule.during("15 minutes")),
-  );
+  ),
+  Schedule.upTo({ duration: "15 minutes" }),
+);
 
 /**
  * Reproduces Go's `utils.NewErrorCallback` (`internal/utils/retry.go:19-35`): after
diff --git a/apps/cli/src/legacy/commands/branches/create/create.command.ts b/apps/cli/src/legacy/commands/branches/create/create.command.ts
index 69367b3f4d..1cc85ecbce 100644
--- a/apps/cli/src/legacy/commands/branches/create/create.command.ts
+++ b/apps/cli/src/legacy/commands/branches/create/create.command.ts
@@ -44,7 +44,6 @@ const BRANCH_SIZES = [
   "48xlarge_optimized_memory",
   "4xlarge",
   "8xlarge",
-  "nano",
   "small",
   "xlarge",
 ] as const;
@@ -96,7 +95,7 @@ export const legacyBranchesCreateCommand = Command.make("create", config).pipe(
   Command.withShortDescription("Create a preview branch"),
   Command.withHandler((flags) =>
     legacyBranchesCreate(flags).pipe(
-      withLegacyCommandInstrumentation({ flags, safeFlags: ["project-ref"] }),
+      withLegacyCommandInstrumentation({ flags, safeFlags: ["project-ref"], config }),
       withJsonErrorHandling,
     ),
   ),
diff --git a/apps/cli/src/legacy/commands/branches/create/create.integration.test.ts b/apps/cli/src/legacy/commands/branches/create/create.integration.test.ts
index fcbb44aa0f..8fb2a9e5d5 100644
--- a/apps/cli/src/legacy/commands/branches/create/create.integration.test.ts
+++ b/apps/cli/src/legacy/commands/branches/create/create.integration.test.ts
@@ -1,8 +1,10 @@
 import type { V1CreateABranchOutput } from "@supabase/api/effect";
 import { describe, expect, it } from "@effect/vitest";
-import { Effect, Exit, Option } from "effect";
+import { Cause, Effect, Exit, Option } from "effect";
+import { Command } from "effect/unstable/cli";
 
 import { mockAnalytics, mockOutput } from "../../../../../tests/helpers/mocks.ts";
+import { LEGACY_GLOBAL_FLAGS } from "../../../../shared/legacy/global-flags.ts";
 import {
   LEGACY_VALID_REF,
   buildLegacyTestRuntime,
@@ -13,7 +15,7 @@ import {
   mockLegacyTelemetryStateTracked,
   useLegacyTempWorkdir,
 } from "../../../../../tests/helpers/legacy-mocks.ts";
-import type { LegacyBranchesCreateFlags } from "./create.command.ts";
+import { legacyBranchesCreateCommand, type LegacyBranchesCreateFlags } from "./create.command.ts";
 import { legacyBranchesCreate } from "./create.handler.ts";
 
 type CreatedBranch = typeof V1CreateABranchOutput.Type;
@@ -282,4 +284,44 @@ describe("legacy branches create integration", () => {
       expect(cache.cached).toBe(true);
     }).pipe(Effect.provide(layer));
   });
+
+  // Go parity (`apps/cli-go/cmd/projects.go:34-55`, reused by `branches create`
+  // at `apps/cli-go/cmd/branches.go:212`): Go's --size EnumFlag is an 18-value
+  // list that does not include "nano" (or "pico") and rejects any other value
+  // at flag-parse time. TS previously listed "nano" as a valid choice, silently
+  // succeeding where Go errors.
+  it.live("rejects --size nano at flag-parse time, matching Go's 18-value enum", () => {
+    const root = Command.make("supabase").pipe(
+      Command.withGlobalFlags(LEGACY_GLOBAL_FLAGS),
+      Command.withSubcommands([legacyBranchesCreateCommand]),
+    );
+
+    return Effect.gen(function* () {
+      const exit = yield* Effect.exit(
+        Command.runWith(root, { version: "0.0.0-test" })(["create", "--size", "nano"]),
+      );
+      expect(Exit.isFailure(exit)).toBe(true);
+      if (Exit.isFailure(exit)) {
+        expect(rejectsInvalidSizeChoice(Cause.squash(exit.cause))).toBe(true);
+      }
+    }) as Effect.Effect<void>;
+  });
 });
+
+// Distinguishes "the --size flag itself was rejected at parse time" from any
+// other failure (e.g. a missing runtime service in this minimal test setup),
+// so the regression test above can't pass for the wrong reason.
+function rejectsInvalidSizeChoice(error: unknown): boolean {
+  if (typeof error !== "object" || error === null || !("errors" in error)) return false;
+  const { errors } = error;
+  if (!Array.isArray(errors)) return false;
+  return errors.some(
+    (candidate: unknown) =>
+      typeof candidate === "object" &&
+      candidate !== null &&
+      "_tag" in candidate &&
+      candidate._tag === "InvalidValue" &&
+      "option" in candidate &&
+      candidate.option === "size",
+  );
+}
diff --git a/apps/cli/src/legacy/commands/branches/update/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/branches/update/SIDE_EFFECTS.md
index 09bab3fd8f..4983406350 100644
--- a/apps/cli/src/legacy/commands/branches/update/SIDE_EFFECTS.md
+++ b/apps/cli/src/legacy/commands/branches/update/SIDE_EFFECTS.md
@@ -6,10 +6,10 @@ Same auth and project-ref resolution chain as every Management-API legacy comman
 
 ## Files Written
 
-| Path                                             | Format | When                                                                     |
-| ------------------------------------------------ | ------ | ------------------------------------------------------------------------ |
-| `~/.supabase/<workdir-hash>/linked-project.json` | JSON   | always (in `Effect.ensuring`) after `--project-ref` resolves — Go parity |
-| `~/.supabase/telemetry.json`                     | JSON   | always (in `Effect.ensuring`) at end of command — Go parity              |
+| Path                                           | Format | When                                                                     |
+| ---------------------------------------------- | ------ | ------------------------------------------------------------------------ |
+| `<workdir>/supabase/.temp/linked-project.json` | JSON   | always (in `Effect.ensuring`) after `--project-ref` resolves — Go parity |
+| `~/.supabase/telemetry.json`                   | JSON   | always (in `Effect.ensuring`) at end of command — Go parity              |
 
 ## API Routes
 
@@ -51,4 +51,4 @@ In Go encoder modes, the header goes to stderr followed by the encoded payload o
 
 ## Notes
 
-The upgrade-suggest call uses the parent project ref (resolved from `--project-ref`) rather than the branch's project ref. Both refs belong to the same organization, so the entitlement check returns the same `org_slug` either way; this also sidesteps a known API schema constraint where `getProject` strictly requires a `^[a-z]{20}$` ref.
+The upgrade-suggest call uses the branch's own resolved project ref (`legacyResolveBranchProjectRef`), matching Go's `update.go:26` (`pause.GetBranchProjectRef`) — not the parent `--project-ref` value — so the entitlements check is scoped to the branch's org.
diff --git a/apps/cli/src/legacy/commands/branches/update/update.command.ts b/apps/cli/src/legacy/commands/branches/update/update.command.ts
index 205f2cdb28..2495a68601 100644
--- a/apps/cli/src/legacy/commands/branches/update/update.command.ts
+++ b/apps/cli/src/legacy/commands/branches/update/update.command.ts
@@ -52,7 +52,7 @@ export const legacyBranchesUpdateCommand = Command.make("update", config).pipe(
   Command.withShortDescription("Update a preview branch"),
   Command.withHandler((flags) =>
     legacyBranchesUpdate(flags).pipe(
-      withLegacyCommandInstrumentation({ flags, safeFlags: ["project-ref"] }),
+      withLegacyCommandInstrumentation({ flags, safeFlags: ["project-ref"], config }),
       withJsonErrorHandling,
     ),
   ),
diff --git a/apps/cli/src/legacy/commands/completion/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/completion/SIDE_EFFECTS.md
index f25912c9c5..ed1b76d1c2 100644
--- a/apps/cli/src/legacy/commands/completion/SIDE_EFFECTS.md
+++ b/apps/cli/src/legacy/commands/completion/SIDE_EFFECTS.md
@@ -26,10 +26,10 @@
 
 ## Exit Codes
 
-| Code | Condition                                                          |
-| ---- | ------------------------------------------------------------------ |
-| `0`  | success — completion script for the chosen shell printed to stdout |
-| `1`  | invocation error (missing or unknown shell subcommand)             |
+| Code | Condition                                                                                                            |
+| ---- | -------------------------------------------------------------------------------------------------------------------- |
+| `0`  | success — completion script for the chosen shell printed to stdout                                                   |
+| `1`  | unknown shell subcommand, or bare `completion` with no shell subcommand — **known divergence, see Notes (CLI-1906)** |
 
 ## Output
 
@@ -58,9 +58,19 @@ straight to the Go binary.
 - Effect CLI's `--completions` global flag remains exposed at the root for `next/`
   users; it does not satisfy the legacy parity contract and is not what this
   subcommand routes through.
-- The Go CLI exits non-zero when called without a shell subcommand (e.g.
-  `supabase completion`). Effect CLI surfaces the same condition through its usual
-  "missing subcommand" help-with-exit-1 behavior.
+- **Known divergence (CLI-1906):** Go's cobra CLI exits `0` on both bare
+  `completion` (no shell subcommand) AND `completion <unknown-shell>` — cobra
+  treats an unrecognized subcommand name the same as a missing one: a
+  non-`Runnable()` command with no `RunE` returns `flag.ErrHelp`, which cobra
+  maps to printing help and returning a nil error (verified against the
+  compiled Go binary for both cases: `completion` and `completion
+bogus-shell` both exit `0`). The legacy TS shell currently exits `1` for
+  both invocations; this is a real, systemic exit-code bug in the shared CLI
+  harness (`shared/cli/run.ts`), not `completion`-specific — it reproduces on
+  any bare or unrecognized-subcommand invocation of a group command with
+  subcommands (e.g. `branches`, `branches bogus-subcommand`). See CLI-1906 for
+  the fix; this doc describes current (buggy) behavior, not the intended
+  target.
 - Each of `bash`/`zsh`/`fish`/`powershell` declares `--no-descriptions` (cobra's
   auto-registered flag, `completions.go` in `spf13/cobra`) and forwards it to the
   Go binary, so the emitted script omits completion descriptions exactly as it
diff --git a/apps/cli/src/legacy/commands/config/push/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/config/push/SIDE_EFFECTS.md
index 8a15ea687b..3661eb0d7e 100644
--- a/apps/cli/src/legacy/commands/config/push/SIDE_EFFECTS.md
+++ b/apps/cli/src/legacy/commands/config/push/SIDE_EFFECTS.md
@@ -7,20 +7,21 @@ local → if changed, print the unified diff and confirm → PATCH/PUT/POST.
 
 ## Files Read
 
-| Path                                             | Format                    | When                                                            |
-| ------------------------------------------------ | ------------------------- | --------------------------------------------------------------- |
-| `<workdir>/supabase/config.toml`                 | TOML                      | always, before any network call (parse error aborts, exit 1)    |
-| `<workdir>/supabase/.env`, `.env.local`          | dotenv                    | always, to resolve `env(VAR)` references inside `config.toml`   |
-| Auth email template HTML (`content_path`)        | HTML                      | when `auth.enabled`; paths resolved per Go rules (see below)    |
-| `~/.supabase/<workdir-hash>/linked-project.json` | JSON                      | project-ref fallback (flag → `SUPABASE_PROJECT_ID` → this file) |
-| `~/.supabase/access-token`                       | plain text (token string) | when `SUPABASE_ACCESS_TOKEN` unset and keyring unavailable      |
+| Path                                           | Format                    | When                                                                                                                                                                               |
+| ---------------------------------------------- | ------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `<workdir>/supabase/config.toml`               | TOML                      | always, before any network call (parse error aborts, exit 1)                                                                                                                       |
+| `<workdir>/supabase/.env`, `.env.local`        | dotenv                    | always, to resolve `env(VAR)` references inside `config.toml` and to collect `DOTENV_PRIVATE_KEY`(`_*`) values for decrypting `encrypted:` secrets                                 |
+| Auth email template HTML (`content_path`)      | HTML                      | when `auth.enabled`; paths resolved per Go rules (see below)                                                                                                                       |
+| `<workdir>/supabase/.temp/project-ref`         | plain text                | project-ref fallback (flag → `SUPABASE_PROJECT_ID` → this file)                                                                                                                    |
+| `<workdir>/supabase/.temp/linked-project.json` | JSON                      | existence check only, to decide whether the cache write below is skipped (mirrors Go's `ensureProjectGroupsCached` telemetry cache — see `db/lint`'s Notes for the full mechanism) |
+| `~/.supabase/access-token`                     | plain text (token string) | when `SUPABASE_ACCESS_TOKEN` unset and keyring unavailable                                                                                                                         |
 
 ## Files Written
 
-| Path                                             | Format | When                                                                   |
-| ------------------------------------------------ | ------ | ---------------------------------------------------------------------- |
-| `~/.supabase/<workdir-hash>/linked-project.json` | JSON   | `Effect.ensuring` after run (success **and** failure), if ref resolved |
-| `~/.supabase/telemetry.json`                     | JSON   | `Effect.ensuring` after run (success **and** failure)                  |
+| Path                                           | Format | When                                                                   |
+| ---------------------------------------------- | ------ | ---------------------------------------------------------------------- |
+| `<workdir>/supabase/.temp/linked-project.json` | JSON   | `Effect.ensuring` after run (success **and** failure), if ref resolved |
+| `~/.supabase/telemetry.json`                   | JSON   | `Effect.ensuring` after run (success **and** failure)                  |
 
 No writes to `config.toml`.
 
@@ -50,14 +51,14 @@ when its local gate is off.
 
 ## Environment Variables
 
-| Variable                | Purpose                                                  | Required?                                               |
-| ----------------------- | -------------------------------------------------------- | ------------------------------------------------------- |
-| `SUPABASE_PROJECT_ID`   | project ref (flag → this → `.temp/project-ref` → prompt) | no                                                      |
-| `SUPABASE_YES`          | auto-confirm prompts (`--yes`)                           | no                                                      |
-| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup)     | no (falls back to keyring → `~/.supabase/access-token`) |
-| `SUPABASE_API_URL`      | override Management API base URL                         | no (defaults to `https://api.supabase.com`)             |
-| `SUPABASE_PROFILE`      | API profile selection                                    | no                                                      |
-| `env(VAR)` references   | interpolated into `config.toml` values at load           | no                                                      |
+| Variable                                     | Purpose                                                                                                   | Required?                                                                                                                                                                                 |
+| -------------------------------------------- | --------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `SUPABASE_PROJECT_ID`                        | project ref (flag → this → `.temp/project-ref` → prompt)                                                  | no                                                                                                                                                                                        |
+| `SUPABASE_YES`                               | auto-confirm prompts (`--yes`)                                                                            | no                                                                                                                                                                                        |
+| `SUPABASE_ACCESS_TOKEN`                      | auth token (bypasses credential file/keyring lookup)                                                      | no (falls back to keyring → `~/.supabase/access-token`)                                                                                                                                   |
+| `SUPABASE_PROFILE`                           | API profile selection                                                                                     | no                                                                                                                                                                                        |
+| `env(VAR)` references                        | interpolated into `config.toml` values at load                                                            | no                                                                                                                                                                                        |
+| `DOTENV_PRIVATE_KEY`, `DOTENV_PRIVATE_KEY_*` | decrypt `encrypted:` (dotenvx) secret values before hashing/pushing; comma-split, first matching key wins | only if a `config.Secret`-typed field (see below) holds an `encrypted:` value — an `encrypted:`-looking string in a non-secret field (e.g. an email template `subject`) never needs a key |
 
 ## Exit Codes
 
@@ -65,6 +66,7 @@ when its local gate is off.
 | ---- | ------------------------------------------------------------------------------------------ |
 | `0`  | success, **including** declining a confirmation prompt (Go returns nil and continues)      |
 | `1`  | malformed `config.toml`                                                                    |
+| `1`  | an `encrypted:` (dotenvx) secret anywhere in the document cannot be decrypted (see below)  |
 | `1`  | invalid `auth.email.*.content_path` (missing/unreadable template file when `auth.enabled`) |
 | `1`  | two `[remotes.*]` blocks declare the same `project_id` as the target ref                   |
 | `1`  | list-addons failure (network or non-200)                                                   |
@@ -115,5 +117,8 @@ keys mirror `config.toml` paths.
 - Diff bytes are byte-for-byte identical to the Go CLI (BurntSushi TOML encoder + anchored diff ports).
 - Optional `*pointer` sections (`db.ssl_enforcement`, `storage.image_transformation`, `storage.s3_protocol`) are decoded as defaulted-present by `@supabase/config`; their true presence is recovered from the raw (merged) config document so they are skipped when absent, matching Go's nil-pointer behaviour.
 - **`[remotes.*]` overrides are merged before push.** When a `[remotes.<name>]` block declares `project_id == <ref>`, `@supabase/config` merges that block's subtree over the base config at the raw (pre-decode) level — Go's `mergeRemoteConfig` (`apps/cli-go/pkg/config/config.go:550`) — so only the keys the block declares override the base. `Loading config override: [remotes.<name>]` prints to stderr. Two remotes sharing the target `project_id` abort with Go's `duplicate project_id for [remotes.<b>] and [remotes.<a>]` message.
+- **`encrypted:` (dotenvx) secrets are decrypted, hashed, and pushed as plaintext**, matching Go's `Secret.Decrypt`/`DecryptSecretHookFunc`. `DOTENV_PRIVATE_KEY`(`_*`) values from the shell + `supabase/.env` decrypt the ciphertext; the decrypted plaintext is what gets hashed for the diff and sent as `Secret.Value` in the update body. The ciphertext itself is never pushed.
+- **An undecryptable secret aborts before any network call.** Before the cost-matrix list-addons request or any other service call, every `config.Secret`-typed value in the document is asserted decryptable — not just `auth.*` (the only fields `config push` actually sends), matching Go's document-wide decode hook, which runs the same check regardless of which fields a given command reads. This covers `[db.vault]` (a `map[string]Secret` in Go too, not just an `auth.*` field). An undecryptable value aborts with Go's `failed to parse config: <cause>` message, exit code `1`.
+- **Deprecated `[auth.external.{linkedin,slack}]` secrets are checked before they're stripped.** `@supabase/config` strips these deprecated blocks from the decoded document before returning it, but Go's decrypt hook runs at decode time — before its own later `external.validate()` deletes them — so `config push` re-checks the stripped-out sub-objects separately, matching Go's decode-before-delete order rather than missing a secret hiding in one of them.
 - KNOWN GAPS:
-  - **`encrypted:` (dotenvx) secret decryption is not reproduced.** The Go CLI decrypts `encrypted:` values before hashing and pushes the plaintext; we cannot decrypt here. Rather than push the ciphertext (which would overwrite the remote secret with garbage), `encrypted:` values are treated as unresolved — exactly like `env()` refs: they hash to `""`, so the empty hash gates them out of both the diff and the update body and the remote secret is left untouched.
+  - The document-wide decrypt-or-abort pre-check scans the config document `@supabase/config` hands back, which has the _matched_ `[remotes.<name>]` block already merged in and its `remotes` key removed. An `encrypted:` secret that's undecryptable inside a **different, non-matching** `[remotes.*]` block is therefore not caught here (Go's decode hook runs over the whole parsed document, including every remote, so it would abort in that case too). Narrow edge case: it only matters when a project declares multiple remotes and the _unused_ one has a broken secret.
diff --git a/apps/cli/src/legacy/commands/config/push/config-sync/api.sync.ts b/apps/cli/src/legacy/commands/config/push/config-sync/api.sync.ts
index c555f72ff9..b1836729c6 100644
--- a/apps/cli/src/legacy/commands/config/push/config-sync/api.sync.ts
+++ b/apps/cli/src/legacy/commands/config/push/config-sync/api.sync.ts
@@ -2,6 +2,7 @@ import type { ProjectConfig } from "@supabase/config";
 
 import { diff } from "./config-sync.diff.ts";
 import { encodeToml, type TomlField, type TomlValue } from "./config-sync.toml.ts";
+import { legacyStrToArr } from "../../../../shared/legacy-local-config-values.ts";
 import { intToUint } from "../../../../shared/legacy-size-units.ts";
 
 /**
@@ -56,11 +57,6 @@ export interface RemoteApiConfig {
   readonly max_rows: number;
 }
 
-/** Go `strToArr`: empty string → `[]`, else comma-split (no trimming here). */
-function strToArr(v: string): Array<string> {
-  return v.length === 0 ? [] : v.split(",");
-}
-
 /** Projects the loaded `config.api` into the push subset. */
 export function apiSubsetFromConfig(config: ProjectConfig): ApiSubset {
   const api = config.api;
@@ -94,8 +90,8 @@ function applyRemoteApiConfig(local: ApiSubset, remote: RemoteApiConfig): ApiSub
   return {
     ...local,
     enabled: true,
-    schemas: strToArr(remote.db_schema).map((s) => s.trim()),
-    extra_search_path: strToArr(remote.db_extra_search_path).map((s) => s.trim()),
+    schemas: legacyStrToArr(remote.db_schema).map((s) => s.trim()),
+    extra_search_path: legacyStrToArr(remote.db_extra_search_path).map((s) => s.trim()),
     max_rows: intToUint(remote.max_rows),
   };
 }
diff --git a/apps/cli/src/legacy/commands/config/push/config-sync/auth.sync.ts b/apps/cli/src/legacy/commands/config/push/config-sync/auth.sync.ts
index 2321f9d960..7a884c5da2 100644
--- a/apps/cli/src/legacy/commands/config/push/config-sync/auth.sync.ts
+++ b/apps/cli/src/legacy/commands/config/push/config-sync/auth.sync.ts
@@ -13,10 +13,11 @@ import type { ProjectConfig } from "@supabase/config";
 
 import { diff } from "./config-sync.diff.ts";
 import { type TomlField, type TomlValue, encodeToml } from "./config-sync.toml.ts";
+import { legacyStrToArr } from "../../../../shared/legacy-local-config-values.ts";
 import { intToUint } from "../../../../shared/legacy-size-units.ts";
 import { durationString, parseDuration, secondsToDurationString } from "./config-sync.duration.ts";
 import type { AuthEmailContent } from "./config-sync.auth-email-content.ts";
-import { secretHash } from "./config-sync.secret.ts";
+import { secretHash, secretPlaintext } from "./config-sync.secret.ts";
 
 // ---------------------------------------------------------------------------
 // Sub-types
@@ -838,11 +839,6 @@ const AUTH_FIELDS: ReadonlyArray<TomlField> = [
 // Helpers
 // ---------------------------------------------------------------------------
 
-/** Go `strToArr`: empty string → `[]`, else comma-split. */
-function strToArr(v: string): Array<string> {
-  return v.length === 0 ? [] : v.split(",");
-}
-
 /** Go `cast.IntToUint`: clamp negatives to 0. */
 function valOrDefault<T>(v: T | null | undefined, def: T): T {
   return v == null ? def : v;
@@ -858,9 +854,13 @@ function normalizeDurationStr(s: string | undefined): string {
   }
 }
 
-function projectSecret(projectId: string, value: string | undefined): string {
+function projectSecret(
+  projectId: string,
+  value: string | undefined,
+  dotenvPrivateKeys: ReadonlyArray<string>,
+): string {
   if (!value) return "";
-  return secretHash(projectId, value);
+  return secretHash(projectId, value, dotenvPrivateKeys);
 }
 
 /**
@@ -908,12 +908,21 @@ export interface AuthPresence {
  * Projects `config.auth` into the push subset, pre-computing all duration and
  * secret fields.  `projectId` is the HMAC key for secret hashing. `presence`
  * carries raw-config presence for the optional sub-sections Go skips when nil.
+ * `dotenvPrivateKeys` (Go's `DOTENV_PRIVATE_KEY`/`DOTENV_PRIVATE_KEY_*` values)
+ * decrypt any `encrypted:` (dotenvx) secret before it's hashed or copied into
+ * {@link AuthSubset.rawSecrets} — see `config-sync.secret.ts`.
+ *
+ * @throws When an `encrypted:` secret cannot be decrypted with any key. The
+ *   handler's document-wide pre-check (`legacyAssertDecryptableSecrets`) runs
+ *   before this and is expected to have already aborted in that case, so this
+ *   throw is a defensive backstop, not the primary abort path.
  */
 export function authSubsetFromConfig(
   config: ProjectConfig,
   projectId: string,
   presence: AuthPresence,
   emailContent: AuthEmailContent = { template: {}, notification: {} },
+  dotenvPrivateKeys: ReadonlyArray<string> = [],
 ): AuthSubset {
   const a = config.auth;
 
@@ -947,7 +956,7 @@ export function authSubsetFromConfig(
       : {
           enabled: captchaConfig.enabled ?? false,
           provider: captchaConfig.provider ?? "",
-          secret: projectSecret(projectId, captchaConfig.secret ?? ""),
+          secret: projectSecret(projectId, captchaConfig.secret ?? "", dotenvPrivateKeys),
         };
 
   // Hooks — Go gates each on `hook.<name> != nil`; absent in raw config → skip.
@@ -960,7 +969,7 @@ export function authSubsetFromConfig(
     return {
       enabled: hc.enabled,
       uri: hc.uri ?? "",
-      secrets: projectSecret(projectId, hc.secrets ?? ""),
+      secrets: projectSecret(projectId, hc.secrets ?? "", dotenvPrivateKeys),
     };
   }
   const hook: AuthSubset["hook"] = {
@@ -1047,7 +1056,7 @@ export function authSubsetFromConfig(
           host: smtpConfig.host ?? "",
           port: smtpConfig.port ?? 0,
           user: smtpConfig.user ?? "",
-          pass: projectSecret(projectId, smtpConfig.pass ?? ""),
+          pass: projectSecret(projectId, smtpConfig.pass ?? "", dotenvPrivateKeys),
           admin_email: smtpConfig.admin_email ?? "",
           sender_name: smtpConfig.sender_name ?? "",
         };
@@ -1064,7 +1073,7 @@ export function authSubsetFromConfig(
       enabled: tc.enabled,
       account_sid: tc.account_sid ?? "",
       message_service_sid: tc.message_service_sid ?? "",
-      auth_token: projectSecret(projectId, tc.auth_token ?? ""),
+      auth_token: projectSecret(projectId, tc.auth_token ?? "", dotenvPrivateKeys),
     };
   }
   const sms: AuthSubset["sms"] = {
@@ -1077,18 +1086,18 @@ export function authSubsetFromConfig(
     messagebird: {
       enabled: s.messagebird.enabled,
       originator: s.messagebird.originator ?? "",
-      access_key: projectSecret(projectId, s.messagebird.access_key ?? ""),
+      access_key: projectSecret(projectId, s.messagebird.access_key ?? "", dotenvPrivateKeys),
     },
     textlocal: {
       enabled: s.textlocal.enabled,
       sender: s.textlocal.sender ?? "",
-      api_key: projectSecret(projectId, s.textlocal.api_key ?? ""),
+      api_key: projectSecret(projectId, s.textlocal.api_key ?? "", dotenvPrivateKeys),
     },
     vonage: {
       enabled: s.vonage.enabled,
       from: s.vonage.from ?? "",
       api_key: s.vonage.api_key ?? "",
-      api_secret: projectSecret(projectId, s.vonage.api_secret ?? ""),
+      api_secret: projectSecret(projectId, s.vonage.api_secret ?? "", dotenvPrivateKeys),
     },
     test_otp: s.test_otp ?? {},
   };
@@ -1105,7 +1114,7 @@ export function authSubsetFromConfig(
     external[k] = {
       enabled: p.enabled,
       client_id: p.client_id ?? "",
-      secret: projectSecret(projectId, p.secret ?? ""),
+      secret: projectSecret(projectId, p.secret ?? "", dotenvPrivateKeys),
       url: p.url ?? "",
       redirect_uri: p.redirect_uri ?? "",
       skip_nonce_check: p.skip_nonce_check ?? false,
@@ -1193,33 +1202,52 @@ export function authSubsetFromConfig(
       allow_dynamic_registration: a.oauth_server.allow_dynamic_registration,
       authorization_url_path: a.oauth_server.authorization_url_path,
     },
-    publishable_key: projectSecret(projectId, a.publishable_key ?? ""),
-    secret_key: projectSecret(projectId, a.secret_key ?? ""),
-    jwt_secret: projectSecret(projectId, a.jwt_secret ?? ""),
-    anon_key: projectSecret(projectId, a.anon_key ?? ""),
-    service_role_key: projectSecret(projectId, a.service_role_key ?? ""),
+    publishable_key: projectSecret(projectId, a.publishable_key ?? "", dotenvPrivateKeys),
+    secret_key: projectSecret(projectId, a.secret_key ?? "", dotenvPrivateKeys),
+    jwt_secret: projectSecret(projectId, a.jwt_secret ?? "", dotenvPrivateKeys),
+    anon_key: projectSecret(projectId, a.anon_key ?? "", dotenvPrivateKeys),
+    service_role_key: projectSecret(projectId, a.service_role_key ?? "", dotenvPrivateKeys),
     third_party,
     // Raw plaintext secrets for the update body (see AuthRawSecrets). Sourced
-    // from the same config accessors used for hashing above.
+    // from the same config accessors used for hashing above, decrypted the
+    // same way (`secretPlaintext`) so an `encrypted:` value is never sent
+    // as-is — Go always pushes `Secret.Value` (plaintext), never the ciphertext.
     rawSecrets: {
-      captcha: captchaConfig?.secret ?? "",
+      captcha: secretPlaintext(captchaConfig?.secret ?? "", dotenvPrivateKeys),
       hooks: {
-        mfa_verification_attempt: h.mfa_verification_attempt?.secrets ?? "",
-        password_verification_attempt: h.password_verification_attempt?.secrets ?? "",
-        custom_access_token: h.custom_access_token?.secrets ?? "",
-        send_sms: h.send_sms?.secrets ?? "",
-        send_email: h.send_email?.secrets ?? "",
-        before_user_created: h.before_user_created?.secrets ?? "",
+        mfa_verification_attempt: secretPlaintext(
+          h.mfa_verification_attempt?.secrets ?? "",
+          dotenvPrivateKeys,
+        ),
+        password_verification_attempt: secretPlaintext(
+          h.password_verification_attempt?.secrets ?? "",
+          dotenvPrivateKeys,
+        ),
+        custom_access_token: secretPlaintext(
+          h.custom_access_token?.secrets ?? "",
+          dotenvPrivateKeys,
+        ),
+        send_sms: secretPlaintext(h.send_sms?.secrets ?? "", dotenvPrivateKeys),
+        send_email: secretPlaintext(h.send_email?.secrets ?? "", dotenvPrivateKeys),
+        before_user_created: secretPlaintext(
+          h.before_user_created?.secrets ?? "",
+          dotenvPrivateKeys,
+        ),
       },
-      smtp_pass: smtpConfig?.pass ?? "",
+      smtp_pass: secretPlaintext(smtpConfig?.pass ?? "", dotenvPrivateKeys),
       sms: {
-        twilio: s.twilio.auth_token ?? "",
-        twilio_verify: s.twilio_verify.auth_token ?? "",
-        messagebird: s.messagebird.access_key ?? "",
-        textlocal: s.textlocal.api_key ?? "",
-        vonage: s.vonage.api_secret ?? "",
+        twilio: secretPlaintext(s.twilio.auth_token ?? "", dotenvPrivateKeys),
+        twilio_verify: secretPlaintext(s.twilio_verify.auth_token ?? "", dotenvPrivateKeys),
+        messagebird: secretPlaintext(s.messagebird.access_key ?? "", dotenvPrivateKeys),
+        textlocal: secretPlaintext(s.textlocal.api_key ?? "", dotenvPrivateKeys),
+        vonage: secretPlaintext(s.vonage.api_secret ?? "", dotenvPrivateKeys),
       },
-      providers: Object.fromEntries(Object.entries(ext ?? {}).map(([k, p]) => [k, p.secret ?? ""])),
+      providers: Object.fromEntries(
+        Object.entries(ext ?? {}).map(([k, p]) => [
+          k,
+          secretPlaintext(p.secret ?? "", dotenvPrivateKeys),
+        ]),
+      ),
     },
   };
 }
@@ -1267,7 +1295,7 @@ export function applyRemoteAuthConfig(local: AuthSubset, remote: RemoteAuthConfi
 
   // Base scalar fields
   const siteUrl = valOrDefault(remote.site_url, "");
-  const additionalRedirectUrls = strToArr(valOrDefault(remote.uri_allow_list, ""));
+  const additionalRedirectUrls = legacyStrToArr(valOrDefault(remote.uri_allow_list, ""));
   const jwtExpiry = intToUint(valOrDefault(remote.jwt_exp, 0));
   const enableRefreshTokenRotation = valOrDefault(remote.refresh_token_rotation_enabled, false);
   const refreshTokenReuseInterval = intToUint(
@@ -1290,7 +1318,7 @@ export function applyRemoteAuthConfig(local: AuthSubset, remote: RemoteAuthConfi
     webauthn = {
       rp_display_name: valOrDefault(remote.webauthn_rp_display_name, ""),
       rp_id: valOrDefault(remote.webauthn_rp_id, ""),
-      rp_origins: strToArr(valOrDefault(remote.webauthn_rp_origins, "")),
+      rp_origins: legacyStrToArr(valOrDefault(remote.webauthn_rp_origins, "")),
     };
   }
 
@@ -1754,7 +1782,7 @@ export function applyRemoteAuthConfig(local: AuthSubset, remote: RemoteAuthConfi
 
 /** Port of Go `sms.fromAuthConfig` → `envToMap`. */
 function envToMap(input: string): Record<string, string> {
-  const env = strToArr(input);
+  const env = legacyStrToArr(input);
   const result: Record<string, string> = {};
   for (const kv of env) {
     const eqIdx = kv.indexOf("=");
diff --git a/apps/cli/src/legacy/commands/config/push/config-sync/auth.sync.unit.test.ts b/apps/cli/src/legacy/commands/config/push/config-sync/auth.sync.unit.test.ts
index 4083093f14..403cb01611 100644
--- a/apps/cli/src/legacy/commands/config/push/config-sync/auth.sync.unit.test.ts
+++ b/apps/cli/src/legacy/commands/config/push/config-sync/auth.sync.unit.test.ts
@@ -1418,10 +1418,11 @@ describe("authToUpdateBody secrets", () => {
     expect("security_captcha_secret" in body).toBe(false);
   });
 
-  it("never pushes dotenvx ciphertext (encrypted: hashes to '' so the gate drops it)", () => {
-    // secretHash returns "" for `encrypted:` values, so the projected captcha
-    // secret is empty even though the raw (ciphertext) value is still present.
-    // The empty hash must gate the ciphertext out of the update body.
+  it("gates the raw secret out of the body when the hashed field is empty", () => {
+    // `authToUpdateBody` itself only knows the pre-computed hash/rawSecrets
+    // pair — this exercises the empty-hash gate directly (a decrypt failure
+    // for a real `encrypted:` value aborts earlier, in `authSubsetFromConfig` /
+    // the handler's document-wide pre-check; see push.integration.test.ts).
     const local = bareAuth({
       enabled: true,
       captcha: { enabled: true, provider: "hcaptcha", secret: "" },
diff --git a/apps/cli/src/legacy/commands/config/push/config-sync/config-sync.secret.ts b/apps/cli/src/legacy/commands/config/push/config-sync/config-sync.secret.ts
index 7b00046e6f..130bf6c48e 100644
--- a/apps/cli/src/legacy/commands/config/push/config-sync/config-sync.secret.ts
+++ b/apps/cli/src/legacy/commands/config/push/config-sync/config-sync.secret.ts
@@ -5,33 +5,72 @@
  * Rules:
  *   - Empty value → "" (no hash prefix).
  *   - Value matching `^env\((.*)\)$` (unresolved env reference) → "" (no hash).
- *   - Value starting with `encrypted:` (dotenvx ciphertext) → "" (no hash).
+ *   - Value starting with `encrypted:` (dotenvx ciphertext) → decrypt with
+ *     `legacyDecryptSecret`, then hash the decrypted plaintext.
  *   - Otherwise → "hash:" + sha256Hmac(projectId, value).
  *
- * NOTE: `encrypted:` dotenvx decryption is not implemented. The Go CLI decrypts
- * such values before hashing and pushes the plaintext; we cannot. Rather than
- * hash and push the ciphertext — which would silently overwrite the remote
- * secret with garbage — we treat `encrypted:` values as unresolved, exactly like
- * `env()` refs: `secretHash` returns "", so the empty hash gates the value out of
- * both the diff and the update body and the remote secret is left untouched.
- * This is a documented residual gap for local dev use of dotenvx secrets
- * (see SIDE_EFFECTS.md).
+ * `config push`'s handler runs a document-wide decrypt-or-abort pre-check
+ * (`push.handler.ts`, reusing `legacyAssertDecryptableSecrets`) immediately
+ * after loading `config.toml` and before any network call — mirroring Go's
+ * `config.Load` timing, where `DecryptSecretHookFunc` runs as part of the
+ * generic decode hook chain, before `internal/config/push.Run` ever reads the
+ * cost matrix or any service. By the time the functions below run (deep in
+ * the auth service's local/diff computation), decryption is therefore
+ * expected to always succeed. They still throw a `failed to parse config:
+ * <cause>` error (Go's own wording) rather than silently gating the secret
+ * out, in case that invariant is ever violated by a future field addition.
  */
 
 import { createHmac } from "node:crypto";
 
+import { legacyDecryptSecret } from "../../../../shared/legacy-vault-decrypt.ts";
+
 const ENV_PATTERN = /^env\((.*)\)$/;
 const ENCRYPTED_PREFIX = "encrypted:";
 const HASHED_PREFIX = "hash:";
 
+/** Decrypts `value` when it's a dotenvx `encrypted:` ciphertext; otherwise returns it unchanged. */
+function decryptIfNeeded(value: string, dotenvPrivateKeys: ReadonlyArray<string>): string {
+  if (!value.startsWith(ENCRYPTED_PREFIX)) return value;
+  const decrypted = legacyDecryptSecret(value, dotenvPrivateKeys);
+  if (!decrypted.ok) {
+    throw new Error(`failed to parse config: ${decrypted.error}`);
+  }
+  return decrypted.value;
+}
+
 /**
  * Returns the TOML serialisation of a Secret field, mirroring Go's
- * `Secret.MarshalText`. The project ref is the HMAC key.
+ * `Secret.MarshalText`. The project ref is the HMAC key. `dotenvPrivateKeys`
+ * are Go's `DOTENV_PRIVATE_KEY`/`DOTENV_PRIVATE_KEY_*` values
+ * (`legacyCollectDotenvPrivateKeys`), used to decrypt an `encrypted:` value
+ * before hashing — Go always hashes the decrypted plaintext, never the
+ * ciphertext.
+ *
+ * @throws When an `encrypted:` value cannot be decrypted with any key.
  */
-export function secretHash(projectId: string, value: string): string {
+export function secretHash(
+  projectId: string,
+  value: string,
+  dotenvPrivateKeys: ReadonlyArray<string>,
+): string {
   if (value.length === 0) return "";
   if (ENV_PATTERN.test(value)) return "";
-  if (value.startsWith(ENCRYPTED_PREFIX)) return "";
-  const hmac = createHmac("sha256", projectId).update(value).digest("hex");
+  const plaintext = decryptIfNeeded(value, dotenvPrivateKeys);
+  const hmac = createHmac("sha256", projectId).update(plaintext).digest("hex");
   return HASHED_PREFIX + hmac;
 }
+
+/**
+ * Resolves a Secret field to the plaintext Go sends as `Secret.Value` in the
+ * update-request body — decrypting an `encrypted:` value with
+ * `dotenvPrivateKeys`, otherwise returning `value` unchanged. Callers gate on
+ * {@link secretHash}'s result being non-empty before using this (mirrors Go's
+ * `if len(Secret.SHA256) > 0`), so the empty/unresolved-`env()` cases never
+ * reach the request body regardless of what this returns for them.
+ *
+ * @throws When an `encrypted:` value cannot be decrypted with any key.
+ */
+export function secretPlaintext(value: string, dotenvPrivateKeys: ReadonlyArray<string>): string {
+  return decryptIfNeeded(value, dotenvPrivateKeys);
+}
diff --git a/apps/cli/src/legacy/commands/config/push/config-sync/config-sync.secret.unit.test.ts b/apps/cli/src/legacy/commands/config/push/config-sync/config-sync.secret.unit.test.ts
index 9766f1efbb..707ad52f28 100644
--- a/apps/cli/src/legacy/commands/config/push/config-sync/config-sync.secret.unit.test.ts
+++ b/apps/cli/src/legacy/commands/config/push/config-sync/config-sync.secret.unit.test.ts
@@ -1,6 +1,6 @@
 /**
  * Unit tests for config-sync.secret.ts — golden parity with Go's
- * `Secret.MarshalText` (`apps/cli-go/pkg/config/secret.go`).
+ * `Secret.MarshalText` + `DecryptSecretHookFunc` (`apps/cli-go/pkg/config/secret.go`).
  *
  * The HMAC keys/values below were captured from the same `createHmac` the port
  * uses; they lock the exact `hash:<sha256hex>` serialisation Go emits.
@@ -8,42 +8,86 @@
 
 import { describe, expect, it } from "vitest";
 
-import { secretHash } from "./config-sync.secret.ts";
+import { secretHash, secretPlaintext } from "./config-sync.secret.ts";
+
+// Go's test vector — `apps/cli-go/pkg/config/secret_test.go:9-19` (same one
+// `legacy-vault-decrypt.unit.test.ts` uses). Decrypts to the plaintext "value".
+const PRIVATE_KEY = "7fd7210cef8f331ee8c55897996aaaafd853a2b20a4dc73d6d75759f65d2a7eb";
+const ENCRYPTED_VALUE =
+  "encrypted:BKiXH15AyRzeohGyUrmB6cGjSklCrrBjdesQlX1VcXo/Xp20Bi2gGZ3AlIqxPQDmjVAALnhZamKnuY73l8Dz1P+BYiZUgxTSLzdCvdYUyVbNekj2UudbdUizBViERtZkuQwZHIv/";
+const WRONG_KEY = "11".repeat(32);
 
 describe("secretHash", () => {
   it("returns the hash:<hmac> form for a plaintext secret", () => {
-    expect(secretHash("abcdefghijklmnopqrst", "my-secret")).toBe(
+    expect(secretHash("abcdefghijklmnopqrst", "my-secret", [])).toBe(
       "hash:64800db722cc0be9e1d816d5aed626805e91a939d2dbcbc5239cd31eeef763e9",
     );
-    expect(secretHash("test", "topsecret")).toBe(
+    expect(secretHash("test", "topsecret", [])).toBe(
       "hash:8eed2826599c798e072951884ced30954f8322fa1c3648506634e8376a740d72",
     );
   });
 
   it("keys the HMAC on the project ref (same value, different ref → different hash)", () => {
-    expect(secretHash("ref-a", "same")).not.toBe(secretHash("ref-b", "same"));
+    expect(secretHash("ref-a", "same", [])).not.toBe(secretHash("ref-b", "same", []));
   });
 
   it("returns '' for an empty value", () => {
-    expect(secretHash("abcdefghijklmnopqrst", "")).toBe("");
+    expect(secretHash("abcdefghijklmnopqrst", "", [])).toBe("");
   });
 
   it("returns '' for an unresolved env() reference", () => {
-    expect(secretHash("abcdefghijklmnopqrst", "env(MY_SECRET)")).toBe("");
-    expect(secretHash("abcdefghijklmnopqrst", "env()")).toBe("");
-  });
-
-  it("returns '' for a dotenvx encrypted: value (never hashes/pushes ciphertext)", () => {
-    // Regression: hashing/pushing the ciphertext would overwrite the remote
-    // secret with garbage. Treated as unresolved, like env().
-    expect(secretHash("abcdefghijklmnopqrst", "encrypted:BvEYU1pXk9...")).toBe("");
+    expect(secretHash("abcdefghijklmnopqrst", "env(MY_SECRET)", [])).toBe("");
+    expect(secretHash("abcdefghijklmnopqrst", "env()", [])).toBe("");
   });
 
   it("hashes a value that merely contains (but does not start with) 'encrypted:'", () => {
     // Only the dotenvx prefix is special; an embedded substring is a real secret.
-    expect(secretHash("test", "not-encrypted:value")).toBe(
-      secretHash("test", "not-encrypted:value"),
+    expect(secretHash("test", "not-encrypted:value", [])).toBe(
+      secretHash("test", "not-encrypted:value", []),
+    );
+    expect(secretHash("test", "not-encrypted:value", []).startsWith("hash:")).toBe(true);
+  });
+
+  describe("dotenvx encrypted: values", () => {
+    it("decrypts before hashing (hash matches the decrypted plaintext, not the ciphertext)", () => {
+      expect(secretHash("abcdefghijklmnopqrst", ENCRYPTED_VALUE, [PRIVATE_KEY])).toBe(
+        secretHash("abcdefghijklmnopqrst", "value", []),
+      );
+    });
+
+    it("tries each key and the first working one wins", () => {
+      expect(secretHash("test", ENCRYPTED_VALUE, [WRONG_KEY, PRIVATE_KEY])).toBe(
+        secretHash("test", "value", []),
+      );
+    });
+
+    it("throws 'failed to parse config: missing private key' with no keys", () => {
+      expect(() => secretHash("test", ENCRYPTED_VALUE, [])).toThrow(
+        "failed to parse config: missing private key",
+      );
+    });
+
+    it("throws 'failed to parse config: failed to decrypt secret: ...' for a wrong key", () => {
+      expect(() => secretHash("test", ENCRYPTED_VALUE, [WRONG_KEY])).toThrow(
+        /^failed to parse config: failed to decrypt secret:/,
+      );
+    });
+  });
+});
+
+describe("secretPlaintext", () => {
+  it("returns a plain value unchanged", () => {
+    expect(secretPlaintext("my-secret", [])).toBe("my-secret");
+    expect(secretPlaintext("", [])).toBe("");
+  });
+
+  it("decrypts a dotenvx encrypted: value to its plaintext", () => {
+    expect(secretPlaintext(ENCRYPTED_VALUE, [PRIVATE_KEY])).toBe("value");
+  });
+
+  it("never returns the ciphertext when decryption fails — throws instead", () => {
+    expect(() => secretPlaintext(ENCRYPTED_VALUE, [])).toThrow(
+      "failed to parse config: missing private key",
     );
-    expect(secretHash("test", "not-encrypted:value").startsWith("hash:")).toBe(true);
   });
 });
diff --git a/apps/cli/src/legacy/commands/config/push/push.handler.ts b/apps/cli/src/legacy/commands/config/push/push.handler.ts
index ebd07baabc..e1fc8971f3 100644
--- a/apps/cli/src/legacy/commands/config/push/push.handler.ts
+++ b/apps/cli/src/legacy/commands/config/push/push.handler.ts
@@ -8,9 +8,13 @@ import { LegacyTelemetryState } from "../../../telemetry/legacy-telemetry-state.
 import { legacyResolveYesWithProjectEnv } from "../../../../shared/legacy/global-flags.ts";
 import { Output } from "../../../../shared/output/output.service.ts";
 import { RuntimeInfo } from "../../../../shared/runtime/runtime-info.service.ts";
-import { legacyLoadProjectEnv } from "../../../shared/legacy-db-config.toml-read.ts";
+import {
+  legacyAssertDecryptableSecrets,
+  legacyLoadProjectEnv,
+} from "../../../shared/legacy-db-config.toml-read.ts";
 import { mapLegacyHttpError } from "../../../shared/legacy-http-errors.ts";
 import { legacyPromptYesNo } from "../../../shared/legacy-prompt-yes-no.ts";
+import { legacyCollectDotenvPrivateKeys } from "../../../shared/legacy-vault-decrypt.ts";
 import { apiSubsetFromConfig, apiToUpdateBody, diffApiWithRemote } from "./config-sync/api.sync.ts";
 import {
   applyRemoteAuthConfig,
@@ -101,6 +105,19 @@ export const legacyConfigPush = Effect.fn("legacy.config.push")(function* (
   const projectRoot = (yield* findProjectRoot(runtimeInfo.cwd)) ?? runtimeInfo.cwd;
   const projectEnv = yield* legacyLoadProjectEnv(fs, path, projectRoot);
   const yes = yield* legacyResolveYesWithProjectEnv(projectEnv);
+  // dotenvx private keys for decrypting `encrypted:` secrets (Go's
+  // `DecryptSecretHookFunc`), from the shell + project env — same source/precedence
+  // as `legacy-db-config.toml-read.ts` (`process.env` wins over `supabase/.env`).
+  const dotenvPrivateKeys = legacyCollectDotenvPrivateKeys({ ...projectEnv, ...process.env });
+  // Only reached by `legacyAssertDecryptableSecrets` below for an `env(VAR)` literal that
+  // survives `loaded.document`'s own (`@supabase/config`) interpolation pass unresolved — i.e.
+  // when this wider env source (matching Go's `loadNestedEnv`) resolves `VAR` but
+  // `@supabase/config`'s narrower one (`supabase/.env`/`.env.local` only) didn't. Practically
+  // unreachable in the same narrow way the CLI-1489 comment below already documents for
+  // non-secret fields; kept for parity with the shared function's other caller
+  // (`legacy-db-config.toml-read.ts`, whose pre-interpolation document relies on this).
+  const secretEnvLookup = (name: string): string | undefined =>
+    process.env[name] ?? projectEnv[name];
 
   const ref = yield* resolver.resolve(flags.projectRef);
 
@@ -116,7 +133,10 @@ export const legacyConfigPush = Effect.fn("legacy.config.push")(function* (
     // Pass `ref` so a matching `[remotes.*]` block is merged over the base config
     // before decode (Go's `loadFromFile` with `Config.ProjectId` set). A duplicate
     // `project_id` across remotes surfaces Go's verbatim message.
-    const loaded = yield* loadProjectConfig(runtimeInfo.cwd, { projectRef: ref }).pipe(
+    const loaded = yield* loadProjectConfig(runtimeInfo.cwd, {
+      projectRef: ref,
+      goViperCompat: true,
+    }).pipe(
       Effect.catchTag(
         "ProjectConfigParseError",
         (cause) =>
@@ -141,6 +161,33 @@ export const legacyConfigPush = Effect.fn("legacy.config.push")(function* (
     const projectId = ref;
     const config = loaded.config;
 
+    // 1b. Assert every `config.Secret`-typed `encrypted:` value in the document
+    // (not just auth.*) can be decrypted, mirroring Go's global
+    // `DecryptSecretHookFunc`, which runs as part of `config.Load` — before
+    // `internal/config/push.Run` ever reads the cost matrix (`push.go:16` vs.
+    // `push.go:25`) or touches any service. An undecryptable secret anywhere in
+    // the document (even one `config push` never itself pushes, e.g.
+    // `studio.openai_api_key`) aborts here with Go's own `failed to parse
+    // config: <cause>` message, before any remote service is read or updated.
+    //
+    // `loaded.document` has already had Go's deprecated `auth.external.{linkedin,slack}`
+    // blocks stripped by `@supabase/config` (`normalizeDeprecatedExternalProviders`), but
+    // Go's decrypt hook runs at decode time — before its own later `external.validate()`
+    // deletes those blocks — so an `encrypted:` secret hiding in one of them still aborts
+    // Go's load. Fold `removedDeprecatedExternalProviders` back into a synthetic
+    // `auth.external` view and scan that too, reusing the same path list rather than a
+    // second scanner.
+    const secretError =
+      legacyAssertDecryptableSecrets(loaded.document, secretEnvLookup, dotenvPrivateKeys) ??
+      legacyAssertDecryptableSecrets(
+        { auth: { external: loaded.removedDeprecatedExternalProviders ?? {} } },
+        secretEnvLookup,
+        dotenvPrivateKeys,
+      );
+    if (secretError !== undefined) {
+      return yield* new LegacyConfigPushLoadConfigError({ message: secretError });
+    }
+
     // Optional `*pointer` sections (ssl_enforcement, image_transformation,
     // s3_protocol) are defaulted-present by @supabase/config and cannot be
     // recovered from the decoded config, so we inspect the raw (merged) document
@@ -360,7 +407,19 @@ export const legacyConfigPush = Effect.fn("legacy.config.push")(function* (
             }),
           ),
         );
-        let local = authSubsetFromConfig(config, projectId, presence.auth, authEmailContent);
+        // `dotenvPrivateKeys` decrypts any `encrypted:` auth secret before it's
+        // hashed/copied into the update body. The document-wide check above
+        // (step 1b) already scanned every `config.Secret` path — including every
+        // field `authSubsetFromConfig` reads — and would have aborted by now if
+        // any were undecryptable, so the decrypt calls inside it are unreachable
+        // failure paths here, not a real branch to guard with `Effect.try`.
+        let local = authSubsetFromConfig(
+          config,
+          projectId,
+          presence.auth,
+          authEmailContent,
+          dotenvPrivateKeys,
+        );
         const projected = applyRemoteAuthConfig(local, remote);
         // MFA phone/webauthn are paid addons: confirm cost before enabling.
         if (mfaPhoneNewlyEnabled(local, projected) && !(yield* keep("auth_mfa_phone"))) {
diff --git a/apps/cli/src/legacy/commands/config/push/push.integration.test.ts b/apps/cli/src/legacy/commands/config/push/push.integration.test.ts
index 02ccd9d77c..0713bf7be0 100644
--- a/apps/cli/src/legacy/commands/config/push/push.integration.test.ts
+++ b/apps/cli/src/legacy/commands/config/push/push.integration.test.ts
@@ -29,6 +29,31 @@ function writeConfig(toml: string): void {
   writeFileSync(join(dir, "config.toml"), toml);
 }
 
+// Go's test vector — `apps/cli-go/pkg/config/secret_test.go:9-19` (same one
+// `legacy-vault-decrypt.unit.test.ts` and `config-sync.secret.unit.test.ts` use).
+// Decrypts to the plaintext "value".
+const DOTENVX_PRIVATE_KEY = "7fd7210cef8f331ee8c55897996aaaafd853a2b20a4dc73d6d75759f65d2a7eb";
+const DOTENVX_ENCRYPTED_VALUE =
+  "encrypted:BKiXH15AyRzeohGyUrmB6cGjSklCrrBjdesQlX1VcXo/Xp20Bi2gGZ3AlIqxPQDmjVAALnhZamKnuY73l8Dz1P+BYiZUgxTSLzdCvdYUyVbNekj2UudbdUizBViERtZkuQwZHIv/";
+
+/** Save/restore `DOTENV_PRIVATE_KEY` around a test — mirrors the SUPABASE_YES pattern below. */
+function withDotenvPrivateKey<A, E, R>(
+  value: string | undefined,
+  effect: Effect.Effect<A, E, R>,
+): Effect.Effect<A, E, R> {
+  const prev = process.env["DOTENV_PRIVATE_KEY"];
+  if (value === undefined) delete process.env["DOTENV_PRIVATE_KEY"];
+  else process.env["DOTENV_PRIVATE_KEY"] = value;
+  return effect.pipe(
+    Effect.ensuring(
+      Effect.sync(() => {
+        if (prev === undefined) delete process.env["DOTENV_PRIVATE_KEY"];
+        else process.env["DOTENV_PRIVATE_KEY"] = prev;
+      }),
+    ),
+  );
+}
+
 // Schema-valid PostgREST GET response with the api disabled remotely (empty
 // schema). The real API client validates GET bodies against the generated
 // output schema, so every postgrest GET must carry these fields.
@@ -724,6 +749,172 @@ secret = "my-plaintext-secret"
     },
   );
 
+  it.live(
+    "decrypts a dotenvx encrypted: captcha secret and pushes the plaintext (CLI-1881)",
+    () => {
+      const toml = `project_id = "test"
+[storage]
+enabled = false
+[auth]
+enabled = true
+site_url = "http://localhost:3000"
+[auth.captcha]
+enabled = true
+provider = "hcaptcha"
+secret = "${DOTENVX_ENCRYPTED_VALUE}"
+`;
+      const { layer, apiMock } = setupService({
+        toml,
+        yes: true,
+        v1: {
+          getAuthServiceConfig: () => Effect.succeed({}),
+          updateAuthServiceConfig: () => Effect.succeed({}),
+        },
+      });
+      return withDotenvPrivateKey(
+        DOTENVX_PRIVATE_KEY,
+        Effect.gen(function* () {
+          yield* legacyConfigPush({ projectRef: Option.none() });
+          const update = apiMock.requests.find((r) => r.method === "updateAuthServiceConfig");
+          expect(update).toBeDefined();
+          const input = update?.input as Record<string, unknown>;
+          // Go decrypts before hashing/pushing — the plaintext goes to the API,
+          // never the dotenvx ciphertext.
+          expect(input["security_captcha_secret"]).toBe("value");
+        }).pipe(Effect.provide(layer)),
+      );
+    },
+  );
+
+  it.live(
+    "aborts before any network call when an encrypted: secret cannot be decrypted (CLI-1881)",
+    () => {
+      // `auth.enabled = false` on purpose: Go's decrypt hook runs for every
+      // `config.Secret` field during `config.Load`, before any feature gate is
+      // consulted — an undecryptable secret aborts even when the section that
+      // contains it would otherwise be skipped entirely.
+      const toml = `project_id = "test"
+[storage]
+enabled = false
+[auth]
+enabled = false
+[auth.captcha]
+enabled = true
+provider = "hcaptcha"
+secret = "${DOTENVX_ENCRYPTED_VALUE}"
+`;
+      const { layer, api } = setup({ toml, yes: true });
+      return withDotenvPrivateKey(
+        undefined,
+        Effect.gen(function* () {
+          const message = yield* legacyConfigPush({ projectRef: Option.none() }).pipe(
+            Effect.catchTag("LegacyConfigPushLoadConfigError", (error) =>
+              Effect.succeed(error.message),
+            ),
+          );
+          expect(message).toBe("failed to parse config: missing private key");
+          // The guard runs during config load, before any network call — not
+          // even the cost-matrix (list-addons) request that normally runs first.
+          expect(api.requests).toHaveLength(0);
+        }).pipe(Effect.provide(layer)),
+      );
+    },
+  );
+
+  it.live(
+    "aborts on an undecryptable secret config push never itself reads or pushes (CLI-1881)",
+    () => {
+      // `studio.openai_api_key` is a `config.Secret` field Go's `DecryptSecretHookFunc`
+      // still decrypts during `config.Load` — but no `config-sync/*.sync.ts` file (api,
+      // db, auth, storage, experimental) ever reads `studio.*`, so this proves the
+      // pre-check is genuinely document-wide, not merely reachable via `auth.*`.
+      const toml = `project_id = "test"
+[storage]
+enabled = false
+[auth]
+enabled = false
+[studio]
+openai_api_key = "${DOTENVX_ENCRYPTED_VALUE}"
+`;
+      const { layer, api } = setup({ toml, yes: true });
+      return withDotenvPrivateKey(
+        undefined,
+        Effect.gen(function* () {
+          const message = yield* legacyConfigPush({ projectRef: Option.none() }).pipe(
+            Effect.catchTag("LegacyConfigPushLoadConfigError", (error) =>
+              Effect.succeed(error.message),
+            ),
+          );
+          expect(message).toBe("failed to parse config: missing private key");
+          expect(api.requests).toHaveLength(0);
+        }).pipe(Effect.provide(layer)),
+      );
+    },
+  );
+
+  it.live("aborts on an undecryptable [db.vault] secret (CLI-1881)", () => {
+    // `db.vault` decodes as `map[string]Secret` in Go (`pkg/config/db.go:96`), so Go's
+    // decrypt hook covers it during `config.Load` — but the shared
+    // `legacyAssertDecryptableSecrets` path list used to omit `db.vault` on the theory
+    // that only the db-config reader's own downstream vault loop needed it. `config push`
+    // never runs that downstream loop, so this proves the shared path list now covers
+    // `db.vault` for every caller.
+    const toml = `project_id = "test"
+[storage]
+enabled = false
+[auth]
+enabled = false
+[db.vault]
+my_secret = "${DOTENVX_ENCRYPTED_VALUE}"
+`;
+    const { layer, api } = setup({ toml, yes: true });
+    return withDotenvPrivateKey(
+      undefined,
+      Effect.gen(function* () {
+        const message = yield* legacyConfigPush({ projectRef: Option.none() }).pipe(
+          Effect.catchTag("LegacyConfigPushLoadConfigError", (error) =>
+            Effect.succeed(error.message),
+          ),
+        );
+        expect(message).toBe("failed to parse config: missing private key");
+        expect(api.requests).toHaveLength(0);
+      }).pipe(Effect.provide(layer)),
+    );
+  });
+
+  it.live(
+    "aborts on an undecryptable secret in a deprecated [auth.external.slack] block (CLI-1881)",
+    () => {
+      // `@supabase/config` strips `auth.external.{linkedin,slack}` from `loaded.document`
+      // before returning it (`normalizeDeprecatedExternalProviders`), matching Go's
+      // `external.validate()` — but Go's decrypt hook runs at DECODE time, strictly before
+      // that later validate-time deletion, so a `secret` hiding in one of these deprecated
+      // blocks still aborts Go's load. This proves the pre-check folds
+      // `removedDeprecatedExternalProviders` back in rather than missing it.
+      const toml = `project_id = "test"
+[storage]
+enabled = false
+[auth]
+enabled = false
+[auth.external.slack]
+secret = "${DOTENVX_ENCRYPTED_VALUE}"
+`;
+      const { layer, api } = setup({ toml, yes: true });
+      return withDotenvPrivateKey(
+        undefined,
+        Effect.gen(function* () {
+          const message = yield* legacyConfigPush({ projectRef: Option.none() }).pipe(
+            Effect.catchTag("LegacyConfigPushLoadConfigError", (error) =>
+              Effect.succeed(error.message),
+            ),
+          );
+          expect(message).toBe("failed to parse config: missing private key");
+          expect(api.requests).toHaveLength(0);
+        }).pipe(Effect.provide(layer)),
+      );
+    },
+  );
+
   it.live("pushes storage when enabled and changed", () => {
     const toml = `project_id = "test"
 [auth]
diff --git a/apps/cli/src/legacy/commands/db/advisors/advisors.command.ts b/apps/cli/src/legacy/commands/db/advisors/advisors.command.ts
index 628b98db8b..2a9e55fc24 100644
--- a/apps/cli/src/legacy/commands/db/advisors/advisors.command.ts
+++ b/apps/cli/src/legacy/commands/db/advisors/advisors.command.ts
@@ -46,10 +46,10 @@ export const legacyDbAdvisorsCommand = Command.make("advisors", config).pipe(
           level: flags.level,
           "fail-on": flags.failOn,
         },
-        // Go's changedFlagValues records every utils.EnumFlag verbatim
-        // (cmd/root_analytics.go:88-116). --db-url stays redacted (plain string,
-        // may carry secrets); --linked/--local are booleans (passed through).
-        safeFlags: ["type", "level", "fail-on"],
+        // type/level/fail-on are Flag.choice and are auto-detected as safe via
+        // `config` below (Go's isEnumFlag, cmd/root_analytics.go:110-116);
+        // --db-url stays redacted (plain string, may carry secrets).
+        config,
       }),
       withJsonErrorHandling,
     ),
diff --git a/apps/cli/src/legacy/commands/db/advisors/advisors.format.unit.test.ts b/apps/cli/src/legacy/commands/db/advisors/advisors.format.unit.test.ts
index ef64d7fdb4..e293152d44 100644
--- a/apps/cli/src/legacy/commands/db/advisors/advisors.format.unit.test.ts
+++ b/apps/cli/src/legacy/commands/db/advisors/advisors.format.unit.test.ts
@@ -385,4 +385,12 @@ describe("splitLegacyLintsSql", () => {
     expect(setup).toBe("set local search_path = ''");
     expect(query.startsWith("(")).toBe(true);
   });
+
+  it("defaults API-exposure lints to public when pgrst.db_schemas is unset", () => {
+    const [, query] = splitLegacyLintsSql();
+    expect(query).not.toContain("string_to_array(current_setting('pgrst.db_schemas', 't'), ',')");
+    expect(query).toContain(
+      "string_to_array(coalesce(current_setting('pgrst.db_schemas', 't'), 'public'), ',')",
+    );
+  });
 });
diff --git a/apps/cli/src/legacy/commands/db/advisors/advisors.lints-sql.ts b/apps/cli/src/legacy/commands/db/advisors/advisors.lints-sql.ts
index 97d8947c15..5cf4bfb06a 100644
--- a/apps/cli/src/legacy/commands/db/advisors/advisors.lints-sql.ts
+++ b/apps/cli/src/legacy/commands/db/advisors/advisors.lints-sql.ts
@@ -10,7 +10,7 @@
  * (`advisors.go:154-160`).
  */
 const LEGACY_ADVISORS_LINTS_SQL =
-  "set local search_path = '';\n\n(\nwith foreign_keys as (\n    select\n        cl.relnamespace::regnamespace::text as schema_name,\n        cl.relname as table_name,\n        cl.oid as table_oid,\n        ct.conname as fkey_name,\n        ct.conkey as col_attnums\n    from\n        pg_catalog.pg_constraint ct\n        join pg_catalog.pg_class cl -- fkey owning table\n            on ct.conrelid = cl.oid\n        left join pg_catalog.pg_depend d\n            on d.objid = cl.oid\n            and d.deptype = 'e'\n    where\n        ct.contype = 'f' -- foreign key constraints\n        and d.objid is null -- exclude tables that are dependencies of extensions\n        and cl.relnamespace::regnamespace::text not in (\n            'pg_catalog', 'information_schema', 'auth', 'storage', 'vault', 'extensions'\n        )\n),\nindex_ as (\n    select\n        pi.indrelid as table_oid,\n        indexrelid::regclass as index_,\n        string_to_array(indkey::text, ' ')::smallint[] as col_attnums\n    from\n        pg_catalog.pg_index pi\n    where\n        indisvalid\n)\nselect\n    'unindexed_foreign_keys' as name,\n    'Unindexed foreign keys' as title,\n    'INFO' as level,\n    'EXTERNAL' as facing,\n    array['PERFORMANCE'] as categories,\n    'Identifies foreign key constraints without a covering index, which can impact database performance.' as description,\n    format(\n        'Table `%s.%s` has a foreign key `%s` without a covering index. This can lead to suboptimal query performance.',\n        fk.schema_name,\n        fk.table_name,\n        fk.fkey_name\n    ) as detail,\n    'https://supabase.com/docs/guides/database/database-linter?lint=0001_unindexed_foreign_keys' as remediation,\n    jsonb_build_object(\n        'schema', fk.schema_name,\n        'name', fk.table_name,\n        'type', 'table',\n        'fkey_name', fk.fkey_name,\n        'fkey_columns', fk.col_attnums\n    ) as metadata,\n    format('unindexed_foreign_keys_%s_%s_%s', fk.schema_name, fk.table_name, fk.fkey_name) as cache_key\nfrom\n    foreign_keys fk\n    left join index_ idx\n        on fk.table_oid = idx.table_oid\n        and fk.col_attnums = idx.col_attnums[1:array_length(fk.col_attnums, 1)]\n    left join pg_catalog.pg_depend dep\n        on idx.table_oid = dep.objid\n        and dep.deptype = 'e'\nwhere\n    idx.index_ is null\n    and fk.schema_name not in (\n        '_timescaledb_cache', '_timescaledb_catalog', '_timescaledb_config', '_timescaledb_internal', 'auth', 'cron', 'extensions', 'graphql', 'graphql_public', 'information_schema', 'net', 'pgmq', 'pgroonga', 'pgsodium', 'pgsodium_masks', 'pgtle', 'pgbouncer', 'pg_catalog', 'pgtle', 'realtime', 'repack', 'storage', 'supabase_functions', 'supabase_migrations', 'tiger', 'topology', 'vault'\n    )\n    and dep.objid is null -- exclude tables owned by extensions\norder by\n    fk.schema_name,\n    fk.table_name,\n    fk.fkey_name)\nunion all\n(\nselect\n    'auth_users_exposed' as name,\n    'Exposed Auth Users' as title,\n    'ERROR' as level,\n    'EXTERNAL' as facing,\n    array['SECURITY'] as categories,\n    'Detects if auth.users is exposed to anon or authenticated roles via a view or materialized view in schemas exposed to PostgREST, potentially compromising user data security.' as description,\n    format(\n        'View/Materialized View \"%s\" in the public schema may expose `auth.users` data to anon or authenticated roles.',\n        c.relname\n    ) as detail,\n    'https://supabase.com/docs/guides/database/database-linter?lint=0002_auth_users_exposed' as remediation,\n    jsonb_build_object(\n        'schema', n.nspname,\n        'name', c.relname,\n        'type', 'view',\n        'exposed_to', array_remove(array_agg(DISTINCT case when pg_catalog.has_table_privilege('anon', c.oid, 'SELECT') then 'anon' when pg_catalog.has_table_privilege('authenticated', c.oid, 'SELECT') then 'authenticated' end), null)\n    ) as metadata,\n    format('auth_users_exposed_%s_%s', n.nspname, c.relname) as cache_key\nfrom\n    -- Identify the oid for auth.users\n    pg_catalog.pg_class auth_users_pg_class\n    join pg_catalog.pg_namespace auth_users_pg_namespace\n        on auth_users_pg_class.relnamespace = auth_users_pg_namespace.oid\n        and auth_users_pg_class.relname = 'users'\n        and auth_users_pg_namespace.nspname = 'auth'\n    -- Depends on auth.users\n    join pg_catalog.pg_depend d\n        on d.refobjid = auth_users_pg_class.oid\n    join pg_catalog.pg_rewrite r\n        on r.oid = d.objid\n    join pg_catalog.pg_class c\n        on c.oid = r.ev_class\n    join pg_catalog.pg_namespace n\n        on n.oid = c.relnamespace\n    join pg_catalog.pg_class pg_class_auth_users\n        on d.refobjid = pg_class_auth_users.oid\nwhere\n    d.deptype = 'n'\n    and (\n      pg_catalog.has_table_privilege('anon', c.oid, 'SELECT')\n      or pg_catalog.has_table_privilege('authenticated', c.oid, 'SELECT')\n    )\n    and n.nspname = any(array(select trim(unnest(string_to_array(current_setting('pgrst.db_schemas', 't'), ',')))))\n    -- Exclude self\n    and c.relname <> '0002_auth_users_exposed'\n    -- There are 3 insecure configurations\n    and\n    (\n        -- Materialized views don't support RLS so this is insecure by default\n        (c.relkind in ('m')) -- m for materialized view\n        or\n        -- Standard View, accessible to anon or authenticated that is security_definer\n        (\n            c.relkind = 'v' -- v for view\n            -- Exclude security invoker views\n            and not (\n                lower(coalesce(c.reloptions::text,'{}'))::text[]\n                && array[\n                    'security_invoker=1',\n                    'security_invoker=true',\n                    'security_invoker=yes',\n                    'security_invoker=on'\n                ]\n            )\n        )\n        or\n        -- Standard View, security invoker, but no RLS enabled on auth.users\n        (\n            c.relkind in ('v') -- v for view\n            -- is security invoker\n            and (\n                lower(coalesce(c.reloptions::text,'{}'))::text[]\n                && array[\n                    'security_invoker=1',\n                    'security_invoker=true',\n                    'security_invoker=yes',\n                    'security_invoker=on'\n                ]\n            )\n            and not pg_class_auth_users.relrowsecurity\n        )\n    )\ngroup by\n    n.nspname,\n    c.relname,\n    c.oid)\nunion all\n(\nwith policies as (\n    select\n        nsp.nspname as schema_name,\n        pb.tablename as table_name,\n        pc.relrowsecurity as is_rls_active,\n        polname as policy_name,\n        polpermissive as is_permissive, -- if not, then restrictive\n        (select array_agg(r::regrole) from unnest(polroles) as x(r)) as roles,\n        case polcmd\n            when 'r' then 'SELECT'\n            when 'a' then 'INSERT'\n            when 'w' then 'UPDATE'\n            when 'd' then 'DELETE'\n            when '*' then 'ALL'\n        end as command,\n        qual,\n        with_check\n    from\n        pg_catalog.pg_policy pa\n        join pg_catalog.pg_class pc\n            on pa.polrelid = pc.oid\n        join pg_catalog.pg_namespace nsp\n            on pc.relnamespace = nsp.oid\n        join pg_catalog.pg_policies pb\n            on pc.relname = pb.tablename\n            and nsp.nspname = pb.schemaname\n            and pa.polname = pb.policyname\n)\nselect\n    'auth_rls_initplan' as name,\n    'Auth RLS Initialization Plan' as title,\n    'WARN' as level,\n    'EXTERNAL' as facing,\n    array['PERFORMANCE'] as categories,\n    'Detects if calls to `current_setting()` and `auth.<function>()` in RLS policies are being unnecessarily re-evaluated for each row' as description,\n    format(\n        'Table `%s.%s` has a row level security policy `%s` that re-evaluates current_setting() or auth.<function>() for each row. This produces suboptimal query performance at scale. Resolve the issue by replacing `auth.<function>()` with `(select auth.<function>())`. See [docs](https://supabase.com/docs/guides/database/postgres/row-level-security#call-functions-with-select) for more info.',\n        schema_name,\n        table_name,\n        policy_name\n    ) as detail,\n    'https://supabase.com/docs/guides/database/database-linter?lint=0003_auth_rls_initplan' as remediation,\n    jsonb_build_object(\n        'schema', schema_name,\n        'name', table_name,\n        'type', 'table'\n    ) as metadata,\n    format('auth_rls_init_plan_%s_%s_%s', schema_name, table_name, policy_name) as cache_key\nfrom\n    policies\nwhere\n    is_rls_active\n    -- NOTE: does not include realtime in support of monitoring policies on realtime.messages\n    and schema_name not in (\n        '_timescaledb_cache', '_timescaledb_catalog', '_timescaledb_config', '_timescaledb_internal', 'auth', 'cron', 'extensions', 'graphql', 'graphql_public', 'information_schema', 'net', 'pgmq', 'pgroonga', 'pgsodium', 'pgsodium_masks', 'pgtle', 'pgbouncer', 'pg_catalog', 'pgtle', 'repack', 'storage', 'supabase_functions', 'supabase_migrations', 'tiger', 'topology', 'vault'\n    )\n    and (\n        -- Example: auth.uid()\n        (\n            qual like '%auth.uid()%'\n            and lower(qual) not like '%select auth.uid()%'\n        )\n        or (\n            qual like '%auth.jwt()%'\n            and lower(qual) not like '%select auth.jwt()%'\n        )\n        or (\n            qual like '%auth.role()%'\n            and lower(qual) not like '%select auth.role()%'\n        )\n        or (\n            qual like '%auth.email()%'\n            and lower(qual) not like '%select auth.email()%'\n        )\n        or (\n            qual like '%current\\_setting(%)%'\n            and lower(qual) not like '%select current\\_setting(%)%'\n        )\n        or (\n            with_check like '%auth.uid()%'\n            and lower(with_check) not like '%select auth.uid()%'\n        )\n        or (\n            with_check like '%auth.jwt()%'\n            and lower(with_check) not like '%select auth.jwt()%'\n        )\n        or (\n            with_check like '%auth.role()%'\n            and lower(with_check) not like '%select auth.role()%'\n        )\n        or (\n            with_check like '%auth.email()%'\n            and lower(with_check) not like '%select auth.email()%'\n        )\n        or (\n            with_check like '%current\\_setting(%)%'\n            and lower(with_check) not like '%select current\\_setting(%)%'\n        )\n    ))\nunion all\n(\nselect\n    'no_primary_key' as name,\n    'No Primary Key' as title,\n    'INFO' as level,\n    'EXTERNAL' as facing,\n    array['PERFORMANCE'] as categories,\n    'Detects if a table does not have a primary key. Tables without a primary key can be inefficient to interact with at scale.' as description,\n    format(\n        'Table `%s.%s` does not have a primary key',\n        pgns.nspname,\n        pgc.relname\n    ) as detail,\n    'https://supabase.com/docs/guides/database/database-linter?lint=0004_no_primary_key' as remediation,\n     jsonb_build_object(\n        'schema', pgns.nspname,\n        'name', pgc.relname,\n        'type', 'table'\n    ) as metadata,\n    format(\n        'no_primary_key_%s_%s',\n        pgns.nspname,\n        pgc.relname\n    ) as cache_key\nfrom\n    pg_catalog.pg_class pgc\n    join pg_catalog.pg_namespace pgns\n        on pgns.oid = pgc.relnamespace\n    left join pg_catalog.pg_index pgi\n        on pgi.indrelid = pgc.oid\n    left join pg_catalog.pg_depend dep\n        on pgc.oid = dep.objid\n        and dep.deptype = 'e'\nwhere\n    pgc.relkind = 'r' -- regular tables\n    and pgns.nspname not in (\n        '_timescaledb_cache', '_timescaledb_catalog', '_timescaledb_config', '_timescaledb_internal', 'auth', 'cron', 'extensions', 'graphql', 'graphql_public', 'information_schema', 'net', 'pgmq', 'pgroonga', 'pgsodium', 'pgsodium_masks', 'pgtle', 'pgbouncer', 'pg_catalog', 'pgtle', 'realtime', 'repack', 'storage', 'supabase_functions', 'supabase_migrations', 'tiger', 'topology', 'vault'\n    )\n    and dep.objid is null -- exclude tables owned by extensions\ngroup by\n    pgc.oid,\n    pgns.nspname,\n    pgc.relname\nhaving\n    max(coalesce(pgi.indisprimary, false)::int) = 0)\nunion all\n(\nselect\n    'unused_index' as name,\n    'Unused Index' as title,\n    'INFO' as level,\n    'EXTERNAL' as facing,\n    array['PERFORMANCE'] as categories,\n    'Detects if an index has never been used and may be a candidate for removal.' as description,\n    format(\n        'Index `%s` on table `%s.%s` has not been used',\n        psui.indexrelname,\n        psui.schemaname,\n        psui.relname\n    ) as detail,\n    'https://supabase.com/docs/guides/database/database-linter?lint=0005_unused_index' as remediation,\n    jsonb_build_object(\n        'schema', psui.schemaname,\n        'name', psui.relname,\n        'type', 'table'\n    ) as metadata,\n    format(\n        'unused_index_%s_%s_%s',\n        psui.schemaname,\n        psui.relname,\n        psui.indexrelname\n    ) as cache_key\n\nfrom\n    pg_catalog.pg_stat_user_indexes psui\n    join pg_catalog.pg_index pi\n        on psui.indexrelid = pi.indexrelid\n    left join pg_catalog.pg_depend dep\n        on psui.relid = dep.objid\n        and dep.deptype = 'e'\nwhere\n    psui.idx_scan = 0\n    and not pi.indisunique\n    and not pi.indisprimary\n    and dep.objid is null -- exclude tables owned by extensions\n    and psui.schemaname not in (\n        '_timescaledb_cache', '_timescaledb_catalog', '_timescaledb_config', '_timescaledb_internal', 'auth', 'cron', 'extensions', 'graphql', 'graphql_public', 'information_schema', 'net', 'pgmq', 'pgroonga', 'pgsodium', 'pgsodium_masks', 'pgtle', 'pgbouncer', 'pg_catalog', 'pgtle', 'realtime', 'repack', 'storage', 'supabase_functions', 'supabase_migrations', 'tiger', 'topology', 'vault'\n    ))\nunion all\n(\nselect\n    'multiple_permissive_policies' as name,\n    'Multiple Permissive Policies' as title,\n    'WARN' as level,\n    'EXTERNAL' as facing,\n    array['PERFORMANCE'] as categories,\n    'Detects if multiple permissive row level security policies are present on a table for the same `role` and `action` (e.g. insert). Multiple permissive policies are suboptimal for performance as each policy must be executed for every relevant query.' as description,\n    format(\n        'Table `%s.%s` has multiple permissive policies for role `%s` for action `%s`. Policies include `%s`',\n        n.nspname,\n        c.relname,\n        r.rolname,\n        act.cmd,\n        array_agg(p.polname order by p.polname)\n    ) as detail,\n    'https://supabase.com/docs/guides/database/database-linter?lint=0006_multiple_permissive_policies' as remediation,\n    jsonb_build_object(\n        'schema', n.nspname,\n        'name', c.relname,\n        'type', 'table'\n    ) as metadata,\n    format(\n        'multiple_permissive_policies_%s_%s_%s_%s',\n        n.nspname,\n        c.relname,\n        r.rolname,\n        act.cmd\n    ) as cache_key\nfrom\n    pg_catalog.pg_policy p\n    join pg_catalog.pg_class c\n        on p.polrelid = c.oid\n    join pg_catalog.pg_namespace n\n        on c.relnamespace = n.oid\n    join pg_catalog.pg_roles r\n        on p.polroles @> array[r.oid]\n        or p.polroles = array[0::oid]\n    left join pg_catalog.pg_depend dep\n        on c.oid = dep.objid\n        and dep.deptype = 'e',\n    lateral (\n        select x.cmd\n        from unnest((\n            select\n                case p.polcmd\n                    when 'r' then array['SELECT']\n                    when 'a' then array['INSERT']\n                    when 'w' then array['UPDATE']\n                    when 'd' then array['DELETE']\n                    when '*' then array['SELECT', 'INSERT', 'UPDATE', 'DELETE']\n                    else array['ERROR']\n                end as actions\n        )) x(cmd)\n    ) act(cmd)\nwhere\n    c.relkind = 'r' -- regular tables\n    and p.polpermissive -- policy is permissive\n    and n.nspname not in (\n        '_timescaledb_cache', '_timescaledb_catalog', '_timescaledb_config', '_timescaledb_internal', 'auth', 'cron', 'extensions', 'graphql', 'graphql_public', 'information_schema', 'net', 'pgmq', 'pgroonga', 'pgsodium', 'pgsodium_masks', 'pgtle', 'pgbouncer', 'pg_catalog', 'pgtle', 'realtime', 'repack', 'storage', 'supabase_functions', 'supabase_migrations', 'tiger', 'topology', 'vault'\n    )\n    and r.rolname not like 'pg_%'\n    and r.rolname not like 'supabase%admin'\n    and not r.rolbypassrls\n    and dep.objid is null -- exclude tables owned by extensions\ngroup by\n    n.nspname,\n    c.relname,\n    r.rolname,\n    act.cmd\nhaving\n    count(1) > 1)\nunion all\n(\nselect\n    'policy_exists_rls_disabled' as name,\n    'Policy Exists RLS Disabled' as title,\n    'ERROR' as level,\n    'EXTERNAL' as facing,\n    array['SECURITY'] as categories,\n    'Detects cases where row level security (RLS) policies have been created, but RLS has not been enabled for the underlying table.' as description,\n    format(\n        'Table `%s.%s` has RLS policies but RLS is not enabled on the table. Policies include %s.',\n        n.nspname,\n        c.relname,\n        array_agg(p.polname order by p.polname)\n    ) as detail,\n    'https://supabase.com/docs/guides/database/database-linter?lint=0007_policy_exists_rls_disabled' as remediation,\n    jsonb_build_object(\n        'schema', n.nspname,\n        'name', c.relname,\n        'type', 'table'\n    ) as metadata,\n    format(\n        'policy_exists_rls_disabled_%s_%s',\n        n.nspname,\n        c.relname\n    ) as cache_key\nfrom\n    pg_catalog.pg_policy p\n    join pg_catalog.pg_class c\n        on p.polrelid = c.oid\n    join pg_catalog.pg_namespace n\n        on c.relnamespace = n.oid\n    left join pg_catalog.pg_depend dep\n        on c.oid = dep.objid\n        and dep.deptype = 'e'\nwhere\n    c.relkind = 'r' -- regular tables\n    and n.nspname not in (\n        '_timescaledb_cache', '_timescaledb_catalog', '_timescaledb_config', '_timescaledb_internal', 'auth', 'cron', 'extensions', 'graphql', 'graphql_public', 'information_schema', 'net', 'pgmq', 'pgroonga', 'pgsodium', 'pgsodium_masks', 'pgtle', 'pgbouncer', 'pg_catalog', 'pgtle', 'realtime', 'repack', 'storage', 'supabase_functions', 'supabase_migrations', 'tiger', 'topology', 'vault'\n    )\n    -- RLS is disabled\n    and not c.relrowsecurity\n    and dep.objid is null -- exclude tables owned by extensions\ngroup by\n    n.nspname,\n    c.relname)\nunion all\n(\nselect\n    'rls_enabled_no_policy' as name,\n    'RLS Enabled No Policy' as title,\n    'INFO' as level,\n    'EXTERNAL' as facing,\n    array['SECURITY'] as categories,\n    'Detects cases where row level security (RLS) has been enabled on a table but no RLS policies have been created.' as description,\n    format(\n        'Table `%s.%s` has RLS enabled, but no policies exist',\n        n.nspname,\n        c.relname\n    ) as detail,\n    'https://supabase.com/docs/guides/database/database-linter?lint=0008_rls_enabled_no_policy' as remediation,\n    jsonb_build_object(\n        'schema', n.nspname,\n        'name', c.relname,\n        'type', 'table'\n    ) as metadata,\n    format(\n        'rls_enabled_no_policy_%s_%s',\n        n.nspname,\n        c.relname\n    ) as cache_key\nfrom\n    pg_catalog.pg_class c\n    left join pg_catalog.pg_policy p\n        on p.polrelid = c.oid\n    join pg_catalog.pg_namespace n\n        on c.relnamespace = n.oid\n    left join pg_catalog.pg_depend dep\n        on c.oid = dep.objid\n        and dep.deptype = 'e'\nwhere\n    c.relkind = 'r' -- regular tables\n    and n.nspname not in (\n        '_timescaledb_cache', '_timescaledb_catalog', '_timescaledb_config', '_timescaledb_internal', 'auth', 'cron', 'extensions', 'graphql', 'graphql_public', 'information_schema', 'net', 'pgmq', 'pgroonga', 'pgsodium', 'pgsodium_masks', 'pgtle', 'pgbouncer', 'pg_catalog', 'pgtle', 'realtime', 'repack', 'storage', 'supabase_functions', 'supabase_migrations', 'tiger', 'topology', 'vault'\n    )\n    -- RLS is enabled\n    and c.relrowsecurity\n    and p.polname is null\n    and dep.objid is null -- exclude tables owned by extensions\ngroup by\n    n.nspname,\n    c.relname)\nunion all\n(\nselect\n    'duplicate_index' as name,\n    'Duplicate Index' as title,\n    'WARN' as level,\n    'EXTERNAL' as facing,\n    array['PERFORMANCE'] as categories,\n    'Detects cases where two ore more identical indexes exist.' as description,\n    format(\n        'Table `%s.%s` has identical indexes %s. Drop all except one of them',\n        n.nspname,\n        c.relname,\n        array_agg(pi.indexname order by pi.indexname)\n    ) as detail,\n    'https://supabase.com/docs/guides/database/database-linter?lint=0009_duplicate_index' as remediation,\n    jsonb_build_object(\n        'schema', n.nspname,\n        'name', c.relname,\n        'type', case\n            when c.relkind = 'r' then 'table'\n            when c.relkind = 'm' then 'materialized view'\n            else 'ERROR'\n        end,\n        'indexes', array_agg(pi.indexname order by pi.indexname)\n    ) as metadata,\n    format(\n        'duplicate_index_%s_%s_%s',\n        n.nspname,\n        c.relname,\n        array_agg(pi.indexname order by pi.indexname)\n    ) as cache_key\nfrom\n    pg_catalog.pg_indexes pi\n    join pg_catalog.pg_namespace n\n        on n.nspname  = pi.schemaname\n    join pg_catalog.pg_class c\n        on pi.tablename = c.relname\n        and n.oid = c.relnamespace\n    left join pg_catalog.pg_depend dep\n        on c.oid = dep.objid\n        and dep.deptype = 'e'\nwhere\n    c.relkind in ('r', 'm') -- tables and materialized views\n    and n.nspname not in (\n        '_timescaledb_cache', '_timescaledb_catalog', '_timescaledb_config', '_timescaledb_internal', 'auth', 'cron', 'extensions', 'graphql', 'graphql_public', 'information_schema', 'net', 'pgmq', 'pgroonga', 'pgsodium', 'pgsodium_masks', 'pgtle', 'pgbouncer', 'pg_catalog', 'pgtle', 'realtime', 'repack', 'storage', 'supabase_functions', 'supabase_migrations', 'tiger', 'topology', 'vault'\n    )\n    and dep.objid is null -- exclude tables owned by extensions\ngroup by\n    n.nspname,\n    c.relkind,\n    c.relname,\n    replace(pi.indexdef, pi.indexname, '')\nhaving\n    count(*) > 1)\nunion all\n(\nselect\n    'security_definer_view' as name,\n    'Security Definer View' as title,\n    'ERROR' as level,\n    'EXTERNAL' as facing,\n    array['SECURITY'] as categories,\n    'Detects views defined with the SECURITY DEFINER property. These views enforce Postgres permissions and row level security policies (RLS) of the view creator, rather than that of the querying user' as description,\n    format(\n        'View `%s.%s` is defined with the SECURITY DEFINER property',\n        n.nspname,\n        c.relname\n    ) as detail,\n    'https://supabase.com/docs/guides/database/database-linter?lint=0010_security_definer_view' as remediation,\n    jsonb_build_object(\n        'schema', n.nspname,\n        'name', c.relname,\n        'type', 'view'\n    ) as metadata,\n    format(\n        'security_definer_view_%s_%s',\n        n.nspname,\n        c.relname\n    ) as cache_key\nfrom\n    pg_catalog.pg_class c\n    join pg_catalog.pg_namespace n\n        on n.oid = c.relnamespace\n    left join pg_catalog.pg_depend dep\n        on c.oid = dep.objid\n        and dep.deptype = 'e'\nwhere\n    c.relkind = 'v'\n    and (\n        pg_catalog.has_table_privilege('anon', c.oid, 'SELECT')\n        or pg_catalog.has_table_privilege('authenticated', c.oid, 'SELECT')\n    )\n    and substring(pg_catalog.version() from 'PostgreSQL ([0-9]+)') >= '15' -- security invoker was added in pg15\n    and n.nspname = any(array(select trim(unnest(string_to_array(current_setting('pgrst.db_schemas', 't'), ',')))))\n    and n.nspname not in (\n        '_timescaledb_cache', '_timescaledb_catalog', '_timescaledb_config', '_timescaledb_internal', 'auth', 'cron', 'extensions', 'graphql', 'graphql_public', 'information_schema', 'net', 'pgmq', 'pgroonga', 'pgsodium', 'pgsodium_masks', 'pgtle', 'pgbouncer', 'pg_catalog', 'pgtle', 'realtime', 'repack', 'storage', 'supabase_functions', 'supabase_migrations', 'tiger', 'topology', 'vault'\n    )\n    and dep.objid is null -- exclude views owned by extensions\n    and not (\n        lower(coalesce(c.reloptions::text,'{}'))::text[]\n        && array[\n            'security_invoker=1',\n            'security_invoker=true',\n            'security_invoker=yes',\n            'security_invoker=on'\n        ]\n    ))\nunion all\n(\nselect\n    'function_search_path_mutable' as name,\n    'Function Search Path Mutable' as title,\n    'WARN' as level,\n    'EXTERNAL' as facing,\n    array['SECURITY'] as categories,\n    'Detects functions where the search_path parameter is not set.' as description,\n    format(\n        'Function `%s.%s` has a role mutable search_path',\n        n.nspname,\n        p.proname\n    ) as detail,\n    'https://supabase.com/docs/guides/database/database-linter?lint=0011_function_search_path_mutable' as remediation,\n    jsonb_build_object(\n        'schema', n.nspname,\n        'name', p.proname,\n        'type', 'function'\n    ) as metadata,\n    format(\n        'function_search_path_mutable_%s_%s_%s',\n        n.nspname,\n        p.proname,\n        md5(p.prosrc) -- required when function is polymorphic\n    ) as cache_key\nfrom\n    pg_catalog.pg_proc p\n    join pg_catalog.pg_namespace n\n        on p.pronamespace = n.oid\n    left join pg_catalog.pg_depend dep\n        on p.oid = dep.objid\n        and dep.deptype = 'e'\nwhere\n    n.nspname not in (\n        '_timescaledb_cache', '_timescaledb_catalog', '_timescaledb_config', '_timescaledb_internal', 'auth', 'cron', 'extensions', 'graphql', 'graphql_public', 'information_schema', 'net', 'pgmq', 'pgroonga', 'pgsodium', 'pgsodium_masks', 'pgtle', 'pgbouncer', 'pg_catalog', 'pgtle', 'realtime', 'repack', 'storage', 'supabase_functions', 'supabase_migrations', 'tiger', 'topology', 'vault'\n    )\n    and dep.objid is null -- exclude functions owned by extensions\n    -- Search path not set\n    and not exists (\n        select 1\n        from unnest(coalesce(p.proconfig, '{}')) as config\n        where config like 'search_path=%'\n    ))\nunion all\n(\nselect\n    'rls_disabled_in_public' as name,\n    'RLS Disabled in Public' as title,\n    'ERROR' as level,\n    'EXTERNAL' as facing,\n    array['SECURITY'] as categories,\n    'Detects cases where row level security (RLS) has not been enabled on tables in schemas exposed to PostgREST' as description,\n    format(\n        'Table `%s.%s` is public, but RLS has not been enabled.',\n        n.nspname,\n        c.relname\n    ) as detail,\n    'https://supabase.com/docs/guides/database/database-linter?lint=0013_rls_disabled_in_public' as remediation,\n    jsonb_build_object(\n        'schema', n.nspname,\n        'name', c.relname,\n        'type', 'table'\n    ) as metadata,\n    format(\n        'rls_disabled_in_public_%s_%s',\n        n.nspname,\n        c.relname\n    ) as cache_key\nfrom\n    pg_catalog.pg_class c\n    join pg_catalog.pg_namespace n\n        on c.relnamespace = n.oid\nwhere\n    c.relkind = 'r' -- regular tables\n    -- RLS is disabled\n    and not c.relrowsecurity\n    and (\n        pg_catalog.has_table_privilege('anon', c.oid, 'SELECT')\n        or pg_catalog.has_table_privilege('authenticated', c.oid, 'SELECT')\n    )\n    and n.nspname = any(array(select trim(unnest(string_to_array(current_setting('pgrst.db_schemas', 't'), ',')))))\n    and n.nspname not in (\n        '_timescaledb_cache', '_timescaledb_catalog', '_timescaledb_config', '_timescaledb_internal', 'auth', 'cron', 'extensions', 'graphql', 'graphql_public', 'information_schema', 'net', 'pgmq', 'pgroonga', 'pgsodium', 'pgsodium_masks', 'pgtle', 'pgbouncer', 'pg_catalog', 'pgtle', 'realtime', 'repack', 'storage', 'supabase_functions', 'supabase_migrations', 'tiger', 'topology', 'vault'\n    ))\nunion all\n(\nselect\n    'extension_in_public' as name,\n    'Extension in Public' as title,\n    'WARN' as level,\n    'EXTERNAL' as facing,\n    array['SECURITY'] as categories,\n    'Detects extensions installed in the `public` schema.' as description,\n    format(\n        'Extension `%s` is installed in the public schema. Move it to another schema.',\n        pe.extname\n    ) as detail,\n    'https://supabase.com/docs/guides/database/database-linter?lint=0014_extension_in_public' as remediation,\n    jsonb_build_object(\n        'schema', pe.extnamespace::regnamespace,\n        'name', pe.extname,\n        'type', 'extension'\n    ) as metadata,\n    format(\n        'extension_in_public_%s',\n        pe.extname\n    ) as cache_key\nfrom\n    pg_catalog.pg_extension pe\nwhere\n    -- plpgsql is installed by default in public and outside user control\n    -- confirmed safe\n    pe.extname not in ('plpgsql')\n    -- Scoping this to public is not optimal. Ideally we would use the postgres\n    -- search path. That currently isn't available via SQL. In other lints\n    -- we have used has_schema_privilege('anon', 'extensions', 'USAGE') but that\n    -- is not appropriate here as it would evaluate true for the extensions schema\n    and pe.extnamespace::regnamespace::text = 'public')\nunion all\n(\nwith policies as (\n    select\n        nsp.nspname as schema_name,\n        pb.tablename as table_name,\n        polname as policy_name,\n        qual,\n        with_check\n    from\n        pg_catalog.pg_policy pa\n        join pg_catalog.pg_class pc\n            on pa.polrelid = pc.oid\n        join pg_catalog.pg_namespace nsp\n            on pc.relnamespace = nsp.oid\n        join pg_catalog.pg_policies pb\n            on pc.relname = pb.tablename\n            and nsp.nspname = pb.schemaname\n            and pa.polname = pb.policyname\n)\nselect\n    'rls_references_user_metadata' as name,\n    'RLS references user metadata' as title,\n    'ERROR' as level,\n    'EXTERNAL' as facing,\n    array['SECURITY'] as categories,\n    'Detects when Supabase Auth user_metadata is referenced insecurely in a row level security (RLS) policy.' as description,\n    format(\n        'Table `%s.%s` has a row level security policy `%s` that references Supabase Auth `user_metadata`. `user_metadata` is editable by end users and should never be used in a security context.',\n        schema_name,\n        table_name,\n        policy_name\n    ) as detail,\n    'https://supabase.com/docs/guides/database/database-linter?lint=0015_rls_references_user_metadata' as remediation,\n    jsonb_build_object(\n        'schema', schema_name,\n        'name', table_name,\n        'type', 'table'\n    ) as metadata,\n    format('rls_references_user_metadata_%s_%s_%s', schema_name, table_name, policy_name) as cache_key\nfrom\n    policies\nwhere\n    schema_name not in (\n        '_timescaledb_cache', '_timescaledb_catalog', '_timescaledb_config', '_timescaledb_internal', 'auth', 'cron', 'extensions', 'graphql', 'graphql_public', 'information_schema', 'net', 'pgmq', 'pgroonga', 'pgsodium', 'pgsodium_masks', 'pgtle', 'pgbouncer', 'pg_catalog', 'pgtle', 'realtime', 'repack', 'storage', 'supabase_functions', 'supabase_migrations', 'tiger', 'topology', 'vault'\n    )\n    and (\n        -- Example: auth.jwt() -> 'user_metadata'\n        -- False positives are possible, but it isn't practical to string match\n        -- If false positive rate is too high, this expression can iterate\n        qual like '%auth.jwt()%user_metadata%'\n        or qual like '%current_setting(%request.jwt.claims%)%user_metadata%'\n        or with_check like '%auth.jwt()%user_metadata%'\n        or with_check like '%current_setting(%request.jwt.claims%)%user_metadata%'\n    ))\nunion all\n(\nselect\n    'materialized_view_in_api' as name,\n    'Materialized View in API' as title,\n    'WARN' as level,\n    'EXTERNAL' as facing,\n    array['SECURITY'] as categories,\n    'Detects materialized views that are accessible over the Data APIs.' as description,\n    format(\n        'Materialized view `%s.%s` is selectable by anon or authenticated roles',\n        n.nspname,\n        c.relname\n    ) as detail,\n    'https://supabase.com/docs/guides/database/database-linter?lint=0016_materialized_view_in_api' as remediation,\n    jsonb_build_object(\n        'schema', n.nspname,\n        'name', c.relname,\n        'type', 'materialized view'\n    ) as metadata,\n    format(\n        'materialized_view_in_api_%s_%s',\n        n.nspname,\n        c.relname\n    ) as cache_key\nfrom\n    pg_catalog.pg_class c\n    join pg_catalog.pg_namespace n\n        on n.oid = c.relnamespace\n    left join pg_catalog.pg_depend dep\n        on c.oid = dep.objid\n        and dep.deptype = 'e'\nwhere\n    c.relkind = 'm'\n    and (\n        pg_catalog.has_table_privilege('anon', c.oid, 'SELECT')\n        or pg_catalog.has_table_privilege('authenticated', c.oid, 'SELECT')\n    )\n    and n.nspname = any(array(select trim(unnest(string_to_array(current_setting('pgrst.db_schemas', 't'), ',')))))\n    and n.nspname not in (\n        '_timescaledb_cache', '_timescaledb_catalog', '_timescaledb_config', '_timescaledb_internal', 'auth', 'cron', 'extensions', 'graphql', 'graphql_public', 'information_schema', 'net', 'pgmq', 'pgroonga', 'pgsodium', 'pgsodium_masks', 'pgtle', 'pgbouncer', 'pg_catalog', 'pgtle', 'realtime', 'repack', 'storage', 'supabase_functions', 'supabase_migrations', 'tiger', 'topology', 'vault'\n    )\n    and dep.objid is null)\nunion all\n(\nselect\n    'foreign_table_in_api' as name,\n    'Foreign Table in API' as title,\n    'WARN' as level,\n    'EXTERNAL' as facing,\n    array['SECURITY'] as categories,\n    'Detects foreign tables that are accessible over APIs. Foreign tables do not respect row level security policies.' as description,\n    format(\n        'Foreign table `%s.%s` is accessible over APIs',\n        n.nspname,\n        c.relname\n    ) as detail,\n    'https://supabase.com/docs/guides/database/database-linter?lint=0017_foreign_table_in_api' as remediation,\n    jsonb_build_object(\n        'schema', n.nspname,\n        'name', c.relname,\n        'type', 'foreign table'\n    ) as metadata,\n    format(\n        'foreign_table_in_api_%s_%s',\n        n.nspname,\n        c.relname\n    ) as cache_key\nfrom\n    pg_catalog.pg_class c\n    join pg_catalog.pg_namespace n\n        on n.oid = c.relnamespace\n    left join pg_catalog.pg_depend dep\n        on c.oid = dep.objid\n        and dep.deptype = 'e'\nwhere\n    c.relkind = 'f'\n    and (\n        pg_catalog.has_table_privilege('anon', c.oid, 'SELECT')\n        or pg_catalog.has_table_privilege('authenticated', c.oid, 'SELECT')\n    )\n    and n.nspname = any(array(select trim(unnest(string_to_array(current_setting('pgrst.db_schemas', 't'), ',')))))\n    and n.nspname not in (\n        '_timescaledb_cache', '_timescaledb_catalog', '_timescaledb_config', '_timescaledb_internal', 'auth', 'cron', 'extensions', 'graphql', 'graphql_public', 'information_schema', 'net', 'pgmq', 'pgroonga', 'pgsodium', 'pgsodium_masks', 'pgtle', 'pgbouncer', 'pg_catalog', 'pgtle', 'realtime', 'repack', 'storage', 'supabase_functions', 'supabase_migrations', 'tiger', 'topology', 'vault'\n    )\n    and dep.objid is null)\nunion all\n(\nselect\n    'unsupported_reg_types' as name,\n    'Unsupported reg types' as title,\n    'WARN' as level,\n    'EXTERNAL' as facing,\n    array['SECURITY'] as categories,\n    'Identifies columns using unsupported reg* types outside pg_catalog schema, which prevents database upgrades using pg_upgrade.' as description,\n    format(\n        'Table `%s.%s` has a column `%s` with unsupported reg* type `%s`.',\n        n.nspname,\n        c.relname,\n        a.attname,\n        t.typname\n    ) as detail,\n    'https://supabase.com/docs/guides/database/database-linter?lint=unsupported_reg_types' as remediation,\n    jsonb_build_object(\n        'schema', n.nspname,\n        'name', c.relname,\n        'column', a.attname,\n        'type', 'table'\n    ) as metadata,\n    format(\n        'unsupported_reg_types_%s_%s_%s',\n        n.nspname,\n        c.relname,\n        a.attname\n    ) AS cache_key\nfrom\n    pg_catalog.pg_attribute a\n    join pg_catalog.pg_class c\n        on a.attrelid = c.oid\n    join pg_catalog.pg_namespace n\n        on c.relnamespace = n.oid\n    join pg_catalog.pg_type t\n        on a.atttypid = t.oid\n    join pg_catalog.pg_namespace tn\n        on t.typnamespace = tn.oid\nwhere\n    tn.nspname = 'pg_catalog'\n    and t.typname in ('regcollation', 'regconfig', 'regdictionary', 'regnamespace', 'regoper', 'regoperator', 'regproc', 'regprocedure')\n    and n.nspname not in ('pg_catalog', 'information_schema', 'pgsodium'))\nunion all\n(\nselect\n    'insecure_queue_exposed_in_api' as name,\n    'Insecure Queue Exposed in API' as title,\n    'ERROR' as level,\n    'EXTERNAL' as facing,\n    array['SECURITY'] as categories,\n    'Detects cases where an insecure Queue is exposed over Data APIs' as description,\n    format(\n        'Table `%s.%s` is public, but RLS has not been enabled.',\n        n.nspname,\n        c.relname\n    ) as detail,\n    'https://supabase.com/docs/guides/database/database-linter?lint=0019_insecure_queue_exposed_in_api' as remediation,\n    jsonb_build_object(\n        'schema', n.nspname,\n        'name', c.relname,\n        'type', 'table'\n    ) as metadata,\n    format(\n        'rls_disabled_in_public_%s_%s',\n        n.nspname,\n        c.relname\n    ) as cache_key\nfrom\n    pg_catalog.pg_class c\n    join pg_catalog.pg_namespace n\n        on c.relnamespace = n.oid\nwhere\n    c.relkind in ('r', 'I') -- regular or partitioned tables\n    and not c.relrowsecurity -- RLS is disabled\n    and (\n        pg_catalog.has_table_privilege('anon', c.oid, 'SELECT')\n        or pg_catalog.has_table_privilege('authenticated', c.oid, 'SELECT')\n    )\n    and n.nspname = 'pgmq' -- tables in the pgmq schema\n    and c.relname like 'q_%' -- only queue tables\n    -- Constant requirements\n    and 'pgmq_public' = any(array(select trim(unnest(string_to_array(current_setting('pgrst.db_schemas', 't'), ','))))))\nunion all\n(\nwith constants as (\n    select current_setting('block_size')::numeric as bs, 23 as hdr, 4 as ma\n),\n\nbloat_info as (\n    select\n        ma,\n        bs,\n        schemaname,\n        tablename,\n        (datawidth + (hdr + ma - (case when hdr % ma = 0 then ma else hdr % ma end)))::numeric as datahdr,\n        (maxfracsum * (nullhdr + ma - (case when nullhdr % ma = 0 then ma else nullhdr % ma end))) as nullhdr2\n    from (\n        select\n            schemaname,\n            tablename,\n            hdr,\n            ma,\n            bs,\n            sum((1 - null_frac) * avg_width) as datawidth,\n            max(null_frac) as maxfracsum,\n            hdr + (\n                select 1 + count(*) / 8\n                from pg_stats s2\n                where\n                    null_frac <> 0\n                    and s2.schemaname = s.schemaname\n                    and s2.tablename = s.tablename\n            ) as nullhdr\n        from pg_stats s, constants\n        group by 1, 2, 3, 4, 5\n    ) as foo\n),\n\ntable_bloat as (\n    select\n        schemaname,\n        tablename,\n        cc.relpages,\n        bs,\n        ceil((cc.reltuples * ((datahdr + ma -\n          (case when datahdr % ma = 0 then ma else datahdr % ma end)) + nullhdr2 + 4)) / (bs - 20::float)) as otta\n    from\n        bloat_info\n        join pg_class cc\n            on cc.relname = bloat_info.tablename\n        join pg_namespace nn\n            on cc.relnamespace = nn.oid\n            and nn.nspname = bloat_info.schemaname\n            and nn.nspname <> 'information_schema'\n        where\n            cc.relkind = 'r'\n            and cc.relam = (select oid from pg_am where amname = 'heap')\n),\n\nbloat_data as (\n    select\n        'table' as type,\n        schemaname,\n        tablename as object_name,\n        round(case when otta = 0 then 0.0 else table_bloat.relpages / otta::numeric end, 1) as bloat,\n        case when relpages < otta then 0 else (bs * (table_bloat.relpages - otta)::bigint)::bigint end as raw_waste\n    from\n        table_bloat\n)\n\nselect\n    'table_bloat' as name,\n    'Table Bloat' as title,\n    'INFO' as level,\n    'EXTERNAL' as facing,\n    array['PERFORMANCE'] as categories,\n    'Detects if a table has excess bloat and may benefit from maintenance operations like vacuum full or cluster.' as description,\n    format(\n        'Table `%s`.`%s` has excessive bloat',\n        bloat_data.schemaname,\n        bloat_data.object_name\n    ) as detail,\n    'Consider running vacuum full (WARNING: incurs downtime) and tweaking autovacuum settings to reduce bloat.' as remediation,\n    jsonb_build_object(\n        'schema', bloat_data.schemaname,\n        'name', bloat_data.object_name,\n        'type', bloat_data.type\n    ) as metadata,\n    format(\n        'table_bloat_%s_%s',\n        bloat_data.schemaname,\n        bloat_data.object_name\n    ) as cache_key\nfrom\n    bloat_data\nwhere\n    bloat > 70.0\n    and raw_waste > (20 * 1024 * 1024) -- filter for waste > 200 MB\norder by\n    schemaname,\n    object_name)\nunion all\n(\nselect\n    'fkey_to_auth_unique' as name,\n    'Foreign Key to Auth Unique Constraint' as title,\n    'ERROR' as level,\n    'EXTERNAL' as facing,\n    array['SECURITY'] as categories,\n    'Detects user defined foreign keys to unique constraints in the auth schema.' as description,\n    format(\n        'Table `%s`.`%s` has a foreign key `%s` referencing an auth unique constraint',\n        n.nspname, -- referencing schema\n        c_rel.relname, -- referencing table\n        c.conname -- fkey name\n    ) as detail,\n    'Drop the foreign key constraint that references the auth schema.' as remediation,\n    jsonb_build_object(\n        'schema', n.nspname,\n        'name', c_rel.relname,\n        'foreign_key', c.conname\n    ) as metadata,\n    format(\n        'fkey_to_auth_unique_%s_%s_%s',\n        n.nspname, -- referencing schema\n        c_rel.relname, -- referencing table\n        c.conname\n    ) as cache_key\nfrom\n    pg_catalog.pg_constraint c\n    join pg_catalog.pg_class c_rel\n        on c.conrelid = c_rel.oid\n    join pg_catalog.pg_namespace n\n        on c_rel.relnamespace = n.oid\n    join pg_catalog.pg_class ref_rel\n        on c.confrelid = ref_rel.oid\n    join pg_catalog.pg_namespace cn\n        on ref_rel.relnamespace = cn.oid\n    join pg_catalog.pg_index i\n        on c.conindid = i.indexrelid\nwhere c.contype = 'f'\n    and cn.nspname = 'auth'\n    and i.indisunique\n    and not i.indisprimary)\nunion all\n(\nselect\n    'extension_versions_outdated' as name,\n    'Extension Versions Outdated' as title,\n    'WARN' as level,\n    'EXTERNAL' as facing,\n    array['SECURITY'] as categories,\n    'Detects extensions that are not using the default (recommended) version.' as description,\n    format(\n        'Extension `%s` is using version `%s` but version `%s` is available. Using outdated extension versions may expose the database to security vulnerabilities.',\n        ext.name,\n        ext.installed_version,\n        ext.default_version\n    ) as detail,\n    'https://supabase.com/docs/guides/database/database-linter?lint=0022_extension_versions_outdated' as remediation,\n    jsonb_build_object(\n        'extension_name', ext.name,\n        'installed_version', ext.installed_version,\n        'default_version', ext.default_version\n    ) as metadata,\n    format(\n        'extension_versions_outdated_%s_%s',\n        ext.name,\n        ext.installed_version\n    ) as cache_key\nfrom\n    pg_catalog.pg_available_extensions ext\njoin\n    -- ignore versions not in pg_available_extension_versions\n    -- e.g. residue of pg_upgrade\n    pg_catalog.pg_available_extension_versions extv\n    on extv.name = ext.name and extv.installed\nwhere\n    ext.installed_version is not null\n    and ext.default_version is not null\n    and ext.installed_version != ext.default_version\norder by\n    ext.name)\nunion all\n(\n-- Detects tables exposed via API that contain columns with sensitive names\n-- Inspired by patterns from security scanners that detect PII/credential exposure\nwith sensitive_patterns as (\n    select unnest(array[\n        -- Authentication & Credentials\n        'password', 'passwd', 'pwd', 'passphrase',\n        'secret', 'secret_key', 'private_key', 'api_key', 'apikey',\n        'auth_key', 'token', 'jwt', 'access_token', 'refresh_token',\n        'oauth_token', 'session_token', 'bearer_token', 'auth_code',\n        'session_id', 'session_key', 'session_secret',\n        'recovery_code', 'backup_code', 'verification_code',\n        'otp', 'two_factor', '2fa_secret', '2fa_code',\n        -- Personal Identifiers\n        'ssn', 'social_security', 'social_security_number',\n        'driver_license', 'drivers_license', 'license_number',\n        'passport_number', 'passport_id', 'national_id', 'tax_id',\n        -- Financial Information\n        'credit_card', 'card_number', 'cvv', 'cvc', 'cvn',\n        'bank_account', 'account_number', 'routing_number',\n        'iban', 'swift_code', 'bic',\n        -- Health & Medical\n        'health_record', 'medical_record', 'patient_id',\n        'insurance_number', 'health_insurance', 'medical_insurance',\n        'treatment',\n        -- Device Identifiers\n        'mac_address', 'macaddr', 'imei', 'device_uuid',\n        -- Digital Keys & Certificates\n        'pgp_key', 'gpg_key', 'ssh_key', 'certificate',\n        'license_key', 'activation_key',\n        -- Biometric Data\n        'facial_recognition'\n    ]) as pattern\n),\nexposed_tables as (\n    select\n        n.nspname as schema_name,\n        c.relname as table_name,\n        c.oid as table_oid\n    from\n        pg_catalog.pg_class c\n        join pg_catalog.pg_namespace n\n            on c.relnamespace = n.oid\n    where\n        c.relkind = 'r' -- regular tables\n        and (\n            pg_catalog.has_table_privilege('anon', c.oid, 'SELECT')\n            or pg_catalog.has_table_privilege('authenticated', c.oid, 'SELECT')\n        )\n        and n.nspname = any(array(select trim(unnest(string_to_array(current_setting('pgrst.db_schemas', 't'), ',')))))\n        and n.nspname not in (\n            '_timescaledb_cache', '_timescaledb_catalog', '_timescaledb_config', '_timescaledb_internal', 'auth', 'cron', 'extensions', 'graphql', 'graphql_public', 'information_schema', 'net', 'pgmq', 'pgroonga', 'pgsodium', 'pgsodium_masks', 'pgtle', 'pgbouncer', 'pg_catalog', 'pgtle', 'realtime', 'repack', 'storage', 'supabase_functions', 'supabase_migrations', 'tiger', 'topology', 'vault'\n        )\n        -- Only flag tables without RLS enabled\n        and not c.relrowsecurity\n),\nsensitive_columns as (\n    select\n        et.schema_name,\n        et.table_name,\n        a.attname as column_name,\n        sp.pattern as matched_pattern\n    from\n        exposed_tables et\n        join pg_catalog.pg_attribute a\n            on a.attrelid = et.table_oid\n            and a.attnum > 0\n            and not a.attisdropped\n        cross join sensitive_patterns sp\n    where\n        -- Match column name against sensitive patterns (case insensitive), allowing '-'/'_' variants\n        replace(lower(a.attname), '-', '_') = sp.pattern\n)\nselect\n    'sensitive_columns_exposed' as name,\n    'Sensitive Columns Exposed' as title,\n    'ERROR' as level,\n    'EXTERNAL' as facing,\n    array['SECURITY'] as categories,\n    'Detects tables exposed via API that contain columns with potentially sensitive data (PII, credentials, financial info) without RLS protection.' as description,\n    format(\n        'Table `%s.%s` is exposed via API without RLS and contains potentially sensitive column(s): %s. This may lead to data exposure.',\n        schema_name,\n        table_name,\n        string_agg(distinct column_name, ', ' order by column_name)\n    ) as detail,\n    'https://supabase.com/docs/guides/database/database-linter?lint=0023_sensitive_columns_exposed' as remediation,\n    jsonb_build_object(\n        'schema', schema_name,\n        'name', table_name,\n        'type', 'table',\n        'sensitive_columns', array_agg(distinct column_name order by column_name),\n        'matched_patterns', array_agg(distinct matched_pattern order by matched_pattern)\n    ) as metadata,\n    format(\n        'sensitive_columns_exposed_%s_%s',\n        schema_name,\n        table_name\n    ) as cache_key\nfrom\n    sensitive_columns\ngroup by\n    schema_name,\n    table_name\norder by\n    schema_name,\n    table_name)\nunion all\n(\n-- Detects RLS policies that are overly permissive (e.g., USING (true), USING (1=1))\n-- These policies effectively disable row-level security while giving a false sense of security\nwith policies as (\n    select\n        nsp.nspname as schema_name,\n        pb.tablename as table_name,\n        pc.relrowsecurity as is_rls_active,\n        pa.polname as policy_name,\n        pa.polpermissive as is_permissive,\n        pa.polroles as role_oids,\n        (select array_agg(r::regrole::text) from unnest(pa.polroles) as x(r)) as roles,\n        case pa.polcmd\n            when 'r' then 'SELECT'\n            when 'a' then 'INSERT'\n            when 'w' then 'UPDATE'\n            when 'd' then 'DELETE'\n            when '*' then 'ALL'\n        end as command,\n        pb.qual,\n        pb.with_check,\n        -- Normalize expressions by removing whitespace and lowercasing\n        replace(replace(replace(lower(coalesce(pb.qual, '')), ' ', ''), E'\\n', ''), E'\\t', '') as normalized_qual,\n        replace(replace(replace(lower(coalesce(pb.with_check, '')), ' ', ''), E'\\n', ''), E'\\t', '') as normalized_with_check\n    from\n        pg_catalog.pg_policy pa\n        join pg_catalog.pg_class pc\n            on pa.polrelid = pc.oid\n        join pg_catalog.pg_namespace nsp\n            on pc.relnamespace = nsp.oid\n        join pg_catalog.pg_policies pb\n            on pc.relname = pb.tablename\n            and nsp.nspname = pb.schemaname\n            and pa.polname = pb.policyname\n    where\n        pc.relkind = 'r' -- regular tables\n        and nsp.nspname not in (\n            '_timescaledb_cache', '_timescaledb_catalog', '_timescaledb_config', '_timescaledb_internal', 'auth', 'cron', 'extensions', 'graphql', 'graphql_public', 'information_schema', 'net', 'pgmq', 'pgroonga', 'pgsodium', 'pgsodium_masks', 'pgtle', 'pgbouncer', 'pg_catalog', 'pgtle', 'realtime', 'repack', 'storage', 'supabase_functions', 'supabase_migrations', 'tiger', 'topology', 'vault'\n        )\n),\npermissive_patterns as (\n    select\n        p.*,\n        -- Check for always-true USING clause patterns\n        -- Note: SELECT with (true) is often intentional and documented, so we only flag UPDATE/DELETE\n        case when (\n            command in ('UPDATE', 'DELETE', 'ALL')\n            and (\n                normalized_qual in ('true', '(true)', '1=1', '(1=1)')\n                -- Empty or null qual on permissive policy means allow all\n                or (qual is null and is_permissive)\n            )\n        ) then true else false end as has_permissive_using,\n        -- Check for always-true WITH CHECK clause patterns\n        case when (\n            normalized_with_check in ('true', '(true)', '1=1', '(1=1)')\n            -- Empty with_check on INSERT means allow all (INSERT has no USING to fall back on)\n            or (with_check is null and is_permissive and command = 'INSERT')\n            -- Empty with_check on UPDATE/ALL with permissive USING means allow all writes\n            or (with_check is null and is_permissive and command in ('UPDATE', 'ALL')\n                and normalized_qual in ('true', '(true)', '1=1', '(1=1)'))\n        ) then true else false end as has_permissive_with_check\n    from\n        policies p\n    where\n        -- Only check tables with RLS enabled (otherwise it's a different lint)\n        is_rls_active\n        -- Only check permissive policies (restrictive policies with true are less dangerous)\n        and is_permissive\n        -- Only flag policies that apply to anon or authenticated roles (or public/all roles)\n        and (\n            role_oids = array[0::oid] -- public (all roles)\n            or exists (\n                select 1\n                from unnest(role_oids) as r\n                where r::regrole::text in ('anon', 'authenticated')\n            )\n        )\n)\nselect\n    'rls_policy_always_true' as name,\n    'RLS Policy Always True' as title,\n    'WARN' as level,\n    'EXTERNAL' as facing,\n    array['SECURITY'] as categories,\n    'Detects RLS policies that use overly permissive expressions like `USING (true)` or `WITH CHECK (true)` for UPDATE, DELETE, or INSERT operations. SELECT policies with `USING (true)` are intentionally excluded as this pattern is often used deliberately for public read access.' as description,\n    format(\n        'Table `%s.%s` has an RLS policy `%s` for `%s` that allows unrestricted access%s. This effectively bypasses row-level security for %s.',\n        schema_name,\n        table_name,\n        policy_name,\n        command,\n        case\n            when has_permissive_using and has_permissive_with_check then ' (both USING and WITH CHECK are always true)'\n            when has_permissive_using then ' (USING clause is always true)'\n            when has_permissive_with_check then ' (WITH CHECK clause is always true)'\n            else ''\n        end,\n        array_to_string(roles, ', ')\n    ) as detail,\n    'https://supabase.com/docs/guides/database/database-linter?lint=0024_permissive_rls_policy' as remediation,\n    jsonb_build_object(\n        'schema', schema_name,\n        'name', table_name,\n        'type', 'table',\n        'policy_name', policy_name,\n        'command', command,\n        'roles', roles,\n        'qual', qual,\n        'with_check', with_check,\n        'permissive_using', has_permissive_using,\n        'permissive_with_check', has_permissive_with_check\n    ) as metadata,\n    format(\n        'rls_policy_always_true_%s_%s_%s',\n        schema_name,\n        table_name,\n        policy_name\n    ) as cache_key\nfrom\n    permissive_patterns\nwhere\n    has_permissive_using or has_permissive_with_check\norder by\n    schema_name,\n    table_name,\n    policy_name)";
+  "set local search_path = '';\n\n(\nwith foreign_keys as (\n    select\n        cl.relnamespace::regnamespace::text as schema_name,\n        cl.relname as table_name,\n        cl.oid as table_oid,\n        ct.conname as fkey_name,\n        ct.conkey as col_attnums\n    from\n        pg_catalog.pg_constraint ct\n        join pg_catalog.pg_class cl -- fkey owning table\n            on ct.conrelid = cl.oid\n        left join pg_catalog.pg_depend d\n            on d.objid = cl.oid\n            and d.deptype = 'e'\n    where\n        ct.contype = 'f' -- foreign key constraints\n        and d.objid is null -- exclude tables that are dependencies of extensions\n        and cl.relnamespace::regnamespace::text not in (\n            'pg_catalog', 'information_schema', 'auth', 'storage', 'vault', 'extensions'\n        )\n),\nindex_ as (\n    select\n        pi.indrelid as table_oid,\n        indexrelid::regclass as index_,\n        string_to_array(indkey::text, ' ')::smallint[] as col_attnums\n    from\n        pg_catalog.pg_index pi\n    where\n        indisvalid\n)\nselect\n    'unindexed_foreign_keys' as name,\n    'Unindexed foreign keys' as title,\n    'INFO' as level,\n    'EXTERNAL' as facing,\n    array['PERFORMANCE'] as categories,\n    'Identifies foreign key constraints without a covering index, which can impact database performance.' as description,\n    format(\n        'Table `%s.%s` has a foreign key `%s` without a covering index. This can lead to suboptimal query performance.',\n        fk.schema_name,\n        fk.table_name,\n        fk.fkey_name\n    ) as detail,\n    'https://supabase.com/docs/guides/database/database-linter?lint=0001_unindexed_foreign_keys' as remediation,\n    jsonb_build_object(\n        'schema', fk.schema_name,\n        'name', fk.table_name,\n        'type', 'table',\n        'fkey_name', fk.fkey_name,\n        'fkey_columns', fk.col_attnums\n    ) as metadata,\n    format('unindexed_foreign_keys_%s_%s_%s', fk.schema_name, fk.table_name, fk.fkey_name) as cache_key\nfrom\n    foreign_keys fk\n    left join index_ idx\n        on fk.table_oid = idx.table_oid\n        and fk.col_attnums = idx.col_attnums[1:array_length(fk.col_attnums, 1)]\n    left join pg_catalog.pg_depend dep\n        on idx.table_oid = dep.objid\n        and dep.deptype = 'e'\nwhere\n    idx.index_ is null\n    and fk.schema_name not in (\n        '_timescaledb_cache', '_timescaledb_catalog', '_timescaledb_config', '_timescaledb_internal', 'auth', 'cron', 'extensions', 'graphql', 'graphql_public', 'information_schema', 'net', 'pgmq', 'pgroonga', 'pgsodium', 'pgsodium_masks', 'pgtle', 'pgbouncer', 'pg_catalog', 'pgtle', 'realtime', 'repack', 'storage', 'supabase_functions', 'supabase_migrations', 'tiger', 'topology', 'vault'\n    )\n    and dep.objid is null -- exclude tables owned by extensions\norder by\n    fk.schema_name,\n    fk.table_name,\n    fk.fkey_name)\nunion all\n(\nselect\n    'auth_users_exposed' as name,\n    'Exposed Auth Users' as title,\n    'ERROR' as level,\n    'EXTERNAL' as facing,\n    array['SECURITY'] as categories,\n    'Detects if auth.users is exposed to anon or authenticated roles via a view or materialized view in schemas exposed to PostgREST, potentially compromising user data security.' as description,\n    format(\n        'View/Materialized View \"%s\" in the public schema may expose `auth.users` data to anon or authenticated roles.',\n        c.relname\n    ) as detail,\n    'https://supabase.com/docs/guides/database/database-linter?lint=0002_auth_users_exposed' as remediation,\n    jsonb_build_object(\n        'schema', n.nspname,\n        'name', c.relname,\n        'type', 'view',\n        'exposed_to', array_remove(array_agg(DISTINCT case when pg_catalog.has_table_privilege('anon', c.oid, 'SELECT') then 'anon' when pg_catalog.has_table_privilege('authenticated', c.oid, 'SELECT') then 'authenticated' end), null)\n    ) as metadata,\n    format('auth_users_exposed_%s_%s', n.nspname, c.relname) as cache_key\nfrom\n    -- Identify the oid for auth.users\n    pg_catalog.pg_class auth_users_pg_class\n    join pg_catalog.pg_namespace auth_users_pg_namespace\n        on auth_users_pg_class.relnamespace = auth_users_pg_namespace.oid\n        and auth_users_pg_class.relname = 'users'\n        and auth_users_pg_namespace.nspname = 'auth'\n    -- Depends on auth.users\n    join pg_catalog.pg_depend d\n        on d.refobjid = auth_users_pg_class.oid\n    join pg_catalog.pg_rewrite r\n        on r.oid = d.objid\n    join pg_catalog.pg_class c\n        on c.oid = r.ev_class\n    join pg_catalog.pg_namespace n\n        on n.oid = c.relnamespace\n    join pg_catalog.pg_class pg_class_auth_users\n        on d.refobjid = pg_class_auth_users.oid\nwhere\n    d.deptype = 'n'\n    and (\n      pg_catalog.has_table_privilege('anon', c.oid, 'SELECT')\n      or pg_catalog.has_table_privilege('authenticated', c.oid, 'SELECT')\n    )\n    and n.nspname = any(array(select trim(unnest(string_to_array(coalesce(current_setting('pgrst.db_schemas', 't'), 'public'), ',')))))\n    -- Exclude self\n    and c.relname <> '0002_auth_users_exposed'\n    -- There are 3 insecure configurations\n    and\n    (\n        -- Materialized views don't support RLS so this is insecure by default\n        (c.relkind in ('m')) -- m for materialized view\n        or\n        -- Standard View, accessible to anon or authenticated that is security_definer\n        (\n            c.relkind = 'v' -- v for view\n            -- Exclude security invoker views\n            and not (\n                lower(coalesce(c.reloptions::text,'{}'))::text[]\n                && array[\n                    'security_invoker=1',\n                    'security_invoker=true',\n                    'security_invoker=yes',\n                    'security_invoker=on'\n                ]\n            )\n        )\n        or\n        -- Standard View, security invoker, but no RLS enabled on auth.users\n        (\n            c.relkind in ('v') -- v for view\n            -- is security invoker\n            and (\n                lower(coalesce(c.reloptions::text,'{}'))::text[]\n                && array[\n                    'security_invoker=1',\n                    'security_invoker=true',\n                    'security_invoker=yes',\n                    'security_invoker=on'\n                ]\n            )\n            and not pg_class_auth_users.relrowsecurity\n        )\n    )\ngroup by\n    n.nspname,\n    c.relname,\n    c.oid)\nunion all\n(\nwith policies as (\n    select\n        nsp.nspname as schema_name,\n        pb.tablename as table_name,\n        pc.relrowsecurity as is_rls_active,\n        polname as policy_name,\n        polpermissive as is_permissive, -- if not, then restrictive\n        (select array_agg(r::regrole) from unnest(polroles) as x(r)) as roles,\n        case polcmd\n            when 'r' then 'SELECT'\n            when 'a' then 'INSERT'\n            when 'w' then 'UPDATE'\n            when 'd' then 'DELETE'\n            when '*' then 'ALL'\n        end as command,\n        qual,\n        with_check\n    from\n        pg_catalog.pg_policy pa\n        join pg_catalog.pg_class pc\n            on pa.polrelid = pc.oid\n        join pg_catalog.pg_namespace nsp\n            on pc.relnamespace = nsp.oid\n        join pg_catalog.pg_policies pb\n            on pc.relname = pb.tablename\n            and nsp.nspname = pb.schemaname\n            and pa.polname = pb.policyname\n)\nselect\n    'auth_rls_initplan' as name,\n    'Auth RLS Initialization Plan' as title,\n    'WARN' as level,\n    'EXTERNAL' as facing,\n    array['PERFORMANCE'] as categories,\n    'Detects if calls to `current_setting()` and `auth.<function>()` in RLS policies are being unnecessarily re-evaluated for each row' as description,\n    format(\n        'Table `%s.%s` has a row level security policy `%s` that re-evaluates current_setting() or auth.<function>() for each row. This produces suboptimal query performance at scale. Resolve the issue by replacing `auth.<function>()` with `(select auth.<function>())`. See [docs](https://supabase.com/docs/guides/database/postgres/row-level-security#call-functions-with-select) for more info.',\n        schema_name,\n        table_name,\n        policy_name\n    ) as detail,\n    'https://supabase.com/docs/guides/database/database-linter?lint=0003_auth_rls_initplan' as remediation,\n    jsonb_build_object(\n        'schema', schema_name,\n        'name', table_name,\n        'type', 'table'\n    ) as metadata,\n    format('auth_rls_init_plan_%s_%s_%s', schema_name, table_name, policy_name) as cache_key\nfrom\n    policies\nwhere\n    is_rls_active\n    -- NOTE: does not include realtime in support of monitoring policies on realtime.messages\n    and schema_name not in (\n        '_timescaledb_cache', '_timescaledb_catalog', '_timescaledb_config', '_timescaledb_internal', 'auth', 'cron', 'extensions', 'graphql', 'graphql_public', 'information_schema', 'net', 'pgmq', 'pgroonga', 'pgsodium', 'pgsodium_masks', 'pgtle', 'pgbouncer', 'pg_catalog', 'pgtle', 'repack', 'storage', 'supabase_functions', 'supabase_migrations', 'tiger', 'topology', 'vault'\n    )\n    and (\n        -- Example: auth.uid()\n        (\n            qual like '%auth.uid()%'\n            and lower(qual) not like '%select auth.uid()%'\n        )\n        or (\n            qual like '%auth.jwt()%'\n            and lower(qual) not like '%select auth.jwt()%'\n        )\n        or (\n            qual like '%auth.role()%'\n            and lower(qual) not like '%select auth.role()%'\n        )\n        or (\n            qual like '%auth.email()%'\n            and lower(qual) not like '%select auth.email()%'\n        )\n        or (\n            qual like '%current\\_setting(%)%'\n            and lower(qual) not like '%select current\\_setting(%)%'\n        )\n        or (\n            with_check like '%auth.uid()%'\n            and lower(with_check) not like '%select auth.uid()%'\n        )\n        or (\n            with_check like '%auth.jwt()%'\n            and lower(with_check) not like '%select auth.jwt()%'\n        )\n        or (\n            with_check like '%auth.role()%'\n            and lower(with_check) not like '%select auth.role()%'\n        )\n        or (\n            with_check like '%auth.email()%'\n            and lower(with_check) not like '%select auth.email()%'\n        )\n        or (\n            with_check like '%current\\_setting(%)%'\n            and lower(with_check) not like '%select current\\_setting(%)%'\n        )\n    ))\nunion all\n(\nselect\n    'no_primary_key' as name,\n    'No Primary Key' as title,\n    'INFO' as level,\n    'EXTERNAL' as facing,\n    array['PERFORMANCE'] as categories,\n    'Detects if a table does not have a primary key. Tables without a primary key can be inefficient to interact with at scale.' as description,\n    format(\n        'Table `%s.%s` does not have a primary key',\n        pgns.nspname,\n        pgc.relname\n    ) as detail,\n    'https://supabase.com/docs/guides/database/database-linter?lint=0004_no_primary_key' as remediation,\n     jsonb_build_object(\n        'schema', pgns.nspname,\n        'name', pgc.relname,\n        'type', 'table'\n    ) as metadata,\n    format(\n        'no_primary_key_%s_%s',\n        pgns.nspname,\n        pgc.relname\n    ) as cache_key\nfrom\n    pg_catalog.pg_class pgc\n    join pg_catalog.pg_namespace pgns\n        on pgns.oid = pgc.relnamespace\n    left join pg_catalog.pg_index pgi\n        on pgi.indrelid = pgc.oid\n    left join pg_catalog.pg_depend dep\n        on pgc.oid = dep.objid\n        and dep.deptype = 'e'\nwhere\n    pgc.relkind = 'r' -- regular tables\n    and pgns.nspname not in (\n        '_timescaledb_cache', '_timescaledb_catalog', '_timescaledb_config', '_timescaledb_internal', 'auth', 'cron', 'extensions', 'graphql', 'graphql_public', 'information_schema', 'net', 'pgmq', 'pgroonga', 'pgsodium', 'pgsodium_masks', 'pgtle', 'pgbouncer', 'pg_catalog', 'pgtle', 'realtime', 'repack', 'storage', 'supabase_functions', 'supabase_migrations', 'tiger', 'topology', 'vault'\n    )\n    and dep.objid is null -- exclude tables owned by extensions\ngroup by\n    pgc.oid,\n    pgns.nspname,\n    pgc.relname\nhaving\n    max(coalesce(pgi.indisprimary, false)::int) = 0)\nunion all\n(\nselect\n    'unused_index' as name,\n    'Unused Index' as title,\n    'INFO' as level,\n    'EXTERNAL' as facing,\n    array['PERFORMANCE'] as categories,\n    'Detects if an index has never been used and may be a candidate for removal.' as description,\n    format(\n        'Index `%s` on table `%s.%s` has not been used',\n        psui.indexrelname,\n        psui.schemaname,\n        psui.relname\n    ) as detail,\n    'https://supabase.com/docs/guides/database/database-linter?lint=0005_unused_index' as remediation,\n    jsonb_build_object(\n        'schema', psui.schemaname,\n        'name', psui.relname,\n        'type', 'table'\n    ) as metadata,\n    format(\n        'unused_index_%s_%s_%s',\n        psui.schemaname,\n        psui.relname,\n        psui.indexrelname\n    ) as cache_key\n\nfrom\n    pg_catalog.pg_stat_user_indexes psui\n    join pg_catalog.pg_index pi\n        on psui.indexrelid = pi.indexrelid\n    left join pg_catalog.pg_depend dep\n        on psui.relid = dep.objid\n        and dep.deptype = 'e'\nwhere\n    psui.idx_scan = 0\n    and not pi.indisunique\n    and not pi.indisprimary\n    and dep.objid is null -- exclude tables owned by extensions\n    and psui.schemaname not in (\n        '_timescaledb_cache', '_timescaledb_catalog', '_timescaledb_config', '_timescaledb_internal', 'auth', 'cron', 'extensions', 'graphql', 'graphql_public', 'information_schema', 'net', 'pgmq', 'pgroonga', 'pgsodium', 'pgsodium_masks', 'pgtle', 'pgbouncer', 'pg_catalog', 'pgtle', 'realtime', 'repack', 'storage', 'supabase_functions', 'supabase_migrations', 'tiger', 'topology', 'vault'\n    ))\nunion all\n(\nselect\n    'multiple_permissive_policies' as name,\n    'Multiple Permissive Policies' as title,\n    'WARN' as level,\n    'EXTERNAL' as facing,\n    array['PERFORMANCE'] as categories,\n    'Detects if multiple permissive row level security policies are present on a table for the same `role` and `action` (e.g. insert). Multiple permissive policies are suboptimal for performance as each policy must be executed for every relevant query.' as description,\n    format(\n        'Table `%s.%s` has multiple permissive policies for role `%s` for action `%s`. Policies include `%s`',\n        n.nspname,\n        c.relname,\n        r.rolname,\n        act.cmd,\n        array_agg(p.polname order by p.polname)\n    ) as detail,\n    'https://supabase.com/docs/guides/database/database-linter?lint=0006_multiple_permissive_policies' as remediation,\n    jsonb_build_object(\n        'schema', n.nspname,\n        'name', c.relname,\n        'type', 'table'\n    ) as metadata,\n    format(\n        'multiple_permissive_policies_%s_%s_%s_%s',\n        n.nspname,\n        c.relname,\n        r.rolname,\n        act.cmd\n    ) as cache_key\nfrom\n    pg_catalog.pg_policy p\n    join pg_catalog.pg_class c\n        on p.polrelid = c.oid\n    join pg_catalog.pg_namespace n\n        on c.relnamespace = n.oid\n    join pg_catalog.pg_roles r\n        on p.polroles @> array[r.oid]\n        or p.polroles = array[0::oid]\n    left join pg_catalog.pg_depend dep\n        on c.oid = dep.objid\n        and dep.deptype = 'e',\n    lateral (\n        select x.cmd\n        from unnest((\n            select\n                case p.polcmd\n                    when 'r' then array['SELECT']\n                    when 'a' then array['INSERT']\n                    when 'w' then array['UPDATE']\n                    when 'd' then array['DELETE']\n                    when '*' then array['SELECT', 'INSERT', 'UPDATE', 'DELETE']\n                    else array['ERROR']\n                end as actions\n        )) x(cmd)\n    ) act(cmd)\nwhere\n    c.relkind = 'r' -- regular tables\n    and p.polpermissive -- policy is permissive\n    and n.nspname not in (\n        '_timescaledb_cache', '_timescaledb_catalog', '_timescaledb_config', '_timescaledb_internal', 'auth', 'cron', 'extensions', 'graphql', 'graphql_public', 'information_schema', 'net', 'pgmq', 'pgroonga', 'pgsodium', 'pgsodium_masks', 'pgtle', 'pgbouncer', 'pg_catalog', 'pgtle', 'realtime', 'repack', 'storage', 'supabase_functions', 'supabase_migrations', 'tiger', 'topology', 'vault'\n    )\n    and r.rolname not like 'pg_%'\n    and r.rolname not like 'supabase%admin'\n    and not r.rolbypassrls\n    and dep.objid is null -- exclude tables owned by extensions\ngroup by\n    n.nspname,\n    c.relname,\n    r.rolname,\n    act.cmd\nhaving\n    count(1) > 1)\nunion all\n(\nselect\n    'policy_exists_rls_disabled' as name,\n    'Policy Exists RLS Disabled' as title,\n    'ERROR' as level,\n    'EXTERNAL' as facing,\n    array['SECURITY'] as categories,\n    'Detects cases where row level security (RLS) policies have been created, but RLS has not been enabled for the underlying table.' as description,\n    format(\n        'Table `%s.%s` has RLS policies but RLS is not enabled on the table. Policies include %s.',\n        n.nspname,\n        c.relname,\n        array_agg(p.polname order by p.polname)\n    ) as detail,\n    'https://supabase.com/docs/guides/database/database-linter?lint=0007_policy_exists_rls_disabled' as remediation,\n    jsonb_build_object(\n        'schema', n.nspname,\n        'name', c.relname,\n        'type', 'table'\n    ) as metadata,\n    format(\n        'policy_exists_rls_disabled_%s_%s',\n        n.nspname,\n        c.relname\n    ) as cache_key\nfrom\n    pg_catalog.pg_policy p\n    join pg_catalog.pg_class c\n        on p.polrelid = c.oid\n    join pg_catalog.pg_namespace n\n        on c.relnamespace = n.oid\n    left join pg_catalog.pg_depend dep\n        on c.oid = dep.objid\n        and dep.deptype = 'e'\nwhere\n    c.relkind = 'r' -- regular tables\n    and n.nspname not in (\n        '_timescaledb_cache', '_timescaledb_catalog', '_timescaledb_config', '_timescaledb_internal', 'auth', 'cron', 'extensions', 'graphql', 'graphql_public', 'information_schema', 'net', 'pgmq', 'pgroonga', 'pgsodium', 'pgsodium_masks', 'pgtle', 'pgbouncer', 'pg_catalog', 'pgtle', 'realtime', 'repack', 'storage', 'supabase_functions', 'supabase_migrations', 'tiger', 'topology', 'vault'\n    )\n    -- RLS is disabled\n    and not c.relrowsecurity\n    and dep.objid is null -- exclude tables owned by extensions\ngroup by\n    n.nspname,\n    c.relname)\nunion all\n(\nselect\n    'rls_enabled_no_policy' as name,\n    'RLS Enabled No Policy' as title,\n    'INFO' as level,\n    'EXTERNAL' as facing,\n    array['SECURITY'] as categories,\n    'Detects cases where row level security (RLS) has been enabled on a table but no RLS policies have been created.' as description,\n    format(\n        'Table `%s.%s` has RLS enabled, but no policies exist',\n        n.nspname,\n        c.relname\n    ) as detail,\n    'https://supabase.com/docs/guides/database/database-linter?lint=0008_rls_enabled_no_policy' as remediation,\n    jsonb_build_object(\n        'schema', n.nspname,\n        'name', c.relname,\n        'type', 'table'\n    ) as metadata,\n    format(\n        'rls_enabled_no_policy_%s_%s',\n        n.nspname,\n        c.relname\n    ) as cache_key\nfrom\n    pg_catalog.pg_class c\n    left join pg_catalog.pg_policy p\n        on p.polrelid = c.oid\n    join pg_catalog.pg_namespace n\n        on c.relnamespace = n.oid\n    left join pg_catalog.pg_depend dep\n        on c.oid = dep.objid\n        and dep.deptype = 'e'\nwhere\n    c.relkind = 'r' -- regular tables\n    and n.nspname not in (\n        '_timescaledb_cache', '_timescaledb_catalog', '_timescaledb_config', '_timescaledb_internal', 'auth', 'cron', 'extensions', 'graphql', 'graphql_public', 'information_schema', 'net', 'pgmq', 'pgroonga', 'pgsodium', 'pgsodium_masks', 'pgtle', 'pgbouncer', 'pg_catalog', 'pgtle', 'realtime', 'repack', 'storage', 'supabase_functions', 'supabase_migrations', 'tiger', 'topology', 'vault'\n    )\n    -- RLS is enabled\n    and c.relrowsecurity\n    and p.polname is null\n    and dep.objid is null -- exclude tables owned by extensions\ngroup by\n    n.nspname,\n    c.relname)\nunion all\n(\nselect\n    'duplicate_index' as name,\n    'Duplicate Index' as title,\n    'WARN' as level,\n    'EXTERNAL' as facing,\n    array['PERFORMANCE'] as categories,\n    'Detects cases where two ore more identical indexes exist.' as description,\n    format(\n        'Table `%s.%s` has identical indexes %s. Drop all except one of them',\n        n.nspname,\n        c.relname,\n        array_agg(pi.indexname order by pi.indexname)\n    ) as detail,\n    'https://supabase.com/docs/guides/database/database-linter?lint=0009_duplicate_index' as remediation,\n    jsonb_build_object(\n        'schema', n.nspname,\n        'name', c.relname,\n        'type', case\n            when c.relkind = 'r' then 'table'\n            when c.relkind = 'm' then 'materialized view'\n            else 'ERROR'\n        end,\n        'indexes', array_agg(pi.indexname order by pi.indexname)\n    ) as metadata,\n    format(\n        'duplicate_index_%s_%s_%s',\n        n.nspname,\n        c.relname,\n        array_agg(pi.indexname order by pi.indexname)\n    ) as cache_key\nfrom\n    pg_catalog.pg_indexes pi\n    join pg_catalog.pg_namespace n\n        on n.nspname  = pi.schemaname\n    join pg_catalog.pg_class c\n        on pi.tablename = c.relname\n        and n.oid = c.relnamespace\n    left join pg_catalog.pg_depend dep\n        on c.oid = dep.objid\n        and dep.deptype = 'e'\nwhere\n    c.relkind in ('r', 'm') -- tables and materialized views\n    and n.nspname not in (\n        '_timescaledb_cache', '_timescaledb_catalog', '_timescaledb_config', '_timescaledb_internal', 'auth', 'cron', 'extensions', 'graphql', 'graphql_public', 'information_schema', 'net', 'pgmq', 'pgroonga', 'pgsodium', 'pgsodium_masks', 'pgtle', 'pgbouncer', 'pg_catalog', 'pgtle', 'realtime', 'repack', 'storage', 'supabase_functions', 'supabase_migrations', 'tiger', 'topology', 'vault'\n    )\n    and dep.objid is null -- exclude tables owned by extensions\ngroup by\n    n.nspname,\n    c.relkind,\n    c.relname,\n    replace(pi.indexdef, pi.indexname, '')\nhaving\n    count(*) > 1)\nunion all\n(\nselect\n    'security_definer_view' as name,\n    'Security Definer View' as title,\n    'ERROR' as level,\n    'EXTERNAL' as facing,\n    array['SECURITY'] as categories,\n    'Detects views defined with the SECURITY DEFINER property. These views enforce Postgres permissions and row level security policies (RLS) of the view creator, rather than that of the querying user' as description,\n    format(\n        'View `%s.%s` is defined with the SECURITY DEFINER property',\n        n.nspname,\n        c.relname\n    ) as detail,\n    'https://supabase.com/docs/guides/database/database-linter?lint=0010_security_definer_view' as remediation,\n    jsonb_build_object(\n        'schema', n.nspname,\n        'name', c.relname,\n        'type', 'view'\n    ) as metadata,\n    format(\n        'security_definer_view_%s_%s',\n        n.nspname,\n        c.relname\n    ) as cache_key\nfrom\n    pg_catalog.pg_class c\n    join pg_catalog.pg_namespace n\n        on n.oid = c.relnamespace\n    left join pg_catalog.pg_depend dep\n        on c.oid = dep.objid\n        and dep.deptype = 'e'\nwhere\n    c.relkind = 'v'\n    and (\n        pg_catalog.has_table_privilege('anon', c.oid, 'SELECT')\n        or pg_catalog.has_table_privilege('authenticated', c.oid, 'SELECT')\n    )\n    and substring(pg_catalog.version() from 'PostgreSQL ([0-9]+)') >= '15' -- security invoker was added in pg15\n    and n.nspname = any(array(select trim(unnest(string_to_array(coalesce(current_setting('pgrst.db_schemas', 't'), 'public'), ',')))))\n    and n.nspname not in (\n        '_timescaledb_cache', '_timescaledb_catalog', '_timescaledb_config', '_timescaledb_internal', 'auth', 'cron', 'extensions', 'graphql', 'graphql_public', 'information_schema', 'net', 'pgmq', 'pgroonga', 'pgsodium', 'pgsodium_masks', 'pgtle', 'pgbouncer', 'pg_catalog', 'pgtle', 'realtime', 'repack', 'storage', 'supabase_functions', 'supabase_migrations', 'tiger', 'topology', 'vault'\n    )\n    and dep.objid is null -- exclude views owned by extensions\n    and not (\n        lower(coalesce(c.reloptions::text,'{}'))::text[]\n        && array[\n            'security_invoker=1',\n            'security_invoker=true',\n            'security_invoker=yes',\n            'security_invoker=on'\n        ]\n    ))\nunion all\n(\nselect\n    'function_search_path_mutable' as name,\n    'Function Search Path Mutable' as title,\n    'WARN' as level,\n    'EXTERNAL' as facing,\n    array['SECURITY'] as categories,\n    'Detects functions where the search_path parameter is not set.' as description,\n    format(\n        'Function `%s.%s` has a role mutable search_path',\n        n.nspname,\n        p.proname\n    ) as detail,\n    'https://supabase.com/docs/guides/database/database-linter?lint=0011_function_search_path_mutable' as remediation,\n    jsonb_build_object(\n        'schema', n.nspname,\n        'name', p.proname,\n        'type', 'function'\n    ) as metadata,\n    format(\n        'function_search_path_mutable_%s_%s_%s',\n        n.nspname,\n        p.proname,\n        md5(p.prosrc) -- required when function is polymorphic\n    ) as cache_key\nfrom\n    pg_catalog.pg_proc p\n    join pg_catalog.pg_namespace n\n        on p.pronamespace = n.oid\n    left join pg_catalog.pg_depend dep\n        on p.oid = dep.objid\n        and dep.deptype = 'e'\nwhere\n    n.nspname not in (\n        '_timescaledb_cache', '_timescaledb_catalog', '_timescaledb_config', '_timescaledb_internal', 'auth', 'cron', 'extensions', 'graphql', 'graphql_public', 'information_schema', 'net', 'pgmq', 'pgroonga', 'pgsodium', 'pgsodium_masks', 'pgtle', 'pgbouncer', 'pg_catalog', 'pgtle', 'realtime', 'repack', 'storage', 'supabase_functions', 'supabase_migrations', 'tiger', 'topology', 'vault'\n    )\n    and dep.objid is null -- exclude functions owned by extensions\n    -- Search path not set\n    and not exists (\n        select 1\n        from unnest(coalesce(p.proconfig, '{}')) as config\n        where config like 'search_path=%'\n    ))\nunion all\n(\nselect\n    'rls_disabled_in_public' as name,\n    'RLS Disabled in Public' as title,\n    'ERROR' as level,\n    'EXTERNAL' as facing,\n    array['SECURITY'] as categories,\n    'Detects cases where row level security (RLS) has not been enabled on tables in schemas exposed to PostgREST' as description,\n    format(\n        'Table `%s.%s` is public, but RLS has not been enabled.',\n        n.nspname,\n        c.relname\n    ) as detail,\n    'https://supabase.com/docs/guides/database/database-linter?lint=0013_rls_disabled_in_public' as remediation,\n    jsonb_build_object(\n        'schema', n.nspname,\n        'name', c.relname,\n        'type', 'table'\n    ) as metadata,\n    format(\n        'rls_disabled_in_public_%s_%s',\n        n.nspname,\n        c.relname\n    ) as cache_key\nfrom\n    pg_catalog.pg_class c\n    join pg_catalog.pg_namespace n\n        on c.relnamespace = n.oid\nwhere\n    c.relkind = 'r' -- regular tables\n    -- RLS is disabled\n    and not c.relrowsecurity\n    and (\n        pg_catalog.has_table_privilege('anon', c.oid, 'SELECT')\n        or pg_catalog.has_table_privilege('authenticated', c.oid, 'SELECT')\n    )\n    and n.nspname = any(array(select trim(unnest(string_to_array(coalesce(current_setting('pgrst.db_schemas', 't'), 'public'), ',')))))\n    and n.nspname not in (\n        '_timescaledb_cache', '_timescaledb_catalog', '_timescaledb_config', '_timescaledb_internal', 'auth', 'cron', 'extensions', 'graphql', 'graphql_public', 'information_schema', 'net', 'pgmq', 'pgroonga', 'pgsodium', 'pgsodium_masks', 'pgtle', 'pgbouncer', 'pg_catalog', 'pgtle', 'realtime', 'repack', 'storage', 'supabase_functions', 'supabase_migrations', 'tiger', 'topology', 'vault'\n    ))\nunion all\n(\nselect\n    'extension_in_public' as name,\n    'Extension in Public' as title,\n    'WARN' as level,\n    'EXTERNAL' as facing,\n    array['SECURITY'] as categories,\n    'Detects extensions installed in the `public` schema.' as description,\n    format(\n        'Extension `%s` is installed in the public schema. Move it to another schema.',\n        pe.extname\n    ) as detail,\n    'https://supabase.com/docs/guides/database/database-linter?lint=0014_extension_in_public' as remediation,\n    jsonb_build_object(\n        'schema', pe.extnamespace::regnamespace,\n        'name', pe.extname,\n        'type', 'extension'\n    ) as metadata,\n    format(\n        'extension_in_public_%s',\n        pe.extname\n    ) as cache_key\nfrom\n    pg_catalog.pg_extension pe\nwhere\n    -- plpgsql is installed by default in public and outside user control\n    -- confirmed safe\n    pe.extname not in ('plpgsql')\n    -- Scoping this to public is not optimal. Ideally we would use the postgres\n    -- search path. That currently isn't available via SQL. In other lints\n    -- we have used has_schema_privilege('anon', 'extensions', 'USAGE') but that\n    -- is not appropriate here as it would evaluate true for the extensions schema\n    and pe.extnamespace::regnamespace::text = 'public')\nunion all\n(\nwith policies as (\n    select\n        nsp.nspname as schema_name,\n        pb.tablename as table_name,\n        polname as policy_name,\n        qual,\n        with_check\n    from\n        pg_catalog.pg_policy pa\n        join pg_catalog.pg_class pc\n            on pa.polrelid = pc.oid\n        join pg_catalog.pg_namespace nsp\n            on pc.relnamespace = nsp.oid\n        join pg_catalog.pg_policies pb\n            on pc.relname = pb.tablename\n            and nsp.nspname = pb.schemaname\n            and pa.polname = pb.policyname\n)\nselect\n    'rls_references_user_metadata' as name,\n    'RLS references user metadata' as title,\n    'ERROR' as level,\n    'EXTERNAL' as facing,\n    array['SECURITY'] as categories,\n    'Detects when Supabase Auth user_metadata is referenced insecurely in a row level security (RLS) policy.' as description,\n    format(\n        'Table `%s.%s` has a row level security policy `%s` that references Supabase Auth `user_metadata`. `user_metadata` is editable by end users and should never be used in a security context.',\n        schema_name,\n        table_name,\n        policy_name\n    ) as detail,\n    'https://supabase.com/docs/guides/database/database-linter?lint=0015_rls_references_user_metadata' as remediation,\n    jsonb_build_object(\n        'schema', schema_name,\n        'name', table_name,\n        'type', 'table'\n    ) as metadata,\n    format('rls_references_user_metadata_%s_%s_%s', schema_name, table_name, policy_name) as cache_key\nfrom\n    policies\nwhere\n    schema_name not in (\n        '_timescaledb_cache', '_timescaledb_catalog', '_timescaledb_config', '_timescaledb_internal', 'auth', 'cron', 'extensions', 'graphql', 'graphql_public', 'information_schema', 'net', 'pgmq', 'pgroonga', 'pgsodium', 'pgsodium_masks', 'pgtle', 'pgbouncer', 'pg_catalog', 'pgtle', 'realtime', 'repack', 'storage', 'supabase_functions', 'supabase_migrations', 'tiger', 'topology', 'vault'\n    )\n    and (\n        -- Example: auth.jwt() -> 'user_metadata'\n        -- False positives are possible, but it isn't practical to string match\n        -- If false positive rate is too high, this expression can iterate\n        qual like '%auth.jwt()%user_metadata%'\n        or qual like '%current_setting(%request.jwt.claims%)%user_metadata%'\n        or with_check like '%auth.jwt()%user_metadata%'\n        or with_check like '%current_setting(%request.jwt.claims%)%user_metadata%'\n    ))\nunion all\n(\nselect\n    'materialized_view_in_api' as name,\n    'Materialized View in API' as title,\n    'WARN' as level,\n    'EXTERNAL' as facing,\n    array['SECURITY'] as categories,\n    'Detects materialized views that are accessible over the Data APIs.' as description,\n    format(\n        'Materialized view `%s.%s` is selectable by anon or authenticated roles',\n        n.nspname,\n        c.relname\n    ) as detail,\n    'https://supabase.com/docs/guides/database/database-linter?lint=0016_materialized_view_in_api' as remediation,\n    jsonb_build_object(\n        'schema', n.nspname,\n        'name', c.relname,\n        'type', 'materialized view'\n    ) as metadata,\n    format(\n        'materialized_view_in_api_%s_%s',\n        n.nspname,\n        c.relname\n    ) as cache_key\nfrom\n    pg_catalog.pg_class c\n    join pg_catalog.pg_namespace n\n        on n.oid = c.relnamespace\n    left join pg_catalog.pg_depend dep\n        on c.oid = dep.objid\n        and dep.deptype = 'e'\nwhere\n    c.relkind = 'm'\n    and (\n        pg_catalog.has_table_privilege('anon', c.oid, 'SELECT')\n        or pg_catalog.has_table_privilege('authenticated', c.oid, 'SELECT')\n    )\n    and n.nspname = any(array(select trim(unnest(string_to_array(coalesce(current_setting('pgrst.db_schemas', 't'), 'public'), ',')))))\n    and n.nspname not in (\n        '_timescaledb_cache', '_timescaledb_catalog', '_timescaledb_config', '_timescaledb_internal', 'auth', 'cron', 'extensions', 'graphql', 'graphql_public', 'information_schema', 'net', 'pgmq', 'pgroonga', 'pgsodium', 'pgsodium_masks', 'pgtle', 'pgbouncer', 'pg_catalog', 'pgtle', 'realtime', 'repack', 'storage', 'supabase_functions', 'supabase_migrations', 'tiger', 'topology', 'vault'\n    )\n    and dep.objid is null)\nunion all\n(\nselect\n    'foreign_table_in_api' as name,\n    'Foreign Table in API' as title,\n    'WARN' as level,\n    'EXTERNAL' as facing,\n    array['SECURITY'] as categories,\n    'Detects foreign tables that are accessible over APIs. Foreign tables do not respect row level security policies.' as description,\n    format(\n        'Foreign table `%s.%s` is accessible over APIs',\n        n.nspname,\n        c.relname\n    ) as detail,\n    'https://supabase.com/docs/guides/database/database-linter?lint=0017_foreign_table_in_api' as remediation,\n    jsonb_build_object(\n        'schema', n.nspname,\n        'name', c.relname,\n        'type', 'foreign table'\n    ) as metadata,\n    format(\n        'foreign_table_in_api_%s_%s',\n        n.nspname,\n        c.relname\n    ) as cache_key\nfrom\n    pg_catalog.pg_class c\n    join pg_catalog.pg_namespace n\n        on n.oid = c.relnamespace\n    left join pg_catalog.pg_depend dep\n        on c.oid = dep.objid\n        and dep.deptype = 'e'\nwhere\n    c.relkind = 'f'\n    and (\n        pg_catalog.has_table_privilege('anon', c.oid, 'SELECT')\n        or pg_catalog.has_table_privilege('authenticated', c.oid, 'SELECT')\n    )\n    and n.nspname = any(array(select trim(unnest(string_to_array(coalesce(current_setting('pgrst.db_schemas', 't'), 'public'), ',')))))\n    and n.nspname not in (\n        '_timescaledb_cache', '_timescaledb_catalog', '_timescaledb_config', '_timescaledb_internal', 'auth', 'cron', 'extensions', 'graphql', 'graphql_public', 'information_schema', 'net', 'pgmq', 'pgroonga', 'pgsodium', 'pgsodium_masks', 'pgtle', 'pgbouncer', 'pg_catalog', 'pgtle', 'realtime', 'repack', 'storage', 'supabase_functions', 'supabase_migrations', 'tiger', 'topology', 'vault'\n    )\n    and dep.objid is null)\nunion all\n(\nselect\n    'unsupported_reg_types' as name,\n    'Unsupported reg types' as title,\n    'WARN' as level,\n    'EXTERNAL' as facing,\n    array['SECURITY'] as categories,\n    'Identifies columns using unsupported reg* types outside pg_catalog schema, which prevents database upgrades using pg_upgrade.' as description,\n    format(\n        'Table `%s.%s` has a column `%s` with unsupported reg* type `%s`.',\n        n.nspname,\n        c.relname,\n        a.attname,\n        t.typname\n    ) as detail,\n    'https://supabase.com/docs/guides/database/database-linter?lint=unsupported_reg_types' as remediation,\n    jsonb_build_object(\n        'schema', n.nspname,\n        'name', c.relname,\n        'column', a.attname,\n        'type', 'table'\n    ) as metadata,\n    format(\n        'unsupported_reg_types_%s_%s_%s',\n        n.nspname,\n        c.relname,\n        a.attname\n    ) AS cache_key\nfrom\n    pg_catalog.pg_attribute a\n    join pg_catalog.pg_class c\n        on a.attrelid = c.oid\n    join pg_catalog.pg_namespace n\n        on c.relnamespace = n.oid\n    join pg_catalog.pg_type t\n        on a.atttypid = t.oid\n    join pg_catalog.pg_namespace tn\n        on t.typnamespace = tn.oid\nwhere\n    tn.nspname = 'pg_catalog'\n    and t.typname in ('regcollation', 'regconfig', 'regdictionary', 'regnamespace', 'regoper', 'regoperator', 'regproc', 'regprocedure')\n    and n.nspname not in ('pg_catalog', 'information_schema', 'pgsodium'))\nunion all\n(\nselect\n    'insecure_queue_exposed_in_api' as name,\n    'Insecure Queue Exposed in API' as title,\n    'ERROR' as level,\n    'EXTERNAL' as facing,\n    array['SECURITY'] as categories,\n    'Detects cases where an insecure Queue is exposed over Data APIs' as description,\n    format(\n        'Table `%s.%s` is public, but RLS has not been enabled.',\n        n.nspname,\n        c.relname\n    ) as detail,\n    'https://supabase.com/docs/guides/database/database-linter?lint=0019_insecure_queue_exposed_in_api' as remediation,\n    jsonb_build_object(\n        'schema', n.nspname,\n        'name', c.relname,\n        'type', 'table'\n    ) as metadata,\n    format(\n        'rls_disabled_in_public_%s_%s',\n        n.nspname,\n        c.relname\n    ) as cache_key\nfrom\n    pg_catalog.pg_class c\n    join pg_catalog.pg_namespace n\n        on c.relnamespace = n.oid\nwhere\n    c.relkind in ('r', 'I') -- regular or partitioned tables\n    and not c.relrowsecurity -- RLS is disabled\n    and (\n        pg_catalog.has_table_privilege('anon', c.oid, 'SELECT')\n        or pg_catalog.has_table_privilege('authenticated', c.oid, 'SELECT')\n    )\n    and n.nspname = 'pgmq' -- tables in the pgmq schema\n    and c.relname like 'q_%' -- only queue tables\n    -- Constant requirements\n    and 'pgmq_public' = any(array(select trim(unnest(string_to_array(coalesce(current_setting('pgrst.db_schemas', 't'), 'public'), ','))))))\nunion all\n(\nwith constants as (\n    select current_setting('block_size')::numeric as bs, 23 as hdr, 4 as ma\n),\n\nbloat_info as (\n    select\n        ma,\n        bs,\n        schemaname,\n        tablename,\n        (datawidth + (hdr + ma - (case when hdr % ma = 0 then ma else hdr % ma end)))::numeric as datahdr,\n        (maxfracsum * (nullhdr + ma - (case when nullhdr % ma = 0 then ma else nullhdr % ma end))) as nullhdr2\n    from (\n        select\n            schemaname,\n            tablename,\n            hdr,\n            ma,\n            bs,\n            sum((1 - null_frac) * avg_width) as datawidth,\n            max(null_frac) as maxfracsum,\n            hdr + (\n                select 1 + count(*) / 8\n                from pg_stats s2\n                where\n                    null_frac <> 0\n                    and s2.schemaname = s.schemaname\n                    and s2.tablename = s.tablename\n            ) as nullhdr\n        from pg_stats s, constants\n        group by 1, 2, 3, 4, 5\n    ) as foo\n),\n\ntable_bloat as (\n    select\n        schemaname,\n        tablename,\n        cc.relpages,\n        bs,\n        ceil((cc.reltuples * ((datahdr + ma -\n          (case when datahdr % ma = 0 then ma else datahdr % ma end)) + nullhdr2 + 4)) / (bs - 20::float)) as otta\n    from\n        bloat_info\n        join pg_class cc\n            on cc.relname = bloat_info.tablename\n        join pg_namespace nn\n            on cc.relnamespace = nn.oid\n            and nn.nspname = bloat_info.schemaname\n            and nn.nspname <> 'information_schema'\n        where\n            cc.relkind = 'r'\n            and cc.relam = (select oid from pg_am where amname = 'heap')\n),\n\nbloat_data as (\n    select\n        'table' as type,\n        schemaname,\n        tablename as object_name,\n        round(case when otta = 0 then 0.0 else table_bloat.relpages / otta::numeric end, 1) as bloat,\n        case when relpages < otta then 0 else (bs * (table_bloat.relpages - otta)::bigint)::bigint end as raw_waste\n    from\n        table_bloat\n)\n\nselect\n    'table_bloat' as name,\n    'Table Bloat' as title,\n    'INFO' as level,\n    'EXTERNAL' as facing,\n    array['PERFORMANCE'] as categories,\n    'Detects if a table has excess bloat and may benefit from maintenance operations like vacuum full or cluster.' as description,\n    format(\n        'Table `%s`.`%s` has excessive bloat',\n        bloat_data.schemaname,\n        bloat_data.object_name\n    ) as detail,\n    'Consider running vacuum full (WARNING: incurs downtime) and tweaking autovacuum settings to reduce bloat.' as remediation,\n    jsonb_build_object(\n        'schema', bloat_data.schemaname,\n        'name', bloat_data.object_name,\n        'type', bloat_data.type\n    ) as metadata,\n    format(\n        'table_bloat_%s_%s',\n        bloat_data.schemaname,\n        bloat_data.object_name\n    ) as cache_key\nfrom\n    bloat_data\nwhere\n    bloat > 70.0\n    and raw_waste > (20 * 1024 * 1024) -- filter for waste > 200 MB\norder by\n    schemaname,\n    object_name)\nunion all\n(\nselect\n    'fkey_to_auth_unique' as name,\n    'Foreign Key to Auth Unique Constraint' as title,\n    'ERROR' as level,\n    'EXTERNAL' as facing,\n    array['SECURITY'] as categories,\n    'Detects user defined foreign keys to unique constraints in the auth schema.' as description,\n    format(\n        'Table `%s`.`%s` has a foreign key `%s` referencing an auth unique constraint',\n        n.nspname, -- referencing schema\n        c_rel.relname, -- referencing table\n        c.conname -- fkey name\n    ) as detail,\n    'Drop the foreign key constraint that references the auth schema.' as remediation,\n    jsonb_build_object(\n        'schema', n.nspname,\n        'name', c_rel.relname,\n        'foreign_key', c.conname\n    ) as metadata,\n    format(\n        'fkey_to_auth_unique_%s_%s_%s',\n        n.nspname, -- referencing schema\n        c_rel.relname, -- referencing table\n        c.conname\n    ) as cache_key\nfrom\n    pg_catalog.pg_constraint c\n    join pg_catalog.pg_class c_rel\n        on c.conrelid = c_rel.oid\n    join pg_catalog.pg_namespace n\n        on c_rel.relnamespace = n.oid\n    join pg_catalog.pg_class ref_rel\n        on c.confrelid = ref_rel.oid\n    join pg_catalog.pg_namespace cn\n        on ref_rel.relnamespace = cn.oid\n    join pg_catalog.pg_index i\n        on c.conindid = i.indexrelid\nwhere c.contype = 'f'\n    and cn.nspname = 'auth'\n    and i.indisunique\n    and not i.indisprimary)\nunion all\n(\nselect\n    'extension_versions_outdated' as name,\n    'Extension Versions Outdated' as title,\n    'WARN' as level,\n    'EXTERNAL' as facing,\n    array['SECURITY'] as categories,\n    'Detects extensions that are not using the default (recommended) version.' as description,\n    format(\n        'Extension `%s` is using version `%s` but version `%s` is available. Using outdated extension versions may expose the database to security vulnerabilities.',\n        ext.name,\n        ext.installed_version,\n        ext.default_version\n    ) as detail,\n    'https://supabase.com/docs/guides/database/database-linter?lint=0022_extension_versions_outdated' as remediation,\n    jsonb_build_object(\n        'extension_name', ext.name,\n        'installed_version', ext.installed_version,\n        'default_version', ext.default_version\n    ) as metadata,\n    format(\n        'extension_versions_outdated_%s_%s',\n        ext.name,\n        ext.installed_version\n    ) as cache_key\nfrom\n    pg_catalog.pg_available_extensions ext\njoin\n    -- ignore versions not in pg_available_extension_versions\n    -- e.g. residue of pg_upgrade\n    pg_catalog.pg_available_extension_versions extv\n    on extv.name = ext.name and extv.installed\nwhere\n    ext.installed_version is not null\n    and ext.default_version is not null\n    and ext.installed_version != ext.default_version\norder by\n    ext.name)\nunion all\n(\n-- Detects tables exposed via API that contain columns with sensitive names\n-- Inspired by patterns from security scanners that detect PII/credential exposure\nwith sensitive_patterns as (\n    select unnest(array[\n        -- Authentication & Credentials\n        'password', 'passwd', 'pwd', 'passphrase',\n        'secret', 'secret_key', 'private_key', 'api_key', 'apikey',\n        'auth_key', 'token', 'jwt', 'access_token', 'refresh_token',\n        'oauth_token', 'session_token', 'bearer_token', 'auth_code',\n        'session_id', 'session_key', 'session_secret',\n        'recovery_code', 'backup_code', 'verification_code',\n        'otp', 'two_factor', '2fa_secret', '2fa_code',\n        -- Personal Identifiers\n        'ssn', 'social_security', 'social_security_number',\n        'driver_license', 'drivers_license', 'license_number',\n        'passport_number', 'passport_id', 'national_id', 'tax_id',\n        -- Financial Information\n        'credit_card', 'card_number', 'cvv', 'cvc', 'cvn',\n        'bank_account', 'account_number', 'routing_number',\n        'iban', 'swift_code', 'bic',\n        -- Health & Medical\n        'health_record', 'medical_record', 'patient_id',\n        'insurance_number', 'health_insurance', 'medical_insurance',\n        'treatment',\n        -- Device Identifiers\n        'mac_address', 'macaddr', 'imei', 'device_uuid',\n        -- Digital Keys & Certificates\n        'pgp_key', 'gpg_key', 'ssh_key', 'certificate',\n        'license_key', 'activation_key',\n        -- Biometric Data\n        'facial_recognition'\n    ]) as pattern\n),\nexposed_tables as (\n    select\n        n.nspname as schema_name,\n        c.relname as table_name,\n        c.oid as table_oid\n    from\n        pg_catalog.pg_class c\n        join pg_catalog.pg_namespace n\n            on c.relnamespace = n.oid\n    where\n        c.relkind = 'r' -- regular tables\n        and (\n            pg_catalog.has_table_privilege('anon', c.oid, 'SELECT')\n            or pg_catalog.has_table_privilege('authenticated', c.oid, 'SELECT')\n        )\n        and n.nspname = any(array(select trim(unnest(string_to_array(coalesce(current_setting('pgrst.db_schemas', 't'), 'public'), ',')))))\n        and n.nspname not in (\n            '_timescaledb_cache', '_timescaledb_catalog', '_timescaledb_config', '_timescaledb_internal', 'auth', 'cron', 'extensions', 'graphql', 'graphql_public', 'information_schema', 'net', 'pgmq', 'pgroonga', 'pgsodium', 'pgsodium_masks', 'pgtle', 'pgbouncer', 'pg_catalog', 'pgtle', 'realtime', 'repack', 'storage', 'supabase_functions', 'supabase_migrations', 'tiger', 'topology', 'vault'\n        )\n        -- Only flag tables without RLS enabled\n        and not c.relrowsecurity\n),\nsensitive_columns as (\n    select\n        et.schema_name,\n        et.table_name,\n        a.attname as column_name,\n        sp.pattern as matched_pattern\n    from\n        exposed_tables et\n        join pg_catalog.pg_attribute a\n            on a.attrelid = et.table_oid\n            and a.attnum > 0\n            and not a.attisdropped\n        cross join sensitive_patterns sp\n    where\n        -- Match column name against sensitive patterns (case insensitive), allowing '-'/'_' variants\n        replace(lower(a.attname), '-', '_') = sp.pattern\n)\nselect\n    'sensitive_columns_exposed' as name,\n    'Sensitive Columns Exposed' as title,\n    'ERROR' as level,\n    'EXTERNAL' as facing,\n    array['SECURITY'] as categories,\n    'Detects tables exposed via API that contain columns with potentially sensitive data (PII, credentials, financial info) without RLS protection.' as description,\n    format(\n        'Table `%s.%s` is exposed via API without RLS and contains potentially sensitive column(s): %s. This may lead to data exposure.',\n        schema_name,\n        table_name,\n        string_agg(distinct column_name, ', ' order by column_name)\n    ) as detail,\n    'https://supabase.com/docs/guides/database/database-linter?lint=0023_sensitive_columns_exposed' as remediation,\n    jsonb_build_object(\n        'schema', schema_name,\n        'name', table_name,\n        'type', 'table',\n        'sensitive_columns', array_agg(distinct column_name order by column_name),\n        'matched_patterns', array_agg(distinct matched_pattern order by matched_pattern)\n    ) as metadata,\n    format(\n        'sensitive_columns_exposed_%s_%s',\n        schema_name,\n        table_name\n    ) as cache_key\nfrom\n    sensitive_columns\ngroup by\n    schema_name,\n    table_name\norder by\n    schema_name,\n    table_name)\nunion all\n(\n-- Detects RLS policies that are overly permissive (e.g., USING (true), USING (1=1))\n-- These policies effectively disable row-level security while giving a false sense of security\nwith policies as (\n    select\n        nsp.nspname as schema_name,\n        pb.tablename as table_name,\n        pc.relrowsecurity as is_rls_active,\n        pa.polname as policy_name,\n        pa.polpermissive as is_permissive,\n        pa.polroles as role_oids,\n        (select array_agg(r::regrole::text) from unnest(pa.polroles) as x(r)) as roles,\n        case pa.polcmd\n            when 'r' then 'SELECT'\n            when 'a' then 'INSERT'\n            when 'w' then 'UPDATE'\n            when 'd' then 'DELETE'\n            when '*' then 'ALL'\n        end as command,\n        pb.qual,\n        pb.with_check,\n        -- Normalize expressions by removing whitespace and lowercasing\n        replace(replace(replace(lower(coalesce(pb.qual, '')), ' ', ''), E'\\n', ''), E'\\t', '') as normalized_qual,\n        replace(replace(replace(lower(coalesce(pb.with_check, '')), ' ', ''), E'\\n', ''), E'\\t', '') as normalized_with_check\n    from\n        pg_catalog.pg_policy pa\n        join pg_catalog.pg_class pc\n            on pa.polrelid = pc.oid\n        join pg_catalog.pg_namespace nsp\n            on pc.relnamespace = nsp.oid\n        join pg_catalog.pg_policies pb\n            on pc.relname = pb.tablename\n            and nsp.nspname = pb.schemaname\n            and pa.polname = pb.policyname\n    where\n        pc.relkind = 'r' -- regular tables\n        and nsp.nspname not in (\n            '_timescaledb_cache', '_timescaledb_catalog', '_timescaledb_config', '_timescaledb_internal', 'auth', 'cron', 'extensions', 'graphql', 'graphql_public', 'information_schema', 'net', 'pgmq', 'pgroonga', 'pgsodium', 'pgsodium_masks', 'pgtle', 'pgbouncer', 'pg_catalog', 'pgtle', 'realtime', 'repack', 'storage', 'supabase_functions', 'supabase_migrations', 'tiger', 'topology', 'vault'\n        )\n),\npermissive_patterns as (\n    select\n        p.*,\n        -- Check for always-true USING clause patterns\n        -- Note: SELECT with (true) is often intentional and documented, so we only flag UPDATE/DELETE\n        case when (\n            command in ('UPDATE', 'DELETE', 'ALL')\n            and (\n                normalized_qual in ('true', '(true)', '1=1', '(1=1)')\n                -- Empty or null qual on permissive policy means allow all\n                or (qual is null and is_permissive)\n            )\n        ) then true else false end as has_permissive_using,\n        -- Check for always-true WITH CHECK clause patterns\n        case when (\n            normalized_with_check in ('true', '(true)', '1=1', '(1=1)')\n            -- Empty with_check on INSERT means allow all (INSERT has no USING to fall back on)\n            or (with_check is null and is_permissive and command = 'INSERT')\n            -- Empty with_check on UPDATE/ALL with permissive USING means allow all writes\n            or (with_check is null and is_permissive and command in ('UPDATE', 'ALL')\n                and normalized_qual in ('true', '(true)', '1=1', '(1=1)'))\n        ) then true else false end as has_permissive_with_check\n    from\n        policies p\n    where\n        -- Only check tables with RLS enabled (otherwise it's a different lint)\n        is_rls_active\n        -- Only check permissive policies (restrictive policies with true are less dangerous)\n        and is_permissive\n        -- Only flag policies that apply to anon or authenticated roles (or public/all roles)\n        and (\n            role_oids = array[0::oid] -- public (all roles)\n            or exists (\n                select 1\n                from unnest(role_oids) as r\n                where r::regrole::text in ('anon', 'authenticated')\n            )\n        )\n)\nselect\n    'rls_policy_always_true' as name,\n    'RLS Policy Always True' as title,\n    'WARN' as level,\n    'EXTERNAL' as facing,\n    array['SECURITY'] as categories,\n    'Detects RLS policies that use overly permissive expressions like `USING (true)` or `WITH CHECK (true)` for UPDATE, DELETE, or INSERT operations. SELECT policies with `USING (true)` are intentionally excluded as this pattern is often used deliberately for public read access.' as description,\n    format(\n        'Table `%s.%s` has an RLS policy `%s` for `%s` that allows unrestricted access%s. This effectively bypasses row-level security for %s.',\n        schema_name,\n        table_name,\n        policy_name,\n        command,\n        case\n            when has_permissive_using and has_permissive_with_check then ' (both USING and WITH CHECK are always true)'\n            when has_permissive_using then ' (USING clause is always true)'\n            when has_permissive_with_check then ' (WITH CHECK clause is always true)'\n            else ''\n        end,\n        array_to_string(roles, ', ')\n    ) as detail,\n    'https://supabase.com/docs/guides/database/database-linter?lint=0024_permissive_rls_policy' as remediation,\n    jsonb_build_object(\n        'schema', schema_name,\n        'name', table_name,\n        'type', 'table',\n        'policy_name', policy_name,\n        'command', command,\n        'roles', roles,\n        'qual', qual,\n        'with_check', with_check,\n        'permissive_using', has_permissive_using,\n        'permissive_with_check', has_permissive_with_check\n    ) as metadata,\n    format(\n        'rls_policy_always_true_%s_%s_%s',\n        schema_name,\n        table_name,\n        policy_name\n    ) as cache_key\nfrom\n    permissive_patterns\nwhere\n    has_permissive_using or has_permissive_with_check\norder by\n    schema_name,\n    table_name,\n    policy_name)";
 
 /**
  * Splits the embedded SQL into [setup, query] on the first `";\n\n"`,
diff --git a/apps/cli/src/legacy/commands/db/branch/create/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/db/branch/create/SIDE_EFFECTS.md
index 5987e44efc..bd930c4242 100644
--- a/apps/cli/src/legacy/commands/db/branch/create/SIDE_EFFECTS.md
+++ b/apps/cli/src/legacy/commands/db/branch/create/SIDE_EFFECTS.md
@@ -8,9 +8,9 @@
 
 ## Files Written
 
-| Path                                             | Format    | When   |
-| ------------------------------------------------ | --------- | ------ |
-| `<workdir>/.branches/<branch-name>/` (directory) | directory | always |
+| Path                                                      | Format    | When   |
+| --------------------------------------------------------- | --------- | ------ |
+| `<workdir>/supabase/.branches/<branch-name>/` (directory) | directory | always |
 
 ## API Routes
 
diff --git a/apps/cli/src/legacy/commands/db/branch/delete/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/db/branch/delete/SIDE_EFFECTS.md
index 6b392e7110..97c31f4eb1 100644
--- a/apps/cli/src/legacy/commands/db/branch/delete/SIDE_EFFECTS.md
+++ b/apps/cli/src/legacy/commands/db/branch/delete/SIDE_EFFECTS.md
@@ -8,9 +8,9 @@
 
 ## Files Written
 
-| Path                                             | Format    | When    |
-| ------------------------------------------------ | --------- | ------- |
-| `<workdir>/.branches/<branch-name>/` (directory) | directory | removed |
+| Path                                                      | Format    | When    |
+| --------------------------------------------------------- | --------- | ------- |
+| `<workdir>/supabase/.branches/<branch-name>/` (directory) | directory | removed |
 
 ## API Routes
 
diff --git a/apps/cli/src/legacy/commands/db/branch/list/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/db/branch/list/SIDE_EFFECTS.md
index 14e1803271..bbbe030daf 100644
--- a/apps/cli/src/legacy/commands/db/branch/list/SIDE_EFFECTS.md
+++ b/apps/cli/src/legacy/commands/db/branch/list/SIDE_EFFECTS.md
@@ -48,4 +48,4 @@ Not applicable.
 ## Notes
 
 - Deprecated in the Go CLI: use `branches list` instead.
-- This is a local-only operation listing branches in `<workdir>/.branches/`.
+- This is a local-only operation listing branches in `<workdir>/supabase/.branches/`.
diff --git a/apps/cli/src/legacy/commands/db/branch/switch/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/db/branch/switch/SIDE_EFFECTS.md
index 5cce0f2423..aa1cd0cbf5 100644
--- a/apps/cli/src/legacy/commands/db/branch/switch/SIDE_EFFECTS.md
+++ b/apps/cli/src/legacy/commands/db/branch/switch/SIDE_EFFECTS.md
@@ -8,9 +8,9 @@
 
 ## Files Written
 
-| Path                                 | Format     | When   |
-| ------------------------------------ | ---------- | ------ |
-| `<workdir>/.supabase/current-branch` | plain text | always |
+| Path                                           | Format     | When   |
+| ---------------------------------------------- | ---------- | ------ |
+| `<workdir>/supabase/.branches/_current_branch` | plain text | always |
 
 ## API Routes
 
diff --git a/apps/cli/src/legacy/commands/db/diff/diff.handler.ts b/apps/cli/src/legacy/commands/db/diff/diff.handler.ts
index c7dcdb5fad..61fb818dbc 100644
--- a/apps/cli/src/legacy/commands/db/diff/diff.handler.ts
+++ b/apps/cli/src/legacy/commands/db/diff/diff.handler.ts
@@ -8,7 +8,6 @@ import { LegacyCliConfig } from "../../../config/legacy-cli-config.service.ts";
 import { legacyAqua, legacyYellow } from "../../../shared/legacy-colors.ts";
 import { legacyReadDbToml } from "../../../shared/legacy-db-config.toml-read.ts";
 import { LegacyDbConfigResolver } from "../../../shared/legacy-db-config.service.ts";
-import type { LegacyPgConnInput } from "../../../shared/legacy-db-connection.service.ts";
 import type { LegacyDbConnType } from "../../../shared/legacy-db-target-flags.ts";
 import { legacyGetHostname } from "../../../shared/legacy-hostname.ts";
 import { legacyMakeDir } from "../../../shared/legacy-make-dir.ts";
@@ -27,6 +26,7 @@ import {
   legacyGetMigrationPath,
 } from "../../../shared/legacy-migration-file.ts";
 import { legacyDiffMigra } from "../shared/legacy-migra.ts";
+import { legacyWritePgDeltaMigrations } from "../shared/legacy-pgdelta-migrations.write.ts";
 import { type LegacyPgDeltaContext, legacyDiffPgDelta } from "../shared/legacy-pgdelta.ts";
 import { LegacyDeclarativeSeam } from "../shared/legacy-pgdelta.seam.service.ts";
 import type { LegacyDbDiffFlags } from "./diff.command.ts";
@@ -44,23 +44,6 @@ import {
 const warnDiff = `WARNING: The diff tool is not foolproof, so you may need to manually rearrange and modify the generated migration.
 Run ${legacyAqua("supabase db reset")} to verify that the new migration does not generate errors.`;
 
-/** Builds a plain Postgres URL from a resolved connection (Go's `ToPostgresURL`). */
-const connToUrl = (conn: LegacyPgConnInput): string =>
-  legacyToPostgresURL({
-    host: conn.host,
-    port: conn.port,
-    user: conn.user,
-    password: conn.password,
-    database: conn.database,
-    ...(conn.options !== undefined ? { options: conn.options } : {}),
-    ...(conn.runtimeParams !== undefined ? { runtimeParams: conn.runtimeParams } : {}),
-    // Preserve a `--db-url` connect_timeout; Go's ToPostgresURL serializes the
-    // parsed ConnectTimeout (`connect.go`), defaulting to 10 only when unset.
-    ...(conn.connectTimeoutSeconds !== undefined
-      ? { connectTimeoutSeconds: conn.connectTimeoutSeconds }
-      : {}),
-  });
-
 /**
  * Rebuilds the `db diff` argv for the pgAdmin / pg-schema delegate path. Flags
  * stay flags (the Go-proxy channel-parity rule). The explicit `--from`/`--to` and
@@ -234,7 +217,7 @@ export const legacyDbDiff = Effect.fn("legacy.db.diff")(function* (flags: Legacy
                 mergedLinkedRef = ref2;
                 cfg = yield* legacyReadDbToml(fs, path, cliConfig.workdir, ref2);
               }
-              return connToUrl(resolved.conn);
+              return legacyToPostgresURL(resolved.conn);
             }
             case "migrations":
               return yield* seam.exportCatalog({
@@ -361,7 +344,7 @@ export const legacyDbDiff = Effect.fn("legacy.db.diff")(function* (flags: Legacy
     });
     const linkedRef = Option.getOrUndefined(resolved.ref ?? Option.none());
     if (linkedRef !== undefined) linkedRefForCache = linkedRef;
-    const targetUrl = connToUrl(resolved.conn);
+    const targetUrl = legacyToPostgresURL(resolved.conn);
 
     // Read config with the resolved linked ref so a matching `[remotes.<ref>]`
     // block merges before the engine/format/runtime are read — Go loads config
@@ -406,7 +389,7 @@ export const legacyDbDiff = Effect.fn("legacy.db.diff")(function* (flags: Legacy
       projectRef: connType === "linked" ? linkedRef : undefined,
     });
 
-    const out = yield* Effect.gen(function* () {
+    const diffResult = yield* Effect.gen(function* () {
       const target = shadow.targetUrlOverride ?? targetUrl;
       yield* output.raw(
         flags.schema.length > 0
@@ -421,15 +404,22 @@ export const legacyDbDiff = Effect.fn("legacy.db.diff")(function* (flags: Legacy
           schema: flags.schema,
           formatOptions,
         });
-        return result.sql;
+        // Keep the per-unit plan files so a multi-unit plan can be written as one
+        // migration file each (Go's `DatabaseDiff.Files`); `sql` stays the flattened
+        // join for stdout review + machine payloads.
+        return { sql: result.sql, files: result.files };
       }
-      return yield* legacyDiffMigra(ctx, {
+      const sql = yield* legacyDiffMigra(ctx, {
         source: shadow.sourceUrl,
         target,
         schema: flags.schema,
         connectOptions: { isLocal: resolved.isLocal, dnsResolver },
       });
+      // The migra engine has no execution-aware plan units, so it always writes a
+      // single migration file (Go's `SaveDiff` single-file path).
+      return { sql, files: undefined };
     }).pipe(Effect.ensuring(seam.removeShadowContainer(shadow.container)));
+    const out = diffResult.sql;
 
     // Detect the branch from the resolved workdir, not the caller's CWD: Go
     // chdirs into --workdir in PersistentPreRunE before GetGitBranch
@@ -444,27 +434,46 @@ export const legacyDbDiff = Effect.fn("legacy.db.diff")(function* (flags: Legacy
     // Go's `SaveDiff` (`pgadmin.go:20`) + the drop-statement warning (`diff.go:44`).
     const engine = useDelta ? "pg-delta" : "migra";
     const drops = legacyFindDropStatements(out);
-    let writtenFile: string | null = null;
+    const writtenFiles: Array<string> = [];
     if (out.length < 2) {
       yield* output.raw("No schema changes found\n", "stderr");
       // Go's `SaveDiff` gates the file write on `len(file) > 0` (`pgadmin.go`), so
       // an empty `--file=""` (e.g. an unset shell var) falls through to stdout
       // rather than writing a `<timestamp>_.sql` migration with no name.
     } else if (Option.isSome(flags.file) && flags.file.value.length > 0) {
-      const timestamp = legacyFormatMigrationTimestamp(yield* Clock.currentTimeMillis);
-      const migrationPath = legacyGetMigrationPath(
-        path,
-        cliConfig.workdir,
-        timestamp,
-        flags.file.value,
-      );
-      yield* legacyMakeDir(fs, path.dirname(migrationPath)).pipe(
-        Effect.mapError((cause) => new LegacyDbDiffWriteError({ message: cause.message })),
-      );
-      yield* fs
-        .writeFileString(migrationPath, out)
-        .pipe(Effect.mapError((cause) => new LegacyDbDiffWriteError({ message: cause.message })));
-      writtenFile = migrationPath;
+      const fileName = flags.file.value;
+      // A pg-delta plan that crosses a transaction boundary yields more than one
+      // ordered unit; writing them into a single migration file would later fail
+      // when `db push`/`reset` applies it as one transaction. Write one migration
+      // file per unit in that case via the shared writer (Go's
+      // `WritePgDeltaMigrations`, `internal/db/diff/pgdelta_migrations.go`): each
+      // file appends the unit name and gets a strictly increasing timestamp, the
+      // full set is collision-checked against existing migrations, and every file is
+      // written exclusively so a pre-existing migration is never overwritten. A
+      // single-unit plan (and the migra engine) keeps the exact `<ts>_<name>.sql`
+      // file (Go's `utils.WriteFile`), byte-identical to before.
+      const planFiles = diffResult.files ?? [];
+      if (planFiles.length > 1) {
+        const writtenUnits = yield* legacyWritePgDeltaMigrations(fs, path, {
+          workdir: cliConfig.workdir,
+          baseMillis: yield* Clock.currentTimeMillis,
+          name: fileName,
+          files: planFiles.map((file) => ({ name: file.name, sql: file.sql })),
+        }).pipe(Effect.mapError((cause) => new LegacyDbDiffWriteError({ message: cause.message })));
+        for (const unit of writtenUnits) writtenFiles.push(unit.path);
+      } else {
+        const timestamp = legacyFormatMigrationTimestamp(yield* Clock.currentTimeMillis);
+        const migrationPath = legacyGetMigrationPath(path, cliConfig.workdir, timestamp, fileName);
+        // Create parent dirs per written path (mirroring Go's `utils.WriteFile`), so a
+        // nested `--file snapshots/remote` name creates `<ts>_snapshots/` first.
+        yield* legacyMakeDir(fs, path.dirname(migrationPath)).pipe(
+          Effect.mapError((cause) => new LegacyDbDiffWriteError({ message: cause.message })),
+        );
+        yield* fs
+          .writeFileString(migrationPath, out)
+          .pipe(Effect.mapError((cause) => new LegacyDbDiffWriteError({ message: cause.message })));
+        writtenFiles.push(migrationPath);
+      }
       yield* output.raw(`${warnDiff}\n`, "stderr");
     } else if (output.format === "text") {
       yield* output.raw(`${out}\n`);
@@ -479,7 +488,12 @@ export const legacyDbDiff = Effect.fn("legacy.db.diff")(function* (flags: Legacy
     if (output.format !== "text") {
       yield* output.success("Diff complete.", {
         diff: out,
-        file: writtenFile,
+        // `file` keeps the first written path for released consumers that read the
+        // string field (null when nothing was written); `files` lists EVERY written
+        // migration path in write order (a pg-delta plan writes one file per unit),
+        // mirroring pull's `schemaFiles` so machine callers see all of them.
+        file: writtenFiles[0] ?? null,
+        files: writtenFiles,
         schemas: flags.schema,
         engine,
         dropStatements: drops,
diff --git a/apps/cli/src/legacy/commands/db/diff/diff.integration.test.ts b/apps/cli/src/legacy/commands/db/diff/diff.integration.test.ts
index 0278e7e41e..f4e6fb4ea6 100644
--- a/apps/cli/src/legacy/commands/db/diff/diff.integration.test.ts
+++ b/apps/cli/src/legacy/commands/db/diff/diff.integration.test.ts
@@ -1,10 +1,11 @@
-import { existsSync, mkdirSync, readdirSync, writeFileSync } from "node:fs";
+import { existsSync, mkdirSync, readdirSync, readFileSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
 import { BunServices } from "@effect/platform-bun";
 import { describe, expect, it } from "@effect/vitest";
 import { Effect, Exit, Layer, Option } from "effect";
 
 import {
+  legacyFailWriteStringOnNthCallFsLayer,
   mockLegacyCliConfig,
   mockLegacyLinkedProjectCacheTracked,
   mockLegacyTelemetryStateTracked,
@@ -35,10 +36,15 @@ interface SetupOpts {
   readonly isLocal?: boolean;
   readonly linkedRef?: string;
   readonly diffSql?: string;
+  // When set, the pg-delta edge mock emits a multi-unit plan envelope (one file
+  // per entry) instead of the single-unit wrap of `diffSql`.
+  readonly diffFiles?: ReadonlyArray<{ readonly name: string; readonly sql: string }>;
   readonly targetOverride?: string;
   readonly oom?: boolean; // edge-runtime OOMs; the bash fallback returns `diffSql`
   readonly delegateStdout?: string; // stdout returned by a captured Go-delegate run
   readonly networkId?: string; // --network-id value forwarded to docker runs
+  // When set, the Nth `writeFileString` fails, exercising cleanup-on-failure.
+  readonly failWriteOnCall?: number;
 }
 
 function setup(workdir: string, opts: SetupOpts = {}) {
@@ -87,7 +93,28 @@ function setup(workdir: string, opts: SetupOpts = {}) {
           new LegacyEdgeRuntimeScriptError({ message: "Fatal JavaScript out of memory" }),
         );
       }
-      return Effect.succeed({ stdout: opts.diffSql ?? "", stderr: "" });
+      const diffSql = opts.diffSql ?? "";
+      // The pg-delta diff script (uniquely identified by `renderPlanFiles`) prints a
+      // JSON envelope with one file per plan unit; wrap the test's raw SQL into a
+      // single-unit envelope so `legacyDiffPgDelta` parses it. The migra script
+      // returns raw SQL unchanged.
+      const isPgDelta = runOpts.script.includes("renderPlanFiles");
+      const planFiles =
+        opts.diffFiles !== undefined
+          ? opts.diffFiles.map((file, i) => ({
+              order: i + 1,
+              name: file.name,
+              transactionMode: "transactional",
+              sql: file.sql,
+            }))
+          : diffSql.length > 0
+            ? [{ order: 1, name: "schema_changes", transactionMode: "transactional", sql: diffSql }]
+            : [];
+      const stdout =
+        isPgDelta && planFiles.length > 0
+          ? JSON.stringify({ version: 1, files: planFiles })
+          : diffSql;
+      return Effect.succeed({ stdout, stderr: "" });
     },
   });
 
@@ -141,7 +168,7 @@ function setup(workdir: string, opts: SetupOpts = {}) {
       }),
   });
 
-  const layer = Layer.mergeAll(
+  const baseLayer = Layer.mergeAll(
     out.layer,
     telemetry.layer,
     cache.layer,
@@ -164,6 +191,12 @@ function setup(workdir: string, opts: SetupOpts = {}) {
     mockRuntimeInfo(),
     BunServices.layer,
   );
+  // Merged last so its `FileSystem` overrides `BunServices` (last-wins); `Path`
+  // still resolves from `BunServices`.
+  const layer =
+    opts.failWriteOnCall === undefined
+      ? baseLayer
+      : Layer.merge(baseLayer, legacyFailWriteStringOnNthCallFsLayer(opts.failWriteOnCall));
 
   return {
     layer,
@@ -438,6 +471,122 @@ describe("legacy db diff", () => {
     }).pipe(Effect.provide(s.layer));
   });
 
+  it.effect("writes one migration file per unit for a multi-unit pg-delta plan", () => {
+    // A pg-delta plan that crosses a transaction boundary yields more than one
+    // ordered unit; writing them into one migration would fail when db push/reset
+    // applies it as a single transaction. Each unit becomes its own file (Go's
+    // WritePgDeltaMigrations), named `<name>_<unit>` with strictly increasing
+    // timestamps, and the machine payload's `files` lists them all.
+    const s = setup(tmp.current, {
+      format: "json",
+      diffFiles: [
+        { name: "schema_changes", sql: "alter type mood add value 'ok';" },
+        { name: "after_enum_values", sql: "insert into t values ('ok');" },
+      ],
+    });
+    return Effect.gen(function* () {
+      yield* legacyDbDiff(flags({ usePgDelta: Option.some(true), file: Option.some("my_diff") }));
+      const dir = join(tmp.current, "supabase", "migrations");
+      const files = readdirSync(dir).sort();
+      expect(files).toHaveLength(2);
+      expect(files[0]).toMatch(/^\d{14}_my_diff_schema_changes\.sql$/);
+      expect(files[1]).toMatch(/^\d{14}_my_diff_after_enum_values\.sql$/);
+      // Each unit's file carries only that unit's SQL, terminated with a newline.
+      expect(readFileSync(join(dir, files[0]!), "utf8")).toBe("alter type mood add value 'ok';\n");
+      const success = s.out.messages.find((m) => m.type === "success");
+      const data = success?.data as { file: string; files: ReadonlyArray<string> };
+      expect(data.files).toHaveLength(2);
+      // `file` stays the first written path for released string-field consumers.
+      expect(data.file).toBe(data.files[0]);
+    }).pipe(Effect.provide(s.layer));
+  });
+
+  it.effect("creates nested parent directories for a nested single-unit --file name", () => {
+    // `db diff -f snapshots/remote` must create the `<ts>_snapshots/` parent dir
+    // before writing, mirroring Go's `utils.WriteFile`.
+    const s = setup(tmp.current, { diffSql: "create table g ();\n" });
+    return Effect.gen(function* () {
+      yield* legacyDbDiff(flags({ file: Option.some("snapshots/remote") }));
+      const migrationsRoot = join(tmp.current, "supabase", "migrations");
+      const dirs = readdirSync(migrationsRoot);
+      expect(dirs).toHaveLength(1);
+      expect(dirs[0]).toMatch(/^\d{14}_snapshots$/);
+      expect(readdirSync(join(migrationsRoot, dirs[0]!))).toEqual(["remote.sql"]);
+    }).pipe(Effect.provide(s.layer));
+  });
+
+  it.effect("creates nested parent directories for a nested multi-unit --file name", () => {
+    const s = setup(tmp.current, {
+      format: "json",
+      diffFiles: [
+        { name: "schema_changes", sql: "alter type mood add value 'ok';" },
+        { name: "after_enum_values", sql: "insert into t values ('ok');" },
+      ],
+    });
+    return Effect.gen(function* () {
+      yield* legacyDbDiff(
+        flags({ usePgDelta: Option.some(true), file: Option.some("snapshots/remote") }),
+      );
+      const success = s.out.messages.find((m) => m.type === "success");
+      const data = success?.data as { files: ReadonlyArray<string> };
+      expect(data.files).toHaveLength(2);
+      for (const written of data.files) expect(existsSync(written)).toBe(true);
+      expect(data.files[0]).toMatch(/\d{14}_snapshots\/remote_schema_changes\.sql$/u);
+      expect(data.files[1]).toMatch(/\d{14}_snapshots\/remote_after_enum_values\.sql$/u);
+    }).pipe(Effect.provide(s.layer));
+  });
+
+  it.effect("bumps the version set when a target migration file already exists", () => {
+    // The full generated set is collision-checked before writing; if any target
+    // exists the base advances one second so the new files stay strictly ascending
+    // AND never overwrite the pre-existing migration.
+    const s = setup(tmp.current, {
+      format: "json",
+      diffFiles: [
+        { name: "schema_changes", sql: "a" },
+        { name: "after_enum_values", sql: "b" },
+      ],
+    });
+    return Effect.gen(function* () {
+      const dir = join(tmp.current, "supabase", "migrations");
+      mkdirSync(dir, { recursive: true });
+      // TestClock starts at epoch 0, so the first version the writer tries is
+      // 19700101000000; pre-seed a colliding file at that version.
+      const clashing = join(dir, "19700101000000_my_diff_schema_changes.sql");
+      writeFileSync(clashing, "-- pre-existing\n");
+      yield* legacyDbDiff(flags({ usePgDelta: Option.some(true), file: Option.some("my_diff") }));
+      expect(readdirSync(dir).sort()).toEqual([
+        "19700101000000_my_diff_schema_changes.sql",
+        "19700101000001_my_diff_schema_changes.sql",
+        "19700101000002_my_diff_after_enum_values.sql",
+      ]);
+      // The pre-existing file was never overwritten.
+      expect(readFileSync(clashing, "utf8")).toBe("-- pre-existing\n");
+    }).pipe(Effect.provide(s.layer));
+  });
+
+  it.effect("removes already-written unit files when a later unit write fails", () => {
+    // A mid-loop write failure best-effort removes every file this invocation
+    // already wrote, so no partial multi-file migration is left behind.
+    const s = setup(tmp.current, {
+      format: "json",
+      failWriteOnCall: 2,
+      diffFiles: [
+        { name: "schema_changes", sql: "a" },
+        { name: "after_enum_values", sql: "b" },
+      ],
+    });
+    return Effect.gen(function* () {
+      const exit = yield* legacyDbDiff(
+        flags({ usePgDelta: Option.some(true), file: Option.some("my_diff") }),
+      ).pipe(Effect.exit);
+      expect(Exit.isFailure(exit)).toBe(true);
+      const dir = join(tmp.current, "supabase", "migrations");
+      const remaining = existsSync(dir) ? readdirSync(dir) : [];
+      expect(remaining).toEqual([]);
+    }).pipe(Effect.provide(s.layer));
+  });
+
   it.effect("explicit --from local --to linked prints the diff to stdout", () => {
     const s = setup(tmp.current, { isLocal: false, diffSql: "create table e ();\n" });
     return Effect.gen(function* () {
diff --git a/apps/cli/src/legacy/commands/db/dump/dump.handler.ts b/apps/cli/src/legacy/commands/db/dump/dump.handler.ts
index 0f72399b85..0a51f63b36 100644
--- a/apps/cli/src/legacy/commands/db/dump/dump.handler.ts
+++ b/apps/cli/src/legacy/commands/db/dump/dump.handler.ts
@@ -18,6 +18,7 @@ import {
 } from "../../../shared/legacy-connect-errors.ts";
 import { legacyBold } from "../../../shared/legacy-colors.ts";
 import { LegacyDnsResolverFlag } from "../../../../shared/legacy/global-flags.ts";
+import { cobraMutuallyExclusiveErrorMessage } from "../../../../shared/cli/cobra-flag-groups.ts";
 import { Output } from "../../../../shared/output/output.service.ts";
 import type { LegacyDbDumpFlags } from "./dump.command.ts";
 import {
@@ -42,15 +43,16 @@ import {
 
 /**
  * Mutually-exclusive flag groups, in cobra's check order (it sorts the joined
- * group keys alphabetically — `apps/cli-go/cmd/db.go:434,436,441,445`). The `key`
- * preserves the registration order used in the error's `[group]`, while the set
- * of violating flags is alphabetised in the message (cobra `sort.Strings(set)`).
+ * group keys alphabetically — `apps/cli-go/cmd/db.go:434,436,441,445`). Each
+ * group's flags are in registration order, matching cobra's `[group]` in the
+ * error text; the set of violating flags is alphabetised separately by
+ * `cobraMutuallyExclusiveErrorMessage` (cobra `sort.Strings(set)`).
  */
 const LEGACY_DUMP_EXCLUSIVE_GROUPS = [
-  { key: "db-url linked local", flags: ["db-url", "linked", "local"] },
-  { key: "keep-comments data-only", flags: ["keep-comments", "data-only"] },
-  { key: "role-only data-only", flags: ["role-only", "data-only"] },
-  { key: "schema role-only", flags: ["schema", "role-only"] },
+  ["db-url", "linked", "local"],
+  ["keep-comments", "data-only"],
+  ["role-only", "data-only"],
+  ["schema", "role-only"],
 ] as const;
 
 const DUMP_FILE_MODE = 0o644;
@@ -126,11 +128,11 @@ export const legacyDbDump = Effect.fn("legacy.db.dump")(function* (flags: Legacy
       }
     };
     for (const group of LEGACY_DUMP_EXCLUSIVE_GROUPS) {
-      const set = group.flags.filter(isSet);
+      const set = group.filter(isSet);
       if (set.length > 1) {
         return yield* Effect.fail(
           new LegacyDbDumpMutuallyExclusiveFlagsError({
-            message: `if any flags in the group [${group.key}] are set none of the others can be; [${[...set].sort().join(" ")}] were all set`,
+            message: cobraMutuallyExclusiveErrorMessage(group, set),
           }),
         );
       }
diff --git a/apps/cli/src/legacy/commands/db/lint/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/db/lint/SIDE_EFFECTS.md
index f76f966c3c..49f2aac8ed 100644
--- a/apps/cli/src/legacy/commands/db/lint/SIDE_EFFECTS.md
+++ b/apps/cli/src/legacy/commands/db/lint/SIDE_EFFECTS.md
@@ -12,15 +12,18 @@ Native TypeScript port of Go's `internal/db/lint`.
 
 ## Files Written
 
-| Path                         | Format | When                                                 |
-| ---------------------------- | ------ | ---------------------------------------------------- |
-| `~/.supabase/telemetry.json` | JSON   | always (PostHog state flush, Go `PersistentPostRun`) |
+| Path                                           | Format | When                                                                                                                |
+| ---------------------------------------------- | ------ | ------------------------------------------------------------------------------------------------------------------- |
+| `<workdir>/supabase/.temp/linked-project.json` | JSON   | `--linked` only, via `LegacyLinkedProjectCache.cache` (Go's `ensureProjectGroupsCached`, `cmd/root.go:174,212-234`) |
+| `~/.supabase/telemetry.json`                   | JSON   | always (PostHog state flush, Go `PersistentPostRun`)                                                                |
 
 No user data is written: the lint runs inside a transaction that is **always
 rolled back** (`BEGIN` … `ROLLBACK`), matching Go — including
 `CREATE EXTENSION plpgsql_check`, which is issued on the same connection inside
-the open transaction and so is rolled back too. `db lint` does not write the
-linked-project cache (it has no `LegacyLinkedProjectCache` dependency).
+the open transaction and so is rolled back too. `db lint` DOES write the
+linked-project cache when run with `--linked` (matching Go's
+`ensureProjectGroupsCached`); the default `--local` and `--db-url` paths never
+populate a project ref, so no cache write occurs there.
 
 ## API Routes
 
diff --git a/apps/cli/src/legacy/commands/db/lint/lint.command.ts b/apps/cli/src/legacy/commands/db/lint/lint.command.ts
index e97a625bc7..f754b6f42c 100644
--- a/apps/cli/src/legacy/commands/db/lint/lint.command.ts
+++ b/apps/cli/src/legacy/commands/db/lint/lint.command.ts
@@ -54,9 +54,10 @@ export const legacyDbLintCommand = Command.make("lint", config).pipe(
           level: flags.level,
           "fail-on": flags.failOn,
         },
-        // Go records utils.EnumFlag values verbatim (cmd/root_analytics.go:88-116).
+        // level/fail-on are Flag.choice and are auto-detected as safe via
+        // `config` below (Go's isEnumFlag, cmd/root_analytics.go:110-116).
         // --schema stays redacted: it's a []string slice flag in Go, not an EnumFlag.
-        safeFlags: ["level", "fail-on"],
+        config,
         // Go's changedFlags() uses pflag Visit, which reports the canonical
         // `schema` name even for the `-s` shorthand (cmd/db.go:506); map it so
         // `db lint -s public` records the schema flag in telemetry.
diff --git a/apps/cli/src/legacy/commands/db/pull/pull.command.ts b/apps/cli/src/legacy/commands/db/pull/pull.command.ts
index d53964fab2..d024c5e789 100644
--- a/apps/cli/src/legacy/commands/db/pull/pull.command.ts
+++ b/apps/cli/src/legacy/commands/db/pull/pull.command.ts
@@ -84,6 +84,7 @@ export const legacyDbPullCommand = Command.make("pull", config).pipe(
           password: flags.password,
         },
         aliases: { s: "schema", p: "password" },
+        config,
       }),
       withJsonErrorHandling,
     ),
diff --git a/apps/cli/src/legacy/commands/db/pull/pull.handler.ts b/apps/cli/src/legacy/commands/db/pull/pull.handler.ts
index e95fc934f2..7334bbfbe1 100644
--- a/apps/cli/src/legacy/commands/db/pull/pull.handler.ts
+++ b/apps/cli/src/legacy/commands/db/pull/pull.handler.ts
@@ -44,6 +44,7 @@ import {
   legacyShouldUsePgDelta,
 } from "../shared/legacy-diff-engine.ts";
 import { legacyDiffMigra } from "../shared/legacy-migra.ts";
+import { legacyWritePgDeltaMigrations } from "../shared/legacy-pgdelta-migrations.write.ts";
 import { type LegacyDumpOptions, legacyBuildSchemaDumpEnv } from "../shared/legacy-pg-dump.env.ts";
 import { legacyStreamPgDump } from "../shared/legacy-pg-dump.run.ts";
 import {
@@ -90,23 +91,6 @@ const DEPRECATION_LINE =
 /** Migration-file mode for the initial pg_dump seed (Go's `OpenFile(..., 0644)`). */
 const MIGRATION_FILE_MODE = 0o644;
 
-/** Builds a plain Postgres URL from a resolved connection (Go's `ToPostgresURL`). */
-const connToUrl = (conn: LegacyPgConnInput): string =>
-  legacyToPostgresURL({
-    host: conn.host,
-    port: conn.port,
-    user: conn.user,
-    password: conn.password,
-    database: conn.database,
-    ...(conn.options !== undefined ? { options: conn.options } : {}),
-    ...(conn.runtimeParams !== undefined ? { runtimeParams: conn.runtimeParams } : {}),
-    // Preserve a `--db-url` connect_timeout; Go's ToPostgresURL serializes the
-    // parsed ConnectTimeout (`connect.go`), defaulting to 10 only when unset.
-    ...(conn.connectTimeoutSeconds !== undefined
-      ? { connectTimeoutSeconds: conn.connectTimeoutSeconds }
-      : {}),
-  });
-
 /** Rebuilds the `db pull` argv for the Go-delegated `--experimental` structured-dump branch. */
 const rebuildDelegateArgs = (flags: LegacyDbPullFlags): Array<string> => {
   const args = ["db", "pull"];
@@ -232,7 +216,7 @@ export const legacyDbPull = Effect.fn("legacy.db.pull")(function* (flags: Legacy
     });
     const linkedRef = Option.getOrUndefined(resolved.ref ?? Option.none());
     if (linkedRef !== undefined) linkedRefForCache = linkedRef;
-    const targetUrl = connToUrl(resolved.conn);
+    const targetUrl = legacyToPostgresURL(resolved.conn);
 
     // Reload config with the resolved linked ref so a matching `[remotes.<ref>]`
     // block merges before the engine/format/runtime/declarative paths are read —
@@ -293,7 +277,7 @@ export const legacyDbPull = Effect.fn("legacy.db.pull")(function* (flags: Legacy
                 .pipe(Effect.orElseSucceed(() => Option.none()));
               if (Option.isSome(pooler)) {
                 yield* legacyEmitPoolerFallbackWarning(resolved.conn.host);
-                return yield* attempt(connToUrl(pooler.value));
+                return yield* attempt(legacyToPostgresURL(pooler.value));
               }
             }
             return yield* Effect.fail(error);
@@ -428,7 +412,8 @@ export const legacyDbPull = Effect.fn("legacy.db.pull")(function* (flags: Legacy
         }
 
         // Migration-file path (Go's `pull.run`).
-        const timestamp = legacyFormatMigrationTimestamp(yield* Clock.currentTimeMillis);
+        const nowMillis = yield* Clock.currentTimeMillis;
+        const timestamp = legacyFormatMigrationTimestamp(nowMillis);
         const migrationPath = legacyGetMigrationPath(path, cliConfig.workdir, timestamp, name);
 
         const remote = yield* legacyListRemoteMigrations(session);
@@ -620,6 +605,7 @@ export const legacyDbPull = Effect.fn("legacy.db.pull")(function* (flags: Legacy
                 });
                 return {
                   sql: result.sql,
+                  files: result.files,
                   capture: debug ? { sourceCatalog, stderr: result.stderr } : undefined,
                 };
               }
@@ -629,7 +615,7 @@ export const legacyDbPull = Effect.fn("legacy.db.pull")(function* (flags: Legacy
                 schema: diffSchema,
                 connectOptions: { isLocal: resolved.isLocal, dnsResolver },
               });
-              return { sql, capture: undefined };
+              return { sql, files: undefined, capture: undefined };
             }),
           );
         }).pipe(Effect.ensuring(seam.removeShadowContainer(shadow.container)));
@@ -678,55 +664,87 @@ export const legacyDbPull = Effect.fn("legacy.db.pull")(function* (flags: Legacy
           );
         }
 
-        if (!diffEmpty) {
-          if (seededFromDump) {
-            // Append the migra diff to the dump-seeded file (Go's `diffRemoteSchema`
-            // opens the migration file `O_APPEND`, `pull.go:191`).
-            yield* Effect.scoped(
-              Effect.gen(function* () {
-                const file = yield* fs.open(migrationPath, { flag: "a" }).pipe(
-                  Effect.mapError(
-                    (cause) =>
-                      new LegacyDbPullWriteError({
-                        message: `failed to open migration file: ${cause.message}`,
-                      }),
-                  ),
-                );
-                yield* file.writeAll(new TextEncoder().encode(out)).pipe(
-                  Effect.mapError(
-                    (cause) =>
-                      new LegacyDbPullWriteError({
-                        message: `failed to write migration file: ${cause.message}`,
-                      }),
-                  ),
-                );
-              }),
-            );
-          } else {
-            yield* legacyMakeDir(fs, path.dirname(migrationPath)).pipe(
-              Effect.mapError((cause) => new LegacyDbPullWriteError({ message: cause.message })),
-            );
-            yield* fs.writeFileString(migrationPath, out).pipe(
-              Effect.mapError(
-                (cause) =>
-                  new LegacyDbPullWriteError({
-                    message: `failed to write migration file: ${cause.message}`,
-                  }),
-              ),
+        // Build the list of migration files to record in the remote history. The
+        // migra engine writes exactly one file (the dump-seeded or freshly written
+        // migrationPath); the pg-delta engine writes one ordered file per
+        // execution-aware plan unit.
+        const writtenMigrations: Array<{ path: string; version: string }> = [];
+        if (usePgDeltaDiff) {
+          // pg-delta: one migration file per plan unit via the shared writer. A
+          // single-unit plan (the common case) keeps the exact `<ts>_<name>.sql`
+          // filename; multi-unit plans append the unit name and give each file a
+          // strictly increasing timestamp so execution + migration-history order stay
+          // stable. The full set is collision-checked against existing migrations and
+          // each file is written exclusively so a pre-existing migration is never
+          // overwritten. Mirrors Go's `WritePgDeltaMigrations`
+          // (`internal/db/diff/pgdelta_migrations.go`). Empty plans are handled by the
+          // `diffEmpty` in-sync branch above, so `planFiles` is non-empty here.
+          const planFiles = diffOutcome.files ?? [];
+          const writtenUnits = yield* legacyWritePgDeltaMigrations(fs, path, {
+            workdir: cliConfig.workdir,
+            baseMillis: nowMillis,
+            name,
+            files: planFiles.map((file) => ({ name: file.name, sql: file.sql })),
+          }).pipe(
+            Effect.mapError((cause) => new LegacyDbPullWriteError({ message: cause.message })),
+          );
+          for (const unit of writtenUnits) {
+            writtenMigrations.push({ path: unit.path, version: unit.version });
+          }
+        } else {
+          if (!diffEmpty) {
+            if (seededFromDump) {
+              // Append the migra diff to the dump-seeded file (Go's `diffRemoteSchema`
+              // opens the migration file `O_APPEND`, `pull.go:191`).
+              yield* Effect.scoped(
+                Effect.gen(function* () {
+                  const file = yield* fs.open(migrationPath, { flag: "a" }).pipe(
+                    Effect.mapError(
+                      (cause) =>
+                        new LegacyDbPullWriteError({
+                          message: `failed to open migration file: ${cause.message}`,
+                        }),
+                    ),
+                  );
+                  yield* file.writeAll(new TextEncoder().encode(out)).pipe(
+                    Effect.mapError(
+                      (cause) =>
+                        new LegacyDbPullWriteError({
+                          message: `failed to write migration file: ${cause.message}`,
+                        }),
+                    ),
+                  );
+                }),
+              );
+            } else {
+              yield* legacyMakeDir(fs, path.dirname(migrationPath)).pipe(
+                Effect.mapError((cause) => new LegacyDbPullWriteError({ message: cause.message })),
+              );
+              yield* fs.writeFileString(migrationPath, out).pipe(
+                Effect.mapError(
+                  (cause) =>
+                    new LegacyDbPullWriteError({
+                      message: `failed to write migration file: ${cause.message}`,
+                    }),
+                ),
+              );
+            }
+          }
+
+          // Go's `ensureMigrationWritten` (`pull.go:68,263-268`): a dump that produced
+          // nothing followed by an empty diff leaves the file empty → in sync.
+          if (seededFromDump && !seedWroteBytes && diffEmpty) {
+            return yield* Effect.fail(
+              new LegacyDbPullInSyncError({ message: "No schema changes found" }),
             );
           }
+          writtenMigrations.push({ path: migrationPath, version: timestamp });
         }
 
-        // Go's `ensureMigrationWritten` (`pull.go:68,263-268`): a dump that produced
-        // nothing followed by an empty diff leaves the file empty → in sync.
-        if (seededFromDump && !seedWroteBytes && diffEmpty) {
-          return yield* Effect.fail(
-            new LegacyDbPullInSyncError({ message: "No schema changes found" }),
-          );
+        for (const written of writtenMigrations) {
+          yield* output.raw(`Schema written to ${legacyBold(written.path)}\n`, "stderr");
         }
 
-        yield* output.raw(`Schema written to ${legacyBold(migrationPath)}\n`, "stderr");
-
         // Prompt to update the remote migration history table. Go calls
         // `PromptYesNo(ctx, "Update remote migration history table?", true)`
         // (`internal/db/pull/pull.go:73`), which returns the default (`true`) on
@@ -739,14 +757,19 @@ export const legacyDbPull = Effect.fn("legacy.db.pull")(function* (flags: Legacy
         // (`console.go:64-82`), and otherwise prompts on a real TTY.
         const shouldUpdate = yield* legacyPromptYesNo(output, yes, updateHistoryTitle, true);
         if (shouldUpdate) {
-          yield* legacyUpdateMigrationHistory(session, fs, path, migrationPath, timestamp);
+          yield* legacyUpdateMigrationHistory(session, fs, path, writtenMigrations);
           remoteHistoryUpdated = true;
         }
 
         if (output.format !== "text") {
           yield* output.success("Schema pulled.", {
             declarative: false,
-            schemaWritten: migrationPath,
+            // `schemaWritten` keeps the first written path for released consumers that
+            // read the string field; `schemaFiles` lists EVERY written migration path
+            // in write order (a pg-delta plan writes one file per unit), so machine
+            // callers see all of them, not just the first.
+            schemaWritten: writtenMigrations[0]?.path ?? migrationPath,
+            schemaFiles: writtenMigrations.map((written) => written.path),
             remoteHistoryUpdated,
             engine: usePgDeltaDiff ? "pg-delta" : "migra",
           });
diff --git a/apps/cli/src/legacy/commands/db/pull/pull.integration.test.ts b/apps/cli/src/legacy/commands/db/pull/pull.integration.test.ts
index 1e15768888..248c0be283 100644
--- a/apps/cli/src/legacy/commands/db/pull/pull.integration.test.ts
+++ b/apps/cli/src/legacy/commands/db/pull/pull.integration.test.ts
@@ -5,6 +5,7 @@ import { describe, expect, it } from "@effect/vitest";
 import { Effect, Exit, Layer, Option } from "effect";
 
 import {
+  legacyFailWriteStringOnNthCallFsLayer,
   mockLegacyCliConfig,
   mockLegacyLinkedProjectCacheTracked,
   mockLegacyTelemetryStateTracked,
@@ -44,6 +45,21 @@ const EXPORT_JSON = JSON.stringify({
   files: [{ path: "schemas/public/t.sql", order: 0, statements: 1, sql: "create table t ();" }],
 });
 
+// Builds the pg-delta diff envelope printed by `templates/pgdelta.ts`: one file
+// per execution-aware plan unit (`{version:1,files:[{order,name,transactionMode,sql}]}`).
+const pgDeltaDiffEnvelope = (
+  units: ReadonlyArray<{ name: string; sql: string; transactionMode?: string }>,
+): string =>
+  JSON.stringify({
+    version: 1,
+    files: units.map((unit, index) => ({
+      order: index + 1,
+      name: unit.name,
+      transactionMode: unit.transactionMode ?? "transactional",
+      sql: unit.sql,
+    })),
+  });
+
 interface SetupOpts {
   readonly format?: OutputFormat;
   readonly remoteVersions?: ReadonlyArray<string>;
@@ -78,6 +94,8 @@ interface SetupOpts {
   // `--declarative` and `--use-pg-delta` are present, to replay pflag's
   // last-occurrence-wins ordering; defaults to empty.
   readonly args?: ReadonlyArray<string>;
+  // When set, the Nth `writeFileString` fails, exercising cleanup-on-failure.
+  readonly failWriteOnCall?: number;
 }
 
 function setup(workdir: string, opts: SetupOpts = {}) {
@@ -222,7 +240,7 @@ function setup(workdir: string, opts: SetupOpts = {}) {
       }),
   });
 
-  const layer = Layer.mergeAll(
+  const baseLayer = Layer.mergeAll(
     out.layer,
     telemetry.layer,
     cache.layer,
@@ -250,6 +268,12 @@ function setup(workdir: string, opts: SetupOpts = {}) {
     mockRuntimeInfo(),
     BunServices.layer,
   );
+  // Merged last so its `FileSystem` overrides `BunServices` (last-wins); `Path`
+  // still resolves from `BunServices`.
+  const layer =
+    opts.failWriteOnCall === undefined
+      ? baseLayer
+      : Layer.merge(baseLayer, legacyFailWriteStringOnNthCallFsLayer(opts.failWriteOnCall));
 
   return {
     layer,
@@ -303,20 +327,158 @@ describe("legacy db pull", () => {
     seedMigration(tmp.current, "20240101000000");
     const s = setup(tmp.current, {
       remoteVersions: ["20240101000000"],
-      edgeStdout: "create table remote ();\n",
+      edgeStdout: pgDeltaDiffEnvelope([
+        {
+          name: "schema_changes",
+          sql: "-- Migration unit 1: schema_changes\n\ncreate table remote ();",
+        },
+      ]),
       yes: true,
     });
     return Effect.gen(function* () {
       yield* legacyDbPull(flags({ diffEngine: Option.some("pg-delta") }));
       const dir = join(tmp.current, "supabase", "migrations");
       expect(existsSync(join(dir, `${"20240101000000"}_local.sql`))).toBe(true);
-      // A new timestamped remote_schema migration was written.
+      // A single-unit plan keeps the unchanged `<ts>_remote_schema.sql` filename.
+      const written = readdirSync(dir).filter((f) => f.endsWith("_remote_schema.sql"));
+      expect(written).toHaveLength(1);
+      expect(readFileSync(join(dir, written[0] ?? ""), "utf8")).toContain(
+        "create table remote ();",
+      );
       expect(streamText(s.out, "stderr")).toContain("Schema written to");
       expect(s.historyUpserts.length).toBe(1);
       expect(streamText(s.out, "stdout")).toContain("Finished supabase db pull.");
     }).pipe(Effect.provide(s.layer));
   });
 
+  it.effect(
+    "a pg-delta plan with transaction boundaries writes one ordered migration file per unit",
+    () => {
+      // pg-delta plans that cross a transaction boundary (e.g. ALTER TYPE ... ADD
+      // VALUE then a statement using the new value) come back as several units; each
+      // is written to its own migration file with a strictly increasing timestamp and
+      // recorded in the remote history. Mirrors Go's `writePgDeltaMigrations`.
+      seedMigration(tmp.current, "20240101000000");
+      const s = setup(tmp.current, {
+        remoteVersions: ["20240101000000"],
+        edgeStdout: pgDeltaDiffEnvelope([
+          { name: "schema_changes", sql: "-- unit 1\n\nalter type mood add value 'ok';" },
+          { name: "after_enum_values", sql: "-- unit 2\n\ninsert into t values ('ok');" },
+          {
+            name: "non_transactional",
+            transactionMode: "none",
+            sql: "-- unit 3\n\ncreate index concurrently i on t (c);",
+          },
+        ]),
+        yes: true,
+      });
+      return Effect.gen(function* () {
+        yield* legacyDbPull(flags({ diffEngine: Option.some("pg-delta") }));
+        const dir = join(tmp.current, "supabase", "migrations");
+        const written = readdirSync(dir)
+          .filter((f) => f !== "20240101000000_local.sql")
+          .sort();
+        expect(written).toHaveLength(3);
+        // Multi-unit plans append the unit name and carry strictly increasing versions.
+        expect(written[0]).toMatch(/^\d{14}_remote_schema_schema_changes\.sql$/u);
+        expect(written[1]).toMatch(/^\d{14}_remote_schema_after_enum_values\.sql$/u);
+        expect(written[2]).toMatch(/^\d{14}_remote_schema_non_transactional\.sql$/u);
+        const versions = written.map((f) => f.slice(0, 14));
+        expect((versions[0] ?? "") < (versions[1] ?? "")).toBe(true);
+        expect((versions[1] ?? "") < (versions[2] ?? "")).toBe(true);
+        expect(readFileSync(join(dir, written[2] ?? ""), "utf8")).toContain(
+          "create index concurrently i on t (c);",
+        );
+        // One "Schema written to" line and one history upsert per unit.
+        expect(streamText(s.out, "stderr").match(/Schema written to/gu)).toHaveLength(3);
+        expect(s.historyUpserts.length).toBe(3);
+        // Go's UpdateMigrationTable prints all versions space-separated.
+        expect(streamText(s.out, "stderr")).toContain(
+          `Repaired migration history: [${versions.join(" ")}] => applied`,
+        );
+      }).pipe(Effect.provide(s.layer));
+    },
+  );
+
+  it.effect(
+    "a multi-unit pg-delta pull reports every written migration path in the json payload",
+    () => {
+      // The structured payload must list ALL written migration files in write order,
+      // not just the first (`schemaWritten`). A pg-delta plan writes one file per unit.
+      seedMigration(tmp.current, "20240101000000");
+      const s = setup(tmp.current, {
+        format: "json",
+        remoteVersions: ["20240101000000"],
+        edgeStdout: pgDeltaDiffEnvelope([
+          { name: "schema_changes", sql: "-- unit 1\n\nalter type mood add value 'ok';" },
+          { name: "after_enum_values", sql: "-- unit 2\n\ninsert into t values ('ok');" },
+          {
+            name: "non_transactional",
+            transactionMode: "none",
+            sql: "-- unit 3\n\ncreate index concurrently i on t (c);",
+          },
+        ]),
+      });
+      return Effect.gen(function* () {
+        yield* legacyDbPull(flags({ diffEngine: Option.some("pg-delta") }));
+        const success = s.out.messages.find((m) => m.type === "success");
+        const data = success?.data as
+          | { schemaWritten?: string; schemaFiles?: Array<string> }
+          | undefined;
+        expect(data?.schemaFiles).toHaveLength(3);
+        // Paths appear in write order, each carrying its unit name.
+        expect(data?.schemaFiles?.[0]).toMatch(/_remote_schema_schema_changes\.sql$/u);
+        expect(data?.schemaFiles?.[1]).toMatch(/_remote_schema_after_enum_values\.sql$/u);
+        expect(data?.schemaFiles?.[2]).toMatch(/_remote_schema_non_transactional\.sql$/u);
+        // `schemaWritten` stays the first written path (unchanged string contract).
+        expect(data?.schemaWritten).toBe(data?.schemaFiles?.[0]);
+      }).pipe(Effect.provide(s.layer));
+    },
+  );
+
+  it.effect("removes already-written unit files when a later pg-delta unit write fails", () => {
+    // A mid-loop write failure best-effort removes every migration file this
+    // invocation already wrote, so no partial multi-file pull is left behind.
+    seedMigration(tmp.current, "20240101000000");
+    const s = setup(tmp.current, {
+      failWriteOnCall: 2,
+      remoteVersions: ["20240101000000"],
+      edgeStdout: pgDeltaDiffEnvelope([
+        { name: "schema_changes", sql: "alter type mood add value 'ok';" },
+        { name: "after_enum_values", sql: "insert into t values ('ok');" },
+      ]),
+      yes: true,
+    });
+    return Effect.gen(function* () {
+      const exit = yield* legacyDbPull(flags({ diffEngine: Option.some("pg-delta") })).pipe(
+        Effect.exit,
+      );
+      expect(Exit.isFailure(exit)).toBe(true);
+      const dir = join(tmp.current, "supabase", "migrations");
+      // Only the pre-seeded local migration remains; the first written unit was
+      // rolled back and the failing second unit never landed.
+      expect(readdirSync(dir)).toEqual(["20240101000000_local.sql"]);
+      // No history rows were upserted because the write failed before the prompt.
+      expect(s.historyUpserts.length).toBe(0);
+    }).pipe(Effect.provide(s.layer));
+  });
+
+  it.effect("a malformed pg-delta diff envelope surfaces a parse error, not 'in sync'", () => {
+    seedMigration(tmp.current, "20240101000000");
+    const s = setup(tmp.current, {
+      remoteVersions: ["20240101000000"],
+      edgeStdout: "not a valid envelope{",
+      yes: true,
+    });
+    return Effect.gen(function* () {
+      const error = yield* legacyDbPull(flags({ diffEngine: Option.some("pg-delta") })).pipe(
+        Effect.flip,
+      );
+      expect(error.message).toContain("failed to parse pg-delta diff output");
+      expect(error.message).not.toContain("No schema changes found");
+    }).pipe(Effect.provide(s.layer));
+  });
+
   it.effect("pulls with the default migra engine", () => {
     seedMigration(tmp.current, "20240101000000");
     const s = setup(tmp.current, {
@@ -527,8 +689,14 @@ describe("legacy db pull", () => {
         remoteHistoryUpdated: true,
         engine: "migra",
       });
-      const data = success?.data as { schemaWritten?: string } | undefined;
+      const data = success?.data as
+        | { schemaWritten?: string; schemaFiles?: Array<string> }
+        | undefined;
       expect(data?.schemaWritten).toMatch(/_remote_schema\.sql$/u);
+      // The single-unit case lists exactly one written migration path, and it is the
+      // same path as the singular `schemaWritten` field.
+      expect(data?.schemaFiles).toHaveLength(1);
+      expect(data?.schemaFiles?.[0]).toBe(data?.schemaWritten);
     }).pipe(Effect.provide(s.layer));
   });
 
@@ -1045,7 +1213,7 @@ describe("legacy db pull", () => {
     writeFileSync(join(tmp.current, "supabase", ".env"), "SUPABASE_EXPERIMENTAL_PG_DELTA=true\n");
     const s = setup(tmp.current, {
       remoteVersions: ["20240101000000"],
-      edgeStdout: "create table remote ();\n",
+      edgeStdout: pgDeltaDiffEnvelope([{ name: "schema_changes", sql: "create table remote ();" }]),
       yes: true,
     });
     return Effect.gen(function* () {
@@ -1158,7 +1326,7 @@ describe("legacy db pull", () => {
     );
     const s = setup(tmp.current, {
       remoteVersions: ["20240101000000"],
-      edgeStdout: "create table remote ();\n",
+      edgeStdout: pgDeltaDiffEnvelope([{ name: "schema_changes", sql: "create table remote ();" }]),
       yes: true,
       resolvedRef: "abcdefghijklmnopqrst",
     });
@@ -1180,7 +1348,7 @@ describe("legacy db pull", () => {
     const s = setup(tmp.current, {
       remoteVersions: ["20240101000000"],
       edgeFailFirstWith: "error diffing schema:\nfailed to connect: network is unreachable",
-      edgeStdout: "create table remote ();\n",
+      edgeStdout: pgDeltaDiffEnvelope([{ name: "schema_changes", sql: "create table remote ();" }]),
       yes: true,
       poolerAvailable: true,
     });
diff --git a/apps/cli/src/legacy/commands/db/pull/pull.sync.integration.test.ts b/apps/cli/src/legacy/commands/db/pull/pull.sync.integration.test.ts
new file mode 100644
index 0000000000..05b3423db6
--- /dev/null
+++ b/apps/cli/src/legacy/commands/db/pull/pull.sync.integration.test.ts
@@ -0,0 +1,100 @@
+import { mkdtempSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { BunServices } from "@effect/platform-bun";
+import { describe, expect, it } from "@effect/vitest";
+import { Effect, FileSystem, Path } from "effect";
+
+import { mockOutput } from "../../../../../tests/helpers/mocks.ts";
+import { LegacyDbExecError } from "../../../shared/legacy-db-connection.errors.ts";
+import type { LegacyDbSession } from "../../../shared/legacy-db-connection.service.ts";
+import { LegacyDbPullWriteError } from "./pull.errors.ts";
+import { legacyUpdateMigrationHistory, type LegacyPulledMigration } from "./pull.sync.ts";
+
+// Records exec statements and successful upserts in one ordered log so the tests
+// can assert the transaction envelope (BEGIN / UPSERT / COMMIT / ROLLBACK) around
+// the version writes. `failUpsertAt` fails the Nth upsert to simulate a dropped
+// connection mid-loop.
+function mockSession(opts: { readonly failUpsertAt?: number } = {}) {
+  const calls: Array<string> = [];
+  let upsertCount = 0;
+  const session: LegacyDbSession = {
+    exec: (sql: string) => Effect.sync(() => void calls.push(sql)),
+    query: (sql: string) => {
+      if (/INSERT INTO supabase_migrations/u.test(sql)) {
+        upsertCount += 1;
+        if (opts.failUpsertAt === upsertCount) {
+          return Effect.fail(new LegacyDbExecError({ message: "connection reset by peer" }));
+        }
+        calls.push("UPSERT");
+      }
+      return Effect.succeed([] as ReadonlyArray<Record<string, unknown>>);
+    },
+    extensionExists: () => Effect.die("extensionExists unused"),
+    copyToCsv: () => Effect.die("copyToCsv unused"),
+    queryRaw: () => Effect.die("queryRaw unused"),
+  };
+  return { session, calls };
+}
+
+function writeMigrations(dir: string): ReadonlyArray<LegacyPulledMigration> {
+  const migrations: ReadonlyArray<LegacyPulledMigration> = [
+    { path: join(dir, "20240101000000_a.sql"), version: "20240101000000" },
+    { path: join(dir, "20240101000001_b.sql"), version: "20240101000001" },
+  ];
+  writeFileSync(migrations[0]!.path, "create table a ();");
+  writeFileSync(migrations[1]!.path, "create table b ();");
+  return migrations;
+}
+
+describe("legacyUpdateMigrationHistory", () => {
+  it.effect("wraps the upserts in one BEGIN + N upserts + COMMIT transaction", () =>
+    Effect.gen(function* () {
+      const fs = yield* FileSystem.FileSystem;
+      const path = yield* Path.Path;
+      const dir = mkdtempSync(join(tmpdir(), "pull-sync-"));
+      const migrations = writeMigrations(dir);
+      const out = mockOutput();
+      const { session, calls } = mockSession();
+
+      yield* legacyUpdateMigrationHistory(session, fs, path, migrations).pipe(
+        Effect.provide(out.layer),
+      );
+
+      // The create-table setup runs its own BEGIN/COMMIT first; the upsert
+      // transaction is the trailing envelope around every version write.
+      expect(calls).not.toContain("ROLLBACK");
+      expect(calls.slice(-4)).toEqual(["BEGIN", "UPSERT", "UPSERT", "COMMIT"]);
+      // The success line is byte-identical to Go's repair output.
+      expect(out.stderrText).toContain(
+        "Repaired migration history: [20240101000000 20240101000001] => applied",
+      );
+    }).pipe(Effect.provide(BunServices.layer)),
+  );
+
+  it.effect("rolls back and surfaces the error when an upsert fails mid-loop", () =>
+    Effect.gen(function* () {
+      const fs = yield* FileSystem.FileSystem;
+      const path = yield* Path.Path;
+      const dir = mkdtempSync(join(tmpdir(), "pull-sync-"));
+      const migrations = writeMigrations(dir);
+      const out = mockOutput();
+      const { session, calls } = mockSession({ failUpsertAt: 2 });
+
+      const error = yield* legacyUpdateMigrationHistory(session, fs, path, migrations).pipe(
+        Effect.provide(out.layer),
+        Effect.flip,
+      );
+
+      // First upsert applied, second failed → the upsert transaction ends in
+      // ROLLBACK, never COMMIT (the create-table setup's own COMMIT ran earlier).
+      expect(calls.slice(-3)).toEqual(["BEGIN", "UPSERT", "ROLLBACK"]);
+      expect(calls[calls.length - 1]).toBe("ROLLBACK");
+      // Error message shape stays byte-identical to the pre-transaction version.
+      expect(error).toBeInstanceOf(LegacyDbPullWriteError);
+      expect(error.message).toBe("failed to update migration table: connection reset by peer");
+      // No success line when the repair failed.
+      expect(out.stderrText).not.toContain("Repaired migration history");
+    }).pipe(Effect.provide(BunServices.layer)),
+  );
+});
diff --git a/apps/cli/src/legacy/commands/db/pull/pull.sync.ts b/apps/cli/src/legacy/commands/db/pull/pull.sync.ts
index 3e251e4c1b..7d00895074 100644
--- a/apps/cli/src/legacy/commands/db/pull/pull.sync.ts
+++ b/apps/cli/src/legacy/commands/db/pull/pull.sync.ts
@@ -10,50 +10,80 @@ import {
 import { legacySplitAndTrim } from "../../../shared/legacy-sql-split.ts";
 import { LegacyDbPullWriteError } from "./pull.errors.ts";
 
+/** A pulled migration file paired with the version to record in the history. */
+export interface LegacyPulledMigration {
+  readonly path: string;
+  readonly version: string;
+}
+
 /**
- * Records the pulled migration as applied in `supabase_migrations.schema_migrations`
- * WITHOUT re-executing it (the schema already exists on the remote). Mirrors Go's
- * `repair.UpdateMigrationTable(conn, [version], Applied, false, fsys)`
+ * Records the pulled migration(s) as applied in
+ * `supabase_migrations.schema_migrations` WITHOUT re-executing them (the schema
+ * already exists on the remote). Mirrors Go's
+ * `repair.UpdateMigrationTable(conn, versions, Applied, false, fsys)`
  * (`internal/migration/repair/repair.go:58`): create the history table, then UPSERT
- * the version row with the migration's name + statements.
+ * each version row with the migration's name + statements. A pg-delta pull whose
+ * plan crosses a transaction boundary writes several ordered files, so several
+ * versions are recorded in one pass.
  */
 export const legacyUpdateMigrationHistory = (
   session: LegacyDbSession,
   fs: FileSystem.FileSystem,
   path: Path.Path,
-  migrationPath: string,
-  timestamp: string,
+  migrations: ReadonlyArray<LegacyPulledMigration>,
 ) =>
   Effect.gen(function* () {
     const output = yield* Output;
-    const match = MIGRATE_FILE_PATTERN.exec(path.basename(migrationPath));
-    if (match === null || match[1] !== timestamp) {
-      // Go resolves the repair file by globbing `<timestamp>_*.sql` against the
-      // migrations dir and fails with `os.ErrNotExist` when nothing matches
-      // (`repair.GetMigrationFile`, `internal/migration/repair/repair.go:90-99`).
-      // The glob is anchored on the GENERATED `timestamp` and `*` never crosses a
-      // path separator, so a migration name with a separator (`supabase db pull
-      // dir/...`) writes a nested file the glob can't reach — even when the nested
-      // basename is itself a valid migration filename (`dir/20250101000000_backfill`
-      // → basename `20250101000000_backfill.sql`, which DOES match the regex but
-      // carries the user's nested timestamp, not the generated one). Require the
-      // basename to both match the pattern AND carry the generated timestamp,
-      // mirroring Go's anchored glob, rather than trusting `path.basename`.
-      return yield* Effect.fail(
-        new LegacyDbPullWriteError({
-          message: `glob supabase/migrations/${timestamp}_*.sql: file does not exist`,
-        }),
-      );
+    // Resolve each file the way Go's `repair.GetMigrationFile` globs
+    // `<version>_*.sql` against the migrations dir, failing with `os.ErrNotExist`
+    // when nothing matches (`internal/migration/repair/repair.go:90-99`). The glob
+    // is anchored on the GENERATED version and `*` never crosses a path separator,
+    // so a migration name with a separator writes a nested file the glob can't
+    // reach — require the basename to both match the pattern AND carry the
+    // generated version rather than trusting `path.basename`.
+    const resolved: Array<{ version: string; name: string; migrationPath: string }> = [];
+    for (const migration of migrations) {
+      const match = MIGRATE_FILE_PATTERN.exec(path.basename(migration.path));
+      if (match === null || match[1] !== migration.version) {
+        return yield* Effect.fail(
+          new LegacyDbPullWriteError({
+            message: `glob supabase/migrations/${migration.version}_*.sql: file does not exist`,
+          }),
+        );
+      }
+      resolved.push({
+        version: migration.version,
+        name: match[2] ?? "",
+        migrationPath: migration.path,
+      });
     }
-    // Guarded above: match[1] === timestamp, so use the generated timestamp
-    // directly (avoids re-deriving a `string | undefined` from the regex group).
-    const version = timestamp;
-    const name = match[2] ?? "";
     yield* Effect.gen(function* () {
-      const content = yield* fs.readFileString(migrationPath);
-      const statements = legacySplitAndTrim(content);
+      // Create the history schema/table first, in its OWN transaction — Go runs
+      // `CreateMigrationTable` before the upsert batch (`repair.go:59`). Keeping it
+      // outside the upsert transaction below avoids nesting BEGINs
+      // (`legacyCreateMigrationTable` issues its own BEGIN/COMMIT).
       yield* legacyCreateMigrationTable(session);
-      yield* session.query(UPSERT_MIGRATION_VERSION, [version, name, statements]);
+      // Record every version in ONE explicit transaction: a mid-loop failure
+      // (dropped connection, unreadable migration file) must record NONE of them.
+      // Go queues all upserts in a single `pgx.Batch` (`repair.go:63-83`), which
+      // Postgres executes as one implicit transaction; without a transaction here
+      // each UPSERT autocommits, so a failure partway through would leave partial
+      // remote history that fails the next pull's sync check.
+      yield* Effect.gen(function* () {
+        yield* session.exec("BEGIN");
+        for (const entry of resolved) {
+          const content = yield* fs.readFileString(entry.migrationPath);
+          const statements = legacySplitAndTrim(content);
+          yield* session.query(UPSERT_MIGRATION_VERSION, [entry.version, entry.name, statements]);
+        }
+        yield* session.exec("COMMIT");
+      }).pipe(
+        // Roll back on ANY failure inside the transaction — including a migration
+        // file read that fails after BEGIN. `Effect.ignore` keeps a ROLLBACK
+        // failure from masking the original error (`tapError` re-raises the
+        // original). Mirrors `legacyCreateMigrationTable`'s rollback handling.
+        Effect.tapError(() => session.exec("ROLLBACK").pipe(Effect.ignore)),
+      );
     }).pipe(
       Effect.mapError(
         (cause) =>
@@ -63,8 +93,9 @@ export const legacyUpdateMigrationHistory = (
       ),
     );
     // Match Go's `repair.UpdateMigrationTable(..., repairAll=false, ...)`, which
-    // prints `Repaired migration history: [<version>] => applied` to stderr
-    // (`internal/migration/repair/repair.go`). Plain text on stderr, so it does
-    // not interfere with machine-output payloads on stdout.
-    yield* output.raw(`Repaired migration history: [${version}] => applied\n`, "stderr");
+    // prints `Repaired migration history: [<v1> <v2> ...] => applied` to stderr
+    // (Go's `%v` over the `[]string` of versions, space-separated). Plain text on
+    // stderr, so it does not interfere with machine-output payloads on stdout.
+    const versions = resolved.map((entry) => entry.version).join(" ");
+    yield* output.raw(`Repaired migration history: [${versions}] => applied\n`, "stderr");
   });
diff --git a/apps/cli/src/legacy/commands/db/push/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/db/push/SIDE_EFFECTS.md
index 11337a8955..6b928c8c4b 100644
--- a/apps/cli/src/legacy/commands/db/push/SIDE_EFFECTS.md
+++ b/apps/cli/src/legacy/commands/db/push/SIDE_EFFECTS.md
@@ -1,59 +1,112 @@
 # `supabase db push`
 
+Native TypeScript port of `apps/cli-go/internal/db/push/push.go`. Applies pending
+local migrations (and optionally seed data and custom roles) to the local or
+linked/remote Postgres database.
+
 ## Files Read
 
-| Path                             | Format     | When                                              |
-| -------------------------------- | ---------- | ------------------------------------------------- |
-| `~/.supabase/access-token`       | plain text | when `SUPABASE_ACCESS_TOKEN` unset and `--linked` |
-| `<workdir>/supabase/migrations/` | directory  | always, to list migration files to push           |
-| `<workdir>/supabase/roles.sql`   | SQL        | when `--include-roles` is set                     |
-| seed files from config           | SQL        | when `--include-seed` is set                      |
+| Path                                  | Format     | When                                                                    |
+| ------------------------------------- | ---------- | ----------------------------------------------------------------------- |
+| `<workdir>/supabase/config.toml`      | TOML       | always (embedded defaults used when absent)                             |
+| `~/.supabase/<hash>/project-ref`      | plain text | on the `--linked` path (and the default target), to resolve the ref     |
+| `~/.supabase/access-token`            | plain text | when `SUPABASE_ACCESS_TOKEN` unset and a linked temp-role is minted     |
+| `<workdir>/supabase/migrations/`      | directory  | when `[db.migrations].enabled` (default true), to list local files      |
+| `<workdir>/supabase/migrations/*.sql` | SQL        | for each pending migration, when applied (and not `--dry-run`)          |
+| seed files from `[db.seed].sql_paths` | SQL        | when `--include-seed` and `[db.seed].enabled` (paths under `supabase/`) |
+| `<workdir>/supabase/roles.sql`        | SQL        | when `--include-roles` (existence check + apply)                        |
 
 ## Files Written
 
-| Path | Format | When |
-| ---- | ------ | ---- |
-| —    | —      | —    |
+| Path                                                                            | Format | When                                                                                                                                                                                                                                                 |
+| ------------------------------------------------------------------------------- | ------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `~/.supabase/<workdir-hash>/linked-project.json`                                | JSON   | on the `--linked` path (post-run cache, Go's `ensureProjectGroupsCached`)                                                                                                                                                                            |
+| `~/.supabase/telemetry.json`                                                    | JSON   | always (post-run telemetry flush)                                                                                                                                                                                                                    |
+| `<workdir>/supabase/.temp/pgdelta/catalog-<prefix>-migrations-<hash>-<ts>.json` | JSON   | best-effort, after a successful migration apply, when pg-delta is enabled (`[experimental.pgdelta] enabled` or `SUPABASE_EXPERIMENTAL_PG_DELTA`); a failure only warns on stderr and never fails the push (Go's `pgcache.TryCacheMigrationsCatalog`) |
+| `<workdir>/supabase/.temp/pgdelta/pgdelta-target-ca.crt`                        | PEM    | same gate as above, when the target requires SSL (`legacyPreparePgDeltaRef`)                                                                                                                                                                         |
+
+## Database Mutations
+
+| Statement                                                                                                                                | When                                                                                                   |
+| ---------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------ |
+| `RESET ALL` + `BEGIN` … migration statements … `INSERT INTO supabase_migrations.schema_migrations(version, name, statements)` … `COMMIT` | per pending migration (after confirmation)                                                             |
+| `CREATE SCHEMA/TABLE … supabase_migrations.schema_migrations`, `ALTER TABLE … ADD COLUMN …`                                              | once before applying migrations (idempotent)                                                           |
+| `RESET ALL` + `BEGIN` … roles.sql statements … `COMMIT` (no history row)                                                                 | per `--include-roles` globals file (after confirmation)                                                |
+| `SELECT id, name FROM vault.secrets …`, `SELECT vault.update_secret(...)`, `SELECT vault.create_secret(...)`                             | when `[db.vault]` has syncable secrets and migrations are applied                                      |
+| `CREATE TABLE … supabase_migrations.seed_files`, seed statements, `INSERT … seed_files(path, hash) … ON CONFLICT …`                      | per pending seed file with `--include-seed` (after confirmation); a dirty seed only refreshes the hash |
 
 ## API Routes
 
-| Method | Path | Auth | Request body | Response (used fields) |
-| ------ | ---- | ---- | ------------ | ---------------------- |
-| —      | —    | —    | —            | —                      |
+| Method | Path | Auth | Request body | Response (used fields)                                                                                                                                                                           |
+| ------ | ---- | ---- | ------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
+| —      | —    | —    | —            | The native handler connects to Postgres directly. On the `--linked` path the db-config resolver may call the Management API to mint a temporary login role (inherited from the shared resolver). |
 
 ## Environment Variables
 
-| Variable                | Purpose                                 | Required?                                               |
-| ----------------------- | --------------------------------------- | ------------------------------------------------------- |
-| `SUPABASE_ACCESS_TOKEN` | auth token for `--linked` mode          | no (falls back to keyring → `~/.supabase/access-token`) |
-| `DB_PASSWORD`           | password for direct database connection | no                                                      |
+| Variable                           | Purpose                                                                             | Required?                                               |
+| ---------------------------------- | ----------------------------------------------------------------------------------- | ------------------------------------------------------- |
+| `SUPABASE_ACCESS_TOKEN`            | auth token for the `--linked` resolver path                                         | no (falls back to keyring → `~/.supabase/access-token`) |
+| `SUPABASE_DB_PASSWORD`             | password for the linked/remote connection                                           | no (`--password`/`-p` takes precedence)                 |
+| `SUPABASE_YES`                     | auto-confirm prompts (Go's `viper YES`)                                             | no (also `--yes`)                                       |
+| `SUPABASE_EXPERIMENTAL_PG_DELTA`   | enables the migrations-catalog cache when `[experimental.pgdelta].enabled` is unset | no (project `.env` or shell)                            |
+| `SUPABASE_INTERNAL_IMAGE_REGISTRY` | overrides the pg-delta edge-runtime image registry for the cache export             | no (project `.env` or shell)                            |
 
 ## Exit Codes
 
-| Code | Condition                   |
-| ---- | --------------------------- |
-| `0`  | success                     |
-| `1`  | database connection failure |
-| `1`  | migration apply error       |
+| Code | Condition                                                                 |
+| ---- | ------------------------------------------------------------------------- |
+| `0`  | success (including "up to date")                                          |
+| `1`  | mutually exclusive target flags (`[db-url linked local]`)                 |
+| `1`  | `ErrMissingLocal` — remote versions absent locally (suggests repair/pull) |
+| `1`  | `ErrMissingRemote` without `--include-all` (suggests `--include-all`)     |
+| `1`  | user declined a confirmation prompt (`context canceled`)                  |
+| `1`  | `config.toml` parse failure                                               |
+| `1`  | database connection / migration / seed / roles / vault apply failure      |
 
 ## Output
 
-### `--output-format text` (Go CLI compatible)
+Diagnostics ("Connecting to…", "Applying migration…", "Seeding…", "Updating vault
+secrets…", skip/up-to-date notices, dry-run plan, prompts) go to **stderr**. The
+two summary lines Go prints to **stdout** — `<Target> is up to date.` and
+`Finished supabase db push.` (the command name in Aqua) — go to stdout in text
+mode; in machine modes they are suppressed and a structured result is emitted.
 
-Prints applied migration versions to stderr. With `--dry-run`, prints the migrations that would be applied.
+### `--output-format text` (Go CLI compatible)
 
-### `--output-format json`
+Byte-matches Go: connection status, per-item progress, prompts, and the stdout
+summary line, including ANSI color (Aqua command name, Bold file paths).
 
-Not applicable.
+### `--output-format json` / `stream-json`
 
-### `--output-format stream-json`
+stdout is payload-only. A single `result` object is emitted:
 
-Not applicable.
+```json
+{
+  "upToDate": false,
+  "dryRun": false,
+  "migrations": ["<file>.sql"],
+  "seeds": ["supabase/seed.sql"],
+  "roles": ["supabase/roles.sql"]
+}
+```
 
 ## Notes
 
-- `--dry-run` prints the migrations that would be applied without applying them.
-- `--include-all` includes all migrations not found in remote history table.
-- `--include-roles` includes custom roles from the roles file.
-- `--include-seed` includes seed data from config.
-- `--db-url`, `--linked` (default true), and `--local` are mutually exclusive.
+- **Targets**: `--db-url`, `--linked` (default), and `--local` are mutually
+  exclusive; with no flag the target defaults to linked, matching Go.
+- **Prompt order**: custom roles → migrations → seeds; each defaults to "yes" and
+  declining returns `context canceled`.
+- **`--dry-run`** prints the plan (roles / migrations / seeds) and applies nothing.
+- **`[db.migrations].enabled = false`** / **`[db.seed].enabled = false`** print a
+  skip notice naming the project ref (empty for local/db-url).
+- **Vault**: non-empty, non-`env()` `[db.vault]` values are synced after config
+  load, including decrypted `encrypted:` values.
+- **Migrations catalog cache**: ported (Go's best-effort `pgcache.TryCacheMigrationsCatalog`).
+  After a successful migration apply, when pg-delta is enabled, exports the target's
+  pg-delta catalog via the edge-runtime stack and writes it under
+  `supabase/.temp/pgdelta/`, pruning older snapshots for the same prefix (retains 2).
+  A failure only warns on stderr (`Warning: failed to cache migrations catalog: …`)
+  and never fails the push, matching Go exactly. Reuses `legacyExportCatalogPgDelta`
+  (the same pg-delta export path `db pull`/`db diff` use, which always mounts the
+  project root at `/workspace`) rather than a second copy, so the ENOENT bug fixed in
+  Go's `pgcache/cache.go` (supabase/cli#5921) has no TS equivalent.
diff --git a/apps/cli/src/legacy/commands/db/push/push.command.ts b/apps/cli/src/legacy/commands/db/push/push.command.ts
index 2d6d8d17e9..8c936315ca 100644
--- a/apps/cli/src/legacy/commands/db/push/push.command.ts
+++ b/apps/cli/src/legacy/commands/db/push/push.command.ts
@@ -1,6 +1,10 @@
 import { Command, Flag } from "effect/unstable/cli";
 import type * as CliCommand from "effect/unstable/cli/Command";
+
+import { withJsonErrorHandling } from "../../../../shared/output/json-error-handling.ts";
+import { withLegacyCommandInstrumentation } from "../../../telemetry/legacy-command-instrumentation.ts";
 import { legacyDbPush } from "./push.handler.ts";
+import { legacyDbPushRuntimeLayer } from "./push.layers.ts";
 
 const config = {
   includeAll: Flag.boolean("include-all").pipe(
@@ -37,5 +41,24 @@ export type LegacyDbPushFlags = CliCommand.Command.Config.Infer<typeof config>;
 export const legacyDbPushCommand = Command.make("push", config).pipe(
   Command.withDescription("Push new migrations to the remote database."),
   Command.withShortDescription("Push new migrations to the remote database"),
-  Command.withHandler((flags) => legacyDbPush(flags)),
+  Command.withHandler((flags) =>
+    legacyDbPush(flags).pipe(
+      withLegacyCommandInstrumentation({
+        flags: {
+          "include-all": flags.includeAll,
+          "include-roles": flags.includeRoles,
+          "include-seed": flags.includeSeed,
+          "dry-run": flags.dryRun,
+          "db-url": flags.dbUrl,
+          linked: flags.linked,
+          local: flags.local,
+          // `password` is a credential — always reaches telemetry as `<redacted>`.
+          password: flags.password,
+        },
+        aliases: { p: "password" },
+      }),
+      withJsonErrorHandling,
+    ),
+  ),
+  Command.provide(legacyDbPushRuntimeLayer),
 );
diff --git a/apps/cli/src/legacy/commands/db/push/push.errors.ts b/apps/cli/src/legacy/commands/db/push/push.errors.ts
new file mode 100644
index 0000000000..3849d55add
--- /dev/null
+++ b/apps/cli/src/legacy/commands/db/push/push.errors.ts
@@ -0,0 +1,56 @@
+import { Data } from "effect";
+
+/**
+ * Conflicting database-target flags. Reproduces cobra's
+ * `MarkFlagsMutuallyExclusive("db-url", "linked", "local")` error byte-for-byte
+ * (`apps/cli-go/cmd/db.go:526`).
+ */
+export class LegacyDbPushTargetFlagsError extends Data.TaggedError("LegacyDbPushTargetFlagsError")<{
+  readonly message: string;
+}> {}
+
+/**
+ * Remote migration versions are missing from the local directory. Byte-matches
+ * Go's `migration.ErrMissingLocal` (`pkg/migration/apply.go:16`); the
+ * `migration repair` / `db pull` suggestion is attached (Go's `CmdSuggestion`).
+ */
+export class LegacyDbPushMissingLocalError extends Data.TaggedError(
+  "LegacyDbPushMissingLocalError",
+)<{
+  readonly message: string;
+  readonly suggestion: string;
+}> {}
+
+/**
+ * Local migration files are ordered before the remote head and `--include-all`
+ * was not passed. Byte-matches Go's `migration.ErrMissingRemote`
+ * (`pkg/migration/apply.go:15`); the `--include-all` suggestion is attached.
+ */
+export class LegacyDbPushMissingRemoteError extends Data.TaggedError(
+  "LegacyDbPushMissingRemoteError",
+)<{
+  readonly message: string;
+  readonly suggestion: string;
+}> {}
+
+/**
+ * The user declined a confirmation prompt. Go returns `errors.New(context.Canceled)`
+ * (`internal/db/push/push.go:80,91,110`), rendered as `context canceled`.
+ */
+export class LegacyDbPushCancelledError extends Data.TaggedError("LegacyDbPushCancelledError")<{
+  readonly message: string;
+}> {}
+
+/** Locating `supabase/roles.sql` failed (Go's `failed to find custom roles: %w`). */
+export class LegacyDbPushRolesError extends Data.TaggedError("LegacyDbPushRolesError")<{
+  readonly message: string;
+}> {}
+
+/**
+ * A migration / seed / globals / vault statement failed while applying. Carries
+ * the underlying Postgres error (with Go's `At statement: <n>` context for
+ * migrations) so stderr matches Go's propagated error.
+ */
+export class LegacyDbPushApplyError extends Data.TaggedError("LegacyDbPushApplyError")<{
+  readonly message: string;
+}> {}
diff --git a/apps/cli/src/legacy/commands/db/push/push.handler.ts b/apps/cli/src/legacy/commands/db/push/push.handler.ts
index fddb270174..47ea574459 100644
--- a/apps/cli/src/legacy/commands/db/push/push.handler.ts
+++ b/apps/cli/src/legacy/commands/db/push/push.handler.ts
@@ -1,17 +1,371 @@
-import { Effect, Option } from "effect";
-import { LegacyGoProxy } from "../../../../shared/legacy/go-proxy.service.ts";
+import { Clock, Effect, FileSystem, Option, Path } from "effect";
+
+import { CliArgs } from "../../../../shared/cli/cli-args.service.ts";
+import { LegacyDnsResolverFlag } from "../../../../shared/legacy/global-flags.ts";
+import { legacyResolveYesWithProjectEnv } from "../../../../shared/legacy/global-flags.ts";
+import { Output } from "../../../../shared/output/output.service.ts";
+import { LegacyCliConfig } from "../../../config/legacy-cli-config.service.ts";
+import { LegacyProjectRefResolver } from "../../../config/legacy-project-ref.service.ts";
+import { legacyAqua, legacyBold } from "../../../shared/legacy-colors.ts";
+import { LegacyDbConfigResolver } from "../../../shared/legacy-db-config.service.ts";
+import {
+  legacyApplyProjectEnv,
+  legacyCheckDbToml,
+  legacyLoadProjectEnv,
+} from "../../../shared/legacy-db-config.toml-read.ts";
+import { LegacyDbConnection } from "../../../shared/legacy-db-connection.service.ts";
+import {
+  legacyApplyMigrations,
+  legacySeedGlobals,
+} from "../../../shared/legacy-migration-apply.ts";
+import { legacyPromptYesNo } from "../../../shared/legacy-prompt-yes-no.ts";
+import { legacyToPostgresURL } from "../../../shared/legacy-postgres-url.ts";
+import { resolveLegacyDbTargetFlags } from "../../../shared/legacy-db-target-flags.ts";
+import { LegacyLinkedProjectCache } from "../../../telemetry/legacy-linked-project-cache.service.ts";
+import { LegacyTelemetryState } from "../../../telemetry/legacy-telemetry-state.service.ts";
+import { redactLegacyConnectionString } from "../../../shared/legacy-db-config.parse.ts";
+import { legacyParseBoolEnv } from "../shared/legacy-diff-engine.ts";
+import {
+  legacyListLocalMigrations,
+  legacyTryCacheMigrationsCatalog,
+} from "../shared/legacy-pgdelta.cache.ts";
+import { type LegacyPgDeltaContext } from "../shared/legacy-pgdelta.ts";
+import {
+  LEGACY_ERR_MISSING_LOCAL,
+  LEGACY_ERR_MISSING_REMOTE,
+  legacyFindPendingMigrations,
+  legacyIncludeAllPending,
+  legacySuggestIgnoreFlag,
+  legacySuggestRevertHistory,
+} from "../shared/legacy-migration-pending.ts";
+import {
+  type LegacySeedFile,
+  legacyGetPendingSeeds,
+  legacySeedData,
+} from "../shared/legacy-seed-ops.ts";
+import { legacyUpsertVaultSecrets } from "../../../shared/legacy-vault.ts";
+// Listing the remote `schema_migrations` history (with the 42P01 → empty rule)
+// lives in the shared migration-history module (Go's `migration.ListRemoteMigrations`).
+import { legacyListRemoteMigrations } from "../../../shared/legacy-migration-history.ts";
 import type { LegacyDbPushFlags } from "./push.command.ts";
+import {
+  LegacyDbPushApplyError,
+  LegacyDbPushCancelledError,
+  LegacyDbPushMissingLocalError,
+  LegacyDbPushMissingRemoteError,
+  LegacyDbPushRolesError,
+  LegacyDbPushTargetFlagsError,
+} from "./push.errors.ts";
+
+const CUSTOM_ROLES_PATH = "supabase/roles.sql";
+
+const toSlash = (p: string): string => p.replaceAll("\\", "/");
+
+/** Go's `confirmPushAll` (`internal/db/push/push.go:123-129`) — bold filenames. */
+const confirmPushAll = (filenames: ReadonlyArray<string>): string =>
+  filenames.map((name) => ` • ${legacyBold(name)}\n`).join("");
+
+/** Go's `confirmSeedAll` (`internal/db/push/push.go:131-140`) — bold paths, hash notice. */
+const confirmSeedAll = (seeds: ReadonlyArray<LegacySeedFile>): string =>
+  seeds
+    .map((seed) => ` • ${legacyBold(seed.dirty ? `${seed.path} (hash update)` : seed.path)}\n`)
+    .join("");
+
+const applyError = (message: string) => new LegacyDbPushApplyError({ message });
 
+/**
+ * `supabase db push` — apply pending local migrations (and optionally seed data
+ * and custom roles) to the local or linked/remote database.
+ *
+ * Strict 1:1 port of `apps/cli-go/internal/db/push/push.go`.
+ */
 export const legacyDbPush = Effect.fn("legacy.db.push")(function* (flags: LegacyDbPushFlags) {
-  const proxy = yield* LegacyGoProxy;
-  const args: string[] = ["db", "push"];
-  if (flags.includeAll) args.push("--include-all");
-  if (flags.includeRoles) args.push("--include-roles");
-  if (flags.includeSeed) args.push("--include-seed");
-  if (flags.dryRun) args.push("--dry-run");
-  if (Option.isSome(flags.dbUrl)) args.push("--db-url", flags.dbUrl.value);
-  if (flags.linked) args.push("--linked");
-  if (flags.local) args.push("--local");
-  if (Option.isSome(flags.password)) args.push("--password", flags.password.value);
-  yield* proxy.exec(args);
+  const output = yield* Output;
+  const resolver = yield* LegacyDbConfigResolver;
+  const dbConn = yield* LegacyDbConnection;
+  const cliConfig = yield* LegacyCliConfig;
+  const telemetryState = yield* LegacyTelemetryState;
+  const linkedProjectCache = yield* LegacyLinkedProjectCache;
+  const fs = yield* FileSystem.FileSystem;
+  const path = yield* Path.Path;
+  const cliArgs = yield* CliArgs;
+  const dnsResolver = yield* LegacyDnsResolverFlag;
+
+  const workdir = cliConfig.workdir;
+  // Go's `ParseDatabaseConfig` runs `loadNestedEnv` (which `os.Setenv`s each project-`.env`
+  // key) before `PromptYesNo` reads `viper.GetBool("YES")`, so a `SUPABASE_YES` set only in
+  // `supabase/.env` auto-confirms. Resolve `yes` with that project env, as `db pull` does.
+  const projectEnv = yield* legacyLoadProjectEnv(fs, path, workdir);
+  const yes = yield* legacyResolveYesWithProjectEnv(projectEnv);
+  let linkedRefForCache: string | undefined;
+
+  const body = Effect.gen(function* () {
+    yield* legacyApplyProjectEnv(projectEnv);
+    const target = resolveLegacyDbTargetFlags(cliArgs.args);
+    // cobra MarkFlagsMutuallyExclusive("db-url", "linked", "local"), keyed off the
+    // explicitly-set flags (cobra's `Changed`), not the `--linked` default value.
+    if (target.setFlags.length > 1) {
+      return yield* Effect.fail(
+        new LegacyDbPushTargetFlagsError({
+          message: `if any flags in the group [db-url linked local] are set none of the others can be; [${target.setFlags.join(" ")}] were all set`,
+        }),
+      );
+    }
+    // Go's push defaults `--linked` to true, so no target flag → linked.
+    const connType = target.connType ?? "linked";
+
+    // The linked path resolves the project ref before loading config so a matching
+    // `[remotes.<ref>]` block merges (Go's ParseDatabaseConfig → LoadConfig). For
+    // `--local` / `--db-url`, Go leaves `flags.ProjectRef` empty.
+    let projectRef = "";
+    if (connType === "linked") {
+      const refResolver = yield* LegacyProjectRefResolver;
+      projectRef = yield* refResolver.loadProjectRef(Option.none());
+      linkedRefForCache = projectRef;
+    }
+
+    // Single Go-parity config load (`flags.LoadConfig` → `config.Load` + `Validate`):
+    // decodes the whole config with Go's env-expansion + `strconv.ParseBool` weak typing
+    // (so `enabled = "env(SEED_ENABLED)"` etc. load like Go), applies `SUPABASE_*`
+    // AutomaticEnv overrides, merges a matching `[remotes.<ref>]` block, and decrypts every
+    // `encrypted:` secret with the shell AND project-`.env` `DOTENV_PRIVATE_KEY*` keys —
+    // aborting here (before connecting or writing) on any undecryptable/invalid config.
+    const toml = yield* legacyCheckDbToml(
+      fs,
+      path,
+      workdir,
+      projectRef !== "" ? projectRef : undefined,
+    );
+    if (toml.appliedRemote !== undefined) {
+      yield* output.raw(`Loading config override: [remotes.${toml.appliedRemote}]\n`, "stderr");
+    }
+    const vaultSecrets = toml.vault;
+
+    if (flags.dryRun) {
+      yield* output.raw("DRY RUN: migrations will *not* be pushed to the database.\n", "stderr");
+    }
+
+    const cfg = yield* resolver.resolve({
+      dbUrl: flags.dbUrl,
+      connType,
+      dnsResolver,
+      password: flags.password,
+    });
+    const databaseName = cfg.isLocal ? "local database" : "remote database";
+    const statusTarget = cfg.isLocal ? "Local database" : "Remote database";
+
+    yield* Effect.scoped(
+      Effect.gen(function* () {
+        yield* output.raw(
+          `Connecting to ${cfg.isLocal ? "local" : "remote"} database...\n`,
+          "stderr",
+        );
+        const session = yield* dbConn.connect(cfg.conn, { isLocal: cfg.isLocal, dnsResolver });
+
+        // --- Collect pending migrations ---
+        let pending: ReadonlyArray<string> = [];
+        if (!toml.migrationsEnabled) {
+          yield* output.raw(
+            `Skipping migrations because it is disabled in config.toml for project: ${projectRef}\n`,
+            "stderr",
+          );
+        } else {
+          const migrationsDir = path.join(workdir, "supabase", "migrations");
+          const remote = yield* legacyListRemoteMigrations(session);
+          const local = yield* legacyListLocalMigrations(fs, path, migrationsDir);
+          const result = legacyFindPendingMigrations(local, remote);
+          if (result.kind === "missing-local") {
+            return yield* Effect.fail(
+              new LegacyDbPushMissingLocalError({
+                message: LEGACY_ERR_MISSING_LOCAL,
+                suggestion: legacySuggestRevertHistory(result.versions),
+              }),
+            );
+          }
+          if (result.kind === "missing-remote") {
+            if (!flags.includeAll) {
+              // Go's suggestIgnoreFlag lists the workdir-relative paths.
+              const relPaths = result.paths.map((p) => toSlash(path.relative(workdir, p)));
+              return yield* Effect.fail(
+                new LegacyDbPushMissingRemoteError({
+                  message: LEGACY_ERR_MISSING_REMOTE,
+                  suggestion: legacySuggestIgnoreFlag(relPaths),
+                }),
+              );
+            }
+            pending = legacyIncludeAllPending(local, remote.length, result.paths);
+          } else {
+            pending = result.pending;
+          }
+        }
+
+        // --- Collect pending seeds ---
+        let seeds: ReadonlyArray<LegacySeedFile> = [];
+        if (flags.includeSeed) {
+          if (!toml.seed.enabled) {
+            yield* output.raw(
+              `Skipping seed because it is disabled in config.toml for project: ${projectRef}\n`,
+              "stderr",
+            );
+          } else {
+            seeds = yield* legacyGetPendingSeeds(session, fs, path, toml.seed.sqlPaths, workdir);
+          }
+        }
+
+        // --- Collect custom roles ---
+        const globals: Array<string> = [];
+        if (flags.includeRoles) {
+          const exists = yield* fs.exists(path.join(workdir, CUSTOM_ROLES_PATH)).pipe(
+            Effect.mapError(
+              (cause) =>
+                new LegacyDbPushRolesError({
+                  message: `failed to find custom roles: ${cause.message}`,
+                }),
+            ),
+          );
+          if (exists) globals.push(CUSTOM_ROLES_PATH);
+        }
+
+        // --- Nothing to push ---
+        if (pending.length === 0 && seeds.length === 0 && globals.length === 0) {
+          if (output.format === "text") {
+            yield* output.raw(`${statusTarget} is up to date.\n`);
+          } else {
+            yield* output.success(`${statusTarget} is up to date.`, {
+              upToDate: true,
+              dryRun: flags.dryRun,
+              migrations: [],
+              seeds: [],
+              roles: [],
+            });
+          }
+          return;
+        }
+
+        if (flags.dryRun) {
+          if (globals.length > 0) {
+            yield* output.raw(
+              `Would create custom roles ${legacyBold(globals[0]!)}...\n`,
+              "stderr",
+            );
+          }
+          if (pending.length > 0) {
+            yield* output.raw("Would push these migrations:\n", "stderr");
+            yield* output.raw(confirmPushAll(pending.map((p) => path.basename(p))), "stderr");
+          }
+          if (seeds.length > 0) {
+            yield* output.raw("Would seed these files:\n", "stderr");
+            yield* output.raw(confirmSeedAll(seeds), "stderr");
+          }
+        } else {
+          // --- Custom roles ---
+          if (globals.length > 0) {
+            const ok = yield* legacyPromptYesNo(
+              output,
+              yes,
+              "Do you want to create custom roles in the database cluster?",
+              true,
+            );
+            if (!ok) {
+              return yield* Effect.fail(
+                new LegacyDbPushCancelledError({ message: "context canceled" }),
+              );
+            }
+            yield* legacySeedGlobals(
+              session,
+              fs,
+              path,
+              globals.map((g) => path.join(workdir, g)),
+              applyError,
+            );
+          }
+
+          // --- Migrations ---
+          if (pending.length > 0) {
+            const ok = yield* legacyPromptYesNo(
+              output,
+              yes,
+              `Do you want to push these migrations to the ${databaseName}?\n${confirmPushAll(pending.map((p) => path.basename(p)))}`,
+              true,
+            );
+            if (!ok) {
+              return yield* Effect.fail(
+                new LegacyDbPushCancelledError({ message: "context canceled" }),
+              );
+            }
+            yield* legacyUpsertVaultSecrets(session, vaultSecrets);
+            yield* legacyApplyMigrations(session, fs, path, pending, applyError);
+            const cacheEnabled =
+              toml.pgDelta.enabled ||
+              legacyParseBoolEnv(toml.envLookup("SUPABASE_EXPERIMENTAL_PG_DELTA"));
+            const pgDeltaCtx: LegacyPgDeltaContext = {
+              projectId: Option.getOrElse(cliConfig.projectId, () => ""),
+              cwd: workdir,
+              npmVersion: Option.getOrUndefined(toml.pgDelta.npmVersion),
+              denoVersion: toml.denoVersion,
+            };
+            yield* legacyTryCacheMigrationsCatalog(fs, path, pgDeltaCtx, {
+              enabled: cacheEnabled,
+              targetUrl: legacyToPostgresURL(cfg.conn),
+              conn: cfg.conn,
+              isLocal: cfg.isLocal,
+              migrationsDir: path.join(workdir, "supabase", "migrations"),
+              nowMillis: yield* Clock.currentTimeMillis,
+            }).pipe(
+              Effect.catch((error) =>
+                output.raw(
+                  `Warning: failed to cache migrations catalog: ${redactLegacyConnectionString(error.message)}\n`,
+                  "stderr",
+                ),
+              ),
+            );
+          } else {
+            yield* output.raw("Schema migrations are up to date.\n", "stderr");
+          }
+
+          // --- Seeds ---
+          if (seeds.length > 0) {
+            const ok = yield* legacyPromptYesNo(
+              output,
+              yes,
+              `Do you want to seed the ${databaseName} with these files?\n${confirmSeedAll(seeds)}`,
+              true,
+            );
+            if (!ok) {
+              return yield* Effect.fail(
+                new LegacyDbPushCancelledError({ message: "context canceled" }),
+              );
+            }
+            yield* legacySeedData(session, fs, workdir, path, seeds, applyError);
+          } else if (flags.includeSeed) {
+            yield* output.raw("Seed files are up to date.\n", "stderr");
+          }
+        }
+
+        if (output.format === "text") {
+          yield* output.raw(`Finished ${legacyAqua("supabase db push")}.\n`);
+        } else {
+          yield* output.success("Finished supabase db push.", {
+            upToDate: false,
+            dryRun: flags.dryRun,
+            migrations: pending.map((p) => path.basename(p)),
+            seeds: seeds.map((s) => s.path),
+            roles: globals,
+          });
+        }
+      }),
+    );
+  });
+
+  yield* body.pipe(
+    Effect.ensuring(
+      Effect.suspend(() =>
+        linkedRefForCache !== undefined && linkedRefForCache !== ""
+          ? linkedProjectCache.cache(linkedRefForCache)
+          : Effect.void,
+      ),
+    ),
+    Effect.ensuring(telemetryState.flush),
+    Effect.scoped,
+  );
 });
diff --git a/apps/cli/src/legacy/commands/db/push/push.integration.test.ts b/apps/cli/src/legacy/commands/db/push/push.integration.test.ts
new file mode 100644
index 0000000000..8ebd64c289
--- /dev/null
+++ b/apps/cli/src/legacy/commands/db/push/push.integration.test.ts
@@ -0,0 +1,976 @@
+import { createHash } from "node:crypto";
+import { existsSync, mkdirSync, readdirSync, readFileSync, writeFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+
+import { BunServices } from "@effect/platform-bun";
+import { describe, expect, it } from "@effect/vitest";
+import { Effect, Exit, Layer, Option } from "effect";
+
+import { mockOutput, mockStdin, mockTty } from "../../../../../tests/helpers/mocks.ts";
+import {
+  LEGACY_VALID_REF,
+  mockLegacyCliConfig,
+  mockLegacyLinkedProjectCacheTracked,
+  mockLegacyTelemetryStateTracked,
+  useLegacyTempWorkdir,
+} from "../../../../../tests/helpers/legacy-mocks.ts";
+import { CliArgs } from "../../../../shared/cli/cli-args.service.ts";
+import { LegacyDnsResolverFlag, LegacyYesFlag } from "../../../../shared/legacy/global-flags.ts";
+import type { OutputFormat } from "../../../../shared/output/types.ts";
+import { LegacyProjectRefResolver } from "../../../config/legacy-project-ref.service.ts";
+import { LegacyProjectNotLinkedError } from "../../../config/legacy-project-ref.errors.ts";
+import { LegacyDbConfigResolver } from "../../../shared/legacy-db-config.service.ts";
+import type {
+  LegacyDbConfigFlags,
+  LegacyResolvedDbConfig,
+} from "../../../shared/legacy-db-config.types.ts";
+import { LegacyDbExecError } from "../../../shared/legacy-db-connection.errors.ts";
+import {
+  LegacyDbConnection,
+  type LegacyPgConnInput,
+} from "../../../shared/legacy-db-connection.service.ts";
+import { LegacyEdgeRuntimeScriptError } from "../../../shared/legacy-edge-runtime-script.errors.ts";
+import {
+  LegacyEdgeRuntimeScript,
+  type LegacyEdgeRuntimeRunOpts,
+} from "../../../shared/legacy-edge-runtime-script.service.ts";
+import { LegacyPgDeltaSslProbe } from "../../../shared/legacy-pgdelta-ssl-probe.service.ts";
+import { legacyDbPush } from "./push.handler.ts";
+import type { LegacyDbPushFlags } from "./push.command.ts";
+
+const LIST_MIGRATIONS =
+  "SELECT version FROM supabase_migrations.schema_migrations ORDER BY version";
+const SELECT_SEEDS = "SELECT path, hash FROM supabase_migrations.seed_files";
+const READ_VAULT = "SELECT id, name FROM vault.secrets WHERE name = ANY($1)";
+
+const LOCAL_CONN: LegacyPgConnInput = {
+  host: "127.0.0.1",
+  port: 54322,
+  user: "postgres",
+  password: "postgres",
+  database: "postgres",
+};
+
+const DEFAULT_FLAGS: LegacyDbPushFlags = {
+  includeAll: false,
+  includeRoles: false,
+  includeSeed: false,
+  dryRun: false,
+  dbUrl: Option.none(),
+  linked: false,
+  local: true,
+  password: Option.none(),
+};
+
+function mockResolver(opts: { isLocal?: boolean } = {}) {
+  return Layer.succeed(LegacyDbConfigResolver, {
+    resolve: (_flags: LegacyDbConfigFlags) =>
+      Effect.succeed({
+        conn: LOCAL_CONN,
+        isLocal: opts.isLocal ?? true,
+      } satisfies LegacyResolvedDbConfig),
+    resolvePoolerFallback: () => Effect.succeed(Option.none()),
+  });
+}
+
+function mockConnection(opts: {
+  remoteMigrations?: ReadonlyArray<string>;
+  remoteSeeds?: Readonly<Record<string, string>>;
+  vaultRows?: ReadonlyArray<{ id: string; name: string }>;
+  noSeedTable?: boolean;
+  failExec?: string;
+}) {
+  const execs: Array<string> = [];
+  const queries: Array<{ sql: string; params?: ReadonlyArray<unknown> }> = [];
+  const layer = Layer.succeed(LegacyDbConnection, {
+    connect: () =>
+      Effect.succeed({
+        extensionExists: () => Effect.succeed(false),
+        copyToCsv: () => Effect.succeed(new Uint8Array()),
+        queryRaw: () => Effect.succeed({ fields: [], rows: [], commandTag: "" }),
+        exec: (sql: string): Effect.Effect<void, LegacyDbExecError> =>
+          Effect.suspend((): Effect.Effect<void, LegacyDbExecError> => {
+            execs.push(sql);
+            if (opts.failExec !== undefined && sql === opts.failExec) {
+              return Effect.fail(
+                new LegacyDbExecError({ message: "ERROR: boom (SQLSTATE 42601)" }),
+              );
+            }
+            return Effect.void;
+          }),
+        query: (
+          sql: string,
+          params?: ReadonlyArray<unknown>,
+        ): Effect.Effect<ReadonlyArray<Record<string, unknown>>, LegacyDbExecError> =>
+          Effect.suspend(
+            (): Effect.Effect<ReadonlyArray<Record<string, unknown>>, LegacyDbExecError> => {
+              queries.push({ sql, params });
+              if (sql === LIST_MIGRATIONS) {
+                return Effect.succeed(
+                  (opts.remoteMigrations ?? []).map((version) => ({ version })),
+                );
+              }
+              if (sql === SELECT_SEEDS) {
+                if (opts.noSeedTable === true) {
+                  return Effect.fail(
+                    new LegacyDbExecError({
+                      message: 'relation "supabase_migrations.seed_files" does not exist',
+                      code: "42P01",
+                    }),
+                  );
+                }
+                return Effect.succeed(
+                  Object.entries(opts.remoteSeeds ?? {}).map(([path, hash]) => ({ path, hash })),
+                );
+              }
+              if (sql === READ_VAULT) {
+                return Effect.succeed(opts.vaultRows ?? []);
+              }
+              return Effect.succeed([]);
+            },
+          ),
+      }),
+  });
+  return {
+    layer,
+    get execs() {
+      return execs;
+    },
+    get queries() {
+      return queries;
+    },
+  };
+}
+
+function setup(
+  workdir: string,
+  opts: {
+    toml?: string;
+    files?: Readonly<Record<string, string>>;
+    format?: OutputFormat;
+    confirm?: ReadonlyArray<boolean>;
+    args?: ReadonlyArray<string>;
+    yes?: boolean;
+    isLocal?: boolean;
+    projectRef?: string;
+    linkedFails?: boolean;
+    remoteMigrations?: ReadonlyArray<string>;
+    remoteSeeds?: Readonly<Record<string, string>>;
+    vaultRows?: ReadonlyArray<{ id: string; name: string }>;
+    noSeedTable?: boolean;
+    failExec?: string;
+    catalogStdout?: string;
+    catalogExportFailWith?: string;
+    noProjectId?: boolean;
+  },
+) {
+  if (opts.toml !== undefined) {
+    mkdirSync(join(workdir, "supabase"), { recursive: true });
+    writeFileSync(join(workdir, "supabase", "config.toml"), opts.toml);
+  }
+  for (const [rel, content] of Object.entries(opts.files ?? {})) {
+    const abs = join(workdir, rel);
+    mkdirSync(dirname(abs), { recursive: true });
+    writeFileSync(abs, content);
+  }
+
+  const out = mockOutput({ format: opts.format ?? "text", promptConfirmResponses: opts.confirm });
+  const conn = mockConnection(opts);
+  const telemetry = mockLegacyTelemetryStateTracked();
+  const linkedCache = mockLegacyLinkedProjectCacheTracked();
+
+  const edgeRunCalls: Array<LegacyEdgeRuntimeRunOpts> = [];
+  const registryEnvAtRunTime: Array<string | undefined> = [];
+  const edge = Layer.succeed(LegacyEdgeRuntimeScript, {
+    run: (runOpts: LegacyEdgeRuntimeRunOpts) => {
+      edgeRunCalls.push(runOpts);
+      registryEnvAtRunTime.push(process.env["SUPABASE_INTERNAL_IMAGE_REGISTRY"]);
+      if (opts.catalogExportFailWith !== undefined) {
+        return Effect.fail(
+          new LegacyEdgeRuntimeScriptError({ message: opts.catalogExportFailWith }),
+        );
+      }
+      return Effect.succeed({ stdout: opts.catalogStdout ?? '{"version":1}', stderr: "" });
+    },
+  });
+  const sslProbe = Layer.succeed(LegacyPgDeltaSslProbe, {
+    requireSsl: () => Effect.succeed(false),
+    requireSslForHost: () => Effect.succeed(false),
+  });
+  const projectRefLayer = Layer.succeed(LegacyProjectRefResolver, {
+    resolve: () => Effect.succeed(opts.projectRef ?? LEGACY_VALID_REF),
+    resolveForLink: () => Effect.succeed(opts.projectRef ?? LEGACY_VALID_REF),
+    resolveOptional: () => Effect.succeed(Option.some(opts.projectRef ?? LEGACY_VALID_REF)),
+    loadProjectRef: () =>
+      opts.linkedFails === true
+        ? Effect.fail(
+            new LegacyProjectNotLinkedError({
+              message: "Cannot find project ref. Have you run supabase link?",
+            }),
+          )
+        : Effect.succeed(opts.projectRef ?? LEGACY_VALID_REF),
+    promptProjectRef: () => Effect.succeed(opts.projectRef ?? LEGACY_VALID_REF),
+  });
+
+  const layer = Layer.mergeAll(
+    out.layer,
+    conn.layer,
+    mockResolver({ isLocal: opts.isLocal ?? true }),
+    mockLegacyCliConfig({
+      workdir,
+      ...(opts.noProjectId === true ? { projectId: Option.none() } : {}),
+    }),
+    BunServices.layer,
+    // Prompts (migration/seed confirmation) are answered through mockOutput's
+    // `promptConfirmResponses` (the TTY/clack path), so mark stdin a TTY. Stdin is
+    // only referenced by legacyPromptYesNo's non-TTY branch (unreached here).
+    mockTty({ stdinIsTty: true }),
+    mockStdin(true),
+    Layer.succeed(CliArgs, { args: opts.args ?? ["db", "push", "--local"] }),
+    Layer.succeed(LegacyYesFlag, opts.yes ?? false),
+    Layer.succeed(LegacyDnsResolverFlag, "native"),
+    projectRefLayer,
+    telemetry.layer,
+    linkedCache.layer,
+    edge,
+    sslProbe,
+  );
+  return { layer, out, conn, telemetry, linkedCache, edgeRunCalls, registryEnvAtRunTime };
+}
+
+const MIGRATION_DIR = "supabase/migrations";
+const migrationFile = (version: string, body = "create table t ();") => ({
+  [`${MIGRATION_DIR}/${version}_test.sql`]: body,
+});
+
+describe("legacy db push", () => {
+  const tmp = useLegacyTempWorkdir("supabase-db-push-");
+
+  it.live("reports up to date when nothing is pending (text)", () => {
+    const { layer, out, conn } = setup(tmp.current, { toml: 'project_id = "test"\n' });
+    return Effect.gen(function* () {
+      const exit = yield* legacyDbPush(DEFAULT_FLAGS).pipe(Effect.provide(layer), Effect.exit);
+      expect(Exit.isSuccess(exit)).toBe(true);
+      expect(out.stdoutText).toBe("Local database is up to date.\n");
+      // No migration was applied.
+      expect(conn.execs).not.toContain("BEGIN");
+    });
+  });
+
+  it.live("emits a json result for an up-to-date run", () => {
+    const { layer, out } = setup(tmp.current, { toml: 'project_id = "test"\n', format: "json" });
+    return Effect.gen(function* () {
+      yield* legacyDbPush(DEFAULT_FLAGS).pipe(Effect.provide(layer));
+      const success = out.messages.find((m) => m.type === "success");
+      expect(success?.data?.["upToDate"]).toBe(true);
+      expect(success?.data?.["migrations"]).toEqual([]);
+    });
+  });
+
+  it.live("rejects mutually exclusive target flags", () => {
+    const { layer } = setup(tmp.current, {
+      toml: 'project_id = "test"\n',
+      args: ["db", "push", "--local", "--linked"],
+    });
+    return Effect.gen(function* () {
+      const exit = yield* legacyDbPush(DEFAULT_FLAGS).pipe(Effect.provide(layer), Effect.exit);
+      expect(Exit.isFailure(exit)).toBe(true);
+    });
+  });
+
+  it.live("applies a pending migration after confirmation", () => {
+    const { layer, out, conn } = setup(tmp.current, {
+      toml: 'project_id = "test"\n',
+      files: migrationFile("20240101000000"),
+      confirm: [true],
+    });
+    return Effect.gen(function* () {
+      yield* legacyDbPush(DEFAULT_FLAGS).pipe(Effect.provide(layer));
+      expect(out.stderrText).toContain("Applying migration 20240101000000_test.sql...");
+      // "supabase db push" is wrapped in Aqua (cyan) on stdout, matching Go.
+      expect(out.stdoutText).toContain("Finished");
+      expect(out.stdoutText).toContain("supabase db push");
+      // The migration body + history insert ran inside a transaction.
+      expect(conn.execs).toContain("BEGIN");
+      expect(conn.execs).toContain("COMMIT");
+      expect(conn.queries.some((q) => q.sql.includes("INSERT INTO supabase_migrations"))).toBe(
+        true,
+      );
+    });
+  });
+
+  it.live("does not attempt to cache the migrations catalog when pg-delta is disabled", () => {
+    const { layer, out, edgeRunCalls } = setup(tmp.current, {
+      toml: 'project_id = "test"\n',
+      files: migrationFile("20240101000000"),
+      confirm: [true],
+    });
+    return Effect.gen(function* () {
+      yield* legacyDbPush(DEFAULT_FLAGS).pipe(Effect.provide(layer));
+      expect(edgeRunCalls).toHaveLength(0);
+      expect(out.stderrText).not.toContain("failed to cache migrations catalog");
+      expect(existsSync(join(tmp.current, "supabase", ".temp", "pgdelta"))).toBe(false);
+    });
+  });
+
+  it.live("caches the migrations catalog when project .env enables pg-delta", () => {
+    const { layer, out, edgeRunCalls } = setup(tmp.current, {
+      toml: 'project_id = "test"\n',
+      files: {
+        ...migrationFile("20240101000000"),
+        "supabase/.env": "SUPABASE_EXPERIMENTAL_PG_DELTA=true\n",
+      },
+      confirm: [true],
+      catalogStdout: '{"snapshot":"ok"}',
+    });
+    return Effect.gen(function* () {
+      yield* legacyDbPush(DEFAULT_FLAGS).pipe(Effect.provide(layer));
+      expect(out.stderrText).not.toContain("failed to cache migrations catalog");
+      expect(edgeRunCalls).toHaveLength(1);
+      const tempDir = join(tmp.current, "supabase", ".temp", "pgdelta");
+      const catalogFiles = readdirSync(tempDir).filter((name) =>
+        name.startsWith("catalog-local-migrations-"),
+      );
+      expect(catalogFiles).toHaveLength(1);
+    });
+  });
+
+  it.live("caches the migrations catalog after a successful push when pg-delta is enabled", () => {
+    const { layer, out, edgeRunCalls } = setup(tmp.current, {
+      toml: 'project_id = "test"\n[experimental.pgdelta]\nenabled = true\n',
+      files: migrationFile("20240101000000"),
+      confirm: [true],
+      catalogStdout: '{"snapshot":"ok"}',
+    });
+    return Effect.gen(function* () {
+      yield* legacyDbPush(DEFAULT_FLAGS).pipe(Effect.provide(layer));
+      expect(out.stderrText).not.toContain("failed to cache migrations catalog");
+      expect(edgeRunCalls).toHaveLength(1);
+      const tempDir = join(tmp.current, "supabase", ".temp", "pgdelta");
+      const catalogFiles = readdirSync(tempDir).filter((name) =>
+        name.startsWith("catalog-local-migrations-"),
+      );
+      expect(catalogFiles).toHaveLength(1);
+      expect(readFileSync(join(tempDir, catalogFiles[0]!), "utf8")).toBe('{"snapshot":"ok"}');
+    });
+  });
+
+  it.live("caches the migrations catalog with an empty projectId when none is resolved", () => {
+    const { layer, out, edgeRunCalls } = setup(tmp.current, {
+      toml: 'project_id = "test"\n[experimental.pgdelta]\nenabled = true\n',
+      files: migrationFile("20240101000000"),
+      confirm: [true],
+      catalogStdout: '{"snapshot":"ok"}',
+      noProjectId: true,
+    });
+    return Effect.gen(function* () {
+      yield* legacyDbPush(DEFAULT_FLAGS).pipe(Effect.provide(layer));
+      expect(out.stderrText).not.toContain("failed to cache migrations catalog");
+      expect(edgeRunCalls).toHaveLength(1);
+    });
+  });
+
+  it.live("warns without failing the push when the catalog export fails", () => {
+    const { layer, out } = setup(tmp.current, {
+      toml: 'project_id = "test"\n[experimental.pgdelta]\nenabled = true\n',
+      files: migrationFile("20240101000000"),
+      confirm: [true],
+      catalogExportFailWith: "edge-runtime script produced no output",
+    });
+    return Effect.gen(function* () {
+      const exit = yield* legacyDbPush(DEFAULT_FLAGS).pipe(Effect.provide(layer), Effect.exit);
+      expect(Exit.isSuccess(exit)).toBe(true);
+      expect(out.stderrText).toContain(
+        "Warning: failed to cache migrations catalog: edge-runtime script produced no output",
+      );
+      expect(out.stdoutText).toContain("Finished");
+    });
+  });
+
+  it.live(
+    "resolves the pg-delta cache export image via SUPABASE_INTERNAL_IMAGE_REGISTRY from supabase/.env",
+    () => {
+      const prev = process.env["SUPABASE_INTERNAL_IMAGE_REGISTRY"];
+      delete process.env["SUPABASE_INTERNAL_IMAGE_REGISTRY"];
+      const { layer, registryEnvAtRunTime } = setup(tmp.current, {
+        toml: 'project_id = "test"\n[experimental.pgdelta]\nenabled = true\n',
+        files: {
+          ...migrationFile("20240101000000"),
+          "supabase/.env": "SUPABASE_INTERNAL_IMAGE_REGISTRY=my-mirror.example.com\n",
+        },
+        confirm: [true],
+        catalogStdout: '{"snapshot":"ok"}',
+      });
+      return Effect.gen(function* () {
+        yield* legacyDbPush(DEFAULT_FLAGS).pipe(Effect.provide(layer));
+        expect(registryEnvAtRunTime).toEqual(["my-mirror.example.com"]);
+        expect(process.env["SUPABASE_INTERNAL_IMAGE_REGISTRY"]).toBeUndefined();
+      }).pipe(
+        Effect.ensuring(
+          Effect.sync(() => {
+            if (prev === undefined) delete process.env["SUPABASE_INTERNAL_IMAGE_REGISTRY"];
+            else process.env["SUPABASE_INTERNAL_IMAGE_REGISTRY"] = prev;
+          }),
+        ),
+      );
+    },
+  );
+
+  it.live("returns context canceled when the migration prompt is declined", () => {
+    const { layer, conn } = setup(tmp.current, {
+      toml: 'project_id = "test"\n',
+      files: migrationFile("20240101000000"),
+      confirm: [false],
+    });
+    return Effect.gen(function* () {
+      const exit = yield* legacyDbPush(DEFAULT_FLAGS).pipe(Effect.provide(layer), Effect.exit);
+      expect(Exit.isFailure(exit)).toBe(true);
+      if (Exit.isFailure(exit)) {
+        expect(JSON.stringify(exit.cause)).toContain("context canceled");
+      }
+      expect(conn.execs).not.toContain("BEGIN");
+    });
+  });
+
+  it.live("prints the plan without applying in dry-run mode", () => {
+    const { layer, out, conn } = setup(tmp.current, {
+      toml: 'project_id = "test"\n',
+      files: migrationFile("20240101000000"),
+    });
+    return Effect.gen(function* () {
+      yield* legacyDbPush({ ...DEFAULT_FLAGS, dryRun: true }).pipe(Effect.provide(layer));
+      expect(out.stderrText).toContain("DRY RUN: migrations will *not* be pushed to the database.");
+      expect(out.stderrText).toContain("Would push these migrations:");
+      expect(out.stderrText).toContain("20240101000000_test.sql");
+      expect(conn.execs).not.toContain("BEGIN");
+    });
+  });
+
+  it.live("fails with a repair suggestion when remote has versions missing locally", () => {
+    const { layer, out } = setup(tmp.current, {
+      toml: 'project_id = "test"\n',
+      remoteMigrations: ["20240101000000"],
+    });
+    return Effect.gen(function* () {
+      const exit = yield* legacyDbPush(DEFAULT_FLAGS).pipe(Effect.provide(layer), Effect.exit);
+      expect(Exit.isFailure(exit)).toBe(true);
+      if (Exit.isFailure(exit)) {
+        expect(JSON.stringify(exit.cause)).toContain(
+          "Remote migration versions not found in local migrations directory.",
+        );
+        expect(JSON.stringify(exit.cause)).toContain("migration repair --status reverted");
+      }
+      expect(out).toBeDefined();
+    });
+  });
+
+  it.live("fails with an --include-all suggestion for out-of-order local migrations", () => {
+    const { layer } = setup(tmp.current, {
+      toml: 'project_id = "test"\n',
+      // 0101 is local-only and ordered before the already-applied remote 0202.
+      files: { ...migrationFile("20240101000000"), ...migrationFile("20240202000000") },
+      remoteMigrations: ["20240202000000"],
+    });
+    return Effect.gen(function* () {
+      const exit = yield* legacyDbPush(DEFAULT_FLAGS).pipe(Effect.provide(layer), Effect.exit);
+      expect(Exit.isFailure(exit)).toBe(true);
+      if (Exit.isFailure(exit)) {
+        expect(JSON.stringify(exit.cause)).toContain("--include-all");
+      }
+    });
+  });
+
+  it.live("pushes out-of-order migrations with --include-all", () => {
+    const { layer, out } = setup(tmp.current, {
+      toml: 'project_id = "test"\n',
+      files: { ...migrationFile("20240101000000"), ...migrationFile("20240202000000") },
+      remoteMigrations: ["20240202000000"],
+      confirm: [true],
+    });
+    return Effect.gen(function* () {
+      yield* legacyDbPush({ ...DEFAULT_FLAGS, includeAll: true }).pipe(Effect.provide(layer));
+      expect(out.stderrText).toContain("Applying migration 20240101000000_test.sql...");
+    });
+  });
+
+  it.live("skips migrations when disabled in config and reports up to date", () => {
+    const { layer, out } = setup(tmp.current, {
+      toml: 'project_id = "test"\n\n[db.migrations]\nenabled = false\n',
+      files: migrationFile("20240101000000"),
+    });
+    return Effect.gen(function* () {
+      yield* legacyDbPush(DEFAULT_FLAGS).pipe(Effect.provide(layer));
+      expect(out.stderrText).toContain(
+        "Skipping migrations because it is disabled in config.toml for project:",
+      );
+      expect(out.stdoutText).toBe("Local database is up to date.\n");
+    });
+  });
+
+  it.live("seeds a new file with --include-seed", () => {
+    const { layer, out, conn } = setup(tmp.current, {
+      toml: 'project_id = "test"\n',
+      files: { "supabase/seed.sql": "insert into t values (1);" },
+      confirm: [true],
+    });
+    return Effect.gen(function* () {
+      yield* legacyDbPush({ ...DEFAULT_FLAGS, includeSeed: true }).pipe(Effect.provide(layer));
+      expect(out.stderrText).toContain("Seeding data from supabase/seed.sql...");
+      expect(
+        conn.queries.some((q) => q.sql.includes("INSERT INTO supabase_migrations.seed_files")),
+      ).toBe(true);
+    });
+  });
+
+  it.live("expands a directory in [db.seed].sql_paths to its sorted .sql children", () => {
+    // Go's `GetPendingSeeds` (`Glob.SQLFiles`) walks a matched directory and seeds its
+    // regular `.sql` files recursively; non-.sql files are skipped. Without dir expansion
+    // the directory path reached `readFileString(<dir>)` and failed.
+    const { layer, out } = setup(tmp.current, {
+      toml: 'project_id = "test"\n\n[db.seed]\nsql_paths = ["seeds"]\n',
+      files: {
+        "supabase/seeds/a.sql": "insert into t values (1);",
+        "supabase/seeds/nested/b.sql": "insert into t values (2);",
+        "supabase/seeds/notes.txt": "not a seed",
+      },
+      confirm: [true],
+    });
+    return Effect.gen(function* () {
+      yield* legacyDbPush({ ...DEFAULT_FLAGS, includeSeed: true }).pipe(Effect.provide(layer));
+      expect(out.stderrText).toContain("Seeding data from supabase/seeds/a.sql...");
+      expect(out.stderrText).toContain("Seeding data from supabase/seeds/nested/b.sql...");
+      expect(out.stderrText).not.toContain("notes.txt");
+    });
+  });
+
+  it.live("reports seed files up to date when hash matches remote", () => {
+    // sha256 of the seed body must match the remote hash to be skipped.
+    const body = "insert into t values (1);";
+    const hash = createHash("sha256").update(body).digest("hex");
+    const { layer, out } = setup(tmp.current, {
+      toml: 'project_id = "test"\n',
+      files: { "supabase/seed.sql": body },
+      remoteSeeds: { "supabase/seed.sql": hash },
+    });
+    return Effect.gen(function* () {
+      yield* legacyDbPush({ ...DEFAULT_FLAGS, includeSeed: true }).pipe(Effect.provide(layer));
+      expect(out.stdoutText).toBe("Local database is up to date.\n");
+    });
+  });
+
+  it.live("hashes a non-UTF-8 seed file by its raw bytes (Go's io.Copy parity)", () => {
+    // Go's `NewSeedFile` hashes the raw stream; a UTF-8 string decode would replace the
+    // invalid bytes and change the hash. Write invalid UTF-8 and pre-seed the remote with
+    // the RAW-byte sha256 — the push must treat it as already-applied (byte hash matches),
+    // not re-run it. A string-decoded hash here would differ and mark the seed dirty.
+    const raw = Buffer.from([0x2d, 0x2d, 0x20, 0xff, 0xfe, 0x00, 0x01, 0x0a]);
+    const rawHash = createHash("sha256").update(raw).digest("hex");
+    const { layer, out } = setup(tmp.current, {
+      toml: 'project_id = "test"\n',
+      remoteSeeds: { "supabase/seed.sql": rawHash },
+    });
+    mkdirSync(join(tmp.current, "supabase"), { recursive: true });
+    writeFileSync(join(tmp.current, "supabase", "seed.sql"), raw);
+    return Effect.gen(function* () {
+      yield* legacyDbPush({ ...DEFAULT_FLAGS, includeSeed: true }).pipe(Effect.provide(layer));
+      expect(out.stdoutText).toBe("Local database is up to date.\n");
+    });
+  });
+
+  it.live("skips seeding when disabled in config", () => {
+    const { layer, out } = setup(tmp.current, {
+      toml: 'project_id = "test"\n\n[db.seed]\nenabled = false\n',
+      files: { "supabase/seed.sql": "insert into t values (1);" },
+    });
+    return Effect.gen(function* () {
+      yield* legacyDbPush({ ...DEFAULT_FLAGS, includeSeed: true }).pipe(Effect.provide(layer));
+      expect(out.stderrText).toContain(
+        "Skipping seed because it is disabled in config.toml for project:",
+      );
+    });
+  });
+
+  it.live("creates custom roles with --include-roles", () => {
+    const { layer, out } = setup(tmp.current, {
+      toml: 'project_id = "test"\n',
+      files: { "supabase/roles.sql": "create role app;" },
+      confirm: [true],
+    });
+    return Effect.gen(function* () {
+      yield* legacyDbPush({ ...DEFAULT_FLAGS, includeRoles: true }).pipe(Effect.provide(layer));
+      expect(out.stderrText).toContain("Seeding globals from roles.sql...");
+    });
+  });
+
+  it.live("--include-roles without a roles.sql pushes migrations and skips globals", () => {
+    // Go's push only globs supabase/roles.sql when it exists; an absent file is
+    // silently skipped (no error, no "Seeding globals" line) and the rest pushes.
+    const { layer, out } = setup(tmp.current, {
+      toml: 'project_id = "test"\n',
+      files: migrationFile("20240101000000"),
+      confirm: [true],
+    });
+    return Effect.gen(function* () {
+      yield* legacyDbPush({ ...DEFAULT_FLAGS, includeRoles: true }).pipe(Effect.provide(layer));
+      expect(out.stderrText).not.toContain("Seeding globals");
+      expect(out.stderrText).toContain("Applying migration 20240101000000_test.sql...");
+    });
+  });
+
+  it.live("emits the seeded file paths in the json success payload", () => {
+    const { layer, out } = setup(tmp.current, {
+      toml: 'project_id = "test"\n',
+      files: {
+        ...migrationFile("20240101000000"),
+        "supabase/seed.sql": "insert into t values (1);",
+      },
+      format: "json",
+    });
+    return Effect.gen(function* () {
+      yield* legacyDbPush({ ...DEFAULT_FLAGS, includeSeed: true }).pipe(Effect.provide(layer));
+      const success = out.messages.find((m) => m.type === "success");
+      expect(success?.data?.["upToDate"]).toBe(false);
+      expect(success?.data?.["migrations"]).toEqual(["20240101000000_test.sql"]);
+      expect(success?.data?.["seeds"]).toEqual(["supabase/seed.sql"]);
+    });
+  });
+
+  it.live("reports schema migrations up to date when only roles are pushed", () => {
+    const { layer, out } = setup(tmp.current, {
+      toml: 'project_id = "test"\n',
+      files: { "supabase/roles.sql": "create role app;" },
+      confirm: [true],
+    });
+    return Effect.gen(function* () {
+      yield* legacyDbPush({ ...DEFAULT_FLAGS, includeRoles: true }).pipe(Effect.provide(layer));
+      expect(out.stderrText).toContain("Schema migrations are up to date.");
+    });
+  });
+
+  it.live("returns context canceled when the roles prompt is declined", () => {
+    const { layer } = setup(tmp.current, {
+      toml: 'project_id = "test"\n',
+      files: { "supabase/roles.sql": "create role app;" },
+      confirm: [false],
+    });
+    return Effect.gen(function* () {
+      const exit = yield* legacyDbPush({ ...DEFAULT_FLAGS, includeRoles: true }).pipe(
+        Effect.provide(layer),
+        Effect.exit,
+      );
+      expect(Exit.isFailure(exit)).toBe(true);
+      if (Exit.isFailure(exit)) expect(JSON.stringify(exit.cause)).toContain("context canceled");
+    });
+  });
+
+  it.live("returns context canceled when the seed prompt is declined", () => {
+    const { layer } = setup(tmp.current, {
+      toml: 'project_id = "test"\n',
+      files: { "supabase/seed.sql": "insert into t values (1);" },
+      confirm: [false],
+    });
+    return Effect.gen(function* () {
+      const exit = yield* legacyDbPush({ ...DEFAULT_FLAGS, includeSeed: true }).pipe(
+        Effect.provide(layer),
+        Effect.exit,
+      );
+      expect(Exit.isFailure(exit)).toBe(true);
+      if (Exit.isFailure(exit)) expect(JSON.stringify(exit.cause)).toContain("context canceled");
+    });
+  });
+
+  it.live("re-hashes a dirty seed without re-running its statements", () => {
+    const { layer, out, conn } = setup(tmp.current, {
+      toml: 'project_id = "test"\n',
+      files: { "supabase/seed.sql": "insert into t values (1);" },
+      // Remote hash differs → dirty.
+      remoteSeeds: { "supabase/seed.sql": "stalehash" },
+      confirm: [true],
+    });
+    return Effect.gen(function* () {
+      yield* legacyDbPush({ ...DEFAULT_FLAGS, includeSeed: true }).pipe(Effect.provide(layer));
+      expect(out.stderrText).toContain("Updating seed hash to supabase/seed.sql...");
+      // Dirty seed only upserts the hash; the body statement is not executed.
+      expect(conn.execs).not.toContain("insert into t values (1);");
+    });
+  });
+
+  it.live("treats every seed as pending when the seed_files table is absent", () => {
+    const { layer, out } = setup(tmp.current, {
+      toml: 'project_id = "test"\n',
+      files: { "supabase/seed.sql": "insert into t values (1);" },
+      noSeedTable: true,
+      confirm: [true],
+    });
+    return Effect.gen(function* () {
+      yield* legacyDbPush({ ...DEFAULT_FLAGS, includeSeed: true }).pipe(Effect.provide(layer));
+      expect(out.stderrText).toContain("Seeding data from supabase/seed.sql...");
+    });
+  });
+
+  it.live("warns and reports up to date when no seed files match", () => {
+    const { layer, out } = setup(tmp.current, {
+      toml: 'project_id = "test"\n\n[db.seed]\nsql_paths = ["missing.sql"]\n',
+    });
+    return Effect.gen(function* () {
+      yield* legacyDbPush({ ...DEFAULT_FLAGS, includeSeed: true }).pipe(Effect.provide(layer));
+      expect(out.stderrText).toContain("WARN: no files matched pattern: supabase/missing.sql");
+      expect(out.stdoutText).toBe("Local database is up to date.\n");
+    });
+  });
+
+  it.live("reports seed files up to date when migrations push but no seeds match", () => {
+    const { layer, out } = setup(tmp.current, {
+      toml: 'project_id = "test"\n\n[db.seed]\nsql_paths = ["missing.sql"]\n',
+      files: migrationFile("20240101000000"),
+      confirm: [true],
+    });
+    return Effect.gen(function* () {
+      yield* legacyDbPush({ ...DEFAULT_FLAGS, includeSeed: true }).pipe(Effect.provide(layer));
+      expect(out.stderrText).toContain("Seed files are up to date.");
+    });
+  });
+
+  it.live("upserts vault secrets (update existing, create new) before migrating", () => {
+    const { layer, out, conn } = setup(tmp.current, {
+      toml: 'project_id = "test"\n\n[db.vault]\nexisting = "v1"\nfresh = "v2"\n',
+      files: migrationFile("20240101000000"),
+      // `existing` already present remotely → update; `fresh` → create.
+      vaultRows: [{ id: "id-1", name: "existing" }],
+      confirm: [true],
+    });
+    return Effect.gen(function* () {
+      yield* legacyDbPush(DEFAULT_FLAGS).pipe(Effect.provide(layer));
+      expect(out.stderrText).toContain("Updating vault secrets...");
+      const sqls = conn.queries.map((q) => q.sql);
+      expect(sqls).toContain("SELECT vault.update_secret($1, $2)");
+      expect(sqls).toContain("SELECT vault.create_secret($1, $2)");
+    });
+  });
+
+  it.live("decrypts an encrypted vault secret keyed by the project .env (not process.env)", () => {
+    // Regression: the old point-of-use vault decryption keyed only on `process.env`, so a
+    // `DOTENV_PRIVATE_KEY` present only in the project `.env` failed to decrypt. Go's config
+    // load merges the project `.env` into the key set (`legacyCheckDbToml`), so it resolves.
+    const PRIVATE_KEY = "7fd7210cef8f331ee8c55897996aaaafd853a2b20a4dc73d6d75759f65d2a7eb";
+    const ENCRYPTED =
+      "encrypted:BKiXH15AyRzeohGyUrmB6cGjSklCrrBjdesQlX1VcXo/Xp20Bi2gGZ3AlIqxPQDmjVAALnhZamKnuY73l8Dz1P+BYiZUgxTSLzdCvdYUyVbNekj2UudbdUizBViERtZkuQwZHIv/";
+    const { layer, out, conn } = setup(tmp.current, {
+      toml: `project_id = "test"\n\n[db.vault]\nmy_secret = "${ENCRYPTED}"\n`,
+      files: {
+        ...migrationFile("20240101000000"),
+        "supabase/.env": `DOTENV_PRIVATE_KEY=${PRIVATE_KEY}\n`,
+      },
+      confirm: [true],
+    });
+    return Effect.gen(function* () {
+      yield* legacyDbPush(DEFAULT_FLAGS).pipe(Effect.provide(layer));
+      expect(out.stderrText).toContain("Updating vault secrets...");
+      // The decrypted plaintext ("value") is written, proving the project-.env key was used.
+      const create = conn.queries.find((q) => q.sql === "SELECT vault.create_secret($1, $2)");
+      expect(create?.params).toEqual(["value", "my_secret"]);
+    });
+  });
+
+  it.live("defaults to the linked target when no target flag is set", () => {
+    const { layer, out } = setup(tmp.current, {
+      toml: 'project_id = "test"\n',
+      args: ["db", "push"],
+      isLocal: false,
+      projectRef: LEGACY_VALID_REF,
+    });
+    return Effect.gen(function* () {
+      yield* legacyDbPush({ ...DEFAULT_FLAGS, local: false }).pipe(Effect.provide(layer));
+      expect(out.stderrText).toContain("Connecting to remote database...");
+      expect(out.stdoutText).toBe("Remote database is up to date.\n");
+    });
+  });
+
+  it.live("surfaces an apply error with statement context", () => {
+    const { layer } = setup(tmp.current, {
+      toml: 'project_id = "test"\n',
+      files: migrationFile("20240101000000", "BOOM;"),
+      failExec: "BOOM",
+      confirm: [true],
+    });
+    return Effect.gen(function* () {
+      const exit = yield* legacyDbPush(DEFAULT_FLAGS).pipe(Effect.provide(layer), Effect.exit);
+      expect(Exit.isFailure(exit)).toBe(true);
+      if (Exit.isFailure(exit)) {
+        expect(JSON.stringify(exit.cause)).toContain("At statement: 0");
+      }
+    });
+  });
+
+  it.live("dry-run lists roles, migrations and seeds without applying", () => {
+    const { layer, out, conn } = setup(tmp.current, {
+      toml: 'project_id = "test"\n',
+      files: {
+        ...migrationFile("20240101000000"),
+        "supabase/roles.sql": "create role app;",
+        "supabase/seed.sql": "insert into t values (1);",
+      },
+    });
+    return Effect.gen(function* () {
+      yield* legacyDbPush({
+        ...DEFAULT_FLAGS,
+        dryRun: true,
+        includeRoles: true,
+        includeSeed: true,
+      }).pipe(Effect.provide(layer));
+      // The roles path is wrapped in Bold (ANSI), matching Go's utils.Bold.
+      expect(out.stderrText).toContain("Would create custom roles");
+      expect(out.stderrText).toContain("roles.sql");
+      expect(out.stderrText).toContain("Would push these migrations:");
+      expect(out.stderrText).toContain("Would seed these files:");
+      expect(conn.execs).not.toContain("BEGIN");
+    });
+  });
+
+  it.live("dry-run with only custom roles lists them without a migration section", () => {
+    const { layer, out } = setup(tmp.current, {
+      toml: 'project_id = "test"\n',
+      files: { "supabase/roles.sql": "create role app;" },
+    });
+    return Effect.gen(function* () {
+      yield* legacyDbPush({ ...DEFAULT_FLAGS, dryRun: true, includeRoles: true }).pipe(
+        Effect.provide(layer),
+      );
+      expect(out.stderrText).toContain("Would create custom roles");
+      expect(out.stderrText).not.toContain("Would push these migrations:");
+    });
+  });
+
+  it.live("uses embedded defaults when no config file is present", () => {
+    const { layer, out } = setup(tmp.current, {
+      files: migrationFile("20240101000000"),
+      confirm: [true],
+    });
+    return Effect.gen(function* () {
+      // No config.toml written → loadProjectConfig returns null → default config
+      // (migrations enabled), and the vault document is absent.
+      yield* legacyDbPush(DEFAULT_FLAGS).pipe(Effect.provide(layer));
+      expect(out.stderrText).toContain("Applying migration 20240101000000_test.sql...");
+    });
+  });
+
+  it.live("auto-confirms pending migrations via SUPABASE_YES set only in the project .env", () => {
+    // Go's loadNestedEnv sets project-.env keys before PromptYesNo reads viper YES, so a
+    // `SUPABASE_YES` in supabase/.env auto-confirms without any interactive answer.
+    const { layer, out } = setup(tmp.current, {
+      toml: 'project_id = "test"\n',
+      files: { ...migrationFile("20240101000000"), "supabase/.env": "SUPABASE_YES=true\n" },
+      // Deliberately no `confirm` responses — the prompt must be auto-confirmed.
+    });
+    return Effect.gen(function* () {
+      yield* legacyDbPush(DEFAULT_FLAGS).pipe(Effect.provide(layer));
+      expect(out.stderrText).toContain("Applying migration 20240101000000_test.sql...");
+    });
+  });
+
+  it.live("fails when config.toml cannot be parsed", () => {
+    const { layer } = setup(tmp.current, { toml: "this is = = not [[[ valid toml" });
+    return Effect.gen(function* () {
+      const exit = yield* legacyDbPush(DEFAULT_FLAGS).pipe(Effect.provide(layer), Effect.exit);
+      expect(Exit.isFailure(exit)).toBe(true);
+      if (Exit.isFailure(exit)) {
+        // Config now loads through the Go-parity reader (`legacyCheckDbToml`), so a malformed
+        // config aborts with Go's `failed to load config` message (the reader path), same as
+        // the other db commands (diff/dump/pull/migration).
+        expect(JSON.stringify(exit.cause)).toContain("failed to load config");
+      }
+    });
+  });
+
+  it.live("loads a Go-style env() boolean in config (no ProjectConfigParseError)", () => {
+    // Regression for the strict @supabase/config loader rejecting `enabled = "env(VAR)"`:
+    // Go decodes it via env-expansion + strconv.ParseBool, so the config must load and the
+    // migration proceed. Previously native push aborted before the Go-compatible parse ran.
+    const previous = process.env["SEED_ENABLED"];
+    process.env["SEED_ENABLED"] = "true";
+    const { layer, out } = setup(tmp.current, {
+      toml: 'project_id = "test"\n\n[db.seed]\nenabled = "env(SEED_ENABLED)"\n',
+      files: migrationFile("20240101000000"),
+      confirm: [true],
+    });
+    return Effect.gen(function* () {
+      yield* legacyDbPush(DEFAULT_FLAGS).pipe(Effect.provide(layer));
+      expect(out.stderrText).toContain("Applying migration 20240101000000_test.sql...");
+    }).pipe(
+      Effect.ensuring(
+        Effect.sync(() => {
+          if (previous === undefined) delete process.env["SEED_ENABLED"];
+          else process.env["SEED_ENABLED"] = previous;
+        }),
+      ),
+    );
+  });
+
+  it.live("a matched remote block's migrations.enabled beats the shell env override", () => {
+    // Go merges a matched [remotes.<ref>] block at viper's override tier (`v.Set`), which
+    // sits ABOVE AutomaticEnv — so `[remotes.preview.db.migrations] enabled = false` wins
+    // over `SUPABASE_DB_MIGRATIONS_ENABLED=true` and the push skips migrations. (Before the
+    // config-reader convergence, push resolved this gate env-first and wrongly applied.)
+    const previous = process.env["SUPABASE_DB_MIGRATIONS_ENABLED"];
+    process.env["SUPABASE_DB_MIGRATIONS_ENABLED"] = "true";
+    const { layer, out } = setup(tmp.current, {
+      toml: `project_id = "base"\n\n[remotes.preview]\nproject_id = "${LEGACY_VALID_REF}"\n\n[remotes.preview.db.migrations]\nenabled = false\n`,
+      files: migrationFile("20240101000000"),
+      args: ["db", "push", "--linked"],
+      isLocal: false,
+      projectRef: LEGACY_VALID_REF,
+      confirm: [true],
+    });
+    return Effect.gen(function* () {
+      yield* legacyDbPush({ ...DEFAULT_FLAGS, local: false, linked: true }).pipe(
+        Effect.provide(layer),
+      );
+      expect(out.stderrText).toContain("Skipping migrations because it is disabled");
+      expect(out.stderrText).not.toContain("Applying migration 20240101000000");
+    }).pipe(
+      Effect.ensuring(
+        Effect.sync(() => {
+          if (previous === undefined) delete process.env["SUPABASE_DB_MIGRATIONS_ENABLED"];
+          else process.env["SUPABASE_DB_MIGRATIONS_ENABLED"] = previous;
+        }),
+      ),
+    );
+  });
+
+  it.live("announces a matching [remotes.*] override on the linked path", () => {
+    const { layer, out } = setup(tmp.current, {
+      toml: `project_id = "base"\n\n[remotes.preview]\nproject_id = "${LEGACY_VALID_REF}"\n`,
+      args: ["db", "push", "--linked"],
+      isLocal: false,
+      projectRef: LEGACY_VALID_REF,
+    });
+    return Effect.gen(function* () {
+      yield* legacyDbPush({ ...DEFAULT_FLAGS, local: false, linked: true }).pipe(
+        Effect.provide(layer),
+      );
+      expect(out.stderrText).toContain("Loading config override: [remotes.preview]");
+    });
+  });
+
+  it.live("pushes to the linked project and caches the project ref (json)", () => {
+    const { layer, out, linkedCache } = setup(tmp.current, {
+      toml: 'project_id = "test"\n',
+      files: migrationFile("20240101000000"),
+      args: ["db", "push", "--linked"],
+      isLocal: false,
+      projectRef: LEGACY_VALID_REF,
+      format: "json",
+      confirm: [true],
+    });
+    return Effect.gen(function* () {
+      yield* legacyDbPush({ ...DEFAULT_FLAGS, local: false, linked: true }).pipe(
+        Effect.provide(layer),
+      );
+      expect(out.stderrText).toContain("Connecting to remote database...");
+      expect(linkedCache.cached).toBe(true);
+      expect(linkedCache.cachedRef).toBe(LEGACY_VALID_REF);
+      const success = out.messages.find((m) => m.type === "success");
+      expect(success?.data?.["migrations"]).toEqual(["20240101000000_test.sql"]);
+    });
+  });
+});
diff --git a/apps/cli/src/legacy/commands/db/push/push.layers.ts b/apps/cli/src/legacy/commands/db/push/push.layers.ts
new file mode 100644
index 0000000000..cf99bc494c
--- /dev/null
+++ b/apps/cli/src/legacy/commands/db/push/push.layers.ts
@@ -0,0 +1,89 @@
+import { Layer } from "effect";
+
+import { commandRuntimeLayer } from "../../../../shared/runtime/command-runtime.layer.ts";
+import { legacyCredentialsLayer } from "../../../auth/legacy-credentials.layer.ts";
+import { legacyHttpClientLayer } from "../../../auth/legacy-http-debug.layer.ts";
+import { legacyPlatformApiFactoryLayer } from "../../../auth/legacy-platform-api-factory.layer.ts";
+import { legacyCliConfigLayer } from "../../../config/legacy-cli-config.layer.ts";
+import { legacyProjectRefLayer } from "../../../config/legacy-project-ref.layer.ts";
+import { legacyDbConfigLayer } from "../../../shared/legacy-db-config.layer.ts";
+import { legacyDbConnectionLayer } from "../../../shared/legacy-db-connection.layer.ts";
+import { legacyDebugLoggerLayer } from "../../../shared/legacy-debug-logger.layer.ts";
+import { legacyDockerRunLayer } from "../../../shared/legacy-docker-run.layer.ts";
+import { legacyEdgeRuntimeScriptLayer } from "../../../shared/legacy-edge-runtime-script.layer.ts";
+import { stdinLayer } from "../../../../shared/runtime/stdin.layer.ts";
+import { legacyIdentityStitchLayer } from "../../../shared/legacy-identity-stitch.ts";
+import { legacyPgDeltaSslProbeLayer } from "../../../shared/legacy-pgdelta-ssl-probe.layer.ts";
+import { legacyLinkedProjectCacheLayer } from "../../../telemetry/legacy-linked-project-cache.layer.ts";
+import { legacyTelemetryStateLayer } from "../../../telemetry/legacy-telemetry-state.layer.ts";
+
+/**
+ * Runtime layer for `supabase db push`. Same shape as `db lint`: it spans local
+ * (`--local` / `--db-url`) and linked DB access, so it composes the Postgres
+ * connection, the db-config resolver, project-ref resolution, and the
+ * linked-project cache (Go's PersistentPostRun `ensureProjectGroupsCached`).
+ *
+ * Like `db lint`, it deliberately uses the **lazy** `legacyPlatformApiFactoryLayer`
+ * (not the eager management-API runtime) so the auth-free `--local` path never
+ * resolves an access token at layer-build time. `legacyCliConfigLayer` is provided
+ * to each consumer that needs it (legacy CLAUDE.md item 5); the single
+ * `legacyIdentityStitchLayer` reference is shared so the factory, the cache, and
+ * the db-config resolver share one `stitchAttempted` guard.
+ */
+const cliConfig = legacyCliConfigLayer.pipe(Layer.provide(legacyDebugLoggerLayer));
+const httpClient = legacyHttpClientLayer.pipe(Layer.provide(legacyDebugLoggerLayer));
+const credentials = legacyCredentialsLayer.pipe(
+  Layer.provide(cliConfig),
+  Layer.provide(legacyDebugLoggerLayer),
+);
+
+const platformApiFactory = legacyPlatformApiFactoryLayer.pipe(
+  Layer.provide(credentials),
+  Layer.provide(cliConfig),
+  Layer.provide(legacyDebugLoggerLayer),
+  Layer.provide(legacyIdentityStitchLayer),
+);
+
+const projectRef = legacyProjectRefLayer.pipe(
+  Layer.provide(platformApiFactory),
+  Layer.provide(cliConfig),
+);
+
+const linkedProjectCache = legacyLinkedProjectCacheLayer.pipe(
+  Layer.provide(credentials),
+  Layer.provide(cliConfig),
+  Layer.provide(httpClient),
+  Layer.provide(legacyIdentityStitchLayer),
+);
+
+const dbConfig = legacyDbConfigLayer.pipe(
+  Layer.provide(cliConfig),
+  Layer.provide(legacyDbConnectionLayer),
+  Layer.provide(legacyDebugLoggerLayer),
+  Layer.provide(legacyIdentityStitchLayer),
+);
+
+const edgeRuntime = legacyEdgeRuntimeScriptLayer.pipe(
+  Layer.provide(legacyDockerRunLayer),
+  Layer.provide(cliConfig),
+);
+
+export const legacyDbPushRuntimeLayer = Layer.mergeAll(
+  dbConfig,
+  legacyDbConnectionLayer,
+  legacyDockerRunLayer,
+  edgeRuntime,
+  legacyPgDeltaSslProbeLayer,
+  cliConfig,
+  httpClient,
+  credentials,
+  projectRef,
+  linkedProjectCache,
+  legacyIdentityStitchLayer,
+  legacyTelemetryStateLayer,
+  // `legacyPromptYesNo`'s non-TTY branch reads the piped answer via `Stdin` (Go's
+  // `console.ReadLine`); without it a CI/piped `db push` that reaches a confirmation
+  // prompt fails with a missing-service defect instead of honoring `y`/`n` or the default.
+  stdinLayer,
+  commandRuntimeLayer(["db", "push"]),
+);
diff --git a/apps/cli/src/legacy/commands/db/remote/commit/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/db/remote/commit/SIDE_EFFECTS.md
index 2b2e6ad3d2..88785a5530 100644
--- a/apps/cli/src/legacy/commands/db/remote/commit/SIDE_EFFECTS.md
+++ b/apps/cli/src/legacy/commands/db/remote/commit/SIDE_EFFECTS.md
@@ -37,7 +37,10 @@
 
 ### `--output-format text` (Go CLI compatible)
 
-Prints `Finished supabase db pull.` on success.
+Prints `Schema written to <path>` to stderr on success (from the shared
+`pull.Run`, `internal/db/pull/pull.go:72`); no stdout confirmation message is
+printed. The `Finished supabase db pull.` PostRun message belongs only to
+`db pull` (`cmd/db.go:198-200`), not `db remote commit`.
 
 ### `--output-format json`
 
diff --git a/apps/cli/src/legacy/commands/db/reset/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/db/reset/SIDE_EFFECTS.md
index d1291e27a4..0934154974 100644
--- a/apps/cli/src/legacy/commands/db/reset/SIDE_EFFECTS.md
+++ b/apps/cli/src/legacy/commands/db/reset/SIDE_EFFECTS.md
@@ -1,60 +1,148 @@
 # `supabase db reset`
 
+Native TypeScript port of `apps/cli-go/internal/db/reset/reset.go`. Reinitialises a
+database from local migrations (plus seed). The **remote** path (`--linked`, or a
+remote `--db-url`) is native: drop all user schemas, upsert vault secrets, then
+re-apply migrations and seed. The **local** path (`--local`/default, or a `--db-url`
+pointing at the local stack) is also native: TS orchestrates the running check,
+messages, bucket seeding, and git-branch line, while the container-recreate
+primitives run behind the hidden Go `db __db-bootstrap` seam. Only the niche
+**`--experimental`** remote schema-files path still delegates to the Go binary.
+
 ## Files Read
 
-| Path                                    | Format     | When                                              |
-| --------------------------------------- | ---------- | ------------------------------------------------- |
-| `~/.supabase/access-token`              | plain text | when `SUPABASE_ACCESS_TOKEN` unset and `--linked` |
-| `<workdir>/supabase/migrations/`        | directory  | always, to load migration files                   |
-| seed files from config or `--sql-paths` | SQL        | unless `--no-seed` is set                         |
+| Path                                                   | Format     | When                                                                                                                  |
+| ------------------------------------------------------ | ---------- | --------------------------------------------------------------------------------------------------------------------- |
+| `<workdir>/supabase/migrations/`                       | directory  | to validate `--version` / resolve `--last`, and to load migrations                                                    |
+| `<workdir>/supabase/config.toml`                       | TOML       | always, parsed up front before any destructive work (embedded defaults when absent); re-read for local bucket seeding |
+| `<workdir>/.git/HEAD` (walked upward)                  | plain text | local path, for the `Finished … on branch <branch>.` line                                                             |
+| `~/.supabase/<hash>/project-ref`                       | plain text | `--linked`, to resolve the ref                                                                                        |
+| `~/.supabase/access-token`                             | plain text | `--linked`, when `SUPABASE_ACCESS_TOKEN` unset and a temp role is minted                                              |
+| seed files from `--sql-paths` or `[db.seed].sql_paths` | SQL        | when seeding is enabled (not `--no-seed`); `--sql-paths` overrides config                                             |
+| `<workdir>/supabase/buckets/`                          | files      | local path, when storage is up and `[storage.buckets]` configure objects                                              |
 
 ## Files Written
 
-| Path | Format | When |
-| ---- | ------ | ---- |
-| —    | —      | —    |
+| Path                                             | Format | When                              |
+| ------------------------------------------------ | ------ | --------------------------------- |
+| `~/.supabase/<workdir-hash>/linked-project.json` | JSON   | `--linked` (post-run cache)       |
+| `~/.supabase/telemetry.json`                     | JSON   | always (post-run telemetry flush) |
+
+On the local path the Go seam additionally recreates the `supabase_db_<project>`
+container/volume and applies the initial schema (`SetupLocalDatabase`); the
+`--experimental` remote path produces whatever the delegated Go binary writes.
+
+## Subprocesses
+
+| Command                                                                     | When                                | Purpose                                                                 |
+| --------------------------------------------------------------------------- | ----------------------------------- | ----------------------------------------------------------------------- |
+| `docker container inspect supabase_db_<project>`                            | local path                          | `AssertSupabaseDbIsRunning` probe (Podman fallback)                     |
+| `supabase-go db __db-bootstrap --mode recreate [--version <v>] [--no-seed]` | local path                          | recreate container + init schema + migrate + seed + restart services    |
+| `supabase-go db __db-bootstrap --mode await-storage`                        | local path                          | storage health gate before bucket seeding (`ready` / `absent`)          |
+| `supabase-go db reset --linked\|--db-url … [--no-seed]`                     | `--experimental` remote, no version | the un-ported experimental schema-files apply path (telemetry disabled) |
+
+The seam subprocesses run with `SUPABASE_TELEMETRY_DISABLED=1`, stderr inherited;
+`--network-id` / a flag-selected `--profile` are forwarded.
+
+## Database Mutations
+
+### Remote path (native, in TS)
+
+| Statement                                                                                       | When                                                         |
+| ----------------------------------------------------------------------------------------------- | ------------------------------------------------------------ |
+| `drop.sql` `DO` block (drops user schemas/extensions/public objects, truncates auth/migrations) | always, first                                                |
+| `SELECT vault.update_secret(...)` / `vault.create_secret(...)`                                  | when `[db.vault]` has syncable secrets                       |
+| migration statements + `schema_migrations` history insert (per file, transactional)             | when `[db.migrations].enabled`, for migrations `≤ --version` |
+| seed statements + `seed_files` hash upsert                                                      | when `[db.seed].enabled` and not `--no-seed`                 |
+
+### Local path (inside the Go seam)
+
+The recreate seam drops & recreates the `postgres`/`_supabase` databases (PG≤14) or
+removes & recreates the db container/volume (PG15), applies the initial schema +
+roles, then runs `MigrateAndSeed` (migrations `≤ --version`, seed unless `--no-seed`)
+and restarts the storage/auth/realtime/pooler containers. Bucket objects are then
+seeded over the Storage gateway (reusing the `seed buckets` local path).
 
 ## API Routes
 
-| Method | Path | Auth | Request body | Response (used fields) |
-| ------ | ---- | ---- | ------------ | ---------------------- |
-| —      | —    | —    | —            | —                      |
+| Method | Path | Auth | Request body | Response (used fields)                                                                                                                                             |
+| ------ | ---- | ---- | ------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
+| —      | —    | —    | —            | Connects to Postgres directly. The `--linked` resolver may call the Management API to mint a temporary login role; local bucket seeding calls the Storage gateway. |
 
 ## Environment Variables
 
-| Variable                | Purpose                                 | Required?                                               |
-| ----------------------- | --------------------------------------- | ------------------------------------------------------- |
-| `SUPABASE_ACCESS_TOKEN` | auth token for `--linked` mode          | no (falls back to keyring → `~/.supabase/access-token`) |
-| `DB_PASSWORD`           | password for direct database connection | no                                                      |
+| Variable                | Purpose                                         | Required?                                               |
+| ----------------------- | ----------------------------------------------- | ------------------------------------------------------- |
+| `SUPABASE_ACCESS_TOKEN` | auth token for the `--linked` resolver path     | no (falls back to keyring → `~/.supabase/access-token`) |
+| `SUPABASE_DB_PASSWORD`  | password for the linked/remote connection       | no                                                      |
+| `SUPABASE_YES`          | auto-confirm the reset prompt                   | no (also `--yes`)                                       |
+| `SUPABASE_EXPERIMENTAL` | routes the experimental schema-files path to Go | no (also `--experimental`)                              |
+| `SUPABASE_PROJECT_ID`   | overrides the local container id (`utils.DbId`) | no                                                      |
 
 ## Exit Codes
 
-| Code | Condition                   |
-| ---- | --------------------------- |
-| `0`  | success                     |
-| `1`  | database connection failure |
-| `1`  | migration apply error       |
+| Code                 | Condition                                                                                                                  |
+| -------------------- | -------------------------------------------------------------------------------------------------------------------------- |
+| `0`                  | success                                                                                                                    |
+| `1`                  | mutually exclusive target flags (`[db-url linked local]`)                                                                  |
+| `1`                  | `--version` + `--last` together (`[last version]`)                                                                         |
+| `1`                  | `--version` not an integer (`invalid version number`)                                                                      |
+| `1`                  | `--version` has no matching migration file                                                                                 |
+| `1`                  | local: database not running (`supabase start is not running.`)                                                             |
+| `1`                  | user declined the reset confirmation (`context canceled`)                                                                  |
+| `1`                  | `config.toml` parse failure                                                                                                |
+| `1`                  | drop / migrate / seed / vault apply failure, or connection error                                                           |
+| child's exact code\* | local: container recreate / storage health-gate failure (seam), or `--experimental`/`--linked` delegate (proxy) child exit |
+
+\* The `db __db-bootstrap` seam and the `--experimental` remote delegate both
+propagate the spawned `supabase-go` child's real exit code (e.g. `130` after a
+Ctrl-C mid-recreate) instead of collapsing every failure to `1` — in every
+`--output-format` (CLI-1879).
 
 ## Output
 
+The remote path prints `Resetting remote database…` to **stderr**, then the
+drop/migrate/seed progress (`Applying migration …`, `Seeding data from …`). Go
+connects with `io.Discard`, so there is **no** `Connecting to … database…` line and
+**no** `Finished …` line on the remote path.
+
+The local path prints `Resetting local database…` to **stderr**, then the seam's
+`Recreating database...` / `Restarting containers...` progress, and finally
+`Finished supabase db reset on branch <branch>.` (`supabase db reset` and `<branch>`
+in Aqua).
+
 ### `--output-format text` (Go CLI compatible)
 
-Prints progress to stderr as migrations are applied.
+Byte-matches Go's stderr progress for both the remote and local paths. The
+`--experimental` remote path passes the delegated Go binary's output through
+unchanged.
 
-### `--output-format json`
+### `--output-format json` / `stream-json`
 
-Not applicable.
+stdout is payload-only; a `result` object is emitted:
 
-### `--output-format stream-json`
+```json
+{ "target": "remote" | "local", "version": "<resolved version or empty>" }
+```
 
-Not applicable.
+In machine modes the remote confirmation prompt is non-interactive and takes its
+default (`false`), so a remote reset is declined unless `--yes` is set. The local
+path has no confirmation prompt.
 
 ## Notes
 
-- `--no-seed` skips running the seed script after reset.
-- `--sql-paths` overrides `[db.seed].sql_paths` for one reset; repeat it to seed multiple files or glob patterns.
-- `--sql-paths` force-enables seeding for that reset even when `[db.seed].enabled = false`.
-- With `--linked` or `--db-url`, `--sql-paths` seeds the selected remote database after migrations.
-- `--version` resets up to the specified migration version.
-- `--last` resets up to the last n migration versions; mutually exclusive with `--version`.
+- **Target/local split** follows Go's `IsLocalDatabase(resolved config)`, not the
+  flag name: a `--db-url` pointing at the local stack is treated as a local reset.
+- `--no-seed` forces seeding off (Go sets `Config.Db.Seed.Enabled = false`); on the
+  local path it is forwarded to the recreate seam so `MigrateAndSeed` skips the seed.
+- `--sql-paths` overrides `[db.seed].sql_paths` for one reset and force-enables seeding
+  even when `[db.seed].enabled = false`; repeat it to seed multiple files or glob
+  patterns (supabase-relative). Mutually exclusive with `--no-seed`. On the local path
+  it is forwarded to the recreate seam; on the remote path it seeds the selected
+  database after migrations (Go warns when paired with `--linked` / `--db-url`).
+- `--last n` reverts the most recent `n` migrations; if `n ≥ total`, the reset target
+  version becomes `-` (revert everything). Mutually exclusive with `--version`.
 - `--db-url`, `--linked`, and `--local` (default true) are mutually exclusive.
+- **Known interim**: only `--experimental` remote resets run via the Go binary; the
+  best-effort pg-delta catalog cache (inside the seam) is not surfaced (no output
+  impact). `encrypted:` vault secrets are skipped on the remote path.
diff --git a/apps/cli/src/legacy/commands/db/reset/reset.command.ts b/apps/cli/src/legacy/commands/db/reset/reset.command.ts
index 15a61c8d88..979d088f84 100644
--- a/apps/cli/src/legacy/commands/db/reset/reset.command.ts
+++ b/apps/cli/src/legacy/commands/db/reset/reset.command.ts
@@ -1,6 +1,10 @@
 import { Command, Flag } from "effect/unstable/cli";
 import type * as CliCommand from "effect/unstable/cli/Command";
+
+import { withJsonErrorHandling } from "../../../../shared/output/json-error-handling.ts";
+import { withLegacyCommandInstrumentation } from "../../../telemetry/legacy-command-instrumentation.ts";
 import { legacyDbReset } from "./reset.handler.ts";
+import { legacyDbResetRuntimeLayer } from "./reset.layers.ts";
 
 const noSqlPaths: ReadonlyArray<string> = [];
 
@@ -42,5 +46,24 @@ export type LegacyDbResetFlags = CliCommand.Command.Config.Infer<typeof config>;
 export const legacyDbResetCommand = Command.make("reset", config).pipe(
   Command.withDescription("Resets the local database to current migrations."),
   Command.withShortDescription("Resets the local database to current migrations"),
-  Command.withHandler((flags) => legacyDbReset(flags)),
+  Command.withHandler((flags) =>
+    legacyDbReset(flags).pipe(
+      withLegacyCommandInstrumentation({
+        flags: {
+          "db-url": flags.dbUrl,
+          linked: flags.linked,
+          local: flags.local,
+          "no-seed": flags.noSeed,
+          "sql-paths": flags.sqlPaths,
+          version: flags.version,
+          last: flags.last,
+        },
+        // NO safeFlags: `markFlagTelemetrySafe` is per flag INSTANCE, and Go only
+        // marks migration squash's `--version` (cmd/migration.go:134). db reset's
+        // `--version` (cmd/db.go) is unmarked, so Go redacts it — match that.
+      }),
+      withJsonErrorHandling,
+    ),
+  ),
+  Command.provide(legacyDbResetRuntimeLayer),
 );
diff --git a/apps/cli/src/legacy/commands/db/reset/reset.errors.ts b/apps/cli/src/legacy/commands/db/reset/reset.errors.ts
new file mode 100644
index 0000000000..bfb4c3e539
--- /dev/null
+++ b/apps/cli/src/legacy/commands/db/reset/reset.errors.ts
@@ -0,0 +1,88 @@
+import { Data } from "effect";
+
+/**
+ * Conflicting database-target flags. Reproduces cobra's
+ * `MarkFlagsMutuallyExclusive("db-url", "linked", "local")` (`cmd/db.go:573`).
+ */
+export class LegacyDbResetTargetFlagsError extends Data.TaggedError(
+  "LegacyDbResetTargetFlagsError",
+)<{
+  readonly message: string;
+}> {}
+
+/**
+ * `--version` and `--last` together. Reproduces cobra's
+ * `MarkFlagsMutuallyExclusive("version", "last")` (`cmd/db.go:576`).
+ */
+export class LegacyDbResetVersionFlagsError extends Data.TaggedError(
+  "LegacyDbResetVersionFlagsError",
+)<{
+  readonly message: string;
+}> {}
+
+/**
+ * `--version` is not a valid integer. Byte-matches Go's
+ * `failed to parse <v>: invalid version number` (`repair.go:24-29`).
+ */
+export class LegacyDbResetInvalidVersionError extends Data.TaggedError(
+  "LegacyDbResetInvalidVersionError",
+)<{
+  readonly message: string;
+}> {}
+
+/**
+ * No migration file matches `--version`. Byte-matches Go's
+ * `glob supabase/migrations/<version>_*.sql: file does not exist`
+ * (`repair.GetMigrationFile`).
+ */
+export class LegacyDbResetMigrationFileError extends Data.TaggedError(
+  "LegacyDbResetMigrationFileError",
+)<{
+  readonly message: string;
+}> {}
+
+/**
+ * The user declined the reset confirmation. Go returns
+ * `errors.New(context.Canceled)` (`internal/db/reset/reset.go:248`).
+ */
+export class LegacyDbResetCancelledError extends Data.TaggedError("LegacyDbResetCancelledError")<{
+  readonly message: string;
+}> {}
+
+/** A drop / migrate / seed / vault statement failed during the remote reset. */
+export class LegacyDbResetApplyError extends Data.TaggedError("LegacyDbResetApplyError")<{
+  readonly message: string;
+}> {}
+
+/**
+ * The local database container is not running. Byte-matches Go's
+ * `utils.ErrNotRunning` (`internal/utils/misc.go:116`), `"<aqua>supabase start</aqua>
+ * is not running."`, returned by `AssertSupabaseDbIsRunning` before the local
+ * reset (`internal/db/reset/reset.go:57`).
+ */
+export class LegacyDbResetNotRunningError extends Data.TaggedError("LegacyDbResetNotRunningError")<{
+  readonly message: string;
+}> {}
+
+/**
+ * `--last` was given a negative value. Go declares `--last` as an unsigned flag
+ * (`UintVar`, `cmd/db.go`), so cobra rejects a negative at parse time. Byte-matches
+ * cobra's parse error for `strconv.ParseUint`.
+ */
+export class LegacyDbResetLastFlagError extends Data.TaggedError("LegacyDbResetLastFlagError")<{
+  readonly message: string;
+}> {}
+
+/**
+ * Invalid `--sql-paths` usage. Byte-matches Go's `validateDbResetSeedFlags`
+ * (`cmd/db.go`): `"--no-seed cannot be used with --sql-paths"` and
+ * `"--sql-paths requires a non-empty path or glob pattern"`.
+ */
+export class LegacyDbResetSeedFlagsError extends Data.TaggedError("LegacyDbResetSeedFlagsError")<{
+  readonly message: string;
+  /**
+   * Actionable hint rendered as a `Suggestion:` line, mirroring Go's
+   * `validateDbResetSeedFlags` `utils.CmdSuggestion` (`cmd/db.go`).
+   */
+  readonly suggestion?: string;
+}> {}
diff --git a/apps/cli/src/legacy/commands/db/reset/reset.handler.ts b/apps/cli/src/legacy/commands/db/reset/reset.handler.ts
index de35923ac2..4b5fc92782 100644
--- a/apps/cli/src/legacy/commands/db/reset/reset.handler.ts
+++ b/apps/cli/src/legacy/commands/db/reset/reset.handler.ts
@@ -1,16 +1,480 @@
-import { Effect, Option } from "effect";
+import { Effect, FileSystem, Option, Path } from "effect";
+
+import { CliArgs } from "../../../../shared/cli/cli-args.service.ts";
+import { detectGitBranch } from "../../../../shared/git/git-branch.ts";
+import { LegacyDnsResolverFlag } from "../../../../shared/legacy/global-flags.ts";
+import {
+  legacyResolveExperimentalWithProjectEnv,
+  legacyResolveYesWithProjectEnv,
+} from "../../../../shared/legacy/global-flags.ts";
 import { LegacyGoProxy } from "../../../../shared/legacy/go-proxy.service.ts";
+import { Output } from "../../../../shared/output/output.service.ts";
+import { legacyAqua, legacyYellow } from "../../../shared/legacy-colors.ts";
+import { LegacyCliConfig } from "../../../config/legacy-cli-config.service.ts";
+import { LegacyProjectRefResolver } from "../../../config/legacy-project-ref.service.ts";
+import { LegacyDbConfigResolver } from "../../../shared/legacy-db-config.service.ts";
+import {
+  legacyCheckDbToml,
+  legacyLoadProjectEnv,
+  legacyResolveSeedSqlPath,
+} from "../../../shared/legacy-db-config.toml-read.ts";
+import { LegacyDbConnection } from "../../../shared/legacy-db-connection.service.ts";
+import { legacyApplyMigrations } from "../../../shared/legacy-migration-apply.ts";
+import { legacyPromptYesNo } from "../../../shared/legacy-prompt-yes-no.ts";
+import {
+  type LegacyDbConnType,
+  resolveLegacyDbTargetFlags,
+} from "../../../shared/legacy-db-target-flags.ts";
+import { LegacyLinkedProjectCache } from "../../../telemetry/legacy-linked-project-cache.service.ts";
+import { LegacyTelemetryState } from "../../../telemetry/legacy-telemetry-state.service.ts";
+import { legacyDropUserSchemas } from "../shared/legacy-drop-schemas.ts";
+import { LegacyDbBootstrapSeam } from "../shared/legacy-db-bootstrap.seam.service.ts";
+import { legacyListLocalMigrations } from "../shared/legacy-pgdelta.cache.ts";
+import { legacyGetPendingSeeds, legacySeedData } from "../shared/legacy-seed-ops.ts";
+import { legacyPathMatch } from "../../../shared/legacy-path-match.ts";
+import { legacyUpsertVaultSecrets } from "../../../shared/legacy-vault.ts";
+import { legacySeedBucketsRun } from "../../../shared/legacy-seed-buckets.ts";
 import type { LegacyDbResetFlags } from "./reset.command.ts";
+import {
+  LegacyDbResetApplyError,
+  LegacyDbResetCancelledError,
+  LegacyDbResetInvalidVersionError,
+  LegacyDbResetLastFlagError,
+  LegacyDbResetMigrationFileError,
+  LegacyDbResetNotRunningError,
+  LegacyDbResetSeedFlagsError,
+  LegacyDbResetTargetFlagsError,
+  LegacyDbResetVersionFlagsError,
+} from "./reset.errors.ts";
 
-export const legacyDbReset = Effect.fn("legacy.db.reset")(function* (flags: LegacyDbResetFlags) {
-  const proxy = yield* LegacyGoProxy;
-  const args: string[] = ["db", "reset"];
+const INTEGER_PATTERN = /^[+-]?\d+$/u;
+const MIGRATE_FILE_PATTERN = /^([0-9]+)_(.*)\.sql$/u;
+
+const applyError = (message: string) => new LegacyDbResetApplyError({ message });
+
+/** Go's `toLogMessage` (`internal/db/reset/reset.go:88-91`). */
+const toLogMessage = (version: string): string =>
+  version.length > 0 ? ` to version: ${version}` : "...";
+
+/**
+ * Rebuilds the `db reset` argv for the remaining Go-delegated path: a remote
+ * `--experimental` reset with no resolved version. Only the flags reachable on
+ * that path are forwarded — `--local` always takes the native path, and a set
+ * `--version`/`--last` resolves a non-empty version which disables the experimental
+ * delegation (a degenerate `--last 0` resolves to "" and is behaviourally identical
+ * whether or not it is forwarded, so it is omitted).
+ *
+ * The target selector is forwarded from the RESOLVED `connType`, not the raw `--linked`
+ * boolean: the parent's `resolveLegacyDbTargetFlags` follows Cobra's `Changed` semantics, so
+ * `--linked=false` selects the linked/remote target (this path is remote-only). Forwarding
+ * only when `flags.linked === true` would drop the selector for `--linked=false` and let the
+ * Go child fall back to its local default — resetting the wrong database.
+ */
+const buildResetArgs = (
+  flags: LegacyDbResetFlags,
+  connType: LegacyDbConnType,
+  yes: boolean,
+): Array<string> => {
+  const args = ["db", "reset"];
   if (Option.isSome(flags.dbUrl)) args.push("--db-url", flags.dbUrl.value);
-  if (flags.linked) args.push("--linked");
-  if (flags.local) args.push("--local");
+  else if (connType === "linked") args.push("--linked");
   if (flags.noSeed) args.push("--no-seed");
-  for (const path of flags.sqlPaths) args.push("--sql-paths", path);
-  if (Option.isSome(flags.version)) args.push("--version", flags.version.value);
-  if (Option.isSome(flags.last)) args.push("--last", String(flags.last.value));
-  yield* proxy.exec(args);
+  for (const p of flags.sqlPaths) args.push("--sql-paths", p);
+  // Forward the parent's RESOLVED `yes` as a bound flag. Go's `--yes` beats `AutomaticEnv`,
+  // so `--yes=false` overrides an inherited `SUPABASE_YES=true` (the child no longer
+  // auto-confirms a reset the user protected with `--yes=false`), while `--yes=true` honors
+  // an explicit `--yes` / env even in machine mode where the child's stdin is ignored.
+  // `--yes=false` still prompts on a TTY (Go's PromptYesNo only short-circuits on true), so
+  // this matches the default behavior when neither flag nor env is set.
+  args.push(`--yes=${yes}`);
+  return args;
+};
+
+/**
+ * `supabase db reset` — reinitialise a database from local migrations (+ seed).
+ *
+ * Strict 1:1 port of `apps/cli-go/internal/db/reset/reset.go`. The remote path
+ * (`--linked` / a remote `--db-url`) is native. The local path (and the niche
+ * `--experimental` schema-files path) delegate to the Go binary as a documented
+ * interim until the container-bootstrap seam is ported (CLI-1325 Stage 3).
+ */
+export const legacyDbReset = Effect.fn("legacy.db.reset")(function* (flags: LegacyDbResetFlags) {
+  const output = yield* Output;
+  const resolver = yield* LegacyDbConfigResolver;
+  const dbConn = yield* LegacyDbConnection;
+  const proxy = yield* LegacyGoProxy;
+  const seam = yield* LegacyDbBootstrapSeam;
+  const cliConfig = yield* LegacyCliConfig;
+  const telemetryState = yield* LegacyTelemetryState;
+  const linkedProjectCache = yield* LegacyLinkedProjectCache;
+  const fs = yield* FileSystem.FileSystem;
+  const path = yield* Path.Path;
+  const cliArgs = yield* CliArgs;
+  const dnsResolver = yield* LegacyDnsResolverFlag;
+
+  const workdir = cliConfig.workdir;
+  const migrationsDir = path.join(workdir, "supabase", "migrations");
+  // Go's `ParseDatabaseConfig` runs `loadNestedEnv` (which `os.Setenv`s each project-.env key)
+  // before `reset.Run` reads `viper.GetBool("YES")` / `viper.GetBool("EXPERIMENTAL")`, so a
+  // `SUPABASE_YES` / `SUPABASE_EXPERIMENTAL` set only in `supabase/.env` is honored. Load the
+  // project env first and resolve both gates against it, as `db pull` does for `yes`.
+  const projectEnv = yield* legacyLoadProjectEnv(fs, path, workdir);
+  const yes = yield* legacyResolveYesWithProjectEnv(projectEnv);
+  const experimental = yield* legacyResolveExperimentalWithProjectEnv(projectEnv);
+  let linkedRefForCache: string | undefined;
+
+  const body = Effect.gen(function* () {
+    const target = resolveLegacyDbTargetFlags(cliArgs.args);
+    // cobra MarkFlagsMutuallyExclusive("db-url", "linked", "local").
+    if (target.setFlags.length > 1) {
+      return yield* Effect.fail(
+        new LegacyDbResetTargetFlagsError({
+          message: `if any flags in the group [db-url linked local] are set none of the others can be; [${target.setFlags.join(" ")}] were all set`,
+        }),
+      );
+    }
+    // Go declares `--last` as `UintVar`, so cobra rejects a negative at parse time
+    // (`Flag.integer` here accepts it). Reject it the same way rather than silently
+    // treating it as "no --last" and resetting the full history.
+    if (Option.isSome(flags.last) && flags.last.value < 0) {
+      return yield* Effect.fail(
+        new LegacyDbResetLastFlagError({
+          message: `invalid argument "${flags.last.value}" for "--last" flag: strconv.ParseUint: parsing "${flags.last.value}": invalid syntax`,
+        }),
+      );
+    }
+    // cobra MarkFlagsMutuallyExclusive("version", "last") — alphabetical group.
+    if (Option.isSome(flags.version) && Option.isSome(flags.last)) {
+      return yield* Effect.fail(
+        new LegacyDbResetVersionFlagsError({
+          message:
+            "if any flags in the group [last version] are set none of the others can be; [last version] were all set",
+        }),
+      );
+    }
+
+    // Go's validateDbResetSeedFlags (PreRunE): `--no-seed` conflicts with
+    // `--sql-paths`, and each `--sql-paths` value must be non-empty.
+    if (flags.noSeed && flags.sqlPaths.length > 0) {
+      return yield* Effect.fail(
+        new LegacyDbResetSeedFlagsError({
+          message: "--no-seed cannot be used with --sql-paths",
+          suggestion: `Use either ${legacyAqua("--no-seed")} to skip seeding or ${legacyAqua(
+            "--sql-paths",
+          )} to override seed files, not both.`,
+        }),
+      );
+    }
+    if (flags.sqlPaths.some((p) => p.length === 0)) {
+      return yield* Effect.fail(
+        new LegacyDbResetSeedFlagsError({
+          message: "--sql-paths requires a non-empty path or glob pattern",
+          suggestion: `Pass a non-empty file path or glob pattern to ${legacyAqua("--sql-paths")}.`,
+        }),
+      );
+    }
+    // Go's warnRemoteResetSeedOverride (PreRunE): a remote target flag + --sql-paths.
+    if (
+      flags.sqlPaths.length > 0 &&
+      (target.setFlags.includes("linked") || target.setFlags.includes("db-url"))
+    ) {
+      yield* output.raw(
+        `${legacyYellow("WARNING:")} --sql-paths overrides [db.seed].sql_paths and seeds the remote database selected by --linked or --db-url.\n`,
+        "stderr",
+      );
+    }
+
+    // Version / last resolution (Go's reset.Run lines 34-52), filesystem only.
+    let resolvedVersion = "";
+    if (Option.isSome(flags.version)) {
+      const v = flags.version.value;
+      if (!INTEGER_PATTERN.test(v)) {
+        return yield* Effect.fail(
+          new LegacyDbResetInvalidVersionError({
+            message: `failed to parse ${v}: invalid version number`,
+          }),
+        );
+      }
+      // Go validates the version with `repair.GetMigrationFile` (repair.go:90-100),
+      // which globs `supabase/migrations/<version>_*.sql` DIRECTLY with no filtering —
+      // so a deprecated first migration (e.g. `20200101000000_init.sql`) that
+      // `legacyListLocalMigrations` excludes is still accepted. Mirror that with a raw
+      // directory read + Go-glob match instead of the filtered migration listing.
+      const entries = yield* fs
+        .readDirectory(migrationsDir)
+        .pipe(Effect.orElseSucceed(() => [] as ReadonlyArray<string>));
+      const found = entries.some(
+        (name) => legacyPathMatch(`${v}_*.sql`, path.basename(name)).matched,
+      );
+      if (!found) {
+        return yield* Effect.fail(
+          new LegacyDbResetMigrationFileError({
+            message: `glob supabase/migrations/${v}_*.sql: file does not exist`,
+          }),
+        );
+      }
+      resolvedVersion = v;
+    } else if (Option.isSome(flags.last) && flags.last.value > 0) {
+      const locals = yield* legacyListLocalMigrations(fs, path, migrationsDir);
+      const versions = locals.flatMap((p) => {
+        const m = MIGRATE_FILE_PATTERN.exec(path.basename(p));
+        return m?.[1] !== undefined ? [m[1]] : [];
+      });
+      const total = versions.length;
+      const last = flags.last.value;
+      resolvedVersion = last < total ? versions[total - last - 1]! : "-";
+    }
+
+    const connType = target.connType ?? "local";
+    // Single source of truth for "does this reset delegate to the Go child?" —
+    // checked at both delegation sites below (before `resolve()` for a linked
+    // target, after it for a `--db-url` target) so the two call sites can never
+    // drift apart.
+    const shouldDelegateExperimental = experimental && resolvedVersion === "";
+
+    // Delegates the remaining `--experimental` schema-files apply path
+    // (`apply.MigrateAndSeed`, not ported) to the Go child. In text mode inherit
+    // its stdio. Under a machine-output mode (`--output-format json|stream-json`)
+    // the Go child emits no TS envelope, so suppress its stdout (capture + discard)
+    // and emit the same structured success the native local and remote paths do,
+    // keeping the JSON contract consistent across all reset paths.
+    const delegateExperimentalReset = () =>
+      Effect.gen(function* () {
+        const env = { SUPABASE_TELEMETRY_DISABLED: "1" };
+        if (output.format === "text") {
+          yield* proxy.exec(buildResetArgs(flags, connType, yes), { env });
+        } else {
+          // Machine-output mode is non-interactive: give the Go child a non-TTY stdin
+          // (`stdin: "ignore"`) so it can't block on (or be answered at) Go's
+          // destructive reset prompt — it takes the default `false`, matching the
+          // native reset path which suppresses prompts under json/stream-json.
+          yield* proxy.execCapture(buildResetArgs(flags, connType, yes), { env, stdin: "ignore" });
+          yield* output.success("Reset remote database.", {
+            target: "remote",
+            version: resolvedVersion,
+          });
+        }
+      });
+
+    // Go's ParseDatabaseConfig runs LoadProjectRef BEFORE the fallible linked
+    // resolution (db_url.go:87-95), and Execute() writes the linked-project cache
+    // even when a later step errors (root.go:171-181). Pre-load the ref so the
+    // post-run cache finalizer still fires when resolve fails mid-way (merged
+    // config, temp-role mint, connection) — mirrors push.handler.
+    if (connType === "linked") {
+      const refResolver = yield* LegacyProjectRefResolver;
+      linkedRefForCache = yield* refResolver.loadProjectRef(Option.none());
+
+      // A linked target is never local (`resolver.resolve()`'s "linked" branch
+      // always returns `isLocal: false`), so the delegated-experimental check can
+      // run BEFORE calling `resolve()`. This matters: for `connType === "linked"`,
+      // `resolve()` mints/verifies a temporary Postgres login role over the
+      // Management API — and the delegated Go child re-runs that exact same
+      // `ParseDatabaseConfig` work itself once delegation happens. Calling
+      // `resolve()` here would mint the temp role twice for zero downstream use on
+      // this branch (Go's own reset flow mints it exactly once, as part of the code
+      // path being delegated to — confirmed against `apps/cli-go/internal/utils/
+      // flags/db_url.go`'s `NewDbConfigWithPassword`/`initLoginRole`). CLI-1879.
+      if (shouldDelegateExperimental) {
+        yield* delegateExperimentalReset();
+        return;
+      }
+    }
+
+    const cfg = yield* resolver.resolve({ dbUrl: flags.dbUrl, connType, dnsResolver });
+
+    // Local target → native local reset. The container-recreate primitives live
+    // behind the hidden Go `db __db-bootstrap` seam; TS orchestrates the rest
+    // (running check, messages, bucket seeding, git-branch line, output shaping).
+    // Mirrors `internal/db/reset/reset.go:57-77`.
+    if (cfg.isLocal) {
+      // Go's `flags.LoadConfig` (root `PersistentPreRunE` → the local target's
+      // per-connType `LoadConfig`, `internal/utils/flags/db_url.go:77-80`) runs full
+      // config validation before `reset.Run` ever reaches `AssertSupabaseDbIsRunning`
+      // / the destructive `resetDatabase` (`internal/db/reset/reset.go:57-61`). The
+      // resolver's own local read (above, line 239) already performs the identical
+      // validation and would already reject a broken config before this point is
+      // reached — so today this re-validates for its own sake. Repeat it here anyway,
+      // as an explicit, independent gate (the same pattern `db start` and `db push`
+      // use), so the "malformed config aborts before the local database is recreated"
+      // guarantee is enforced by this handler directly and stays covered by a
+      // handler-level test even if the resolver's own internal read is ever mocked,
+      // relaxed, or refactored to stop validating.
+      yield* legacyCheckDbToml(fs, path, workdir);
+
+      // AssertSupabaseDbIsRunning — error if the local db container is down.
+      const running = yield* seam.isDbRunning();
+      if (!running) {
+        return yield* Effect.fail(
+          new LegacyDbResetNotRunningError({
+            message: `${legacyAqua("supabase start")} is not running.`,
+          }),
+        );
+      }
+      // resetDatabase: "Resetting local database…" then recreate + migrate + seed.
+      yield* output.raw(`Resetting local database${toLogMessage(resolvedVersion)}\n`, "stderr");
+      yield* seam.recreateDatabase({
+        version: resolvedVersion,
+        noSeed: flags.noSeed,
+        sqlPaths: flags.sqlPaths,
+      });
+
+      // Seed objects from supabase/buckets when storage is up (Go gates buckets on
+      // an existing, healthy storage container). Reuses the ported seed-buckets
+      // local path; its summary is suppressed (reset emits its own result).
+      const storageReady = yield* seam.awaitStorageReady();
+      if (storageReady) {
+        // Go's `buckets.Run(ctx, "", false, fsys)` — non-interactive: overwrite/prune
+        // confirmations take their defaults instead of blocking on input.
+        //
+        // `legacyCheckDbToml` above resolves `env(VAR)` via `legacyLoadProjectEnv`,
+        // which mirrors Go's full nested-env walk (`.env.<SUPABASE_ENV>.local`,
+        // `.env.local`, `.env.<SUPABASE_ENV>`, `.env`, across both `supabase/` and the
+        // project root — `pkg/config/config.go:1220-1257`). This reload instead goes
+        // through `@supabase/config`'s `loadProjectConfig` → `loadProjectEnvironment`,
+        // which only ever reads `supabase/.env`/`.env.local` plus ambient env
+        // (`packages/config/src/project.ts:209-245`) — regardless of `goViperCompat`,
+        // which only widens `env(VAR)` matching, not the file set consulted. So a
+        // config whose `env(VAR)` reference is backed by e.g. `supabase/.env.development`
+        // is genuinely Go-valid (Go's `godotenv.Load` calls `os.Setenv`, so the value is
+        // real ambient env by the time Go resolves it — `config.go:1260-1261`) and
+        // already passed `legacyCheckDbToml` and the real recreate above, but this
+        // narrower reload can still reject it. A `LegacySeedConfigLoadError` here is
+        // that env-file-set gap, not a genuinely invalid config — and recreate already
+        // dropped/rebuilt the DB, so aborting now would leave the reset half-done; warn
+        // and skip buckets so `db reset` finishes like Go instead.
+        yield* legacySeedBucketsRun({
+          projectRef: "",
+          emitSummary: false,
+          interactive: false,
+          // Go loads nested env before `buckets.Run`, so `SUPABASE_YES` in `supabase/.env`
+          // auto-confirms bucket/vector/analytics prune prompts. Pass the project-env-resolved
+          // `yes` (the shared runner's own `legacyResolveYes` only sees the shell env).
+          yes,
+        }).pipe(
+          Effect.catchTag("LegacySeedConfigLoadError", (error) =>
+            output.raw(
+              `${legacyYellow("WARNING:")} skipped seeding storage buckets: ${error.message}\n`,
+              "stderr",
+            ),
+          ),
+        );
+      }
+
+      // "Finished supabase db reset on branch <branch>." (both Aqua).
+      const branch = Option.getOrElse(yield* detectGitBranch(workdir), () => "main");
+      yield* output.raw(
+        `Finished ${legacyAqua("supabase db reset")} on branch ${legacyAqua(branch)}.\n`,
+        "stderr",
+      );
+      if (output.format !== "text") {
+        yield* output.success("Reset local database.", {
+          target: "local",
+          version: resolvedVersion,
+        });
+      }
+      return;
+    }
+
+    // Re-confirm `linkedRefForCache` from the now-resolved `cfg.ref` for the native
+    // remote linked path below (a linked+experimental+versionless target already
+    // delegated and returned above, before `resolve()` was ever called — see the
+    // `connType === "linked"` block earlier in this function). A `connType ===
+    // "db-url"` target leaves `linkedRefForCache` as whatever the pre-load block
+    // set (nothing, for `db-url`), since this assignment only fires when linked.
+    const linkedRef = Option.getOrUndefined(cfg.ref ?? Option.none());
+    if (connType === "linked" && linkedRef !== undefined) linkedRefForCache = linkedRef;
+
+    // Remaining remote target: a `--db-url` pointing at a non-local host (the
+    // `connType === "linked"` case already delegated above, before `resolve()`,
+    // without resolving a connection at all).
+    if (shouldDelegateExperimental) {
+      yield* delegateExperimentalReset();
+      return;
+    }
+
+    // Single Go-parity config load (`flags.LoadConfig` → `config.Load` + `Validate`):
+    // decodes the whole config with Go's env-expansion + `strconv.ParseBool` weak typing
+    // (so `enabled = "env(SEED_ENABLED)"` etc. load like Go), applies `SUPABASE_*`
+    // AutomaticEnv overrides, merges a matching `[remotes.<ref>]` block, and decrypts every
+    // `encrypted:` secret with the shell AND project-`.env` `DOTENV_PRIVATE_KEY*` keys —
+    // aborting here (before the destructive prompt / `legacyDropUserSchemas`) on any
+    // undecryptable/invalid config, exactly like Go's `LoadConfig` before ResetAll.
+    const configRef = connType === "linked" && linkedRef !== undefined ? linkedRef : undefined;
+    const toml = yield* legacyCheckDbToml(fs, path, workdir, configRef);
+    if (toml.appliedRemote !== undefined) {
+      yield* output.raw(`Loading config override: [remotes.${toml.appliedRemote}]\n`, "stderr");
+    }
+    const vaultSecrets = toml.vault;
+
+    // Go's resetRemote: prompt (default false) → cancel, then ResetAll.
+    const shouldReset = yield* legacyPromptYesNo(
+      output,
+      yes,
+      "Do you want to reset the remote database?",
+      false,
+    );
+    if (!shouldReset) {
+      return yield* Effect.fail(new LegacyDbResetCancelledError({ message: "context canceled" }));
+    }
+    yield* output.raw(`Resetting remote database${toLogMessage(resolvedVersion)}\n`, "stderr");
+
+    // Go connects with io.Discard, so NO "Connecting to ... database..." line.
+    yield* Effect.scoped(
+      Effect.gen(function* () {
+        const session = yield* dbConn.connect(cfg.conn, { isLocal: false, dnsResolver });
+        // ResetAll: drop user schemas → upsert vault → migrate + seed.
+        yield* legacyDropUserSchemas(session, applyError);
+        yield* legacyUpsertVaultSecrets(session, vaultSecrets);
+
+        if (toml.migrationsEnabled) {
+          const locals = yield* legacyListLocalMigrations(fs, path, migrationsDir);
+          // LoadPartialMigrations filter: version === "" || v <= version.
+          const pending = locals.filter((p) => {
+            if (resolvedVersion === "") return true;
+            const m = MIGRATE_FILE_PATTERN.exec(path.basename(p));
+            return m?.[1] !== undefined && m[1] <= resolvedVersion;
+          });
+          yield* legacyApplyMigrations(session, fs, path, pending, applyError);
+        }
+
+        // `--no-seed` disables seeding; `--sql-paths` overrides [db.seed].sql_paths
+        // and force-enables it (Go's applyDbResetSeedFlags). The two are mutually
+        // exclusive (validated above).
+        const overrideSeed = flags.sqlPaths.length > 0;
+        // `--sql-paths` force-enables seeding (Go's applyDbResetSeedFlags); otherwise
+        // honor `db.seed.enabled` (already `SUPABASE_DB_SEED_ENABLED`-resolved by the reader).
+        const seedEnabled = overrideSeed || (toml.seed.enabled && !flags.noSeed);
+        if (seedEnabled) {
+          // `[db.seed].sql_paths` is already Go-config-resolved (supabase/-joined) by the
+          // reader; the `--sql-paths` override is resolved here the same way Go's
+          // `resolveSeedSqlPaths` does, so both feed the glob identical paths.
+          const seedPaths = overrideSeed
+            ? flags.sqlPaths.map((p) => legacyResolveSeedSqlPath(path, p))
+            : toml.seed.sqlPaths;
+          const seeds = yield* legacyGetPendingSeeds(session, fs, path, seedPaths, workdir);
+          yield* legacySeedData(session, fs, workdir, path, seeds, applyError);
+        }
+        // Go's best-effort pgcache catalog warning is not ported (no output impact).
+      }),
+    );
+
+    if (output.format !== "text") {
+      yield* output.success("Reset remote database.", {
+        target: "remote",
+        version: resolvedVersion,
+      });
+    }
+  });
+
+  yield* body.pipe(
+    Effect.ensuring(
+      Effect.suspend(() =>
+        linkedRefForCache !== undefined && linkedRefForCache !== ""
+          ? linkedProjectCache.cache(linkedRefForCache)
+          : Effect.void,
+      ),
+    ),
+    Effect.ensuring(telemetryState.flush),
+  );
 });
diff --git a/apps/cli/src/legacy/commands/db/reset/reset.integration.test.ts b/apps/cli/src/legacy/commands/db/reset/reset.integration.test.ts
index bd533d2adc..48d25519c8 100644
--- a/apps/cli/src/legacy/commands/db/reset/reset.integration.test.ts
+++ b/apps/cli/src/legacy/commands/db/reset/reset.integration.test.ts
@@ -1,26 +1,66 @@
+import { mkdirSync, writeFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+
+import { BunServices } from "@effect/platform-bun";
 import { describe, expect, it } from "@effect/vitest";
-import { Effect, Layer, Option } from "effect";
-import { CliOutput, Command } from "effect/unstable/cli";
-import { mockOutput } from "../../../../../tests/helpers/mocks.ts";
+import { Cause, Effect, Exit, Layer, Option } from "effect";
+import * as HttpClient from "effect/unstable/http/HttpClient";
+import * as HttpClientResponse from "effect/unstable/http/HttpClientResponse";
+
+import {
+  mockOutput,
+  mockRuntimeInfo,
+  mockStdin,
+  mockTty,
+} from "../../../../../tests/helpers/mocks.ts";
+import {
+  LEGACY_VALID_REF,
+  mockLegacyCliConfig,
+  mockLegacyLinkedProjectCacheTracked,
+  mockLegacyPlatformApiService,
+  mockLegacyTelemetryStateTracked,
+  useLegacyTempWorkdir,
+} from "../../../../../tests/helpers/legacy-mocks.ts";
+import { LegacyPlatformApi } from "../../../auth/legacy-platform-api.service.ts";
+import { LegacyPlatformApiFactory } from "../../../auth/legacy-platform-api-factory.service.ts";
+import { LegacyProjectRefResolver } from "../../../config/legacy-project-ref.service.ts";
+import { CliArgs } from "../../../../shared/cli/cli-args.service.ts";
+import {
+  LegacyDnsResolverFlag,
+  LegacyExperimentalFlag,
+  LegacyYesFlag,
+} from "../../../../shared/legacy/global-flags.ts";
 import { LegacyGoProxy } from "../../../../shared/legacy/go-proxy.service.ts";
-import { textCliOutputFormatter } from "../../../../shared/output/text-formatter.ts";
-import { legacyDbResetCommand } from "./reset.command.ts";
+import { LegacyGoChildExitError } from "../../../../shared/legacy/legacy-go-child-exit.error.ts";
+import type { OutputFormat } from "../../../../shared/output/types.ts";
+import { LegacyDbConfigResolver } from "../../../shared/legacy-db-config.service.ts";
+import type {
+  LegacyDbConfigFlags,
+  LegacyResolvedDbConfig,
+} from "../../../shared/legacy-db-config.types.ts";
+import { LegacyDbConfigConnectTempRoleError } from "../../../shared/legacy-db-config.errors.ts";
+import { LegacyDbExecError } from "../../../shared/legacy-db-connection.errors.ts";
+import {
+  LegacyDbConnection,
+  type LegacyPgConnInput,
+} from "../../../shared/legacy-db-connection.service.ts";
+import { LegacyDbBootstrapSeam } from "../shared/legacy-db-bootstrap.seam.service.ts";
 import { legacyDbReset } from "./reset.handler.ts";
 import type { LegacyDbResetFlags } from "./reset.command.ts";
 
-function setupLegacyDbReset() {
-  const calls: Array<ReadonlyArray<string>> = [];
-  const layer = Layer.succeed(LegacyGoProxy, {
-    exec: (args) =>
-      Effect.sync(() => {
-        calls.push(args);
-      }),
-    execCapture: () => Effect.succeed(""),
-  });
-  return { layer, calls };
-}
+const LIST_MIGRATIONS =
+  "SELECT version FROM supabase_migrations.schema_migrations ORDER BY version";
+const SELECT_SEEDS = "SELECT path, hash FROM supabase_migrations.seed_files";
 
-const baseFlags: LegacyDbResetFlags = {
+const CONN: LegacyPgConnInput = {
+  host: "db.example.supabase.co",
+  port: 5432,
+  user: "postgres",
+  password: "secret",
+  database: "postgres",
+};
+
+const DEFAULT_FLAGS: LegacyDbResetFlags = {
   dbUrl: Option.none(),
   linked: false,
   local: false,
@@ -30,118 +70,1327 @@ const baseFlags: LegacyDbResetFlags = {
   last: Option.none(),
 };
 
+/**
+ * Tracks every `resolve`/`resolvePoolerFallback` invocation so tests can prove a
+ * connection was (or, for the delegated-experimental path, was NOT) resolved —
+ * `resolve()` mints/verifies a temporary Postgres login role over the Management
+ * API, so calling it on a path that immediately discards the result is wasted
+ * (and duplicated) work (CLI-1879).
+ */
+function mockResolver(opts: {
+  isLocal: boolean;
+  ref?: string;
+  omitRef?: boolean;
+  resolveFails?: boolean;
+}) {
+  let calls = 0;
+  const layer = Layer.succeed(LegacyDbConfigResolver, {
+    resolve: (_flags: LegacyDbConfigFlags) => {
+      calls++;
+      return opts.resolveFails === true
+        ? Effect.fail(
+            new LegacyDbConfigConnectTempRoleError({
+              message: "failed to create login role: network error",
+            }),
+          )
+        : Effect.succeed(
+            (opts.omitRef === true
+              ? { conn: CONN, isLocal: opts.isLocal }
+              : {
+                  conn: CONN,
+                  isLocal: opts.isLocal,
+                  ref: opts.ref !== undefined ? Option.some(opts.ref) : Option.none(),
+                }) satisfies LegacyResolvedDbConfig,
+          );
+    },
+    resolvePoolerFallback: () => {
+      calls++;
+      return Effect.succeed(Option.none());
+    },
+  });
+  return {
+    layer,
+    get calls() {
+      return calls;
+    },
+  };
+}
+
+function mockConnection(opts: { remoteSeeds?: Readonly<Record<string, string>> }) {
+  const execs: Array<string> = [];
+  const queries: Array<{ sql: string; params?: ReadonlyArray<unknown> }> = [];
+  const layer = Layer.succeed(LegacyDbConnection, {
+    connect: () =>
+      Effect.succeed({
+        extensionExists: () => Effect.succeed(false),
+        copyToCsv: () => Effect.succeed(new Uint8Array()),
+        queryRaw: () => Effect.succeed({ fields: [], rows: [], commandTag: "" }),
+        exec: (sql: string): Effect.Effect<void, LegacyDbExecError> =>
+          Effect.sync(() => {
+            execs.push(sql);
+          }),
+        query: (
+          sql: string,
+          params?: ReadonlyArray<unknown>,
+        ): Effect.Effect<ReadonlyArray<Record<string, unknown>>, LegacyDbExecError> =>
+          Effect.suspend(
+            (): Effect.Effect<ReadonlyArray<Record<string, unknown>>, LegacyDbExecError> => {
+              queries.push({ sql, params });
+              if (sql === SELECT_SEEDS) {
+                return Effect.succeed(
+                  Object.entries(opts.remoteSeeds ?? {}).map(([path, hash]) => ({ path, hash })),
+                );
+              }
+              if (sql === LIST_MIGRATIONS) return Effect.succeed([]);
+              return Effect.succeed([]);
+            },
+          ),
+      }),
+  });
+  return {
+    layer,
+    get execs() {
+      return execs;
+    },
+    get queries() {
+      return queries;
+    },
+  };
+}
+
+/**
+ * Stateful mock of the container-bootstrap seam. `running` drives
+ * `AssertSupabaseDbIsRunning`; `storageReady` drives the bucket-seed gate. Records
+ * the recreate args so tests can assert version / `--no-seed` propagation.
+ * `awaitStorageReadyExitCode`, when set, fails `awaitStorageReady` with a
+ * `LegacyGoChildExitError` carrying that code — simulating the seam's real
+ * `captureStdout` bootstrap-child path exiting non-zero (CLI-1879).
+ */
+function mockBootstrapSeam(opts: {
+  running?: boolean;
+  storageReady?: boolean;
+  awaitStorageReadyExitCode?: number;
+}) {
+  const recreateCalls: Array<{
+    version: string;
+    noSeed: boolean;
+    sqlPaths: ReadonlyArray<string>;
+  }> = [];
+  let storageChecked = false;
+  const layer = Layer.succeed(LegacyDbBootstrapSeam, {
+    isDbRunning: () => Effect.succeed(opts.running ?? true),
+    startDatabase: () => Effect.void,
+    recreateDatabase: (args: {
+      version: string;
+      noSeed: boolean;
+      sqlPaths: ReadonlyArray<string>;
+    }) =>
+      Effect.sync(() => {
+        recreateCalls.push(args);
+      }),
+    awaitStorageReady: () =>
+      Effect.sync(() => {
+        storageChecked = true;
+      }).pipe(
+        Effect.flatMap(() =>
+          opts.awaitStorageReadyExitCode !== undefined
+            ? Effect.fail(
+                new LegacyGoChildExitError({
+                  exitCode: opts.awaitStorageReadyExitCode,
+                  message: `failed to bootstrap the local database: exit ${opts.awaitStorageReadyExitCode}`,
+                }),
+              )
+            : Effect.succeed(opts.storageReady ?? false),
+        ),
+      ),
+  });
+  return {
+    layer,
+    get recreateCalls() {
+      return recreateCalls;
+    },
+    get storageChecked() {
+      return storageChecked;
+    },
+  };
+}
+
+// Dummy HTTP client; the local-reset bucket-seed core only reaches it when storage
+// is ready AND buckets are configured (no reset test configures buckets, so the
+// gateway is never actually called). Present to satisfy the handler's R.
+const mockStorageHttp = Layer.succeed(
+  HttpClient.HttpClient,
+  HttpClient.make((request) =>
+    Effect.succeed(HttpClientResponse.fromWeb(request, new Response("{}", { status: 404 }))),
+  ),
+);
+
+/**
+ * `execCaptureExitCode`, when set, makes `execCapture` fail with a
+ * `LegacyGoChildExitError` carrying that code instead of succeeding — simulating
+ * a delegated Go child exiting non-zero under a machine-output mode (CLI-1879).
+ */
+function mockProxy(opts: { execCaptureExitCode?: number } = {}) {
+  const calls: Array<{ args: ReadonlyArray<string>; env?: Record<string, string> }> = [];
+  const layer = Layer.succeed(LegacyGoProxy, {
+    exec: (args, execOpts) =>
+      Effect.sync(() => {
+        calls.push({ args, env: execOpts?.env });
+      }),
+    execCapture: (args, execOpts) =>
+      Effect.sync(() => {
+        calls.push({ args, env: execOpts?.env });
+      }).pipe(
+        Effect.flatMap(() =>
+          opts.execCaptureExitCode !== undefined
+            ? Effect.fail(
+                new LegacyGoChildExitError({
+                  exitCode: opts.execCaptureExitCode,
+                  message: `supabase-go exited with code ${opts.execCaptureExitCode}`,
+                }),
+              )
+            : Effect.succeed(""),
+        ),
+      ),
+  });
+  return {
+    layer,
+    get calls() {
+      return calls;
+    },
+  };
+}
+
+function setup(
+  workdir: string,
+  opts: {
+    toml?: string;
+    files?: Readonly<Record<string, string>>;
+    format?: OutputFormat;
+    confirm?: ReadonlyArray<boolean>;
+    args?: ReadonlyArray<string>;
+    isLocal?: boolean;
+    ref?: string;
+    experimental?: boolean;
+    remoteSeeds?: Readonly<Record<string, string>>;
+    yes?: boolean;
+    omitRef?: boolean;
+    resolveFails?: boolean;
+    running?: boolean;
+    storageReady?: boolean;
+    awaitStorageReadyExitCode?: number;
+    execCaptureExitCode?: number;
+  },
+) {
+  if (opts.toml !== undefined) {
+    mkdirSync(join(workdir, "supabase"), { recursive: true });
+    writeFileSync(join(workdir, "supabase", "config.toml"), opts.toml);
+  }
+  for (const [rel, content] of Object.entries(opts.files ?? {})) {
+    const abs = join(workdir, rel);
+    mkdirSync(dirname(abs), { recursive: true });
+    writeFileSync(abs, content);
+  }
+
+  const out = mockOutput({ format: opts.format ?? "text", promptConfirmResponses: opts.confirm });
+  const conn = mockConnection(opts);
+  const proxy = mockProxy({ execCaptureExitCode: opts.execCaptureExitCode });
+  const seam = mockBootstrapSeam({
+    running: opts.running,
+    storageReady: opts.storageReady,
+    awaitStorageReadyExitCode: opts.awaitStorageReadyExitCode,
+  });
+  const telemetry = mockLegacyTelemetryStateTracked();
+  const linkedCache = mockLegacyLinkedProjectCacheTracked();
+  // The local-reset bucket-seed core statically requires the (lazy) Management-API
+  // factory; never invoked on `--local` (projectRef === "").
+  const platformApi = mockLegacyPlatformApiService({});
+  const resolver = mockResolver({
+    isLocal: opts.isLocal ?? false,
+    ref: opts.ref ?? LEGACY_VALID_REF,
+    omitRef: opts.omitRef,
+    resolveFails: opts.resolveFails,
+  });
+
+  const layer = Layer.mergeAll(
+    out.layer,
+    conn.layer,
+    proxy.layer,
+    seam.layer,
+    resolver.layer,
+    mockLegacyCliConfig({ workdir }),
+    BunServices.layer,
+    mockRuntimeInfo(),
+    // The remote-reset confirmation is answered through mockOutput's
+    // `promptConfirmResponses` (the TTY/clack path), so mark stdin a TTY. Stdin is
+    // only referenced by legacyPromptYesNo's non-TTY branch (unreached here) but must
+    // be present to satisfy the effect's requirements.
+    mockTty({ stdinIsTty: true }),
+    mockStdin(true),
+    // The linked ref is pre-loaded (for the post-run cache) before resolve,
+    // mirroring Go's LoadProjectRef-before-NewDbConfigWithPassword order.
+    Layer.succeed(LegacyProjectRefResolver, {
+      resolve: () => Effect.succeed(opts.ref ?? LEGACY_VALID_REF),
+      resolveForLink: () => Effect.succeed(opts.ref ?? LEGACY_VALID_REF),
+      resolveOptional: () => Effect.succeed(Option.some(opts.ref ?? LEGACY_VALID_REF)),
+      loadProjectRef: () => Effect.succeed(opts.ref ?? LEGACY_VALID_REF),
+      promptProjectRef: () => Effect.succeed(opts.ref ?? LEGACY_VALID_REF),
+    }),
+    mockStorageHttp,
+    Layer.succeed(LegacyPlatformApiFactory, {
+      make: LegacyPlatformApi.pipe(Effect.provide(platformApi.layer)),
+    }),
+    Layer.succeed(CliArgs, { args: opts.args ?? ["db", "reset", "--linked"] }),
+    Layer.succeed(LegacyYesFlag, opts.yes ?? false),
+    Layer.succeed(LegacyDnsResolverFlag, "native"),
+    Layer.succeed(LegacyExperimentalFlag, opts.experimental ?? false),
+    telemetry.layer,
+    linkedCache.layer,
+  );
+  return { layer, out, conn, proxy, seam, telemetry, linkedCache, resolver };
+}
+
+const migrationFile = (version: string, body = "create table t ();") => ({
+  [`supabase/migrations/${version}_test.sql`]: body,
+});
+
 describe("legacy db reset", () => {
-  it.live("forwards the empty-array baseline without seed override flags", () => {
-    const { layer, calls } = setupLegacyDbReset();
+  const tmp = useLegacyTempWorkdir("supabase-db-reset-");
+
+  it.live("resets the local database via the bootstrap seam", () => {
+    const { layer, out, seam, proxy } = setup(tmp.current, {
+      toml: 'project_id = "test"\n',
+      args: ["db", "reset"],
+      isLocal: true,
+      running: true,
+    });
     return Effect.gen(function* () {
-      yield* legacyDbReset(baseFlags);
-      expect(calls).toEqual([["db", "reset"]]);
-    }).pipe(Effect.provide(layer));
+      yield* legacyDbReset(DEFAULT_FLAGS).pipe(Effect.provide(layer));
+      // Native path — no Go delegation.
+      expect(proxy.calls).toHaveLength(0);
+      expect(out.stderrText).toContain("Resetting local database...");
+      expect(seam.recreateCalls).toEqual([{ version: "", noSeed: false, sqlPaths: [] }]);
+      // Storage gate checked; with no buckets configured nothing is seeded.
+      expect(seam.storageChecked).toBe(true);
+      expect(out.stderrText).toContain("Finished ");
+      expect(out.stderrText).toContain("on branch ");
+    });
   });
 
-  it.live("forwards --no-seed alone", () => {
-    const { layer, calls } = setupLegacyDbReset();
+  it.live("fails a local reset when the database is not running", () => {
+    const { layer, seam } = setup(tmp.current, {
+      toml: 'project_id = "test"\n',
+      args: ["db", "reset"],
+      isLocal: true,
+      running: false,
+    });
     return Effect.gen(function* () {
-      yield* legacyDbReset({ ...baseFlags, noSeed: true });
-      expect(calls).toEqual([["db", "reset", "--no-seed"]]);
-    }).pipe(Effect.provide(layer));
+      const exit = yield* legacyDbReset(DEFAULT_FLAGS).pipe(Effect.provide(layer), Effect.exit);
+      expect(Exit.isFailure(exit)).toBe(true);
+      if (Exit.isFailure(exit)) expect(JSON.stringify(exit.cause)).toContain("is not running.");
+      expect(seam.recreateCalls).toHaveLength(0);
+    });
   });
 
-  it.live("forwards a single --sql-paths flag", () => {
-    const { layer, calls } = setupLegacyDbReset();
+  it.live("proceeds with a local reset when no config file is present", () => {
+    // Go's `Config.Load` tolerates a missing `config.toml`: `Eject` defaults an empty
+    // `project_id` to the cwd basename (`pkg/config/config.go:563-570`), so `Validate`
+    // never sees an empty required field and the CLI proceeds — exactly the mechanism
+    // the cli-e2e parity suite relies on when it runs `db reset --local` from a project
+    // with no config.toml. A missing config must not become a hard failure here.
+    const { layer, seam } = setup(tmp.current, {
+      args: ["db", "reset"],
+      isLocal: true,
+      running: true,
+    });
     return Effect.gen(function* () {
-      yield* legacyDbReset({
-        ...baseFlags,
-        sqlPaths: ["./seeds/base.sql"],
+      yield* legacyDbReset(DEFAULT_FLAGS).pipe(Effect.provide(layer));
+      expect(seam.recreateCalls).toHaveLength(1);
+    });
+  });
+
+  it.live("fails a local reset before the destructive recreate on a malformed config.toml", () => {
+    // Go's `flags.LoadConfig` (the local target's `LoadConfig`, `db_url.go:77-80`) runs
+    // full config validation before `reset.Run` reaches `AssertSupabaseDbIsRunning` /
+    // `resetDatabase` (`internal/db/reset/reset.go:57-61`). A broken config.toml must
+    // abort before the local database is ever recreated.
+    const { layer, seam } = setup(tmp.current, {
+      toml: 'project_id = "unterminated\n',
+      args: ["db", "reset"],
+      isLocal: true,
+      running: true,
+    });
+    return Effect.gen(function* () {
+      const exit = yield* legacyDbReset(DEFAULT_FLAGS).pipe(Effect.provide(layer), Effect.exit);
+      expect(Exit.isFailure(exit)).toBe(true);
+      if (Exit.isFailure(exit)) {
+        expect(JSON.stringify(exit.cause)).toContain("failed to load config");
+      }
+      expect(seam.recreateCalls).toHaveLength(0);
+    });
+  });
+
+  it.live(
+    "fails a local reset on a malformed config.toml even when the database is not running",
+    () => {
+      // Pins Go's exact ordering: `flags.LoadConfig` runs in the root `PersistentPreRunE`,
+      // strictly before `reset.Run` ever calls `AssertSupabaseDbIsRunning`
+      // (`internal/db/reset/reset.go:57`). So a broken config must surface as a config
+      // error even when the local database is ALSO not running — the config check must
+      // win the race, not the "is not running" check.
+      const { layer, seam } = setup(tmp.current, {
+        toml: 'project_id = "unterminated\n',
+        args: ["db", "reset"],
+        isLocal: true,
+        running: false,
+      });
+      return Effect.gen(function* () {
+        const exit = yield* legacyDbReset(DEFAULT_FLAGS).pipe(Effect.provide(layer), Effect.exit);
+        expect(Exit.isFailure(exit)).toBe(true);
+        if (Exit.isFailure(exit)) {
+          const cause = JSON.stringify(exit.cause);
+          expect(cause).toContain("failed to load config");
+          expect(cause).not.toContain("is not running.");
+        }
+        expect(seam.recreateCalls).toHaveLength(0);
+      });
+    },
+  );
+
+  it.live("fails a local reset before the destructive recreate on an undecryptable secret", () => {
+    // Regression: Go's `flags.LoadConfig` decrypts every `encrypted:` secret before
+    // `reset.Run` recreates the local database, so an undecryptable secret must abort
+    // before the destructive recreate, not surface later (or never) during bucket
+    // seeding.
+    const { layer, seam } = setup(tmp.current, {
+      toml: 'project_id = "test"\n\n[db.vault]\nmy_secret = "encrypted:anything"\n',
+      args: ["db", "reset"],
+      isLocal: true,
+      running: true,
+    });
+    return Effect.gen(function* () {
+      const exit = yield* legacyDbReset(DEFAULT_FLAGS).pipe(Effect.provide(layer), Effect.exit);
+      expect(Exit.isFailure(exit)).toBe(true);
+      // Assert on the stable "failed to parse config:" prefix rather than the exact
+      // decrypt-failure tail, which depends on whether an ambient `DOTENV_PRIVATE_KEY*`
+      // is set (missing key vs. a base64/decrypt failure) — either way, the config
+      // load must fail before the destructive recreate.
+      if (Exit.isFailure(exit)) {
+        expect(JSON.stringify(exit.cause)).toContain("failed to parse config:");
+      }
+      expect(seam.recreateCalls).toHaveLength(0);
+    });
+  });
+
+  it.live("fails a local reset before the destructive recreate on an empty project_id", () => {
+    // Go's `config.Validate` rejects an explicit `project_id = ""` (a present override
+    // that resolved to empty, unlike an absent field) before the local recreate.
+    const { layer, seam } = setup(tmp.current, {
+      toml: 'project_id = ""\n',
+      args: ["db", "reset"],
+      isLocal: true,
+      running: true,
+    });
+    return Effect.gen(function* () {
+      const exit = yield* legacyDbReset(DEFAULT_FLAGS).pipe(Effect.provide(layer), Effect.exit);
+      expect(Exit.isFailure(exit)).toBe(true);
+      if (Exit.isFailure(exit)) {
+        expect(JSON.stringify(exit.cause)).toContain(
+          "Missing required field in config: project_id",
+        );
+      }
+      expect(seam.recreateCalls).toHaveLength(0);
+    });
+  });
+
+  it.live("seeds buckets after a local reset when storage is ready", () => {
+    const { layer, seam } = setup(tmp.current, {
+      toml: 'project_id = "test"\n',
+      args: ["db", "reset"],
+      isLocal: true,
+      running: true,
+      storageReady: true,
+    });
+    return Effect.gen(function* () {
+      // No buckets configured → the seed-buckets core short-circuits, but the
+      // storage gate is still consulted (Go inspects storage before buckets.Run).
+      yield* legacyDbReset(DEFAULT_FLAGS).pipe(Effect.provide(layer));
+      expect(seam.storageChecked).toBe(true);
+      expect(seam.recreateCalls).toHaveLength(1);
+    });
+  });
+
+  it.live("fails a local reset before the destructive recreate on an unparseable boolean", () => {
+    // `SEED_ENABLED=maybe` cannot be resolved by Go's `strconv.ParseBool`, so
+    // `flags.LoadConfig` aborts on this config before `reset.Run` ever reaches
+    // `AssertSupabaseDbIsRunning`/`resetDatabase`. Previously this surfaced only much
+    // later (if at all) via the bucket-seeding core's own reload, AFTER the local
+    // database had already been recreated — this must now abort up front instead,
+    // via the pre-recreate `legacyCheckDbToml` gate.
+    const previous = process.env["SEED_ENABLED"];
+    process.env["SEED_ENABLED"] = "maybe";
+    const { layer, seam } = setup(tmp.current, {
+      toml: 'project_id = "test"\n\n[db.seed]\nenabled = "env(SEED_ENABLED)"\n',
+      args: ["db", "reset"],
+      isLocal: true,
+      running: true,
+      storageReady: true,
+    });
+    return Effect.gen(function* () {
+      const exit = yield* legacyDbReset(DEFAULT_FLAGS).pipe(Effect.provide(layer), Effect.exit);
+      expect(Exit.isFailure(exit)).toBe(true);
+      if (Exit.isFailure(exit)) {
+        expect(JSON.stringify(exit.cause)).toContain("invalid db.seed.enabled");
+      }
+      expect(seam.recreateCalls).toHaveLength(0);
+    }).pipe(
+      Effect.ensuring(
+        Effect.sync(() => {
+          if (previous === undefined) delete process.env["SEED_ENABLED"];
+          else process.env["SEED_ENABLED"] = previous;
+        }),
+      ),
+    );
+  });
+
+  it.live(
+    "finishes a local reset when bucket seeding can't see an env(VAR) value the pre-recreate gate saw",
+    () => {
+      // `legacyCheckDbToml` (the pre-recreate gate) resolves `env(VAR)` via
+      // `legacyLoadProjectEnv`, which mirrors Go's full nested-env walk and sees
+      // `supabase/.env.development` — a real, Go-valid env source
+      // (`pkg/config/config.go:1220-1257`; `godotenv.Load` calls `os.Setenv`, so this
+      // is genuinely ambient env by the time Go itself resolves `env(VAR)`,
+      // `config.go:1260-1261`). The post-recreate bucket-seed reload instead goes
+      // through `@supabase/config`'s `loadProjectEnvironment`, which only ever reads
+      // `supabase/.env`/`.env.local` + ambient env (`packages/config/src/project.ts:
+      // 209-245) — it can't see `.env.development` at all. So this Go-valid config
+      // passes the gate and the real recreate, then can't be re-resolved by the
+      // reload; the reset must still finish (warn-and-skip), not hard-fail after the
+      // local database has already been dropped and rebuilt.
+      const { layer, out, seam } = setup(tmp.current, {
+        toml: 'project_id = "test"\n\n[db.seed]\nenabled = "env(SEED_ENABLED)"\n',
+        files: { "supabase/.env.development": "SEED_ENABLED=true\n" },
+        args: ["db", "reset"],
+        isLocal: true,
+        running: true,
+        storageReady: true,
+      });
+      return Effect.gen(function* () {
+        yield* legacyDbReset(DEFAULT_FLAGS).pipe(Effect.provide(layer));
+        expect(seam.recreateCalls).toHaveLength(1);
+        expect(out.stderrText).toContain("skipped seeding storage buckets");
+        expect(out.stderrText).toContain("Finished ");
       });
-      expect(calls).toEqual([["db", "reset", "--sql-paths", "./seeds/base.sql"]]);
-    }).pipe(Effect.provide(layer));
+    },
+  );
+
+  it.live("uses the detected git branch in the Finished line", () => {
+    const { layer, out } = setup(tmp.current, {
+      toml: 'project_id = "test"\n',
+      args: ["db", "reset"],
+      isLocal: true,
+      running: true,
+    });
+    // `detectGitBranch` checks `$GITHUB_HEAD_REF` first (matching Go's
+    // `GetGitBranchOrDefault`). Set it explicitly so the test is deterministic in
+    // both a plain checkout and a GitHub Actions PR run (where it is preset to the
+    // PR branch); restore it afterwards.
+    const previous = process.env["GITHUB_HEAD_REF"];
+    process.env["GITHUB_HEAD_REF"] = "feature-x";
+    return Effect.gen(function* () {
+      yield* legacyDbReset(DEFAULT_FLAGS).pipe(Effect.provide(layer));
+      // The branch name is wrapped in ANSI (legacyAqua), so assert on the token.
+      expect(out.stderrText).toContain("on branch ");
+      expect(out.stderrText).toContain("feature-x");
+    }).pipe(
+      Effect.ensuring(
+        Effect.sync(() => {
+          if (previous === undefined) delete process.env["GITHUB_HEAD_REF"];
+          else process.env["GITHUB_HEAD_REF"] = previous;
+        }),
+      ),
+    );
   });
 
-  it.live("forwards repeated --sql-paths flags in order", () => {
-    const { layer, calls } = setupLegacyDbReset();
+  it.live("fails a remote reset on a malformed config.toml", () => {
+    const { layer } = setup(tmp.current, { toml: 'project_id = "unterminated\n' });
+    return Effect.gen(function* () {
+      const exit = yield* legacyDbReset({ ...DEFAULT_FLAGS, linked: true }).pipe(
+        Effect.provide(layer),
+        Effect.exit,
+      );
+      expect(Exit.isFailure(exit)).toBe(true);
+      if (Exit.isFailure(exit)) {
+        // Config now loads through the Go-parity reader (`legacyCheckDbToml`), so a malformed
+        // config aborts with Go's `failed to load config` message, same as the other db
+        // commands (diff/dump/pull/migration).
+        expect(JSON.stringify(exit.cause)).toContain("failed to load config");
+      }
+    });
+  });
+
+  it.live("loads a Go-style env() boolean in config for a remote reset", () => {
+    // Regression: `enabled = "env(VAR)"` must load via Go's env-expansion + ParseBool
+    // (`legacyCheckDbToml`) instead of the strict @supabase/config loader rejecting it.
+    const previous = process.env["MIGRATIONS_ENABLED"];
+    process.env["MIGRATIONS_ENABLED"] = "true";
+    const { layer, out } = setup(tmp.current, {
+      toml: 'project_id = "test"\n\n[db.migrations]\nenabled = "env(MIGRATIONS_ENABLED)"\n',
+      files: migrationFile("20240101000000"),
+      confirm: [true],
+    });
+    return Effect.gen(function* () {
+      yield* legacyDbReset({ ...DEFAULT_FLAGS, linked: true }).pipe(Effect.provide(layer));
+      expect(out.stderrText).toContain("Applying migration 20240101000000_test.sql...");
+    }).pipe(
+      Effect.ensuring(
+        Effect.sync(() => {
+          if (previous === undefined) delete process.env["MIGRATIONS_ENABLED"];
+          else process.env["MIGRATIONS_ENABLED"] = previous;
+        }),
+      ),
+    );
+  });
+
+  it.live("emits a json result for a local reset", () => {
+    const { layer, out } = setup(tmp.current, {
+      toml: 'project_id = "test"\n',
+      args: ["db", "reset"],
+      isLocal: true,
+      running: true,
+      format: "json",
+    });
+    return Effect.gen(function* () {
+      yield* legacyDbReset(DEFAULT_FLAGS).pipe(Effect.provide(layer));
+      const success = out.messages.find((m) => m.type === "success");
+      expect(success?.data?.["target"]).toBe("local");
+    });
+  });
+
+  it.live("rejects mutually exclusive target flags", () => {
+    const { layer } = setup(tmp.current, {
+      toml: 'project_id = "test"\n',
+      args: ["db", "reset", "--linked", "--local"],
+    });
+    return Effect.gen(function* () {
+      const exit = yield* legacyDbReset(DEFAULT_FLAGS).pipe(Effect.provide(layer), Effect.exit);
+      expect(Exit.isFailure(exit)).toBe(true);
+    });
+  });
+
+  it.live("rejects --version together with --last", () => {
+    const { layer } = setup(tmp.current, { toml: 'project_id = "test"\n' });
+    return Effect.gen(function* () {
+      const exit = yield* legacyDbReset({
+        ...DEFAULT_FLAGS,
+        linked: true,
+        version: Option.some("20240101000000"),
+        last: Option.some(1),
+      }).pipe(Effect.provide(layer), Effect.exit);
+      expect(Exit.isFailure(exit)).toBe(true);
+      if (Exit.isFailure(exit)) expect(JSON.stringify(exit.cause)).toContain("[last version]");
+    });
+  });
+
+  it.live("rejects a non-integer --version", () => {
+    const { layer } = setup(tmp.current, { toml: 'project_id = "test"\n' });
+    return Effect.gen(function* () {
+      const exit = yield* legacyDbReset({
+        ...DEFAULT_FLAGS,
+        linked: true,
+        version: Option.some("not-a-number"),
+      }).pipe(Effect.provide(layer), Effect.exit);
+      expect(Exit.isFailure(exit)).toBe(true);
+      if (Exit.isFailure(exit))
+        expect(JSON.stringify(exit.cause)).toContain("invalid version number");
+    });
+  });
+
+  it.live("fails when --version has no matching migration file", () => {
+    const { layer } = setup(tmp.current, { toml: 'project_id = "test"\n' });
+    return Effect.gen(function* () {
+      const exit = yield* legacyDbReset({
+        ...DEFAULT_FLAGS,
+        linked: true,
+        version: Option.some("20240101000000"),
+      }).pipe(Effect.provide(layer), Effect.exit);
+      expect(Exit.isFailure(exit)).toBe(true);
+      if (Exit.isFailure(exit)) {
+        expect(JSON.stringify(exit.cause)).toContain(
+          "glob supabase/migrations/20240101000000_*.sql: file does not exist",
+        );
+      }
+    });
+  });
+
+  it.live("returns context canceled when the reset prompt is declined", () => {
+    const { layer, conn } = setup(tmp.current, {
+      toml: 'project_id = "test"\n',
+      confirm: [false],
+    });
+    return Effect.gen(function* () {
+      const exit = yield* legacyDbReset({ ...DEFAULT_FLAGS, linked: true }).pipe(
+        Effect.provide(layer),
+        Effect.exit,
+      );
+      expect(Exit.isFailure(exit)).toBe(true);
+      if (Exit.isFailure(exit)) expect(JSON.stringify(exit.cause)).toContain("context canceled");
+      expect(conn.execs).toHaveLength(0);
+    });
+  });
+
+  it.live("drops schemas and applies migrations + seed on a confirmed remote reset", () => {
+    const { layer, out, conn, linkedCache } = setup(tmp.current, {
+      toml: 'project_id = "test"\n',
+      files: {
+        ...migrationFile("20240101000000"),
+        "supabase/seed.sql": "insert into t values (1);",
+      },
+      confirm: [true],
+    });
+    return Effect.gen(function* () {
+      yield* legacyDbReset({ ...DEFAULT_FLAGS, linked: true }).pipe(Effect.provide(layer));
+      expect(out.stderrText).toContain("Resetting remote database...");
+      // No "Connecting to ... database..." line (Go uses io.Discard).
+      expect(out.stderrText).not.toContain("Connecting to");
+      // Drop block ran, then the migration applied.
+      expect(conn.execs.some((s) => s.includes("drop schema if exists"))).toBe(true);
+      expect(out.stderrText).toContain("Applying migration 20240101000000_test.sql...");
+      expect(out.stderrText).toContain("Seeding data from supabase/seed.sql...");
+      expect(linkedCache.cached).toBe(true);
+    });
+  });
+
+  it.live("fails a remote reset before dropping schemas on an undecryptable secret", () => {
+    // Regression: the old point-of-use vault decryption ran AFTER `legacyDropUserSchemas`,
+    // so an undecryptable `encrypted:` secret dropped the schemas before failing. Go runs
+    // `flags.LoadConfig` (which decrypts every secret) before ResetAll, so the reset must
+    // abort before any destructive work — matched here by `legacyCheckDbToml` at load time.
+    const { layer, conn } = setup(tmp.current, {
+      toml: 'project_id = "test"\n\n[db.vault]\nmy_secret = "encrypted:anything"\n',
+      confirm: [true],
+    });
+    return Effect.gen(function* () {
+      const exit = yield* legacyDbReset({ ...DEFAULT_FLAGS, linked: true }).pipe(
+        Effect.provide(layer),
+        Effect.exit,
+      );
+      expect(Exit.isFailure(exit)).toBe(true);
+      if (Exit.isFailure(exit)) {
+        expect(JSON.stringify(exit.cause)).toContain("failed to parse config: missing private key");
+      }
+      // Config load failed before ResetAll → schemas were never dropped.
+      expect(conn.execs.some((s) => s.includes("drop schema if exists"))).toBe(false);
+    });
+  });
+
+  it.live("fails a remote reset before dropping schemas on an empty project_id", () => {
+    // Go's config.Validate rejects an explicit `project_id = ""` before the reset prompt, so
+    // the native remote reset must abort before `legacyDropUserSchemas`.
+    const { layer, conn } = setup(tmp.current, {
+      toml: 'project_id = ""\n',
+      confirm: [true],
+    });
+    return Effect.gen(function* () {
+      const exit = yield* legacyDbReset({ ...DEFAULT_FLAGS, linked: true }).pipe(
+        Effect.provide(layer),
+        Effect.exit,
+      );
+      expect(Exit.isFailure(exit)).toBe(true);
+      if (Exit.isFailure(exit)) {
+        expect(JSON.stringify(exit.cause)).toContain(
+          "Missing required field in config: project_id",
+        );
+      }
+      expect(conn.execs.some((s) => s.includes("drop schema if exists"))).toBe(false);
+    });
+  });
+
+  it.live("auto-confirms a remote reset via SUPABASE_YES set only in the project .env", () => {
+    // Go's loadNestedEnv sets project-.env keys before the reset prompt reads viper YES, so
+    // a `SUPABASE_YES` in supabase/.env auto-confirms the destructive prompt (default false).
+    const { layer, conn } = setup(tmp.current, {
+      toml: 'project_id = "test"\n',
+      files: { "supabase/.env": "SUPABASE_YES=true\n" },
+      // Deliberately no `confirm` responses — the prompt must be auto-confirmed.
+    });
+    return Effect.gen(function* () {
+      yield* legacyDbReset({ ...DEFAULT_FLAGS, linked: true }).pipe(Effect.provide(layer));
+      expect(conn.execs.some((s) => s.includes("drop schema if exists"))).toBe(true);
+    });
+  });
+
+  it.live("still caches the linked ref when DB-config resolution fails", () => {
+    // Go's Execute() runs ensureProjectGroupsCached after ExecuteC returns even on
+    // error (root.go:171-181), and ParseDatabaseConfig sets ProjectRef via
+    // LoadProjectRef BEFORE the fallible temp-role/connection step — so a failed
+    // linked resolve must not skip the post-run linked-project cache write.
+    const { layer, linkedCache } = setup(tmp.current, {
+      toml: 'project_id = "test"\n',
+      resolveFails: true,
+    });
+    return Effect.gen(function* () {
+      const exit = yield* legacyDbReset({ ...DEFAULT_FLAGS, linked: true }).pipe(
+        Effect.provide(layer),
+        Effect.exit,
+      );
+      expect(Exit.isFailure(exit)).toBe(true);
+      expect(linkedCache.cached).toBe(true);
+      expect(linkedCache.cachedRef).toBe(LEGACY_VALID_REF);
+    });
+  });
+
+  it.live("resets to a specific version, applying only migrations up to it", () => {
+    const { layer, out, conn } = setup(tmp.current, {
+      toml: 'project_id = "test"\n',
+      files: {
+        ...migrationFile("20240101000000"),
+        ...migrationFile("20240202000000"),
+      },
+      confirm: [true],
+    });
     return Effect.gen(function* () {
       yield* legacyDbReset({
-        ...baseFlags,
-        sqlPaths: ["./seeds/base.sql", "./seeds/demo/*.sql"],
+        ...DEFAULT_FLAGS,
+        linked: true,
+        version: Option.some("20240101000000"),
+      }).pipe(Effect.provide(layer));
+      expect(out.stderrText).toContain("Resetting remote database to version: 20240101000000");
+      expect(out.stderrText).toContain("Applying migration 20240101000000_test.sql...");
+      expect(out.stderrText).not.toContain("Applying migration 20240202000000_test.sql...");
+      expect(conn).toBeDefined();
+    });
+  });
+
+  it.live("resolves --last to a version prefix", () => {
+    const { layer, out } = setup(tmp.current, {
+      toml: 'project_id = "test"\n',
+      files: {
+        ...migrationFile("20240101000000"),
+        ...migrationFile("20240202000000"),
+      },
+      confirm: [true],
+    });
+    return Effect.gen(function* () {
+      // last=1 → revert the most recent → reset to version 20240101000000.
+      yield* legacyDbReset({ ...DEFAULT_FLAGS, linked: true, last: Option.some(1) }).pipe(
+        Effect.provide(layer),
+      );
+      expect(out.stderrText).toContain("Resetting remote database to version: 20240101000000");
+    });
+  });
+
+  it.live("reverts all migrations when --last covers the full history", () => {
+    const { layer, out } = setup(tmp.current, {
+      toml: 'project_id = "test"\n',
+      files: { ...migrationFile("20240101000000"), ...migrationFile("20240202000000") },
+      confirm: [true],
+    });
+    return Effect.gen(function* () {
+      // last=2 with 2 local migrations → revert all → version "-".
+      yield* legacyDbReset({ ...DEFAULT_FLAGS, linked: true, last: Option.some(2) }).pipe(
+        Effect.provide(layer),
+      );
+      expect(out.stderrText).toContain("Resetting remote database to version: -");
+    });
+  });
+
+  it.live("skips seeding with --no-seed", () => {
+    const { layer, out } = setup(tmp.current, {
+      toml: 'project_id = "test"\n',
+      files: {
+        ...migrationFile("20240101000000"),
+        "supabase/seed.sql": "insert into t values (1);",
+      },
+      confirm: [true],
+    });
+    return Effect.gen(function* () {
+      yield* legacyDbReset({ ...DEFAULT_FLAGS, linked: true, noSeed: true }).pipe(
+        Effect.provide(layer),
+      );
+      expect(out.stderrText).not.toContain("Seeding data from");
+    });
+  });
+
+  it.live("delegates an experimental remote reset to the Go binary", () => {
+    const { layer, proxy } = setup(tmp.current, {
+      toml: 'project_id = "test"\n',
+      experimental: true,
+    });
+    return Effect.gen(function* () {
+      yield* legacyDbReset({ ...DEFAULT_FLAGS, linked: true }).pipe(Effect.provide(layer));
+      expect(proxy.calls).toHaveLength(1);
+      expect(proxy.calls[0]!.args).toEqual(["db", "reset", "--linked", "--yes=false"]);
+      expect(proxy.calls[0]!.env).toEqual({ SUPABASE_TELEMETRY_DISABLED: "1" });
+    });
+  });
+
+  it.live("does not resolve a linked DB connection before delegating an experimental reset", () => {
+    const { layer, proxy, resolver } = setup(tmp.current, {
+      toml: 'project_id = "test"\n',
+      experimental: true,
+    });
+    return Effect.gen(function* () {
+      yield* legacyDbReset({ ...DEFAULT_FLAGS, linked: true }).pipe(Effect.provide(layer));
+      expect(proxy.calls).toHaveLength(1);
+      // The delegated Go child re-runs its own connection resolution (including
+      // minting/verifying the temp login role) once it starts — the TS wrapper
+      // must not do that same Management-API work first only to discard it (CLI-1879).
+      expect(resolver.calls).toBe(0);
+    });
+  });
+
+  it.live("still caches the linked ref when delegating an experimental reset", () => {
+    // `linkedRefForCache` is pre-loaded via `LegacyProjectRefResolver.loadProjectRef`
+    // separately from `resolver.resolve()`, specifically so the post-run
+    // linked-project-cache finalizer still fires on this path even though
+    // `resolve()` itself is skipped entirely (CLI-1879).
+    const { layer, linkedCache } = setup(tmp.current, {
+      toml: 'project_id = "test"\n',
+      experimental: true,
+      ref: LEGACY_VALID_REF,
+    });
+    return Effect.gen(function* () {
+      yield* legacyDbReset({ ...DEFAULT_FLAGS, linked: true }).pipe(Effect.provide(layer));
+      expect(linkedCache.cached).toBe(true);
+      expect(linkedCache.cachedRef).toBe(LEGACY_VALID_REF);
+    });
+  });
+
+  it.live(
+    "surfaces a delegated experimental-reset child failure as a LegacyGoChildExitError under json output",
+    () => {
+      const { layer } = setup(tmp.current, {
+        toml: 'project_id = "test"\n',
+        experimental: true,
+        format: "json",
+        execCaptureExitCode: 3,
+      });
+      return Effect.gen(function* () {
+        // Under json/stream-json, the delegated path uses `execCapture` (non-text
+        // branch of `delegateExperimentalReset`) — this must flow through the normal
+        // Effect failure channel (reachable by `withJsonErrorHandling` at the
+        // command-wiring layer) instead of an immediate `ProcessControl.exit()` that a
+        // handler-level test could never observe (CLI-1879).
+        const exit = yield* legacyDbReset({ ...DEFAULT_FLAGS, linked: true }).pipe(
+          Effect.provide(layer),
+          Effect.exit,
+        );
+        expect(Exit.isFailure(exit)).toBe(true);
+        if (Exit.isFailure(exit)) {
+          const error = Cause.squash(exit.cause);
+          expect(error).toBeInstanceOf(LegacyGoChildExitError);
+          expect((error as LegacyGoChildExitError).exitCode).toBe(3);
+        }
       });
-      expect(calls).toEqual([
-        ["db", "reset", "--sql-paths", "./seeds/base.sql", "--sql-paths", "./seeds/demo/*.sql"],
+    },
+  );
+
+  it.live(
+    "propagates the storage-ready check's exact exit code and still flushes telemetry on a local reset",
+    () => {
+      // The bootstrap seam's `awaitStorageReady` (the `captureStdout` bootstrap-child
+      // path) failing non-zero must reach the handler as the exact `LegacyGoChildExitError`
+      // it fails with, and the handler's own `Effect.ensuring(telemetryState.flush)`
+      // finalizer must still run despite the typed failure (CLI-1879).
+      const { layer, telemetry } = setup(tmp.current, {
+        toml: 'project_id = "test"\n',
+        args: ["db", "reset"],
+        isLocal: true,
+        running: true,
+        awaitStorageReadyExitCode: 4,
+      });
+      return Effect.gen(function* () {
+        const exit = yield* legacyDbReset(DEFAULT_FLAGS).pipe(Effect.provide(layer), Effect.exit);
+        expect(Exit.isFailure(exit)).toBe(true);
+        if (Exit.isFailure(exit)) {
+          const error = Cause.squash(exit.cause);
+          expect(error).toBeInstanceOf(LegacyGoChildExitError);
+          expect((error as LegacyGoChildExitError).exitCode).toBe(4);
+        }
+        expect(telemetry.flushed).toBe(true);
+      });
+    },
+  );
+
+  it.live("forwards the linked selector to the delegate even for --linked=false", () => {
+    // Cobra `Changed` semantics: `--linked=false` still selects the linked/remote target in
+    // the parent, so the delegated argv must carry `--linked` — otherwise the Go child falls
+    // back to its local default and resets the wrong database.
+    const { layer, proxy } = setup(tmp.current, {
+      toml: 'project_id = "test"\n',
+      experimental: true,
+      args: ["db", "reset", "--linked=false"],
+    });
+    return Effect.gen(function* () {
+      yield* legacyDbReset({ ...DEFAULT_FLAGS, linked: false }).pipe(Effect.provide(layer));
+      expect(proxy.calls).toHaveLength(1);
+      expect(proxy.calls[0]!.args).toEqual(["db", "reset", "--linked", "--yes=false"]);
+    });
+  });
+
+  it.live("forwards --yes=false to the delegate even when SUPABASE_YES is set", () => {
+    // Explicit `--yes=false` beats `AutomaticEnv` in Go; the delegated child must receive the
+    // bound false flag so an inherited `SUPABASE_YES=true` doesn't auto-confirm the reset and
+    // drop the remote schemas the user tried to protect.
+    const previous = process.env["SUPABASE_YES"];
+    process.env["SUPABASE_YES"] = "true";
+    const { layer, proxy } = setup(tmp.current, {
+      toml: 'project_id = "test"\n',
+      experimental: true,
+      args: ["db", "reset", "--linked", "--yes=false"],
+    });
+    return Effect.gen(function* () {
+      yield* legacyDbReset({ ...DEFAULT_FLAGS, linked: true }).pipe(Effect.provide(layer));
+      expect(proxy.calls[0]!.args).toContain("--yes=false");
+    }).pipe(
+      Effect.ensuring(
+        Effect.sync(() => {
+          if (previous === undefined) delete process.env["SUPABASE_YES"];
+          else process.env["SUPABASE_YES"] = previous;
+        }),
+      ),
+    );
+  });
+
+  it.live("forwards --yes=true to the delegate when --yes is set", () => {
+    const { layer, proxy } = setup(tmp.current, {
+      toml: 'project_id = "test"\n',
+      experimental: true,
+      args: ["db", "reset", "--linked", "--yes"],
+      yes: true,
+    });
+    return Effect.gen(function* () {
+      yield* legacyDbReset({ ...DEFAULT_FLAGS, linked: true }).pipe(Effect.provide(layer));
+      expect(proxy.calls[0]!.args).toContain("--yes=true");
+    });
+  });
+
+  it.live(
+    "takes the experimental delegate path via SUPABASE_EXPERIMENTAL in the project .env",
+    () => {
+      // Go loads nested env before reset.Run reads viper EXPERIMENTAL, so the versionless remote
+      // reset delegates to the Go binary rather than replaying migrations natively.
+      const previous = process.env["SUPABASE_EXPERIMENTAL"];
+      delete process.env["SUPABASE_EXPERIMENTAL"];
+      const { layer, proxy, conn } = setup(tmp.current, {
+        toml: 'project_id = "test"\n',
+        files: { "supabase/.env": "SUPABASE_EXPERIMENTAL=true\n" },
+        // No experimental flag / shell env — only the project .env sets it.
+      });
+      return Effect.gen(function* () {
+        yield* legacyDbReset({ ...DEFAULT_FLAGS, linked: true }).pipe(Effect.provide(layer));
+        expect(proxy.calls).toHaveLength(1);
+        // Delegated, so the native remote path never dropped schemas.
+        expect(conn.execs.some((s) => s.includes("drop schema if exists"))).toBe(false);
+      }).pipe(
+        Effect.ensuring(
+          Effect.sync(() => {
+            if (previous === undefined) delete process.env["SUPABASE_EXPERIMENTAL"];
+            else process.env["SUPABASE_EXPERIMENTAL"] = previous;
+          }),
+        ),
+      );
+    },
+  );
+
+  it.live("attaches the Go seed-flag conflict suggestion to --no-seed + --sql-paths", () => {
+    const { layer } = setup(tmp.current, { toml: 'project_id = "test"\n' });
+    return Effect.gen(function* () {
+      const exit = yield* legacyDbReset({
+        ...DEFAULT_FLAGS,
+        noSeed: true,
+        sqlPaths: ["seed.sql"],
+      }).pipe(Effect.provide(layer), Effect.exit);
+      expect(Exit.isFailure(exit)).toBe(true);
+      if (Exit.isFailure(exit)) {
+        expect(JSON.stringify(exit.cause)).toContain("--no-seed cannot be used with --sql-paths");
+        // Go's validateDbResetSeedFlags CmdSuggestion, rendered as a Suggestion: line.
+        expect(JSON.stringify(exit.cause)).toContain("Use either");
+      }
+    });
+  });
+
+  it.live("forwards --db-url and --no-seed on an experimental remote db-url reset", () => {
+    const { layer, proxy, resolver } = setup(tmp.current, {
+      toml: 'project_id = "test"\n',
+      experimental: true,
+      args: ["db", "reset", "--db-url", "postgresql://db.example.com:5432/postgres"],
+    });
+    return Effect.gen(function* () {
+      yield* legacyDbReset({
+        ...DEFAULT_FLAGS,
+        dbUrl: Option.some("postgresql://db.example.com:5432/postgres"),
+        noSeed: true,
+      }).pipe(Effect.provide(layer));
+      expect(proxy.calls[0]!.args).toEqual([
+        "db",
+        "reset",
+        "--db-url",
+        "postgresql://db.example.com:5432/postgres",
+        "--no-seed",
+        "--yes=false",
       ]);
-    }).pipe(Effect.provide(layer));
+      // Unlike the `connType === "linked"` branch above, a `--db-url` target still
+      // resolves a connection before delegating — the pre-delegation skip (CLI-1879)
+      // is scoped to the linked branch only, not "never call resolve when delegating".
+      expect(resolver.calls).toBe(1);
+    });
   });
 
-  it.live("forwards --no-seed with --sql-paths so Go owns the diagnostic", () => {
-    const { layer, calls } = setupLegacyDbReset();
+  it.live("passes --no-seed and the resolved --last version to the recreate seam", () => {
+    const { layer, seam } = setup(tmp.current, {
+      toml: 'project_id = "test"\n',
+      files: { ...migrationFile("20240101000000"), ...migrationFile("20240202000000") },
+      args: ["db", "reset", "--local"],
+      isLocal: true,
+      running: true,
+    });
     return Effect.gen(function* () {
+      // last=1 with 2 local migrations → recreate up to version 20240101000000.
       yield* legacyDbReset({
-        ...baseFlags,
+        ...DEFAULT_FLAGS,
+        local: true,
         noSeed: true,
-        sqlPaths: ["./seeds/base.sql"],
-      });
-      expect(calls).toEqual([["db", "reset", "--no-seed", "--sql-paths", "./seeds/base.sql"]]);
-    }).pipe(Effect.provide(layer));
+        last: Option.some(1),
+      }).pipe(Effect.provide(layer));
+      expect(seam.recreateCalls).toEqual([
+        { version: "20240101000000", noSeed: true, sqlPaths: [] },
+      ]);
+    });
   });
 
-  it.live("forwards an empty --sql-paths value so Go owns the diagnostic", () => {
-    const { layer, calls } = setupLegacyDbReset();
+  it.live("recreates to a specific --version on a local db-url reset", () => {
+    const { layer, out, seam } = setup(tmp.current, {
+      toml: 'project_id = "test"\n',
+      files: migrationFile("20240101000000"),
+      args: ["db", "reset", "--db-url", "postgresql://localhost:54322/postgres"],
+      isLocal: true,
+      running: true,
+    });
     return Effect.gen(function* () {
       yield* legacyDbReset({
-        ...baseFlags,
+        ...DEFAULT_FLAGS,
+        dbUrl: Option.some("postgresql://localhost:54322/postgres"),
+        version: Option.some("20240101000000"),
+      }).pipe(Effect.provide(layer));
+      expect(out.stderrText).toContain("Resetting local database to version: 20240101000000");
+      expect(seam.recreateCalls).toEqual([
+        { version: "20240101000000", noSeed: false, sqlPaths: [] },
+      ]);
+    });
+  });
+
+  it.live("resets a remote --db-url target without loading a remote config override", () => {
+    const { layer, out, conn } = setup(tmp.current, {
+      // No config file → embedded defaults (migrations + seed enabled).
+      files: migrationFile("20240101000000"),
+      args: ["db", "reset", "--db-url", "postgresql://db.example.com:5432/postgres"],
+      isLocal: false,
+      omitRef: true,
+      confirm: [true],
+    });
+    return Effect.gen(function* () {
+      yield* legacyDbReset({
+        ...DEFAULT_FLAGS,
+        dbUrl: Option.some("postgresql://db.example.com:5432/postgres"),
+      }).pipe(Effect.provide(layer));
+      expect(out.stderrText).toContain("Resetting remote database...");
+      expect(conn.execs.some((s) => s.includes("drop schema if exists"))).toBe(true);
+    });
+  });
+
+  it.live("announces a matching [remotes.*] override", () => {
+    const { layer, out } = setup(tmp.current, {
+      toml: `project_id = "base"\n\n[remotes.preview]\nproject_id = "${LEGACY_VALID_REF}"\n`,
+      confirm: [true],
+      ref: LEGACY_VALID_REF,
+    });
+    return Effect.gen(function* () {
+      yield* legacyDbReset({ ...DEFAULT_FLAGS, linked: true }).pipe(Effect.provide(layer));
+      expect(out.stderrText).toContain("Loading config override: [remotes.preview]");
+    });
+  });
+
+  it.live("skips migrations and seed when both are disabled in config", () => {
+    const { layer, out, conn } = setup(tmp.current, {
+      toml: 'project_id = "test"\n\n[db.migrations]\nenabled = false\n\n[db.seed]\nenabled = false\n',
+      files: {
+        ...migrationFile("20240101000000"),
+        "supabase/seed.sql": "insert into t values (1);",
+      },
+      confirm: [true],
+    });
+    return Effect.gen(function* () {
+      yield* legacyDbReset({ ...DEFAULT_FLAGS, linked: true }).pipe(Effect.provide(layer));
+      // Schemas are still dropped, but nothing is applied or seeded.
+      expect(conn.execs.some((s) => s.includes("drop schema if exists"))).toBe(true);
+      expect(out.stderrText).not.toContain("Applying migration");
+      expect(out.stderrText).not.toContain("Seeding data from");
+    });
+  });
+
+  it.live("emits a json result for a confirmed remote reset (--yes)", () => {
+    const { layer, out } = setup(tmp.current, {
+      toml: 'project_id = "test"\n',
+      files: migrationFile("20240101000000"),
+      format: "json",
+      yes: true,
+    });
+    return Effect.gen(function* () {
+      yield* legacyDbReset({ ...DEFAULT_FLAGS, linked: true }).pipe(Effect.provide(layer));
+      const success = out.messages.find((m) => m.type === "success");
+      expect(success?.data?.["target"]).toBe("remote");
+    });
+  });
+
+  it.live("emits a json result for a confirmed remote reset", () => {
+    const { layer, out } = setup(tmp.current, {
+      toml: 'project_id = "test"\n',
+      files: migrationFile("20240101000000"),
+      format: "json",
+    });
+    return Effect.gen(function* () {
+      // json mode is non-interactive → prompt takes the default (false) → cancel.
+      const exit = yield* legacyDbReset({ ...DEFAULT_FLAGS, linked: true }).pipe(
+        Effect.provide(layer),
+        Effect.exit,
+      );
+      // default-false prompt in non-text mode declines → context canceled.
+      expect(Exit.isFailure(exit)).toBe(true);
+      expect(out).toBeDefined();
+    });
+  });
+
+  it.live("rejects --no-seed together with --sql-paths", () => {
+    const { layer } = setup(tmp.current, { toml: 'project_id = "test"\n' });
+    return Effect.gen(function* () {
+      const exit = yield* legacyDbReset({
+        ...DEFAULT_FLAGS,
+        linked: true,
+        noSeed: true,
+        sqlPaths: ["seed.sql"],
+      }).pipe(Effect.provide(layer), Effect.exit);
+      expect(Exit.isFailure(exit)).toBe(true);
+      if (Exit.isFailure(exit)) {
+        expect(JSON.stringify(exit.cause)).toContain("--no-seed cannot be used with --sql-paths");
+      }
+    });
+  });
+
+  it.live("rejects an empty --sql-paths value", () => {
+    const { layer } = setup(tmp.current, { toml: 'project_id = "test"\n' });
+    return Effect.gen(function* () {
+      const exit = yield* legacyDbReset({
+        ...DEFAULT_FLAGS,
+        linked: true,
         sqlPaths: [""],
-      });
-      expect(calls).toEqual([["db", "reset", "--sql-paths", ""]]);
-    }).pipe(Effect.provide(layer));
-  });
-
-  it("parses repeated --sql-paths flags from the command surface", async () => {
-    const { layer, calls } = setupLegacyDbReset();
-    await Effect.runPromise(
-      Effect.scoped(
-        Effect.gen(function* () {
-          yield* Command.runWith(legacyDbResetCommand, { version: "0.0.0-test" })([
-            "--sql-paths",
-            "./seeds/base.sql",
-            "--sql-paths",
-            "./seeds/demo/*.sql",
-          ]);
-          expect(calls).toEqual([
-            ["db", "reset", "--sql-paths", "./seeds/base.sql", "--sql-paths", "./seeds/demo/*.sql"],
-          ]);
-        }),
-      ).pipe(
-        Effect.provide(
-          Layer.mergeAll(
-            layer,
-            mockOutput({ format: "text" }).layer,
-            CliOutput.layer(textCliOutputFormatter()),
-          ),
-        ),
-      ) as Effect.Effect<void>,
-    );
+      }).pipe(Effect.provide(layer), Effect.exit);
+      expect(Exit.isFailure(exit)).toBe(true);
+      if (Exit.isFailure(exit)) {
+        expect(JSON.stringify(exit.cause)).toContain(
+          "--sql-paths requires a non-empty path or glob pattern",
+        );
+      }
+    });
   });
 
-  it("forwards mutually exclusive seed flags from the command surface", async () => {
-    const { layer, calls } = setupLegacyDbReset();
-    await Effect.runPromise(
-      Effect.scoped(
-        Effect.gen(function* () {
-          yield* Command.runWith(legacyDbResetCommand, { version: "0.0.0-test" })([
-            "--no-seed",
-            "--sql-paths",
-            "./seeds/base.sql",
-          ]);
-          expect(calls).toEqual([["db", "reset", "--no-seed", "--sql-paths", "./seeds/base.sql"]]);
-        }),
-      ).pipe(
-        Effect.provide(
-          Layer.mergeAll(
-            layer,
-            mockOutput({ format: "text" }).layer,
-            CliOutput.layer(textCliOutputFormatter()),
-          ),
-        ),
-      ) as Effect.Effect<void>,
-    );
+  it.live("rejects a negative --last value", () => {
+    const { layer } = setup(tmp.current, { toml: 'project_id = "test"\n' });
+    return Effect.gen(function* () {
+      const exit = yield* legacyDbReset({
+        ...DEFAULT_FLAGS,
+        linked: true,
+        last: Option.some(-1),
+      }).pipe(Effect.provide(layer), Effect.exit);
+      expect(Exit.isFailure(exit)).toBe(true);
+      if (Exit.isFailure(exit)) {
+        const cause = JSON.stringify(exit.cause);
+        expect(cause).toContain("invalid argument");
+        expect(cause).toContain("strconv.ParseUint");
+      }
+    });
+  });
+
+  it.live("seeds an absolute --sql-paths file on a remote reset", () => {
+    const absSeed = join(tmp.current, "external-seed.sql");
+    writeFileSync(absSeed, "insert into t values (3);");
+    const { layer, out } = setup(tmp.current, {
+      toml: 'project_id = "test"\n',
+      files: migrationFile("20240101000000"),
+      confirm: [true],
+    });
+    return Effect.gen(function* () {
+      yield* legacyDbReset({
+        ...DEFAULT_FLAGS,
+        linked: true,
+        sqlPaths: [absSeed],
+      }).pipe(Effect.provide(layer));
+      // Absolute paths are preserved (not prefixed with supabase/) and seeded.
+      expect(out.stderrText).toContain(`Seeding data from ${absSeed}...`);
+    });
+  });
+
+  it.live("warns and seeds from --sql-paths overriding config on a remote reset", () => {
+    const { layer, out } = setup(tmp.current, {
+      // Seed disabled in config — --sql-paths must force-enable it.
+      toml: 'project_id = "test"\n\n[db.seed]\nenabled = false\n',
+      files: {
+        ...migrationFile("20240101000000"),
+        "supabase/custom-seed.sql": "insert into t values (2);",
+      },
+      confirm: [true],
+    });
+    return Effect.gen(function* () {
+      yield* legacyDbReset({
+        ...DEFAULT_FLAGS,
+        linked: true,
+        sqlPaths: ["custom-seed.sql"],
+      }).pipe(Effect.provide(layer));
+      expect(out.stderrText).toContain("--sql-paths overrides [db.seed].sql_paths");
+      expect(out.stderrText).toContain("Seeding data from supabase/custom-seed.sql...");
+    });
+  });
+
+  it.live("forwards --sql-paths to the recreate seam on a local reset", () => {
+    const { layer, seam } = setup(tmp.current, {
+      toml: 'project_id = "test"\n',
+      args: ["db", "reset", "--local"],
+      isLocal: true,
+      running: true,
+    });
+    return Effect.gen(function* () {
+      yield* legacyDbReset({
+        ...DEFAULT_FLAGS,
+        local: true,
+        sqlPaths: ["custom-seed.sql", "demo/*.sql"],
+      }).pipe(Effect.provide(layer));
+      expect(seam.recreateCalls).toEqual([
+        { version: "", noSeed: false, sqlPaths: ["custom-seed.sql", "demo/*.sql"] },
+      ]);
+    });
+  });
+
+  it.live("forwards --sql-paths to the Go binary on an experimental remote reset", () => {
+    const { layer, proxy } = setup(tmp.current, {
+      toml: 'project_id = "test"\n',
+      experimental: true,
+    });
+    return Effect.gen(function* () {
+      yield* legacyDbReset({
+        ...DEFAULT_FLAGS,
+        linked: true,
+        sqlPaths: ["custom-seed.sql"],
+      }).pipe(Effect.provide(layer));
+      expect(proxy.calls[0]!.args).toEqual([
+        "db",
+        "reset",
+        "--linked",
+        "--sql-paths",
+        "custom-seed.sql",
+        "--yes=false",
+      ]);
+    });
   });
 });
diff --git a/apps/cli/src/legacy/commands/db/reset/reset.layers.ts b/apps/cli/src/legacy/commands/db/reset/reset.layers.ts
new file mode 100644
index 0000000000..7cf648f3fe
--- /dev/null
+++ b/apps/cli/src/legacy/commands/db/reset/reset.layers.ts
@@ -0,0 +1,80 @@
+import { Layer } from "effect";
+
+import { commandRuntimeLayer } from "../../../../shared/runtime/command-runtime.layer.ts";
+import { legacyCredentialsLayer } from "../../../auth/legacy-credentials.layer.ts";
+import { legacyHttpClientLayer } from "../../../auth/legacy-http-debug.layer.ts";
+import { legacyPlatformApiFactoryLayer } from "../../../auth/legacy-platform-api-factory.layer.ts";
+import { legacyCliConfigLayer } from "../../../config/legacy-cli-config.layer.ts";
+import { legacyProjectRefLayer } from "../../../config/legacy-project-ref.layer.ts";
+import { legacyDbConfigLayer } from "../../../shared/legacy-db-config.layer.ts";
+import { legacyDbConnectionLayer } from "../../../shared/legacy-db-connection.layer.ts";
+import { legacyDebugLoggerLayer } from "../../../shared/legacy-debug-logger.layer.ts";
+import { stdinLayer } from "../../../../shared/runtime/stdin.layer.ts";
+import { legacyIdentityStitchLayer } from "../../../shared/legacy-identity-stitch.ts";
+import { legacyLinkedProjectCacheLayer } from "../../../telemetry/legacy-linked-project-cache.layer.ts";
+import { legacyTelemetryStateLayer } from "../../../telemetry/legacy-telemetry-state.layer.ts";
+import { legacyDbBootstrapSeamLayer } from "../shared/legacy-db-bootstrap.seam.layer.ts";
+
+/**
+ * Runtime layer for `supabase db reset`. Same composition as `db push` / `db lint`:
+ * the Postgres connection, the db-config resolver, project-ref resolution, and the
+ * linked-project cache, all over the lazy management-API factory so the local /
+ * `--db-url` paths never resolve an access token at layer-build time. `LegacyGoProxy`
+ * (used to delegate the local / experimental reset paths) is ambient from the root.
+ */
+const cliConfig = legacyCliConfigLayer.pipe(Layer.provide(legacyDebugLoggerLayer));
+const httpClient = legacyHttpClientLayer.pipe(Layer.provide(legacyDebugLoggerLayer));
+const credentials = legacyCredentialsLayer.pipe(
+  Layer.provide(cliConfig),
+  Layer.provide(legacyDebugLoggerLayer),
+);
+
+const platformApiFactory = legacyPlatformApiFactoryLayer.pipe(
+  Layer.provide(credentials),
+  Layer.provide(cliConfig),
+  Layer.provide(legacyDebugLoggerLayer),
+  Layer.provide(legacyIdentityStitchLayer),
+);
+
+const projectRef = legacyProjectRefLayer.pipe(
+  Layer.provide(platformApiFactory),
+  Layer.provide(cliConfig),
+);
+
+const linkedProjectCache = legacyLinkedProjectCacheLayer.pipe(
+  Layer.provide(credentials),
+  Layer.provide(cliConfig),
+  Layer.provide(httpClient),
+  Layer.provide(legacyIdentityStitchLayer),
+);
+
+const dbConfig = legacyDbConfigLayer.pipe(
+  Layer.provide(cliConfig),
+  Layer.provide(legacyDbConnectionLayer),
+  Layer.provide(legacyDebugLoggerLayer),
+  Layer.provide(legacyIdentityStitchLayer),
+);
+
+export const legacyDbResetRuntimeLayer = Layer.mergeAll(
+  dbConfig,
+  legacyDbConnectionLayer,
+  cliConfig,
+  httpClient,
+  credentials,
+  projectRef,
+  // Exposed (not just provided to `projectRef`) because the local reset path reuses
+  // the seed-buckets core, whose `legacyResolveStorageCredentials` requires the
+  // (lazy) Management-API factory for the linked branch — never hit on `--local`,
+  // but a static service requirement of the shared core.
+  platformApiFactory,
+  linkedProjectCache,
+  legacyIdentityStitchLayer,
+  legacyTelemetryStateLayer,
+  // `legacyPromptYesNo`'s non-TTY branch reads the piped answer via `Stdin` (Go's
+  // `console.ReadLine`); without it a CI/piped remote `db reset` that reaches the
+  // confirmation prompt fails with a missing-service defect instead of the default.
+  stdinLayer,
+  // Container-recreate / storage-health primitives for the native local reset.
+  legacyDbBootstrapSeamLayer.pipe(Layer.provide(cliConfig)),
+  commandRuntimeLayer(["db", "reset"]),
+);
diff --git a/apps/cli/src/legacy/commands/db/schema/declarative/declarative.errors.ts b/apps/cli/src/legacy/commands/db/schema/declarative/declarative.errors.ts
index a97de5224d..4ff6cb9ab5 100644
--- a/apps/cli/src/legacy/commands/db/schema/declarative/declarative.errors.ts
+++ b/apps/cli/src/legacy/commands/db/schema/declarative/declarative.errors.ts
@@ -29,8 +29,8 @@ export class LegacyDeclarativeNonInteractiveError extends Data.TaggedError(
 /**
  * A mutually-exclusive flag group was violated. Reproduces cobra's
  * `MarkFlagsMutuallyExclusive` `ValidateFlagGroups` error byte-for-byte:
- *  - `generate`: `db-url`/`linked`/`local` (`apps/cli-go/cmd/db_schema_declarative.go:499`)
- *  - `sync`: `apply`/`no-apply` (`apps/cli-go/cmd/db_schema_declarative.go:490`)
+ *  - `generate`: `db-url`/`linked`/`local` (`apps/cli-go/cmd/db_schema_declarative.go:570`)
+ *  - `sync`: `apply`/`no-apply` (`apps/cli-go/cmd/db_schema_declarative.go:561`)
  * Both fail before any side effects run, matching cobra's pre-RunE validation.
  */
 export class LegacyDeclarativeMutuallyExclusiveFlagsError extends Data.TaggedError(
diff --git a/apps/cli/src/legacy/commands/db/schema/declarative/declarative.gate.ts b/apps/cli/src/legacy/commands/db/schema/declarative/declarative.gate.ts
index 506af3485d..bd4777e545 100644
--- a/apps/cli/src/legacy/commands/db/schema/declarative/declarative.gate.ts
+++ b/apps/cli/src/legacy/commands/db/schema/declarative/declarative.gate.ts
@@ -28,11 +28,17 @@ export function legacyPgDeltaSuggestion(configPath: string): string {
 }
 
 /**
- * The Effect-CLI replacement for Go's `PersistentPreRunE` gate: invoke at the
- * top of each declarative leaf handler. Fails with
- * `LegacyDeclarativeNotEnabledError` (carrying the byte-exact message +
- * suggestion) when neither `--experimental` nor `[experimental.pgdelta]` enables
- * pg-delta.
+ * The Effect-CLI replacement for Go's `dbDeclarativeCmd.PersistentPreRunE` gate
+ * (`apps/cli-go/cmd/db_schema_declarative.go:49-99`). Cobra runs
+ * `PersistentPreRunE` BEFORE `ValidateFlagGroups()` (mutual-exclusivity checks)
+ * and `RunE` (`cobra@v1.10.2/command.go:985,1010,1014`), so this gate must run
+ * before the `MarkFlagsMutuallyExclusive` check in the same command — `db-url`/
+ * `linked`/`local` on `generate` (`:570`), `apply`/`no-apply` on `sync` (`:561`)
+ * — a closed gate must win over a flag-group conflict, not the other way
+ * around. Invoke at the top of each declarative leaf handler's body, before
+ * that handler's mutex check. Fails with `LegacyDeclarativeNotEnabledError`
+ * (carrying the byte-exact message + suggestion) when neither `--experimental`
+ * nor `[experimental.pgdelta]` enables pg-delta.
  */
 export const legacyRequirePgDelta = Effect.fnUntraced(function* (opts: {
   readonly experimental: boolean;
diff --git a/apps/cli/src/legacy/commands/db/schema/declarative/declarative.orchestrate.integration.test.ts b/apps/cli/src/legacy/commands/db/schema/declarative/declarative.orchestrate.integration.test.ts
index ad474a9a77..2b581df3b0 100644
--- a/apps/cli/src/legacy/commands/db/schema/declarative/declarative.orchestrate.integration.test.ts
+++ b/apps/cli/src/legacy/commands/db/schema/declarative/declarative.orchestrate.integration.test.ts
@@ -41,7 +41,20 @@ function mockEdge(stdout: string) {
   const layer = Layer.succeed(LegacyEdgeRuntimeScript, {
     run: (opts: LegacyEdgeRuntimeRunOpts) => {
       calls.push(opts);
-      return Effect.succeed({ stdout, stderr: "" });
+      // The pg-delta diff script (uniquely identified by `renderPlanFiles`) prints a
+      // JSON envelope with one file per plan unit; wrap the test's raw SQL into a
+      // single-unit envelope so `legacyDiffPgDelta` parses it. Other scripts
+      // (declarative export) return their stdout unchanged.
+      const wrapped =
+        opts.script.includes("renderPlanFiles") && stdout.length > 0
+          ? JSON.stringify({
+              version: 1,
+              files: [
+                { order: 1, name: "schema_changes", transactionMode: "transactional", sql: stdout },
+              ],
+            })
+          : stdout;
+      return Effect.succeed({ stdout: wrapped, stderr: "" });
     },
   });
   return { layer, calls };
diff --git a/apps/cli/src/legacy/commands/db/schema/declarative/declarative.smart-target.ts b/apps/cli/src/legacy/commands/db/schema/declarative/declarative.smart-target.ts
index 7e6cbab323..77fb087c26 100644
--- a/apps/cli/src/legacy/commands/db/schema/declarative/declarative.smart-target.ts
+++ b/apps/cli/src/legacy/commands/db/schema/declarative/declarative.smart-target.ts
@@ -169,9 +169,10 @@ export const legacyResolveSmartTargetUrl = Effect.fnUntraced(function* (
   }
   if (shouldReset) {
     // Go runs reset in-process and returns the error (`cmd/db_schema_declarative.go:262-267`).
-    // Use the non-exiting seam (not LegacyGoProxy.exec, which process.exits on a
-    // non-zero child and would skip the handler's telemetry flush / error handling),
-    // and propagate a failure on a non-zero reset exit.
+    // `execInherit` (not `LegacyGoProxy.exec`) returns the child's exit code as a
+    // catchable value rather than exiting the host process — the same
+    // typed-failure design CLI-1879 gave `LegacyGoProxy.exec` itself, predating
+    // it here as its own seam. Propagate a failure on a non-zero reset exit.
     const seam = yield* LegacyDeclarativeSeam;
     // Forward --network-id: Go's in-process reset.Run honors the root viper
     // network-id (`apps/cli-go/internal/utils/docker.go:267-271`), so the
diff --git a/apps/cli/src/legacy/commands/db/schema/declarative/generate/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/db/schema/declarative/generate/SIDE_EFFECTS.md
index 5df90ac1a9..bd009a4af3 100644
--- a/apps/cli/src/legacy/commands/db/schema/declarative/generate/SIDE_EFFECTS.md
+++ b/apps/cli/src/legacy/commands/db/schema/declarative/generate/SIDE_EFFECTS.md
@@ -47,16 +47,28 @@ pg-delta catalog (source) against the target database's catalog (target).
 | Code | Condition                                                             |
 | ---- | --------------------------------------------------------------------- |
 | `0`  | success (files written, or skipped after a declined prompt)           |
-| `1`  | conflicting `--db-url`/`--linked`/`--local` (mutually exclusive)      |
 | `1`  | pg-delta not enabled (no `--experimental` / `[experimental.pgdelta]`) |
+| `1`  | conflicting `--db-url`/`--linked`/`--local` (mutually exclusive)      |
 | `1`  | non-interactive mode with no explicit target                          |
 | `1`  | shadow-database / edge-runtime / export failure                       |
 
+The pg-delta gate and the mutex check are both raised before any side effects run,
+but the gate wins when both conditions apply simultaneously: Go's
+`PersistentPreRunE` runs before `ValidateFlagGroups()`
+(`cobra@v1.10.2/command.go:985,1010`), so a closed gate (missing `--experimental`)
+surfaces before a `--db-url`/`--linked`/`--local` conflict is ever checked.
+
 ## Output
 
-Text mode only (no machine envelope). Diagnostics + the final
-`Declarative schema written to <dir>` go to stderr; the PostRun prints
-`Finished supabase db schema declarative generate.` to stdout on success.
+Diagnostics (target resolution, prompts, `Declarative schema written to <dir>`)
+always go to stderr, in every `--output-format`. On success:
+
+- `text` mode prints `Finished supabase db schema declarative generate.` to
+  stdout (matches Go's PostRun `fmt.Println`, `cmd/db_schema_declarative.go:116-118`).
+- `json`/`stream-json` mode instead emits a structured success envelope
+  (`output.success("Finished supabase db schema declarative generate.")`) so
+  the machine stdout payload isn't corrupted by a bare human line
+  (`generate.command.ts:74-90`, CLI-1546 invariant).
 
 ## Notes
 
diff --git a/apps/cli/src/legacy/commands/db/schema/declarative/generate/generate.handler.ts b/apps/cli/src/legacy/commands/db/schema/declarative/generate/generate.handler.ts
index fbcb89a721..3cec545df7 100644
--- a/apps/cli/src/legacy/commands/db/schema/declarative/generate/generate.handler.ts
+++ b/apps/cli/src/legacy/commands/db/schema/declarative/generate/generate.handler.ts
@@ -1,8 +1,8 @@
 import { Effect, FileSystem, Option, Path } from "effect";
 
 import {
-  LegacyExperimentalFlag,
   LegacyYesFlag,
+  legacyResolveExperimentalWithProjectEnv,
 } from "../../../../../../shared/legacy/global-flags.ts";
 import { Output } from "../../../../../../shared/output/output.service.ts";
 import { Tty } from "../../../../../../shared/runtime/tty.service.ts";
@@ -10,6 +10,7 @@ import { LegacyCliConfig } from "../../../../../config/legacy-cli-config.service
 import { legacyBold } from "../../../../../shared/legacy-colors.ts";
 import { legacyReadProjectRefFile } from "../../../../../shared/legacy-temp-paths.ts";
 import {
+  legacyLoadProjectEnv,
   legacyReadDbToml,
   legacyResolveDeclarativeDir,
 } from "../../../../../shared/legacy-db-config.toml-read.ts";
@@ -44,7 +45,14 @@ export const legacyDbSchemaDeclarativeGenerate = Effect.fn("legacy.db.schema.dec
     const cliConfig = yield* LegacyCliConfig;
     const telemetryState = yield* LegacyTelemetryState;
     const linkedProjectCache = yield* LegacyLinkedProjectCache;
-    const experimental = yield* LegacyExperimentalFlag;
+    // Go's `dbDeclarativeCmd.PersistentPreRunE` calls `flags.LoadConfig` — which runs
+    // `loadNestedEnv` and `os.Setenv`s each project-.env key — BEFORE reading
+    // `viper.GetBool("EXPERIMENTAL")` for the gate below (`apps/cli-go/cmd/
+    // db_schema_declarative.go:73-78`, `pkg/config/config.go:789`). Load the project env
+    // first and resolve against it, as `db reset` does for its own experimental gate, so a
+    // `SUPABASE_EXPERIMENTAL` set only in `supabase/.env` opens the gate too.
+    const projectEnv = yield* legacyLoadProjectEnv(fs, path, cliConfig.workdir);
+    const experimental = yield* legacyResolveExperimentalWithProjectEnv(projectEnv);
     const yes = yield* LegacyYesFlag;
 
     // The resolved linked ref (explicit `--linked` only), hoisted so the post-run
@@ -52,9 +60,23 @@ export const legacyDbSchemaDeclarativeGenerate = Effect.fn("legacy.db.schema.dec
     let linkedProjectRef: string | undefined;
 
     yield* Effect.gen(function* () {
+      const baseToml = yield* legacyReadDbToml(fs, path, cliConfig.workdir);
+      // Gate before the mutex check below — order matters; see
+      // legacyRequirePgDelta's doc comment for why. The pg-delta gate also runs on
+      // the BASE config: Go's declarative `PersistentPreRunE` gates before the root
+      // `ParseDatabaseConfig` reloads any `[remotes.<ref>]` block, so a remote
+      // `experimental.pgdelta.enabled = true` must NOT enable a base-disabled
+      // command without `--experimental`.
+      yield* legacyRequirePgDelta({
+        experimental,
+        pgDeltaEnabled: baseToml.pgDelta.enabled,
+        configPath: path.join("supabase", "config.toml"),
+      });
+
       // cobra `MarkFlagsMutuallyExclusive("db-url", "linked", "local")`
-      // (`apps/cli-go/cmd/db_schema_declarative.go:499`) runs before PreRunE/RunE,
-      // so reject conflicting targets before reading config or the pg-delta gate.
+      // (`apps/cli-go/cmd/db_schema_declarative.go:570`) runs via
+      // `ValidateFlagGroups()`, which cobra invokes AFTER `PersistentPreRunE` (the
+      // gate above) — see legacyRequirePgDelta's doc comment for the full ordering.
       // "Set" follows cobra's `Changed`: Option set when `Some`, boolean when `true`.
       const exclusive: Array<string> = [];
       if (Option.isSome(flags.dbUrl)) exclusive.push("db-url");
@@ -68,17 +90,6 @@ export const legacyDbSchemaDeclarativeGenerate = Effect.fn("legacy.db.schema.dec
         );
       }
 
-      const baseToml = yield* legacyReadDbToml(fs, path, cliConfig.workdir);
-      // The pg-delta gate runs on the BASE config: Go's declarative `PersistentPreRunE`
-      // gates before the root `ParseDatabaseConfig` reloads any `[remotes.<ref>]` block,
-      // so a remote `experimental.pgdelta.enabled = true` must NOT enable a
-      // base-disabled command without `--experimental`.
-      yield* legacyRequirePgDelta({
-        experimental,
-        pgDeltaEnabled: baseToml.pgDelta.enabled,
-        configPath: path.join("supabase", "config.toml"),
-      });
-
       // Explicit `--linked`: Go re-loads config with the resolved ref (root
       // `ParseDatabaseConfig` linked branch), so a matching `[remotes.<ref>]` block
       // overrides `experimental.pgdelta.*` (declarative_schema_path / format_options)
diff --git a/apps/cli/src/legacy/commands/db/schema/declarative/generate/generate.integration.test.ts b/apps/cli/src/legacy/commands/db/schema/declarative/generate/generate.integration.test.ts
index 8241336bd5..48ade9b8a6 100644
--- a/apps/cli/src/legacy/commands/db/schema/declarative/generate/generate.integration.test.ts
+++ b/apps/cli/src/legacy/commands/db/schema/declarative/generate/generate.integration.test.ts
@@ -12,6 +12,7 @@ import {
   mockLegacyTelemetryStateTracked,
   useLegacyTempWorkdir,
 } from "../../../../../../../tests/helpers/legacy-mocks.ts";
+import { CliArgs } from "../../../../../../shared/cli/cli-args.service.ts";
 import {
   LegacyDnsResolverFlag,
   LegacyExperimentalFlag,
@@ -48,6 +49,7 @@ const EXPORT_JSON = JSON.stringify({
 
 interface SetupOpts {
   experimental?: boolean;
+  args?: ReadonlyArray<string>;
   yes?: boolean;
   stdinIsTty?: boolean;
   promptConfirmResponses?: ReadonlyArray<boolean>;
@@ -147,6 +149,7 @@ function setup(workdir: string, opts: SetupOpts = {}) {
     mockLegacyCliConfig({ workdir, projectId: opts.projectId ?? Option.some("test") }),
     mockTty({ stdinIsTty: opts.stdinIsTty ?? false, stdoutIsTty: false }),
     Layer.succeed(LegacyExperimentalFlag, opts.experimental ?? true),
+    Layer.succeed(CliArgs, { args: opts.args ?? ["db", "schema", "declarative", "generate"] }),
     Layer.succeed(LegacyYesFlag, opts.yes ?? false),
     Layer.succeed(LegacyNetworkIdFlag, opts.networkId ?? Option.none()),
     Layer.succeed(LegacyDnsResolverFlag, "native"),
@@ -204,10 +207,11 @@ describe("legacy db schema declarative generate integration", () => {
     }).pipe(Effect.provide(layer));
   });
 
-  it.effect("rejects conflicting targets (--local --linked) before the pg-delta gate", () => {
-    // cobra MarkFlagsMutuallyExclusive("db-url", "linked", "local") runs before
-    // PreRunE, so this fails even when pg-delta is not enabled.
-    const { layer } = setup(tmp.current, { experimental: false });
+  it.effect("--local --linked with --experimental fails with the mutex error", () => {
+    // Go's declarative PersistentPreRunE gate (db_schema_declarative.go:49-99) runs
+    // BEFORE cobra's ValidateFlagGroups() mutex check (cobra@v1.10.2/command.go:985,
+    // 1010), so the mutex error only surfaces once the gate is open.
+    const { layer } = setup(tmp.current, { experimental: true });
     return Effect.gen(function* () {
       const exit = yield* Effect.exit(
         legacyDbSchemaDeclarativeGenerate(
@@ -223,6 +227,118 @@ describe("legacy db schema declarative generate integration", () => {
     }).pipe(Effect.provide(layer));
   });
 
+  it.effect(
+    "--local --linked without --experimental fails with the gate error, not the mutex error",
+    () => {
+      // Mirrors storage's experimental-gate-vs-mutex ordering fix (CLI-1855 / CLI-1876):
+      // the pg-delta gate runs before the mutex check, so an unopened gate wins even
+      // when the flags would also violate mutual exclusivity.
+      const { layer } = setup(tmp.current, { experimental: false });
+      return Effect.gen(function* () {
+        const exit = yield* Effect.exit(
+          legacyDbSchemaDeclarativeGenerate(
+            flags({ local: Option.some(true), linked: Option.some(true) }),
+          ),
+        );
+        expect(Exit.isFailure(exit)).toBe(true);
+        expect(failError(exit)?.constructor.name).toBe("LegacyDeclarativeNotEnabledError");
+      }).pipe(Effect.provide(layer));
+    },
+  );
+
+  it.effect(
+    "--local --linked with SUPABASE_EXPERIMENTAL env (no --experimental flag) fails with the mutex error",
+    () => {
+      // Go's gate reads viper.GetBool("EXPERIMENTAL") (db_schema_declarative.go:78),
+      // which picks up SUPABASE_EXPERIMENTAL via viper.AutomaticEnv (root.go:318-334),
+      // so an env-only experimental session still opens the gate and lets the mutex
+      // check fire. legacyResolveExperimental (not the raw LegacyExperimentalFlag) is
+      // what makes the TS gate honor the env var the same way.
+      const { layer } = setup(tmp.current, { experimental: false });
+      const ENV = "SUPABASE_EXPERIMENTAL";
+      return Effect.gen(function* () {
+        const saved = process.env[ENV];
+        process.env[ENV] = "1";
+        const exit = yield* Effect.exit(
+          legacyDbSchemaDeclarativeGenerate(
+            flags({ local: Option.some(true), linked: Option.some(true) }),
+          ),
+        );
+        if (saved === undefined) delete process.env[ENV];
+        else process.env[ENV] = saved;
+        expect(Exit.isFailure(exit)).toBe(true);
+        expect(failError(exit)).toMatchObject({
+          _tag: "LegacyDeclarativeMutuallyExclusiveFlagsError",
+          message:
+            "if any flags in the group [db-url linked local] are set none of the others can be; [linked local] were all set",
+        });
+      }).pipe(Effect.provide(layer));
+    },
+  );
+
+  it.effect(
+    "an explicit --experimental=false closes the gate even when SUPABASE_EXPERIMENTAL is set",
+    () => {
+      // viper's bound-pflag lookup returns the flag value whenever Changed is true —
+      // BEFORE falling back to AutomaticEnv (viper@v1.21.0/viper.go:1176-1178) — so an
+      // explicit --experimental=false must win over SUPABASE_EXPERIMENTAL=1, closing the
+      // gate instead of letting the env value override it.
+      const { layer } = setup(tmp.current, {
+        experimental: false,
+        args: ["db", "schema", "declarative", "generate", "--experimental=false"],
+      });
+      const ENV = "SUPABASE_EXPERIMENTAL";
+      return Effect.gen(function* () {
+        const saved = process.env[ENV];
+        process.env[ENV] = "1";
+        const exit = yield* Effect.exit(
+          legacyDbSchemaDeclarativeGenerate(flags({ local: Option.some(true) })),
+        );
+        if (saved === undefined) delete process.env[ENV];
+        else process.env[ENV] = saved;
+        expect(Exit.isFailure(exit)).toBe(true);
+        expect(failError(exit)?.constructor.name).toBe("LegacyDeclarativeNotEnabledError");
+      }).pipe(Effect.provide(layer));
+    },
+  );
+
+  it.effect(
+    "--local --linked with SUPABASE_EXPERIMENTAL set only in the project .env fails with the mutex error",
+    () => {
+      // Go's flags.LoadConfig runs loadNestedEnv (which os.Setenv's each project-.env key)
+      // before dbDeclarativeCmd.PersistentPreRunE reads viper.GetBool("EXPERIMENTAL")
+      // (apps/cli-go/cmd/db_schema_declarative.go:73-78, pkg/config/config.go:789), so a
+      // SUPABASE_EXPERIMENTAL set only in supabase/.env opens the gate and lets the mutex
+      // check fire, same as the shell-env case above.
+      const saved = process.env["SUPABASE_EXPERIMENTAL"];
+      delete process.env["SUPABASE_EXPERIMENTAL"];
+      mkdirSync(join(tmp.current, "supabase"), { recursive: true });
+      writeFileSync(join(tmp.current, "supabase", ".env"), "SUPABASE_EXPERIMENTAL=true\n");
+      const { layer } = setup(tmp.current, { experimental: false });
+      return Effect.gen(function* () {
+        const exit = yield* Effect.exit(
+          legacyDbSchemaDeclarativeGenerate(
+            flags({ local: Option.some(true), linked: Option.some(true) }),
+          ),
+        );
+        expect(Exit.isFailure(exit)).toBe(true);
+        expect(failError(exit)).toMatchObject({
+          _tag: "LegacyDeclarativeMutuallyExclusiveFlagsError",
+          message:
+            "if any flags in the group [db-url linked local] are set none of the others can be; [linked local] were all set",
+        });
+      }).pipe(
+        Effect.provide(layer),
+        Effect.ensuring(
+          Effect.sync(() => {
+            if (saved === undefined) delete process.env["SUPABASE_EXPERIMENTAL"];
+            else process.env["SUPABASE_EXPERIMENTAL"] = saved;
+          }),
+        ),
+      );
+    },
+  );
+
   it.effect("explicit --local: provisions baseline, exports, writes declarative files", () => {
     const s = setup(tmp.current, { experimental: true });
     return Effect.gen(function* () {
diff --git a/apps/cli/src/legacy/commands/db/schema/declarative/sync/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/db/schema/declarative/sync/SIDE_EFFECTS.md
index 53d1a64fad..e2182911be 100644
--- a/apps/cli/src/legacy/commands/db/schema/declarative/sync/SIDE_EFFECTS.md
+++ b/apps/cli/src/legacy/commands/db/schema/declarative/sync/SIDE_EFFECTS.md
@@ -23,12 +23,12 @@ as a new timestamped migration.
 
 ## Subprocesses / Containers
 
-| What                                                                                                                                                     | When                                                         |
-| -------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------ |
-| `supabase-go db schema declarative __catalog --mode migrations --experimental` (seam) — shadow Postgres + `SetupDatabase` + apply migrations → catalog   | always                                                       |
-| `supabase-go db schema declarative __catalog --mode declarative --experimental` (seam) — shadow Postgres + `SetupDatabase` + apply declarative → catalog | always                                                       |
-| Edge-runtime container running the pg-delta diff Deno script                                                                                             | always                                                       |
-| `supabase-go migration up --local`                                                                                                                       | when the migration is applied (`--apply` / prompt / `--yes`) |
+| What                                                                                                                                                                                                 | When                                                              |
+| ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------- |
+| `supabase-go db schema declarative __catalog --mode migrations --experimental` (seam) — shadow Postgres + `SetupDatabase` + apply migrations → catalog                                               | always                                                            |
+| `supabase-go db schema declarative __catalog --mode declarative --experimental` (seam) — shadow Postgres + `SetupDatabase` + apply declarative → catalog                                             | always                                                            |
+| Edge-runtime container running the pg-delta diff Deno script                                                                                                                                         | always                                                            |
+| `supabase-go db reset --local [--network-id <id>]` (seam) — only on the failed-apply recovery path; `db reset` is still Go-proxied (`wrapped`), so the reset itself shells out to the bundled binary | TTY only, apply failed, and the user confirms "reset and reapply" |
 
 ## Environment Variables
 
@@ -42,14 +42,20 @@ as a new timestamped migration.
 
 ## Exit Codes
 
-| Code | Condition                                                          |
-| ---- | ------------------------------------------------------------------ |
-| `0`  | success (migration created, applied, or "No schema changes found") |
-| `1`  | conflicting `--apply`/`--no-apply` (mutually exclusive)            |
-| `1`  | pg-delta not enabled                                               |
-| `1`  | no declarative schema files found                                  |
-| `1`  | shadow-database / edge-runtime / diff failure                      |
-| `1`  | apply failure (when applied) — propagated from `migration up`      |
+| Code | Condition                                                                                           |
+| ---- | --------------------------------------------------------------------------------------------------- |
+| `0`  | success (migration created, applied, or "No schema changes found")                                  |
+| `1`  | pg-delta not enabled                                                                                |
+| `1`  | conflicting `--apply`/`--no-apply` (mutually exclusive)                                             |
+| `1`  | no declarative schema files found                                                                   |
+| `1`  | shadow-database / edge-runtime / diff failure                                                       |
+| `1`  | apply failure (when applied) — propagated from the native migration apply (`applyMigrationToLocal`) |
+
+The pg-delta gate and the mutex check are both raised before any side effects run,
+but the gate wins when both conditions apply simultaneously: Go's
+`PersistentPreRunE` runs before `ValidateFlagGroups()`
+(`cobra@v1.10.2/command.go:985,1010`), so a closed gate (missing `--experimental`)
+surfaces before an `--apply`/`--no-apply` conflict is ever checked.
 
 ## Output
 
diff --git a/apps/cli/src/legacy/commands/db/schema/declarative/sync/sync.command.ts b/apps/cli/src/legacy/commands/db/schema/declarative/sync/sync.command.ts
index e06c092a1f..db9da924de 100644
--- a/apps/cli/src/legacy/commands/db/schema/declarative/sync/sync.command.ts
+++ b/apps/cli/src/legacy/commands/db/schema/declarative/sync/sync.command.ts
@@ -33,7 +33,7 @@ const config = {
     Flag.optional,
   ),
   // cobra's `MarkFlagsMutuallyExclusive("apply", "no-apply")` keys off `flag.Changed`,
-  // not the value (`cmd/db_schema_declarative.go:490`), so model presence with `Option`
+  // not the value (`cmd/db_schema_declarative.go:561`), so model presence with `Option`
   // so `--apply=false --no-apply` still trips the conflict. The apply decision below
   // reads the resolved value via `Option.getOrElse`.
   apply: Flag.boolean("apply").pipe(
diff --git a/apps/cli/src/legacy/commands/db/schema/declarative/sync/sync.handler.ts b/apps/cli/src/legacy/commands/db/schema/declarative/sync/sync.handler.ts
index 61f276e4c0..63f8d8a7e4 100644
--- a/apps/cli/src/legacy/commands/db/schema/declarative/sync/sync.handler.ts
+++ b/apps/cli/src/legacy/commands/db/schema/declarative/sync/sync.handler.ts
@@ -2,9 +2,9 @@ import { Cause, Clock, Effect, Exit, FileSystem, Option, Path } from "effect";
 
 import {
   LegacyDnsResolverFlag,
-  LegacyExperimentalFlag,
   LegacyNetworkIdFlag,
   LegacyYesFlag,
+  legacyResolveExperimentalWithProjectEnv,
 } from "../../../../../../shared/legacy/global-flags.ts";
 import { Output } from "../../../../../../shared/output/output.service.ts";
 import { Tty } from "../../../../../../shared/runtime/tty.service.ts";
@@ -13,6 +13,7 @@ import { legacyBold, legacyRed, legacyYellow } from "../../../../../shared/legac
 import { LegacyDbConnection } from "../../../../../shared/legacy-db-connection.service.ts";
 import { legacyGetHostname } from "../../../../../shared/legacy-hostname.ts";
 import {
+  legacyLoadProjectEnv,
   legacyReadDbToml,
   legacyResolveDeclarativeDir,
 } from "../../../../../shared/legacy-db-config.toml-read.ts";
@@ -72,7 +73,14 @@ export const legacyDbSchemaDeclarativeSync = Effect.fn("legacy.db.schema.declara
     const path = yield* Path.Path;
     const cliConfig = yield* LegacyCliConfig;
     const telemetryState = yield* LegacyTelemetryState;
-    const experimental = yield* LegacyExperimentalFlag;
+    // Go's `dbDeclarativeCmd.PersistentPreRunE` calls `flags.LoadConfig` — which runs
+    // `loadNestedEnv` and `os.Setenv`s each project-.env key — BEFORE reading
+    // `viper.GetBool("EXPERIMENTAL")` for the gate below (`apps/cli-go/cmd/
+    // db_schema_declarative.go:73-78`, `pkg/config/config.go:789`). Load the project env
+    // first and resolve against it, as `db reset` does for its own experimental gate, so a
+    // `SUPABASE_EXPERIMENTAL` set only in `supabase/.env` opens the gate too.
+    const projectEnv = yield* legacyLoadProjectEnv(fs, path, cliConfig.workdir);
+    const experimental = yield* legacyResolveExperimentalWithProjectEnv(projectEnv);
     const yes = yield* LegacyYesFlag;
     const networkId = yield* LegacyNetworkIdFlag;
     const dnsResolver = yield* LegacyDnsResolverFlag;
@@ -89,10 +97,21 @@ export const legacyDbSchemaDeclarativeSync = Effect.fn("legacy.db.schema.declara
     let linkedProjectRef: string | undefined;
 
     yield* Effect.gen(function* () {
+      const toml = yield* legacyReadDbToml(fs, path, cliConfig.workdir);
+      // Gate before the mutex check below — order matters; see
+      // legacyRequirePgDelta's doc comment for why.
+      yield* legacyRequirePgDelta({
+        experimental,
+        pgDeltaEnabled: toml.pgDelta.enabled,
+        configPath: path.join("supabase", "config.toml"),
+      });
+
       // cobra `MarkFlagsMutuallyExclusive("apply", "no-apply")`
-      // (`apps/cli-go/cmd/db_schema_declarative.go:490`) runs before PreRunE/RunE,
-      // so reject the conflict before reading config or the pg-delta gate, rather
-      // than letting `--no-apply` silently win in the apply-decision helper.
+      // (`apps/cli-go/cmd/db_schema_declarative.go:561`) runs via
+      // `ValidateFlagGroups()`, which cobra invokes AFTER `PersistentPreRunE` (the
+      // gate above) — see legacyRequirePgDelta's doc comment for the full ordering.
+      // Reject the conflict here rather than letting `--no-apply` silently win in
+      // the apply-decision helper.
       const exclusive: Array<string> = [];
       if (Option.isSome(flags.apply)) exclusive.push("apply");
       if (Option.isSome(flags.noApply)) exclusive.push("no-apply");
@@ -104,12 +123,6 @@ export const legacyDbSchemaDeclarativeSync = Effect.fn("legacy.db.schema.declara
         );
       }
 
-      const toml = yield* legacyReadDbToml(fs, path, cliConfig.workdir);
-      yield* legacyRequirePgDelta({
-        experimental,
-        pgDeltaEnabled: toml.pgDelta.enabled,
-        configPath: path.join("supabase", "config.toml"),
-      });
       // `path.resolve` (not `path.join`) so an absolute `declarative_schema_path` is
       // used as-is, matching Go's `config.resolve` (which only prefixes the workdir onto
       // a relative path). `path.join(workdir, abs)` would mangle the absolute path.
diff --git a/apps/cli/src/legacy/commands/db/schema/declarative/sync/sync.integration.test.ts b/apps/cli/src/legacy/commands/db/schema/declarative/sync/sync.integration.test.ts
index d1e83e7290..fa04d716dd 100644
--- a/apps/cli/src/legacy/commands/db/schema/declarative/sync/sync.integration.test.ts
+++ b/apps/cli/src/legacy/commands/db/schema/declarative/sync/sync.integration.test.ts
@@ -11,6 +11,7 @@ import {
   mockLegacyTelemetryStateTracked,
   useLegacyTempWorkdir,
 } from "../../../../../../../tests/helpers/legacy-mocks.ts";
+import { CliArgs } from "../../../../../../shared/cli/cli-args.service.ts";
 import {
   LegacyDnsResolverFlag,
   LegacyExperimentalFlag,
@@ -44,6 +45,7 @@ const EXPORT_JSON = JSON.stringify({
 
 interface SetupOpts {
   experimental?: boolean;
+  args?: ReadonlyArray<string>;
   yes?: boolean;
   stdinIsTty?: boolean;
   diffSql?: string;
@@ -94,15 +96,33 @@ function setup(workdir: string, opts: SetupOpts = {}) {
     removeShadowContainer: () => Effect.void,
   });
   const edge = Layer.succeed(LegacyEdgeRuntimeScript, {
-    run: (runOpts: LegacyEdgeRuntimeRunOpts) =>
-      Effect.succeed({
-        stdout:
-          opts.exportJson !== undefined &&
-          runOpts.errPrefix === "error exporting declarative schema"
-            ? opts.exportJson
-            : (opts.diffSql ?? ""),
-        stderr: "",
-      }),
+    run: (runOpts: LegacyEdgeRuntimeRunOpts) => {
+      if (
+        opts.exportJson !== undefined &&
+        runOpts.errPrefix === "error exporting declarative schema"
+      ) {
+        return Effect.succeed({ stdout: opts.exportJson, stderr: "" });
+      }
+      const diffSql = opts.diffSql ?? "";
+      // The pg-delta diff script (uniquely identified by `renderPlanFiles`) prints a
+      // JSON envelope with one file per plan unit; wrap the test's raw SQL into a
+      // single-unit envelope so `legacyDiffPgDelta` parses it.
+      const stdout =
+        runOpts.script.includes("renderPlanFiles") && diffSql.length > 0
+          ? JSON.stringify({
+              version: 1,
+              files: [
+                {
+                  order: 1,
+                  name: "schema_changes",
+                  transactionMode: "transactional",
+                  sql: diffSql,
+                },
+              ],
+            })
+          : diffSql;
+      return Effect.succeed({ stdout, stderr: "" });
+    },
   });
   const dbExec: string[] = [];
   const dbConn = Layer.succeed(LegacyDbConnection, {
@@ -151,6 +171,7 @@ function setup(workdir: string, opts: SetupOpts = {}) {
     mockLegacyCliConfig({ workdir, projectId: opts.projectId ?? Option.some("test") }),
     mockTty({ stdinIsTty: opts.stdinIsTty ?? false, stdoutIsTty: false }),
     Layer.succeed(LegacyExperimentalFlag, opts.experimental ?? true),
+    Layer.succeed(CliArgs, { args: opts.args ?? ["db", "schema", "declarative", "sync"] }),
     Layer.succeed(LegacyYesFlag, opts.yes ?? false),
     Layer.succeed(
       LegacyNetworkIdFlag,
@@ -199,10 +220,11 @@ describe("legacy db schema declarative sync integration", () => {
     }).pipe(Effect.provide(layer));
   });
 
-  it.effect("rejects --apply and --no-apply together before the pg-delta gate", () => {
-    // cobra MarkFlagsMutuallyExclusive("apply", "no-apply") runs before PreRunE,
-    // so this fails even when pg-delta is not enabled.
-    const { layer } = setup(tmp.current, { experimental: false });
+  it.effect("--apply and --no-apply together with --experimental fail with the mutex error", () => {
+    // Go's declarative PersistentPreRunE gate (db_schema_declarative.go:49-99) runs
+    // BEFORE cobra's ValidateFlagGroups() mutex check (cobra@v1.10.2/command.go:985,
+    // 1010), so the mutex error only surfaces once the gate is open.
+    const { layer } = setup(tmp.current, { experimental: true });
     return Effect.gen(function* () {
       const exit = yield* Effect.exit(
         legacyDbSchemaDeclarativeSync(
@@ -218,10 +240,122 @@ describe("legacy db schema declarative sync integration", () => {
     }).pipe(Effect.provide(layer));
   });
 
+  it.effect(
+    "--apply and --no-apply together without --experimental fail with the gate error, not the mutex error",
+    () => {
+      // Mirrors storage's experimental-gate-vs-mutex ordering fix (CLI-1855 / CLI-1876):
+      // the pg-delta gate runs before the mutex check, so an unopened gate wins even
+      // when the flags would also violate mutual exclusivity.
+      const { layer } = setup(tmp.current, { experimental: false });
+      return Effect.gen(function* () {
+        const exit = yield* Effect.exit(
+          legacyDbSchemaDeclarativeSync(
+            flags({ apply: Option.some(true), noApply: Option.some(true) }),
+          ),
+        );
+        expect(Exit.isFailure(exit)).toBe(true);
+        expect(failError(exit)?.constructor.name).toBe("LegacyDeclarativeNotEnabledError");
+      }).pipe(Effect.provide(layer));
+    },
+  );
+
+  it.effect(
+    "--apply and --no-apply together with SUPABASE_EXPERIMENTAL env (no --experimental flag) fail with the mutex error",
+    () => {
+      // Go's gate reads viper.GetBool("EXPERIMENTAL") (db_schema_declarative.go:78),
+      // which picks up SUPABASE_EXPERIMENTAL via viper.AutomaticEnv (root.go:318-334),
+      // so an env-only experimental session still opens the gate and lets the mutex
+      // check fire. legacyResolveExperimental (not the raw LegacyExperimentalFlag) is
+      // what makes the TS gate honor the env var the same way.
+      const { layer } = setup(tmp.current, { experimental: false });
+      const ENV = "SUPABASE_EXPERIMENTAL";
+      return Effect.gen(function* () {
+        const saved = process.env[ENV];
+        process.env[ENV] = "1";
+        const exit = yield* Effect.exit(
+          legacyDbSchemaDeclarativeSync(
+            flags({ apply: Option.some(true), noApply: Option.some(true) }),
+          ),
+        );
+        if (saved === undefined) delete process.env[ENV];
+        else process.env[ENV] = saved;
+        expect(Exit.isFailure(exit)).toBe(true);
+        expect(failError(exit)).toMatchObject({
+          _tag: "LegacyDeclarativeMutuallyExclusiveFlagsError",
+          message:
+            "if any flags in the group [apply no-apply] are set none of the others can be; [apply no-apply] were all set",
+        });
+      }).pipe(Effect.provide(layer));
+    },
+  );
+
+  it.effect(
+    "an explicit --experimental=false closes the gate even when SUPABASE_EXPERIMENTAL is set",
+    () => {
+      // viper's bound-pflag lookup returns the flag value whenever Changed is true —
+      // BEFORE falling back to AutomaticEnv (viper@v1.21.0/viper.go:1176-1178) — so an
+      // explicit --experimental=false must win over SUPABASE_EXPERIMENTAL=1, closing the
+      // gate instead of letting the env value override it.
+      const { layer } = setup(tmp.current, {
+        experimental: false,
+        args: ["db", "schema", "declarative", "sync", "--experimental=false"],
+      });
+      const ENV = "SUPABASE_EXPERIMENTAL";
+      return Effect.gen(function* () {
+        const saved = process.env[ENV];
+        process.env[ENV] = "1";
+        const exit = yield* Effect.exit(legacyDbSchemaDeclarativeSync(flags()));
+        if (saved === undefined) delete process.env[ENV];
+        else process.env[ENV] = saved;
+        expect(Exit.isFailure(exit)).toBe(true);
+        expect(failError(exit)?.constructor.name).toBe("LegacyDeclarativeNotEnabledError");
+      }).pipe(Effect.provide(layer));
+    },
+  );
+
+  it.effect(
+    "--apply and --no-apply together with SUPABASE_EXPERIMENTAL set only in the project .env fail with the mutex error",
+    () => {
+      // Go's flags.LoadConfig runs loadNestedEnv (which os.Setenv's each project-.env key)
+      // before dbDeclarativeCmd.PersistentPreRunE reads viper.GetBool("EXPERIMENTAL")
+      // (apps/cli-go/cmd/db_schema_declarative.go:73-78, pkg/config/config.go:789), so a
+      // SUPABASE_EXPERIMENTAL set only in supabase/.env opens the gate and lets the mutex
+      // check fire, same as the shell-env case above.
+      const saved = process.env["SUPABASE_EXPERIMENTAL"];
+      delete process.env["SUPABASE_EXPERIMENTAL"];
+      mkdirSync(join(tmp.current, "supabase"), { recursive: true });
+      writeFileSync(join(tmp.current, "supabase", ".env"), "SUPABASE_EXPERIMENTAL=true\n");
+      const { layer } = setup(tmp.current, { experimental: false });
+      return Effect.gen(function* () {
+        const exit = yield* Effect.exit(
+          legacyDbSchemaDeclarativeSync(
+            flags({ apply: Option.some(true), noApply: Option.some(true) }),
+          ),
+        );
+        expect(Exit.isFailure(exit)).toBe(true);
+        expect(failError(exit)).toMatchObject({
+          _tag: "LegacyDeclarativeMutuallyExclusiveFlagsError",
+          message:
+            "if any flags in the group [apply no-apply] are set none of the others can be; [apply no-apply] were all set",
+        });
+      }).pipe(
+        Effect.provide(layer),
+        Effect.ensuring(
+          Effect.sync(() => {
+            if (saved === undefined) delete process.env["SUPABASE_EXPERIMENTAL"];
+            else process.env["SUPABASE_EXPERIMENTAL"] = saved;
+          }),
+        ),
+      );
+    },
+  );
+
   it.effect("rejects --apply=false --no-apply as a conflict (Go flag.Changed)", () => {
     // cobra keys the mutex off flag.Changed, so an explicit `--apply=false` still
     // counts as set and conflicts with `--no-apply`, even though its value is false.
-    const { layer } = setup(tmp.current, { experimental: false });
+    // The gate runs first (see legacyRequirePgDelta's doc comment), so --experimental
+    // is required here for the mutex error to be the one that surfaces.
+    const { layer } = setup(tmp.current, { experimental: true });
     return Effect.gen(function* () {
       const exit = yield* Effect.exit(
         legacyDbSchemaDeclarativeSync(
diff --git a/apps/cli/src/legacy/commands/db/shared/legacy-db-bootstrap.errors.ts b/apps/cli/src/legacy/commands/db/shared/legacy-db-bootstrap.errors.ts
new file mode 100644
index 0000000000..673e78a466
--- /dev/null
+++ b/apps/cli/src/legacy/commands/db/shared/legacy-db-bootstrap.errors.ts
@@ -0,0 +1,20 @@
+import { Data } from "effect";
+
+/**
+ * Driving the bundled Go binary's hidden `db __db-bootstrap` seam failed — the
+ * container-lifecycle primitives that back native `db start` / `db reset --local`
+ * (create/recreate the local Postgres container, apply the initial schema, the
+ * storage health gate) are not yet ported to TypeScript. Wraps a failed inspect,
+ * a missing `supabase-go` binary, or a non-zero seam exit. The seam tees its own
+ * progress to stderr, so this message is the fallback shown when the subprocess
+ * dies without surfacing a more specific Go error.
+ */
+export class LegacyDbBootstrapError extends Data.TaggedError("LegacyDbBootstrapError")<{
+  readonly message: string;
+  /**
+   * Optional actionable hint rendered as a separate "Suggestion:" line, mirroring
+   * Go's `utils.CmdSuggestion` — set to the Docker-install hint when the container
+   * runtime's daemon is unreachable (`AssertServiceIsRunning`, `misc.go:148-154`).
+   */
+  readonly suggestion?: string;
+}> {}
diff --git a/apps/cli/src/legacy/commands/db/shared/legacy-db-bootstrap.seam.layer.ts b/apps/cli/src/legacy/commands/db/shared/legacy-db-bootstrap.seam.layer.ts
new file mode 100644
index 0000000000..d6b1793166
--- /dev/null
+++ b/apps/cli/src/legacy/commands/db/shared/legacy-db-bootstrap.seam.layer.ts
@@ -0,0 +1,252 @@
+import { Effect, FileSystem, Layer, Option, Path, Stream } from "effect";
+import * as ChildProcess from "effect/unstable/process/ChildProcess";
+import { ChildProcessSpawner } from "effect/unstable/process/ChildProcessSpawner";
+
+import {
+  LegacyNetworkIdFlag,
+  LegacyProfileFlag,
+  legacyResolveExperimental,
+} from "../../../../shared/legacy/global-flags.ts";
+import { resolveBinary } from "../../../../shared/legacy/go-proxy.layer.ts";
+import { LegacyGoChildExitError } from "../../../../shared/legacy/legacy-go-child-exit.error.ts";
+import { ProcessControl } from "../../../../shared/runtime/process-control.service.ts";
+import { LegacyCliConfig } from "../../../config/legacy-cli-config.service.ts";
+import { spawnContainerCli } from "../../../shared/legacy-container-cli.ts";
+import { legacyReadDbToml } from "../../../shared/legacy-db-config.toml-read.ts";
+import {
+  legacyResolveLocalProjectId,
+  localDbContainerId,
+} from "../../../shared/legacy-docker-ids.ts";
+import {
+  LEGACY_SUGGEST_DOCKER_INSTALL,
+  legacyIsDockerDaemonUnreachable,
+} from "../../../shared/legacy-docker-suggest.ts";
+import { LegacyDbBootstrapError } from "./legacy-db-bootstrap.errors.ts";
+import { LegacyDbBootstrapSeam } from "./legacy-db-bootstrap.seam.service.ts";
+
+const seamFailure = (message: string) => new LegacyDbBootstrapError({ message });
+
+const decodeChunks = (chunks: ReadonlyArray<Uint8Array>): string => {
+  const total = chunks.reduce((size, chunk) => size + chunk.length, 0);
+  const bytes = new Uint8Array(total);
+  let offset = 0;
+  for (const chunk of chunks) {
+    bytes.set(chunk, offset);
+    offset += chunk.length;
+  }
+  return new TextDecoder().decode(bytes);
+};
+
+/**
+ * Real {@link LegacyDbBootstrapSeam}: drives the bundled `supabase-go`'s hidden
+ * `db __db-bootstrap --mode <m>` command. The binary is resolved exactly like
+ * `LegacyGoProxy` (`resolveBinary`); the child's telemetry is disabled and its
+ * progress teed to stderr, matching the `db __shadow` seam. `--network-id` and a
+ * flag-selected `--profile` are forwarded so the spawned containers land on the
+ * same network and the child re-runs Go's identical config resolution.
+ */
+export const legacyDbBootstrapSeamLayer = Layer.effect(
+  LegacyDbBootstrapSeam,
+  Effect.gen(function* () {
+    const cliConfig = yield* LegacyCliConfig;
+    const networkId = yield* LegacyNetworkIdFlag;
+    const profile = yield* LegacyProfileFlag;
+    const profileArgs = profile !== "supabase" ? ["--profile", profile] : [];
+    const networkArgs = Option.isSome(networkId) ? ["--network-id", networkId.value] : [];
+    // Forward `--experimental` (env-aware) so the seam's `SetupLocalDatabase` /
+    // `apply.MigrateAndSeed` takes Go's experimental schema-file path on a
+    // versionless reset/start, matching `viper.GetBool("EXPERIMENTAL")`.
+    const experimental = yield* legacyResolveExperimental;
+    const experimentalArgs = experimental ? ["--experimental"] : [];
+    const spawner = yield* ChildProcessSpawner;
+    const processControl = yield* ProcessControl;
+    const fs = yield* FileSystem.FileSystem;
+    const path = yield* Path.Path;
+    const resolved = resolveBinary();
+
+    /**
+     * Run `db __db-bootstrap` with the given mode args. `captureStdout` pipes
+     * stdout (for the `await-storage` marker); otherwise stdout is inherited.
+     * Returns the captured stdout (empty when inherited).
+     */
+    const runBootstrap = (modeArgs: ReadonlyArray<string>, captureStdout: boolean) =>
+      Effect.scoped(
+        Effect.gen(function* () {
+          if (!("found" in resolved)) {
+            return yield* Effect.fail(
+              seamFailure(
+                "Could not find the supabase-go binary required to bootstrap the local database.",
+              ),
+            );
+          }
+          // `runCli` treats `db start`/`db reset` as self-managed and installs no
+          // global signal handler, and this direct child spawn (unlike
+          // `LegacyGoProxy.exec`) inherits the foreground process group. Hold
+          // SIGINT/SIGTERM/SIGHUP with no-op listeners so an interactive Ctrl-C
+          // during container startup/restore does not default-terminate the TS
+          // parent out from under the Go child's docker-cleanup path — the parent
+          // stays blocked on the child's exit and propagates its real status.
+          // Scoped, so the listeners are removed on completion/failure/interrupt.
+          yield* processControl.holdSignals(["SIGINT", "SIGTERM", "SIGHUP"]);
+          const args = [
+            "db",
+            "__db-bootstrap",
+            ...modeArgs,
+            ...networkArgs,
+            ...profileArgs,
+            ...experimentalArgs,
+          ];
+          const command = ChildProcess.make(resolved.found, args, {
+            cwd: cliConfig.workdir,
+            stdin: "inherit",
+            stdout: captureStdout ? "pipe" : "inherit",
+            stderr: "inherit",
+            extendEnv: true,
+            // Disable the child's telemetry so the hidden seam never records its
+            // own `cli_command_executed` on top of the user's TS command, matching
+            // the `db __shadow` seam and the explicit LegacyGoProxy delegates.
+            env: { SUPABASE_TELEMETRY_DISABLED: "1" },
+            detached: false,
+          });
+          if (!captureStdout) {
+            const exitCode = yield* spawner
+              .exitCode(command)
+              .pipe(Effect.mapError(() => seamFailure("failed to run supabase-go.")));
+            if (exitCode !== 0) {
+              // `LegacyGoChildExitError` (not `seamFailure`/`processControl.exit`) so the
+              // handler's finalizers — `Effect.ensuring(telemetryState.flush)` + the legacy
+              // command instrumentation — still run (an immediate `process.exit` would skip
+              // them), AND the child's exact exit code (e.g. 130 after Ctrl-C cleanup) reaches
+              // `runCli`'s `processControl.exit()` instead of collapsing to a generic 1. The
+              // child's detailed failure is already on the inherited stderr, so `runCli`
+              // special-cases this error class to suppress its own normally-would-print
+              // generic stderr line — Go itself never prints a second line here. CLI-1879.
+              return yield* Effect.fail(
+                new LegacyGoChildExitError({
+                  exitCode,
+                  message: `failed to bootstrap the local database: exit ${exitCode}`,
+                }),
+              );
+            }
+            return "";
+          }
+          const handle = yield* spawner
+            .spawn(command)
+            .pipe(Effect.mapError(() => seamFailure("failed to run supabase-go.")));
+          const chunks: Array<Uint8Array> = [];
+          yield* Stream.runForEach(handle.stdout, (chunk) =>
+            Effect.sync(() => {
+              chunks.push(chunk);
+            }),
+          ).pipe(Effect.mapError(() => seamFailure("failed to bootstrap the local database.")));
+          const exitCode = yield* handle.exitCode.pipe(
+            Effect.mapError(() => seamFailure("failed to bootstrap the local database.")),
+          );
+          if (exitCode !== 0) {
+            // See the `!captureStdout` branch above for why `LegacyGoChildExitError`
+            // replaces `seamFailure` here — same exact-code + finalizer + no-duplicate-line
+            // reasoning (CLI-1879).
+            return yield* Effect.fail(
+              new LegacyGoChildExitError({
+                exitCode,
+                message: `failed to bootstrap the local database: exit ${exitCode}`,
+              }),
+            );
+          }
+          return decodeChunks(chunks);
+        }),
+      );
+
+    return LegacyDbBootstrapSeam.of({
+      isDbRunning: () =>
+        Effect.scoped(
+          Effect.gen(function* () {
+            // Resolve `utils.DbId` exactly as Go does (env → config.toml → workdir
+            // basename); the config.toml read is best-effort (`validate: false`) since
+            // the handler has already run Go's `LoadConfig` validation — an invalid
+            // config would have failed there, so here we only want the `projectId` and
+            // tolerate a fallback to the workdir basename rather than re-throwing.
+            const tomlProjectId = yield* legacyReadDbToml(fs, path, cliConfig.workdir, undefined, {
+              validate: false,
+            }).pipe(
+              Effect.map((toml) => toml.projectId),
+              // The lenient read still surfaces a genuinely unreadable/malformed project
+              // `.env`; fall back to the workdir basename in that case rather than failing
+              // the running-check (the handler has already validated config).
+              Effect.orElseSucceed(() => Option.none<string>()),
+            );
+            const projectId = legacyResolveLocalProjectId(
+              Option.getOrUndefined(cliConfig.projectId),
+              Option.getOrUndefined(tomlProjectId),
+              cliConfig.workdir,
+            );
+            const containerId = localDbContainerId(projectId);
+            // Go's AssertSupabaseDbIsRunning = ContainerInspect → NotFound ⇒ not
+            // running. Discard stdout (the inspect JSON) so the unconsumed pipe can
+            // never deadlock; only the exit code + stderr matter.
+            const child = yield* spawnContainerCli(spawner, ["container", "inspect", containerId], {
+              stdin: "ignore",
+              stdout: "ignore",
+              stderr: "pipe",
+              extendEnv: true,
+            }).pipe(Effect.mapError(() => seamFailure("failed to inspect service")));
+            const stderrChunks: Array<Uint8Array> = [];
+            yield* Stream.runForEach(child.stderr, (chunk) =>
+              Effect.sync(() => {
+                stderrChunks.push(chunk);
+              }),
+            ).pipe(Effect.mapError(() => seamFailure("failed to inspect service")));
+            const inspectExit = yield* child.exitCode.pipe(
+              Effect.map(Number),
+              Effect.mapError(() => seamFailure("failed to inspect service")),
+            );
+            if (inspectExit === 0) return true; // container exists ⇒ running
+
+            const stderr = decodeChunks(stderrChunks).trim();
+            // Only a missing container means "not running". Docker reports this as
+            // either "No such container" or "No such object" depending on daemon
+            // version/CLI path (the same pair handled in `shared/functions/serve.ts`).
+            // Any other inspect failure (e.g. the Docker daemon is down) propagates,
+            // matching Go's `AssertSupabaseDbIsRunning`.
+            if (!stderr.includes("No such container") && !stderr.includes("No such object")) {
+              // Go's `AssertServiceIsRunning` sets `CmdSuggestion = suggestDockerInstall`
+              // on a daemon-connection failure (`misc.go:148-154`), so a down daemon
+              // still surfaces the actionable Docker Desktop hint, not just raw stderr.
+              return yield* Effect.fail(
+                new LegacyDbBootstrapError({
+                  message:
+                    stderr.length > 0
+                      ? `failed to inspect service: ${stderr}`
+                      : "failed to inspect service",
+                  ...(legacyIsDockerDaemonUnreachable(stderr)
+                    ? { suggestion: LEGACY_SUGGEST_DOCKER_INSTALL }
+                    : {}),
+                }),
+              );
+            }
+            return false;
+          }),
+        ),
+      startDatabase: ({ fromBackup }) =>
+        runBootstrap(
+          ["--mode", "start", ...(fromBackup !== undefined ? ["--from-backup", fromBackup] : [])],
+          false,
+        ).pipe(Effect.asVoid),
+      recreateDatabase: ({ version, noSeed, sqlPaths }) =>
+        runBootstrap(
+          [
+            "--mode",
+            "recreate",
+            ...(version !== "" ? ["--version", version] : []),
+            ...(noSeed ? ["--no-seed"] : []),
+            ...sqlPaths.flatMap((p) => ["--sql-paths", p]),
+          ],
+          false,
+        ).pipe(Effect.asVoid),
+      awaitStorageReady: () =>
+        runBootstrap(["--mode", "await-storage"], true).pipe(
+          Effect.map((stdout) => stdout.trim() === "ready"),
+        ),
+    });
+  }),
+);
diff --git a/apps/cli/src/legacy/commands/db/shared/legacy-db-bootstrap.seam.service.ts b/apps/cli/src/legacy/commands/db/shared/legacy-db-bootstrap.seam.service.ts
new file mode 100644
index 0000000000..157b290c4b
--- /dev/null
+++ b/apps/cli/src/legacy/commands/db/shared/legacy-db-bootstrap.seam.service.ts
@@ -0,0 +1,72 @@
+import { Context, type Effect } from "effect";
+
+import type { LegacyGoChildExitError } from "../../../../shared/legacy/legacy-go-child-exit.error.ts";
+import type { LegacyDbBootstrapError } from "./legacy-db-bootstrap.errors.ts";
+
+/**
+ * Seam over the bundled Go binary's hidden `db __db-bootstrap` command, exposing
+ * the container-bootstrap primitives that native `db start` / `db reset --local`
+ * still need but that are not ported to TypeScript: the local-stack "is running?"
+ * probe, the database container create/recreate flows, and the storage health gate
+ * before bucket seeding. The TS handlers orchestrate everything else (user-facing
+ * messages, version resolution, bucket seeding, the git-branch line, telemetry,
+ * and `--output-format` shaping); only the Docker lifecycle lives behind here.
+ *
+ * Mirrors {@link LegacyDeclarativeSeam} (`db __shadow`): each method shells out to
+ * the same resolved `supabase-go`, with the child's telemetry disabled so the
+ * hidden seam never double-counts the user's command, and its progress teed to
+ * stderr.
+ */
+interface LegacyDbBootstrapSeamShape {
+  /**
+   * Go's `utils.AssertSupabaseDbIsRunning` (`internal/utils/misc.go:144`): inspect
+   * the local Postgres container. `true` when it exists (the stack is up), `false`
+   * when Docker reports "No such container" (Go's `ErrNotRunning`). Any other
+   * inspect failure (e.g. the Docker daemon is unreachable) fails with
+   * {@link LegacyDbBootstrapError}, matching Go, which returns the wrapped inspect
+   * error rather than treating the database as stopped.
+   */
+  readonly isDbRunning: () => Effect.Effect<boolean, LegacyDbBootstrapError>;
+  /**
+   * `db start`'s container bootstrap — `start.StartDatabase(fromBackup)` plus Go's
+   * `DockerRemoveAll` cleanup on failure (`internal/db/start/start.go:54-60`):
+   * create the Postgres container, wait for health, apply the initial schema +
+   * roles + migrations + seed on a fresh volume, and write `_current_branch`.
+   * Progress (`Starting database...`, `Initialising schema...`) is teed to stderr.
+   */
+  readonly startDatabase: (opts: {
+    readonly fromBackup?: string;
+  }) => Effect.Effect<void, LegacyDbBootstrapError | LegacyGoChildExitError>;
+  /**
+   * The PG14/PG15 container-recreate half of local `db reset`
+   * (`reset.RecreateLocalDatabase`): recreate the db container/volume, init schema,
+   * migrate + seed up to `version`, and restart the satellite containers. The
+   * caller has already printed `Resetting local database…`; the seam tees the
+   * remaining progress (`Recreating database...`, `Restarting containers...`) to
+   * stderr. `version` is the resolved migration version ("" for all migrations);
+   * `noSeed` disables the seed and `sqlPaths` overrides `[db.seed].sql_paths`
+   * inside the recreate's MigrateAndSeed, mirroring the `db reset`
+   * `--no-seed` / `--sql-paths` handling (`cmd/db.go` `dbResetCmd`).
+   */
+  readonly recreateDatabase: (opts: {
+    readonly version: string;
+    readonly noSeed: boolean;
+    readonly sqlPaths: ReadonlyArray<string>;
+  }) => Effect.Effect<void, LegacyDbBootstrapError | LegacyGoChildExitError>;
+  /**
+   * The storage health gate local `db reset` runs before seeding buckets
+   * (`reset.AwaitStorageReady`): if the storage container exists but is unhealthy,
+   * wait up to 30s for it. Resolves `true` when the storage container exists (so
+   * the caller should run the ported bucket seeding) and `false` when it does not
+   * — matching Go, which silently skips buckets when storage is absent.
+   */
+  readonly awaitStorageReady: () => Effect.Effect<
+    boolean,
+    LegacyDbBootstrapError | LegacyGoChildExitError
+  >;
+}
+
+export class LegacyDbBootstrapSeam extends Context.Service<
+  LegacyDbBootstrapSeam,
+  LegacyDbBootstrapSeamShape
+>()("supabase/legacy/DbBootstrapSeam") {}
diff --git a/apps/cli/src/legacy/commands/db/shared/legacy-drop-schemas.ts b/apps/cli/src/legacy/commands/db/shared/legacy-drop-schemas.ts
new file mode 100644
index 0000000000..88d394498c
--- /dev/null
+++ b/apps/cli/src/legacy/commands/db/shared/legacy-drop-schemas.ts
@@ -0,0 +1,169 @@
+import { Effect } from "effect";
+
+import type { LegacyDbExecError } from "../../../shared/legacy-db-connection.errors.ts";
+import type { LegacyDbSession } from "../../../shared/legacy-db-connection.service.ts";
+
+/**
+ * Verbatim port of Go's embedded `pkg/migration/queries/drop.sql`
+ * (`DropUserSchemas`). A single PL/pgSQL `DO` block that drops user schemas,
+ * extensions, public-schema objects, and non-managed publications, then
+ * truncates the auth / supabase_functions / supabase_migrations tables. Run as a
+ * single simple-query statement, matching Go's one-statement `ExecBatch`.
+ */
+const DROP_OBJECTS = `do $$ declare
+  rec record;
+begin
+  -- schemas
+  for rec in
+    select pn.*
+    from pg_namespace pn
+    left join pg_depend pd on pd.objid = pn.oid
+    where pd.deptype is null
+      and not pn.nspname like any(array['information\\_schema', 'pg\\_%', '\\_analytics', '\\_realtime', '\\_supavisor', 'pgbouncer', 'pgmq', 'pgsodium', 'pgtle', 'supabase\\_migrations', 'vault', 'extensions', 'public'])
+      and pn.nspowner::regrole::text != 'supabase_admin'
+  loop
+    -- If an extension uses a schema it doesn't create, dropping the schema will cascade to also
+    -- drop the extension. But if an extension creates its own schema, dropping the schema will
+    -- throw an error. Hence, we drop schemas first while excluding those created by extensions.
+    raise notice 'dropping schema: %', rec.nspname;
+    execute format('drop schema if exists %I cascade', rec.nspname);
+  end loop;
+
+  -- extensions
+  for rec in
+    select *
+    from pg_extension p
+    where p.extname not in ('pg_graphql', 'pg_net', 'pg_stat_statements', 'pgcrypto', 'pgjwt', 'pgsodium', 'plpgsql', 'supabase_vault', 'uuid-ossp')
+  loop
+    raise notice 'dropping extension: %', rec.extname;
+    execute format('drop extension if exists %I cascade', rec.extname);
+  end loop;
+
+  -- functions
+  for rec in
+    select *
+    from pg_proc p
+    where p.pronamespace::regnamespace::name = 'public'
+  loop
+    -- supports aggregate, function, and procedure
+    raise notice 'dropping function: %.%', rec.pronamespace::regnamespace::name, rec.proname;
+    execute format('drop routine if exists %I.%I(%s) cascade', rec.pronamespace::regnamespace::name, rec.proname, pg_catalog.pg_get_function_identity_arguments(rec.oid));
+  end loop;
+
+  -- views (necessary for views referencing objects in Supabase-managed schemas)
+  for rec in
+    select *
+    from pg_class c
+    where
+      c.relnamespace::regnamespace::name = 'public'
+      and c.relkind = 'v'
+  loop
+    raise notice 'dropping view: %.%', rec.relnamespace::regnamespace::name, rec.relname;
+    execute format('drop view if exists %I.%I cascade', rec.relnamespace::regnamespace::name, rec.relname);
+  end loop;
+
+  -- materialized views (necessary for materialized views referencing objects in Supabase-managed schemas)
+  for rec in
+    select *
+    from pg_class c
+    where
+      c.relnamespace::regnamespace::name = 'public'
+      and c.relkind = 'm'
+  loop
+    raise notice 'dropping materialized view: %.%', rec.relnamespace::regnamespace::name, rec.relname;
+    execute format('drop materialized view if exists %I.%I cascade', rec.relnamespace::regnamespace::name, rec.relname);
+  end loop;
+
+  -- tables (cascade to dependent objects)
+  for rec in
+    select *
+    from pg_class c
+    where
+      c.relnamespace::regnamespace::name = 'public'
+      and c.relkind not in ('c', 'S', 'v', 'm')
+    order by c.relkind desc
+  loop
+    -- supports all table like relations, except views, complex types, and sequences
+    raise notice 'dropping table: %.%', rec.relnamespace::regnamespace::name, rec.relname;
+    execute format('drop table if exists %I.%I cascade', rec.relnamespace::regnamespace::name, rec.relname);
+  end loop;
+
+  -- truncate tables in auth, webhooks, and migrations schema
+  for rec in
+    select *
+    from pg_class c
+    where
+      (c.relnamespace::regnamespace::name = 'auth' and c.relname != 'schema_migrations'
+      or c.relnamespace::regnamespace::name = 'supabase_functions' and c.relname != 'migrations'
+      or c.relnamespace::regnamespace::name = 'supabase_migrations')
+      and c.relkind = 'r'
+  loop
+    raise notice 'truncating table: %.%', rec.relnamespace::regnamespace::name, rec.relname;
+    execute format('truncate %I.%I cascade', rec.relnamespace::regnamespace::name, rec.relname);
+  end loop;
+
+  -- sequences
+  for rec in
+    select *
+    from pg_class c
+    where
+      c.relnamespace::regnamespace::name = 'public'
+      and c.relkind = 's'
+  loop
+    raise notice 'dropping sequence: %.%', rec.relnamespace::regnamespace::name, rec.relname;
+    execute format('drop sequence if exists %I.%I cascade', rec.relnamespace::regnamespace::name, rec.relname);
+  end loop;
+
+  -- types
+  for rec in
+    select *
+    from pg_type t
+    where
+      t.typnamespace::regnamespace::name = 'public'
+      and typtype != 'b'
+  loop
+    raise notice 'dropping type: %.%', rec.typnamespace::regnamespace::name, rec.typname;
+    execute format('drop type if exists %I.%I cascade', rec.typnamespace::regnamespace::name, rec.typname);
+  end loop;
+
+  -- policies
+  for rec in
+    select *
+    from pg_policies p
+  loop
+    raise notice 'dropping policy: %', rec.policyname;
+    execute format('drop policy if exists %I on %I.%I cascade', rec.policyname, rec.schemaname, rec.tablename);
+  end loop;
+
+  -- publications
+  for rec in
+    select *
+    from pg_publication p
+    where
+      not p.pubname like any(array['supabase\\_realtime%', 'realtime\\_messages%'])
+  loop
+    raise notice 'dropping publication: %', rec.pubname;
+    execute format('drop publication if exists %I', rec.pubname);
+  end loop;
+end $$;`;
+
+/**
+ * Drops all user-created database objects, mirroring Go's
+ * `migration.DropUserSchemas` (`pkg/migration/drop.go:34-38`): the `drop.sql` `DO`
+ * block runs as a single transactional statement (no migration-history row).
+ */
+export const legacyDropUserSchemas = <E>(
+  session: LegacyDbSession,
+  mapError: (message: string) => E,
+): Effect.Effect<void, E> =>
+  Effect.gen(function* () {
+    // Go's `DropUserSchemas` runs only `drop.sql` via `ExecBatch` (drop.go:34-38) —
+    // no `RESET ALL`. Resetting here would clear caller-supplied DB URL runtime
+    // params (e.g. `options=-c statement_timeout=…`) before the destructive drop, so
+    // the remote `db reset --db-url` path must NOT reset (matches Go's ExecBatch).
+    yield* session.exec("BEGIN");
+    yield* session
+      .exec(DROP_OBJECTS)
+      .pipe(Effect.tapError(() => session.exec("ROLLBACK").pipe(Effect.ignore)));
+    yield* session.exec("COMMIT");
+  }).pipe(Effect.mapError((error: LegacyDbExecError) => mapError(error.message)));
diff --git a/apps/cli/src/legacy/commands/db/shared/legacy-migration-pending.ts b/apps/cli/src/legacy/commands/db/shared/legacy-migration-pending.ts
new file mode 100644
index 0000000000..579a0b675a
--- /dev/null
+++ b/apps/cli/src/legacy/commands/db/shared/legacy-migration-pending.ts
@@ -0,0 +1,123 @@
+import { legacyBold } from "../../../shared/legacy-colors.ts";
+
+/**
+ * `pkg/migration/file.go` — local migration filenames are `<digits>_<name>.sql`.
+ * `ListLocalMigrations` guarantees every path in `localMigrations` matches, so the
+ * version capture group is always present.
+ */
+const MIGRATE_FILE_PATTERN = /^([0-9]+)_(.*)\.sql$/u;
+
+/** Last path segment, mirroring Go's `filepath.Base`. */
+const baseName = (path: string): string => {
+  const normalized = path.replace(/[/\\]+$/u, "");
+  const slash = Math.max(normalized.lastIndexOf("/"), normalized.lastIndexOf("\\"));
+  return slash === -1 ? normalized : normalized.slice(slash + 1);
+};
+
+/**
+ * `pkg/migration/apply.go:14-16` — the exact error strings Go raises so the legacy
+ * handler can byte-match them on stderr.
+ */
+export const LEGACY_ERR_MISSING_REMOTE =
+  "Found local migration files to be inserted before the last migration on remote database.";
+export const LEGACY_ERR_MISSING_LOCAL =
+  "Remote migration versions not found in local migrations directory.";
+
+/**
+ * The outcome of comparing local migration files against the remote
+ * `schema_migrations` history. Pure 1:1 port of Go's `FindPendingMigrations`
+ * (`pkg/migration/apply.go:21-54`).
+ *
+ * - `ok`            — `pending` are the local migration paths to apply (those
+ *                     beyond the remote history, in order).
+ * - `missing-local` — remote has versions with no local file (`ErrMissingLocal`).
+ *                     `versions` are the offending remote versions.
+ * - `missing-remote`— local has files ordered before the remote head
+ *                     (`ErrMissingRemote`). `paths` are the out-of-order local
+ *                     migration paths.
+ */
+export type LegacyPendingMigrations =
+  | { readonly kind: "ok"; readonly pending: ReadonlyArray<string> }
+  | { readonly kind: "missing-local"; readonly versions: ReadonlyArray<string> }
+  | { readonly kind: "missing-remote"; readonly paths: ReadonlyArray<string> };
+
+/**
+ * Two-pointer reconciliation of local migration paths vs remote applied versions.
+ * Mirrors Go's `FindPendingMigrations` exactly, including its **string**
+ * comparison of versions (`remote == local` / `remote < local`) — version
+ * prefixes are fixed-width timestamps, so lexical order equals chronological
+ * order, matching Go.
+ */
+export function legacyFindPendingMigrations(
+  localMigrations: ReadonlyArray<string>,
+  remoteMigrations: ReadonlyArray<string>,
+): LegacyPendingMigrations {
+  const unapplied: Array<string> = [];
+  const missing: Array<string> = [];
+  let i = 0;
+  let j = 0;
+  while (i < remoteMigrations.length && j < localMigrations.length) {
+    const remote = remoteMigrations[i]!;
+    const filename = baseName(localMigrations[j]!);
+    // ListLocalMigrations guarantees a match, so the capture group is present.
+    const local = MIGRATE_FILE_PATTERN.exec(filename)![1]!;
+    if (remote === local) {
+      i++;
+      j++;
+    } else if (remote < local) {
+      missing.push(remote);
+      i++;
+    } else {
+      // Include out-of-order local migrations.
+      unapplied.push(localMigrations[j]!);
+      j++;
+    }
+  }
+  // Ensure all remote versions exist on local.
+  if (j === localMigrations.length) {
+    missing.push(...remoteMigrations.slice(i));
+  }
+  if (missing.length > 0) {
+    return { kind: "missing-local", versions: missing };
+  }
+  // Enforce migrations are applied in chronological order by default.
+  if (unapplied.length > 0) {
+    return { kind: "missing-remote", paths: unapplied };
+  }
+  return { kind: "ok", pending: localMigrations.slice(remoteMigrations.length) };
+}
+
+/**
+ * Computes the `--include-all` pending set when reconciliation reports
+ * `missing-remote`. Mirrors Go's `GetPendingMigrations` includeAll branch
+ * (`internal/migration/up/up.go:46-48`): the out-of-order paths first, then the
+ * local migrations beyond `len(remote)+len(diff)`.
+ */
+export function legacyIncludeAllPending(
+  localMigrations: ReadonlyArray<string>,
+  remoteCount: number,
+  diff: ReadonlyArray<string>,
+): ReadonlyArray<string> {
+  return [...diff, ...localMigrations.slice(remoteCount + diff.length)];
+}
+
+/**
+ * Go's `suggestRevertHistory` (`internal/migration/up/up.go:55-61`). `fmt.Sprintln`
+ * appends a trailing newline to each line, so the suggestion ends with `\n`.
+ */
+export function legacySuggestRevertHistory(versions: ReadonlyArray<string>): string {
+  return (
+    "\nMake sure your local git repo is up-to-date. If the error persists, try repairing the migration history table:\n" +
+    `${legacyBold(`supabase migration repair --status reverted ${versions.join(" ")}`)}\n` +
+    "\nAnd update local migrations to match remote database:\n" +
+    `${legacyBold("supabase db pull")}\n`
+  );
+}
+
+/** Go's `suggestIgnoreFlag` (`internal/migration/up/up.go:63-67`). */
+export function legacySuggestIgnoreFlag(paths: ReadonlyArray<string>): string {
+  return (
+    "\nRerun the command with --include-all flag to apply these migrations:\n" +
+    `${legacyBold(paths.join("\n"))}\n`
+  );
+}
diff --git a/apps/cli/src/legacy/commands/db/shared/legacy-migration-pending.unit.test.ts b/apps/cli/src/legacy/commands/db/shared/legacy-migration-pending.unit.test.ts
new file mode 100644
index 0000000000..eaf5400d60
--- /dev/null
+++ b/apps/cli/src/legacy/commands/db/shared/legacy-migration-pending.unit.test.ts
@@ -0,0 +1,83 @@
+import { describe, expect, it } from "vitest";
+
+import {
+  legacyFindPendingMigrations,
+  legacyIncludeAllPending,
+  legacySuggestIgnoreFlag,
+  legacySuggestRevertHistory,
+} from "./legacy-migration-pending.ts";
+
+const local = (...versions: ReadonlyArray<string>) =>
+  versions.map((v) => `supabase/migrations/${v}_name.sql`);
+
+describe("legacyFindPendingMigrations", () => {
+  it("returns the local migrations beyond the remote history when in sync", () => {
+    const result = legacyFindPendingMigrations(local("0001", "0002", "0003"), ["0001"]);
+    expect(result).toEqual({
+      kind: "ok",
+      pending: ["supabase/migrations/0002_name.sql", "supabase/migrations/0003_name.sql"],
+    });
+  });
+
+  it("is up to date when local and remote match exactly", () => {
+    const result = legacyFindPendingMigrations(local("0001", "0002"), ["0001", "0002"]);
+    expect(result).toEqual({ kind: "ok", pending: [] });
+  });
+
+  it("reports missing-local when remote has a version with no local file", () => {
+    const result = legacyFindPendingMigrations(local("0001", "0003"), ["0001", "0002", "0003"]);
+    expect(result).toEqual({ kind: "missing-local", versions: ["0002"] });
+  });
+
+  it("reports missing-local for trailing remote versions absent locally", () => {
+    const result = legacyFindPendingMigrations(local("0001"), ["0001", "0002"]);
+    expect(result).toEqual({ kind: "missing-local", versions: ["0002"] });
+  });
+
+  it("reports missing-remote for an out-of-order local migration", () => {
+    const result = legacyFindPendingMigrations(local("0001", "0002"), ["0002"]);
+    expect(result).toEqual({
+      kind: "missing-remote",
+      paths: ["supabase/migrations/0001_name.sql"],
+    });
+  });
+
+  it("treats an empty remote history as all-local pending", () => {
+    const result = legacyFindPendingMigrations(local("0001", "0002"), []);
+    expect(result).toEqual({
+      kind: "ok",
+      pending: ["supabase/migrations/0001_name.sql", "supabase/migrations/0002_name.sql"],
+    });
+  });
+});
+
+describe("legacyIncludeAllPending", () => {
+  it("prepends the out-of-order diff then the migrations beyond remote+diff", () => {
+    const locals = local("0001", "0002", "0003");
+    const diff = ["supabase/migrations/0001_name.sql"];
+    // remoteCount 1, diff length 1 → slice from index 2.
+    expect(legacyIncludeAllPending(locals, 1, diff)).toEqual([
+      "supabase/migrations/0001_name.sql",
+      "supabase/migrations/0003_name.sql",
+    ]);
+  });
+});
+
+describe("suggestion strings", () => {
+  it("builds the revert-history suggestion with a trailing newline per line", () => {
+    expect(legacySuggestRevertHistory(["0002", "0003"])).toContain(
+      "supabase migration repair --status reverted 0002 0003",
+    );
+    expect(legacySuggestRevertHistory(["0002"])).toMatch(/\n$/u);
+    expect(legacySuggestRevertHistory(["0002"])).toContain("supabase db pull");
+  });
+
+  it("builds the include-all suggestion listing each path on its own line", () => {
+    const suggestion = legacySuggestIgnoreFlag([
+      "supabase/migrations/0001_a.sql",
+      "supabase/migrations/0002_b.sql",
+    ]);
+    expect(suggestion).toContain("--include-all");
+    expect(suggestion).toContain("supabase/migrations/0001_a.sql\nsupabase/migrations/0002_b.sql");
+  });
+});
diff --git a/apps/cli/src/legacy/commands/db/shared/legacy-pgdelta-migrations.write.ts b/apps/cli/src/legacy/commands/db/shared/legacy-pgdelta-migrations.write.ts
new file mode 100644
index 0000000000..e02b5c720f
--- /dev/null
+++ b/apps/cli/src/legacy/commands/db/shared/legacy-pgdelta-migrations.write.ts
@@ -0,0 +1,135 @@
+import { Data, Effect, type FileSystem, type Path } from "effect";
+
+import { legacyMakeDir } from "../../../shared/legacy-make-dir.ts";
+import {
+  legacyFormatMigrationTimestamp,
+  legacyGetMigrationPath,
+} from "../../../shared/legacy-migration-file.ts";
+
+/** A migration file written by a diff/pull, paired with its history version. */
+export interface LegacyWrittenMigration {
+  readonly path: string;
+  readonly version: string;
+}
+
+/**
+ * A write failure from `legacyWritePgDeltaMigrations`. Callers map this to their
+ * own command-domain write error (`LegacyDbDiffWriteError` / `LegacyDbPullWriteError`).
+ */
+export class LegacyPgDeltaMigrationWriteError extends Data.TaggedError(
+  "LegacyPgDeltaMigrationWriteError",
+)<{
+  readonly message: string;
+}> {}
+
+/**
+ * Bounds the base-timestamp bump retry so a directory already full of same-second
+ * migrations can't spin forever. Mirrors Go's `maxVersionCollisionAttempts`.
+ */
+const MAX_VERSION_COLLISION_ATTEMPTS = 60;
+
+/**
+ * Port of Go's `WritePgDeltaMigrations` (`apps/cli-go/internal/db/diff/pgdelta_migrations.go`).
+ *
+ * Writes one ordered migration file per plan unit. A single-unit plan (the common
+ * case) keeps the exact `<ts>_<name>.sql` filename; multi-unit plans append the
+ * unit name and give each file a strictly increasing timestamp (real time
+ * arithmetic on the base millis, never string increment) so their execution order
+ * and migration-history order stay stable.
+ *
+ * Before writing anything the FULL set of generated filenames is collision-checked
+ * against the filesystem: if any target path already exists the base is advanced by
+ * one second and every version recomputed, so the set stays strictly ascending AND
+ * unique against pre-existing migrations. The base only ever moves forward — never
+ * backdated below the caller's wall clock, since backdating could sort a new file
+ * before pre-existing migrations. The resulting ≤N−1s future-dating is inherent to
+ * second-granularity versions and acceptable once uniqueness is enforced.
+ *
+ * Each file is written with the exclusive `"wx"` flag so a race between the
+ * collision check and the write can still never silently overwrite an existing
+ * migration. If any open/write fails mid-loop, every file already written by THIS
+ * invocation is best-effort removed before the error surfaces (a removal failure
+ * never masks the original error).
+ */
+export const legacyWritePgDeltaMigrations = (
+  fs: FileSystem.FileSystem,
+  pathSvc: Path.Path,
+  opts: {
+    readonly workdir: string;
+    readonly baseMillis: number;
+    readonly name: string;
+    readonly files: ReadonlyArray<{ readonly name: string; readonly sql: string }>;
+  },
+): Effect.Effect<Array<LegacyWrittenMigration>, LegacyPgDeltaMigrationWriteError> =>
+  Effect.gen(function* () {
+    const { workdir, name, files } = opts;
+    const single = files.length === 1;
+    const buildSet = (baseMillis: number): Array<LegacyWrittenMigration> =>
+      files.map((file, i) => {
+        const version = legacyFormatMigrationTimestamp(baseMillis + i * 1000);
+        const unitName = single ? name : `${name}_${file.name}`;
+        return { path: legacyGetMigrationPath(pathSvc, workdir, version, unitName), version };
+      });
+
+    let baseMillis = opts.baseMillis;
+    let set = buildSet(baseMillis);
+    for (let attempt = 0; ; attempt++) {
+      let collision = false;
+      for (const w of set) {
+        const exists = yield* fs.exists(w.path).pipe(
+          Effect.mapError(
+            (cause) =>
+              new LegacyPgDeltaMigrationWriteError({
+                message: `failed to check migration file: ${cause.message}`,
+              }),
+          ),
+        );
+        if (exists) {
+          collision = true;
+          break;
+        }
+      }
+      if (!collision) break;
+      if (attempt + 1 >= MAX_VERSION_COLLISION_ATTEMPTS) {
+        return yield* Effect.fail(
+          new LegacyPgDeltaMigrationWriteError({
+            message: `failed to find a unique migration version after ${MAX_VERSION_COLLISION_ATTEMPTS} attempts`,
+          }),
+        );
+      }
+      baseMillis += 1000;
+      set = buildSet(baseMillis);
+    }
+
+    const written: Array<LegacyWrittenMigration> = [];
+    const writeAll = Effect.gen(function* () {
+      for (let i = 0; i < files.length; i++) {
+        const w = set[i]!;
+        const file = files[i]!;
+        yield* legacyMakeDir(fs, pathSvc.dirname(w.path)).pipe(
+          Effect.mapError(
+            (cause) => new LegacyPgDeltaMigrationWriteError({ message: cause.message }),
+          ),
+        );
+        yield* fs.writeFileString(w.path, `${file.sql}\n`, { flag: "wx" }).pipe(
+          Effect.mapError(
+            (cause) =>
+              new LegacyPgDeltaMigrationWriteError({
+                message:
+                  cause.reason._tag === "AlreadyExists"
+                    ? `failed to open migration file: ${cause.message}`
+                    : `failed to write migration file: ${cause.message}`,
+              }),
+          ),
+        );
+        written.push(w);
+      }
+      return written;
+    });
+
+    return yield* writeAll.pipe(
+      Effect.tapError(() =>
+        Effect.forEach(written, (w) => fs.remove(w.path).pipe(Effect.ignore), { discard: true }),
+      ),
+    );
+  });
diff --git a/apps/cli/src/legacy/commands/db/shared/legacy-pgdelta.cache.ts b/apps/cli/src/legacy/commands/db/shared/legacy-pgdelta.cache.ts
index a15f683d02..f06b687000 100644
--- a/apps/cli/src/legacy/commands/db/shared/legacy-pgdelta.cache.ts
+++ b/apps/cli/src/legacy/commands/db/shared/legacy-pgdelta.cache.ts
@@ -3,6 +3,7 @@ import { Effect, type FileSystem, Option, type Path } from "effect";
 
 import { Output } from "../../../../shared/output/output.service.ts";
 import { LegacyMigrationsReadError } from "../../../shared/legacy-migration.errors.ts";
+import { type LegacyPgDeltaContext, legacyExportCatalogPgDelta } from "./legacy-pgdelta.ts";
 
 /**
  * Declarative catalog-cache key builders + on-disk catalog resolution, ported
@@ -19,6 +20,8 @@ const INIT_SCHEMA_PATTERN = /([0-9]{14})_init\.sql/;
 const INIT_SCHEMA_CUTOFF = 20211209000000;
 // `pkg/migration/file.go` — valid migration filenames.
 const MIGRATE_FILE_PATTERN = /^([0-9]+)_(.*)\.sql$/;
+// `internal/utils/misc.go` — `ProjectHostPattern`, matches a direct `db.<ref>.supabase.{co,red}` host.
+const PROJECT_HOST_PATTERN = /^(db\.)([a-z]{20})\.supabase\.(co|red)$/;
 
 /** Inputs to `setupInputsToken` — everything `start.SetupDatabase` consumes. */
 export interface LegacySetupInputs {
@@ -43,6 +46,28 @@ export function legacySanitizedCatalogPrefix(prefix: string): string {
   return trimmed.replace(CATALOG_PREFIX_PATTERN, "-");
 }
 
+/**
+ * Mirrors Go's `pgcache.CatalogPrefixFromConfig` (`pgcache/cache.go`): `"local"`
+ * for the local dev database, the project ref for a direct `db.<ref>.supabase.*`
+ * host, else a stable `url-<sha256[:12]>` derived from the connection.
+ */
+export function legacyCatalogPrefixFromConfig(
+  conn: {
+    readonly host: string;
+    readonly port: number;
+    readonly user: string;
+    readonly database: string;
+  },
+  isLocal: boolean,
+): string {
+  if (isLocal) return "local";
+  const match = PROJECT_HOST_PATTERN.exec(conn.host);
+  if (match?.[2] !== undefined) return match[2];
+  const key = `${conn.user}@${conn.host}:${conn.port}/${conn.database}`;
+  const digest = createHash("sha256").update(key, "utf8").digest("hex");
+  return `url-${digest.slice(0, 12)}`;
+}
+
 /** Mirrors Go's `baselineVersionToken` (`declarative.go:665`): the image tag, or `pg<major>`. */
 export function legacyBaselineVersionToken(image: string, majorVersion: number): string {
   let tag = image.trim();
@@ -167,18 +192,20 @@ export const legacyListLocalMigrations = Effect.fnUntraced(function* (
 
 /**
  * Mirrors Go's `pgcache.HashMigrations` (`pgcache/cache.go`): for each local
- * migration (in list order), hash its path then its contents. Returns full hex.
+ * migration (in list order), hash its `workdir`-relative path then its
+ * contents. Returns full hex.
  */
 export const legacyHashMigrations = Effect.fnUntraced(function* (
   fs: FileSystem.FileSystem,
   path: Path.Path,
+  workdir: string,
   migrationsDir: string,
 ) {
   const migrations = yield* legacyListLocalMigrations(fs, path, migrationsDir);
   const hash = createHash("sha256");
   for (const filePath of migrations) {
     const contents = yield* fs.readFile(filePath);
-    hash.update(filePath, "utf8");
+    hash.update(path.relative(workdir, filePath), "utf8");
     hash.update(contents);
   }
   return hash.digest("hex");
@@ -274,18 +301,13 @@ export const legacyResolveDeclarativeCatalogPath = Effect.fnUntraced(function* (
   return latestPath;
 });
 
-/**
- * Removes all but the newest `catalogRetentionCount` declarative catalogs for a
- * prefix family. Mirrors Go's `cleanupOldDeclarativeCatalogs` (`declarative.go:610`).
- */
-export const legacyCleanupOldDeclarativeCatalogs = Effect.fnUntraced(function* (
+const cleanupOldCatalogsByFamily = Effect.fnUntraced(function* (
   fs: FileSystem.FileSystem,
   path: Path.Path,
   tempDir: string,
-  prefix: string,
+  familyPrefix: string,
 ) {
   const entries = yield* listJsonEntries(fs, tempDir);
-  const familyPrefix = `catalog-${legacySanitizedCatalogPrefix(prefix)}-declarative-`;
   const files = entries
     .filter((name) => name.startsWith(familyPrefix) && name.endsWith(".json"))
     .map((name) => ({ name, timestamp: Option.getOrElse(parseCatalogTimestamp(name), () => 0) }))
@@ -298,3 +320,117 @@ export const legacyCleanupOldDeclarativeCatalogs = Effect.fnUntraced(function* (
       .pipe(Effect.orElseSucceed(() => undefined));
   }
 });
+
+/**
+ * Removes all but the newest `catalogRetentionCount` declarative catalogs for a
+ * prefix family. Mirrors Go's `cleanupOldDeclarativeCatalogs` (`declarative.go:610`).
+ */
+export const legacyCleanupOldDeclarativeCatalogs = Effect.fnUntraced(function* (
+  fs: FileSystem.FileSystem,
+  path: Path.Path,
+  tempDir: string,
+  prefix: string,
+) {
+  yield* cleanupOldCatalogsByFamily(
+    fs,
+    path,
+    tempDir,
+    `catalog-${legacySanitizedCatalogPrefix(prefix)}-declarative-`,
+  );
+});
+
+/**
+ * Removes all but the newest `catalogRetentionCount` migrations catalogs for a
+ * prefix family. Mirrors Go's `pgcache.CleanupOldMigrationCatalogs` (`pgcache/cache.go`).
+ */
+export const legacyCleanupOldMigrationCatalogs = Effect.fnUntraced(function* (
+  fs: FileSystem.FileSystem,
+  path: Path.Path,
+  tempDir: string,
+  prefix: string,
+) {
+  yield* cleanupOldCatalogsByFamily(
+    fs,
+    path,
+    tempDir,
+    `catalog-${legacySanitizedCatalogPrefix(prefix)}-migrations-`,
+  );
+});
+
+/** `catalog-<prefix>-migrations-<hash>-<ts>.json` (Go's `migrationsCatalogName`, `pgcache/cache.go`). */
+export function legacyMigrationCatalogFileName(
+  prefix: string,
+  hash: string,
+  timestampMillis: number,
+): string {
+  return `catalog-${legacySanitizedCatalogPrefix(prefix)}-migrations-${hash}-${timestampMillis}.json`;
+}
+
+/**
+ * Writes a migrations-catalog snapshot to `<tempDir>/catalog-<prefix>-migrations-<hash>-<ts>.json`
+ * and prunes older snapshots for the same `(prefix)` family. Mirrors Go's
+ * `pgcache.WriteMigrationCatalogSnapshot` (`pgcache/cache.go`).
+ */
+export const legacyWriteMigrationCatalogSnapshot = Effect.fnUntraced(function* (
+  fs: FileSystem.FileSystem,
+  path: Path.Path,
+  tempDir: string,
+  prefix: string,
+  hash: string,
+  snapshot: string,
+  timestampMillis: number,
+) {
+  yield* fs.makeDirectory(tempDir, { recursive: true }).pipe(Effect.ignore);
+  const filePath = path.join(
+    tempDir,
+    legacyMigrationCatalogFileName(prefix, hash, timestampMillis),
+  );
+  yield* fs.writeFileString(filePath, snapshot);
+  yield* legacyCleanupOldMigrationCatalogs(fs, path, tempDir, prefix);
+  return filePath;
+});
+
+/**
+ * Best-effort caches the migrations catalog for pg-delta after a successful
+ * `db push` migration apply. Mirrors Go's `pgcache.TryCacheMigrationsCatalog`
+ * (`pgcache/cache.go`); `enabled` is resolved by the caller since it depends on
+ * already-loaded config. Reuses `legacyExportCatalogPgDelta` (Go's correct
+ * `diff/pgdelta.go` `ExportCatalogPgDelta`) rather than porting a second copy,
+ * so this can't reintroduce the `/workspace` mount bug `pgcache/cache.go` had
+ * (supabase/cli#5921).
+ */
+export const legacyTryCacheMigrationsCatalog = Effect.fnUntraced(function* (
+  fs: FileSystem.FileSystem,
+  path: Path.Path,
+  ctx: LegacyPgDeltaContext,
+  params: {
+    readonly enabled: boolean;
+    readonly targetUrl: string;
+    readonly conn: {
+      readonly host: string;
+      readonly port: number;
+      readonly user: string;
+      readonly database: string;
+    };
+    readonly isLocal: boolean;
+    readonly migrationsDir: string;
+    readonly nowMillis: number;
+  },
+) {
+  if (!params.enabled) return;
+  const prefix = legacyCatalogPrefixFromConfig(params.conn, params.isLocal);
+  const hash = yield* legacyHashMigrations(fs, path, ctx.cwd, params.migrationsDir);
+  const snapshot = yield* legacyExportCatalogPgDelta(ctx, {
+    targetRef: params.targetUrl,
+    role: "postgres",
+  });
+  yield* legacyWriteMigrationCatalogSnapshot(
+    fs,
+    path,
+    legacyPgDeltaTempPath(path, ctx.cwd),
+    prefix,
+    hash,
+    snapshot,
+    params.nowMillis,
+  );
+});
diff --git a/apps/cli/src/legacy/commands/db/shared/legacy-pgdelta.cache.unit.test.ts b/apps/cli/src/legacy/commands/db/shared/legacy-pgdelta.cache.unit.test.ts
index 9f2e57e3aa..83535b91c0 100644
--- a/apps/cli/src/legacy/commands/db/shared/legacy-pgdelta.cache.unit.test.ts
+++ b/apps/cli/src/legacy/commands/db/shared/legacy-pgdelta.cache.unit.test.ts
@@ -13,15 +13,19 @@ import {
   legacyBaselineCatalogFileName,
   legacyBaselineCatalogKey,
   legacyBaselineVersionToken,
+  legacyCatalogPrefixFromConfig,
   legacyCleanupOldDeclarativeCatalogs,
+  legacyCleanupOldMigrationCatalogs,
   legacyDeclarativeCatalogCacheKey,
   legacyDeclarativeCatalogFileName,
   legacyHashDeclarativeSchemas,
   legacyHashMigrations,
   legacyListLocalMigrations,
+  legacyMigrationCatalogFileName,
   legacyResolveDeclarativeCatalogPath,
   legacySanitizedCatalogPrefix,
   legacySetupInputsToken,
+  legacyWriteMigrationCatalogSnapshot,
 } from "./legacy-pgdelta.cache.ts";
 
 const BASE: LegacySetupInputs = {
@@ -216,25 +220,57 @@ describe("legacyListLocalMigrations", () => {
 });
 
 describe("legacyHashMigrations", () => {
-  it.effect("hashes path + contents in list order (stable, content-sensitive)", () => {
-    const dir = withTemp();
-    const migrationsDir = join(dir, "supabase", "migrations");
-    mkdirSync(migrationsDir, { recursive: true });
-    const file = join(migrationsDir, "20240101120000_create.sql");
-    writeFileSync(file, "create table x();");
-    const expected = createHash("sha256")
-      .update(file, "utf8")
-      .update(Buffer.from("create table x();"))
-      .digest("hex");
-    return withServices((fs, path) => legacyHashMigrations(fs, path, migrationsDir)).pipe(
-      Effect.tap((hash) =>
-        Effect.sync(() => {
-          expect(hash).toBe(expected);
-          rmSync(dir, { recursive: true, force: true });
+  it.effect(
+    "hashes the workdir-relative path + contents in list order (stable, content-sensitive)",
+    () => {
+      const dir = withTemp();
+      const migrationsDir = join(dir, "supabase", "migrations");
+      mkdirSync(migrationsDir, { recursive: true });
+      const file = join(migrationsDir, "20240101120000_create.sql");
+      writeFileSync(file, "create table x();");
+      const relPath = join("supabase", "migrations", "20240101120000_create.sql");
+      const expected = createHash("sha256")
+        .update(relPath, "utf8")
+        .update(Buffer.from("create table x();"))
+        .digest("hex");
+      return withServices((fs, path) => legacyHashMigrations(fs, path, dir, migrationsDir)).pipe(
+        Effect.tap((hash) =>
+          Effect.sync(() => {
+            expect(hash).toBe(expected);
+            rmSync(dir, { recursive: true, force: true });
+          }),
+        ),
+      );
+    },
+  );
+
+  it.effect(
+    "is unaffected by the absolute location of workdir (Go-parity, not machine-specific)",
+    () => {
+      const dirA = withTemp();
+      const dirB = withTemp();
+      const migrationsA = join(dirA, "supabase", "migrations");
+      const migrationsB = join(dirB, "supabase", "migrations");
+      mkdirSync(migrationsA, { recursive: true });
+      mkdirSync(migrationsB, { recursive: true });
+      writeFileSync(join(migrationsA, "20240101120000_create.sql"), "create table x();");
+      writeFileSync(join(migrationsB, "20240101120000_create.sql"), "create table x();");
+      return withServices((fs, path) =>
+        Effect.gen(function* () {
+          const hashA = yield* legacyHashMigrations(fs, path, dirA, migrationsA);
+          const hashB = yield* legacyHashMigrations(fs, path, dirB, migrationsB);
+          expect(hashA).toBe(hashB);
         }),
-      ),
-    );
-  });
+      ).pipe(
+        Effect.tap(() =>
+          Effect.sync(() => {
+            rmSync(dirA, { recursive: true, force: true });
+            rmSync(dirB, { recursive: true, force: true });
+          }),
+        ),
+      );
+    },
+  );
 });
 
 describe("legacyHashDeclarativeSchemas", () => {
@@ -281,7 +317,6 @@ describe("legacyResolveDeclarativeCatalogPath + cleanup", () => {
         const remaining = (yield* fs.readDirectory(tempDir)).filter((n) =>
           n.startsWith("catalog-local-declarative-"),
         );
-        // Retention keeps the 2 newest of the family (300, 200); 100 + other-50 pruned.
         expect(remaining.sort()).toEqual([
           "catalog-local-declarative-h-200.json",
           "catalog-local-declarative-h-300.json",
@@ -290,3 +325,119 @@ describe("legacyResolveDeclarativeCatalogPath + cleanup", () => {
     ).pipe(Effect.tap(() => Effect.sync(() => rmSync(dir, { recursive: true, force: true }))));
   });
 });
+
+describe("legacyCatalogPrefixFromConfig", () => {
+  const CONN = { host: "127.0.0.1", port: 5432, user: "postgres", database: "postgres" };
+
+  it("returns 'local' for a local database regardless of host", () => {
+    expect(legacyCatalogPrefixFromConfig(CONN, true)).toBe("local");
+  });
+
+  it("returns the project ref for a direct db.<ref>.supabase.{co,red} host", () => {
+    const ref = "abcdefghijklmnopqrst";
+    expect(legacyCatalogPrefixFromConfig({ ...CONN, host: `db.${ref}.supabase.co` }, false)).toBe(
+      ref,
+    );
+    expect(legacyCatalogPrefixFromConfig({ ...CONN, host: `db.${ref}.supabase.red` }, false)).toBe(
+      ref,
+    );
+  });
+
+  it("falls back to a stable url-<sha256[:12]> hash for anything else", () => {
+    const conn = {
+      host: "aws-0-us-east-1.pooler.supabase.com",
+      port: 6543,
+      user: "postgres.ref",
+      database: "postgres",
+    };
+    expect(legacyCatalogPrefixFromConfig(conn, false)).toBe(
+      `url-${sha12(`${conn.user}@${conn.host}:${conn.port}/${conn.database}`)}`,
+    );
+  });
+
+  it("does not match a host with the wrong ref length or a different TLD", () => {
+    const conn = { ...CONN, host: "db.tooshort.supabase.co" };
+    const digest = createHash("sha256")
+      .update(`${conn.user}@${conn.host}:${conn.port}/${conn.database}`, "utf8")
+      .digest("hex");
+    expect(legacyCatalogPrefixFromConfig(conn, false)).toBe(`url-${digest.slice(0, 12)}`);
+  });
+});
+
+describe("legacyMigrationCatalogFileName", () => {
+  it("formats catalog-<prefix>-migrations-<hash>-<ts>.json", () => {
+    expect(legacyMigrationCatalogFileName("local", "h", 1700)).toBe(
+      "catalog-local-migrations-h-1700.json",
+    );
+  });
+});
+
+describe("legacyWriteMigrationCatalogSnapshot + cleanup", () => {
+  it.effect(
+    "writes the snapshot and prunes older migrations catalogs past the retention count",
+    () => {
+      const dir = withTemp();
+      const tempDir = join(dir, "pgdelta");
+      mkdirSync(tempDir, { recursive: true });
+      for (const ts of [100, 300, 200]) {
+        writeFileSync(join(tempDir, `catalog-local-migrations-h-${ts}.json`), "{}");
+      }
+      return withServices((fs, path) =>
+        Effect.gen(function* () {
+          const filePath = yield* legacyWriteMigrationCatalogSnapshot(
+            fs,
+            path,
+            tempDir,
+            "local",
+            "h",
+            '{"snapshot":true}',
+            400,
+          );
+          expect(filePath.endsWith("catalog-local-migrations-h-400.json")).toBe(true);
+          expect(yield* fs.readFileString(filePath)).toBe('{"snapshot":true}');
+          const remaining = (yield* fs.readDirectory(tempDir)).filter((n) =>
+            n.startsWith("catalog-local-migrations-"),
+          );
+          expect(remaining.sort()).toEqual([
+            "catalog-local-migrations-h-300.json",
+            "catalog-local-migrations-h-400.json",
+          ]);
+        }),
+      ).pipe(Effect.tap(() => Effect.sync(() => rmSync(dir, { recursive: true, force: true }))));
+    },
+  );
+
+  it.effect("creates the temp dir when it doesn't exist yet", () => {
+    const dir = withTemp();
+    const tempDir = join(dir, "pgdelta");
+    return withServices((fs, path) =>
+      Effect.gen(function* () {
+        yield* legacyWriteMigrationCatalogSnapshot(fs, path, tempDir, "local", "h", "{}", 100);
+        expect(yield* fs.exists(join(tempDir, "catalog-local-migrations-h-100.json"))).toBe(true);
+      }),
+    ).pipe(Effect.tap(() => Effect.sync(() => rmSync(dir, { recursive: true, force: true }))));
+  });
+});
+
+describe("legacyCleanupOldMigrationCatalogs", () => {
+  it.effect("only prunes files matching the given prefix's family", () => {
+    const dir = withTemp();
+    const tempDir = join(dir, "pgdelta");
+    mkdirSync(tempDir, { recursive: true });
+    for (const ts of [100, 200, 300]) {
+      writeFileSync(join(tempDir, `catalog-local-migrations-h-${ts}.json`), "{}");
+    }
+    writeFileSync(join(tempDir, "catalog-other-migrations-h-50.json"), "{}");
+    return withServices((fs, path) =>
+      Effect.gen(function* () {
+        yield* legacyCleanupOldMigrationCatalogs(fs, path, tempDir, "local");
+        const remaining = (yield* fs.readDirectory(tempDir)).sort();
+        expect(remaining).toEqual([
+          "catalog-local-migrations-h-200.json",
+          "catalog-local-migrations-h-300.json",
+          "catalog-other-migrations-h-50.json",
+        ]);
+      }),
+    ).pipe(Effect.tap(() => Effect.sync(() => rmSync(dir, { recursive: true, force: true }))));
+  });
+});
diff --git a/apps/cli/src/legacy/commands/db/shared/legacy-pgdelta.deno-templates.ts b/apps/cli/src/legacy/commands/db/shared/legacy-pgdelta.deno-templates.ts
index e43e9828a8..5a6fb7060b 100644
--- a/apps/cli/src/legacy/commands/db/shared/legacy-pgdelta.deno-templates.ts
+++ b/apps/cli/src/legacy/commands/db/shared/legacy-pgdelta.deno-templates.ts
@@ -15,15 +15,15 @@
 
 /** `templates/pgdelta.ts` — diffs SOURCE→TARGET and prints SQL statements. */
 export const legacyPgDeltaDiffScript =
-  'import {\n  createPlan,\n  deserializeCatalog,\n  formatSqlStatements,\n} from "npm:@supabase/pg-delta@1.0.0-alpha.20";\nimport { supabase } from "npm:@supabase/pg-delta@1.0.0-alpha.20/integrations/supabase";\n\nasync function resolveInput(ref: string | undefined) {\n  if (!ref) {\n    return null;\n  }\n  if (ref.startsWith("postgres://") || ref.startsWith("postgresql://")) {\n    return ref;\n  }\n  const json = await Deno.readTextFile(ref);\n  return deserializeCatalog(JSON.parse(json));\n}\n\nconst source = Deno.env.get("SOURCE");\nconst target = Deno.env.get("TARGET");\n\nconst includedSchemas = Deno.env.get("INCLUDED_SCHEMAS");\nif (includedSchemas) {\n  const schemas = includedSchemas.split(",");\n  const schemaFilter = {\n    or: [{ "*/schema": schemas }, { "schema/name": schemas }],\n  };\n  // CompositionPattern `and` is valid FilterDSL; Deno\'s structural typing is strict on `or` branches.\n  supabase.filter = {\n    and: [supabase.filter!, schemaFilter],\n  } as typeof supabase.filter;\n}\n\nconst formatOptionsRaw = Deno.env.get("FORMAT_OPTIONS");\nlet formatOptions = undefined;\nif (formatOptionsRaw) {\n  formatOptions = JSON.parse(formatOptionsRaw);\n}\n\ntry {\n  const result = await createPlan(\n    await resolveInput(source),\n    await resolveInput(target),\n    {\n      ...supabase,\n      skipDefaultPrivilegeSubtraction: true,\n    },\n  );\n  let statements = result?.plan.statements ?? [];\n  if (formatOptions != null) {\n    statements = formatSqlStatements(statements, formatOptions);\n  }\n  if (Deno.env.get("PGDELTA_DEBUG")) {\n    console.error(\n      JSON.stringify({\n        statementCount: statements.length,\n        source: source ? "connected" : "null",\n        target: target ? "connected" : "null",\n        includedSchemas: includedSchemas ?? null,\n        skipDefaultPrivilegeSubtraction: true,\n      }),\n    );\n  }\n  for (const sql of statements) {\n    console.log(`${sql};`);\n  }\n} catch (e) {\n  console.error(e);\n  // Force close event loop\n  throw new Error("");\n}\n// Force close the event loop on the success path too. When SOURCE/TARGET are\n// live database URLs the plan opens connections whose keepalive handles can keep\n// the Edge Runtime worker alive after the diff has been written, so the container\n// never exits and the CLI — which follows this container\'s logs — hangs\n// indefinitely at 0% CPU (supabase/pg-toolbelt#312).\nthrow new Error("");\n';
+  'import {\n  createPlan,\n  deserializeCatalog,\n  renderPlanFiles,\n} from "npm:@supabase/pg-delta@1.0.0-alpha.20";\nimport { supabase } from "npm:@supabase/pg-delta@1.0.0-alpha.20/integrations/supabase";\n\nasync function resolveInput(ref: string | undefined) {\n  if (!ref) {\n    return null;\n  }\n  if (ref.startsWith("postgres://") || ref.startsWith("postgresql://")) {\n    return ref;\n  }\n  const json = await Deno.readTextFile(ref);\n  return deserializeCatalog(JSON.parse(json));\n}\n\nconst source = Deno.env.get("SOURCE");\nconst target = Deno.env.get("TARGET");\n\nconst includedSchemas = Deno.env.get("INCLUDED_SCHEMAS");\nif (includedSchemas) {\n  const schemas = includedSchemas.split(",");\n  const schemaFilter = {\n    or: [{ "*/schema": schemas }, { "schema/name": schemas }],\n  };\n  // CompositionPattern `and` is valid FilterDSL; Deno\'s structural typing is strict on `or` branches.\n  supabase.filter = {\n    and: [supabase.filter!, schemaFilter],\n  } as typeof supabase.filter;\n}\n\nconst formatOptionsRaw = Deno.env.get("FORMAT_OPTIONS");\nconst parsedFormatOptions = formatOptionsRaw ? JSON.parse(formatOptionsRaw) : undefined;\n// Format the emitted SQL by default with the same sensible settings the\n// declarative export uses (`exportDeclarativeSchema` in @supabase/pg-delta:\n// `{ ...DEFAULT_OPTIONS, maxWidth: 180, keywordCase: "upper", ...userOptions }`),\n// so `db pull` / `db diff` produce readable migrations even when config sets no\n// `[experimental.pgdelta] format_options`. The formatter fills DEFAULT_OPTIONS\n// for missing keys itself, so only the two overrides are passed here. Setting\n// `format_options = "null"` (parsed to `null`) is the explicit opt-out: raw,\n// unformatted statements, mirroring declarative export\'s `formatOptions === null`.\nconst sqlFormatOptions =\n  parsedFormatOptions === null\n    ? undefined\n    : { maxWidth: 180, keywordCase: "upper", ...parsedFormatOptions };\n\ntry {\n  const result = await createPlan(\n    await resolveInput(source),\n    await resolveInput(target),\n    {\n      ...supabase,\n      skipDefaultPrivilegeSubtraction: true,\n    },\n  );\n  // pg-delta >= 1.0.0-alpha.32 groups plan statements into execution-aware\n  // `units` with transaction boundaries. `renderPlanFiles` turns those into one\n  // numbered SQL file per unit (header comments included). `includeTransactions:\n  // false` because the CLI appliers already wrap each migration file in a single\n  // transaction (Go\'s implicit ExecBatch / the TS BEGIN/COMMIT wrap), so embedded\n  // BEGIN/COMMIT would nest; format options are applied per unit here instead of a\n  // manual `formatSqlStatements` pass.\n  const files = result\n    ? renderPlanFiles(result.plan, {\n        includeTransactions: false,\n        sqlFormatOptions,\n      })\n    : [];\n  const envelope = files.map((file, index) => ({\n    order: index + 1,\n    // The unit name is the rendered path minus its numeric prefix and `.sql`\n    // extension (e.g. `001_after_enum_values.sql` -> `after_enum_values`).\n    name: file.path.replace(/^\\d+_/, "").replace(/\\.sql$/, ""),\n    transactionMode: file.unit.transactionMode,\n    sql: file.sql,\n  }));\n  if (Deno.env.get("PGDELTA_DEBUG")) {\n    console.error(\n      JSON.stringify({\n        statementCount: files.reduce((total, file) => total + file.unit.statements.length, 0),\n        fileCount: files.length,\n        source: source ? "connected" : "null",\n        target: target ? "connected" : "null",\n        includedSchemas: includedSchemas ?? null,\n        skipDefaultPrivilegeSubtraction: true,\n      }),\n    );\n  }\n  console.log(JSON.stringify({ version: 1, files: envelope }));\n} catch (e) {\n  console.error(e);\n  // Emit a sentinel so the CLI runner can distinguish a real script crash from a\n  // successful empty diff, even though the forced-exit non-zero code below is\n  // suppressed by the "main worker has been destroyed" handling.\n  console.error("PGDELTA_SCRIPT_ERROR");\n  // Force close event loop\n  throw new Error("");\n}\n// Force close the event loop on the success path too. When SOURCE/TARGET are\n// live database URLs the plan opens connections whose keepalive handles can keep\n// the Edge Runtime worker alive after the diff has been written, so the container\n// never exits and the CLI — which follows this container\'s logs — hangs\n// indefinitely at 0% CPU (supabase/pg-toolbelt#312).\nthrow new Error("");\n';
 
 /** `templates/pgdelta_declarative_export.ts` — exports declarative file payloads. */
 export const legacyPgDeltaDeclarativeExportScript =
-  '// This script is executed inside Edge Runtime by the CLI to export a target\n// schema as declarative file payloads. It accepts either live DB URLs or\n// catalog-file references for SOURCE/TARGET, which enables cached sync flows.\nimport {\n  createPlan,\n  deserializeCatalog,\n  exportDeclarativeSchema,\n} from "npm:@supabase/pg-delta@1.0.0-alpha.20";\nimport { supabase } from "npm:@supabase/pg-delta@1.0.0-alpha.20/integrations/supabase";\n\nasync function resolveInput(ref: string | undefined) {\n  if (!ref) {\n    return null;\n  }\n  if (ref.startsWith("postgres://") || ref.startsWith("postgresql://")) {\n    return ref;\n  }\n  const json = await Deno.readTextFile(ref);\n  return deserializeCatalog(JSON.parse(json));\n}\n\nconst source = Deno.env.get("SOURCE");\nconst target = Deno.env.get("TARGET");\n\nconst includedSchemas = Deno.env.get("INCLUDED_SCHEMAS");\nif (includedSchemas) {\n  const schemas = includedSchemas.split(",");\n  const schemaFilter = {\n    or: [{ "*/schema": schemas }, { "schema/name": schemas }],\n  };\n  supabase.filter = {\n    and: [supabase.filter!, schemaFilter],\n  } as unknown as typeof supabase.filter;\n}\n\nconst formatOptionsRaw = Deno.env.get("FORMAT_OPTIONS");\nlet formatOptions = undefined;\nif (formatOptionsRaw) {\n  formatOptions = JSON.parse(formatOptionsRaw);\n}\ntry {\n  const result = await createPlan(\n    await resolveInput(source),\n    await resolveInput(target),\n    {\n      ...supabase,\n      skipDefaultPrivilegeSubtraction: true,\n    },\n  );\n  if (!result) {\n    console.log(\n      JSON.stringify({\n        version: 1,\n        mode: "declarative",\n        files: [],\n      }),\n    );\n  } else {\n    const output = exportDeclarativeSchema(result, {\n      integration: supabase,\n      formatOptions,\n    });\n    console.log(\n      JSON.stringify(output, (_key, value) =>\n        typeof value === "bigint" ? Number(value) : value,\n      ),\n    );\n  }\n} catch (e) {\n  console.error(e);\n  // Force close event loop\n  throw new Error("");\n}\n// Force close the event loop on the success path too. When SOURCE/TARGET are\n// live database URLs the plan opens connections whose keepalive handles can keep\n// the Edge Runtime worker alive after the export has been written, so the\n// container never exits and the CLI — which follows this container\'s logs —\n// hangs indefinitely at 0% CPU (supabase/pg-toolbelt#312).\nthrow new Error("");\n';
+  '// This script is executed inside Edge Runtime by the CLI to export a target\n// schema as declarative file payloads. It accepts either live DB URLs or\n// catalog-file references for SOURCE/TARGET, which enables cached sync flows.\nimport {\n  createPlan,\n  deserializeCatalog,\n  exportDeclarativeSchema,\n} from "npm:@supabase/pg-delta@1.0.0-alpha.20";\nimport { supabase } from "npm:@supabase/pg-delta@1.0.0-alpha.20/integrations/supabase";\n\nasync function resolveInput(ref: string | undefined) {\n  if (!ref) {\n    return null;\n  }\n  if (ref.startsWith("postgres://") || ref.startsWith("postgresql://")) {\n    return ref;\n  }\n  const json = await Deno.readTextFile(ref);\n  return deserializeCatalog(JSON.parse(json));\n}\n\nconst source = Deno.env.get("SOURCE");\nconst target = Deno.env.get("TARGET");\n\nconst includedSchemas = Deno.env.get("INCLUDED_SCHEMAS");\nif (includedSchemas) {\n  const schemas = includedSchemas.split(",");\n  const schemaFilter = {\n    or: [{ "*/schema": schemas }, { "schema/name": schemas }],\n  };\n  supabase.filter = {\n    and: [supabase.filter!, schemaFilter],\n  } as unknown as typeof supabase.filter;\n}\n\nconst formatOptionsRaw = Deno.env.get("FORMAT_OPTIONS");\nlet formatOptions = undefined;\nif (formatOptionsRaw) {\n  formatOptions = JSON.parse(formatOptionsRaw);\n}\ntry {\n  const result = await createPlan(\n    await resolveInput(source),\n    await resolveInput(target),\n    {\n      ...supabase,\n      skipDefaultPrivilegeSubtraction: true,\n    },\n  );\n  if (!result) {\n    console.log(\n      JSON.stringify({\n        version: 1,\n        mode: "declarative",\n        files: [],\n      }),\n    );\n  } else {\n    const output = exportDeclarativeSchema(result, {\n      integration: supabase,\n      formatOptions,\n    });\n    console.log(\n      JSON.stringify(output, (_key, value) =>\n        typeof value === "bigint" ? Number(value) : value,\n      ),\n    );\n  }\n} catch (e) {\n  console.error(e);\n  // Emit a sentinel so the CLI runner can distinguish a real script crash from a\n  // successful empty export, even though the forced-exit non-zero code below is\n  // suppressed by the "main worker has been destroyed" handling.\n  console.error("PGDELTA_SCRIPT_ERROR");\n  // Force close event loop\n  throw new Error("");\n}\n// Force close the event loop on the success path too. When SOURCE/TARGET are\n// live database URLs the plan opens connections whose keepalive handles can keep\n// the Edge Runtime worker alive after the export has been written, so the\n// container never exits and the CLI — which follows this container\'s logs —\n// hangs indefinitely at 0% CPU (supabase/pg-toolbelt#312).\nthrow new Error("");\n';
 
 /** `templates/pgdelta_catalog_export.ts` — serializes a catalog snapshot for caching. */
 export const legacyPgDeltaCatalogExportScript =
-  '// This script serializes a database catalog for caching/reuse in declarative\n// sync workflows, so later diff/export operations can run from file references.\nimport {\n  createManagedPool,\n  extractCatalog,\n  serializeCatalog,\n  stringifyCatalogSnapshot,\n} from "npm:@supabase/pg-delta@1.0.0-alpha.20";\n\nconst target = Deno.env.get("TARGET");\nconst role = Deno.env.get("ROLE") ?? undefined;\n\nif (!target) {\n  console.error("TARGET is required");\n  throw new Error("");\n}\nconst { pool, close } = await createManagedPool(target, { role });\n\ntry {\n  const catalog = await extractCatalog(pool);\n  console.log(stringifyCatalogSnapshot(serializeCatalog(catalog)));\n} catch (e) {\n  console.error(e);\n  // Force close event loop\n  throw new Error("");\n} finally {\n  await close();\n}\n// Force close the event loop on the success path too. The connection pool can\n// leave keepalive handles registered even after close() resolves, which keeps\n// the Edge Runtime worker (and therefore the container) alive after the catalog\n// has already been written to stdout. The CLI streams this container\'s logs with\n// Follow:true, so a worker that never exits hangs the parent `__catalog`\n// subprocess — and the declarative-sync command that spawned it — indefinitely\n// at 0% CPU (supabase/pg-toolbelt#312).\nthrow new Error("");\n';
+  '// This script serializes a database catalog for caching/reuse in declarative\n// sync workflows, so later diff/export operations can run from file references.\nimport {\n  createManagedPool,\n  extractCatalog,\n  serializeCatalog,\n  stringifyCatalogSnapshot,\n} from "npm:@supabase/pg-delta@1.0.0-alpha.20";\n\nconst target = Deno.env.get("TARGET");\nconst role = Deno.env.get("ROLE") ?? undefined;\n\nif (!target) {\n  console.error("TARGET is required");\n  // Emit a sentinel so the CLI runner treats this as a real script crash rather\n  // than a successful empty catalog, even though the forced-exit non-zero code is\n  // suppressed by the "main worker has been destroyed" handling.\n  console.error("PGDELTA_SCRIPT_ERROR");\n  throw new Error("");\n}\nconst { pool, close } = await createManagedPool(target, { role });\n\ntry {\n  const catalog = await extractCatalog(pool);\n  console.log(stringifyCatalogSnapshot(serializeCatalog(catalog)));\n} catch (e) {\n  console.error(e);\n  // Emit a sentinel so the CLI runner can distinguish a real script crash from a\n  // successful empty catalog, even though the forced-exit non-zero code below is\n  // suppressed by the "main worker has been destroyed" handling.\n  console.error("PGDELTA_SCRIPT_ERROR");\n  // Force close event loop\n  throw new Error("");\n} finally {\n  await close();\n}\n// Force close the event loop on the success path too. The connection pool can\n// leave keepalive handles registered even after close() resolves, which keeps\n// the Edge Runtime worker (and therefore the container) alive after the catalog\n// has already been written to stdout. The CLI streams this container\'s logs with\n// Follow:true, so a worker that never exits hangs the parent `__catalog`\n// subprocess — and the declarative-sync command that spawned it — indefinitely\n// at 0% CPU (supabase/pg-toolbelt#312).\nthrow new Error("");\n';
 
 /** `internal/pgdelta/templates/pgdelta_declarative_apply.ts` — applies declarative files to TARGET. */
 export const legacyPgDeltaDeclarativeApplyScript =
@@ -35,7 +35,7 @@ export const legacyPgDeltaDeclarativeApplyScript =
  * config field) is absent or empty. Mirrors Go's `DefaultPgDeltaNpmVersion`
  * (`apps/cli-go/pkg/config/pgdelta_version.go:7`).
  */
-export const LEGACY_DEFAULT_PG_DELTA_NPM_VERSION = "1.0.0-alpha.27";
+export const LEGACY_DEFAULT_PG_DELTA_NPM_VERSION = "1.0.0-alpha.32";
 
 /**
  * The literal version baked into the embedded templates above, replaced by
diff --git a/apps/cli/src/legacy/commands/db/shared/legacy-pgdelta.errors.ts b/apps/cli/src/legacy/commands/db/shared/legacy-pgdelta.errors.ts
index b52d173fbe..6e12afd324 100644
--- a/apps/cli/src/legacy/commands/db/shared/legacy-pgdelta.errors.ts
+++ b/apps/cli/src/legacy/commands/db/shared/legacy-pgdelta.errors.ts
@@ -48,6 +48,15 @@ export class LegacyDeclarativeParseOutputError extends Data.TaggedError(
   readonly message: string;
 }> {}
 
+/**
+ * Parsing the pg-delta diff envelope failed. Byte-matches Go's
+ * `"failed to parse pg-delta diff output: " + err + ":\n" + stderr`
+ * (`apps/cli-go/internal/db/diff/pgdelta.go`, `parsePgDeltaDiffOutput`).
+ */
+export class LegacyPgDeltaDiffParseError extends Data.TaggedError("LegacyPgDeltaDiffParseError")<{
+  readonly message: string;
+}> {}
+
 /**
  * Materializing the declarative export on disk failed. Byte-matches Go's
  * `WriteDeclarativeSchemas` errors (`declarative.go:239`):
diff --git a/apps/cli/src/legacy/commands/db/shared/legacy-pgdelta.integration.test.ts b/apps/cli/src/legacy/commands/db/shared/legacy-pgdelta.integration.test.ts
index f6c816c461..c64f9f624a 100644
--- a/apps/cli/src/legacy/commands/db/shared/legacy-pgdelta.integration.test.ts
+++ b/apps/cli/src/legacy/commands/db/shared/legacy-pgdelta.integration.test.ts
@@ -58,7 +58,20 @@ describe("legacyDiffPgDelta", () => {
   it.effect(
     "returns the SQL + stderr and passes the interpolated diff script + env + binds",
     () => {
-      const edge = fakeEdgeRuntime({ stdout: "ALTER TABLE x;\n", stderr: "warn" });
+      const edge = fakeEdgeRuntime({
+        stdout: JSON.stringify({
+          version: 1,
+          files: [
+            {
+              order: 1,
+              name: "schema_changes",
+              transactionMode: "transactional",
+              sql: "-- unit 1\n\nALTER TABLE x;",
+            },
+          ],
+        }),
+        stderr: "warn",
+      });
       return legacyDiffPgDelta(CTX, {
         targetRef: "postgresql://u:p@127.0.0.1:54320/postgres?connect_timeout=10",
         sourceRef: "supabase/.temp/catalog.json",
@@ -67,7 +80,10 @@ describe("legacyDiffPgDelta", () => {
       }).pipe(
         Effect.tap((result) =>
           Effect.sync(() => {
-            expect(result.sql).toBe("ALTER TABLE x;\n");
+            // The envelope is parsed into per-unit files and a flattened SQL join.
+            expect(result.sql).toBe("-- unit 1\n\nALTER TABLE x;");
+            expect(result.files).toHaveLength(1);
+            expect(result.files[0]?.name).toBe("schema_changes");
             expect(result.stderr).toBe("warn");
             const opts = edge.calls[0]!;
             expect(opts.errPrefix).toBe("error diffing schema");
@@ -139,6 +155,27 @@ describe("legacyDiffPgDelta", () => {
       Effect.provide(Layer.mergeAll(edge.layer, probe, BunServices.layer)),
     );
   });
+
+  it.effect("fails with LegacyPgDeltaDiffParseError on a malformed envelope", () => {
+    const edge = fakeEdgeRuntime({ stdout: "not json{", stderr: "boom" });
+    return legacyDiffPgDelta(CTX, {
+      targetRef: "postgresql://t",
+      sourceRef: "",
+      schema: [],
+      formatOptions: "",
+    }).pipe(
+      Effect.exit,
+      Effect.tap((exit) =>
+        Effect.sync(() => {
+          expect(failError(exit)?.constructor.name).toBe("LegacyPgDeltaDiffParseError");
+          const message = (failError(exit) as { message: string }).message;
+          expect(message).toContain("failed to parse pg-delta diff output");
+          expect(message).toContain("boom");
+        }),
+      ),
+      Effect.provide(Layer.mergeAll(edge.layer, probe, BunServices.layer)),
+    );
+  });
 });
 
 describe("legacyDeclarativeExportPgDelta", () => {
diff --git a/apps/cli/src/legacy/commands/db/shared/legacy-pgdelta.seam.layer.ts b/apps/cli/src/legacy/commands/db/shared/legacy-pgdelta.seam.layer.ts
index 634c4c7b56..6a52434c89 100644
--- a/apps/cli/src/legacy/commands/db/shared/legacy-pgdelta.seam.layer.ts
+++ b/apps/cli/src/legacy/commands/db/shared/legacy-pgdelta.seam.layer.ts
@@ -209,9 +209,11 @@ export const legacyDeclarativeSeamLayer = Layer.effect(
                 })(),
               )
               .trim();
-            // Only a missing container means "not running" → start it. Any other
-            // inspect failure (e.g. Docker daemon down) propagates, matching Go.
-            if (!stderr.includes("No such container")) {
+            // Only a missing container means "not running" → start it. Docker reports
+            // this as either "No such container" or "No such object" (the same pair
+            // handled in `shared/functions/serve.ts`). Any other inspect failure (e.g.
+            // Docker daemon down) propagates, matching Go.
+            if (!stderr.includes("No such container") && !stderr.includes("No such object")) {
               return yield* Effect.fail(
                 new LegacyDeclarativeShadowDbError({
                   message:
@@ -503,6 +505,13 @@ export const legacyDeclarativeSeamLayer = Layer.effect(
   }),
 );
 
+// Intentionally NOT `LegacyGoChildExitError` (contrast `legacy-db-bootstrap.seam.layer.ts`,
+// fixed under CLI-1879): this seam's failure is a TS-authored domain summary over noisy
+// docker/pgdelta child stderr, not a passthrough of a real Go-CLI child the user invoked
+// directly — Go itself wraps every shadow-DB failure into a generic error that `cmd/root.go`'s
+// `recoverAndExit` exits `1` for, so propagating THIS child's exact exit code would itself
+// diverge from Go, and suppressing this message (as `LegacyGoChildExitError` does for its own,
+// already-detailed child stderr) would drop the only actionable line the user sees.
 const failure = (exitCode?: number) =>
   new LegacyDeclarativeShadowDbError({
     message:
diff --git a/apps/cli/src/legacy/commands/db/shared/legacy-pgdelta.ts b/apps/cli/src/legacy/commands/db/shared/legacy-pgdelta.ts
index a7b49c230d..4dc3de042f 100644
--- a/apps/cli/src/legacy/commands/db/shared/legacy-pgdelta.ts
+++ b/apps/cli/src/legacy/commands/db/shared/legacy-pgdelta.ts
@@ -19,6 +19,7 @@ import {
   LegacyDeclarativeEdgeRuntimeError,
   LegacyDeclarativeEmptyOutputError,
   LegacyDeclarativeParseOutputError,
+  LegacyPgDeltaDiffParseError,
 } from "./legacy-pgdelta.errors.ts";
 
 const PG_DELTA_NPM_REGISTRY_ENV = "PGDELTA_NPM_REGISTRY";
@@ -38,9 +39,32 @@ export interface LegacyDeclarativeOutput {
   readonly files: ReadonlyArray<LegacyDeclarativeFile>;
 }
 
-/** Result of a pg-delta diff: the SQL statements plus edge-runtime stderr. */
+/**
+ * One execution-aware migration unit from a pg-delta diff plan. Mirrors Go's
+ * `PgDeltaPlanFile` (`internal/db/diff/pgdelta.go`): a numbered SQL file whose
+ * header comments record the unit number, transaction mode and boundary reason.
+ */
+interface LegacyPgDeltaPlanFile {
+  readonly order: number;
+  readonly name: string;
+  readonly transactionMode: string;
+  readonly sql: string;
+}
+
+/** The pg-delta diff envelope. Mirrors Go's `PgDeltaDiffOutput`. */
+interface LegacyPgDeltaDiffOutput {
+  readonly version: number;
+  readonly files: ReadonlyArray<LegacyPgDeltaPlanFile>;
+}
+
+/**
+ * Result of a pg-delta diff: the per-unit plan `files`, a `sql` flattening of
+ * them (kept for `db diff` / declarative callers that consume one blob), and the
+ * edge-runtime `stderr`.
+ */
 interface LegacyPgDeltaDiffResult {
   readonly sql: string;
+  readonly files: ReadonlyArray<LegacyPgDeltaPlanFile>;
   readonly stderr: string;
 }
 
@@ -189,7 +213,27 @@ export const legacyDiffPgDelta = Effect.fnUntraced(function* (
       denoVersion: ctx.denoVersion,
     })
     .pipe(Effect.mapError(toDeclarativeEdgeRuntimeError));
-  return { sql: result.stdout, stderr: result.stderr } satisfies LegacyPgDeltaDiffResult;
+  // The template always prints the diff envelope on the success path, even for an
+  // empty plan (`{"version":1,"files":[]}`); a truly empty stdout means no envelope
+  // was produced, which we surface as "no changes" rather than a parse error.
+  // Mirrors Go's `parsePgDeltaDiffOutput` (`internal/db/diff/pgdelta.go`).
+  if (result.stdout.trim().length === 0) {
+    return { sql: "", files: [], stderr: result.stderr } satisfies LegacyPgDeltaDiffResult;
+  }
+  const envelope = yield* Effect.try({
+    try: () => JSON.parse(result.stdout) as LegacyPgDeltaDiffOutput,
+    catch: (cause) =>
+      new LegacyPgDeltaDiffParseError({
+        message: `failed to parse pg-delta diff output: ${
+          cause instanceof Error ? cause.message : String(cause)
+        }:\n${result.stderr}`,
+      }),
+  });
+  const files = envelope.files ?? [];
+  // Flatten to one blob for callers that need it; unit header comments keep the
+  // transaction boundaries visible (mirrors Go's `joinPgDeltaFiles`).
+  const sql = files.map((file) => file.sql).join("\n\n");
+  return { sql, files, stderr: result.stderr } satisfies LegacyPgDeltaDiffResult;
 });
 
 /**
diff --git a/apps/cli/src/legacy/commands/db/shared/legacy-seed-ops.ts b/apps/cli/src/legacy/commands/db/shared/legacy-seed-ops.ts
new file mode 100644
index 0000000000..2617aee0c3
--- /dev/null
+++ b/apps/cli/src/legacy/commands/db/shared/legacy-seed-ops.ts
@@ -0,0 +1,314 @@
+import { createHash } from "node:crypto";
+import { Effect, type FileSystem, Option, type Path } from "effect";
+
+import { Output } from "../../../../shared/output/output.service.ts";
+import type { LegacyDbExecError } from "../../../shared/legacy-db-connection.errors.ts";
+import type { LegacyDbSession } from "../../../shared/legacy-db-connection.service.ts";
+import { legacyCreateSeedTable } from "../../../shared/legacy-migration-history.ts";
+import { LEGACY_BAD_PATTERN_MESSAGE, legacyPathMatch } from "../../../shared/legacy-path-match.ts";
+import { legacySplitAndTrim } from "../../../shared/legacy-sql-split.ts";
+
+/**
+ * Seed-history DML, verbatim from Go's `pkg/migration/history.go`. The schema/table
+ * DDL (with a transaction-scoped lock timeout) lives in `legacyCreateSeedTable`.
+ */
+const UPSERT_SEED_FILE =
+  "INSERT INTO supabase_migrations.seed_files(path, hash) VALUES($1, $2) ON CONFLICT (path) DO UPDATE SET hash = EXCLUDED.hash";
+const SELECT_SEED_TABLE = "SELECT path, hash FROM supabase_migrations.seed_files";
+
+/** A local seed file resolved from `[db.seed].sql_paths`, with its content hash. */
+export interface LegacySeedFile {
+  /** Workdir-relative, forward-slashed path (Go's `filepath.ToSlash`). */
+  readonly path: string;
+  /** Lowercase hex SHA-256 of the file content (Go's `NewSeedFile`). */
+  readonly hash: string;
+  /** True when the remote `seed_files` row has a different hash (re-hash only). */
+  readonly dirty: boolean;
+}
+
+const META_CHARS = /[*?[\\]/u;
+
+/** Result of resolving `[db.seed].sql_paths` against the workspace. */
+interface LegacyGlobResult {
+  /** Workdir-relative, forward-slashed matches, deduplicated in pattern order. */
+  readonly files: ReadonlyArray<string>;
+  /** Per-pattern warnings (`no files matched pattern: …`), joined by Go's `errors.Join`. */
+  readonly warning: Option.Option<string>;
+}
+
+/**
+ * Resolves seed glob patterns to existing files, porting Go's `config.Glob.Files`
+ * over `fs.Glob` (`pkg/config/config.go:102-124`). Each pattern is first joined
+ * under the `supabase/` directory (Go resolves `sql_paths` at config load,
+ * `config.go:884`). Matches per pattern are sorted; the overall result preserves
+ * first-seen order across patterns. A pattern that matches nothing, or is malformed
+ * (Go's `path.ErrBadPattern`, e.g. an unterminated `[` class), contributes a warning
+ * but is not fatal — mirroring `fs.Glob`'s up-front `Match(pattern, "")` validation
+ * (`io/fs/glob.go`) and the sibling seed pipeline's `legacy-seed.ts:resolveSeedFiles`.
+ */
+const legacyGlobSeedFiles = Effect.fnUntraced(function* (
+  fs: FileSystem.FileSystem,
+  path: Path.Path,
+  patterns: ReadonlyArray<string>,
+  workdir: string,
+) {
+  const seen = new Set<string>();
+  const files: Array<string> = [];
+  const errors: Array<string> = [];
+
+  for (const rawPattern of patterns) {
+    // Patterns arrive already resolved to Go's config-load form (relative entries
+    // supabase/-joined, absolute preserved) via `legacyResolveSeedSqlPath` — the reader
+    // for `[db.seed].sql_paths`, the caller for `--sql-paths`. Go's `config.Glob.Files`
+    // globs those resolved paths without re-prefixing (`config.go:102-124`), so only
+    // normalize separators here; re-joining `supabase/` would double-prefix.
+    const pattern = toSlash(rawPattern);
+    // Go's `fs.Glob` validates the whole pattern up front (`Match(pattern, "")`); a
+    // malformed glob is reported as `failed to glob files: <ErrBadPattern>` and
+    // contributes no matches, rather than the misleading "no files matched" below.
+    if (legacyPathMatch(pattern, "").badPattern) {
+      errors.push(`failed to glob files: ${LEGACY_BAD_PATTERN_MESSAGE}`);
+      continue;
+    }
+    const matches = yield* globOne(fs, path, workdir, pattern);
+    if (matches.length === 0) {
+      errors.push(`no files matched pattern: ${pattern}`);
+      continue;
+    }
+    for (const match of [...matches].sort()) {
+      const fp = toSlash(match);
+      // Go's `GetPendingSeeds` globs via `Glob.SQLFiles`, which `Stat`s each match: a
+      // directory is expanded to its regular `.sql` files recursively (`walkMatchedDir`,
+      // sorted) while a file match is kept verbatim (`config.go:157-183`). Without this a
+      // directory `sql_paths` entry (e.g. `["seeds"]`) would flow into
+      // `readFileString(<dir>)` and fail — Go's `db push --include-seed` / remote reset
+      // seed the directory's SQL children instead.
+      const matchType = yield* fs.stat(path.isAbsolute(fp) ? fp : path.join(workdir, fp)).pipe(
+        Effect.map((info) => info.type),
+        Effect.orElseSucceed(() => "File" as const),
+      );
+      if (matchType === "Directory") {
+        for (const file of yield* legacyWalkSeedSqlFiles(fs, path, workdir, fp)) {
+          if (!seen.has(file)) {
+            seen.add(file);
+            files.push(file);
+          }
+        }
+        continue;
+      }
+      if (!seen.has(fp)) {
+        seen.add(fp);
+        files.push(fp);
+      }
+    }
+  }
+
+  return {
+    files,
+    warning: errors.length > 0 ? Option.some(errors.join("\n")) : Option.none(),
+  } satisfies LegacyGlobResult;
+});
+
+const toSlash = (p: string): string => p.replaceAll("\\", "/");
+
+/** Splits a forward-slashed path into its directory prefix and final element. */
+const splitPath = (p: string): { readonly dir: string; readonly file: string } => {
+  const slash = p.lastIndexOf("/");
+  return slash === -1 ? { dir: "", file: p } : { dir: p.slice(0, slash), file: p.slice(slash + 1) };
+};
+
+/** Faithful port of Go's `fs.Glob` for one pattern, rooted at `workdir`. */
+const globOne = (
+  fs: FileSystem.FileSystem,
+  path: Path.Path,
+  workdir: string,
+  pattern: string,
+): Effect.Effect<ReadonlyArray<string>, never> =>
+  Effect.gen(function* () {
+    // Absolute patterns resolve against the filesystem root (Go preserves absolute
+    // seed paths); relative ones are rooted at the workdir.
+    const resolve = (p: string): string => (path.isAbsolute(p) ? p : path.join(workdir, p));
+    // No metacharacters: a direct existence check (Go's `fs.Glob` fast path).
+    if (!META_CHARS.test(pattern)) {
+      const exists = yield* fs.exists(resolve(pattern)).pipe(Effect.orElseSucceed(() => false));
+      return exists ? [pattern] : [];
+    }
+    const { dir, file } = splitPath(pattern);
+    // Resolve the directory level first (recursively if it, too, is a glob).
+    const dirs =
+      dir === "" || !META_CHARS.test(dir) ? [dir] : yield* globOne(fs, path, workdir, dir);
+    const result: Array<string> = [];
+    for (const d of dirs) {
+      const absDir = d === "" ? workdir : resolve(d);
+      const names = yield* fs
+        .readDirectory(absDir)
+        .pipe(Effect.orElseSucceed((): ReadonlyArray<string> => []));
+      for (const name of names) {
+        if (legacyPathMatch(file, name).matched) {
+          result.push(d === "" ? name : `${d}/${name}`);
+        }
+      }
+    }
+    return result;
+  });
+
+/**
+ * Recursively collects the regular `.sql` files under a matched seed directory, porting
+ * Go's `walkMatchedDir` with the `SQLFiles` include filter (`entry.Type().IsRegular() &&
+ * filepath.Ext(path) == ".sql"`, `config.go:126-131,194-211`). Paths are workdir-relative
+ * (matching the glob output), forward-slashed, and sorted for deterministic application.
+ */
+const legacyWalkSeedSqlFiles = (
+  fs: FileSystem.FileSystem,
+  path: Path.Path,
+  workdir: string,
+  dir: string,
+): Effect.Effect<ReadonlyArray<string>, never> =>
+  Effect.gen(function* () {
+    const collected: Array<string> = [];
+    const walk = (rel: string): Effect.Effect<void, never> =>
+      Effect.gen(function* () {
+        const absDir = path.isAbsolute(rel) ? rel : path.join(workdir, rel);
+        const names = yield* fs
+          .readDirectory(absDir)
+          .pipe(Effect.orElseSucceed((): ReadonlyArray<string> => []));
+        for (const name of names) {
+          const childRel = `${rel}/${name}`;
+          const childType = yield* fs
+            .stat(path.isAbsolute(childRel) ? childRel : path.join(workdir, childRel))
+            .pipe(
+              Effect.map((info) => info.type),
+              Effect.orElseSucceed(() => "Unknown" as const),
+            );
+          if (childType === "Directory") {
+            yield* walk(childRel);
+          } else if (childType === "File" && childRel.endsWith(".sql")) {
+            collected.push(toSlash(childRel));
+          }
+        }
+      });
+    yield* walk(dir);
+    return collected.sort();
+  });
+
+/** `SELECT path, hash FROM supabase_migrations.seed_files`, `42P01` → empty map. */
+const readRemoteSeeds = (session: LegacyDbSession) =>
+  session.query(SELECT_SEED_TABLE).pipe(
+    Effect.map((rows) => {
+      const applied = new Map<string, string>();
+      for (const row of rows) applied.set(String(row["path"]), String(row["hash"]));
+      return applied;
+    }),
+    Effect.catch((error: LegacyDbExecError) =>
+      isUndefinedTable(error) ? Effect.succeed(new Map<string, string>()) : Effect.fail(error),
+    ),
+  );
+
+const isUndefinedTable = (error: LegacyDbExecError): boolean =>
+  error.code !== undefined
+    ? error.code === "42P01"
+    : /relation .* does not exist/iu.test(error.message) &&
+      !/column .* does not exist/iu.test(error.message);
+
+/**
+ * Resolves the pending seed files for `db push --include-seed`. Mirrors Go's
+ * `GetPendingSeeds` (`pkg/migration/seed.go:34-63`): glob the configured paths
+ * (warn, don't fail, on empty patterns), read the remote `seed_files` hashes,
+ * and emit each local file that is new (`dirty=false`) or hash-changed
+ * (`dirty=true`); files whose hash already matches are skipped.
+ */
+export const legacyGetPendingSeeds = Effect.fnUntraced(function* (
+  session: LegacyDbSession,
+  fs: FileSystem.FileSystem,
+  path: Path.Path,
+  patterns: ReadonlyArray<string>,
+  workdir: string,
+) {
+  const output = yield* Output;
+  const { files, warning } = yield* legacyGlobSeedFiles(fs, path, patterns, workdir);
+  if (Option.isSome(warning)) {
+    yield* output.raw(`WARN: ${warning.value}\n`, "stderr");
+  }
+  const pending: Array<LegacySeedFile> = [];
+  if (files.length === 0) return pending;
+
+  const applied = yield* readRemoteSeeds(session);
+  for (const file of files) {
+    // Go's `NewSeedFile` hashes the raw file stream (`io.Copy`, `pkg/migration/file.go:184`),
+    // so hash the bytes — not a UTF-8-decoded string, which replaces invalid sequences and
+    // would drift from the Go-recorded `seed_files` hash for a non-UTF-8 seed (SQL_ASCII dump
+    // / binary COPY payload), spuriously re-running it across a Go ↔ native switch.
+    const content = yield* fs.readFile(path.isAbsolute(file) ? file : path.join(workdir, file));
+    const hash = createHash("sha256").update(content).digest("hex");
+    const appliedHash = applied.get(file);
+    if (appliedHash !== undefined) {
+      if (appliedHash === hash) continue; // Already applied, unchanged.
+      pending.push({ path: file, hash, dirty: true });
+      continue;
+    }
+    pending.push({ path: file, hash, dirty: false });
+  }
+  return pending;
+});
+
+/**
+ * Applies pending seed files. Mirrors Go's `SeedData` + `ExecBatchWithCache`
+ * (`pkg/migration/seed.go:65-83`, `file.go:198-217`): create the `seed_files`
+ * table, then per file emit the dirty/clean status line and, in one transaction,
+ * run the file's statements (skipped when dirty — only the hash is refreshed)
+ * followed by the `seed_files` hash upsert.
+ */
+export const legacySeedData = <E>(
+  session: LegacyDbSession,
+  fs: FileSystem.FileSystem,
+  workdir: string,
+  path: Path.Path,
+  seeds: ReadonlyArray<LegacySeedFile>,
+  mapError: (message: string) => E,
+): Effect.Effect<void, E, Output> =>
+  Effect.gen(function* () {
+    const output = yield* Output;
+    if (seeds.length === 0) return;
+    // Go's `CreateSeedTable` (history.go:54-64) runs `SET lock_timeout = '4s'` +
+    // schema/table DDL in one implicit transaction, so a conflicting schema/table lock
+    // fails promptly but the timeout reverts on COMMIT and never leaks into the seed
+    // SQL run below. `legacyCreateSeedTable` reproduces that with BEGIN + SET LOCAL +
+    // DDL + COMMIT (creating the schema first so a seed-only run doesn't fail).
+    yield* legacyCreateSeedTable(session);
+    for (const seed of seeds) {
+      yield* output.raw(
+        seed.dirty
+          ? `Updating seed hash to ${seed.path}...\n`
+          : `Seeding data from ${seed.path}...\n`,
+        "stderr",
+      );
+      // Go's `ExecBatchWithCache` parses the file (read + `SplitAndTrim`)
+      // UNCONDITIONALLY before the dirty check (`file.go:198-211`), so a dirty seed
+      // that is unreadable or contains malformed SQL still fails and leaves the
+      // previous hash — only the queueing of statements is gated on `Dirty`.
+      const lines = legacySplitAndTrim(
+        yield* fs.readFileString(
+          path.isAbsolute(seed.path) ? seed.path : path.join(workdir, seed.path),
+        ),
+      );
+      const statements = seed.dirty ? [] : lines;
+      yield* session.exec("BEGIN");
+      const body = Effect.gen(function* () {
+        for (const statement of statements) yield* session.exec(statement);
+        yield* session.query(UPSERT_SEED_FILE, [seed.path, seed.hash]);
+        yield* session.exec("COMMIT");
+      });
+      yield* body.pipe(Effect.tapError(() => session.exec("ROLLBACK").pipe(Effect.ignore)));
+    }
+  }).pipe(
+    Effect.mapError((error) =>
+      mapError(
+        typeof error === "object" &&
+          error !== null &&
+          "message" in error &&
+          typeof error.message === "string"
+          ? error.message
+          : String(error),
+      ),
+    ),
+  );
diff --git a/apps/cli/src/legacy/commands/db/shared/legacy-seed-ops.unit.test.ts b/apps/cli/src/legacy/commands/db/shared/legacy-seed-ops.unit.test.ts
new file mode 100644
index 0000000000..6f0a1dcb3f
--- /dev/null
+++ b/apps/cli/src/legacy/commands/db/shared/legacy-seed-ops.unit.test.ts
@@ -0,0 +1,143 @@
+import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { BunServices } from "@effect/platform-bun";
+import { describe, expect, it } from "@effect/vitest";
+import { Data, Effect, Exit, FileSystem, Path } from "effect";
+
+import { mockOutput } from "../../../../../tests/helpers/mocks.ts";
+import type { LegacyDbSession } from "../../../shared/legacy-db-connection.service.ts";
+import { legacyGetPendingSeeds, legacySeedData } from "./legacy-seed-ops.ts";
+
+class TestError extends Data.TaggedError("TestError")<{ readonly message: string }> {}
+
+function fakeSeedSession() {
+  const calls: Array<{ kind: "exec" | "query"; sql: string }> = [];
+  const session: LegacyDbSession = {
+    exec: (sql) => {
+      calls.push({ kind: "exec", sql });
+      return Effect.void;
+    },
+    query: (sql) => {
+      calls.push({ kind: "query", sql });
+      return Effect.succeed([]);
+    },
+    extensionExists: () => Effect.succeed(false),
+    copyToCsv: () => Effect.succeed(new Uint8Array()),
+    queryRaw: () => Effect.succeed({ fields: [], rows: [], commandTag: "" }),
+  };
+  return { session, calls };
+}
+
+// Glob matching itself is `legacyPathMatch` (`../../../shared/legacy-path-match.ts`),
+// a faithful port of Go's `path.Match` already covered by
+// `legacy-path-match.unit.test.ts` (including the `^`-only negation / `!`-is-literal
+// rule this file used to duplicate — and get wrong — in a local `legacyMatchPattern`).
+// This exercises that the seed pipeline's own glob resolution (`legacyGetPendingSeeds`)
+// actually uses it end to end, per Go's `config.Glob.Files` → `fs.Glob` → `path.Match`.
+describe("legacyGetPendingSeeds (glob character classes)", () => {
+  it.effect(
+    "treats a leading `!` in a bracket class as literal, not negation (Go path.Match parity)",
+    () => {
+      const dir = mkdtempSync(join(tmpdir(), "legacy-seed-glob-"));
+      writeFileSync(join(dir, "a.sql"), "select 1;");
+      writeFileSync(join(dir, "b.sql"), "select 2;");
+      const { session } = fakeSeedSession();
+      return Effect.gen(function* () {
+        const fs = yield* FileSystem.FileSystem;
+        const path = yield* Path.Path;
+        // Go's `[!a]` is a positive class of the literal members `!` and `a` — only a
+        // leading `^` negates. So this pattern matches `a.sql`, not `b.sql` (the old
+        // shell-style bug negated on `!` too, and would have matched `b.sql` instead).
+        const pending = yield* legacyGetPendingSeeds(session, fs, path, ["[!a].sql"], dir);
+        expect(pending.map((seed) => seed.path)).toEqual(["a.sql"]);
+        rmSync(dir, { recursive: true, force: true });
+      }).pipe(
+        Effect.provide(mockOutput({ format: "text" }).layer),
+        Effect.provide(BunServices.layer),
+      );
+    },
+  );
+
+  it.effect(
+    "warns Go's bad-pattern message for an unterminated bracket class, not a bogus no-match",
+    () => {
+      // An unclosed `[` is malformed per Go's `path.Match` grammar (`ErrBadPattern`), which
+      // `fs.Glob` reports as `failed to glob files: syntax error in pattern` — not the
+      // generic `no files matched pattern` a same-shaped but well-formed glob would get.
+      const dir = mkdtempSync(join(tmpdir(), "legacy-seed-glob-"));
+      const { session } = fakeSeedSession();
+      const out = mockOutput({ format: "text" });
+      return Effect.gen(function* () {
+        const fs = yield* FileSystem.FileSystem;
+        const path = yield* Path.Path;
+        const pending = yield* legacyGetPendingSeeds(session, fs, path, ["seed[.sql"], dir);
+        expect(pending).toEqual([]);
+        expect(out.rawChunks.map((c) => c.text).join("")).toContain(
+          "failed to glob files: syntax error in pattern",
+        );
+        rmSync(dir, { recursive: true, force: true });
+      }).pipe(Effect.provide(out.layer), Effect.provide(BunServices.layer));
+    },
+  );
+});
+
+const runSeed = (
+  session: LegacyDbSession,
+  workdir: string,
+  seeds: ReadonlyArray<{ readonly path: string; readonly hash: string; readonly dirty: boolean }>,
+) =>
+  Effect.gen(function* () {
+    const fs = yield* FileSystem.FileSystem;
+    const path = yield* Path.Path;
+    return yield* legacySeedData(
+      session,
+      fs,
+      workdir,
+      path,
+      seeds,
+      (message) => new TestError({ message }),
+    );
+  }).pipe(Effect.provide(mockOutput({ format: "text" }).layer), Effect.provide(BunServices.layer));
+
+describe("legacySeedData (dirty parse)", () => {
+  it.effect("fails on an unreadable dirty seed instead of refreshing its hash", () => {
+    // Go's `ExecBatchWithCache` reads + parses the file UNCONDITIONALLY before the
+    // dirty check, so a dirty seed pointing at a missing file must fail (and leave
+    // the previous hash) rather than silently upserting the new hash.
+    const dir = mkdtempSync(join(tmpdir(), "legacy-seed-"));
+    const { session, calls } = fakeSeedSession();
+    return runSeed(session, dir, [{ path: "missing.sql", hash: "newhash", dirty: true }]).pipe(
+      Effect.exit,
+      Effect.tap((exit) =>
+        Effect.sync(() => {
+          expect(Exit.isFailure(exit)).toBe(true);
+          // The hash upsert is a `query`; the only execs that ran are the
+          // schema/table creation (whose DDL also mentions `seed_files`), so assert
+          // no `query` ran rather than substring-matching the table name.
+          expect(calls.some((c) => c.kind === "query")).toBe(false);
+          rmSync(dir, { recursive: true, force: true });
+        }),
+      ),
+    );
+  });
+
+  it.effect("refreshes the hash for a dirty seed that parses, without running statements", () => {
+    const dir = mkdtempSync(join(tmpdir(), "legacy-seed-"));
+    writeFileSync(join(dir, "data.sql"), "insert into t values (1);");
+    const { session, calls } = fakeSeedSession();
+    return runSeed(session, dir, [{ path: "data.sql", hash: "newhash", dirty: true }]).pipe(
+      Effect.tap(() =>
+        Effect.sync(() => {
+          // Go's CreateSeedTable scopes the lock timeout to the DDL transaction
+          // (BEGIN + SET LOCAL + COMMIT) so it never leaks into the seed SQL below.
+          expect(calls.some((c) => c.sql === "SET LOCAL lock_timeout = '4s'")).toBe(true);
+          // Statements are NOT executed for a dirty seed, but the hash IS upserted.
+          expect(calls.some((c) => c.sql.includes("insert into t"))).toBe(false);
+          expect(calls.some((c) => c.kind === "query" && c.sql.includes("seed_files"))).toBe(true);
+          rmSync(dir, { recursive: true, force: true });
+        }),
+      ),
+    );
+  });
+});
diff --git a/apps/cli/src/legacy/commands/db/start/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/db/start/SIDE_EFFECTS.md
index 0c980a749c..dacbedff73 100644
--- a/apps/cli/src/legacy/commands/db/start/SIDE_EFFECTS.md
+++ b/apps/cli/src/legacy/commands/db/start/SIDE_EFFECTS.md
@@ -1,17 +1,35 @@
 # `supabase db start`
 
+Native TS port of `apps/cli-go/internal/db/start/start.go` `Run`. The handler
+validates config, checks whether the local Postgres container is already running,
+and otherwise delegates the container bootstrap to the bundled Go binary's hidden
+`db __db-bootstrap --mode start` seam (the container-lifecycle primitives are not
+ported). This is `db start`, **not** the top-level `supabase start`: no status
+table, no `cli_stack_started` event, no `Finished` line.
+
 ## Files Read
 
-| Path                             | Format | When                               |
-| -------------------------------- | ------ | ---------------------------------- |
-| `<workdir>/supabase/config.toml` | TOML   | always, to resolve local DB config |
-| `<path>` (from `--from-backup`)  | binary | when `--from-backup` flag is set   |
+| Path                             | Format | When                                                            |
+| -------------------------------- | ------ | --------------------------------------------------------------- |
+| `<workdir>/supabase/config.toml` | TOML   | always — parsed up front; a malformed config aborts before work |
+| `<path>` (from `--from-backup`)  | binary | when `--from-backup` is set (read by the Go seam on start)      |
 
 ## Files Written
 
-| Path | Format | When |
-| ---- | ------ | ---- |
-| —    | —      | —    |
+| Path                                           | Format | When                                                                        |
+| ---------------------------------------------- | ------ | --------------------------------------------------------------------------- |
+| `<workdir>/supabase/.branches/_current_branch` | text   | by the Go seam (`initCurrentBranch`) when starting; writes `main` if absent |
+| local Docker volume `supabase_db_<project>`    | —      | by the Go seam — the Postgres data volume created on first start            |
+| `~/.supabase/telemetry.json`                   | JSON   | always (telemetry flush, success and failure)                               |
+
+## Subprocesses
+
+| Command                                                          | When                             | Purpose                                                                                                                                                                   |
+| ---------------------------------------------------------------- | -------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `docker container inspect supabase_db_<project>`                 | always                           | `AssertSupabaseDbIsRunning` probe (Podman fallback)                                                                                                                       |
+| `supabase-go db __db-bootstrap --mode start [--from-backup <p>]` | when the database is not running | create container + health check + initial schema/roles/migrations/seed + `_current_branch`; telemetry disabled (`SUPABASE_TELEMETRY_DISABLED=1`), progress teed to stderr |
+
+`--network-id` and a flag-selected `--profile` are forwarded to the seam.
 
 ## API Routes
 
@@ -19,34 +37,49 @@
 | ------ | ---- | ---- | ------------ | ---------------------- |
 | —      | —    | —    | —            | —                      |
 
+(The Go seam may call Auth's JWKS endpoint while applying service migrations on a
+fresh PG15 volume; that is internal to the seam, not the TS handler.)
+
 ## Environment Variables
 
-| Variable | Purpose | Required? |
-| -------- | ------- | --------- |
-| —        | —       | —         |
+| Variable                      | Purpose                                              | Required?  |
+| ----------------------------- | ---------------------------------------------------- | ---------- |
+| `SUPABASE_PROJECT_ID`         | overrides the local container id (`utils.DbId`)      | no         |
+| `SUPABASE_TELEMETRY_DISABLED` | set on the seam subprocess so it never double-counts | (internal) |
 
 ## Exit Codes
 
-| Code | Condition                      |
-| ---- | ------------------------------ |
-| `0`  | success                        |
-| `1`  | Docker not running             |
-| `1`  | database container start error |
+| Code                 | Condition                                                             |
+| -------------------- | --------------------------------------------------------------------- |
+| `0`                  | success — database started, or already running                        |
+| `1`                  | malformed `supabase/config.toml`                                      |
+| `1`                  | Docker daemon unreachable / inspect failure                           |
+| child's exact code\* | container bootstrap failed (the seam cleans up via `DockerRemoveAll`) |
+
+\* The `db __db-bootstrap` seam propagates the spawned `supabase-go` child's
+real exit code (e.g. `130` after a Ctrl-C mid-bootstrap) instead of collapsing
+every failure to `1` — in every `--output-format` (CLI-1879).
 
 ## Output
 
 ### `--output-format text` (Go CLI compatible)
 
-Prints progress to stderr as the local Postgres container starts.
+- Already running → `Postgres database is already running.` on **stderr**, exit 0.
+- Starting → the Go seam tees `Starting database...` / `Initialising schema...` to
+  **stderr**. No stdout output, no `Finished` line.
 
 ### `--output-format json`
 
-Not applicable.
+Emits a single result object to stdout: `{ status: "already-running" }` or
+`{ status: "started" }`. Progress stays on stderr.
 
 ### `--output-format stream-json`
 
-Not applicable.
+Same result object as the terminal `result` event; progress on stderr.
 
 ## Notes
 
-- `--from-backup` restores the database from a logical backup file on start.
+- `--from-backup` restores the database from a logical backup file on start; the
+  health check is skipped for backups (a large restore can exceed the timeout).
+- No `cli_stack_started` telemetry — that event belongs to `supabase start`, not
+  `db start`. The only event is the standard `cli_command_executed`.
diff --git a/apps/cli/src/legacy/commands/db/start/start.command.ts b/apps/cli/src/legacy/commands/db/start/start.command.ts
index cc4081ae84..c9457733ae 100644
--- a/apps/cli/src/legacy/commands/db/start/start.command.ts
+++ b/apps/cli/src/legacy/commands/db/start/start.command.ts
@@ -1,6 +1,10 @@
 import { Command, Flag } from "effect/unstable/cli";
 import type * as CliCommand from "effect/unstable/cli/Command";
+
+import { withJsonErrorHandling } from "../../../../shared/output/json-error-handling.ts";
+import { withLegacyCommandInstrumentation } from "../../../telemetry/legacy-command-instrumentation.ts";
 import { legacyDbStart } from "./start.handler.ts";
+import { legacyDbStartRuntimeLayer } from "./start.layers.ts";
 
 const config = {
   fromBackup: Flag.string("from-backup").pipe(
@@ -14,5 +18,15 @@ export type LegacyDbStartFlags = CliCommand.Command.Config.Infer<typeof config>;
 export const legacyDbStartCommand = Command.make("start", config).pipe(
   Command.withDescription("Starts local Postgres database."),
   Command.withShortDescription("Starts local Postgres database"),
-  Command.withHandler((flags) => legacyDbStart(flags)),
+  Command.withHandler((flags) =>
+    legacyDbStart(flags).pipe(
+      withLegacyCommandInstrumentation({
+        // `--from-backup` is not telemetry-safe in Go (no markFlagTelemetrySafe),
+        // so a set value reaches telemetry as `<redacted>`.
+        flags: { "from-backup": flags.fromBackup },
+      }),
+      withJsonErrorHandling,
+    ),
+  ),
+  Command.provide(legacyDbStartRuntimeLayer),
 );
diff --git a/apps/cli/src/legacy/commands/db/start/start.handler.ts b/apps/cli/src/legacy/commands/db/start/start.handler.ts
index a1aa3e586a..7428173f1a 100644
--- a/apps/cli/src/legacy/commands/db/start/start.handler.ts
+++ b/apps/cli/src/legacy/commands/db/start/start.handler.ts
@@ -1,10 +1,85 @@
-import { Effect, Option } from "effect";
-import { LegacyGoProxy } from "../../../../shared/legacy/go-proxy.service.ts";
+import { Effect, FileSystem, Option, Path } from "effect";
+
+import { Output } from "../../../../shared/output/output.service.ts";
+import { RuntimeInfo } from "../../../../shared/runtime/runtime-info.service.ts";
+import { LegacyCliConfig } from "../../../config/legacy-cli-config.service.ts";
+import { LegacyTelemetryState } from "../../../telemetry/legacy-telemetry-state.service.ts";
+import { legacyCheckDbToml } from "../../../shared/legacy-db-config.toml-read.ts";
+import { LegacyDbBootstrapSeam } from "../shared/legacy-db-bootstrap.seam.service.ts";
 import type { LegacyDbStartFlags } from "./start.command.ts";
 
+/**
+ * `supabase db start` — start the local Postgres database.
+ *
+ * Strict 1:1 port of `apps/cli-go/internal/db/start/start.go` `Run`. Native TS
+ * orchestrates: it validates config, checks whether the database is already
+ * running (printing Go's "already running" line), and otherwise delegates the
+ * container bootstrap to the hidden Go `__db-bootstrap` seam (create container +
+ * health + initial schema + `_current_branch`), whose progress is teed to stderr.
+ *
+ * Parity notes: this is `db start`, NOT the top-level `supabase start`. It does
+ * NOT print a status table and does NOT fire `cli_stack_started` — those belong to
+ * `internal/start/start.go`. There is no `Finished` line.
+ */
 export const legacyDbStart = Effect.fn("legacy.db.start")(function* (flags: LegacyDbStartFlags) {
-  const proxy = yield* LegacyGoProxy;
-  const args: string[] = ["db", "start"];
-  if (Option.isSome(flags.fromBackup)) args.push("--from-backup", flags.fromBackup.value);
-  yield* proxy.exec(args);
+  const output = yield* Output;
+  const cliConfig = yield* LegacyCliConfig;
+  const seam = yield* LegacyDbBootstrapSeam;
+  const telemetryState = yield* LegacyTelemetryState;
+  const fs = yield* FileSystem.FileSystem;
+  const path = yield* Path.Path;
+  const runtimeInfo = yield* RuntimeInfo;
+
+  const body = Effect.gen(function* () {
+    // Go's `flags.LoadConfig(fsys)` runs first thing in `start.Run`
+    // (`internal/db/start/start.go:45`): a missing config is tolerated (defaults), but
+    // a present config that is malformed, references an undecryptable `encrypted:`
+    // secret, or fails Validate aborts before any container work. `legacyCheckDbToml`
+    // is that exact load+validate — call it here (not via the seam's best-effort read,
+    // which swallows config errors) so `db start` fails fast on a broken config.
+    yield* legacyCheckDbToml(fs, path, cliConfig.workdir);
+
+    // Go's AssertSupabaseDbIsRunning: if the db container is already up, print to
+    // stderr and return nil (exit 0).
+    const running = yield* seam.isDbRunning();
+    if (running) {
+      if (output.format === "text") {
+        yield* output.raw("Postgres database is already running.\n", "stderr");
+      } else {
+        yield* output.success("Postgres database is already running.", {
+          status: "already-running",
+        });
+      }
+      return;
+    }
+
+    // Not running → bootstrap the container (StartDatabase + DockerRemoveAll on
+    // failure). The seam tees "Starting database...", "Initialising schema...",
+    // etc. to stderr.
+    //
+    // Resolve a relative `--from-backup` against the CALLER's cwd, mirroring Go's
+    // `StartDatabase` (`filepath.Join(utils.CurrentDirAbs, fromBackup)`, start.go:160-161)
+    // where `CurrentDirAbs` is captured before `ChangeWorkDir`. The seam spawns the Go child
+    // with cwd = the project workdir, so passing a relative path would resolve it against the
+    // project root (wrong file / not found) when `db start` runs from a subdirectory or with
+    // `--workdir`. Passing an absolute path makes the child's resolution a no-op.
+    const fromBackupFlag = Option.getOrUndefined(flags.fromBackup);
+    // An empty `--from-backup ""` is a normal no-backup start in Go (`len(fromBackup) == 0`),
+    // so treat it as absent rather than joining it to a directory path.
+    const fromBackup =
+      fromBackupFlag === undefined || fromBackupFlag === ""
+        ? undefined
+        : path.isAbsolute(fromBackupFlag)
+          ? fromBackupFlag
+          : path.join(runtimeInfo.cwd, fromBackupFlag);
+    yield* seam.startDatabase({ fromBackup });
+
+    if (output.format !== "text") {
+      yield* output.success("Started local database.", { status: "started" });
+    }
+  });
+
+  // db start is local-only — no project ref, so no linked-project cache write.
+  // Telemetry still flushes on success and failure (Go's PersistentPostRun).
+  yield* body.pipe(Effect.ensuring(telemetryState.flush));
 });
diff --git a/apps/cli/src/legacy/commands/db/start/start.integration.test.ts b/apps/cli/src/legacy/commands/db/start/start.integration.test.ts
new file mode 100644
index 0000000000..e53edc5f2b
--- /dev/null
+++ b/apps/cli/src/legacy/commands/db/start/start.integration.test.ts
@@ -0,0 +1,286 @@
+import { mkdirSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+
+import { BunServices } from "@effect/platform-bun";
+import { describe, expect, it } from "@effect/vitest";
+import { Cause, Effect, Exit, Layer, Option } from "effect";
+
+import { mockOutput, mockRuntimeInfo } from "../../../../../tests/helpers/mocks.ts";
+import {
+  mockLegacyCliConfig,
+  mockLegacyTelemetryStateTracked,
+  useLegacyTempWorkdir,
+} from "../../../../../tests/helpers/legacy-mocks.ts";
+import { LegacyGoChildExitError } from "../../../../shared/legacy/legacy-go-child-exit.error.ts";
+import type { OutputFormat } from "../../../../shared/output/types.ts";
+import { LegacyDbBootstrapError } from "../shared/legacy-db-bootstrap.errors.ts";
+import { LegacyDbBootstrapSeam } from "../shared/legacy-db-bootstrap.seam.service.ts";
+import { legacyDbStart } from "./start.handler.ts";
+import type { LegacyDbStartFlags } from "./start.command.ts";
+
+const DEFAULT_FLAGS: LegacyDbStartFlags = { fromBackup: Option.none() };
+
+/**
+ * Stateful mock of the container-bootstrap seam. `running` drives
+ * `AssertSupabaseDbIsRunning`; `runningFails` / `startFails` make the respective
+ * call fail (Docker daemon down / StartDatabase error). `startExitCode`, when set,
+ * fails `startDatabase` with a `LegacyGoChildExitError` carrying that code instead —
+ * simulating the seam's real bootstrap child (`db __db-bootstrap --mode start`)
+ * exiting non-zero (CLI-1879). Records the args passed to `startDatabase`.
+ */
+function mockSeam(
+  opts: {
+    running?: boolean;
+    runningFails?: boolean;
+    startFails?: boolean;
+    startExitCode?: number;
+  } = {},
+) {
+  const startCalls: Array<{ fromBackup?: string }> = [];
+  const layer = Layer.succeed(LegacyDbBootstrapSeam, {
+    isDbRunning: () =>
+      opts.runningFails === true
+        ? Effect.fail(new LegacyDbBootstrapError({ message: "failed to inspect service" }))
+        : Effect.succeed(opts.running ?? false),
+    startDatabase: (args: { fromBackup?: string }) => {
+      if (opts.startExitCode !== undefined) {
+        return Effect.fail(
+          new LegacyGoChildExitError({
+            exitCode: opts.startExitCode,
+            message: `failed to bootstrap the local database: exit ${opts.startExitCode}`,
+          }),
+        );
+      }
+      return opts.startFails === true
+        ? Effect.fail(new LegacyDbBootstrapError({ message: "failed to bootstrap" }))
+        : Effect.sync(() => {
+            startCalls.push(args);
+          });
+    },
+    recreateDatabase: () => Effect.void,
+    awaitStorageReady: () => Effect.succeed(false),
+  });
+  return {
+    layer,
+    get startCalls() {
+      return startCalls;
+    },
+  };
+}
+
+function setup(
+  workdir: string,
+  opts: {
+    toml?: string;
+    format?: OutputFormat;
+    running?: boolean;
+    runningFails?: boolean;
+    startFails?: boolean;
+    startExitCode?: number;
+    /** Caller cwd (Go's `CurrentDirAbs`) for relative `--from-backup` resolution. */
+    cwd?: string;
+  },
+) {
+  if (opts.toml !== undefined) {
+    mkdirSync(join(workdir, "supabase"), { recursive: true });
+    writeFileSync(join(workdir, "supabase", "config.toml"), opts.toml);
+  }
+  const out = mockOutput({ format: opts.format ?? "text" });
+  const seam = mockSeam(opts);
+  const telemetry = mockLegacyTelemetryStateTracked();
+  const layer = Layer.mergeAll(
+    out.layer,
+    seam.layer,
+    mockLegacyCliConfig({ workdir }),
+    telemetry.layer,
+    mockRuntimeInfo({ cwd: opts.cwd ?? workdir }),
+    BunServices.layer,
+  );
+  return { layer, out, seam, telemetry };
+}
+
+describe("legacy db start", () => {
+  const tmp = useLegacyTempWorkdir("supabase-db-start-");
+
+  it.live("reports an already-running database without starting a container", () => {
+    const { layer, out, seam, telemetry } = setup(tmp.current, {
+      toml: 'project_id = "test"\n',
+      running: true,
+    });
+    return Effect.gen(function* () {
+      yield* legacyDbStart(DEFAULT_FLAGS).pipe(Effect.provide(layer));
+      expect(out.stderrText).toContain("Postgres database is already running.");
+      expect(seam.startCalls).toHaveLength(0);
+      expect(telemetry.flushed).toBe(true);
+    });
+  });
+
+  it.live("starts the database when it is not running", () => {
+    const { layer, out, seam } = setup(tmp.current, {
+      toml: 'project_id = "test"\n',
+      running: false,
+    });
+    return Effect.gen(function* () {
+      yield* legacyDbStart(DEFAULT_FLAGS).pipe(Effect.provide(layer));
+      expect(seam.startCalls).toEqual([{ fromBackup: undefined }]);
+      // db start prints no "Finished" line and no status table.
+      expect(out.stderrText).not.toContain("Finished");
+    });
+  });
+
+  it.live("forwards an absolute --from-backup to the bootstrap seam unchanged", () => {
+    const { layer, seam } = setup(tmp.current, { toml: 'project_id = "test"\n' });
+    return Effect.gen(function* () {
+      yield* legacyDbStart({ fromBackup: Option.some("/tmp/dump.sql") }).pipe(
+        Effect.provide(layer),
+      );
+      expect(seam.startCalls).toEqual([{ fromBackup: "/tmp/dump.sql" }]);
+    });
+  });
+
+  it.live("resolves a relative --from-backup against the caller cwd, not the workdir", () => {
+    // Go resolves a relative fromBackup against `CurrentDirAbs` (the caller cwd, captured
+    // before ChangeWorkDir), so the seam must receive the caller-relative absolute path even
+    // though its Go child runs with cwd = the project workdir.
+    const { layer, seam } = setup(tmp.current, {
+      toml: 'project_id = "test"\n',
+      cwd: "/caller/here",
+    });
+    return Effect.gen(function* () {
+      yield* legacyDbStart({ fromBackup: Option.some("dump.sql") }).pipe(Effect.provide(layer));
+      expect(seam.startCalls).toEqual([{ fromBackup: "/caller/here/dump.sql" }]);
+    });
+  });
+
+  it.live("treats an empty --from-backup as a normal no-backup start", () => {
+    // Go's StartDatabase sees `len(fromBackup) == 0` and starts without a backup; an empty
+    // string must not be joined to the caller cwd and passed as a directory path.
+    const { layer, seam } = setup(tmp.current, {
+      toml: 'project_id = "test"\n',
+      cwd: "/caller/here",
+    });
+    return Effect.gen(function* () {
+      yield* legacyDbStart({ fromBackup: Option.some("") }).pipe(Effect.provide(layer));
+      expect(seam.startCalls).toEqual([{ fromBackup: undefined }]);
+    });
+  });
+
+  it.live("proceeds with no config file (missing config is tolerated)", () => {
+    const { layer, seam } = setup(tmp.current, { running: false });
+    return Effect.gen(function* () {
+      yield* legacyDbStart(DEFAULT_FLAGS).pipe(Effect.provide(layer));
+      expect(seam.startCalls).toHaveLength(1);
+    });
+  });
+
+  it.live("fails fast on a malformed config.toml", () => {
+    const { layer, seam, telemetry } = setup(tmp.current, {
+      toml: 'project_id = "unterminated\n',
+    });
+    return Effect.gen(function* () {
+      const exit = yield* legacyDbStart(DEFAULT_FLAGS).pipe(Effect.provide(layer), Effect.exit);
+      expect(Exit.isFailure(exit)).toBe(true);
+      if (Exit.isFailure(exit)) {
+        expect(JSON.stringify(exit.cause)).toContain("failed to load config");
+      }
+      // No container work attempted; telemetry still flushes on failure.
+      expect(seam.startCalls).toHaveLength(0);
+      expect(telemetry.flushed).toBe(true);
+    });
+  });
+
+  it.live("fails fast on an undecryptable secret even when the db is already running", () => {
+    // Regression for the seam swallowing config-load errors: Go runs `flags.LoadConfig`
+    // (which decrypts every secret) BEFORE `AssertSupabaseDbIsRunning`, so a broken
+    // config aborts `db start` regardless of container state. Previously the handler's
+    // only config read was the seam's best-effort one, so an undecryptable secret with
+    // the container already up printed "already running" and exited 0.
+    const { layer, out } = setup(tmp.current, {
+      toml: '[db]\nroot_key = "encrypted:anything"\n',
+      running: true,
+    });
+    return Effect.gen(function* () {
+      const exit = yield* legacyDbStart(DEFAULT_FLAGS).pipe(Effect.provide(layer), Effect.exit);
+      expect(Exit.isFailure(exit)).toBe(true);
+      if (Exit.isFailure(exit)) {
+        expect(JSON.stringify(exit.cause)).toContain("failed to parse config: missing private key");
+      }
+      expect(out.stderrText).not.toContain("already running");
+    });
+  });
+
+  it.live("propagates a Docker inspect failure", () => {
+    const { layer } = setup(tmp.current, { toml: 'project_id = "test"\n', runningFails: true });
+    return Effect.gen(function* () {
+      const exit = yield* legacyDbStart(DEFAULT_FLAGS).pipe(Effect.provide(layer), Effect.exit);
+      expect(Exit.isFailure(exit)).toBe(true);
+      if (Exit.isFailure(exit)) {
+        expect(JSON.stringify(exit.cause)).toContain("failed to inspect service");
+      }
+    });
+  });
+
+  it.live("propagates a StartDatabase failure", () => {
+    const { layer } = setup(tmp.current, { toml: 'project_id = "test"\n', startFails: true });
+    return Effect.gen(function* () {
+      const exit = yield* legacyDbStart(DEFAULT_FLAGS).pipe(Effect.provide(layer), Effect.exit);
+      expect(Exit.isFailure(exit)).toBe(true);
+      if (Exit.isFailure(exit)) {
+        expect(JSON.stringify(exit.cause)).toContain("failed to bootstrap");
+      }
+    });
+  });
+
+  it.live(
+    "propagates the bootstrap child's exact exit code as LegacyGoChildExitError and still flushes telemetry",
+    () => {
+      // The bootstrap seam's `startDatabase` (the `!captureStdout` bootstrap-child
+      // path) failing non-zero must reach the handler as the exact `LegacyGoChildExitError`
+      // it fails with — not a generic `LegacyDbBootstrapError` collapsing every exit code to
+      // 1 — and the handler's own `Effect.ensuring(telemetryState.flush)` finalizer must
+      // still run despite the typed failure (CLI-1879).
+      const { layer, telemetry } = setup(tmp.current, {
+        toml: 'project_id = "test"\n',
+        running: false,
+        startExitCode: 3,
+      });
+      return Effect.gen(function* () {
+        const exit = yield* legacyDbStart(DEFAULT_FLAGS).pipe(Effect.provide(layer), Effect.exit);
+        expect(Exit.isFailure(exit)).toBe(true);
+        if (Exit.isFailure(exit)) {
+          const error = Cause.squash(exit.cause);
+          expect(error).toBeInstanceOf(LegacyGoChildExitError);
+          expect((error as LegacyGoChildExitError).exitCode).toBe(3);
+        }
+        expect(telemetry.flushed).toBe(true);
+      });
+    },
+  );
+
+  it.live("emits a json result when the database is already running", () => {
+    const { layer, out } = setup(tmp.current, {
+      toml: 'project_id = "test"\n',
+      running: true,
+      format: "json",
+    });
+    return Effect.gen(function* () {
+      yield* legacyDbStart(DEFAULT_FLAGS).pipe(Effect.provide(layer));
+      const success = out.messages.find((m) => m.type === "success");
+      expect(success?.data?.["status"]).toBe("already-running");
+    });
+  });
+
+  it.live("emits a json result after starting the database", () => {
+    const { layer, out, seam } = setup(tmp.current, {
+      toml: 'project_id = "test"\n',
+      running: false,
+      format: "json",
+    });
+    return Effect.gen(function* () {
+      yield* legacyDbStart(DEFAULT_FLAGS).pipe(Effect.provide(layer));
+      expect(seam.startCalls).toHaveLength(1);
+      const success = out.messages.find((m) => m.type === "success");
+      expect(success?.data?.["status"]).toBe("started");
+    });
+  });
+});
diff --git a/apps/cli/src/legacy/commands/db/start/start.layers.ts b/apps/cli/src/legacy/commands/db/start/start.layers.ts
new file mode 100644
index 0000000000..71603292ee
--- /dev/null
+++ b/apps/cli/src/legacy/commands/db/start/start.layers.ts
@@ -0,0 +1,27 @@
+import { Layer } from "effect";
+
+import { commandRuntimeLayer } from "../../../../shared/runtime/command-runtime.layer.ts";
+import { legacyCliConfigLayer } from "../../../config/legacy-cli-config.layer.ts";
+import { legacyDebugLoggerLayer } from "../../../shared/legacy-debug-logger.layer.ts";
+import { legacyTelemetryStateLayer } from "../../../telemetry/legacy-telemetry-state.layer.ts";
+import { legacyDbBootstrapSeamLayer } from "../shared/legacy-db-bootstrap.seam.layer.ts";
+
+/**
+ * Runtime layer for `supabase db start`. The command is local-only, so it needs
+ * far less than the remote-capable db commands: just the container-bootstrap seam
+ * (`db __db-bootstrap`), the CLI config (workdir + project id), and the telemetry
+ * flush. The seam's other dependencies (`LegacyNetworkIdFlag`, `LegacyProfileFlag`,
+ * `ChildProcessSpawner`, `FileSystem`, `Path`) are ambient from the root runtime,
+ * matching how `db diff` composes the `db __shadow` seam. `LegacyCliConfig` is
+ * provided to the seam explicitly (legacy CLAUDE.md rule 5).
+ */
+const cliConfig = legacyCliConfigLayer.pipe(Layer.provide(legacyDebugLoggerLayer));
+
+const seam = legacyDbBootstrapSeamLayer.pipe(Layer.provide(cliConfig));
+
+export const legacyDbStartRuntimeLayer = Layer.mergeAll(
+  seam,
+  cliConfig,
+  legacyTelemetryStateLayer,
+  commandRuntimeLayer(["db", "start"]),
+);
diff --git a/apps/cli/src/legacy/commands/domains/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/domains/SIDE_EFFECTS.md
index 90660186db..5dada1097d 100644
--- a/apps/cli/src/legacy/commands/domains/SIDE_EFFECTS.md
+++ b/apps/cli/src/legacy/commands/domains/SIDE_EFFECTS.md
@@ -6,10 +6,10 @@ Cloudflare DNS-over-HTTPS CNAME pre-check.
 
 ## Files Read
 
-| Path                                   | Format                    | When                                                       |
-| -------------------------------------- | ------------------------- | ---------------------------------------------------------- |
-| `~/.supabase/access-token`             | plain text (token string) | when `SUPABASE_ACCESS_TOKEN` unset and keyring unavailable |
-| `<workdir>/supabase/.temp/project-ref` | plain text                | when `--project-ref` flag and `PROJECT_ID` env are unset   |
+| Path                                   | Format                    | When                                                              |
+| -------------------------------------- | ------------------------- | ----------------------------------------------------------------- |
+| `~/.supabase/access-token`             | plain text (token string) | when `SUPABASE_ACCESS_TOKEN` unset and keyring unavailable        |
+| `<workdir>/supabase/.temp/project-ref` | plain text                | when `--project-ref` flag and `SUPABASE_PROJECT_ID` env are unset |
 
 ## Files Written
 
@@ -92,7 +92,7 @@ suppressed on stderr. `delete` ignores `-o`.
 
 - `--custom-hostname` is required for `create`.
 - `create` validates the CNAME via Cloudflare DNS-over-HTTPS (`https://1.1.1.1`, 10s timeout) before initializing; on failure it short-circuits before any POST.
-- All subcommands resolve the ref via `--project-ref` → `PROJECT_ID` env → linked-project file, matching Go.
+- All subcommands resolve the ref via `--project-ref` → `SUPABASE_PROJECT_ID` env → linked-project file, matching Go.
 - The project-ref fallback env var is `SUPABASE_PROJECT_ID`, matching Go (Go calls `viper.GetString("PROJECT_ID")` under `viper.SetEnvPrefix("SUPABASE")`, which resolves to the `SUPABASE_PROJECT_ID` environment variable).
 - **Documented divergences from Go (intentional):**
   - `--include-raw-output` is declared as a normal boolean **on each subcommand** (Go declares it as a persistent flag on the `domains` group). Two consequences: (a) it must appear after the subcommand name (`domains get --include-raw-output`) rather than before it (`domains --include-raw-output get`), matching how `--project-ref` is already handled shell-wide; (b) it cannot reproduce Cobra's help-hiding or the `Flag --include-raw-output has been deprecated` stderr warning, which Effect CLI has no hook for. It still reproduces the behavioral effect (forces `-o json` when `-o` is unset/pretty); on `delete` it is inert, matching Go.
diff --git a/apps/cli/src/legacy/commands/encryption/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/encryption/SIDE_EFFECTS.md
index 458b7aeb86..770358b237 100644
--- a/apps/cli/src/legacy/commands/encryption/SIDE_EFFECTS.md
+++ b/apps/cli/src/legacy/commands/encryption/SIDE_EFFECTS.md
@@ -6,11 +6,11 @@ additionally reads the new key from stdin.
 
 ## Files Read
 
-| Path                                             | Format                    | When                                                               |
-| ------------------------------------------------ | ------------------------- | ------------------------------------------------------------------ |
-| `~/.supabase/access-token`                       | plain text (token string) | when `SUPABASE_ACCESS_TOKEN` unset and keyring unavailable         |
-| `~/.supabase/<workdir-hash>/linked-project.json` | JSON                      | when `--project-ref` / `PROJECT_ID` unset, to resolve linked ref   |
-| stdin                                            | raw bytes / masked TTY    | `update-root-key` only — masked TTY input or piped bytes (the key) |
+| Path                                             | Format                    | When                                                                      |
+| ------------------------------------------------ | ------------------------- | ------------------------------------------------------------------------- |
+| `~/.supabase/access-token`                       | plain text (token string) | when `SUPABASE_ACCESS_TOKEN` unset and keyring unavailable                |
+| `~/.supabase/<workdir-hash>/linked-project.json` | JSON                      | when `--project-ref` / `SUPABASE_PROJECT_ID` unset, to resolve linked ref |
+| stdin                                            | raw bytes / masked TTY    | `update-root-key` only — masked TTY input or piped bytes (the key)        |
 
 ## Files Written
 
@@ -30,12 +30,11 @@ additionally reads the new key from stdin.
 
 ## Environment Variables
 
-| Variable                             | Purpose                                              | Required?                                               |
-| ------------------------------------ | ---------------------------------------------------- | ------------------------------------------------------- |
-| `SUPABASE_ACCESS_TOKEN`              | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `~/.supabase/access-token`) |
-| `SUPABASE_PROJECT_ID` / `PROJECT_ID` | project ref (fallback when `--project-ref` unset)    | no (falls back to linked-project file → prompt)         |
-| `SUPABASE_API_URL`                   | override Management API base URL                     | no (defaults to `https://api.supabase.com`)             |
-| `SUPABASE_PROFILE`                   | built-in profile name or YAML file path              | no (defaults to `supabase`)                             |
+| Variable                | Purpose                                              | Required?                                               |
+| ----------------------- | ---------------------------------------------------- | ------------------------------------------------------- |
+| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `~/.supabase/access-token`) |
+| `SUPABASE_PROJECT_ID`   | project ref (fallback when `--project-ref` unset)    | no (falls back to linked-project file → prompt)         |
+| `SUPABASE_PROFILE`      | built-in profile name or YAML file path              | no (falls back to `~/.supabase/profile` -> `supabase`)  |
 
 ## Exit Codes
 
@@ -76,7 +75,7 @@ One `result` event carrying `{root_key}` (both subcommands).
 
 ## Notes
 
-- Requires `--project-ref`, `SUPABASE_PROJECT_ID`/`PROJECT_ID`, or a linked project.
+- Requires `--project-ref`, `SUPABASE_PROJECT_ID`, or a linked project.
 - `update-root-key` reads the key from stdin: a real TTY is read with a masked
   prompt; piped stdin is decoded as UTF-8 and whitespace-trimmed. An empty or
   whitespace-only key sends an empty `root_key`, matching Go's `io.Copy` +
diff --git a/apps/cli/src/legacy/commands/functions/delete/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/functions/delete/SIDE_EFFECTS.md
index f3914b1b22..d46ffc8b86 100644
--- a/apps/cli/src/legacy/commands/functions/delete/SIDE_EFFECTS.md
+++ b/apps/cli/src/legacy/commands/functions/delete/SIDE_EFFECTS.md
@@ -2,28 +2,39 @@
 
 ## Files Read
 
-| Path                       | Format     | When                                                       |
-| -------------------------- | ---------- | ---------------------------------------------------------- |
-| `~/.supabase/access-token` | plain text | when `SUPABASE_ACCESS_TOKEN` unset and keyring unavailable |
+| Path                                            | Format     | When                                                          |
+| ----------------------------------------------- | ---------- | ------------------------------------------------------------- |
+| `<SUPABASE_HOME or ~/.supabase>/access-token`   | plain text | when `SUPABASE_ACCESS_TOKEN` unset and keyring unavailable    |
+| `<SUPABASE_HOME or ~/.supabase>/profile`        | plain text | when `--profile` and `SUPABASE_PROFILE` are both unset        |
+| `<profile>.yaml`                                | YAML       | when `SUPABASE_PROFILE` or `--profile` points to a file       |
+| `<workdir>/supabase/.temp/project-ref`          | plain text | when `--project-ref` and `SUPABASE_PROJECT_ID` are both unset |
+| `<SUPABASE_HOME or ~/.supabase>/telemetry.json` | JSON       | when present, before post-run telemetry state is refreshed    |
 
 ## Files Written
 
-| Path | Format | When |
-| ---- | ------ | ---- |
-| —    | —      | —    |
+| Path                                            | Format | When                                                                    |
+| ----------------------------------------------- | ------ | ----------------------------------------------------------------------- |
+| `<workdir>/supabase/.temp/linked-project.json`  | JSON   | after resolving a project ref, cached on both success and failure paths |
+| `<SUPABASE_HOME or ~/.supabase>/telemetry.json` | JSON   | after command completion, flushed on both success and failure paths     |
 
 ## API Routes
 
-| Method   | Path                                  | Auth         | Request body | Response (used fields) |
-| -------- | ------------------------------------- | ------------ | ------------ | ---------------------- |
-| `DELETE` | `/v1/projects/{ref}/functions/{slug}` | Bearer token | none         | none                   |
+| Method   | Path                                  | Auth         | Request body | Response (used fields)                                |
+| -------- | ------------------------------------- | ------------ | ------------ | ----------------------------------------------------- |
+| `DELETE` | `/v1/projects/{ref}/functions/{slug}` | Bearer token | none         | none                                                  |
+| `GET`    | `/v1/projects`                        | Bearer token | none         | project picker options when no ref is supplied in TTY |
+| `GET`    | `/v1/projects/{ref}`                  | Bearer token | none         | linked project metadata used by the post-run cache    |
 
 ## Environment Variables
 
-| Variable                | Purpose                                              | Required?                                               |
-| ----------------------- | ---------------------------------------------------- | ------------------------------------------------------- |
-| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `~/.supabase/access-token`) |
-| `SUPABASE_API_URL`      | override Management API base URL                     | no (defaults to `https://api.supabase.com`)             |
+| Variable                | Purpose                                                         | Required?                                                                             |
+| ----------------------- | --------------------------------------------------------------- | ------------------------------------------------------------------------------------- |
+| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup)            | no (falls back to keyring → `<SUPABASE_HOME or ~/.supabase>/access-token`)            |
+| `SUPABASE_HOME`         | overrides where `telemetry.json` and `profile` are read/written | no (defaults to `~/.supabase`)                                                        |
+| `SUPABASE_NO_KEYRING`   | disables the OS keyring, forcing the access-token file fallback | no                                                                                    |
+| `SUPABASE_PROFILE`      | select a built-in profile or YAML profile file with `api_url:`  | no (falls back to `~/.supabase/profile` -> `supabase`)                                |
+| `SUPABASE_PROJECT_ID`   | provides the project ref when `--project-ref` is unset          | no (falls back to `<workdir>/supabase/.temp/project-ref`)                             |
+| `SUPABASE_WORKDIR`      | sets `<workdir>` for local Supabase temp files                  | no (falls back to `--workdir` -> nearest ancestor with `supabase/config.toml` -> cwd) |
 
 ## Exit Codes
 
@@ -34,6 +45,12 @@
 | `1`  | authentication error (no token found) |
 | `1`  | network / connection failure          |
 
+## Telemetry Events Fired
+
+| Event                  | When                                       | Notable properties / groups                                                                                                 |
+| ---------------------- | ------------------------------------------ | --------------------------------------------------------------------------------------------------------------------------- |
+| `cli_command_executed` | post-run, success or failure (via wrapper) | `exit_code`, `duration_ms`, `flags` (`project-ref` recorded verbatim, matching `functions list`; every other flag redacted) |
+
 ## Output
 
 ### `--output-format text` (Go CLI compatible)
diff --git a/apps/cli/src/legacy/commands/functions/delete/delete.command.ts b/apps/cli/src/legacy/commands/functions/delete/delete.command.ts
index c7fa7bec59..307d65aa3c 100644
--- a/apps/cli/src/legacy/commands/functions/delete/delete.command.ts
+++ b/apps/cli/src/legacy/commands/functions/delete/delete.command.ts
@@ -1,5 +1,6 @@
 import { Argument, Command, Flag } from "effect/unstable/cli";
 import type * as CliCommand from "effect/unstable/cli/Command";
+import { FUNCTIONS_PROJECT_REF_SAFE_FLAGS } from "../../../../shared/functions/functions.shared.ts";
 import { withJsonErrorHandling } from "../../../../shared/output/json-error-handling.ts";
 import { legacyManagementApiRuntimeLayer } from "../../../shared/legacy-management-api-runtime.layer.ts";
 import { withLegacyCommandInstrumentation } from "../../../telemetry/legacy-command-instrumentation.ts";
@@ -17,6 +18,14 @@ const config = {
 
 export type LegacyFunctionsDeleteFlags = CliCommand.Command.Config.Infer<typeof config>;
 
+// Exported so integration tests can drive the exact wiring `Command.withHandler`
+// uses below, instead of re-asserting the generic instrumentation mechanism.
+export const legacyFunctionsDeleteHandler = (flags: LegacyFunctionsDeleteFlags) =>
+  legacyFunctionsDelete(flags).pipe(
+    withLegacyCommandInstrumentation({ flags, safeFlags: FUNCTIONS_PROJECT_REF_SAFE_FLAGS }),
+    withJsonErrorHandling,
+  );
+
 export const legacyFunctionsDeleteCommand = Command.make("delete", config).pipe(
   Command.withDescription(
     "Delete a Function from the linked Supabase project. This does NOT remove the Function locally.",
@@ -32,11 +41,6 @@ export const legacyFunctionsDeleteCommand = Command.make("delete", config).pipe(
       description: "Delete a deployed function from a specific project",
     },
   ]),
-  Command.withHandler((flags) =>
-    legacyFunctionsDelete(flags).pipe(
-      withLegacyCommandInstrumentation({ flags }),
-      withJsonErrorHandling,
-    ),
-  ),
+  Command.withHandler(legacyFunctionsDeleteHandler),
   Command.provide(legacyManagementApiRuntimeLayer(["functions", "delete"])),
 );
diff --git a/apps/cli/src/legacy/commands/functions/delete/delete.integration.test.ts b/apps/cli/src/legacy/commands/functions/delete/delete.integration.test.ts
index c3d78584d3..6c897b64db 100644
--- a/apps/cli/src/legacy/commands/functions/delete/delete.integration.test.ts
+++ b/apps/cli/src/legacy/commands/functions/delete/delete.integration.test.ts
@@ -1,6 +1,9 @@
 import { describe, expect, it } from "@effect/vitest";
-import { Effect, Option } from "effect";
+import { Effect, Layer, Option, Stdio } from "effect";
 
+import { commandRuntimeLayer } from "../../../../shared/runtime/command-runtime.layer.ts";
+import { CurrentAnalyticsContext } from "../../../../shared/telemetry/analytics-context.ts";
+import { Analytics } from "../../../../shared/telemetry/analytics.service.ts";
 import {
   buildLegacyTestRuntime,
   mockLegacyCliConfig,
@@ -10,10 +13,34 @@ import {
   useLegacyTempWorkdir,
 } from "../../../../../tests/helpers/legacy-mocks.ts";
 import { mockOutput } from "../../../../../tests/helpers/mocks.ts";
+import { legacyFunctionsDeleteHandler } from "./delete.command.ts";
 import { legacyFunctionsDelete } from "./delete.handler.ts";
 
 const tempRoot = useLegacyTempWorkdir("supabase-functions-delete-legacy-");
 
+// `withLegacyCommandInstrumentation` threads `flags`/`command`/etc. through
+// `CurrentAnalyticsContext`, not the direct `capture()` call args — mirrors
+// the identical local helper in `legacy-command-instrumentation.unit.test.ts`.
+// The shared `mockAnalytics()` in tests/helpers/mocks.ts deliberately doesn't
+// merge this context (most callers don't need it).
+function mockContextualAnalytics() {
+  const captured: Array<{ event: string; properties: Record<string, unknown> }> = [];
+  const layer = Layer.succeed(
+    Analytics,
+    Analytics.of({
+      capture: (event: string, properties: Record<string, unknown> = {}) =>
+        Effect.gen(function* () {
+          const context = yield* CurrentAnalyticsContext;
+          captured.push({ event, properties: { ...context, ...properties } });
+        }),
+      identify: () => Effect.void,
+      alias: () => Effect.void,
+      groupIdentify: () => Effect.void,
+    }),
+  );
+  return { layer, captured };
+}
+
 describe("legacy functions delete", () => {
   it.live("deletes a function natively through the Management API", () => {
     const out = mockOutput({ format: "text" });
@@ -68,4 +95,41 @@ describe("legacy functions delete", () => {
       expect(api.requests[0]?.url).toContain("/projects/qrstuvwxyzabcdefghij/functions/");
     }).pipe(Effect.provide(layer));
   });
+
+  it.live(
+    "does not redact --project-ref in cli_command_executed (Go parity: cmd/functions.go:153)",
+    () => {
+      const out = mockOutput({ format: "text" });
+      const api = mockLegacyPlatformApi({ response: { status: 200, body: null } });
+      const analytics = mockContextualAnalytics();
+      const layer = Layer.mergeAll(
+        buildLegacyTestRuntime({
+          out,
+          api,
+          cliConfig: mockLegacyCliConfig({ workdir: tempRoot.current }),
+          analytics,
+        }),
+        commandRuntimeLayer(["functions", "delete"]),
+        Stdio.layerTest({
+          args: Effect.succeed([
+            "functions",
+            "delete",
+            "hello-world",
+            "--project-ref",
+            "abcdefghijklmnopqrst",
+          ]),
+        }),
+      );
+
+      return Effect.gen(function* () {
+        yield* legacyFunctionsDeleteHandler({
+          functionName: "hello-world",
+          projectRef: Option.some("abcdefghijklmnopqrst"),
+        });
+
+        const event = analytics.captured.find((c) => c.event === "cli_command_executed");
+        expect(event?.properties.flags).toEqual({ "project-ref": "abcdefghijklmnopqrst" });
+      }).pipe(Effect.provide(layer));
+    },
+  );
 });
diff --git a/apps/cli/src/legacy/commands/functions/deploy/deploy.command.ts b/apps/cli/src/legacy/commands/functions/deploy/deploy.command.ts
index 495cb4f3bc..cb5577e056 100644
--- a/apps/cli/src/legacy/commands/functions/deploy/deploy.command.ts
+++ b/apps/cli/src/legacy/commands/functions/deploy/deploy.command.ts
@@ -1,5 +1,6 @@
 import { Argument, Command, Flag } from "effect/unstable/cli";
 import type * as CliCommand from "effect/unstable/cli/Command";
+import { FUNCTIONS_PROJECT_REF_SAFE_FLAGS } from "../../../../shared/functions/functions.shared.ts";
 import { withJsonErrorHandling } from "../../../../shared/output/json-error-handling.ts";
 import { legacyManagementApiRuntimeLayer } from "../../../shared/legacy-management-api-runtime.layer.ts";
 import { withLegacyCommandInstrumentation } from "../../../telemetry/legacy-command-instrumentation.ts";
@@ -64,7 +65,7 @@ export const legacyFunctionsDeployCommand = Command.make("deploy", config).pipe(
   ]),
   Command.withHandler((flags) =>
     legacyFunctionsDeploy(flags).pipe(
-      withLegacyCommandInstrumentation({ flags, safeFlags: ["project-ref"] }),
+      withLegacyCommandInstrumentation({ flags, safeFlags: FUNCTIONS_PROJECT_REF_SAFE_FLAGS }),
       withJsonErrorHandling,
     ),
   ),
diff --git a/apps/cli/src/legacy/commands/functions/deploy/deploy.e2e.test.ts b/apps/cli/src/legacy/commands/functions/deploy/deploy.e2e.test.ts
index 5f8df92de9..b9806a8151 100644
--- a/apps/cli/src/legacy/commands/functions/deploy/deploy.e2e.test.ts
+++ b/apps/cli/src/legacy/commands/functions/deploy/deploy.e2e.test.ts
@@ -4,21 +4,25 @@ import { join } from "node:path";
 import { describe, expect, test } from "vitest";
 import { makeTempHome, runSupabase } from "../../../../../tests/helpers/cli.ts";
 
-// Argument-validation negatives for `functions deploy`. This validation lives in
-// the Go CLI today (the legacy TS command proxies to it); a black-box subprocess
-// test keeps these assertions valid through the eventual native TS port — it
-// guards behavior, not implementation. Asserting the SPECIFIC error text also
-// avoids a false pass from an unrelated non-zero exit (e.g. a missing Go binary).
+// Argument-validation negatives for `functions deploy`. Both checks below are
+// native TS today (deployFunctions in shared/functions/deploy.ts) — the
+// bundler-mutex message byte-matches cobra's validateExclusiveFlagGroups
+// template, and --jobs mirrors Go's own top-of-RunE guard (`if useApi { ... }
+// else if maxJobs > 1 { error }`). A black-box subprocess test still earns its
+// keep here: asserting the SPECIFIC error text avoids a false pass from an
+// unrelated non-zero exit (e.g. a missing build artifact), and exercises the
+// real CLI entrypoint end to end.
 //
-// All cases fail before any network call (cobra flag parsing / pre-resolution),
-// so no auth or linked project is required.
+// All cases fail before any network call (flag-group validation / the jobs
+// check both run before project-ref resolution), so no auth or linked
+// project is required.
 
 const E2E_TIMEOUT_MS = 30_000;
 const SLUG = "deploy-e2e-basic";
 // Valid-format token + ref to clear the auth and project-ref gates (both checked
-// before the Go bundler-flag validation under test). These cases all fail before
-// any network call (cobra flag-group validation / the jobs check at the top of
-// RunE), so neither value is ever used against a real API.
+// before the bundler-flag validation under test). These cases all fail before
+// any network call (flag-group validation / the jobs check at the top of the
+// handler), so neither value is ever used against a real API.
 const FAKE_TOKEN = `sbp_${"0".repeat(40)}`;
 const FAKE_REF = "a".repeat(20);
 
@@ -41,7 +45,10 @@ describe("supabase functions deploy (legacy) — argument validation", () => {
         },
       );
       expect(exitCode).not.toBe(0);
-      expect(stderr).toMatch(/none of the others can be|mutually exclusive/i);
+      // Byte-matches cobra's validateExclusiveFlagGroups (flag_groups.go:204).
+      expect(stderr).toContain(
+        "if any flags in the group [use-api use-docker legacy-bundle] are set none of the others can be",
+      );
     });
   }
 
@@ -56,12 +63,36 @@ describe("supabase functions deploy (legacy) — argument validation", () => {
       },
     );
     expect(exitCode).not.toBe(0);
-    // The Go CLI phrases this as either "must be used together with --use-api"
-    // or "cannot be used with local bundling" depending on version — both mean
-    // --jobs is rejected without server-side (--use-api) bundling.
-    expect(stderr).toMatch(/--jobs\b.*(--use-api|local bundling)/i);
+    expect(stderr).toContain("--jobs must be used together with --use-api");
   });
 
+  test(
+    "rejects --jobs without --use-api even with --use-docker=false (Go parity gap)",
+    { timeout: E2E_TIMEOUT_MS },
+    async () => {
+      using home = makeTempHome();
+      const { exitCode, stderr } = await runSupabase(
+        [
+          "functions",
+          "deploy",
+          SLUG,
+          "--project-ref",
+          FAKE_REF,
+          "--use-docker=false",
+          "--jobs",
+          "2",
+        ],
+        {
+          entrypoint: "legacy",
+          home: home.dir,
+          env: { HOME: home.dir, SUPABASE_ACCESS_TOKEN: FAKE_TOKEN },
+        },
+      );
+      expect(exitCode).not.toBe(0);
+      expect(stderr).toContain("--jobs must be used together with --use-api");
+    },
+  );
+
   test("fails without a linked project or --project-ref", { timeout: E2E_TIMEOUT_MS }, async () => {
     using home = makeTempHome();
     const workdir = mkdtempSync(join(tmpdir(), "fn-deploy-nolink-"));
diff --git a/apps/cli/src/legacy/commands/functions/deploy/deploy.handler.ts b/apps/cli/src/legacy/commands/functions/deploy/deploy.handler.ts
index ece00daaa3..f1f8e6c4c9 100644
--- a/apps/cli/src/legacy/commands/functions/deploy/deploy.handler.ts
+++ b/apps/cli/src/legacy/commands/functions/deploy/deploy.handler.ts
@@ -41,6 +41,7 @@ export const legacyFunctionsDeploy = Effect.fn("legacy.functions.deploy")(functi
     projectRoot: cliConfig.workdir,
     supabaseDir: join(cliConfig.workdir, "supabase"),
     dashboardUrl: legacyDashboardUrl(cliConfig.profile),
+    goViperCompat: true,
     yes,
     rawArgs,
     edgeRuntimeVersion,
diff --git a/apps/cli/src/legacy/commands/functions/deploy/deploy.integration.test.ts b/apps/cli/src/legacy/commands/functions/deploy/deploy.integration.test.ts
index 7984803387..e572727916 100644
--- a/apps/cli/src/legacy/commands/functions/deploy/deploy.integration.test.ts
+++ b/apps/cli/src/legacy/commands/functions/deploy/deploy.integration.test.ts
@@ -14,6 +14,8 @@ import {
   useLegacyTempWorkdir,
 } from "../../../../../tests/helpers/legacy-mocks.ts";
 import { mockOutput, mockRuntimeInfo } from "../../../../../tests/helpers/mocks.ts";
+import { mockChildProcessSpawner } from "../../../../../../../packages/process-compose/tests/helpers/mocks.ts";
+import { ConflictingFunctionDeployFlagsError } from "../../../../shared/functions/deploy.errors.ts";
 import { legacyFunctionsDeploy } from "./deploy.handler.ts";
 import type { LegacyFunctionsDeployFlags } from "./deploy.command.ts";
 
@@ -482,4 +484,285 @@ describe("legacy functions deploy", () => {
       ),
     );
   });
+
+  it.live("rejects the bundler mutex with cobra's exact error text", () => {
+    const out = mockOutput({ format: "text" });
+    const api = mockLegacyPlatformApi();
+    const layer = Layer.mergeAll(
+      buildLegacyTestRuntime({
+        out,
+        api,
+        cliConfig: mockLegacyCliConfig({ workdir: tempRoot.current }),
+        runtimeInfo: mockRuntimeInfo({ cwd: tempRoot.current }),
+      }),
+      Layer.succeed(LegacyYesFlag, false),
+      Stdio.layerTest({
+        args: Effect.succeed(["functions", "deploy", "hello-world", "--use-api", "--use-docker"]),
+      }),
+    );
+
+    return Effect.gen(function* () {
+      const error = yield* legacyFunctionsDeploy({ ...baseFlags, useDocker: true }).pipe(
+        Effect.flip,
+      );
+
+      expect(error).toBeInstanceOf(ConflictingFunctionDeployFlagsError);
+      if (!(error instanceof ConflictingFunctionDeployFlagsError)) {
+        throw new Error(`unexpected error: ${String(error)}`);
+      }
+      expect(error.message).toBe(
+        "if any flags in the group [use-api use-docker legacy-bundle] are set none of the others can be; [use-api use-docker] were all set",
+      );
+      expect(api.requests).toHaveLength(0);
+    }).pipe(Effect.provide(layer));
+  });
+
+  describe("--jobs validation (Go parity: cmd/functions.go:79-82)", () => {
+    function setupJobsTest(rawArgs: ReadonlyArray<string>) {
+      const out = mockOutput({ format: "text" });
+      const api = mockLegacyPlatformApi({
+        handler: (request) => Effect.succeed(legacyJsonResponse(request, 200, [])),
+      });
+      const layer = Layer.mergeAll(
+        buildLegacyTestRuntime({
+          out,
+          api,
+          cliConfig: mockLegacyCliConfig({ workdir: tempRoot.current }),
+          runtimeInfo: mockRuntimeInfo({ cwd: tempRoot.current }),
+        }),
+        Layer.succeed(LegacyYesFlag, false),
+        Stdio.layerTest({ args: Effect.succeed(rawArgs) }),
+      );
+      return { out, api, layer };
+    }
+
+    it.live("rejects --jobs > 1 without --use-api, even with default --use-docker", () => {
+      const { layer } = setupJobsTest(["functions", "deploy", "hello-world", "--jobs", "2"]);
+
+      return Effect.gen(function* () {
+        const error = yield* legacyFunctionsDeploy({
+          ...baseFlags,
+          useApi: false,
+          useDocker: true,
+          jobs: Option.some(2),
+        }).pipe(Effect.provide(layer), Effect.flip);
+
+        expect(error).toBeInstanceOf(Error);
+        expect((error as Error).message).toBe("--jobs must be used together with --use-api");
+      });
+    });
+
+    it.live("rejects --jobs > 1 with --use-docker=false and no --use-api (Go parity gap)", () => {
+      // Divergence this test guards: previously the guard only fired when local
+      // bundling (Docker/legacy-bundle) was active, so `--use-docker=false --jobs 2`
+      // (no --use-api) silently passed in TS while Go rejected it.
+      const { layer } = setupJobsTest([
+        "functions",
+        "deploy",
+        "hello-world",
+        "--use-docker=false",
+        "--jobs",
+        "2",
+      ]);
+
+      return Effect.gen(function* () {
+        const error = yield* legacyFunctionsDeploy({
+          ...baseFlags,
+          useApi: false,
+          useDocker: false,
+          jobs: Option.some(2),
+        }).pipe(Effect.provide(layer), Effect.flip);
+
+        expect(error).toBeInstanceOf(Error);
+        expect((error as Error).message).toBe("--jobs must be used together with --use-api");
+      });
+    });
+
+    it.live("allows --jobs > 1 together with --use-api", () => {
+      const out = mockOutput({ format: "text" });
+      const api = mockLegacyPlatformApi({
+        handler: (request) => {
+          if (request.method === "GET") {
+            return Effect.succeed(legacyJsonResponse(request, 200, []));
+          }
+          return Effect.succeed(
+            legacyJsonResponse(request, 201, {
+              id: "function-id",
+              slug: "hello-world",
+              name: "hello-world",
+              status: "ACTIVE",
+              version: 2,
+              created_at: 1_687_423_025_152,
+              updated_at: 1_687_423_025_152,
+              verify_jwt: true,
+              import_map: true,
+              entrypoint_path: "functions/hello-world/index.ts",
+              import_map_path: "functions/hello-world/deno.json",
+            }),
+          );
+        },
+      });
+      const layer = Layer.mergeAll(
+        buildLegacyTestRuntime({
+          out,
+          api,
+          cliConfig: mockLegacyCliConfig({ workdir: tempRoot.current }),
+          runtimeInfo: mockRuntimeInfo({ cwd: tempRoot.current }),
+        }),
+        Layer.succeed(LegacyYesFlag, false),
+        Stdio.layerTest({
+          args: Effect.succeed(["functions", "deploy", "hello-world", "--use-api", "--jobs", "2"]),
+        }),
+      );
+
+      return Effect.gen(function* () {
+        yield* Effect.tryPromise(() => writeProjectConfig(tempRoot.current));
+        yield* Effect.tryPromise(() => writeLocalFunction(tempRoot.current, "hello-world"));
+
+        yield* legacyFunctionsDeploy({
+          ...baseFlags,
+          useApi: true,
+          jobs: Option.some(2),
+        });
+
+        expect(out.stdoutText).toContain(
+          "Deployed Functions on project abcdefghijklmnopqrst: hello-world\n",
+        );
+      }).pipe(
+        Effect.provide(layer),
+        Effect.ensuring(
+          Effect.tryPromise(() => rm(tempRoot.current, { recursive: true, force: true })),
+        ),
+      );
+    });
+
+    it.live("treats --jobs 0 as 1 and does not require --use-api", () => {
+      const out = mockOutput({ format: "text" });
+      const api = mockLegacyPlatformApi({
+        handler: (request) => {
+          if (request.method === "GET") {
+            return Effect.succeed(legacyJsonResponse(request, 200, []));
+          }
+          return Effect.succeed(
+            legacyJsonResponse(request, 201, {
+              id: "function-id",
+              slug: "hello-world",
+              name: "hello-world",
+              status: "ACTIVE",
+              version: 2,
+              created_at: 1_687_423_025_152,
+              updated_at: 1_687_423_025_152,
+              verify_jwt: true,
+              import_map: true,
+              entrypoint_path: "functions/hello-world/index.ts",
+              import_map_path: "functions/hello-world/deno.json",
+            }),
+          );
+        },
+      });
+      const layer = Layer.mergeAll(
+        buildLegacyTestRuntime({
+          out,
+          api,
+          cliConfig: mockLegacyCliConfig({ workdir: tempRoot.current }),
+          runtimeInfo: mockRuntimeInfo({ cwd: tempRoot.current }),
+        }),
+        Layer.succeed(LegacyYesFlag, false),
+        Stdio.layerTest({
+          args: Effect.succeed(["functions", "deploy", "hello-world", "--jobs", "0"]),
+        }),
+      );
+
+      return Effect.gen(function* () {
+        yield* Effect.tryPromise(() => writeProjectConfig(tempRoot.current));
+        yield* Effect.tryPromise(() => writeLocalFunction(tempRoot.current, "hello-world"));
+
+        yield* legacyFunctionsDeploy({
+          ...baseFlags,
+          useApi: false,
+          jobs: Option.some(0),
+        });
+
+        expect(out.stdoutText).toContain(
+          "Deployed Functions on project abcdefghijklmnopqrst: hello-world\n",
+        );
+      }).pipe(
+        Effect.provide(layer),
+        Effect.ensuring(
+          Effect.tryPromise(() => rm(tempRoot.current, { recursive: true, force: true })),
+        ),
+      );
+    });
+  });
+
+  describe("bundler routing with --use-api=false (Go parity: cmd/functions.go:79-80)", () => {
+    it.live("falls through to Docker bundling, not the API path, when --use-api=false", () => {
+      // Divergence this test guards: Go's `if useApi { useDocker = false }` only forces
+      // the API path when the RESOLVED value is true. `--use-api=false` alone must leave
+      // `useDocker`'s own value (default true) in effect, routing to Docker — previously
+      // `useLocalBundler` keyed off flag *presence* (`explicitUseApi`), so typing
+      // `--use-api=false` silently forced the API path instead.
+      const out = mockOutput({ format: "text" });
+      const child = mockChildProcessSpawner({ exitCode: 1 });
+      const api = mockLegacyPlatformApi({
+        handler: (request) => {
+          if (request.method === "GET") {
+            return Effect.succeed(legacyJsonResponse(request, 200, []));
+          }
+          return Effect.succeed(
+            legacyJsonResponse(request, 201, {
+              id: "function-id",
+              slug: "hello-world",
+              name: "hello-world",
+              status: "ACTIVE",
+              version: 2,
+              created_at: 1_687_423_025_152,
+              updated_at: 1_687_423_025_152,
+              verify_jwt: true,
+              import_map: true,
+              entrypoint_path: "functions/hello-world/index.ts",
+              import_map_path: "functions/hello-world/deno.json",
+            }),
+          );
+        },
+      });
+      const layer = Layer.mergeAll(
+        buildLegacyTestRuntime({
+          out,
+          api,
+          cliConfig: mockLegacyCliConfig({ workdir: tempRoot.current }),
+          runtimeInfo: mockRuntimeInfo({ cwd: tempRoot.current }),
+        }),
+        Layer.succeed(LegacyYesFlag, false),
+        child.layer,
+        Stdio.layerTest({
+          args: Effect.succeed(["functions", "deploy", "hello-world", "--use-api=false"]),
+        }),
+      );
+
+      return Effect.gen(function* () {
+        yield* Effect.tryPromise(() => writeProjectConfig(tempRoot.current));
+        yield* Effect.tryPromise(() => writeLocalFunction(tempRoot.current, "hello-world"));
+
+        yield* legacyFunctionsDeploy({
+          ...baseFlags,
+          useApi: false,
+          useDocker: true,
+        });
+
+        // Docker was actually attempted (proves useLocalBundler resolved to true);
+        // it wasn't running, so the command fell back to the API and still succeeded.
+        expect(child.spawned).toEqual([{ command: "docker", args: ["info"] }]);
+        expect(out.stderrText).toContain("WARNING: Docker is not running\n");
+        expect(out.stdoutText).toContain(
+          "Deployed Functions on project abcdefghijklmnopqrst: hello-world\n",
+        );
+      }).pipe(
+        Effect.provide(layer),
+        Effect.ensuring(
+          Effect.tryPromise(() => rm(tempRoot.current, { recursive: true, force: true })),
+        ),
+      );
+    });
+  });
 });
diff --git a/apps/cli/src/legacy/commands/functions/download/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/functions/download/SIDE_EFFECTS.md
index 7a70bcb517..9c9c6a1845 100644
--- a/apps/cli/src/legacy/commands/functions/download/SIDE_EFFECTS.md
+++ b/apps/cli/src/legacy/commands/functions/download/SIDE_EFFECTS.md
@@ -2,45 +2,72 @@
 
 ## Files Read
 
-| Path                       | Format     | When                                                       |
-| -------------------------- | ---------- | ---------------------------------------------------------- |
-| `~/.supabase/access-token` | plain text | when `SUPABASE_ACCESS_TOKEN` unset and keyring unavailable |
+| Path                                            | Format     | When                                                          |
+| ----------------------------------------------- | ---------- | ------------------------------------------------------------- |
+| `<SUPABASE_HOME or ~/.supabase>/access-token`   | plain text | when `SUPABASE_ACCESS_TOKEN` unset and keyring unavailable    |
+| `<SUPABASE_HOME or ~/.supabase>/profile`        | plain text | when `--profile` and `SUPABASE_PROFILE` are both unset        |
+| `<profile>.yaml`                                | YAML       | when `SUPABASE_PROFILE` or `--profile` points to a file       |
+| `<workdir>/supabase/.temp/project-ref`          | plain text | when `--project-ref` and `SUPABASE_PROJECT_ID` are both unset |
+| `<SUPABASE_HOME or ~/.supabase>/telemetry.json` | JSON       | when present, before post-run telemetry state is refreshed    |
 
 ## Files Written
 
-| Path                                                | Format | When                                     |
-| --------------------------------------------------- | ------ | ---------------------------------------- |
-| `<workdir>/supabase/functions/<slug>/<remote path>` | bytes  | for each source file returned by the API |
+| Path                                                | Format | When                                                                    |
+| --------------------------------------------------- | ------ | ----------------------------------------------------------------------- |
+| `<workdir>/supabase/functions/<slug>/<remote path>` | bytes  | for each source file returned by the API                                |
+| `<workdir>/supabase/.temp/linked-project.json`      | JSON   | after resolving a project ref, cached on both success and failure paths |
+| `<SUPABASE_HOME or ~/.supabase>/telemetry.json`     | JSON   | after command completion, flushed on both success and failure paths     |
 
 ## API Routes
 
-| Method | Path                                       | Auth         | Request body | Response (used fields)                     |
-| ------ | ------------------------------------------ | ------------ | ------------ | ------------------------------------------ |
-| `GET`  | `/v1/projects/{ref}/functions`             | Bearer token | none         | function slugs, when downloading all       |
-| `GET`  | `/v1/projects/{ref}/functions/{slug}`      | Bearer token | none         | entrypoint path, when absent from metadata |
-| `GET`  | `/v1/projects/{ref}/functions/{slug}/body` | Bearer token | none         | multipart function source                  |
+| Method | Path                                       | Auth         | Request body | Response (used fields)                                |
+| ------ | ------------------------------------------ | ------------ | ------------ | ----------------------------------------------------- |
+| `GET`  | `/v1/projects/{ref}/functions`             | Bearer token | none         | function slugs, when downloading all                  |
+| `GET`  | `/v1/projects/{ref}/functions/{slug}`      | Bearer token | none         | entrypoint path, when absent from metadata            |
+| `GET`  | `/v1/projects/{ref}/functions/{slug}/body` | Bearer token | none         | multipart function source                             |
+| `GET`  | `/v1/projects`                             | Bearer token | none         | project picker options when no ref is supplied in TTY |
+| `GET`  | `/v1/projects/{ref}`                       | Bearer token | none         | linked project metadata used by the post-run cache    |
 
 ## Subprocesses
 
-| Command                              | When                                | Purpose                             |
-| ------------------------------------ | ----------------------------------- | ----------------------------------- |
-| `supabase-go functions download ...` | `--use-docker` or `--legacy-bundle` | preserve hidden compatibility modes |
+| Command                              | When                                                              | Purpose                             |
+| ------------------------------------ | ----------------------------------------------------------------- | ----------------------------------- |
+| `supabase-go functions download ...` | `--use-docker` (default) or `--legacy-bundle`, unless `--use-api` | preserve hidden compatibility modes |
+
+The delegated call runs with `SUPABASE_TELEMETRY_DISABLED=1` so the Go child's
+own `cli_command_executed` doesn't double-count on top of this command's own
+telemetry (mirrors `db pull`/`db diff`'s delegated-call pattern). In
+`--output-format json|stream-json`, the child's stdout is captured and
+discarded instead of inherited (`LegacyGoProxy.execCapture`) — the raw text
+never reaches the terminal, and this command emits the `Output` envelope
+itself once the child exits successfully.
 
 ## Environment Variables
 
-| Variable                | Purpose                                              | Required?                                               |
-| ----------------------- | ---------------------------------------------------- | ------------------------------------------------------- |
-| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `~/.supabase/access-token`) |
-| `SUPABASE_API_URL`      | override Management API base URL                     | no (defaults to `https://api.supabase.com`)             |
+| Variable                | Purpose                                                         | Required?                                                                             |
+| ----------------------- | --------------------------------------------------------------- | ------------------------------------------------------------------------------------- |
+| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup)            | no (falls back to keyring → `<SUPABASE_HOME or ~/.supabase>/access-token`)            |
+| `SUPABASE_HOME`         | overrides where `telemetry.json` and `profile` are read/written | no (defaults to `~/.supabase`)                                                        |
+| `SUPABASE_NO_KEYRING`   | disables the OS keyring, forcing the access-token file fallback | no                                                                                    |
+| `SUPABASE_PROFILE`      | select a built-in profile or YAML profile file with `api_url:`  | no (falls back to `~/.supabase/profile` -> `supabase`)                                |
+| `SUPABASE_PROJECT_ID`   | provides the project ref when `--project-ref` is unset          | no (falls back to `<workdir>/supabase/.temp/project-ref`)                             |
+| `SUPABASE_WORKDIR`      | sets `<workdir>` for local Supabase temp files                  | no (falls back to `--workdir` -> nearest ancestor with `supabase/config.toml` -> cwd) |
 
 ## Exit Codes
 
-| Code | Condition                             |
-| ---- | ------------------------------------- |
-| `0`  | success                               |
-| `1`  | API error (non-2xx response)          |
-| `1`  | authentication error (no token found) |
-| `1`  | network / connection failure          |
+| Code | Condition                              |
+| ---- | -------------------------------------- |
+| `0`  | success                                |
+| `1`  | API error (non-2xx response)           |
+| `1`  | authentication error (no token found)  |
+| `1`  | network / connection failure           |
+| `1`  | invalid function slug or flag conflict |
+
+## Telemetry Events Fired
+
+| Event                  | When                                       | Notable properties / groups                                                                                                                                                                                                                                                                |
+| ---------------------- | ------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
+| `cli_command_executed` | post-run, success or failure (via wrapper) | `exit_code`, `duration_ms`, `flags` (`project-ref` recorded verbatim, matching `functions list`/`delete`; `use-api`/`use-docker`/`legacy-bundle` also recorded verbatim since they are boolean flags, matching Go's `isBooleanFlag` branch; no flag on this command is currently redacted) |
 
 ## Output
 
@@ -50,11 +77,13 @@ Prints progress and success messages as functions are downloaded.
 
 ### `--output-format json`
 
-Prints a structured success result with the downloaded function slugs and project ref.
+Prints a structured success result with the downloaded function slugs and project ref. On the
+Docker/legacy-bundle proxy path, the Go child's stdout is captured/discarded (never inherited) so
+it can't corrupt the envelope; the slug list is resolved independently for the payload.
 
 ### `--output-format stream-json`
 
-Prints a structured success result with the downloaded function slugs and project ref.
+Same envelope as `json` above (including on the proxy path).
 
 ## Notes
 
@@ -62,4 +91,7 @@ Prints a structured success result with the downloaded function slugs and projec
 - Requires a linked project (`--project-ref` or linked project config).
 - Native downloads reject path traversal and symlink escapes before writing source files.
 - `--use-docker` and `--legacy-bundle` are hidden flags forwarded to the Go binary for backward compatibility; they are mutually exclusive with `--use-api`.
+- `--use-docker` defaults to `true` (Go parity), so a bare `supabase functions download` proxies to the Go binary's Docker-based unbundler unless `--use-api` resolves to `true`, which forces the native server-side download path instead (`apps/cli-go/cmd/functions.go:51-53`: `if useApi { useDocker = false }` reads the resolved flag value, not presence — `--use-api=false` still proxies).
+- If Docker is not running, the Go binary itself prints `WARNING: Docker is not running` to stderr and falls back to its own server-side unbundler — the command still exits `0` without Docker installed or running.
+- The mutual-exclusivity check only counts flags the user explicitly passed on the command line, not `--use-docker`'s default value — so `--use-api` alone never trips the "mutually exclusive" error. The Go proxy call itself also only ever forwards one of `--use-docker`/`--legacy-bundle`, never both, even though `--use-docker` defaults to `true`.
 - Refreshes the linked-project telemetry cache and flushes telemetry state after resolving a project ref.
diff --git a/apps/cli/src/legacy/commands/functions/download/download.command.ts b/apps/cli/src/legacy/commands/functions/download/download.command.ts
index 0d3f559dd0..e7cb3d5ad5 100644
--- a/apps/cli/src/legacy/commands/functions/download/download.command.ts
+++ b/apps/cli/src/legacy/commands/functions/download/download.command.ts
@@ -1,5 +1,6 @@
 import { Argument, Command, Flag } from "effect/unstable/cli";
 import type * as CliCommand from "effect/unstable/cli/Command";
+import { FUNCTIONS_PROJECT_REF_SAFE_FLAGS } from "../../../../shared/functions/functions.shared.ts";
 import { withJsonErrorHandling } from "../../../../shared/output/json-error-handling.ts";
 import { legacyManagementApiRuntimeLayer } from "../../../shared/legacy-management-api-runtime.layer.ts";
 import { withLegacyCommandInstrumentation } from "../../../telemetry/legacy-command-instrumentation.ts";
@@ -19,6 +20,7 @@ const config = {
   ),
   useDocker: Flag.boolean("use-docker").pipe(
     Flag.withDescription("Use Docker to unbundle functions locally."),
+    Flag.withDefault(true),
     Flag.withHidden,
   ),
   legacyBundle: Flag.boolean("legacy-bundle").pipe(
@@ -29,6 +31,14 @@ const config = {
 
 export type LegacyFunctionsDownloadFlags = CliCommand.Command.Config.Infer<typeof config>;
 
+// Exported so integration tests can drive the exact wiring `Command.withHandler`
+// uses below, instead of re-asserting the generic instrumentation mechanism.
+export const legacyFunctionsDownloadHandler = (flags: LegacyFunctionsDownloadFlags) =>
+  legacyFunctionsDownload(flags).pipe(
+    withLegacyCommandInstrumentation({ flags, safeFlags: FUNCTIONS_PROJECT_REF_SAFE_FLAGS }),
+    withJsonErrorHandling,
+  );
+
 export const legacyFunctionsDownloadCommand = Command.make("download", config).pipe(
   Command.withDescription(
     "Download the source code for a Function from the linked Supabase project. If no function name is provided, downloads all functions.",
@@ -44,11 +54,6 @@ export const legacyFunctionsDownloadCommand = Command.make("download", config).p
       description: "Download all functions from a specific project",
     },
   ]),
-  Command.withHandler((flags) =>
-    legacyFunctionsDownload(flags).pipe(
-      withLegacyCommandInstrumentation({ flags }),
-      withJsonErrorHandling,
-    ),
-  ),
+  Command.withHandler(legacyFunctionsDownloadHandler),
   Command.provide(legacyManagementApiRuntimeLayer(["functions", "download"])),
 );
diff --git a/apps/cli/src/legacy/commands/functions/download/download.e2e.test.ts b/apps/cli/src/legacy/commands/functions/download/download.e2e.test.ts
new file mode 100644
index 0000000000..f52a23d3be
--- /dev/null
+++ b/apps/cli/src/legacy/commands/functions/download/download.e2e.test.ts
@@ -0,0 +1,66 @@
+import { describe, expect, test } from "vitest";
+import { makeTempHome, runSupabase } from "../../../../../tests/helpers/cli.ts";
+
+// Argument-validation negatives for `functions download`. This validation
+// lives in the Go CLI today (the legacy TS command proxies to it); a
+// black-box subprocess test keeps these assertions valid through the
+// eventual native TS port — it guards behavior, not implementation. Mirrors
+// `deploy.e2e.test.ts`'s coverage for the sibling `--use-docker` default bug
+// (CLI-1862).
+//
+// The mutex-conflict cases below fail before any network call (flag parsing
+// / mutex validation), so no auth or linked project is required.
+
+const E2E_TIMEOUT_MS = 30_000;
+const SLUG = "download-e2e-basic";
+const FAKE_TOKEN = `sbp_${"0".repeat(40)}`;
+const FAKE_REF = "a".repeat(20);
+
+describe("supabase functions download (legacy) — argument validation", () => {
+  const conflicts = [
+    { name: "--use-api + --use-docker", flags: ["--use-api", "--use-docker"] },
+    { name: "--use-api + --legacy-bundle", flags: ["--use-api", "--legacy-bundle"] },
+    { name: "--use-docker + --legacy-bundle", flags: ["--use-docker", "--legacy-bundle"] },
+  ] as const;
+
+  for (const { name, flags } of conflicts) {
+    test(`rejects ${name} as mutually exclusive`, { timeout: E2E_TIMEOUT_MS }, async () => {
+      using home = makeTempHome();
+      const { exitCode, stderr } = await runSupabase(
+        ["functions", "download", SLUG, "--project-ref", FAKE_REF, ...flags],
+        {
+          entrypoint: "legacy",
+          home: home.dir,
+          env: { HOME: home.dir, SUPABASE_ACCESS_TOKEN: FAKE_TOKEN },
+        },
+      );
+      expect(exitCode).not.toBe(0);
+      expect(stderr).toMatch(/none of the others can be|mutually exclusive/i);
+    });
+  }
+
+  // CLI-1862: `--use-docker` now defaults to `true` (Go parity). Before the
+  // fix, that default was counted as "explicitly selected" by the mutex
+  // check, so passing `--use-api` alone was incorrectly rejected as
+  // conflicting with the (unpassed) `--use-docker` default. Covered in
+  // `download.integration.test.ts` ("does not treat the --use-docker default
+  // as conflicting with an explicit --use-api") via a mocked platform API
+  // instead of here: now that the mutex check is fixed, `--use-api` alone
+  // passes validation and proceeds to the native downloader, which calls the
+  // real Management API with the fake token/ref — an argument-validation
+  // test shouldn't depend on that network round-trip.
+
+  // CLI-1862: the TS→Go proxy call must not forward the now-defaulted
+  // `--use-docker` alongside an explicit `--legacy-bundle` — the Go binary
+  // re-parses this argv itself and enforces the same mutual exclusivity, so
+  // forwarding both breaks `--legacy-bundle` outright. Covered in
+  // `download.integration.test.ts` ("forwards only --legacy-bundle to the Go
+  // proxy...") via a mocked `LegacyGoProxy` instead of here: unlike
+  // `--use-api`, `--legacy-bundle` routes to the Go binary's `RunLegacy`
+  // downloader, which calls `InstallOrUpgradeDeno` before any network call
+  // (`apps/cli-go/internal/functions/download/download.go`). Each e2e run
+  // gets a fresh `SUPABASE_HOME`, so this would trigger a real, uncached
+  // Deno download from GitHub on every run — a real cross-boundary
+  // dependency this suite shouldn't take on to prove a pure TS-side routing
+  // decision.
+});
diff --git a/apps/cli/src/legacy/commands/functions/download/download.handler.ts b/apps/cli/src/legacy/commands/functions/download/download.handler.ts
index 70cb9da73c..4b666da7f6 100644
--- a/apps/cli/src/legacy/commands/functions/download/download.handler.ts
+++ b/apps/cli/src/legacy/commands/functions/download/download.handler.ts
@@ -1,4 +1,4 @@
-import { Effect, Option } from "effect";
+import { Effect, Option, Stdio } from "effect";
 import {
   downloadFunctions,
   makeGoProxyDownloadArgs,
@@ -20,11 +20,14 @@ export const legacyFunctionsDownload = Effect.fn("legacy.functions.download")(fu
   const linkedProjectCache = yield* LegacyLinkedProjectCache;
   const telemetryState = yield* LegacyTelemetryState;
   const proxy = yield* LegacyGoProxy;
+  const stdio = yield* Stdio.Stdio;
+  const rawArgs = yield* stdio.args;
   let resolvedProjectRef = Option.none<string>();
 
   yield* downloadFunctions(flags, {
     api,
     projectRoot: cliConfig.workdir,
+    rawArgs,
     resolveProjectRef: (projectRef) =>
       resolver.resolve(projectRef).pipe(
         Effect.tap((ref) =>
@@ -33,8 +36,23 @@ export const legacyFunctionsDownload = Effect.fn("legacy.functions.download")(fu
           }),
         ),
       ),
-    proxyDownload: (proxyFlags, projectRef) =>
-      proxy.exec(makeGoProxyDownloadArgs(proxyFlags, projectRef)),
+    // The delegated Go binary runs its own `Execute()` and would otherwise
+    // fire its own `cli_command_executed` on top of this command's own
+    // `withLegacyCommandInstrumentation` wrapper. Suppress it so proxied
+    // invocations record exactly one event, matching Go (mirrors `db pull` /
+    // `db diff`'s delegated-call pattern).
+    //
+    // In machine-output mode the child's stdout is captured and discarded
+    // instead of inherited, matching `db pull`/`db diff`'s delegated-call
+    // pattern for the CLI-1546 "stdout is payload-only in machine mode"
+    // invariant — `downloadFunctions` emits the `Output` envelope itself.
+    proxyDownload: (proxyFlags, projectRef, captureOutput) => {
+      const args = makeGoProxyDownloadArgs(proxyFlags, projectRef);
+      const env = { SUPABASE_TELEMETRY_DISABLED: "1" };
+      return captureOutput
+        ? Effect.asVoid(proxy.execCapture(args, { env, stdin: "ignore" }))
+        : proxy.exec(args, { env });
+    },
   }).pipe(
     Effect.ensuring(
       Effect.suspend(() =>
diff --git a/apps/cli/src/legacy/commands/functions/download/download.integration.test.ts b/apps/cli/src/legacy/commands/functions/download/download.integration.test.ts
index a6384d4e06..af37969828 100644
--- a/apps/cli/src/legacy/commands/functions/download/download.integration.test.ts
+++ b/apps/cli/src/legacy/commands/functions/download/download.integration.test.ts
@@ -1,9 +1,12 @@
 import { describe, expect, it } from "@effect/vitest";
 import { readFile } from "node:fs/promises";
 import { join } from "node:path";
-import { Effect, Layer, Option } from "effect";
+import { Effect, Exit, Layer, Option, Stdio } from "effect";
 import * as HttpClientResponse from "effect/unstable/http/HttpClientResponse";
 
+import { commandRuntimeLayer } from "../../../../shared/runtime/command-runtime.layer.ts";
+import { CurrentAnalyticsContext } from "../../../../shared/telemetry/analytics-context.ts";
+import { Analytics } from "../../../../shared/telemetry/analytics.service.ts";
 import {
   buildLegacyTestRuntime,
   legacyJsonResponse,
@@ -15,10 +18,35 @@ import {
 } from "../../../../../tests/helpers/legacy-mocks.ts";
 import { mockOutput } from "../../../../../tests/helpers/mocks.ts";
 import { LegacyGoProxy } from "../../../../shared/legacy/go-proxy.service.ts";
+import { ConflictingFunctionDownloadFlagsError } from "../../../../shared/functions/download.errors.ts";
+import { legacyFunctionsDownloadHandler } from "./download.command.ts";
 import type { LegacyFunctionsDownloadFlags } from "./download.command.ts";
 import { legacyFunctionsDownload } from "./download.handler.ts";
 
 const tempRoot = useLegacyTempWorkdir("supabase-functions-download-legacy-");
+
+// `withLegacyCommandInstrumentation` threads `flags`/`command`/etc. through
+// `CurrentAnalyticsContext`, not the direct `capture()` call args — mirrors
+// the identical local helper in `legacy-command-instrumentation.unit.test.ts`.
+// The shared `mockAnalytics()` in tests/helpers/mocks.ts deliberately doesn't
+// merge this context (most callers don't need it).
+function mockContextualAnalytics() {
+  const captured: Array<{ event: string; properties: Record<string, unknown> }> = [];
+  const layer = Layer.succeed(
+    Analytics,
+    Analytics.of({
+      capture: (event: string, properties: Record<string, unknown> = {}) =>
+        Effect.gen(function* () {
+          const context = yield* CurrentAnalyticsContext;
+          captured.push({ event, properties: { ...context, ...properties } });
+        }),
+      identify: () => Effect.void,
+      alias: () => Effect.void,
+      groupIdentify: () => Effect.void,
+    }),
+  );
+  return { layer, captured };
+}
 const baseFlags: LegacyFunctionsDownloadFlags = {
   functionName: Option.some("hello-world"),
   projectRef: Option.none(),
@@ -53,14 +81,26 @@ function multipartResponse(request: Parameters<typeof HttpClientResponse.fromWeb
 
 function mockProxy() {
   const calls: Array<ReadonlyArray<string>> = [];
+  const envs: Array<Record<string, string> | undefined> = [];
+  const captureCalls: Array<ReadonlyArray<string>> = [];
+  const captureEnvs: Array<Record<string, string> | undefined> = [];
   return {
     calls,
+    envs,
+    captureCalls,
+    captureEnvs,
     layer: Layer.succeed(LegacyGoProxy, {
-      exec: (args) =>
+      exec: (args, opts) =>
         Effect.sync(() => {
           calls.push([...args]);
+          envs.push(opts?.env);
+        }),
+      execCapture: (args, opts) =>
+        Effect.sync(() => {
+          captureCalls.push([...args]);
+          captureEnvs.push(opts?.env);
+          return "";
         }),
-      execCapture: () => Effect.succeed(""),
     }),
   };
 }
@@ -86,6 +126,15 @@ describe("legacy functions download", () => {
         telemetry: telemetry.layer,
       }),
       proxy.layer,
+      Stdio.layerTest({
+        args: Effect.succeed([
+          "functions",
+          "download",
+          "hello-world",
+          "--project-ref",
+          "abcdefghijklmnopqrst",
+        ]),
+      }),
     );
 
     return Effect.gen(function* () {
@@ -108,7 +157,7 @@ describe("legacy functions download", () => {
     }).pipe(Effect.provide(layer));
   });
 
-  it.live("keeps hidden Docker compatibility mode behind the Go proxy", () => {
+  it.live("proxies to Docker by default (Go parity), with no flags passed", () => {
     const out = mockOutput({ format: "text" });
     const api = mockLegacyPlatformApi();
     const proxy = mockProxy();
@@ -119,9 +168,20 @@ describe("legacy functions download", () => {
         cliConfig: mockLegacyCliConfig({ workdir: tempRoot.current }),
       }),
       proxy.layer,
+      Stdio.layerTest({
+        args: Effect.succeed([
+          "functions",
+          "download",
+          "hello-world",
+          "--project-ref",
+          "abcdefghijklmnopqrst",
+        ]),
+      }),
     );
 
     return Effect.gen(function* () {
+      // `useDocker: true` mirrors what the CLI parser now resolves to by
+      // default (CLI-1862) — no `--use-docker` flag appears in argv above.
       yield* legacyFunctionsDownload({ ...baseFlags, useDocker: true });
 
       expect(api.requests).toEqual([]);
@@ -135,6 +195,473 @@ describe("legacy functions download", () => {
           "--use-docker",
         ],
       ]);
+      // The delegated Go binary must not also fire its own
+      // `cli_command_executed` on top of this command's own instrumentation.
+      expect(proxy.envs).toEqual([{ SUPABASE_TELEMETRY_DISABLED: "1" }]);
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live(
+    "does not treat the --use-docker default as conflicting with an explicit --use-api",
+    () => {
+      const out = mockOutput({ format: "text" });
+      const api = mockLegacyPlatformApi({
+        handler: (request) =>
+          request.url.endsWith("/body")
+            ? Effect.succeed(multipartResponse(request))
+            : Effect.succeed(legacyJsonResponse(request, 200, {})),
+      });
+      const proxy = mockProxy();
+      const layer = Layer.mergeAll(
+        buildLegacyTestRuntime({
+          out,
+          api,
+          cliConfig: mockLegacyCliConfig({ workdir: tempRoot.current }),
+        }),
+        proxy.layer,
+        Stdio.layerTest({
+          args: Effect.succeed([
+            "functions",
+            "download",
+            "hello-world",
+            "--use-api",
+            "--project-ref",
+            "abcdefghijklmnopqrst",
+          ]),
+        }),
+      );
+
+      return Effect.gen(function* () {
+        // The CLI parser resolves `useDocker: true` here too (its default),
+        // even though only `--use-api` was passed explicitly. Neither the
+        // mutex check nor the routing decision should treat that default as
+        // if the user had asked for Docker.
+        yield* legacyFunctionsDownload({ ...baseFlags, useApi: true, useDocker: true });
+
+        expect(proxy.calls).toEqual([]);
+        expect(
+          yield* Effect.tryPromise(() =>
+            readFile(
+              join(tempRoot.current, "supabase", "functions", "hello-world", "index.ts"),
+              "utf8",
+            ),
+          ),
+        ).toBe("console.log('legacy native')");
+      }).pipe(Effect.provide(layer));
+    },
+  );
+
+  it.live("still proxies to Docker when --use-api=false is passed explicitly", () => {
+    const out = mockOutput({ format: "text" });
+    const api = mockLegacyPlatformApi();
+    const proxy = mockProxy();
+    const layer = Layer.mergeAll(
+      buildLegacyTestRuntime({
+        out,
+        api,
+        cliConfig: mockLegacyCliConfig({ workdir: tempRoot.current }),
+      }),
+      proxy.layer,
+      Stdio.layerTest({
+        args: Effect.succeed([
+          "functions",
+          "download",
+          "hello-world",
+          "--use-api=false",
+          "--project-ref",
+          "abcdefghijklmnopqrst",
+        ]),
+      }),
+    );
+
+    return Effect.gen(function* () {
+      // Go's override is value-based (`if useApi { useDocker = false }`,
+      // apps/cli-go/cmd/functions.go:51-53), not presence-based. An explicit
+      // `--use-api=false` must not be treated like `--use-api` — it should
+      // leave the `--use-docker` default (true) in effect and still proxy.
+      yield* legacyFunctionsDownload({ ...baseFlags, useApi: false, useDocker: true });
+
+      expect(api.requests).toEqual([]);
+      expect(proxy.calls).toEqual([
+        [
+          "functions",
+          "download",
+          "hello-world",
+          "--project-ref",
+          "abcdefghijklmnopqrst",
+          "--use-docker",
+        ],
+      ]);
+      expect(proxy.envs).toEqual([{ SUPABASE_TELEMETRY_DISABLED: "1" }]);
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("emits a JSON success envelope when proxying to Docker in machine-output mode", () => {
+    const out = mockOutput({ format: "json" });
+    const api = mockLegacyPlatformApi();
+    const proxy = mockProxy();
+    const layer = Layer.mergeAll(
+      buildLegacyTestRuntime({
+        out,
+        api,
+        cliConfig: mockLegacyCliConfig({ workdir: tempRoot.current }),
+      }),
+      proxy.layer,
+      Stdio.layerTest({
+        args: Effect.succeed([
+          "functions",
+          "download",
+          "hello-world",
+          "--project-ref",
+          "abcdefghijklmnopqrst",
+          "--output-format",
+          "json",
+        ]),
+      }),
+    );
+
+    return Effect.gen(function* () {
+      // CLI-1546: stdout is payload-only in machine mode, so the Go child's
+      // raw output must be captured/discarded (not inherited) and this
+      // command must emit the `Output` envelope itself, matching the native
+      // path's shape.
+      yield* legacyFunctionsDownload({ ...baseFlags, useDocker: true });
+
+      expect(proxy.calls).toEqual([]);
+      expect(proxy.captureCalls).toEqual([
+        [
+          "functions",
+          "download",
+          "hello-world",
+          "--project-ref",
+          "abcdefghijklmnopqrst",
+          "--use-docker",
+        ],
+      ]);
+      expect(proxy.captureEnvs).toEqual([{ SUPABASE_TELEMETRY_DISABLED: "1" }]);
+      expect(out.messages).toContainEqual(
+        expect.objectContaining({
+          type: "success",
+          data: { function_slugs: ["hello-world"], project_ref: "abcdefghijklmnopqrst" },
+        }),
+      );
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live(
+    "lists remote functions before delegating when no function name is given in machine mode",
+    () => {
+      const out = mockOutput({ format: "json" });
+      const api = mockLegacyPlatformApi({
+        handler: (request) =>
+          request.url.endsWith("/functions")
+            ? Effect.succeed(
+                legacyJsonResponse(request, 200, [
+                  { slug: "hello-world" },
+                  { slug: "goodbye-world" },
+                ]),
+              )
+            : Effect.succeed(legacyJsonResponse(request, 200, {})),
+      });
+      const proxy = mockProxy();
+      const layer = Layer.mergeAll(
+        buildLegacyTestRuntime({
+          out,
+          api,
+          cliConfig: mockLegacyCliConfig({ workdir: tempRoot.current }),
+        }),
+        proxy.layer,
+        Stdio.layerTest({
+          args: Effect.succeed([
+            "functions",
+            "download",
+            "--project-ref",
+            "abcdefghijklmnopqrst",
+            "--output-format",
+            "json",
+          ]),
+        }),
+      );
+
+      return Effect.gen(function* () {
+        yield* legacyFunctionsDownload({
+          ...baseFlags,
+          functionName: Option.none(),
+          useDocker: true,
+        });
+
+        expect(proxy.calls).toEqual([]);
+        expect(proxy.captureCalls).toEqual([
+          ["functions", "download", "--project-ref", "abcdefghijklmnopqrst", "--use-docker"],
+        ]);
+        expect(out.messages).toContainEqual(
+          expect.objectContaining({
+            type: "success",
+            data: {
+              function_slugs: ["hello-world", "goodbye-world"],
+              project_ref: "abcdefghijklmnopqrst",
+            },
+          }),
+        );
+      }).pipe(Effect.provide(layer));
+    },
+  );
+
+  it.live(
+    "reports no functions found without delegating when the project is empty in machine mode",
+    () => {
+      const out = mockOutput({ format: "json" });
+      const api = mockLegacyPlatformApi({
+        handler: (request) =>
+          request.url.endsWith("/functions")
+            ? Effect.succeed(legacyJsonResponse(request, 200, []))
+            : Effect.succeed(legacyJsonResponse(request, 200, {})),
+      });
+      const proxy = mockProxy();
+      const layer = Layer.mergeAll(
+        buildLegacyTestRuntime({
+          out,
+          api,
+          cliConfig: mockLegacyCliConfig({ workdir: tempRoot.current }),
+        }),
+        proxy.layer,
+        Stdio.layerTest({
+          args: Effect.succeed([
+            "functions",
+            "download",
+            "--project-ref",
+            "abcdefghijklmnopqrst",
+            "--output-format",
+            "json",
+          ]),
+        }),
+      );
+
+      return Effect.gen(function* () {
+        // An empty project has nothing to delegate — this must match the
+        // native path's "No functions found." short-circuit instead of
+        // still invoking the Go/Docker child and reporting a misleading
+        // "Downloaded Edge Function source." success with an empty list.
+        yield* legacyFunctionsDownload({
+          ...baseFlags,
+          functionName: Option.none(),
+          useDocker: true,
+        });
+
+        expect(proxy.calls).toEqual([]);
+        expect(proxy.captureCalls).toEqual([]);
+        expect(out.messages).toContainEqual(
+          expect.objectContaining({
+            type: "success",
+            message: "No functions found.",
+            data: { function_slugs: [], project_ref: "abcdefghijklmnopqrst" },
+          }),
+        );
+      }).pipe(Effect.provide(layer));
+    },
+  );
+
+  it.live("fails before delegating when the pre-flight function list fails in machine mode", () => {
+    const out = mockOutput({ format: "json" });
+    const api = mockLegacyPlatformApi({
+      handler: (request) =>
+        request.url.endsWith("/functions")
+          ? Effect.succeed(legacyJsonResponse(request, 500, { message: "unavailable" }))
+          : Effect.succeed(legacyJsonResponse(request, 200, {})),
+    });
+    const proxy = mockProxy();
+    const layer = Layer.mergeAll(
+      buildLegacyTestRuntime({
+        out,
+        api,
+        cliConfig: mockLegacyCliConfig({ workdir: tempRoot.current }),
+      }),
+      proxy.layer,
+      Stdio.layerTest({
+        args: Effect.succeed([
+          "functions",
+          "download",
+          "--project-ref",
+          "abcdefghijklmnopqrst",
+          "--output-format",
+          "json",
+        ]),
+      }),
+    );
+
+    return Effect.gen(function* () {
+      // The pre-flight list failure must be reported before any download
+      // side effect — the delegated proxy must never be invoked (CLI-1862
+      // review: a listing failure after a successful delegated download
+      // must not mask that success).
+      const exit = yield* legacyFunctionsDownload({
+        ...baseFlags,
+        functionName: Option.none(),
+        useDocker: true,
+      }).pipe(Effect.exit);
+
+      expect(Exit.isFailure(exit)).toBe(true);
+      expect(proxy.calls).toEqual([]);
+      expect(proxy.captureCalls).toEqual([]);
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("forwards only --legacy-bundle to the Go proxy, not the --use-docker default too", () => {
+    const out = mockOutput({ format: "text" });
+    const api = mockLegacyPlatformApi();
+    const proxy = mockProxy();
+    const layer = Layer.mergeAll(
+      buildLegacyTestRuntime({
+        out,
+        api,
+        cliConfig: mockLegacyCliConfig({ workdir: tempRoot.current }),
+      }),
+      proxy.layer,
+      Stdio.layerTest({
+        args: Effect.succeed([
+          "functions",
+          "download",
+          "hello-world",
+          "--legacy-bundle",
+          "--project-ref",
+          "abcdefghijklmnopqrst",
+        ]),
+      }),
+    );
+
+    return Effect.gen(function* () {
+      // `useDocker: true` mirrors the CLI parser's default (CLI-1862) even
+      // though only `--legacy-bundle` was passed explicitly. The Go proxy
+      // call must not forward both, or the Go binary's own
+      // MarkFlagsMutuallyExclusive rejects the combination.
+      yield* legacyFunctionsDownload({ ...baseFlags, useDocker: true, legacyBundle: true });
+
+      expect(proxy.calls).toEqual([
+        [
+          "functions",
+          "download",
+          "hello-world",
+          "--project-ref",
+          "abcdefghijklmnopqrst",
+          "--legacy-bundle",
+        ],
+      ]);
+      expect(proxy.envs).toEqual([{ SUPABASE_TELEMETRY_DISABLED: "1" }]);
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("rejects an invalid slug before ever reaching the Go proxy", () => {
+    const out = mockOutput({ format: "text" });
+    const api = mockLegacyPlatformApi();
+    const proxy = mockProxy();
+    const layer = Layer.mergeAll(
+      buildLegacyTestRuntime({
+        out,
+        api,
+        cliConfig: mockLegacyCliConfig({ workdir: tempRoot.current }),
+      }),
+      proxy.layer,
+      Stdio.layerTest({
+        args: Effect.succeed([
+          "functions",
+          "download",
+          "../../etc",
+          "--project-ref",
+          "abcdefghijklmnopqrst",
+        ]),
+      }),
+    );
+
+    return Effect.gen(function* () {
+      // `useDocker: true` is the real default (CLI-1862). Before this fix,
+      // slug validation only ran on the native path, so a malformed slug
+      // would sail past it and straight into the Go proxy argv.
+      const exit = yield* legacyFunctionsDownload({
+        ...baseFlags,
+        functionName: Option.some("../../etc"),
+        useDocker: true,
+      }).pipe(Effect.exit);
+
+      expect(Exit.isFailure(exit)).toBe(true);
+      expect(proxy.calls).toEqual([]);
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live(
+    "does not redact --project-ref in cli_command_executed (Go parity: cmd/functions.go:178)",
+    () => {
+      const out = mockOutput({ format: "text" });
+      const api = mockLegacyPlatformApi({
+        handler: (request) =>
+          request.url.endsWith("/body")
+            ? Effect.succeed(multipartResponse(request))
+            : Effect.succeed(legacyJsonResponse(request, 200, {})),
+      });
+      const proxy = mockProxy();
+      const analytics = mockContextualAnalytics();
+      const layer = Layer.mergeAll(
+        buildLegacyTestRuntime({
+          out,
+          api,
+          cliConfig: mockLegacyCliConfig({ workdir: tempRoot.current }),
+          analytics,
+        }),
+        proxy.layer,
+        commandRuntimeLayer(["functions", "download"]),
+        Stdio.layerTest({
+          args: Effect.succeed([
+            "functions",
+            "download",
+            "hello-world",
+            "--project-ref",
+            "abcdefghijklmnopqrst",
+          ]),
+        }),
+      );
+
+      return Effect.gen(function* () {
+        yield* legacyFunctionsDownloadHandler({
+          ...baseFlags,
+          projectRef: Option.some("abcdefghijklmnopqrst"),
+        });
+
+        const event = analytics.captured.find((c) => c.event === "cli_command_executed");
+        expect(event?.properties.flags).toEqual({ "project-ref": "abcdefghijklmnopqrst" });
+      }).pipe(Effect.provide(layer));
+    },
+  );
+
+  it.live("rejects the bundler mutex with cobra's exact error text", () => {
+    const out = mockOutput({ format: "text" });
+    const api = mockLegacyPlatformApi();
+    const proxy = mockProxy();
+    const layer = Layer.mergeAll(
+      buildLegacyTestRuntime({
+        out,
+        api,
+        cliConfig: mockLegacyCliConfig({ workdir: tempRoot.current }),
+      }),
+      proxy.layer,
+      Stdio.layerTest({
+        args: Effect.succeed(["functions", "download", "--use-api", "--use-docker"]),
+      }),
+    );
+
+    return Effect.gen(function* () {
+      const error = yield* legacyFunctionsDownload({
+        ...baseFlags,
+        useApi: true,
+        useDocker: true,
+      }).pipe(Effect.flip);
+
+      expect(error).toBeInstanceOf(ConflictingFunctionDownloadFlagsError);
+      if (!(error instanceof ConflictingFunctionDownloadFlagsError)) {
+        throw new Error(`unexpected error: ${String(error)}`);
+      }
+      expect(error.message).toBe(
+        "if any flags in the group [use-api use-docker legacy-bundle] are set none of the others can be; [use-api use-docker] were all set",
+      );
+      expect(proxy.calls).toEqual([]);
     }).pipe(Effect.provide(layer));
   });
 });
diff --git a/apps/cli/src/legacy/commands/functions/list/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/functions/list/SIDE_EFFECTS.md
index b6764b7dfc..f1613f83fe 100644
--- a/apps/cli/src/legacy/commands/functions/list/SIDE_EFFECTS.md
+++ b/apps/cli/src/legacy/commands/functions/list/SIDE_EFFECTS.md
@@ -34,7 +34,6 @@
 | `SUPABASE_PROFILE`      | select a built-in profile or YAML profile file with `api_url:` | no (falls back to `~/.supabase/profile` -> `supabase`)    |
 | `SUPABASE_PROJECT_ID`   | provides the project ref when `--project-ref` is unset         | no (falls back to `<workdir>/supabase/.temp/project-ref`) |
 | `SUPABASE_WORKDIR`      | sets `<workdir>` for local Supabase temp files                 | no (falls back to `--workdir` -> current working dir)     |
-| ~~`SUPABASE_API_URL`~~  | **not honored** - Go parity. Use `SUPABASE_PROFILE` instead.   | -                                                         |
 
 ## Exit Codes
 
diff --git a/apps/cli/src/legacy/commands/functions/list/list.command.ts b/apps/cli/src/legacy/commands/functions/list/list.command.ts
index f411518741..4f85ebeb0b 100644
--- a/apps/cli/src/legacy/commands/functions/list/list.command.ts
+++ b/apps/cli/src/legacy/commands/functions/list/list.command.ts
@@ -1,5 +1,6 @@
 import { Command, Flag } from "effect/unstable/cli";
 import type * as CliCommand from "effect/unstable/cli/Command";
+import { FUNCTIONS_PROJECT_REF_SAFE_FLAGS } from "../../../../shared/functions/functions.shared.ts";
 import { withJsonErrorHandling } from "../../../../shared/output/json-error-handling.ts";
 import { legacyManagementApiRuntimeLayer } from "../../../shared/legacy-management-api-runtime.layer.ts";
 import { withLegacyCommandInstrumentation } from "../../../telemetry/legacy-command-instrumentation.ts";
@@ -29,7 +30,7 @@ export const legacyFunctionsListCommand = Command.make("list", config).pipe(
   ]),
   Command.withHandler((flags) =>
     legacyFunctionsList(flags).pipe(
-      withLegacyCommandInstrumentation({ flags, safeFlags: ["project-ref"] }),
+      withLegacyCommandInstrumentation({ flags, safeFlags: FUNCTIONS_PROJECT_REF_SAFE_FLAGS }),
       withJsonErrorHandling,
     ),
   ),
diff --git a/apps/cli/src/legacy/commands/functions/new/new.command.ts b/apps/cli/src/legacy/commands/functions/new/new.command.ts
index 8a161adf28..5a9ef84b25 100644
--- a/apps/cli/src/legacy/commands/functions/new/new.command.ts
+++ b/apps/cli/src/legacy/commands/functions/new/new.command.ts
@@ -36,7 +36,7 @@ export const legacyFunctionsNewCommand = Command.make("new", config).pipe(
   Command.withShortDescription("Create a new Function locally"),
   Command.withHandler((flags) =>
     legacyFunctionsNew(flags).pipe(
-      withLegacyCommandInstrumentation({ flags }),
+      withLegacyCommandInstrumentation({ flags, config }),
       withJsonErrorHandling,
     ),
   ),
diff --git a/apps/cli/src/legacy/commands/functions/new/new.handler.ts b/apps/cli/src/legacy/commands/functions/new/new.handler.ts
index b448c0307a..5080e4416b 100644
--- a/apps/cli/src/legacy/commands/functions/new/new.handler.ts
+++ b/apps/cli/src/legacy/commands/functions/new/new.handler.ts
@@ -89,7 +89,9 @@ const listExistingFunctionSlugs = Effect.fnUntraced(function* (workdir: string)
 });
 
 const resolveTemplateInputs = Effect.fnUntraced(function* (workdir: string, slug: string) {
-  const loaded = yield* loadProjectConfig(workdir).pipe(Effect.orElseSucceed(() => null));
+  const loaded = yield* loadProjectConfig(workdir, { goViperCompat: true }).pipe(
+    Effect.orElseSucceed(() => null),
+  );
   const port = loaded?.config.api.port ?? DEFAULT_LOCAL_API_PORT;
   const publishableKey = loaded?.config.auth.publishable_key ?? defaultPublishableKey;
   return {
diff --git a/apps/cli/src/legacy/commands/functions/serve/serve.command.ts b/apps/cli/src/legacy/commands/functions/serve/serve.command.ts
index 1e3cd4ea5e..83992053b6 100644
--- a/apps/cli/src/legacy/commands/functions/serve/serve.command.ts
+++ b/apps/cli/src/legacy/commands/functions/serve/serve.command.ts
@@ -54,7 +54,7 @@ export const legacyFunctionsServeCommand = Command.make("serve", config).pipe(
   Command.withShortDescription("Serve all Functions locally"),
   Command.withHandler((flags) =>
     legacyFunctionsServe(flags).pipe(
-      withLegacyCommandInstrumentation({ flags }),
+      withLegacyCommandInstrumentation({ flags, config }),
       withJsonErrorHandling,
     ),
   ),
diff --git a/apps/cli/src/legacy/commands/functions/serve/serve.handler.ts b/apps/cli/src/legacy/commands/functions/serve/serve.handler.ts
index 0718862e64..86b51f387b 100644
--- a/apps/cli/src/legacy/commands/functions/serve/serve.handler.ts
+++ b/apps/cli/src/legacy/commands/functions/serve/serve.handler.ts
@@ -33,5 +33,6 @@ export const legacyFunctionsServe = Effect.fn("legacy.functions.serve")(function
     debug,
     networkId,
     projectIdOverride: cliConfig.projectId,
+    goViperCompat: true,
   }).pipe(Effect.ensuring(telemetryState.flush));
 });
diff --git a/apps/cli/src/legacy/commands/functions/serve/serve.integration.test.ts b/apps/cli/src/legacy/commands/functions/serve/serve.integration.test.ts
index 370af5aacf..5b8d75be10 100644
--- a/apps/cli/src/legacy/commands/functions/serve/serve.integration.test.ts
+++ b/apps/cli/src/legacy/commands/functions/serve/serve.integration.test.ts
@@ -51,11 +51,15 @@ const deployMockState = vi.hoisted(() => ({
         command: string,
         args: ReadonlyArray<string>,
         options: unknown,
-      ) => {
-        exitCode: number;
-        stdout: string;
-        stderr: string;
-      }),
+      ) =>
+        | {
+            exitCode: number;
+            stdout: string;
+            stderr: string;
+          }
+        // Never resolves — lets a test fork+interrupt while this specific call is in flight,
+        // matching Effect's own canonical "forever pending, interruptible" primitive.
+        | { pending: true }),
   reset() {
     this.isDockerRunning = true;
     this.runCalls = [];
@@ -83,7 +87,7 @@ vi.mock("../../../../shared/functions/deploy.ts", async () => {
         deployMockState.volumeCalls.push({ volumeName, projectId });
       }),
     runChildProcess: (command: string, args: ReadonlyArray<string>, options?: unknown) =>
-      Effect.sync(() => {
+      Effect.suspend(() => {
         const envFile = args.flatMap((value, index) =>
           args[index - 1] === "--env-file" ? [value] : [],
         )[0];
@@ -117,13 +121,12 @@ vi.mock("../../../../shared/functions/deploy.ts", async () => {
                     }),
               };
         deployMockState.runCalls.push({ command, args: [...args], options: enrichedOptions });
-        return (
-          deployMockState.runHandler?.(command, args, options) ?? {
-            exitCode: 0,
-            stdout: "",
-            stderr: "",
-          }
-        );
+        const result = deployMockState.runHandler?.(command, args, options) ?? {
+          exitCode: 0,
+          stdout: "",
+          stderr: "",
+        };
+        return "pending" in result ? Effect.never : Effect.succeed(result);
       }),
   };
 });
@@ -508,6 +511,19 @@ describe("legacy functions serve integration", () => {
           },
         });
 
+        expect(deployMockState.runCalls).toContainEqual({
+          command: "docker",
+          args: [
+            "exec",
+            "supabase_kong_test-project",
+            "kong",
+            "reload",
+            "--nginx-conf",
+            "/home/kong/custom_nginx.template",
+          ],
+          options: { stdout: "ignore", stderr: "pipe" },
+        });
+
         expect(childSpawner.spawned).toEqual([
           {
             command: "docker",
@@ -637,6 +653,87 @@ describe("legacy functions serve integration", () => {
     });
   });
 
+  it.live(
+    "cleans up a stale multiline-env directory from a previous run even when this run has no multiline secrets",
+    () => {
+      deployMockState.runHandler = (command, args) => {
+        if (command !== "docker") {
+          throw new Error(`unexpected process: ${command}`);
+        }
+        if (args[0] === "container" && args[1] === "inspect") {
+          return { exitCode: 0, stdout: "", stderr: "" };
+        }
+        if (args[0] === "container" && args[1] === "rm") {
+          return { exitCode: 0, stdout: "", stderr: "" };
+        }
+        if (args[0] === "run") {
+          return { exitCode: 0, stdout: "edge-runtime-id\n", stderr: "" };
+        }
+        if (args[0] === "exec") {
+          return { exitCode: 0, stdout: "", stderr: "" };
+        }
+        throw new Error(`unexpected docker args: ${args.join(" ")}`);
+      };
+
+      const childSpawner = mockDockerLogSpawner([
+        {
+          exitCode: 1,
+          stderr: "error running container: exit 1",
+        },
+      ]);
+
+      const staleMultilineEnvDir = join(
+        tempRoot.current,
+        "supabase",
+        ".temp",
+        "start-secrets",
+        "supabase_edge_runtime_test-project",
+        "multiline-env",
+      );
+
+      return Effect.gen(function* () {
+        yield* Effect.promise(() =>
+          writeProjectConfig(['project_id = "test-project"', ""].join("\n")),
+        );
+        yield* Effect.promise(() =>
+          writeFunctionFile("hello", "index.ts", 'Deno.serve(() => new Response("hello"))\n'),
+        );
+        yield* Effect.promise(() =>
+          writeProjectFile(join("supabase", "functions", ".env"), ["HELLO=WORLD", ""].join("\n")),
+        );
+        // Simulate a stale directory left behind by an earlier run that DID have multiline secrets.
+        yield* Effect.promise(async () => {
+          await mkdir(join(staleMultilineEnvDir, "values"), { recursive: true, mode: 0o700 });
+          await writeFile(join(staleMultilineEnvDir, "multiline-env.sh"), "stale script\n");
+          await writeFile(join(staleMultilineEnvDir, "values", "env-0"), "stale secret\n");
+        });
+
+        const { layer } = setupServe({ childSpawner });
+
+        const error = yield* legacyFunctionsServe(baseFlags()).pipe(
+          Effect.provide(layer),
+          Effect.flip,
+        );
+        expect(error).toBeInstanceOf(Error);
+
+        expect(existsSync(staleMultilineEnvDir)).toBe(false);
+
+        const dockerRun = deployMockState.runCalls.find(
+          (call) => call.command === "docker" && call.args[0] === "run",
+        );
+        expect(dockerRun).toBeDefined();
+        if (dockerRun === undefined) {
+          throw new Error("expected docker run call");
+        }
+        expect(
+          extractFlagValues(dockerRun.args, "-v").some((value) =>
+            value.endsWith(":/root/.supabase/multiline-env:ro"),
+          ),
+        ).toBe(false);
+      });
+    },
+  );
+
   it.live("fails before startup when a multiline env name is not a shell identifier", () => {
     return Effect.gen(function* () {
       yield* Effect.promise(() =>
@@ -1024,6 +1121,19 @@ describe("legacy functions serve integration", () => {
         ),
       ).toHaveLength(2);
       expect(out.stderrText).toContain("File change detected:");
+
+      // `functions serve`'s restart wrapper (`startEdgeRuntime`, Go's
+      // `restartEdgeRuntime`) reloads Kong after each successful bring-up —
+      // once for the initial start, once for the file-change-triggered restart.
+      expect(
+        deployMockState.runCalls.filter(
+          (call) =>
+            call.command === "docker" &&
+            call.args[0] === "exec" &&
+            call.args.includes("supabase_kong_test-project") &&
+            call.args.includes("reload"),
+        ),
+      ).toHaveLength(2);
     });
   });
 
@@ -1143,6 +1253,84 @@ describe("legacy functions serve integration", () => {
     });
   });
 
+  it.live(
+    "cleans up staged secrets when interrupted while reloading Kong after a successful bring-up",
+    () => {
+      const processControl = mockQueuedProcessControl();
+      deployMockState.runHandler = (command, args) => {
+        if (command !== "docker") {
+          throw new Error(`unexpected process: ${command}`);
+        }
+        if (args[0] === "container" && args[1] === "inspect") {
+          return { exitCode: 0, stdout: "", stderr: "" };
+        }
+        if (args[0] === "container" && args[1] === "rm") {
+          return { exitCode: 0, stdout: "", stderr: "" };
+        }
+        if (args[0] === "run") {
+          return { exitCode: 0, stdout: "edge-runtime-id\n", stderr: "" };
+        }
+        if (args[0] === "exec") {
+          // Hangs Kong reload so the interrupt below lands after bring-up succeeded (staged
+          // secrets already written, `startedRuntime` already assigned) but before this
+          // wrapper's own `reloadKong` call returns.
+          return { pending: true };
+        }
+        throw new Error(`unexpected docker args: ${args.join(" ")}`);
+      };
+
+      const childSpawner = mockDockerLogSpawner([{ pending: true }]);
+
+      const stagingDir = join(
+        tempRoot.current,
+        "supabase",
+        ".temp",
+        "start-secrets",
+        "supabase_edge_runtime_test-project",
+      );
+
+      return Effect.gen(function* () {
+        yield* Effect.promise(() =>
+          writeProjectConfig(['project_id = "test-project"', ""].join("\n")),
+        );
+        yield* Effect.promise(() =>
+          writeFunctionFile("hello", "index.ts", 'Deno.serve(() => new Response("hello"))\n'),
+        );
+        yield* Effect.promise(() => writeFunctionFile("hello", "deno.json", '{"imports":{}}\n'));
+
+        const { layer } = setupServe({ processControl, childSpawner });
+        const fiber = yield* legacyFunctionsServe(baseFlags()).pipe(
+          Effect.provide(layer),
+          Effect.forkChild({ startImmediately: true }),
+        );
+
+        yield* waitFor(
+          () =>
+            deployMockState.runCalls.some(
+              (call) => call.command === "docker" && call.args[0] === "exec",
+            ),
+          "timed out waiting for Kong reload to start",
+        );
+        expect(existsSync(stagingDir)).toBe(true);
+        processControl.signal("SIGINT");
+
+        const exit = yield* Fiber.await(fiber);
+        expect(Exit.isSuccess(exit)).toBe(true);
+
+        expect(
+          deployMockState.runCalls.some(
+            (call) =>
+              call.command === "docker" &&
+              call.args[0] === "container" &&
+              call.args[1] === "rm" &&
+              call.args.includes("supabase_edge_runtime_test-project"),
+          ),
+        ).toBe(true);
+        expect(existsSync(stagingDir)).toBe(false);
+      });
+    },
+  );
+
   it.live("passes inspect, debug, and custom network settings through to edge-runtime", () => {
     deployMockState.runHandler = (command, args) => {
       if (command !== "docker") {
@@ -1518,6 +1706,98 @@ describe("legacy functions serve integration", () => {
     },
   );
 
+  it.live(
+    "does not fail startup on a malformed third-party provider config when auth is disabled",
+    () => {
+      // Go's `Auth.ThirdParty.validate()` (the "required field" check) only runs inside
+      // `Config.Validate`'s `if Auth.Enabled` block — `functions serve`'s own JWKS resolution
+      // discards `ResolveJWKS`'s error unconditionally, regardless of `auth.enabled`. So a
+      // workos provider enabled without an `issuer_url` must not block startup here.
+      deployMockState.runHandler = (command, args) => {
+        if (command !== "docker") {
+          throw new Error(`unexpected process: ${command}`);
+        }
+        if (args[0] === "container" && args[1] === "inspect") {
+          return { exitCode: 0, stdout: "", stderr: "" };
+        }
+        if (args[0] === "container" && args[1] === "rm") {
+          return { exitCode: 0, stdout: "", stderr: "" };
+        }
+        if (args[0] === "run") {
+          return { exitCode: 0, stdout: "edge-runtime-id\n", stderr: "" };
+        }
+        if (args[0] === "exec") {
+          return { exitCode: 0, stdout: "", stderr: "" };
+        }
+        throw new Error(`unexpected docker args: ${args.join(" ")}`);
+      };
+
+      const childSpawner = mockDockerLogSpawner([{ exitCode: 1, stderr: "jwks logs failed" }]);
+
+      return Effect.gen(function* () {
+        const fetchMock = vi.spyOn(globalThis, "fetch");
+
+        yield* Effect.addFinalizer(() =>
+          Effect.sync(() => {
+            fetchMock.mockRestore();
+          }),
+        );
+
+        yield* Effect.promise(() =>
+          writeProjectConfig(
+            [
+              'project_id = "test-project"',
+              "",
+              "[auth]",
+              "enabled = false",
+              "",
+              "[auth.third_party.workos]",
+              "enabled = true",
+              "",
+            ].join("\n"),
+          ),
+        );
+        yield* Effect.promise(() =>
+          writeFunctionFile("hello", "index.ts", 'Deno.serve(() => new Response("hello"))\n'),
+        );
+        yield* Effect.promise(() => writeFunctionFile("hello", "deno.json", '{"imports":{}}\n'));
+
+        const { layer } = setupServe({ childSpawner });
+        const error = yield* legacyFunctionsServe(baseFlags()).pipe(
+          Effect.provide(layer),
+          Effect.flip,
+        );
+
+        expect(error).toBeInstanceOf(Error);
+        if (error instanceof Error) {
+          expect(error.message).toContain("jwks logs failed");
+        }
+        expect(fetchMock).not.toHaveBeenCalled();
+
+        const dockerRun = deployMockState.runCalls.find(
+          (call) => call.command === "docker" && call.args[0] === "run",
+        );
+        expect(dockerRun).toBeDefined();
+        if (dockerRun === undefined) {
+          throw new Error("expected docker run call");
+        }
+
+        const envs = yield* Effect.promise(() => extractDockerEnvEntries(dockerRun));
+        const jwks = envs.find((entry) => entry.startsWith("SUPABASE_JWKS="));
+        expect(jwks).toBeDefined();
+        if (jwks === undefined) {
+          throw new Error("missing SUPABASE_JWKS");
+        }
+        expect(JSON.parse(jwks.slice("SUPABASE_JWKS=".length))).toEqual({
+          keys: expect.arrayContaining([
+            expect.objectContaining({ kid: "b81269f1-21d8-4f2e-b719-c2240a840d90" }),
+            expect.objectContaining({ kty: "oct" }),
+          ]),
+        });
+      });
+    },
+  );
+
   it.live("includes config-defined edge runtime secrets in the runtime env", () => {
     deployMockState.runHandler = (command, args) => {
       if (command !== "docker") {
@@ -1695,7 +1975,7 @@ describe("legacy functions serve integration", () => {
               "verify_jwt = true",
               "",
               "[remotes.override]",
-              'project_id = "override-project"',
+              'project_id = "overrideprojectaaaaa"',
               "",
               "[remotes.override.functions.hello]",
               "verify_jwt = false",
@@ -1710,7 +1990,7 @@ describe("legacy functions serve integration", () => {
 
         const { layer } = setupServe({
           childSpawner,
-          projectId: Option.some("override-project"),
+          projectId: Option.some("overrideprojectaaaaa"),
         });
         const error = yield* legacyFunctionsServe(baseFlags()).pipe(
           Effect.provide(layer),
@@ -1724,20 +2004,20 @@ describe("legacy functions serve integration", () => {
 
         expect(deployMockState.volumeCalls).toEqual([
           {
-            volumeName: "supabase_edge_runtime_override-project",
-            projectId: "override-project",
+            volumeName: "supabase_edge_runtime_overrideprojectaaaaa",
+            projectId: "overrideprojectaaaaa",
           },
         ]);
         expect(deployMockState.networkCalls).toEqual([
           {
-            networkMode: "supabase_network_override-project",
-            projectId: "override-project",
+            networkMode: "supabase_network_overrideprojectaaaaa",
+            projectId: "overrideprojectaaaaa",
           },
         ]);
         expect(deployMockState.runCalls).toContainEqual(
           expect.objectContaining({
             command: "docker",
-            args: ["container", "inspect", "supabase_db_override-project"],
+            args: ["container", "inspect", "supabase_db_overrideprojectaaaaa"],
           }),
         );
 
diff --git a/apps/cli/src/legacy/commands/gen/keys/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/gen/keys/SIDE_EFFECTS.md
index 325e8d58ed..00f28f8924 100644
--- a/apps/cli/src/legacy/commands/gen/keys/SIDE_EFFECTS.md
+++ b/apps/cli/src/legacy/commands/gen/keys/SIDE_EFFECTS.md
@@ -20,10 +20,10 @@
 
 ## Environment Variables
 
-| Variable                | Purpose                          | Required?                                               |
-| ----------------------- | -------------------------------- | ------------------------------------------------------- |
-| `SUPABASE_ACCESS_TOKEN` | auth token                       | no (falls back to keyring → `~/.supabase/access-token`) |
-| `SUPABASE_API_URL`      | override Management API base URL | no (defaults to `https://api.supabase.com`)             |
+| Variable                | Purpose                                 | Required?                                               |
+| ----------------------- | --------------------------------------- | ------------------------------------------------------- |
+| `SUPABASE_ACCESS_TOKEN` | auth token                              | no (falls back to keyring → `~/.supabase/access-token`) |
+| `SUPABASE_PROFILE`      | built-in profile name or YAML file path | no (falls back to `~/.supabase/profile` -> `supabase`)  |
 
 ## Exit Codes
 
diff --git a/apps/cli/src/legacy/commands/gen/signing-key/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/gen/signing-key/SIDE_EFFECTS.md
index 8cf887643d..f7dab774da 100644
--- a/apps/cli/src/legacy/commands/gen/signing-key/SIDE_EFFECTS.md
+++ b/apps/cli/src/legacy/commands/gen/signing-key/SIDE_EFFECTS.md
@@ -2,11 +2,12 @@
 
 ## Files Read
 
-| Path                                            | Format                      | When                                                                                 |
-| ----------------------------------------------- | --------------------------- | ------------------------------------------------------------------------------------ |
-| `supabase/config.toml` / `supabase/config.json` | TOML / JSON                 | always when present in the active workdir; used to discover `auth.signing_keys_path` |
-| `<resolved signing_keys_path>`                  | JSON array of JWKs          | when `auth.signing_keys_path` is configured; loaded before overwrite or append       |
-| git ignore rules                                | git metadata / ignore files | best-effort after a successful write when the resulting file contains exactly 1 key  |
+| Path                                            | Format                      | When                                                                                  |
+| ----------------------------------------------- | --------------------------- | ------------------------------------------------------------------------------------- |
+| `supabase/config.toml` / `supabase/config.json` | TOML / JSON                 | always when present in the active workdir; used to discover `auth.signing_keys_path`  |
+| `<resolved signing_keys_path>`                  | JSON array of JWKs          | when `auth.signing_keys_path` is configured; loaded before overwrite or append        |
+| git ignore rules                                | git metadata / ignore files | best-effort after a successful write when the resulting file contains exactly 1 key   |
+| `<workdir>/supabase/.env*`, `<workdir>/.env*`   | dotenv                      | always, to resolve `SUPABASE_YES` (CLI-1878; Go's `flags.LoadConfig`/`loadNestedEnv`) |
 
 ## Files Written
 
@@ -22,9 +23,9 @@
 
 ## Environment Variables
 
-| Variable | Purpose | Required? |
-| -------- | ------- | --------- |
-| -        | -       | -         |
+| Variable       | Purpose                                                                                                                                                                                          | Required? |
+| -------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | --------- |
+| `SUPABASE_YES` | Auto-confirms the overwrite prompt, same as `--yes` (Go's `viper.GetBool("YES")`). Read from the shell env OR the project `.env`/`.env.local`/`.env.<env>[.local]` files (shell wins; CLI-1878). | No        |
 
 ## Exit Codes
 
@@ -47,16 +48,17 @@
 
 ### `--output-format json`
 
-Not applicable; the command uses raw stdout and stderr text like the Go CLI.
+Not applicable to output rendering; the command uses raw stdout and stderr text like the Go CLI. It does, however, affect the overwrite-confirmation prompt: since this command has no structured json/stream-json payload, requesting a non-text format from a real interactive terminal (no `--yes`, no piped stdin) fails the overwrite closed (`context canceled`) rather than silently defaulting to yes on a destructive, irreversible action. A non-TTY caller (piped or not) is unaffected — piped `y`/`n` answers are honored regardless of `--output-format`.
 
 ### `--output-format stream-json`
 
-Not applicable; the command uses raw stdout and stderr text like the Go CLI.
+Same as `--output-format json` above.
 
 ## Notes
 
 - `--algorithm` accepts `ES256` (default, recommended) or `RS256`.
 - `--append` appends the new key to an existing keys file instead of overwriting.
+- The overwrite prompt honors `SUPABASE_YES` (shell env or the project `.env`/`.env.local`/`.env.<env>[.local]` files, shell wins) and an explicit `--yes=false` override, matching Go's `viper.GetBool("YES")` precedence (flag wins over env; an omitted flag falls back to the env var, resolved after `flags.LoadConfig` loads the project env — CLI-1878). On non-TTY stdin, a piped `y`/`n` line is read within a 100ms timeout and honored before falling back to the default (`y`), matching Go's `Console.ReadLine`/`PromptYesNo` — a piped answer other than an exact `y`/`yes`/`n`/`no` (case-insensitive) also falls back to the default.
 - `auth.signing_keys_path` is resolved relative to the active `supabase/config.toml` or `supabase/config.json`.
 - Generated keys are JWKs, not PEM files.
 - No network or Management API calls are involved.
diff --git a/apps/cli/src/legacy/commands/gen/signing-key/signing-key.command.ts b/apps/cli/src/legacy/commands/gen/signing-key/signing-key.command.ts
index 35a026f682..83bc33b38d 100644
--- a/apps/cli/src/legacy/commands/gen/signing-key/signing-key.command.ts
+++ b/apps/cli/src/legacy/commands/gen/signing-key/signing-key.command.ts
@@ -3,6 +3,7 @@ import { Command, Flag } from "effect/unstable/cli";
 import type * as CliCommand from "effect/unstable/cli/Command";
 import { withJsonErrorHandling } from "../../../../shared/output/json-error-handling.ts";
 import { commandRuntimeLayer } from "../../../../shared/runtime/command-runtime.layer.ts";
+import { stdinLayer } from "../../../../shared/runtime/stdin.layer.ts";
 import { legacyCliConfigLayer } from "../../../config/legacy-cli-config.layer.ts";
 import { legacyDebugLoggerLayer } from "../../../shared/legacy-debug-logger.layer.ts";
 import { withLegacyCommandInstrumentation } from "../../../telemetry/legacy-command-instrumentation.ts";
@@ -29,6 +30,10 @@ const legacyGenSigningKeyRuntimeLayer = Layer.mergeAll(
   cliConfig,
   legacyTelemetryStateLayer,
   commandRuntimeLayer(["gen", "signing-key"]),
+  // The overwrite-confirmation prompt reads piped stdin via `legacyPromptYesNo`
+  // (`stdin.readLine`), same as `config push`, `seed buckets`, `storage rm`, `db pull`,
+  // and `logout` — all of which merge `stdinLayer` alongside their runtime layer.
+  stdinLayer,
 );
 
 export const legacyGenSigningKeyCommand = Command.make("signing-key", config).pipe(
@@ -55,7 +60,7 @@ export const legacyGenSigningKeyCommand = Command.make("signing-key", config).pi
   ]),
   Command.withHandler((flags) =>
     legacyGenSigningKey(flags).pipe(
-      withLegacyCommandInstrumentation({ flags }),
+      withLegacyCommandInstrumentation({ flags, config }),
       withJsonErrorHandling,
     ),
   ),
diff --git a/apps/cli/src/legacy/commands/gen/signing-key/signing-key.e2e.test.ts b/apps/cli/src/legacy/commands/gen/signing-key/signing-key.e2e.test.ts
new file mode 100644
index 0000000000..3a2b377ee4
--- /dev/null
+++ b/apps/cli/src/legacy/commands/gen/signing-key/signing-key.e2e.test.ts
@@ -0,0 +1,63 @@
+import { mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { afterEach, beforeEach, describe, expect, test } from "vitest";
+
+import { runSupabase } from "../../../../../tests/helpers/cli.ts";
+
+const E2E_TIMEOUT_MS = 30_000;
+
+/**
+ * Golden-path e2e for CLI-1865: exercises the real compiled-binary boundary —
+ * `signing-key.command.ts`'s actual production runtime layer, not the mocked
+ * `Stdin` the integration suite provides via `Layer.succeed`. A missing
+ * `stdinLayer` in that composition only surfaces as a "Service not found" defect
+ * at this boundary (see the legacy CLAUDE.md Go Parity Checklist item 5). Per-branch
+ * prompt/format coverage lives in the integration suite.
+ */
+describe("supabase gen signing-key (legacy)", () => {
+  let projectDir: string;
+
+  beforeEach(() => {
+    projectDir = mkdtempSync(join(tmpdir(), "supabase-gen-signing-key-e2e-"));
+    mkdirSync(join(projectDir, "supabase"), { recursive: true });
+    writeFileSync(
+      join(projectDir, "supabase", "config.toml"),
+      '[auth]\nsigning_keys_path = "./signing_keys.json"\n',
+    );
+    writeFileSync(join(projectDir, "supabase", "signing_keys.json"), "[]\n");
+  });
+
+  afterEach(() => {
+    rmSync(projectDir, { recursive: true, force: true });
+  });
+
+  test(
+    "declines the overwrite on a piped 'n' without crashing or writing the file",
+    { timeout: E2E_TIMEOUT_MS },
+    async () => {
+      const { exitCode, stderr } = await runSupabase(["gen", "signing-key"], {
+        entrypoint: "legacy",
+        cwd: projectDir,
+        stdin: "n\n",
+      });
+      expect(exitCode).toBe(1);
+      expect(stderr).toContain("context canceled");
+      expect(stderr).not.toContain("Service not found");
+      const saved = readFileSync(join(projectDir, "supabase", "signing_keys.json"), "utf8");
+      expect(JSON.parse(saved)).toEqual([]);
+    },
+  );
+
+  test("overwrites on a piped 'y'", { timeout: E2E_TIMEOUT_MS }, async () => {
+    const { exitCode, stderr } = await runSupabase(["gen", "signing-key"], {
+      entrypoint: "legacy",
+      cwd: projectDir,
+      stdin: "y\n",
+    });
+    expect(exitCode).toBe(0);
+    expect(stderr).toContain("JWT signing key appended to:");
+    const saved = readFileSync(join(projectDir, "supabase", "signing_keys.json"), "utf8");
+    expect(JSON.parse(saved)).toHaveLength(1);
+  });
+});
diff --git a/apps/cli/src/legacy/commands/gen/signing-key/signing-key.handler.ts b/apps/cli/src/legacy/commands/gen/signing-key/signing-key.handler.ts
index 6396c658c6..87a734da73 100644
--- a/apps/cli/src/legacy/commands/gen/signing-key/signing-key.handler.ts
+++ b/apps/cli/src/legacy/commands/gen/signing-key/signing-key.handler.ts
@@ -6,9 +6,11 @@ import { ChildProcess, ChildProcessSpawner } from "effect/unstable/process";
 
 import { LegacyCliConfig } from "../../../config/legacy-cli-config.service.ts";
 import { findGitRootPath } from "../../../../shared/git/git-root.ts";
+import { legacyLoadProjectEnv } from "../../../shared/legacy-db-config.toml-read.ts";
 import { LegacyDebugLogger } from "../../../shared/legacy-debug-logger.service.ts";
+import { legacyPromptYesNo } from "../../../shared/legacy-prompt-yes-no.ts";
 import { LegacyTelemetryState } from "../../../telemetry/legacy-telemetry-state.service.ts";
-import { LegacyYesFlag } from "../../../../shared/legacy/global-flags.ts";
+import { legacyResolveYesWithProjectEnv } from "../../../../shared/legacy/global-flags.ts";
 import { Output } from "../../../../shared/output/output.service.ts";
 import { Tty } from "../../../../shared/runtime/tty.service.ts";
 import type { LegacyGenSigningKeyFlags } from "./signing-key.command.ts";
@@ -161,7 +163,7 @@ const generatePrivateKey = Effect.fnUntraced(function* (algorithm: SigningAlgori
 
 const loadSigningKeysConfig = Effect.fnUntraced(function* (cwd: string) {
   const path = yield* Path.Path;
-  const loaded = yield* loadProjectConfig(cwd).pipe(
+  const loaded = yield* loadProjectConfig(cwd, { goViperCompat: true }).pipe(
     Effect.catchTag("ProjectConfigParseError", (cause) =>
       Effect.fail(
         new LegacyGenSigningKeyConfigParseError({
@@ -246,25 +248,6 @@ const isGitIgnored = Effect.fnUntraced(function* (filePath: string, searchFrom:
     .pipe(Effect.map((exitCode) => Option.some(Number(exitCode) === 0)));
 });
 
-const confirmOverwrite = Effect.fnUntraced(function* (title: string) {
-  const output = yield* Output;
-  const tty = yield* Tty;
-  const yes = yield* LegacyYesFlag;
-  if (yes) {
-    yield* output.raw(`${title} [Y/n] y\n`, "stderr");
-    return true;
-  }
-  if (!tty.stdinIsTty) {
-    yield* output.raw(`${title} [Y/n] \n`, "stderr");
-    return true;
-  }
-  // In json / stream-json mode `promptConfirm` fails with NonInteractiveError; treat that as a
-  // declined overwrite so the command cancels cleanly instead of corrupting the machine payload.
-  return yield* output
-    .promptConfirm(title, { defaultValue: true })
-    .pipe(Effect.orElseSucceed(() => false));
-});
-
 export const legacyGenSigningKey = Effect.fn("legacy.gen.signing-key")(function* (
   flags: LegacyGenSigningKeyFlags,
 ) {
@@ -279,6 +262,15 @@ export const legacyGenSigningKey = Effect.fn("legacy.gen.signing-key")(function*
   const warnText = (text: string) => styleIfTty(tty.stdoutIsTty, "yellow", text);
 
   return yield* Effect.gen(function* () {
+    // Go's `flags.LoadConfig` (`signingkeys.go:99`) loads the project `.env` files before the
+    // overwrite prompt reads `viper.GetBool("YES")` (`console.PromptYesNo`, `signingkeys.go:130`),
+    // so a `SUPABASE_YES` set only in `supabase/.env` must auto-confirm here too. Resolved inside
+    // this block (not above it) so a malformed/unreadable `.env` still flushes telemetry below,
+    // matching Go: telemetry attaches in root's `PersistentPreRunE` (`cmd/root.go:131-155`)
+    // before this command's own `RunE` runs `flags.LoadConfig`, so `service.Capture` still fires
+    // in Go even when that load fails.
+    const projectEnv = yield* legacyLoadProjectEnv(fs, path, cliConfig.workdir);
+    const yes = yield* legacyResolveYesWithProjectEnv(projectEnv);
     // Match Go's order: LoadConfig validates the configured signing-keys file before any key is
     // generated, so a broken config fails fast without doing throwaway crypto work.
     const signingKeysConfig = yield* loadSigningKeysConfig(cliConfig.workdir);
@@ -298,9 +290,30 @@ export const legacyGenSigningKey = Effect.fn("legacy.gen.signing-key")(function*
     const nextKeys = flags.append
       ? [...configured.value.existingKeys, key]
       : yield* Effect.gen(function* () {
-          const confirmed = yield* confirmOverwrite(
-            `Do you want to overwrite the existing ${emphasize(configured.value.displayPath)} file?`,
-          );
+          // `legacyPromptYesNo` silently returns the default (true) for any non-text
+          // `--output-format`, but this command has no structured json/stream-json output
+          // (SIDE_EFFECTS.md) — that combination only arises from a real interactive TTY
+          // explicitly requesting machine output. Fail closed rather than silently
+          // overwriting irrecoverable key material.
+          const confirmed =
+            !yes && tty.stdinIsTty && output.format !== "text"
+              ? false
+              : yield* legacyPromptYesNo(
+                  // `legacyPromptYesNo` checks `output.format !== "text"` BEFORE it checks
+                  // TTY, so a non-TTY (piped or empty) invocation under `json`/`stream-json`
+                  // would otherwise hit that check first and return the default without
+                  // ever reading stdin. Go's `console.PromptYesNo`
+                  // (apps/cli-go/internal/utils/console.go:64-82) has no concept of output
+                  // format at all — it always reads piped stdin — so a piped `y`/`n` answer
+                  // must be honored here the same as in text mode. Present a text-shaped
+                  // view of `output` to reach that read; `raw`/`promptConfirm` write the
+                  // prompt to stderr under every `Output` layer, so this never touches the
+                  // machine-readable stdout payload.
+                  output.format === "text" ? output : { ...output, format: "text" },
+                  yes,
+                  `Do you want to overwrite the existing ${emphasize(configured.value.displayPath)} file?`,
+                  true,
+                );
           if (!confirmed) {
             return yield* Effect.fail(
               new LegacyGenSigningKeyCancelledError({ message: "context canceled" }),
diff --git a/apps/cli/src/legacy/commands/gen/signing-key/signing-key.integration.test.ts b/apps/cli/src/legacy/commands/gen/signing-key/signing-key.integration.test.ts
index 93ac85949d..95439473a8 100644
--- a/apps/cli/src/legacy/commands/gen/signing-key/signing-key.integration.test.ts
+++ b/apps/cli/src/legacy/commands/gen/signing-key/signing-key.integration.test.ts
@@ -10,6 +10,7 @@ import {
   mockAnalytics,
   mockOutput,
   mockRuntimeInfo,
+  mockStdin,
   mockTty,
   processEnvLayer,
 } from "../../../../../tests/helpers/mocks.ts";
@@ -20,6 +21,7 @@ import {
   mockLegacyTelemetryStateTracked,
   useLegacyTempWorkdir,
 } from "../../../../../tests/helpers/legacy-mocks.ts";
+import { CliArgs } from "../../../../shared/cli/cli-args.service.ts";
 import { LegacyDebugLogger } from "../../../shared/legacy-debug-logger.service.ts";
 import { LEGACY_GLOBAL_FLAGS, LegacyYesFlag } from "../../../../shared/legacy/global-flags.ts";
 import { textCliOutputFormatter } from "../../../../shared/output/text-formatter.ts";
@@ -32,6 +34,7 @@ import { legacyGenSigningKey } from "./signing-key.handler.ts";
 const tempRoot = useLegacyTempWorkdir("supabase-gen-signing-key-int-");
 
 interface SetupOptions {
+  readonly format?: "text" | "json" | "stream-json";
   readonly stdinIsTty?: boolean;
   readonly yes?: boolean;
   readonly promptConfirmResponses?: ReadonlyArray<boolean>;
@@ -39,6 +42,10 @@ interface SetupOptions {
   // Exit code returned by the mocked `git check-ignore` subprocess. `0` means the path is
   // ignored, any non-zero code means it is not. Only consumed by the gitignore-warning branch.
   readonly gitCheckIgnoreExitCode?: number;
+  // Piped (non-TTY) stdin answer for the overwrite prompt (CLI-1865).
+  readonly pipedAnswer?: string;
+  // Raw argv for `legacyResolveYes`'s explicit `--yes=false` detection.
+  readonly cliArgs?: ReadonlyArray<string>;
 }
 
 // `git check-ignore` is invoked via ChildProcessSpawner. Mock it with a controlled exit code so
@@ -68,7 +75,7 @@ function mockGitCheckIgnore(exitCode: number) {
 
 function setup(options: SetupOptions = {}) {
   const out = mockOutput({
-    format: "text",
+    format: options.format ?? "text",
     interactive: options.stdinIsTty ?? false,
     promptConfirmResponses: options.promptConfirmResponses,
   });
@@ -82,6 +89,8 @@ function setup(options: SetupOptions = {}) {
   const layer = Layer.mergeAll(
     buildLegacyTestRuntime({ out, api, cliConfig, tty, telemetry: telemetry?.layer }),
     Layer.succeed(LegacyYesFlag, options.yes ?? false),
+    Layer.succeed(CliArgs, { args: options.cliArgs ?? [] }),
+    mockStdin(options.stdinIsTty ?? false, options.pipedAnswer),
     Layer.succeed(LegacyDebugLogger, {
       debug: () => Effect.void,
       http: () => Effect.void,
@@ -156,6 +165,8 @@ describe("legacy gen signing-key integration", () => {
       processEnvLayer({ SUPABASE_HOME: tempRoot.current }),
       mockRuntimeInfo({ cwd: tempRoot.current, homeDir: tempRoot.current }),
       mockTty({ stdinIsTty: false, stdoutIsTty: false }),
+      Layer.succeed(CliArgs, { args: [] }),
+      mockStdin(false),
       Layer.succeed(
         TelemetryRuntime,
         TelemetryRuntime.of({
@@ -203,8 +214,38 @@ describe("legacy gen signing-key integration", () => {
     }).pipe(Effect.provide(layer));
   });
 
-  it.live("overwrites the configured signing keys file and defaults to yes on non-tty", () => {
-    const { layer, out } = setup({ stdinIsTty: false });
+  it.live(
+    "overwrites the configured signing keys file and defaults to yes on non-tty when stdin has no piped answer",
+    () => {
+      const { layer, out } = setup({ stdinIsTty: false });
+      return Effect.gen(function* () {
+        yield* Effect.tryPromise(() =>
+          writeConfig('[auth]\nsigning_keys_path = "./signing_keys.json"\n'),
+        );
+        yield* Effect.tryPromise(() =>
+          writeFile(join(tempRoot.current, "supabase", "signing_keys.json"), "[]\n"),
+        );
+
+        yield* legacyGenSigningKey({ algorithm: "RS256", append: false });
+
+        const saved = yield* Effect.tryPromise(() =>
+          readFile(join(tempRoot.current, "supabase", "signing_keys.json"), "utf8"),
+        );
+        const parsed = JSON.parse(saved) as ReadonlyArray<Record<string, unknown>>;
+        expect(parsed).toHaveLength(1);
+        expect(parsed[0]?.alg).toBe("RS256");
+        expect(out.stderrText).toContain("Do you want to overwrite the existing");
+        expect(out.stderrText).toContain("JWT signing key appended to: ");
+        expect(out.stderrText).toContain(join("supabase", "signing_keys.json"));
+      }).pipe(Effect.provide(layer));
+    },
+  );
+
+  // CLI-1865: Go's overwrite prompt reads piped stdin even in non-TTY mode and honors an
+  // explicit "n" — before this fix, TS returned `true` unconditionally without reading stdin at
+  // all, so `echo n | supabase gen signing-key` silently overwrote instead of canceling.
+  it.live("cancels the overwrite when a piped non-tty answer of 'n' is read", () => {
+    const { layer, out } = setup({ stdinIsTty: false, pipedAnswer: "n" });
     return Effect.gen(function* () {
       yield* Effect.tryPromise(() =>
         writeConfig('[auth]\nsigning_keys_path = "./signing_keys.json"\n'),
@@ -213,17 +254,41 @@ describe("legacy gen signing-key integration", () => {
         writeFile(join(tempRoot.current, "supabase", "signing_keys.json"), "[]\n"),
       );
 
-      yield* legacyGenSigningKey({ algorithm: "RS256", append: false });
+      const exit = yield* Effect.exit(legacyGenSigningKey({ algorithm: "ES256", append: false }));
+      expect(Exit.isFailure(exit)).toBe(true);
+      if (Exit.isFailure(exit)) {
+        const json = JSON.stringify(exit.cause);
+        expect(json).toContain("LegacyGenSigningKeyCancelledError");
+        expect(json).toContain("context canceled");
+      }
+
+      const saved = yield* Effect.tryPromise(() =>
+        readFile(join(tempRoot.current, "supabase", "signing_keys.json"), "utf8"),
+      );
+      expect(JSON.parse(saved)).toEqual([]);
+      // Go's non-TTY prompt echoes the piped answer back to stderr after the label.
+      expect(out.stderrText).toContain("[Y/n] n\n");
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("overwrites when a piped non-tty answer of 'y' is read", () => {
+    const { layer, out } = setup({ stdinIsTty: false, pipedAnswer: "y" });
+    return Effect.gen(function* () {
+      yield* Effect.tryPromise(() =>
+        writeConfig('[auth]\nsigning_keys_path = "./signing_keys.json"\n'),
+      );
+      yield* Effect.tryPromise(() =>
+        writeFile(join(tempRoot.current, "supabase", "signing_keys.json"), "[]\n"),
+      );
+
+      yield* legacyGenSigningKey({ algorithm: "ES256", append: false });
 
       const saved = yield* Effect.tryPromise(() =>
         readFile(join(tempRoot.current, "supabase", "signing_keys.json"), "utf8"),
       );
       const parsed = JSON.parse(saved) as ReadonlyArray<Record<string, unknown>>;
       expect(parsed).toHaveLength(1);
-      expect(parsed[0]?.alg).toBe("RS256");
       expect(out.stderrText).toContain("Do you want to overwrite the existing");
-      expect(out.stderrText).toContain("JWT signing key appended to: ");
-      expect(out.stderrText).toContain(join("supabase", "signing_keys.json"));
     }).pipe(Effect.provide(layer));
   });
 
@@ -440,6 +505,199 @@ describe("legacy gen signing-key integration", () => {
     }).pipe(Effect.provide(layer));
   });
 
+  // This command has no structured json/stream-json output (SIDE_EFFECTS.md), so a real TTY
+  // requesting machine output is an unsupported combination — fail closed on this destructive,
+  // irreversible overwrite rather than silently defaulting to yes with no prompt at all.
+  it.live(
+    "declines the overwrite without prompting on a tty when --output-format is not text",
+    () => {
+      const { layer, out } = setup({ format: "json", stdinIsTty: true });
+      return Effect.gen(function* () {
+        yield* Effect.tryPromise(() =>
+          writeConfig('[auth]\nsigning_keys_path = "./signing_keys.json"\n'),
+        );
+        yield* Effect.tryPromise(() =>
+          writeFile(join(tempRoot.current, "supabase", "signing_keys.json"), "[]\n"),
+        );
+
+        const exit = yield* Effect.exit(legacyGenSigningKey({ algorithm: "ES256", append: false }));
+        expect(Exit.isFailure(exit)).toBe(true);
+        if (Exit.isFailure(exit)) {
+          const json = JSON.stringify(exit.cause);
+          expect(json).toContain("LegacyGenSigningKeyCancelledError");
+        }
+
+        const saved = yield* Effect.tryPromise(() =>
+          readFile(join(tempRoot.current, "supabase", "signing_keys.json"), "utf8"),
+        );
+        expect(JSON.parse(saved)).toEqual([]);
+        expect(out.promptConfirmCalls).toHaveLength(0);
+      }).pipe(Effect.provide(layer));
+    },
+  );
+
+  // CLI-1865 follow-up: `legacyPromptYesNo` checks `output.format !== "text"` BEFORE it
+  // checks TTY, so a non-TTY invocation under `json`/`stream-json` must not fall into that
+  // early return — this command has no structured json/stream-json payload, so a piped
+  // answer must be honored the same as text mode. Before this fix, a piped "n" here was
+  // silently ignored and the file was overwritten with the default (true).
+  it.live("honors a piped non-tty 'n' even when --output-format is json", () => {
+    const { layer, out } = setup({ format: "json", stdinIsTty: false, pipedAnswer: "n" });
+    return Effect.gen(function* () {
+      yield* Effect.tryPromise(() =>
+        writeConfig('[auth]\nsigning_keys_path = "./signing_keys.json"\n'),
+      );
+      yield* Effect.tryPromise(() =>
+        writeFile(join(tempRoot.current, "supabase", "signing_keys.json"), "[]\n"),
+      );
+
+      const exit = yield* Effect.exit(legacyGenSigningKey({ algorithm: "ES256", append: false }));
+      expect(Exit.isFailure(exit)).toBe(true);
+      if (Exit.isFailure(exit)) {
+        expect(JSON.stringify(exit.cause)).toContain("LegacyGenSigningKeyCancelledError");
+      }
+
+      const saved = yield* Effect.tryPromise(() =>
+        readFile(join(tempRoot.current, "supabase", "signing_keys.json"), "utf8"),
+      );
+      expect(JSON.parse(saved)).toEqual([]);
+      expect(out.promptConfirmCalls).toHaveLength(0);
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("honors a piped non-tty 'y' when --output-format is stream-json", () => {
+    const { layer } = setup({ format: "stream-json", stdinIsTty: false, pipedAnswer: "y" });
+    return Effect.gen(function* () {
+      yield* Effect.tryPromise(() =>
+        writeConfig('[auth]\nsigning_keys_path = "./signing_keys.json"\n'),
+      );
+      yield* Effect.tryPromise(() =>
+        writeFile(join(tempRoot.current, "supabase", "signing_keys.json"), "[]\n"),
+      );
+
+      yield* legacyGenSigningKey({ algorithm: "ES256", append: false });
+
+      const saved = yield* Effect.tryPromise(() =>
+        readFile(join(tempRoot.current, "supabase", "signing_keys.json"), "utf8"),
+      );
+      expect(JSON.parse(saved) as ReadonlyArray<unknown>).toHaveLength(1);
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("honors SUPABASE_YES and overwrites even when a piped 'n' is present", () => {
+    // Go reads `viper.GetBool("YES")` (incl. the SUPABASE_YES env var) BEFORE scanning
+    // stdin (`console.go:71`), so `SUPABASE_YES=1 printf 'n\n' | supabase gen signing-key`
+    // auto-confirms and overwrites rather than consuming the piped `n`. The handler
+    // resolves `yes` via `legacyResolveYes`, not the raw --yes flag.
+    const prev = process.env["SUPABASE_YES"];
+    process.env["SUPABASE_YES"] = "1";
+    const { layer } = setup({ stdinIsTty: false, pipedAnswer: "n" });
+    return Effect.gen(function* () {
+      yield* Effect.tryPromise(() =>
+        writeConfig('[auth]\nsigning_keys_path = "./signing_keys.json"\n'),
+      );
+      yield* Effect.tryPromise(() =>
+        writeFile(join(tempRoot.current, "supabase", "signing_keys.json"), "[]\n"),
+      );
+
+      yield* legacyGenSigningKey({ algorithm: "ES256", append: false });
+
+      const saved = yield* Effect.tryPromise(() =>
+        readFile(join(tempRoot.current, "supabase", "signing_keys.json"), "utf8"),
+      );
+      const parsed = JSON.parse(saved) as ReadonlyArray<Record<string, unknown>>;
+      expect(parsed).toHaveLength(1);
+    }).pipe(
+      Effect.ensuring(
+        Effect.sync(() => {
+          if (prev === undefined) delete process.env["SUPABASE_YES"];
+          else process.env["SUPABASE_YES"] = prev;
+        }),
+      ),
+      Effect.provide(layer),
+    );
+  });
+
+  it.live(
+    "auto-confirms from SUPABASE_YES in the project .env, even with a piped 'n' (CLI-1878)",
+    () => {
+      // SUPABASE_YES lives only in supabase/.env, not the shell. Go's `flags.LoadConfig`
+      // (`signingkeys.go:99`) loads the project `.env` files before the overwrite prompt reads
+      // `viper.GetBool("YES")` (`signingkeys.go:130`), so the overwrite auto-confirms and the
+      // piped `n` is never consumed — same precedence as the shell-env case above.
+      //
+      // Defensively clear a shell SUPABASE_YES: this test must prove the project-.env source
+      // specifically, not accidentally pass because a prior test in this file left the shell
+      // env set (the sibling shell-env tests above save/restore theirs).
+      const prev = process.env["SUPABASE_YES"];
+      delete process.env["SUPABASE_YES"];
+      const { layer } = setup({ stdinIsTty: false, pipedAnswer: "n" });
+      return Effect.gen(function* () {
+        yield* Effect.tryPromise(() =>
+          writeConfig('[auth]\nsigning_keys_path = "./signing_keys.json"\n'),
+        );
+        yield* Effect.tryPromise(() =>
+          writeFile(join(tempRoot.current, "supabase", "signing_keys.json"), "[]\n"),
+        );
+        yield* Effect.tryPromise(() =>
+          writeFile(join(tempRoot.current, "supabase", ".env"), "SUPABASE_YES=true\n"),
+        );
+
+        yield* legacyGenSigningKey({ algorithm: "ES256", append: false });
+
+        const saved = yield* Effect.tryPromise(() =>
+          readFile(join(tempRoot.current, "supabase", "signing_keys.json"), "utf8"),
+        );
+        const parsed = JSON.parse(saved) as ReadonlyArray<Record<string, unknown>>;
+        expect(parsed).toHaveLength(1);
+      }).pipe(
+        Effect.ensuring(
+          Effect.sync(() => {
+            if (prev !== undefined) process.env["SUPABASE_YES"] = prev;
+          }),
+        ),
+        Effect.provide(layer),
+      );
+    },
+  );
+
+  it.live("an explicit --yes=false overrides SUPABASE_YES and honors a piped 'n'", () => {
+    const prev = process.env["SUPABASE_YES"];
+    process.env["SUPABASE_YES"] = "1";
+    const { layer } = setup({
+      stdinIsTty: false,
+      pipedAnswer: "n",
+      cliArgs: ["gen", "signing-key", "--yes=false"],
+    });
+    return Effect.gen(function* () {
+      yield* Effect.tryPromise(() =>
+        writeConfig('[auth]\nsigning_keys_path = "./signing_keys.json"\n'),
+      );
+      yield* Effect.tryPromise(() =>
+        writeFile(join(tempRoot.current, "supabase", "signing_keys.json"), "[]\n"),
+      );
+
+      const exit = yield* Effect.exit(legacyGenSigningKey({ algorithm: "ES256", append: false }));
+      expect(Exit.isFailure(exit)).toBe(true);
+      if (Exit.isFailure(exit)) {
+        expect(JSON.stringify(exit.cause)).toContain("LegacyGenSigningKeyCancelledError");
+      }
+
+      const saved = yield* Effect.tryPromise(() =>
+        readFile(join(tempRoot.current, "supabase", "signing_keys.json"), "utf8"),
+      );
+      expect(JSON.parse(saved)).toEqual([]);
+    }).pipe(
+      Effect.ensuring(
+        Effect.sync(() => {
+          if (prev === undefined) delete process.env["SUPABASE_YES"];
+          else process.env["SUPABASE_YES"] = prev;
+        }),
+      ),
+      Effect.provide(layer),
+    );
+  });
+
   it.live("flushes telemetry state after the command finishes", () => {
     const { layer, telemetry } = setup({ trackTelemetry: true });
     return Effect.gen(function* () {
@@ -447,4 +705,28 @@ describe("legacy gen signing-key integration", () => {
       expect(telemetry?.flushed).toBe(true);
     }).pipe(Effect.provide(layer));
   });
+
+  it.live("flushes telemetry state even when the project .env is malformed (Codex review)", () => {
+    // Go attaches the telemetry service in root's `PersistentPreRunE` (cmd/root.go:131-155),
+    // before this command's own `RunE` runs `flags.LoadConfig` (signingkeys.go:99), so
+    // `service.Capture` still fires even when that project-.env load fails. The project-env
+    // resolution here must live inside the `Effect.ensuring(telemetryState.flush)`-wrapped
+    // block for the same reason — locks in that fix.
+    const { layer, telemetry } = setup({ trackTelemetry: true });
+    return Effect.gen(function* () {
+      yield* Effect.tryPromise(() =>
+        mkdir(join(tempRoot.current, "supabase"), { recursive: true }),
+      );
+      yield* Effect.tryPromise(() =>
+        writeFile(join(tempRoot.current, "supabase", ".env"), "!=broken\n"),
+      );
+
+      const exit = yield* Effect.exit(legacyGenSigningKey({ algorithm: "ES256", append: false }));
+      expect(Exit.isFailure(exit)).toBe(true);
+      if (Exit.isFailure(exit)) {
+        expect(JSON.stringify(exit.cause)).toContain("LegacyDbConfigLoadError");
+      }
+      expect(telemetry?.flushed).toBe(true);
+    }).pipe(Effect.provide(layer));
+  });
 });
diff --git a/apps/cli/src/legacy/commands/gen/types/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/gen/types/SIDE_EFFECTS.md
index 1bc6151b77..4ef5a89369 100644
--- a/apps/cli/src/legacy/commands/gen/types/SIDE_EFFECTS.md
+++ b/apps/cli/src/legacy/commands/gen/types/SIDE_EFFECTS.md
@@ -5,7 +5,8 @@
 | Path                                      | Format     | When                                                                                     |
 | ----------------------------------------- | ---------- | ---------------------------------------------------------------------------------------- |
 | `~/.supabase/access-token`                | plain text | when `SUPABASE_ACCESS_TOKEN` unset and `--linked` or `--project-id`                      |
-| `<workdir>/supabase/config.toml`          | TOML       | when selecting schemas from config; required for `--local`, best-effort otherwise        |
+| `<workdir>/supabase/config.toml`          | TOML       | when selecting schemas; `--local` uses embedded defaults when the file is missing        |
+| `<workdir>{/supabase}/.env*`              | dotenv     | `--local`; resolves the same nested environment overrides as the legacy CLI              |
 | `<workdir>/supabase/.temp/rest-version`   | plain text | `--local` only, when `db.major_version > 14` — forces v9 compat if the tag contains `v9` |
 | `<workdir>/supabase/.temp/pgmeta-version` | plain text | `--local` only — overrides the pg-meta docker image tag                                  |
 
@@ -59,7 +60,12 @@ default 10s pg-delta probe timeout.
 | Variable                           | Purpose                                                                                     | Required?                                                                                                     |
 | ---------------------------------- | ------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------- |
 | `SUPABASE_ACCESS_TOKEN`            | auth token for linked/project-id mode                                                       | no (falls back to keyring → `~/.supabase/access-token`)                                                       |
-| `SUPABASE_API_URL`                 | override Management API base URL                                                            | no (defaults to `https://api.supabase.com`)                                                                   |
+| `SUPABASE_PROJECT_ID`              | local Docker container and network project ID                                               | no (falls back to the workdir name)                                                                           |
+| `SUPABASE_DB_PORT`                 | local database probe port                                                                   | no (defaults to `54322`)                                                                                      |
+| `SUPABASE_DB_MAJOR_VERSION`        | local PostgreSQL major version                                                              | no (defaults to `17`)                                                                                         |
+| `SUPABASE_API_SCHEMAS`             | local schemas used when `--schema` is omitted                                               | no (defaults to `public,graphql_public`)                                                                      |
+| `SUPABASE_ENV`                     | selects nested dotenv files for local generation                                            | no (defaults to `development`)                                                                                |
+| `SUPABASE_PROFILE`                 | built-in profile name or YAML file path                                                     | no (falls back to `~/.supabase/profile` -> `supabase`)                                                        |
 | `SUPABASE_DB_PASSWORD`             | database password for `--local` and the `--linked` workdir project                          | no (defaults to `postgres`; **ignored** for ad-hoc `--project-id`, which always mints a temporary login role) |
 | `SUPABASE_SERVICES_HOSTNAME`       | host used for the local TLS probe                                                           | no (defaults to `127.0.0.1`)                                                                                  |
 | `SUPABASE_INTERNAL_IMAGE_REGISTRY` | pg-meta image registry override (`docker.io` → Docker Hub; any other value → that registry) | no (defaults to the ECR registry)                                                                             |
@@ -95,6 +101,8 @@ Not applicable.
 ## Notes
 
 - Exactly one of `--local`, `--linked`, `--project-id`, or `--db-url` must be specified.
+- With `--local`, a missing `supabase/config.toml` uses the embedded config defaults plus
+  shell and nested dotenv overrides, matching the legacy CLI.
 - `--lang` flag accepts `typescript` (default), `go`, `swift`, or `python`. Project-ref
   paths use the Management API for TypeScript, and use a project database host +
   temporary login role + pg-meta for other languages.
diff --git a/apps/cli/src/legacy/commands/gen/types/types.command.ts b/apps/cli/src/legacy/commands/gen/types/types.command.ts
index 341e9dfa38..1e1e78921e 100644
--- a/apps/cli/src/legacy/commands/gen/types/types.command.ts
+++ b/apps/cli/src/legacy/commands/gen/types/types.command.ts
@@ -75,7 +75,7 @@ export const legacyGenTypesCommand = Command.make("types", config).pipe(
   ]),
   Command.withHandler((flags) =>
     legacyGenTypes(flags).pipe(
-      withLegacyCommandInstrumentation({ flags, safeFlags: ["project-id"] }),
+      withLegacyCommandInstrumentation({ flags, safeFlags: ["project-id"], config }),
       withJsonErrorHandling,
     ),
   ),
diff --git a/apps/cli/src/legacy/commands/gen/types/types.handler.ts b/apps/cli/src/legacy/commands/gen/types/types.handler.ts
index 6008a3849e..3f090e6090 100644
--- a/apps/cli/src/legacy/commands/gen/types/types.handler.ts
+++ b/apps/cli/src/legacy/commands/gen/types/types.handler.ts
@@ -7,6 +7,10 @@ import {
   LegacyNetworkIdFlag,
 } from "../../../../shared/legacy/global-flags.ts";
 import { Output } from "../../../../shared/output/output.service.ts";
+import {
+  cobraMutuallyExclusiveErrorMessage,
+  hasExplicitLongFlag,
+} from "../../../../shared/cli/cobra-flag-groups.ts";
 import { LegacyCliConfig } from "../../../config/legacy-cli-config.service.ts";
 import { LegacyProjectNotLinkedError } from "../../../config/legacy-project-ref.errors.ts";
 import {
@@ -22,6 +26,10 @@ import { mapLegacyHttpError } from "../../../shared/legacy-http-errors.ts";
 import { LegacyDbConfigResolver } from "../../../shared/legacy-db-config.service.ts";
 import type { LegacyDbConfigFlags } from "../../../shared/legacy-db-config.types.ts";
 import { legacyPoolerConfigFromConnectionString } from "../../../shared/legacy-db-config.parse.ts";
+import {
+  legacyApplyProjectEnv,
+  legacyReadDbToml,
+} from "../../../shared/legacy-db-config.toml-read.ts";
 import type { LegacyPgConnInput } from "../../../shared/legacy-db-connection.service.ts";
 import { legacyToPostgresURL } from "../../../shared/legacy-postgres-url.ts";
 import { legacyTempPaths } from "../../../shared/legacy-temp-paths.ts";
@@ -79,6 +87,8 @@ function isProjectNotFound(cause: unknown) {
   return cause instanceof LegacyGenTypesUnexpectedStatusError && cause.status === 404;
 }
 
+const GEN_TYPES_COMMAND_PATH = ["gen", "types"] as const;
+
 function ensureMutuallyExclusive(
   group: ReadonlyArray<string>,
   present: ReadonlyArray<string>,
@@ -86,11 +96,7 @@ function ensureMutuallyExclusive(
   if (present.length <= 1) {
     return Effect.void;
   }
-  return Effect.fail(
-    new Error(
-      `if any flags in the group [${group.join(" ")}] are set none of the others can be; [${present.join(" ")}] were all set`,
-    ),
-  );
+  return Effect.fail(new Error(cobraMutuallyExclusiveErrorMessage(group, present)));
 }
 
 function forwardByteStream(
@@ -177,29 +183,6 @@ function findLegacyPositionalLanguage(rawArgs: ReadonlyArray<string>): Option.Op
   return Option.none();
 }
 
-function hasExplicitLongFlag(rawArgs: ReadonlyArray<string>, flagName: string): boolean {
-  const commandIndex = rawArgs.findIndex(
-    (value, index) => value === "types" && rawArgs[index - 1] === "gen",
-  );
-  if (commandIndex === -1) {
-    return false;
-  }
-
-  for (let index = commandIndex + 1; index < rawArgs.length; index += 1) {
-    const token = rawArgs[index];
-    if (token === undefined) {
-      return false;
-    }
-    if (token === "--") {
-      return false;
-    }
-    if (token === `--${flagName}` || token.startsWith(`--${flagName}=`)) {
-      return true;
-    }
-  }
-  return false;
-}
-
 export const legacyGenTypes = Effect.fn("legacy.gen.types")(function* (flags: LegacyGenTypesFlags) {
   const output = yield* Output;
   const cliConfig = yield* LegacyCliConfig;
@@ -231,7 +214,7 @@ export const legacyGenTypes = Effect.fn("legacy.gen.types")(function* (flags: Le
   if (
     Option.isSome(legacyLang) &&
     legacyLang.value !== "typescript" &&
-    !hasExplicitLongFlag(rawArgs, "lang")
+    !hasExplicitLongFlag(rawArgs, GEN_TYPES_COMMAND_PATH, "lang")
   ) {
     return yield* Effect.fail(new Error("use --lang flag to specify the typegen language"));
   }
@@ -244,7 +227,10 @@ export const legacyGenTypes = Effect.fn("legacy.gen.types")(function* (flags: Le
   const swiftAccessControl = flags.swiftAccessControl;
   const usesPgMeta = flags.local || Option.isSome(flags.dbUrl) || flags.lang !== "typescript";
 
-  if (hasExplicitLongFlag(rawArgs, "swift-access-control") && lang !== "swift") {
+  if (
+    hasExplicitLongFlag(rawArgs, GEN_TYPES_COMMAND_PATH, "swift-access-control") &&
+    lang !== "swift"
+  ) {
     return yield* Effect.fail(
       new Error("--swift-access-control can only be used with --lang swift"),
     );
@@ -254,7 +240,7 @@ export const legacyGenTypes = Effect.fn("legacy.gen.types")(function* (flags: Le
       new Error("--postgrest-v9-compat can only be used with pg-meta type generation"),
     );
   }
-  if (hasExplicitLongFlag(rawArgs, "query-timeout") && !usesPgMeta) {
+  if (hasExplicitLongFlag(rawArgs, GEN_TYPES_COMMAND_PATH, "query-timeout") && !usesPgMeta) {
     if (flags.linked || Option.isSome(flags.projectId)) {
       return yield* Effect.fail(
         new Error("--query-timeout can only be used with pg-meta type generation"),
@@ -266,9 +252,9 @@ export const legacyGenTypes = Effect.fn("legacy.gen.types")(function* (flags: Le
     );
   }
 
-  const loadConfig = () => loadProjectConfig(cliConfig.workdir);
+  const loadConfig = () => loadProjectConfig(cliConfig.workdir, { goViperCompat: true });
   const loadConfigForRef = (projectRef: string) =>
-    loadProjectConfig(cliConfig.workdir, { projectRef });
+    loadProjectConfig(cliConfig.workdir, { projectRef, goViperCompat: true });
 
   const schemasFromConfig = (apiSchemas: ReadonlyArray<string> | undefined) =>
     defaultSchemas(apiSchemas);
@@ -545,12 +531,12 @@ export const legacyGenTypes = Effect.fn("legacy.gen.types")(function* (flags: Le
 
   yield* Effect.gen(function* () {
     if (flags.local) {
-      const loaded = yield* loadConfig();
-      if (loaded === null) {
-        return yield* Effect.fail(
-          new Error("failed to load config: supabase/config.toml not found"),
-        );
-      }
+      const config = yield* legacyReadDbToml(fs, path, cliConfig.workdir);
+      yield* legacyApplyProjectEnv(
+        config.projectEnv,
+        Object.keys(config.projectEnv).filter((key) => key !== "SUPABASE_DB_PASSWORD"),
+      );
+      const projectId = Option.getOrElse(config.projectId, () => path.basename(cliConfig.workdir));
 
       const paths = legacyTempPaths(path, cliConfig.workdir);
       // Go resolves Config.Api.Image from the rest-version file only when
@@ -558,7 +544,7 @@ export const legacyGenTypes = Effect.fn("legacy.gen.types")(function* (flags: Le
       // (pkg/config/config.go:657-666, internal/gen/types/types.go:69). Gate and trim
       // identically so we don't force v9 on older databases.
       const restVersion =
-        loaded.config.db.major_version > 14
+        config.majorVersion > 14
           ? (yield* fs
               .readFileString(paths.restVersion)
               .pipe(Effect.orElseSucceed(() => ""))).trim()
@@ -569,9 +555,8 @@ export const legacyGenTypes = Effect.fn("legacy.gen.types")(function* (flags: Le
         .pipe(Effect.orElseSucceed(() => ""));
 
       const includedSchemas = (
-        schemas.length > 0 ? schemas : defaultSchemas(loaded.config.api.schemas)
+        schemas.length > 0 ? schemas : defaultSchemas(config.apiSchemas)
       ).join(",");
-      const projectId = loaded.config.project_id ?? path.basename(cliConfig.workdir);
       yield* assertLocalDbRunning(projectId);
 
       yield* runPgMeta({
@@ -585,7 +570,7 @@ export const legacyGenTypes = Effect.fn("legacy.gen.types")(function* (flags: Le
         host: "db",
         port: 5432,
         probeHost: legacyGetHostname(),
-        probePort: loaded.config.db.port,
+        probePort: config.port,
         networkMode: localNetworkId(projectId),
         includedSchemas,
         postgrestV9Compat: flags.postgrestV9Compat || forcedV9,
@@ -655,5 +640,5 @@ export const legacyGenTypes = Effect.fn("legacy.gen.types")(function* (flags: Le
       schemas.length > 0 ? schemas : schemasFromConfig(loaded?.config.api.schemas),
       false,
     );
-  }).pipe(Effect.ensuring(telemetryState.flush));
+  }).pipe(Effect.scoped, Effect.ensuring(telemetryState.flush));
 });
diff --git a/apps/cli/src/legacy/commands/gen/types/types.integration.test.ts b/apps/cli/src/legacy/commands/gen/types/types.integration.test.ts
index 5407d1bd2d..5d75f2caa9 100644
--- a/apps/cli/src/legacy/commands/gen/types/types.integration.test.ts
+++ b/apps/cli/src/legacy/commands/gen/types/types.integration.test.ts
@@ -1,7 +1,7 @@
 import { existsSync, mkdtempSync, mkdirSync, rmSync, writeFileSync } from "node:fs";
 import { createServer } from "node:net";
 import { tmpdir } from "node:os";
-import { join } from "node:path";
+import { basename, join } from "node:path";
 import { describe, expect, it } from "@effect/vitest";
 import { BunServices } from "@effect/platform-bun";
 import type {
@@ -62,7 +62,12 @@ import type {
 import { legacyGenCommand } from "../gen.command.ts";
 import type { LegacyGenTypesFlags } from "./types.command.ts";
 import { legacyGenTypes } from "./types.handler.ts";
-import { parseQueryTimeoutSeconds, resolvePgmetaImage } from "./types.shared.ts";
+import {
+  localDbContainerId,
+  localNetworkId,
+  parseQueryTimeoutSeconds,
+  resolvePgmetaImage,
+} from "./types.shared.ts";
 
 function writeConfig(workdir: string, contents: string) {
   const supabaseDir = join(workdir, "supabase");
@@ -788,8 +793,10 @@ describe("legacy gen types", () => {
 
       expect(Exit.isFailure(exit)).toBe(true);
       if (Exit.isFailure(exit)) {
+        // cobra sorts the violating-flag set alphabetically (sort.Strings) —
+        // "linked" before "local" — regardless of check order.
         expect(String(exit.cause)).toContain(
-          "if any flags in the group [local linked project-id db-url] are set none of the others can be; [local linked] were all set",
+          "if any flags in the group [local linked project-id db-url] are set none of the others can be; [linked local] were all set",
         );
       }
     });
@@ -2629,22 +2636,98 @@ describe("legacy gen types", () => {
     },
   );
 
-  it.live("fails local generation when supabase/config.toml is missing", () => {
+  it.live("generates locally with Go defaults when supabase/config.toml is missing", () => {
     const workdir = mkdtempSync(join(tmpdir(), "supabase-gen-types-local-no-config-"));
-    const { layer } = setup({ workdir, skipConfig: true });
+    const docker = captureDockerRun();
+    const probes: Array<{ host: string; port: number }> = [];
+    const { layer, out, child } = setup({
+      workdir,
+      skipConfig: true,
+      childStdout: ["generated"],
+      onSpawn: docker.onSpawn,
+      sslProbeLayer: Layer.succeed(LegacyPgDeltaSslProbe, {
+        requireSsl: () => Effect.succeed(false),
+        requireSslForHost: (host, port) =>
+          Effect.sync(() => {
+            probes.push({ host, port });
+            return false;
+          }),
+      }),
+    });
 
     return Effect.gen(function* () {
-      const exit = yield* legacyGenTypes(defaultFlags({ local: true })).pipe(
-        Effect.provide(layer),
-        Effect.exit,
+      yield* legacyGenTypes(defaultFlags({ local: true })).pipe(Effect.provide(layer));
+
+      const projectId = basename(workdir);
+      expect(child.spawned[0]).toEqual({
+        command: "docker",
+        args: ["container", "inspect", localDbContainerId(projectId)],
+      });
+      expect(child.spawned[1]?.args).toContain(localNetworkId(projectId));
+      expect(probes).toEqual([{ host: "127.0.0.1", port: 54322 }]);
+      expect(docker.env.has("PG_META_GENERATE_TYPES_INCLUDED_SCHEMAS=public,graphql_public")).toBe(
+        true,
       );
+      expect(out.stdoutText).toContain("generated");
+    });
+  });
 
-      expect(Exit.isFailure(exit)).toBe(true);
-      if (Exit.isFailure(exit)) {
-        expect(String(exit.cause)).toContain(
-          "failed to load config: supabase/config.toml not found",
-        );
-      }
+  it.live("honors local dotenv overrides when supabase/config.toml is missing", () => {
+    const workdir = mkdtempSync(join(tmpdir(), "supabase-gen-types-local-no-config-env-"));
+    const supabaseDir = join(workdir, "supabase");
+    mkdirSync(supabaseDir, { recursive: true });
+    writeFileSync(
+      join(supabaseDir, ".env"),
+      [
+        "SUPABASE_PROJECT_ID=configless-env-project",
+        "SUPABASE_DB_PORT=55432",
+        "SUPABASE_DB_PASSWORD=remote-password",
+        "SUPABASE_API_SCHEMAS=private,graphql_public",
+        "SUPABASE_SERVICES_HOSTNAME=host.docker.internal",
+        "SUPABASE_INTERNAL_IMAGE_REGISTRY=mirror.example.com",
+        "",
+      ].join("\n"),
+    );
+    const docker = captureDockerRun();
+    const probes: Array<{ host: string; port: number }> = [];
+    const { layer, out, child } = setup({
+      workdir,
+      skipConfig: true,
+      childStdout: ["generated"],
+      onSpawn: docker.onSpawn,
+      sslProbeLayer: Layer.succeed(LegacyPgDeltaSslProbe, {
+        requireSsl: () => Effect.succeed(false),
+        requireSslForHost: (host, port) =>
+          Effect.sync(() => {
+            probes.push({ host, port });
+            return false;
+          }),
+      }),
+    });
+
+    return Effect.gen(function* () {
+      yield* legacyGenTypes(defaultFlags({ local: true })).pipe(Effect.provide(layer));
+
+      expect(child.spawned[0]).toEqual({
+        command: "docker",
+        args: ["container", "inspect", localDbContainerId("configless-env-project")],
+      });
+      expect(child.spawned[1]?.args).toContain(localNetworkId("configless-env-project"));
+      expect(probes).toEqual([{ host: "host.docker.internal", port: 55432 }]);
+      expect(
+        docker.env.has("PG_META_GENERATE_TYPES_INCLUDED_SCHEMAS=public,private,graphql_public"),
+      ).toBe(true);
+      expect(
+        docker.env.has(
+          "PG_META_DB_URL=postgresql://postgres:postgres@db:5432/postgres?connect_timeout=10",
+        ),
+      ).toBe(true);
+      expect(
+        child.spawned[1]?.args.some((arg) =>
+          arg.startsWith("mirror.example.com/supabase/postgres-meta:"),
+        ),
+      ).toBe(true);
+      expect(out.stdoutText).toContain("generated");
     });
   });
 
diff --git a/apps/cli/src/legacy/commands/inspect/db/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/inspect/db/SIDE_EFFECTS.md
index f5728c86be..7bfc41e7a1 100644
--- a/apps/cli/src/legacy/commands/inspect/db/SIDE_EFFECTS.md
+++ b/apps/cli/src/legacy/commands/inspect/db/SIDE_EFFECTS.md
@@ -40,7 +40,7 @@ no new config reads.
 | ---------------------------------------------------- | --------------------------------- | --------------------------------------- |
 | `SUPABASE_DB_PASSWORD` / `DB_PASSWORD`               | database password (linked/local)  | no (prompts / config fallback)          |
 | `SUPABASE_ACCESS_TOKEN`                              | Management API auth (linked only) | no (falls back to keyring / token file) |
-| `PROJECT_ID`                                         | project ref fallback (linked)     | no (config resolution fallback)         |
+| `SUPABASE_PROJECT_ID`                                | project ref fallback (linked)     | no (config resolution fallback)         |
 | libpq vars (`PGSSLROOTCERT`, `PGCONNECT_TIMEOUT`, …) | honored when `--db-url` is used   | no                                      |
 
 ## Database Queries
diff --git a/apps/cli/src/legacy/commands/inspect/report/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/inspect/report/SIDE_EFFECTS.md
index 3da2b98fdb..9307ddcd2a 100644
--- a/apps/cli/src/legacy/commands/inspect/report/SIDE_EFFECTS.md
+++ b/apps/cli/src/legacy/commands/inspect/report/SIDE_EFFECTS.md
@@ -54,12 +54,12 @@ resolve the connection (via `LegacyDbConfigResolver`).
 
 ## Environment Variables
 
-| Variable                | Purpose                                              | Required? |
-| ----------------------- | ---------------------------------------------------- | --------- |
-| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no        |
-| `SUPABASE_API_URL`      | override Management API base URL                     | no        |
-| `SUPABASE_DB_*`         | override `[db]` port / shadow_port / password        | no        |
-| `SUPABASE_ENV`          | selects which project `.env` files load              | no        |
+| Variable                | Purpose                                              | Required?                                              |
+| ----------------------- | ---------------------------------------------------- | ------------------------------------------------------ |
+| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no                                                     |
+| `SUPABASE_PROFILE`      | built-in profile name or YAML file path              | no (falls back to `~/.supabase/profile` -> `supabase`) |
+| `SUPABASE_DB_*`         | override `[db]` port / shadow_port / password        | no                                                     |
+| `SUPABASE_ENV`          | selects which project `.env` files load              | no                                                     |
 
 ## Exit Codes
 
diff --git a/apps/cli/src/legacy/commands/migration/fetch/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/migration/fetch/SIDE_EFFECTS.md
index 7da5a26931..398edd9745 100644
--- a/apps/cli/src/legacy/commands/migration/fetch/SIDE_EFFECTS.md
+++ b/apps/cli/src/legacy/commands/migration/fetch/SIDE_EFFECTS.md
@@ -2,9 +2,10 @@
 
 ## Files Read
 
-| Path                       | Format     | When                                              |
-| -------------------------- | ---------- | ------------------------------------------------- |
-| `~/.supabase/access-token` | plain text | when `SUPABASE_ACCESS_TOKEN` unset and `--linked` |
+| Path                                          | Format     | When                                                               |
+| --------------------------------------------- | ---------- | ------------------------------------------------------------------ |
+| `~/.supabase/access-token`                    | plain text | when `SUPABASE_ACCESS_TOKEN` unset and `--linked`                  |
+| `<workdir>/supabase/.env*`, `<workdir>/.env*` | dotenv     | always, to resolve `SUPABASE_YES` (CLI-1878; Go's `loadNestedEnv`) |
 
 ## Files Written
 
@@ -20,9 +21,10 @@
 
 ## Environment Variables
 
-| Variable                | Purpose                        | Required?                                               |
-| ----------------------- | ------------------------------ | ------------------------------------------------------- |
-| `SUPABASE_ACCESS_TOKEN` | auth token for `--linked` mode | no (falls back to keyring → `~/.supabase/access-token`) |
+| Variable                | Purpose                           | Required?                                                                                                         |
+| ----------------------- | --------------------------------- | ----------------------------------------------------------------------------------------------------------------- |
+| `SUPABASE_ACCESS_TOKEN` | auth token for `--linked` mode    | no (falls back to keyring → `~/.supabase/access-token`)                                                           |
+| `SUPABASE_YES`          | auto-confirm the overwrite prompt | no — read from the shell env OR the project `.env`/`.env.local`/`.env.<env>[.local]` files (shell wins; CLI-1878) |
 
 ## Exit Codes
 
@@ -54,8 +56,9 @@ Same structured `files` result delivered as an NDJSON `result` event.
 
 - When the migrations directory is non-empty, prompts
   `Do you want to overwrite existing files in supabase/migrations directory?`
-  (default **YES**). Declining exits non-zero (`context canceled`). `--yes`
-  auto-confirms; a non-interactive / machine-output run takes the default (YES).
+  (default **YES**). Declining exits non-zero (`context canceled`). `--yes` or
+  `SUPABASE_YES` (shell env or project `.env`) auto-confirms; a non-interactive /
+  machine-output run takes the default (YES).
 
 ## Notes
 
diff --git a/apps/cli/src/legacy/commands/migration/fetch/fetch.handler.ts b/apps/cli/src/legacy/commands/migration/fetch/fetch.handler.ts
index ccc5b69f43..6fadfea2b4 100644
--- a/apps/cli/src/legacy/commands/migration/fetch/fetch.handler.ts
+++ b/apps/cli/src/legacy/commands/migration/fetch/fetch.handler.ts
@@ -1,6 +1,9 @@
 import { Effect, FileSystem, Option, Path } from "effect";
 
-import { LegacyDnsResolverFlag, legacyResolveYes } from "../../../../shared/legacy/global-flags.ts";
+import {
+  LegacyDnsResolverFlag,
+  legacyResolveYesWithProjectEnv,
+} from "../../../../shared/legacy/global-flags.ts";
 import { CliArgs } from "../../../../shared/cli/cli-args.service.ts";
 import { Output } from "../../../../shared/output/output.service.ts";
 import { LegacyCliConfig } from "../../../config/legacy-cli-config.service.ts";
@@ -8,6 +11,7 @@ import { LegacyProjectRefResolver } from "../../../config/legacy-project-ref.ser
 import { legacyBold } from "../../../shared/legacy-colors.ts";
 import { LegacyDbConfigResolver } from "../../../shared/legacy-db-config.service.ts";
 import { LegacyDbConnection } from "../../../shared/legacy-db-connection.service.ts";
+import { legacyLoadProjectEnv } from "../../../shared/legacy-db-config.toml-read.ts";
 import { resolveLegacyDbTargetFlags } from "../../../shared/legacy-db-target-flags.ts";
 import { legacyReadMigrationTable } from "../../../shared/legacy-migration-history.ts";
 import { LegacyLinkedProjectCache } from "../../../telemetry/legacy-linked-project-cache.service.ts";
@@ -31,8 +35,10 @@ const runFetch = Effect.fnUntraced(function* (
   const fs = yield* FileSystem.FileSystem;
   const path = yield* Path.Path;
   const dnsResolver = yield* LegacyDnsResolverFlag;
-  const yes = yield* legacyResolveYes; // --yes OR SUPABASE_YES (Go viper AutomaticEnv, root.go:318-334).
 
+  // Flag-group mutual-exclusion first: cobra's `MarkFlagsMutuallyExclusive` validates at
+  // parse time, ahead of the root `PersistentPreRunE` (same ordering as `migration down`/
+  // `repair`).
   if (target.setFlags.length > 1) {
     return yield* Effect.fail(
       new LegacyMigrationTargetFlagsError({
@@ -55,6 +61,14 @@ const runFetch = Effect.fnUntraced(function* (
     dnsResolver,
   });
 
+  // Go loads the project .env via loadNestedEnv INSIDE ParseDatabaseConfig (config.go:701),
+  // i.e. after the parse-time flag-group validation above — so a SUPABASE_YES set only in
+  // supabase/.env auto-confirms, but a flag conflict still surfaces before any .env read.
+  // Resolve --yes against the project env here, not just process.env (root.go:318-334).
+  // Same ordering as `migration down`/`repair`.
+  const projectEnv = yield* legacyLoadProjectEnv(fs, path, cliConfig.workdir);
+  const yes = yield* legacyResolveYesWithProjectEnv(projectEnv);
+
   // Linked fetch caches the project ref on success (Go's `PersistentPostRun`). The ref is
   // loaded now (pre-run), but the cache write is attached to the body via `Effect.ensuring`,
   // so a declined prompt returns before it runs — matching Go (PostRun is skipped on a
diff --git a/apps/cli/src/legacy/commands/migration/fetch/fetch.integration.test.ts b/apps/cli/src/legacy/commands/migration/fetch/fetch.integration.test.ts
index f0fcd50ccf..b4c408487d 100644
--- a/apps/cli/src/legacy/commands/migration/fetch/fetch.integration.test.ts
+++ b/apps/cli/src/legacy/commands/migration/fetch/fetch.integration.test.ts
@@ -43,6 +43,8 @@ interface SetupOpts {
   readonly confirm?: boolean;
   readonly rows?: ReadonlyArray<MigrationRow>;
   readonly resolveFails?: boolean;
+  /** Raw argv seen by `resolveLegacyDbTargetFlags` (e.g. to exercise a flag conflict). */
+  readonly cliArgs?: ReadonlyArray<string>;
 }
 
 function setup(workdir: string, opts: SetupOpts = {}) {
@@ -109,7 +111,7 @@ function setup(workdir: string, opts: SetupOpts = {}) {
     mockLegacyCliConfig({ workdir }),
     Layer.succeed(LegacyDnsResolverFlag, "native"),
     Layer.succeed(LegacyYesFlag, opts.yes ?? false),
-    Layer.succeed(CliArgs, { args: [] }),
+    Layer.succeed(CliArgs, { args: opts.cliArgs ?? [] }),
     mockTty({ stdinIsTty: opts.isTTY ?? true }),
     mockStdin(
       opts.isTTY ?? true,
@@ -237,6 +239,27 @@ describe("legacy migration fetch", () => {
     }).pipe(Effect.provide(layer));
   });
 
+  it.live(
+    "auto-confirms the overwrite prompt from SUPABASE_YES in the project .env (Go loadNestedEnv)",
+    () => {
+      // SUPABASE_YES lives only in supabase/.env, not the shell — `fetch` defaults to
+      // `--linked` (Go: migration.go:161), and root's `ParseDatabaseConfig` loads the project
+      // `.env` files before `fetch.Run`'s overwrite prompt (root.go:118), so the overwrite
+      // auto-confirms with no --yes flag and no piped stdin answer (CLI-1878).
+      mkdirSync(migrationsDir(tmp.current), { recursive: true });
+      writeFileSync(join(migrationsDir(tmp.current), "existing.sql"), "select 1;\n");
+      writeFileSync(join(tmp.current, "supabase", ".env"), "SUPABASE_YES=true\n");
+      const { layer, out } = setup(tmp.current, {
+        rows: [{ version: "20240101000000", name: "init", statements: ["create table a"] }],
+      });
+      return Effect.gen(function* () {
+        yield* legacyMigrationFetch(flags());
+        expect(out.stderrText).toContain("[Y/n] y");
+        expect(readdirSync(migrationsDir(tmp.current))).toContain("20240101000000_init.sql");
+      }).pipe(Effect.provide(layer));
+    },
+  );
+
   it.live("still prompts on stderr in json mode and proceeds on a piped yes", () => {
     // Go writes the prompt to stderr and reads stdin regardless of --output (console.go),
     // so --output-format json must NOT silently auto-accept: the overwrite prompt fires on
@@ -332,8 +355,12 @@ describe("legacy migration fetch", () => {
   });
 
   it.live("reports a write failure", () => {
-    // A file at <workdir>/supabase makes `makeDirectory(supabase/migrations)` fail.
-    writeFileSync(join(tmp.current, "supabase"), "not a directory");
+    // A file at <workdir>/supabase/migrations makes `makeDirectory` fail. `supabase` itself
+    // must stay a real directory here: the handler's project-env load (CLI-1878, honoring
+    // Go's `loadNestedEnv`) reads `<workdir>/supabase/.env*` before this mkdir, and a plain
+    // file at `<workdir>/supabase` would make that read fail first (ENOTDIR) instead.
+    mkdirSync(join(tmp.current, "supabase"), { recursive: true });
+    writeFileSync(join(tmp.current, "supabase", "migrations"), "not a directory");
     const { layer } = setup(tmp.current, { rows: [] });
     return Effect.gen(function* () {
       const exit = yield* legacyMigrationFetch(flags()).pipe(Effect.exit);
@@ -362,4 +389,33 @@ describe("legacy migration fetch", () => {
       expect(out.promptConfirmCalls.length).toBe(0);
     }).pipe(Effect.provide(layer));
   });
+
+  it.live(
+    "rejects --db-url combined with --linked before reading the project .env (CLI-1878)",
+    () => {
+      // Cobra's `MarkFlagsMutuallyExclusive` validates at parse time, ahead of the root
+      // `PersistentPreRunE` that runs `ParseDatabaseConfig`/`loadNestedEnv` — so a flag
+      // conflict must surface even when `supabase/.env` is malformed (which would abort a
+      // project-env load with a DIFFERENT error, `LegacyDbConfigLoadError`, if the env load
+      // ran first). Locks in the fix that reordered the project-env load in `fetch.handler.ts`
+      // to run after this flag-group check.
+      mkdirSync(join(tmp.current, "supabase"), { recursive: true });
+      writeFileSync(join(tmp.current, "supabase", ".env"), "!=broken\n");
+      const { layer } = setup(tmp.current, {
+        cliArgs: ["--db-url", "postgresql://x", "--linked"],
+      });
+      return Effect.gen(function* () {
+        const exit = yield* legacyMigrationFetch(
+          flags({ dbUrl: Option.some("postgresql://x") }),
+        ).pipe(Effect.exit);
+        expect(Exit.isFailure(exit)).toBe(true);
+        if (Exit.isFailure(exit)) {
+          const failure = Cause.findErrorOption(exit.cause);
+          expect(Option.isSome(failure) && failure.value._tag).toBe(
+            "LegacyMigrationTargetFlagsError",
+          );
+        }
+      }).pipe(Effect.provide(layer));
+    },
+  );
 });
diff --git a/apps/cli/src/legacy/commands/migration/repair/repair.command.ts b/apps/cli/src/legacy/commands/migration/repair/repair.command.ts
index d00659ed76..0b6859a907 100644
--- a/apps/cli/src/legacy/commands/migration/repair/repair.command.ts
+++ b/apps/cli/src/legacy/commands/migration/repair/repair.command.ts
@@ -55,8 +55,9 @@ export const legacyMigrationRepairCommand = Command.make("repair", config).pipe(
           // `password` is a credential — always reaches telemetry as `<redacted>`.
           password: flags.password,
         },
-        // Go records `utils.EnumFlag` values verbatim (`--status`); password stays redacted.
-        safeFlags: ["status"],
+        // --status is Flag.choice and is auto-detected as safe via `config`
+        // below (Go's isEnumFlag, cmd/root_analytics.go:110-116); password stays redacted.
+        config,
         aliases: { p: "password" },
       }),
       withJsonErrorHandling,
diff --git a/apps/cli/src/legacy/commands/network-bans/get/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/network-bans/get/SIDE_EFFECTS.md
index f9042c22a7..edfa550b89 100644
--- a/apps/cli/src/legacy/commands/network-bans/get/SIDE_EFFECTS.md
+++ b/apps/cli/src/legacy/commands/network-bans/get/SIDE_EFFECTS.md
@@ -2,10 +2,10 @@
 
 ## Files Read
 
-| Path                                   | Format                    | When                                                          |
-| -------------------------------------- | ------------------------- | ------------------------------------------------------------- |
-| `~/.supabase/access-token`             | plain text (token string) | when `SUPABASE_ACCESS_TOKEN` unset and keyring unavailable    |
-| `<workdir>/supabase/.temp/project-ref` | plain text (project ref)  | when `--project-ref` flag and `PROJECT_ID` env are both unset |
+| Path                                   | Format                    | When                                                                   |
+| -------------------------------------- | ------------------------- | ---------------------------------------------------------------------- |
+| `~/.supabase/access-token`             | plain text (token string) | when `SUPABASE_ACCESS_TOKEN` unset and keyring unavailable             |
+| `<workdir>/supabase/.temp/project-ref` | plain text (project ref)  | when `--project-ref` flag and `SUPABASE_PROJECT_ID` env are both unset |
 
 ## Files Written
 
@@ -27,8 +27,8 @@ The Management API exposes this read operation as `POST .../network-bans/retriev
 | Variable                | Purpose                                                  | Required?                                                      |
 | ----------------------- | -------------------------------------------------------- | -------------------------------------------------------------- |
 | `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup)     | no (falls back to keyring → `~/.supabase/access-token`)        |
-| `SUPABASE_API_URL`      | override Management API base URL                         | no (defaults to `https://api.supabase.com`)                    |
-| `PROJECT_ID`            | project ref fallback when `--project-ref` is unset       | no (falls back to `supabase/.temp/project-ref` → prompt)       |
+| `SUPABASE_PROFILE`      | built-in profile name or YAML file path                  | no (falls back to `~/.supabase/profile` -> `supabase`)         |
+| `SUPABASE_PROJECT_ID`   | project ref fallback when `--project-ref` is unset       | no (falls back to `supabase/.temp/project-ref` → prompt)       |
 | `SUPABASE_EXPERIMENTAL` | enables `--experimental`-gated commands without the flag | no (pass `--experimental` instead; one of the two is required) |
 
 ## Exit Codes
diff --git a/apps/cli/src/legacy/commands/network-bans/remove/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/network-bans/remove/SIDE_EFFECTS.md
index 333bf103a1..937970c60d 100644
--- a/apps/cli/src/legacy/commands/network-bans/remove/SIDE_EFFECTS.md
+++ b/apps/cli/src/legacy/commands/network-bans/remove/SIDE_EFFECTS.md
@@ -2,10 +2,10 @@
 
 ## Files Read
 
-| Path                                   | Format                    | When                                                          |
-| -------------------------------------- | ------------------------- | ------------------------------------------------------------- |
-| `~/.supabase/access-token`             | plain text (token string) | when `SUPABASE_ACCESS_TOKEN` unset and keyring unavailable    |
-| `<workdir>/supabase/.temp/project-ref` | plain text (project ref)  | when `--project-ref` flag and `PROJECT_ID` env are both unset |
+| Path                                   | Format                    | When                                                                   |
+| -------------------------------------- | ------------------------- | ---------------------------------------------------------------------- |
+| `~/.supabase/access-token`             | plain text (token string) | when `SUPABASE_ACCESS_TOKEN` unset and keyring unavailable             |
+| `<workdir>/supabase/.temp/project-ref` | plain text (project ref)  | when `--project-ref` flag and `SUPABASE_PROJECT_ID` env are both unset |
 
 ## Files Written
 
@@ -27,8 +27,8 @@
 | Variable                | Purpose                                                  | Required?                                                      |
 | ----------------------- | -------------------------------------------------------- | -------------------------------------------------------------- |
 | `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup)     | no (falls back to keyring → `~/.supabase/access-token`)        |
-| `SUPABASE_API_URL`      | override Management API base URL                         | no (defaults to `https://api.supabase.com`)                    |
-| `PROJECT_ID`            | project ref fallback when `--project-ref` is unset       | no (falls back to `supabase/.temp/project-ref` → prompt)       |
+| `SUPABASE_PROFILE`      | built-in profile name or YAML file path                  | no (falls back to `~/.supabase/profile` -> `supabase`)         |
+| `SUPABASE_PROJECT_ID`   | project ref fallback when `--project-ref` is unset       | no (falls back to `supabase/.temp/project-ref` → prompt)       |
 | `SUPABASE_EXPERIMENTAL` | enables `--experimental`-gated commands without the flag | no (pass `--experimental` instead; one of the two is required) |
 
 ## Exit Codes
diff --git a/apps/cli/src/legacy/commands/network-restrictions/get/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/network-restrictions/get/SIDE_EFFECTS.md
index 7c746dbd01..f39c04d7c9 100644
--- a/apps/cli/src/legacy/commands/network-restrictions/get/SIDE_EFFECTS.md
+++ b/apps/cli/src/legacy/commands/network-restrictions/get/SIDE_EFFECTS.md
@@ -2,10 +2,10 @@
 
 ## Files Read
 
-| Path                                   | Format                    | When                                                          |
-| -------------------------------------- | ------------------------- | ------------------------------------------------------------- |
-| `~/.supabase/access-token`             | plain text (token string) | when `SUPABASE_ACCESS_TOKEN` unset and keyring unavailable    |
-| `<workdir>/supabase/.temp/project-ref` | plain text (project ref)  | when `--project-ref` flag and `PROJECT_ID` env are both unset |
+| Path                                   | Format                    | When                                                                   |
+| -------------------------------------- | ------------------------- | ---------------------------------------------------------------------- |
+| `~/.supabase/access-token`             | plain text (token string) | when `SUPABASE_ACCESS_TOKEN` unset and keyring unavailable             |
+| `<workdir>/supabase/.temp/project-ref` | plain text (project ref)  | when `--project-ref` flag and `SUPABASE_PROJECT_ID` env are both unset |
 
 ## Files Written
 
@@ -25,8 +25,8 @@
 | Variable                | Purpose                                              | Required?                                                |
 | ----------------------- | ---------------------------------------------------- | -------------------------------------------------------- |
 | `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `~/.supabase/access-token`)  |
-| `SUPABASE_API_URL`      | override Management API base URL                     | no (defaults to `https://api.supabase.com`)              |
-| `PROJECT_ID`            | project ref fallback when `--project-ref` is unset   | no (falls back to `supabase/.temp/project-ref` → prompt) |
+| `SUPABASE_PROFILE`      | built-in profile name or YAML file path              | no (falls back to `~/.supabase/profile` -> `supabase`)   |
+| `SUPABASE_PROJECT_ID`   | project ref fallback when `--project-ref` is unset   | no (falls back to `supabase/.temp/project-ref` → prompt) |
 
 ## Exit Codes
 
diff --git a/apps/cli/src/legacy/commands/network-restrictions/update/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/network-restrictions/update/SIDE_EFFECTS.md
index fb31633592..f30b5ed87e 100644
--- a/apps/cli/src/legacy/commands/network-restrictions/update/SIDE_EFFECTS.md
+++ b/apps/cli/src/legacy/commands/network-restrictions/update/SIDE_EFFECTS.md
@@ -2,10 +2,10 @@
 
 ## Files Read
 
-| Path                                   | Format                    | When                                                          |
-| -------------------------------------- | ------------------------- | ------------------------------------------------------------- |
-| `~/.supabase/access-token`             | plain text (token string) | when `SUPABASE_ACCESS_TOKEN` unset and keyring unavailable    |
-| `<workdir>/supabase/.temp/project-ref` | plain text (project ref)  | when `--project-ref` flag and `PROJECT_ID` env are both unset |
+| Path                                   | Format                    | When                                                                   |
+| -------------------------------------- | ------------------------- | ---------------------------------------------------------------------- |
+| `~/.supabase/access-token`             | plain text (token string) | when `SUPABASE_ACCESS_TOKEN` unset and keyring unavailable             |
+| `<workdir>/supabase/.temp/project-ref` | plain text (project ref)  | when `--project-ref` flag and `SUPABASE_PROJECT_ID` env are both unset |
 
 ## Files Written
 
@@ -31,8 +31,8 @@ when no `--db-allow-cidr` was supplied), matching Go's `&[]string{}` initializat
 | Variable                | Purpose                                              | Required?                                                |
 | ----------------------- | ---------------------------------------------------- | -------------------------------------------------------- |
 | `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `~/.supabase/access-token`)  |
-| `SUPABASE_API_URL`      | override Management API base URL                     | no (defaults to `https://api.supabase.com`)              |
-| `PROJECT_ID`            | project ref fallback when `--project-ref` is unset   | no (falls back to `supabase/.temp/project-ref` → prompt) |
+| `SUPABASE_PROFILE`      | built-in profile name or YAML file path              | no (falls back to `~/.supabase/profile` -> `supabase`)   |
+| `SUPABASE_PROJECT_ID`   | project ref fallback when `--project-ref` is unset   | no (falls back to `supabase/.temp/project-ref` → prompt) |
 
 ## Exit Codes
 
diff --git a/apps/cli/src/legacy/commands/postgres-config/delete/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/postgres-config/delete/SIDE_EFFECTS.md
index 69bd23294e..97168c0975 100644
--- a/apps/cli/src/legacy/commands/postgres-config/delete/SIDE_EFFECTS.md
+++ b/apps/cli/src/legacy/commands/postgres-config/delete/SIDE_EFFECTS.md
@@ -2,10 +2,10 @@
 
 ## Files Read
 
-| Path                                   | Format                    | When                                                          |
-| -------------------------------------- | ------------------------- | ------------------------------------------------------------- |
-| `~/.supabase/access-token`             | plain text (token string) | when `SUPABASE_ACCESS_TOKEN` unset and keyring unavailable    |
-| `<workdir>/supabase/.temp/project-ref` | plain text (project ref)  | when `--project-ref` flag and `PROJECT_ID` env are both unset |
+| Path                                   | Format                    | When                                                                   |
+| -------------------------------------- | ------------------------- | ---------------------------------------------------------------------- |
+| `~/.supabase/access-token`             | plain text (token string) | when `SUPABASE_ACCESS_TOKEN` unset and keyring unavailable             |
+| `<workdir>/supabase/.temp/project-ref` | plain text (project ref)  | when `--project-ref` flag and `SUPABASE_PROJECT_ID` env are both unset |
 
 ## Files Written
 
@@ -28,8 +28,8 @@ This command does not call a delete endpoint. It mirrors Go: fetch current confi
 | Variable                | Purpose                                                  | Required?                                                      |
 | ----------------------- | -------------------------------------------------------- | -------------------------------------------------------------- |
 | `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup)     | no (falls back to keyring -> `~/.supabase/access-token`)       |
-| `SUPABASE_API_URL`      | override Management API base URL                         | no (defaults to `https://api.supabase.com`)                    |
-| `PROJECT_ID`            | project ref fallback when `--project-ref` is unset       | no (falls back to `supabase/.temp/project-ref` -> prompt)      |
+| `SUPABASE_PROFILE`      | built-in profile name or YAML file path                  | no (falls back to `~/.supabase/profile` -> `supabase`)         |
+| `SUPABASE_PROJECT_ID`   | project ref fallback when `--project-ref` is unset       | no (falls back to `supabase/.temp/project-ref` -> prompt)      |
 | `SUPABASE_EXPERIMENTAL` | enables `--experimental`-gated commands without the flag | no (pass `--experimental` instead; one of the two is required) |
 
 ## Exit Codes
diff --git a/apps/cli/src/legacy/commands/postgres-config/get/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/postgres-config/get/SIDE_EFFECTS.md
index 6582161bd1..d969c35982 100644
--- a/apps/cli/src/legacy/commands/postgres-config/get/SIDE_EFFECTS.md
+++ b/apps/cli/src/legacy/commands/postgres-config/get/SIDE_EFFECTS.md
@@ -2,10 +2,10 @@
 
 ## Files Read
 
-| Path                                   | Format                    | When                                                          |
-| -------------------------------------- | ------------------------- | ------------------------------------------------------------- |
-| `~/.supabase/access-token`             | plain text (token string) | when `SUPABASE_ACCESS_TOKEN` unset and keyring unavailable    |
-| `<workdir>/supabase/.temp/project-ref` | plain text (project ref)  | when `--project-ref` flag and `PROJECT_ID` env are both unset |
+| Path                                   | Format                    | When                                                                   |
+| -------------------------------------- | ------------------------- | ---------------------------------------------------------------------- |
+| `~/.supabase/access-token`             | plain text (token string) | when `SUPABASE_ACCESS_TOKEN` unset and keyring unavailable             |
+| `<workdir>/supabase/.temp/project-ref` | plain text (project ref)  | when `--project-ref` flag and `SUPABASE_PROJECT_ID` env are both unset |
 
 ## Files Written
 
@@ -25,8 +25,8 @@
 | Variable                | Purpose                                                  | Required?                                                      |
 | ----------------------- | -------------------------------------------------------- | -------------------------------------------------------------- |
 | `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup)     | no (falls back to keyring -> `~/.supabase/access-token`)       |
-| `SUPABASE_API_URL`      | override Management API base URL                         | no (defaults to `https://api.supabase.com`)                    |
-| `PROJECT_ID`            | project ref fallback when `--project-ref` is unset       | no (falls back to `supabase/.temp/project-ref` -> prompt)      |
+| `SUPABASE_PROFILE`      | built-in profile name or YAML file path                  | no (falls back to `~/.supabase/profile` -> `supabase`)         |
+| `SUPABASE_PROJECT_ID`   | project ref fallback when `--project-ref` is unset       | no (falls back to `supabase/.temp/project-ref` -> prompt)      |
 | `SUPABASE_EXPERIMENTAL` | enables `--experimental`-gated commands without the flag | no (pass `--experimental` instead; one of the two is required) |
 
 ## Exit Codes
diff --git a/apps/cli/src/legacy/commands/postgres-config/update/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/postgres-config/update/SIDE_EFFECTS.md
index edd0de4c4a..8cfba86318 100644
--- a/apps/cli/src/legacy/commands/postgres-config/update/SIDE_EFFECTS.md
+++ b/apps/cli/src/legacy/commands/postgres-config/update/SIDE_EFFECTS.md
@@ -2,10 +2,10 @@
 
 ## Files Read
 
-| Path                                   | Format                    | When                                                          |
-| -------------------------------------- | ------------------------- | ------------------------------------------------------------- |
-| `~/.supabase/access-token`             | plain text (token string) | when `SUPABASE_ACCESS_TOKEN` unset and keyring unavailable    |
-| `<workdir>/supabase/.temp/project-ref` | plain text (project ref)  | when `--project-ref` flag and `PROJECT_ID` env are both unset |
+| Path                                   | Format                    | When                                                                   |
+| -------------------------------------- | ------------------------- | ---------------------------------------------------------------------- |
+| `~/.supabase/access-token`             | plain text (token string) | when `SUPABASE_ACCESS_TOKEN` unset and keyring unavailable             |
+| `<workdir>/supabase/.temp/project-ref` | plain text (project ref)  | when `--project-ref` flag and `SUPABASE_PROJECT_ID` env are both unset |
 
 ## Files Written
 
@@ -28,8 +28,8 @@ The initial `GET` is skipped when `--replace-existing-overrides` is set. Otherwi
 | Variable                | Purpose                                                  | Required?                                                      |
 | ----------------------- | -------------------------------------------------------- | -------------------------------------------------------------- |
 | `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup)     | no (falls back to keyring -> `~/.supabase/access-token`)       |
-| `SUPABASE_API_URL`      | override Management API base URL                         | no (defaults to `https://api.supabase.com`)                    |
-| `PROJECT_ID`            | project ref fallback when `--project-ref` is unset       | no (falls back to `supabase/.temp/project-ref` -> prompt)      |
+| `SUPABASE_PROFILE`      | built-in profile name or YAML file path                  | no (falls back to `~/.supabase/profile` -> `supabase`)         |
+| `SUPABASE_PROJECT_ID`   | project ref fallback when `--project-ref` is unset       | no (falls back to `supabase/.temp/project-ref` -> prompt)      |
 | `SUPABASE_EXPERIMENTAL` | enables `--experimental`-gated commands without the flag | no (pass `--experimental` instead; one of the two is required) |
 
 ## Exit Codes
diff --git a/apps/cli/src/legacy/commands/projects/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/projects/SIDE_EFFECTS.md
index 23e0b9711e..fa2e82029d 100644
--- a/apps/cli/src/legacy/commands/projects/SIDE_EFFECTS.md
+++ b/apps/cli/src/legacy/commands/projects/SIDE_EFFECTS.md
@@ -41,7 +41,7 @@ subcommand's own `SIDE_EFFECTS.md`.
 | ----------------------- | ---------------------------------------------------- | ------------------------------------------------------------- |
 | `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `~/.supabase/access-token`)       |
 | `SUPABASE_PROJECT_REF`  | linked project ref (via the config layer)            | no (used by `list` marker / `api-keys` ref / `delete` unlink) |
-| `SUPABASE_API_URL`      | override Management API base URL                     | no (defaults to `https://api.supabase.com`)                   |
+| `SUPABASE_PROFILE`      | built-in profile name or YAML file path              | no (falls back to `~/.supabase/profile` -> `supabase`)        |
 
 > `DB_PASSWORD` is **not** consumed. In Go it only mirrors `--db-password` via a
 > viper binding for downstream local-stack use; `projects create` never reads it.
diff --git a/apps/cli/src/legacy/commands/projects/api-keys/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/projects/api-keys/SIDE_EFFECTS.md
index 79a7642c2c..b0207e720a 100644
--- a/apps/cli/src/legacy/commands/projects/api-keys/SIDE_EFFECTS.md
+++ b/apps/cli/src/legacy/commands/projects/api-keys/SIDE_EFFECTS.md
@@ -28,7 +28,7 @@ Management API to return the full secret keys (`sb_secret_...`) in `api_key` ins
 | Variable                | Purpose                                              | Required?                                               |
 | ----------------------- | ---------------------------------------------------- | ------------------------------------------------------- |
 | `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `~/.supabase/access-token`) |
-| `SUPABASE_API_URL`      | override Management API base URL                     | no (defaults to `https://api.supabase.com`)             |
+| `SUPABASE_PROFILE`      | built-in profile name or YAML file path              | no (falls back to `~/.supabase/profile` -> `supabase`)  |
 
 ## Flags
 
diff --git a/apps/cli/src/legacy/commands/projects/create/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/projects/create/SIDE_EFFECTS.md
index 0726aaa348..1a9d18c419 100644
--- a/apps/cli/src/legacy/commands/projects/create/SIDE_EFFECTS.md
+++ b/apps/cli/src/legacy/commands/projects/create/SIDE_EFFECTS.md
@@ -24,7 +24,7 @@
 | Variable                | Purpose                                                                                                               | Required?                                               |
 | ----------------------- | --------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------- |
 | `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup)                                                                  | no (falls back to keyring → `~/.supabase/access-token`) |
-| `SUPABASE_API_URL`      | override Management API base URL                                                                                      | no (defaults to `https://api.supabase.com`)             |
+| `SUPABASE_PROFILE`      | built-in profile name or YAML file path                                                                               | no (falls back to `~/.supabase/profile` -> `supabase`)  |
 | `DB_PASSWORD`           | **not consumed** — Go only mirrors `--db-password` into viper for local-stack reuse; `projects create` never reads it | n/a                                                     |
 
 ## Exit Codes
@@ -40,22 +40,22 @@
 
 ## Telemetry Events Fired
 
-| Event                  | When                                       | Notable properties / groups                                                                |
-| ---------------------- | ------------------------------------------ | ------------------------------------------------------------------------------------------ |
-| `cli_command_executed` | post-run, success or failure (via wrapper) | `exit_code`, `duration_ms`, `flags` (`--org-id`, `--high-availability` are telemetry-safe) |
+| Event                  | When                                       | Notable properties / groups                                                     |
+| ---------------------- | ------------------------------------------ | ------------------------------------------------------------------------------- |
+| `cli_command_executed` | post-run, success or failure (via wrapper) | `exit_code`, `duration_ms`, `flags` (`--org-id` is telemetry-safe, matching Go) |
 
 ## Flags
 
-| Flag                  | Type   | Required (non-interactive) | Description                                     |
-| --------------------- | ------ | -------------------------- | ----------------------------------------------- |
-| `[project name]`      | arg    | yes (non-interactive)      | Name of the project (positional argument)       |
-| `--org-id`            | string | yes (non-interactive)      | Organization ID (slug) to create the project in |
-| `--db-password`       | string | yes (non-interactive)      | Database password for the project               |
-| `--region`            | enum   | yes (non-interactive)      | AWS region for the project                      |
-| `--size`              | enum   | no                         | Desired instance size                           |
-| `--high-availability` | bool   | no                         | Enable high availability for the project        |
-| `--interactive`       | bool   | no (default: true)         | Enable interactive mode (hidden flag)           |
-| `--plan`              | string | no                         | Plan selection (hidden flag)                    |
+| Flag                  | Type   | Required (non-interactive) | Description                                                                  |
+| --------------------- | ------ | -------------------------- | ---------------------------------------------------------------------------- |
+| `[project name]`      | arg    | yes (non-interactive)      | Name of the project (positional argument)                                    |
+| `--org-id`            | string | yes (non-interactive)      | Organization ID (slug) to create the project in                              |
+| `--db-password`       | string | yes (non-interactive)      | Database password for the project                                            |
+| `--region`            | enum   | yes (non-interactive)      | AWS region for the project                                                   |
+| `--size`              | enum   | no                         | Desired instance size                                                        |
+| `--high-availability` | bool   | no                         | Enable high availability for the project (**TS-only, no Go CLI equivalent**) |
+| `--interactive`       | bool   | no (default: true)         | Enable interactive mode (hidden flag)                                        |
+| `--plan`              | string | no                         | Plan selection (hidden flag)                                                 |
 
 ## Output
 
@@ -93,4 +93,8 @@ One `result` event on success.
   flags and the positional project name argument are required.
 - The `--size` flag, when provided, sets the `desired_instance_size` field in the request body.
 - The `--high-availability` flag, when provided, sets the `high_availability` field in the request body.
+  This is a TS-only flag with no Go CLI equivalent: `apps/cli-go/cmd/projects.go`'s `init()` (~line 133)
+  never registers a `high-availability` flag, and the create command's `RunE` closure (~line 74) never sets
+  `HighAvailability` on the request body, even though the underlying API field exists — matching how
+  `--reveal` is disclosed on `projects api-keys`.
 - The `--plan` flag is hidden and reserved.
diff --git a/apps/cli/src/legacy/commands/projects/create/create.command.ts b/apps/cli/src/legacy/commands/projects/create/create.command.ts
index 2486931973..29e63c37ad 100644
--- a/apps/cli/src/legacy/commands/projects/create/create.command.ts
+++ b/apps/cli/src/legacy/commands/projects/create/create.command.ts
@@ -27,25 +27,24 @@ const AWS_REGIONS = [
 ] as const;
 
 const INSTANCE_SIZES = [
-  "nano",
-  "micro",
-  "small",
-  "medium",
   "large",
-  "xlarge",
-  "2xlarge",
-  "4xlarge",
-  "8xlarge",
+  "medium",
+  "micro",
   "12xlarge",
   "16xlarge",
   "24xlarge",
   "24xlarge_high_memory",
   "24xlarge_optimized_cpu",
   "24xlarge_optimized_memory",
+  "2xlarge",
   "48xlarge",
   "48xlarge_high_memory",
   "48xlarge_optimized_cpu",
   "48xlarge_optimized_memory",
+  "4xlarge",
+  "8xlarge",
+  "small",
+  "xlarge",
 ] as const;
 
 const config = {
@@ -69,6 +68,10 @@ const config = {
     Flag.withDescription("Select a desired instance size for your project."),
     Flag.optional,
   ),
+  // TS-only, no Go CLI equivalent: `cmd/projects.go`'s `init()` never registers a
+  // `high-availability` flag, and the `RunE` closure's `api.V1CreateProjectBody{...}`
+  // never sets `HighAvailability` even though the API field exists — disclosed in
+  // SIDE_EFFECTS.md, matching how `--reveal` is disclosed on `projects api-keys`.
   highAvailability: Flag.boolean("high-availability").pipe(
     Flag.withDescription("Enable high availability for the project."),
     Flag.optional,
@@ -99,7 +102,13 @@ export const legacyProjectsCreateCommand = Command.make("create", config).pipe(
   ]),
   Command.withHandler((flags) =>
     legacyProjectsCreate(flags).pipe(
-      withLegacyCommandInstrumentation({ flags, safeFlags: ["org-id", "high-availability"] }),
+      // `high-availability` is intentionally not in `safeFlags`: Go marks only
+      // `org-id` telemetry-safe (`markFlagTelemetrySafe`), and it's a boolean flag
+      // anyway — boolean values are always logged verbatim by the instrumentation
+      // regardless of `safeFlags`. See the same pattern on `projects api-keys`'s
+      // `--reveal`. `config` is passed so `region`/`size` (both `Flag.choice`)
+      // are auto-detected as telemetry-safe, matching Go's `isEnumFlag`.
+      withLegacyCommandInstrumentation({ flags, safeFlags: ["org-id"], config }),
       withJsonErrorHandling,
     ),
   ),
diff --git a/apps/cli/src/legacy/commands/projects/create/create.integration.test.ts b/apps/cli/src/legacy/commands/projects/create/create.integration.test.ts
index f21138df6c..d38c35c021 100644
--- a/apps/cli/src/legacy/commands/projects/create/create.integration.test.ts
+++ b/apps/cli/src/legacy/commands/projects/create/create.integration.test.ts
@@ -1,8 +1,10 @@
 import type { OrganizationResponseV1, V1CreateAProjectOutput } from "@supabase/api/effect";
 import { describe, expect, it } from "@effect/vitest";
-import { Effect, Exit, Option } from "effect";
+import { Cause, Effect, Exit, Option } from "effect";
+import { Command } from "effect/unstable/cli";
 
 import { mockOutput, mockTty } from "../../../../../tests/helpers/mocks.ts";
+import { LEGACY_GLOBAL_FLAGS } from "../../../../shared/legacy/global-flags.ts";
 import {
   type LegacyApiResponse,
   type LegacyHttpMethod,
@@ -13,7 +15,7 @@ import {
   mockLegacyTelemetryStateTracked,
   useLegacyTempWorkdir,
 } from "../../../../../tests/helpers/legacy-mocks.ts";
-import type { LegacyProjectsCreateFlags } from "./create.command.ts";
+import { legacyProjectsCreateCommand, type LegacyProjectsCreateFlags } from "./create.command.ts";
 import { legacyProjectsCreate } from "./create.handler.ts";
 
 const CREATED: typeof V1CreateAProjectOutput.Type = {
@@ -451,4 +453,54 @@ describe("legacy projects create integration", () => {
       expect(cache.cached).toBe(false);
     }).pipe(Effect.provide(layer));
   });
+
+  // Go parity (`apps/cli-go/cmd/projects.go:34-55`): Go's --size EnumFlag is an
+  // 18-value list that does not include "nano" (or "pico") and rejects any other
+  // value at flag-parse time. TS previously listed "nano" as a valid choice,
+  // silently succeeding where Go errors.
+  it.live("rejects --size nano at flag-parse time, matching Go's 18-value enum", () => {
+    const root = Command.make("supabase").pipe(
+      Command.withGlobalFlags(LEGACY_GLOBAL_FLAGS),
+      Command.withSubcommands([legacyProjectsCreateCommand]),
+    );
+
+    return Effect.gen(function* () {
+      const exit = yield* Effect.exit(
+        Command.runWith(root, { version: "0.0.0-test" })([
+          "create",
+          "alpha",
+          "--org-id",
+          "acme",
+          "--db-password",
+          "s3cret-pass",
+          "--region",
+          "us-east-1",
+          "--size",
+          "nano",
+        ]),
+      );
+      expect(Exit.isFailure(exit)).toBe(true);
+      if (Exit.isFailure(exit)) {
+        expect(rejectsInvalidSizeChoice(Cause.squash(exit.cause))).toBe(true);
+      }
+    }) as Effect.Effect<void>;
+  });
 });
+
+// Distinguishes "the --size flag itself was rejected at parse time" from any
+// other failure (e.g. a missing runtime service in this minimal test setup),
+// so the regression test above can't pass for the wrong reason.
+function rejectsInvalidSizeChoice(error: unknown): boolean {
+  if (typeof error !== "object" || error === null || !("errors" in error)) return false;
+  const { errors } = error;
+  if (!Array.isArray(errors)) return false;
+  return errors.some(
+    (candidate: unknown) =>
+      typeof candidate === "object" &&
+      candidate !== null &&
+      "_tag" in candidate &&
+      candidate._tag === "InvalidValue" &&
+      "option" in candidate &&
+      candidate.option === "size",
+  );
+}
diff --git a/apps/cli/src/legacy/commands/projects/delete/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/projects/delete/SIDE_EFFECTS.md
index f4e46eab50..3d94401b92 100644
--- a/apps/cli/src/legacy/commands/projects/delete/SIDE_EFFECTS.md
+++ b/apps/cli/src/legacy/commands/projects/delete/SIDE_EFFECTS.md
@@ -30,7 +30,7 @@
 | Variable                | Purpose                                              | Required?                                               |
 | ----------------------- | ---------------------------------------------------- | ------------------------------------------------------- |
 | `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `~/.supabase/access-token`) |
-| `SUPABASE_API_URL`      | override Management API base URL                     | no (defaults to `https://api.supabase.com`)             |
+| `SUPABASE_PROFILE`      | built-in profile name or YAML file path              | no (falls back to `~/.supabase/profile` -> `supabase`)  |
 
 ## Exit Codes
 
diff --git a/apps/cli/src/legacy/commands/projects/list/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/projects/list/SIDE_EFFECTS.md
index f4785c0f14..8ddce1209a 100644
--- a/apps/cli/src/legacy/commands/projects/list/SIDE_EFFECTS.md
+++ b/apps/cli/src/legacy/commands/projects/list/SIDE_EFFECTS.md
@@ -24,7 +24,7 @@
 | Variable                | Purpose                                              | Required?                                               |
 | ----------------------- | ---------------------------------------------------- | ------------------------------------------------------- |
 | `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `~/.supabase/access-token`) |
-| `SUPABASE_API_URL`      | override Management API base URL                     | no (defaults to `https://api.supabase.com`)             |
+| `SUPABASE_PROFILE`      | built-in profile name or YAML file path              | no (falls back to `~/.supabase/profile` -> `supabase`)  |
 
 ## Exit Codes
 
diff --git a/apps/cli/src/legacy/commands/secrets/list/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/secrets/list/SIDE_EFFECTS.md
index a7a248607e..9a1ce5d299 100644
--- a/apps/cli/src/legacy/commands/secrets/list/SIDE_EFFECTS.md
+++ b/apps/cli/src/legacy/commands/secrets/list/SIDE_EFFECTS.md
@@ -32,7 +32,6 @@
 | `SUPABASE_PROFILE`      | selects API base URL: `supabase` → `api.supabase.com`, `supabase-staging` → `api.supabase.green`, `supabase-local` → `http://localhost:8080`. May alternatively be a filesystem path to a YAML profile with at least `api_url:` and optional `name:` (Go parity — used by the cli-e2e test harness). | no (defaults to `supabase`)                                                |
 | `SUPABASE_PROJECT_ID`   | project ref fallback when `--project-ref` is unset                                                                                                                                                                                                                                                   | no (also reads `<workdir>/supabase/.temp/project-ref` then prompts on TTY) |
 | `SUPABASE_WORKDIR`      | base directory for the `.temp/project-ref` lookup                                                                                                                                                                                                                                                    | no (walks up from CWD looking for `supabase/config.toml`)                  |
-| ~~`SUPABASE_API_URL`~~  | **not honored** — Go parity. Use `SUPABASE_PROFILE` to override the API base URL.                                                                                                                                                                                                                    | —                                                                          |
 
 ## Exit Codes
 
diff --git a/apps/cli/src/legacy/commands/secrets/secrets.errors.ts b/apps/cli/src/legacy/commands/secrets/secrets.errors.ts
index 7094cf2336..385c0911fe 100644
--- a/apps/cli/src/legacy/commands/secrets/secrets.errors.ts
+++ b/apps/cli/src/legacy/commands/secrets/secrets.errors.ts
@@ -82,9 +82,3 @@ export class LegacySecretsUnsetCancelledError extends Data.TaggedError(
 )<{
   readonly message: string;
 }> {}
-
-export class LegacySecretsConfigParseError extends Data.TaggedError(
-  "LegacySecretsConfigParseError",
-)<{
-  readonly message: string;
-}> {}
diff --git a/apps/cli/src/legacy/commands/secrets/set/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/secrets/set/SIDE_EFFECTS.md
index c99884485e..fa3c8eec26 100644
--- a/apps/cli/src/legacy/commands/secrets/set/SIDE_EFFECTS.md
+++ b/apps/cli/src/legacy/commands/secrets/set/SIDE_EFFECTS.md
@@ -2,17 +2,17 @@
 
 ## Files Read
 
-| Path                                      | Format                    | When                                                                                          |
-| ----------------------------------------- | ------------------------- | --------------------------------------------------------------------------------------------- |
-| `/proc/sys/kernel/osrelease` (Linux)      | plain text                | once on layer init — disables keyring on WSL (`WSL` / `Microsoft` substring match)            |
-| keyring `"Supabase CLI"` / `<profile>`    | OS keychain               | when `SUPABASE_ACCESS_TOKEN` unset and keyring available; account = `LegacyCliConfig.profile` |
-| keyring `"Supabase CLI"` / `access-token` | OS keychain               | legacy-key fallback when the profile-keyed lookup misses                                      |
-| `~/.supabase/access-token`                | plain text (token string) | last-resort fallback after env + keyring miss                                                 |
-| `<workdir>/supabase/.temp/project-ref`    | plain text                | when `--project-ref` and `SUPABASE_PROJECT_ID` are both unset                                 |
-| `<workdir>/supabase/config.toml`          | TOML                      | always (for `[edge_runtime.secrets]`) — via `@supabase/config`'s `loadProjectConfig`          |
-| `<workdir>/.env`                          | dotenv                    | always — context for `env(VAR)` interpolation in `[edge_runtime.secrets]` values              |
-| `<workdir>/.env.local`                    | dotenv                    | always — overrides `.env` for `env(VAR)` interpolation context                                |
-| `<env-file>` (absolute or CWD-relative)   | dotenv                    | when `--env-file` flag is provided                                                            |
+| Path                                      | Format                    | When                                                                                                                                                                     |
+| ----------------------------------------- | ------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
+| `/proc/sys/kernel/osrelease` (Linux)      | plain text                | once on layer init — disables keyring on WSL (`WSL` / `Microsoft` substring match)                                                                                       |
+| keyring `"Supabase CLI"` / `<profile>`    | OS keychain               | when `SUPABASE_ACCESS_TOKEN` unset and keyring available; account = `LegacyCliConfig.profile`                                                                            |
+| keyring `"Supabase CLI"` / `access-token` | OS keychain               | legacy-key fallback when the profile-keyed lookup misses                                                                                                                 |
+| `~/.supabase/access-token`                | plain text (token string) | last-resort fallback after env + keyring miss                                                                                                                            |
+| `<workdir>/supabase/.temp/project-ref`    | plain text                | when `--project-ref` and `SUPABASE_PROJECT_ID` are both unset                                                                                                            |
+| `<workdir>/supabase/config.toml`          | TOML                      | always (for `[edge_runtime.secrets]`) — via `@supabase/config`'s `loadProjectConfig`; a parse failure is logged to the debug logger and tolerated (Go parity), not fatal |
+| `<workdir>/.env`                          | dotenv                    | always — context for `env(VAR)` interpolation in `[edge_runtime.secrets]` values                                                                                         |
+| `<workdir>/.env.local`                    | dotenv                    | always — overrides `.env` for `env(VAR)` interpolation context                                                                                                           |
+| `<env-file>` (absolute or CWD-relative)   | dotenv                    | when `--env-file` flag is provided                                                                                                                                       |
 
 ## Files Written
 
@@ -37,7 +37,6 @@
 | `SUPABASE_PROJECT_ID`   | project ref fallback when `--project-ref` is unset                                                                                                                                                                                                                                                   | no (also reads `<workdir>/supabase/.temp/project-ref` then prompts on TTY) |
 | `SUPABASE_WORKDIR`      | base directory for the `.temp/project-ref` lookup                                                                                                                                                                                                                                                    | no (walks up from CWD looking for `supabase/config.toml`)                  |
 | `env(VAR)` references   | values matching `env(NAME)` in `[edge_runtime.secrets]` are resolved against the loaded env. Missing variables preserve the literal verbatim (Go parity).                                                                                                                                            | —                                                                          |
-| ~~`SUPABASE_API_URL`~~  | **not honored** — Go parity. Use `SUPABASE_PROFILE` to override the API base URL.                                                                                                                                                                                                                    | —                                                                          |
 
 ## Exit Codes
 
@@ -52,7 +51,6 @@
 | `1`  | `LegacyInvalidSecretPairError` — positional argument missing `=`                             |
 | `1`  | `LegacySecretsEnvFileOpenError` — `--env-file` cannot be opened                              |
 | `1`  | `LegacySecretsEnvFileParseError` — `--env-file` cannot be parsed                             |
-| `1`  | `LegacySecretsConfigParseError` — `supabase/config.toml` cannot be parsed                    |
 | `1`  | `LegacySecretsSetUnexpectedStatusError` — non-2xx response from POST                         |
 | `1`  | `LegacySecretsSetNetworkError` — transport-level network failure                             |
 
@@ -85,4 +83,5 @@ One `result` NDJSON event on success containing `{project_ref, count}`.
 - Source order for merging entries: `[edge_runtime.secrets]` from `config.toml` (only resolved entries — see below) → `--env-file` (overrides config) → CLI args (overrides env-file).
 - `SUPABASE_`-prefixed entries are skipped post-merge with a stderr warning.
 - `[edge_runtime.secrets]` from config.toml is read via `@supabase/config`'s `loadProjectConfig` + `resolveProjectSubtree`. Resolved secret values arrive wrapped in `Redacted<string>`; unresolved `env(VAR)` literals (env var unset) stay as plain strings and are filtered out at the handler — matches Go's `set.go:48-52` which filters by `len(secret.SHA256) > 0` (the SHA256 is empty when `DecryptSecretHookFunc` sees a still-literal `env(VAR)`).
+- A malformed `config.toml` does **not** abort the command — matches Go's `set.go:20-24`, which logs the `LoadConfig` error to the debug logger and proceeds. `--env-file` and positional `NAME=VALUE` secrets always still apply. What happens to config-declared secrets depends on the failure class, matching Go's `viper`+`mapstructure` decode (`pkg/config/config.go:749`), which mutates the target struct field-by-field: a raw TOML/JSON syntax error drops everything (no `EdgeRuntime.Secrets`), but a schema-type error on an _unrelated_ field (e.g. `analytics.port` being a string) still leaves a valid `[edge_runtime.secrets]` section usable — the handler recovers it by re-decoding just that subtree. Pass `--debug` to see the logged parse error.
 - Sends `User-Agent: SupabaseCLI/<version>` and Bearer auth. No `X-Supabase-Command` headers — Go parity.
diff --git a/apps/cli/src/legacy/commands/secrets/set/set.handler.ts b/apps/cli/src/legacy/commands/secrets/set/set.handler.ts
index 422f503070..fed1646688 100644
--- a/apps/cli/src/legacy/commands/secrets/set/set.handler.ts
+++ b/apps/cli/src/legacy/commands/secrets/set/set.handler.ts
@@ -1,9 +1,18 @@
-import { loadProjectConfig, loadProjectEnvironment, resolveProjectSubtree } from "@supabase/config";
+import {
+  loadProjectConfig,
+  loadProjectEnvironment,
+  ProjectConfigSchema,
+  resolveProjectSubtree,
+  type ProjectConfig,
+  type ProjectConfigParseError,
+} from "@supabase/config";
+import { V1BulkCreateSecretsInput } from "@supabase/api/effect";
 import { parse as parseDotenv } from "dotenv";
-import { Effect, FileSystem, Option, Path, Redacted } from "effect";
+import { Effect, FileSystem, Option, Path, Redacted, Schema } from "effect";
 
 import { LegacyPlatformApi } from "../../../auth/legacy-platform-api.service.ts";
 import { LegacyProjectRefResolver } from "../../../config/legacy-project-ref.service.ts";
+import { LegacyDebugLogger } from "../../../shared/legacy-debug-logger.service.ts";
 import { LegacyLinkedProjectCache } from "../../../telemetry/legacy-linked-project-cache.service.ts";
 import { LegacyTelemetryState } from "../../../telemetry/legacy-telemetry-state.service.ts";
 import { Output } from "../../../../shared/output/output.service.ts";
@@ -11,7 +20,6 @@ import { RuntimeInfo } from "../../../../shared/runtime/runtime-info.service.ts"
 import { mapLegacyHttpError } from "../../../shared/legacy-http-errors.ts";
 import {
   LegacyInvalidSecretPairError,
-  LegacySecretsConfigParseError,
   LegacySecretsEnvFileOpenError,
   LegacySecretsEnvFileParseError,
   LegacySecretsNoArgumentsError,
@@ -27,12 +35,118 @@ const mapSetError = mapLegacyHttpError({
   statusMessage: (_status, body) => `Unexpected error setting project secrets: ${body}`,
 });
 
+const decodeProjectConfig = Schema.decodeUnknownSync(ProjectConfigSchema);
+
+// Excludes arrays, matching `packages/config/src/io.ts`'s `isObject` (the
+// identical "is this a table" check used when merging `[remotes.*]`). A TOML
+// array for a map-typed field (e.g. `[edge_runtime] secrets = ["actual-secret"]`)
+// is not a recoverable table: `Object.entries` on an array yields index keys
+// ("0", "1", ...), which would otherwise fabricate spurious secret names. Go's
+// mapstructure decoder never does this either — `UnmarshalExact`
+// (`apps/cli-go/pkg/config/config.go:749`) never sets `WeaklyTypedInput`, so a
+// slice source for a map-typed field hits `UnconvertibleTypeError` in
+// `decodeMap` rather than the index-as-key `decodeMapFromSlice` path, and the
+// whole field is left empty.
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
+/**
+ * Best-effort recovery for a schema-decode failure (as opposed to a raw
+ * TOML/JSON parse failure) on `supabase/config.toml`. Go's `viper`+
+ * `mapstructure` decode (`apps/cli-go/pkg/config/config.go:749`) mutates the
+ * target struct field-by-field: a type error anywhere — an unrelated
+ * top-level table (`analytics.port`), a sibling field inside the same
+ * `edge_runtime` table (`edge_runtime.inspector_port`), *or* a single bad
+ * entry inside the `edge_runtime.secrets` map itself (`BAD = 123`) — does not
+ * stop the rest of `edge_runtime.secrets` from landing in `utils.Config`.
+ * `UnmarshalExact` still populates every field (and every map entry) it *can*
+ * decode before aggregating errors: `mapstructure`'s map decoder
+ * (`decodeMapFromMap`) iterates each key independently, appends a per-entry
+ * error and `continue`s rather than aborting, then still calls `val.Set` with
+ * whatever entries succeeded. Confirmed empirically against this repo's
+ * actual `pkg/config`: a TOML with both a malformed `edge_runtime.inspector_port`
+ * and a valid `[edge_runtime.secrets]` block still yields a populated
+ * `EdgeRuntime.Secrets` (`InspectorPort` is left at its zero value), and a
+ * `[edge_runtime.secrets]` block with one bad entry alongside a good one
+ * still yields the good entry.
+ * `Schema.decodeUnknownSync` has no such tolerance; a single bad field
+ * anywhere discards the whole decode — re-decoding the *entire* `edge_runtime`
+ * subtree would still fail in the sibling-field case (`inspector_port` comes
+ * along for the ride), and re-decoding the whole `secrets` map atomically
+ * would still fail when just one entry in that map is bad. To keep
+ * `secrets set` at parity without loosening `packages/config`'s decode
+ * semantics for every caller: re-slice `edge_runtime.secrets` out of the
+ * pre-decode document (`cause.document` — only set when the document itself
+ * parsed fine and the *schema* decode is what failed, see
+ * `ProjectConfigParseError`), decode each entry independently and keep only
+ * the ones that succeed (mirroring `decodeMapFromMap`'s per-key tolerance),
+ * then decode the filtered map against the full schema, where every other
+ * field (including the rest of `edge_runtime`) defaults cleanly. A true parse
+ * failure (`cause.document` undefined) has no recoverable structure in either
+ * implementation — Go's own `viper.MergeConfig` also fails the whole load
+ * before `mapstructure` ever runs in that case.
+ */
+function recoverEdgeRuntimeConfig(cause: ProjectConfigParseError): ProjectConfig | null {
+  if (cause.document === undefined) {
+    return null;
+  }
+  const edgeRuntime = cause.document.edge_runtime;
+  const secretsField = isRecord(edgeRuntime) ? edgeRuntime.secrets : undefined;
+  // `redactEdgeRuntimeSecrets` (`packages/config/src/io.ts`) wraps a malformed,
+  // non-object `secrets` field (e.g. a TOML array) in a single `Redacted`
+  // rather than leaving it a plain record, so an uncaught error can't leak it
+  // either. Unwrap before the `isRecord` check below — otherwise the
+  // `Redacted` wrapper object itself (an object, just not a secrets map) gets
+  // misread as a one-entry map and fabricates a bogus secret from its
+  // internal fields.
+  const secrets = Redacted.isRedacted(secretsField) ? Redacted.value(secretsField) : secretsField;
+  const decodableSecrets = isRecord(secrets) ? filterDecodableSecrets(secrets) : undefined;
+  try {
+    return decodeProjectConfig({
+      edge_runtime: decodableSecrets !== undefined ? { secrets: decodableSecrets } : {},
+    });
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Mirrors mapstructure's per-entry map decode tolerance
+ * (`decodeMapFromMap`, invoked via `v.UnmarshalExact` in
+ * `apps/cli-go/pkg/config/config.go:749`): a decode error on one secret
+ * value doesn't discard the whole `[edge_runtime.secrets]` map — only that
+ * entry is dropped, and every other entry is still recovered.
+ *
+ * Each value arrives wrapped in `Redacted` (whatever its underlying type) —
+ * `ProjectConfigParseError.document` wraps every `edge_runtime.secrets` entry
+ * so an uncaught parse error can't leak a resolved secret, or a malformed
+ * non-string entry, into a log or trace (see the field doc on `.document`).
+ * Unwrap before re-decoding: `secret()`'s schema is a plain `Schema.String`,
+ * not `Redacted`, and a non-string entry (e.g. an array) still fails that
+ * decode and is dropped below, same as it would in Go.
+ */
+function filterDecodableSecrets(secrets: Record<string, unknown>): Record<string, unknown> {
+  const kept: Record<string, unknown> = {};
+  for (const [name, value] of Object.entries(secrets)) {
+    const plainValue = Redacted.isRedacted(value) ? Redacted.value(value) : value;
+    try {
+      decodeProjectConfig({ edge_runtime: { secrets: { [name]: plainValue } } });
+      kept[name] = plainValue;
+    } catch {
+      // Drop this entry only, matching mapstructure's per-key error handling.
+    }
+  }
+  return kept;
+}
+
 export const legacySecretsSet = Effect.fn("legacy.secrets.set")(function* (
   flags: LegacySecretsSetFlags,
 ) {
   const output = yield* Output;
   const api = yield* LegacyPlatformApi;
   const resolver = yield* LegacyProjectRefResolver;
+  const debugLogger = yield* LegacyDebugLogger;
   const linkedProjectCache = yield* LegacyLinkedProjectCache;
   const telemetryState = yield* LegacyTelemetryState;
   const runtimeInfo = yield* RuntimeInfo;
@@ -53,28 +167,147 @@ export const legacySecretsSet = Effect.fn("legacy.secrets.set")(function* (
     // literals stay as plain strings, so `Redacted.isRedacted(...)` is the
     // equivalent guard.
     const merged = new Map<string, string>();
-    const loaded = yield* loadProjectConfig(runtimeInfo.cwd).pipe(
-      Effect.catchTag("ProjectConfigParseError", (cause) =>
-        Effect.fail(
-          new LegacySecretsConfigParseError({
-            message: `failed to parse supabase/config.toml: ${String(cause.cause)}`,
-          }),
-        ),
+    // Go swallows a malformed config.toml (or a malformed `.env`/`.env.local`
+    // sibling — see the `ProjectEnvParseError` catch below) here
+    // (`internal/secrets/set/set.go:20-24`: `fmt.Fprintln(utils.GetDebugLogger(), err)`)
+    // and proceeds with an empty `EdgeRuntime.Secrets` — env-file and
+    // positional-arg secrets still work. `secrets set` has no
+    // `--linked`/`--local`/`--db-url` flag, so (unlike most commands) the root
+    // `PreRun` never loads the config first either; this is the only load, and
+    // it must not be fatal.
+    //
+    // Pass `ref` so a matching `[remotes.*]` block is merged over the base
+    // config before decode, mirroring Go's `flags.LoadConfig`
+    // (`internal/utils/flags/config_path.go:11-12`: `utils.Config.ProjectId =
+    // ProjectRef` before `Load()`) merging the override in `loadFromFile`
+    // (`pkg/config/config.go:604-609`) ahead of the tolerant decode below.
+    // Without this, a schema-decode error on `--project-ref <remote-ref>`
+    // would recover the *base* `[edge_runtime.secrets]` instead of the
+    // explicitly selected remote's override.
+    // `goViperCompat: true` opts into `applyRemoteOverride`'s duplicate-
+    // `project_id`/format checks (`packages/config/src/io.ts`) — required for
+    // the `DuplicateRemoteProjectIdError` catch below to ever fire.
+    const loadedConfig = yield* loadProjectConfig(runtimeInfo.cwd, {
+      projectRef: ref,
+      goViperCompat: true,
+    }).pipe(
+      Effect.flatMap((loaded) => {
+        if (loaded === null) {
+          return Effect.succeed(null);
+        }
+        // Go prints this from inside config load, before any command output
+        // (`pkg/config/config.go:605`) — unconditionally on a matching
+        // `[remotes.*]` block, ahead of the (possibly failing) decode. Other
+        // legacy handlers surface it the same way (e.g. `config push`); this
+        // path must not silently drop it just because it maps straight down
+        // to `.config` below.
+        return (
+          loaded.appliedRemote !== undefined
+            ? output.raw(`Loading config override: [remotes.${loaded.appliedRemote}]\n`, "stderr")
+            : Effect.void
+        ).pipe(Effect.as(loaded.config));
+      }),
+      Effect.catchTag("ProjectConfigParseError", (cause) => {
+        // `smol-toml`'s `TomlError` embeds a source codeblock after a
+        // blank-line separator — literal file content, which for this file's
+        // `[edge_runtime.secrets]` section can include real secret values.
+        // Truncating before the separator handles that case (`cause.document
+        // === undefined`, a raw parse failure with no decoded document to
+        // recover from — see the field doc on `ProjectConfigParseError`).
+        //
+        // A schema-decode error (`cause.document !== undefined`) has no such
+        // separator: Effect's `ParseError` puts the rejected value inline on
+        // one line (e.g. `Expected string, actual ["actual-secret"]`), which
+        // the truncation above wouldn't catch. Go's pinned mapstructure
+        // decode-error types (`UnconvertibleTypeError.Error()`,
+        // `DecodeError.Error()`, `github.com/go-viper/mapstructure/v2
+        // v2.5.0`) never include the rejected value, only type names — so a
+        // fixed, content-free message here matches Go's actual behaviour
+        // rather than just being defensive.
+        const shortMessage =
+          cause.document === undefined
+            ? String(cause.cause).split("\n\n")[0]
+            : "schema validation failed";
+        // Go prints the override notice unconditionally as soon as a
+        // `[remotes.*]` block's `project_id` matches, *before* `mapstructure`
+        // decode ever runs (`pkg/config/config.go:604-609`) — so the notice is
+        // still owed here even though decode subsequently failed and this
+        // whole load is non-fatal. `cause.appliedRemote` carries that match
+        // through the failed decode (see the field doc on
+        // `ProjectConfigParseError.appliedRemote`); the success path above
+        // handles the non-error case. Emitted ahead of the debug log below to
+        // match Go's actual order: the print happens inside `loadFromFile`,
+        // the debug log only after `flags.LoadConfig` returns the swallowed
+        // error to `Run` (`internal/secrets/set/set.go:20-24`).
+        return (
+          cause.appliedRemote !== undefined
+            ? output.raw(`Loading config override: [remotes.${cause.appliedRemote}]\n`, "stderr")
+            : Effect.void
+        ).pipe(
+          Effect.andThen(
+            debugLogger.debug(`failed to parse supabase/config.toml: ${shortMessage}`),
+          ),
+          Effect.as(recoverEdgeRuntimeConfig(cause)),
+        );
+      }),
+      // `loadProjectConfig` resolves `env(VAR)` references against
+      // `.env`/`.env.local` (`loadProjectEnvironment` inside
+      // `loadProjectConfigFile`) *before* schema decode, so a malformed dotenv
+      // line fails with this distinct tag rather than `ProjectConfigParseError`.
+      // Go's `Load()` (`pkg/config/config.go:788-791`) calls `loadNestedEnv`
+      // first too and returns immediately on error, before `loadFromFile` (the
+      // TOML parse) ever runs — so `EdgeRuntime.Secrets` never gets populated
+      // in this failure path, unlike the schema-decode-only case above. Recover
+      // to `null`, not `recoverEdgeRuntimeConfig`: there is no parsed document
+      // to recover a subtree from.
+      Effect.catchTag("ProjectEnvParseError", (cause) =>
+        debugLogger.debug(`failed to parse ${cause.path}:${cause.line}`).pipe(Effect.as(null)),
+      ),
+      // Two `[remotes.*]` blocks declare the same `project_id` as `ref` — Go's
+      // `flags.LoadConfig` swallows *any* `Load()` error non-fatally
+      // (`internal/secrets/set/set.go:22-24`), including this one, which
+      // `loadFromFile` raises before `mapstructure` ever runs
+      // (`pkg/config/config.go:601`). `cause.message` already matches Go's
+      // string verbatim (see `DuplicateRemoteProjectIdError`'s field doc).
+      Effect.catchTag("DuplicateRemoteProjectIdError", (cause) =>
+        debugLogger.debug(cause.message).pipe(Effect.as(null)),
+      ),
+      // A `[remotes.*]` block's `project_id` fails Go's ref-pattern check —
+      // raised from `Config.Validate` (`pkg/config/config.go:996-1001`), which
+      // runs inside the same `Config.Load()` call as the duplicate check above
+      // (`config.go:882`). Go's `flags.LoadConfig` swallows this the same
+      // non-fatal way (`internal/secrets/set/set.go:22-24`), so a malformed
+      // remote block must not abort an otherwise-valid `secrets set`.
+      // `cause.message` already matches Go's string verbatim (see
+      // `InvalidRemoteProjectIdError`'s field doc).
+      Effect.catchTag("InvalidRemoteProjectIdError", (cause) =>
+        debugLogger.debug(cause.message).pipe(Effect.as(null)),
       ),
     );
-    if (loaded !== null) {
+    if (loadedConfig !== null) {
       const projectEnv = yield* loadProjectEnvironment({
         cwd: runtimeInfo.cwd,
         baseEnv: process.env,
       });
       if (projectEnv !== null) {
         const resolved = yield* resolveProjectSubtree(
-          loaded.config.edge_runtime,
+          loadedConfig.edge_runtime,
           projectEnv,
           "edge_runtime",
+          { goViperCompat: true },
         );
         for (const [name, value] of Object.entries(resolved.secrets ?? {})) {
-          if (Redacted.isRedacted(value)) {
+          // Go's `DecryptSecretHookFunc` (`pkg/config/secret.go:98`) never
+          // hashes an empty value, and `ListSecrets` (`internal/secrets/set/set.go:48-52`)
+          // only includes config entries with a non-empty SHA256 — so an empty
+          // `[edge_runtime.secrets]` entry is silently skipped rather than sent
+          // as an empty-string overwrite of a remote secret. `Redacted.isRedacted`
+          // already excludes the other SHA256-empty case (a still-literal
+          // `env(VAR)` reference); check for a non-empty value too so both
+          // zero-hash cases match. This applies to config-sourced secrets only —
+          // an explicit `--env-file`/positional `NAME=` below is sent as-is,
+          // matching Go's unconditional `maps.Copy`/assignment for those sources.
+          if (Redacted.isRedacted(value) && Redacted.value(value).length > 0) {
             merged.set(name, Redacted.value(value));
           }
         }
@@ -143,8 +376,33 @@ export const legacySecretsSet = Effect.fn("legacy.secrets.set")(function* (
       );
     }
 
+    // The Management API caps a single bulk-create request at 100 secrets
+    // (`V1BulkCreateSecretsInput`'s `isMaxLength(100)` check in `@supabase/api`).
+    // Go issues one unbatched request (`internal/secrets/set/set.go`), so against
+    // the capped API a >100-entry env file would be rejected wholesale; split into
+    // batches of at most 100 so large env files still upload.
+    const SECRETS_PER_REQUEST = 100;
+    const batches: Array<typeof body> = [];
+    for (let i = 0; i < body.length; i += SECRETS_PER_REQUEST) {
+      batches.push(body.slice(i, i + SECRETS_PER_REQUEST));
+    }
+
+    // Validate every batch (per-entry name/value constraints and the 100-item
+    // cap) before sending any request. Without this, a schema-invalid entry in a
+    // later batch would only surface after earlier batches had already been
+    // uploaded, leaving the project partially updated. Decoding fails with the
+    // same `SchemaError` `bulkCreateSecrets` raises, so `mapSetError` keeps the
+    // error surface identical to the previous single-call path.
+    yield* Effect.forEach(
+      batches,
+      (batch) => Schema.decodeUnknownEffect(V1BulkCreateSecretsInput)({ ref, body: batch }),
+      { discard: true },
+    ).pipe(Effect.catch(mapSetError));
+
     const setting = output.format === "text" ? yield* output.task("Setting secrets...") : undefined;
-    yield* api.v1.bulkCreateSecrets({ ref, body }).pipe(
+    yield* Effect.forEach(batches, (batch) => api.v1.bulkCreateSecrets({ ref, body: batch }), {
+      discard: true,
+    }).pipe(
       Effect.tapError(() => setting?.fail() ?? Effect.void),
       Effect.catch(mapSetError),
     );
diff --git a/apps/cli/src/legacy/commands/secrets/set/set.integration.test.ts b/apps/cli/src/legacy/commands/secrets/set/set.integration.test.ts
index 524ee4f3f7..29bbaf3fd0 100644
--- a/apps/cli/src/legacy/commands/secrets/set/set.integration.test.ts
+++ b/apps/cli/src/legacy/commands/secrets/set/set.integration.test.ts
@@ -16,8 +16,23 @@ import {
   mockLegacyPlatformApi,
   useLegacyTempWorkdir,
 } from "../../../../../tests/helpers/legacy-mocks.ts";
+import { LegacyDebugLogger } from "../../../shared/legacy-debug-logger.service.ts";
 import { legacySecretsSet } from "./set.handler.ts";
 
+function mockLegacyDebugLoggerTracked() {
+  const messages: Array<string> = [];
+  return {
+    messages,
+    layer: Layer.succeed(LegacyDebugLogger, {
+      debug: (message) =>
+        Effect.sync(() => {
+          messages.push(message);
+        }),
+      http: () => Effect.void,
+    }),
+  };
+}
+
 // ---------------------------------------------------------------------------
 // Setup
 // ---------------------------------------------------------------------------
@@ -40,6 +55,7 @@ function setup(opts: SetupOpts = {}) {
     network: opts.network,
   });
   const cliConfig = mockLegacyCliConfig({ workdir: tempRoot.current });
+  const debugLogger = mockLegacyDebugLoggerTracked();
   const layer = Layer.mergeAll(
     buildLegacyTestRuntime({
       out,
@@ -49,8 +65,9 @@ function setup(opts: SetupOpts = {}) {
     }),
     mockRuntimeInfo({ cwd: tempRoot.current }),
     processEnvLayer(opts.env ?? {}),
+    debugLogger.layer,
   );
-  return { layer, out, api };
+  return { layer, out, api, debugLogger };
 }
 
 function writeConfig(content: string) {
@@ -58,6 +75,11 @@ function writeConfig(content: string) {
   writeFileSync(join(tempRoot.current, "supabase", "config.toml"), content);
 }
 
+function writeSupabaseDotEnv(content: string) {
+  mkdirSync(join(tempRoot.current, "supabase"), { recursive: true });
+  writeFileSync(join(tempRoot.current, "supabase", ".env"), content);
+}
+
 function parsePostBody(body: unknown): Array<{ name: string; value: string }> {
   // `mockLegacyPlatformApi` JSON-decodes the request body when it parses; this
   // helper just narrows the type for the test assertions.
@@ -101,6 +123,66 @@ describe("legacy secrets set integration", () => {
     }).pipe(Effect.provide(layer));
   });
 
+  it.live("batches large secret sets into requests of at most 100", () => {
+    const { layer, out, api } = setup();
+    return Effect.gen(function* () {
+      yield* legacySecretsSet({
+        projectRef: Option.none(),
+        envFile: Option.none(),
+        secrets: Array.from({ length: 150 }, (_, i) => `KEY${i}=value${i}`),
+      });
+      expect(api.requests).toHaveLength(2);
+      const first = parsePostBody(api.requests[0]!.body);
+      const second = parsePostBody(api.requests[1]!.body);
+      expect(first).toHaveLength(100);
+      expect(second).toHaveLength(50);
+      const names = new Set([...first, ...second].map((entry) => entry.name));
+      for (let i = 0; i < 150; i++) {
+        expect(names.has(`KEY${i}`)).toBe(true);
+      }
+      expect(out.stdoutText).toContain("Finished supabase secrets set.");
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("batches 250 secrets into three requests (100/100/50)", () => {
+    const { layer, api } = setup();
+    return Effect.gen(function* () {
+      yield* legacySecretsSet({
+        projectRef: Option.none(),
+        envFile: Option.none(),
+        secrets: Array.from({ length: 250 }, (_, i) => `KEY${i}=value${i}`),
+      });
+      expect(api.requests).toHaveLength(3);
+      expect(parsePostBody(api.requests[0]!.body)).toHaveLength(100);
+      expect(parsePostBody(api.requests[1]!.body)).toHaveLength(100);
+      expect(parsePostBody(api.requests[2]!.body)).toHaveLength(50);
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live(
+    "rejects the whole upload when a later batch has an invalid entry (no partial update)",
+    () => {
+      const { layer, api } = setup();
+      // Index 120 lands in the SECOND batch (batch 0 covers indices 0-99): a
+      // value exceeding the 24576-byte cap there must fail up-front validation
+      // before batch 0 (which is otherwise entirely valid) is ever sent.
+      const secrets = Array.from({ length: 150 }, (_, i) =>
+        i === 120 ? `KEY${i}=${"x".repeat(24577)}` : `KEY${i}=value${i}`,
+      );
+      return Effect.gen(function* () {
+        const exit = yield* Effect.exit(
+          legacySecretsSet({
+            projectRef: Option.none(),
+            envFile: Option.none(),
+            secrets,
+          }),
+        );
+        expect(Exit.isFailure(exit)).toBe(true);
+        expect(api.requests).toHaveLength(0);
+      }).pipe(Effect.provide(layer));
+    },
+  );
+
   it.live("sets secrets from --env-file with a relative path (joined to CWD)", () => {
     writeFileSync(join(tempRoot.current, "myfile.env"), "FROM_FILE=fromvalue\n");
     const { layer, api } = setup();
@@ -216,6 +298,34 @@ LITERAL = "plain-value"
     }).pipe(Effect.provide(layer));
   });
 
+  it.live(
+    "skips an empty [edge_runtime.secrets] value instead of overwriting a remote secret (Go set.go:48-52 parity)",
+    () => {
+      // Go's `DecryptSecretHookFunc` (`pkg/config/secret.go:98`) leaves `SHA256`
+      // empty for an empty value, and `ListSecrets` only includes entries with
+      // `len(secret.SHA256) > 0` — so a literal `EMPTY = ""` in config.toml is
+      // never sent, which prevents it from silently overwriting a same-named
+      // remote secret with an empty string.
+      writeConfig(
+        `[edge_runtime.secrets]
+EMPTY = ""
+NON_EMPTY = "config-value"
+`,
+      );
+      const { layer, api } = setup();
+      return Effect.gen(function* () {
+        yield* legacySecretsSet({
+          projectRef: Option.none(),
+          envFile: Option.none(),
+          secrets: [],
+        });
+        expect(parsePostBody(api.requests[0]?.body)).toEqual([
+          { name: "NON_EMPTY", value: "config-value" },
+        ]);
+      }).pipe(Effect.provide(layer));
+    },
+  );
+
   it.live(
     "does not crash when config.toml has env(NUMERIC_PORT) on an unrelated numeric field (CLI-1489 regression guard)",
     () => {
@@ -317,23 +427,474 @@ FOO = "literal-foo"
     }).pipe(Effect.provide(layer));
   });
 
-  it.live("fails with LegacySecretsConfigParseError when config.toml is malformed", () => {
-    writeConfig("this is not valid = = toml [[[\n");
-    const { layer } = setup();
-    return Effect.gen(function* () {
-      const exit = yield* Effect.exit(
-        legacySecretsSet({
+  it.live(
+    "tolerates a malformed config.toml, logs it to the debug logger, and still sets CLI-arg secrets",
+    () => {
+      writeConfig("this is not valid = = toml [[[\n");
+      const { layer, api, debugLogger } = setup();
+      return Effect.gen(function* () {
+        yield* legacySecretsSet({
           projectRef: Option.none(),
           envFile: Option.none(),
           secrets: ["FOO=bar"],
-        }),
+        });
+        expect(api.requests).toHaveLength(1);
+        expect(parsePostBody(api.requests[0]?.body)).toEqual([{ name: "FOO", value: "bar" }]);
+        expect(debugLogger.messages).toHaveLength(1);
+        expect(debugLogger.messages[0]).toContain("failed to parse supabase/config.toml");
+      }).pipe(Effect.provide(layer));
+    },
+  );
+
+  it.live(
+    "recovers [edge_runtime.secrets] when an unrelated field fails schema decode (CLI-1867 Go parity)",
+    () => {
+      // Valid TOML syntax throughout, but `analytics.port` has the wrong type
+      // for its schema field. Go's viper+mapstructure decode
+      // (`pkg/config/config.go:749`) mutates the target struct field-by-field,
+      // so an unrelated type error doesn't stop `EdgeRuntime.Secrets` from
+      // landing on `utils.Config` — `secrets set` still reads it. Effect
+      // Schema's `decodeUnknownSync` is atomic and would otherwise discard the
+      // whole document, silently dropping `FROM_CONFIG` too.
+      writeConfig(
+        `[edge_runtime.secrets]
+FROM_CONFIG = "config-value"
+
+[analytics]
+port = "not-a-number"
+`,
       );
-      expect(Exit.isFailure(exit)).toBe(true);
-      if (Exit.isFailure(exit)) {
-        expect(JSON.stringify(exit.cause)).toContain("LegacySecretsConfigParseError");
-      }
-    }).pipe(Effect.provide(layer));
-  });
+      const { layer, api, debugLogger } = setup();
+      return Effect.gen(function* () {
+        yield* legacySecretsSet({
+          projectRef: Option.none(),
+          envFile: Option.none(),
+          secrets: [],
+        });
+        expect(parsePostBody(api.requests[0]?.body)).toEqual([
+          { name: "FROM_CONFIG", value: "config-value" },
+        ]);
+        expect(debugLogger.messages).toHaveLength(1);
+        expect(debugLogger.messages[0]).toContain("failed to parse supabase/config.toml");
+      }).pipe(Effect.provide(layer));
+    },
+  );
+
+  it.live(
+    "recovers [edge_runtime.secrets] when a sibling field in the same edge_runtime table fails schema decode (CLI-1867 Go parity)",
+    () => {
+      // Valid TOML syntax throughout, but `edge_runtime.inspector_port` has
+      // the wrong type for its schema field — a SIBLING of `secrets` inside
+      // the same `edge_runtime` table, not an unrelated top-level table. Go's
+      // viper+mapstructure decode (`pkg/config/config.go:749`) mutates the
+      // target struct field-by-field even within the same table, so
+      // `EdgeRuntime.Secrets` still lands on `utils.Config` while
+      // `InspectorPort` is left at its zero value — verified empirically
+      // against `pkg/config` directly. The recovery must therefore re-decode
+      // `secrets` on its own rather than the whole `edge_runtime` subtree.
+      writeConfig(
+        `[edge_runtime]
+inspector_port = "not-a-number"
+
+[edge_runtime.secrets]
+FROM_CONFIG = "config-value"
+`,
+      );
+      const { layer, api, debugLogger } = setup();
+      return Effect.gen(function* () {
+        yield* legacySecretsSet({
+          projectRef: Option.none(),
+          envFile: Option.none(),
+          secrets: [],
+        });
+        expect(parsePostBody(api.requests[0]?.body)).toEqual([
+          { name: "FROM_CONFIG", value: "config-value" },
+        ]);
+        expect(debugLogger.messages).toHaveLength(1);
+        expect(debugLogger.messages[0]).toContain("failed to parse supabase/config.toml");
+      }).pipe(Effect.provide(layer));
+    },
+  );
+
+  it.live(
+    "tolerates a malformed supabase/.env, logs it to the debug logger, and still sets CLI-arg secrets (CLI-1867 Go parity)",
+    () => {
+      // `loadProjectConfig` resolves `env(VAR)` references against
+      // `supabase/.env`/`.env.local` *before* schema decode, so a malformed
+      // dotenv line fails with `ProjectEnvParseError` rather than
+      // `ProjectConfigParseError`. Go's `Load()` (`pkg/config/config.go:788-791`)
+      // calls `loadNestedEnv` first too and swallows any error the same way
+      // `flags.LoadConfig` does in `internal/secrets/set/set.go:20-24` — so this
+      // must not abort the command either. `.env` is only read once a
+      // `supabase/config.toml`/`.json` is found (`findProjectPaths`), so a
+      // config.toml must exist here too.
+      writeConfig(
+        `[edge_runtime.secrets]
+FROM_CONFIG = "config-value"
+`,
+      );
+      writeSupabaseDotEnv("THIS IS NOT A VALID DOTENV LINE\n");
+      const { layer, api, debugLogger } = setup();
+      return Effect.gen(function* () {
+        yield* legacySecretsSet({
+          projectRef: Option.none(),
+          envFile: Option.none(),
+          secrets: ["FOO=bar"],
+        });
+        expect(api.requests).toHaveLength(1);
+        expect(parsePostBody(api.requests[0]?.body)).toEqual([{ name: "FOO", value: "bar" }]);
+        expect(debugLogger.messages).toHaveLength(1);
+        expect(debugLogger.messages[0]).toContain("failed to parse");
+      }).pipe(Effect.provide(layer));
+    },
+  );
+
+  it.live(
+    "recovers valid [edge_runtime.secrets] entries when a sibling entry in the same map fails schema decode (CLI-1867 Go parity)",
+    () => {
+      // `GOOD` is a valid secret value; `BAD` is not (a non-string TOML value
+      // for a field whose schema expects a string-like secret). Go's
+      // mapstructure decodes `map[string]Secret` entry-by-entry
+      // (`decodeMapFromMap`), appending a per-entry error and continuing
+      // rather than discarding the whole map, so `GOOD` still lands on
+      // `utils.Config.EdgeRuntime.Secrets` even with `BAD` present. Effect
+      // Schema's `decodeUnknownSync` is atomic per record and would otherwise
+      // discard `GOOD` too when re-decoding the whole `secrets` map at once.
+      writeConfig(
+        `[edge_runtime.secrets]
+GOOD = "config-value"
+BAD = 123
+`,
+      );
+      const { layer, api, debugLogger } = setup();
+      return Effect.gen(function* () {
+        yield* legacySecretsSet({
+          projectRef: Option.none(),
+          envFile: Option.none(),
+          secrets: [],
+        });
+        const body = parsePostBody(api.requests[0]?.body);
+        expect(body).toEqual([{ name: "GOOD", value: "config-value" }]);
+        expect(debugLogger.messages).toHaveLength(1);
+        expect(debugLogger.messages[0]).toContain("failed to parse supabase/config.toml");
+      }).pipe(Effect.provide(layer));
+    },
+  );
+
+  it.live(
+    "skips an empty recovered [edge_runtime.secrets] entry alongside an unrelated schema error (Go set.go:48-52 parity)",
+    () => {
+      // Same empty-value skip as the happy path, but exercised through
+      // `recoverEdgeRuntimeConfig`/`filterDecodableSecrets`: `EMPTY` decodes
+      // fine on its own (it's a valid, if empty, string), so it must be
+      // dropped downstream in the same merge loop the happy path uses, not
+      // resurrected as a false "recoverable" entry.
+      writeConfig(
+        `[edge_runtime.secrets]
+EMPTY = ""
+GOOD = "config-value"
+
+[analytics]
+port = "not-a-number"
+`,
+      );
+      const { layer, api, debugLogger } = setup();
+      return Effect.gen(function* () {
+        yield* legacySecretsSet({
+          projectRef: Option.none(),
+          envFile: Option.none(),
+          secrets: [],
+        });
+        expect(parsePostBody(api.requests[0]?.body)).toEqual([
+          { name: "GOOD", value: "config-value" },
+        ]);
+        expect(debugLogger.messages).toHaveLength(1);
+        expect(debugLogger.messages[0]).toContain("failed to parse supabase/config.toml");
+      }).pipe(Effect.provide(layer));
+    },
+  );
+
+  it.live(
+    "does not fabricate a secret named 0 when [edge_runtime.secrets] is an array (CLI-1867 Go parity)",
+    () => {
+      // `edge_runtime.secrets` as an array (instead of a table) is not
+      // recoverable structure: Go's mapstructure decoder never sets
+      // `WeaklyTypedInput`, so a slice source for a map-typed field hits
+      // `UnconvertibleTypeError` in `decodeMap` rather than the index-as-key
+      // `decodeMapFromSlice` path, and the whole field is left empty. Before
+      // the `isRecord` fix, `Object.entries(["actual-secret"])` would turn
+      // this into a spurious `{ "0": "actual-secret" }` entry.
+      writeConfig(
+        `[analytics]
+port = "not-a-number"
+
+[edge_runtime]
+secrets = ["actual-secret"]
+`,
+      );
+      const { layer, api, debugLogger } = setup();
+      return Effect.gen(function* () {
+        yield* legacySecretsSet({
+          projectRef: Option.none(),
+          envFile: Option.none(),
+          secrets: ["FOO=bar"],
+        });
+        const body = parsePostBody(api.requests[0]?.body);
+        expect(body).toEqual([{ name: "FOO", value: "bar" }]);
+        expect(body.find((entry) => entry.name === "0")).toBeUndefined();
+        expect(debugLogger.messages).toHaveLength(1);
+      }).pipe(Effect.provide(layer));
+    },
+  );
+
+  it.live(
+    "recovers the selected remote's [edge_runtime.secrets] override, not the base, on schema-decode error (CLI-1867 Go parity)",
+    () => {
+      // `analytics.port` is an unrelated schema-decode error that triggers the
+      // recovery path. `remotes.staging.project_id` matches the ref the
+      // resolver defaults to (`mockLegacyCliConfig`'s `LEGACY_VALID_REF`), so
+      // Go seeds `Config.ProjectId` before `Load()`
+      // (`internal/utils/flags/config_path.go:11-12`) and merges the remote
+      // override in `loadFromFile` (`pkg/config/config.go:604-609`) before the
+      // tolerant decode this PR models — the recovered secret must reflect the
+      // remote's override value, not the base document's.
+      writeConfig(
+        `[edge_runtime.secrets]
+FROM_CONFIG = "base-value"
+
+[analytics]
+port = "not-a-number"
+
+[remotes.staging]
+project_id = "${LEGACY_VALID_REF}"
+
+[remotes.staging.edge_runtime.secrets]
+FROM_CONFIG = "remote-value"
+`,
+      );
+      const { layer, out, api, debugLogger } = setup();
+      return Effect.gen(function* () {
+        yield* legacySecretsSet({
+          projectRef: Option.none(),
+          envFile: Option.none(),
+          secrets: [],
+        });
+        expect(parsePostBody(api.requests[0]?.body)).toEqual([
+          { name: "FROM_CONFIG", value: "remote-value" },
+        ]);
+        expect(debugLogger.messages).toHaveLength(1);
+        expect(debugLogger.messages[0]).toContain("failed to parse supabase/config.toml");
+        // Go prints the override notice unconditionally as soon as the
+        // `project_id` match is found, *before* `mapstructure` decode ever
+        // runs (`pkg/config/config.go:604-609`) — so it's still owed here
+        // even though the decode that follows fails and recovers.
+        expect(out.stderrText).toContain("Loading config override: [remotes.staging]\n");
+      }).pipe(Effect.provide(layer));
+    },
+  );
+
+  it.live(
+    "prints the remote override notice to stderr when [remotes.*] matches the resolved ref (Go parity: pkg/config/config.go:605)",
+    () => {
+      // No decode error here — the plain success path. Go's `loadFromFile`
+      // prints `Loading config override: [remotes.<name>]` to stderr
+      // unconditionally whenever a `[remotes.*]` block's `project_id` matches
+      // `Config.ProjectId`, before `mapstructure` ever runs. `mockLegacyCliConfig`
+      // defaults the resolved ref to `LEGACY_VALID_REF`.
+      writeConfig(
+        `[edge_runtime.secrets]
+FROM_CONFIG = "base-value"
+
+[remotes.staging]
+project_id = "${LEGACY_VALID_REF}"
+
+[remotes.staging.edge_runtime.secrets]
+FROM_CONFIG = "remote-value"
+`,
+      );
+      const { layer, out, api } = setup();
+      return Effect.gen(function* () {
+        yield* legacySecretsSet({
+          projectRef: Option.none(),
+          envFile: Option.none(),
+          secrets: [],
+        });
+        expect(parsePostBody(api.requests[0]?.body)).toEqual([
+          { name: "FROM_CONFIG", value: "remote-value" },
+        ]);
+        expect(out.stderrText).toContain("Loading config override: [remotes.staging]\n");
+      }).pipe(Effect.provide(layer));
+    },
+  );
+
+  it.live(
+    "does not print a remote override notice when no [remotes.*] block matches the resolved ref",
+    () => {
+      writeConfig(
+        `[edge_runtime.secrets]
+FROM_CONFIG = "config-value"
+`,
+      );
+      const { layer, out, api } = setup();
+      return Effect.gen(function* () {
+        yield* legacySecretsSet({
+          projectRef: Option.none(),
+          envFile: Option.none(),
+          secrets: [],
+        });
+        expect(parsePostBody(api.requests[0]?.body)).toEqual([
+          { name: "FROM_CONFIG", value: "config-value" },
+        ]);
+        expect(out.stderrText).not.toContain("Loading config override");
+      }).pipe(Effect.provide(layer));
+    },
+  );
+
+  it.live(
+    "tolerates two [remotes.*] blocks sharing the target project_id, logs it, and still sets CLI-arg secrets (CLI-1867 Go parity)",
+    () => {
+      // Go's `flags.LoadConfig` swallows *any* `Load()` error non-fatally
+      // (`internal/secrets/set/set.go:22-24`), including the duplicate-
+      // `project_id` error `loadFromFile` raises before `mapstructure` ever
+      // runs (`pkg/config/config.go:601`). There is no parsed document to
+      // recover a subtree from, so config-sourced secrets are dropped
+      // entirely — only CLI-arg secrets survive.
+      writeConfig(
+        `[edge_runtime.secrets]
+FROM_CONFIG = "config-value"
+
+[remotes.a]
+project_id = "dupe-project-id"
+
+[remotes.b]
+project_id = "dupe-project-id"
+`,
+      );
+      const { layer, api, debugLogger } = setup();
+      return Effect.gen(function* () {
+        yield* legacySecretsSet({
+          projectRef: Option.none(),
+          envFile: Option.none(),
+          secrets: ["FOO=bar"],
+        });
+        expect(parsePostBody(api.requests[0]?.body)).toEqual([{ name: "FOO", value: "bar" }]);
+        expect(debugLogger.messages).toHaveLength(1);
+        expect(debugLogger.messages[0]).toContain("duplicate project_id for [remotes.");
+      }).pipe(Effect.provide(layer));
+    },
+  );
+
+  it.live(
+    "tolerates a [remotes.*] block with a malformed project_id and still sets CLI-arg secrets (Go parity)",
+    () => {
+      // Go's `flags.LoadConfig` swallows *any* `Load()` error non-fatally
+      // (`internal/secrets/set/set.go:22-24`), including the invalid-format
+      // error `Config.Validate` raises for every `[remotes.*].project_id`
+      // that doesn't match Go's ref pattern (`pkg/config/config.go:996-1001`),
+      // which runs inside the same `Config.Load()` call (`config.go:882`) as
+      // the duplicate check above. There is no parsed document to recover a
+      // subtree from, so config-sourced secrets are dropped entirely — only
+      // CLI-arg secrets survive.
+      writeConfig(
+        `[edge_runtime.secrets]
+FROM_CONFIG = "config-value"
+
+[remotes.a]
+project_id = "not-a-valid-ref"
+`,
+      );
+      const { layer, api, debugLogger } = setup();
+      return Effect.gen(function* () {
+        yield* legacySecretsSet({
+          projectRef: Option.none(),
+          envFile: Option.none(),
+          secrets: ["FOO=bar"],
+        });
+        expect(parsePostBody(api.requests[0]?.body)).toEqual([{ name: "FOO", value: "bar" }]);
+        expect(debugLogger.messages).toHaveLength(1);
+        expect(debugLogger.messages[0]).toContain("Invalid config for remotes.a.project_id");
+      }).pipe(Effect.provide(layer));
+    },
+  );
+
+  it.live(
+    "does not echo a literal secret value from config.toml into the debug log on a syntax error",
+    () => {
+      // `smol-toml`'s `TomlError` embeds a source codeblock (the offending line ±1)
+      // in its message; the planted secret sits directly above the syntax error so
+      // it would land inside that codeblock if the handler logged the raw message.
+      writeConfig(
+        [
+          "[edge_runtime.secrets]",
+          'PLANTED_SECRET = "sk_live_TOTALLY_REAL_SECRET_VALUE"',
+          "BROKEN = = invalid[[[",
+        ].join("\n"),
+      );
+      const { layer, debugLogger } = setup();
+      return Effect.gen(function* () {
+        yield* legacySecretsSet({
+          projectRef: Option.none(),
+          envFile: Option.none(),
+          secrets: ["FOO=bar"],
+        });
+        expect(debugLogger.messages).toHaveLength(1);
+        expect(debugLogger.messages[0]).not.toContain("PLANTED_SECRET");
+        expect(debugLogger.messages[0]).not.toContain("sk_live_TOTALLY_REAL_SECRET_VALUE");
+      }).pipe(Effect.provide(layer));
+    },
+  );
+
+  it.live(
+    "does not echo a literal secret value from config.toml into the debug log on a schema-decode error",
+    () => {
+      // Unlike the syntax-error case above, a schema-decode failure has no
+      // blank-line-separated source codeblock to truncate: Effect's decode
+      // error puts the rejected value inline on one line (e.g. `Expected
+      // string, actual ["sk_live_TOTALLY_REAL_SECRET_VALUE"]`). The bad entry
+      // sits inside `[edge_runtime.secrets]` itself, so this also exercises
+      // the per-entry recovery path — `PLANTED_SECRET` is dropped, but the
+      // CLI-arg secret still goes through.
+      writeConfig(
+        `[edge_runtime.secrets]
+PLANTED_SECRET = ["sk_live_TOTALLY_REAL_SECRET_VALUE"]
+`,
+      );
+      const { layer, api, debugLogger } = setup();
+      return Effect.gen(function* () {
+        yield* legacySecretsSet({
+          projectRef: Option.none(),
+          envFile: Option.none(),
+          secrets: ["FOO=bar"],
+        });
+        expect(parsePostBody(api.requests[0]?.body)).toEqual([{ name: "FOO", value: "bar" }]);
+        expect(debugLogger.messages).toHaveLength(1);
+        expect(debugLogger.messages[0]).not.toContain("PLANTED_SECRET");
+        expect(debugLogger.messages[0]).not.toContain("sk_live_TOTALLY_REAL_SECRET_VALUE");
+      }).pipe(Effect.provide(layer));
+    },
+  );
+
+  it.live(
+    "still fails with LegacySecretsNoArgumentsError when a malformed config leaves zero secret sources",
+    () => {
+      writeConfig("this is not valid = = toml [[[\n");
+      const { layer, api } = setup();
+      return Effect.gen(function* () {
+        const exit = yield* Effect.exit(
+          legacySecretsSet({
+            projectRef: Option.none(),
+            envFile: Option.none(),
+            secrets: [],
+          }),
+        );
+        expect(Exit.isFailure(exit)).toBe(true);
+        if (Exit.isFailure(exit)) {
+          expect(JSON.stringify(exit.cause)).toContain("LegacySecretsNoArgumentsError");
+        }
+        expect(api.requests).toHaveLength(0);
+      }).pipe(Effect.provide(layer));
+    },
+  );
 
   it.live("fails with LegacySecretsSetNetworkError on transport failure", () => {
     const { layer } = setup({ network: "fail" });
diff --git a/apps/cli/src/legacy/commands/secrets/unset/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/secrets/unset/SIDE_EFFECTS.md
index 504a4d99f1..873a57cf6d 100644
--- a/apps/cli/src/legacy/commands/secrets/unset/SIDE_EFFECTS.md
+++ b/apps/cli/src/legacy/commands/secrets/unset/SIDE_EFFECTS.md
@@ -33,7 +33,6 @@
 | `SUPABASE_PROFILE`      | selects API base URL: `supabase` → `api.supabase.com`, `supabase-staging` → `api.supabase.green`, `supabase-local` → `http://localhost:8080`. May alternatively be a filesystem path to a YAML profile with at least `api_url:` and optional `name:` (Go parity — used by the cli-e2e test harness). | no (defaults to `supabase`)                                                |
 | `SUPABASE_PROJECT_ID`   | project ref fallback when `--project-ref` is unset                                                                                                                                                                                                                                                   | no (also reads `<workdir>/supabase/.temp/project-ref` then prompts on TTY) |
 | `SUPABASE_WORKDIR`      | base directory for the `.temp/project-ref` lookup                                                                                                                                                                                                                                                    | no (walks up from CWD looking for `supabase/config.toml`)                  |
-| ~~`SUPABASE_API_URL`~~  | **not honored** — Go parity. Use `SUPABASE_PROFILE` to override the API base URL.                                                                                                                                                                                                                    | —                                                                          |
 
 ## Exit Codes
 
diff --git a/apps/cli/src/legacy/commands/seed/buckets/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/seed/buckets/SIDE_EFFECTS.md
index 67676ca81d..e884f1f397 100644
--- a/apps/cli/src/legacy/commands/seed/buckets/SIDE_EFFECTS.md
+++ b/apps/cli/src/legacy/commands/seed/buckets/SIDE_EFFECTS.md
@@ -7,12 +7,13 @@ stack is used; with `--linked` the remote project is used.
 
 ## Files Read
 
-| Path                                     | Format      | When                                                                                                                                                                                                                                                                             |
-| ---------------------------------------- | ----------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `<workdir>/supabase/config.toml`         | TOML        | always, to read `[storage.buckets]` / `[storage.vector]` config; on `--linked`, the matching `[remotes.<name>]` block (whose `project_id` equals the resolved project ref) is merged over the base config before decode, so remote-specific storage config takes effect          |
-| `<workdir>/supabase/<objects_path>/**`   | any (bytes) | per configured bucket with a non-empty `objects_path`, recursively; a relative `objects_path` resolves under `supabase/` (Go `config.go:757-759`), an absolute path is used as-is                                                                                                |
-| `<workdir>/supabase/<api.tls.cert_path>` | PEM text    | local runs only, when `[api.tls] enabled = true` AND `api.tls.cert_path` is set; the file is read to obtain the CA certificate for trusting the local Kong HTTPS gateway. If `cert_path` is not set, the embedded `kong.local.crt` constant is used instead (no file read).      |
-| `<workdir>/supabase/<api.tls.key_path>`  | PEM text    | local runs only, when `[api.tls] enabled = true` AND `api.tls.key_path` is set; read purely to validate the cert/key pairing (Go `config.go:845-861`) — the key content is not used by the CLI. If `cert_path` is set without `key_path` (or vice-versa), the command exits `1`. |
+| Path                                          | Format      | When                                                                                                                                                                                                                                                                             |
+| --------------------------------------------- | ----------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `<workdir>/supabase/config.toml`              | TOML        | always, to read `[storage.buckets]` / `[storage.vector]` config; on `--linked`, the matching `[remotes.<name>]` block (whose `project_id` equals the resolved project ref) is merged over the base config before decode, so remote-specific storage config takes effect          |
+| `<workdir>/supabase/<objects_path>/**`        | any (bytes) | per configured bucket with a non-empty `objects_path`, recursively; a relative `objects_path` resolves under `supabase/` (Go `config.go:757-759`), an absolute path is used as-is                                                                                                |
+| `<workdir>/supabase/<api.tls.cert_path>`      | PEM text    | local runs only, when `[api.tls] enabled = true` AND `api.tls.cert_path` is set; the file is read to obtain the CA certificate for trusting the local Kong HTTPS gateway. If `cert_path` is not set, the embedded `kong.local.crt` constant is used instead (no file read).      |
+| `<workdir>/supabase/<api.tls.key_path>`       | PEM text    | local runs only, when `[api.tls] enabled = true` AND `api.tls.key_path` is set; read purely to validate the cert/key pairing (Go `config.go:845-861`) — the key content is not used by the CLI. If `cert_path` is set without `key_path` (or vice-versa), the command exits `1`. |
+| `<workdir>/supabase/.env*`, `<workdir>/.env*` | dotenv      | when no pre-resolved `yes` is passed in (the standalone command; `db reset --local` passes its own), to resolve `SUPABASE_YES` for the overwrite/prune prompts (CLI-1878; Go's `loadNestedEnv`)                                                                                  |
 
 ## Files Written
 
@@ -71,6 +72,7 @@ Analytics bucket routes (`/storage/v1/iceberg/...`) are only reached when
 | `DOCKER_HOST`                    | when a `tcp://host:port` endpoint, the local services host falls back to it before `127.0.0.1`                                                                                                                        | no        |
 | `SUPABASE_AUTH_SERVICE_ROLE_KEY` | when set and non-empty: for `--linked`, used as the service-role key (skips Management API key fetch); for local runs, used as the service-role key instead of `auth.service_role_key` (Go Viper AutomaticEnv parity) | no        |
 | `SUPABASE_AUTH_JWT_SECRET`       | local runs only: when set and non-empty, overrides `auth.jwt_secret` for service-role key derivation (Go Viper `AutomaticEnv`+`SUPABASE_` prefix parity, `config.go:492-497`)                                         | no        |
+| `SUPABASE_YES`                   | auto-confirms the overwrite/prune prompts, same as `--yes`; read from the shell env OR the project `.env`/`.env.local`/`.env.<env>[.local]` files (shell wins; CLI-1878)                                              | no        |
 
 ## Exit Codes
 
@@ -114,6 +116,7 @@ Creating vector bucket: <name>
 Pruning vector bucket: <name>
 Uploading: <objects_path>/<rel> => <bucket>/<rel>
 Skipping non-regular file: <path>
+Skipping OS metadata file: <path>
 WARNING: Vector buckets are not available in this project's region yet. Skipping vector bucket seeding.
 WARNING: Vector buckets are not available in the local storage service. If this project is linked, run `supabase link` to update service versions, then restart the local stack. Skipping vector bucket seeding.
 ```
diff --git a/apps/cli/src/legacy/commands/seed/buckets/buckets.handler.ts b/apps/cli/src/legacy/commands/seed/buckets/buckets.handler.ts
index 9ddb8fdb86..f5d04275b7 100644
--- a/apps/cli/src/legacy/commands/seed/buckets/buckets.handler.ts
+++ b/apps/cli/src/legacy/commands/seed/buckets/buckets.handler.ts
@@ -1,138 +1,31 @@
-import {
-  loadProjectConfig,
-  type LoadProjectConfigOptions,
-  ProjectConfigSchema,
-} from "@supabase/config";
-import { Effect, FileSystem, Option, Path, Schema } from "effect";
-import { FetchHttpClient } from "effect/unstable/http";
-import type { PlatformError } from "effect/PlatformError";
+import { Effect, Option } from "effect";
 
 import { CliArgs } from "../../../../shared/cli/cli-args.service.ts";
-import { legacyResolveYes } from "../../../../shared/legacy/global-flags.ts";
-import { LegacyCliConfig } from "../../../config/legacy-cli-config.service.ts";
 import { LegacyProjectRefResolver } from "../../../config/legacy-project-ref.service.ts";
-import { legacySeedChangedTargetFlags } from "./buckets.flags.ts";
-import { legacyBold, legacyYellow } from "../../../shared/legacy-colors.ts";
-import {
-  legacyResolveStorageCredentials,
-  legacyStorageGatewayFetch,
-} from "../../../shared/legacy-storage-credentials.ts";
-import {
-  legacyParseFileSizeLimit,
-  legacyResolveBucketProps,
-} from "../../../shared/legacy-storage-bucket-config.ts";
-import {
-  type LegacyStorageGateway,
-  type LegacyUpsertBucketProps,
-  legacyMakeStorageGateway,
-} from "../../../shared/legacy-storage-gateway.ts";
-import type { LegacyStorageGatewayError } from "../../../shared/legacy-storage-gateway.errors.ts";
-import { Output } from "../../../../shared/output/output.service.ts";
-import {
-  legacyIsLocalVectorBucketsUnavailable,
-  legacyIsVectorBucketsFeatureNotEnabled,
-} from "./buckets.classify.ts";
-import { LegacySeedConfigLoadError } from "./buckets.errors.ts";
-import { legacyBucketObjectKey } from "./buckets.upload.ts";
-import { legacyPromptYesNo } from "../../../shared/legacy-prompt-yes-no.ts";
-import {
-  legacyContentTypeForUpload,
-  legacyReadSniffBytes,
-} from "../../../shared/legacy-storage-content-type.ts";
+import { legacySeedBucketsRun } from "../../../shared/legacy-seed-buckets.ts";
 import { LegacyLinkedProjectCache } from "../../../telemetry/legacy-linked-project-cache.service.ts";
 import { LegacyTelemetryState } from "../../../telemetry/legacy-telemetry-state.service.ts";
+import { legacySeedChangedTargetFlags } from "./buckets.flags.ts";
 import type { LegacyBucketsFlags } from "./buckets.command.ts";
 
-const CONFIG_PATH = "supabase/config.toml";
-const UPLOAD_CONCURRENCY = 5;
-
-/**
- * Mirrors Go's `ValidateBucketName` regex (`apps/cli-go/pkg/config/config.go:1382`).
- * Used to validate `[storage.buckets]` names before any Storage API call, matching
- * Go's config-load-time check (`config.go:899-903`). Vector and analytics names are
- * NOT validated here — Go only validates `[storage.buckets]`.
- */
-const LEGACY_BUCKET_NAME_PATTERN = /^(?:[0-9A-Za-z_]|!|-|\.|\*|'|\(|\)| |&|\$|@|=|;|:|\+|,|\?)*$/;
-
-/**
- * Verbatim Go regex literal (`config.go:1382`) — used in the error message so it
- * is byte-identical to Go's output. Do NOT derive from `LEGACY_BUCKET_NAME_PATTERN.source`.
- */
-const LEGACY_BUCKET_NAME_PATTERN_SOURCE =
-  "^(\\w|!|-|\\.|\\*|'|\\(|\\)| |&|\\$|@|=|;|:|\\+|,|\\?)*$";
-
-const legacyValidateBucketName = Effect.fnUntraced(function* (name: string) {
-  if (!LEGACY_BUCKET_NAME_PATTERN.test(name)) {
-    return yield* new LegacySeedConfigLoadError({
-      message: `Invalid Bucket name: ${name}. Only lowercase letters, numbers, dots, hyphens, and spaces are allowed. (${LEGACY_BUCKET_NAME_PATTERN_SOURCE})`,
-    });
-  }
-});
-
-interface CollectedFile {
-  readonly absPath: string;
-  readonly displayPath: string;
-}
-
-/** Mutable run summary, emitted as the structured result in json/stream-json mode. */
-interface SeedSummary {
-  readonly buckets_created: Array<string>;
-  readonly buckets_updated: Array<string>;
-  readonly buckets_skipped: Array<string>;
-  readonly vector_created: Array<string>;
-  readonly vector_pruned: Array<string>;
-  vector_skipped: boolean;
-  readonly objects_uploaded: Array<string>;
-  readonly analytics_created: Array<string>;
-  readonly analytics_pruned: Array<string>;
-}
-
-function emptySummary(): SeedSummary {
-  return {
-    buckets_created: [],
-    buckets_updated: [],
-    buckets_skipped: [],
-    vector_created: [],
-    vector_pruned: [],
-    vector_skipped: false,
-    objects_uploaded: [],
-    analytics_created: [],
-    analytics_pruned: [],
-  };
-}
-
-/**
- * Embedded-default project config, decoded from an empty object — the same
- * `decodeUnknownSync(ProjectConfigSchema)({})` the loader uses internally
- * (`packages/config/src/io.ts:54-56`). Go's `seed buckets` never aborts on a
- * missing `config.toml`: it reads the package-global `utils.Config`, initialized
- * to embedded defaults, and `config.Load` no-ops on a missing file. So "no
- * config file" behaves like the embedded-default config.
- */
-const legacyDecodeDefaultProjectConfig = Schema.decodeUnknownSync(ProjectConfigSchema);
-
 /**
  * `supabase seed buckets` — seeds Storage buckets from
  * `[storage.buckets]` / `[storage.vector]` in `supabase/config.toml`.
  *
  * Port of `apps/cli-go/internal/seed/buckets/buckets.go`. When `--linked` is
  * passed, the remote Storage gateway is used with the project's service-role key;
- * otherwise the local stack is used.
+ * otherwise the local stack is used. The seeding work lives in the hoisted
+ * `legacySeedBucketsRun` (shared with `db reset --local`); this handler owns the
+ * target-flag resolution and the post-run cache + telemetry side effects.
  */
 export const legacySeedBuckets = Effect.fn("legacy.seed.buckets")(function* (
   // Target is selected from the changed-flag set (Go's flag.Changed), not the
   // parsed value, so the flags arg itself is unused here.
   _flags: LegacyBucketsFlags,
 ) {
-  const output = yield* Output;
-  const cliConfig = yield* LegacyCliConfig;
   const telemetryState = yield* LegacyTelemetryState;
   const linkedProjectCache = yield* LegacyLinkedProjectCache;
-  const fs = yield* FileSystem.FileSystem;
-  const path = yield* Path.Path;
   const cliArgs = yield* CliArgs;
-  // `--yes` OR `SUPABASE_YES` (Go's viper AutomaticEnv, root.go:318-320).
-  const yes = yield* legacyResolveYes;
 
   // Set once --linked resolves a ref; drives the post-run linked-project cache
   // write + org/project group identify, mirroring Go's `ensureProjectGroupsCached`
@@ -141,11 +34,11 @@ export const legacySeedBuckets = Effect.fn("legacy.seed.buckets")(function* (
   let linkedRef = "";
 
   yield* Effect.gen(function* () {
-    // 1. Resolve the project ref for --linked BEFORE loading config, so that
-    // the matching `[remotes.<name>]` override (whose `project_id == ref`) is
-    // merged over the base config by `loadProjectConfig`. Go selects the target
-    // from `flag.Changed`, not the flag value: `--linked` is the linked path
-    // whenever it's *set* (even `--linked=false`).
+    // Resolve the project ref for --linked BEFORE loading config, so that the
+    // matching `[remotes.<name>]` override (whose `project_id == ref`) is merged
+    // over the base config by `loadProjectConfig`. Go selects the target from
+    // `flag.Changed`, not the flag value: `--linked` is the linked path whenever
+    // it's *set* (even `--linked=false`).
     const setFlags = legacySeedChangedTargetFlags(cliArgs.args);
     const projectRefResolver = yield* LegacyProjectRefResolver;
     const projectRef = setFlags.includes("linked")
@@ -153,123 +46,7 @@ export const legacySeedBuckets = Effect.fn("legacy.seed.buckets")(function* (
       : "";
     linkedRef = projectRef;
 
-    // 2. Load config.toml, passing projectRef so `[remotes.*]` overrides are
-    // merged for --linked. A parse failure aborts before any network call.
-    const loadOptions: LoadProjectConfigOptions | undefined =
-      projectRef !== "" ? { projectRef } : undefined;
-    const loaded = yield* loadProjectConfig(cliConfig.workdir, loadOptions).pipe(
-      Effect.catchTag(
-        "ProjectConfigParseError",
-        (cause) =>
-          new LegacySeedConfigLoadError({
-            message: `failed to parse supabase/config.toml: ${String(cause.cause)}`,
-          }),
-      ),
-    );
-    // A missing config file is NOT an early exit: Go uses embedded defaults and
-    // still gates the no-op on `len(projectRef) == 0`. So local + no-config falls
-    // into the no-op short-circuit; `--linked` + no-config falls through to the
-    // remote path so auth/project/API failures surface.
-    const config = loaded === null ? legacyDecodeDefaultProjectConfig({}) : loaded.config;
-    const document = loaded === null ? undefined : loaded.document;
-
-    // Go prints this from inside config load (`config.go:513`) whenever a
-    // `[remotes.*]` block matched the linked ref. stderr in all output modes.
-    if (loaded !== null && loaded.appliedRemote !== undefined) {
-      yield* output.raw(`Loading config override: [remotes.${loaded.appliedRemote}]\n`, "stderr");
-    }
-    const bucketsConfig = config.storage.buckets ?? {};
-    const bucketNames = Object.keys(bucketsConfig);
-    const vectorEnabled = config.storage.vector.enabled;
-    const vectorBucketNames = Object.keys(config.storage.vector.buckets);
-    const hasVectorBuckets = vectorBucketNames.length > 0;
-
-    // 3. Config-load-time validations run BEFORE the no-op short-circuit: Go
-    // decodes the whole config (storage.FileSizeLimit, bucket sizes) and runs
-    // ValidateBucketName during config.Load — before `buckets.Run` can take its
-    // no-op path — so an invalid value fails even when there's nothing to seed.
-    //
-    // 3a. Bucket names (Go ValidateBucketName, config.go:899-903).
-    for (const name of bucketNames) {
-      yield* legacyValidateBucketName(name);
-    }
-
-    // 3b. Storage-level file_size_limit, parsed unconditionally.
-    const storageFileSizeLimitBytes = yield* parseFileSizeLimitOrFail(
-      config.storage.file_size_limit,
-    );
-
-    // 3c. Per-bucket props (sizes parsed before any Storage call).
-    const bucketPropsByName = new Map<string, LegacyUpsertBucketProps>();
-    for (const [name, bucket] of Object.entries(bucketsConfig)) {
-      bucketPropsByName.set(
-        name,
-        yield* computeBucketProps(document, name, bucket, storageFileSizeLimitBytes),
-      );
-    }
-
-    // 3d. Short-circuit: nothing to seed (ref present → never short-circuits).
-    if (projectRef === "" && bucketNames.length === 0 && !hasVectorBuckets) {
-      if (output.format !== "text") {
-        yield* output.success("", { ...emptySummary() });
-      }
-      return;
-    }
-
-    // 4. Build the Storage service-gateway client (local or remote).
-    const credentials = yield* legacyResolveStorageCredentials({ projectRef, config });
-
-    // All gateway operations run with an explicit non-DoH fetch (CA-trusting for
-    // local + https, plain `globalThis.fetch` otherwise). The api-keys lookup
-    // inside `legacyResolveStorageCredentials` runs BEFORE this scope, so it
-    // still honors `--dns-resolver https`, matching Go's `tenant.GetApiKeys`.
-    const gatewayOps = Effect.gen(function* () {
-      const gateway = yield* legacyMakeStorageGateway({
-        baseUrl: credentials.baseUrl,
-        apiKey: credentials.apiKey,
-        userAgent: cliConfig.userAgent,
-      });
-
-      const summary = emptySummary();
-
-      // 5. Upsert configured buckets.
-      yield* upsertBuckets(output, yes, gateway, bucketPropsByName, summary);
-
-      // 6. Upsert analytics buckets (remote --linked only).
-      if (config.storage.analytics.enabled && projectRef !== "") {
-        yield* output.raw("Updating analytics buckets...\n", "stderr");
-        yield* upsertAnalyticsBuckets(
-          output,
-          yes,
-          gateway,
-          Object.keys(config.storage.analytics.buckets),
-          summary,
-        );
-      }
-
-      // 7. Upsert vector buckets (local), with graceful skip on unavailability.
-      if (vectorEnabled && hasVectorBuckets) {
-        yield* output.raw("Updating vector buckets...\n", "stderr");
-        yield* upsertVectorBuckets(output, yes, gateway, vectorBucketNames, summary).pipe(
-          Effect.catch((error) => handleVectorError(output, error, summary)),
-        );
-      }
-
-      // 8. Upload objects for each bucket with a configured objects_path.
-      yield* uploadObjects(fs, path, output, gateway, cliConfig.workdir, bucketsConfig, summary);
-
-      // 9. Machine-readable summary (Go has none; text mode emits nothing extra).
-      if (output.format !== "text") {
-        yield* output.success("", { ...summary });
-      }
-    });
-
-    yield* gatewayOps.pipe(
-      Effect.provideService(
-        FetchHttpClient.Fetch,
-        legacyStorageGatewayFetch(credentials.localKongCa),
-      ),
-    );
+    yield* legacySeedBucketsRun({ projectRef, emitSummary: true });
   }).pipe(
     // Go's root `Execute` caches the linked project + fires org/project group
     // identify whenever `flags.ProjectRef` is set — only on the --linked path.
@@ -279,315 +56,3 @@ export const legacySeedBuckets = Effect.fn("legacy.seed.buckets")(function* (
     Effect.ensuring(telemetryState.flush),
   );
 });
-
-type BucketsConfig = Readonly<
-  Record<
-    string,
-    {
-      readonly public: boolean;
-      readonly file_size_limit: string;
-      readonly allowed_mime_types: ReadonlyArray<string>;
-      readonly objects_path: string;
-    }
-  >
->;
-
-// Parse a `file_size_limit` string to bytes, mapping a parse failure to a
-// config-load error (Go rejects an invalid `sizeInBytes` during `config.Load`,
-// before NewStorageAPI).
-const parseFileSizeLimitOrFail = (value: string) =>
-  Effect.try({
-    try: () => legacyParseFileSizeLimit(value),
-    catch: (cause) =>
-      new LegacySeedConfigLoadError({
-        message: cause instanceof Error ? cause.message : String(cause),
-      }),
-  });
-
-const computeBucketProps = (
-  document: Record<string, unknown> | undefined,
-  name: string,
-  bucket: BucketsConfig[string],
-  storageFileSizeLimitBytes: number,
-) =>
-  Effect.try({
-    try: () => legacyResolveBucketProps({ document, name, bucket, storageFileSizeLimitBytes }),
-    catch: (cause) =>
-      new LegacySeedConfigLoadError({
-        message: cause instanceof Error ? cause.message : String(cause),
-      }),
-  });
-
-// Port of `pkg/storage/batch.go:UpsertBuckets`. `propsByName` is precomputed and
-// size-validated before this runs (Go parses sizes at config-load, before any
-// Storage call).
-const upsertBuckets = Effect.fnUntraced(function* (
-  output: typeof Output.Service,
-  yes: boolean,
-  gateway: LegacyStorageGateway,
-  propsByName: ReadonlyMap<string, LegacyUpsertBucketProps>,
-  summary: SeedSummary,
-) {
-  const existing = yield* gateway.listBuckets();
-  const byName = new Map(existing.map((b) => [b.name, b.id]));
-
-  for (const [name, props] of propsByName) {
-    const bucketId = byName.get(name);
-    if (bucketId !== undefined) {
-      const overwrite = yield* legacyPromptYesNo(
-        output,
-        yes,
-        `Bucket ${legacyBold(bucketId)} already exists. Do you want to overwrite its properties?`,
-        true,
-      );
-      if (!overwrite) {
-        summary.buckets_skipped.push(bucketId);
-        continue;
-      }
-      yield* output.raw(`Updating Storage bucket: ${bucketId}\n`, "stderr");
-      yield* gateway.updateBucket(bucketId, props);
-      summary.buckets_updated.push(bucketId);
-    } else {
-      yield* output.raw(`Creating Storage bucket: ${name}\n`, "stderr");
-      yield* gateway.createBucket(name, props);
-      summary.buckets_created.push(name);
-    }
-  }
-});
-
-// Port of `pkg/storage/vector.go:UpsertVectorBuckets`.
-const upsertVectorBuckets = Effect.fnUntraced(function* (
-  output: typeof Output.Service,
-  yes: boolean,
-  gateway: LegacyStorageGateway,
-  configuredNames: ReadonlyArray<string>,
-  summary: SeedSummary,
-) {
-  const existing = yield* gateway.listVectorBuckets();
-  const existingSet = new Set(existing);
-  const configuredSet = new Set(configuredNames);
-  const toDelete = existing.filter((name) => !configuredSet.has(name));
-
-  for (const name of configuredNames) {
-    if (existingSet.has(name)) {
-      yield* output.raw(`Bucket already exists: ${name}\n`, "stderr");
-      continue;
-    }
-    yield* output.raw(`Creating vector bucket: ${name}\n`, "stderr");
-    yield* gateway.createVectorBucket(name);
-    summary.vector_created.push(name);
-  }
-
-  for (const name of toDelete) {
-    const prune = yield* legacyPromptYesNo(
-      output,
-      yes,
-      `Bucket ${legacyBold(name)} not found in ${legacyBold(CONFIG_PATH)}. Do you want to prune it?`,
-      false,
-    );
-    if (!prune) {
-      continue;
-    }
-    yield* output.raw(`Pruning vector bucket: ${name}\n`, "stderr");
-    yield* gateway.deleteVectorBucket(name);
-    summary.vector_pruned.push(name);
-  }
-});
-
-// Port of `pkg/storage/analytics.go:UpsertAnalyticsBuckets`.
-const upsertAnalyticsBuckets = Effect.fnUntraced(function* (
-  output: typeof Output.Service,
-  yes: boolean,
-  gateway: LegacyStorageGateway,
-  configuredNames: ReadonlyArray<string>,
-  summary: SeedSummary,
-) {
-  const existing = yield* gateway.listAnalyticsBuckets();
-  const existingSet = new Set(existing);
-  const configuredSet = new Set(configuredNames);
-  const toDelete = existing.filter((name) => !configuredSet.has(name));
-
-  for (const name of configuredNames) {
-    if (existingSet.has(name)) {
-      yield* output.raw(`Bucket already exists: ${name}\n`, "stderr");
-      continue;
-    }
-    yield* output.raw(`Creating analytics bucket: ${name}\n`, "stderr");
-    yield* gateway.createAnalyticsBucket(name);
-    summary.analytics_created.push(name);
-  }
-
-  for (const name of toDelete) {
-    const prune = yield* legacyPromptYesNo(
-      output,
-      yes,
-      `Bucket ${legacyBold(name)} not found in ${legacyBold(CONFIG_PATH)}. Do you want to prune it?`,
-      false,
-    );
-    if (!prune) {
-      continue;
-    }
-    yield* output.raw(`Pruning analytics bucket: ${name}\n`, "stderr");
-    yield* gateway.deleteAnalyticsBucket(name);
-    summary.analytics_pruned.push(name);
-  }
-});
-
-/**
- * Vector graceful-skip (`buckets.go:57-66`): on `FeatureNotEnabled` /
- * local-unavailable errors, print the matching WARNING and continue (object
- * upload still runs). Any other error propagates.
- */
-const handleVectorError = Effect.fnUntraced(function* (
-  output: typeof Output.Service,
-  error: LegacyStorageGatewayError,
-  summary: SeedSummary,
-) {
-  if (legacyIsVectorBucketsFeatureNotEnabled(error.message)) {
-    yield* output.raw(
-      `${legacyYellow("WARNING:")} Vector buckets are not available in this project's region yet. Skipping vector bucket seeding.\n`,
-      "stderr",
-    );
-    summary.vector_skipped = true;
-    return;
-  }
-  if (legacyIsLocalVectorBucketsUnavailable(error.message)) {
-    yield* output.raw(
-      `${legacyYellow("WARNING:")} Vector buckets are not available in the local storage service. If this project is linked, run \`supabase link\` to update service versions, then restart the local stack. Skipping vector bucket seeding.\n`,
-      "stderr",
-    );
-    summary.vector_skipped = true;
-    return;
-  }
-  return yield* Effect.fail(error);
-});
-
-// Port of `pkg/storage/batch.go:UpsertObjects` (+ object walk in objects.go).
-const uploadObjects = Effect.fnUntraced(function* (
-  fs: FileSystem.FileSystem,
-  path: Path.Path,
-  output: typeof Output.Service,
-  gateway: LegacyStorageGateway,
-  workdir: string,
-  bucketsConfig: BucketsConfig,
-  summary: SeedSummary,
-) {
-  for (const [name, bucket] of Object.entries(bucketsConfig)) {
-    const objectsPath = bucket.objects_path;
-    if (objectsPath.length === 0) {
-      continue;
-    }
-    // Go resolves a relative bucket objects_path against SupabaseDirPath at
-    // config-resolve time (`pkg/config/config.go:757-759`); absolute paths are
-    // left untouched. `displayRoot` (workdir-relative) drives the `Uploading:`
-    // stderr and the destination key so both stay byte-identical to Go.
-    const displayRoot = path.isAbsolute(objectsPath)
-      ? objectsPath
-      : path.join("supabase", objectsPath);
-    const absRoot = path.isAbsolute(objectsPath)
-      ? objectsPath
-      : path.join(workdir, "supabase", objectsPath);
-    const files = yield* collectFiles(fs, path, output, absRoot, displayRoot);
-    yield* Effect.forEach(
-      files,
-      (file) =>
-        Effect.gen(function* () {
-          const dstPath = legacyBucketObjectKey(name, displayRoot, file.displayPath);
-          yield* output.raw(`Uploading: ${file.displayPath} => ${dstPath}\n`, "stderr");
-          // Content-type is byte-driven: Go sniffs the first 512 bytes with
-          // http.DetectContentType, refining only a generic text/plain by
-          // extension (`pkg/storage/objects.go:77-108`).
-          const sniff = yield* legacyReadSniffBytes(fs, file.absPath);
-          // Go's seed upload always sets Cache-Control max-age=3600 and x-upsert
-          // (Overwrite) true (`pkg/storage/batch.go`).
-          yield* gateway.uploadObject(dstPath, file.absPath, {
-            contentType: legacyContentTypeForUpload(sniff, file.absPath),
-            cacheControl: "max-age=3600",
-            overwrite: true,
-          });
-          summary.objects_uploaded.push(dstPath);
-        }),
-      { concurrency: UPLOAD_CONCURRENCY },
-    );
-  }
-});
-
-/**
- * Collect uploadable files under `absRoot`, lexically ordered, mirroring Go's
- * `fs.WalkDir` + `isUploadableEntry` (`pkg/storage/batch.go:65-131`).
- *
- * Parity details:
- *  - The **root** is resolved with a following stat (Go's `fs.Stat`), so a
- *    symlinked `objects_path` is followed; a missing/dangling root fails.
- *  - **Nested** entries use no-follow detection: real directories are descended;
- *    symlinks are NOT descended — Go's `isUploadableEntry` OPENS the symlink
- *    target then stats the handle, uploading only a regular file and skipping
- *    dangling symlinks / symlinks-to-directories / unreadable targets.
- */
-const collectFiles = (
-  fs: FileSystem.FileSystem,
-  path: Path.Path,
-  output: typeof Output.Service,
-  absRoot: string,
-  displayRoot: string,
-): Effect.Effect<ReadonlyArray<CollectedFile>, PlatformError> =>
-  Effect.gen(function* () {
-    const info = yield* fs.stat(absRoot);
-    if (info.type === "Directory") {
-      return yield* collectDir(fs, path, output, absRoot, displayRoot);
-    }
-    if (info.type === "File") {
-      return [{ absPath: absRoot, displayPath: displayRoot }];
-    }
-    yield* output.raw(`Skipping non-regular file: ${displayRoot}\n`, "stderr");
-    return [];
-  });
-
-const collectDir = (
-  fs: FileSystem.FileSystem,
-  path: Path.Path,
-  output: typeof Output.Service,
-  absDir: string,
-  displayDir: string,
-): Effect.Effect<ReadonlyArray<CollectedFile>, PlatformError> =>
-  Effect.gen(function* () {
-    const names = [...(yield* fs.readDirectory(absDir))].sort();
-    const collected: Array<CollectedFile> = [];
-    for (const name of names) {
-      const absChild = path.join(absDir, name);
-      const displayChild = path.join(displayDir, name);
-      // `readLink` succeeds only on a symlink — our no-follow detector (Effect's
-      // `stat` follows symlinks and has no `lstat`).
-      const isSymlink = yield* fs.readLink(absChild).pipe(
-        Effect.as(true),
-        Effect.catch(() => Effect.succeed(false)),
-      );
-      if (isSymlink) {
-        // Go `isUploadableEntry` (batch.go:73-84) OPENS the target then stats the
-        // handle; it uploads only a regular file. `stat` alone would queue an
-        // unreadable target and abort later at upload, so mirror Go: open + stat.
-        const targetType = yield* Effect.scoped(
-          Effect.gen(function* () {
-            const handle = yield* fs.open(absChild, { flag: "r" });
-            const targetInfo = yield* handle.stat;
-            return targetInfo.type;
-          }),
-        ).pipe(Effect.catch(() => Effect.succeed("Unknown" as const)));
-        if (targetType === "File") {
-          collected.push({ absPath: absChild, displayPath: displayChild });
-        } else {
-          yield* output.raw(`Skipping non-regular file: ${displayChild}\n`, "stderr");
-        }
-        continue;
-      }
-      const childInfo = yield* fs.stat(absChild);
-      if (childInfo.type === "Directory") {
-        collected.push(...(yield* collectDir(fs, path, output, absChild, displayChild)));
-      } else if (childInfo.type === "File") {
-        collected.push({ absPath: absChild, displayPath: displayChild });
-      } else {
-        yield* output.raw(`Skipping non-regular file: ${displayChild}\n`, "stderr");
-      }
-    }
-    return collected;
-  });
diff --git a/apps/cli/src/legacy/commands/seed/buckets/buckets.integration.test.ts b/apps/cli/src/legacy/commands/seed/buckets/buckets.integration.test.ts
index 986fcc4af6..a689e82bfb 100644
--- a/apps/cli/src/legacy/commands/seed/buckets/buckets.integration.test.ts
+++ b/apps/cli/src/legacy/commands/seed/buckets/buckets.integration.test.ts
@@ -25,6 +25,7 @@ import { LegacyYesFlag } from "../../../../shared/legacy/global-flags.ts";
 import type { OutputFormat } from "../../../../shared/output/types.ts";
 import { LegacyProjectRefResolver } from "../../../../legacy/config/legacy-project-ref.service.ts";
 import { LegacyProjectNotLinkedError } from "../../../../legacy/config/legacy-project-ref.errors.ts";
+import { legacySeedBucketsRun } from "../../../shared/legacy-seed-buckets.ts";
 import { legacySeedBuckets } from "./buckets.handler.ts";
 import type { LegacyBucketsFlags } from "./buckets.command.ts";
 import { LegacyPlatformApi } from "../../../../legacy/auth/legacy-platform-api.service.ts";
@@ -323,6 +324,36 @@ describe("legacy seed buckets", () => {
     });
   });
 
+  it.live(
+    "honors a piped decline for the overwrite prompt when non-interactive (db reset path)",
+    () => {
+      const { layer, out, requests } = setupLegacySeedBuckets(tmp.current, {
+        toml: "[storage.buckets.test]\npublic = true\n",
+        routes: [
+          { method: "GET", match: "/storage/v1/bucket", body: [{ name: "test", id: "test" }] },
+        ],
+        pipedAnswers: ["n"],
+      });
+      return Effect.gen(function* () {
+        // db reset seeds buckets with interactive=false (Go's `buckets.Run(ctx, "",
+        // false, fsys)` forces console.IsTTY=false). Go does NOT silently take the
+        // default: the prompt still prints its label, scans one line, and honors a
+        // parsed answer — so the piped "n" must skip the overwrite (default is yes).
+        const exit = yield* legacySeedBucketsRun({
+          projectRef: "",
+          emitSummary: false,
+          interactive: false,
+        }).pipe(Effect.provide(layer), Effect.exit);
+        expect(Exit.isSuccess(exit)).toBe(true);
+        expect(out.stderrText).toContain(
+          "already exists. Do you want to overwrite its properties?",
+        );
+        expect(out.stderrText).not.toContain("Updating Storage bucket");
+        expect(requests.some((r) => r.method === "PUT")).toBe(false);
+      });
+    },
+  );
+
   it.live("creates configured vector buckets and leaves stale ones (prune default no)", () => {
     const { layer, out, requests } = setupLegacySeedBuckets(tmp.current, {
       toml: "[storage.vector]\nenabled = true\n[storage.vector.buckets.documents-openai]\n[storage.vector.buckets.existing-vec]\n",
@@ -397,6 +428,40 @@ describe("legacy seed buckets", () => {
     });
   });
 
+  it.live(
+    "prunes a stale vector bucket when the caller passes yes (db reset project-env path)",
+    () => {
+      // `db reset` resolves `yes` with the nested project `.env` and passes it into the runner
+      // with `interactive: false`; the pre-resolved `yes` must drive pruning even though no
+      // prompt is answered and the runner's own shell-only resolveYes would default to false.
+      const { layer, out, requests } = setupLegacySeedBuckets(tmp.current, {
+        toml: "[storage.vector]\nenabled = true\n[storage.vector.buckets.keep-vec]\n",
+        routes: [
+          { method: "GET", match: "/storage/v1/bucket", body: [] },
+          {
+            method: "POST",
+            match: VECTOR_LIST,
+            body: {
+              vectorBuckets: [{ vectorBucketName: "keep-vec" }, { vectorBucketName: "stale-vec" }],
+            },
+          },
+          { method: "POST", match: VECTOR_DELETE, body: {} },
+        ],
+        // No `confirm` and no `--yes` flag — pruning is driven solely by the passed `yes`.
+      });
+      return Effect.gen(function* () {
+        yield* legacySeedBucketsRun({
+          projectRef: "",
+          emitSummary: false,
+          interactive: false,
+          yes: true,
+        }).pipe(Effect.provide(layer));
+        expect(out.stderrText).toContain("Pruning vector bucket: stale-vec");
+        expect(requests.some((r) => r.url.includes(VECTOR_DELETE))).toBe(true);
+      });
+    },
+  );
+
   it.live("warns and continues when vector buckets are unavailable in the region", () => {
     const { layer, out } = setupLegacySeedBuckets(tmp.current, {
       toml: "[storage.vector]\nenabled = true\n[storage.vector.buckets.documents-openai]\n",
@@ -1220,6 +1285,95 @@ describe("legacy seed buckets", () => {
     });
   });
 
+  it.live("skips OS metadata files during the object walk (CLI-1950)", () => {
+    // .DS_Store (macOS Finder), Thumbs.db and desktop.ini (Windows Explorer)
+    // must never be uploaded as seeded objects — they are never even attempted,
+    // covering the "silently becomes a public object" failure mode, not just
+    // an upload-time abort.
+    mkdirSync(join(tmp.current, "supabase", "assets"), { recursive: true });
+    writeFileSync(join(tmp.current, "supabase", "assets", "a.txt"), "hello");
+    writeFileSync(join(tmp.current, "supabase", "assets", ".DS_Store"), "junk");
+    writeFileSync(join(tmp.current, "supabase", "assets", "Thumbs.db"), "junk");
+    writeFileSync(join(tmp.current, "supabase", "assets", "desktop.ini"), "junk");
+    const { layer, out, requests } = setupLegacySeedBuckets(tmp.current, {
+      toml: '[storage.buckets.images]\npublic = true\nobjects_path = "./assets"\n',
+      routes: [
+        { method: "GET", match: "/storage/v1/bucket", body: [] },
+        { method: "POST", match: "/storage/v1/object/", body: {} },
+        { method: "POST", match: "/storage/v1/bucket", body: { name: "images" } },
+      ],
+    });
+    return Effect.gen(function* () {
+      const exit = yield* legacySeedBuckets(DEFAULT_FLAGS).pipe(Effect.provide(layer), Effect.exit);
+      expect(Exit.isSuccess(exit)).toBe(true);
+      expect(out.stderrText).toContain("Skipping OS metadata file: supabase/assets/.DS_Store");
+      expect(out.stderrText).toContain("Skipping OS metadata file: supabase/assets/Thumbs.db");
+      expect(out.stderrText).toContain("Skipping OS metadata file: supabase/assets/desktop.ini");
+      expect(out.stderrText).toContain("Uploading: supabase/assets/a.txt => images/a.txt");
+      const uploads = requests.filter((r) => r.url.includes("/storage/v1/object/"));
+      expect(uploads).toHaveLength(1);
+    });
+  });
+
+  it.live(
+    "skips a .DS_Store file in a MIME-restricted bucket instead of uploading it (CLI-1950)",
+    () => {
+      // Reproduces the original bug report shape: a bucket with allowed_mime_types
+      // restricted to images. The test harness's mock HTTP route doesn't enforce
+      // allowed_mime_types server-side (that's real Storage-service behavior), so
+      // this doesn't simulate the 415 abort itself — it asserts the junk file is
+      // skipped and never uploaded, while the real image file still uploads.
+      mkdirSync(join(tmp.current, "supabase", "assets"), { recursive: true });
+      writeFileSync(join(tmp.current, "supabase", "assets", "logo.png"), "fake-png-bytes");
+      writeFileSync(join(tmp.current, "supabase", "assets", ".DS_Store"), "junk");
+      const { layer, out, requests } = setupLegacySeedBuckets(tmp.current, {
+        toml: [
+          "[storage.buckets.images]",
+          "public = true",
+          'allowed_mime_types = ["image/png"]',
+          'objects_path = "./assets"',
+        ].join("\n"),
+        routes: [
+          { method: "GET", match: "/storage/v1/bucket", body: [] },
+          { method: "POST", match: "/storage/v1/object/", body: {} },
+          { method: "POST", match: "/storage/v1/bucket", body: { name: "images" } },
+        ],
+      });
+      return Effect.gen(function* () {
+        const exit = yield* legacySeedBuckets(DEFAULT_FLAGS).pipe(
+          Effect.provide(layer),
+          Effect.exit,
+        );
+        expect(Exit.isSuccess(exit)).toBe(true);
+        expect(out.stderrText).toContain("Skipping OS metadata file: supabase/assets/.DS_Store");
+        expect(out.stderrText).toContain("Uploading: supabase/assets/logo.png => images/logo.png");
+        const uploads = requests.filter((r) => r.url.includes("/storage/v1/object/"));
+        expect(uploads).toHaveLength(1);
+      });
+    },
+  );
+
+  it.live("skips a .DS_Store file when objects_path points directly at it (CLI-1950)", () => {
+    // Covers collectFiles' single-file branch: objects_path resolves directly to
+    // a junk-named file rather than a directory.
+    mkdirSync(join(tmp.current, "supabase"), { recursive: true });
+    writeFileSync(join(tmp.current, "supabase", ".DS_Store"), "junk");
+    const { layer, out, requests } = setupLegacySeedBuckets(tmp.current, {
+      toml: '[storage.buckets.images]\npublic = true\nobjects_path = "./.DS_Store"\n',
+      routes: [
+        { method: "GET", match: "/storage/v1/bucket", body: [] },
+        { method: "POST", match: "/storage/v1/bucket", body: { name: "images" } },
+      ],
+    });
+    return Effect.gen(function* () {
+      const exit = yield* legacySeedBuckets(DEFAULT_FLAGS).pipe(Effect.provide(layer), Effect.exit);
+      expect(Exit.isSuccess(exit)).toBe(true);
+      expect(out.stderrText).toContain("Skipping OS metadata file: supabase/.DS_Store");
+      const uploads = requests.filter((r) => r.url.includes("/storage/v1/object/"));
+      expect(uploads).toHaveLength(0);
+    });
+  });
+
   // Root bypasses POSIX permission bits, so chmod 000 wouldn't block open() there
   // and the open-vs-stat distinction this test relies on would vanish.
   const isRoot = typeof process.getuid === "function" && process.getuid() === 0;
@@ -1346,6 +1500,37 @@ describe("legacy seed buckets", () => {
     });
   });
 
+  it.live(
+    "auto-confirms the overwrite from SUPABASE_YES in the project .env (Go loadNestedEnv, CLI-1878)",
+    () => {
+      // SUPABASE_YES lives only in supabase/.env, not the shell or the --yes flag. `seed
+      // buckets` defaults to `--local` (Go: `cmd/seed.go:31`), and root's
+      // `ParseDatabaseConfig` loads the project `.env` files before `buckets.Run`'s
+      // overwrite prompt (`root.go:118`), so the standalone command's own fallback
+      // resolution (not the `db reset`-passed `opts.yes`) must read it too.
+      const { layer, out, requests } = setupLegacySeedBuckets(tmp.current, {
+        toml: "[storage.buckets.assets]\npublic = true\n",
+        files: { "supabase/.env": "SUPABASE_YES=true\n" },
+        routes: [
+          { method: "GET", match: "/storage/v1/bucket", body: [{ name: "assets", id: "assets" }] },
+          { method: "PUT", match: "/storage/v1/bucket/assets", body: {} },
+        ],
+      });
+      return Effect.gen(function* () {
+        const exit = yield* legacySeedBuckets(DEFAULT_FLAGS).pipe(
+          Effect.provide(layer),
+          Effect.exit,
+        );
+        expect(Exit.isSuccess(exit)).toBe(true);
+        expect(out.stderrText).toContain(
+          "already exists. Do you want to overwrite its properties? [Y/n] y",
+        );
+        expect(out.stderrText).toContain("Updating Storage bucket: assets");
+        expect(requests.some((r) => r.method === "PUT")).toBe(true);
+      });
+    },
+  );
+
   it.live("--yes prunes a stale vector bucket and echoes Go's prompt line", () => {
     const { layer, out, requests } = setupLegacySeedBuckets(tmp.current, {
       toml: "[storage.vector]\nenabled = true\n[storage.vector.buckets.vec1]\n",
diff --git a/apps/cli/src/legacy/commands/services/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/services/SIDE_EFFECTS.md
index 07092ca913..092f927b61 100644
--- a/apps/cli/src/legacy/commands/services/SIDE_EFFECTS.md
+++ b/apps/cli/src/legacy/commands/services/SIDE_EFFECTS.md
@@ -16,12 +16,22 @@
 
 ## API Routes
 
-The resolved project ref must match `^[a-z]{20}$` (Go's `utils.ProjectRefPattern`)
-before any remote lookup runs; a malformed ref skips the linked-version checks
-and only the local matrix is printed. Tenant calls send `apikey: <serviceKey>`
-and additionally `Authorization: Bearer <serviceKey>` unless the key is a
-new-style `sb_…` key (which authenticates via the `apikey` header alone),
-matching `apps/cli-go/pkg/fetcher/gateway.go`.
+**Divergence from Go on a malformed ref:** Go validates the resolved ref against
+`utils.ProjectRefPattern` (`^[a-z]{20}$`) but only warns on failure
+(`cmd/services.go`'s `Run` prints the validation error to stderr) and still
+calls `listRemoteImages` with the malformed ref anyway (`services.go:61-62`).
+TS prints the same warning ("Invalid project ref format. Must be like
+`abcdefghijklmnopqrst`.") but deliberately skips the remote lookup instead of
+reproducing Go's behavior — the ref is embedded unescaped into the tenant
+gateway hostname below, so proceeding with a malformed value would let it
+redirect the service-role key to an attacker-controlled host. Only the local
+matrix is printed in this case. This is intentional TS-only hardening, not a
+parity bug.
+
+Tenant calls send `apikey: <serviceKey>` and additionally
+`Authorization: Bearer <serviceKey>` unless the key is a new-style `sb_…` key
+(which authenticates via the `apikey` header alone), matching
+`apps/cli-go/pkg/fetcher/gateway.go`.
 
 | Method | Path                                           | Auth                           | Request body | Response (used fields)                                             |
 | ------ | ---------------------------------------------- | ------------------------------ | ------------ | ------------------------------------------------------------------ |
@@ -36,7 +46,7 @@ matching `apps/cli-go/pkg/fetcher/gateway.go`.
 | Variable                | Purpose                                             | Required?                                                   |
 | ----------------------- | --------------------------------------------------- | ----------------------------------------------------------- |
 | `SUPABASE_ACCESS_TOKEN` | auth token for Management API linked-version checks | no (falls back to keyring, then `~/.supabase/access-token`) |
-| `SUPABASE_API_URL`      | override Management API base URL                    | no (defaults to `https://api.supabase.com`)                 |
+| `SUPABASE_PROFILE`      | built-in profile name or YAML file path             | no (falls back to `~/.supabase/profile` -> `supabase`)      |
 
 ## Exit Codes
 
@@ -75,5 +85,6 @@ TS-only NDJSON success event with the same `{ services: [...] }` payload.
 
 - Local versions come from the command's baked-in service matrix; the command does not inspect Docker state or local config files.
 - Linked-version checks are best-effort. Remote lookup failures do not change the exit code; they only leave the `LINKED` column empty for unavailable services.
+- A malformed linked ref is the one lookup failure that prints an explicit stderr warning (see API Routes above); every other remote failure (network error, expired token, etc.) still fails silently and just leaves `LINKED` empty. Most real-world malformed refs come from an untrimmed `SUPABASE_PROJECT_ID` env var (e.g. a trailing newline from a secrets manager or `.env` file) rather than actual file tampering — the env var is read raw and unlike the on-disk `project-ref` file is never trimmed, matching Go's own `viper.GetString("PROJECT_ID")` (`internal/utils/flags/project_ref.go:62`).
 - Version mismatches are reported to stderr as a warning.
 - `telemetry.json` is written on every invocation, including `--output env` failures, to match the legacy Go command lifecycle.
diff --git a/apps/cli/src/legacy/commands/services/services.handler.ts b/apps/cli/src/legacy/commands/services/services.handler.ts
index f6dd731220..7fa9a9e81b 100644
--- a/apps/cli/src/legacy/commands/services/services.handler.ts
+++ b/apps/cli/src/legacy/commands/services/services.handler.ts
@@ -1,12 +1,16 @@
 import { Effect, Exit, FileSystem, Option, Path } from "effect";
 import { LegacyCliConfig } from "../../config/legacy-cli-config.service.ts";
 import { LegacyCredentials } from "../../auth/legacy-credentials.service.ts";
+import {
+  INVALID_PROJECT_REF_MESSAGE,
+  PROJECT_REF_PATTERN,
+} from "../../config/legacy-project-ref.service.ts";
 import { LegacyLinkedProjectCache } from "../../telemetry/legacy-linked-project-cache.service.ts";
 import { LegacyTelemetryState } from "../../telemetry/legacy-telemetry-state.service.ts";
 import { legacyReadDbToml } from "../../shared/legacy-db-config.toml-read.ts";
 import { legacyResolveDbImage } from "../../shared/legacy-db-image.ts";
 import { legacyResolveEdgeRuntimeImage } from "../../shared/legacy-edge-runtime-image.ts";
-import { legacyTempPaths } from "../../shared/legacy-temp-paths.ts";
+import { legacyReadServiceVersionOverrides } from "../../shared/legacy-service-version-overrides.ts";
 import { LegacyOutputFlag } from "../../../shared/legacy/global-flags.ts";
 import { Output } from "../../../shared/output/output.service.ts";
 import { encodeGoJson, encodeToml, encodeYaml } from "../../shared/legacy-go-output.encoders.ts";
@@ -16,8 +20,6 @@ import {
   formatServicesWarning,
   listLocalServiceVersions,
   type LocalServiceImageOverrides,
-  type LocalServiceVersionName,
-  type LocalServiceVersionOverrides,
   mergeRemoteServiceVersions,
   renderServicesTable,
   renderServicesWarning,
@@ -62,6 +64,21 @@ export const legacyServices = Effect.fn("legacy.services")(function* (_flags: Le
   yield* Effect.gen(function* () {
     const accessTokenExit = yield* credentials.getAccessToken.pipe(Effect.exit);
     const accessToken = Exit.isSuccess(accessTokenExit) ? accessTokenExit.value : Option.none();
+
+    const validLinkedRef = Option.filter(linkedProjectRef, (ref) => PROJECT_REF_PATTERN.test(ref));
+    if (Option.isSome(linkedProjectRef) && Option.isNone(validLinkedRef)) {
+      // Go's `flags.LoadProjectRef` (project_ref.go:54-76) validates the ref but
+      // `cmd/services.go`'s Run only warns on the error and keeps going, so Go
+      // still calls `listRemoteImages` with the malformed ref (services.go:61-62).
+      // TS matches the warning but deliberately skips the remote call instead of
+      // reproducing it: the ref is embedded unescaped into the tenant gateway
+      // hostname in `fetchLinkedServiceVersions`, so proceeding would let a
+      // malformed ref redirect the service-role key to an attacker-controlled host.
+      // Emitted before the config-load warning below to match the order Go's
+      // `Run` prints them in (services.go:18-24).
+      yield* output.raw(`${INVALID_PROJECT_REF_MESSAGE}\n`, "stderr");
+    }
+
     const tomlValues = yield* legacyReadDbToml(
       fs,
       path,
@@ -75,7 +92,7 @@ export const legacyServices = Effect.fn("legacy.services")(function* (_flags: Le
     const serviceVersions =
       tomlValues === null
         ? {}
-        : yield* readLegacyServiceVersionOverrides(
+        : yield* legacyReadServiceVersionOverrides(
             fs,
             path,
             cliConfig.workdir,
@@ -109,11 +126,11 @@ export const legacyServices = Effect.fn("legacy.services")(function* (_flags: Le
     };
 
     let rows = listLocalServiceVersions(localImageOptions);
-    if (Option.isSome(linkedProjectRef) && Option.isSome(accessToken)) {
+    if (Option.isSome(validLinkedRef) && Option.isSome(accessToken)) {
       const remote = yield* fetchLinkedServiceVersions({
         apiUrl: cliConfig.apiUrl,
         projectHost: cliConfig.projectHost,
-        projectRef: linkedProjectRef.value,
+        projectRef: validLinkedRef.value,
         accessToken: accessToken.value,
         userAgent: cliConfig.userAgent,
       });
@@ -166,42 +183,3 @@ export const legacyServices = Effect.fn("legacy.services")(function* (_flags: Le
 function formatConfigLoadError(error: unknown): string {
   return error instanceof Error ? error.message : String(error);
 }
-
-const LEGACY_VERSION_FILES = [
-  ["auth", "gotrue-version", (majorVersion: number | undefined) => (majorVersion ?? 17) > 14],
-  ["postgrest", "rest-version", (majorVersion: number | undefined) => (majorVersion ?? 17) > 14],
-  ["storage", "storage-version"],
-  ["realtime", "realtime-version"],
-  ["studio", "studio-version"],
-  ["pgmeta", "pgmeta-version"],
-  ["analytics", "logflare-version"],
-  ["pooler", "pooler-version"],
-] as const satisfies ReadonlyArray<
-  readonly [LocalServiceVersionName, string, ((majorVersion: number | undefined) => boolean)?]
->;
-
-const readLegacyServiceVersionOverrides = Effect.fnUntraced(function* (
-  fs: FileSystem.FileSystem,
-  path: Path.Path,
-  workdir: string,
-  majorVersion: number | undefined,
-) {
-  const paths = legacyTempPaths(path, workdir);
-  const versions: LocalServiceVersionOverrides = {};
-
-  for (const [service, fileName, shouldRead] of LEGACY_VERSION_FILES) {
-    if (shouldRead !== undefined && !shouldRead(majorVersion)) {
-      continue;
-    }
-
-    const version = yield* fs.readFileString(path.join(paths.tempDir, fileName)).pipe(
-      Effect.map((content) => content.trim()),
-      Effect.orElseSucceed(() => ""),
-    );
-    if (version.length > 0) {
-      versions[service] = version;
-    }
-  }
-
-  return versions;
-});
diff --git a/apps/cli/src/legacy/commands/services/services.integration.test.ts b/apps/cli/src/legacy/commands/services/services.integration.test.ts
index 7e03294354..86c2ceb807 100644
--- a/apps/cli/src/legacy/commands/services/services.integration.test.ts
+++ b/apps/cli/src/legacy/commands/services/services.integration.test.ts
@@ -5,10 +5,11 @@ import { describe, expect, it } from "@effect/vitest";
 import { BunServices } from "@effect/platform-bun";
 import { CliOutput, Command } from "effect/unstable/cli";
 import { Stdio } from "effect";
-import { Cause, Effect, Exit, Layer, Option } from "effect";
+import { Cause, Effect, Exit, Layer, Option, Redacted } from "effect";
 import { FetchHttpClient } from "effect/unstable/http";
 import { LegacyCredentials } from "../../auth/legacy-credentials.service.ts";
 import { LegacyCliConfig } from "../../config/legacy-cli-config.service.ts";
+import { INVALID_PROJECT_REF_MESSAGE } from "../../config/legacy-project-ref.service.ts";
 import { LegacyLinkedProjectCache } from "../../telemetry/legacy-linked-project-cache.service.ts";
 import { LEGACY_GLOBAL_FLAGS, LegacyOutputFlag } from "../../../shared/legacy/global-flags.ts";
 import {
@@ -45,6 +46,8 @@ function setup(
     format?: "text" | "json" | "stream-json";
     goOutput?: Option.Option<"env" | "pretty" | "json" | "toml" | "yaml">;
     workdir?: string;
+    accessToken?: string;
+    apiUrl?: string;
   } = {},
 ) {
   const out = mockOutput({
@@ -68,16 +71,20 @@ function setup(
         LegacyCliConfig,
         LegacyCliConfig.of({
           profile: "supabase",
-          apiUrl: "https://api.supabase.com",
+          apiUrl: opts.apiUrl ?? "https://api.supabase.com",
           projectHost: "supabase.co",
           poolerHost: "supabase.com",
+          dashboardUrl: "https://supabase.com/dashboard",
           accessToken: Option.none(),
           projectId: Option.none(),
           workdir: opts.workdir ?? process.cwd(),
           userAgent: "SupabaseCLI/test",
         }),
       ),
-      Layer.succeed(LegacyCredentials, LegacyCredentials.of(legacyCredentialsMock)),
+      Layer.succeed(
+        LegacyCredentials,
+        LegacyCredentials.of(legacyCredentialsMock(opts.accessToken)),
+      ),
       Layer.succeed(
         LegacyLinkedProjectCache,
         LegacyLinkedProjectCache.of({
@@ -91,13 +98,19 @@ function setup(
   };
 }
 
-const legacyCredentialsMock = {
-  getAccessToken: Effect.succeed(Option.none()),
-  saveAccessToken: () => Effect.die("unexpected saveAccessToken"),
-  deleteAccessToken: Effect.die("unexpected deleteAccessToken"),
-  deleteAllProjectCredentials: Effect.void,
-  deleteProjectCredential: () => Effect.succeed(false),
-};
+function legacyCredentialsMock(accessToken?: string) {
+  return {
+    getAccessToken: Effect.succeed(
+      accessToken === undefined
+        ? Option.none()
+        : Option.some(Redacted.make(accessToken, { label: "SUPABASE_ACCESS_TOKEN" })),
+    ),
+    saveAccessToken: () => Effect.die("unexpected saveAccessToken"),
+    deleteAccessToken: Effect.die("unexpected deleteAccessToken"),
+    deleteAllProjectCredentials: Effect.void,
+    deleteProjectCredential: () => Effect.succeed(false),
+  };
+}
 
 const legacyTestRoot = Command.make("supabase").pipe(
   Command.withGlobalFlags(LEGACY_GLOBAL_FLAGS),
@@ -309,6 +322,112 @@ major_version = 15
     }).pipe(Effect.ensuring(Effect.sync(() => rmSync(workdir, { recursive: true, force: true }))));
   });
 
+  it.live("warns and skips the remote lookup for a malformed linked project ref", () => {
+    const workdir = mkdtempSync(join(tmpdir(), "supabase-services-"));
+    writeTempFile(workdir, "project-ref", "not-a-valid-ref");
+    const { layer, out } = setup({ workdir });
+
+    return Effect.gen(function* () {
+      yield* legacyServices({}).pipe(Effect.provide(layer));
+
+      expect(out.stderrText).toContain(INVALID_PROJECT_REF_MESSAGE);
+      expect(out.stdoutText).toContain("supabase/postgres");
+    }).pipe(Effect.ensuring(Effect.sync(() => rmSync(workdir, { recursive: true, force: true }))));
+  });
+
+  // A token present doesn't bypass the format guard (Go's warning is
+  // unconditional on login too) — same code path as the previous test, so this
+  // isn't new branch coverage, just pinning that login state can't skip it.
+  it.live("still warns on a malformed ref even when logged in", () => {
+    const workdir = mkdtempSync(join(tmpdir(), "supabase-services-"));
+    writeTempFile(workdir, "project-ref", "not-a-valid-ref");
+    const { layer, out } = setup({ workdir, accessToken: "sbp_test-token" });
+
+    return Effect.gen(function* () {
+      yield* legacyServices({}).pipe(Effect.provide(layer));
+
+      expect(out.stderrText).toContain(INVALID_PROJECT_REF_MESSAGE);
+      expect(out.stdoutText).toContain("supabase/postgres");
+    }).pipe(Effect.ensuring(Effect.sync(() => rmSync(workdir, { recursive: true, force: true }))));
+  });
+
+  it.live("fetches and merges remote versions for a valid ref when logged in", () => {
+    const workdir = mkdtempSync(join(tmpdir(), "supabase-services-"));
+    writeTempFile(workdir, "project-ref", "abcdefghijklmnopqrst");
+
+    const server = Bun.serve({
+      port: 0,
+      fetch(request) {
+        const url = new URL(request.url);
+        if (url.pathname === "/v1/projects/abcdefghijklmnopqrst") {
+          return Response.json({
+            id: "abcdefghijklmnopqrst",
+            ref: "abcdefghijklmnopqrst",
+            organization_id: "org-id",
+            organization_slug: "org",
+            name: "Linked Project",
+            region: "us-east-1",
+            created_at: "2026-03-13T12:00:00.000Z",
+            status: "ACTIVE_HEALTHY",
+            database: {
+              host: "db.supabase.internal",
+              version: "17.6.1.200",
+              postgres_engine: "17",
+              release_channel: "ga",
+            },
+          });
+        }
+
+        if (url.pathname === "/v1/projects/abcdefghijklmnopqrst/api-keys") {
+          // Deliberately no service-role key: this test only needs to prove the
+          // handler wires the fetch+merge branch through, not re-test
+          // `fetchLinkedServiceVersions`'s own tenant-probe logic (already
+          // covered in services.shared.unit.test.ts). Omitting the
+          // service-role key keeps this test free of a second, tenant-gateway
+          // mock without weakening the assertion below.
+          return Response.json([
+            {
+              name: "anon",
+              id: "publishable-id",
+              type: "publishable",
+              api_key: "publishable-key",
+              description: null,
+            },
+          ]);
+        }
+
+        return new Response("not found", { status: 404 });
+      },
+    });
+
+    const { layer, out } = setup({
+      workdir,
+      accessToken: "sbp_test-token",
+      apiUrl: server.url.origin,
+      goOutput: Option.some("json"),
+    });
+
+    return Effect.gen(function* () {
+      yield* legacyServices({}).pipe(Effect.provide(layer));
+
+      expect(out.stderrText).not.toContain(INVALID_PROJECT_REF_MESSAGE);
+      const rows = JSON.parse(out.stdoutText) as Array<{
+        name: string;
+        local: string;
+        remote: string;
+      }>;
+      expect(rows).toContainEqual(
+        expect.objectContaining({ name: "supabase/postgres", remote: "17.6.1.200" }),
+      );
+    }).pipe(
+      Effect.ensuring(
+        Effect.promise(() => server.stop(true)).pipe(
+          Effect.andThen(Effect.sync(() => rmSync(workdir, { recursive: true, force: true }))),
+        ),
+      ),
+    );
+  });
+
   it.live("reports pinned legacy temp service versions", () => {
     const workdir = makeProjectWithDbMajorVersion(15);
     writeTempFile(workdir, "postgres-version", "15.1.0.117\n");
diff --git a/apps/cli/src/legacy/commands/snippets/download/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/snippets/download/SIDE_EFFECTS.md
index 19f3323f9e..ec7b0f9f11 100644
--- a/apps/cli/src/legacy/commands/snippets/download/SIDE_EFFECTS.md
+++ b/apps/cli/src/legacy/commands/snippets/download/SIDE_EFFECTS.md
@@ -7,7 +7,7 @@
 | keyring `"Supabase CLI"` / `<profile>`         | OS keychain               | when `SUPABASE_ACCESS_TOKEN` unset and keyring available; account = `LegacyCliConfig.profile` |
 | keyring `"Supabase CLI"` / `access-token`      | OS keychain               | legacy-key fallback when the profile-keyed lookup misses                                      |
 | `~/.supabase/access-token`                     | plain text (token string) | last-resort fallback after env + keyring miss                                                 |
-| `<workdir>/supabase/.temp/project-ref`         | plain text                | when `--project-ref` flag and `PROJECT_ID` env are unset                                      |
+| `<workdir>/supabase/.temp/project-ref`         | plain text                | when `--project-ref` flag and `SUPABASE_PROJECT_ID` env are unset                             |
 | `<workdir>/supabase/.temp/linked-project.json` | JSON                      | always — `linkedProjectCache` reads to decide whether to write                                |
 
 ## Files Written
@@ -30,8 +30,7 @@ Only `content.sql` is rendered in text mode. The full payload is exposed via `--
 | Variable                | Purpose                                              | Required?                                               |
 | ----------------------- | ---------------------------------------------------- | ------------------------------------------------------- |
 | `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `~/.supabase/access-token`) |
-| `PROJECT_ID`            | project ref fallback when `--project-ref` is unset   | no (falls back to `supabase/.temp/project-ref`)         |
-| `SUPABASE_API_URL`      | override Management API base URL                     | no (defaults to `https://api.supabase.com`)             |
+| `SUPABASE_PROJECT_ID`   | project ref fallback when `--project-ref` is unset   | no (falls back to `supabase/.temp/project-ref`)         |
 | `SUPABASE_PROFILE`      | profile selector (built-in name or YAML file path)   | no (defaults to `supabase`)                             |
 
 ## Exit Codes
diff --git a/apps/cli/src/legacy/commands/snippets/list/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/snippets/list/SIDE_EFFECTS.md
index 867b2331ac..85e3717180 100644
--- a/apps/cli/src/legacy/commands/snippets/list/SIDE_EFFECTS.md
+++ b/apps/cli/src/legacy/commands/snippets/list/SIDE_EFFECTS.md
@@ -7,7 +7,7 @@
 | keyring `"Supabase CLI"` / `<profile>`         | OS keychain               | when `SUPABASE_ACCESS_TOKEN` unset and keyring available; account = `LegacyCliConfig.profile` |
 | keyring `"Supabase CLI"` / `access-token`      | OS keychain               | legacy-key fallback when the profile-keyed lookup misses                                      |
 | `~/.supabase/access-token`                     | plain text (token string) | last-resort fallback after env + keyring miss                                                 |
-| `<workdir>/supabase/.temp/project-ref`         | plain text                | when `--project-ref` flag and `PROJECT_ID` env are unset                                      |
+| `<workdir>/supabase/.temp/project-ref`         | plain text                | when `--project-ref` flag and `SUPABASE_PROJECT_ID` env are unset                             |
 | `<workdir>/supabase/.temp/linked-project.json` | JSON                      | always — `linkedProjectCache` reads to decide whether to write                                |
 
 ## Files Written
@@ -28,8 +28,7 @@
 | Variable                | Purpose                                              | Required?                                               |
 | ----------------------- | ---------------------------------------------------- | ------------------------------------------------------- |
 | `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `~/.supabase/access-token`) |
-| `PROJECT_ID`            | project ref fallback when `--project-ref` is unset   | no (falls back to `supabase/.temp/project-ref`)         |
-| `SUPABASE_API_URL`      | override Management API base URL                     | no (defaults to `https://api.supabase.com`)             |
+| `SUPABASE_PROJECT_ID`   | project ref fallback when `--project-ref` is unset   | no (falls back to `supabase/.temp/project-ref`)         |
 | `SUPABASE_PROFILE`      | profile selector (built-in name or YAML file path)   | no (defaults to `supabase`)                             |
 
 ## Exit Codes
diff --git a/apps/cli/src/legacy/commands/ssl-enforcement/get/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/ssl-enforcement/get/SIDE_EFFECTS.md
index ccf0e03d43..d56ed25db2 100644
--- a/apps/cli/src/legacy/commands/ssl-enforcement/get/SIDE_EFFECTS.md
+++ b/apps/cli/src/legacy/commands/ssl-enforcement/get/SIDE_EFFECTS.md
@@ -2,10 +2,10 @@
 
 ## Files Read
 
-| Path                                   | Format                    | When                                                          |
-| -------------------------------------- | ------------------------- | ------------------------------------------------------------- |
-| `~/.supabase/access-token`             | plain text (token string) | when `SUPABASE_ACCESS_TOKEN` unset and keyring unavailable    |
-| `<workdir>/supabase/.temp/project-ref` | plain text (project ref)  | when `--project-ref` flag and `PROJECT_ID` env are both unset |
+| Path                                   | Format                    | When                                                                   |
+| -------------------------------------- | ------------------------- | ---------------------------------------------------------------------- |
+| `~/.supabase/access-token`             | plain text (token string) | when `SUPABASE_ACCESS_TOKEN` unset and keyring unavailable             |
+| `<workdir>/supabase/.temp/project-ref` | plain text (project ref)  | when `--project-ref` flag and `SUPABASE_PROJECT_ID` env are both unset |
 
 ## Files Written
 
@@ -25,8 +25,8 @@
 | Variable                | Purpose                                                  | Required?                                                      |
 | ----------------------- | -------------------------------------------------------- | -------------------------------------------------------------- |
 | `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup)     | no (falls back to keyring → `~/.supabase/access-token`)        |
-| `SUPABASE_API_URL`      | override Management API base URL                         | no (defaults to `https://api.supabase.com`)                    |
-| `PROJECT_ID`            | project ref fallback when `--project-ref` is unset       | no (falls back to `supabase/.temp/project-ref` → prompt)       |
+| `SUPABASE_PROFILE`      | built-in profile name or YAML file path                  | no (falls back to `~/.supabase/profile` -> `supabase`)         |
+| `SUPABASE_PROJECT_ID`   | project ref fallback when `--project-ref` is unset       | no (falls back to `supabase/.temp/project-ref` → prompt)       |
 | `SUPABASE_EXPERIMENTAL` | enables `--experimental`-gated commands without the flag | no (pass `--experimental` instead; one of the two is required) |
 
 ## Exit Codes
diff --git a/apps/cli/src/legacy/commands/ssl-enforcement/update/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/ssl-enforcement/update/SIDE_EFFECTS.md
index 6f067ad6b5..2a5657772a 100644
--- a/apps/cli/src/legacy/commands/ssl-enforcement/update/SIDE_EFFECTS.md
+++ b/apps/cli/src/legacy/commands/ssl-enforcement/update/SIDE_EFFECTS.md
@@ -2,10 +2,10 @@
 
 ## Files Read
 
-| Path                                   | Format                    | When                                                          |
-| -------------------------------------- | ------------------------- | ------------------------------------------------------------- |
-| `~/.supabase/access-token`             | plain text (token string) | when `SUPABASE_ACCESS_TOKEN` unset and keyring unavailable    |
-| `<workdir>/supabase/.temp/project-ref` | plain text (project ref)  | when `--project-ref` flag and `PROJECT_ID` env are both unset |
+| Path                                   | Format                    | When                                                                   |
+| -------------------------------------- | ------------------------- | ---------------------------------------------------------------------- |
+| `~/.supabase/access-token`             | plain text (token string) | when `SUPABASE_ACCESS_TOKEN` unset and keyring unavailable             |
+| `<workdir>/supabase/.temp/project-ref` | plain text (project ref)  | when `--project-ref` flag and `SUPABASE_PROJECT_ID` env are both unset |
 
 ## Files Written
 
@@ -25,8 +25,8 @@
 | Variable                | Purpose                                                  | Required?                                                      |
 | ----------------------- | -------------------------------------------------------- | -------------------------------------------------------------- |
 | `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup)     | no (falls back to keyring → `~/.supabase/access-token`)        |
-| `SUPABASE_API_URL`      | override Management API base URL                         | no (defaults to `https://api.supabase.com`)                    |
-| `PROJECT_ID`            | project ref fallback when `--project-ref` is unset       | no (falls back to `supabase/.temp/project-ref` → prompt)       |
+| `SUPABASE_PROFILE`      | built-in profile name or YAML file path                  | no (falls back to `~/.supabase/profile` -> `supabase`)         |
+| `SUPABASE_PROJECT_ID`   | project ref fallback when `--project-ref` is unset       | no (falls back to `supabase/.temp/project-ref` → prompt)       |
 | `SUPABASE_EXPERIMENTAL` | enables `--experimental`-gated commands without the flag | no (pass `--experimental` instead; one of the two is required) |
 
 ## Exit Codes
diff --git a/apps/cli/src/legacy/commands/sso/add/add.command.ts b/apps/cli/src/legacy/commands/sso/add/add.command.ts
index 4030c121a3..e48071520e 100644
--- a/apps/cli/src/legacy/commands/sso/add/add.command.ts
+++ b/apps/cli/src/legacy/commands/sso/add/add.command.ts
@@ -84,7 +84,16 @@ export const legacySsoAddCommand = Command.make("add", config).pipe(
   ]),
   Command.withHandler((flags) =>
     legacySsoAdd(flags).pipe(
-      withLegacyCommandInstrumentation({ flags, safeFlags: ["project-ref"] }),
+      withLegacyCommandInstrumentation({
+        flags,
+        safeFlags: ["project-ref"],
+        config,
+        // `--type` registers `-t` (Flag.withAlias above); without this, `-t saml`
+        // never resolves to the canonical `type` name in extractChangedFlagNames,
+        // so it wouldn't appear in telemetry at all (Go's pflag.Visit reports the
+        // canonical name regardless of shorthand — cmd/root_analytics.go:53-76).
+        aliases: { t: "type" },
+      }),
       withJsonErrorHandling,
     ),
   ),
diff --git a/apps/cli/src/legacy/commands/sso/sso.e2e.test.ts b/apps/cli/src/legacy/commands/sso/sso.e2e.test.ts
index 795b71200a..b2b1636c51 100644
--- a/apps/cli/src/legacy/commands/sso/sso.e2e.test.ts
+++ b/apps/cli/src/legacy/commands/sso/sso.e2e.test.ts
@@ -69,4 +69,53 @@ describe("supabase sso (legacy)", () => {
       expect(`${stdout}${stderr}`).toContain(`identity provider ID "not-a-uuid" is not a UUID`);
     },
   );
+
+  // CLI-1901: `add`'s `--type` has no `Flag.optional` (see `add.command.ts`)
+  // — Go marks it required via `MarkFlagRequired("type")` (`cmd/sso.go:65`)
+  // — so a missing/invalid `--type` used to dump the full help doc to
+  // stdout AND print the error twice on stderr. No auth/network call ever
+  // happens for either case: flag parsing fails before the handler runs.
+  //
+  // A missing required flag and an invalid choice value get different
+  // treatment, matching the real `apps/cli-go/supabase-go` binary (verified
+  // directly against it): Go's `PersistentPreRunE` sets `SilenceUsage = true`
+  // (`cmd/root.go:97`) BEFORE `ValidateRequiredFlags` runs, so a missing
+  // `--type` is a single clean stderr line with no usage block — but
+  // `Flag.choice` validation happens during `ParseFlags`, BEFORE that point,
+  // so Go still shows a usage block for an invalid `--type` value, always on
+  // stderr, never stdout.
+  test(
+    "add without --type: stdout stays clean, stderr is a single Go-parity line (no usage block)",
+    { timeout: E2E_TIMEOUT_MS },
+    async () => {
+      const { exitCode, stdout, stderr } = await runSupabase(
+        ["sso", "add", "--project-ref", TEST_PROJECT_REF],
+        { entrypoint: "legacy" },
+      );
+      expect(exitCode).toBe(1);
+      expect(stdout).toBe("");
+      expect(stderr).toContain(`required flag(s) "type" not set`);
+      expect(stderr).not.toContain("USAGE");
+      expect(stderr.trim().split("\n")).toHaveLength(2);
+    },
+  );
+
+  test(
+    "add with an invalid --type value: stdout stays clean, the usage content and the single error line land on stderr with no duplicate",
+    { timeout: E2E_TIMEOUT_MS },
+    async () => {
+      const { exitCode, stdout, stderr } = await runSupabase(
+        ["sso", "add", "--type", "bogus", "--project-ref", TEST_PROJECT_REF],
+        { entrypoint: "legacy" },
+      );
+      expect(exitCode).toBe(1);
+      expect(stdout).toBe("");
+      expect(stderr).toContain("USAGE");
+      const occurrences = stderr.split(`Invalid value for flag --type: "bogus"`).length - 1;
+      expect(occurrences).toBe(1);
+      expect(
+        stderr.trim().endsWith("Try rerunning the command with --debug to troubleshoot the error."),
+      ).toBe(true);
+    },
+  );
 });
diff --git a/apps/cli/src/legacy/commands/sso/update/update.command.ts b/apps/cli/src/legacy/commands/sso/update/update.command.ts
index cf6732ddca..2f61eecc19 100644
--- a/apps/cli/src/legacy/commands/sso/update/update.command.ts
+++ b/apps/cli/src/legacy/commands/sso/update/update.command.ts
@@ -106,7 +106,7 @@ export const legacySsoUpdateCommand = Command.make("update", config).pipe(
   ]),
   Command.withHandler((flags) =>
     legacySsoUpdate(flags).pipe(
-      withLegacyCommandInstrumentation({ flags, safeFlags: ["project-ref"] }),
+      withLegacyCommandInstrumentation({ flags, safeFlags: ["project-ref"], config }),
       withJsonErrorHandling,
     ),
   ),
diff --git a/apps/cli/src/legacy/commands/sso/update/update.command.unit.test.ts b/apps/cli/src/legacy/commands/sso/update/update.command.unit.test.ts
index 0afeb0e4d2..6f88558830 100644
--- a/apps/cli/src/legacy/commands/sso/update/update.command.unit.test.ts
+++ b/apps/cli/src/legacy/commands/sso/update/update.command.unit.test.ts
@@ -47,6 +47,23 @@ describe("legacy sso update domain flags (pflag StringSlice parity)", () => {
     expect(removeDomains).toEqual(["example.com", "example.org"]);
   });
 
+  test("--domains= (explicit empty value) parses to an empty array, not a missing flag", async () => {
+    // Backs the "changed vs truthy" mutex-check fix (CLI-1902): the handler's
+    // `hasExplicitLongFlag` reads raw argv rather than this parsed value
+    // precisely because `--domains=` collapses to `[]` here, indistinguishable
+    // from the flag never being passed at all if you only looked at `.length`.
+    const [, domains] = await Effect.runPromise(
+      legacySsoUpdateDomainsFlag
+        .parse({
+          flags: { domains: [""] },
+          arguments: [],
+        })
+        .pipe(Effect.provide(BunServices.layer)),
+    );
+
+    expect(domains).toEqual([]);
+  });
+
   test("rejects malformed CSV (bare quote)", async () => {
     const exit = await Effect.runPromise(
       legacySsoUpdateDomainsFlag
diff --git a/apps/cli/src/legacy/commands/sso/update/update.handler.ts b/apps/cli/src/legacy/commands/sso/update/update.handler.ts
index ca86765455..aba1d6833f 100644
--- a/apps/cli/src/legacy/commands/sso/update/update.handler.ts
+++ b/apps/cli/src/legacy/commands/sso/update/update.handler.ts
@@ -1,5 +1,5 @@
 import type { SupabaseApiError } from "@supabase/api/effect";
-import { Effect, Option, Result } from "effect";
+import { Effect, Option, Result, Stdio } from "effect";
 import * as HttpClient from "effect/unstable/http/HttpClient";
 import * as HttpClientRequest from "effect/unstable/http/HttpClientRequest";
 
@@ -7,6 +7,10 @@ import { LegacyPlatformApi } from "../../../auth/legacy-platform-api.service.ts"
 import { LegacyCliConfig } from "../../../config/legacy-cli-config.service.ts";
 import { LegacyProjectRefResolver } from "../../../config/legacy-project-ref.service.ts";
 import { LegacyOutputFlag } from "../../../../shared/legacy/global-flags.ts";
+import {
+  cobraMutuallyExclusiveErrorMessage,
+  hasExplicitValueFlag,
+} from "../../../../shared/cli/cobra-flag-groups.ts";
 import { Output } from "../../../../shared/output/output.service.ts";
 import {
   encodeGoJson,
@@ -48,6 +52,40 @@ const mapGetStatusOrNetwork = mapLegacyHttpError({
   statusMessage: (_status, body) => `unexpected error fetching identity provider: ${body}`,
 });
 
+const SSO_UPDATE_COMMAND_PATH = ["sso", "update"] as const;
+
+/**
+ * Registration order mirrors Go's `cmd/sso.go:178-180` — three independent
+ * `MarkFlagsMutuallyExclusive` groups (`metadata-file`/`metadata-url` plus two
+ * 2-element groups sharing `--domains`, not one 3-way group). Cobra checks
+ * groups in `sort.Strings`-order of the joined group key (`flag_groups.go:189`),
+ * which happens to match registration order here: "domains add-domains" <
+ * "domains remove-domains" < "metadata-file metadata-url" alphabetically.
+ */
+const SSO_UPDATE_MUTEX_GROUPS = [
+  ["domains", "add-domains"],
+  ["domains", "remove-domains"],
+  ["metadata-file", "metadata-url"],
+] as const;
+
+/**
+ * Every value-taking (non-boolean) flag `sso update` declares
+ * (`update.command.ts`) — tells `hasExplicitValueFlag` which bare tokens
+ * consume the next argv token as their value. `--skip-url-validation` is this
+ * command's only boolean flag and is deliberately excluded; booleans never
+ * consume a following token.
+ */
+const SSO_UPDATE_VALUE_FLAG_NAMES = new Set([
+  "project-ref",
+  "domains",
+  "add-domains",
+  "remove-domains",
+  "metadata-file",
+  "metadata-url",
+  "attribute-mapping-file",
+  "name-id-format",
+]);
+
 const handleGetError = (ref: string, providerId: string, cause: SupabaseApiError) =>
   Effect.gen(function* () {
     const mapped = yield* Effect.flip(mapGetStatusOrNetwork(cause));
@@ -104,34 +142,50 @@ export const legacySsoUpdate = Effect.fn("legacy.sso.update")(function* (
   const resolver = yield* LegacyProjectRefResolver;
   const linkedProjectCache = yield* LegacyLinkedProjectCache;
   const telemetryState = yield* LegacyTelemetryState;
+  const stdio = yield* Stdio.Stdio;
+  const rawArgs = yield* stdio.args;
 
   yield* Effect.gen(function* () {
+    // cobra runs `ValidateFlagGroups` (`command.go:1010`) before `RunE`
+    // (`command.go:1014`), and Go's provider-ID format check lives inside
+    // `RunE` (`cmd/sso.go:90-91`) — so a mutex violation must win over an
+    // invalid provider ID when both apply. Keep this block ahead of
+    // `validateUuid` below to match that precedence.
+    //
+    // "Set" follows cobra's `pflag.Changed` — whether the flag was passed at
+    // all — not the resulting value. `--domains`/`--add-domains`/
+    // `--remove-domains` all default to `[]`, so `--domains=` (parses to an
+    // empty array) must still count as "set"; gating on `.length > 0` would
+    // miss it, the same "changed vs truthy" gap CLI-1860 fixed for
+    // `functions download`'s `--use-docker`.
+    //
+    // `hasExplicitValueFlag` (not the simpler `hasExplicitLongFlag`) is
+    // required here because every flag in these groups takes a value: a bare
+    // `--metadata-file --metadata-url` is pflag consuming `--metadata-url` as
+    // `metadata-file`'s (oddly named) value, not two flags being set — see
+    // that function's doc comment.
+    for (const group of SSO_UPDATE_MUTEX_GROUPS) {
+      const changed = group.filter((flagName) =>
+        hasExplicitValueFlag(
+          rawArgs,
+          SSO_UPDATE_COMMAND_PATH,
+          SSO_UPDATE_VALUE_FLAG_NAMES,
+          flagName,
+        ),
+      );
+      if (changed.length > 1) {
+        return yield* Effect.fail(
+          new LegacySsoMutexFlagError({
+            message: cobraMutuallyExclusiveErrorMessage(group, changed),
+          }),
+        );
+      }
+    }
+
     const providerId = yield* validateUuid(flags.providerId).pipe(
       Result.match({ onFailure: Effect.fail, onSuccess: Effect.succeed }),
     );
 
-    if (flags.domains.length > 0 && flags.addDomains.length > 0) {
-      return yield* Effect.fail(
-        new LegacySsoMutexFlagError({
-          message: "only one of --domains or --add-domains may be set",
-        }),
-      );
-    }
-    if (flags.domains.length > 0 && flags.removeDomains.length > 0) {
-      return yield* Effect.fail(
-        new LegacySsoMutexFlagError({
-          message: "only one of --domains or --remove-domains may be set",
-        }),
-      );
-    }
-    if (Option.isSome(flags.metadataFile) && Option.isSome(flags.metadataUrl)) {
-      return yield* Effect.fail(
-        new LegacySsoMutexFlagError({
-          message: "only one of --metadata-file or --metadata-url may be set",
-        }),
-      );
-    }
-
     const ref = yield* resolver.resolve(flags.projectRef);
 
     yield* Effect.gen(function* () {
diff --git a/apps/cli/src/legacy/commands/sso/update/update.integration.test.ts b/apps/cli/src/legacy/commands/sso/update/update.integration.test.ts
index c1060092cb..c76206a29b 100644
--- a/apps/cli/src/legacy/commands/sso/update/update.integration.test.ts
+++ b/apps/cli/src/legacy/commands/sso/update/update.integration.test.ts
@@ -2,7 +2,7 @@ import { writeFileSync } from "node:fs";
 import { join } from "node:path";
 
 import { describe, expect, it } from "@effect/vitest";
-import { Effect, Exit, Option } from "effect";
+import { Effect, Exit, Layer, Option, Stdio } from "effect";
 import * as HttpClientResponse from "effect/unstable/http/HttpClientResponse";
 
 import { mockAnalytics, mockOutput } from "../../../../../tests/helpers/mocks.ts";
@@ -45,6 +45,13 @@ interface SetupOpts {
   putStatus?: number;
   putBody?: unknown;
   upgradeGate?: "gated" | "notGated";
+  /**
+   * Raw argv the handler sees via `Stdio.Stdio` — drives the
+   * `hasExplicitLongFlag`-based mutex checks. Defaults to a bare invocation
+   * with none of the mutually-exclusive domain flags present; tests that
+   * exercise those checks must pass the matching flags explicitly here.
+   */
+  cliArgs?: ReadonlyArray<string>;
 }
 
 function jsonResponse(
@@ -122,15 +129,20 @@ function setup(opts: SetupOpts = {}) {
   });
 
   const cliConfig = mockLegacyCliConfig({ workdir: tempRoot.current });
-  const layer = buildLegacyTestRuntime({
-    out,
-    api: { layer: api.layer, httpClientLayer: api.httpClientLayer },
-    cliConfig,
-    telemetry: telemetry.layer,
-    linkedProjectCache: cache.layer,
-    analytics,
-    goOutput: opts.goOutput === undefined ? Option.none() : Option.some(opts.goOutput),
-  });
+  const layer = Layer.mergeAll(
+    buildLegacyTestRuntime({
+      out,
+      api: { layer: api.layer, httpClientLayer: api.httpClientLayer },
+      cliConfig,
+      telemetry: telemetry.layer,
+      linkedProjectCache: cache.layer,
+      analytics,
+      goOutput: opts.goOutput === undefined ? Option.none() : Option.some(opts.goOutput),
+    }),
+    Stdio.layerTest({
+      args: Effect.succeed(opts.cliArgs ?? ["sso", "update", VALID_PROVIDER_ID]),
+    }),
+  );
 
   return { layer, out, api, analytics, telemetry, cache };
 }
@@ -200,40 +212,237 @@ describe("legacy sso update integration", () => {
     }).pipe(Effect.provide(layer));
   });
 
-  it.live("mutex check: --domains + --add-domains fails", () => {
-    const { layer } = setup();
+  it.live("mutex check: --domains + --add-domains fails with cobra's exact error text", () => {
+    const { layer } = setup({
+      cliArgs: ["sso", "update", VALID_PROVIDER_ID, "--domains", "a.com", "--add-domains", "b.com"],
+    });
     return Effect.gen(function* () {
       const exit = yield* Effect.exit(
         legacySsoUpdate({ ...defaultFlags, domains: ["a.com"], addDomains: ["b.com"] }),
       );
       expect(Exit.isFailure(exit)).toBe(true);
       if (Exit.isFailure(exit)) {
-        expect(JSON.stringify(exit.cause)).toContain("LegacySsoMutexFlagError");
+        const dump = JSON.stringify(exit.cause);
+        expect(dump).toContain("LegacySsoMutexFlagError");
+        // Byte-matches cobra's `validateExclusiveFlagGroups` template
+        // (`flag_groups.go:204`): group in registration order, changed flags
+        // sorted alphabetically — "add-domains" < "domains".
+        expect(dump).toContain(
+          "if any flags in the group [domains add-domains] are set none of the others can be; [add-domains domains] were all set",
+        );
       }
     }).pipe(Effect.provide(layer));
   });
 
-  it.live("mutex check: --domains + --remove-domains fails", () => {
-    const { layer } = setup();
+  it.live("mutex check: --domains + --remove-domains fails with cobra's exact error text", () => {
+    const { layer } = setup({
+      cliArgs: [
+        "sso",
+        "update",
+        VALID_PROVIDER_ID,
+        "--domains",
+        "a.com",
+        "--remove-domains",
+        "b.com",
+      ],
+    });
     return Effect.gen(function* () {
       const exit = yield* Effect.exit(
         legacySsoUpdate({ ...defaultFlags, domains: ["a.com"], removeDomains: ["b.com"] }),
       );
       expect(Exit.isFailure(exit)).toBe(true);
+      if (Exit.isFailure(exit)) {
+        const dump = JSON.stringify(exit.cause);
+        expect(dump).toContain("LegacySsoMutexFlagError");
+        expect(dump).toContain(
+          "if any flags in the group [domains remove-domains] are set none of the others can be; [domains remove-domains] were all set",
+        );
+      }
     }).pipe(Effect.provide(layer));
   });
 
-  it.live("mutex check: --metadata-file + --metadata-url fails", () => {
-    const { layer } = setup();
+  it.live(
+    "mutex check: an explicit but empty --domains= still conflicts with --add-domains (changed, not truthy)",
+    () => {
+      // `--domains=` parses to an empty array, but cobra's `pflag.Changed`
+      // tracks that the flag was passed at all, not the resulting value — the
+      // same "changed vs truthy" gap CLI-1860 fixed for `functions download`'s
+      // `--use-docker`. Gating on `.length > 0` would miss this combination.
+      const { layer } = setup({
+        cliArgs: ["sso", "update", VALID_PROVIDER_ID, "--domains=", "--add-domains", "b.com"],
+      });
+      return Effect.gen(function* () {
+        const exit = yield* Effect.exit(
+          legacySsoUpdate({ ...defaultFlags, domains: [], addDomains: ["b.com"] }),
+        );
+        expect(Exit.isFailure(exit)).toBe(true);
+        if (Exit.isFailure(exit)) {
+          expect(JSON.stringify(exit.cause)).toContain("LegacySsoMutexFlagError");
+        }
+      }).pipe(Effect.provide(layer));
+    },
+  );
+
+  it.live(
+    "mutex check: --add-domains and --remove-domains together are not mutually exclusive",
+    () => {
+      // Go only registers ("domains","add-domains") and ("domains","remove-domains")
+      // as separate 2-element groups (`cmd/sso.go:179-180`) — add-domains and
+      // remove-domains together, without --domains, is not a violation.
+      const { layer } = setup({
+        cliArgs: [
+          "sso",
+          "update",
+          VALID_PROVIDER_ID,
+          "--add-domains",
+          "b.com",
+          "--remove-domains",
+          "c.com",
+        ],
+      });
+      return Effect.gen(function* () {
+        const exit = yield* Effect.exit(
+          legacySsoUpdate({ ...defaultFlags, addDomains: ["b.com"], removeDomains: ["c.com"] }),
+        );
+        expect(Exit.isSuccess(exit)).toBe(true);
+      }).pipe(Effect.provide(layer));
+    },
+  );
+
+  it.live("mutex check: all three domain flags set reports the --add-domains group first", () => {
+    // Pins the `SSO_UPDATE_MUTEX_GROUPS` array order: cobra's sorted-key
+    // iteration ("domains add-domains" < "domains remove-domains") means the
+    // add-domains group is checked — and its error returned — first when all
+    // three domain flags collide at once.
+    const { layer } = setup({
+      cliArgs: [
+        "sso",
+        "update",
+        VALID_PROVIDER_ID,
+        "--domains",
+        "a.com",
+        "--add-domains",
+        "b.com",
+        "--remove-domains",
+        "c.com",
+      ],
+    });
+    return Effect.gen(function* () {
+      const exit = yield* Effect.exit(
+        legacySsoUpdate({
+          ...defaultFlags,
+          domains: ["a.com"],
+          addDomains: ["b.com"],
+          removeDomains: ["c.com"],
+        }),
+      );
+      expect(Exit.isFailure(exit)).toBe(true);
+      if (Exit.isFailure(exit)) {
+        const dump = JSON.stringify(exit.cause);
+        expect(dump).toContain(
+          "if any flags in the group [domains add-domains] are set none of the others can be; [add-domains domains] were all set",
+        );
+        expect(dump).not.toContain("remove-domains");
+      }
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("mutex check: a flag-group violation wins over an invalid provider ID", () => {
+    // Cobra runs `ValidateFlagGroups` before `RunE` (`command.go:1010,1014`);
+    // Go's provider-ID format check lives inside `RunE` (`cmd/sso.go:90-91`).
+    // So an invalid UUID combined with a mutex violation must surface the
+    // mutex error, not `LegacySsoInvalidUuidError`.
+    const { layer } = setup({
+      cliArgs: ["sso", "update", "not-a-uuid", "--domains", "a.com", "--add-domains", "b.com"],
+    });
     return Effect.gen(function* () {
       const exit = yield* Effect.exit(
         legacySsoUpdate({
           ...defaultFlags,
-          metadataFile: Option.some("/tmp/x.xml"),
-          metadataUrl: Option.some("https://idp.example.com/m"),
+          providerId: "not-a-uuid",
+          domains: ["a.com"],
+          addDomains: ["b.com"],
         }),
       );
       expect(Exit.isFailure(exit)).toBe(true);
+      if (Exit.isFailure(exit)) {
+        const dump = JSON.stringify(exit.cause);
+        expect(dump).toContain("LegacySsoMutexFlagError");
+        expect(dump).not.toContain("LegacySsoInvalidUuidError");
+      }
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live(
+    "mutex check: --metadata-file + --metadata-url fails with cobra's exact error text",
+    () => {
+      const { layer } = setup({
+        cliArgs: [
+          "sso",
+          "update",
+          VALID_PROVIDER_ID,
+          "--metadata-file",
+          "/tmp/x.xml",
+          "--metadata-url",
+          "https://idp.example.com/m",
+        ],
+      });
+      return Effect.gen(function* () {
+        const exit = yield* Effect.exit(
+          legacySsoUpdate({
+            ...defaultFlags,
+            metadataFile: Option.some("/tmp/x.xml"),
+            metadataUrl: Option.some("https://idp.example.com/m"),
+          }),
+        );
+        expect(Exit.isFailure(exit)).toBe(true);
+        if (Exit.isFailure(exit)) {
+          const dump = JSON.stringify(exit.cause);
+          expect(dump).toContain("LegacySsoMutexFlagError");
+          // Go registers this pair too (`cmd/sso.go:178`) — it was left emitting
+          // a hand-written message alongside the domains groups' custom text
+          // before this fix; now all three of `sso update`'s mutex groups on
+          // this command share the same byte-exact cobra template.
+          expect(dump).toContain(
+            "if any flags in the group [metadata-file metadata-url] are set none of the others can be; [metadata-file metadata-url] were all set",
+          );
+        }
+      }).pipe(Effect.provide(layer));
+    },
+  );
+
+  it.live(
+    "mutex check: a bare --metadata-file followed by --metadata-url is not a violation",
+    () => {
+      // pflag's `--flag arg` branch consumes the very next argv token as the
+      // value unconditionally (`flag.go:1013-1031`), so real cobra parses this
+      // as `metadata-file` receiving the literal value `"--metadata-url"` —
+      // `metadata-url` is never parsed as its own flag and stays unset. The
+      // TS CLI's own parser (unlike pflag) never hands a dash-prefixed token
+      // to a non-boolean flag as a bare value, so here both flags resolve to
+      // `Option.none()` — but the raw-argv mutex scan must reach the same
+      // "not a violation" conclusion pflag does, not double-count the
+      // `--metadata-url` token as a second explicit flag.
+      const { layer } = setup({
+        cliArgs: ["sso", "update", VALID_PROVIDER_ID, "--metadata-file", "--metadata-url"],
+      });
+      return Effect.gen(function* () {
+        const exit = yield* Effect.exit(legacySsoUpdate(defaultFlags));
+        expect(Exit.isSuccess(exit)).toBe(true);
+      }).pipe(Effect.provide(layer));
+    },
+  );
+
+  it.live("mutex check: a bare --add-domains followed by --domains=... is not a violation", () => {
+    // Same consumed-value class as the metadata-file/metadata-url case
+    // above, but for the domains group: pflag would hand `add-domains` the
+    // literal value `"--domains=x.com"` and never parse `--domains` at all.
+    const { layer } = setup({
+      cliArgs: ["sso", "update", VALID_PROVIDER_ID, "--add-domains", "--domains=x.com"],
+    });
+    return Effect.gen(function* () {
+      const exit = yield* Effect.exit(legacySsoUpdate(defaultFlags));
+      expect(Exit.isSuccess(exit)).toBe(true);
     }).pipe(Effect.provide(layer));
   });
 
diff --git a/apps/cli/src/legacy/commands/start/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/start/SIDE_EFFECTS.md
index d9e3ac4a7a..6dc07b8140 100644
--- a/apps/cli/src/legacy/commands/start/SIDE_EFFECTS.md
+++ b/apps/cli/src/legacy/commands/start/SIDE_EFFECTS.md
@@ -1,60 +1,259 @@
 # `supabase start`
 
+Native TypeScript port of Go's `internal/start` (+ the Postgres-container half of
+`internal/db/start`). Talks directly to Docker via subprocess (`docker`/`podman`),
+mirroring Go's sequential per-container `DockerStart` — it does not use Docker Compose
+(the one `docker/compose` import Go has is an internal, best-effort concurrent
+image-pre-pull helper this port never depends on) and it does not go through
+`@supabase/stack/effect`'s orchestration model (see the CLI-1323 plan's "Critical
+architectural finding" for why: that runtime is a deliberately different local-dev
+product — no Kong gateway, native-binary-first, auto-allocated ports, opaque API keys —
+that would break the Go-parity contract this port exists to provide).
+
+## Scope
+
+Edge Runtime bring-up, the fresh-volume DB schema/migration/seed setup pipeline, and
+fresh-volume storage-bucket seeding are all now natively implemented (see below) — this
+section previously listed them as out-of-scope follow-ups.
+
+One piece of Go's `start` remains explicitly **out of scope**, discovered during this
+port's own research (not called out in Go's public docs or the original port plan) and
+documented at its exact Go call site in `start.handler.ts`:
+
+1. **Linked-project version-check suggestion** (`internal/start/start.go:61-63`, delegates
+   to `internal/services.CheckVersions`) — a best-effort Management API call, made only
+   when a project happens to be linked _and_ the user is logged in, purely to print an
+   "update available" hint. Every error is silently swallowed in Go. Omitted entirely —
+   this port has zero Management API dependency for `start`, by design.
+
+### Fresh-volume DB setup (`legacyStartSetupLocalDatabase`)
+
+Ported: Go's `SetupLocalDatabase` → `initSchema` →
+`initRealtimeJob`/`initStorageJob`/`initAuthJob` pipeline (`internal/db/start/`). Gated on
+`isFreshVolume` (`legacyStartVolumeExists` on the Postgres volume, checked BEFORE the
+volume is created), matching Go's `NoBackupVolume` — this same check also selects which of
+`Starting database...`/`Starting database from backup...` prints to stderr immediately
+before Postgres's container is created (`db/start/start.go:165-175`). Runs immediately
+after Postgres's own health check passes, before "Starting containers..." prints and
+before any other service starts. Opens a direct `LegacyDbConnection` session to the
+host-facing Postgres address (PG<=14: execs schema/globals/API-privileges SQL over that
+session; PG>=15: runs three one-shot `LegacyDockerRun` jobs instead, gated independently on
+`realtime.enabled`/`storage.enabled`/`auth.enabled`). Also upserts `[db.vault]` secrets and
+seeds `supabase/roles.sql`: matching Go's own print-before-read ordering
+(`pkg/migration/seed.go:88`), the `Seeding globals from roles.sql...` stderr line always
+prints, whether or not the file exists — a missing file is silently tolerated (no SQL runs),
+any other read/exec error still fails the run. Finally runs every pending migration + seed.
+A failure at any step rolls back the whole `start` run (same as any other bring-up failure).
+
+`legacyStartInitCurrentBranch` (writes `supabase/.branches/_current_branch` = `"main"` if
+absent) is NOT part of this fresh-volume-gated pipeline — matching Go's `initCurrentBranch`
+call (`db/start/start.go:189`), it runs unconditionally on every `start`, immediately after
+this pipeline's gate closes (whether or not the pipeline itself ran).
+
+### Edge Runtime bring-up (`legacyStartEdgeRuntimeContainer`)
+
+Ported: Go's `serve.ServeFunctions()` call (`internal/functions/serve/`), reusing
+`shared/functions/serve.ts`'s `startEdgeRuntimeContainer` core (the same one `functions
+serve` uses). Gated on `edge_runtime.enabled && !--exclude edge-runtime`, in Go's real
+container-start position (between ImgProxy and pg-meta). Unlike every other service, it's
+a direct `docker run -d ...` (not `docker create`+`docker start`) and is health-checked via
+an HTTP probe through Kong (`/functions/v1/_internal/health`), not a Docker healthcheck —
+mirrors PostgREST's own probe shape.
+
+### Storage bucket seeding (`legacySeedBucketsRun`)
+
+Ported: Go's `buckets.Run(ctx, "", false, fsys)` call (`start.go:1281-1286`,
+`internal/seed/buckets`). Runs only when `isFreshVolume && Storage started`, after the bulk
+health check genuinely succeeds, right before the `cli_stack_started` telemetry capture. A
+seeding failure rolls back the whole `start` run, same as any other post-bring-up failure.
+
+A second, narrower seeding path exists for the `--ignore-health-check` downgrade branch
+(`start.go:1272-1277`): when the bulk health check fails but `isFreshVolume && Storage
+started`, Go re-checks Storage's health in isolation and, only if Storage itself is
+healthy, seeds buckets anyway before falling through to the downgrade-to-warning behavior.
+Unlike the main path above, a failure on THIS path is not swallowed by
+`--ignore-health-check` — it replaces the original health error, rolls back, and fails the
+command (Go's `return seedErr` instead of the downgraded `return err`).
+
 ## Files Read
 
-| Path                             | Format | When                                     |
-| -------------------------------- | ------ | ---------------------------------------- |
-| `<workdir>/supabase/config.toml` | TOML   | always, to resolve project configuration |
+| Path                                                                                            | Format | When                                                                                                                                                                             |
+| ----------------------------------------------------------------------------------------------- | ------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `<workdir>/supabase/config.toml`                                                                | TOML   | always                                                                                                                                                                           |
+| `<workdir>/supabase/.env`, `.env.local`                                                         | dotenv | always (`.env.local` skipped when `SUPABASE_ENV=test`)                                                                                                                           |
+| project-root / `SUPABASE_ENV`-selected dotenv file                                              | dotenv | always, same precedence chain as `stop`/`status`                                                                                                                                 |
+| `auth.signing_keys_path` file                                                                   | JSON   | when configured                                                                                                                                                                  |
+| `api.tls.cert_path` / `api.tls.key_path`                                                        | PEM    | when `api.tls.enabled`                                                                                                                                                           |
+| `auth.email.template.*` / `auth.email.notification.*` content files                             | text   | when configured                                                                                                                                                                  |
+| GCP JWT credentials file                                                                        | JSON   | when `analytics.backend = "bigquery"`                                                                                                                                            |
+| `<workdir>/supabase/roles.sql`                                                                  | SQL    | on a fresh volume (custom-roles seed) — the "Seeding globals..." message always prints first; the file itself is only read if it exists, tolerating a missing file               |
+| `<workdir>/supabase/migrations/*.sql`, `supabase/seed.sql`                                      | SQL    | on a fresh volume, via the standard migration-apply + seed pipeline                                                                                                              |
+| `<workdir>/supabase/.branches/_current_branch`                                                  | text   | on every start, existence check before writing (see "Files Written")                                                                                                             |
+| `<workdir>/supabase/functions/**`                                                               | —      | when Edge Runtime starts, and independently when Studio starts (function discovery/config resolution + Docker bind mounts, regardless of whether Edge Runtime itself is enabled) |
+| `<workdir>/supabase/.temp/storage-migration`                                                    | text   | always — linked-project Storage migration pin (`DB_MIGRATIONS_FREEZE_AT`), written by `supabase link`; absent/unreadable resolves to no pin                                      |
+| `<workdir>/supabase/.temp/{gotrue,rest,storage,realtime,studio,pgmeta,logflare,pooler}-version` | text   | always — linked-project per-service image version pins, written by `supabase link`; absent/unreadable resolves to the embedded default image                                     |
+| `~/.docker/config.json`                                                                         | JSON   | via the `docker`/`podman` CLI itself, for registry auth — never read directly by this process                                                                                    |
 
 ## Files Written
 
-| Path | Format | When |
-| ---- | ------ | ---- |
-| —    | —      | —    |
+| Path                                                                                          | Format | When                                                                                                                      |
+| --------------------------------------------------------------------------------------------- | ------ | ------------------------------------------------------------------------------------------------------------------------- |
+| `<workdir>/supabase/.branches/_current_branch`                                                | text   | on every start, only if absent — writes `"main"`                                                                          |
+| `<workdir>/supabase/.temp/start-secrets/<containerName>/secret-<n>`                           | varies | for Kong (`kong.yml`, TLS cert, TLS key), Postgres (`pgsodium_root.key`), and Supavisor (`pooler_tenant.exs`) — see below |
+| `<workdir>/supabase/.temp/start-secrets/<edgeRuntimeContainerName>/{env,multiline-env,main}/` | varies | Edge Runtime's own JWT/service-role-key/secret env artifacts and bootstrap template — see below                           |
+
+Kong's `custom_nginx.template`, Vector's `vector.yaml`, and Postgres's own bootstrap
+script (`postgresql.conf`-equivalent setup) are all rendered in memory and injected
+directly into each container's entrypoint (a `sh -c '... heredoc ...'` command) —
+never written to the host filesystem, since none of them carries secret content.
+Kong's `kong.yml`/TLS cert/TLS key, Postgres's `pgsodium_root.key`, and Supavisor's
+`pooler_tenant.exs` DO carry secret content (a service-role-key-derived bearer/query
+key, TLS private key material, and the DB password respectively) and are instead
+written to `<workdir>/supabase/.temp/start-secrets/<containerName>/` (directory mode
+`0700`, files mode `0644` — world-readable, since Kong (uid 100) and Postgres's
+post-privilege-drop `postgres` user read these bind-mounted files as non-root, and a
+Linux/Podman bind mount preserves the host file's mode verbatim) and
+bind-mounted `:ro` into the container at the exact path each container's
+entrypoint/`Cmd` expects — see `container-lifecycle.ts`'s `legacyStageStartSecretFiles`
+doc comment for the full rationale (CWE-214/522: keeping secret content out of the
+`docker create` argv the host can see via `ps`/`/proc/<pid>/cmdline`) and for why this
+directory is a DETERMINISTIC, PERSISTENT path under the project's own workdir rather
+than an ephemeral OS temp dir — every one of these three containers runs with
+`restartPolicy: "unless-stopped"`, so the files must survive a host/Docker-daemon
+restart for dockerd to successfully re-attach the bind mount. The directory is
+recreated fresh (any stale contents removed first) on every `start` invocation that
+reaches container creation, and is cleaned up immediately if `docker create`/`docker
+start` itself fails — otherwise it is left in place for the life of the container.
+Studio reads/writes SQL snippets under `<workdir>/supabase/snippets/` at its own
+runtime — that's Studio's behavior, not something `start` itself writes.
+
+Edge Runtime's own JWT/service-role-key/configured-secret env file, multiline-env
+script + value files, and bootstrap `index.ts` template (`shared/functions/serve.ts`'s
+`writeDockerEnvFile`/`writeDockerMultilineEnvScript`/`writeServeMainTemplateFile`) are
+staged the same way, under `<workdir>/supabase/.temp/start-secrets/<edgeRuntime
+containerName>/{env,multiline-env,main}/` (directory mode `0700`, files mode `0600`),
+bind-mounted `:ro` into the container — a deterministic, persistent path rather than
+`os.tmpdir()` (which is frequently tmpfs and gets wiped on reboot) so
+`legacyCleanupStartSecrets` (see the Exit Codes/rollback section below) can reclaim
+them on `stop` or a failed-start rollback, exactly like the Kong/Postgres/Supavisor
+directories above. Each of the three writers removes and recreates its own
+subdirectory fresh on every call (self-healing, same as the directory above), so a
+shrinking env set never leaves stale files behind.
 
 ## API Routes
 
-| Method | Path | Auth | Request body | Response (used fields) |
-| ------ | ---- | ---- | ------------ | ---------------------- |
-| —      | —    | —    | —            | —                      |
+| Method   | Path                                 | Auth                  | Request body | Response (used fields)    |
+| -------- | ------------------------------------ | --------------------- | ------------ | ------------------------- |
+| GET      | `<api-url>/storage/v1/bucket`        | Kong service-role key | —            | existing bucket names/ids |
+| POST/PUT | `<api-url>/storage/v1/bucket[/<id>]` | Kong service-role key | bucket props | created/updated bucket    |
+
+Local-only: the Storage bucket-seeding step (fresh volume + Storage enabled) talks to the
+LOCAL Storage service through Kong, never the Management API. See "Scope" above for the
+one Go behavior (`CheckVersions`) that _would_ call the Management API and is deliberately
+not implemented.
 
 ## Environment Variables
 
-| Variable | Purpose | Required? |
-| -------- | ------- | --------- |
-| —        | —       | —         |
+| Variable                               | Purpose                                                                                                                                                         | Required? |
+| -------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------- |
+| `SUPABASE_*` (any dotted config field) | Generic Viper-style `AutomaticEnv` override of any `config.toml` field (e.g. `SUPABASE_AUTH_ENABLED`, `SUPABASE_API_PORT`)                                      | no        |
+| `SUPABASE_INTERNAL_IMAGE_REGISTRY`     | Overrides the image registry used to resolve every service's image                                                                                              | no        |
+| `SUPABASE_PROJECT_ID`                  | Overrides the resolved local project id (env → config.toml → workdir basename)                                                                                  | no        |
+| `SUPABASE_WORKDIR`                     | Resolves `LegacyCliConfig.workdir`                                                                                                                              | no        |
+| `BITBUCKET_CLONE_DIR`                  | When non-empty, drops named volumes and `--security-opt` from every container create                                                                            | no        |
+| `DOCKER_HOST`                          | Read to discover the Docker daemon's own address, then re-derived and set on Vector's container env so it can reach the host's Docker socket for log collection | no        |
+| `KONG_NGINX_WORKER_PROCESSES`          | Read (ambient shell or project dotenv) into Kong's own container env (defaults to `"1"` when unset)                                                             | no        |
+
+`docker`/`podman` must be resolvable on `PATH` — same fallback behavior as `stop`/`status`.
 
 ## Exit Codes
 
-| Code | Condition                                     |
-| ---- | --------------------------------------------- |
-| `0`  | success — all containers started              |
-| `1`  | malformed config                              |
-| `1`  | Docker daemon not running or connection error |
-| `1`  | one or more containers failed health check    |
+| Code | Condition                                                                                                                                                                                                                                                                                                      |
+| ---- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `0`  | success — every started container passed its health check                                                                                                                                                                                                                                                      |
+| `0`  | the stack was already running — shows status instead of restarting                                                                                                                                                                                                                                             |
+| `0`  | `--ignore-health-check` set and one or more containers timed out — the failure is printed and swallowed, no rollback                                                                                                                                                                                           |
+| `1`  | `--ignore-health-check` set, the fresh-volume/Storage-healthy recheck-and-seed path ran (see "Storage bucket seeding"), and that seed itself failed — rolls back despite the flag                                                                                                                              |
+| `1`  | malformed `config.toml` / `Config.Validate` failure                                                                                                                                                                                                                                                            |
+| `1`  | `docker`/`podman` not spawnable, or the daemon is unreachable                                                                                                                                                                                                                                                  |
+| `1`  | image pull exhausted across every registry candidate                                                                                                                                                                                                                                                           |
+| `1`  | network, volume, container create, or container start failure (including a port conflict) — rolls back everything created so far                                                                                                                                                                               |
+| `1`  | health check timeout **without** `--ignore-health-check` — rolls back                                                                                                                                                                                                                                          |
+| `1`  | Postgres itself fails to start or its own health wait times out, **without** `--ignore-health-check` — rolls back                                                                                                                                                                                              |
+| `0`  | `--ignore-health-check` set and Postgres's own health wait times out — the failure is printed and swallowed, no rollback; no OTHER service is ever created (Postgres's failure is returned before any other bring-up step runs), but the command still prints "Started..." + the (config-derived) status table |
+| `1`  | fresh-volume DB setup failure (schema SQL / one-shot migrate job / vault upsert / roles seed / migration-apply) — rolls back                                                                                                                                                                                   |
+| `1`  | fresh-volume bucket-seeding failure — rolls back                                                                                                                                                                                                                                                               |
 
-## Output
+Rollback (`legacyRollbackStart`) tears down everything created so far by Docker label,
+matching Go's `DockerRemoveAll`, and never masks the original failure — a rollback error
+is logged to stderr and swallowed. `deleteVolumes` mirrors Go's `utils.NoBackupVolume`
+exactly: `true` only when this run's Postgres volume was freshly created (so a failed
+first-ever `start` prunes its own empty volume too), `false` otherwise (never touches a
+pre-existing user's data on a failed restart). Rollback also reclaims this run's own
+`<workdir>/supabase/.temp/start-secrets/<containerName>` directories (via
+`legacyCleanupStartSecrets`, `legacy/shared/legacy-start-secrets-cleanup.ts`) once
+teardown is CONFIRMED complete — the matching containers come from
+`legacyDockerRemoveAll`'s `onContainersRemoved` hook, which fires only once `docker
+container prune` has actually removed them (not at the initial listing), so cleanup only
+ever targets containers this failed run itself created AND actually tore down. Each
+container's directory is located via its own `com.supabase.cli.workdir` label (stamped on
+every container `start` creates); this run's own workdir is only the fallback for a
+container missing that label. A later successful `stop` reclaims the same directories for
+a normal (non-rollback) teardown — see `stop`'s own `SIDE_EFFECTS.md`.
 
-### `--output-format text` (Go CLI compatible)
+## Telemetry Events Fired
 
-Streams Docker pull and container start progress to stdout. Prints service URLs on success.
+| Event                  | When                                                                                                                                                                                                                                            | Notable properties / groups         |
+| ---------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------- |
+| `cli_command_executed` | post-run, success or failure (via `withLegacyCommandInstrumentation`)                                                                                                                                                                           | `exit_code`, `duration_ms`, `flags` |
+| `cli_stack_started`    | once, only on a genuine bulk health-check success — never fires on an `--ignore-health-check` downgrade-to-warning path, Postgres's own or the later bulk check's, matching Go's capture sitting after the error-return block (`start.go:1287`) | no properties                       |
 
-### `--output-format json` / `--output json`
+## Output
 
-Starts the local stack while capturing Go's start progress output, then emits the same JSON
-object as `supabase status --output json`.
+`start` has no Go `-o`/`--output` flag of its own — after orchestration (or the
+already-running short-circuit, or the ignored-health-check path), it renders through the
+exact same `status` value/pretty-table machinery `supabase status` uses, in all three TS
+output modes.
+
+### `--output-format text` (Go CLI compatible)
 
-Legacy `--output env|toml|yaml` follows the same path and emits the corresponding
-`supabase status --output <format>` payload after a successful start.
+- stderr (conditional, `--exclude` had invalid values): a `WARNING:` line naming the
+  invalid values and listing the 13 valid ones — the command still proceeds.
+- stderr: already-running banner (`supabase start` in aqua) **or** the bring-up sequence:
+  `Starting database...` (fresh volume) / `Starting database from backup...` (existing
+  volume) → Postgres create+start+health-wait → `Starting containers...` → (image
+  pre-pull) → per-container create+start → `Waiting for health checks...` → `Started
+supabase local development setup.`
+- stdout: the `status` pretty table (rounded box, same renderer `supabase status` uses).
+- stderr: the local-dev security notice block (bind-to-`0.0.0.0` / shared-default-keys /
+  no-auth-on-Studio-pgMeta-analytics warning).
 
-### `--output-format stream-json`
+### `--output-format json` / `--output-format stream-json`
 
-Starts the local stack while capturing Go's start progress output, then emits the same JSON
-object as `supabase status --output json`.
+A single JSON object (or a `result` NDJSON event) carrying the same value shape
+`supabase status --output json` produces. All the progress/warning/banner/security-notice
+text above is suppressed in these modes — stdout stays payload-only.
 
 ## Notes
 
-- `--exclude` / `-x` flag accepts a comma-separated list of container names to skip.
-- `--ignore-health-check` suppresses unhealthy container errors and exits 0.
-- `--preview` is a hidden flag to connect to a feature preview branch.
-- If all containers are already running the command shows status instead.
+- `--exclude`/`-x` accepts container names from the verified 13-key list (`gotrue`,
+  `realtime`, `storage-api`, `imgproxy`, `kong`, `mailpit`, `postgrest`, `postgres-meta`,
+  `studio`, `edge-runtime`, `logflare`, `vector`, `supavisor`) — `db`/`postgres` is never
+  excludable, matching Go. An invalid value warns and proceeds; it never fails the command.
+- `--ignore-health-check` applies uniformly to EVERY service's health wait, Postgres
+  included — matching Go's `Run()`, which downgrades whatever `run()` returns as a whole,
+  not just the later bulk health check. It never skips rollback for a _creation_ failure,
+  only for a health _timeout_. When Postgres's OWN wait times out and the flag is set, no
+  other service is ever created (Postgres's failure returns before any later bring-up step
+  runs), yet the command still falls through to the "Started..." tail and the
+  (config-derived) status table, exactly like Go. When it's instead the LATER bulk health
+  check that times out with the flag set, and this run also freshly created the Postgres
+  volume and Storage started, a narrower Storage-only recheck runs and, if Storage is
+  healthy, buckets are seeded anyway — a failure in THAT seed step still rolls back and
+  fails the command despite the flag (see "Storage bucket seeding" and the `Exit Codes`
+  table).
+- `--preview` is a hidden, parsed-but-inert flag, matching Go exactly (never read by
+  Go's own `start.Run`).
+- The already-running check is a plain container-existence check (`docker container
+inspect` on the Postgres container), not a health check — matching Go's
+  `AssertSupabaseDbIsRunning` naming despite what it actually verifies.
diff --git a/apps/cli/src/legacy/commands/start/lib/container-lifecycle.ts b/apps/cli/src/legacy/commands/start/lib/container-lifecycle.ts
new file mode 100644
index 0000000000..7f681f4857
--- /dev/null
+++ b/apps/cli/src/legacy/commands/start/lib/container-lifecycle.ts
@@ -0,0 +1,721 @@
+/**
+ * Port of Go's `DockerStart` (`apps/cli-go/internal/utils/docker.go:363-440`):
+ * given a fully-resolved {@link LegacyStartContainerSpec} (image already
+ * resolved by `image-prepull.ts` — see its doc comment), sets the two
+ * project-identity labels, provisions this container's own named volumes,
+ * stages any `secretFiles` onto the host (see {@link legacyStageStartSecretFiles}),
+ * builds the `docker create` argv (`docker-create-args.ts`), and spawns
+ * `docker create` + `docker start`.
+ *
+ * Network creation (`DockerNetworkCreateIfNotExists`) is deliberately NOT part
+ * of this per-container function — see {@link legacyEnsureStartNetwork}'s doc
+ * comment for why it is hoisted to run once instead of once per container.
+ */
+
+import { chmod, mkdir, rm, writeFile } from "node:fs/promises";
+import { join } from "node:path";
+
+import { Data, Effect, Stream } from "effect";
+import type { ChildProcessSpawner } from "effect/unstable/process/ChildProcessSpawner";
+
+import {
+  legacyDescribeContainerCliFailure,
+  spawnContainerCli,
+} from "../../../shared/legacy-container-cli.ts";
+import {
+  legacyBindMountSpecSource,
+  legacyIsBindMountSource,
+} from "../../../shared/legacy-docker-bind-classify.ts";
+import {
+  LEGACY_CLI_PROJECT_LABEL,
+  LEGACY_CLI_WORKDIR_LABEL,
+} from "../../../shared/legacy-docker-ids.ts";
+import { isUserDefinedDockerNetwork } from "../../../../shared/functions/deploy.ts";
+import {
+  legacyBuildStartContainerCreateArgs,
+  legacyApplyBitbucketStartContainerFilter,
+  legacyIsDockerClientEnvKey,
+  type LegacyStartContainerSpec,
+} from "./docker-create-args.ts";
+
+/** Structural element type of {@link LegacyStartContainerSpec.secretFiles} — not exported from `docker-create-args.ts`, so referenced positionally here. */
+type LegacyStartSecretFileSpec = NonNullable<LegacyStartContainerSpec["secretFiles"]>[number];
+
+type Spawner = ChildProcessSpawner["Service"];
+
+/**
+ * Go's `composeProjectLabel` (`apps/cli-go/internal/utils/docker.go:60`,
+ * unexported there). This port does not integrate with docker-compose
+ * anywhere (an intentional architecture decision), but the label is still set
+ * unconditionally, matching Go's own unconditional assignment
+ * (`docker.go:376`) regardless of whether compose is actually in use: external
+ * tooling that groups/filters containers by this label (Docker Desktop's
+ * Compose view, `docker compose ls`, the VS Code Docker extension) would
+ * otherwise silently stop recognizing the local stack's containers.
+ *
+ * A same-value private constant already exists at
+ * `shared/functions/deploy.ts` (`dockerComposeProjectLabel`, for the unrelated
+ * `functions deploy` Docker Desktop extension gateway) but is neither exported
+ * nor in the same Docker-usage domain as `start` — not hoisted from there.
+ */
+export const LEGACY_COMPOSE_PROJECT_LABEL = "com.docker.compose.project";
+
+/** `docker network create --label ...`/`docker volume create --label ...` failed. */
+export class LegacyStartNetworkCreateError extends Data.TaggedError(
+  "LegacyStartNetworkCreateError",
+)<{
+  readonly message: string;
+}> {}
+
+export class LegacyStartVolumeCreateError extends Data.TaggedError("LegacyStartVolumeCreateError")<{
+  readonly message: string;
+}> {}
+
+/** `docker create` failed. */
+export class LegacyStartContainerCreateError extends Data.TaggedError(
+  "LegacyStartContainerCreateError",
+)<{
+  readonly message: string;
+}> {}
+
+/** `docker start` failed — see {@link legacyPortConflictSuggestion} for the port-already-allocated case. */
+export class LegacyStartContainerStartError extends Data.TaggedError(
+  "LegacyStartContainerStartError",
+)<{
+  readonly message: string;
+}> {}
+
+/** Every failure {@link legacyStartContainer} itself can produce (network creation is separate, see {@link legacyEnsureStartNetwork}). */
+export type LegacyStartContainerError =
+  | LegacyStartVolumeCreateError
+  | LegacyStartContainerCreateError
+  | LegacyStartContainerStartError;
+
+export interface LegacyStartContainerOpts {
+  /**
+   * Go's `Config.ProjectId`, already sanitized (`legacySanitizeProjectId`) by
+   * the caller's config-load pipeline — `DockerStart` itself performs no
+   * sanitization, it just reads the already-sanitized singleton
+   * (`docker.go:375-376`). Merged onto both {@link LEGACY_CLI_PROJECT_LABEL}
+   * and {@link LEGACY_COMPOSE_PROJECT_LABEL}, overwriting any value the caller
+   * may have already set under those keys in `spec.labels` — exactly like
+   * Go's unconditional map assignment.
+   */
+  readonly projectId: string;
+  /**
+   * `os.Getenv("BITBUCKET_CLONE_DIR") != ""` — see `legacyIsBitbucketPipeline`
+   * (`shared/legacy-bitbucket-pipeline.ts`). Passed in rather than read here so
+   * this module stays a pure effect orchestrator with no direct env access,
+   * matching `legacyApplyBitbucketStartContainerFilter`'s own boolean-flag
+   * shape (`docker-create-args.ts`).
+   */
+  readonly isBitbucketPipeline: boolean;
+  /**
+   * `LegacyCliConfig.workdir` — the project's own working directory. Roots
+   * {@link legacyStageStartSecretFiles}'s deterministic, persistent host directory
+   * (`<workdir>/supabase/.temp/start-secrets/<containerName>/`) so staged secret files
+   * survive a host/Docker-daemon restart — see that function's doc comment for why.
+   *
+   * Also stamped onto every created container as {@link LEGACY_CLI_WORKDIR_LABEL} (see
+   * that constant's doc comment) so a later `stop`/{@link legacyRollbackStart} can find
+   * this exact directory again from the container's own label, without depending on
+   * being invoked from the same cwd/`--workdir` `start` was.
+   */
+  readonly workdir: string;
+  /**
+   * `DockerStart`'s platform-specific `extraHosts` package var
+   * (`docker_linux.go`/`docker_darwin.go`/`docker_windows.go`), merged onto
+   * EVERY container's `HostConfig.ExtraHosts` (`docker.go:378`) — Linux-only
+   * (`["host.docker.internal:host-gateway"]`); empty on Docker Desktop
+   * platforms, which already resolve that hostname natively. Merged here
+   * (not per-spec) for the same reason the two project-identity labels are:
+   * Go applies it identically to every container this orchestrator creates.
+   */
+  readonly extraHosts: ReadonlyArray<string>;
+}
+
+function collectText(stream: Stream.Stream<Uint8Array, unknown>) {
+  const decoder = new TextDecoder();
+  return Stream.runFold(
+    stream,
+    () => "",
+    (text, chunk) => text + decoder.decode(chunk, { stream: true }),
+  ).pipe(Effect.map((text) => text + decoder.decode()));
+}
+
+/**
+ * Extracts every named-volume source from `binds` (Go's `loader.ParseVolume`
+ * classification loop, `docker.go:388-399`): a bind is `source:target[:mode]`
+ * (see `docker-create-args.ts`'s `LegacyStartContainerSpec.binds` doc comment
+ * and its own worked examples in `docker-create-args.unit.test.ts`), and its
+ * source segment is a named volume exactly when
+ * {@link legacyIsBindMountSource} says it is NOT a bind-mount path. No dedupe
+ * is applied — Go's own `sources` slice doesn't dedupe either, and
+ * `Docker.VolumeCreate` is idempotent for a repeated name.
+ */
+function legacyNamedVolumeSources(binds: ReadonlyArray<string>): ReadonlyArray<string> {
+  const sources: Array<string> = [];
+  for (const bind of binds) {
+    const source = legacyBindMountSpecSource(bind);
+    if (source.length > 0 && !legacyIsBindMountSource(source)) {
+      sources.push(source);
+    }
+  }
+  return sources;
+}
+
+/**
+ * Whether `docker`/`podman network create`'s stderr reports the network
+ * already existing — the CLI-subprocess equivalent of Go's
+ * `errdefs.IsConflict(err)` (`docker.go:70`), which inspects a structured
+ * Engine API error instead of stderr text. Docker's real message is `Error
+ * response from daemon: network with name <id> already exists`; Podman's is
+ * worded differently (`network name <id> already used`), hence the broader
+ * pattern rather than matching Docker's exact sentence.
+ */
+function legacyIsNetworkAlreadyExistsError(stderr: string): boolean {
+  return /already exists|already used/iu.test(stderr);
+}
+
+/** Go's `portErrorPattern` (`apps/cli-go/internal/utils/docker.go:657`). */
+const LEGACY_PORT_BIND_ERROR_PATTERN = /Bind for (.*) failed: port is already allocated/;
+
+function legacyParsePortBindError(stderr: string): string | undefined {
+  return LEGACY_PORT_BIND_ERROR_PATTERN.exec(stderr)?.[1];
+}
+
+/**
+ * A scoped-down port of Go's `suggestDockerStop`
+ * (`apps/cli-go/internal/utils/docker.go:667-686`): Go lists every running
+ * container, matches the failed host port against each container's own
+ * published ports, and reports either `supabase stop --project-id <id>` (the
+ * port owner carries the CLI project label) or a bare `docker stop <name>`
+ * (it doesn't) — then `docker.go:425-436` appends a further "configure a
+ * different port" suggestion on top of that.
+ *
+ * Reproducing the lookup would mean this pure CLI-orchestration function also
+ * lists and inspects every other running container purely to word a hint —
+ * disproportionate plumbing for a suggestion string. This reproduces only the
+ * detection Go itself starts from (the same regex match) and folds both of
+ * Go's suggestion branches into one still-actionable sentence that covers
+ * either case without the extra lookup.
+ */
+function legacyPortConflictSuggestion(hostPort: string, serviceLabel: string): string {
+  return (
+    `\nTry stopping the project or container already using ${hostPort} ` +
+    "(`docker ps` lists what's bound to it, or `supabase stop` for another local Supabase project), " +
+    `or configure a different ${serviceLabel} port in supabase/config.toml.`
+  );
+}
+
+/**
+ * Go's `DockerNetworkCreateIfNotExists` (`docker.go:63-77`) via `docker
+ * network create --label ... <networkId>`, treating "already exists" as
+ * success.
+ *
+ * Called ONCE, up front, by the caller orchestrating a whole `start` run —
+ * NOT per-container the way Go's `DockerStart` calls it on every single
+ * invocation. Go's repeated call is a no-op after the first (the network
+ * already exists), so this is a pure optimization, not a behavior change: a
+ * `start` run's containers are exclusively created by this same code path in
+ * one process, never interleaved with an external network deletion, so the
+ * network is guaranteed to still exist for every later `legacyStartContainer`
+ * call in the same run.
+ *
+ * Mirrors Go's own `isUserDefined(mode)` guard (`docker.go:65`,
+ * `docker_linux.go:10` and platform siblings) that runs first inside
+ * `DockerNetworkCreateIfNotExists` itself: `--network-id default|bridge|host|
+ * none` names a built-in Docker network that already exists and cannot be
+ * created (`docker network create host` errors with "operation is not
+ * permitted on predefined host network"), so this returns immediately without
+ * spawning `docker network create` at all for those names, reusing the same
+ * `isUserDefinedDockerNetwork` check `shared/functions/deploy.ts` already
+ * applies for the unrelated `functions deploy` extension-gateway network.
+ */
+export function legacyEnsureStartNetwork(
+  spawner: Spawner,
+  networkId: string,
+  labels: Readonly<Record<string, string>>,
+): Effect.Effect<void, LegacyStartNetworkCreateError> {
+  if (!isUserDefinedDockerNetwork(networkId)) {
+    return Effect.void;
+  }
+  return Effect.scoped(
+    Effect.gen(function* () {
+      const args = [
+        "network",
+        "create",
+        ...Object.entries(labels).flatMap(([key, value]) => ["--label", `${key}=${value}`]),
+        networkId,
+      ];
+      const child = yield* spawnContainerCli(spawner, args, {
+        stdin: "ignore",
+        stdout: "ignore",
+        stderr: "pipe",
+      }).pipe(
+        Effect.mapError(
+          (cause) =>
+            new LegacyStartNetworkCreateError({
+              message: `failed to create docker network: ${legacyDescribeContainerCliFailure(cause)}`,
+            }),
+        ),
+      );
+      const [exitCode, stderr] = yield* Effect.all(
+        [child.exitCode.pipe(Effect.map(Number)), collectText(child.stderr)],
+        { concurrency: "unbounded" },
+      ).pipe(
+        Effect.mapError(
+          () => new LegacyStartNetworkCreateError({ message: "failed to create docker network" }),
+        ),
+      );
+      if (exitCode !== 0 && !legacyIsNetworkAlreadyExistsError(stderr)) {
+        const message = stderr.trim();
+        return yield* Effect.fail(
+          new LegacyStartNetworkCreateError({
+            message:
+              message.length > 0
+                ? `failed to create docker network: ${message}`
+                : "failed to create docker network",
+          }),
+        );
+      }
+    }),
+  );
+}
+
+/**
+ * Go's per-source-name `Docker.VolumeCreate` call (`docker.go:407-415`) via
+ * `docker volume create --label ...`. Unlike network creation, Go applies no
+ * "already exists" tolerance here — `VolumeCreate` is already idempotent for a
+ * repeated name with matching options, so any non-zero exit is a real failure.
+ */
+export function legacyEnsureStartVolume(
+  spawner: Spawner,
+  name: string,
+  labels: Readonly<Record<string, string>>,
+): Effect.Effect<void, LegacyStartVolumeCreateError> {
+  return Effect.scoped(
+    Effect.gen(function* () {
+      const args = [
+        "volume",
+        "create",
+        ...Object.entries(labels).flatMap(([key, value]) => ["--label", `${key}=${value}`]),
+        name,
+      ];
+      const child = yield* spawnContainerCli(spawner, args, {
+        stdin: "ignore",
+        stdout: "ignore",
+        stderr: "pipe",
+      }).pipe(
+        Effect.mapError(
+          (cause) =>
+            new LegacyStartVolumeCreateError({
+              message: `failed to create volume: ${legacyDescribeContainerCliFailure(cause)}`,
+            }),
+        ),
+      );
+      const [exitCode, stderr] = yield* Effect.all(
+        [child.exitCode.pipe(Effect.map(Number)), collectText(child.stderr)],
+        { concurrency: "unbounded" },
+      ).pipe(
+        Effect.mapError(
+          () => new LegacyStartVolumeCreateError({ message: "failed to create volume" }),
+        ),
+      );
+      if (exitCode !== 0) {
+        const message = stderr.trim();
+        return yield* Effect.fail(
+          new LegacyStartVolumeCreateError({
+            message:
+              message.length > 0
+                ? `failed to create volume: ${message}`
+                : "failed to create volume",
+          }),
+        );
+      }
+    }),
+  );
+}
+
+/** `docker volume inspect` failed to spawn at all (no docker/podman binary). */
+export class LegacyStartVolumeInspectError extends Data.TaggedError(
+  "LegacyStartVolumeInspectError",
+)<{
+  readonly message: string;
+}> {}
+
+/** Docker's/Podman's "no such volume" stderr shape for `volume inspect`. */
+function isVolumeNotFoundMessage(message: string): boolean {
+  return /no such volume/iu.test(message);
+}
+
+/**
+ * Go's pre-create existence check (`_, err := utils.Docker.VolumeInspect(ctx,
+ * utils.DbId); utils.NoBackupVolume = errdefs.IsNotFound(err)`,
+ * `apps/cli-go/internal/db/start/start.go:165-167`), run BEFORE the volume is
+ * created — `docker volume create` is idempotent, so creating first would lose
+ * whether the volume already existed. `docker volume inspect <name>` exits 0
+ * when the volume exists; a confirmed "no such volume" resolves to `false`,
+ * matching Go's `errdefs.IsNotFound`. Any OTHER inspect failure (permission
+ * denied, daemon unreachable, …) resolves to `true` instead — Go's
+ * `errdefs.IsNotFound(err)` is `false` for any error that isn't specifically a
+ * not-found, so Go always defaults to treating the volume as pre-existing
+ * (protected from rollback's `volume prune`) unless it can positively confirm
+ * otherwise; collapsing every non-zero exit into "doesn't exist" would let an
+ * ambiguous inspect failure on a stack with real prior data get pruned by
+ * {@link legacyRollbackStart} after any later failure — a data-loss
+ * regression Go's own gate doesn't have. Only a spawn failure (neither
+ * `docker` nor `podman` on `PATH`) is a real error here.
+ *
+ * A separate, additional export — NOT called from {@link legacyEnsureStartVolume}
+ * itself, whose existing idempotent-create behavior must not change. The caller
+ * orchestrating a `start` run checks this BEFORE creating the volume, to gate the
+ * `SetupLocalDatabase`-equivalent pipeline and bucket seeding on "was this a
+ * fresh volume", matching Go's exact check-before-create ordering
+ * (`internal/db/start/start.go:165-184`).
+ */
+export function legacyStartVolumeExists(
+  spawner: Spawner,
+  name: string,
+): Effect.Effect<boolean, LegacyStartVolumeInspectError> {
+  return Effect.scoped(
+    Effect.gen(function* () {
+      const child = yield* spawnContainerCli(spawner, ["volume", "inspect", name], {
+        stdin: "ignore",
+        stdout: "ignore",
+        stderr: "pipe",
+      }).pipe(
+        Effect.mapError(
+          (cause) =>
+            new LegacyStartVolumeInspectError({
+              message: `failed to inspect volume: ${legacyDescribeContainerCliFailure(cause)}`,
+            }),
+        ),
+      );
+      const [exitCode, stderr] = yield* Effect.all(
+        [child.exitCode.pipe(Effect.map(Number)), collectText(child.stderr)],
+        { concurrency: "unbounded" },
+      ).pipe(
+        Effect.mapError(
+          () => new LegacyStartVolumeInspectError({ message: "failed to inspect volume" }),
+        ),
+      );
+      if (exitCode === 0) return true;
+      return !isVolumeNotFoundMessage(stderr);
+    }),
+  );
+}
+
+function legacyDockerCreateContainer(
+  spawner: Spawner,
+  args: ReadonlyArray<string>,
+  env: Readonly<Record<string, string>>,
+): Effect.Effect<string, LegacyStartContainerCreateError> {
+  return Effect.scoped(
+    Effect.gen(function* () {
+      // `docker-create-args.ts` emits the key-only `-e KEY` form (never `-e KEY=value`) so
+      // secrets never appear in argv/`ps`/`/proc/<pid>/cmdline` (CWE-214/209) — Docker then
+      // resolves each key's value from THIS spawned process's own environment. `extendEnv:
+      // true` keeps the rest of the parent's env (PATH, the real DOCKER_HOST, …) so the docker
+      // CLI invocation itself still behaves correctly; `env` supplies the actual secret values.
+      // Matches the same pattern already used for `docker run` (`legacy-docker-run.layer.ts`)
+      // and image resolution (`legacy-docker-image-resolve.ts`).
+      //
+      // Callers must have already stripped `legacyIsDockerClientEnvKey` keys (e.g. a
+      // container-facing `DOCKER_HOST`, set by Vector's spec for a tcp/npipe daemon host) from
+      // `env` before calling this function — those are emitted inline as `-e KEY=value` by
+      // `legacyBuildStartContainerCreateArgs` instead, since `extendEnv: true` merges `env` INTO
+      // this spawned process's own environment (per Effect's `ChildProcess` semantics,
+      // prioritizing `env`'s values), and that same environment is what the `docker`/`podman`
+      // CLI client itself reads `DOCKER_HOST` from to pick which daemon to talk to. Letting a
+      // container-facing `DOCKER_HOST` leak in here would hijack this `docker create` call's own
+      // daemon target before the container even exists.
+      const child = yield* spawnContainerCli(spawner, args, {
+        stdin: "ignore",
+        stdout: "pipe",
+        stderr: "pipe",
+        env,
+        extendEnv: true,
+      }).pipe(
+        Effect.mapError(
+          (cause) =>
+            new LegacyStartContainerCreateError({
+              message: `failed to create docker container: ${legacyDescribeContainerCliFailure(cause)}`,
+            }),
+        ),
+      );
+      const [exitCode, stdout, stderr] = yield* Effect.all(
+        [
+          child.exitCode.pipe(Effect.map(Number)),
+          collectText(child.stdout),
+          collectText(child.stderr),
+        ],
+        { concurrency: "unbounded" },
+      ).pipe(
+        Effect.mapError(
+          () =>
+            new LegacyStartContainerCreateError({ message: "failed to create docker container" }),
+        ),
+      );
+      if (exitCode !== 0) {
+        const message = stderr.trim();
+        return yield* Effect.fail(
+          new LegacyStartContainerCreateError({
+            message:
+              message.length > 0
+                ? `failed to create docker container: ${message}`
+                : "failed to create docker container",
+          }),
+        );
+      }
+      return stdout.trim();
+    }),
+  );
+}
+
+function legacyDockerStartContainer(
+  spawner: Spawner,
+  containerId: string,
+  spec: LegacyStartContainerSpec,
+): Effect.Effect<void, LegacyStartContainerStartError> {
+  return Effect.scoped(
+    Effect.gen(function* () {
+      const child = yield* spawnContainerCli(spawner, ["start", containerId], {
+        stdin: "ignore",
+        stdout: "ignore",
+        stderr: "pipe",
+      }).pipe(
+        Effect.mapError(
+          (cause) =>
+            new LegacyStartContainerStartError({
+              message: `failed to start docker container "${spec.containerName}": ${legacyDescribeContainerCliFailure(cause)}`,
+            }),
+        ),
+      );
+      const [exitCode, stderr] = yield* Effect.all(
+        [child.exitCode.pipe(Effect.map(Number)), collectText(child.stderr)],
+        { concurrency: "unbounded" },
+      ).pipe(
+        Effect.mapError(
+          () =>
+            new LegacyStartContainerStartError({
+              message: `failed to start docker container "${spec.containerName}"`,
+            }),
+        ),
+      );
+      if (exitCode !== 0) {
+        const trimmed = stderr.trim();
+        const base = `failed to start docker container "${spec.containerName}": ${
+          trimmed.length > 0 ? trimmed : `exit ${exitCode}`
+        }`;
+        const hostPort = legacyParsePortBindError(trimmed);
+        if (hostPort === undefined) {
+          return yield* Effect.fail(new LegacyStartContainerStartError({ message: base }));
+        }
+        const serviceLabel = spec.networkAliases?.[0] ?? spec.containerName;
+        return yield* Effect.fail(
+          new LegacyStartContainerStartError({
+            message: `${base}${legacyPortConflictSuggestion(hostPort, serviceLabel)}`,
+          }),
+        );
+      }
+    }),
+  );
+}
+
+/**
+ * Writes each {@link LegacyStartContainerSpec.secretFiles} entry's `content`
+ * to a HOST directory scoped to this container, at the DETERMINISTIC path
+ * `<workdir>/supabase/.temp/start-secrets/<containerName>/` (matching this
+ * codebase's existing `<workdir>/supabase/.temp/` convention for CLI-owned
+ * scratch state — see `legacy-linked-project-cache.layer.ts`), directory mode
+ * `0700` and one file per entry force-`chmod`'d to mode `0644` after writing
+ * (a creation-time `writeFile({ mode })` is only ever the argument to the
+ * underlying `open()`/`creat()` syscall, which the kernel ANDs with `~umask`
+ * — under a restrictive shell umask like `077`/`027` the file would otherwise
+ * land at `0600`, unlike `chmod`, which sets the mode unconditionally) — the
+ * directory stays
+ * owner-only (the kernel checks execute/search permission on this ancestor
+ * directory before it ever checks a file's own mode, so no other local user
+ * on the host can list the staged file names/count or read their contents
+ * while they exist), but each file is world-readable: it is bind-mounted
+ * `:ro` into a container that reads it as a NON-ROOT in-container user
+ * (Kong's image runs as uid 100 `kong`; Postgres's entrypoint drops root and
+ * reads `pgsodium_root.key` as the `postgres` user), and a Linux/Podman bind
+ * mount preserves the host file's uid/mode verbatim inside the container, so
+ * an arbitrary host-invoking uid at `0600` would get `EACCES` there — Go's
+ * own equivalent (heredoc'd directly into the container by a root-authored
+ * entrypoint script) already lands at world-readable `0644`, matching this
+ * exactly — then returns the `<hostPath>:<containerPath>:ro`
+ * bind for each. Mirrors this same session's `-e KEY`-only env fix
+ * (`legacyDockerCreateContainer`'s doc comment) for entrypoint/`Cmd`-bound
+ * secret content instead of env values: the file's HOST path is the only
+ * thing that ever reaches `docker create`'s argv, never the secret `content`
+ * itself (CWE-214/522).
+ *
+ * Deliberately NOT an ephemeral `os.tmpdir()` directory (`fs.mkdtemp`, this
+ * function's original implementation): every container that uses this
+ * mechanism (Kong, Postgres, Supavisor) runs with `restartPolicy:
+ * "unless-stopped"`, so dockerd re-attaches its bind mounts on its own after
+ * a host/daemon restart — by which point `supabase start`'s own process (and
+ * any `os.tmpdir()` directory it made, which is frequently tmpfs on Linux and
+ * wiped on reboot regardless) is long gone. Re-attaching a bind mount whose
+ * host source no longer exists either fails outright or (with the legacy `-v
+ * host:container` syntax) silently recreates an empty directory there —
+ * either way silently dropping the secret content (e.g. Postgres's
+ * `pgsodium_root.key`) until the user manually reruns `stop` + `start`. A
+ * path rooted in the project's own working directory survives the restart,
+ * exactly like Go's own heredoc'd-into-`Entrypoint`/`Cmd` approach does (via
+ * dockerd's own persisted container metadata) — without reintroducing the
+ * argv-exposure problem that approach has.
+ *
+ * Self-healing: any pre-existing directory at this path is removed FIRST,
+ * before writing fresh files, on every call — so a config change that
+ * shrinks or removes `secretFiles` between `start` invocations never leaves a
+ * stale file behind, and no orphaned directories accumulate across restarts.
+ * `legacyStartContainer` never resolves this for a container while an
+ * earlier instance of that same container might still be reading from it —
+ * see that function's doc comment.
+ */
+function legacyStageStartSecretFiles(
+  secretFiles: ReadonlyArray<LegacyStartSecretFileSpec>,
+  containerName: string,
+  workdir: string,
+): Effect.Effect<
+  { readonly binds: ReadonlyArray<string>; readonly cleanup: () => Promise<void> },
+  LegacyStartContainerCreateError
+> {
+  const dir = join(workdir, "supabase", ".temp", "start-secrets", containerName);
+  return Effect.tryPromise({
+    try: async () => {
+      await rm(dir, { recursive: true, force: true });
+      if (secretFiles.length === 0) {
+        return { binds: [], cleanup: () => Promise.resolve() };
+      }
+      try {
+        await mkdir(dir, { recursive: true, mode: 0o700 });
+        const binds = await Promise.all(
+          secretFiles.map(async (secretFile, index) => {
+            const hostPath = join(dir, `secret-${index}`);
+            await writeFile(hostPath, secretFile.content, { mode: 0o644 });
+            // `writeFile`'s `mode` is only a creation-time hint the kernel ANDs with the
+            // process umask — force the final mode explicitly so a restrictive umask (e.g.
+            // `077`/`027`) can't silently narrow this to `0600` and break the non-root
+            // in-container reader (see this function's doc comment).
+            await chmod(hostPath, 0o644);
+            return `${hostPath}:${secretFile.containerPath}:ro`;
+          }),
+        );
+        return { binds, cleanup: () => rm(dir, { recursive: true, force: true }) };
+      } catch (cause) {
+        await rm(dir, { recursive: true, force: true });
+        throw cause;
+      }
+    },
+    catch: (cause) =>
+      new LegacyStartContainerCreateError({
+        message: `failed to create docker container: failed to stage container secret files: ${
+          cause instanceof Error ? cause.message : String(cause)
+        }`,
+      }),
+  });
+}
+
+/**
+ * Port of Go's `DockerStart` (`apps/cli-go/internal/utils/docker.go:363-440`),
+ * minus image resolution (already done by `image-prepull.ts`) and network
+ * creation (hoisted, see {@link legacyEnsureStartNetwork}):
+ *
+ * 1. Merge the two project-identity labels onto `spec.labels`.
+ * 2. Provision this container's own named volumes (skipped entirely under
+ *    Bitbucket Pipelines, matching Go).
+ * 3. Apply the Bitbucket named-volume-bind / security-opt filter
+ *    (`legacyApplyBitbucketStartContainerFilter`, already ported).
+ * 4. Stage any `secretFiles` onto the host and append their bind mounts
+ *    (`legacyStageStartSecretFiles`) — a TS-port-only step with no Go
+ *    equivalent, see `docker-create-args.ts`'s `secretFiles` doc comment.
+ * 5. `docker create` then `docker start`. The staged secret files are left in
+ *    place on success — they must persist for the container's whole
+ *    lifetime so a `restartPolicy: "unless-stopped"` restart (dockerd
+ *    re-attaching bind mounts after a host reboot, long after this process
+ *    has exited) can still read them; see `legacyStageStartSecretFiles`'s doc
+ *    comment. Only cleaned up (best-effort, `Effect.onError` — not
+ *    `Effect.tapError`, which is built on `Cause.findError` and never sees a
+ *    pure SIGINT/SIGTERM interrupt, the same gap already fixed for the
+ *    top-level bring-up rollback in `start.handler.ts`) when `docker
+ *    create`/`docker start` itself FAILS, is interrupted, or the container
+ *    never successfully starts — nothing is depending on the files at that
+ *    point, and this fires regardless of whether a container was ever
+ *    created, so it doesn't depend on `docker ps`-based discovery the way
+ *    `legacyCleanupStartSecrets` does. Once the container is actually torn
+ *    down (a failed-start rollback, or a later `stop`),
+ *    `legacyCleanupStartSecrets` (`legacy-start-secrets-cleanup.ts`) reclaims
+ *    the staged directory then instead.
+ *
+ * Resolves to the created container's id/name on success.
+ */
+export function legacyStartContainer(
+  spawner: Spawner,
+  spec: LegacyStartContainerSpec,
+  opts: LegacyStartContainerOpts,
+): Effect.Effect<string, LegacyStartContainerError> {
+  return Effect.gen(function* () {
+    const labels: Record<string, string> = {
+      ...spec.labels,
+      [LEGACY_CLI_PROJECT_LABEL]: opts.projectId,
+      [LEGACY_COMPOSE_PROJECT_LABEL]: opts.projectId,
+    };
+    // The workdir label is stamped on the CONTAINER only, not on its named volumes below
+    // (`legacyEnsureStartVolume` is passed `labels`, not `containerLabels`) — a volume's own
+    // name already carries the project id, and nothing ever reads a workdir label back off a
+    // volume the way `legacyListContainerIdsAndNames` does for containers.
+    const containerLabels: Record<string, string> = {
+      ...labels,
+      [LEGACY_CLI_WORKDIR_LABEL]: opts.workdir,
+    };
+    const labeledSpec: LegacyStartContainerSpec = {
+      ...spec,
+      labels: containerLabels,
+      extraHosts: [...(spec.extraHosts ?? []), ...opts.extraHosts],
+    };
+
+    if (!opts.isBitbucketPipeline) {
+      for (const name of legacyNamedVolumeSources(labeledSpec.binds)) {
+        yield* legacyEnsureStartVolume(spawner, name, labels);
+      }
+    }
+
+    const finalSpec = legacyApplyBitbucketStartContainerFilter(
+      labeledSpec,
+      opts.isBitbucketPipeline,
+    );
+
+    const { binds: secretBinds, cleanup: cleanupSecretFiles } = yield* legacyStageStartSecretFiles(
+      finalSpec.secretFiles ?? [],
+      finalSpec.containerName,
+      opts.workdir,
+    );
+    const specWithSecretBinds: LegacyStartContainerSpec =
+      secretBinds.length === 0
+        ? finalSpec
+        : { ...finalSpec, binds: [...finalSpec.binds, ...secretBinds] };
+
+    return yield* Effect.gen(function* () {
+      const createArgs = legacyBuildStartContainerCreateArgs(specWithSecretBinds);
+      // `legacyIsDockerClientEnvKey` keys (e.g. Vector's container-facing `DOCKER_HOST`) are
+      // already emitted inline as `-e KEY=value` by `legacyBuildStartContainerCreateArgs` above —
+      // see `legacyDockerCreateContainer`'s doc comment for why they must not also reach the
+      // spawned `docker create` process's own environment.
+      const createProcessEnv = Object.fromEntries(
+        Object.entries(specWithSecretBinds.env).filter(([key]) => !legacyIsDockerClientEnvKey(key)),
+      );
+      const containerId = yield* legacyDockerCreateContainer(spawner, createArgs, createProcessEnv);
+      yield* legacyDockerStartContainer(spawner, containerId, specWithSecretBinds);
+      return containerId;
+    }).pipe(
+      Effect.onError(() =>
+        Effect.promise(cleanupSecretFiles).pipe(Effect.catchCause(() => Effect.void)),
+      ),
+    );
+  });
+}
diff --git a/apps/cli/src/legacy/commands/start/lib/container-lifecycle.unit.test.ts b/apps/cli/src/legacy/commands/start/lib/container-lifecycle.unit.test.ts
new file mode 100644
index 0000000000..b1ef49c9d4
--- /dev/null
+++ b/apps/cli/src/legacy/commands/start/lib/container-lifecycle.unit.test.ts
@@ -0,0 +1,837 @@
+import {
+  existsSync,
+  mkdirSync,
+  mkdtempSync,
+  readdirSync,
+  readFileSync,
+  rmSync,
+  statSync,
+  writeFileSync,
+} from "node:fs";
+import { tmpdir } from "node:os";
+import { dirname, join } from "node:path";
+
+import { describe, expect, it } from "@effect/vitest";
+import { Deferred, Effect, Fiber, PlatformError, Sink, Stream } from "effect";
+import { ChildProcessSpawner } from "effect/unstable/process";
+import { afterEach, beforeEach } from "vitest";
+
+import {
+  LegacyStartContainerCreateError,
+  LegacyStartContainerStartError,
+  LegacyStartNetworkCreateError,
+  LegacyStartVolumeCreateError,
+  LegacyStartVolumeInspectError,
+  legacyEnsureStartNetwork,
+  legacyEnsureStartVolume,
+  legacyStartContainer,
+  legacyStartVolumeExists,
+} from "./container-lifecycle.ts";
+import type { LegacyStartContainerSpec } from "./docker-create-args.ts";
+
+let workdir: string;
+
+beforeEach(() => {
+  workdir = mkdtempSync(join(tmpdir(), "supabase-legacy-start-container-lifecycle-"));
+});
+
+afterEach(() => {
+  rmSync(workdir, { recursive: true, force: true });
+});
+
+/** Matches the standing `mockSpawner` shape used across `legacy-docker-*.unit.test.ts` files, generalized to a per-call handler for multi-step orchestration (volume create -> container create -> container start). */
+function mockSpawner(
+  handler: (args: ReadonlyArray<string>) => { exitCode: number; stdout?: string; stderr?: string },
+) {
+  const encoder = new TextEncoder();
+  const spawned: Array<ReadonlyArray<string>> = [];
+  const spawnedOptions: Array<{
+    readonly args: ReadonlyArray<string>;
+    readonly env: Record<string, string | undefined> | undefined;
+    readonly extendEnv: boolean | undefined;
+  }> = [];
+
+  const spawner = ChildProcessSpawner.make((command) =>
+    Effect.gen(function* () {
+      const args = command._tag === "StandardCommand" ? command.args : [];
+      spawned.push(args);
+      if (command._tag === "StandardCommand") {
+        spawnedOptions.push({
+          args,
+          env: command.options.env,
+          extendEnv: command.options.extendEnv,
+        });
+      }
+      const result = handler(args);
+
+      const exitDeferred = yield* Deferred.make<ChildProcessSpawner.ExitCode>();
+      yield* Deferred.succeed(exitDeferred, ChildProcessSpawner.ExitCode(result.exitCode));
+
+      return ChildProcessSpawner.makeHandle({
+        pid: ChildProcessSpawner.ProcessId(1),
+        stdout: Stream.fromIterable(
+          result.stdout !== undefined ? [encoder.encode(result.stdout)] : [],
+        ),
+        stderr: Stream.fromIterable(
+          result.stderr !== undefined ? [encoder.encode(result.stderr)] : [],
+        ),
+        all: Stream.empty,
+        exitCode: Deferred.await(exitDeferred),
+        isRunning: Effect.succeed(false),
+        stdin: Sink.drain,
+        kill: () => Effect.void,
+        unref: Effect.succeed(Effect.void),
+        getInputFd: () => Sink.drain,
+        getOutputFd: () => Stream.empty,
+      });
+    }),
+  );
+
+  return {
+    spawner,
+    get spawned() {
+      return spawned;
+    },
+    get spawnedOptions() {
+      return spawnedOptions;
+    },
+  };
+}
+
+const baseSpec: LegacyStartContainerSpec = {
+  image: "public.ecr.aws/supabase/postgres:15",
+  containerName: "supabase_db_proj",
+  env: {},
+  binds: ["supabase_db_proj:/var/lib/postgresql/data", "/repo/backup.sql:/etc/backup.sql:ro"],
+  securityOpt: ["label:disable"],
+  networkId: "supabase_network_proj",
+  networkAliases: ["db"],
+  labels: {},
+};
+
+function alwaysSucceed(stdout = "container-id-123\n") {
+  return mockSpawner((args) => {
+    if (args[0] === "create") return { exitCode: 0, stdout };
+    return { exitCode: 0 };
+  });
+}
+
+describe("legacyStartContainer", () => {
+  it.live(
+    "merges project + compose labels, provisions named volumes, then creates and starts",
+    () => {
+      const mock = alwaysSucceed();
+      return legacyStartContainer(mock.spawner, baseSpec, {
+        projectId: "proj",
+        isBitbucketPipeline: false,
+        workdir,
+        extraHosts: [],
+      }).pipe(
+        Effect.map((containerId) => {
+          expect(containerId).toBe("container-id-123");
+
+          const volumeCreate = mock.spawned.find(
+            (args) => args[0] === "volume" && args[1] === "create",
+          );
+          expect(volumeCreate).toEqual([
+            "volume",
+            "create",
+            "--label",
+            "com.supabase.cli.project=proj",
+            "--label",
+            "com.docker.compose.project=proj",
+            "supabase_db_proj",
+          ]);
+
+          const create = mock.spawned.find((args) => args[0] === "create");
+          expect(create).toContain("--label");
+          expect(create).toContain("com.supabase.cli.project=proj");
+          expect(create).toContain("com.docker.compose.project=proj");
+          // Both the named-volume bind and the plain bind mount survive outside Bitbucket.
+          expect(create).toContain("supabase_db_proj:/var/lib/postgresql/data");
+          expect(create).toContain("/repo/backup.sql:/etc/backup.sql:ro");
+          expect(create).toContain("--security-opt");
+
+          const start = mock.spawned.find((args) => args[0] === "start");
+          expect(start).toEqual(["start", "container-id-123"]);
+
+          // Order matters: the volume must exist before `docker create` references it.
+          expect(mock.spawned.map((args) => args[0])).toEqual(["volume", "create", "start"]);
+        }),
+      );
+    },
+  );
+
+  it.live(
+    "stamps the container (but not its named volumes) with a com.supabase.cli.workdir label matching opts.workdir",
+    () => {
+      // Read back later by `legacyListContainerIdsAndNames` so a subsequent `stop`/rollback can
+      // reclaim `legacyCleanupStartSecrets`'s staged-secret directory from the CONTAINER's own
+      // label rather than the invoking caller's own cwd/`--workdir` (see that label's doc
+      // comment, `legacy-docker-ids.ts`). Volumes deliberately do NOT get this label — nothing
+      // ever reads it back off a volume, and the "merges project + compose labels..." test above
+      // already pins the volume's label list to exactly the two project-identity labels via
+      // `toEqual`, so a regression that leaked the workdir label onto volumes too would fail that
+      // test's exact-match assertion.
+      const mock = alwaysSucceed();
+      return legacyStartContainer(mock.spawner, baseSpec, {
+        projectId: "proj",
+        isBitbucketPipeline: false,
+        workdir,
+        extraHosts: [],
+      }).pipe(
+        Effect.map(() => {
+          const create = mock.spawned.find((args) => args[0] === "create");
+          expect(create).toContain(`com.supabase.cli.workdir=${workdir}`);
+        }),
+      );
+    },
+  );
+
+  it.live(
+    "passes the spec's env values through the spawned process's own environment, extending it",
+    () => {
+      // `docker-create-args.ts` emits the key-only `-e KEY` form (never `-e KEY=value`) so
+      // secrets never appear in argv — Docker then resolves each key's value from the
+      // spawned `docker create` process's own environment. If `env`/`extendEnv` are ever
+      // dropped from the spawn call again, every `-e KEY` flag silently resolves to nothing
+      // and every container starts with none of its configured environment.
+      const mock = alwaysSucceed();
+      const spec: LegacyStartContainerSpec = {
+        ...baseSpec,
+        env: { POSTGRES_PASSWORD: "s3cret", JWT_SECRET: "super-secret-value" },
+      };
+      return legacyStartContainer(mock.spawner, spec, {
+        projectId: "proj",
+        isBitbucketPipeline: false,
+        workdir,
+        extraHosts: [],
+      }).pipe(
+        Effect.map(() => {
+          const create = mock.spawnedOptions.find((entry) => entry.args[0] === "create");
+          expect(create?.env).toEqual({
+            POSTGRES_PASSWORD: "s3cret",
+            JWT_SECRET: "super-secret-value",
+          });
+          expect(create?.extendEnv).toBe(true);
+        }),
+      );
+    },
+  );
+
+  it.live(
+    "excludes DOCKER_HOST from the spawned docker create process's own env, even though it's in spec.env (Vector's tcp/npipe daemon host)",
+    () => {
+      // `env`/`extendEnv: true` merge `spec.env` INTO the spawned `docker create` process's own
+      // environment (see the previous test) — but `DOCKER_HOST` configures which daemon the
+      // `docker`/`podman` CLI CLIENT itself talks to, not a container env var read via `-e KEY`.
+      // Letting a container-facing `DOCKER_HOST` (e.g. Vector's `http://host.docker.internal:...`
+      // for a tcp/npipe daemon host) leak into the spawned process's own env would hijack which
+      // daemon this `docker create` call itself targets, before the container even exists.
+      const mock = alwaysSucceed();
+      const spec: LegacyStartContainerSpec = {
+        ...baseSpec,
+        env: { DOCKER_HOST: "http://host.docker.internal:2375", API_KEY: "s3cret" },
+      };
+      return legacyStartContainer(mock.spawner, spec, {
+        projectId: "proj",
+        isBitbucketPipeline: false,
+        workdir,
+        extraHosts: [],
+      }).pipe(
+        Effect.map(() => {
+          const create = mock.spawnedOptions.find((entry) => entry.args[0] === "create");
+          expect(create?.env).toEqual({ API_KEY: "s3cret" });
+          expect(create?.args).toContain("DOCKER_HOST=http://host.docker.internal:2375");
+        }),
+      );
+    },
+  );
+
+  it.live(
+    "skips volume creation and drops the named-volume bind + security-opt under Bitbucket Pipelines",
+    () => {
+      const mock = alwaysSucceed();
+      return legacyStartContainer(mock.spawner, baseSpec, {
+        projectId: "proj",
+        isBitbucketPipeline: true,
+        workdir,
+        extraHosts: [],
+      }).pipe(
+        Effect.map(() => {
+          expect(mock.spawned.some((args) => args[0] === "volume")).toBe(false);
+
+          const create = mock.spawned.find((args) => args[0] === "create");
+          expect(create).not.toContain("supabase_db_proj:/var/lib/postgresql/data");
+          expect(create).toContain("/repo/backup.sql:/etc/backup.sql:ro");
+          expect(create).not.toContain("--security-opt");
+        }),
+      );
+    },
+  );
+
+  it.live("fails with LegacyStartVolumeCreateError before ever creating the container", () => {
+    const mock = mockSpawner((args) => {
+      if (args[0] === "volume") return { exitCode: 1, stderr: "no space left on device\n" };
+      return { exitCode: 0, stdout: "should-not-be-created\n" };
+    });
+    return legacyStartContainer(mock.spawner, baseSpec, {
+      projectId: "proj",
+      isBitbucketPipeline: false,
+      workdir,
+      extraHosts: [],
+    }).pipe(
+      Effect.flip,
+      Effect.map((error) => {
+        expect(error).toBeInstanceOf(LegacyStartVolumeCreateError);
+        expect(error.message).toBe("failed to create volume: no space left on device");
+        expect(mock.spawned.some((args) => args[0] === "create")).toBe(false);
+      }),
+    );
+  });
+
+  it.live("fails with LegacyStartContainerCreateError on a `docker create` non-zero exit", () => {
+    const mock = mockSpawner((args) => {
+      if (args[0] === "create") return { exitCode: 1, stderr: "no such image\n" };
+      return { exitCode: 0 };
+    });
+    const spec: LegacyStartContainerSpec = { ...baseSpec, binds: [] };
+    return legacyStartContainer(mock.spawner, spec, {
+      projectId: "proj",
+      isBitbucketPipeline: false,
+      workdir,
+      extraHosts: [],
+    }).pipe(
+      Effect.flip,
+      Effect.map((error) => {
+        expect(error).toBeInstanceOf(LegacyStartContainerCreateError);
+        expect(error.message).toBe("failed to create docker container: no such image");
+        expect(mock.spawned.some((args) => args[0] === "start")).toBe(false);
+      }),
+    );
+  });
+
+  it.live("fails with LegacyStartContainerStartError, unmodified, on a plain start failure", () => {
+    const mock = mockSpawner((args) => {
+      if (args[0] === "create") return { exitCode: 0, stdout: "abc\n" };
+      if (args[0] === "start") return { exitCode: 1, stderr: "container is already stopped\n" };
+      return { exitCode: 0 };
+    });
+    const spec: LegacyStartContainerSpec = { ...baseSpec, binds: [] };
+    return legacyStartContainer(mock.spawner, spec, {
+      projectId: "proj",
+      isBitbucketPipeline: false,
+      workdir,
+      extraHosts: [],
+    }).pipe(
+      Effect.flip,
+      Effect.map((error) => {
+        expect(error).toBeInstanceOf(LegacyStartContainerStartError);
+        expect(error.message).toBe(
+          'failed to start docker container "supabase_db_proj": container is already stopped',
+        );
+      }),
+    );
+  });
+
+  it.live(
+    "appends a port-conflict suggestion, naming the container's first network alias, on a port-already-allocated failure",
+    () => {
+      const mock = mockSpawner((args) => {
+        if (args[0] === "create") return { exitCode: 0, stdout: "abc\n" };
+        if (args[0] === "start") {
+          return {
+            exitCode: 1,
+            stderr:
+              "Error response from daemon: driver failed programming external connectivity on endpoint supabase_db_proj: Bind for 0.0.0.0:5432 failed: port is already allocated\n",
+          };
+        }
+        return { exitCode: 0 };
+      });
+      const spec: LegacyStartContainerSpec = { ...baseSpec, binds: [] };
+      return legacyStartContainer(mock.spawner, spec, {
+        projectId: "proj",
+        isBitbucketPipeline: false,
+        workdir,
+        extraHosts: [],
+      }).pipe(
+        Effect.flip,
+        Effect.map((error) => {
+          expect(error).toBeInstanceOf(LegacyStartContainerStartError);
+          expect(error.message).toContain('failed to start docker container "supabase_db_proj"');
+          expect(error.message).toContain("0.0.0.0:5432");
+          expect(error.message).toContain("db port in supabase/config.toml");
+        }),
+      );
+    },
+  );
+});
+
+describe("legacyStartContainer secretFiles", () => {
+  it.live(
+    "stages a secretFile as a mode-0644 HOST file (readable by non-root container users) under a mode-0700 deterministic, per-container directory, bind-mounts it read-only at the exact containerPath, keeps the raw content out of argv, and PERSISTS the file after a successful start so a `restartPolicy: unless-stopped` container can survive a host/daemon restart (CWE-214/522)",
+    () => {
+      let hostPath: string | undefined;
+      let modeAtCreateTime: number | undefined;
+      let dirModeAtCreateTime: number | undefined;
+      const mock = mockSpawner((args) => {
+        if (args[0] === "create") {
+          const bind = args.find((a) => a.endsWith(":/etc/kong/kong.yml:ro"));
+          if (bind !== undefined) {
+            hostPath = bind.slice(0, bind.length - ":/etc/kong/kong.yml:ro".length);
+            modeAtCreateTime = statSync(hostPath).mode & 0o777;
+            dirModeAtCreateTime = statSync(dirname(hostPath)).mode & 0o777;
+          }
+          return { exitCode: 0, stdout: "container-id-789\n" };
+        }
+        return { exitCode: 0 };
+      });
+
+      const spec: LegacyStartContainerSpec = {
+        ...baseSpec,
+        secretFiles: [{ containerPath: "/etc/kong/kong.yml", content: "super-secret-content" }],
+      };
+
+      return legacyStartContainer(mock.spawner, spec, {
+        projectId: "proj",
+        isBitbucketPipeline: false,
+        workdir,
+        extraHosts: [],
+      }).pipe(
+        Effect.map((containerId) => {
+          expect(containerId).toBe("container-id-789");
+
+          const create = mock.spawned.find((a) => a[0] === "create");
+          expect(create?.some((a) => a.includes("super-secret-content"))).toBe(false);
+
+          expect(hostPath).toBeDefined();
+          expect(modeAtCreateTime).toBe(0o644);
+          expect(dirModeAtCreateTime).toBe(0o700);
+          expect(create).toContain(`${hostPath}:/etc/kong/kong.yml:ro`);
+
+          // Deterministic — rooted in the project's own workdir, not an OS temp dir, and
+          // scoped by container name so sibling services never collide.
+          expect(hostPath).toBe(
+            join(workdir, "supabase", ".temp", "start-secrets", spec.containerName, "secret-0"),
+          );
+
+          // The staged file is left in place after a successful start: it must survive for
+          // the container's whole lifetime so a `restartPolicy: unless-stopped` restart (e.g.
+          // dockerd re-attaching this bind mount after a host reboot, long after this process
+          // has exited) can still read it.
+          expect(existsSync(hostPath ?? "")).toBe(true);
+        }),
+      );
+    },
+  );
+
+  it.live(
+    "keeps the staged secretFile at HOST mode 0644 even under a restrictive process umask (writeFile's `mode` is only a creation-time hint ANDed with the umask — without the explicit chmod, a 0077 umask would silently narrow the on-disk mode to 0600 and the non-root in-container reader would get EACCES)",
+    () => {
+      let hostPath: string | undefined;
+      let modeAtCreateTime: number | undefined;
+      const mock = mockSpawner((args) => {
+        if (args[0] === "create") {
+          const bind = args.find((a) => a.endsWith(":/etc/kong/kong.yml:ro"));
+          if (bind !== undefined) {
+            hostPath = bind.slice(0, bind.length - ":/etc/kong/kong.yml:ro".length);
+            modeAtCreateTime = statSync(hostPath).mode & 0o777;
+          }
+          return { exitCode: 0, stdout: "container-id-umask\n" };
+        }
+        return { exitCode: 0 };
+      });
+
+      const spec: LegacyStartContainerSpec = {
+        ...baseSpec,
+        secretFiles: [{ containerPath: "/etc/kong/kong.yml", content: "super-secret-content" }],
+      };
+
+      // `it.live`'s test function runs inside `Effect.suspend`, so a plain JS try/finally around
+      // this `return` would restore the umask synchronously right after CONSTRUCTING the effect
+      // pipeline below, before it actually runs — long before the real write+chmod happens.
+      // `Effect.ensuring` is the effect-native equivalent: it sequences the restore to run only
+      // after this effect actually completes, on success, failure, or defect alike.
+      return Effect.sync(() => process.umask(0o077)).pipe(
+        Effect.flatMap((originalUmask) =>
+          legacyStartContainer(mock.spawner, spec, {
+            projectId: "proj",
+            isBitbucketPipeline: false,
+            workdir,
+            extraHosts: [],
+          }).pipe(
+            Effect.map(() => {
+              expect(hostPath).toBeDefined();
+              expect(modeAtCreateTime).toBe(0o644);
+            }),
+            Effect.ensuring(Effect.sync(() => process.umask(originalUmask))),
+          ),
+        ),
+      );
+    },
+  );
+
+  it.live(
+    "removes any pre-existing directory at the deterministic path before writing fresh files (self-healing across config changes)",
+    () => {
+      const dir = join(workdir, "supabase", ".temp", "start-secrets", baseSpec.containerName);
+      mkdirSync(dir, { recursive: true });
+      writeFileSync(join(dir, "stale-leftover-from-a-previous-config"), "old-content");
+
+      const mock = alwaysSucceed("container-id-stale\n");
+      const spec: LegacyStartContainerSpec = {
+        ...baseSpec,
+        secretFiles: [{ containerPath: "/etc/kong/kong.yml", content: "fresh-content" }],
+      };
+
+      return legacyStartContainer(mock.spawner, spec, {
+        projectId: "proj",
+        isBitbucketPipeline: false,
+        workdir,
+        extraHosts: [],
+      }).pipe(
+        Effect.map(() => {
+          expect(readdirSync(dir)).toEqual(["secret-0"]);
+          expect(readFileSync(join(dir, "secret-0"), "utf8")).toBe("fresh-content");
+        }),
+      );
+    },
+  );
+
+  it.live("cleans up the staged file even when `docker create` fails", () => {
+    let hostPath: string | undefined;
+    const mock = mockSpawner((args) => {
+      if (args[0] === "create") {
+        const bind = args.find((a) => a.endsWith(":/etc/kong/kong.yml:ro"));
+        hostPath = bind?.slice(0, bind.length - ":/etc/kong/kong.yml:ro".length);
+        return { exitCode: 1, stderr: "no such image\n" };
+      }
+      return { exitCode: 0 };
+    });
+
+    const spec: LegacyStartContainerSpec = {
+      ...baseSpec,
+      binds: [],
+      secretFiles: [{ containerPath: "/etc/kong/kong.yml", content: "super-secret-content" }],
+    };
+
+    return legacyStartContainer(mock.spawner, spec, {
+      projectId: "proj",
+      isBitbucketPipeline: false,
+      workdir,
+      extraHosts: [],
+    }).pipe(
+      Effect.flip,
+      Effect.map((error) => {
+        expect(error).toBeInstanceOf(LegacyStartContainerCreateError);
+        expect(hostPath).toBeDefined();
+        expect(existsSync(hostPath ?? "")).toBe(false);
+      }),
+    );
+  });
+
+  it.live(
+    "cleans up the staged file when `docker create` succeeds but `docker start` fails",
+    () => {
+      let hostPath: string | undefined;
+      const mock = mockSpawner((args) => {
+        if (args[0] === "create") {
+          const bind = args.find((a) => a.endsWith(":/etc/kong/kong.yml:ro"));
+          hostPath = bind?.slice(0, bind.length - ":/etc/kong/kong.yml:ro".length);
+          return { exitCode: 0, stdout: "container-id-abc\n" };
+        }
+        if (args[0] === "start") {
+          return { exitCode: 1, stderr: "container is already stopped\n" };
+        }
+        return { exitCode: 0 };
+      });
+
+      const spec: LegacyStartContainerSpec = {
+        ...baseSpec,
+        binds: [],
+        secretFiles: [{ containerPath: "/etc/kong/kong.yml", content: "super-secret-content" }],
+      };
+
+      return legacyStartContainer(mock.spawner, spec, {
+        projectId: "proj",
+        isBitbucketPipeline: false,
+        workdir,
+        extraHosts: [],
+      }).pipe(
+        Effect.flip,
+        Effect.map((error) => {
+          expect(error).toBeInstanceOf(LegacyStartContainerStartError);
+          expect(hostPath).toBeDefined();
+          // The container never successfully started, so nothing depends on the file surviving.
+          expect(existsSync(hostPath ?? "")).toBe(false);
+        }),
+      );
+    },
+  );
+
+  it.live(
+    "cleans up the staged file on a SIGINT-style interruption mid-`docker create`, matching Go's no-orphaned-secrets guarantee",
+    () => {
+      // Go never writes these secrets to a host file at all (see `legacyStageStartSecretFiles`'s
+      // doc comment), so this is judged on its own correctness/security merits, not Go parity:
+      // a SIGINT landing after staging but before `docker create` returns must not leave a
+      // plaintext secret file behind indefinitely. `Effect.tapError` (the previous wiring) never
+      // sees a pure fiber interrupt — only `Effect.onError` does — same class of gap already
+      // fixed for the top-level bring-up rollback in `start.handler.ts`.
+      const createStarted = Deferred.makeUnsafe<void>();
+      const hangForever = Deferred.makeUnsafe<ChildProcessSpawner.ExitCode>();
+      let hostPath: string | undefined;
+      const encoder = new TextEncoder();
+
+      const spawner = ChildProcessSpawner.make((command) =>
+        Effect.gen(function* () {
+          const args = command._tag === "StandardCommand" ? command.args : [];
+          if (args[0] === "create") {
+            const bind = args.find((a) => a.endsWith(":/etc/kong/kong.yml:ro"));
+            hostPath = bind?.slice(0, bind.length - ":/etc/kong/kong.yml:ro".length);
+            yield* Deferred.succeed(createStarted, undefined);
+            // Never resolves on its own — only interruption ends this "process".
+            return ChildProcessSpawner.makeHandle({
+              pid: ChildProcessSpawner.ProcessId(1),
+              stdout: Stream.empty,
+              stderr: Stream.empty,
+              all: Stream.empty,
+              exitCode: Deferred.await(hangForever),
+              isRunning: Effect.succeed(true),
+              stdin: Sink.drain,
+              kill: () => Effect.void,
+              unref: Effect.succeed(Effect.void),
+              getInputFd: () => Sink.drain,
+              getOutputFd: () => Stream.empty,
+            });
+          }
+          const exitDeferred = yield* Deferred.make<ChildProcessSpawner.ExitCode>();
+          yield* Deferred.succeed(exitDeferred, ChildProcessSpawner.ExitCode(0));
+          return ChildProcessSpawner.makeHandle({
+            pid: ChildProcessSpawner.ProcessId(1),
+            stdout: Stream.fromIterable([encoder.encode("")]),
+            stderr: Stream.empty,
+            all: Stream.empty,
+            exitCode: Deferred.await(exitDeferred),
+            isRunning: Effect.succeed(false),
+            stdin: Sink.drain,
+            kill: () => Effect.void,
+            unref: Effect.succeed(Effect.void),
+            getInputFd: () => Sink.drain,
+            getOutputFd: () => Stream.empty,
+          });
+        }),
+      );
+
+      const spec: LegacyStartContainerSpec = {
+        ...baseSpec,
+        binds: [],
+        secretFiles: [{ containerPath: "/etc/kong/kong.yml", content: "super-secret-content" }],
+      };
+
+      return Effect.gen(function* () {
+        const fiber = yield* legacyStartContainer(spawner, spec, {
+          projectId: "proj",
+          isBitbucketPipeline: false,
+          workdir,
+          extraHosts: [],
+        }).pipe(Effect.forkChild({ startImmediately: true }));
+        yield* Deferred.await(createStarted);
+        expect(hostPath).toBeDefined();
+        expect(existsSync(hostPath ?? "")).toBe(true);
+        yield* Fiber.interrupt(fiber);
+        expect(existsSync(hostPath ?? "")).toBe(false);
+      });
+    },
+  );
+
+  it.live(
+    "maps a staging write failure to LegacyStartContainerCreateError, without ever invoking `docker create`",
+    () => {
+      const dir = join(workdir, "supabase", ".temp", "start-secrets", baseSpec.containerName);
+      // `dir` itself doesn't exist yet, so the self-healing `rm(dir, ...)` up front is a no-op —
+      // but its PARENT ("start-secrets") is a plain file instead of a directory, which forces
+      // `mkdir(dir, { recursive: true })` to fail with ENOTDIR. This exercises the staging
+      // try/catch's failure branch, which has no other way to fail deterministically from a
+      // unit test.
+      mkdirSync(dirname(dirname(dir)), { recursive: true });
+      writeFileSync(dirname(dir), "not a directory");
+
+      const mock = mockSpawner(() => ({ exitCode: 0, stdout: "should-not-be-created\n" }));
+      const spec: LegacyStartContainerSpec = {
+        ...baseSpec,
+        binds: [],
+        secretFiles: [{ containerPath: "/etc/kong/kong.yml", content: "super-secret-content" }],
+      };
+
+      return legacyStartContainer(mock.spawner, spec, {
+        projectId: "proj",
+        isBitbucketPipeline: false,
+        workdir,
+        extraHosts: [],
+      }).pipe(
+        Effect.flip,
+        Effect.map((error) => {
+          expect(error).toBeInstanceOf(LegacyStartContainerCreateError);
+          expect(error.message).toMatch(
+            /^failed to create docker container: failed to stage container secret files: /,
+          );
+          expect(mock.spawned.some((args) => args[0] === "create")).toBe(false);
+          // `mkdir` never got far enough to create anything at the per-container path — the
+          // inner catch's own `rm(dir, ...)` cleanup call is a no-op here, but still runs.
+          expect(existsSync(dir)).toBe(false);
+        }),
+      );
+    },
+  );
+});
+
+describe("legacyEnsureStartNetwork", () => {
+  it.live("creates the network with labels", () => {
+    const mock = mockSpawner(() => ({ exitCode: 0 }));
+    return legacyEnsureStartNetwork(mock.spawner, "supabase_network_proj", {
+      "com.supabase.cli.project": "proj",
+      "com.docker.compose.project": "proj",
+    }).pipe(
+      Effect.map(() => {
+        expect(mock.spawned).toEqual([
+          [
+            "network",
+            "create",
+            "--label",
+            "com.supabase.cli.project=proj",
+            "--label",
+            "com.docker.compose.project=proj",
+            "supabase_network_proj",
+          ],
+        ]);
+      }),
+    );
+  });
+
+  it.live("treats an already-exists failure as success", () => {
+    const mock = mockSpawner(() => ({
+      exitCode: 1,
+      stderr:
+        "Error response from daemon: network with name supabase_network_proj already exists\n",
+    }));
+    return legacyEnsureStartNetwork(mock.spawner, "supabase_network_proj", {}).pipe(
+      Effect.map(() => {
+        // Just needs to not fail — no return value to assert on.
+      }),
+    );
+  });
+
+  it.live("fails with LegacyStartNetworkCreateError on any other failure", () => {
+    const mock = mockSpawner(() => ({ exitCode: 1, stderr: "permission denied\n" }));
+    return legacyEnsureStartNetwork(mock.spawner, "supabase_network_proj", {}).pipe(
+      Effect.flip,
+      Effect.map((error) => {
+        expect(error).toBeInstanceOf(LegacyStartNetworkCreateError);
+        expect(error.message).toBe("failed to create docker network: permission denied");
+      }),
+    );
+  });
+
+  it.live.each(["default", "bridge", "host", "none"])(
+    "skips docker network create for the built-in %s network",
+    (networkId) => {
+      const mock = mockSpawner(() => ({
+        exitCode: 1,
+        stderr: "operation is not permitted on predefined host network",
+      }));
+      return legacyEnsureStartNetwork(mock.spawner, networkId, {}).pipe(
+        Effect.map(() => {
+          expect(mock.spawned).toEqual([]);
+        }),
+      );
+    },
+  );
+});
+
+describe("legacyEnsureStartVolume", () => {
+  it.live("creates the named volume with labels", () => {
+    const mock = mockSpawner(() => ({ exitCode: 0 }));
+    return legacyEnsureStartVolume(mock.spawner, "supabase_db_proj", {
+      "com.supabase.cli.project": "proj",
+    }).pipe(
+      Effect.map(() => {
+        expect(mock.spawned).toEqual([
+          ["volume", "create", "--label", "com.supabase.cli.project=proj", "supabase_db_proj"],
+        ]);
+      }),
+    );
+  });
+
+  it.live("fails on any non-zero exit, with no already-exists tolerance", () => {
+    const mock = mockSpawner(() => ({
+      exitCode: 1,
+      stderr:
+        "a volume named supabase_db_proj already exists but was not created for the current specification\n",
+    }));
+    return legacyEnsureStartVolume(mock.spawner, "supabase_db_proj", {}).pipe(
+      Effect.flip,
+      Effect.map((error) => {
+        expect(error).toBeInstanceOf(LegacyStartVolumeCreateError);
+        expect(error.message).toBe(
+          "failed to create volume: a volume named supabase_db_proj already exists but was not created for the current specification",
+        );
+      }),
+    );
+  });
+});
+
+describe("legacyStartVolumeExists", () => {
+  it.live("resolves true when `docker volume inspect` exits 0", () => {
+    const mock = mockSpawner(() => ({ exitCode: 0, stdout: "[]\n" }));
+    return legacyStartVolumeExists(mock.spawner, "supabase_db_proj").pipe(
+      Effect.map((exists) => {
+        expect(exists).toBe(true);
+        expect(mock.spawned).toEqual([["volume", "inspect", "supabase_db_proj"]]);
+      }),
+    );
+  });
+
+  it.live('resolves false on a "no such volume" non-zero exit', () => {
+    const mock = mockSpawner(() => ({
+      exitCode: 1,
+      stderr: "Error: No such volume: supabase_db_proj\n",
+    }));
+    return legacyStartVolumeExists(mock.spawner, "supabase_db_proj").pipe(
+      Effect.map((exists) => {
+        expect(exists).toBe(false);
+      }),
+    );
+  });
+
+  it.live(
+    "resolves true (protected, not fresh) on an ambiguous inspect failure, matching Go's IsNotFound gate",
+    () => {
+      const mock = mockSpawner(() => ({ exitCode: 1, stderr: "permission denied\n" }));
+      return legacyStartVolumeExists(mock.spawner, "supabase_db_proj").pipe(
+        Effect.map((exists) => {
+          expect(exists).toBe(true);
+        }),
+      );
+    },
+  );
+
+  it.live("fails with LegacyStartVolumeInspectError when no runtime can be spawned", () => {
+    const spawner = ChildProcessSpawner.make(() =>
+      Effect.fail(
+        PlatformError.systemError({
+          _tag: "NotFound",
+          module: "ChildProcess",
+          method: "spawn",
+          description: "spawn ENOENT",
+        }),
+      ),
+    );
+    return legacyStartVolumeExists(spawner, "supabase_db_proj").pipe(
+      Effect.flip,
+      Effect.map((error) => {
+        expect(error).toBeInstanceOf(LegacyStartVolumeInspectError);
+      }),
+    );
+  });
+});
diff --git a/apps/cli/src/legacy/commands/start/lib/db-setup.ts b/apps/cli/src/legacy/commands/start/lib/db-setup.ts
new file mode 100644
index 0000000000..c9722c8cdd
--- /dev/null
+++ b/apps/cli/src/legacy/commands/start/lib/db-setup.ts
@@ -0,0 +1,650 @@
+/**
+ * Post-Postgres-health local database setup pipeline — a strict 1:1 port of Go's
+ * `SetupLocalDatabase` (`apps/cli-go/internal/db/start/start.go:359-381`), run once
+ * the `db` container's healthcheck passes on a FRESH volume (Go's `NoBackupVolume`
+ * gate, `start.go:184` — the caller decides whether to invoke this at all; see
+ * `legacyStartVolumeExists` in `./container-lifecycle.ts`). The single exported
+ * entry point, {@link legacyStartSetupLocalDatabase}, runs the exact Go call chain
+ * in order:
+ *
+ * 1. **`initSchema`** (`start.go:243-266`) — prints `Initialising schema...`, then
+ *    branches on `db.major_version`:
+ *    - **PG <= 14**: execs {@link LEGACY_START_DB_GLOBALS_SQL} (`utils.GlobalsSql`)
+ *      then either {@link LEGACY_START_DB_INITIAL_SCHEMA_13_SQL} or
+ *      {@link LEGACY_START_DB_INITIAL_SCHEMA_14_SQL} (`InitSchema14`, `start.go:256-266`,
+ *      keyed on `major_version == 13`), each via `legacyExecSqlFile` against a temp file.
+ *    - **PG >= 15** (`initSchema15`, `start.go:334-357`): runs up to three one-shot,
+ *      foreground Docker jobs (`utils.DockerRunJob` = `DockerRunOnceWithStream`, a
+ *      run-to-completion container on the SAME Docker network as `db` — Go's
+ *      `DockerStart` defaults `NetworkMode` to `utils.NetId` when unset,
+ *      `docker.go:379-383`), each gated on its own service's `enabled` flag and none
+ *      of which touch `conn` directly:
+ *      - `initRealtimeJob` (`start.go:268-295`) — reuses
+ *        `../services/realtime.service.ts`'s `legacyBuildRealtimeEnv`, which builds
+ *        the byte-identical env-var literal Go's own `initRealtimeJob` embeds
+ *        verbatim (both are the same Go `Env` list, just addressed from two call
+ *        sites: the long-running container and this one-shot job).
+ *      - `initStorageJob` (`start.go:297-317`) — a DELIBERATELY SMALLER, differently-
+ *        keyed env set than the long-running Storage container's own
+ *        `storage.service.ts` builder (`PGRST_JWT_SECRET` not `AUTH_JWT_SECRET`,
+ *        `STORAGE_FILE_BACKEND_PATH` not `FILE_STORAGE_BACKEND_PATH`, `REGION` not
+ *        `STORAGE_S3_REGION`, no JWKS) — built locally, not reused.
+ *      - `initAuthJob` (`start.go:319-332`) — ditto, a minimal env distinct from
+ *        `gotrue.service.ts`'s full container builder.
+ * 2. **`ApplyApiPrivileges`** (`start.go:414-435`) — tri-state on
+ *    `api.auto_expose_new_tables`: `true` is a no-op (keep the bundled initial-schema
+ *    grants); unset/`false` execs {@link LEGACY_START_REVOKE_API_PRIVILEGES_SQL}
+ *    (Go's inline `RevokeDefaultDataApiPrivilegesSql` constant, `start.go:405-412`)
+ *    via a temp file, same as the schema SQL above.
+ * 3. **Vault upsert** (`start.go:390-393`) — `legacyUpsertVaultSecrets`, run BEFORE
+ *    the custom-roles seed "so roles.sql can reference them" (Go's own comment).
+ * 4. **Custom-roles seed** (`start.go:394-398` + `pkg/migration/seed.go:84-97`) —
+ *    prints "Seeding globals from roles.sql..." UNCONDITIONALLY, BEFORE checking
+ *    whether `supabase/roles.sql` even exists (Go's `SeedGlobals` prints first,
+ *    then attempts the read), then execs the file via `legacyExecSqlFile` only when
+ *    it's actually present. A missing file is tolerated (Go's `errors.Is(err,
+ *    os.ErrNotExist)` check, reproduced here as an existence check ahead of the read
+ *    rather than a caught not-found error — see the call site's own comment for why);
+ *    any other read/exec error propagates.
+ * 5. **`apply.MigrateAndSeed`** (`start.go:368`, via the already-ported
+ *    `legacyMigrateAndSeed`) with `version: ""` — every pending migration, matching
+ *    `SetupLocalDatabase`'s own call in the `start` context.
+ *
+ * Go's `initCurrentBranch` (`start.go:233-241`, writes `supabase/.branches/
+ * _current_branch` = `"main"` if absent) is NOT part of this pipeline, even though
+ * it's exported from this module ({@link legacyStartInitCurrentBranch}): in Go it's
+ * called by `StartDatabase` (the caller of `SetupLocalDatabase`) UNCONDITIONALLY,
+ * regardless of `NoBackupVolume` (`start.go:184-189`) — unlike everything above,
+ * which only runs on a fresh volume. `start.handler.ts` calls it directly, outside
+ * the `isFreshVolume` gate that wraps {@link legacyStartSetupLocalDatabase}.
+ *
+ * Go's best-effort `pgcache.TryCacheMigrationsCatalog` warning (`start.go:371-379`)
+ * is intentionally NOT ported — same accepted, documented divergence as
+ * `db/reset/reset.handler.ts`'s identical comment (no output impact either way).
+ *
+ * This module also duplicates ONE config-load pass: `legacyCheckDbToml` is called
+ * internally (not threaded in from the caller) to resolve `[db.vault]`, `[db.seed]`,
+ * `db.migrations.enabled`, and the effective `api.auto_expose_new_tables` tri-state —
+ * the same accepted duplication `db start`'s own handler already takes
+ * independently of the top-level `start` command's own config resolution (see
+ * `commands/db/start/start.handler.ts:40`).
+ */
+
+import type { ProjectConfig } from "@supabase/config";
+import { Data, Effect, type FileSystem, Option, type Path } from "effect";
+
+import { Output } from "../../../../shared/output/output.service.ts";
+import { RuntimeInfo } from "../../../../shared/runtime/runtime-info.service.ts";
+import type { LegacyDbSession } from "../../../shared/legacy-db-connection.service.ts";
+import { LegacyDbConfigLoadError } from "../../../shared/legacy-db-config.errors.ts";
+import { legacyCheckDbToml } from "../../../shared/legacy-db-config.toml-read.ts";
+import { legacyServiceContainerName } from "../../../shared/legacy-docker-ids.ts";
+import {
+  LegacyDockerRun,
+  type LegacyDockerRunOpts,
+} from "../../../shared/legacy-docker-run.service.ts";
+import { legacyMigrateAndSeed } from "../../../shared/legacy-migrate-and-seed.ts";
+import {
+  LegacyMigrationApplyError,
+  legacyExecSqlFile,
+} from "../../../shared/legacy-migration-apply.ts";
+import type { LegacyMigrationSeedError } from "../../../shared/legacy-seed.ts";
+import { ramInBytes } from "../../../shared/legacy-size-units.ts";
+import {
+  LegacyMigrationVaultError,
+  legacyUpsertVaultSecrets,
+} from "../../../shared/legacy-vault.ts";
+import { LEGACY_REALTIME_TENANT_ID, legacyBuildRealtimeEnv } from "../services/realtime.service.ts";
+import { LEGACY_START_DB_GLOBALS_SQL } from "../templates/db-globals.sql.ts";
+import { LEGACY_START_DB_INITIAL_SCHEMA_13_SQL } from "../templates/db-initial-schema-13.sql.ts";
+import { LEGACY_START_DB_INITIAL_SCHEMA_14_SQL } from "../templates/db-initial-schema-14.sql.ts";
+import {
+  legacyStartInternalDbPassword,
+  legacyStartInternalDbUrl,
+} from "./internal-db-connection.ts";
+
+/**
+ * Go's inline `RevokeDefaultDataApiPrivilegesSql` constant (`start.go:405-412`) —
+ * NOT a `//go:embed` file (unlike the three large SQL templates), so transcribed
+ * directly here rather than as a sibling `templates/*.sql.ts` module.
+ */
+const LEGACY_START_REVOKE_API_PRIVILEGES_SQL = `
+alter default privileges for role postgres in schema public
+  revoke select, insert, update, delete on tables from anon, authenticated, service_role;
+alter default privileges for role postgres in schema public
+  revoke usage, select on sequences from anon, authenticated, service_role;
+alter default privileges for role postgres in schema public
+  revoke execute on functions from anon, authenticated, service_role;
+`;
+
+/**
+ * A SQL exec (schema/globals/API-privileges) or one-shot service-migration Docker
+ * job failed, or the scratch temp directory/file could not be created. The Docker
+ * job branch's message mirrors Go's `DockerRunOnceWithStream` failure shape
+ * (`errors.Errorf("error running container: %w", err)`, `apps/cli-go/internal/
+ * utils/docker.go:469-487,559-591` — Go discards the container's own stdout/stderr
+ * outside `--debug`, so only the exit code is meaningful here too).
+ */
+export class LegacyStartDbSetupError extends Data.TaggedError("LegacyStartDbSetupError")<{
+  readonly message: string;
+}> {}
+
+/** Every failure {@link legacyStartSetupLocalDatabase} can produce. */
+export type LegacyStartSetupLocalDatabaseError =
+  | LegacyDbConfigLoadError
+  | LegacyStartDbSetupError
+  | LegacyMigrationVaultError
+  | LegacyMigrationApplyError
+  | LegacyMigrationSeedError;
+
+/** Already-resolved Docker images for the three PG15+ one-shot migrate jobs (`initSchema15`'s `initJobs`). */
+export interface LegacyStartDbSetupImages {
+  /** `utils.Config.Realtime.Image`, resolved by the caller (not part of the decoded `ProjectConfig` schema — `toml:"-"`). */
+  readonly realtime: string;
+  /** `utils.Config.Storage.Image`, ditto. */
+  readonly storage: string;
+  /** `utils.Config.Auth.Image`, ditto. */
+  readonly auth: string;
+}
+
+/** Input to {@link legacyStartSetupLocalDatabase}. */
+export interface LegacyStartSetupLocalDatabaseInput {
+  /**
+   * An already-open session to the local Postgres database, dialed the same way
+   * Go's `ConnectLocalPostgres(ctx, pgconn.Config{})` does (`internal/utils/
+   * connect.go:144-167`): the HOST-facing address (`legacyGetHostname()` +
+   * `db.port`, user `postgres`, `isLocal: true`) — the SAME shape `legacy-db-
+   * config.layer.ts`'s own `--local` branch already dials (`legacy-db-config.
+   * layer.ts:518-529`). This is deliberately NOT the internal Docker-network `db`
+   * container address the PG15+ one-shot jobs below connect through (see
+   * `networkId`/`projectId`) — the two addressing schemes are independent, exactly
+   * like Go's `conn` (host-facing) vs. `host` parameter (`utils.DbId`) in
+   * `SetupDatabase(ctx, conn, utils.DbId, w, fsys)`.
+   */
+  readonly session: LegacyDbSession;
+  readonly fs: FileSystem.FileSystem;
+  readonly path: Path.Path;
+  /** The Supabase project root (parent of `supabase/`). */
+  readonly workdir: string;
+  /** The caller's already-resolved, effective config (env overrides already applied). */
+  readonly config: ProjectConfig;
+  /** `db.major_version` (13-17) — Go's `utils.Config.Db.MajorVersion`, resolved by the caller once, ahead of the `db` container's own image tag selection. */
+  readonly majorVersion: number;
+  /** Go's `Config.ProjectId`, already sanitized (`legacySanitizeProjectId`) — derives the `db` container's internal Docker name for the PG15+ one-shot jobs (`legacyServiceContainerName("db", projectId)`, Go's `utils.DbId`). */
+  readonly projectId: string;
+  /** The `start` run's Docker network id (Go's `utils.NetId` or the `--network-id` override) — every PG15+ one-shot job joins it, matching `DockerStart`'s own default (`docker.go:379-383`). */
+  readonly networkId: string;
+  /** `LegacyLocalConfigValues.dbUrl` — reused (not recomputed) to derive the internal DB password via `legacyStartInternalDbPassword`, matching every other `start/services/*.service.ts` builder. */
+  readonly dbUrl: string;
+  /** `LegacyLocalConfigValues.jwtSecret`. */
+  readonly jwtSecret: string;
+  /** `legacyResolveLocalJwks`'s resolved JWKS JSON string (only read when `realtime.enabled`) — already built by the caller, not recomputed here. */
+  readonly jwks: string;
+  /** `LegacyLocalConfigValues.apiUrl` — the auth job's `API_EXTERNAL_URL` falls back to this, `/auth/v1`-suffixed, only when {@link authExternalUrl} is unset. */
+  readonly apiUrl: string;
+  /**
+   * Raw `auth.external_url` (already `SUPABASE_AUTH_EXTERNAL_URL`-overridden
+   * by the caller) — Go's `Config.Auth.ExternalUrl`/`AuthExternalURL()`
+   * (`pkg/config/config.go:543-545`, `auth.go:401-405`): an explicit value
+   * wins over the `apiUrl`-derived fallback, same as `gotrue.service.ts`'s
+   * `LegacyBuildGotrueEnvInput.authExternalUrl` for the long-running
+   * container — this one-shot job must resolve to the SAME value so a fresh
+   * database's auth migration never disagrees with the container it's
+   * migrating for.
+   */
+  readonly authExternalUrl?: string;
+  /**
+   * `LegacyLocalConfigValues.authSiteUrl` (already `SUPABASE_AUTH_SITE_URL`-
+   * overridden by the caller) — Go's `initAuthJob` reads the same overridden
+   * `utils.Config.Auth.SiteUrl` the long-running GoTrue container does
+   * (`apps/cli-go/internal/db/start/start.go:327`, `internal/start/
+   * start.go:1365`), so this one-shot job must resolve to the SAME value,
+   * not the raw `config.auth.site_url` — same rationale as
+   * {@link authExternalUrl} above.
+   */
+  readonly siteUrl: string;
+  /** `LegacyLocalConfigValues.anonKey`. */
+  readonly anonKey: string;
+  /** `LegacyLocalConfigValues.serviceRoleKey`. */
+  readonly serviceRoleKey: string;
+  /** Go's `utils.Config.Storage.TargetMigration` (`toml:"-"`, resolved from a version-pin file) — the caller passes `""` when absent, matching Go's zero-value default. */
+  readonly storageTargetMigration: string;
+  readonly images: LegacyStartDbSetupImages;
+}
+
+const errMessage = (e: unknown): string =>
+  typeof e === "object" && e !== null && "message" in e && typeof e.message === "string"
+    ? e.message
+    : String(e);
+
+/**
+ * Writes `sql` to `<tmpDir>/<filename>` and execs it via `legacyExecSqlFile`
+ * (Go's `migration.NewMigrationFromReader(strings.NewReader(sql))` +
+ * `file.ExecBatch(ctx, conn)` on an in-memory string — there is no on-disk file in
+ * Go at all; this port needs one only because `legacyExecSqlFile` reads from the
+ * filesystem like every other `execMigrationBatch` caller).
+ */
+const legacyExecSqlConstant = Effect.fnUntraced(function* (
+  session: LegacyDbSession,
+  fs: FileSystem.FileSystem,
+  path: Path.Path,
+  tmpDir: string,
+  filename: string,
+  sql: string,
+) {
+  const filePath = path.join(tmpDir, filename);
+  yield* fs.writeFileString(filePath, sql).pipe(
+    Effect.mapError(
+      (error) =>
+        new LegacyStartDbSetupError({
+          message: `failed to write ${filename}: ${errMessage(error)}`,
+        }),
+    ),
+  );
+  yield* legacyExecSqlFile(
+    session,
+    fs,
+    path,
+    filePath,
+    (message) => new LegacyStartDbSetupError({ message }),
+  );
+});
+
+/**
+ * Port of Go's `InitSchema14` (`start.go:256-266`): execs
+ * {@link LEGACY_START_DB_GLOBALS_SQL} then the major-version-appropriate initial
+ * schema. Only reached for `majorVersion <= 14` (the caller, `legacyStartInitSchema`,
+ * gates on that).
+ */
+const legacyStartInitSchemaPre15 = Effect.fnUntraced(function* (
+  session: LegacyDbSession,
+  fs: FileSystem.FileSystem,
+  path: Path.Path,
+  tmpDir: string,
+  majorVersion: number,
+) {
+  yield* legacyExecSqlConstant(
+    session,
+    fs,
+    path,
+    tmpDir,
+    "globals.sql",
+    LEGACY_START_DB_GLOBALS_SQL,
+  );
+  const schemaSql =
+    majorVersion === 13
+      ? LEGACY_START_DB_INITIAL_SCHEMA_13_SQL
+      : LEGACY_START_DB_INITIAL_SCHEMA_14_SQL;
+  yield* legacyExecSqlConstant(session, fs, path, tmpDir, "initial-schema.sql", schemaSql);
+});
+
+/**
+ * Runs one PG15+ one-shot service-migration job to completion (Go's
+ * `utils.DockerRunJob` = `DockerRunOnceWithStream`, `docker.go:457-459,469-487`):
+ * foreground, same Docker network as `db`, no entrypoint override (Go's plain
+ * `Cmd` field), stdout discarded and stderr not teed (Go discards both outside
+ * `--debug` — `utils.GetDebugLogger()`, `logger.go:10-15`). A non-zero exit fails
+ * with the same shape as Go's `error running container: <cause>`.
+ */
+const legacyRunStartMigrateJob = Effect.fnUntraced(function* (opts: {
+  readonly image: string;
+  readonly env: Readonly<Record<string, string>>;
+  readonly cmd: ReadonlyArray<string>;
+  readonly networkId: string;
+}) {
+  const docker = yield* LegacyDockerRun;
+  const runtimeInfo = yield* RuntimeInfo;
+  // Go's `DockerStart` unconditionally appends the Linux-only `host.docker.internal:
+  // host-gateway` extra host for every container it starts (`docker_linux.go`),
+  // including one-shot jobs routed through the same `DockerStart` path.
+  const extraHosts = runtimeInfo.platform === "linux" ? ["host.docker.internal:host-gateway"] : [];
+  const runOpts: LegacyDockerRunOpts = {
+    image: opts.image,
+    cmd: opts.cmd,
+    env: opts.env,
+    binds: [],
+    workingDir: Option.none(),
+    securityOpt: [],
+    extraHosts,
+    network: { _tag: "named", name: opts.networkId },
+    // `opts.image` is already fully resolved (`start.handler.ts`'s `resolveImage`, which
+    // threads `projectEnvValues` through `legacyEnsureImagesCached`) — this layer's own
+    // ambient-only resolver must not re-resolve it. See `LegacyDockerRunOpts.
+    // skipImageResolve`'s doc comment.
+    skipImageResolve: true,
+  };
+  const result = yield* docker
+    .runCapture(runOpts)
+    .pipe(Effect.mapError((cause) => new LegacyStartDbSetupError({ message: cause.message })));
+  if (result.exitCode !== 0) {
+    return yield* Effect.fail(
+      new LegacyStartDbSetupError({ message: `error running container: exit ${result.exitCode}` }),
+    );
+  }
+});
+
+/** Go's `initStorageJob` env (`start.go:297-317`) — deliberately distinct from `storage.service.ts`'s full container env, see this module's header. */
+function legacyStartStorageMigrateEnv(input: {
+  readonly targetMigration: string;
+  readonly anonKey: string;
+  readonly serviceRoleKey: string;
+  readonly jwtSecret: string;
+  readonly dbHost: string;
+  readonly dbPassword: string;
+  readonly fileSizeLimit: ProjectConfig["storage"]["file_size_limit"];
+}): Record<string, string> {
+  return {
+    DB_INSTALL_ROLES: "false",
+    DB_MIGRATIONS_FREEZE_AT: input.targetMigration,
+    ANON_KEY: input.anonKey,
+    SERVICE_KEY: input.serviceRoleKey,
+    PGRST_JWT_SECRET: input.jwtSecret,
+    DATABASE_URL: legacyStartInternalDbUrl(
+      "supabase_storage_admin",
+      input.dbHost,
+      input.dbPassword,
+    ),
+    FILE_SIZE_LIMIT: String(ramInBytes(input.fileSizeLimit)),
+    STORAGE_BACKEND: "file",
+    STORAGE_FILE_BACKEND_PATH: "/mnt",
+    TENANT_ID: "stub",
+    // TODO (matches Go's own TODO, `start.go:311`): https://github.com/supabase/storage-api/issues/55
+    REGION: "stub",
+    GLOBAL_S3_BUCKET: "stub",
+  };
+}
+
+/** Go's `initAuthJob` env (`start.go:319-332`) — deliberately distinct from `gotrue.service.ts`'s full container env, see this module's header. */
+function legacyStartAuthMigrateEnv(input: {
+  readonly apiUrl: string;
+  readonly authExternalUrl: string | undefined;
+  readonly siteUrl: ProjectConfig["auth"]["site_url"];
+  readonly jwtSecret: string;
+  readonly dbHost: string;
+  readonly dbPassword: string;
+}): Record<string, string> {
+  // Go's `AuthExternalURL()` (`pkg/config/config.go:543-545` -> `auth.GetExternalURL`):
+  // an explicit `auth.external_url` wins outright; only derive from `apiUrl`
+  // when it's unset — matching `gotrue.service.ts`'s identical preference
+  // chain for the long-running container.
+  const authExternalUrl =
+    input.authExternalUrl !== undefined && input.authExternalUrl.length > 0
+      ? input.authExternalUrl
+      : `${input.apiUrl.replace(/\/+$/, "")}/auth/v1`;
+  return {
+    API_EXTERNAL_URL: authExternalUrl,
+    GOTRUE_LOG_LEVEL: "error",
+    GOTRUE_DB_DRIVER: "postgres",
+    GOTRUE_DB_DATABASE_URL: legacyStartInternalDbUrl(
+      "supabase_auth_admin",
+      input.dbHost,
+      input.dbPassword,
+    ),
+    GOTRUE_SITE_URL: input.siteUrl,
+    GOTRUE_JWT_SECRET: input.jwtSecret,
+  };
+}
+
+/**
+ * Port of Go's `initSchema15` (`start.go:334-357`): up to three one-shot
+ * migrate jobs, each gated on its own service's `enabled` flag, run in Go's
+ * fixed order (realtime, storage, auth).
+ */
+const legacyStartInitSchema15 = Effect.fnUntraced(function* (
+  input: LegacyStartSetupLocalDatabaseInput,
+) {
+  const dbHost = legacyServiceContainerName("db", input.projectId);
+  const dbPassword = legacyStartInternalDbPassword(input.dbUrl);
+
+  if (input.config.realtime.enabled) {
+    yield* legacyRunStartMigrateJob({
+      image: input.images.realtime,
+      networkId: input.networkId,
+      env: legacyBuildRealtimeEnv({
+        ipVersion: input.config.realtime.ip_version,
+        maxHeaderLength: input.config.realtime.max_header_length,
+        dbHost,
+        dbPassword,
+        jwtSecret: input.jwtSecret,
+        jwks: input.jwks,
+      }),
+      cmd: [
+        "/app/bin/realtime",
+        "eval",
+        `{:ok, _} = Application.ensure_all_started(:realtime)\n{:ok, _} = Realtime.Tenants.health_check("${LEGACY_REALTIME_TENANT_ID}")`,
+      ],
+    });
+  }
+  if (input.config.storage.enabled) {
+    // `legacyStartStorageMigrateEnv` parses `storage.file_size_limit` via
+    // `ramInBytes`, which throws on a malformed value — a plain synchronous
+    // throw here would become an uncaught Effect defect (`Effect.tapError`'s
+    // rollback trigger below only fires on typed `Fail` causes, never `Die`
+    // ones), leaking Postgres's already-created container/network/volume.
+    // Go fails this same malformed value at TOML-decode time, before any
+    // Docker work (`sizeInBytes.UnmarshalText`, `pkg/config/config.go:41-47`)
+    // — this can't be replicated literally here since Postgres is already up
+    // by this step, but surfacing it as a typed `LegacyStartDbSetupError` so
+    // rollback actually runs is the achievable equivalent, matching the same
+    // fix already applied to `resolveDbHealthTimeoutSeconds` and the
+    // long-running Storage container's own file-size-limit parsing
+    // (`start.handler.ts`).
+    const storageEnv = yield* Effect.try({
+      try: () =>
+        legacyStartStorageMigrateEnv({
+          targetMigration: input.storageTargetMigration,
+          anonKey: input.anonKey,
+          serviceRoleKey: input.serviceRoleKey,
+          jwtSecret: input.jwtSecret,
+          dbHost,
+          dbPassword,
+          fileSizeLimit: input.config.storage.file_size_limit,
+        }),
+      catch: (cause) =>
+        new LegacyStartDbSetupError({
+          message: `invalid config for storage: ${errMessage(cause)}`,
+        }),
+    });
+    yield* legacyRunStartMigrateJob({
+      image: input.images.storage,
+      networkId: input.networkId,
+      env: storageEnv,
+      cmd: ["node", "dist/scripts/migrate-call.js"],
+    });
+  }
+  if (input.config.auth.enabled) {
+    yield* legacyRunStartMigrateJob({
+      image: input.images.auth,
+      networkId: input.networkId,
+      env: legacyStartAuthMigrateEnv({
+        apiUrl: input.apiUrl,
+        authExternalUrl: input.authExternalUrl,
+        siteUrl: input.siteUrl,
+        jwtSecret: input.jwtSecret,
+        dbHost,
+        dbPassword,
+      }),
+      cmd: ["gotrue", "migrate"],
+    });
+  }
+});
+
+/**
+ * Port of Go's `initSchema` (`start.go:243-254`): prints the banner line once,
+ * then branches on PG major version — unconditionally, for BOTH branches, exactly
+ * matching Go's `fmt.Fprintln(w, "Initialising schema...")` running before the
+ * `if utils.Config.Db.MajorVersion <= 14` check.
+ */
+const legacyStartInitSchema = Effect.fnUntraced(function* (
+  input: LegacyStartSetupLocalDatabaseInput,
+  tmpDir: string,
+) {
+  const output = yield* Output;
+  yield* output.raw("Initialising schema...\n", "stderr");
+  if (input.majorVersion <= 14) {
+    yield* legacyStartInitSchemaPre15(
+      input.session,
+      input.fs,
+      input.path,
+      tmpDir,
+      input.majorVersion,
+    );
+    return;
+  }
+  yield* legacyStartInitSchema15(input);
+});
+
+/**
+ * Port of Go's `ApplyApiPrivileges` (`start.go:414-435`): tri-state on
+ * `api.auto_expose_new_tables` — `true` keeps the bundled initial-schema grants
+ * (no-op); unset/`false` execs {@link LEGACY_START_REVOKE_API_PRIVILEGES_SQL}. Runs
+ * regardless of PG major version (unlike `initSchema`, this always execs SQL over
+ * `session` directly — it is never part of the PG15+ one-shot Docker jobs).
+ */
+const legacyStartApplyApiPrivileges = Effect.fnUntraced(function* (
+  input: LegacyStartSetupLocalDatabaseInput,
+  tmpDir: string,
+  autoExposeNewTables: Option.Option<boolean>,
+) {
+  if (Option.isSome(autoExposeNewTables) && autoExposeNewTables.value) return;
+  yield* legacyExecSqlConstant(
+    input.session,
+    input.fs,
+    input.path,
+    tmpDir,
+    "revoke-api-privileges.sql",
+    LEGACY_START_REVOKE_API_PRIVILEGES_SQL,
+  );
+});
+
+/**
+ * Port of Go's `initCurrentBranch` (`start.go:233-241`): writes
+ * `supabase/.branches/_current_branch` = `"main"` (Go's `CurrBranchPath`,
+ * `apps/cli-go/internal/utils/misc.go:99` = `filepath.Join(SupabaseDirPath,
+ * ".branches", "_current_branch")`) only if it doesn't already exist. No existing
+ * TS constant for this path — `legacy/commands/db/branch/*` are Management-API
+ * cloud-branch commands, unrelated to this local file — so it's inlined here,
+ * the only current consumer (per "Hoist Before You Duplicate"). Exported (rather
+ * than folded into {@link legacyStartSetupLocalDatabase}) because Go calls it
+ * unconditionally, not just on a fresh volume — see this module's header.
+ */
+export const legacyStartInitCurrentBranch = Effect.fnUntraced(function* (
+  fs: FileSystem.FileSystem,
+  path: Path.Path,
+  workdir: string,
+) {
+  const currentBranchPath = path.join(workdir, "supabase", ".branches", "_current_branch");
+  const exists = yield* fs.exists(currentBranchPath).pipe(
+    Effect.mapError(
+      (error) =>
+        new LegacyStartDbSetupError({
+          message: `failed init current branch: ${errMessage(error)}`,
+        }),
+    ),
+  );
+  if (exists) return;
+  yield* fs.makeDirectory(path.dirname(currentBranchPath), { recursive: true }).pipe(
+    Effect.mapError(
+      (error) =>
+        new LegacyStartDbSetupError({
+          message: `failed init current branch: ${errMessage(error)}`,
+        }),
+    ),
+  );
+  yield* fs.writeFileString(currentBranchPath, "main").pipe(
+    Effect.mapError(
+      (error) =>
+        new LegacyStartDbSetupError({
+          message: `failed init current branch: ${errMessage(error)}`,
+        }),
+    ),
+  );
+});
+
+/**
+ * Runs the full `SetupLocalDatabase`-equivalent sequence — see this module's
+ * header for the exact Go call chain and line-range citations. Call once, right
+ * after the `db` container's healthcheck passes on a fresh volume (Go's
+ * `NoBackupVolume` gate); the caller decides that gating, this function performs
+ * no health/readiness checks of its own.
+ */
+export const legacyStartSetupLocalDatabase = (
+  input: LegacyStartSetupLocalDatabaseInput,
+): Effect.Effect<
+  void,
+  LegacyStartSetupLocalDatabaseError,
+  Output | LegacyDockerRun | RuntimeInfo
+> =>
+  Effect.gen(function* () {
+    const { session, fs, path, workdir } = input;
+
+    const toml = yield* legacyCheckDbToml(fs, path, workdir);
+
+    // SetupDatabase: initSchema -> ApplyApiPrivileges (start.go:383-389).
+    yield* Effect.scoped(
+      Effect.gen(function* () {
+        const tmpDir = yield* fs
+          .makeTempDirectoryScoped({ prefix: "supabase-start-db-setup-" })
+          .pipe(
+            Effect.mapError(
+              (error) =>
+                new LegacyStartDbSetupError({
+                  message: `failed to create temp directory: ${errMessage(error)}`,
+                }),
+            ),
+          );
+        yield* legacyStartInitSchema(input, tmpDir);
+        yield* legacyStartApplyApiPrivileges(input, tmpDir, toml.baseline.apiAutoExposeNewTables);
+      }),
+    );
+
+    // "Create vault secrets first so roles.sql can reference them" (start.go:390).
+    yield* legacyUpsertVaultSecrets(session, toml.vault);
+
+    // Custom-roles seed (start.go:394-398, pkg/migration/seed.go:84-97): Go's
+    // `SeedGlobals` prints "Seeding globals from roles.sql..." BEFORE attempting
+    // to read the file, then tolerates a missing file (`errors.Is(err,
+    // os.ErrNotExist)`); any other read/exec error propagates. Reproduced here as
+    // an unconditional print followed by an existence check ahead of the read
+    // (via `legacyExecSqlFile`, not `legacySeedGlobals` — reusing `legacySeedGlobals`
+    // would need the missing-file case to unwind through `execMigrationBatch`'s
+    // shared, flattened error-mapping contract in `legacy-migration-apply.ts`,
+    // which every other caller of that file also relies on and which is out of
+    // scope to change here) rather than a caught not-found error, since there is
+    // no meaningful TOCTOU concern in this CLI context.
+    const customRolesPath = path.join(workdir, "supabase", "roles.sql");
+    const output = yield* Output;
+    yield* output.raw(`Seeding globals from ${path.basename(customRolesPath)}...\n`, "stderr");
+    const rolesExist = yield* fs.exists(customRolesPath).pipe(
+      Effect.mapError(
+        (error) =>
+          new LegacyStartDbSetupError({
+            message: `failed to check roles.sql: ${errMessage(error)}`,
+          }),
+      ),
+    );
+    if (rolesExist) {
+      yield* legacyExecSqlFile(
+        session,
+        fs,
+        path,
+        customRolesPath,
+        (message) => new LegacyStartDbSetupError({ message }),
+      );
+    }
+
+    // apply.MigrateAndSeed(ctx, "", conn, fsys) — empty version = every pending
+    // migration, matching `SetupLocalDatabase`'s own call in the `start` context
+    // (start.go:368).
+    yield* legacyMigrateAndSeed(session, fs, path, workdir, "", {
+      migrationsEnabled: toml.migrationsEnabled,
+      seed: toml.seed,
+    });
+
+    // Go's best-effort pgcache catalog warning (`pgcache.TryCacheMigrationsCatalog`,
+    // start.go:371-379) is not ported (no output impact) — same accepted, documented
+    // divergence as `db/reset/reset.handler.ts`.
+    //
+    // `initCurrentBranch` (start.go:233-241) is NOT called here — see this
+    // module's header for why it moved to the caller instead.
+  });
diff --git a/apps/cli/src/legacy/commands/start/lib/db-setup.unit.test.ts b/apps/cli/src/legacy/commands/start/lib/db-setup.unit.test.ts
new file mode 100644
index 0000000000..8f2decfc6f
--- /dev/null
+++ b/apps/cli/src/legacy/commands/start/lib/db-setup.unit.test.ts
@@ -0,0 +1,523 @@
+import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import type { ProjectConfig } from "@supabase/config";
+import { ProjectConfigSchema } from "@supabase/config";
+import { BunServices } from "@effect/platform-bun";
+import { describe, expect, it } from "@effect/vitest";
+import { Effect, FileSystem, Layer, Path, Schema } from "effect";
+
+import { mockOutput, mockRuntimeInfo } from "../../../../../tests/helpers/mocks.ts";
+import type { LegacyDbSession } from "../../../shared/legacy-db-connection.service.ts";
+import {
+  LegacyDockerRun,
+  type LegacyDockerRunOpts,
+} from "../../../shared/legacy-docker-run.service.ts";
+import { LegacyDockerRunError } from "../../../shared/legacy-docker-run.errors.ts";
+import {
+  LegacyStartDbSetupError,
+  legacyStartInitCurrentBranch,
+  legacyStartSetupLocalDatabase,
+  type LegacyStartSetupLocalDatabaseInput,
+} from "./db-setup.ts";
+
+const decodeConfig = Schema.decodeUnknownSync(ProjectConfigSchema);
+
+/**
+ * Fingerprints unique to each transcribed SQL constant — see `db-setup.ts`'s
+ * templates. No trailing `;`: `legacySplitAndTrim` strips it from every
+ * executed statement before `session.exec` sees it.
+ *
+ * `GLOBALS`/`SCHEMA_13`/`REVOKE_PRIVILEGES` are checked as SUBSTRINGS: each is
+ * embedded inside a larger executed block (a preceding comment, a `DO`-style
+ * conditional, or the sibling `alter default privileges` line). `SCHEMA_14`
+ * is checked with `.endsWith` instead — `CREATE SCHEMA IF NOT EXISTS graphql`
+ * is itself preceded by a comment block (so a plain equality check would
+ * fail), but a naive substring check would also match 14.sql's unrelated
+ * `CREATE SCHEMA IF NOT EXISTS graphql_public` statement, since `graphql` is
+ * a prefix of `graphql_public`.
+ */
+const GLOBALS_FINGERPRINT = "CREATE ROLE anon";
+const SCHEMA_13_FINGERPRINT =
+  "CREATE USER supabase_functions_admin NOINHERIT CREATEROLE LOGIN NOREPLICATION";
+const SCHEMA_14_FINGERPRINT_SUFFIX = "CREATE SCHEMA IF NOT EXISTS graphql";
+const REVOKE_PRIVILEGES_FINGERPRINT =
+  "revoke execute on functions from anon, authenticated, service_role";
+
+function fakeSession() {
+  const calls: Array<{ kind: "exec" | "query"; sql: string; params?: ReadonlyArray<unknown> }> = [];
+  const session: LegacyDbSession = {
+    exec: (sql) =>
+      Effect.sync(() => {
+        calls.push({ kind: "exec", sql });
+      }),
+    query: (sql, params) =>
+      Effect.sync(() => {
+        calls.push({ kind: "query", sql, params });
+        return [];
+      }),
+    extensionExists: () => Effect.succeed(false),
+    copyToCsv: () => Effect.succeed(new Uint8Array()),
+    queryRaw: () => Effect.succeed({ fields: [], rows: [], commandTag: "" }),
+  };
+  return { session, calls };
+}
+
+function mockDockerRun(opts: { exitCode?: number } = {}) {
+  const runs: Array<LegacyDockerRunOpts> = [];
+  const layer = Layer.succeed(LegacyDockerRun, {
+    run: () => Effect.succeed(opts.exitCode ?? 0),
+    runCapture: (runOpts) => {
+      runs.push(runOpts);
+      return Effect.succeed({
+        exitCode: opts.exitCode ?? 0,
+        stdout: new Uint8Array(),
+        stderr: "",
+      });
+    },
+    runStream: () => Effect.succeed({ exitCode: opts.exitCode ?? 0, stderr: "" }),
+  });
+  return { layer, runs };
+}
+
+function mockDockerRunFails() {
+  const layer = Layer.succeed(LegacyDockerRun, {
+    run: () => Effect.fail(new LegacyDockerRunError({ message: "failed to run docker" })),
+    runCapture: () => Effect.fail(new LegacyDockerRunError({ message: "failed to run docker" })),
+    runStream: () => Effect.fail(new LegacyDockerRunError({ message: "failed to run docker" })),
+  });
+  return { layer };
+}
+
+function makeWorkdir(): string {
+  return mkdtempSync(join(tmpdir(), "legacy-db-setup-"));
+}
+
+function writeConfigToml(workdir: string, content: string): void {
+  const supabaseDir = join(workdir, "supabase");
+  mkdirSync(supabaseDir, { recursive: true });
+  writeFileSync(join(supabaseDir, "config.toml"), content);
+}
+
+const defaultConfig: ProjectConfig = decodeConfig({});
+
+function baseInput(
+  workdir: string,
+  session: LegacyDbSession,
+  overrides: Partial<LegacyStartSetupLocalDatabaseInput> = {},
+): Omit<LegacyStartSetupLocalDatabaseInput, "fs" | "path"> {
+  return {
+    session,
+    workdir,
+    config: defaultConfig,
+    majorVersion: 17,
+    projectId: "proj",
+    networkId: "supabase_network_proj",
+    dbUrl: "postgresql://postgres:postgrespassword@127.0.0.1:54322/postgres",
+    jwtSecret: "super-secret-jwt-token-with-at-least-32-characters-long",
+    jwks: '{"keys":[]}',
+    apiUrl: "http://127.0.0.1:54321",
+    siteUrl: defaultConfig.auth.site_url,
+    anonKey: "anon-key",
+    serviceRoleKey: "service-role-key",
+    storageTargetMigration: "",
+    images: {
+      realtime: "public.ecr.aws/supabase/realtime:v2.34.7",
+      storage: "public.ecr.aws/supabase/storage-api:v1.0.0",
+      auth: "public.ecr.aws/supabase/gotrue:v2.170.0",
+    },
+    ...overrides,
+  };
+}
+
+const run = (
+  input: Omit<LegacyStartSetupLocalDatabaseInput, "fs" | "path">,
+  out: ReturnType<typeof mockOutput>,
+  docker: ReturnType<typeof mockDockerRun> | ReturnType<typeof mockDockerRunFails>,
+) =>
+  Effect.gen(function* () {
+    const fs = yield* FileSystem.FileSystem;
+    const path = yield* Path.Path;
+    return yield* legacyStartSetupLocalDatabase({ ...input, fs, path });
+  }).pipe(
+    Effect.provide(
+      Layer.mergeAll(
+        BunServices.layer,
+        out.layer,
+        docker.layer,
+        mockRuntimeInfo({ platform: "darwin" }),
+      ),
+    ),
+  );
+
+describe("legacyStartSetupLocalDatabase", () => {
+  describe("PG <= 14 vs PG >= 15 schema branch", () => {
+    it.effect("PG14: execs globals + the PG14 initial schema, runs no one-shot docker jobs", () => {
+      const workdir = makeWorkdir();
+      const { session, calls } = fakeSession();
+      const out = mockOutput();
+      const docker = mockDockerRun();
+      return run(baseInput(workdir, session, { majorVersion: 14 }), out, docker).pipe(
+        Effect.map(() => {
+          const execSql = calls.filter((c) => c.kind === "exec").map((c) => c.sql);
+          expect(execSql.some((sql) => sql.includes(GLOBALS_FINGERPRINT))).toBe(true);
+          expect(execSql.some((sql) => sql.endsWith(SCHEMA_14_FINGERPRINT_SUFFIX))).toBe(true);
+          expect(execSql.some((sql) => sql.includes(SCHEMA_13_FINGERPRINT))).toBe(false);
+          expect(docker.runs.length).toBe(0);
+          rmSync(workdir, { recursive: true, force: true });
+        }),
+      );
+    });
+
+    it.effect("PG13: execs globals + the PG13 initial schema, not the PG14 one", () => {
+      const workdir = makeWorkdir();
+      const { session, calls } = fakeSession();
+      const out = mockOutput();
+      const docker = mockDockerRun();
+      return run(baseInput(workdir, session, { majorVersion: 13 }), out, docker).pipe(
+        Effect.map(() => {
+          const execSql = calls.filter((c) => c.kind === "exec").map((c) => c.sql);
+          expect(execSql.some((sql) => sql.includes(GLOBALS_FINGERPRINT))).toBe(true);
+          expect(execSql.some((sql) => sql.includes(SCHEMA_13_FINGERPRINT))).toBe(true);
+          expect(execSql.some((sql) => sql.endsWith(SCHEMA_14_FINGERPRINT_SUFFIX))).toBe(false);
+          expect(docker.runs.length).toBe(0);
+          rmSync(workdir, { recursive: true, force: true });
+        }),
+      );
+    });
+
+    it.effect("PG15+: runs one-shot docker jobs, execs no schema SQL at all", () => {
+      const workdir = makeWorkdir();
+      const { session, calls } = fakeSession();
+      const out = mockOutput();
+      const docker = mockDockerRun();
+      return run(baseInput(workdir, session, { majorVersion: 17 }), out, docker).pipe(
+        Effect.map(() => {
+          const execSql = calls.filter((c) => c.kind === "exec").map((c) => c.sql);
+          expect(execSql.some((sql) => sql.includes(GLOBALS_FINGERPRINT))).toBe(false);
+          expect(execSql.some((sql) => sql.includes(SCHEMA_13_FINGERPRINT))).toBe(false);
+          expect(execSql.some((sql) => sql.endsWith(SCHEMA_14_FINGERPRINT_SUFFIX))).toBe(false);
+          // Default config: realtime, storage, and auth are all enabled.
+          expect(docker.runs.length).toBe(3);
+          rmSync(workdir, { recursive: true, force: true });
+        }),
+      );
+    });
+
+    it.effect('prints "Initialising schema..." once, for either branch', () => {
+      const workdir = makeWorkdir();
+      const { session } = fakeSession();
+      const out = mockOutput();
+      const docker = mockDockerRun();
+      return run(baseInput(workdir, session, { majorVersion: 17 }), out, docker).pipe(
+        Effect.map(() => {
+          const banner = out.rawChunks.filter((c) => c.text === "Initialising schema...\n");
+          expect(banner.length).toBe(1);
+          expect(banner[0]?.stream).toBe("stderr");
+          rmSync(workdir, { recursive: true, force: true });
+        }),
+      );
+    });
+  });
+
+  describe("PG15+ one-shot job gating", () => {
+    it.effect("gates each job independently on its own service's enabled flag", () => {
+      const workdir = makeWorkdir();
+      const { session } = fakeSession();
+      const out = mockOutput();
+      const docker = mockDockerRun();
+      const config = decodeConfig({
+        realtime: { enabled: true },
+        storage: { enabled: false },
+        auth: { enabled: true },
+      });
+      return run(baseInput(workdir, session, { majorVersion: 15, config }), out, docker).pipe(
+        Effect.map(() => {
+          expect(docker.runs.length).toBe(2);
+          const images = docker.runs.map((r) => r.image);
+          expect(images).toContain("public.ecr.aws/supabase/realtime:v2.34.7");
+          expect(images).toContain("public.ecr.aws/supabase/gotrue:v2.170.0");
+          expect(images).not.toContain("public.ecr.aws/supabase/storage-api:v1.0.0");
+          rmSync(workdir, { recursive: true, force: true });
+        }),
+      );
+    });
+
+    it.effect("runs nothing when all three services are disabled", () => {
+      const workdir = makeWorkdir();
+      const { session } = fakeSession();
+      const out = mockOutput();
+      const docker = mockDockerRun();
+      const config = decodeConfig({
+        realtime: { enabled: false },
+        storage: { enabled: false },
+        auth: { enabled: false },
+      });
+      return run(baseInput(workdir, session, { majorVersion: 15, config }), out, docker).pipe(
+        Effect.map(() => {
+          expect(docker.runs.length).toBe(0);
+          rmSync(workdir, { recursive: true, force: true });
+        }),
+      );
+    });
+
+    it.effect(
+      "the realtime job's env matches `legacyBuildRealtimeEnv` on the internal db address + jwks",
+      () => {
+        const workdir = makeWorkdir();
+        const { session } = fakeSession();
+        const out = mockOutput();
+        const docker = mockDockerRun();
+        const config = decodeConfig({ storage: { enabled: false }, auth: { enabled: false } });
+        return run(
+          baseInput(workdir, session, {
+            majorVersion: 15,
+            config,
+            projectId: "myproj",
+            jwks: '{"keys":["stub"]}',
+          }),
+          out,
+          docker,
+        ).pipe(
+          Effect.map(() => {
+            expect(docker.runs.length).toBe(1);
+            const job = docker.runs[0]!;
+            expect(job.cmd[0]).toBe("/app/bin/realtime");
+            expect(job.cmd[1]).toBe("eval");
+            expect(job.cmd[2]).toContain('Realtime.Tenants.health_check("realtime-dev")');
+            expect(job.env["DB_HOST"]).toBe("supabase_db_myproj");
+            expect(job.env["API_JWT_JWKS"]).toBe('{"keys":["stub"]}');
+            expect(job.network).toEqual({ _tag: "named", name: "supabase_network_proj" });
+            rmSync(workdir, { recursive: true, force: true });
+          }),
+        );
+      },
+    );
+
+    it.effect(
+      "the auth job's env derives API_EXTERNAL_URL from apiUrl and carries site_url + jwt secret",
+      () => {
+        const workdir = makeWorkdir();
+        const { session } = fakeSession();
+        const out = mockOutput();
+        const docker = mockDockerRun();
+        const config = decodeConfig({ realtime: { enabled: false }, storage: { enabled: false } });
+        return run(
+          baseInput(workdir, session, {
+            majorVersion: 15,
+            config,
+            apiUrl: "http://127.0.0.1:54321/",
+          }),
+          out,
+          docker,
+        ).pipe(
+          Effect.map(() => {
+            expect(docker.runs.length).toBe(1);
+            const job = docker.runs[0]!;
+            expect(job.cmd).toEqual(["gotrue", "migrate"]);
+            expect(job.env["API_EXTERNAL_URL"]).toBe("http://127.0.0.1:54321/auth/v1");
+            expect(job.env["GOTRUE_SITE_URL"]).toBe(config.auth.site_url);
+            expect(job.env["GOTRUE_JWT_SECRET"]).toBe(
+              "super-secret-jwt-token-with-at-least-32-characters-long",
+            );
+            rmSync(workdir, { recursive: true, force: true });
+          }),
+        );
+      },
+    );
+
+    it.effect(
+      "the auth job's GOTRUE_SITE_URL reflects the caller's resolved siteUrl, not the raw config value",
+      () => {
+        // `siteUrl` is already SUPABASE_AUTH_SITE_URL-overridden by the caller
+        // (`start.handler.ts`'s `values.authSiteUrl`) — the one-shot auth
+        // migration job must agree with the long-running GoTrue container,
+        // not fall back to reading the un-overridden `config.auth.site_url`.
+        const workdir = makeWorkdir();
+        const { session } = fakeSession();
+        const out = mockOutput();
+        const docker = mockDockerRun();
+        const config = decodeConfig({
+          realtime: { enabled: false },
+          storage: { enabled: false },
+          auth: { site_url: "http://raw-config-value.example" },
+        });
+        return run(
+          baseInput(workdir, session, {
+            majorVersion: 15,
+            config,
+            apiUrl: "http://127.0.0.1:54321/",
+            siteUrl: "http://env-overridden-value.example",
+          }),
+          out,
+          docker,
+        ).pipe(
+          Effect.map(() => {
+            const job = docker.runs[0]!;
+            expect(job.env["GOTRUE_SITE_URL"]).toBe("http://env-overridden-value.example");
+            rmSync(workdir, { recursive: true, force: true });
+          }),
+        );
+      },
+    );
+
+    it.effect("a non-zero exit from a one-shot job fails the whole pipeline", () => {
+      const workdir = makeWorkdir();
+      const { session } = fakeSession();
+      const out = mockOutput();
+      const docker = mockDockerRun({ exitCode: 1 });
+      const config = decodeConfig({ storage: { enabled: false }, auth: { enabled: false } });
+      return run(baseInput(workdir, session, { majorVersion: 15, config }), out, docker).pipe(
+        Effect.flip,
+        Effect.map((error) => {
+          expect(error).toBeInstanceOf(LegacyStartDbSetupError);
+          expect((error as LegacyStartDbSetupError).message).toBe(
+            "error running container: exit 1",
+          );
+          rmSync(workdir, { recursive: true, force: true });
+        }),
+      );
+    });
+  });
+
+  describe("ApplyApiPrivileges tri-state", () => {
+    it.effect("auto_expose_new_tables = true is a no-op (no revoke SQL exec'd)", () => {
+      const workdir = makeWorkdir();
+      writeConfigToml(workdir, "[api]\nauto_expose_new_tables = true\n");
+      const { session, calls } = fakeSession();
+      const out = mockOutput();
+      const docker = mockDockerRun();
+      return run(baseInput(workdir, session, { majorVersion: 14 }), out, docker).pipe(
+        Effect.map(() => {
+          const execSql = calls.filter((c) => c.kind === "exec").map((c) => c.sql);
+          expect(execSql.some((sql) => sql.includes(REVOKE_PRIVILEGES_FINGERPRINT))).toBe(false);
+          rmSync(workdir, { recursive: true, force: true });
+        }),
+      );
+    });
+
+    it.effect("auto_expose_new_tables = false execs the revoke SQL", () => {
+      const workdir = makeWorkdir();
+      writeConfigToml(workdir, "[api]\nauto_expose_new_tables = false\n");
+      const { session, calls } = fakeSession();
+      const out = mockOutput();
+      const docker = mockDockerRun();
+      return run(baseInput(workdir, session, { majorVersion: 14 }), out, docker).pipe(
+        Effect.map(() => {
+          const execSql = calls.filter((c) => c.kind === "exec").map((c) => c.sql);
+          expect(execSql.some((sql) => sql.includes(REVOKE_PRIVILEGES_FINGERPRINT))).toBe(true);
+          rmSync(workdir, { recursive: true, force: true });
+        }),
+      );
+    });
+
+    it.effect(
+      "unset (no config.toml at all) matches the false behavior — execs the revoke SQL",
+      () => {
+        const workdir = makeWorkdir();
+        const { session, calls } = fakeSession();
+        const out = mockOutput();
+        const docker = mockDockerRun();
+        return run(baseInput(workdir, session, { majorVersion: 14 }), out, docker).pipe(
+          Effect.map(() => {
+            const execSql = calls.filter((c) => c.kind === "exec").map((c) => c.sql);
+            expect(execSql.some((sql) => sql.includes(REVOKE_PRIVILEGES_FINGERPRINT))).toBe(true);
+            rmSync(workdir, { recursive: true, force: true });
+          }),
+        );
+      },
+    );
+  });
+
+  describe("vault upsert + custom-roles seed", () => {
+    it.effect("upserts vault secrets before seeding supabase/roles.sql", () => {
+      const workdir = makeWorkdir();
+      writeConfigToml(workdir, '[db.vault]\nmy_secret = "shh"\n');
+      writeFileSync(
+        join(workdir, "supabase", "roles.sql"),
+        "grant select on all tables in schema public to custom_role;",
+      );
+      const { session, calls } = fakeSession();
+      const out = mockOutput();
+      const docker = mockDockerRun();
+      return run(baseInput(workdir, session, { majorVersion: 14 }), out, docker).pipe(
+        Effect.map(() => {
+          const vaultCallIndex = calls.findIndex(
+            (c) => c.kind === "query" && c.sql.includes("vault.create_secret"),
+          );
+          const rolesCallIndex = calls.findIndex(
+            (c) => c.kind === "exec" && c.sql.includes("custom_role"),
+          );
+          expect(vaultCallIndex).toBeGreaterThanOrEqual(0);
+          expect(rolesCallIndex).toBeGreaterThanOrEqual(0);
+          expect(vaultCallIndex).toBeLessThan(rolesCallIndex);
+          expect(out.rawChunks.map((c) => c.text)).toContain("Seeding globals from roles.sql...\n");
+          rmSync(workdir, { recursive: true, force: true });
+        }),
+      );
+    });
+
+    it.effect(
+      "prints the seed message even when supabase/roles.sql is absent, and does not error",
+      () => {
+        const workdir = makeWorkdir();
+        const { session, calls } = fakeSession();
+        const out = mockOutput();
+        const docker = mockDockerRun();
+        return run(baseInput(workdir, session, { majorVersion: 14 }), out, docker).pipe(
+          Effect.map(() => {
+            // Go's `SeedGlobals` prints before attempting the read (`pkg/migration/
+            // seed.go:84-97`) — a missing roles.sql is tolerated, not skipped.
+            expect(out.rawChunks.map((c) => c.text)).toContain(
+              "Seeding globals from roles.sql...\n",
+            );
+            const rolesCallIndex = calls.findIndex(
+              (c) => c.kind === "exec" && c.sql.includes("custom_role"),
+            );
+            expect(rolesCallIndex).toBe(-1);
+            rmSync(workdir, { recursive: true, force: true });
+          }),
+        );
+      },
+    );
+  });
+});
+
+describe("legacyStartInitCurrentBranch", () => {
+  it.effect('writes supabase/.branches/_current_branch = "main" when absent', () => {
+    const workdir = makeWorkdir();
+    return Effect.gen(function* () {
+      const fs = yield* FileSystem.FileSystem;
+      const path = yield* Path.Path;
+      yield* legacyStartInitCurrentBranch(fs, path, workdir);
+      const content = yield* fs.readFileString(
+        join(workdir, "supabase", ".branches", "_current_branch"),
+      );
+      expect(content).toBe("main");
+    }).pipe(
+      Effect.provide(BunServices.layer),
+      Effect.map(() => {
+        rmSync(workdir, { recursive: true, force: true });
+      }),
+    );
+  });
+
+  it.effect("leaves an existing _current_branch file untouched", () => {
+    const workdir = makeWorkdir();
+    const branchesDir = join(workdir, "supabase", ".branches");
+    mkdirSync(branchesDir, { recursive: true });
+    writeFileSync(join(branchesDir, "_current_branch"), "feature-x");
+    return Effect.gen(function* () {
+      const fs = yield* FileSystem.FileSystem;
+      const path = yield* Path.Path;
+      yield* legacyStartInitCurrentBranch(fs, path, workdir);
+      const content = yield* fs.readFileString(join(branchesDir, "_current_branch"));
+      expect(content).toBe("feature-x");
+    }).pipe(
+      Effect.provide(BunServices.layer),
+      Effect.map(() => {
+        rmSync(workdir, { recursive: true, force: true });
+      }),
+    );
+  });
+});
diff --git a/apps/cli/src/legacy/commands/start/lib/docker-create-args.ts b/apps/cli/src/legacy/commands/start/lib/docker-create-args.ts
new file mode 100644
index 0000000000..28cf3bfda7
--- /dev/null
+++ b/apps/cli/src/legacy/commands/start/lib/docker-create-args.ts
@@ -0,0 +1,466 @@
+/**
+ * Assembles `docker create <flags> <image> [cmd...]` argv for the per-service
+ * containers Go's `supabase start` creates directly against the Docker Engine
+ * SDK (`utils.DockerStart`, `apps/cli-go/internal/utils/docker.go:363-440`).
+ *
+ * Go never shells out to `docker` — it builds `container.Config` /
+ * `container.HostConfig` / `network.NetworkingConfig` structs and calls
+ * `Docker.ContainerCreate` over the Engine API. This module is the CLI-shell
+ * translation of that same struct surface into `docker create` CLI flags, so
+ * every field here is documented against the exact Go struct field (and, where
+ * useful, the exact call site) it reproduces.
+ *
+ * Unlike the Engine API, `docker create`'s argv has no inherent "field order"
+ * — Docker parses flags independently of position. The order emitted by
+ * {@link legacyBuildStartContainerCreateArgs} below is therefore this module's
+ * own fixed, deterministic convention (grouped: identity → env → volumes →
+ * ports → healthcheck → restart/security → network → labels →
+ * entrypoint/image/cmd), chosen for readability and stable unit-test
+ * snapshots — it carries no Go parity obligation, unlike every flag-to-field
+ * mapping it emits.
+ *
+ * Surveyed call sites (every `container.Config{`/`network.NetworkingConfig{`
+ * block across the Go source, per the task's "read every one" instruction):
+ *   - `apps/cli-go/internal/start/start.go:350-394`   Logflare/analytics
+ *   - `apps/cli-go/internal/start/start.go:396-484`   Vector
+ *   - `apps/cli-go/internal/start/start.go:486-627`   Kong
+ *   - `apps/cli-go/internal/start/start.go:629-851`   GoTrue
+ *   - `apps/cli-go/internal/start/start.go:853-901`   Mailpit/Inbucket
+ *   - `apps/cli-go/internal/start/start.go:903-958`   Realtime
+ *   - `apps/cli-go/internal/start/start.go:960-992`   PostgREST/Rest
+ *   - `apps/cli-go/internal/start/start.go:994-1057`  Storage
+ *   - `apps/cli-go/internal/start/start.go:1059-1099` Storage ImgProxy
+ *   - `apps/cli-go/internal/start/start.go:1110-1146` pg-meta
+ *   - `apps/cli-go/internal/start/start.go:1148-1191` Studio
+ *   - `apps/cli-go/internal/start/start.go:1193-1268` Pooler
+ *   - `apps/cli-go/internal/db/start/start.go:63-131` Postgres (the db container)
+ *
+ * Fields deliberately NOT modelled, because none of the 13 call sites above
+ * set them on `container.Config`/`container.HostConfig` (verified by grepping
+ * every block for these field names): `User`, `WorkingDir`, `Tty`, `CapAdd`,
+ * `Ulimits`, `ShmSize`. Add them here — following the same "optional field,
+ * flag omitted unless present" shape as every other field below — the day a
+ * call site actually needs one; there is no value in modelling Docker surface
+ * this builder never has to reproduce.
+ *
+ * One field has no Go struct equivalent at all: {@link LegacyStartContainerSpec.secretFiles}.
+ * It exists purely because this module's own "shell out to `docker create`"
+ * architecture (unlike Go's direct Engine API calls) has an argv-exposure
+ * problem `container.Config`/`container.HostConfig` never had — see that
+ * field's doc comment, and `container-lifecycle.ts`'s `legacyStartContainer`,
+ * for the mitigation.
+ */
+
+import {
+  legacyBindMountSpecSource,
+  legacyIsBindMountSource,
+} from "../../../shared/legacy-docker-bind-classify.ts";
+
+/**
+ * `container.HealthConfig` (`docker/docker/api/types/container`). Not
+ * exported on its own — callers reference it structurally through
+ * {@link LegacyStartContainerSpec.healthcheck}; nothing outside this module
+ * needs to name the shape directly.
+ */
+interface LegacyStartHealthcheckSpec {
+  /**
+   * Go's `HealthConfig.Test` exec form (`["CMD", ...args]`) or shell form
+   * (`["CMD-SHELL", script]`). See {@link legacyBuildHealthCmdArg} for exactly
+   * how each form becomes the single `--health-cmd` string docker CLI expects.
+   */
+  readonly test: ReadonlyArray<string>;
+  /** `HealthConfig.Interval`, already-whole seconds → `--health-interval <n>s`. */
+  readonly intervalSeconds?: number;
+  /** `HealthConfig.Timeout` → `--health-timeout <n>s`. */
+  readonly timeoutSeconds?: number;
+  /** `HealthConfig.Retries` → `--health-retries <n>`. */
+  readonly retries?: number;
+  /**
+   * `HealthConfig.StartPeriod` → `--health-start-period <n>s`. Only Logflare
+   * and Mailpit set this (`start.go:371`, `start.go:882`); every other
+   * healthcheck leaves Go's zero value, which docker treats as "unset" — so
+   * this stays optional and the flag is omitted, not emitted as `0s`.
+   */
+  readonly startPeriodSeconds?: number;
+}
+
+/**
+ * `-p <hostPort>:<containerPort>[/<protocol>]` — one
+ * `container.HostConfig.PortBindings` entry. Not exported; referenced
+ * structurally through {@link LegacyStartContainerSpec.ports}.
+ */
+interface LegacyStartPortBindingSpec {
+  readonly hostPort: string;
+  readonly containerPort: string;
+  /** Defaults to `"tcp"` (omitted from the flag) — no call site uses `"udp"` today. */
+  readonly protocol?: "tcp" | "udp";
+}
+
+/**
+ * `--expose <containerPort>[/<protocol>]` — one `container.Config.ExposedPorts`
+ * entry with no matching `PortBindings` entry (kept separate from
+ * {@link LegacyStartPortBindingSpec} on purpose, see the doc comment on
+ * {@link LegacyStartContainerSpec.exposedPorts}). Not exported; referenced
+ * structurally through {@link LegacyStartContainerSpec.exposedPorts}.
+ */
+interface LegacyStartExposedPortSpec {
+  readonly containerPort: string;
+  readonly protocol?: "tcp" | "udp";
+}
+
+/**
+ * One entry a caller must stage as a HOST temp file and bind-mount read-only
+ * into the container — see {@link LegacyStartContainerSpec.secretFiles}'s doc
+ * comment for the full contract. Not exported on its own — callers reference
+ * it structurally through that field; nothing outside this module needs to
+ * name the shape directly.
+ */
+interface LegacyStartSecretFileSpec {
+  /** The fixed path INSIDE the container the caller's generated bind mount targets. */
+  readonly containerPath: string;
+  /** The secret content to write to a HOST temp file — never emitted into argv. */
+  readonly content: string;
+}
+
+export interface LegacyStartContainerSpec {
+  /** `container.Config.Image` (already resolved/pulled — resolution is out of scope here). */
+  readonly image: string;
+  /** The 4th `DockerStart` positional argument — `--name`. */
+  readonly containerName: string;
+  /**
+   * `container.Config.Hostname`. Only Logflare sets this (`start.go:353`,
+   * `Hostname: "127.0.0.1"`); every other service leaves it unset and relies
+   * on Docker's default (the container's own short ID).
+   */
+  readonly hostname?: string;
+  /**
+   * `container.Config.Env`, reshaped from Go's `KEY=value` string slice into a
+   * map. Emitted as the key-only `-e KEY` form — see the doc comment on
+   * {@link legacyBuildStartContainerCreateArgs} — so secret values (JWT
+   * secrets, SMTP passwords, API keys — every one of these containers carries
+   * at least one) never appear in this process's own argv.
+   */
+  readonly env: Readonly<Record<string, string>>;
+  /**
+   * Entrypoint/`Cmd`-script secret content that must land at a specific path
+   * INSIDE the container without ever appearing in this process's own
+   * `docker create` argv (`ps aux`/`/proc/<pid>/cmdline`, CWE-214/522) — the
+   * entrypoint/`Cmd` analogue of {@link env}'s key-only `-e KEY` protection.
+   * Kong/Postgres/Supavisor all heredoc or shell-embed secret-bearing content
+   * (Kong's `kong.yml`/TLS private key, Postgres's pgsodium root key,
+   * Supavisor's rendered `pooler.exs`) directly into their entrypoint script
+   * or `Cmd` — safe in Go's Engine-API architecture (never a subprocess's own
+   * argv) but not in this port's, which shells out to a real `docker create`.
+   *
+   * NOT consumed here: {@link legacyBuildStartContainerCreateArgs} stays
+   * pure/no-I/O and never reads this field. `container-lifecycle.ts`'s
+   * `legacyStartContainer` is the sole consumer — it writes each entry's
+   * `content` to a HOST-side temp file (mode `0644` — world-readable, so the
+   * non-root in-container user reading it (e.g. Kong, Postgres) doesn't hit
+   * `EACCES` once the bind mount preserves this host mode verbatim; see
+   * `legacyStageStartSecretFiles`'s doc comment — in a fresh temp
+   * directory) and appends a `<tempHostPath>:<containerPath>:ro` bind (the
+   * bind's SOURCE is a generated temp-file path, never the secret itself —
+   * safe in argv) to {@link binds} BEFORE this builder ever sees the spec,
+   * then removes the temp file/directory once the container is created and
+   * started. Generic by design — any future service's spec can set this, not
+   * just the three call sites that need it today.
+   */
+  readonly secretFiles?: ReadonlyArray<LegacyStartSecretFileSpec>;
+  /**
+   * `container.Config.Entrypoint`'s first element. Docker CLI's `--entrypoint`
+   * only accepts a single executable/script name (unlike the Engine API field,
+   * which is a full argv array) — the remaining Go `Entrypoint` elements are
+   * reproduced via {@link cmd} instead, exactly like the existing `docker run`
+   * precedent (`legacy-docker-run.service.ts`'s `entrypoint`/`cmd` split).
+   * E.g. Go's `Entrypoint: ["sh", "-c", script]` (Logflare/Vector/Kong/db)
+   * becomes `entrypoint: "sh", cmd: ["-c", script]`.
+   */
+  readonly entrypoint?: string;
+  /**
+   * Trailing argv tokens placed after the image. Always emitted — unlike the
+   * `docker run` precedent's comment (which only ever pairs `cmd` with
+   * `entrypoint`), Pooler (`start.go:1234-1237`) sets `container.Config.Cmd`
+   * with NO `Entrypoint` at all: it overrides the pooler image's default `CMD`
+   * while keeping its own `ENTRYPOINT`. Docker CLI's trailing-tokens-after-image
+   * convention already covers both cases identically (args to `--entrypoint`
+   * when set, or a `CMD` override of the image default when not), so `cmd` is
+   * independent of {@link entrypoint} here.
+   */
+  readonly cmd?: ReadonlyArray<string>;
+  /**
+   * `container.HostConfig.Binds` — `"source:target[:mode]"` bind-mount strings
+   * or `"volumeName:target"` named-volume strings (Go's `loader.ParseVolume`
+   * classification, see {@link legacyIsBindMountSource}). Named-volume
+   * creation itself (`Docker.VolumeCreate`, `docker.go:407-415`) is a
+   * higher-level orchestration concern, not this pure argv builder's job.
+   */
+  readonly binds: ReadonlyArray<string>;
+  /** `container.HostConfig.VolumesFrom` — ImgProxy only (`start.go:1084`, mounts Storage's volumes). */
+  readonly volumesFrom?: ReadonlyArray<string>;
+  /**
+   * `container.HostConfig.Tmpfs` (`map[mountPath]mountOptions`) — only the
+   * Postgres container sets this, and only on PG ≤ 14
+   * (`apps/cli-go/internal/db/start/start.go:127-129`:
+   * `map[string]string{"/docker-entrypoint-initdb.d": ""}`). An empty options
+   * string means "no extra tmpfs mount options" (`--tmpfs <path>` with no
+   * `:options` suffix); a non-empty value is joined as `<path>:<options>`.
+   */
+  readonly tmpfs?: Readonly<Record<string, string>>;
+  /**
+   * `container.HostConfig.PortBindings` — ports published to the host via
+   * `-p`. Distinct from {@link exposedPorts}: publishing a port with `-p`
+   * already implies exposing it (docker CLI infers `ExposedPorts` from `-p`
+   * the same way Go's own `container.Config.ExposedPorts` happens to overlap
+   * with `PortBindings` in the Logflare example, `start.go:373` vs `:377`).
+   */
+  readonly ports?: ReadonlyArray<LegacyStartPortBindingSpec>;
+  /**
+   * `container.Config.ExposedPorts` entries that have NO matching
+   * `PortBindings` entry — i.e. ports declared reachable on the Docker network
+   * but never published to the host. This is a real, recurring pattern, not a
+   * one-off: GoTrue (`start.go:825`, port 9999) and Realtime (`start.go:930`,
+   * port 4000) expose a port with zero `PortBindings`; Kong exposes 3 ports
+   * (`start.go:602-606`) but only ever publishes one of them depending on TLS;
+   * Pooler exposes 3 ports (`start.go:1238-1242`) but only ever publishes the
+   * one matching its configured pool mode. A single `ports` field (CLI `-p`)
+   * cannot express "exposed but not published", so it is kept as its own field
+   * rather than folded into {@link ports} with an optional host side.
+   */
+  readonly exposedPorts?: ReadonlyArray<LegacyStartExposedPortSpec>;
+  /** `container.Config.Healthcheck`. Omitted entirely for Kong and PostgREST — see `start.go:975` ("PostgREST does not expose a shell for health check") — so no `--health-*` flags are emitted for those services. */
+  readonly healthcheck?: LegacyStartHealthcheckSpec;
+  /**
+   * `container.HostConfig.RestartPolicy.Name`. Every one of the 13 surveyed
+   * call sites uses `container.RestartPolicyUnlessStopped` (verified — grep
+   * `RestartPolicy` across `start.go`/`db/start/start.go` returns only
+   * `RestartPolicyUnlessStopped`), but the full docker CLI `--restart` enum is
+   * supported for completeness/future callers, per the task brief.
+   */
+  readonly restartPolicy?: "unless-stopped" | "no" | "always" | "on-failure";
+  /**
+   * `container.HostConfig.SecurityOpt`. Only Vector sets this
+   * (`start.go:441`, `"label:disable"`, when mounting a non-root Docker
+   * socket) — cleared globally under Bitbucket Pipelines, see
+   * {@link legacyApplyBitbucketStartContainerFilter}.
+   */
+  readonly securityOpt?: ReadonlyArray<string>;
+  /**
+   * `container.HostConfig.ExtraHosts`. Populated by `DockerStart` itself from
+   * the platform-specific `extraHosts` package var (`docker_linux.go`,
+   * `docker_darwin.go`, `docker_windows.go`), not by any individual
+   * `container.Config` literal — every container gets the same extra hosts.
+   * That orchestration (merging in the platform default) is a caller concern;
+   * this builder just emits whatever is passed here.
+   */
+  readonly extraHosts?: ReadonlyArray<string>;
+  /**
+   * `container.HostConfig.NetworkMode`, resolved by `DockerStart`
+   * (`docker.go:379-383`) to either the `--network-id` override or
+   * `utils.NetId` — never set per-container in any surveyed call site.
+   */
+  readonly networkId: string;
+  /**
+   * `network.NetworkingConfig.EndpointsConfig[NetId].Aliases` — the per-service
+   * alias array (e.g. `utils.RealtimeAliases = ["realtime", tenantId]`,
+   * `apps/cli-go/internal/utils/config.go:40`). The container's OWN name is
+   * already DNS-resolvable on a user-defined network without any alias; this
+   * field only adds the short/extra names other containers' env vars and
+   * templates reference by.
+   */
+  readonly networkAliases?: ReadonlyArray<string>;
+  /**
+   * `container.Config.Labels`, merged in by `DockerStart` itself
+   * (`docker.go:372-376`: `CliProjectLabel`/`composeProjectLabel`, both the
+   * sanitized project id) rather than set per-service — this builder emits
+   * whatever map is passed here, unconditionally.
+   */
+  readonly labels: Readonly<Record<string, string>>;
+}
+
+function formatDockerDurationSeconds(seconds: number): string {
+  return `${seconds}s`;
+}
+
+/**
+ * Quotes a single argv-style argument for safe embedding in a POSIX shell
+ * command line: wraps it in single quotes, escaping any embedded single quote
+ * as `'\''` (close quote, escaped literal quote, reopen quote) — the standard
+ * POSIX-portable technique (equivalent to Python's `shlex.quote`). Arguments
+ * containing only characters that never need quoting are returned unchanged
+ * for readability.
+ */
+function legacyShellQuoteArg(arg: string): string {
+  if (arg.length > 0 && /^[A-Za-z0-9_\-./:@%,+=]+$/.test(arg)) return arg;
+  return `'${arg.replaceAll("'", "'\\''")}'`;
+}
+
+/**
+ * Converts Go's `HealthConfig.Test` into the single string `docker create
+ * --health-cmd` expects.
+ *
+ * Docker CLI's `--health-cmd` flag has no exec-form equivalent: whatever
+ * string it is given always becomes `HealthConfig.Test = ["CMD-SHELL",
+ * value]` on the resulting container (there is no CLI flag that produces the
+ * exec-form `["CMD", ...]` Go sometimes uses directly over the Engine API —
+ * only a Dockerfile `HEALTHCHECK` instruction or the raw API can do that). So:
+ *
+ * - `["CMD-SHELL", script]` (pg-meta/Studio, `start.go:1125`/`:1166`) — `script`
+ *   is already the exact string Go's own `CMD-SHELL` form would run verbatim
+ *   via the container's `/bin/sh -c`; it is forwarded completely unmodified.
+ *   No quoting is applied on this side because this string travels as a
+ *   single argv element to the spawned `docker` process (no host-side shell
+ *   parses it) — only Docker's own eventual in-container `/bin/sh -c
+ *   <value>` interprets it, exactly reproducing Go's `Test` value untouched.
+ * - `["CMD", ...args]` (exec form — e.g. Logflare's `["CMD", "curl", "-sSfL",
+ *   "--head", "-o", "/dev/null", "http://127.0.0.1:4000/health"]`,
+ *   `start.go:365-366`) — since `--health-cmd` always produces a `CMD-SHELL`
+ *   test, each `args` element is POSIX-shell-quoted individually (via
+ *   {@link legacyShellQuoteArg}) and joined with spaces, so that when Docker
+ *   later runs `/bin/sh -c "<joined>"` inside the container, the shell
+ *   re-splits it back into the exact same argv the exec form specified —
+ *   including an argument containing spaces or embedded quotes, which none of
+ *   the current 14 services happen to need but which this conversion must
+ *   still get right.
+ */
+export function legacyBuildHealthCmdArg(test: ReadonlyArray<string>): string {
+  const [mode, ...rest] = test;
+  if (mode === "CMD-SHELL") return rest[0] ?? "";
+  return rest.map(legacyShellQuoteArg).join(" ");
+}
+
+function formatPortBindingFlag(port: LegacyStartPortBindingSpec): string {
+  const suffix = port.protocol === "udp" ? "/udp" : "";
+  return `${port.hostPort}:${port.containerPort}${suffix}`;
+}
+
+function formatExposedPortFlag(port: LegacyStartExposedPortSpec): string {
+  const suffix = port.protocol === "udp" ? "/udp" : "";
+  return `${port.containerPort}${suffix}`;
+}
+
+function buildHealthcheckArgs(healthcheck: LegacyStartHealthcheckSpec): ReadonlyArray<string> {
+  const args: Array<string> = ["--health-cmd", legacyBuildHealthCmdArg(healthcheck.test)];
+  if (healthcheck.intervalSeconds !== undefined) {
+    args.push("--health-interval", formatDockerDurationSeconds(healthcheck.intervalSeconds));
+  }
+  if (healthcheck.timeoutSeconds !== undefined) {
+    args.push("--health-timeout", formatDockerDurationSeconds(healthcheck.timeoutSeconds));
+  }
+  if (healthcheck.retries !== undefined) {
+    args.push("--health-retries", String(healthcheck.retries));
+  }
+  if (healthcheck.startPeriodSeconds !== undefined) {
+    args.push("--health-start-period", formatDockerDurationSeconds(healthcheck.startPeriodSeconds));
+  }
+  return args;
+}
+
+/**
+ * Docker/Podman CLI env vars that configure the CLIENT itself — which daemon
+ * it connects to — rather than a value for the container being created. A
+ * container spec's own `env` can legitimately need to set one of these (e.g.
+ * Vector's `DOCKER_HOST=http://host.docker.internal:<port>`, set by
+ * `legacyResolveVectorDockerSocketPlan` for a `tcp`/`npipe` daemon host so
+ * Vector can reach the real daemon from inside its own container), but that
+ * value must never be inherited by the spawned `docker`/`podman create`
+ * PROCESS's own environment: doing so would hijack which daemon that process
+ * itself talks to before the container even exists (see
+ * `legacyDockerCreateContainer`, `container-lifecycle.ts`, which filters these
+ * keys out of the env it hands to the spawned process for exactly this
+ * reason). These are not secrets, so unlike the rest of `spec.env` they are
+ * safe to emit inline as `-e KEY=value` instead of the key-only form.
+ */
+const DOCKER_CLIENT_ENV_KEYS: ReadonlySet<string> = new Set([
+  "DOCKER_HOST",
+  "DOCKER_TLS_VERIFY",
+  "DOCKER_CERT_PATH",
+  "DOCKER_CONTEXT",
+  "DOCKER_API_VERSION",
+]);
+
+/** Whether `key` configures the Docker/Podman CLI client itself — see {@link DOCKER_CLIENT_ENV_KEYS}. */
+export function legacyIsDockerClientEnvKey(key: string): boolean {
+  return DOCKER_CLIENT_ENV_KEYS.has(key);
+}
+
+/**
+ * Assemble the `docker create` argv for one `supabase start` service
+ * container. Pure (no Effect) so every flag mapping is unit-testable in
+ * isolation, matching the `buildLegacyDockerArgs` (`docker run`) precedent.
+ *
+ * `"create"` is argv[0] — the caller (`legacy-container-cli.ts`'s
+ * `spawnContainerCli`/`containerCliExitCode`) prepends only the `docker`/
+ * `podman` binary itself, exactly like `buildLegacyDockerArgs` returning
+ * `"run"` as its own argv[0].
+ *
+ * Env is emitted in the key-only `-e KEY` form (never `-e KEY=value`) for the
+ * same CWE-214/209 reason as `buildLegacyDockerArgs`: these containers'
+ * env carries JWT secrets, SMTP credentials, API keys, and DB passwords, none
+ * of which may appear in this process's own argv (`ps aux` /
+ * `/proc/<pid>/cmdline`). The spawned `docker create`'s own child environment
+ * supplies each value — a later caller's responsibility, not this builder's.
+ * The exception is {@link legacyIsDockerClientEnvKey} keys, which are emitted
+ * inline as `-e KEY=value` instead — see that function's doc comment.
+ */
+export function legacyBuildStartContainerCreateArgs(
+  spec: LegacyStartContainerSpec,
+): ReadonlyArray<string> {
+  return [
+    "create",
+    "--name",
+    spec.containerName,
+    ...(spec.hostname === undefined ? [] : ["--hostname", spec.hostname]),
+    ...Object.entries(spec.env).flatMap(([key, value]) =>
+      legacyIsDockerClientEnvKey(key) ? ["-e", `${key}=${value}`] : ["-e", key],
+    ),
+    ...spec.binds.flatMap((bind) => ["-v", bind]),
+    ...(spec.volumesFrom ?? []).flatMap((source) => ["--volumes-from", source]),
+    ...Object.entries(spec.tmpfs ?? {}).flatMap(([path, options]) => [
+      "--tmpfs",
+      options.length > 0 ? `${path}:${options}` : path,
+    ]),
+    ...(spec.ports ?? []).flatMap((port) => ["-p", formatPortBindingFlag(port)]),
+    ...(spec.exposedPorts ?? []).flatMap((port) => ["--expose", formatExposedPortFlag(port)]),
+    ...(spec.healthcheck === undefined ? [] : buildHealthcheckArgs(spec.healthcheck)),
+    ...(spec.restartPolicy === undefined ? [] : ["--restart", spec.restartPolicy]),
+    ...(spec.securityOpt ?? []).flatMap((opt) => ["--security-opt", opt]),
+    ...(spec.extraHosts ?? []).flatMap((host) => ["--add-host", host]),
+    "--network",
+    spec.networkId,
+    ...(spec.networkAliases ?? []).flatMap((alias) => ["--network-alias", alias]),
+    ...Object.entries(spec.labels).flatMap(([key, value]) => ["--label", `${key}=${value}`]),
+    // `--entrypoint` must precede the image (it is a `docker create` flag).
+    ...(spec.entrypoint === undefined ? [] : ["--entrypoint", spec.entrypoint]),
+    spec.image,
+    ...(spec.cmd ?? []),
+  ];
+}
+
+/**
+ * Mirror Go's `DockerStart` Bitbucket Pipelines handling
+ * (`apps/cli-go/internal/utils/docker.go:400-405`): when `BITBUCKET_CLONE_DIR`
+ * is set, that runner disallows named volumes and `--security-opt`, so Go
+ * drops named-volume binds and clears `SecurityOpt` before starting any
+ * container. Mirrors `legacyApplyBitbucketDockerFilter`
+ * (`legacy-docker-run.args.ts`) for the `docker create` shape — e.g. the
+ * Postgres container's `<projectId>_db:/var/lib/postgresql/data` named-volume
+ * bind is dropped while a bind-mount stays; Vector's non-root Docker-socket
+ * bind mount (already a bind mount, not a named volume) is unaffected either
+ * way, but its `SecurityOpt: ["label:disable"]` is cleared.
+ *
+ * `volumesFrom` and `tmpfs` are untouched: Go's Bitbucket branch only ever
+ * reassigns `hostConfig.Binds` and clears `hostConfig.SecurityOpt`
+ * (`docker.go:401-405`) — it does not touch `VolumesFrom` or `Tmpfs`.
+ */
+export function legacyApplyBitbucketStartContainerFilter(
+  spec: LegacyStartContainerSpec,
+  isBitbucket: boolean,
+): LegacyStartContainerSpec {
+  if (!isBitbucket) return spec;
+  return {
+    ...spec,
+    binds: spec.binds.filter((bind) => legacyIsBindMountSource(legacyBindMountSpecSource(bind))),
+    securityOpt: [],
+  };
+}
diff --git a/apps/cli/src/legacy/commands/start/lib/docker-create-args.unit.test.ts b/apps/cli/src/legacy/commands/start/lib/docker-create-args.unit.test.ts
new file mode 100644
index 0000000000..d4b2e86802
--- /dev/null
+++ b/apps/cli/src/legacy/commands/start/lib/docker-create-args.unit.test.ts
@@ -0,0 +1,308 @@
+import { describe, expect, test } from "vitest";
+
+import {
+  legacyBuildStartContainerCreateArgs,
+  legacyApplyBitbucketStartContainerFilter,
+  legacyBuildHealthCmdArg,
+  legacyIsDockerClientEnvKey,
+  type LegacyStartContainerSpec,
+} from "./docker-create-args.ts";
+
+// Mirrors the Logflare/analytics container (`start.go:350-394`): the fullest
+// worked example in the Go source — Hostname, Entrypoint+Cmd, exec-form
+// Healthcheck with StartPeriod, ExposedPorts alongside a matching
+// PortBinding, RestartPolicy, and network aliases.
+const full: LegacyStartContainerSpec = {
+  image: "supabase/logflare:1.0.0",
+  containerName: "supabase_analytics_proj",
+  hostname: "127.0.0.1",
+  env: { DB_PASSWORD: "super-secret", DB_HOSTNAME: "supabase_db_proj" },
+  entrypoint: "sh",
+  cmd: ["-c", "./logflare start"],
+  binds: ["/host/gcloud.json:/opt/app/gcloud.json"],
+  volumesFrom: ["supabase_storage_proj"],
+  tmpfs: { "/docker-entrypoint-initdb.d": "" },
+  ports: [{ hostPort: "4000", containerPort: "4000" }],
+  exposedPorts: [{ containerPort: "4000" }],
+  healthcheck: {
+    test: ["CMD", "curl", "-sSfL", "--head", "-o", "/dev/null", "http://127.0.0.1:4000/health"],
+    intervalSeconds: 10,
+    timeoutSeconds: 2,
+    retries: 3,
+    startPeriodSeconds: 10,
+  },
+  restartPolicy: "unless-stopped",
+  securityOpt: ["label:disable"],
+  extraHosts: ["host.docker.internal:host-gateway"],
+  networkId: "supabase_network_proj",
+  networkAliases: ["analytics"],
+  labels: {
+    "com.supabase.cli.project": "proj",
+    "com.docker.compose.project": "proj",
+  },
+};
+
+describe("legacyBuildStartContainerCreateArgs", () => {
+  test("assembles full-option argv in the documented fixed order", () => {
+    expect(legacyBuildStartContainerCreateArgs(full)).toEqual([
+      "create",
+      "--name",
+      "supabase_analytics_proj",
+      "--hostname",
+      "127.0.0.1",
+      "-e",
+      "DB_PASSWORD",
+      "-e",
+      "DB_HOSTNAME",
+      "-v",
+      "/host/gcloud.json:/opt/app/gcloud.json",
+      "--volumes-from",
+      "supabase_storage_proj",
+      "--tmpfs",
+      "/docker-entrypoint-initdb.d",
+      "-p",
+      "4000:4000",
+      "--expose",
+      "4000",
+      "--health-cmd",
+      "curl -sSfL --head -o /dev/null http://127.0.0.1:4000/health",
+      "--health-interval",
+      "10s",
+      "--health-timeout",
+      "2s",
+      "--health-retries",
+      "3",
+      "--health-start-period",
+      "10s",
+      "--restart",
+      "unless-stopped",
+      "--security-opt",
+      "label:disable",
+      "--add-host",
+      "host.docker.internal:host-gateway",
+      "--network",
+      "supabase_network_proj",
+      "--network-alias",
+      "analytics",
+      "--label",
+      "com.supabase.cli.project=proj",
+      "--label",
+      "com.docker.compose.project=proj",
+      "--entrypoint",
+      "sh",
+      "supabase/logflare:1.0.0",
+      "-c",
+      "./logflare start",
+    ]);
+  });
+
+  test("emits only required flags for the minimal-options case", () => {
+    const minimal: LegacyStartContainerSpec = {
+      image: "supabase/postgres-meta:v1",
+      containerName: "supabase_pg_meta_proj",
+      env: {},
+      binds: [],
+      networkId: "supabase_network_proj",
+      labels: {},
+    };
+    expect(legacyBuildStartContainerCreateArgs(minimal)).toEqual([
+      "create",
+      "--name",
+      "supabase_pg_meta_proj",
+      "--network",
+      "supabase_network_proj",
+      "supabase/postgres-meta:v1",
+    ]);
+  });
+
+  test("never serializes env values into argv (CWE-214: secrets must not leak to ps)", () => {
+    const args = legacyBuildStartContainerCreateArgs(full);
+    expect(args).toContain("DB_PASSWORD");
+    expect(args.some((a) => a.includes("super-secret"))).toBe(false);
+    // Every -e argument is a bare key: no '=' anywhere in an -e value.
+    const envValues = args.flatMap((a, i) => (args[i - 1] === "-e" ? [a] : []));
+    expect(envValues.every((v) => !v.includes("="))).toBe(true);
+  });
+
+  test("emits DOCKER_HOST inline as -e KEY=value, not key-only, since it's not a secret (Vector's tcp/npipe daemon host)", () => {
+    const spec: LegacyStartContainerSpec = {
+      image: "timberio/vector:0.36.0-alpine",
+      containerName: "supabase_vector_proj",
+      env: { DOCKER_HOST: "http://host.docker.internal:2375", API_KEY: "super-secret" },
+      binds: [],
+      networkId: "supabase_network_proj",
+      labels: {},
+    };
+    const args = legacyBuildStartContainerCreateArgs(spec);
+    expect(args).toContain("-e");
+    const dockerHostIndex = args.indexOf("DOCKER_HOST=http://host.docker.internal:2375");
+    expect(dockerHostIndex).toBeGreaterThan(-1);
+    expect(args[dockerHostIndex - 1]).toBe("-e");
+    // The genuine secret alongside it must still stay key-only.
+    expect(args).toContain("API_KEY");
+    expect(args.some((a) => a.includes("super-secret"))).toBe(false);
+  });
+
+  test("legacyIsDockerClientEnvKey recognizes Docker/Podman client env vars and nothing else", () => {
+    expect(legacyIsDockerClientEnvKey("DOCKER_HOST")).toBe(true);
+    expect(legacyIsDockerClientEnvKey("DOCKER_TLS_VERIFY")).toBe(true);
+    expect(legacyIsDockerClientEnvKey("DOCKER_CERT_PATH")).toBe(true);
+    expect(legacyIsDockerClientEnvKey("DOCKER_CONTEXT")).toBe(true);
+    expect(legacyIsDockerClientEnvKey("DOCKER_API_VERSION")).toBe(true);
+    expect(legacyIsDockerClientEnvKey("DB_PASSWORD")).toBe(false);
+  });
+
+  test("omits the protocol suffix for tcp ports and adds /udp when specified", () => {
+    const spec: LegacyStartContainerSpec = {
+      image: "img",
+      containerName: "c",
+      env: {},
+      binds: [],
+      networkId: "net",
+      labels: {},
+      ports: [
+        { hostPort: "53", containerPort: "53", protocol: "udp" },
+        { hostPort: "80", containerPort: "80" },
+        { hostPort: "81", containerPort: "81", protocol: "tcp" },
+      ],
+      exposedPorts: [{ containerPort: "9999" }, { containerPort: "9998", protocol: "udp" }],
+    };
+    const args = legacyBuildStartContainerCreateArgs(spec);
+    expect(args).toEqual(
+      expect.arrayContaining([
+        "-p",
+        "53:53/udp",
+        "-p",
+        "80:80",
+        "-p",
+        "81:81",
+        "--expose",
+        "9999",
+        "--expose",
+        "9998/udp",
+      ]),
+    );
+  });
+
+  test("emits --tmpfs with :options only when options are non-empty", () => {
+    const spec: LegacyStartContainerSpec = {
+      image: "img",
+      containerName: "c",
+      env: {},
+      binds: [],
+      networkId: "net",
+      labels: {},
+      tmpfs: { "/tmp/bare": "", "/tmp/opts": "rw,size=100m" },
+    };
+    const args = legacyBuildStartContainerCreateArgs(spec);
+    expect(args).toEqual(
+      expect.arrayContaining(["--tmpfs", "/tmp/bare", "--tmpfs", "/tmp/opts:rw,size=100m"]),
+    );
+  });
+
+  test("emits cmd tokens after the image even when entrypoint is absent (Pooler: start.go:1234-1237)", () => {
+    const spec: LegacyStartContainerSpec = {
+      image: "supabase/supavisor:2.0.0",
+      containerName: "supabase_pooler_proj",
+      env: {},
+      binds: [],
+      networkId: "net",
+      labels: {},
+      cmd: ["/bin/sh", "-c", "/app/bin/migrate && /app/bin/server"],
+    };
+    const args = legacyBuildStartContainerCreateArgs(spec);
+    expect(args).not.toContain("--entrypoint");
+    const imageIdx = args.indexOf("supabase/supavisor:2.0.0");
+    expect(args.slice(imageIdx)).toEqual([
+      "supabase/supavisor:2.0.0",
+      "/bin/sh",
+      "-c",
+      "/app/bin/migrate && /app/bin/server",
+    ]);
+  });
+
+  test("omits health flags entirely when healthcheck is absent (Kong/PostgREST: start.go:975)", () => {
+    const spec: LegacyStartContainerSpec = {
+      image: "kong:3",
+      containerName: "supabase_kong_proj",
+      env: {},
+      binds: [],
+      networkId: "net",
+      labels: {},
+    };
+    const args = legacyBuildStartContainerCreateArgs(spec);
+    expect(args.some((a) => a.startsWith("--health"))).toBe(false);
+  });
+
+  test("never reads spec.secretFiles — the pure builder emits nothing from it (container-lifecycle.ts alone stages it into a real bind, CWE-214/522)", () => {
+    const spec: LegacyStartContainerSpec = {
+      image: "kong:3",
+      containerName: "supabase_kong_proj",
+      env: {},
+      binds: ["/host/other.txt:/etc/other.txt"],
+      networkId: "net",
+      labels: {},
+      secretFiles: [{ containerPath: "/etc/secret.yml", content: "top-secret-content" }],
+    };
+    const args = legacyBuildStartContainerCreateArgs(spec);
+    expect(args.some((a) => a.includes("top-secret-content"))).toBe(false);
+    expect(args.some((a) => a.includes("/etc/secret.yml"))).toBe(false);
+    // Only the spec's own `binds` entries are ever emitted — secretFiles contributes nothing.
+    expect(args.filter((a) => a === "-v")).toHaveLength(1);
+  });
+});
+
+describe("legacyBuildHealthCmdArg", () => {
+  test("forwards CMD-SHELL scripts verbatim, with no quoting applied", () => {
+    const script = `node --eval="fetch('http://127.0.0.1:8080/health').then((r) => {if (!r.ok) throw new Error(r.status)})"`;
+    expect(legacyBuildHealthCmdArg(["CMD-SHELL", script])).toBe(script);
+  });
+
+  test("shell-quotes each exec-form argument and joins with spaces", () => {
+    expect(
+      legacyBuildHealthCmdArg([
+        "CMD",
+        "curl",
+        "-sSfL",
+        "--head",
+        "-o",
+        "/dev/null",
+        "http://127.0.0.1:4000/health",
+      ]),
+    ).toBe("curl -sSfL --head -o /dev/null http://127.0.0.1:4000/health");
+  });
+
+  test("quotes an exec-form argument containing spaces so the container shell re-splits it back to one token", () => {
+    expect(legacyBuildHealthCmdArg(["CMD", "echo", "hello world"])).toBe("echo 'hello world'");
+  });
+
+  test("escapes an embedded single quote using the '\\'' POSIX technique", () => {
+    expect(legacyBuildHealthCmdArg(["CMD", "echo", "it's here"])).toBe("echo 'it'\\''s here'");
+  });
+});
+
+describe("legacyApplyBitbucketStartContainerFilter", () => {
+  const dbLike: LegacyStartContainerSpec = {
+    image: "supabase/postgres:15",
+    containerName: "supabase_db_proj",
+    env: {},
+    binds: ["supabase_db_proj:/var/lib/postgresql/data", "/repo/backup.sql:/etc/backup.sql:ro"],
+    networkId: "net",
+    labels: {},
+    securityOpt: ["label:disable"],
+    tmpfs: { "/docker-entrypoint-initdb.d": "" },
+    volumesFrom: ["supabase_storage_proj"],
+  };
+
+  test("passes the spec through unchanged outside Bitbucket", () => {
+    expect(legacyApplyBitbucketStartContainerFilter(dbLike, false)).toBe(dbLike);
+  });
+
+  test("drops named-volume binds and clears security-opt under Bitbucket, leaving tmpfs/volumesFrom untouched", () => {
+    const filtered = legacyApplyBitbucketStartContainerFilter(dbLike, true);
+    expect(filtered.binds).toEqual(["/repo/backup.sql:/etc/backup.sql:ro"]);
+    expect(filtered.securityOpt).toEqual([]);
+    expect(filtered.tmpfs).toEqual({ "/docker-entrypoint-initdb.d": "" });
+    expect(filtered.volumesFrom).toEqual(["supabase_storage_proj"]);
+  });
+});
diff --git a/apps/cli/src/legacy/commands/start/lib/health-check.ts b/apps/cli/src/legacy/commands/start/lib/health-check.ts
new file mode 100644
index 0000000000..f21e6b9693
--- /dev/null
+++ b/apps/cli/src/legacy/commands/start/lib/health-check.ts
@@ -0,0 +1,296 @@
+/**
+ * Port of Go's `WaitForHealthyService`/`IsServiceReady`
+ * (`apps/cli-go/internal/db/start/start.go:192-231`,
+ * `apps/cli-go/internal/status/status.go:147-168`): a single shared probe
+ * across every still-unhealthy started container, on a 1-second constant
+ * backoff, for up to `timeoutSeconds` retries (Go's default `serviceTimeout =
+ * 30 * time.Second`) — NOT independent per-container timers. Each tick probes
+ * every still-unhealthy container, narrows the "still watching" set to just
+ * the ones that failed this round (a healthy container stops being probed),
+ * and only the final timeout's failures surface to the caller.
+ */
+
+import { Data, Effect, Schedule, Stream } from "effect";
+import * as HttpClient from "effect/unstable/http/HttpClient";
+import * as HttpClientRequest from "effect/unstable/http/HttpClientRequest";
+import type { ChildProcessSpawner } from "effect/unstable/process/ChildProcessSpawner";
+
+import { spawnContainerCli } from "../../../shared/legacy-container-cli.ts";
+import { legacyInspectContainerState } from "../../../shared/legacy-docker-lifecycle.ts";
+import { legacyKongAuthHeaders } from "../../../shared/legacy-kong-auth.ts";
+
+type Spawner = ChildProcessSpawner["Service"];
+
+/** Go's `serviceTimeout` (`apps/cli-go/internal/start/start.go:161`). */
+const LEGACY_HEALTH_CHECK_TIMEOUT_SECONDS = 30;
+
+/**
+ * Go's `healthProbeTimeout` (`apps/cli-go/internal/status/status.go:209`): caps
+ * a single HTTP readiness probe so a hung response cannot stall the
+ * surrounding retry loop.
+ */
+const LEGACY_HTTP_PROBE_TIMEOUT_SECONDS = 10;
+
+/** `apps/cli-go/internal/status/status.go:161` — PostgREST does not support native Docker healthchecks. */
+const LEGACY_POSTGREST_READY_PATH = "/rest-admin/v1/ready";
+
+/**
+ * `apps/cli-go/internal/status/status.go:163-166` — Edge Runtime bypasses its
+ * native Docker healthcheck too ("native health check logs too much
+ * hyper::Error(IncompleteMessage)"), through the exact same
+ * {@link legacyCheckHttpReady}/Kong-gateway path as PostgREST, just its own
+ * path and container id. Go's `checkHTTPHead` even shares one lazily-built
+ * `healthClient` across both call sites (`status.go:202-219`) — the closest
+ * equivalent here is {@link LegacyHealthCheckPostgrestGateway} being reused
+ * as-is (name notwithstanding — its shape is generic, not
+ * PostgREST-specific) for both {@link LegacyWaitForHealthyServicesOptions.postgrest}
+ * and {@link LegacyWaitForHealthyServicesOptions.edgeRuntime}.
+ */
+const LEGACY_EDGE_RUNTIME_READY_PATH = "/functions/v1/_internal/health";
+
+/** Identifies a single container's readiness failure this round. */
+export interface LegacyHealthCheckFailure {
+  readonly containerId: string;
+  readonly reason: string;
+}
+
+/** Internal-only: one probe round's failures, narrowing which containers are still watched next round. */
+class LegacyHealthCheckProbeError extends Data.TaggedError("LegacyHealthCheckProbeError")<{
+  readonly failures: ReadonlyArray<LegacyHealthCheckFailure>;
+}> {}
+
+/**
+ * The retry loop's final, and only surfaced, failure — mirrors Go returning
+ * `errors.Join(errHealth...)` from the last failed `probe()` call once
+ * `backoff.Retry` gives up (`start.go:210-214`).
+ */
+export class LegacyHealthCheckTimeoutError extends Data.TaggedError(
+  "LegacyHealthCheckTimeoutError",
+)<{
+  readonly message: string;
+  readonly unhealthy: ReadonlyArray<LegacyHealthCheckFailure>;
+}> {}
+
+/**
+ * PostgREST's local Kong gateway coordinates, mirroring Go's
+ * `fetcher.NewServiceGateway(utils.Config.Api.ExternalUrl,
+ * utils.Config.Auth.SecretKey.Value, ...)` (`status.go:213-218`). TLS/CA trust
+ * for a local https gateway is the caller's responsibility when composing the
+ * `HttpClient.HttpClient` layer this module requires — same split as
+ * `legacy-storage-gateway.ts`/`legacyStorageGatewayFetch`.
+ *
+ * `start.command.ts` composes the `HttpClient.HttpClient` this module
+ * requires via `legacyHttpClientLayer` (itself `FetchHttpClient`-backed, and
+ * on its own CA-unaware; see that layer's own header) — the same layer
+ * `db reset`/`seed buckets` compose for the equivalent gateway calls.
+ * `start.handler.ts` layers a CA-trusting override on top of that: when
+ * `api.tls.enabled`, `apiExternalUrl` is `https://` against Kong's
+ * self-signed local cert (`KONG_LOCAL_CA_CERT`, or a validated
+ * `api.tls.cert_path` override), so before calling
+ * {@link legacyWaitForHealthyServices} it resolves that same CA via
+ * `legacy-storage-credentials.ts`'s `legacyResolveStorageCredentials` (the
+ * mechanism `seed buckets`/`storage`/`db reset` already use) and, when a
+ * local CA resolves, overrides `FetchHttpClient.Fetch` with
+ * `legacyStorageGatewayFetch` around the health-check call via
+ * `Effect.provideService`. That override only takes effect against a
+ * `FetchHttpClient`-backed `HttpClient.HttpClient` — exactly what
+ * `legacyHttpClientLayer` provides — so a stack started with
+ * `[api.tls] enabled = true` now gets a `legacyCheckHttpReady` probe that
+ * trusts the local Kong CA instead of exhausting `legacyWaitForHealthyServices`'s
+ * full 30s budget on a TLS verification failure.
+ */
+export interface LegacyHealthCheckPostgrestGateway {
+  readonly containerId: string;
+  readonly apiExternalUrl: string;
+  readonly secretKey: string;
+}
+
+export interface LegacyWaitForHealthyServicesOptions {
+  readonly timeoutSeconds?: number;
+  readonly postgrest?: LegacyHealthCheckPostgrestGateway;
+  /** See {@link LEGACY_EDGE_RUNTIME_READY_PATH}'s doc comment for why this reuses the same gateway shape as {@link postgrest}. */
+  readonly edgeRuntime?: LegacyHealthCheckPostgrestGateway;
+}
+
+/**
+ * Go's `assertContainerHealthy` (`status.go:147-156`), reused verbatim via
+ * {@link legacyInspectContainerState} — the same primitive `status.handler.ts`
+ * already uses for the exact same not-running/not-ready gating.
+ */
+function legacyCheckContainerReady(
+  spawner: Spawner,
+  containerId: string,
+): Effect.Effect<void, string> {
+  return legacyInspectContainerState(spawner, containerId).pipe(
+    Effect.mapError((cause) => cause.message),
+    Effect.flatMap((state) => {
+      if (!state.running) {
+        return Effect.fail(`container is not running: ${state.status}`);
+      }
+      if (state.health !== undefined && state.health !== "healthy") {
+        return Effect.fail(`container is not ready: ${state.health}`);
+      }
+      return Effect.void;
+    }),
+  );
+}
+
+/**
+ * Go's `checkHTTPHead` (`status.go:211-229`): an HTTP HEAD through the local
+ * Kong gateway, expecting exactly 200. Bypasses the Docker healthcheck
+ * entirely — PostgREST "does not support native health checks"
+ * (`status.go:159-161`).
+ */
+function legacyCheckHttpReady(
+  gateway: LegacyHealthCheckPostgrestGateway,
+  path: string,
+): Effect.Effect<void, string, HttpClient.HttpClient> {
+  return Effect.gen(function* () {
+    const httpClient = yield* HttpClient.HttpClient;
+    const request = HttpClientRequest.head(`${gateway.apiExternalUrl}${path}`).pipe(
+      HttpClientRequest.setHeaders(legacyKongAuthHeaders(gateway.secretKey)),
+    );
+    const response = yield* httpClient.execute(request).pipe(
+      Effect.timeout(`${LEGACY_HTTP_PROBE_TIMEOUT_SECONDS} seconds`),
+      Effect.mapError((cause) => String(cause)),
+    );
+    if (response.status !== 200) {
+      return yield* Effect.fail(`unexpected status ${response.status}`);
+    }
+  });
+}
+
+/**
+ * Go's `DockerStreamLogsOnce` (`apps/cli-go/internal/utils/docker.go:593-606`)
+ * via `docker logs <id>`, teed to this process's stderr — best-effort: a
+ * failure to stream logs must never mask the timeout error it was printed
+ * alongside, so every failure here is swallowed.
+ */
+function legacyStreamContainerLogsOnce(spawner: Spawner, containerId: string): Effect.Effect<void> {
+  return Effect.scoped(
+    Effect.gen(function* () {
+      const handle = yield* spawnContainerCli(spawner, ["logs", containerId], {
+        stdin: "ignore",
+        stdout: "pipe",
+        stderr: "pipe",
+      });
+      yield* Effect.all(
+        [
+          Stream.runForEach(handle.stdout, (chunk) =>
+            Effect.sync(() => {
+              globalThis.process.stderr.write(chunk);
+            }),
+          ),
+          Stream.runForEach(handle.stderr, (chunk) =>
+            Effect.sync(() => {
+              globalThis.process.stderr.write(chunk);
+            }),
+          ),
+        ],
+        { concurrency: "unbounded" },
+      );
+      yield* handle.exitCode;
+    }),
+  ).pipe(Effect.orElseSucceed(() => undefined));
+}
+
+/** Go's `fmt.Fprintln(os.Stderr, containerId, "container logs:")` (`start.go:218`) + the log dump itself. */
+function legacyDumpContainerLogs(spawner: Spawner, containerId: string): Effect.Effect<void> {
+  return Effect.gen(function* () {
+    yield* Effect.sync(() => {
+      globalThis.process.stderr.write(`${containerId} container logs:\n`);
+    });
+    yield* legacyStreamContainerLogsOnce(spawner, containerId);
+  });
+}
+
+/**
+ * Waits for every container in `containerIds` to become ready, mirroring
+ * Go's `WaitForHealthyService(ctx, timeout, started...)`. Resolves once all
+ * are ready; fails with {@link LegacyHealthCheckTimeoutError} (carrying every
+ * still-unhealthy container's last-seen reason) once the retry budget is
+ * exhausted. The caller (`start.handler.ts`) decides whether
+ * `--ignore-health-check` turns that failure into a warning instead of a hard
+ * exit — this module only implements the polling contract.
+ */
+export function legacyWaitForHealthyServices(
+  spawner: Spawner,
+  containerIds: ReadonlyArray<string>,
+  opts: LegacyWaitForHealthyServicesOptions = {},
+): Effect.Effect<void, LegacyHealthCheckTimeoutError, HttpClient.HttpClient> {
+  const timeoutSeconds = opts.timeoutSeconds ?? LEGACY_HEALTH_CHECK_TIMEOUT_SECONDS;
+  const postgrest = opts.postgrest;
+  const edgeRuntime = opts.edgeRuntime;
+
+  const checkOne = (containerId: string): Effect.Effect<void, string, HttpClient.HttpClient> => {
+    if (postgrest !== undefined && containerId === postgrest.containerId) {
+      return legacyCheckHttpReady(postgrest, LEGACY_POSTGREST_READY_PATH);
+    }
+    if (edgeRuntime !== undefined && containerId === edgeRuntime.containerId) {
+      return legacyCheckHttpReady(edgeRuntime, LEGACY_EDGE_RUNTIME_READY_PATH);
+    }
+    return legacyCheckContainerReady(spawner, containerId);
+  };
+
+  return Effect.gen(function* () {
+    let stillWatching = containerIds;
+
+    // Mirrors Go's closure-captured `started` slice
+    // (`db/start/start.go:200-212`): each round narrows `stillWatching` to
+    // just the containers that failed, so a container that becomes healthy
+    // mid-run stops being probed on later rounds.
+    const probe: Effect.Effect<void, LegacyHealthCheckProbeError, HttpClient.HttpClient> =
+      Effect.gen(function* () {
+        const outcomes = yield* Effect.forEach(
+          stillWatching,
+          (containerId) =>
+            checkOne(containerId).pipe(
+              Effect.match({
+                onFailure: (reason): LegacyHealthCheckFailure | undefined => ({
+                  containerId,
+                  reason,
+                }),
+                onSuccess: (): LegacyHealthCheckFailure | undefined => undefined,
+              }),
+            ),
+          { concurrency: "unbounded" },
+        );
+        const failures = outcomes.filter(
+          (outcome): outcome is LegacyHealthCheckFailure => outcome !== undefined,
+        );
+        stillWatching = failures.map((failure) => failure.containerId);
+        if (failures.length > 0) {
+          return yield* Effect.fail(new LegacyHealthCheckProbeError({ failures }));
+        }
+      });
+
+    // `backoff.WithMaxRetries(backoff.NewConstantBackOff(time.Second),
+    // uint64(timeout.Seconds()))` (`db/start/start.go:192-198`): a 1-second
+    // constant delay, capped at `timeoutSeconds` retries after the initial
+    // attempt (~`timeoutSeconds` further seconds elapsed on total failure).
+    const schedule = Schedule.max([Schedule.spaced("1 seconds"), Schedule.recurs(timeoutSeconds)]);
+
+    yield* probe.pipe(
+      Effect.retry(schedule),
+      Effect.catch((probeError) =>
+        Effect.gen(function* () {
+          // Go skips this dump on context cancellation (`start.go:215`,
+          // `!errors.Is(err, context.Canceled)`) — an interrupted fiber never
+          // reaches this `Effect.catch` handler at all, so no separate check
+          // is needed here.
+          yield* Effect.forEach(probeError.failures, (failure) =>
+            legacyDumpContainerLogs(spawner, failure.containerId),
+          );
+          return yield* Effect.fail(
+            new LegacyHealthCheckTimeoutError({
+              message: probeError.failures
+                .map((failure) => `${failure.containerId}: ${failure.reason}`)
+                .join("\n"),
+              unhealthy: probeError.failures,
+            }),
+          );
+        }),
+      ),
+    );
+  });
+}
diff --git a/apps/cli/src/legacy/commands/start/lib/health-check.unit.test.ts b/apps/cli/src/legacy/commands/start/lib/health-check.unit.test.ts
new file mode 100644
index 0000000000..ed0d287421
--- /dev/null
+++ b/apps/cli/src/legacy/commands/start/lib/health-check.unit.test.ts
@@ -0,0 +1,418 @@
+import { describe, expect, it } from "@effect/vitest";
+import { Deferred, Effect, Exit, Fiber, Layer, Sink, Stream } from "effect";
+import { ChildProcessSpawner } from "effect/unstable/process";
+import * as HttpClient from "effect/unstable/http/HttpClient";
+import * as HttpClientResponse from "effect/unstable/http/HttpClientResponse";
+import * as TestClock from "effect/testing/TestClock";
+
+import {
+  LegacyHealthCheckTimeoutError,
+  legacyWaitForHealthyServices,
+  type LegacyHealthCheckPostgrestGateway,
+} from "./health-check.ts";
+
+/**
+ * A spawner that answers `docker container inspect`/`docker logs` calls.
+ * `inspectResponse` is called once per `(containerId, callIndex)` pair — the
+ * `callIndex` (0-based, per container) lets a test script a container's
+ * health across successive polling rounds. `docker logs` calls (the
+ * timeout-path debug dump) always succeed with empty output.
+ */
+function mockHealthSpawner(inspectResponse: (containerId: string, callIndex: number) => string) {
+  const counts = new Map<string, number>();
+  const encoder = new TextEncoder();
+  const spawned: Array<ReadonlyArray<string>> = [];
+
+  const spawner = ChildProcessSpawner.make((command) =>
+    Effect.gen(function* () {
+      const args = command._tag === "StandardCommand" ? command.args : [];
+      spawned.push(args);
+
+      let stdout = "";
+      if (args[0] === "container" && args[1] === "inspect") {
+        const containerId = args[2] ?? "";
+        const callIndex = counts.get(containerId) ?? 0;
+        counts.set(containerId, callIndex + 1);
+        stdout = inspectResponse(containerId, callIndex);
+      }
+
+      const exitDeferred = yield* Deferred.make<ChildProcessSpawner.ExitCode>();
+      yield* Deferred.succeed(exitDeferred, ChildProcessSpawner.ExitCode(0));
+      return ChildProcessSpawner.makeHandle({
+        pid: ChildProcessSpawner.ProcessId(1),
+        stdout: Stream.fromIterable(stdout.length > 0 ? [encoder.encode(stdout)] : []),
+        stderr: Stream.empty,
+        all: Stream.empty,
+        exitCode: Deferred.await(exitDeferred),
+        isRunning: Effect.succeed(false),
+        stdin: Sink.drain,
+        kill: () => Effect.void,
+        unref: Effect.succeed(Effect.void),
+        getInputFd: () => Sink.drain,
+        getOutputFd: () => Stream.empty,
+      });
+    }),
+  );
+
+  return {
+    spawner,
+    get spawned() {
+      return spawned;
+    },
+  };
+}
+
+const runningHealthy = JSON.stringify({
+  Status: "running",
+  Running: true,
+  Health: { Status: "healthy" },
+});
+const runningStarting = JSON.stringify({
+  Status: "running",
+  Running: true,
+  Health: { Status: "starting" },
+});
+const notRunning = JSON.stringify({ Status: "exited", Running: false });
+
+/**
+ * `legacyWaitForHealthyServices` structurally requires `HttpClient.HttpClient`
+ * (only exercised on the PostgREST HTTP-HEAD branch) — every test provides
+ * some `HttpClient.HttpClient`, and this one fails loudly if a
+ * container-only-health-check test ever calls it unexpectedly.
+ */
+const unusedHttpClientLayer = Layer.succeed(
+  HttpClient.HttpClient,
+  HttpClient.make(() => Effect.die("HttpClient should not be called for a plain container check")),
+);
+
+describe("legacyWaitForHealthyServices", () => {
+  it.effect(
+    "polls on a 1-second backoff until the container reports healthy, without waiting a full timeout",
+    () =>
+      Effect.gen(function* () {
+        const mock = mockHealthSpawner((_id, callIndex) =>
+          callIndex === 0 ? runningStarting : runningHealthy,
+        );
+
+        const fiber = yield* legacyWaitForHealthyServices(mock.spawner, ["supabase_kong_proj"], {
+          timeoutSeconds: 30,
+        }).pipe(
+          Effect.provide(unusedHttpClientLayer),
+          Effect.forkChild({ startImmediately: true }),
+        );
+
+        yield* TestClock.adjust("1 seconds");
+        const exit = yield* Fiber.await(fiber);
+
+        expect(Exit.isSuccess(exit)).toBe(true);
+        const inspectCalls = mock.spawned.filter(
+          (args) => args[0] === "container" && args[1] === "inspect",
+        );
+        expect(inspectCalls).toHaveLength(2);
+      }),
+  );
+
+  it.effect(
+    "stops probing a container once it becomes healthy, and only reports the still-unhealthy one on timeout",
+    () =>
+      Effect.gen(function* () {
+        const mock = mockHealthSpawner((containerId) =>
+          containerId === "supabase_kong_proj" ? runningHealthy : notRunning,
+        );
+
+        const fiber = yield* legacyWaitForHealthyServices(
+          mock.spawner,
+          ["supabase_kong_proj", "supabase_rest_proj"],
+          { timeoutSeconds: 2 },
+        ).pipe(Effect.provide(unusedHttpClientLayer), Effect.forkChild({ startImmediately: true }));
+
+        // 2 retries after the initial attempt (Go's `WithMaxRetries(..., timeout.Seconds())`).
+        yield* TestClock.adjust("1 seconds");
+        yield* TestClock.adjust("1 seconds");
+        const exit = yield* Fiber.await(fiber);
+
+        expect(Exit.isFailure(exit)).toBe(true);
+
+        const kongCalls = mock.spawned.filter(
+          (args) =>
+            args[0] === "container" && args[1] === "inspect" && args[2] === "supabase_kong_proj",
+        );
+        const restCalls = mock.spawned.filter(
+          (args) =>
+            args[0] === "container" && args[1] === "inspect" && args[2] === "supabase_rest_proj",
+        );
+        // The healthy container is probed exactly once, then narrowed out of
+        // the "still watching" set — the unhealthy one is probed on every round.
+        expect(kongCalls).toHaveLength(1);
+        expect(restCalls).toHaveLength(3);
+      }),
+  );
+
+  it.effect(
+    "fails with LegacyHealthCheckTimeoutError carrying only the still-unhealthy container's reason",
+    () =>
+      Effect.gen(function* () {
+        const mock = mockHealthSpawner(() => notRunning);
+
+        const fiber = yield* legacyWaitForHealthyServices(mock.spawner, ["supabase_rest_proj"], {
+          timeoutSeconds: 1,
+        }).pipe(
+          Effect.provide(unusedHttpClientLayer),
+          Effect.forkChild({ startImmediately: true }),
+        );
+
+        yield* TestClock.adjust("1 seconds");
+        const error = yield* Fiber.join(fiber).pipe(Effect.flip);
+
+        expect(error).toBeInstanceOf(LegacyHealthCheckTimeoutError);
+        expect(error.unhealthy).toEqual([
+          { containerId: "supabase_rest_proj", reason: "container is not running: exited" },
+        ]);
+        expect(error.message).toBe("supabase_rest_proj: container is not running: exited");
+      }),
+  );
+
+  it.effect("dumps container logs to stderr on a genuine timeout", () =>
+    Effect.gen(function* () {
+      const mock = mockHealthSpawner(() => notRunning);
+      const writes: Array<string> = [];
+      const originalWrite = globalThis.process.stderr.write.bind(globalThis.process.stderr);
+      globalThis.process.stderr.write = ((chunk: string | Uint8Array) => {
+        writes.push(typeof chunk === "string" ? chunk : new TextDecoder().decode(chunk));
+        return true;
+      }) as typeof globalThis.process.stderr.write;
+
+      try {
+        const fiber = yield* legacyWaitForHealthyServices(mock.spawner, ["supabase_rest_proj"], {
+          timeoutSeconds: 1,
+        }).pipe(
+          Effect.provide(unusedHttpClientLayer),
+          Effect.forkChild({ startImmediately: true }),
+        );
+
+        yield* TestClock.adjust("1 seconds");
+        yield* Fiber.await(fiber);
+      } finally {
+        globalThis.process.stderr.write = originalWrite;
+      }
+
+      expect(writes.some((chunk) => chunk.includes("supabase_rest_proj container logs:"))).toBe(
+        true,
+      );
+      expect(
+        mock.spawned.some((args) => args[0] === "logs" && args[1] === "supabase_rest_proj"),
+      ).toBe(true);
+    }),
+  );
+
+  describe("PostgREST HTTP-HEAD readiness", () => {
+    function postgrestGateway(secretKey: string): LegacyHealthCheckPostgrestGateway {
+      return {
+        containerId: "supabase_rest_proj",
+        apiExternalUrl: "http://127.0.0.1:54321",
+        secretKey,
+      };
+    }
+
+    function httpLayer(status: number, expectHeaders: (headers: Record<string, string>) => void) {
+      return Layer.succeed(
+        HttpClient.HttpClient,
+        HttpClient.make((request) => {
+          expectHeaders({ ...request.headers });
+          expect(request.method).toBe("HEAD");
+          expect(request.url).toBe("http://127.0.0.1:54321/rest-admin/v1/ready");
+          return Effect.succeed(
+            HttpClientResponse.fromWeb(request, new Response(null, { status })),
+          );
+        }),
+      );
+    }
+
+    it.effect("bypasses the Docker healthcheck and succeeds on a 200 HEAD response", () =>
+      Effect.gen(function* () {
+        const mock = mockHealthSpawner(() => runningHealthy);
+        const layer = httpLayer(200, (headers) => {
+          expect(headers["apikey"]).toBe("sb_secret_local");
+          expect(headers["authorization"]).toBeUndefined();
+        });
+
+        const exit = yield* legacyWaitForHealthyServices(mock.spawner, ["supabase_rest_proj"], {
+          timeoutSeconds: 1,
+          postgrest: postgrestGateway("sb_secret_local"),
+        }).pipe(Effect.provide(layer), Effect.exit);
+
+        expect(Exit.isSuccess(exit)).toBe(true);
+        // Never falls back to the Docker healthcheck for PostgREST.
+        expect(mock.spawned.some((args) => args[0] === "container" && args[1] === "inspect")).toBe(
+          false,
+        );
+      }),
+    );
+
+    it.effect("sends both apikey and Authorization headers for a JWT secret key", () =>
+      Effect.gen(function* () {
+        const mock = mockHealthSpawner(() => runningHealthy);
+        const layer = httpLayer(200, (headers) => {
+          expect(headers["apikey"]).toBe("ey.jwt.key");
+          expect(headers["authorization"]).toBe("Bearer ey.jwt.key");
+        });
+
+        const exit = yield* legacyWaitForHealthyServices(mock.spawner, ["supabase_rest_proj"], {
+          timeoutSeconds: 1,
+          postgrest: postgrestGateway("ey.jwt.key"),
+        }).pipe(Effect.provide(layer), Effect.exit);
+
+        expect(Exit.isSuccess(exit)).toBe(true);
+      }),
+    );
+
+    it.effect("retries and eventually times out when PostgREST never returns 200", () =>
+      Effect.gen(function* () {
+        const mock = mockHealthSpawner(() => runningHealthy);
+        const layer = httpLayer(503, () => {});
+
+        const fiber = yield* legacyWaitForHealthyServices(mock.spawner, ["supabase_rest_proj"], {
+          timeoutSeconds: 1,
+          postgrest: postgrestGateway("sb_secret_local"),
+        }).pipe(Effect.provide(layer), Effect.forkChild({ startImmediately: true }));
+
+        yield* TestClock.adjust("1 seconds");
+        const error = yield* Fiber.join(fiber).pipe(Effect.flip);
+
+        expect(error).toBeInstanceOf(LegacyHealthCheckTimeoutError);
+        expect(error.unhealthy).toEqual([
+          { containerId: "supabase_rest_proj", reason: "unexpected status 503" },
+        ]);
+      }),
+    );
+  });
+
+  describe("Edge Runtime HTTP-HEAD readiness", () => {
+    function edgeRuntimeGateway(secretKey: string): LegacyHealthCheckPostgrestGateway {
+      return {
+        containerId: "supabase_edge_runtime_proj",
+        apiExternalUrl: "http://127.0.0.1:54321",
+        secretKey,
+      };
+    }
+
+    function httpLayer(status: number, expectPath: string) {
+      return Layer.succeed(
+        HttpClient.HttpClient,
+        HttpClient.make((request) => {
+          expect(request.method).toBe("HEAD");
+          expect(request.url).toBe(`http://127.0.0.1:54321${expectPath}`);
+          return Effect.succeed(
+            HttpClientResponse.fromWeb(request, new Response(null, { status })),
+          );
+        }),
+      );
+    }
+
+    it.effect("bypasses the Docker healthcheck and succeeds on a 200 HEAD response", () =>
+      Effect.gen(function* () {
+        const mock = mockHealthSpawner(() => runningHealthy);
+        const layer = httpLayer(200, "/functions/v1/_internal/health");
+
+        const exit = yield* legacyWaitForHealthyServices(
+          mock.spawner,
+          ["supabase_edge_runtime_proj"],
+          {
+            timeoutSeconds: 1,
+            edgeRuntime: edgeRuntimeGateway("sb_secret_local"),
+          },
+        ).pipe(Effect.provide(layer), Effect.exit);
+
+        expect(Exit.isSuccess(exit)).toBe(true);
+        // Never falls back to the Docker healthcheck for Edge Runtime.
+        expect(mock.spawned.some((args) => args[0] === "container" && args[1] === "inspect")).toBe(
+          false,
+        );
+      }),
+    );
+
+    it.effect("retries and eventually times out when Edge Runtime never returns 200", () =>
+      Effect.gen(function* () {
+        const mock = mockHealthSpawner(() => runningHealthy);
+        const layer = httpLayer(503, "/functions/v1/_internal/health");
+
+        const fiber = yield* legacyWaitForHealthyServices(
+          mock.spawner,
+          ["supabase_edge_runtime_proj"],
+          {
+            timeoutSeconds: 1,
+            edgeRuntime: edgeRuntimeGateway("sb_secret_local"),
+          },
+        ).pipe(Effect.provide(layer), Effect.forkChild({ startImmediately: true }));
+
+        yield* TestClock.adjust("1 seconds");
+        const error = yield* Fiber.join(fiber).pipe(Effect.flip);
+
+        expect(error).toBeInstanceOf(LegacyHealthCheckTimeoutError);
+        expect(error.unhealthy).toEqual([
+          { containerId: "supabase_edge_runtime_proj", reason: "unexpected status 503" },
+        ]);
+      }),
+    );
+
+    it.effect(
+      "probes PostgREST and Edge Runtime on their own paths, and every other container via Docker",
+      () =>
+        Effect.gen(function* () {
+          const mock = mockHealthSpawner(() => runningHealthy);
+          const layer = Layer.succeed(
+            HttpClient.HttpClient,
+            HttpClient.make((request) => {
+              const url = new URL(request.url);
+              expect(["/rest-admin/v1/ready", "/functions/v1/_internal/health"]).toContain(
+                url.pathname,
+              );
+              return Effect.succeed(
+                HttpClientResponse.fromWeb(request, new Response(null, { status: 200 })),
+              );
+            }),
+          );
+
+          const exit = yield* legacyWaitForHealthyServices(
+            mock.spawner,
+            ["supabase_rest_proj", "supabase_edge_runtime_proj", "supabase_kong_proj"],
+            {
+              timeoutSeconds: 1,
+              postgrest: {
+                containerId: "supabase_rest_proj",
+                apiExternalUrl: "http://127.0.0.1:54321",
+                secretKey: "sb_secret_local",
+              },
+              edgeRuntime: edgeRuntimeGateway("sb_secret_local"),
+            },
+          ).pipe(Effect.provide(layer), Effect.exit);
+
+          expect(Exit.isSuccess(exit)).toBe(true);
+          expect(
+            mock.spawned.some(
+              (args) =>
+                args[0] === "container" &&
+                args[1] === "inspect" &&
+                args[2] === "supabase_kong_proj",
+            ),
+          ).toBe(true);
+          expect(
+            mock.spawned.some(
+              (args) =>
+                args[0] === "container" &&
+                args[1] === "inspect" &&
+                args[2] === "supabase_rest_proj",
+            ),
+          ).toBe(false);
+          expect(
+            mock.spawned.some(
+              (args) =>
+                args[0] === "container" &&
+                args[1] === "inspect" &&
+                args[2] === "supabase_edge_runtime_proj",
+            ),
+          ).toBe(false);
+        }),
+    );
+  });
+});
diff --git a/apps/cli/src/legacy/commands/start/lib/image-prepull.ts b/apps/cli/src/legacy/commands/start/lib/image-prepull.ts
new file mode 100644
index 0000000000..bf43bd04ee
--- /dev/null
+++ b/apps/cli/src/legacy/commands/start/lib/image-prepull.ts
@@ -0,0 +1,95 @@
+/**
+ * Port of Go's `ensureImagesCached` (`apps/cli-go/internal/start/start.go:225-262`):
+ * guarantees every image `supabase start` needs is resolved/pulled into the
+ * local Docker cache BEFORE any container is created, using the same
+ * multi-registry fallback as the per-container start path
+ * (`legacyMakeDockerImageResolver`).
+ *
+ * Go's caller (`internal/start/start.go:264-291`, `run`) also runs a
+ * best-effort `docker-compose`-based pre-pull first
+ * (`pullImagesUsingCompose`) and treats `ensureImagesCached` as the hard-failing
+ * backstop that catches whatever the compose pre-pull's `IgnoreFailures` step
+ * skipped. This port does not implement docker-compose integration anywhere
+ * (an intentional architecture decision for this port), so
+ * {@link legacyEnsureImagesCached} is the ONLY image pre-pull step here, not a
+ * backstop for a separate best-effort pass — every image must resolve through
+ * this call before any container starts.
+ */
+
+import { Data, Effect, Result } from "effect";
+import type { ChildProcessSpawner } from "effect/unstable/process/ChildProcessSpawner";
+
+import { legacyMakeDockerImageResolver } from "../../../shared/legacy-docker-image-resolve.ts";
+import {
+  LEGACY_SUGGEST_DOCKER_INSTALL,
+  legacyIsDockerDaemonUnreachable,
+} from "../../../shared/legacy-docker-suggest.ts";
+
+type Spawner = ChildProcessSpawner["Service"];
+
+/**
+ * One or more images failed to resolve/pull from every registry candidate.
+ * Mirrors Go's `errors.Join(result...)` (`start.go:257`): the message
+ * aggregates every failed image's own error rather than surfacing only the
+ * first failure, so a caller can see every broken image in one report.
+ */
+export class LegacyImagePrepullError extends Data.TaggedError("LegacyImagePrepullError")<{
+  readonly message: string;
+}> {}
+
+/**
+ * Resolves every image in `images` concurrently (Go's `utils.WaitAll` —
+ * unbounded goroutines) via the shared registry-fallback resolver, and returns
+ * a map from the ORIGINAL image reference to the resolved image URL a caller
+ * must use to reference that image afterward (e.g. as
+ * `LegacyStartContainerSpec.image`) — resolving the same image twice would be
+ * wasteful and could, in theory, land on a different registry candidate on a
+ * second, independent call.
+ *
+ * `images` is deduped here (Go's `seen := map[string]struct{}{}`,
+ * `start.go:238-249`) — callers are not expected to have already deduped their
+ * service image list.
+ */
+export function legacyEnsureImagesCached(
+  spawner: Spawner,
+  images: ReadonlyArray<string>,
+  projectEnvValues?: Readonly<Record<string, string>>,
+): Effect.Effect<ReadonlyMap<string, string>, LegacyImagePrepullError> {
+  const uniqueImages = [...new Set(images)];
+  const resolveImage = legacyMakeDockerImageResolver(spawner, projectEnvValues);
+
+  return Effect.gen(function* () {
+    const results = yield* Effect.all(
+      uniqueImages.map((image) => resolveImage(image).pipe(Effect.result)),
+      { concurrency: "unbounded" },
+    );
+
+    const resolved = new Map<string, string>();
+    const failures: Array<string> = [];
+    for (const [index, image] of uniqueImages.entries()) {
+      const result = results[index];
+      if (result === undefined || Result.isFailure(result)) {
+        failures.push(result === undefined ? `${image}: unknown error` : result.failure.message);
+        continue;
+      }
+      resolved.set(image, result.success);
+    }
+
+    if (failures.length > 0) {
+      // Go sets the install hint once, sequentially, after the concurrent
+      // resolve finishes (`SuggestDockerInstallIfConnectionFailed`,
+      // `start.go:254-259`) rather than from inside the resolver itself, where
+      // concurrent goroutines would race on the shared `CmdSuggestion` global.
+      // There is no such global here, so the hint is appended directly onto
+      // the joined message instead.
+      const hint = failures.some(legacyIsDockerDaemonUnreachable)
+        ? `\n\n${LEGACY_SUGGEST_DOCKER_INSTALL}`
+        : "";
+      return yield* Effect.fail(
+        new LegacyImagePrepullError({ message: `${failures.join("\n")}${hint}` }),
+      );
+    }
+
+    return resolved;
+  });
+}
diff --git a/apps/cli/src/legacy/commands/start/lib/image-prepull.unit.test.ts b/apps/cli/src/legacy/commands/start/lib/image-prepull.unit.test.ts
new file mode 100644
index 0000000000..716eddc854
--- /dev/null
+++ b/apps/cli/src/legacy/commands/start/lib/image-prepull.unit.test.ts
@@ -0,0 +1,185 @@
+import { describe, expect, it } from "@effect/vitest";
+import { Deferred, Effect, Ref, Sink, Stream } from "effect";
+import { ChildProcessSpawner } from "effect/unstable/process";
+
+import { LegacyImagePrepullError, legacyEnsureImagesCached } from "./image-prepull.ts";
+
+/** Matches the standing `mockSpawner` shape in `legacy-docker-lifecycle.unit.test.ts`, generalized to a per-call handler so each argv can respond differently (needed for "some images cached, others not"). */
+function mockSpawner(
+  handler: (args: ReadonlyArray<string>) => { exitCode: number; stdout?: string; stderr?: string },
+) {
+  const encoder = new TextEncoder();
+  const spawned: Array<ReadonlyArray<string>> = [];
+
+  const spawner = ChildProcessSpawner.make((command) =>
+    Effect.gen(function* () {
+      const args = command._tag === "StandardCommand" ? command.args : [];
+      spawned.push(args);
+      const result = handler(args);
+
+      const exitDeferred = yield* Deferred.make<ChildProcessSpawner.ExitCode>();
+      yield* Deferred.succeed(exitDeferred, ChildProcessSpawner.ExitCode(result.exitCode));
+
+      return ChildProcessSpawner.makeHandle({
+        pid: ChildProcessSpawner.ProcessId(1),
+        stdout: Stream.fromIterable(
+          result.stdout !== undefined ? [encoder.encode(result.stdout)] : [],
+        ),
+        stderr: Stream.fromIterable(
+          result.stderr !== undefined ? [encoder.encode(result.stderr)] : [],
+        ),
+        all: Stream.empty,
+        exitCode: Deferred.await(exitDeferred),
+        isRunning: Effect.succeed(false),
+        stdin: Sink.drain,
+        kill: () => Effect.void,
+        unref: Effect.succeed(Effect.void),
+        getInputFd: () => Sink.drain,
+        getOutputFd: () => Stream.empty,
+      });
+    }),
+  );
+
+  return {
+    spawner,
+    get spawned() {
+      return spawned;
+    },
+  };
+}
+
+describe("legacyEnsureImagesCached", () => {
+  it.live("dedupes images before resolving, returning original ref -> resolved URL", () => {
+    const mock = mockSpawner((args) => {
+      if (args[0] === "image" && args[1] === "inspect") {
+        const image = args[2];
+        const cached =
+          image === "public.ecr.aws/supabase/postgres:15" ||
+          image === "public.ecr.aws/supabase/kong:3";
+        return { exitCode: cached ? 0 : 1 };
+      }
+      return { exitCode: 1 };
+    });
+
+    return legacyEnsureImagesCached(mock.spawner, [
+      "supabase/postgres:15",
+      "supabase/kong:3",
+      "supabase/postgres:15",
+    ]).pipe(
+      Effect.map((resolved) => {
+        expect(resolved).toEqual(
+          new Map([
+            ["supabase/postgres:15", "public.ecr.aws/supabase/postgres:15"],
+            ["supabase/kong:3", "public.ecr.aws/supabase/kong:3"],
+          ]),
+        );
+        // One `image inspect` call per UNIQUE image, not one per (duplicated) input entry.
+        const inspectCalls = mock.spawned.filter(
+          (call) => call[0] === "image" && call[1] === "inspect",
+        );
+        expect(inspectCalls).toHaveLength(2);
+      }),
+    );
+  });
+
+  it.live("resolves every image concurrently rather than one at a time", () =>
+    Effect.gen(function* () {
+      const started = yield* Ref.make(0);
+      const bothStarted = yield* Deferred.make<void>();
+
+      const spawner = ChildProcessSpawner.make((command) =>
+        Effect.gen(function* () {
+          const args = command._tag === "StandardCommand" ? command.args : [];
+          if (args[0] === "image" && args[1] === "inspect") {
+            const count = yield* Ref.updateAndGet(started, (n) => n + 1);
+            if (count < 2) {
+              // A sequential (non-concurrent) implementation would never let the
+              // second image's `image inspect` call start until this one
+              // returns, so awaiting here would hang forever — proving
+              // concurrency is what lets this test complete at all.
+              yield* Deferred.await(bothStarted);
+            } else {
+              yield* Deferred.succeed(bothStarted, undefined);
+            }
+          }
+          const exitDeferred = yield* Deferred.make<ChildProcessSpawner.ExitCode>();
+          yield* Deferred.succeed(exitDeferred, ChildProcessSpawner.ExitCode(0));
+          return ChildProcessSpawner.makeHandle({
+            pid: ChildProcessSpawner.ProcessId(1),
+            stdout: Stream.empty,
+            stderr: Stream.empty,
+            all: Stream.empty,
+            exitCode: Deferred.await(exitDeferred),
+            isRunning: Effect.succeed(false),
+            stdin: Sink.drain,
+            kill: () => Effect.void,
+            unref: Effect.succeed(Effect.void),
+            getInputFd: () => Sink.drain,
+            getOutputFd: () => Stream.empty,
+          });
+        }),
+      );
+
+      const resolved = yield* legacyEnsureImagesCached(spawner, ["supabase/a:1", "supabase/b:1"]);
+      expect(resolved.size).toBe(2);
+    }),
+  );
+
+  // Every pull attempt fails, so this drives the real DOCKER_PULL_RETRY_DELAYS_MS
+  // backoff (4s + 8s) to exhaustion across all 3 registry candidates (~36s) —
+  // needs more than Vitest's 5s default.
+  it.live(
+    "aggregates every failed image's message into one combined error",
+    () => {
+      const mock = mockSpawner((args) => {
+        if (args[0] === "image" && args[1] === "inspect") return { exitCode: 1 };
+        if (args[0] === "pull") return { exitCode: 1, stderr: `no such image: ${args[1]}\n` };
+        return { exitCode: 1 };
+      });
+
+      return legacyEnsureImagesCached(mock.spawner, ["supabase/a:1", "supabase/b:1"]).pipe(
+        Effect.flip,
+        Effect.map((error) => {
+          expect(error).toBeInstanceOf(LegacyImagePrepullError);
+          expect(error.message).toContain("supabase/a:1");
+          expect(error.message).toContain("supabase/b:1");
+        }),
+      );
+    },
+    60_000,
+  );
+
+  it.live(
+    "appends the install hint once when a failure indicates the daemon is unreachable",
+    () => {
+      const mock = mockSpawner((args) => {
+        if (args[0] === "image" && args[1] === "inspect") return { exitCode: 1 };
+        if (args[0] === "pull") {
+          return {
+            exitCode: 1,
+            stderr: "Cannot connect to the Docker daemon at unix:///var/run/docker.sock\n",
+          };
+        }
+        return { exitCode: 1 };
+      });
+
+      return legacyEnsureImagesCached(mock.spawner, ["supabase/a:1"]).pipe(
+        Effect.flip,
+        Effect.map((error) => {
+          expect(error.message).toContain("Docker Desktop is a prerequisite for local development");
+        }),
+      );
+    },
+    60_000,
+  );
+
+  it.live("resolves an empty map for an empty image list without spawning anything", () => {
+    const mock = mockSpawner(() => ({ exitCode: 0 }));
+    return legacyEnsureImagesCached(mock.spawner, []).pipe(
+      Effect.map((resolved) => {
+        expect(resolved.size).toBe(0);
+        expect(mock.spawned).toHaveLength(0);
+      }),
+    );
+  });
+});
diff --git a/apps/cli/src/legacy/commands/start/lib/internal-db-connection.ts b/apps/cli/src/legacy/commands/start/lib/internal-db-connection.ts
new file mode 100644
index 0000000000..7f7dd46b06
--- /dev/null
+++ b/apps/cli/src/legacy/commands/start/lib/internal-db-connection.ts
@@ -0,0 +1,56 @@
+/**
+ * The fixed, in-Docker-network Postgres address every `start`-created service
+ * container (Realtime, PostgREST, Storage) reaches Postgres at, ported from
+ * Go's `dbConfig := pgconn.Config{Host: utils.DbId, Port: 5432, User:
+ * "postgres", Password: utils.Config.Db.Password, Database: "postgres"}`
+ * (`apps/cli-go/internal/start/start.go:66-72`, threaded through `run()` as
+ * `dbConfig`).
+ *
+ * This is deliberately NOT the same value as
+ * `LegacyLocalConfigValues.dbUrl` (`legacy-local-config-values.ts`): that
+ * field is `postgresql://postgres:<password>@<hostname>:<host-mapped db.port>/postgres`
+ * — the HOST-facing address `status`/`stop` print for a user's own `psql`
+ * client, reachable through Docker's published port mapping. Every
+ * container-to-container env var in `start.go` instead reaches Postgres via
+ * `utils.DbId` (the `db` container's own Docker name) on its unpublished,
+ * always-5432 internal port — the two never share a value except by
+ * coincidence (`db.port` happening to equal 5432).
+ *
+ * Hoisted here (`start/lib/`, the `start` command family's shared root) per
+ * `apps/cli/CLAUDE.md`'s "Hoist Before You Duplicate" rule: Realtime,
+ * PostgREST, and Storage's own container-spec builders
+ * (`start/services/*.service.ts`) all need this exact host/port/password
+ * derivation.
+ */
+
+/** Go's `dbConfig.Port` literal (`start.go:68`) — always 5432, never the configurable `db.port`. */
+export const LEGACY_START_INTERNAL_DB_PORT = 5432;
+
+/** Go's `dbConfig.Database` literal (`start.go:71`) — always `"postgres"`, never configurable. */
+export const LEGACY_START_INTERNAL_DB_NAME = "postgres";
+
+/**
+ * Extracts `dbConfig.Password` (Go's `utils.Config.Db.Password`, `db.go:88` —
+ * `toml:"-"`, never configurable, always the `"postgres"` literal default,
+ * `pkg/config/config.go:459`) from the already-resolved
+ * `LegacyLocalConfigValues.dbUrl` rather than re-deriving that default a
+ * second time — `dbUrl`'s shape
+ * (`postgresql://postgres:<password>@<hostname>:<port>/postgres`,
+ * `legacyResolveLocalConfigValues`) always embeds the exact same password
+ * value `dbConfig.Password` does, since both are sourced from the same
+ * `config.Db.Password` field.
+ */
+export function legacyStartInternalDbPassword(dbUrl: string): string {
+  return new URL(dbUrl).password;
+}
+
+/**
+ * `<role>:<password>@<dbHost>:5432/postgres` — the shape of every
+ * container-to-container Postgres URI `start.go` builds for a specific role
+ * (PostgREST's `PGRST_DB_URI` as `authenticator`, Storage's `DATABASE_URL` as
+ * `supabase_storage_admin`, Storage's vector-bucket default `VECTOR_DATABASE_URL`
+ * as `postgres` — see `appendStorageVectorEnv`, `start.go:1487-1501`).
+ */
+export function legacyStartInternalDbUrl(role: string, dbHost: string, dbPassword: string): string {
+  return `postgresql://${role}:${dbPassword}@${dbHost}:${LEGACY_START_INTERNAL_DB_PORT}/${LEGACY_START_INTERNAL_DB_NAME}`;
+}
diff --git a/apps/cli/src/legacy/commands/start/lib/internal-db-connection.unit.test.ts b/apps/cli/src/legacy/commands/start/lib/internal-db-connection.unit.test.ts
new file mode 100644
index 0000000000..25f27fdc1d
--- /dev/null
+++ b/apps/cli/src/legacy/commands/start/lib/internal-db-connection.unit.test.ts
@@ -0,0 +1,35 @@
+import { describe, expect, test } from "vitest";
+
+import {
+  LEGACY_START_INTERNAL_DB_NAME,
+  LEGACY_START_INTERNAL_DB_PORT,
+  legacyStartInternalDbPassword,
+  legacyStartInternalDbUrl,
+} from "./internal-db-connection.ts";
+
+describe("legacyStartInternalDbPassword", () => {
+  test("extracts the password component from a resolved dbUrl", () => {
+    expect(
+      legacyStartInternalDbPassword("postgresql://postgres:postgres@127.0.0.1:54322/postgres"),
+    ).toBe("postgres");
+  });
+
+  test("extracts a non-default password", () => {
+    expect(
+      legacyStartInternalDbPassword("postgresql://postgres:super-secret@127.0.0.1:54322/postgres"),
+    ).toBe("super-secret");
+  });
+});
+
+describe("legacyStartInternalDbUrl", () => {
+  test("builds a role-specific internal connection string on the fixed port/database", () => {
+    expect(legacyStartInternalDbUrl("authenticator", "supabase_db_proj", "postgres")).toBe(
+      `postgresql://authenticator:postgres@supabase_db_proj:${LEGACY_START_INTERNAL_DB_PORT}/${LEGACY_START_INTERNAL_DB_NAME}`,
+    );
+  });
+
+  test("port and database name are always the fixed internal values", () => {
+    expect(LEGACY_START_INTERNAL_DB_PORT).toBe(5432);
+    expect(LEGACY_START_INTERNAL_DB_NAME).toBe("postgres");
+  });
+});
diff --git a/apps/cli/src/legacy/commands/start/lib/legacy-env-or-default.ts b/apps/cli/src/legacy/commands/start/lib/legacy-env-or-default.ts
new file mode 100644
index 0000000000..1d1756256b
--- /dev/null
+++ b/apps/cli/src/legacy/commands/start/lib/legacy-env-or-default.ts
@@ -0,0 +1,25 @@
+/**
+ * Go's `envOrDefault(key, def string) string` (`start.go:1466-1471`):
+ * `os.LookupEnv`-if-set-else-default — an env var that is SET but empty is
+ * used verbatim (unlike `legacy-local-config-values.ts`'s `envOverride`,
+ * which treats an empty resolved value as unset). `projectEnvValues` mirrors
+ * that module's own merged (dotenv + ambient shell, ambient-wins) map;
+ * `??` only skips a `null`/`undefined` operand, never an empty string, so
+ * this naturally reproduces `LookupEnv`'s "ok if set, even if empty"
+ * semantics without a separate presence check. No `SUPABASE_` prefix and no
+ * `env(VAR)` indirection — Go's raw `os.LookupEnv` here bypasses the
+ * mapstructure decode-hook chain those only apply to.
+ *
+ * Hoisted here (`start/lib/`, the `start` command family's shared root) per
+ * `apps/cli/CLAUDE.md`'s "Hoist Before You Duplicate" rule: Storage's
+ * vector-bucket env (`services/storage.service.ts`) and Kong's
+ * `KONG_NGINX_WORKER_PROCESSES` (`services/kong.service.ts`) both need this
+ * exact env/dotenv-vs-default derivation.
+ */
+export function legacyEnvOrDefault(
+  key: string,
+  def: string,
+  projectEnvValues: Readonly<Record<string, string>> | undefined,
+): string {
+  return projectEnvValues?.[key] ?? process.env[key] ?? def;
+}
diff --git a/apps/cli/src/legacy/commands/start/lib/legacy-env-or-default.unit.test.ts b/apps/cli/src/legacy/commands/start/lib/legacy-env-or-default.unit.test.ts
new file mode 100644
index 0000000000..44f19d6861
--- /dev/null
+++ b/apps/cli/src/legacy/commands/start/lib/legacy-env-or-default.unit.test.ts
@@ -0,0 +1,21 @@
+import { describe, expect, test } from "vitest";
+
+import { legacyEnvOrDefault } from "./legacy-env-or-default.ts";
+
+describe("legacyEnvOrDefault", () => {
+  test('falls back to the default when unset anywhere (Go\'s "envOrDefault", start.go:1466-1471)', () => {
+    expect(legacyEnvOrDefault("LEGACY_ENV_OR_DEFAULT_UNSET_KEY", "default", undefined)).toBe(
+      "default",
+    );
+  });
+
+  test("prefers a projectEnvValues (dotenv) value over the default", () => {
+    expect(legacyEnvOrDefault("SOME_KEY", "default", { SOME_KEY: "from-dotenv" })).toBe(
+      "from-dotenv",
+    );
+  });
+
+  test("an override that is set but empty is used verbatim, matching os.LookupEnv (not treated as unset)", () => {
+    expect(legacyEnvOrDefault("SOME_KEY", "default", { SOME_KEY: "" })).toBe("");
+  });
+});
diff --git a/apps/cli/src/legacy/commands/start/lib/template-render.ts b/apps/cli/src/legacy/commands/start/lib/template-render.ts
new file mode 100644
index 0000000000..de266f9aa9
--- /dev/null
+++ b/apps/cli/src/legacy/commands/start/lib/template-render.ts
@@ -0,0 +1,131 @@
+/**
+ * Pure renderer for the Go `text/template` sources transcribed under
+ * `../templates/`. Mirrors `apps/cli-go/internal/start/start.go`'s use of
+ * `text/template`: every placeholder is a bare `{{ .FieldName }}` reference
+ * (no pipelines, functions, or control structures), and every one of the
+ * three templates rendered here is executed with `Option("missingkey=error")`
+ * (verified via `grep -n '\.Execute(' apps/cli-go/internal/start/start.go`,
+ * lines 399, 489, 1203) — so a placeholder with no matching field always
+ * throws, never silently renders Go's `<no value>`.
+ *
+ * `custom_nginx.template` is deliberately NOT rendered here: it is not a Go
+ * `text/template` at all (see the comment on
+ * `LEGACY_START_CUSTOM_NGINX_TEMPLATE`) and is injected byte-for-byte, with
+ * its `${{VAR}}` placeholders substituted by Kong itself at container boot.
+ * Callers needing that file should import `LEGACY_START_CUSTOM_NGINX_TEMPLATE`
+ * directly from `../templates/custom_nginx.template.ts`.
+ */
+import { LEGACY_START_KONG_YML_TEMPLATE } from "../templates/kong.yml.ts";
+import { LEGACY_START_POOLER_EXS_TEMPLATE } from "../templates/pooler.exs.ts";
+import { LEGACY_START_VECTOR_YAML_TEMPLATE } from "../templates/vector.yaml.ts";
+
+const GO_TEMPLATE_FIELD_PATTERN = /\{\{\s*\.(\w+)\s*\}\}/g;
+
+/**
+ * Substitutes every `{{ .FieldName }}` occurrence in `template` with the
+ * matching value from `fields`, replicating Go's `text/template` rendered
+ * with `Option("missingkey=error")`: a placeholder referencing a field not
+ * present in `fields` throws instead of rendering `<no value>`.
+ */
+export function legacyRenderGoTemplate(
+  template: string,
+  fields: Readonly<Record<string, string | number>>,
+): string {
+  return template.replace(GO_TEMPLATE_FIELD_PATTERN, (_match, fieldName: string) => {
+    if (!Object.hasOwn(fields, fieldName)) {
+      throw new Error(
+        `legacyRenderGoTemplate: template references undefined field ".${fieldName}" (missingkey=error)`,
+      );
+    }
+    return String(fields[fieldName]);
+  });
+}
+
+export interface LegacyStartKongYmlFields {
+  readonly gotrueId: string;
+  readonly restId: string;
+  readonly realtimeId: string;
+  readonly storageId: string;
+  readonly studioId: string;
+  readonly pgmetaId: string;
+  readonly edgeRuntimeId: string;
+  readonly logflareId: string;
+  readonly poolerId: string;
+  readonly apiHost: string;
+  readonly apiPort: number;
+  readonly bearerToken: string;
+  readonly queryToken: string;
+}
+
+/** Renders `kong.yml` from Go's `kongConfig` struct (`start.go:90-104`). */
+export function legacyRenderStartKongYml(fields: LegacyStartKongYmlFields): string {
+  return legacyRenderGoTemplate(LEGACY_START_KONG_YML_TEMPLATE, {
+    GotrueId: fields.gotrueId,
+    RestId: fields.restId,
+    RealtimeId: fields.realtimeId,
+    StorageId: fields.storageId,
+    StudioId: fields.studioId,
+    PgmetaId: fields.pgmetaId,
+    EdgeRuntimeId: fields.edgeRuntimeId,
+    LogflareId: fields.logflareId,
+    PoolerId: fields.poolerId,
+    ApiHost: fields.apiHost,
+    ApiPort: fields.apiPort,
+    BearerToken: fields.bearerToken,
+    QueryToken: fields.queryToken,
+  });
+}
+
+export interface LegacyStartVectorYamlFields {
+  readonly apiKey: string;
+  readonly vectorId: string;
+  readonly logflareId: string;
+  readonly kongId: string;
+  readonly gotrueId: string;
+  readonly restId: string;
+  readonly realtimeId: string;
+  readonly storageId: string;
+  readonly edgeRuntimeId: string;
+  readonly dbId: string;
+}
+
+/** Renders `vector.yaml` from Go's `vectorConfig` struct (`start.go:118-129`). */
+export function legacyRenderStartVectorYaml(fields: LegacyStartVectorYamlFields): string {
+  return legacyRenderGoTemplate(LEGACY_START_VECTOR_YAML_TEMPLATE, {
+    ApiKey: fields.apiKey,
+    VectorId: fields.vectorId,
+    LogflareId: fields.logflareId,
+    KongId: fields.kongId,
+    GotrueId: fields.gotrueId,
+    RestId: fields.restId,
+    RealtimeId: fields.realtimeId,
+    StorageId: fields.storageId,
+    EdgeRuntimeId: fields.edgeRuntimeId,
+    DbId: fields.dbId,
+  });
+}
+
+export interface LegacyStartPoolerExsFields {
+  readonly dbHost: string;
+  readonly dbPort: number;
+  readonly dbDatabase: string;
+  readonly dbPassword: string;
+  readonly externalId: string;
+  readonly modeType: string;
+  readonly defaultMaxClients: number;
+  readonly defaultPoolSize: number;
+}
+
+/** Renders `pooler.exs` from Go's `poolerTenant` struct (`start.go:144-153`). */
+export function legacyRenderStartPoolerExs(fields: LegacyStartPoolerExsFields): string {
+  return legacyRenderGoTemplate(LEGACY_START_POOLER_EXS_TEMPLATE, {
+    DbHost: fields.dbHost,
+    DbPort: fields.dbPort,
+    DbDatabase: fields.dbDatabase,
+    DbPassword: fields.dbPassword,
+    ExternalId: fields.externalId,
+    ModeType: fields.modeType,
+    DefaultMaxClients: fields.defaultMaxClients,
+    DefaultPoolSize: fields.defaultPoolSize,
+  });
+}
diff --git a/apps/cli/src/legacy/commands/start/lib/template-render.unit.test.ts b/apps/cli/src/legacy/commands/start/lib/template-render.unit.test.ts
new file mode 100644
index 0000000000..ba8c16e78b
--- /dev/null
+++ b/apps/cli/src/legacy/commands/start/lib/template-render.unit.test.ts
@@ -0,0 +1,240 @@
+import { describe, expect, it } from "vitest";
+
+import { LEGACY_START_KONG_YML_TEMPLATE } from "../templates/kong.yml.ts";
+import { LEGACY_START_POOLER_EXS_TEMPLATE } from "../templates/pooler.exs.ts";
+import { LEGACY_START_VECTOR_YAML_TEMPLATE } from "../templates/vector.yaml.ts";
+import {
+  legacyRenderGoTemplate,
+  legacyRenderStartKongYml,
+  legacyRenderStartPoolerExs,
+  legacyRenderStartVectorYaml,
+  type LegacyStartKongYmlFields,
+  type LegacyStartPoolerExsFields,
+  type LegacyStartVectorYamlFields,
+} from "./template-render.ts";
+
+const kongFields: LegacyStartKongYmlFields = {
+  gotrueId: "supabase_auth_test",
+  restId: "supabase_rest_test",
+  realtimeId: "supabase_realtime_test",
+  storageId: "supabase_storage_test",
+  studioId: "supabase_studio_test",
+  pgmetaId: "supabase_pg_meta_test",
+  edgeRuntimeId: "supabase_edge_runtime_test",
+  logflareId: "supabase_analytics_test",
+  poolerId: "supabase_pooler_test",
+  apiHost: "127.0.0.1",
+  apiPort: 54321,
+  bearerToken: "test-bearer-token",
+  queryToken: "test-query-token",
+};
+
+const vectorFields: LegacyStartVectorYamlFields = {
+  apiKey: "test-api-key",
+  vectorId: "supabase_vector_test",
+  logflareId: "supabase_analytics_test",
+  kongId: "supabase_kong_test",
+  gotrueId: "supabase_auth_test",
+  restId: "supabase_rest_test",
+  realtimeId: "supabase_realtime_test",
+  storageId: "supabase_storage_test",
+  edgeRuntimeId: "supabase_edge_runtime_test",
+  dbId: "supabase_db_test",
+};
+
+const poolerFields: LegacyStartPoolerExsFields = {
+  dbHost: "supabase_db_test",
+  dbPort: 6543,
+  dbDatabase: "postgres",
+  dbPassword: "postgres",
+  externalId: "supabase_pooler_test",
+  modeType: "transaction",
+  defaultMaxClients: 100,
+  defaultPoolSize: 20,
+};
+
+describe("legacyRenderGoTemplate", () => {
+  it("substitutes bare {{ .Field }} placeholders", () => {
+    expect(legacyRenderGoTemplate("hello {{ .Name }}", { Name: "world" })).toBe("hello world");
+  });
+
+  it("tolerates any amount of whitespace inside the braces", () => {
+    expect(legacyRenderGoTemplate("{{.Name}} {{  .Name  }} {{ .Name }}", { Name: "x" })).toBe(
+      "x x x",
+    );
+  });
+
+  it("renders numeric fields as base-10 strings with no added quotes or decimals", () => {
+    expect(legacyRenderGoTemplate("port={{ .Port }}", { Port: 6543 })).toBe("port=6543");
+  });
+
+  it("throws when a referenced field is missing (missingkey=error parity)", () => {
+    expect(() => legacyRenderGoTemplate("{{ .Missing }}", {})).toThrow(/\.Missing/);
+  });
+
+  it("does not error on struct fields that exist but are never referenced", () => {
+    expect(legacyRenderGoTemplate("{{ .Used }}", { Used: "a", Unused: "b" })).toBe("a");
+  });
+});
+
+describe("legacyRenderStartKongYml", () => {
+  it("replaces every placeholder with no template syntax or missing-value markers left behind", () => {
+    const rendered = legacyRenderStartKongYml(kongFields);
+    expect(rendered).not.toContain("{{");
+    expect(rendered).not.toContain("}}");
+    expect(rendered).not.toContain("<no value>");
+    expect(rendered).not.toContain("undefined");
+  });
+
+  it("interpolates each service upstream URL from the matching container id", () => {
+    const rendered = legacyRenderStartKongYml(kongFields);
+    expect(rendered).toContain("url: http://supabase_auth_test:9999/verify");
+    expect(rendered).toContain("url: http://supabase_rest_test:3000/");
+    expect(rendered).toContain("url: http://supabase_realtime_test:4000/socket");
+    expect(rendered).toContain("url: http://supabase_storage_test:5000/s3");
+    expect(rendered).toContain("url: http://supabase_edge_runtime_test:8081/");
+    expect(rendered).toContain("url: http://supabase_pg_meta_test:8080/");
+    expect(rendered).toContain("url: http://supabase_analytics_test:4000/");
+    expect(rendered).toContain("url: http://supabase_pooler_test:4000/v2");
+    expect(rendered).toContain("url: http://supabase_studio_test:3000/api/mcp");
+  });
+
+  it("interpolates the bearer and query tokens into every header/querystring reference", () => {
+    const rendered = legacyRenderStartKongYml(kongFields);
+    expect(rendered).toContain('"Authorization: test-bearer-token"');
+    expect(rendered).toContain('"sb-api-key: test-bearer-token"');
+    expect(rendered).toContain('"apikey:test-query-token"');
+    expect(rendered.match(/test-bearer-token/g)).toHaveLength(
+      (LEGACY_START_KONG_YML_TEMPLATE.match(/\{\{ \.BearerToken \}\}/g) ?? []).length,
+    );
+  });
+
+  it("throws referencing the missing Go struct field when a placeholder has no value", () => {
+    const { gotrueId: _gotrueId, ...withoutGotrue } = kongFields;
+    const rawFields: Record<string, string | number> = {
+      RestId: withoutGotrue.restId,
+      RealtimeId: withoutGotrue.realtimeId,
+      StorageId: withoutGotrue.storageId,
+      StudioId: withoutGotrue.studioId,
+      PgmetaId: withoutGotrue.pgmetaId,
+      EdgeRuntimeId: withoutGotrue.edgeRuntimeId,
+      LogflareId: withoutGotrue.logflareId,
+      PoolerId: withoutGotrue.poolerId,
+      ApiHost: withoutGotrue.apiHost,
+      ApiPort: withoutGotrue.apiPort,
+      BearerToken: withoutGotrue.bearerToken,
+      QueryToken: withoutGotrue.queryToken,
+    };
+    expect(() => legacyRenderGoTemplate(LEGACY_START_KONG_YML_TEMPLATE, rawFields)).toThrow(
+      /\.GotrueId/,
+    );
+  });
+});
+
+describe("legacyRenderStartVectorYaml", () => {
+  it("replaces every placeholder with no template syntax or missing-value markers left behind", () => {
+    const rendered = legacyRenderStartVectorYaml(vectorFields);
+    expect(rendered).not.toContain("{{");
+    expect(rendered).not.toContain("}}");
+    expect(rendered).not.toContain("<no value>");
+    expect(rendered).not.toContain("undefined");
+  });
+
+  it("interpolates the vector, router, and logflare sink fields", () => {
+    const rendered = legacyRenderStartVectorYaml(vectorFields);
+    expect(rendered).toContain('- "supabase_vector_test"');
+    expect(rendered).toContain("kong: '.appname == \"supabase_kong_test\"'");
+    expect(rendered).toContain("auth: '.appname == \"supabase_auth_test\"'");
+    expect(rendered).toContain("rest: '.appname == \"supabase_rest_test\"'");
+    expect(rendered).toContain("realtime: '.appname == \"supabase_realtime_test\"'");
+    expect(rendered).toContain("storage: '.appname == \"supabase_storage_test\"'");
+    expect(rendered).toContain("functions: '.appname == \"supabase_edge_runtime_test\"'");
+    expect(rendered).toContain("db: '.appname == \"supabase_db_test\"'");
+    expect(rendered).toContain('x-api-key: "test-api-key"');
+    expect(rendered).toContain(
+      'uri: "http://supabase_analytics_test:4000/api/logs?source_name=gotrue.logs.prod"',
+    );
+  });
+
+  it("throws referencing the missing Go struct field when a placeholder has no value", () => {
+    const { apiKey: _apiKey, ...withoutApiKey } = vectorFields;
+    const rawFields: Record<string, string | number> = {
+      VectorId: withoutApiKey.vectorId,
+      LogflareId: withoutApiKey.logflareId,
+      KongId: withoutApiKey.kongId,
+      GotrueId: withoutApiKey.gotrueId,
+      RestId: withoutApiKey.restId,
+      RealtimeId: withoutApiKey.realtimeId,
+      StorageId: withoutApiKey.storageId,
+      EdgeRuntimeId: withoutApiKey.edgeRuntimeId,
+      DbId: withoutApiKey.dbId,
+    };
+    expect(() => legacyRenderGoTemplate(LEGACY_START_VECTOR_YAML_TEMPLATE, rawFields)).toThrow(
+      /\.ApiKey/,
+    );
+  });
+});
+
+describe("legacyRenderStartPoolerExs", () => {
+  it("renders the exact expected Elixir source", () => {
+    expect(legacyRenderStartPoolerExs(poolerFields)).toBe(
+      `{:ok, _} = Application.ensure_all_started(:supavisor)
+
+{:ok, version} =
+  case Supavisor.Repo.query!("select version()") do
+    %{rows: [[ver]]} -> Supavisor.Helpers.parse_pg_version(ver)
+    _ -> nil
+  end
+
+params = %{
+  "external_id" => "supabase_pooler_test",
+  "db_host" => "supabase_db_test",
+  "db_port" => 6543,
+  "db_database" => "postgres",
+  "require_user" => false,
+  "auth_query" => "SELECT * FROM pgbouncer.get_auth($1)",
+  "default_max_clients" => 100,
+  "default_pool_size" => 20,
+  "default_parameter_status" => %{"server_version" => version},
+  "users" => [%{
+    "db_user" => "pgbouncer",
+    "db_password" => "postgres",
+    "mode_type" => "transaction",
+    "pool_size" => 20,
+    "is_manager" => true
+  }]
+}
+
+if !Supavisor.Tenants.get_tenant_by_external_id(params["external_id"]) do
+  {:ok, _} = Supavisor.Tenants.create_tenant(params)
+end
+`,
+    );
+  });
+
+  it("renders numeric fields as bare Elixir integer literals with no quotes or decimals", () => {
+    const rendered = legacyRenderStartPoolerExs(poolerFields);
+    expect(rendered).toContain('"db_port" => 6543,');
+    expect(rendered).toContain('"default_max_clients" => 100,');
+    expect(rendered).toContain('"default_pool_size" => 20,');
+    expect(rendered).toContain('"pool_size" => 20,');
+    expect(rendered).not.toMatch(/"db_port" => "6543"/);
+    expect(rendered).not.toMatch(/"db_port" => 6543\.0/);
+  });
+
+  it("throws referencing the missing Go struct field when a placeholder has no value", () => {
+    const { dbHost: _dbHost, ...withoutDbHost } = poolerFields;
+    const rawFields: Record<string, string | number> = {
+      DbPort: withoutDbHost.dbPort,
+      DbDatabase: withoutDbHost.dbDatabase,
+      DbPassword: withoutDbHost.dbPassword,
+      ExternalId: withoutDbHost.externalId,
+      ModeType: withoutDbHost.modeType,
+      DefaultMaxClients: withoutDbHost.defaultMaxClients,
+      DefaultPoolSize: withoutDbHost.defaultPoolSize,
+    };
+    expect(() => legacyRenderGoTemplate(LEGACY_START_POOLER_EXS_TEMPLATE, rawFields)).toThrow(
+      /\.DbHost/,
+    );
+  });
+});
diff --git a/apps/cli/src/legacy/commands/start/services/edge-runtime.service.integration.test.ts b/apps/cli/src/legacy/commands/start/services/edge-runtime.service.integration.test.ts
new file mode 100644
index 0000000000..8c996aca65
--- /dev/null
+++ b/apps/cli/src/legacy/commands/start/services/edge-runtime.service.integration.test.ts
@@ -0,0 +1,331 @@
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+
+import { describe, expect, it } from "@effect/vitest";
+import { Deferred, Effect, Exit, Sink, Stream } from "effect";
+import { ChildProcessSpawner } from "effect/unstable/process";
+import { beforeEach } from "vitest";
+
+import { useLegacyTempWorkdir } from "../../../../../tests/helpers/legacy-mocks.ts";
+import { mockOutput } from "../../../../../tests/helpers/mocks.ts";
+import {
+  legacyStartEdgeRuntimeContainer,
+  type LegacyEdgeRuntimeBringUpInput,
+} from "./edge-runtime.service.ts";
+
+/**
+ * A spawner that answers every `docker` invocation
+ * `legacyStartEdgeRuntimeContainer`'s call chain makes
+ * (`ensureDockerNamedVolume`/`ensureDockerNetwork`/the `docker run -d` bring-up
+ * itself) with success, recording every invocation's argv for assertions —
+ * same shape as `health-check.unit.test.ts`'s `mockHealthSpawner`. Secret
+ * values are delivered to the `run -d` call via `--env-file`/a bind-mounted
+ * script, not this spawned process's own environment (see
+ * `edge-runtime.service.ts`'s header for why), so there is nothing to capture
+ * beyond argv. Note `legacyStartEdgeRuntimeContainer` never issues a
+ * `docker exec ... kong reload` — that only happens in `functions serve`'s own
+ * `restartEdgeRuntime`-equivalent wrapper (`shared/functions/serve.ts`'s
+ * `startEdgeRuntime`), not in the shared bring-up core this module calls
+ * directly — see the "does not reload Kong" test below.
+ */
+function mockDockerSpawner() {
+  const calls: Array<{ args: ReadonlyArray<string> }> = [];
+
+  const spawner = ChildProcessSpawner.make((command) =>
+    Effect.gen(function* () {
+      const args = command._tag === "StandardCommand" ? command.args : [];
+      calls.push({ args });
+
+      const exitDeferred = yield* Deferred.make<ChildProcessSpawner.ExitCode>();
+      yield* Deferred.succeed(exitDeferred, ChildProcessSpawner.ExitCode(0));
+      return ChildProcessSpawner.makeHandle({
+        pid: ChildProcessSpawner.ProcessId(1),
+        stdout: Stream.empty,
+        stderr: Stream.empty,
+        all: Stream.empty,
+        exitCode: Deferred.await(exitDeferred),
+        isRunning: Effect.succeed(false),
+        stdin: Sink.drain,
+        kill: () => Effect.void,
+        unref: Effect.succeed(Effect.void),
+        getInputFd: () => Sink.drain,
+        getOutputFd: () => Stream.empty,
+      });
+    }),
+  );
+
+  return {
+    spawner,
+    get calls() {
+      return calls;
+    },
+    get runCall() {
+      return calls.find((call) => call.args[0] === "run" && call.args[1] === "-d");
+    },
+  };
+}
+
+function baseInput(workdir: string): LegacyEdgeRuntimeBringUpInput {
+  return {
+    projectId: "proj",
+    networkId: "supabase_network_proj",
+    image: "registry.example.com/supabase/edge-runtime:v1.74.2",
+    workdir,
+    // `authenticator:postgres@127.0.0.1:54322/postgres` — password "postgres", matching every
+    // other service's `dbUrl` input shape (`LegacyLocalConfigValues.dbUrl`).
+    dbUrl: "postgresql://postgres:postgres@127.0.0.1:54322/postgres",
+    apiPort: 54321,
+    edgeRuntimePolicy: "oneshot",
+    edgeRuntimeInspectorPort: 8083,
+    edgeRuntimeSecrets: {},
+    configDeclaredFunctions: {},
+    configFunctions: {},
+    rawConfigFunctions: {},
+    authArtifacts: {
+      publishableKey: "sb_publishable_local",
+      secretKey: "sb_secret_local",
+      jwtSecret: "super-secret-jwt-token-with-at-least-32-characters-long",
+      anonKey: "anon.jwt.value",
+      serviceRoleKey: "service-role.jwt.value",
+      jwks: '{"keys":[]}',
+    },
+    debug: false,
+    platform: "darwin",
+  };
+}
+
+function envEntries(runCall: {
+  args: ReadonlyArray<string>;
+  env?: Readonly<Record<string, string>>;
+}) {
+  const envFileArgIndex = runCall.args.indexOf("--env-file");
+  const envFilePath = runCall.args[envFileArgIndex + 1];
+  expect(envFilePath).toBeDefined();
+  return readFileSync(envFilePath!, "utf8")
+    .split("\n")
+    .filter((line) => line.length > 0);
+}
+
+describe("legacyStartEdgeRuntimeContainer", () => {
+  const tempWorkdir = useLegacyTempWorkdir("supabase-edge-runtime-service-int-");
+
+  // An empty functions directory — every scenario here has zero declared
+  // functions (`configDeclaredFunctions`/`configFunctions` in `baseInput`),
+  // so nothing under it is ever read; it only needs to exist.
+  beforeEach(() => {
+    mkdirSync(join(tempWorkdir.current, "supabase", "functions"), { recursive: true });
+  });
+
+  it.effect(
+    "sends the real internal db url (db container name, port 5432, config.db.password) — NOT functions serve's `db`-alias default",
+    () =>
+      Effect.gen(function* () {
+        const mock = mockDockerSpawner();
+        const out = mockOutput();
+
+        yield* legacyStartEdgeRuntimeContainer(baseInput(tempWorkdir.current)).pipe(
+          Effect.provideService(ChildProcessSpawner.ChildProcessSpawner, mock.spawner),
+          Effect.provide(out.layer),
+        );
+
+        const entries = envEntries(mock.runCall!);
+        expect(entries).toContain(
+          "SUPABASE_DB_URL=postgresql://postgres:postgres@supabase_db_proj:5432/postgres",
+        );
+      }),
+  );
+
+  it.effect("passes every already-resolved auth artifact through unchanged", () =>
+    Effect.gen(function* () {
+      const mock = mockDockerSpawner();
+      const out = mockOutput();
+
+      yield* legacyStartEdgeRuntimeContainer(baseInput(tempWorkdir.current)).pipe(
+        Effect.provideService(ChildProcessSpawner.ChildProcessSpawner, mock.spawner),
+        Effect.provide(out.layer),
+      );
+
+      const entries = envEntries(mock.runCall!);
+      expect(entries).toContain("SUPABASE_ANON_KEY=anon.jwt.value");
+      expect(entries).toContain("SUPABASE_SERVICE_ROLE_KEY=service-role.jwt.value");
+      expect(entries).toContain(
+        "SUPABASE_INTERNAL_JWT_SECRET=super-secret-jwt-token-with-at-least-32-characters-long",
+      );
+      expect(entries).toContain("SUPABASE_INTERNAL_PUBLISHABLE_KEY=sb_publishable_local");
+      expect(entries).toContain("SUPABASE_INTERNAL_SECRET_KEY=sb_secret_local");
+      expect(entries).toContain('SUPABASE_JWKS={"keys":[]}');
+      expect(entries).toContain("SUPABASE_INTERNAL_HOST_PORT=54321");
+    }),
+  );
+
+  it.effect(
+    "never applies functions serve's own CLI-only overrides (no inspector port, verifyJWT defaults on)",
+    () =>
+      Effect.gen(function* () {
+        const mock = mockDockerSpawner();
+        const out = mockOutput();
+
+        yield* legacyStartEdgeRuntimeContainer(baseInput(tempWorkdir.current)).pipe(
+          Effect.provideService(ChildProcessSpawner.ChildProcessSpawner, mock.spawner),
+          Effect.provide(out.layer),
+        );
+
+        const runCall = mock.runCall!;
+        expect(runCall.args).not.toContain("-p");
+        expect(runCall.args.join(" ")).not.toContain("--inspect");
+      }),
+  );
+
+  it.effect(
+    "sets --workdir and --ulimit nofile=65536:65536, matching Go's WorkingDir/Ulimits container.Config",
+    () =>
+      Effect.gen(function* () {
+        const mock = mockDockerSpawner();
+        const out = mockOutput();
+
+        yield* legacyStartEdgeRuntimeContainer(baseInput(tempWorkdir.current)).pipe(
+          Effect.provideService(ChildProcessSpawner.ChildProcessSpawner, mock.spawner),
+          Effect.provide(out.layer),
+        );
+
+        const runCall = mock.runCall!;
+        const workdirIndex = runCall.args.indexOf("--workdir");
+        expect(workdirIndex).toBeGreaterThanOrEqual(0);
+        expect(runCall.args[workdirIndex + 1]).toBe(tempWorkdir.current);
+        const ulimitIndex = runCall.args.indexOf("--ulimit");
+        expect(runCall.args[ulimitIndex + 1]).toBe("nofile=65536:65536");
+      }),
+  );
+
+  it.effect(
+    "stamps its own com.supabase.cli.workdir label so a later stop from a different cwd can reclaim this container's staged-secret directory",
+    () =>
+      Effect.gen(function* () {
+        const mock = mockDockerSpawner();
+        const out = mockOutput();
+
+        yield* legacyStartEdgeRuntimeContainer(baseInput(tempWorkdir.current)).pipe(
+          Effect.provideService(ChildProcessSpawner.ChildProcessSpawner, mock.spawner),
+          Effect.provide(out.layer),
+        );
+
+        const runCall = mock.runCall!;
+        expect(runCall.args).toContain(`com.supabase.cli.workdir=${tempWorkdir.current}`);
+      }),
+  );
+
+  it.effect(
+    "joins the caller-supplied network id and uses the already-resolved image, unmodified",
+    () =>
+      Effect.gen(function* () {
+        const mock = mockDockerSpawner();
+        const out = mockOutput();
+        const input = {
+          ...baseInput(tempWorkdir.current),
+          networkId: "custom_network_override",
+          image: "registry.example.com/supabase/edge-runtime:v1.99.9",
+        };
+
+        yield* legacyStartEdgeRuntimeContainer(input).pipe(
+          Effect.provideService(ChildProcessSpawner.ChildProcessSpawner, mock.spawner),
+          Effect.provide(out.layer),
+        );
+
+        const runCall = mock.runCall!;
+        const networkIndex = runCall.args.indexOf("--network");
+        expect(runCall.args[networkIndex + 1]).toBe("custom_network_override");
+        expect(runCall.args).toContain("registry.example.com/supabase/edge-runtime:v1.99.9");
+      }),
+  );
+
+  it.effect(
+    "resolves with the started container's id and a cleanup effect left for the caller to run",
+    () =>
+      Effect.gen(function* () {
+        const mock = mockDockerSpawner();
+        const out = mockOutput();
+
+        const started = yield* legacyStartEdgeRuntimeContainer(baseInput(tempWorkdir.current)).pipe(
+          Effect.provideService(ChildProcessSpawner.ChildProcessSpawner, mock.spawner),
+          Effect.provide(out.layer),
+        );
+
+        expect(started.containerId).toBe("supabase_edge_runtime_proj");
+        yield* started.cleanup;
+      }),
+  );
+
+  it.effect(
+    "cleans up a stale staging directory from a previous invocation even when this invocation fails before ever reaching docker run",
+    () =>
+      Effect.gen(function* () {
+        const mock = mockDockerSpawner();
+        const out = mockOutput();
+        const stagingDir = join(
+          tempWorkdir.current,
+          "supabase",
+          ".temp",
+          "start-secrets",
+          "supabase_edge_runtime_proj",
+        );
+        // Simulates a leftover from an earlier invocation (e.g. `functions serve`'s watch-mode
+        // restart loop) that was never reclaimed — `writeDockerEnvFile`'s own header explains why
+        // this path is deterministic/reused rather than a fresh mkdtemp per call.
+        mkdirSync(join(stagingDir, "env"), { recursive: true });
+        writeFileSync(join(stagingDir, "env", "docker.env"), "STALE=1");
+
+        const input = {
+          ...baseInput(tempWorkdir.current),
+          // A multiline secret with a name that fails `validateDockerMultilineEnvNames` (must
+          // match a shell variable name) — this throws before any of THIS invocation's staging
+          // writes happen, proving cleanup covers the whole staging-write window, not just a
+          // failure at (or after) the `docker run` step.
+          edgeRuntimeSecrets: { "1BAD_NAME": "line one\nline two" },
+        };
+
+        const exit = yield* Effect.exit(
+          legacyStartEdgeRuntimeContainer(input).pipe(
+            Effect.provideService(ChildProcessSpawner.ChildProcessSpawner, mock.spawner),
+            Effect.provide(out.layer),
+          ),
+        );
+
+        expect(Exit.isFailure(exit)).toBe(true);
+        expect(existsSync(stagingDir)).toBe(false);
+      }),
+  );
+
+  it.effect(
+    "never reloads Kong — Go's `start` bring-up (`ServeFunctions`) never does, unlike `functions serve`'s own restart wrapper",
+    () =>
+      Effect.gen(function* () {
+        const mock = mockDockerSpawner();
+        const out = mockOutput();
+
+        yield* legacyStartEdgeRuntimeContainer(baseInput(tempWorkdir.current)).pipe(
+          Effect.provideService(ChildProcessSpawner.ChildProcessSpawner, mock.spawner),
+          Effect.provide(out.layer),
+        );
+
+        expect(
+          mock.calls.some((call) => call.args[0] === "exec" && call.args.includes("kong")),
+        ).toBe(false);
+      }),
+  );
+
+  it.effect(
+    "never prints functions serve's own setup banner — Go's start bring-up (ServeFunctions) never does, unlike restartEdgeRuntime",
+    () =>
+      Effect.gen(function* () {
+        const mock = mockDockerSpawner();
+        const out = mockOutput();
+
+        yield* legacyStartEdgeRuntimeContainer(baseInput(tempWorkdir.current)).pipe(
+          Effect.provideService(ChildProcessSpawner.ChildProcessSpawner, mock.spawner),
+          Effect.provide(out.layer),
+        );
+
+        expect(out.stderrText).not.toContain("Setting up Edge Functions runtime...");
+      }),
+  );
+});
diff --git a/apps/cli/src/legacy/commands/start/services/edge-runtime.service.ts b/apps/cli/src/legacy/commands/start/services/edge-runtime.service.ts
new file mode 100644
index 0000000000..08f30eba9f
--- /dev/null
+++ b/apps/cli/src/legacy/commands/start/services/edge-runtime.service.ts
@@ -0,0 +1,205 @@
+/**
+ * Real bring-up for the Edge Runtime container — Go's "Start all functions"
+ * block (`apps/cli-go/internal/start/start.go:1101-1108`):
+ *
+ * ```go
+ * if utils.Config.EdgeRuntime.Enabled && !isContainerExcluded(utils.Config.EdgeRuntime.Image, excluded) {
+ *   dbUrl := fmt.Sprintf("postgresql://%s:%s@%s:%d/%s", dbConfig.User, dbConfig.Password, dbConfig.Host, dbConfig.Port, dbConfig.Database)
+ *   if err := serve.ServeFunctions(ctx, "", nil, "", dbUrl, serve.RuntimeOption{}, fsys); err != nil {
+ *     return err
+ *   }
+ *   started = append(started, utils.EdgeRuntimeId)
+ * }
+ * ```
+ *
+ * Unlike its 12 siblings in this directory, this module does NOT build a
+ * `LegacyStartContainerSpec` for `legacyStartContainer`
+ * (`../lib/container-lifecycle.ts`) to create+start uniformly. That
+ * unification (`docker create`/`docker start`, `-e KEY`-only env with values
+ * supplied via the spawned process's own environment) was evaluated against
+ * what `shared/functions/serve.ts`'s `startEdgeRuntimeContainer` actually
+ * spawns and rejected as NOT a clean mapping:
+ *
+ *   - `docker-create-args.ts`'s own header explicitly excludes `WorkingDir`
+ *     and `Ulimits` from `LegacyStartContainerSpec` ("none of the 13 [other]
+ *     call sites... set them") — Edge Runtime needs BOTH (`--workdir`,
+ *     `--ulimit nofile=65536:65536`), so "mapping cleanly" would mean
+ *     extending the shared spec for a single caller.
+ *   - Every other service's env travels as bare `-e KEY` flags whose values
+ *     come from the spawned `docker create` process's own environment
+ *     (`container-lifecycle.ts`'s `legacyDockerCreateContainer`). Edge
+ *     Runtime instead needs an `--env-file` for ordinary secrets AND a
+ *     separate bind-mounted, `sh`-sourced multiline-env script for any secret
+ *     containing a newline (`docker env-file` is a line-oriented format that
+ *     cannot represent one) — a second env-delivery mechanism the shared spec
+ *     has no concept of.
+ *   - `docker run -d` (one atomic call) vs. `docker create` + `docker start`
+ *     (two calls) is a structural argv difference, not a flag-mapping detail.
+ *
+ * So this module keeps `startEdgeRuntimeContainer`'s direct `docker run -d`
+ * exactly as `functions serve` already spawns it (see that module's own doc
+ * comment), and exposes {@link legacyStartEdgeRuntimeContainer} as a direct
+ * bring-up `Effect` for `start.handler.ts` to call from its own bring-up loop
+ * — NOT a spec for `legacyStartContainer` to create. `start.handler.ts`'s
+ * wiring must special-case Edge Runtime's bring-up call, the same way it
+ * already special-cases Postgres's (also called directly, not through the
+ * generic `buildSpecForService` switch, since it needs its own health-wait
+ * pass before the other services start).
+ *
+ * `SUPABASE_DB_URL` is the one thing that genuinely differs from what
+ * `functions serve` sends: standalone `functions serve` hardcodes the `db`
+ * network alias (`shared/functions/serve.ts`'s `legacyDefaultServeDbUrl`,
+ * matching Go's `restartEdgeRuntime`), but `start`'s own direct call
+ * (`start.go:66-72,1103`) uses the real `dbConfig` — the `db` container's own
+ * sanitized name and `config.db.password` — exactly like the other 12
+ * services' `dbHost`/`dbPassword` derivation
+ * (`../lib/internal-db-connection.ts`). {@link legacyStartEdgeRuntimeContainer}
+ * reproduces that real value, not `functions serve`'s alias-based default.
+ */
+
+import { Effect, Option } from "effect";
+
+import {
+  startEdgeRuntimeContainer,
+  type ServeAuthArtifacts,
+  type ServeEdgeRuntimeContainerConfig,
+} from "../../../../shared/functions/serve.ts";
+import { legacyServiceContainerName } from "../../../shared/legacy-docker-ids.ts";
+import {
+  legacyStartInternalDbPassword,
+  legacyStartInternalDbUrl,
+} from "../lib/internal-db-connection.ts";
+
+export interface LegacyEdgeRuntimeBringUpInput {
+  /** Go's `Config.ProjectId`, already sanitized — see `legacyServiceContainerName`'s callers. */
+  readonly projectId: string;
+  /** `container.HostConfig.NetworkMode`/`network.NetworkingConfig` target — the `--network-id` override or `utils.NetId`. */
+  readonly networkId: string;
+  /** `utils.Config.EdgeRuntime.Image`, already resolved/pulled by the caller (`image-prepull.ts`/`legacyResolveEdgeRuntimeImage`). */
+  readonly image: string;
+  /**
+   * Go's `cwd`/`utils.CurrentDirAbs` for this call — `cliConfig.workdir` in
+   * `start.handler.ts`. Used as `functions serve`'s `projectRoot`/`flagCwd`
+   * (no separate "flag cwd" exists for `start`) and to derive `supabaseDir`
+   * (`<workdir>/supabase`).
+   */
+  readonly workdir: string;
+  /** `LegacyLocalConfigValues.dbUrl` — reused, not recomputed, to derive the internal DB host/password (matches every other service builder's own `dbUrl` input). */
+  readonly dbUrl: string;
+  /** `config.api.port` — `SUPABASE_INTERNAL_HOST_PORT`. */
+  readonly apiPort: number;
+  /** `config.edge_runtime.policy`. */
+  readonly edgeRuntimePolicy: string;
+  /** `config.edge_runtime.inspector_port` — only published when `inspectMode` is set, which `start` never does (Go's `serve.RuntimeOption{}` zero value). */
+  readonly edgeRuntimeInspectorPort: number;
+  /**
+   * `config.edge_runtime.secrets`, already unwrapped/uppercased — build via
+   * `shared/functions/serve.ts`'s exported `toPlainEdgeRuntimeConfig(config.edge_runtime).secrets`
+   * rather than re-deriving the `Redacted`-unwrap/uppercase logic here.
+   */
+  readonly edgeRuntimeSecrets: Readonly<Record<string, string>>;
+  /**
+   * `config.functions`, already unwrapped — build via
+   * `shared/functions/serve.ts`'s exported `toPlainFunctionRecord(config.functions)`.
+   */
+  readonly configDeclaredFunctions: ServeEdgeRuntimeContainerConfig["configDeclaredFunctions"];
+  /**
+   * The functions directory manifest — build via `@supabase/config`'s
+   * `inferFunctionsManifest({ cwd: workdir, config })`, same as
+   * `shared/functions/serve.ts`'s own `resolveServeConfig` does.
+   */
+  readonly configFunctions: ServeEdgeRuntimeContainerConfig["configFunctions"];
+  /**
+   * The raw, pre-schema `[functions.*]` TOML table — build via
+   * `shared/functions/deploy.ts`'s exported `rawFunctionConfigRecord(document)`
+   * against the same raw document `start.handler.ts` already loads (its own
+   * `context.loaded?.document`).
+   */
+  readonly rawConfigFunctions: ServeEdgeRuntimeContainerConfig["rawConfigFunctions"];
+  /**
+   * Every already-resolved secret/key this container needs — `start`'s own
+   * `values.{publishableKey,secretKey,jwtSecret,anonKey,serviceRoleKey}` plus
+   * `jwks` (`legacyResolveLocalJwks`'s result), NOT independently re-resolved
+   * (see this module's header).
+   */
+  readonly authArtifacts: ServeAuthArtifacts;
+  /** The global `--debug` flag. */
+  readonly debug: boolean;
+  /** `RuntimeInfo.platform`/`process.platform` — gates the Linux-only `--add-host host.docker.internal:host-gateway` flag. */
+  readonly platform: NodeJS.Platform;
+}
+
+/**
+ * Bring up the Edge Runtime container for `start`, delegating the entire
+ * `docker run` argv/env assembly to `shared/functions/serve.ts`'s
+ * `startEdgeRuntimeContainer` (already ported for `functions serve`) with
+ * `start`'s own already-resolved config/secrets in place of that command's
+ * independent config-loading pipeline. `start.handler.ts`'s bring-up loop
+ * should call this directly (NOT `legacyStartContainer`) for the Edge Runtime
+ * entry in its service list, gated the same way as every other service on
+ * `config.edge_runtime.enabled && !isContainerExcluded(...)`.
+ *
+ * Resolves to the same `StartedRuntime` shape `functions serve` itself
+ * gets back. `containerId` is what the caller adds to its post-bring-up
+ * health-wait list (pairing it with an `edgeRuntime` gateway on
+ * `LegacyWaitForHealthyServicesOptions`, `../lib/health-check.ts` — the same
+ * shape as the existing `postgrest` gateway). `watchSpecs` is
+ * `functions serve`-only file-watch plumbing and can be ignored here.
+ *
+ * `cleanup` (removing the temp env-file/multiline-env-script/serve-main-
+ * template files this call writes to the host) is intentionally left to the
+ * caller, and the caller must NOT invoke it on a successful bring-up. Unlike
+ * every other `start` service (`legacyStartContainer`'s `restartPolicy:
+ * "unless-stopped"`), Go's own Edge Runtime bring-up (`serve.ServeFunctions`,
+ * `internal/functions/serve/serve.go:218-241`) sets NO Docker restart policy
+ * at all — its lifecycle is deliberately reconciled at the CLI level
+ * (`restartEdgeRuntime`, `serve.go:108-133`), not the Docker daemon level —
+ * so this container's own `docker run` (`shared/functions/serve.ts`)
+ * intentionally omits `--restart` too. Its bind-mounted host paths must
+ * still exist for as long as the container itself can be reattached to
+ * (e.g. a plain `docker start` by the user, or discovery by a later CLI
+ * invocation) — the same reasoning `legacyStageStartSecretFiles`
+ * (`../lib/container-lifecycle.ts`) already applies to every other service's
+ * staged secret files. `startEdgeRuntimeContainer` (`shared/functions/
+ * serve.ts`) already runs `cleanup` internally on any failed or interrupted
+ * bring-up (`Effect.onError`, covering the whole staging-write-through-
+ * `docker run` window, not just a non-zero exit code), so the caller only
+ * needs to leave the returned `cleanup` unused on success.
+ */
+export const legacyStartEdgeRuntimeContainer = Effect.fn("legacy.start.edgeRuntime")(function* (
+  input: LegacyEdgeRuntimeBringUpInput,
+) {
+  return yield* startEdgeRuntimeContainer({
+    config: {
+      projectId: input.projectId,
+      apiPort: input.apiPort,
+      edgeRuntimePolicy: input.edgeRuntimePolicy,
+      edgeRuntimeInspectorPort: input.edgeRuntimeInspectorPort,
+      edgeRuntimeSecrets: input.edgeRuntimeSecrets,
+      configDeclaredFunctions: input.configDeclaredFunctions,
+      configFunctions: input.configFunctions,
+      rawConfigFunctions: input.rawConfigFunctions,
+    },
+    authArtifacts: input.authArtifacts,
+    dbUrl: legacyStartInternalDbUrl(
+      "postgres",
+      legacyServiceContainerName("db", input.projectId),
+      legacyStartInternalDbPassword(input.dbUrl),
+    ),
+    image: input.image,
+    projectRoot: input.workdir,
+    supabaseDir: `${input.workdir}/supabase`,
+    flagCwd: input.workdir,
+    platform: input.platform,
+    debug: input.debug,
+    networkId: input.networkId,
+    // Go's `start.go:1104` passes `serve.RuntimeOption{}` (its zero value)
+    // and an empty `envFilePath`/`nil` `noVerifyJWT`/empty `importMapPath`
+    // — `start` has no CLI flags of its own for any of these.
+    envFile: Option.none(),
+    importMap: Option.none(),
+    noVerifyJwt: Option.none(),
+    inspectMode: undefined,
+    inspectMain: false,
+  });
+});
diff --git a/apps/cli/src/legacy/commands/start/services/gotrue.service.ts b/apps/cli/src/legacy/commands/start/services/gotrue.service.ts
new file mode 100644
index 0000000000..b915a3d2b8
--- /dev/null
+++ b/apps/cli/src/legacy/commands/start/services/gotrue.service.ts
@@ -0,0 +1,699 @@
+/**
+ * GoTrue/Auth env + container spec builder — port of Go's "Start GoTrue"
+ * block (`apps/cli-go/internal/start/start.go:629-851`) and its
+ * `buildGotrueEnv`/`appendGotruePasskeyEnv`/`appendGotrueExternalProviderEnv`/
+ * `formatMapForEnvConfig` helpers (`start.go:1305-1462`). Gated in Go by
+ * `config.auth.enabled` and `!isContainerExcluded(config.auth.image,
+ * excluded)` — see `legacy-service-catalog.ts`'s `gotrue` entry (`excludeKey:
+ * "gotrue"`, gated on `auth.enabled`). Gating and image resolution/pre-pull
+ * are the caller's job (a future `start.handler.ts`); this module only
+ * assembles the env/container spec once the caller has already decided to
+ * start it.
+ *
+ * {@link legacyBuildGotrueEnv} deliberately reproduces the FULL env surface
+ * Go's container actually receives — not just Go's narrowly-named
+ * `buildGotrueEnv()` return value, but every conditional env var the
+ * surrounding "Start GoTrue" block in `run()` appends on top of it (JWT
+ * signing keys, SMTP/Mailpit fallback, mailer template/notification URLs, the
+ * fixed-priority SMS provider switch, CAPTCHA, the six auth hooks, MFA phone
+ * extras, passkey/WebAuthn, external OAuth providers, Web3, OAuth server).
+ * Ported test: `apps/cli-go/internal/start/start_test.go:440 TestBuildGotrueEnv`
+ * (+`:566 TestFormatMapForEnvConfig`), see `gotrue.service.unit.test.ts`.
+ *
+ * `@supabase/config` schema gaps this module works around (all pre-existing,
+ * not introduced here — see each input field's own doc comment):
+ *   - `auth.external_url` has no schema field at all, so the caller reads it
+ *     off the raw TOML document (same pattern as the gaps below) and passes
+ *     the resolved value in as {@link LegacyBuildGotrueEnvInput.authExternalUrl}
+ *     — when set, it wins over the `apiUrl`-derived fallback for
+ *     `API_EXTERNAL_URL`/`GOTRUE_JWT_ISSUER`'s default/the mailer verify URL/
+ *     OAuth redirect-URI fallbacks, matching `auth.GetExternalURL`
+ *     (`pkg/config/auth.go:401-405`). `config/push/config-sync/auth.sync.ts`
+ *     has the identical gap, unresolved — a separate command, not this PR's
+ *     scope.
+ *   - `auth.captcha`/`auth.passkey`/`auth.webauthn`/`auth.email.smtp`'s
+ *     presence-and-default quirks (Go's `Config.Validate`/`Config.Load`
+ *     treat an explicitly-omitted `enabled` differently depending on whether
+ *     the surrounding TOML table is present at all) can't be recovered from
+ *     the decoded `ProjectConfig` alone — the caller resolves these the same
+ *     way `legacy-local-config-values.ts` already does (reading the raw
+ *     TOML document) and passes the final, presence-resolved values in.
+ *   - `auth.external` decodes as a FIXED struct of ~19 known providers, each
+ *     always present with `enabled: false` when unconfigured — but Go's own
+ *     `Auth.External` is a genuine `map[string]provider{}` that only ever
+ *     contains the providers a user's `config.toml` actually mentions, and
+ *     `appendGotrueExternalProviderEnv` iterates that real map unconditionally
+ *     (emitting `_ENABLED=false` etc. for a configured-but-disabled provider,
+ *     never for an unconfigured one). {@link LegacyBuildGotrueEnvInput.externalProviders}
+ *     must therefore already be presence-filtered by the caller (only the
+ *     providers whose `[auth.external.<name>]` section actually exists in
+ *     the TOML document), the same way `legacy-local-config-values.ts`'s
+ *     `validateAuthExternalProviders` already filters for its own purposes.
+ */
+
+import type { ProjectConfig } from "@supabase/config";
+
+import { legacyServiceContainerName } from "../../../shared/legacy-docker-ids.ts";
+import {
+  legacyFormatGoDuration,
+  legacyParseGoDuration,
+} from "../../../shared/legacy-go-duration.ts";
+import { LEGACY_DEFAULT_SIGNING_KEY } from "../../../shared/legacy-go-jwt.ts";
+import type { LegacyResolvedAuthEmail } from "../../../shared/legacy-local-config-values.ts";
+import type { LegacyStartContainerSpec } from "../lib/docker-create-args.ts";
+import {
+  legacyStartInternalDbPassword,
+  legacyStartInternalDbUrl,
+} from "../lib/internal-db-connection.ts";
+
+/** `utils.GotrueAliases[0]` (`apps/cli-go/internal/utils/config.go:38`) — also this service's `containerSuffix` in `LEGACY_SERVICE_CATALOG`. */
+const LEGACY_GOTRUE_CONTAINER_SUFFIX = "auth";
+
+/** GoTrue's fixed listen port (`start.go:825`, `ExposedPorts: nat.PortSet{"9999/tcp": {}}`) — never published to the host. */
+const LEGACY_GOTRUE_PORT = "9999";
+
+/** `nginxTemplateServerPort` (`start.go:115`) — Kong's nginx template server, used for mailer template/subject URLs. */
+const LEGACY_GOTRUE_NGINX_TEMPLATE_SERVER_PORT = 8088;
+
+/** Go's `Config.Inbucket.AdminEmail`/`SenderName` defaults (`pkg/config/config.go:518-520`, `NewConfig()`). */
+const LEGACY_GOTRUE_DEFAULT_INBUCKET_ADMIN_EMAIL = "admin@email.com";
+const LEGACY_GOTRUE_DEFAULT_INBUCKET_SENDER_NAME = "Admin";
+
+/** `supabase_auth_admin` — the fixed Postgres role GoTrue's `GOTRUE_DB_DATABASE_URL` authenticates as (`start.go:1363`). */
+const LEGACY_GOTRUE_DB_ROLE = "supabase_auth_admin";
+
+/**
+ * RFC 7517 JWK fields Go's `JWK` struct round-trips
+ * (`apps/cli-go/pkg/config/auth.go:88-108`), in the exact `json:"..."` field
+ * declaration order — needed so {@link legacyBuildGotrueEnv}'s
+ * `JSON.stringify` reproduces Go's `encoding/json.Marshal` byte-for-byte
+ * (both languages serialize object/struct keys in declaration order).
+ * Structurally near-identical to `legacy/shared/legacy-go-jwt.ts`'s `LegacyJwk`
+ * (the only difference is `key_ops`'s mutable `string[]` there, needed for
+ * assignability into Node's `createPrivateKey`/`JsonWebKey` input — see that
+ * type's own doc comment) and a superset of `shared/auth/jwks.ts`'s `JwkLike`
+ * (which omits the private-key fields `d`/`p`/`q`/`dp`/`dq`/`qi`) — kept local
+ * rather than reusing either shared type, since neither of their existing
+ * callers needs the union of all seventeen fields.
+ */
+export interface LegacyGotrueSigningKey {
+  readonly kty: string;
+  readonly kid?: string;
+  readonly use?: string;
+  readonly key_ops?: ReadonlyArray<string>;
+  readonly alg?: string;
+  readonly ext?: boolean;
+  readonly n?: string;
+  readonly e?: string;
+  readonly d?: string;
+  readonly p?: string;
+  readonly q?: string;
+  readonly dp?: string;
+  readonly dq?: string;
+  readonly qi?: string;
+  readonly crv?: string;
+  readonly x?: string;
+  readonly y?: string;
+}
+
+/**
+ * `Config.Auth.SigningKeys`' default single entry (`pkg/config/config.go:504-515`,
+ * `NewConfig()`) — used whenever `auth.signing_keys_path` is unset. Hoisted to
+ * `legacy-go-jwt.ts` (as `LEGACY_DEFAULT_SIGNING_KEY`) so `legacyResolveLocalJwks`
+ * publishes the exact same key's public form in the JWKS this default signs
+ * with — the two must never disagree on which key is "the" default.
+ */
+const LEGACY_GOTRUE_DEFAULT_SIGNING_KEY: LegacyGotrueSigningKey = LEGACY_DEFAULT_SIGNING_KEY;
+
+/**
+ * Go `PasswordRequirements.ToChar()` (`apps/cli-go/pkg/config/auth.go:34-44`).
+ * Values are the real Management API `password_required_characters` literals
+ * (the `:`-separated character classes are significant), matching the
+ * identical, currently un-hoisted mapping in
+ * `config/push/config-sync/auth.sync.ts`'s `PASSWORD_REQUIREMENTS_TO_CHAR`.
+ */
+const LEGACY_GOTRUE_PASSWORD_REQUIREMENTS_TO_CHAR: Record<string, string> = {
+  letters_digits: "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ:0123456789",
+  lower_upper_letters_digits: "abcdefghijklmnopqrstuvwxyz:ABCDEFGHIJKLMNOPQRSTUVWXYZ:0123456789",
+  lower_upper_letters_digits_symbols:
+    "abcdefghijklmnopqrstuvwxyz:ABCDEFGHIJKLMNOPQRSTUVWXYZ:0123456789:!@#$%^&*()_+-=[]{};'\\\\:\"|<>?,./`~",
+};
+
+function legacyGotruePasswordRequirementsToChar(
+  value: ProjectConfig["auth"]["password_requirements"],
+): string {
+  return LEGACY_GOTRUE_PASSWORD_REQUIREMENTS_TO_CHAR[value] ?? "";
+}
+
+/**
+ * Go's `formatMapForEnvConfig(input map[string]string, output *bytes.Buffer)`
+ * (`start.go:1305-1317`) — the `auth.sms.test_otp` map's `GOTRUE_SMS_TEST_OTP`
+ * wire format: `key:value` pairs, comma-joined, no trailing comma. Go iterates
+ * a `map[string]string` (unordered); this iterates `Object.entries` (insertion
+ * order) instead — order is not part of Go's own contract here (map iteration
+ * order is intentionally randomized in Go), so this doesn't need to match any
+ * particular Go run's order, only the `key:value,...` shape.
+ */
+export function legacyFormatMapForEnvConfig(input: Readonly<Record<string, string>>): string {
+  return Object.entries(input)
+    .map(([key, value]) => `${key}:${value}`)
+    .join(",");
+}
+
+/** One already-resolved, presence-gated `[auth.hook.<type>]` entry — see this module's header for why presence must be pre-resolved by the caller. */
+export interface LegacyGotrueHookInput {
+  readonly enabled: boolean;
+  readonly uri?: string;
+  readonly secrets?: string;
+}
+
+/** `[auth.webauthn]`, present iff the caller's raw TOML document has that section (`Auth.Webauthn != nil` in Go). */
+export interface LegacyGotrueWebauthnInput {
+  readonly rpId: string;
+  readonly rpDisplayName: string;
+  readonly rpOrigins: ReadonlyArray<string>;
+}
+
+/**
+ * One already-presence-filtered `[auth.external.<name>]` entry — see this
+ * module's header for why the caller must filter the whole map by TOML
+ * presence before calling {@link legacyBuildGotrueEnv}.
+ */
+export interface LegacyGotrueExternalProviderInput {
+  readonly enabled: boolean;
+  readonly clientId: string;
+  readonly secret?: string;
+  readonly url: string;
+  readonly redirectUri?: string;
+  readonly skipNonceCheck: boolean;
+  readonly emailOptional: boolean;
+}
+
+export interface LegacyBuildGotrueEnvInput {
+  /** The `db` container's own Docker name (`legacyServiceContainerName("db", projectId)`) — Go's `dbConfig.Host`. */
+  readonly dbHost: string;
+  /** Go's `dbConfig.Password` (`Config.Db.Password`) — see {@link legacyStartInternalDbPassword}. */
+  readonly dbPassword: string;
+
+  /**
+   * `LegacyLocalConfigValues.apiUrl` (Go's resolved `Config.Api.ExternalUrl`)
+   * — reused, not recomputed, so `API_EXTERNAL_URL`/`GOTRUE_JWT_ISSUER`'s
+   * derived fallback (used when {@link authExternalUrl} is unset) never
+   * drifts from what `status` reports.
+   */
+  readonly apiUrl: string;
+  /**
+   * Raw `auth.external_url` (already `SUPABASE_AUTH_EXTERNAL_URL`-overridden
+   * by the caller) — Go's `Config.Auth.ExternalUrl`/`AuthExternalURL()`
+   * (`pkg/config/config.go:543-545`, `auth.go:401-405`): an explicit value
+   * wins outright, otherwise Go derives `TrimRight(apiUrl, "/") + "/auth/v1"`.
+   * `undefined`/empty means unset — fall back to the `apiUrl` derivation.
+   */
+  readonly authExternalUrl?: string;
+  /** `LegacyLocalConfigValues.jwtSecret` — reused, not recomputed. */
+  readonly jwtSecret: string;
+  /** `config.auth.jwt_issuer`, raw (`undefined` when unset — falls back to the derived auth-external URL, matching `Config.Load`'s `if len(c.Auth.JwtIssuer) == 0`). */
+  readonly jwtIssuer: string | undefined;
+  readonly jwtExpiry: ProjectConfig["auth"]["jwt_expiry"];
+  readonly siteUrl: ProjectConfig["auth"]["site_url"];
+  readonly additionalRedirectUrls: ProjectConfig["auth"]["additional_redirect_urls"];
+  readonly enableSignup: ProjectConfig["auth"]["enable_signup"];
+  readonly enableAnonymousSignIns: ProjectConfig["auth"]["enable_anonymous_sign_ins"];
+  readonly enableRefreshTokenRotation: ProjectConfig["auth"]["enable_refresh_token_rotation"];
+  readonly refreshTokenReuseInterval: ProjectConfig["auth"]["refresh_token_reuse_interval"];
+  readonly enableManualLinking: ProjectConfig["auth"]["enable_manual_linking"];
+  readonly minimumPasswordLength: ProjectConfig["auth"]["minimum_password_length"];
+  readonly passwordRequirements: ProjectConfig["auth"]["password_requirements"];
+
+  /**
+   * `Config.Auth.SigningKeys`, already resolved (the `auth.signing_keys_path`
+   * file's contents via `legacy-local-config-values.ts`'s `loadSigningKeys`,
+   * when configured). Defaults to Go's hardcoded single ES256 key
+   * ({@link LEGACY_GOTRUE_DEFAULT_SIGNING_KEY}) when omitted, matching
+   * `NewConfig()`'s default when `signing_keys_path` is unset.
+   */
+  readonly signingKeys?: ReadonlyArray<LegacyGotrueSigningKey>;
+
+  /** `config.auth.email`, everything except `smtp` (kept separate — see {@link smtp}). */
+  readonly email: Omit<LegacyResolvedAuthEmail, "smtp">;
+  /** Kong's own container name (Go's `utils.KongId`) — mailer template/subject URLs route through it. */
+  readonly kongContainerName: string;
+
+  /**
+   * `config.auth.email.smtp`, already presence-and-default resolved by the
+   * caller (Go's `Auth.Email.Smtp != nil && Auth.Email.Smtp.Enabled` —
+   * `@supabase/config` can't reproduce Go's "TOML table present, `enabled`
+   * key absent → true" default on its own, see this module's header).
+   * `undefined` means Go's `Smtp == nil || !Smtp.Enabled` — the mailpit
+   * fallback below applies instead.
+   */
+  readonly smtp?: {
+    readonly host: string;
+    readonly port: number;
+    readonly user: string;
+    readonly pass: string;
+    readonly adminEmail: string;
+    readonly senderName?: string;
+  };
+  /**
+   * `config.local_smtp` (Go's `Inbucket`), present iff `local_smtp.enabled`
+   * AND {@link smtp} is unset (Go's `else if utils.Config.Inbucket.Enabled`).
+   * `adminEmail`/`senderName` default to Go's `NewConfig()` literals when
+   * unset, matching `@supabase/config`'s `inbucket.ts` schema having no
+   * default for either (unlike Go, which always has a literal default even
+   * when the key is absent from `config.toml`).
+   */
+  readonly mailpit?: {
+    readonly containerName: string;
+    readonly adminEmail?: string;
+    readonly senderName?: string;
+  };
+
+  readonly sms: ProjectConfig["auth"]["sms"];
+  readonly sessions: ProjectConfig["auth"]["sessions"];
+  readonly mfa: ProjectConfig["auth"]["mfa"];
+  readonly rateLimit: ProjectConfig["auth"]["rate_limit"];
+  readonly web3: ProjectConfig["auth"]["web3"];
+  readonly oauthServer: ProjectConfig["auth"]["oauth_server"];
+  /**
+   * `config.auth.hook.<type>`, each already presence-resolved AND
+   * env-override-resolved by the caller (`legacyResolveAuthHooks` —
+   * `SUPABASE_AUTH_HOOK_<TYPE>_ENABLED`/`_URI`/`_SECRETS`).
+   */
+  readonly hooks: {
+    readonly mfaVerificationAttempt: LegacyGotrueHookInput;
+    readonly passwordVerificationAttempt: LegacyGotrueHookInput;
+    readonly customAccessToken: LegacyGotrueHookInput;
+    readonly sendSms: LegacyGotrueHookInput;
+    readonly sendEmail: LegacyGotrueHookInput;
+    readonly beforeUserCreated: LegacyGotrueHookInput;
+  };
+
+  /**
+   * `config.auth.captcha`, already presence-resolved AND env-override-resolved
+   * by the caller (`legacyResolveAuthCaptcha` — `SUPABASE_AUTH_CAPTCHA_ENABLED`/
+   * `_PROVIDER`/`_SECRET`, `secret` decrypted like every other `Secret`-typed
+   * field). `@supabase/config`'s `withDecodingDefaultKey` fills in `{enabled:
+   * false}` even when `[auth.captcha]` is absent — see this module's header.
+   * `undefined` means `Auth.Captcha == nil` in Go.
+   */
+  readonly captcha?: {
+    readonly enabled: boolean;
+    readonly provider?: string;
+    readonly secret?: string;
+  };
+
+  /** `[auth.passkey].enabled`, `undefined` iff the section is absent — see this module's header (not in `@supabase/config`'s schema at all). */
+  readonly passkeyEnabled?: boolean;
+  /** `[auth.webauthn]`, `undefined` iff the section is absent — independent of {@link passkeyEnabled} (Go checks both pointers separately). */
+  readonly webauthn?: LegacyGotrueWebauthnInput;
+
+  /** Already presence-filtered by the caller — see this module's header. */
+  readonly externalProviders: Readonly<Record<string, LegacyGotrueExternalProviderInput>>;
+}
+
+function legacyTrimTrailingSlashes(value: string): string {
+  return value.replace(/\/+$/, "");
+}
+
+/**
+ * Port of Go's `appendGotruePasskeyEnv` (`start.go:1427-1440`). Two
+ * INDEPENDENT presence gates (`Auth.Passkey != nil`, `Auth.Webauthn != nil`)
+ * — Go's `Config.Validate` requires `Auth.Webauthn` whenever
+ * `Auth.Passkey.Enabled`, but this function doesn't assume that invariant,
+ * matching Go's own un-assuming implementation.
+ */
+function legacyAppendGotruePasskeyEnv(
+  env: Record<string, string>,
+  passkeyEnabled: boolean | undefined,
+  webauthn: LegacyGotrueWebauthnInput | undefined,
+): void {
+  if (passkeyEnabled !== undefined) {
+    env["GOTRUE_PASSKEY_ENABLED"] = String(passkeyEnabled);
+  }
+  if (webauthn !== undefined) {
+    env["GOTRUE_WEBAUTHN_RP_ID"] = webauthn.rpId;
+    env["GOTRUE_WEBAUTHN_RP_DISPLAY_NAME"] = webauthn.rpDisplayName;
+    env["GOTRUE_WEBAUTHN_RP_ORIGINS"] = webauthn.rpOrigins.join(",");
+  }
+}
+
+/**
+ * Port of Go's `appendGotrueExternalProviderEnv` (`start.go:1442-1462`).
+ * Iterates `providers` unconditionally (every entry, enabled or not) — Go's
+ * loop has no `if config.Enabled` gate at all, only the trailing `URL` field
+ * is conditional. See this module's header for why `providers` must already
+ * be presence-filtered by the caller.
+ */
+function legacyAppendGotrueExternalProviderEnv(
+  env: Record<string, string>,
+  providers: Readonly<Record<string, LegacyGotrueExternalProviderInput>>,
+  jwtIssuer: string,
+): void {
+  for (const [name, provider] of Object.entries(providers)) {
+    const upper = name.toUpperCase();
+    const redirectUri =
+      provider.redirectUri !== undefined && provider.redirectUri.length > 0
+        ? provider.redirectUri
+        : `${jwtIssuer}/callback`;
+    env[`GOTRUE_EXTERNAL_${upper}_ENABLED`] = String(provider.enabled);
+    env[`GOTRUE_EXTERNAL_${upper}_CLIENT_ID`] = provider.clientId;
+    env[`GOTRUE_EXTERNAL_${upper}_SECRET`] = provider.secret ?? "";
+    env[`GOTRUE_EXTERNAL_${upper}_SKIP_NONCE_CHECK`] = String(provider.skipNonceCheck);
+    env[`GOTRUE_EXTERNAL_${upper}_EMAIL_OPTIONAL`] = String(provider.emailOptional);
+    env[`GOTRUE_EXTERNAL_${upper}_REDIRECT_URI`] = redirectUri;
+    if (provider.url.length > 0) {
+      env[`GOTRUE_EXTERNAL_${upper}_URL`] = provider.url;
+    }
+  }
+}
+
+/**
+ * `json.Marshal`-equivalent for one signing key: builds a plain object with
+ * keys in Go's `JWK` struct declaration order, omitting every field Go's
+ * `omitempty` would drop (an absent/`undefined` field, or an empty string —
+ * `Extractable`/`KeyOps` are pointer/slice-typed in Go, so only `undefined`,
+ * not a falsy value, is dropped for those two). `JSON.stringify` then
+ * serializes in that same insertion order, matching `encoding/json.Marshal`
+ * byte-for-byte.
+ */
+function legacyOrderGotrueSigningKey(key: LegacyGotrueSigningKey): Record<string, unknown> {
+  const ordered: Record<string, unknown> = { kty: key.kty };
+  if (key.kid !== undefined && key.kid.length > 0) ordered["kid"] = key.kid;
+  if (key.use !== undefined && key.use.length > 0) ordered["use"] = key.use;
+  if (key.key_ops !== undefined) ordered["key_ops"] = key.key_ops;
+  if (key.alg !== undefined && key.alg.length > 0) ordered["alg"] = key.alg;
+  if (key.ext !== undefined) ordered["ext"] = key.ext;
+  if (key.n !== undefined && key.n.length > 0) ordered["n"] = key.n;
+  if (key.e !== undefined && key.e.length > 0) ordered["e"] = key.e;
+  if (key.d !== undefined && key.d.length > 0) ordered["d"] = key.d;
+  if (key.p !== undefined && key.p.length > 0) ordered["p"] = key.p;
+  if (key.q !== undefined && key.q.length > 0) ordered["q"] = key.q;
+  if (key.dp !== undefined && key.dp.length > 0) ordered["dp"] = key.dp;
+  if (key.dq !== undefined && key.dq.length > 0) ordered["dq"] = key.dq;
+  if (key.qi !== undefined && key.qi.length > 0) ordered["qi"] = key.qi;
+  if (key.crv !== undefined && key.crv.length > 0) ordered["crv"] = key.crv;
+  if (key.x !== undefined && key.x.length > 0) ordered["x"] = key.x;
+  if (key.y !== undefined && key.y.length > 0) ordered["y"] = key.y;
+  return ordered;
+}
+
+/** `filepath.Ext` (Go stdlib) — the last `.`-prefixed suffix of the final path segment, or `""` if there is none. */
+function legacyFileExt(path: string): string {
+  const base = path.slice(Math.max(path.lastIndexOf("/"), path.lastIndexOf("\\")) + 1);
+  const dot = base.lastIndexOf(".");
+  return dot <= 0 ? "" : base.slice(dot);
+}
+
+/**
+ * Pure GoTrue container env builder — port of Go's `buildGotrueEnv` PLUS
+ * every conditional env var the surrounding "Start GoTrue" block in `run()`
+ * appends on top of it (`start.go:629-819`). See this module's header for the
+ * full rationale and the `@supabase/config` schema gaps this input type works
+ * around. No Effect, no I/O — every field is a plain, already-resolved value.
+ */
+export function legacyBuildGotrueEnv(input: LegacyBuildGotrueEnvInput): Record<string, string> {
+  const authExternalUrl =
+    input.authExternalUrl !== undefined && input.authExternalUrl.length > 0
+      ? input.authExternalUrl
+      : `${legacyTrimTrailingSlashes(input.apiUrl)}/auth/v1`;
+  const jwtIssuer =
+    input.jwtIssuer !== undefined && input.jwtIssuer.length > 0 ? input.jwtIssuer : authExternalUrl;
+  const mailerVerifyUrl = `${legacyTrimTrailingSlashes(authExternalUrl)}/verify`;
+  const testOtp =
+    input.sms.test_otp !== undefined ? legacyFormatMapForEnvConfig(input.sms.test_otp) : "";
+
+  const env: Record<string, string> = {
+    API_EXTERNAL_URL: authExternalUrl,
+
+    GOTRUE_API_HOST: "0.0.0.0",
+    GOTRUE_API_PORT: LEGACY_GOTRUE_PORT,
+
+    GOTRUE_DB_DRIVER: "postgres",
+    GOTRUE_DB_DATABASE_URL: legacyStartInternalDbUrl(
+      LEGACY_GOTRUE_DB_ROLE,
+      input.dbHost,
+      input.dbPassword,
+    ),
+
+    GOTRUE_SITE_URL: input.siteUrl,
+    GOTRUE_URI_ALLOW_LIST: input.additionalRedirectUrls.join(","),
+    GOTRUE_DISABLE_SIGNUP: String(!input.enableSignup),
+
+    GOTRUE_JWT_ADMIN_ROLES: "service_role",
+    GOTRUE_JWT_AUD: "authenticated",
+    GOTRUE_JWT_DEFAULT_GROUP_NAME: "authenticated",
+    GOTRUE_JWT_EXP: String(input.jwtExpiry),
+    GOTRUE_JWT_SECRET: input.jwtSecret,
+    GOTRUE_JWT_ISSUER: jwtIssuer,
+
+    GOTRUE_EXTERNAL_EMAIL_ENABLED: String(input.email.enable_signup),
+    GOTRUE_MAILER_SECURE_EMAIL_CHANGE_ENABLED: String(input.email.double_confirm_changes),
+    GOTRUE_MAILER_AUTOCONFIRM: String(!input.email.enable_confirmations),
+    GOTRUE_MAILER_OTP_LENGTH: String(input.email.otp_length),
+    GOTRUE_MAILER_OTP_EXP: String(input.email.otp_expiry),
+    GOTRUE_MAILER_TEMPLATE_RELOADING_ENABLED: "true",
+
+    GOTRUE_EXTERNAL_ANONYMOUS_USERS_ENABLED: String(input.enableAnonymousSignIns),
+
+    GOTRUE_SMTP_MAX_FREQUENCY: legacyFormatGoDuration(
+      legacyParseGoDuration(input.email.max_frequency),
+    ),
+
+    GOTRUE_MAILER_URLPATHS_INVITE: mailerVerifyUrl,
+    GOTRUE_MAILER_URLPATHS_CONFIRMATION: mailerVerifyUrl,
+    GOTRUE_MAILER_URLPATHS_RECOVERY: mailerVerifyUrl,
+    GOTRUE_MAILER_URLPATHS_EMAIL_CHANGE: mailerVerifyUrl,
+    GOTRUE_RATE_LIMIT_EMAIL_SENT: "360000",
+
+    GOTRUE_EXTERNAL_PHONE_ENABLED: String(input.sms.enable_signup),
+    GOTRUE_SMS_AUTOCONFIRM: String(!input.sms.enable_confirmations),
+    GOTRUE_SMS_MAX_FREQUENCY: legacyFormatGoDuration(
+      legacyParseGoDuration(input.sms.max_frequency),
+    ),
+    GOTRUE_SMS_OTP_EXP: "6000",
+    GOTRUE_SMS_OTP_LENGTH: "6",
+    GOTRUE_SMS_TEMPLATE: input.sms.template,
+    GOTRUE_SMS_TEST_OTP: testOtp,
+
+    GOTRUE_PASSWORD_MIN_LENGTH: String(input.minimumPasswordLength),
+    GOTRUE_PASSWORD_REQUIRED_CHARACTERS: legacyGotruePasswordRequirementsToChar(
+      input.passwordRequirements,
+    ),
+    GOTRUE_SECURITY_REFRESH_TOKEN_ROTATION_ENABLED: String(input.enableRefreshTokenRotation),
+    GOTRUE_SECURITY_REFRESH_TOKEN_REUSE_INTERVAL: String(input.refreshTokenReuseInterval),
+    GOTRUE_SECURITY_MANUAL_LINKING_ENABLED: String(input.enableManualLinking),
+    GOTRUE_SECURITY_UPDATE_PASSWORD_REQUIRE_REAUTHENTICATION: String(
+      input.email.secure_password_change,
+    ),
+    GOTRUE_MFA_PHONE_ENROLL_ENABLED: String(input.mfa.phone.enroll_enabled),
+    GOTRUE_MFA_PHONE_VERIFY_ENABLED: String(input.mfa.phone.verify_enabled),
+    GOTRUE_MFA_TOTP_ENROLL_ENABLED: String(input.mfa.totp.enroll_enabled),
+    GOTRUE_MFA_TOTP_VERIFY_ENABLED: String(input.mfa.totp.verify_enabled),
+    GOTRUE_MFA_WEB_AUTHN_ENROLL_ENABLED: String(input.mfa.web_authn.enroll_enabled),
+    GOTRUE_MFA_WEB_AUTHN_VERIFY_ENABLED: String(input.mfa.web_authn.verify_enabled),
+    GOTRUE_MFA_MAX_ENROLLED_FACTORS: String(input.mfa.max_enrolled_factors),
+
+    GOTRUE_RATE_LIMIT_ANONYMOUS_USERS: String(input.rateLimit.anonymous_users),
+    GOTRUE_RATE_LIMIT_TOKEN_REFRESH: String(input.rateLimit.token_refresh),
+    GOTRUE_RATE_LIMIT_OTP: String(input.rateLimit.sign_in_sign_ups),
+    GOTRUE_RATE_LIMIT_VERIFY: String(input.rateLimit.token_verifications),
+    GOTRUE_RATE_LIMIT_SMS_SENT: String(input.rateLimit.sms_sent),
+    GOTRUE_RATE_LIMIT_WEB3: String(input.rateLimit.web3),
+  };
+
+  // JWT signing keys (start.go:634-640) — `json.Marshal` never fails for this
+  // shape, so Go's `if err == nil` guard is effectively unconditional here.
+  const signingKeys = input.signingKeys ?? [LEGACY_GOTRUE_DEFAULT_SIGNING_KEY];
+  env["GOTRUE_JWT_KEYS"] = JSON.stringify(signingKeys.map(legacyOrderGotrueSigningKey));
+  // TODO: deprecate HS256 when it's no longer supported.
+  // TODO: remove VALIDMETHODS after a while to avoid breaking changes.
+  env["GOTRUE_JWT_VALIDMETHODS"] = "HS256,RS256,ES256";
+  env["GOTRUE_JWT_VALID_METHODS"] = "HS256,RS256,ES256";
+
+  // SMTP, else Mailpit fallback (start.go:642-659).
+  if (input.smtp !== undefined) {
+    env["GOTRUE_RATE_LIMIT_EMAIL_SENT"] = String(input.rateLimit.email_sent);
+    env["GOTRUE_SMTP_HOST"] = input.smtp.host;
+    env["GOTRUE_SMTP_PORT"] = String(input.smtp.port);
+    env["GOTRUE_SMTP_USER"] = input.smtp.user;
+    env["GOTRUE_SMTP_PASS"] = input.smtp.pass;
+    env["GOTRUE_SMTP_ADMIN_EMAIL"] = input.smtp.adminEmail;
+    env["GOTRUE_SMTP_SENDER_NAME"] = input.smtp.senderName ?? "";
+  } else if (input.mailpit !== undefined) {
+    env["GOTRUE_SMTP_HOST"] = input.mailpit.containerName;
+    env["GOTRUE_SMTP_PORT"] = "1025";
+    env["GOTRUE_SMTP_ADMIN_EMAIL"] =
+      input.mailpit.adminEmail ?? LEGACY_GOTRUE_DEFAULT_INBUCKET_ADMIN_EMAIL;
+    env["GOTRUE_SMTP_SENDER_NAME"] =
+      input.mailpit.senderName ?? LEGACY_GOTRUE_DEFAULT_INBUCKET_SENDER_NAME;
+  }
+
+  // Sessions (start.go:661-666) — only emitted when the parsed duration is
+  // strictly positive, matching Go's `> 0` guard on the zero `time.Duration`.
+  if (input.sessions?.timebox !== undefined) {
+    const nanoseconds = legacyParseGoDuration(input.sessions.timebox);
+    if (nanoseconds > 0) {
+      env["GOTRUE_SESSIONS_TIMEBOX"] = legacyFormatGoDuration(nanoseconds);
+    }
+  }
+  if (input.sessions?.inactivity_timeout !== undefined) {
+    const nanoseconds = legacyParseGoDuration(input.sessions.inactivity_timeout);
+    if (nanoseconds > 0) {
+      env["GOTRUE_SESSIONS_INACTIVITY_TIMEOUT"] = legacyFormatGoDuration(nanoseconds);
+    }
+  }
+
+  // Mailer template/notification URLs and subjects (start.go:668-694).
+  // `subject !== undefined` matches Go's `subject *string; if subject != nil` exactly: the
+  // caller (`legacyResolveAuthEmail`) has already recovered the "explicit empty string" vs
+  // "absent" distinction from the raw document, so `undefined` here means Go's nil (omit the
+  // env var entirely) and `""` means an explicit blank subject (still emit it).
+  const addMailerEnvVars = (id: string, contentPath: string, subject: string | undefined): void => {
+    if (contentPath.length > 0) {
+      env[`GOTRUE_MAILER_TEMPLATES_${id.toUpperCase()}`] =
+        `http://${input.kongContainerName}:${LEGACY_GOTRUE_NGINX_TEMPLATE_SERVER_PORT}/email/${id}${legacyFileExt(contentPath)}`;
+    }
+    if (subject !== undefined) {
+      env[`GOTRUE_MAILER_SUBJECTS_${id.toUpperCase()}`] = subject;
+    }
+  };
+  for (const [id, template] of Object.entries(input.email.template)) {
+    addMailerEnvVars(id, template.content_path, template.subject);
+  }
+  for (const [id, notification] of Object.entries(input.email.notification)) {
+    if (notification.enabled) {
+      env[`GOTRUE_MAILER_NOTIFICATIONS_${id.toUpperCase()}_ENABLED`] = "true";
+      addMailerEnvVars(`${id}_notification`, notification.content_path, notification.subject);
+    }
+  }
+
+  // SMS provider switch (start.go:696-735) — first enabled provider wins, in
+  // Go's fixed priority order; a later enabled-but-lower-priority provider is
+  // never inspected.
+  if (input.sms.twilio.enabled) {
+    env["GOTRUE_SMS_PROVIDER"] = "twilio";
+    env["GOTRUE_SMS_TWILIO_ACCOUNT_SID"] = input.sms.twilio.account_sid;
+    env["GOTRUE_SMS_TWILIO_AUTH_TOKEN"] = input.sms.twilio.auth_token ?? "";
+    env["GOTRUE_SMS_TWILIO_MESSAGE_SERVICE_SID"] = input.sms.twilio.message_service_sid;
+  } else if (input.sms.twilio_verify.enabled) {
+    env["GOTRUE_SMS_PROVIDER"] = "twilio_verify";
+    env["GOTRUE_SMS_TWILIO_VERIFY_ACCOUNT_SID"] = input.sms.twilio_verify.account_sid ?? "";
+    env["GOTRUE_SMS_TWILIO_VERIFY_AUTH_TOKEN"] = input.sms.twilio_verify.auth_token ?? "";
+    env["GOTRUE_SMS_TWILIO_VERIFY_MESSAGE_SERVICE_SID"] =
+      input.sms.twilio_verify.message_service_sid ?? "";
+  } else if (input.sms.messagebird.enabled) {
+    env["GOTRUE_SMS_PROVIDER"] = "messagebird";
+    env["GOTRUE_SMS_MESSAGEBIRD_ACCESS_KEY"] = input.sms.messagebird.access_key ?? "";
+    env["GOTRUE_SMS_MESSAGEBIRD_ORIGINATOR"] = input.sms.messagebird.originator ?? "";
+  } else if (input.sms.textlocal.enabled) {
+    env["GOTRUE_SMS_PROVIDER"] = "textlocal";
+    env["GOTRUE_SMS_TEXTLOCAL_API_KEY"] = input.sms.textlocal.api_key ?? "";
+    env["GOTRUE_SMS_TEXTLOCAL_SENDER"] = input.sms.textlocal.sender ?? "";
+  } else if (input.sms.vonage.enabled) {
+    env["GOTRUE_SMS_PROVIDER"] = "vonage";
+    env["GOTRUE_SMS_VONAGE_API_KEY"] = input.sms.vonage.api_key ?? "";
+    env["GOTRUE_SMS_VONAGE_API_SECRET"] = input.sms.vonage.api_secret ?? "";
+    env["GOTRUE_SMS_VONAGE_FROM"] = input.sms.vonage.from ?? "";
+  }
+
+  // CAPTCHA (start.go:737-744).
+  if (input.captcha !== undefined) {
+    env["GOTRUE_SECURITY_CAPTCHA_ENABLED"] = String(input.captcha.enabled);
+    env["GOTRUE_SECURITY_CAPTCHA_PROVIDER"] = input.captcha.provider ?? "";
+    env["GOTRUE_SECURITY_CAPTCHA_SECRET"] = input.captcha.secret ?? "";
+  }
+
+  // Auth hooks (start.go:746-793) — each independently gated on its own `enabled`.
+  const appendHookEnv = (envPrefix: string, hook: LegacyGotrueHookInput): void => {
+    if (!hook.enabled) return;
+    env[`GOTRUE_HOOK_${envPrefix}_ENABLED`] = "true";
+    env[`GOTRUE_HOOK_${envPrefix}_URI`] = hook.uri ?? "";
+    env[`GOTRUE_HOOK_${envPrefix}_SECRETS`] = hook.secrets ?? "";
+  };
+  appendHookEnv("MFA_VERIFICATION_ATTEMPT", input.hooks.mfaVerificationAttempt);
+  appendHookEnv("PASSWORD_VERIFICATION_ATTEMPT", input.hooks.passwordVerificationAttempt);
+  appendHookEnv("CUSTOM_ACCESS_TOKEN", input.hooks.customAccessToken);
+  appendHookEnv("SEND_SMS", input.hooks.sendSms);
+  appendHookEnv("SEND_EMAIL", input.hooks.sendEmail);
+  appendHookEnv("BEFORE_USER_CREATED", input.hooks.beforeUserCreated);
+
+  // MFA phone extras (start.go:795-802) — only when phone MFA is reachable at all.
+  if (input.mfa.phone.enroll_enabled || input.mfa.phone.verify_enabled) {
+    env["GOTRUE_MFA_PHONE_TEMPLATE"] = input.mfa.phone.template;
+    env["GOTRUE_MFA_PHONE_OTP_LENGTH"] = String(input.mfa.phone.otp_length);
+    env["GOTRUE_MFA_PHONE_MAX_FREQUENCY"] = legacyFormatGoDuration(
+      legacyParseGoDuration(input.mfa.phone.max_frequency),
+    );
+  }
+
+  // Passkey/WebAuthn, then external OAuth providers (start.go:804-805).
+  legacyAppendGotruePasskeyEnv(env, input.passkeyEnabled, input.webauthn);
+  legacyAppendGotrueExternalProviderEnv(env, input.externalProviders, jwtIssuer);
+
+  // Web3 (start.go:806-809) — always emitted, unconditionally.
+  env["GOTRUE_EXTERNAL_WEB3_SOLANA_ENABLED"] = String(input.web3.solana.enabled);
+  env["GOTRUE_EXTERNAL_WEB3_ETHEREUM_ENABLED"] = String(input.web3.ethereum.enabled);
+
+  // OAuth server configuration (start.go:811-818).
+  if (input.oauthServer.enabled) {
+    env["GOTRUE_OAUTH_SERVER_ENABLED"] = String(input.oauthServer.enabled);
+    env["GOTRUE_OAUTH_SERVER_AUTHORIZATION_PATH"] = input.oauthServer.authorization_url_path;
+    env["GOTRUE_OAUTH_SERVER_ALLOW_DYNAMIC_REGISTRATION"] = String(
+      input.oauthServer.allow_dynamic_registration,
+    );
+  }
+
+  return env;
+}
+
+export interface LegacyGotrueContainerSpecInput {
+  /** `container.Config.Image` — the already-resolved `config.auth.image`. Not part of the decoded `@supabase/config` schema (Go's own `Auth.Image` field is `toml:"-"`); resolution is the caller's responsibility. */
+  readonly image: string;
+  /** Go's `Config.ProjectId`, used to derive `utils.GotrueId`/the `db` container's own name via {@link legacyServiceContainerName}. */
+  readonly projectId: string;
+  /** `container.HostConfig.NetworkMode`'s target — resolved once per `start` run, not per-container. */
+  readonly networkId: string;
+  /** `LegacyLocalConfigValues.dbUrl` — reused, not recomputed, to derive the internal DB password (see {@link legacyStartInternalDbPassword}). */
+  readonly dbUrl: string;
+  /** Every value {@link legacyBuildGotrueEnv} needs, minus the two this builder derives itself (`dbHost`/`dbPassword`). */
+  readonly env: Omit<LegacyBuildGotrueEnvInput, "dbHost" | "dbPassword">;
+}
+
+/**
+ * Builds the `docker create` spec for the GoTrue/Auth container
+ * (`start.go:820-850`). No `ports` (host-published) entry — GoTrue, like
+ * Realtime, only ever `ExposedPorts` its port on the Docker network.
+ */
+export function legacyBuildGotrueContainerSpec(
+  input: LegacyGotrueContainerSpecInput,
+): LegacyStartContainerSpec {
+  const dbHost = legacyServiceContainerName("db", input.projectId);
+  const dbPassword = legacyStartInternalDbPassword(input.dbUrl);
+  const env = legacyBuildGotrueEnv({ ...input.env, dbHost, dbPassword });
+
+  return {
+    image: input.image,
+    containerName: legacyServiceContainerName(LEGACY_GOTRUE_CONTAINER_SUFFIX, input.projectId),
+    env,
+    binds: [],
+    exposedPorts: [{ containerPort: LEGACY_GOTRUE_PORT }],
+    healthcheck: {
+      test: [
+        "CMD",
+        "wget",
+        "--no-verbose",
+        "--tries=1",
+        "--spider",
+        `http://127.0.0.1:${LEGACY_GOTRUE_PORT}/health`,
+      ],
+      intervalSeconds: 10,
+      timeoutSeconds: 2,
+      retries: 3,
+    },
+    restartPolicy: "unless-stopped",
+    networkId: input.networkId,
+    networkAliases: [LEGACY_GOTRUE_CONTAINER_SUFFIX],
+    labels: {},
+  };
+}
diff --git a/apps/cli/src/legacy/commands/start/services/gotrue.service.unit.test.ts b/apps/cli/src/legacy/commands/start/services/gotrue.service.unit.test.ts
new file mode 100644
index 0000000000..a38d4401a6
--- /dev/null
+++ b/apps/cli/src/legacy/commands/start/services/gotrue.service.unit.test.ts
@@ -0,0 +1,715 @@
+import { describe, expect, test } from "vitest";
+
+import {
+  legacyBuildGotrueContainerSpec,
+  legacyBuildGotrueEnv,
+  legacyFormatMapForEnvConfig,
+  type LegacyBuildGotrueEnvInput,
+  type LegacyGotrueExternalProviderInput,
+  type LegacyGotrueHookInput,
+  type LegacyGotrueSigningKey,
+  type LegacyGotrueWebauthnInput,
+} from "./gotrue.service.ts";
+
+// Mirrors the fixture Go's `TestBuildGotrueEnv` builds via `config.NewConfig()`
+// (`apps/cli-go/internal/start/start_test.go:440-520`), translated into this
+// pure function's explicit input shape. Every field not asserted by a
+// specific Go subtest below reflects `config.NewConfig()`'s own defaults.
+const baseEnvInput: LegacyBuildGotrueEnvInput = {
+  dbHost: "db",
+  dbPassword: "postgres",
+  apiUrl: "http://127.0.0.1:54321",
+  jwtSecret: "test-jwt-secret",
+  jwtIssuer: undefined,
+  jwtExpiry: 3600,
+  siteUrl: "http://127.0.0.1:3000",
+  additionalRedirectUrls: ["https://127.0.0.1:3000"],
+  enableSignup: true,
+  enableAnonymousSignIns: false,
+  enableRefreshTokenRotation: true,
+  refreshTokenReuseInterval: 10,
+  enableManualLinking: false,
+  minimumPasswordLength: 6,
+  passwordRequirements: "",
+  email: {
+    enable_signup: true,
+    double_confirm_changes: true,
+    enable_confirmations: false,
+    secure_password_change: false,
+    max_frequency: "1s",
+    otp_length: 6,
+    otp_expiry: 3600,
+    template: {},
+    notification: {},
+  },
+  kongContainerName: "test-kong",
+  sms: {
+    enable_signup: false,
+    enable_confirmations: false,
+    template: "Your code is {{ .Code }}",
+    max_frequency: "5s",
+    twilio: { enabled: false, account_sid: "", message_service_sid: "" },
+    twilio_verify: { enabled: false },
+    messagebird: { enabled: false },
+    textlocal: { enabled: false },
+    vonage: { enabled: false },
+  },
+  sessions: undefined,
+  mfa: {
+    totp: { enroll_enabled: false, verify_enabled: false },
+    phone: {
+      enroll_enabled: false,
+      verify_enabled: false,
+      otp_length: 6,
+      template: "Your code is {{ .Code }}",
+      max_frequency: "5s",
+    },
+    web_authn: { enroll_enabled: false, verify_enabled: false },
+    max_enrolled_factors: 10,
+  },
+  rateLimit: {
+    anonymous_users: 30,
+    token_refresh: 150,
+    sign_in_sign_ups: 30,
+    token_verifications: 30,
+    email_sent: 2,
+    sms_sent: 30,
+    web3: 30,
+  },
+  web3: { solana: { enabled: false }, ethereum: { enabled: false } },
+  oauthServer: {
+    enabled: false,
+    authorization_url_path: "/oauth/consent",
+    allow_dynamic_registration: false,
+  },
+  hooks: {
+    mfaVerificationAttempt: { enabled: false },
+    passwordVerificationAttempt: { enabled: false },
+    customAccessToken: { enabled: false },
+    sendSms: { enabled: false },
+    sendEmail: { enabled: false },
+    beforeUserCreated: { enabled: false },
+  },
+  externalProviders: {},
+};
+
+describe("legacyBuildGotrueEnv", () => {
+  // Port of TestBuildGotrueEnv's 4 sub-cases (start_test.go:440-520).
+  describe("TestBuildGotrueEnv parity", () => {
+    test("uses auth scoped external url and absolute mailer verify urls", () => {
+      const env = legacyBuildGotrueEnv({
+        ...baseEnvInput,
+        apiUrl: "http://127.0.0.1:54321",
+        jwtIssuer: undefined,
+        siteUrl: "http://127.0.0.1:3000",
+        externalProviders: {
+          github: {
+            enabled: true,
+            clientId: "client-id",
+            secret: "secret",
+            url: "",
+            skipNonceCheck: false,
+            emailOptional: false,
+          },
+        },
+      });
+
+      expect(env["API_EXTERNAL_URL"]).toBe("http://127.0.0.1:54321/auth/v1");
+      expect(env["GOTRUE_JWT_ISSUER"]).toBe("http://127.0.0.1:54321/auth/v1");
+      expect(env["GOTRUE_MAILER_URLPATHS_INVITE"]).toBe("http://127.0.0.1:54321/auth/v1/verify");
+      expect(env["GOTRUE_MAILER_URLPATHS_CONFIRMATION"]).toBe(
+        "http://127.0.0.1:54321/auth/v1/verify",
+      );
+      expect(env["GOTRUE_MAILER_URLPATHS_RECOVERY"]).toBe("http://127.0.0.1:54321/auth/v1/verify");
+      expect(env["GOTRUE_MAILER_URLPATHS_EMAIL_CHANGE"]).toBe(
+        "http://127.0.0.1:54321/auth/v1/verify",
+      );
+      expect(env["GOTRUE_EXTERNAL_GITHUB_REDIRECT_URI"]).toBe(
+        "http://127.0.0.1:54321/auth/v1/callback",
+      );
+    });
+
+    test("honors an explicit auth.external_url override for API_EXTERNAL_URL, the JWT issuer default, the mailer verify URL, and OAuth redirects", () => {
+      const env = legacyBuildGotrueEnv({
+        ...baseEnvInput,
+        apiUrl: "http://127.0.0.1:54321",
+        authExternalUrl: "https://auth.example.com",
+        jwtIssuer: undefined,
+        siteUrl: "http://127.0.0.1:3000",
+        externalProviders: {
+          github: {
+            enabled: true,
+            clientId: "client-id",
+            secret: "secret",
+            url: "",
+            skipNonceCheck: false,
+            emailOptional: false,
+          },
+        },
+      });
+
+      expect(env["API_EXTERNAL_URL"]).toBe("https://auth.example.com");
+      expect(env["GOTRUE_JWT_ISSUER"]).toBe("https://auth.example.com");
+      expect(env["GOTRUE_MAILER_URLPATHS_INVITE"]).toBe("https://auth.example.com/verify");
+      expect(env["GOTRUE_EXTERNAL_GITHUB_REDIRECT_URI"]).toBe("https://auth.example.com/callback");
+    });
+
+    test("preserves explicit provider redirect override", () => {
+      const env = legacyBuildGotrueEnv({
+        ...baseEnvInput,
+        apiUrl: "http://127.0.0.1:54321",
+        jwtIssuer: "https://issuer.example.com/auth/v1",
+        siteUrl: "http://127.0.0.1:3000",
+        externalProviders: {
+          azure: {
+            enabled: true,
+            clientId: "",
+            url: "",
+            redirectUri: "https://example.com/custom/callback",
+            skipNonceCheck: false,
+            emailOptional: false,
+          },
+        },
+      });
+
+      expect(env["API_EXTERNAL_URL"]).toBe("http://127.0.0.1:54321/auth/v1");
+      expect(env["GOTRUE_JWT_ISSUER"]).toBe("https://issuer.example.com/auth/v1");
+      expect(env["GOTRUE_MAILER_URLPATHS_INVITE"]).toBe("http://127.0.0.1:54321/auth/v1/verify");
+      expect(env["GOTRUE_EXTERNAL_AZURE_REDIRECT_URI"]).toBe("https://example.com/custom/callback");
+    });
+
+    test("wires passkey and webauthn settings", () => {
+      const webauthn: LegacyGotrueWebauthnInput = {
+        rpId: "localhost",
+        rpDisplayName: "Supabase",
+        rpOrigins: ["http://127.0.0.1:5173", "http://localhost:5173"],
+      };
+      const env = legacyBuildGotrueEnv({
+        ...baseEnvInput,
+        passkeyEnabled: true,
+        webauthn,
+      });
+
+      expect(env["GOTRUE_PASSKEY_ENABLED"]).toBe("true");
+      expect(env["GOTRUE_WEBAUTHN_RP_ID"]).toBe("localhost");
+      expect(env["GOTRUE_WEBAUTHN_RP_DISPLAY_NAME"]).toBe("Supabase");
+      expect(env["GOTRUE_WEBAUTHN_RP_ORIGINS"]).toBe("http://127.0.0.1:5173,http://localhost:5173");
+    });
+
+    test("omits passkey and webauthn env when sections are unset", () => {
+      const env = legacyBuildGotrueEnv({
+        ...baseEnvInput,
+        passkeyEnabled: undefined,
+        webauthn: undefined,
+      });
+
+      expect(env["GOTRUE_PASSKEY_ENABLED"]).toBeUndefined();
+      expect(env["GOTRUE_WEBAUTHN_RP_ID"]).toBeUndefined();
+    });
+  });
+
+  // Port of TestFormatMapForEnvConfig (start_test.go:566-612), exercised
+  // through GOTRUE_SMS_TEST_OTP since `formatMapForEnvConfig` is only ever
+  // called from inside `buildGotrueEnv`.
+  describe("GOTRUE_SMS_TEST_OTP / formatMapForEnvConfig parity", () => {
+    test("legacyFormatMapForEnvConfig produces key:value pairs with no trailing comma", () => {
+      expect(legacyFormatMapForEnvConfig({})).toBe("");
+      expect(legacyFormatMapForEnvConfig({ "123456": "123456" })).toMatch(/^\w{6}:\w{6}$/);
+      expect(legacyFormatMapForEnvConfig({ "123456": "123456", "234567": "234567" })).toMatch(
+        /^\w{6}:\w{6},\w{6}:\w{6}$/,
+      );
+    });
+
+    test("defaults GOTRUE_SMS_TEST_OTP to an empty string when auth.sms.test_otp is unset", () => {
+      const env = legacyBuildGotrueEnv({ ...baseEnvInput, sms: { ...baseEnvInput.sms } });
+      expect(env["GOTRUE_SMS_TEST_OTP"]).toBe("");
+    });
+
+    test("formats a single-entry auth.sms.test_otp map", () => {
+      const env = legacyBuildGotrueEnv({
+        ...baseEnvInput,
+        sms: { ...baseEnvInput.sms, test_otp: { "5555555555": "123456" } },
+      });
+      expect(env["GOTRUE_SMS_TEST_OTP"]).toBe("5555555555:123456");
+    });
+
+    test("formats a multi-entry auth.sms.test_otp map with commas and no trailing comma", () => {
+      const env = legacyBuildGotrueEnv({
+        ...baseEnvInput,
+        sms: {
+          ...baseEnvInput.sms,
+          test_otp: { "5555555555": "123456", "4444444444": "654321" },
+        },
+      });
+      expect(env["GOTRUE_SMS_TEST_OTP"]).not.toMatch(/,$/);
+      expect(env["GOTRUE_SMS_TEST_OTP"]?.split(",").sort()).toEqual(
+        ["5555555555:123456", "4444444444:654321"].sort(),
+      );
+    });
+  });
+
+  describe("external OAuth providers", () => {
+    test("a simple enabled provider (github) emits the full env set, with URL omitted when unset", () => {
+      const github: LegacyGotrueExternalProviderInput = {
+        enabled: true,
+        clientId: "gh-client-id",
+        secret: "gh-secret",
+        url: "",
+        skipNonceCheck: false,
+        emailOptional: true,
+      };
+      const env = legacyBuildGotrueEnv({
+        ...baseEnvInput,
+        externalProviders: { github },
+      });
+
+      expect(env["GOTRUE_EXTERNAL_GITHUB_ENABLED"]).toBe("true");
+      expect(env["GOTRUE_EXTERNAL_GITHUB_CLIENT_ID"]).toBe("gh-client-id");
+      expect(env["GOTRUE_EXTERNAL_GITHUB_SECRET"]).toBe("gh-secret");
+      expect(env["GOTRUE_EXTERNAL_GITHUB_SKIP_NONCE_CHECK"]).toBe("false");
+      expect(env["GOTRUE_EXTERNAL_GITHUB_EMAIL_OPTIONAL"]).toBe("true");
+      expect(env["GOTRUE_EXTERNAL_GITHUB_REDIRECT_URI"]).toBe(
+        "http://127.0.0.1:54321/auth/v1/callback",
+      );
+      expect(env["GOTRUE_EXTERNAL_GITHUB_URL"]).toBeUndefined();
+    });
+
+    test("a provider with a configured base url (keycloak) emits GOTRUE_EXTERNAL_<X>_URL", () => {
+      const env = legacyBuildGotrueEnv({
+        ...baseEnvInput,
+        externalProviders: {
+          keycloak: {
+            enabled: true,
+            clientId: "kc-client-id",
+            secret: "kc-secret",
+            url: "https://keycloak.example.com/realms/myrealm",
+            skipNonceCheck: true,
+            emailOptional: false,
+          },
+        },
+      });
+
+      expect(env["GOTRUE_EXTERNAL_KEYCLOAK_URL"]).toBe(
+        "https://keycloak.example.com/realms/myrealm",
+      );
+      expect(env["GOTRUE_EXTERNAL_KEYCLOAK_SKIP_NONCE_CHECK"]).toBe("true");
+    });
+
+    test("emits full env for a configured-but-disabled provider (Go has no `if config.Enabled` gate)", () => {
+      const env = legacyBuildGotrueEnv({
+        ...baseEnvInput,
+        externalProviders: {
+          apple: {
+            enabled: false,
+            clientId: "",
+            url: "",
+            skipNonceCheck: false,
+            emailOptional: false,
+          },
+        },
+      });
+
+      expect(env["GOTRUE_EXTERNAL_APPLE_ENABLED"]).toBe("false");
+      expect(env["GOTRUE_EXTERNAL_APPLE_CLIENT_ID"]).toBe("");
+      expect(env["GOTRUE_EXTERNAL_APPLE_SECRET"]).toBe("");
+    });
+
+    test("omits any env for a provider absent from the (caller-presence-filtered) input map", () => {
+      const env = legacyBuildGotrueEnv({ ...baseEnvInput, externalProviders: {} });
+
+      expect(env["GOTRUE_EXTERNAL_GITHUB_ENABLED"]).toBeUndefined();
+      expect(env["GOTRUE_EXTERNAL_APPLE_ENABLED"]).toBeUndefined();
+      expect(env["GOTRUE_EXTERNAL_AZURE_ENABLED"]).toBeUndefined();
+    });
+  });
+
+  describe("SMTP / Mailpit fallback", () => {
+    test("uses configured SMTP when present, overriding the hardcoded GOTRUE_RATE_LIMIT_EMAIL_SENT default", () => {
+      const env = legacyBuildGotrueEnv({
+        ...baseEnvInput,
+        rateLimit: { ...baseEnvInput.rateLimit, email_sent: 99 },
+        smtp: {
+          host: "smtp.example.com",
+          port: 587,
+          user: "smtp-user",
+          pass: "smtp-pass",
+          adminEmail: "admin@example.com",
+          senderName: "Example",
+        },
+      });
+
+      expect(env["GOTRUE_SMTP_HOST"]).toBe("smtp.example.com");
+      expect(env["GOTRUE_SMTP_PORT"]).toBe("587");
+      expect(env["GOTRUE_SMTP_USER"]).toBe("smtp-user");
+      expect(env["GOTRUE_SMTP_PASS"]).toBe("smtp-pass");
+      expect(env["GOTRUE_SMTP_ADMIN_EMAIL"]).toBe("admin@example.com");
+      expect(env["GOTRUE_SMTP_SENDER_NAME"]).toBe("Example");
+      expect(env["GOTRUE_RATE_LIMIT_EMAIL_SENT"]).toBe("99");
+    });
+
+    test("falls back to Mailpit when SMTP is unset and local_smtp is enabled", () => {
+      const env = legacyBuildGotrueEnv({
+        ...baseEnvInput,
+        mailpit: { containerName: "supabase_inbucket_proj" },
+      });
+
+      expect(env["GOTRUE_SMTP_HOST"]).toBe("supabase_inbucket_proj");
+      expect(env["GOTRUE_SMTP_PORT"]).toBe("1025");
+      expect(env["GOTRUE_SMTP_ADMIN_EMAIL"]).toBe("admin@email.com");
+      expect(env["GOTRUE_SMTP_SENDER_NAME"]).toBe("Admin");
+      expect(env["GOTRUE_RATE_LIMIT_EMAIL_SENT"]).toBe("360000");
+    });
+
+    test("emits neither SMTP nor Mailpit env when both are unset", () => {
+      const env = legacyBuildGotrueEnv(baseEnvInput);
+      expect(env["GOTRUE_SMTP_HOST"]).toBeUndefined();
+      expect(env["GOTRUE_RATE_LIMIT_EMAIL_SENT"]).toBe("360000");
+    });
+  });
+
+  describe("sessions", () => {
+    test("omits GOTRUE_SESSIONS_TIMEBOX/INACTIVITY_TIMEOUT when unset", () => {
+      const env = legacyBuildGotrueEnv(baseEnvInput);
+      expect(env["GOTRUE_SESSIONS_TIMEBOX"]).toBeUndefined();
+      expect(env["GOTRUE_SESSIONS_INACTIVITY_TIMEOUT"]).toBeUndefined();
+    });
+
+    test("reformats a configured duration into Go's canonical Duration.String() form", () => {
+      const env = legacyBuildGotrueEnv({
+        ...baseEnvInput,
+        sessions: { timebox: "1h", inactivity_timeout: "90s" },
+      });
+      expect(env["GOTRUE_SESSIONS_TIMEBOX"]).toBe("1h0m0s");
+      expect(env["GOTRUE_SESSIONS_INACTIVITY_TIMEOUT"]).toBe("1m30s");
+    });
+
+    test("omits a configured but zero-valued duration, matching Go's `> 0` guard", () => {
+      const env = legacyBuildGotrueEnv({
+        ...baseEnvInput,
+        sessions: { timebox: "0s" },
+      });
+      expect(env["GOTRUE_SESSIONS_TIMEBOX"]).toBeUndefined();
+    });
+  });
+
+  describe("SMS provider switch", () => {
+    test("twilio takes priority when multiple providers are enabled", () => {
+      const env = legacyBuildGotrueEnv({
+        ...baseEnvInput,
+        sms: {
+          ...baseEnvInput.sms,
+          twilio: {
+            enabled: true,
+            account_sid: "AC123",
+            message_service_sid: "MG123",
+            auth_token: "token123",
+          },
+          vonage: { enabled: true, from: "vonage-from", api_key: "k", api_secret: "s" },
+        },
+      });
+
+      expect(env["GOTRUE_SMS_PROVIDER"]).toBe("twilio");
+      expect(env["GOTRUE_SMS_TWILIO_ACCOUNT_SID"]).toBe("AC123");
+      expect(env["GOTRUE_SMS_TWILIO_AUTH_TOKEN"]).toBe("token123");
+      expect(env["GOTRUE_SMS_TWILIO_MESSAGE_SERVICE_SID"]).toBe("MG123");
+      expect(env["GOTRUE_SMS_VONAGE_API_KEY"]).toBeUndefined();
+    });
+
+    test("vonage is used when it is the only enabled provider", () => {
+      const env = legacyBuildGotrueEnv({
+        ...baseEnvInput,
+        sms: {
+          ...baseEnvInput.sms,
+          vonage: { enabled: true, from: "vonage-from", api_key: "k", api_secret: "s" },
+        },
+      });
+
+      expect(env["GOTRUE_SMS_PROVIDER"]).toBe("vonage");
+      expect(env["GOTRUE_SMS_VONAGE_FROM"]).toBe("vonage-from");
+      expect(env["GOTRUE_SMS_VONAGE_API_KEY"]).toBe("k");
+      expect(env["GOTRUE_SMS_VONAGE_API_SECRET"]).toBe("s");
+    });
+
+    test("omits GOTRUE_SMS_PROVIDER when no provider is enabled", () => {
+      const env = legacyBuildGotrueEnv(baseEnvInput);
+      expect(env["GOTRUE_SMS_PROVIDER"]).toBeUndefined();
+    });
+  });
+
+  describe("CAPTCHA", () => {
+    test("emits CAPTCHA env when present", () => {
+      const env = legacyBuildGotrueEnv({
+        ...baseEnvInput,
+        captcha: { enabled: true, provider: "hcaptcha", secret: "captcha-secret" },
+      });
+      expect(env["GOTRUE_SECURITY_CAPTCHA_ENABLED"]).toBe("true");
+      expect(env["GOTRUE_SECURITY_CAPTCHA_PROVIDER"]).toBe("hcaptcha");
+      expect(env["GOTRUE_SECURITY_CAPTCHA_SECRET"]).toBe("captcha-secret");
+    });
+
+    test("omits CAPTCHA env when unset", () => {
+      const env = legacyBuildGotrueEnv(baseEnvInput);
+      expect(env["GOTRUE_SECURITY_CAPTCHA_ENABLED"]).toBeUndefined();
+    });
+  });
+
+  describe("hooks", () => {
+    test("emits ENABLED/URI/SECRETS for each enabled hook, omits disabled ones", () => {
+      const customAccessToken: LegacyGotrueHookInput = {
+        enabled: true,
+        uri: "pg-functions://postgres/public/custom_access_token_hook",
+        secrets: "hook-secret",
+      };
+      const env = legacyBuildGotrueEnv({
+        ...baseEnvInput,
+        hooks: { ...baseEnvInput.hooks, customAccessToken },
+      });
+
+      expect(env["GOTRUE_HOOK_CUSTOM_ACCESS_TOKEN_ENABLED"]).toBe("true");
+      expect(env["GOTRUE_HOOK_CUSTOM_ACCESS_TOKEN_URI"]).toBe(
+        "pg-functions://postgres/public/custom_access_token_hook",
+      );
+      expect(env["GOTRUE_HOOK_CUSTOM_ACCESS_TOKEN_SECRETS"]).toBe("hook-secret");
+      expect(env["GOTRUE_HOOK_SEND_EMAIL_ENABLED"]).toBeUndefined();
+    });
+  });
+
+  describe("MFA phone extras", () => {
+    test("emits template/otp_length/max_frequency when phone enrollment is enabled", () => {
+      const env = legacyBuildGotrueEnv({
+        ...baseEnvInput,
+        mfa: {
+          ...baseEnvInput.mfa,
+          phone: { ...baseEnvInput.mfa.phone, enroll_enabled: true, max_frequency: "10s" },
+        },
+      });
+      expect(env["GOTRUE_MFA_PHONE_TEMPLATE"]).toBe("Your code is {{ .Code }}");
+      expect(env["GOTRUE_MFA_PHONE_OTP_LENGTH"]).toBe("6");
+      expect(env["GOTRUE_MFA_PHONE_MAX_FREQUENCY"]).toBe("10s");
+    });
+
+    test("omits phone extras when neither enroll nor verify is enabled", () => {
+      const env = legacyBuildGotrueEnv(baseEnvInput);
+      expect(env["GOTRUE_MFA_PHONE_TEMPLATE"]).toBeUndefined();
+      expect(env["GOTRUE_MFA_PHONE_MAX_FREQUENCY"]).toBeUndefined();
+    });
+  });
+
+  describe("mailer templates and notifications", () => {
+    test("emits a template URL and subject, using the content path's extension", () => {
+      const env = legacyBuildGotrueEnv({
+        ...baseEnvInput,
+        email: {
+          ...baseEnvInput.email,
+          template: {
+            confirmation: {
+              subject: "Confirm your signup",
+              content_path: "supabase/templates/confirm.html",
+              content_present: false,
+            },
+          },
+        },
+      });
+      expect(env["GOTRUE_MAILER_TEMPLATES_CONFIRMATION"]).toBe(
+        "http://test-kong:8088/email/confirmation.html",
+      );
+      expect(env["GOTRUE_MAILER_SUBJECTS_CONFIRMATION"]).toBe("Confirm your signup");
+    });
+
+    // Go's `emailTemplate.Subject` is `*string` (`pkg/config/auth.go:266`); `start.go:668-676`
+    // gates strictly on `subject != nil`, not on string length — an explicit blank subject is
+    // still emitted, distinct from an absent one below.
+    test("still emits an explicit empty subject, distinct from an absent one", () => {
+      const env = legacyBuildGotrueEnv({
+        ...baseEnvInput,
+        email: {
+          ...baseEnvInput.email,
+          template: {
+            confirmation: {
+              subject: "",
+              content_path: "supabase/templates/confirm.html",
+              content_present: false,
+            },
+          },
+        },
+      });
+      expect(env["GOTRUE_MAILER_SUBJECTS_CONFIRMATION"]).toBe("");
+    });
+
+    test("omits the subject env var entirely when subject is absent (undefined)", () => {
+      const env = legacyBuildGotrueEnv({
+        ...baseEnvInput,
+        email: {
+          ...baseEnvInput.email,
+          template: {
+            confirmation: {
+              subject: undefined,
+              content_path: "supabase/templates/confirm.html",
+              content_present: false,
+            },
+          },
+        },
+      });
+      expect(env).not.toHaveProperty("GOTRUE_MAILER_SUBJECTS_CONFIRMATION");
+    });
+
+    test("emits a notification's ENABLED flag and template/subject with the _notification suffix", () => {
+      const env = legacyBuildGotrueEnv({
+        ...baseEnvInput,
+        email: {
+          ...baseEnvInput.email,
+          notification: {
+            password_changed: {
+              enabled: true,
+              subject: "Your password changed",
+              content_path: "supabase/templates/password_changed.html",
+              content_present: false,
+            },
+          },
+        },
+      });
+      expect(env["GOTRUE_MAILER_NOTIFICATIONS_PASSWORD_CHANGED_ENABLED"]).toBe("true");
+      expect(env["GOTRUE_MAILER_TEMPLATES_PASSWORD_CHANGED_NOTIFICATION"]).toBe(
+        "http://test-kong:8088/email/password_changed_notification.html",
+      );
+      expect(env["GOTRUE_MAILER_SUBJECTS_PASSWORD_CHANGED_NOTIFICATION"]).toBe(
+        "Your password changed",
+      );
+    });
+
+    test("omits a disabled notification's env entirely", () => {
+      const env = legacyBuildGotrueEnv({
+        ...baseEnvInput,
+        email: {
+          ...baseEnvInput.email,
+          notification: {
+            password_changed: {
+              enabled: false,
+              subject: "Your password changed",
+              content_path: "supabase/templates/password_changed.html",
+              content_present: false,
+            },
+          },
+        },
+      });
+      expect(env["GOTRUE_MAILER_NOTIFICATIONS_PASSWORD_CHANGED_ENABLED"]).toBeUndefined();
+      expect(env["GOTRUE_MAILER_TEMPLATES_PASSWORD_CHANGED_NOTIFICATION"]).toBeUndefined();
+    });
+  });
+
+  describe("web3 and OAuth server", () => {
+    test("always emits both Web3 flags, regardless of value", () => {
+      const env = legacyBuildGotrueEnv({
+        ...baseEnvInput,
+        web3: { solana: { enabled: true }, ethereum: { enabled: false } },
+      });
+      expect(env["GOTRUE_EXTERNAL_WEB3_SOLANA_ENABLED"]).toBe("true");
+      expect(env["GOTRUE_EXTERNAL_WEB3_ETHEREUM_ENABLED"]).toBe("false");
+    });
+
+    test("emits OAuth server env only when enabled", () => {
+      const disabled = legacyBuildGotrueEnv(baseEnvInput);
+      expect(disabled["GOTRUE_OAUTH_SERVER_ENABLED"]).toBeUndefined();
+
+      const enabled = legacyBuildGotrueEnv({
+        ...baseEnvInput,
+        oauthServer: {
+          enabled: true,
+          authorization_url_path: "/oauth/consent",
+          allow_dynamic_registration: true,
+        },
+      });
+      expect(enabled["GOTRUE_OAUTH_SERVER_ENABLED"]).toBe("true");
+      expect(enabled["GOTRUE_OAUTH_SERVER_AUTHORIZATION_PATH"]).toBe("/oauth/consent");
+      expect(enabled["GOTRUE_OAUTH_SERVER_ALLOW_DYNAMIC_REGISTRATION"]).toBe("true");
+    });
+  });
+
+  describe("password requirements", () => {
+    test.each([
+      ["", ""],
+      ["letters_digits", "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ:0123456789"],
+      [
+        "lower_upper_letters_digits",
+        "abcdefghijklmnopqrstuvwxyz:ABCDEFGHIJKLMNOPQRSTUVWXYZ:0123456789",
+      ],
+    ] as const)("%s -> %s", (passwordRequirements, expected) => {
+      const env = legacyBuildGotrueEnv({ ...baseEnvInput, passwordRequirements });
+      expect(env["GOTRUE_PASSWORD_REQUIRED_CHARACTERS"]).toBe(expected);
+    });
+  });
+
+  describe("JWT signing keys", () => {
+    test("defaults to Go's hardcoded ES256 signing key when unset", () => {
+      const env = legacyBuildGotrueEnv(baseEnvInput);
+      const keys = JSON.parse(env["GOTRUE_JWT_KEYS"] as string);
+      expect(keys).toEqual([
+        {
+          kty: "EC",
+          kid: "b81269f1-21d8-4f2e-b719-c2240a840d90",
+          use: "sig",
+          key_ops: ["sign", "verify"],
+          alg: "ES256",
+          ext: true,
+          crv: "P-256",
+          x: "M5Sjqn5zwC9Kl1zVfUUGvv9boQjCGd45G8sdopBExB4",
+          y: "P6IXMvA2WYXSHSOMTBH2jsw_9rrzGy89FjPf6oOsIxQ",
+          d: "dIhR8wywJlqlua4y_yMq2SLhlFXDZJBCvFrY1DCHyVU",
+        },
+      ]);
+      expect(env["GOTRUE_JWT_VALIDMETHODS"]).toBe("HS256,RS256,ES256");
+      expect(env["GOTRUE_JWT_VALID_METHODS"]).toBe("HS256,RS256,ES256");
+    });
+
+    test("serializes a configured signing key, omitting unset fields", () => {
+      const rsaKey: LegacyGotrueSigningKey = { kty: "RSA", alg: "RS256", n: "modulus", e: "AQAB" };
+      const env = legacyBuildGotrueEnv({
+        ...baseEnvInput,
+        signingKeys: [rsaKey],
+      });
+      expect(JSON.parse(env["GOTRUE_JWT_KEYS"] as string)).toEqual([
+        { kty: "RSA", alg: "RS256", n: "modulus", e: "AQAB" },
+      ]);
+    });
+  });
+});
+
+describe("legacyBuildGotrueContainerSpec", () => {
+  test("assembles the full container spec, deriving dbHost/dbPassword from projectId/dbUrl", () => {
+    const spec = legacyBuildGotrueContainerSpec({
+      image: "supabase/gotrue:v2.180.0",
+      projectId: "proj",
+      networkId: "supabase_network_proj",
+      dbUrl: "postgresql://postgres:secret@127.0.0.1:54322/postgres",
+      env: baseEnvInput,
+    });
+
+    expect(spec.image).toBe("supabase/gotrue:v2.180.0");
+    expect(spec.containerName).toBe("supabase_auth_proj");
+    expect(spec.binds).toEqual([]);
+    expect(spec.ports).toBeUndefined();
+    expect(spec.exposedPorts).toEqual([{ containerPort: "9999" }]);
+    expect(spec.healthcheck).toEqual({
+      test: [
+        "CMD",
+        "wget",
+        "--no-verbose",
+        "--tries=1",
+        "--spider",
+        "http://127.0.0.1:9999/health",
+      ],
+      intervalSeconds: 10,
+      timeoutSeconds: 2,
+      retries: 3,
+    });
+    expect(spec.restartPolicy).toBe("unless-stopped");
+    expect(spec.networkId).toBe("supabase_network_proj");
+    expect(spec.networkAliases).toEqual(["auth"]);
+    expect(spec.labels).toEqual({});
+
+    // dbHost/dbPassword flow from projectId/dbUrl into the env's connection string.
+    expect(spec.env["GOTRUE_DB_DATABASE_URL"]).toBe(
+      "postgresql://supabase_auth_admin:secret@supabase_db_proj:5432/postgres",
+    );
+  });
+});
diff --git a/apps/cli/src/legacy/commands/start/services/imgproxy.service.ts b/apps/cli/src/legacy/commands/start/services/imgproxy.service.ts
new file mode 100644
index 0000000000..69c9a32831
--- /dev/null
+++ b/apps/cli/src/legacy/commands/start/services/imgproxy.service.ts
@@ -0,0 +1,80 @@
+/**
+ * Port of Go's "Start Storage ImgProxy" block
+ * (`apps/cli-go/internal/start/start.go:1059-1099`).
+ *
+ * Enabled gate: `isStorageEnabled && isImgProxyEnabled` (`start.go:1060`) —
+ * i.e. `config.storage.enabled && config.storage.image_transformation?.enabled
+ * && !isContainerExcluded(imgproxyImage, excluded)`, AND Storage itself must
+ * be enabled (ImgProxy mounts Storage's own volumes via `VolumesFrom` below,
+ * so it cannot meaningfully run without it). Gating the actual container
+ * start is the future `start.handler.ts` orchestrator's responsibility —
+ * see `start.services.ts`'s `imgproxy` catalog entry (`enabledGate:
+ * "storage.enabled && storage.image_transformation.enabled"`, `dependsOn:
+ * ["storage"]`) — this module only builds the container spec once called.
+ * The caller must pass the SAME `isImgProxyEnabled` boolean it used for this
+ * gating decision into `storage.service.ts`'s `LegacyStorageEnvInput.
+ * imageTransformationEnabled` — see that file's header.
+ */
+
+import { legacyServiceContainerName } from "../../../shared/legacy-docker-ids.ts";
+import type { LegacyStartContainerSpec } from "../lib/docker-create-args.ts";
+
+/**
+ * Go's `Env` literal (`start.go:1065-1075`) — entirely static, no
+ * `config.toml` field feeds any of these values.
+ */
+export function legacyBuildImgproxyEnv(): Record<string, string> {
+  return {
+    IMGPROXY_BIND: ":5001",
+    IMGPROXY_LOCAL_FILESYSTEM_ROOT: "/",
+    // Reproduced verbatim: Go's own literal is `"/"`, not a boolean-looking
+    // value (`start.go:1068`) — not "fixed" here, matching Go exactly.
+    IMGPROXY_USE_ETAG: "/",
+    IMGPROXY_MAX_SRC_RESOLUTION: "50",
+    IMGPROXY_MAX_SRC_FILE_SIZE: "25000000",
+    IMGPROXY_MAX_ANIMATION_FRAMES: "60",
+    IMGPROXY_ENABLE_WEBP_DETECTION: "true",
+    IMGPROXY_PRESETS: "default=width:3000/height:8192",
+    IMGPROXY_FORMAT_QUALITY: "jpeg=80,avif=62,webp=80",
+  };
+}
+
+export interface LegacyImgproxyContainerSpecInput {
+  /** Go's `Config.ProjectId`, already sanitized — see `legacyServiceContainerName`'s callers. */
+  readonly projectId: string;
+  /** `container.HostConfig.NetworkMode`/`network.NetworkingConfig` target — the `--network-id` override or `utils.NetId`. */
+  readonly networkId: string;
+  /** `utils.Config.Storage.ImgProxyImage`, already resolved/pulled by the caller (`image-prepull.ts`). */
+  readonly image: string;
+}
+
+/**
+ * Builds the `docker create` spec for the ImgProxy container
+ * (`start.go:1059-1099`). `volumesFrom` mounts Storage's own volumes
+ * (`container.HostConfig.VolumesFrom: []string{utils.StorageId}`,
+ * `start.go:1084`) — no `ports`/`exposedPorts`; ImgProxy is reached only via
+ * its Docker network alias, from Storage's own `IMGPROXY_URL` env var
+ * (`storage.service.ts`'s `legacyBuildStorageEnv`).
+ */
+export function legacyBuildImgproxyContainerSpec(
+  input: LegacyImgproxyContainerSpecInput,
+): LegacyStartContainerSpec {
+  return {
+    image: input.image,
+    containerName: legacyServiceContainerName("imgproxy", input.projectId),
+    env: legacyBuildImgproxyEnv(),
+    binds: [],
+    volumesFrom: [legacyServiceContainerName("storage", input.projectId)],
+    healthcheck: {
+      test: ["CMD", "imgproxy", "health"],
+      intervalSeconds: 10,
+      timeoutSeconds: 2,
+      retries: 3,
+    },
+    restartPolicy: "unless-stopped",
+    networkId: input.networkId,
+    // `utils.ImgProxyAliases = []string{"imgproxy"}` (`utils/config.go:43`).
+    networkAliases: ["imgproxy"],
+    labels: {},
+  };
+}
diff --git a/apps/cli/src/legacy/commands/start/services/imgproxy.service.unit.test.ts b/apps/cli/src/legacy/commands/start/services/imgproxy.service.unit.test.ts
new file mode 100644
index 0000000000..4d13b0bb12
--- /dev/null
+++ b/apps/cli/src/legacy/commands/start/services/imgproxy.service.unit.test.ts
@@ -0,0 +1,68 @@
+import { describe, expect, test } from "vitest";
+
+import {
+  legacyBuildImgproxyContainerSpec,
+  legacyBuildImgproxyEnv,
+  type LegacyImgproxyContainerSpecInput,
+} from "./imgproxy.service.ts";
+
+describe("legacyBuildImgproxyEnv", () => {
+  test("matches Go's fully static Env literal, including the literal (non-boolean) IMGPROXY_USE_ETAG value", () => {
+    expect(legacyBuildImgproxyEnv()).toEqual({
+      IMGPROXY_BIND: ":5001",
+      IMGPROXY_LOCAL_FILESYSTEM_ROOT: "/",
+      IMGPROXY_USE_ETAG: "/",
+      IMGPROXY_MAX_SRC_RESOLUTION: "50",
+      IMGPROXY_MAX_SRC_FILE_SIZE: "25000000",
+      IMGPROXY_MAX_ANIMATION_FRAMES: "60",
+      IMGPROXY_ENABLE_WEBP_DETECTION: "true",
+      IMGPROXY_PRESETS: "default=width:3000/height:8192",
+      IMGPROXY_FORMAT_QUALITY: "jpeg=80,avif=62,webp=80",
+    });
+  });
+});
+
+describe("legacyBuildImgproxyContainerSpec", () => {
+  const input: LegacyImgproxyContainerSpecInput = {
+    projectId: "proj",
+    networkId: "supabase_network_proj",
+    image: "supabase/imgproxy:v3",
+  };
+
+  test("derives its own container name and mounts Storage's volumes via VolumesFrom", () => {
+    const spec = legacyBuildImgproxyContainerSpec(input);
+    expect(spec.containerName).toBe("supabase_imgproxy_proj");
+    expect(spec.volumesFrom).toEqual(["supabase_storage_proj"]);
+    expect(spec.binds).toEqual([]);
+  });
+
+  test("has no ports/exposedPorts — reached only via its network alias", () => {
+    const spec = legacyBuildImgproxyContainerSpec(input);
+    expect(spec.ports).toBeUndefined();
+    expect(spec.exposedPorts).toBeUndefined();
+  });
+
+  test("builds the imgproxy-native healthcheck", () => {
+    const spec = legacyBuildImgproxyContainerSpec(input);
+    expect(spec.healthcheck).toEqual({
+      test: ["CMD", "imgproxy", "health"],
+      intervalSeconds: 10,
+      timeoutSeconds: 2,
+      retries: 3,
+    });
+  });
+
+  test("network alias is 'imgproxy'", () => {
+    const spec = legacyBuildImgproxyContainerSpec(input);
+    expect(spec.networkAliases).toEqual(["imgproxy"]);
+    expect(spec.networkId).toBe("supabase_network_proj");
+    expect(spec.restartPolicy).toBe("unless-stopped");
+    expect(spec.labels).toEqual({});
+  });
+
+  test("derives the storage volume-source name from a different projectId", () => {
+    const spec = legacyBuildImgproxyContainerSpec({ ...input, projectId: "other" });
+    expect(spec.containerName).toBe("supabase_imgproxy_other");
+    expect(spec.volumesFrom).toEqual(["supabase_storage_other"]);
+  });
+});
diff --git a/apps/cli/src/legacy/commands/start/services/kong.service.ts b/apps/cli/src/legacy/commands/start/services/kong.service.ts
new file mode 100644
index 0000000000..f36cdd93d1
--- /dev/null
+++ b/apps/cli/src/legacy/commands/start/services/kong.service.ts
@@ -0,0 +1,341 @@
+/**
+ * Kong container spec builder — port of Go's "Start Kong" block
+ * (`apps/cli-go/internal/start/start.go:486-627`), gated on
+ * `!isContainerExcluded(config.api.kong_image, excluded)` (Kong has no
+ * `enabled` flag of its own — it is the stack's mandatory gateway) — see
+ * `legacy-service-catalog.ts`'s `kong` entry (`excludeKey: "kong"`). Gating and
+ * image resolution/pre-pull are the caller's job (a future `start.handler.ts`);
+ * this module only assembles the container spec once the caller has already
+ * decided to start it, matching `docker-create-args.ts`'s "image already
+ * resolved/pulled" contract.
+ *
+ * How Go injects `kong.yml`/`custom_nginx.template`/the TLS cert+key into the
+ * container (`start.go:588-601`): a single `sh -c` entrypoint script with
+ * FOUR chained `cat <<'EOF' > <path> && \` heredocs (joined by shell
+ * line-continuation into one logical command line), all four bodies —
+ * including `kong.yml`'s embedded service-role-key-derived bearer/query
+ * tokens and the TLS private key — landing directly in the container's own
+ * `Cmd`. Safe for Go: it builds `container.Config` structs and calls
+ * `Docker.ContainerCreate` over the Engine API directly, so that `Cmd` string
+ * never becomes a subprocess's own argv. THIS PORT SHELLS OUT to a real
+ * `docker create`, so it deliberately diverges here (CWE-214/522, `ps aux`/
+ * `/proc/<pid>/cmdline`): `kong.yml` (the service-role key) and the TLS
+ * cert/key (the highest-value secret — a private key) travel via
+ * {@link LegacyStartContainerSpec.secretFiles} instead — a HOST temp file,
+ * mode `0644` (world-readable — Kong's image runs its process as uid 100
+ * `kong`, a non-root user, and a Linux/Podman bind mount preserves the host
+ * file's mode verbatim, so `0600` would make it unreadable in-container; see
+ * `legacyStageStartSecretFiles`'s doc comment), bind-mounted read-only at the
+ * exact fixed paths
+ * `KONG_DECLARATIVE_CONFIG`/`KONG_SSL_CERT`/`KONG_SSL_CERT_KEY` already
+ * reference — and never appear in this process's own argv. Only
+ * `custom_nginx.template`, which carries no secret content, still travels via
+ * the heredoc entrypoint script, matching Go exactly.
+ *
+ * The TLS cert/key `secretFiles` entries are still ALWAYS present — never a
+ * conditional bind — for the same reason Go always wrote them:
+ * `KONG_SSL_CERT`/`KONG_SSL_CERT_KEY` reference fixed in-container paths
+ * unconditionally. Their content is never empty either: Go's `NewConfig`
+ * seeds `Api.Tls.{CertContent,KeyContent}` with the embedded default
+ * localhost cert/key (`pkg/config/config.go:452-455`), and only overwrites
+ * them from disk when TLS is enabled AND both `cert_path`/`key_path` are
+ * configured — see {@link LegacyKongContainerSpecInput.tlsCertContent}'s doc
+ * comment. {@link legacyBuildKongEntrypointScript}
+ * reproduces the remaining `custom_nginx.template` heredoc + exec line
+ * byte-for-byte; see its doc comment for the exact shell mechanics.
+ *
+ * Kong mints no JWTs of its own: `BearerToken`/`QueryToken` (`start.go:501-521`)
+ * are Kong `request-transformer`/lua expression STRINGS built by
+ * `fmt.Sprintf` from the four already-generated API keys
+ * (`utils.Config.Auth.{SecretKey,ServiceRoleKey,PublishableKey,AnonKey}.Value`
+ * — see `legacy-local-config-values.ts`'s `LegacyLocalConfigValues`, which
+ * already resolves all four). {@link legacyBuildKongBearerToken}/
+ * {@link legacyBuildKongQueryToken} reproduce those two `fmt.Sprintf` calls
+ * exactly; nothing in this module calls `legacyGenerateGoJwt` itself.
+ */
+
+import * as nodePath from "node:path";
+
+import type { LegacyStartContainerSpec } from "../lib/docker-create-args.ts";
+import { legacyEnvOrDefault } from "../lib/legacy-env-or-default.ts";
+import { legacyRenderStartKongYml } from "../lib/template-render.ts";
+import { LEGACY_START_CUSTOM_NGINX_TEMPLATE } from "../templates/custom_nginx.template.ts";
+
+/** `utils.KongAliases` (`apps/cli-go/internal/utils/config.go:37`) — a fixed, non-configurable constant. */
+const LEGACY_KONG_NETWORK_ALIASES = ["kong", "api.supabase.internal"];
+
+/** `nginxEmailTemplateDir` (`start.go:114`) — the fixed in-container directory email template mounts land in. */
+const LEGACY_KONG_NGINX_EMAIL_TEMPLATE_DIR = "/home/kong/templates/email";
+
+/** `nginxTemplateServerPort` (`start.go:115`) — the fixed port `custom_nginx.template`'s `email_templates` server listens on. */
+const LEGACY_KONG_NGINX_TEMPLATE_SERVER_PORT = 8088;
+
+export interface LegacyKongApiKeys {
+  /** `Config.Auth.SecretKey.Value`. */
+  readonly secretKey: string;
+  /** `Config.Auth.ServiceRoleKey.Value`. */
+  readonly serviceRoleKey: string;
+  /** `Config.Auth.PublishableKey.Value`. */
+  readonly publishableKey: string;
+  /** `Config.Auth.AnonKey.Value`. */
+  readonly anonKey: string;
+}
+
+/**
+ * Go's `BearerToken` (`start.go:501-514`): a Kong `request-transformer` lua
+ * expression, NOT a JWT — forwards a caller's own `Bearer sb_...` Authorization
+ * header verbatim, otherwise maps a matching `apikey` header to the
+ * corresponding `Bearer <key>` value, falling back to echoing `apikey` as-is.
+ * Reproduces the `fmt.Sprintf` call exactly, including argument order
+ * (secretKey, serviceRoleKey, publishableKey, anonKey).
+ */
+export function legacyBuildKongBearerToken(apiKeys: LegacyKongApiKeys): string {
+  return (
+    `$((headers.authorization ~= nil and headers.authorization:sub(1, 10) ~= 'Bearer sb_' and headers.authorization) ` +
+    `or (headers.apikey == '${apiKeys.secretKey}' and 'Bearer ${apiKeys.serviceRoleKey}') ` +
+    `or (headers.apikey == '${apiKeys.publishableKey}' and 'Bearer ${apiKeys.anonKey}') ` +
+    `or headers.apikey)`
+  );
+}
+
+/**
+ * Go's `QueryToken` (`start.go:515-521`): the same mapping as
+ * {@link legacyBuildKongBearerToken}, applied to the `apikey` query parameter
+ * instead of a header, and without the `Bearer sb_...` passthrough branch
+ * (there is no equivalent "already a query-string bearer" case).
+ */
+export function legacyBuildKongQueryToken(apiKeys: LegacyKongApiKeys): string {
+  return (
+    `$((query_params.apikey == '${apiKeys.secretKey}' and '${apiKeys.serviceRoleKey}') ` +
+    `or (query_params.apikey == '${apiKeys.publishableKey}' and '${apiKeys.anonKey}') ` +
+    `or query_params.apikey)`
+  );
+}
+
+/**
+ * Go's `envOrDefault("KONG_NGINX_WORKER_PROCESSES", "1")` (`start.go:583`,
+ * helper at `start.go:1464-1471`): the operator's own shell value wins when
+ * set (e.g. `KONG_NGINX_WORKER_PROCESSES=auto` for one worker per CPU core),
+ * otherwise Go's default of a single worker to minimize local-stack memory
+ * usage (Ref: supabase/cli#1271). By the time Go's `os.LookupEnv` runs here,
+ * `Config.Load` has already merged any project dotenv file into the real
+ * process env (`loadEnvIfExists`/`godotenv.Load`) — `projectEnvValues` is
+ * this port's equivalent merged (dotenv + ambient shell, ambient-wins) view,
+ * so a `KONG_NGINX_WORKER_PROCESSES` set only in a project dotenv file (not
+ * the ambient shell) is honored too, matching Storage's identical
+ * `VECTOR_*`-env handling (`storage.service.ts`). Kept separate from
+ * {@link legacyBuildKongContainerSpec} (which stays a pure function of
+ * already-resolved values, matching every other `start`-service builder) so
+ * this one ambient-env read is independently testable and the builder itself
+ * never touches `process.env`.
+ */
+export function legacyResolveKongNginxWorkerProcesses(
+  projectEnvValues: Readonly<Record<string, string>> | undefined = undefined,
+): string {
+  return legacyEnvOrDefault("KONG_NGINX_WORKER_PROCESSES", "1", projectEnvValues);
+}
+
+export interface LegacyKongEmailTemplateMount {
+  /**
+   * Go's `mountEmailTemplates(id, contentPath string)` `id` parameter
+   * (`start.go:527-542`): the raw `config.auth.email.template` key for a
+   * template mount, or `<key>_notification` for an enabled
+   * `config.auth.email.notification` entry (`start.go:551-557`) — the caller
+   * is responsible for that suffixing and for filtering notifications down to
+   * `enabled` ones; this module only reproduces the per-mount path derivation.
+   */
+  readonly id: string;
+  /** `tmpl.ContentPath` — empty means "not configured", matching Go's `len(contentPath) == 0` early return (no bind emitted). */
+  readonly contentPath: string;
+}
+
+/**
+ * Go's `mountEmailTemplates` closure (`start.go:527-542`): resolves
+ * `contentPath` to an absolute HOST path via `filepath.Abs` (relative to the
+ * process's own working directory — NOT `<workdir>/supabase`, unlike
+ * `legacyResolveEmailTemplateContentPath`'s existence-check base in
+ * `legacy-config-validate.ts`, a genuinely different Go call site with a
+ * different base), joins it onto the fixed in-container email-template
+ * directory as `<id><ext-of-hostPath>` (`path.Join`, POSIX — the container is
+ * always Linux regardless of the host OS, hence `nodePath.posix.join`, not the
+ * platform-dependent `nodePath.join`), and formats the `rw` bind. Returns
+ * `undefined` for an empty `contentPath`, matching Go's no-op early return
+ * (no bind appended).
+ */
+export function legacyBuildKongEmailTemplateBind(
+  mount: LegacyKongEmailTemplateMount,
+  workdir: string,
+): string | undefined {
+  if (mount.contentPath.length === 0) return undefined;
+  const hostPath = nodePath.isAbsolute(mount.contentPath)
+    ? mount.contentPath
+    : nodePath.resolve(workdir, mount.contentPath);
+  const dockerPath = nodePath.posix.join(
+    LEGACY_KONG_NGINX_EMAIL_TEMPLATE_DIR,
+    `${mount.id}${nodePath.extname(hostPath)}`,
+  );
+  return `${hostPath}:${dockerPath}:rw`;
+}
+
+const LEGACY_KONG_ENTRYPOINT_HEAD =
+  "cat <<'EOF' > /home/kong/custom_nginx.template && \\\n" +
+  "./docker-entrypoint.sh kong docker-start --nginx-conf /home/kong/custom_nginx.template\n";
+
+/**
+ * Reproduces the surviving (non-secret) half of Go's exact string
+ * concatenation for the Kong entrypoint (`start.go:588-601`): only the
+ * `custom_nginx.template` heredoc and the final `docker-entrypoint.sh` exec
+ * line — `LEGACY_KONG_ENTRYPOINT_HEAD + nginxTemplate + "\nEOF\n"`. The other
+ * three heredocs Go's version chains ahead of this one (`kong.yml`, the TLS
+ * cert, the TLS key) no longer travel through this script at all — see this
+ * module's header comment for why (`secretFiles`, CWE-214/522).
+ */
+export function legacyBuildKongEntrypointScript(nginxTemplate: string): string {
+  return LEGACY_KONG_ENTRYPOINT_HEAD + nginxTemplate + "\nEOF\n";
+}
+
+export interface LegacyKongContainerSpecInput {
+  /** `config.api.kong_image`, already resolved/pulled by the caller. */
+  readonly image: string;
+  /** `legacyServiceContainerName("kong", projectId)` — Go's `utils.KongId`. */
+  readonly containerName: string;
+  /** Go's `utils.NetId` — the shared Docker network every `start` container joins. */
+  readonly networkId: string;
+  /** `config.hostname`, post-override — the `kongConfig.ApiHost` template field (currently unreferenced by `kong.yml`'s body, but still required to match Go's struct exactly). */
+  readonly apiHost: string;
+  /**
+   * `config.api.port`, post-`SUPABASE_API_PORT`-override — used for the
+   * `kongConfig.ApiPort` template field, `KONG_PORT_MAPS`, and (alongside
+   * {@link apiTlsEnabled}) the published host port.
+   */
+  readonly apiPort: number;
+  /** `config.api.tls.enabled`, post-override — selects the published container port (`8443` vs `8000`, `start.go:560-563`). */
+  readonly apiTlsEnabled: boolean;
+  /**
+   * `Config.Api.Tls.CertContent` as a string. NOT empty-by-default: Go's
+   * `NewConfig` seeds this with the embedded default cert
+   * (`pkg/config/config.go:452-455`, `LEGACY_KONG_LOCAL_TLS_CERT`) and only
+   * `Validate` overwrites it from `api.tls.cert_path` when TLS is enabled AND
+   * both `cert_path`/`key_path` are configured — the caller must pass the
+   * embedded default here otherwise, matching Kong's own unconditional write
+   * of this field to `/home/kong/localhost.crt` (`start.go:585-601`).
+   */
+  readonly tlsCertContent: string;
+  /** `Config.Api.Tls.KeyContent` as a string — see {@link tlsCertContent} for the same embedded-default requirement. */
+  readonly tlsKeyContent: string;
+  /** The four already-generated API keys `BearerToken`/`QueryToken` are built from — see {@link legacyBuildKongBearerToken}/{@link legacyBuildKongQueryToken}. */
+  readonly apiKeys: LegacyKongApiKeys;
+  /** Go's `utils.GotrueId` — GoTrue's own container name. */
+  readonly gotrueId: string;
+  /** Go's `utils.RestId` — PostgREST's own container name. */
+  readonly restId: string;
+  /**
+   * Go's `Config.Realtime.TenantId` (`start.go:492`) — NOT Realtime's
+   * container name/id. Realtime is reachable under this same value because
+   * it is ALSO Realtime's own network alias (`utils.RealtimeAliases =
+   * ["realtime", Config.Realtime.TenantId]`), so `kong.yml`'s `url:
+   * http://{{ .RealtimeId }}:4000/...` resolves via that alias, not via
+   * `legacyServiceContainerName("realtime", projectId)`.
+   */
+  readonly realtimeTenantId: string;
+  /** Go's `utils.StorageId` — Storage's own container name. */
+  readonly storageId: string;
+  /** Go's `utils.StudioId` — Studio's own container name. */
+  readonly studioId: string;
+  /** Go's `utils.PgmetaId` — pg-meta's own container name. */
+  readonly pgmetaId: string;
+  /** Go's `utils.EdgeRuntimeId` — Edge Runtime's own container name. */
+  readonly edgeRuntimeId: string;
+  /** Go's `utils.LogflareId` — Logflare's own container name. */
+  readonly logflareId: string;
+  /** Go's `utils.PoolerId` — Supavisor's own container name. */
+  readonly poolerId: string;
+  /**
+   * `envOrDefault("KONG_NGINX_WORKER_PROCESSES", "1")` — already resolved by
+   * the caller via {@link legacyResolveKongNginxWorkerProcesses}, keeping
+   * this builder a pure function of its `input`.
+   */
+  readonly nginxWorkerProcesses: string;
+  /**
+   * Go's `workdir` (`os.Getwd()` in `run()`, `start.go:308`) — used to
+   * resolve any relative {@link emailTemplateMounts} `contentPath` to an
+   * absolute host path (`filepath.Abs`, `start.go:531-538`).
+   */
+  readonly workdir: string;
+  /**
+   * Every `config.auth.email.template.*`/enabled `config.auth.email.notification.*`
+   * entry the caller has already gathered (`start.go:544-558`) — see
+   * {@link LegacyKongEmailTemplateMount}'s doc comment for the notification
+   * `id` suffixing/filtering the caller owns. Defaults to `[]` (no email
+   * template mounts).
+   */
+  readonly emailTemplateMounts?: ReadonlyArray<LegacyKongEmailTemplateMount>;
+}
+
+/**
+ * Assembles Kong's {@link LegacyStartContainerSpec}. Pure — no Effect or
+ * ambient I/O — matching every other `start`-service builder in this
+ * directory.
+ */
+export function legacyBuildKongContainerSpec(
+  input: LegacyKongContainerSpecInput,
+): LegacyStartContainerSpec {
+  const kongYml = legacyRenderStartKongYml({
+    gotrueId: input.gotrueId,
+    restId: input.restId,
+    realtimeId: input.realtimeTenantId,
+    storageId: input.storageId,
+    studioId: input.studioId,
+    pgmetaId: input.pgmetaId,
+    edgeRuntimeId: input.edgeRuntimeId,
+    logflareId: input.logflareId,
+    poolerId: input.poolerId,
+    apiHost: input.apiHost,
+    apiPort: input.apiPort,
+    bearerToken: legacyBuildKongBearerToken(input.apiKeys),
+    queryToken: legacyBuildKongQueryToken(input.apiKeys),
+  });
+
+  const binds = (input.emailTemplateMounts ?? [])
+    .map((mount) => legacyBuildKongEmailTemplateBind(mount, input.workdir))
+    .filter((bind): bind is string => bind !== undefined);
+
+  const dockerPort = input.apiTlsEnabled ? 8443 : 8000;
+
+  return {
+    image: input.image,
+    containerName: input.containerName,
+    env: {
+      KONG_DATABASE: "off",
+      KONG_DECLARATIVE_CONFIG: "/home/kong/kong.yml",
+      // Ref: https://github.com/supabase/cli/issues/14
+      KONG_DNS_ORDER: "LAST,A,CNAME",
+      KONG_PLUGINS: "request-transformer,cors",
+      KONG_PORT_MAPS: `${input.apiPort}:8000`,
+      // Ref: https://github.com/Kong/kong/issues/3974#issuecomment-482105126
+      KONG_NGINX_PROXY_PROXY_BUFFER_SIZE: "160k",
+      KONG_NGINX_PROXY_PROXY_BUFFERS: "64 160k",
+      KONG_NGINX_WORKER_PROCESSES: input.nginxWorkerProcesses,
+      KONG_SSL_CERT: "/home/kong/localhost.crt",
+      KONG_SSL_CERT_KEY: "/home/kong/localhost.key",
+    },
+    entrypoint: "sh",
+    cmd: ["-c", legacyBuildKongEntrypointScript(LEGACY_START_CUSTOM_NGINX_TEMPLATE)],
+    secretFiles: [
+      { containerPath: "/home/kong/kong.yml", content: kongYml },
+      { containerPath: "/home/kong/localhost.crt", content: input.tlsCertContent },
+      { containerPath: "/home/kong/localhost.key", content: input.tlsKeyContent },
+    ],
+    binds,
+    ports: [{ hostPort: String(input.apiPort), containerPort: String(dockerPort) }],
+    exposedPorts: [
+      { containerPort: "8000" },
+      { containerPort: "8443" },
+      { containerPort: String(LEGACY_KONG_NGINX_TEMPLATE_SERVER_PORT) },
+    ],
+    restartPolicy: "unless-stopped",
+    networkId: input.networkId,
+    networkAliases: LEGACY_KONG_NETWORK_ALIASES,
+    labels: {},
+  };
+}
diff --git a/apps/cli/src/legacy/commands/start/services/kong.service.unit.test.ts b/apps/cli/src/legacy/commands/start/services/kong.service.unit.test.ts
new file mode 100644
index 0000000000..47bc0c9830
--- /dev/null
+++ b/apps/cli/src/legacy/commands/start/services/kong.service.unit.test.ts
@@ -0,0 +1,246 @@
+import { describe, expect, test } from "vitest";
+
+import {
+  legacyBuildKongBearerToken,
+  legacyBuildKongContainerSpec,
+  legacyBuildKongEmailTemplateBind,
+  legacyBuildKongEntrypointScript,
+  legacyBuildKongQueryToken,
+  legacyResolveKongNginxWorkerProcesses,
+  type LegacyKongApiKeys,
+  type LegacyKongContainerSpecInput,
+} from "./kong.service.ts";
+
+const apiKeys: LegacyKongApiKeys = {
+  secretKey: "sb_secret_abc",
+  serviceRoleKey: "service-role-jwt",
+  publishableKey: "sb_publishable_abc",
+  anonKey: "anon-jwt",
+};
+
+describe("legacyBuildKongBearerToken", () => {
+  test("builds the exact lua request-transformer expression (start.go:501-514)", () => {
+    expect(legacyBuildKongBearerToken(apiKeys)).toBe(
+      "$((headers.authorization ~= nil and headers.authorization:sub(1, 10) ~= 'Bearer sb_' and headers.authorization) " +
+        "or (headers.apikey == 'sb_secret_abc' and 'Bearer service-role-jwt') " +
+        "or (headers.apikey == 'sb_publishable_abc' and 'Bearer anon-jwt') " +
+        "or headers.apikey)",
+    );
+  });
+});
+
+describe("legacyBuildKongQueryToken", () => {
+  test("builds the exact lua query-param expression (start.go:515-521)", () => {
+    expect(legacyBuildKongQueryToken(apiKeys)).toBe(
+      "$((query_params.apikey == 'sb_secret_abc' and 'service-role-jwt') " +
+        "or (query_params.apikey == 'sb_publishable_abc' and 'anon-jwt') " +
+        "or query_params.apikey)",
+    );
+  });
+});
+
+describe("legacyResolveKongNginxWorkerProcesses", () => {
+  test('defaults to "1" when unset (start.go:1466-1471)', () => {
+    expect(legacyResolveKongNginxWorkerProcesses(undefined)).toBe("1");
+  });
+
+  test("uses a project dotenv-only value, matching Go's post-Load os.LookupEnv", () => {
+    expect(legacyResolveKongNginxWorkerProcesses({ KONG_NGINX_WORKER_PROCESSES: "auto" })).toBe(
+      "auto",
+    );
+  });
+});
+
+describe("legacyBuildKongEmailTemplateBind", () => {
+  test("returns undefined for an empty contentPath (start.go:528-530)", () => {
+    expect(
+      legacyBuildKongEmailTemplateBind({ id: "invite", contentPath: "" }, "/work"),
+    ).toBeUndefined();
+  });
+
+  test("resolves a relative contentPath against workdir (start.go:531-538)", () => {
+    expect(
+      legacyBuildKongEmailTemplateBind({ id: "invite", contentPath: "invite.html" }, "/work"),
+    ).toBe("/work/invite.html:/home/kong/templates/email/invite.html:rw");
+  });
+
+  test("leaves an absolute contentPath untouched", () => {
+    expect(
+      legacyBuildKongEmailTemplateBind({ id: "invite", contentPath: "/abs/invite.html" }, "/work"),
+    ).toBe("/abs/invite.html:/home/kong/templates/email/invite.html:rw");
+  });
+
+  test("drops the extension when hostPath has none", () => {
+    expect(
+      legacyBuildKongEmailTemplateBind(
+        { id: "invite_notification", contentPath: "invite" },
+        "/work",
+      ),
+    ).toBe("/work/invite:/home/kong/templates/email/invite_notification:rw");
+  });
+});
+
+describe("legacyBuildKongEntrypointScript", () => {
+  test("writes only the custom_nginx.template heredoc, then execs docker-entrypoint.sh (start.go:588-601, minus the secretFiles-carried heredocs)", () => {
+    const script = legacyBuildKongEntrypointScript("NGINX_TEMPLATE");
+    expect(script).toBe(
+      "cat <<'EOF' > /home/kong/custom_nginx.template && \\\n" +
+        "./docker-entrypoint.sh kong docker-start --nginx-conf /home/kong/custom_nginx.template\n" +
+        "NGINX_TEMPLATE\nEOF\n",
+    );
+  });
+
+  test("no longer references kong.yml or the TLS cert/key paths at all", () => {
+    const script = legacyBuildKongEntrypointScript("NGINX_TEMPLATE");
+    expect(script).not.toContain("kong.yml");
+    expect(script).not.toContain("localhost.crt");
+    expect(script).not.toContain("localhost.key");
+  });
+});
+
+const base: LegacyKongContainerSpecInput = {
+  image: "supabase/kong:3.0.0",
+  containerName: "supabase_kong_proj",
+  networkId: "supabase_network_proj",
+  apiHost: "localhost",
+  apiPort: 54321,
+  apiTlsEnabled: false,
+  tlsCertContent: "",
+  tlsKeyContent: "",
+  apiKeys,
+  gotrueId: "supabase_auth_proj",
+  restId: "supabase_rest_proj",
+  realtimeTenantId: "realtime-dev",
+  storageId: "supabase_storage_proj",
+  studioId: "supabase_studio_proj",
+  pgmetaId: "supabase_pg_meta_proj",
+  edgeRuntimeId: "supabase_edge_runtime_proj",
+  logflareId: "supabase_analytics_proj",
+  poolerId: "supabase_pooler_proj",
+  nginxWorkerProcesses: "1",
+  workdir: "/work",
+};
+
+describe("legacyBuildKongContainerSpec", () => {
+  test("builds identity, entrypoint, restart policy, and network aliases (start.go:564-627)", () => {
+    const spec = legacyBuildKongContainerSpec(base);
+    expect(spec.image).toBe("supabase/kong:3.0.0");
+    expect(spec.containerName).toBe("supabase_kong_proj");
+    expect(spec.entrypoint).toBe("sh");
+    expect(spec.cmd?.[0]).toBe("-c");
+    expect(spec.restartPolicy).toBe("unless-stopped");
+    expect(spec.networkId).toBe("supabase_network_proj");
+    expect(spec.networkAliases).toEqual(["kong", "api.supabase.internal"]);
+    expect(spec.labels).toEqual({});
+    expect(spec.healthcheck).toBeUndefined();
+  });
+
+  test("emits the fixed KONG_* env vars, including the resolved worker-process count (start.go:568-587)", () => {
+    const spec = legacyBuildKongContainerSpec(base);
+    expect(spec.env).toEqual({
+      KONG_DATABASE: "off",
+      KONG_DECLARATIVE_CONFIG: "/home/kong/kong.yml",
+      KONG_DNS_ORDER: "LAST,A,CNAME",
+      KONG_PLUGINS: "request-transformer,cors",
+      KONG_PORT_MAPS: "54321:8000",
+      KONG_NGINX_PROXY_PROXY_BUFFER_SIZE: "160k",
+      KONG_NGINX_PROXY_PROXY_BUFFERS: "64 160k",
+      KONG_NGINX_WORKER_PROCESSES: "1",
+      KONG_SSL_CERT: "/home/kong/localhost.crt",
+      KONG_SSL_CERT_KEY: "/home/kong/localhost.key",
+    });
+  });
+
+  test("publishes 8000 to the host and exposes 8000/8443/8088 when TLS is disabled (start.go:560-563,602-612)", () => {
+    const spec = legacyBuildKongContainerSpec({ ...base, apiTlsEnabled: false });
+    expect(spec.ports).toEqual([{ hostPort: "54321", containerPort: "8000" }]);
+    expect(spec.exposedPorts).toEqual([
+      { containerPort: "8000" },
+      { containerPort: "8443" },
+      { containerPort: "8088" },
+    ]);
+  });
+
+  test("publishes 8443 to the host when TLS is enabled, exposed ports unchanged", () => {
+    const spec = legacyBuildKongContainerSpec({ ...base, apiTlsEnabled: true });
+    expect(spec.ports).toEqual([{ hostPort: "54321", containerPort: "8443" }]);
+    expect(spec.exposedPorts).toEqual([
+      { containerPort: "8000" },
+      { containerPort: "8443" },
+      { containerPort: "8088" },
+    ]);
+  });
+
+  test("renders kong.yml using Config.Realtime.TenantId, not Realtime's container name (start.go:492)", () => {
+    const spec = legacyBuildKongContainerSpec(base);
+    const kongYml = spec.secretFiles?.find(
+      (f) => f.containerPath === "/home/kong/kong.yml",
+    )?.content;
+    expect(kongYml).toContain("http://realtime-dev:4000/socket");
+    expect(kongYml).not.toContain("supabase_realtime_proj");
+  });
+
+  test("embeds the bearer/query token lua expressions into the rendered kong.yml", () => {
+    const spec = legacyBuildKongContainerSpec(base);
+    const kongYml = spec.secretFiles?.find(
+      (f) => f.containerPath === "/home/kong/kong.yml",
+    )?.content;
+    expect(kongYml).toContain(legacyBuildKongBearerToken(apiKeys));
+    expect(kongYml).toContain(legacyBuildKongQueryToken(apiKeys));
+  });
+
+  test("has no email template binds by default", () => {
+    const spec = legacyBuildKongContainerSpec(base);
+    expect(spec.binds).toEqual([]);
+  });
+
+  test("mounts every resolved email template bind (start.go:544-558)", () => {
+    const spec = legacyBuildKongContainerSpec({
+      ...base,
+      emailTemplateMounts: [
+        { id: "invite", contentPath: "invite.html" },
+        { id: "confirmation_notification", contentPath: "" },
+        { id: "recovery_notification", contentPath: "/abs/recovery.html" },
+      ],
+    });
+    expect(spec.binds).toEqual([
+      "/work/invite.html:/home/kong/templates/email/invite.html:rw",
+      "/abs/recovery.html:/home/kong/templates/email/recovery_notification.html:rw",
+    ]);
+  });
+
+  test("carries kong.yml and the TLS cert/key as secretFiles at the exact paths KONG_DECLARATIVE_CONFIG/KONG_SSL_CERT/KONG_SSL_CERT_KEY reference, never in cmd (CWE-214/522)", () => {
+    const spec = legacyBuildKongContainerSpec({
+      ...base,
+      tlsCertContent: "-----BEGIN CERTIFICATE-----",
+      tlsKeyContent: "-----BEGIN PRIVATE KEY-----",
+    });
+    expect(spec.secretFiles).toEqual(
+      expect.arrayContaining([
+        expect.objectContaining({ containerPath: "/home/kong/localhost.crt" }),
+        expect.objectContaining({ containerPath: "/home/kong/localhost.key" }),
+      ]),
+    );
+    const cert = spec.secretFiles?.find(
+      (f) => f.containerPath === "/home/kong/localhost.crt",
+    )?.content;
+    const key = spec.secretFiles?.find(
+      (f) => f.containerPath === "/home/kong/localhost.key",
+    )?.content;
+    expect(cert).toBe("-----BEGIN CERTIFICATE-----");
+    expect(key).toBe("-----BEGIN PRIVATE KEY-----");
+
+    const script = String(spec.cmd?.[1]);
+    expect(script).not.toContain("-----BEGIN CERTIFICATE-----");
+    expect(script).not.toContain("-----BEGIN PRIVATE KEY-----");
+    expect(script).not.toContain("kong.yml");
+  });
+
+  test("still carries (empty-content) TLS cert/key secretFiles entries when TLS is unconfigured — an unconditional bind, matching Go's always-written empty files", () => {
+    const spec = legacyBuildKongContainerSpec(base);
+    const cert = spec.secretFiles?.find((f) => f.containerPath === "/home/kong/localhost.crt");
+    const key = spec.secretFiles?.find((f) => f.containerPath === "/home/kong/localhost.key");
+    expect(cert?.content).toBe("");
+    expect(key?.content).toBe("");
+  });
+});
diff --git a/apps/cli/src/legacy/commands/start/services/logflare.service.ts b/apps/cli/src/legacy/commands/start/services/logflare.service.ts
new file mode 100644
index 0000000000..3b61d6a9d7
--- /dev/null
+++ b/apps/cli/src/legacy/commands/start/services/logflare.service.ts
@@ -0,0 +1,159 @@
+/**
+ * Port of Go's "Start Logflare" block (`apps/cli-go/internal/start/start.go:
+ * 313-394`), gated on `config.analytics.enabled` — the gate itself is
+ * `start.handler.ts`'s job (a later task), not this module's; this file only
+ * builds the `docker create` spec.
+ *
+ * Two things make this the fullest worked example among the three real
+ * services ported in this file group:
+ *
+ * - A custom `Entrypoint`/`Cmd` pair that writes and runs its own `run.sh`,
+ *   because the image's own entrypoint conflicts with the healthcheck due to
+ *   a 15-second sleep
+ *   (https://github.com/Logflare/logflare/blob/staging/run.sh#L35).
+ * - A `config.analytics.backend` branch (`postgres` vs `bigquery`,
+ *   `start.go:333-348`) that appends different env vars (and, for BigQuery
+ *   only, a bind mount for the GCP service-account JSON).
+ */
+
+import { join } from "node:path";
+
+import { legacyServiceContainerName } from "../../../shared/legacy-docker-ids.ts";
+import type { LegacyStartContainerSpec } from "../lib/docker-create-args.ts";
+
+/** `utils.LogflareAliases[0]` (`apps/cli-go/internal/utils/config.go:47`) — also this service's `containerSuffix` in `LEGACY_SERVICE_CATALOG`. */
+const LEGACY_LOGFLARE_CONTAINER_SUFFIX = "analytics";
+
+/**
+ * `utils.SUPERUSER_ROLE` (`apps/cli-go/internal/utils/connect.go:338`) — the DB
+ * user Logflare's own Ecto connection authenticates as. Distinct from
+ * {@link LegacyLogflareContainerSpecInput.dbUser} (`dbConfig.User = "postgres"`
+ * in Go), which is used only for the Postgres-backend `POSTGRES_BACKEND_URL`
+ * below (`start.go:344-347`) — Go really does use two different DB users for
+ * two different env vars in this one block.
+ */
+const LEGACY_LOGFLARE_DB_USERNAME = "supabase_admin";
+
+/**
+ * `Config.Analytics.ApiKey`'s only possible value
+ * (`apps/cli-go/pkg/config/config.go:307,529`). The field is `toml:"-"` —
+ * excluded from `config.toml` unmarshalling entirely — so this can never
+ * actually vary; hardcoding it here (rather than threading it through as an
+ * input) mirrors that Go compile-time constant exactly.
+ */
+const LEGACY_LOGFLARE_API_KEY = "api-key";
+
+/**
+ * Go's Logflare entrypoint script (`start.go:358-362`): the image's own
+ * entrypoint conflicts with the container healthcheck due to a 15-second
+ * sleep, so Go writes its own `run.sh` and runs that instead. Transcribed
+ * byte-for-byte, including the trailing newline after `EOF` (Go's raw string
+ * literal ends with a newline before the closing backtick).
+ */
+const LEGACY_LOGFLARE_ENTRYPOINT_SCRIPT =
+  "cat <<'EOF' > run.sh && sh run.sh\n./logflare eval Logflare.Release.migrate\n./logflare start --sname logflare\nEOF\n";
+
+export interface LegacyLogflareContainerSpecInput {
+  /**
+   * `container.Config.Image` — the already-resolved `config.analytics.image`.
+   * Not part of the decoded `@supabase/config` schema (Go's own
+   * `Analytics.Image` field is `toml:"-"`); resolution is the caller's
+   * responsibility.
+   */
+  readonly image: string;
+  /** Go's `Config.ProjectId`, used to derive `utils.LogflareId` via {@link legacyServiceContainerName}. */
+  readonly projectId: string;
+  /** `container.HostConfig.NetworkMode`'s target — resolved once per `start` run, not per-container. */
+  readonly networkId: string;
+  /** `config.analytics.port` — published as `4000/tcp`. */
+  readonly port: number;
+  /** `config.analytics.backend` (`start.go:333`). */
+  readonly backend: "postgres" | "bigquery";
+  /** `config.analytics.gcp_project_id` — only read when {@link backend} is `"bigquery"` (`start.go:340`). */
+  readonly gcpProjectId: string;
+  /** `config.analytics.gcp_project_number` — only read when {@link backend} is `"bigquery"` (`start.go:341`). */
+  readonly gcpProjectNumber: string;
+  /**
+   * `config.analytics.gcp_jwt_path` — only read when {@link backend} is
+   * `"bigquery"` (`start.go:335-336`). Joined onto {@link workdir}
+   * UNCONDITIONALLY, exactly like Go's own `filepath.Join(workdir,
+   * GcpJwtPath)` — an empty string still produces a (degenerate) bind mount of
+   * `workdir` itself, matching Go's behavior when the field is unset.
+   */
+  readonly gcpJwtPath: string;
+  /** `os.Getwd()` at the call site (`start.go:308-311`) — the process working directory, used to resolve {@link gcpJwtPath} to a host path. */
+  readonly workdir: string;
+  /** `dbConfig.Host` (`utils.DbId` on the default path — see `start.go:66-72`). */
+  readonly dbHost: string;
+  /** `dbConfig.Port` (`5432` on the default path). */
+  readonly dbPort: number;
+  /**
+   * `dbConfig.User` (`"postgres"` on the default path) — used only for the
+   * Postgres-backend `POSTGRES_BACKEND_URL` env var, NOT for
+   * `DB_USERNAME` (see {@link LEGACY_LOGFLARE_DB_USERNAME}'s doc comment).
+   */
+  readonly dbUser: string;
+  /** `dbConfig.Password` (`Config.Db.Password`). */
+  readonly dbPassword: string;
+}
+
+/** Builds the `docker create` spec for the Logflare/analytics container (`start.go:313-394`). */
+export function legacyBuildLogflareContainerSpec(
+  input: LegacyLogflareContainerSpecInput,
+): LegacyStartContainerSpec {
+  const env: Record<string, string> = {
+    DB_DATABASE: "_supabase",
+    DB_HOSTNAME: input.dbHost,
+    DB_PORT: String(input.dbPort),
+    DB_SCHEMA: "_analytics",
+    DB_USERNAME: LEGACY_LOGFLARE_DB_USERNAME,
+    DB_PASSWORD: input.dbPassword,
+    LOGFLARE_MIN_CLUSTER_SIZE: "1",
+    LOGFLARE_SINGLE_TENANT: "true",
+    LOGFLARE_SUPABASE_MODE: "true",
+    LOGFLARE_PRIVATE_ACCESS_TOKEN: LEGACY_LOGFLARE_API_KEY,
+    LOGFLARE_LOG_LEVEL: "warn",
+    LOGFLARE_NODE_HOST: "127.0.0.1",
+    // The literal env VALUE includes the single quotes (start.go:328) — Go sets
+    // this directly on container.Config.Env, never through a shell, so the
+    // quotes are not stripped anywhere.
+    LOGFLARE_FEATURE_FLAG_OVERRIDE: "'multibackend=true'",
+    RELEASE_COOKIE: "cookie",
+  };
+
+  const binds: Array<string> = [];
+
+  if (input.backend === "bigquery") {
+    const hostJwtPath = join(input.workdir, input.gcpJwtPath);
+    binds.push(`${hostJwtPath}:/opt/app/rel/logflare/bin/gcloud.json`);
+    env.GOOGLE_DATASET_ID_APPEND = "_prod";
+    env.GOOGLE_PROJECT_ID = input.gcpProjectId;
+    env.GOOGLE_PROJECT_NUMBER = input.gcpProjectNumber;
+  } else {
+    env.POSTGRES_BACKEND_URL = `postgresql://${input.dbUser}:${input.dbPassword}@${input.dbHost}:${input.dbPort}/_supabase`;
+    env.POSTGRES_BACKEND_SCHEMA = "_analytics";
+  }
+
+  return {
+    image: input.image,
+    containerName: legacyServiceContainerName(LEGACY_LOGFLARE_CONTAINER_SUFFIX, input.projectId),
+    hostname: "127.0.0.1",
+    env,
+    entrypoint: "sh",
+    cmd: ["-c", LEGACY_LOGFLARE_ENTRYPOINT_SCRIPT],
+    binds,
+    exposedPorts: [{ containerPort: "4000" }],
+    ports: [{ hostPort: String(input.port), containerPort: "4000" }],
+    healthcheck: {
+      test: ["CMD", "curl", "-sSfL", "--head", "-o", "/dev/null", "http://127.0.0.1:4000/health"],
+      intervalSeconds: 10,
+      timeoutSeconds: 2,
+      retries: 3,
+      startPeriodSeconds: 10,
+    },
+    restartPolicy: "unless-stopped",
+    networkId: input.networkId,
+    networkAliases: [LEGACY_LOGFLARE_CONTAINER_SUFFIX],
+    labels: {},
+  };
+}
diff --git a/apps/cli/src/legacy/commands/start/services/logflare.service.unit.test.ts b/apps/cli/src/legacy/commands/start/services/logflare.service.unit.test.ts
new file mode 100644
index 0000000000..881f243f7d
--- /dev/null
+++ b/apps/cli/src/legacy/commands/start/services/logflare.service.unit.test.ts
@@ -0,0 +1,111 @@
+import { join } from "node:path";
+
+import { describe, expect, test } from "vitest";
+
+import {
+  legacyBuildLogflareContainerSpec,
+  type LegacyLogflareContainerSpecInput,
+} from "./logflare.service.ts";
+
+const base: LegacyLogflareContainerSpecInput = {
+  image: "supabase/logflare:1.0.0",
+  projectId: "proj",
+  networkId: "supabase_network_proj",
+  port: 54327,
+  backend: "postgres",
+  gcpProjectId: "",
+  gcpProjectNumber: "",
+  gcpJwtPath: "",
+  workdir: "/workdir",
+  dbHost: "supabase_db_proj",
+  dbPort: 5432,
+  dbUser: "postgres",
+  dbPassword: "secret",
+};
+
+describe("legacyBuildLogflareContainerSpec", () => {
+  test("builds the shared shape: identity, hostname, entrypoint/cmd, ports, healthcheck, aliases (start.go:350-394)", () => {
+    const spec = legacyBuildLogflareContainerSpec(base);
+    expect(spec.image).toBe("supabase/logflare:1.0.0");
+    expect(spec.containerName).toBe("supabase_analytics_proj");
+    expect(spec.hostname).toBe("127.0.0.1");
+    expect(spec.entrypoint).toBe("sh");
+    expect(spec.cmd).toEqual([
+      "-c",
+      "cat <<'EOF' > run.sh && sh run.sh\n./logflare eval Logflare.Release.migrate\n./logflare start --sname logflare\nEOF\n",
+    ]);
+    expect(spec.exposedPorts).toEqual([{ containerPort: "4000" }]);
+    expect(spec.ports).toEqual([{ hostPort: "54327", containerPort: "4000" }]);
+    expect(spec.healthcheck).toEqual({
+      test: ["CMD", "curl", "-sSfL", "--head", "-o", "/dev/null", "http://127.0.0.1:4000/health"],
+      intervalSeconds: 10,
+      timeoutSeconds: 2,
+      retries: 3,
+      startPeriodSeconds: 10,
+    });
+    expect(spec.restartPolicy).toBe("unless-stopped");
+    expect(spec.networkAliases).toEqual(["analytics"]);
+    expect(spec.networkId).toBe("supabase_network_proj");
+  });
+
+  test("emits the common DB_*/LOGFLARE_* env vars regardless of backend (start.go:315-330)", () => {
+    const spec = legacyBuildLogflareContainerSpec(base);
+    expect(spec.env).toMatchObject({
+      DB_DATABASE: "_supabase",
+      DB_HOSTNAME: "supabase_db_proj",
+      DB_PORT: "5432",
+      DB_SCHEMA: "_analytics",
+      DB_USERNAME: "supabase_admin",
+      DB_PASSWORD: "secret",
+      LOGFLARE_MIN_CLUSTER_SIZE: "1",
+      LOGFLARE_SINGLE_TENANT: "true",
+      LOGFLARE_SUPABASE_MODE: "true",
+      LOGFLARE_PRIVATE_ACCESS_TOKEN: "api-key",
+      LOGFLARE_LOG_LEVEL: "warn",
+      LOGFLARE_NODE_HOST: "127.0.0.1",
+      LOGFLARE_FEATURE_FLAG_OVERRIDE: "'multibackend=true'",
+      RELEASE_COOKIE: "cookie",
+    });
+  });
+
+  test("postgres backend: sets POSTGRES_BACKEND_URL/SCHEMA, no GCP env or bind, no bind mounts (start.go:343-347)", () => {
+    const spec = legacyBuildLogflareContainerSpec({ ...base, backend: "postgres" });
+    expect(spec.env.POSTGRES_BACKEND_URL).toBe(
+      "postgresql://postgres:secret@supabase_db_proj:5432/_supabase",
+    );
+    expect(spec.env.POSTGRES_BACKEND_SCHEMA).toBe("_analytics");
+    expect(spec.env.GOOGLE_PROJECT_ID).toBeUndefined();
+    expect(spec.env.GOOGLE_PROJECT_NUMBER).toBeUndefined();
+    expect(spec.env.GOOGLE_DATASET_ID_APPEND).toBeUndefined();
+    expect(spec.binds).toEqual([]);
+  });
+
+  test("bigquery backend: sets GOOGLE_* env and binds the host JWT path, no postgres env (start.go:334-342)", () => {
+    const spec = legacyBuildLogflareContainerSpec({
+      ...base,
+      backend: "bigquery",
+      gcpProjectId: "my-project",
+      gcpProjectNumber: "123456",
+      gcpJwtPath: "gcloud.json",
+      workdir: "/workdir",
+    });
+    expect(spec.env.GOOGLE_DATASET_ID_APPEND).toBe("_prod");
+    expect(spec.env.GOOGLE_PROJECT_ID).toBe("my-project");
+    expect(spec.env.GOOGLE_PROJECT_NUMBER).toBe("123456");
+    expect(spec.env.POSTGRES_BACKEND_URL).toBeUndefined();
+    expect(spec.env.POSTGRES_BACKEND_SCHEMA).toBeUndefined();
+    expect(spec.binds).toEqual([
+      `${join("/workdir", "gcloud.json")}:/opt/app/rel/logflare/bin/gcloud.json`,
+    ]);
+  });
+
+  test("bigquery backend still binds workdir itself when gcpJwtPath is empty, matching Go's unconditional filepath.Join", () => {
+    const spec = legacyBuildLogflareContainerSpec({
+      ...base,
+      backend: "bigquery",
+      gcpJwtPath: "",
+      workdir: "/workdir",
+    });
+    expect(spec.binds).toEqual([`${join("/workdir", "")}:/opt/app/rel/logflare/bin/gcloud.json`]);
+  });
+});
diff --git a/apps/cli/src/legacy/commands/start/services/mailpit.service.ts b/apps/cli/src/legacy/commands/start/services/mailpit.service.ts
new file mode 100644
index 0000000000..9ddb6faa77
--- /dev/null
+++ b/apps/cli/src/legacy/commands/start/services/mailpit.service.ts
@@ -0,0 +1,93 @@
+/**
+ * Port of Go's "Start Mailpit" block (`apps/cli-go/internal/start/start.go:
+ * 853-901`), gated on `config.inbucket.enabled` (`utils.Config.Inbucket.Enabled`
+ * in Go) — the gate itself is `start.handler.ts`'s job (a later task), not
+ * this module's; this file only builds the `docker create` spec.
+ *
+ * The simplest of the container-bring-up services in this port: no hostname
+ * override, no entrypoint/cmd override, no binds, and exactly one
+ * unconditional env var. The only real branching is which of the two optional
+ * ports (SMTP, POP3) get published alongside the always-on web UI port.
+ */
+
+import { legacyServiceContainerName } from "../../../shared/legacy-docker-ids.ts";
+import type { LegacyStartContainerSpec } from "../lib/docker-create-args.ts";
+
+/**
+ * `utils.InbucketAliases[0]` (`apps/cli-go/internal/utils/config.go:39`) — also
+ * this service's `containerSuffix` in `LEGACY_SERVICE_CATALOG`
+ * (`legacy-service-catalog.ts`). Mailpit keeps the Go-internal "inbucket" name
+ * (the product it replaced) for the container/alias/id, even though the
+ * user-facing service and config section are "Mailpit"/`config.inbucket`.
+ */
+const LEGACY_MAILPIT_CONTAINER_SUFFIX = "inbucket";
+
+export interface LegacyMailpitContainerSpecInput {
+  /**
+   * `container.Config.Image` — the already-resolved `config.inbucket.image`.
+   * Not part of the decoded `@supabase/config` schema (Go's own
+   * `Inbucket.Image` field is `toml:"-"`); resolution is the caller's
+   * responsibility, same as every other service in this port.
+   */
+  readonly image: string;
+  /** Go's `Config.ProjectId`, used to derive `utils.InbucketId` via {@link legacyServiceContainerName}. */
+  readonly projectId: string;
+  /**
+   * `container.HostConfig.NetworkMode`'s target — resolved once per `start`
+   * run, not per-container (see `LegacyStartContainerSpec.networkId`'s doc
+   * comment in `docker-create-args.ts`).
+   */
+  readonly networkId: string;
+  /** `config.inbucket.port` — always published as `8025/tcp` (`start.go:855-857`). */
+  readonly port: number;
+  /**
+   * `config.inbucket.smtp_port` — published as `1025/tcp` only when set and
+   * non-zero, matching Go's `SmtpPort != 0` guard (`start.go:858-862`).
+   * `@supabase/config` has no default for this key, so an absent value
+   * decodes to `undefined` — the same "unset" case as Go's zero `uint16`.
+   */
+  readonly smtpPort?: number;
+  /**
+   * `config.inbucket.pop3_port` — published as `1110/tcp` only when set and
+   * non-zero, matching Go's `Pop3Port != 0` guard (`start.go:863-867`).
+   */
+  readonly pop3Port?: number;
+}
+
+/** Builds the `docker create` spec for the Mailpit/Inbucket container (`start.go:853-901`). */
+export function legacyBuildMailpitContainerSpec(
+  input: LegacyMailpitContainerSpecInput,
+): LegacyStartContainerSpec {
+  const ports: Array<{ hostPort: string; containerPort: string }> = [
+    { hostPort: String(input.port), containerPort: "8025" },
+  ];
+  if (input.smtpPort !== undefined && input.smtpPort !== 0) {
+    ports.push({ hostPort: String(input.smtpPort), containerPort: "1025" });
+  }
+  if (input.pop3Port !== undefined && input.pop3Port !== 0) {
+    ports.push({ hostPort: String(input.pop3Port), containerPort: "1110" });
+  }
+
+  return {
+    image: input.image,
+    containerName: legacyServiceContainerName(LEGACY_MAILPIT_CONTAINER_SUFFIX, input.projectId),
+    env: {
+      // Disable reverse DNS lookups in Mailpit to avoid slow/delayed DNS resolution (start.go:873-874).
+      MP_SMTP_DISABLE_RDNS: "true",
+    },
+    binds: [],
+    ports,
+    healthcheck: {
+      test: ["CMD", "/mailpit", "readyz"],
+      intervalSeconds: 10,
+      timeoutSeconds: 2,
+      retries: 3,
+      // StartPeriod taken from upstream Dockerfile (start.go:881-882).
+      startPeriodSeconds: 10,
+    },
+    restartPolicy: "unless-stopped",
+    networkId: input.networkId,
+    networkAliases: [LEGACY_MAILPIT_CONTAINER_SUFFIX],
+    labels: {},
+  };
+}
diff --git a/apps/cli/src/legacy/commands/start/services/mailpit.service.unit.test.ts b/apps/cli/src/legacy/commands/start/services/mailpit.service.unit.test.ts
new file mode 100644
index 0000000000..af8d104479
--- /dev/null
+++ b/apps/cli/src/legacy/commands/start/services/mailpit.service.unit.test.ts
@@ -0,0 +1,88 @@
+import { describe, expect, test } from "vitest";
+
+import { legacyBuildMailpitContainerSpec } from "./mailpit.service.ts";
+
+describe("legacyBuildMailpitContainerSpec", () => {
+  test("builds the minimal spec with only the always-on web UI port bound (start.go:853-901)", () => {
+    const spec = legacyBuildMailpitContainerSpec({
+      image: "supabase/mailpit:v1",
+      projectId: "proj",
+      networkId: "supabase_network_proj",
+      port: 54324,
+    });
+
+    expect(spec).toEqual({
+      image: "supabase/mailpit:v1",
+      containerName: "supabase_inbucket_proj",
+      env: { MP_SMTP_DISABLE_RDNS: "true" },
+      binds: [],
+      ports: [{ hostPort: "54324", containerPort: "8025" }],
+      healthcheck: {
+        test: ["CMD", "/mailpit", "readyz"],
+        intervalSeconds: 10,
+        timeoutSeconds: 2,
+        retries: 3,
+        startPeriodSeconds: 10,
+      },
+      restartPolicy: "unless-stopped",
+      networkId: "supabase_network_proj",
+      networkAliases: ["inbucket"],
+      labels: {},
+    });
+  });
+
+  test("adds the SMTP port binding only when smtpPort is set and non-zero (start.go:858-862)", () => {
+    const spec = legacyBuildMailpitContainerSpec({
+      image: "img",
+      projectId: "proj",
+      networkId: "net",
+      port: 54324,
+      smtpPort: 54325,
+    });
+    expect(spec.ports).toEqual([
+      { hostPort: "54324", containerPort: "8025" },
+      { hostPort: "54325", containerPort: "1025" },
+    ]);
+  });
+
+  test("omits the SMTP port binding when smtpPort is explicitly 0, matching Go's zero-value guard", () => {
+    const spec = legacyBuildMailpitContainerSpec({
+      image: "img",
+      projectId: "proj",
+      networkId: "net",
+      port: 54324,
+      smtpPort: 0,
+    });
+    expect(spec.ports).toEqual([{ hostPort: "54324", containerPort: "8025" }]);
+  });
+
+  test("adds the POP3 port binding only when pop3Port is set and non-zero (start.go:863-867)", () => {
+    const spec = legacyBuildMailpitContainerSpec({
+      image: "img",
+      projectId: "proj",
+      networkId: "net",
+      port: 54324,
+      pop3Port: 1110,
+    });
+    expect(spec.ports).toEqual([
+      { hostPort: "54324", containerPort: "8025" },
+      { hostPort: "1110", containerPort: "1110" },
+    ]);
+  });
+
+  test("adds both optional ports together, in Go's declared order", () => {
+    const spec = legacyBuildMailpitContainerSpec({
+      image: "img",
+      projectId: "proj",
+      networkId: "net",
+      port: 54324,
+      smtpPort: 54325,
+      pop3Port: 1110,
+    });
+    expect(spec.ports).toEqual([
+      { hostPort: "54324", containerPort: "8025" },
+      { hostPort: "54325", containerPort: "1025" },
+      { hostPort: "1110", containerPort: "1110" },
+    ]);
+  });
+});
diff --git a/apps/cli/src/legacy/commands/start/services/pg-meta.service.ts b/apps/cli/src/legacy/commands/start/services/pg-meta.service.ts
new file mode 100644
index 0000000000..351ed67f7e
--- /dev/null
+++ b/apps/cli/src/legacy/commands/start/services/pg-meta.service.ts
@@ -0,0 +1,82 @@
+/**
+ * pg-meta container spec builder — port of Go's "Start pg-meta" block
+ * (`apps/cli-go/internal/start/start.go:1110-1146`). Gated in Go by
+ * `config.studio.enabled` (pg-meta has no `enabled` flag of its own — it only
+ * exists to back Studio's schema browser) and
+ * `!isContainerExcluded(config.studio.pgmeta_image, excluded)` — see
+ * `legacy-service-catalog.ts`'s `pgMeta` entry (`excludeKey: "postgres-meta"`,
+ * gated on `studio.enabled`). Gating and image resolution/pre-pull are the
+ * caller's job (a future `start.handler.ts`); this module only assembles the
+ * container spec once the caller has already decided to start it, matching
+ * `docker-create-args.ts`'s "image already resolved/pulled" contract.
+ *
+ * No separately-tested pure env function the way Studio has
+ * (`legacyBuildStudioEnv`): pg-meta's env is 6 straight `KEY=value`
+ * assignments with no derived formatting or conditional logic, so
+ * {@link legacyBuildPgMetaContainerSpec} is the only exported entry point.
+ */
+
+import type { LegacyStartContainerSpec } from "../lib/docker-create-args.ts";
+
+/** Go's hardcoded pg-meta listen port (`start.go:1117`, `PG_META_PORT=8080`) — never configurable. */
+const PG_META_PORT = 8080;
+
+/** Go's `utils.PgmetaAliases` (`apps/cli-go/internal/utils/config.go:44`) — a fixed, non-configurable constant. */
+const PG_META_NETWORK_ALIASES = ["pg_meta"];
+
+export interface LegacyPgMetaContainerInput {
+  /** `config.studio.pgmeta_image`, already resolved/pulled by the caller. */
+  readonly image: string;
+  /** `legacyServiceContainerName("pg_meta", projectId)` — Go's `utils.PgmetaId`. */
+  readonly containerName: string;
+  /**
+   * Go's `dbConfig.Host` (`utils.DbId`, `internal/start/start.go:66`) — the
+   * local Postgres container's own hostname on the shared Docker network.
+   */
+  readonly dbHost: string;
+  /** Go's `dbConfig.Port` (hardcoded `5432`, `start.go:67`). */
+  readonly dbPort: number;
+  /** Go's `dbConfig.User` (hardcoded `"postgres"`, `start.go:68`). */
+  readonly dbUser: string;
+  /** Go's `dbConfig.Password` (`config.db.password`, `legacyResolveLocalConfigValues`'s resolved value). */
+  readonly dbPassword: string;
+  /** Go's `dbConfig.Database` (hardcoded `"postgres"`, `start.go:70`). */
+  readonly dbName: string;
+  /** Go's `utils.NetId` — the shared Docker network every `start` container joins. */
+  readonly networkId: string;
+}
+
+/**
+ * Assembles pg-meta's {@link LegacyStartContainerSpec}. Pure — no Effect or
+ * I/O — matching `docker-create-args.ts`'s own builder shape.
+ */
+export function legacyBuildPgMetaContainerSpec(
+  input: LegacyPgMetaContainerInput,
+): LegacyStartContainerSpec {
+  return {
+    image: input.image,
+    containerName: input.containerName,
+    env: {
+      PG_META_PORT: String(PG_META_PORT),
+      PG_META_DB_HOST: input.dbHost,
+      PG_META_DB_NAME: input.dbName,
+      PG_META_DB_USER: input.dbUser,
+      PG_META_DB_PORT: String(input.dbPort),
+      PG_META_DB_PASSWORD: input.dbPassword,
+    },
+    binds: [],
+    healthcheck: {
+      test: [
+        "CMD-SHELL",
+        `node --eval="fetch('http://127.0.0.1:${PG_META_PORT}/health').then((r) => {if (!r.ok) throw new Error(r.status)})"`,
+      ],
+      intervalSeconds: 10,
+      timeoutSeconds: 2,
+      retries: 3,
+    },
+    restartPolicy: "unless-stopped",
+    networkId: input.networkId,
+    networkAliases: PG_META_NETWORK_ALIASES,
+    labels: {},
+  };
+}
diff --git a/apps/cli/src/legacy/commands/start/services/pg-meta.service.unit.test.ts b/apps/cli/src/legacy/commands/start/services/pg-meta.service.unit.test.ts
new file mode 100644
index 0000000000..a63048a97f
--- /dev/null
+++ b/apps/cli/src/legacy/commands/start/services/pg-meta.service.unit.test.ts
@@ -0,0 +1,63 @@
+import { describe, expect, test } from "vitest";
+
+import { legacyBuildPgMetaContainerSpec } from "./pg-meta.service.ts";
+
+describe("legacyBuildPgMetaContainerSpec", () => {
+  test("assembles the full container spec from resolved inputs", () => {
+    const spec = legacyBuildPgMetaContainerSpec({
+      image: "supabase/postgres-meta:v0.96.6",
+      containerName: "supabase_pg_meta_proj",
+      dbHost: "supabase_db_proj",
+      dbPort: 5432,
+      dbUser: "postgres",
+      dbPassword: "postgres",
+      dbName: "postgres",
+      networkId: "supabase_network_proj",
+    });
+
+    expect(spec).toEqual({
+      image: "supabase/postgres-meta:v0.96.6",
+      containerName: "supabase_pg_meta_proj",
+      env: {
+        PG_META_PORT: "8080",
+        PG_META_DB_HOST: "supabase_db_proj",
+        PG_META_DB_NAME: "postgres",
+        PG_META_DB_USER: "postgres",
+        PG_META_DB_PORT: "5432",
+        PG_META_DB_PASSWORD: "postgres",
+      },
+      binds: [],
+      healthcheck: {
+        test: [
+          "CMD-SHELL",
+          `node --eval="fetch('http://127.0.0.1:8080/health').then((r) => {if (!r.ok) throw new Error(r.status)})"`,
+        ],
+        intervalSeconds: 10,
+        timeoutSeconds: 2,
+        retries: 3,
+      },
+      restartPolicy: "unless-stopped",
+      networkId: "supabase_network_proj",
+      networkAliases: ["pg_meta"],
+      labels: {},
+    });
+  });
+
+  test("reflects a non-default db host/port/password in env, while the healthcheck stays on the fixed container port", () => {
+    const spec = legacyBuildPgMetaContainerSpec({
+      image: "supabase/postgres-meta:v0.96.6",
+      containerName: "supabase_pg_meta_proj",
+      dbHost: "custom-db-host",
+      dbPort: 6543,
+      dbUser: "postgres",
+      dbPassword: "hunter2",
+      dbName: "postgres",
+      networkId: "supabase_network_proj",
+    });
+
+    expect(spec.env["PG_META_DB_HOST"]).toBe("custom-db-host");
+    expect(spec.env["PG_META_DB_PORT"]).toBe("6543");
+    expect(spec.env["PG_META_DB_PASSWORD"]).toBe("hunter2");
+    expect(spec.healthcheck?.test[1]).toContain("127.0.0.1:8080");
+  });
+});
diff --git a/apps/cli/src/legacy/commands/start/services/postgres.service.ts b/apps/cli/src/legacy/commands/start/services/postgres.service.ts
new file mode 100644
index 0000000000..5d008d6502
--- /dev/null
+++ b/apps/cli/src/legacy/commands/start/services/postgres.service.ts
@@ -0,0 +1,334 @@
+/**
+ * Port of Go's `NewContainerConfig`/`NewHostConfig`
+ * (`apps/cli-go/internal/db/start/start.go:63-131`): builds the
+ * {@link LegacyStartContainerSpec} for `supabase start`'s Postgres container.
+ *
+ * Deliberately out of scope, per the approved start-port plan:
+ *  - `StartDatabase`'s `fromBackup` restore branch (`start.go:143-164`,
+ *    `templates/restore.sh`) — `supabase start` always calls `StartDatabase`
+ *    with an empty `fromBackup` (`apps/cli-go/internal/start/start.go:295`),
+ *    so that whole branch is dead code on this path.
+ *  - `SetupLocalDatabase` (initial schema bootstrap, `start.go:184-187`) — an
+ *    explicit follow-up, not container construction.
+ *  - Actually creating/starting the container and waiting for it to become
+ *    healthy — that's {@link legacyStartContainer} (`../lib/container-lifecycle.ts`)
+ *    and {@link legacyWaitForHealthyServices} (`../lib/health-check.ts`), wired
+ *    up by a later `start.handler.ts` task.
+ */
+
+import type { ProjectConfig } from "@supabase/config";
+
+import { localDbContainerId } from "../../../shared/legacy-docker-ids.ts";
+import { encodeToml } from "../../../shared/legacy-go-output.encoders.ts";
+import { LEGACY_POSTGRES_DEFAULT_ROOT_KEY } from "../../../shared/legacy-local-config-values.ts";
+import type { LegacyStartContainerSpec } from "../lib/docker-create-args.ts";
+import { LEGACY_START_DB_SCHEMA_SQL } from "../templates/db-schema.sql.ts";
+import { LEGACY_START_DB_SUPABASE_SQL } from "../templates/db-supabase.sql.ts";
+import { LEGACY_START_DB_WEBHOOK_SQL } from "../templates/db-webhook.sql.ts";
+
+/** Go's `Db.Password` default (`pkg/config/config.go:459`). `db.password` has no
+ * config.toml field (`toml:"-"`, `pkg/config/db.go:88`), so this is the only value
+ * this port can ever observe — matches `DEFAULT_DB_PASSWORD` in
+ * `legacy-local-config-values.ts`, not imported from there since that constant
+ * isn't exported and status/stop's resolver is otherwise unrelated to this module. */
+const LEGACY_POSTGRES_PASSWORD = "postgres";
+
+/**
+ * The exact in-container path Go's PG >= 15 entrypoint heredocs the pgsodium
+ * root key to (`start.go:96`) — now a `secretFiles` bind-mount target instead
+ * (see {@link legacyBuildPostgresStartContainerSpec}), not a heredoc.
+ */
+const LEGACY_POSTGRES_PGSODIUM_ROOT_KEY_PATH = "/etc/postgresql-custom/pgsodium_root.key";
+
+/** Go's `container.HealthConfig` literals (`apps/cli-go/internal/db/start/start.go:85-90`). */
+const LEGACY_POSTGRES_HEALTHCHECK_INTERVAL_SECONDS = 10;
+const LEGACY_POSTGRES_HEALTHCHECK_TIMEOUT_SECONDS = 2;
+const LEGACY_POSTGRES_HEALTHCHECK_RETRIES = 3;
+
+/** Go's `utils.DbAliases` (`apps/cli-go/internal/utils/config.go:36`). */
+const LEGACY_POSTGRES_NETWORK_ALIASES: ReadonlyArray<string> = ["db", "db.supabase.internal"];
+
+/** Go's version-compare threshold (`apps/cli-go/internal/db/start/start.go:79`). */
+const LEGACY_POSTGRES_INITDB_VERSION_THRESHOLD = "15.8.1.005";
+
+const LEGACY_POSTGRES_CONFIG_HEADER = "\n# supabase [db.settings] configuration\n";
+
+export interface LegacyPostgresStartServiceInput {
+  /** Decoded `[db]` section — every field this builder needs (`port`, `major_version`, `settings`) lives here. */
+  readonly db: ProjectConfig["db"];
+  /** Decoded `[experimental]` section — only the OrioleDB/S3 fields are read. */
+  readonly experimental: ProjectConfig["experimental"];
+  /** Already-resolved (default-or-configured, decrypted) `auth.jwt_secret` — same shape `legacyResolveLocalConfigValues` produces. */
+  readonly jwtSecret: string;
+  /** `config.auth.jwt_expiry`. */
+  readonly jwtExpiry: number;
+  /** Go's `Config.ProjectId`, already sanitized — see `legacyServiceContainerName`'s doc comment. */
+  readonly projectId: string;
+  /** `utils.NetId` — the local stack's docker network id. */
+  readonly networkId: string;
+  /** `utils.Config.Db.Image`, already resolved/pulled (see `../lib/image-prepull.ts`) — the container's own image. */
+  readonly image: string;
+  /**
+   * `utils.Config.Db.Image` BEFORE registry resolution — Go's
+   * `POSTGRES_INITDB_ARGS` version-tag comparison (`start.go:79`) always runs
+   * against this un-rewritten value; the registry candidate only ever
+   * overwrites the container's `Image` field, afterward, inside `DockerStart`
+   * (`docker.go:365,371`). Passed separately from {@link image} because a
+   * `SUPABASE_INTERNAL_IMAGE_REGISTRY` override containing a port (e.g.
+   * `localhost:5000`) would otherwise inject an extra colon that breaks
+   * {@link legacyPostgresImageVersionTag}'s first-colon tag split.
+   */
+  readonly configImage: string;
+  /** Already-resolved `db.root_key` value. Defaults to {@link LEGACY_POSTGRES_DEFAULT_ROOT_KEY} when omitted — see that constant's doc comment for why. */
+  readonly rootKey?: string;
+}
+
+/**
+ * Port of Go's `(a *settings) ToPostgresConfig()`
+ * (`apps/cli-go/pkg/config/db.go:181-190`): serializes `db.settings` as TOML —
+ * only the fields actually set, matching Go's nil-pointer fields never being
+ * written — replaces every `"` with `'`, and prepends the fixed header
+ * comment.
+ *
+ * Reuses the shared {@link encodeToml} (`legacy-go-output.encoders.ts`, backed
+ * by `smol-toml`) for the actual line rendering: `smol-toml`'s `stringifyTable`
+ * already skips `undefined`/`null` values exactly like Go's TOML encoder
+ * (`github.com/BurntSushi/toml`'s `eStruct`) skips nil pointers — verified
+ * against that library's source, which omits a nil field unconditionally, with
+ * no `omitempty` tag required — and its integer/string/boolean formatting
+ * already matches Go's (unquoted numbers/bools, double-quoted strings, single-
+ * quoted here afterward). The one divergence: `smol-toml`'s `stringify` always
+ * appends a trailing `\n`, even for an empty object (`stringify({})` →
+ * `"\n"`), whereas Go's `ToTomlBytes` of an all-nil-pointer struct returns the
+ * empty string (`TestSettingsToPostgresConfig`'s "Empty settings should
+ * result in empty string" case) — so the empty-settings case is special-cased
+ * below instead of delegated to `encodeToml`.
+ *
+ * `settings` itself is typed optional (`ProjectConfig["db"]["settings"]`
+ * includes `undefined`) because `db.ts` wraps the whole `[db.settings]` table
+ * in `Schema.optionalKey` — in practice the schema's own `withDecodingDefaultKey`
+ * always fills in `{}` when the section is absent, but this stays defensive
+ * against the static type either way, matching Go's `settings` being a plain
+ * (never-nil) struct value.
+ */
+export function legacyPostgresSettingsToPostgresConfig(
+  settings: ProjectConfig["db"]["settings"],
+): string {
+  const defined = Object.fromEntries(
+    Object.entries(settings ?? {}).filter(([, value]) => value !== undefined),
+  );
+  if (Object.keys(defined).length === 0) {
+    return LEGACY_POSTGRES_CONFIG_HEADER;
+  }
+  const toml = encodeToml(defined).replaceAll('"', "'");
+  return `${LEGACY_POSTGRES_CONFIG_HEADER}${toml}`;
+}
+
+/**
+ * Port of Go's `config.VersionCompare` (`apps/cli-go/pkg/config/config.go:885-899`)
+ * — NOT a real semver comparator. A dotted version with more than 3 components
+ * truncates to its first 3 as the primary comparison key, and compares the
+ * remaining components — joined and left-trimmed of leading `0` characters —
+ * as a secondary tie-break (Go: `semver.Compare("v"+pA, "v"+pB)`). Both real
+ * inputs at this module's one call site (a Postgres image tag and the
+ * `"15.8.1.005"` threshold) always have exactly 4 numeric components, so this
+ * only reproduces Go's `golang.org/x/mod/semver` invalid-version rule (an
+ * invalid version string sorts before a valid one; two invalid strings
+ * compare equal — exercised by Go's own `TestVersionCompare` `"oriole-17"`
+ * cases) for the narrower set of shapes real inputs can take; full semver
+ * pre-release/build-metadata syntax is out of scope.
+ */
+export function legacyPostgresVersionCompare(a: string, b: string): number {
+  const [aHead, aTail] = legacySplitVersionHeadTail(a);
+  const [bHead, bTail] = legacySplitVersionHeadTail(b);
+  const headCompare = legacyCompareVersionStrings(aHead, bHead);
+  if (headCompare !== 0) return headCompare;
+  return legacyCompareVersionStrings(aTail, bTail);
+}
+
+function legacySplitVersionHeadTail(version: string): readonly [string, string] {
+  const parts = version.split(".");
+  if (parts.length <= 3) return [version, ""];
+  return [parts.slice(0, 3).join("."), parts.slice(3).join(".").replace(/^0+/, "")];
+}
+
+function legacyIsValidDottedVersion(version: string): boolean {
+  return version.length > 0 && version.split(".").every((part) => /^\d+$/.test(part));
+}
+
+function legacyCompareVersionStrings(a: string, b: string): number {
+  const aValid = legacyIsValidDottedVersion(a);
+  const bValid = legacyIsValidDottedVersion(b);
+  if (!aValid || !bValid) {
+    return aValid === bValid ? 0 : aValid ? 1 : -1;
+  }
+  const aParts = a.split(".").map(Number);
+  const bParts = b.split(".").map(Number);
+  const length = Math.max(aParts.length, bParts.length);
+  for (let index = 0; index < length; index += 1) {
+    const diff = (aParts[index] ?? 0) - (bParts[index] ?? 0);
+    if (diff !== 0) return diff > 0 ? 1 : -1;
+  }
+  return 0;
+}
+
+/**
+ * Go's `i := strings.IndexByte(utils.Config.Db.Image, ':'); ...Image[i+1:]`
+ * (`apps/cli-go/internal/db/start/start.go:79`) — the FIRST colon splits the
+ * image name from its tag. Go's own `Db.Image` is never registry-prefixed at
+ * this point in Go's pipeline (registry resolution only overwrites the
+ * container's `Image` field afterward, inside `DockerStart` —
+ * `docker.go:365,371`), so the first colon is always the name/tag separator.
+ * The caller MUST pass the pre-registry-rewrite image (see
+ * {@link LegacyPostgresStartServiceInput.configImage}) — a resolved image can
+ * carry a registry host prefix with its own colon (e.g. a
+ * `SUPABASE_INTERNAL_IMAGE_REGISTRY=localhost:5000` override), which would
+ * otherwise be misparsed as the tag. When no colon is present at all, Go's
+ * slice expression degrades to the whole string (`Image[0:]`) — reproduced
+ * here the same way.
+ */
+export function legacyPostgresImageVersionTag(image: string): string {
+  const colonIndex = image.indexOf(":");
+  return colonIndex === -1 ? image : image.slice(colonIndex + 1);
+}
+
+/**
+ * Go's OrioleDB / version-compare `Env` branch (`start.go:70-81`) — an
+ * `else if`, so at most one of the two ever fires.
+ */
+function legacyPostgresExtraEnv(
+  experimental: ProjectConfig["experimental"],
+  image: string,
+): Readonly<Record<string, string>> {
+  if (experimental.orioledb_version !== undefined && experimental.orioledb_version.length > 0) {
+    return {
+      POSTGRES_INITDB_ARGS: "--lc-collate=C --lc-ctype=C",
+      S3_ENABLED: "true",
+      S3_HOST: experimental.s3_host ?? "",
+      S3_REGION: experimental.s3_region ?? "",
+      S3_ACCESS_KEY: experimental.s3_access_key ?? "",
+      S3_SECRET_KEY: experimental.s3_secret_key ?? "",
+    };
+  }
+  const tag = legacyPostgresImageVersionTag(image);
+  if (legacyPostgresVersionCompare(tag, LEGACY_POSTGRES_INITDB_VERSION_THRESHOLD) < 0) {
+    return { POSTGRES_INITDB_ARGS: "--lc-collate=C.UTF-8" };
+  }
+  return {};
+}
+
+/**
+ * PG >= 15 entrypoint (`config.db.major_version > 14`, Go's default branch,
+ * `start.go:91-104`): writes `/etc/postgresql.schema.sql` (schema.sql +
+ * webhook.sql + _supabase.sql, concatenated in that exact order), appends
+ * `postgresConfig` to `postgresql.conf`, then execs `docker-entrypoint.sh`.
+ * Go also heredocs `/etc/postgresql-custom/pgsodium_root.key` directly into
+ * this same script (`start.go:96`) — safe for Go, which calls
+ * `Docker.ContainerCreate` over the Engine API directly rather than shelling
+ * out. THIS PORT SHELLS OUT to a real `docker create`, so it deliberately
+ * diverges here: the pgsodium root key travels via
+ * {@link LegacyStartContainerSpec.secretFiles} instead (a HOST temp file,
+ * mode `0644` — world-readable, because Postgres's entrypoint drops root and
+ * reads this file back as the `postgres` user, and a Linux/Podman bind mount
+ * preserves the host file's mode verbatim; see `legacyStageStartSecretFiles`'s
+ * doc comment — bind-mounted read-only at that exact path — see
+ * {@link legacyBuildPostgresStartContainerSpec}), so it never appears in this
+ * process's own `docker create` argv (CWE-214/522).
+ *
+ * Otherwise byte-for-byte derived from Go's raw-string concatenation
+ * (including the trailing space after `/etc/postgresql` — Go's
+ * `NewContainerConfig(args ...string)` joins its variadic `args` there,
+ * always empty for `supabase start`, so the space survives as-is); built via
+ * explicit `"...\n" +` concatenation rather than a multi-line template
+ * literal so that trailing space stays a visible, lint/format-proof string
+ * character instead of invisible end-of-line whitespace.
+ */
+function legacyPostgresEntrypointScriptPg15(postgresConfig: string): string {
+  return (
+    "\n" +
+    "cat <<'EOF' > /etc/postgresql.schema.sql && \\\n" +
+    "cat <<'EOF' >> /etc/postgresql/postgresql.conf && \\\n" +
+    "docker-entrypoint.sh postgres -D /etc/postgresql \n" +
+    `${LEGACY_START_DB_SCHEMA_SQL}\n` +
+    `${LEGACY_START_DB_WEBHOOK_SQL}\n` +
+    `${LEGACY_START_DB_SUPABASE_SQL}\n` +
+    "EOF\n" +
+    `${postgresConfig}\n` +
+    "EOF"
+  );
+}
+
+/**
+ * PG <= 14 entrypoint (`start.go:106-113`): a shorter script — no
+ * `schema.sql`/`webhook.sql` (PG >= 15 only) and no pgsodium root key file —
+ * writes `/docker-entrypoint-initdb.d/supabase_schema.sql` (_supabase.sql
+ * only), appends `postgresConfig` to `postgresql.conf`, then execs
+ * `docker-entrypoint.sh`. See {@link legacyPostgresEntrypointScriptPg15}'s doc
+ * comment for why this is explicit concatenation rather than a template
+ * literal.
+ */
+function legacyPostgresEntrypointScriptPg14(postgresConfig: string): string {
+  return (
+    "\n" +
+    "cat <<'EOF' > /docker-entrypoint-initdb.d/supabase_schema.sql && \\\n" +
+    "cat <<'EOF' >> /etc/postgresql/postgresql.conf && \\\n" +
+    "docker-entrypoint.sh postgres -D /etc/postgresql \n" +
+    `${LEGACY_START_DB_SUPABASE_SQL}\n` +
+    "EOF\n" +
+    `${postgresConfig}\n` +
+    "EOF"
+  );
+}
+
+/**
+ * Builds the {@link LegacyStartContainerSpec} for `supabase start`'s Postgres
+ * container — see this module's header for what's deliberately out of scope.
+ */
+export function legacyBuildPostgresStartContainerSpec(
+  input: LegacyPostgresStartServiceInput,
+): LegacyStartContainerSpec {
+  const containerName = localDbContainerId(input.projectId);
+  const rootKeyValue = input.rootKey ?? LEGACY_POSTGRES_DEFAULT_ROOT_KEY;
+  const postgresConfig = legacyPostgresSettingsToPostgresConfig(input.db.settings);
+  const isPg14OrEarlier = input.db.major_version <= 14;
+
+  const env: Record<string, string> = {
+    POSTGRES_PASSWORD: LEGACY_POSTGRES_PASSWORD,
+    POSTGRES_HOST: "/var/run/postgresql",
+    JWT_SECRET: input.jwtSecret,
+    JWT_EXP: String(input.jwtExpiry),
+    ...legacyPostgresExtraEnv(input.experimental, input.configImage),
+  };
+
+  const script = isPg14OrEarlier
+    ? legacyPostgresEntrypointScriptPg14(postgresConfig)
+    : legacyPostgresEntrypointScriptPg15(postgresConfig);
+
+  return {
+    image: input.image,
+    containerName,
+    env,
+    entrypoint: "sh",
+    cmd: ["-c", script],
+    binds: [`${containerName}:/var/lib/postgresql/data`],
+    ...(isPg14OrEarlier ? { tmpfs: { "/docker-entrypoint-initdb.d": "" } } : {}),
+    ...(isPg14OrEarlier
+      ? {}
+      : {
+          secretFiles: [
+            { containerPath: LEGACY_POSTGRES_PGSODIUM_ROOT_KEY_PATH, content: rootKeyValue },
+          ],
+        }),
+    ports: [{ hostPort: String(input.db.port), containerPort: "5432" }],
+    healthcheck: {
+      test: ["CMD", "pg_isready", "-U", "postgres", "-h", "127.0.0.1", "-p", "5432"],
+      intervalSeconds: LEGACY_POSTGRES_HEALTHCHECK_INTERVAL_SECONDS,
+      timeoutSeconds: LEGACY_POSTGRES_HEALTHCHECK_TIMEOUT_SECONDS,
+      retries: LEGACY_POSTGRES_HEALTHCHECK_RETRIES,
+    },
+    restartPolicy: "unless-stopped",
+    networkId: input.networkId,
+    networkAliases: LEGACY_POSTGRES_NETWORK_ALIASES,
+    labels: {},
+  };
+}
diff --git a/apps/cli/src/legacy/commands/start/services/postgres.service.unit.test.ts b/apps/cli/src/legacy/commands/start/services/postgres.service.unit.test.ts
new file mode 100644
index 0000000000..b651045860
--- /dev/null
+++ b/apps/cli/src/legacy/commands/start/services/postgres.service.unit.test.ts
@@ -0,0 +1,315 @@
+import type { ProjectConfig } from "@supabase/config";
+import { describe, expect, test } from "vitest";
+
+import { LEGACY_START_DB_SCHEMA_SQL } from "../templates/db-schema.sql.ts";
+import { LEGACY_START_DB_SUPABASE_SQL } from "../templates/db-supabase.sql.ts";
+import { LEGACY_START_DB_WEBHOOK_SQL } from "../templates/db-webhook.sql.ts";
+import { LEGACY_POSTGRES_DEFAULT_ROOT_KEY } from "../../../shared/legacy-local-config-values.ts";
+import {
+  legacyBuildPostgresStartContainerSpec,
+  legacyPostgresImageVersionTag,
+  legacyPostgresSettingsToPostgresConfig,
+  legacyPostgresVersionCompare,
+  type LegacyPostgresStartServiceInput,
+} from "./postgres.service.ts";
+
+const POSTGRES_CONFIG_HEADER = "\n# supabase [db.settings] configuration\n";
+
+function baseDb(overrides: Partial<ProjectConfig["db"]> = {}): ProjectConfig["db"] {
+  return {
+    port: 54322,
+    shadow_port: 54320,
+    health_timeout: "2m",
+    major_version: 17,
+    pooler: {
+      enabled: false,
+      port: 54329,
+      pool_mode: "transaction",
+      default_pool_size: 20,
+      max_client_conn: 100,
+    },
+    migrations: { enabled: true, schema_paths: [] },
+    seed: { enabled: true, sql_paths: [] },
+    settings: {},
+    network_restrictions: { enabled: false, allowed_cidrs: [], allowed_cidrs_v6: [] },
+    ...overrides,
+  };
+}
+
+function baseExperimental(
+  overrides: Partial<ProjectConfig["experimental"]> = {},
+): ProjectConfig["experimental"] {
+  return {
+    webhooks: { enabled: false },
+    pgdelta: { enabled: false },
+    inspect: { rules: [] },
+    ...overrides,
+  };
+}
+
+function baseInput(
+  overrides: Partial<LegacyPostgresStartServiceInput> = {},
+): LegacyPostgresStartServiceInput {
+  return {
+    db: baseDb(),
+    experimental: baseExperimental(),
+    jwtSecret: "super-secret-jwt-token-with-at-least-32-characters-long",
+    jwtExpiry: 3600,
+    projectId: "myproj",
+    networkId: "supabase_network_myproj",
+    image: "public.ecr.aws/supabase/postgres:17.4.1.030",
+    configImage: "supabase/postgres:17.4.1.030",
+    ...overrides,
+  };
+}
+
+describe("legacyBuildPostgresStartContainerSpec", () => {
+  test("PG >= 15: concatenates schema.sql + webhook.sql + _supabase.sql into the schema heredoc, appends the postgres config, and carries the pgsodium root key as a secretFile instead of a heredoc", () => {
+    const spec = legacyBuildPostgresStartContainerSpec(
+      baseInput({ db: baseDb({ major_version: 17 }) }),
+    );
+
+    expect(spec.entrypoint).toBe("sh");
+    const script = spec.cmd?.[1];
+    expect(script).toBe(
+      "\n" +
+        "cat <<'EOF' > /etc/postgresql.schema.sql && \\\n" +
+        "cat <<'EOF' >> /etc/postgresql/postgresql.conf && \\\n" +
+        "docker-entrypoint.sh postgres -D /etc/postgresql \n" +
+        `${LEGACY_START_DB_SCHEMA_SQL}\n` +
+        `${LEGACY_START_DB_WEBHOOK_SQL}\n` +
+        `${LEGACY_START_DB_SUPABASE_SQL}\n` +
+        "EOF\n" +
+        `${POSTGRES_CONFIG_HEADER}\n` +
+        "EOF",
+    );
+    expect(script).not.toContain(LEGACY_POSTGRES_DEFAULT_ROOT_KEY);
+    expect(script).not.toContain("pgsodium_root.key");
+    expect(spec.tmpfs).toBeUndefined();
+    expect(spec.secretFiles).toEqual([
+      {
+        containerPath: "/etc/postgresql-custom/pgsodium_root.key",
+        content: LEGACY_POSTGRES_DEFAULT_ROOT_KEY,
+      },
+    ]);
+  });
+
+  test("PG <= 14: writes only _supabase.sql (no schema.sql/webhook.sql, no pgsodium root key) and sets the initdb tmpfs mount", () => {
+    const spec = legacyBuildPostgresStartContainerSpec(
+      baseInput({ db: baseDb({ major_version: 14 }) }),
+    );
+
+    const script = spec.cmd?.[1];
+    expect(script).toBe(
+      "\n" +
+        "cat <<'EOF' > /docker-entrypoint-initdb.d/supabase_schema.sql && \\\n" +
+        "cat <<'EOF' >> /etc/postgresql/postgresql.conf && \\\n" +
+        "docker-entrypoint.sh postgres -D /etc/postgresql \n" +
+        `${LEGACY_START_DB_SUPABASE_SQL}\n` +
+        "EOF\n" +
+        `${POSTGRES_CONFIG_HEADER}\n` +
+        "EOF",
+    );
+    expect(script).not.toContain("postgresql.schema.sql");
+    expect(script).not.toContain("pgsodium_root.key");
+    expect(spec.tmpfs).toEqual({ "/docker-entrypoint-initdb.d": "" });
+    expect(spec.secretFiles).toBeUndefined();
+  });
+
+  test("uses a rootKey override instead of the Go default when provided", () => {
+    const spec = legacyBuildPostgresStartContainerSpec(
+      baseInput({ db: baseDb({ major_version: 17 }), rootKey: "custom-root-key" }),
+    );
+    expect(spec.secretFiles).toEqual([
+      { containerPath: "/etc/postgresql-custom/pgsodium_root.key", content: "custom-root-key" },
+    ]);
+    expect(spec.cmd?.[1]).not.toContain("custom-root-key");
+    expect(spec.cmd?.[1]).not.toContain(LEGACY_POSTGRES_DEFAULT_ROOT_KEY);
+  });
+
+  test("base env carries password, host, jwt secret, and jwt expiry", () => {
+    const spec = legacyBuildPostgresStartContainerSpec(baseInput());
+    expect(spec.env).toMatchObject({
+      POSTGRES_PASSWORD: "postgres",
+      POSTGRES_HOST: "/var/run/postgresql",
+      JWT_SECRET: "super-secret-jwt-token-with-at-least-32-characters-long",
+      JWT_EXP: "3600",
+    });
+  });
+
+  test("OrioleDB branch: adds POSTGRES_INITDB_ARGS + S3 env vars and skips the version-compare branch", () => {
+    const spec = legacyBuildPostgresStartContainerSpec(
+      baseInput({
+        experimental: baseExperimental({
+          orioledb_version: "17.4.1.030",
+          s3_host: "s3.example.com",
+          s3_region: "us-east-1",
+          s3_access_key: "access-key",
+          s3_secret_key: "secret-key",
+        }),
+        // Old enough to trigger the version-compare branch too, if it weren't skipped.
+        image: "supabase/postgres:orioledb-15.1.0.55",
+      }),
+    );
+    expect(spec.env).toEqual({
+      POSTGRES_PASSWORD: "postgres",
+      POSTGRES_HOST: "/var/run/postgresql",
+      JWT_SECRET: "super-secret-jwt-token-with-at-least-32-characters-long",
+      JWT_EXP: "3600",
+      POSTGRES_INITDB_ARGS: "--lc-collate=C --lc-ctype=C",
+      S3_ENABLED: "true",
+      S3_HOST: "s3.example.com",
+      S3_REGION: "us-east-1",
+      S3_ACCESS_KEY: "access-key",
+      S3_SECRET_KEY: "secret-key",
+    });
+  });
+
+  test("OrioleDB branch defaults unset S3 fields to empty strings, matching Go's zero-value string fields", () => {
+    const spec = legacyBuildPostgresStartContainerSpec(
+      baseInput({ experimental: baseExperimental({ orioledb_version: "17.4.1.030" }) }),
+    );
+    expect(spec.env).toMatchObject({
+      S3_HOST: "",
+      S3_REGION: "",
+      S3_ACCESS_KEY: "",
+      S3_SECRET_KEY: "",
+    });
+  });
+
+  test("version-compare branch: adds POSTGRES_INITDB_ARGS=--lc-collate=C.UTF-8 when the image tag is below the threshold", () => {
+    const spec = legacyBuildPostgresStartContainerSpec(
+      baseInput({
+        image: "public.ecr.aws/supabase/postgres:15.1.0.117",
+        configImage: "supabase/postgres:15.1.0.117",
+      }),
+    );
+    expect(spec.env.POSTGRES_INITDB_ARGS).toBe("--lc-collate=C.UTF-8");
+  });
+
+  test("version-compare branch is skipped when the image tag is at or above the threshold", () => {
+    const atThreshold = legacyBuildPostgresStartContainerSpec(
+      baseInput({
+        image: "public.ecr.aws/supabase/postgres:15.8.1.005",
+        configImage: "supabase/postgres:15.8.1.005",
+      }),
+    );
+    expect(atThreshold.env.POSTGRES_INITDB_ARGS).toBeUndefined();
+
+    const aboveThreshold = legacyBuildPostgresStartContainerSpec(
+      baseInput({
+        image: "public.ecr.aws/supabase/postgres:17.4.1.030",
+        configImage: "supabase/postgres:17.4.1.030",
+      }),
+    );
+    expect(aboveThreshold.env.POSTGRES_INITDB_ARGS).toBeUndefined();
+  });
+
+  test("version-compare branch reads the pre-registry-rewrite configImage, not the registry-resolved image (a port-bearing registry override must not break the tag parse)", () => {
+    const spec = legacyBuildPostgresStartContainerSpec(
+      baseInput({
+        image: "localhost:5000/supabase/postgres:17.4.1.030",
+        configImage: "supabase/postgres:17.4.1.030",
+      }),
+    );
+    expect(spec.env.POSTGRES_INITDB_ARGS).toBeUndefined();
+  });
+
+  test("healthcheck matches Go's pg_isready probe", () => {
+    const spec = legacyBuildPostgresStartContainerSpec(baseInput());
+    expect(spec.healthcheck).toEqual({
+      test: ["CMD", "pg_isready", "-U", "postgres", "-h", "127.0.0.1", "-p", "5432"],
+      intervalSeconds: 10,
+      timeoutSeconds: 2,
+      retries: 3,
+    });
+  });
+
+  test("port binding maps the configured db.port to container port 5432", () => {
+    const spec = legacyBuildPostgresStartContainerSpec(baseInput({ db: baseDb({ port: 12345 }) }));
+    expect(spec.ports).toEqual([{ hostPort: "12345", containerPort: "5432" }]);
+  });
+
+  test("binds a named volume keyed by the container's own (sanitized) name", () => {
+    const spec = legacyBuildPostgresStartContainerSpec(baseInput({ projectId: "my project!" }));
+    expect(spec.containerName).toBe("supabase_db_my_project_");
+    expect(spec.binds).toEqual(["supabase_db_my_project_:/var/lib/postgresql/data"]);
+  });
+
+  test("network id, aliases, restart policy, and image pass through unchanged", () => {
+    const spec = legacyBuildPostgresStartContainerSpec(
+      baseInput({ networkId: "supabase_network_myproj", image: "some/resolved-image:17.4.1.030" }),
+    );
+    expect(spec.networkId).toBe("supabase_network_myproj");
+    expect(spec.networkAliases).toEqual(["db", "db.supabase.internal"]);
+    expect(spec.restartPolicy).toBe("unless-stopped");
+    expect(spec.image).toBe("some/resolved-image:17.4.1.030");
+    expect(spec.labels).toEqual({});
+  });
+});
+
+describe("legacyPostgresSettingsToPostgresConfig", () => {
+  test("only set values appear, in the configured field's TOML form", () => {
+    const config = legacyPostgresSettingsToPostgresConfig({
+      max_connections: 100,
+      max_locks_per_transaction: 64,
+      shared_buffers: "128MB",
+      work_mem: "4MB",
+    });
+    expect(config).toContain("max_connections = 100");
+    expect(config).toContain("max_locks_per_transaction = 64");
+    expect(config).toContain("shared_buffers = '128MB'");
+    expect(config).toContain("work_mem = '4MB'");
+    expect(config).not.toContain("effective_cache_size");
+    expect(config).not.toContain("maintenance_work_mem");
+    expect(config).not.toContain("max_parallel_workers");
+  });
+
+  test("session_replication_role is single-quoted like every other string field", () => {
+    const config = legacyPostgresSettingsToPostgresConfig({ session_replication_role: "origin" });
+    expect(config).toContain("session_replication_role = 'origin'");
+  });
+
+  test("empty settings produce just the header, with no trailing content", () => {
+    const config = legacyPostgresSettingsToPostgresConfig({});
+    expect(config).toBe(POSTGRES_CONFIG_HEADER);
+    expect(config).not.toContain("=");
+  });
+
+  test("a boolean field is emitted unquoted", () => {
+    const config = legacyPostgresSettingsToPostgresConfig({ track_commit_timestamp: true });
+    expect(config).toContain("track_commit_timestamp = true");
+  });
+});
+
+describe("legacyPostgresVersionCompare", () => {
+  test.each([
+    ["15.1.0.55", "15.1.0.55", 0],
+    ["15.8.1.085", "15.1.0.55", 1],
+    ["15.1.0.55", "15.8.1.085", -1],
+    ["17.4.1.005", "17.4.1.005", 0],
+    ["17.4.1.030", "17.4.1.005", 1],
+    ["17.4.1.005", "17.4.1.030", -1],
+    ["15.8.1", "15.8.1", 0],
+    ["17", "15.8", 1],
+    ["14", "15.8", -1],
+    ["oriole-17", "oriole-17", 0],
+    ["17", "oriole-17", 1],
+    ["oriole-17", "17", -1],
+  ] as const)("VersionCompare(%s, %s) === %d", (a, b, expected) => {
+    expect(legacyPostgresVersionCompare(a, b)).toBe(expected);
+  });
+});
+
+describe("legacyPostgresImageVersionTag", () => {
+  test("extracts the tag after the last colon, ignoring any registry host prefix", () => {
+    expect(legacyPostgresImageVersionTag("public.ecr.aws/supabase/postgres:15.1.0.117")).toBe(
+      "15.1.0.117",
+    );
+    expect(legacyPostgresImageVersionTag("supabase/postgres:17.4.1.030")).toBe("17.4.1.030");
+  });
+
+  test("degrades to the whole string when there is no colon at all, matching Go's Image[i+1:] with i=-1", () => {
+    expect(legacyPostgresImageVersionTag("supabase/postgres")).toBe("supabase/postgres");
+  });
+});
diff --git a/apps/cli/src/legacy/commands/start/services/postgrest.service.ts b/apps/cli/src/legacy/commands/start/services/postgrest.service.ts
new file mode 100644
index 0000000000..c935d8a1f1
--- /dev/null
+++ b/apps/cli/src/legacy/commands/start/services/postgrest.service.ts
@@ -0,0 +1,114 @@
+/**
+ * Port of Go's "Start PostgREST" block
+ * (`apps/cli-go/internal/start/start.go:960-992`).
+ *
+ * Enabled gate: `config.api.enabled` (`utils.Config.Api.Enabled`,
+ * `start.go:961`). Gating (this field, plus `!isContainerExcluded`) is the
+ * caller's responsibility — see `start.services.ts`'s `postgrest` catalog
+ * entry (`enabledGate: "api.enabled"`).
+ *
+ * No `Healthcheck` field at all: Go's own `container.Config` literal for this
+ * service (`start.go:964-976`) sets only `Image`/`Env`, with the comment
+ * `// PostgREST does not expose a shell for health check` in place of a
+ * `Healthcheck:` entry — confirmed by reading the struct literal itself, not
+ * just the comment. PostgREST readiness is instead checked at runtime via an
+ * HTTP HEAD through the local Kong gateway
+ * (`legacyCheckHttpReady`/`LEGACY_POSTGREST_READY_PATH`, `../lib/health-check.ts`,
+ * itself porting `status.go:159-229`'s "PostgREST does not support native
+ * health checks" branch) — this builder correctly omits `healthcheck` so
+ * `legacyBuildStartContainerCreateArgs` never emits a `--health-*` flag for
+ * this container, matching `docker-create-args.ts`'s own documented
+ * PostgREST exception.
+ */
+
+import type { ProjectConfig } from "@supabase/config";
+
+import { legacyServiceContainerName } from "../../../shared/legacy-docker-ids.ts";
+import type { LegacyStartContainerSpec } from "../lib/docker-create-args.ts";
+import {
+  legacyStartInternalDbPassword,
+  legacyStartInternalDbUrl,
+} from "../lib/internal-db-connection.ts";
+
+export interface LegacyPostgrestEnvInput {
+  /** `config.api.schemas` — joined with `,` into `PGRST_DB_SCHEMAS`. */
+  readonly schemas: ProjectConfig["api"]["schemas"];
+  /** `config.api.extra_search_path` — joined with `,` into `PGRST_DB_EXTRA_SEARCH_PATH`. */
+  readonly extraSearchPath: ProjectConfig["api"]["extra_search_path"];
+  /** `config.api.max_rows`. */
+  readonly maxRows: ProjectConfig["api"]["max_rows"];
+  /** The `db` container's own Docker name (`legacyServiceContainerName("db", projectId)`). */
+  readonly dbHost: string;
+  /** See `legacyStartInternalDbPassword` (`../lib/internal-db-connection.ts`). */
+  readonly dbPassword: string;
+  /**
+   * `legacyResolveLocalJwks`'s resolved JWKS JSON string — feeds
+   * `PGRST_JWT_SECRET` directly (Go's `fmt.Sprintf("PGRST_JWT_SECRET=%s",
+   * jwks)`, `start.go:972`; despite the env var's name, PostgREST is fed the
+   * JWKS document, not the raw `auth.jwt_secret`).
+   */
+  readonly jwks: string;
+}
+
+/**
+ * Pure env-var builder, split out from
+ * {@link legacyBuildPostgrestContainerSpec} so the full Go `Env` literal
+ * (`start.go:966-973`) is unit-testable without constructing a whole
+ * container spec.
+ */
+export function legacyBuildPostgrestEnv(input: LegacyPostgrestEnvInput): Record<string, string> {
+  return {
+    PGRST_DB_URI: legacyStartInternalDbUrl("authenticator", input.dbHost, input.dbPassword),
+    PGRST_DB_SCHEMAS: input.schemas.join(","),
+    PGRST_DB_EXTRA_SEARCH_PATH: input.extraSearchPath.join(","),
+    PGRST_DB_MAX_ROWS: String(input.maxRows),
+    PGRST_DB_ANON_ROLE: "anon",
+    PGRST_JWT_SECRET: input.jwks,
+    PGRST_ADMIN_SERVER_PORT: "3001",
+  };
+}
+
+export interface LegacyPostgrestContainerSpecInput {
+  /** Go's `Config.ProjectId`, already sanitized — see `legacyServiceContainerName`'s callers. */
+  readonly projectId: string;
+  /** `container.HostConfig.NetworkMode`/`network.NetworkingConfig` target — the `--network-id` override or `utils.NetId`. */
+  readonly networkId: string;
+  /** `utils.Config.Api.Image`, already resolved/pulled by the caller (`image-prepull.ts`). */
+  readonly image: string;
+  readonly schemas: ProjectConfig["api"]["schemas"];
+  readonly extraSearchPath: ProjectConfig["api"]["extra_search_path"];
+  readonly maxRows: ProjectConfig["api"]["max_rows"];
+  /** `LegacyLocalConfigValues.dbUrl` — reused, not recomputed, to derive the internal DB password. */
+  readonly dbUrl: string;
+  readonly jwks: string;
+}
+
+/**
+ * Builds the `docker create` spec for the PostgREST container
+ * (`start.go:960-992`). No `ports`/`exposedPorts` either — Go's
+ * `container.Config` literal for this service declares neither.
+ */
+export function legacyBuildPostgrestContainerSpec(
+  input: LegacyPostgrestContainerSpecInput,
+): LegacyStartContainerSpec {
+  const env = legacyBuildPostgrestEnv({
+    schemas: input.schemas,
+    extraSearchPath: input.extraSearchPath,
+    maxRows: input.maxRows,
+    dbHost: legacyServiceContainerName("db", input.projectId),
+    dbPassword: legacyStartInternalDbPassword(input.dbUrl),
+    jwks: input.jwks,
+  });
+
+  return {
+    image: input.image,
+    containerName: legacyServiceContainerName("rest", input.projectId),
+    env,
+    binds: [],
+    restartPolicy: "unless-stopped",
+    networkId: input.networkId,
+    // `utils.RestAliases = []string{"rest"}` (`utils/config.go:41`).
+    networkAliases: ["rest"],
+    labels: {},
+  };
+}
diff --git a/apps/cli/src/legacy/commands/start/services/postgrest.service.unit.test.ts b/apps/cli/src/legacy/commands/start/services/postgrest.service.unit.test.ts
new file mode 100644
index 0000000000..957b845820
--- /dev/null
+++ b/apps/cli/src/legacy/commands/start/services/postgrest.service.unit.test.ts
@@ -0,0 +1,91 @@
+import { describe, expect, test } from "vitest";
+
+import {
+  legacyBuildPostgrestContainerSpec,
+  legacyBuildPostgrestEnv,
+  type LegacyPostgrestContainerSpecInput,
+} from "./postgrest.service.ts";
+
+describe("legacyBuildPostgrestEnv", () => {
+  const base = {
+    schemas: ["public", "graphql_public"],
+    extraSearchPath: ["public", "extensions"],
+    maxRows: 1000,
+    dbHost: "supabase_db_proj",
+    dbPassword: "postgres",
+    jwks: '{"keys":[]}',
+  };
+
+  test("wires PGRST_DB_URI as the authenticator role against the internal DB address", () => {
+    const env = legacyBuildPostgrestEnv(base);
+    expect(env["PGRST_DB_URI"]).toBe(
+      "postgresql://authenticator:postgres@supabase_db_proj:5432/postgres",
+    );
+  });
+
+  test("joins schemas and extra_search_path with commas", () => {
+    const env = legacyBuildPostgrestEnv(base);
+    expect(env["PGRST_DB_SCHEMAS"]).toBe("public,graphql_public");
+    expect(env["PGRST_DB_EXTRA_SEARCH_PATH"]).toBe("public,extensions");
+  });
+
+  test("feeds the resolved JWKS string into PGRST_JWT_SECRET, not the raw jwt secret", () => {
+    const env = legacyBuildPostgrestEnv({ ...base, jwks: '{"keys":["fake"]}' });
+    expect(env["PGRST_JWT_SECRET"]).toBe('{"keys":["fake"]}');
+  });
+
+  test("matches Go's remaining static env values", () => {
+    const env = legacyBuildPostgrestEnv(base);
+    expect(env).toMatchObject({
+      PGRST_DB_MAX_ROWS: "1000",
+      PGRST_DB_ANON_ROLE: "anon",
+      PGRST_ADMIN_SERVER_PORT: "3001",
+    });
+  });
+});
+
+describe("legacyBuildPostgrestContainerSpec", () => {
+  const input: LegacyPostgrestContainerSpecInput = {
+    projectId: "proj",
+    networkId: "supabase_network_proj",
+    image: "supabase/postgrest:v12",
+    schemas: ["public"],
+    extraSearchPath: ["public"],
+    maxRows: 1000,
+    dbUrl: "postgresql://postgres:postgres@127.0.0.1:54322/postgres",
+    jwks: '{"keys":[]}',
+  };
+
+  test("derives the container name and internal DB host from projectId", () => {
+    const spec = legacyBuildPostgrestContainerSpec(input);
+    expect(spec.containerName).toBe("supabase_rest_proj");
+    expect(spec.env["PGRST_DB_URI"]).toBe(
+      "postgresql://authenticator:postgres@supabase_db_proj:5432/postgres",
+    );
+  });
+
+  test("has no healthcheck, no ports, and no exposedPorts — matching Go's PostgREST container.Config", () => {
+    const spec = legacyBuildPostgrestContainerSpec(input);
+    expect(spec.healthcheck).toBeUndefined();
+    expect(spec.ports).toBeUndefined();
+    expect(spec.exposedPorts).toBeUndefined();
+  });
+
+  test("network alias is 'rest'", () => {
+    const spec = legacyBuildPostgrestContainerSpec(input);
+    expect(spec.networkAliases).toEqual(["rest"]);
+    expect(spec.networkId).toBe("supabase_network_proj");
+    expect(spec.restartPolicy).toBe("unless-stopped");
+    expect(spec.labels).toEqual({});
+  });
+
+  test("reuses (does not recompute) the resolved db password from a non-default dbUrl", () => {
+    const spec = legacyBuildPostgrestContainerSpec({
+      ...input,
+      dbUrl: "postgresql://postgres:another-secret@127.0.0.1:54322/postgres",
+    });
+    expect(spec.env["PGRST_DB_URI"]).toBe(
+      "postgresql://authenticator:another-secret@supabase_db_proj:5432/postgres",
+    );
+  });
+});
diff --git a/apps/cli/src/legacy/commands/start/services/realtime.service.ts b/apps/cli/src/legacy/commands/start/services/realtime.service.ts
new file mode 100644
index 0000000000..1f0571da34
--- /dev/null
+++ b/apps/cli/src/legacy/commands/start/services/realtime.service.ts
@@ -0,0 +1,158 @@
+/**
+ * Port of Go's "Start Realtime" block
+ * (`apps/cli-go/internal/start/start.go:903-958`).
+ *
+ * Enabled gate: `config.realtime.enabled` (`utils.Config.Realtime.Enabled`,
+ * `start.go:904`) — independent of `config.api.enabled` (PostgREST's own
+ * gate, `api.go:961`); the two are never conflated in Go. Gating (this field,
+ * plus `!isContainerExcluded`) is the caller's responsibility — see
+ * `start.services.ts`'s `realtime` catalog entry (`enabledGate:
+ * "realtime.enabled"`) — this module only builds the container spec once
+ * called.
+ */
+
+import type { ProjectConfig } from "@supabase/config";
+
+import { legacyServiceContainerName } from "../../../shared/legacy-docker-ids.ts";
+import type { LegacyStartContainerSpec } from "../lib/docker-create-args.ts";
+import {
+  legacyStartInternalDbPassword,
+  LEGACY_START_INTERNAL_DB_NAME,
+  LEGACY_START_INTERNAL_DB_PORT,
+} from "../lib/internal-db-connection.ts";
+
+/**
+ * Go's `utils.SUPERUSER_ROLE` (`apps/cli-go/internal/utils/connect.go:338`) —
+ * Realtime's fixed `DB_USER` (`start.go:913`). Unrelated to the per-service
+ * role each OTHER container's own DB connection string uses (PostgREST's
+ * `authenticator`, Storage's `supabase_storage_admin`), so it is not hoisted
+ * alongside `legacyStartInternalDbUrl`.
+ */
+const LEGACY_REALTIME_DB_USER = "supabase_admin";
+
+/**
+ * Go's `realtime.TenantId` default (`pkg/config/config.go:481`) — `toml:"-"`
+ * (`config.go:254`), so never configurable via `config.toml` or a
+ * `SUPABASE_*` override; always this literal. Exported: `kong.service.ts`'s
+ * `kong.yml` template needs this exact same value for its `RealtimeId` field
+ * (Go's `Config.Realtime.TenantId`, `start.go:492` — NOT Realtime's own
+ * container name/id, see that module's `realtimeTenantId` doc comment).
+ */
+export const LEGACY_REALTIME_TENANT_ID = "realtime-dev";
+
+/** Go's `realtime.EncryptionKey` default (`pkg/config/config.go:482`) — `toml:"-"`, never configurable. */
+const LEGACY_REALTIME_ENCRYPTION_KEY = "supabaserealtime";
+
+/** Go's `realtime.SecretKeyBase` default (`pkg/config/config.go:483`) — `toml:"-"`, never configurable. */
+const LEGACY_REALTIME_SECRET_KEY_BASE =
+  "EAx3IQ/wRG1v47ZD4NE4/9RzBI8Jmil3x0yhcW4V2NHBP6c2iPIzwjofi2Ep4HIG";
+
+export interface LegacyRealtimeEnvInput {
+  /** `config.realtime.ip_version` — feeds `utils.ToRealtimeEnv` (`utils/config.go:209-214`). */
+  readonly ipVersion: ProjectConfig["realtime"]["ip_version"];
+  /** `config.realtime.max_header_length`. */
+  readonly maxHeaderLength: ProjectConfig["realtime"]["max_header_length"];
+  /** The `db` container's own Docker name (`legacyServiceContainerName("db", projectId)`). */
+  readonly dbHost: string;
+  /** See {@link legacyStartInternalDbPassword}. */
+  readonly dbPassword: string;
+  /** `LegacyLocalConfigValues.jwtSecret` — feeds both `API_JWT_SECRET` and `METRICS_JWT_SECRET`. */
+  readonly jwtSecret: string;
+  /** `legacyResolveLocalJwks`'s resolved JWKS JSON string — feeds `API_JWT_JWKS`. */
+  readonly jwks: string;
+}
+
+/**
+ * Pure env-var builder, split out from {@link legacyBuildRealtimeContainerSpec}
+ * so the full Go `Env` literal (`start.go:909-929`) is unit-testable without
+ * constructing a whole container spec.
+ */
+export function legacyBuildRealtimeEnv(input: LegacyRealtimeEnvInput): Record<string, string> {
+  return {
+    PORT: "4000",
+    DB_HOST: input.dbHost,
+    DB_PORT: String(LEGACY_START_INTERNAL_DB_PORT),
+    DB_USER: LEGACY_REALTIME_DB_USER,
+    DB_PASSWORD: input.dbPassword,
+    DB_NAME: LEGACY_START_INTERNAL_DB_NAME,
+    DB_AFTER_CONNECT_QUERY: "SET search_path TO _realtime",
+    DB_ENC_KEY: LEGACY_REALTIME_ENCRYPTION_KEY,
+    API_JWT_SECRET: input.jwtSecret,
+    API_JWT_JWKS: input.jwks,
+    METRICS_JWT_SECRET: input.jwtSecret,
+    APP_NAME: "realtime",
+    SECRET_KEY_BASE: LEGACY_REALTIME_SECRET_KEY_BASE,
+    ERL_AFLAGS: input.ipVersion === "IPv6" ? "-proto_dist inet6_tcp" : "-proto_dist inet_tcp",
+    // Two literal single-quote characters, exactly like Go's `"DNS_NODES=''"` (`start.go:924`).
+    DNS_NODES: "''",
+    RLIMIT_NOFILE: "",
+    SEED_SELF_HOST: "true",
+    RUN_JANITOR: "true",
+    MAX_HEADER_LENGTH: String(input.maxHeaderLength),
+  };
+}
+
+export interface LegacyRealtimeContainerSpecInput {
+  /** Go's `Config.ProjectId`, already sanitized — see `legacyServiceContainerName`'s callers. */
+  readonly projectId: string;
+  /** `container.HostConfig.NetworkMode`/`network.NetworkingConfig` target — the `--network-id` override or `utils.NetId`. */
+  readonly networkId: string;
+  /** `utils.Config.Realtime.Image`, already resolved/pulled by the caller (`image-prepull.ts`). */
+  readonly image: string;
+  readonly ipVersion: ProjectConfig["realtime"]["ip_version"];
+  readonly maxHeaderLength: ProjectConfig["realtime"]["max_header_length"];
+  /** `LegacyLocalConfigValues.dbUrl` — reused, not recomputed, to derive the internal DB password. */
+  readonly dbUrl: string;
+  readonly jwtSecret: string;
+  readonly jwks: string;
+}
+
+/**
+ * Builds the `docker create` spec for the Realtime container
+ * (`start.go:903-958`). No `ports` (host-published) entry — Realtime, like
+ * GoTrue, only ever `ExposedPorts` its port on the Docker network
+ * (`nat.PortSet{"4000/tcp": {}}`, `start.go:930`).
+ */
+export function legacyBuildRealtimeContainerSpec(
+  input: LegacyRealtimeContainerSpecInput,
+): LegacyStartContainerSpec {
+  const env = legacyBuildRealtimeEnv({
+    ipVersion: input.ipVersion,
+    maxHeaderLength: input.maxHeaderLength,
+    dbHost: legacyServiceContainerName("db", input.projectId),
+    dbPassword: legacyStartInternalDbPassword(input.dbUrl),
+    jwtSecret: input.jwtSecret,
+    jwks: input.jwks,
+  });
+
+  return {
+    image: input.image,
+    containerName: legacyServiceContainerName("realtime", input.projectId),
+    env,
+    binds: [],
+    exposedPorts: [{ containerPort: "4000" }],
+    healthcheck: {
+      // Podman splits command by spaces unless quoted, but curl's header can't be quoted
+      // (`start.go:932`, reproduced verbatim as this exec-form `test` array).
+      test: [
+        "CMD",
+        "curl",
+        "-sSfL",
+        "--head",
+        "-o",
+        "/dev/null",
+        "-H",
+        `Host:${LEGACY_REALTIME_TENANT_ID}`,
+        "http://127.0.0.1:4000/api/ping",
+      ],
+      intervalSeconds: 10,
+      timeoutSeconds: 2,
+      retries: 3,
+    },
+    restartPolicy: "unless-stopped",
+    networkId: input.networkId,
+    // `utils.RealtimeAliases = []string{"realtime", Config.Realtime.TenantId}` (`utils/config.go:40`).
+    networkAliases: ["realtime", LEGACY_REALTIME_TENANT_ID],
+    labels: {},
+  };
+}
diff --git a/apps/cli/src/legacy/commands/start/services/realtime.service.unit.test.ts b/apps/cli/src/legacy/commands/start/services/realtime.service.unit.test.ts
new file mode 100644
index 0000000000..dfbf24b95d
--- /dev/null
+++ b/apps/cli/src/legacy/commands/start/services/realtime.service.unit.test.ts
@@ -0,0 +1,120 @@
+import { describe, expect, test } from "vitest";
+
+import {
+  legacyBuildRealtimeContainerSpec,
+  legacyBuildRealtimeEnv,
+  type LegacyRealtimeContainerSpecInput,
+} from "./realtime.service.ts";
+
+describe("legacyBuildRealtimeEnv", () => {
+  const base = {
+    ipVersion: "IPv4" as const,
+    maxHeaderLength: 4096,
+    dbHost: "supabase_db_proj",
+    dbPassword: "postgres",
+    jwtSecret: "super-secret-jwt-token-with-at-least-32-characters-long",
+    jwks: '{"keys":[]}',
+  };
+
+  test("wires the fixed internal DB address, JWT secret, and JWKS", () => {
+    const env = legacyBuildRealtimeEnv(base);
+    expect(env["DB_HOST"]).toBe("supabase_db_proj");
+    expect(env["DB_PORT"]).toBe("5432");
+    expect(env["DB_USER"]).toBe("supabase_admin");
+    expect(env["DB_PASSWORD"]).toBe("postgres");
+    expect(env["DB_NAME"]).toBe("postgres");
+    expect(env["API_JWT_SECRET"]).toBe(base.jwtSecret);
+    expect(env["METRICS_JWT_SECRET"]).toBe(base.jwtSecret);
+    expect(env["API_JWT_JWKS"]).toBe(base.jwks);
+  });
+
+  test("matches Go's remaining static env values", () => {
+    const env = legacyBuildRealtimeEnv(base);
+    expect(env).toMatchObject({
+      PORT: "4000",
+      DB_AFTER_CONNECT_QUERY: "SET search_path TO _realtime",
+      DB_ENC_KEY: "supabaserealtime",
+      APP_NAME: "realtime",
+      SECRET_KEY_BASE: "EAx3IQ/wRG1v47ZD4NE4/9RzBI8Jmil3x0yhcW4V2NHBP6c2iPIzwjofi2Ep4HIG",
+      DNS_NODES: "''",
+      RLIMIT_NOFILE: "",
+      SEED_SELF_HOST: "true",
+      RUN_JANITOR: "true",
+      MAX_HEADER_LENGTH: "4096",
+    });
+  });
+
+  test("selects inet_tcp for IPv4", () => {
+    expect(legacyBuildRealtimeEnv({ ...base, ipVersion: "IPv4" })["ERL_AFLAGS"]).toBe(
+      "-proto_dist inet_tcp",
+    );
+  });
+
+  test("selects inet6_tcp for IPv6", () => {
+    expect(legacyBuildRealtimeEnv({ ...base, ipVersion: "IPv6" })["ERL_AFLAGS"]).toBe(
+      "-proto_dist inet6_tcp",
+    );
+  });
+});
+
+describe("legacyBuildRealtimeContainerSpec", () => {
+  const input: LegacyRealtimeContainerSpecInput = {
+    projectId: "proj",
+    networkId: "supabase_network_proj",
+    image: "supabase/realtime:v2",
+    ipVersion: "IPv4",
+    maxHeaderLength: 4096,
+    dbUrl: "postgresql://postgres:postgres@127.0.0.1:54322/postgres",
+    jwtSecret: "super-secret-jwt-token-with-at-least-32-characters-long",
+    jwks: '{"keys":[]}',
+  };
+
+  test("derives the container name and internal DB host from projectId", () => {
+    const spec = legacyBuildRealtimeContainerSpec(input);
+    expect(spec.containerName).toBe("supabase_realtime_proj");
+    expect(spec.env["DB_HOST"]).toBe("supabase_db_proj");
+    expect(spec.env["DB_PASSWORD"]).toBe("postgres");
+  });
+
+  test("exposes port 4000 with no host-published port binding", () => {
+    const spec = legacyBuildRealtimeContainerSpec(input);
+    expect(spec.exposedPorts).toEqual([{ containerPort: "4000" }]);
+    expect(spec.ports).toBeUndefined();
+  });
+
+  test("builds the exec-form healthcheck with the tenant id host header", () => {
+    const spec = legacyBuildRealtimeContainerSpec(input);
+    expect(spec.healthcheck).toEqual({
+      test: [
+        "CMD",
+        "curl",
+        "-sSfL",
+        "--head",
+        "-o",
+        "/dev/null",
+        "-H",
+        "Host:realtime-dev",
+        "http://127.0.0.1:4000/api/ping",
+      ],
+      intervalSeconds: 10,
+      timeoutSeconds: 2,
+      retries: 3,
+    });
+  });
+
+  test("network aliases are 'realtime' and the tenant id", () => {
+    const spec = legacyBuildRealtimeContainerSpec(input);
+    expect(spec.networkAliases).toEqual(["realtime", "realtime-dev"]);
+    expect(spec.networkId).toBe("supabase_network_proj");
+    expect(spec.restartPolicy).toBe("unless-stopped");
+    expect(spec.labels).toEqual({});
+  });
+
+  test("reuses (does not recompute) the resolved db password from a non-default dbUrl", () => {
+    const spec = legacyBuildRealtimeContainerSpec({
+      ...input,
+      dbUrl: "postgresql://postgres:another-secret@127.0.0.1:54322/postgres",
+    });
+    expect(spec.env["DB_PASSWORD"]).toBe("another-secret");
+  });
+});
diff --git a/apps/cli/src/legacy/commands/start/services/storage.service.ts b/apps/cli/src/legacy/commands/start/services/storage.service.ts
new file mode 100644
index 0000000000..439a465b9e
--- /dev/null
+++ b/apps/cli/src/legacy/commands/start/services/storage.service.ts
@@ -0,0 +1,266 @@
+/**
+ * Port of Go's "Start Storage" block
+ * (`apps/cli-go/internal/start/start.go:994-1057`), plus the vector-bucket
+ * env helper `appendStorageVectorEnv` (`start.go:1487-1501`).
+ *
+ * Enabled gate: `isStorageEnabled` (`start.go:301`) —
+ * `config.storage.enabled && !isContainerExcluded(storageImage, excluded)`.
+ * Gating itself is the caller's responsibility (`start.services.ts`'s
+ * `storage` catalog entry, `enabledGate: "storage.enabled"`); this module
+ * only builds the container spec once called.
+ *
+ * `imageTransformationEnabled` (below) is Go's `isImgProxyEnabled` — a
+ * COMPOUND value (`storage.enabled` is already implied by the fact Storage
+ * itself is starting) `&& config.storage.image_transformation?.enabled &&
+ * !isContainerExcluded(imgproxyImage, excluded)` (`start.go:302-303`), NOT
+ * the bare `config.storage.image_transformation?.enabled` field alone. The
+ * caller must compute this compound boolean exactly once and pass the SAME
+ * value both here (`ENABLE_IMAGE_TRANSFORMATION`) and to the decision of
+ * whether to actually start the ImgProxy container
+ * (`imgproxy.service.ts`'s `legacyBuildImgproxyContainerSpec` precondition)
+ * — the two must never disagree, matching Go's single shared
+ * `isImgProxyEnabled` local variable (`start.go:995,1011,1060`).
+ *
+ * `s3ProtocolEnabled` is `config.storage.s3_protocol.enabled` directly (no
+ * exclusion factor — S3 protocol support is a Storage feature flag, not a
+ * separate container). Go models `S3Protocol` as a nilable pointer
+ * (`*s3Protocol`, `pkg/config/storage.go:17`) that stays `nil` only when
+ * `[storage.s3_protocol]` is entirely absent from BOTH the user's
+ * `config.toml` and the embedded default template — but the embedded
+ * template always sets `[storage.s3_protocol]\nenabled = true`
+ * (`pkg/config/templates/config.toml:128-129`) and is merged in as the base
+ * layer before any real config loads, so `S3Protocol` is non-nil for every
+ * config `Config.Load` actually produces. `@supabase/config`'s schema
+ * mirrors this by decoding `storage.s3_protocol` unconditionally (never
+ * `optionalKey`, unlike `image_transformation`), so the raw decoded boolean
+ * needs no extra PRESENCE check — but the caller is still responsible for
+ * applying `SUPABASE_STORAGE_S3_PROTOCOL_ENABLED`/`SUPABASE_STORAGE_VECTOR_
+ * ENABLED` (Go's generic Viper `AutomaticEnv` override, same mechanism
+ * `imageTransformationEnabled`'s own compound gate already accounts for)
+ * before passing `s3ProtocolEnabled`/`vectorBucketsEnabled` in.
+ */
+
+import type { ProjectConfig } from "@supabase/config";
+
+import { legacyServiceContainerName } from "../../../shared/legacy-docker-ids.ts";
+import { ramInBytes } from "../../../shared/legacy-size-units.ts";
+import type { LegacyStartContainerSpec } from "../lib/docker-create-args.ts";
+import { legacyEnvOrDefault } from "../lib/legacy-env-or-default.ts";
+import {
+  legacyStartInternalDbUrl,
+  legacyStartInternalDbPassword,
+} from "../lib/internal-db-connection.ts";
+
+/** Go's `dockerStoragePath` local (`start.go:996`) — both the container's `FILE_STORAGE_BACKEND_PATH` and its named-volume mount target. */
+const LEGACY_STORAGE_DOCKER_PATH = "/mnt";
+
+export interface LegacyStorageVectorEnvInput {
+  /** The `db` container's own Docker name (`legacyServiceContainerName("db", projectId)`). */
+  readonly dbHost: string;
+  /** See `legacyStartInternalDbPassword` (`../lib/internal-db-connection.ts`). */
+  readonly dbPassword: string;
+  readonly projectEnvValues?: Readonly<Record<string, string>>;
+}
+
+/**
+ * Port of `appendStorageVectorEnv(env []string, dbConfig pgconn.Config)
+ * []string` (`start.go:1473-1501`). Only called when
+ * `config.storage.vector.enabled` (Go's `isVectorBucketsEnabled`,
+ * `start.go:305,1022-1024`) — note the TOML key is `[storage.vector]`, not
+ * `vector_buckets`; Go's Go-side struct field is named `VectorBuckets` but
+ * tagged `toml:"vector"` (`pkg/config/storage.go:21`).
+ */
+export function legacyAppendStorageVectorEnv(
+  env: Readonly<Record<string, string>>,
+  input: LegacyStorageVectorEnvInput,
+): Record<string, string> {
+  const defaultVectorUrl = legacyStartInternalDbUrl("postgres", input.dbHost, input.dbPassword);
+  return {
+    ...env,
+    VECTOR_ENABLED: legacyEnvOrDefault("VECTOR_ENABLED", "true", input.projectEnvValues),
+    VECTOR_BUCKET_PROVIDER: legacyEnvOrDefault(
+      "VECTOR_BUCKET_PROVIDER",
+      "pgvector",
+      input.projectEnvValues,
+    ),
+    VECTOR_STORE_MIGRATIONS_ENABLED: legacyEnvOrDefault(
+      "VECTOR_STORE_MIGRATIONS_ENABLED",
+      "true",
+      input.projectEnvValues,
+    ),
+    VECTOR_DATABASE_URL: legacyEnvOrDefault(
+      "VECTOR_DATABASE_URL",
+      defaultVectorUrl,
+      input.projectEnvValues,
+    ),
+  };
+}
+
+export interface LegacyStorageEnvInput {
+  /**
+   * Go's `utils.Config.Storage.TargetMigration` (`pkg/config/storage.go:13`) —
+   * `toml:"-"`, resolved from a version-pin file
+   * (`builder.StorageMigrationPath`, `config.go:844-846`), not from
+   * `@supabase/config`'s schema. Out of scope for this builder (like `image`);
+   * the caller resolves it and typically passes `""` when the file is absent,
+   * matching Go's zero-value string default.
+   */
+  readonly targetMigration: string;
+  /** `LegacyLocalConfigValues.anonKey`. */
+  readonly anonKey: string;
+  /** `LegacyLocalConfigValues.serviceRoleKey`. */
+  readonly serviceRoleKey: string;
+  /** `LegacyLocalConfigValues.jwtSecret`. */
+  readonly jwtSecret: string;
+  /** `legacyResolveLocalJwks`'s resolved JWKS JSON string. */
+  readonly jwks: string;
+  /** The `db` container's own Docker name (`legacyServiceContainerName("db", projectId)`). */
+  readonly dbHost: string;
+  /** See `legacyStartInternalDbPassword` (`../lib/internal-db-connection.ts`). */
+  readonly dbPassword: string;
+  /** `config.storage.file_size_limit`, e.g. `"50MiB"` — converted to a byte count via `ramInBytes`. */
+  readonly fileSizeLimit: ProjectConfig["storage"]["file_size_limit"];
+  /** `LegacyLocalConfigValues.storageS3Region`. */
+  readonly s3Region: string;
+  /** `LegacyLocalConfigValues.storageS3AccessKeyId`. */
+  readonly s3AccessKeyId: string;
+  /** `LegacyLocalConfigValues.storageS3SecretAccessKey`. */
+  readonly s3SecretAccessKey: string;
+  /** Go's compound `isImgProxyEnabled` — see this file's header for why this is NOT the bare config field. */
+  readonly imageTransformationEnabled: boolean;
+  /** The ImgProxy container's own Docker name (`legacyServiceContainerName("imgproxy", projectId)`). */
+  readonly imgproxyHost: string;
+  /** `config.storage.s3_protocol.enabled` — see this file's header for why no extra presence check is needed. */
+  readonly s3ProtocolEnabled: boolean;
+  /** `config.storage.vector.enabled` (Go's `isVectorBucketsEnabled`). */
+  readonly vectorBucketsEnabled: boolean;
+  readonly projectEnvValues?: Readonly<Record<string, string>>;
+}
+
+/**
+ * Pure env-var builder, split out from {@link legacyBuildStorageContainerSpec}
+ * so the full Go `storageEnv` literal (`start.go:997-1021`) — including the
+ * conditional vector-bucket branch — is unit-testable without constructing a
+ * whole container spec.
+ */
+export function legacyBuildStorageEnv(input: LegacyStorageEnvInput): Record<string, string> {
+  const env: Record<string, string> = {
+    DB_MIGRATIONS_FREEZE_AT: input.targetMigration,
+    ANON_KEY: input.anonKey,
+    SERVICE_KEY: input.serviceRoleKey,
+    AUTH_JWT_SECRET: input.jwtSecret,
+    JWT_JWKS: input.jwks,
+    DATABASE_URL: legacyStartInternalDbUrl(
+      "supabase_storage_admin",
+      input.dbHost,
+      input.dbPassword,
+    ),
+    FILE_SIZE_LIMIT: String(ramInBytes(input.fileSizeLimit)),
+    STORAGE_BACKEND: "file",
+    FILE_STORAGE_BACKEND_PATH: LEGACY_STORAGE_DOCKER_PATH,
+    TENANT_ID: "stub",
+    // TODO (matches Go's own TODO, `start.go:1008`): https://github.com/supabase/storage-api/issues/55
+    STORAGE_S3_REGION: input.s3Region,
+    GLOBAL_S3_BUCKET: "stub",
+    ENABLE_IMAGE_TRANSFORMATION: String(input.imageTransformationEnabled),
+    IMGPROXY_URL: `http://${input.imgproxyHost}:5001`,
+    TUS_URL_PATH: "/storage/v1/upload/resumable",
+    S3_PROTOCOL_ENABLED: String(input.s3ProtocolEnabled),
+    S3_PROTOCOL_ACCESS_KEY_ID: input.s3AccessKeyId,
+    S3_PROTOCOL_ACCESS_KEY_SECRET: input.s3SecretAccessKey,
+    S3_PROTOCOL_PREFIX: "/storage/v1",
+    UPLOAD_FILE_SIZE_LIMIT: "52428800000",
+    UPLOAD_FILE_SIZE_LIMIT_STANDARD: "5242880000",
+    SIGNED_UPLOAD_URL_EXPIRATION_TIME: "7200",
+  };
+
+  return input.vectorBucketsEnabled
+    ? legacyAppendStorageVectorEnv(env, {
+        dbHost: input.dbHost,
+        dbPassword: input.dbPassword,
+        projectEnvValues: input.projectEnvValues,
+      })
+    : env;
+}
+
+export interface LegacyStorageContainerSpecInput {
+  /** Go's `Config.ProjectId`, already sanitized — see `legacyServiceContainerName`'s callers. */
+  readonly projectId: string;
+  /** `container.HostConfig.NetworkMode`/`network.NetworkingConfig` target — the `--network-id` override or `utils.NetId`. */
+  readonly networkId: string;
+  /** `utils.Config.Storage.Image`, already resolved/pulled by the caller (`image-prepull.ts`). */
+  readonly image: string;
+  readonly targetMigration: string;
+  readonly fileSizeLimit: ProjectConfig["storage"]["file_size_limit"];
+  readonly s3Region: string;
+  readonly s3AccessKeyId: string;
+  readonly s3SecretAccessKey: string;
+  readonly s3ProtocolEnabled: boolean;
+  readonly imageTransformationEnabled: boolean;
+  readonly vectorBucketsEnabled: boolean;
+  /** `LegacyLocalConfigValues.dbUrl` — reused, not recomputed, to derive the internal DB password. */
+  readonly dbUrl: string;
+  readonly jwtSecret: string;
+  readonly jwks: string;
+  readonly anonKey: string;
+  readonly serviceRoleKey: string;
+  readonly projectEnvValues?: Readonly<Record<string, string>>;
+}
+
+/**
+ * Builds the `docker create` spec for the Storage container
+ * (`start.go:994-1057`). `binds` mounts the container's own named volume at
+ * `/mnt` (`container.HostConfig.Binds: []string{utils.StorageId + ":" +
+ * dockerStoragePath}`, `start.go:1043`) — no `ports`/`exposedPorts`, Storage
+ * is reached only via its Docker network alias.
+ */
+export function legacyBuildStorageContainerSpec(
+  input: LegacyStorageContainerSpecInput,
+): LegacyStartContainerSpec {
+  const containerName = legacyServiceContainerName("storage", input.projectId);
+  const env = legacyBuildStorageEnv({
+    targetMigration: input.targetMigration,
+    anonKey: input.anonKey,
+    serviceRoleKey: input.serviceRoleKey,
+    jwtSecret: input.jwtSecret,
+    jwks: input.jwks,
+    dbHost: legacyServiceContainerName("db", input.projectId),
+    dbPassword: legacyStartInternalDbPassword(input.dbUrl),
+    fileSizeLimit: input.fileSizeLimit,
+    s3Region: input.s3Region,
+    s3AccessKeyId: input.s3AccessKeyId,
+    s3SecretAccessKey: input.s3SecretAccessKey,
+    imageTransformationEnabled: input.imageTransformationEnabled,
+    imgproxyHost: legacyServiceContainerName("imgproxy", input.projectId),
+    s3ProtocolEnabled: input.s3ProtocolEnabled,
+    vectorBucketsEnabled: input.vectorBucketsEnabled,
+    projectEnvValues: input.projectEnvValues,
+  });
+
+  return {
+    image: input.image,
+    containerName,
+    env,
+    binds: [`${containerName}:${LEGACY_STORAGE_DOCKER_PATH}`],
+    healthcheck: {
+      // "For some reason, localhost resolves to IPv6 address on GitPod which breaks
+      // healthcheck." (`start.go:1031`) — reproduced verbatim, IPv4 loopback pinned.
+      test: [
+        "CMD",
+        "wget",
+        "--no-verbose",
+        "--tries=1",
+        "--spider",
+        "http://127.0.0.1:5000/status",
+      ],
+      intervalSeconds: 10,
+      timeoutSeconds: 2,
+      retries: 3,
+    },
+    restartPolicy: "unless-stopped",
+    networkId: input.networkId,
+    // `utils.StorageAliases = []string{"storage"}` (`utils/config.go:42`).
+    networkAliases: ["storage"],
+    labels: {},
+  };
+}
diff --git a/apps/cli/src/legacy/commands/start/services/storage.service.unit.test.ts b/apps/cli/src/legacy/commands/start/services/storage.service.unit.test.ts
new file mode 100644
index 0000000000..0efe020753
--- /dev/null
+++ b/apps/cli/src/legacy/commands/start/services/storage.service.unit.test.ts
@@ -0,0 +1,256 @@
+import { describe, expect, test } from "vitest";
+
+import {
+  legacyAppendStorageVectorEnv,
+  legacyBuildStorageContainerSpec,
+  legacyBuildStorageEnv,
+  type LegacyStorageContainerSpecInput,
+  type LegacyStorageEnvInput,
+} from "./storage.service.ts";
+
+const baseEnvInput: LegacyStorageEnvInput = {
+  targetMigration: "",
+  anonKey: "anon-key",
+  serviceRoleKey: "service-role-key",
+  jwtSecret: "super-secret-jwt-token-with-at-least-32-characters-long",
+  jwks: '{"keys":[]}',
+  dbHost: "supabase_db_proj",
+  dbPassword: "postgres",
+  fileSizeLimit: "50MiB",
+  s3Region: "local",
+  s3AccessKeyId: "625729a08b95bf1b7ff351a663f3a23c",
+  s3SecretAccessKey: "850181e4652dd023b7a98c58ae0d2d34bd487ee0cc3254aed6eda37307425907",
+  imageTransformationEnabled: false,
+  imgproxyHost: "supabase_imgproxy_proj",
+  s3ProtocolEnabled: true,
+  vectorBucketsEnabled: false,
+};
+
+describe("legacyBuildStorageEnv", () => {
+  test("wires the resolved auth keys, JWT secret, and JWKS", () => {
+    const env = legacyBuildStorageEnv(baseEnvInput);
+    expect(env["ANON_KEY"]).toBe("anon-key");
+    expect(env["SERVICE_KEY"]).toBe("service-role-key");
+    expect(env["AUTH_JWT_SECRET"]).toBe(baseEnvInput.jwtSecret);
+    expect(env["JWT_JWKS"]).toBe(baseEnvInput.jwks);
+  });
+
+  test("wires DATABASE_URL as the supabase_storage_admin role against the internal DB address", () => {
+    const env = legacyBuildStorageEnv(baseEnvInput);
+    expect(env["DATABASE_URL"]).toBe(
+      "postgresql://supabase_storage_admin:postgres@supabase_db_proj:5432/postgres",
+    );
+  });
+
+  test("wires the resolved S3 credentials, not hardcoded literals", () => {
+    const env = legacyBuildStorageEnv({
+      ...baseEnvInput,
+      s3AccessKeyId: "custom-access-key",
+      s3SecretAccessKey: "custom-secret-key",
+      s3Region: "custom-region",
+    });
+    expect(env["S3_PROTOCOL_ACCESS_KEY_ID"]).toBe("custom-access-key");
+    expect(env["S3_PROTOCOL_ACCESS_KEY_SECRET"]).toBe("custom-secret-key");
+    expect(env["STORAGE_S3_REGION"]).toBe("custom-region");
+  });
+
+  test("converts file_size_limit from a human-readable string to a byte count", () => {
+    const env = legacyBuildStorageEnv({ ...baseEnvInput, fileSizeLimit: "5MiB" });
+    expect(env["FILE_SIZE_LIMIT"]).toBe(String(5 * 1024 * 1024));
+  });
+
+  test("matches Go's remaining static env values", () => {
+    const env = legacyBuildStorageEnv(baseEnvInput);
+    expect(env).toMatchObject({
+      STORAGE_BACKEND: "file",
+      FILE_STORAGE_BACKEND_PATH: "/mnt",
+      TENANT_ID: "stub",
+      GLOBAL_S3_BUCKET: "stub",
+      TUS_URL_PATH: "/storage/v1/upload/resumable",
+      S3_PROTOCOL_PREFIX: "/storage/v1",
+      UPLOAD_FILE_SIZE_LIMIT: "52428800000",
+      UPLOAD_FILE_SIZE_LIMIT_STANDARD: "5242880000",
+      SIGNED_UPLOAD_URL_EXPIRATION_TIME: "7200",
+    });
+  });
+
+  describe("image-transformation / ImgProxy gate", () => {
+    test("ENABLE_IMAGE_TRANSFORMATION and IMGPROXY_URL reflect the caller-resolved compound flag", () => {
+      const disabled = legacyBuildStorageEnv({
+        ...baseEnvInput,
+        imageTransformationEnabled: false,
+      });
+      expect(disabled["ENABLE_IMAGE_TRANSFORMATION"]).toBe("false");
+
+      const enabled = legacyBuildStorageEnv({ ...baseEnvInput, imageTransformationEnabled: true });
+      expect(enabled["ENABLE_IMAGE_TRANSFORMATION"]).toBe("true");
+    });
+
+    test("IMGPROXY_URL always points at the imgproxy container regardless of the gate", () => {
+      const env = legacyBuildStorageEnv(baseEnvInput);
+      expect(env["IMGPROXY_URL"]).toBe("http://supabase_imgproxy_proj:5001");
+    });
+  });
+
+  describe("S3 protocol gate", () => {
+    test("S3_PROTOCOL_ENABLED reflects config.storage.s3_protocol.enabled directly", () => {
+      expect(
+        legacyBuildStorageEnv({ ...baseEnvInput, s3ProtocolEnabled: true })["S3_PROTOCOL_ENABLED"],
+      ).toBe("true");
+      expect(
+        legacyBuildStorageEnv({ ...baseEnvInput, s3ProtocolEnabled: false })["S3_PROTOCOL_ENABLED"],
+      ).toBe("false");
+    });
+  });
+
+  describe("vector-buckets env branch", () => {
+    test("omits every VECTOR_* key when vectorBucketsEnabled is false", () => {
+      const env = legacyBuildStorageEnv({ ...baseEnvInput, vectorBucketsEnabled: false });
+      expect(env["VECTOR_ENABLED"]).toBeUndefined();
+      expect(env["VECTOR_BUCKET_PROVIDER"]).toBeUndefined();
+      expect(env["VECTOR_STORE_MIGRATIONS_ENABLED"]).toBeUndefined();
+      expect(env["VECTOR_DATABASE_URL"]).toBeUndefined();
+    });
+
+    test("appends the four VECTOR_* keys with Go's defaults when enabled and no override is set", () => {
+      const env = legacyBuildStorageEnv({ ...baseEnvInput, vectorBucketsEnabled: true });
+      expect(env["VECTOR_ENABLED"]).toBe("true");
+      expect(env["VECTOR_BUCKET_PROVIDER"]).toBe("pgvector");
+      expect(env["VECTOR_STORE_MIGRATIONS_ENABLED"]).toBe("true");
+      expect(env["VECTOR_DATABASE_URL"]).toBe(
+        "postgresql://postgres:postgres@supabase_db_proj:5432/postgres",
+      );
+    });
+
+    test("VECTOR_DATABASE_URL defaults to the postgres role, distinct from DATABASE_URL's storage_admin role", () => {
+      const env = legacyBuildStorageEnv({ ...baseEnvInput, vectorBucketsEnabled: true });
+      expect(env["VECTOR_DATABASE_URL"]).not.toBe(env["DATABASE_URL"]);
+      expect(env["VECTOR_DATABASE_URL"]).toContain("postgres:postgres@");
+      expect(env["DATABASE_URL"]).toContain("supabase_storage_admin:postgres@");
+    });
+
+    test("respects a projectEnvValues override over the default, matching Go's envOrDefault", () => {
+      const env = legacyBuildStorageEnv({
+        ...baseEnvInput,
+        vectorBucketsEnabled: true,
+        projectEnvValues: { VECTOR_ENABLED: "false", VECTOR_BUCKET_PROVIDER: "custom" },
+      });
+      expect(env["VECTOR_ENABLED"]).toBe("false");
+      expect(env["VECTOR_BUCKET_PROVIDER"]).toBe("custom");
+      // Unoverridden keys still fall back to Go's defaults.
+      expect(env["VECTOR_STORE_MIGRATIONS_ENABLED"]).toBe("true");
+    });
+
+    test("an override that is set but empty is used verbatim, matching os.LookupEnv (not treated as unset)", () => {
+      const env = legacyBuildStorageEnv({
+        ...baseEnvInput,
+        vectorBucketsEnabled: true,
+        projectEnvValues: { VECTOR_BUCKET_PROVIDER: "" },
+      });
+      expect(env["VECTOR_BUCKET_PROVIDER"]).toBe("");
+    });
+  });
+});
+
+describe("legacyAppendStorageVectorEnv", () => {
+  test("preserves the base env and appends the four vector keys", () => {
+    const base = { EXISTING_KEY: "unchanged" };
+    const appended = legacyAppendStorageVectorEnv(base, {
+      dbHost: "supabase_db_proj",
+      dbPassword: "postgres",
+    });
+    expect(appended["EXISTING_KEY"]).toBe("unchanged");
+    expect(Object.keys(appended)).toEqual(
+      expect.arrayContaining([
+        "VECTOR_ENABLED",
+        "VECTOR_BUCKET_PROVIDER",
+        "VECTOR_STORE_MIGRATIONS_ENABLED",
+        "VECTOR_DATABASE_URL",
+      ]),
+    );
+  });
+});
+
+describe("legacyBuildStorageContainerSpec", () => {
+  const input: LegacyStorageContainerSpecInput = {
+    projectId: "proj",
+    networkId: "supabase_network_proj",
+    image: "supabase/storage-api:v1",
+    targetMigration: "",
+    fileSizeLimit: "50MiB",
+    s3Region: "local",
+    s3AccessKeyId: "625729a08b95bf1b7ff351a663f3a23c",
+    s3SecretAccessKey: "850181e4652dd023b7a98c58ae0d2d34bd487ee0cc3254aed6eda37307425907",
+    s3ProtocolEnabled: true,
+    imageTransformationEnabled: false,
+    vectorBucketsEnabled: false,
+    dbUrl: "postgresql://postgres:postgres@127.0.0.1:54322/postgres",
+    jwtSecret: "super-secret-jwt-token-with-at-least-32-characters-long",
+    jwks: '{"keys":[]}',
+    anonKey: "anon-key",
+    serviceRoleKey: "service-role-key",
+  };
+
+  test("derives the container name, DB host, and imgproxy host from projectId", () => {
+    const spec = legacyBuildStorageContainerSpec(input);
+    expect(spec.containerName).toBe("supabase_storage_proj");
+    expect(spec.env["DATABASE_URL"]).toBe(
+      "postgresql://supabase_storage_admin:postgres@supabase_db_proj:5432/postgres",
+    );
+    expect(spec.env["IMGPROXY_URL"]).toBe("http://supabase_imgproxy_proj:5001");
+  });
+
+  test("mounts its own named volume at /mnt, with no ports/exposedPorts", () => {
+    const spec = legacyBuildStorageContainerSpec(input);
+    expect(spec.binds).toEqual(["supabase_storage_proj:/mnt"]);
+    expect(spec.ports).toBeUndefined();
+    expect(spec.exposedPorts).toBeUndefined();
+  });
+
+  test("builds the wget-based healthcheck against the IPv4 loopback", () => {
+    const spec = legacyBuildStorageContainerSpec(input);
+    expect(spec.healthcheck).toEqual({
+      test: [
+        "CMD",
+        "wget",
+        "--no-verbose",
+        "--tries=1",
+        "--spider",
+        "http://127.0.0.1:5000/status",
+      ],
+      intervalSeconds: 10,
+      timeoutSeconds: 2,
+      retries: 3,
+    });
+  });
+
+  test("network alias is 'storage'", () => {
+    const spec = legacyBuildStorageContainerSpec(input);
+    expect(spec.networkAliases).toEqual(["storage"]);
+    expect(spec.networkId).toBe("supabase_network_proj");
+    expect(spec.restartPolicy).toBe("unless-stopped");
+    expect(spec.labels).toEqual({});
+  });
+
+  test("propagates the image-transformation gate through to ENABLE_IMAGE_TRANSFORMATION", () => {
+    const withImgproxy = legacyBuildStorageContainerSpec({
+      ...input,
+      imageTransformationEnabled: true,
+    });
+    expect(withImgproxy.env["ENABLE_IMAGE_TRANSFORMATION"]).toBe("true");
+
+    const withoutImgproxy = legacyBuildStorageContainerSpec({
+      ...input,
+      imageTransformationEnabled: false,
+    });
+    expect(withoutImgproxy.env["ENABLE_IMAGE_TRANSFORMATION"]).toBe("false");
+  });
+
+  test("propagates the vector-buckets flag through to the container env", () => {
+    const spec = legacyBuildStorageContainerSpec({ ...input, vectorBucketsEnabled: true });
+    expect(spec.env["VECTOR_ENABLED"]).toBe("true");
+    expect(spec.env["VECTOR_DATABASE_URL"]).toBe(
+      "postgresql://postgres:postgres@supabase_db_proj:5432/postgres",
+    );
+  });
+});
diff --git a/apps/cli/src/legacy/commands/start/services/studio.service.ts b/apps/cli/src/legacy/commands/start/services/studio.service.ts
new file mode 100644
index 0000000000..5bca44b936
--- /dev/null
+++ b/apps/cli/src/legacy/commands/start/services/studio.service.ts
@@ -0,0 +1,221 @@
+/**
+ * Studio env + container spec builder — port of Go's "Start Studio" block
+ * (`apps/cli-go/internal/start/start.go:1148-1191`) and its `buildStudioEnv`
+ * helper (`start.go:1319-1347`), ported faithfully as {@link legacyBuildStudioEnv}
+ * — see `apps/cli-go/internal/start/start_test.go:522 TestBuildStudioEnv`,
+ * ported in `studio.service.unit.test.ts`. Gated in Go by `config.studio.enabled`
+ * and `!isContainerExcluded(config.studio.image, excluded)` — see
+ * `legacy-service-catalog.ts`'s `studio` entry (`excludeKey: "studio"`, gated
+ * on `studio.enabled`, depends on pg-meta being healthy/running). Gating,
+ * image resolution/pre-pull, and edge-function bind-mount resolution
+ * (`serve.PopulatePerFunctionConfigs`, out of scope here — see
+ * {@link LegacyStudioContainerInput.functionBinds}) are the caller's job (a
+ * future `start.handler.ts`).
+ *
+ * `workdir`/`containerSnippetsPath`: Go computes `hostSnippetsPath :=
+ * filepath.Join(workdir, utils.SnippetsDir)` where `utils.SnippetsDir =
+ * filepath.Join("supabase", "snippets")` (`apps/cli-go/internal/utils/misc.go:107`)
+ * — a plain top-level `<project>/supabase/snippets` directory, NOT under
+ * `supabase/.temp/` (that directory is reserved for Go's own link-state cache,
+ * see `legacy-temp-paths.ts`; snippets are user content Studio's SQL Editor
+ * reads/writes, meant to persist, not a cache). `containerSnippetsPath` is
+ * that host path translated to its in-container mount form
+ * (`utils.ToDockerPath` — see {@link legacyToDockerPath}), computed once by
+ * {@link legacyBuildStudioContainerSpec} and threaded into both the bind mount
+ * and {@link legacyBuildStudioEnv}'s `SNIPPETS_MANAGEMENT_FOLDER`, mirroring
+ * Go's `run()` computing it once for both uses.
+ */
+
+import { join } from "node:path";
+
+import { legacyToDockerPath } from "../../../shared/legacy-docker-path.ts";
+import type { LegacyStartContainerSpec } from "../lib/docker-create-args.ts";
+
+/** Container-internal port Studio listens on — Go's hardcoded `3000/tcp` (`start.go:1166,1174`). */
+const STUDIO_CONTAINER_PORT = 3000;
+
+/** Go's `utils.StudioAliases` (`apps/cli-go/internal/utils/config.go:45`) — a fixed, non-configurable constant. */
+const STUDIO_NETWORK_ALIASES = ["studio"];
+
+/**
+ * Go's `Config.Analytics.ApiKey` default (`pkg/config/config.go:529`,
+ * `NewConfig()`'s `Analytics: analytics{ApiKey: "api-key", ...}`). That field
+ * is `toml:"-"` (`pkg/config/config.go:307`) — never decoded from
+ * `config.toml`, never overridable — so this is always the value regardless of
+ * the resolved project config, exactly like `legacy-local-config-values.ts`'s
+ * other Go-hardcoded, schema-absent constants (`DEFAULT_DB_PASSWORD`, the S3
+ * credential triple).
+ */
+const LOGFLARE_PRIVATE_ACCESS_TOKEN = "api-key";
+
+export interface LegacyBuildStudioEnvInput {
+  /** Go's `dbConfig.Password` (`start.go:1323`) — becomes `POSTGRES_PASSWORD`. */
+  readonly dbPassword: string;
+  /**
+   * Go's `workdir` (`os.Getwd()` in `run()`, `start.go:308`; matches
+   * `LegacyCliConfig.workdir`, the already-resolved absolute project root) —
+   * `EDGE_FUNCTIONS_MANAGEMENT_FOLDER` is resolved against it
+   * (`filepath.Join(workdir, utils.FunctionsDir)`, `start.go:1341`).
+   */
+  readonly workdir: string;
+  /**
+   * Go's `containerSnippetsPath` (`start.go:1157`) — becomes
+   * `SNIPPETS_MANAGEMENT_FOLDER` verbatim. See this module's doc comment for
+   * what it is and how it's derived.
+   */
+  readonly containerSnippetsPath: string;
+  /** Go's `utils.Version` — `CURRENT_CLI_VERSION`. */
+  readonly cliVersion: string;
+  /** pg-meta's own container name (Go's `utils.PgmetaId`) — `STUDIO_PG_META_URL=http://<name>:8080`. */
+  readonly pgMetaContainerName: string;
+  /** Kong's own container name (Go's `utils.KongId`) — `SUPABASE_URL=http://<name>:8000`. */
+  readonly kongContainerName: string;
+  /** Logflare's own container name (Go's `utils.LogflareId`) — `LOGFLARE_URL=http://<name>:4000`. */
+  readonly logflareContainerName: string;
+  /**
+   * `config.studio.api_url`, post-`SUPABASE_STUDIO_API_URL`-override AND
+   * post-`Config.Validate`'s host-rewrite (`legacyResolveStudioApiUrl`,
+   * `pkg/config/config.go:1074-1078`) — `SUPABASE_PUBLIC_URL`. Distinct from
+   * `LegacyLocalConfigValues.studioUrl` (the `http://<hostname>:<port>` value
+   * `status` reports). This is NOT simply the raw `studio.api_url` field:
+   * under a default config its host (`127.0.0.1`) matches the local hostname,
+   * so Go rewrites it to `Config.Api.ExternalUrl` (the Kong URL) before
+   * `start` ever reads it — the caller must apply that same rewrite before
+   * passing this field in.
+   */
+  readonly studioApiUrl: string;
+  /** `legacyResolveLocalConfigValues(...).jwtSecret` — `AUTH_JWT_SECRET`. */
+  readonly jwtSecret: string;
+  /** `legacyResolveLocalConfigValues(...).anonKey` — `SUPABASE_ANON_KEY`. */
+  readonly anonKey: string;
+  /** `legacyResolveLocalConfigValues(...).serviceRoleKey` — `SUPABASE_SERVICE_KEY`. */
+  readonly serviceRoleKey: string;
+  /** `legacyResolveLocalConfigValues(...).publishableKey` — `SUPABASE_PUBLISHABLE_KEY`. */
+  readonly publishableKey: string;
+  /** `legacyResolveLocalConfigValues(...).secretKey` — `SUPABASE_SECRET_KEY`. */
+  readonly secretKey: string;
+  /** `legacyResolveLocalConfigValues(...).storageS3AccessKeyId` — `S3_PROTOCOL_ACCESS_KEY_ID`. */
+  readonly s3AccessKeyId: string;
+  /** `legacyResolveLocalConfigValues(...).storageS3SecretAccessKey` — `S3_PROTOCOL_ACCESS_KEY_SECRET`. */
+  readonly s3SecretAccessKey: string;
+  /**
+   * `config.studio.openai_api_key`, decrypted/resolved by the caller —
+   * `OPENAI_API_KEY`. `undefined` maps to `""`, matching Go's unset `Secret`
+   * zero value (`utils.Config.Studio.OpenaiApiKey.Value`).
+   */
+  readonly openaiApiKey: string | undefined;
+  /** `config.api.schemas` — `PGRST_DB_SCHEMAS`, comma-joined. */
+  readonly apiSchemas: ReadonlyArray<string>;
+  /** `config.api.extra_search_path` — `PGRST_DB_EXTRA_SEARCH_PATH`, comma-joined. */
+  readonly apiExtraSearchPath: ReadonlyArray<string>;
+  /** `config.api.max_rows` — `PGRST_DB_MAX_ROWS`. */
+  readonly apiMaxRows: number;
+  /** `legacyEnvOverrideBool`-resolved `analytics.enabled` — `NEXT_PUBLIC_ENABLE_LOGS`. */
+  readonly analyticsEnabled: boolean;
+  /** `config.analytics.backend`, post-`SUPABASE_ANALYTICS_BACKEND`-override — `NEXT_ANALYTICS_BACKEND_PROVIDER`. */
+  readonly analyticsBackend: "postgres" | "bigquery";
+}
+
+/**
+ * Port of Go's `buildStudioEnv(dbConfig pgconn.Config, workdir,
+ * containerSnippetsPath string) []string` (`start.go:1319-1347`). Returns a
+ * `KEY -> value` map rather than Go's `KEY=value` string slice —
+ * {@link LegacyStartContainerSpec.env}'s own shape, chosen so secret values
+ * never round-trip through this process's own `docker create` argv (see that
+ * field's doc comment in `docker-create-args.ts`). Pure — no Effect or I/O —
+ * so every env var mapping is unit-testable in isolation; ported test:
+ * `apps/cli-go/internal/start/start_test.go:522 TestBuildStudioEnv`.
+ */
+export function legacyBuildStudioEnv(input: LegacyBuildStudioEnvInput): Record<string, string> {
+  return {
+    CURRENT_CLI_VERSION: input.cliVersion,
+    STUDIO_PG_META_URL: `http://${input.pgMetaContainerName}:8080`,
+    POSTGRES_PASSWORD: input.dbPassword,
+    SUPABASE_URL: `http://${input.kongContainerName}:8000`,
+    SUPABASE_PUBLIC_URL: input.studioApiUrl,
+    AUTH_JWT_SECRET: input.jwtSecret,
+    SUPABASE_ANON_KEY: input.anonKey,
+    SUPABASE_SERVICE_KEY: input.serviceRoleKey,
+    SUPABASE_PUBLISHABLE_KEY: input.publishableKey,
+    SUPABASE_SECRET_KEY: input.secretKey,
+    S3_PROTOCOL_ACCESS_KEY_ID: input.s3AccessKeyId,
+    S3_PROTOCOL_ACCESS_KEY_SECRET: input.s3SecretAccessKey,
+    LOGFLARE_PRIVATE_ACCESS_TOKEN,
+    OPENAI_API_KEY: input.openaiApiKey ?? "",
+    PGRST_DB_SCHEMAS: input.apiSchemas.join(","),
+    PGRST_DB_EXTRA_SEARCH_PATH: input.apiExtraSearchPath.join(","),
+    PGRST_DB_MAX_ROWS: String(input.apiMaxRows),
+    LOGFLARE_URL: `http://${input.logflareContainerName}:4000`,
+    NEXT_PUBLIC_ENABLE_LOGS: String(input.analyticsEnabled),
+    NEXT_ANALYTICS_BACKEND_PROVIDER: input.analyticsBackend,
+    EDGE_FUNCTIONS_MANAGEMENT_FOLDER: legacyToDockerPath(
+      join(input.workdir, "supabase", "functions"),
+    ),
+    SNIPPETS_MANAGEMENT_FOLDER: input.containerSnippetsPath,
+    // Ref: https://github.com/vercel/next.js/issues/51684#issuecomment-1612834913
+    HOSTNAME: "0.0.0.0",
+    POSTGRES_USER_READ_WRITE: "postgres",
+  };
+}
+
+export interface LegacyStudioContainerInput {
+  /** `config.studio.image`, already resolved/pulled by the caller. */
+  readonly image: string;
+  /** `legacyServiceContainerName("studio", projectId)` — Go's `utils.StudioId`. */
+  readonly containerName: string;
+  /** Go's `utils.NetId` — the shared Docker network every `start` container joins. */
+  readonly networkId: string;
+  /** `config.studio.port` — the host port published to `3000/tcp`. */
+  readonly port: number;
+  /**
+   * Go's `serve.PopulatePerFunctionConfigs(workdir, "", nil, fsys)` binds
+   * (`start.go:1150`) — the per-enabled-Edge-Function module bind mounts Go
+   * resolves from each `supabase/functions/<slug>`'s deploy config. Out of
+   * scope for this port (a separate, large functions-deploy-config-parsing
+   * concern); pass `[]` until a future edge-functions-serve integration
+   * supplies these.
+   */
+  readonly functionBinds: ReadonlyArray<string>;
+  /** Every value {@link legacyBuildStudioEnv} needs, minus the path this builder derives itself. */
+  readonly env: Omit<LegacyBuildStudioEnvInput, "containerSnippetsPath">;
+}
+
+/**
+ * Assembles Studio's {@link LegacyStartContainerSpec}, including the snippets
+ * bind mount and its Docker-path form Go derives from `workdir` once
+ * (`start.go:1150-1159`) and reuses for both the bind and
+ * {@link legacyBuildStudioEnv}'s `SNIPPETS_MANAGEMENT_FOLDER`.
+ */
+export function legacyBuildStudioContainerSpec(
+  input: LegacyStudioContainerInput,
+): LegacyStartContainerSpec {
+  const hostSnippetsPath = join(input.env.workdir, "supabase", "snippets");
+  const containerSnippetsPath = legacyToDockerPath(hostSnippetsPath);
+
+  // Go's `utils.RemoveDuplicates` (`start.go:1159`) — order-preserving dedup;
+  // `Set` iteration order matches Go's own first-seen-wins semantics.
+  const binds = Array.from(
+    new Set([...input.functionBinds, `${hostSnippetsPath}:${containerSnippetsPath}:rw`]),
+  );
+
+  return {
+    image: input.image,
+    containerName: input.containerName,
+    env: legacyBuildStudioEnv({ ...input.env, containerSnippetsPath }),
+    binds,
+    healthcheck: {
+      test: [
+        "CMD-SHELL",
+        `node --eval="fetch('http://127.0.0.1:${STUDIO_CONTAINER_PORT}/api/platform/profile').then((r) => {if (!r.ok) throw new Error(r.status)})"`,
+      ],
+      intervalSeconds: 10,
+      timeoutSeconds: 2,
+      retries: 3,
+    },
+    ports: [{ hostPort: String(input.port), containerPort: String(STUDIO_CONTAINER_PORT) }],
+    restartPolicy: "unless-stopped",
+    networkId: input.networkId,
+    networkAliases: STUDIO_NETWORK_ALIASES,
+    labels: {},
+  };
+}
diff --git a/apps/cli/src/legacy/commands/start/services/studio.service.unit.test.ts b/apps/cli/src/legacy/commands/start/services/studio.service.unit.test.ts
new file mode 100644
index 0000000000..c3a87ea728
--- /dev/null
+++ b/apps/cli/src/legacy/commands/start/services/studio.service.unit.test.ts
@@ -0,0 +1,174 @@
+import { describe, expect, test } from "vitest";
+
+import {
+  legacyBuildStudioContainerSpec,
+  legacyBuildStudioEnv,
+  type LegacyBuildStudioEnvInput,
+} from "./studio.service.ts";
+
+// Mirrors the fixture Go's `TestBuildStudioEnv` builds via `config.NewConfig()`
+// plus its explicit field overrides (`apps/cli-go/internal/start/start_test.go:522-564`),
+// translated into this pure function's explicit input shape.
+const baseEnvInput: LegacyBuildStudioEnvInput = {
+  dbPassword: "postgres",
+  workdir: "/project",
+  containerSnippetsPath: "/project/supabase/.temp/snippets",
+  cliVersion: "test-version",
+  pgMetaContainerName: "test-pgmeta",
+  kongContainerName: "test-kong",
+  logflareContainerName: "test-logflare",
+  studioApiUrl: "http://127.0.0.1:54321",
+  jwtSecret: "jwt-secret",
+  anonKey: "anon-key",
+  serviceRoleKey: "service-role-key",
+  publishableKey: "sb_publishable_test",
+  secretKey: "sb_secret_test",
+  s3AccessKeyId: "s3-access-key",
+  s3SecretAccessKey: "s3-secret-key",
+  openaiApiKey: undefined,
+  apiSchemas: ["public", "graphql_public"],
+  apiExtraSearchPath: ["public", "extensions"],
+  apiMaxRows: 1000,
+  analyticsEnabled: true,
+  analyticsBackend: "postgres",
+};
+
+describe("legacyBuildStudioEnv", () => {
+  test("mirrors Go's TestBuildStudioEnv fixture", () => {
+    const env = legacyBuildStudioEnv(baseEnvInput);
+
+    // The exact 8 assertions `TestBuildStudioEnv` makes.
+    expect(env["SUPABASE_ANON_KEY"]).toBe("anon-key");
+    expect(env["SUPABASE_SERVICE_KEY"]).toBe("service-role-key");
+    expect(env["SUPABASE_PUBLISHABLE_KEY"]).toBe("sb_publishable_test");
+    expect(env["SUPABASE_SECRET_KEY"]).toBe("sb_secret_test");
+    expect(env["S3_PROTOCOL_ACCESS_KEY_ID"]).toBe("s3-access-key");
+    expect(env["S3_PROTOCOL_ACCESS_KEY_SECRET"]).toBe("s3-secret-key");
+    expect(env["SUPABASE_URL"]).toBe("http://test-kong:8000");
+    expect(env["STUDIO_PG_META_URL"]).toBe("http://test-pgmeta:8080");
+
+    // Every other key `buildStudioEnv` emits (`start.go:1319-1347`), not
+    // asserted by the Go test but covered here for full parity.
+    expect(env).toEqual({
+      CURRENT_CLI_VERSION: "test-version",
+      STUDIO_PG_META_URL: "http://test-pgmeta:8080",
+      POSTGRES_PASSWORD: "postgres",
+      SUPABASE_URL: "http://test-kong:8000",
+      SUPABASE_PUBLIC_URL: "http://127.0.0.1:54321",
+      AUTH_JWT_SECRET: "jwt-secret",
+      SUPABASE_ANON_KEY: "anon-key",
+      SUPABASE_SERVICE_KEY: "service-role-key",
+      SUPABASE_PUBLISHABLE_KEY: "sb_publishable_test",
+      SUPABASE_SECRET_KEY: "sb_secret_test",
+      S3_PROTOCOL_ACCESS_KEY_ID: "s3-access-key",
+      S3_PROTOCOL_ACCESS_KEY_SECRET: "s3-secret-key",
+      LOGFLARE_PRIVATE_ACCESS_TOKEN: "api-key",
+      OPENAI_API_KEY: "",
+      PGRST_DB_SCHEMAS: "public,graphql_public",
+      PGRST_DB_EXTRA_SEARCH_PATH: "public,extensions",
+      PGRST_DB_MAX_ROWS: "1000",
+      LOGFLARE_URL: "http://test-logflare:4000",
+      NEXT_PUBLIC_ENABLE_LOGS: "true",
+      NEXT_ANALYTICS_BACKEND_PROVIDER: "postgres",
+      EDGE_FUNCTIONS_MANAGEMENT_FOLDER: "/project/supabase/functions",
+      SNIPPETS_MANAGEMENT_FOLDER: "/project/supabase/.temp/snippets",
+      HOSTNAME: "0.0.0.0",
+      POSTGRES_USER_READ_WRITE: "postgres",
+    });
+  });
+
+  test("LOGFLARE_PRIVATE_ACCESS_TOKEN is always Go's hardcoded 'api-key', regardless of input", () => {
+    // `analytics.api_key` isn't a `config.toml`-configurable field in Go
+    // (`toml:"-"`) — there is no input field for it at all.
+    const env = legacyBuildStudioEnv(baseEnvInput);
+    expect(env["LOGFLARE_PRIVATE_ACCESS_TOKEN"]).toBe("api-key");
+  });
+
+  test("falls back OPENAI_API_KEY to an empty string when unset", () => {
+    const env = legacyBuildStudioEnv({ ...baseEnvInput, openaiApiKey: undefined });
+    expect(env["OPENAI_API_KEY"]).toBe("");
+  });
+
+  test("passes through a configured OPENAI_API_KEY", () => {
+    const env = legacyBuildStudioEnv({ ...baseEnvInput, openaiApiKey: "sk-test" });
+    expect(env["OPENAI_API_KEY"]).toBe("sk-test");
+  });
+
+  test('reflects analyticsEnabled/analyticsBackend verbatim (Go\'s fmt.Sprintf("%v", ...))', () => {
+    const env = legacyBuildStudioEnv({
+      ...baseEnvInput,
+      analyticsEnabled: false,
+      analyticsBackend: "bigquery",
+    });
+    expect(env["NEXT_PUBLIC_ENABLE_LOGS"]).toBe("false");
+    expect(env["NEXT_ANALYTICS_BACKEND_PROVIDER"]).toBe("bigquery");
+  });
+
+  test("EDGE_FUNCTIONS_MANAGEMENT_FOLDER is workdir/supabase/functions in Docker-path form", () => {
+    const env = legacyBuildStudioEnv({
+      ...baseEnvInput,
+      workdir: "/Users/me/my-project",
+    });
+    expect(env["EDGE_FUNCTIONS_MANAGEMENT_FOLDER"]).toBe("/Users/me/my-project/supabase/functions");
+  });
+});
+
+describe("legacyBuildStudioContainerSpec", () => {
+  const baseSpecInput = {
+    image: "supabase/studio:2026.07.07-sha-a6a04f2",
+    containerName: "supabase_studio_proj",
+    networkId: "supabase_network_proj",
+    port: 54323,
+    functionBinds: [] as ReadonlyArray<string>,
+    env: baseEnvInput,
+  };
+
+  test("assembles the full container spec, wiring pg-meta's own container name into STUDIO_PG_META_URL", () => {
+    const spec = legacyBuildStudioContainerSpec(baseSpecInput);
+
+    expect(spec.image).toBe("supabase/studio:2026.07.07-sha-a6a04f2");
+    expect(spec.containerName).toBe("supabase_studio_proj");
+    expect(spec.networkId).toBe("supabase_network_proj");
+    expect(spec.networkAliases).toEqual(["studio"]);
+    expect(spec.restartPolicy).toBe("unless-stopped");
+    expect(spec.labels).toEqual({});
+    expect(spec.ports).toEqual([{ hostPort: "54323", containerPort: "3000" }]);
+    expect(spec.healthcheck).toEqual({
+      test: [
+        "CMD-SHELL",
+        `node --eval="fetch('http://127.0.0.1:3000/api/platform/profile').then((r) => {if (!r.ok) throw new Error(r.status)})"`,
+      ],
+      intervalSeconds: 10,
+      timeoutSeconds: 2,
+      retries: 3,
+    });
+
+    // pg-meta URL wiring: a distinct `pgMetaContainerName` (Go's `utils.PgmetaId`,
+    // resolved by the caller via `legacyServiceContainerName("pg_meta", projectId)`)
+    // flows through to STUDIO_PG_META_URL exactly like it does in `legacyBuildStudioEnv`.
+    expect(spec.env["STUDIO_PG_META_URL"]).toBe("http://test-pgmeta:8080");
+  });
+
+  test("derives the snippets bind from env.workdir and includes it alongside functionBinds", () => {
+    const spec = legacyBuildStudioContainerSpec({
+      ...baseSpecInput,
+      functionBinds: ["/project/supabase/functions/hello:/home/deno/functions/hello:ro"],
+    });
+
+    expect(spec.binds).toEqual([
+      "/project/supabase/functions/hello:/home/deno/functions/hello:ro",
+      "/project/supabase/snippets:/project/supabase/snippets:rw",
+    ]);
+    // The snippets bind's container-side path also backs SNIPPETS_MANAGEMENT_FOLDER.
+    expect(spec.env["SNIPPETS_MANAGEMENT_FOLDER"]).toBe("/project/supabase/snippets");
+  });
+
+  test("dedupes the snippets bind against an identical functionBinds entry (Go's utils.RemoveDuplicates)", () => {
+    const spec = legacyBuildStudioContainerSpec({
+      ...baseSpecInput,
+      functionBinds: ["/project/supabase/snippets:/project/supabase/snippets:rw"],
+    });
+
+    expect(spec.binds).toEqual(["/project/supabase/snippets:/project/supabase/snippets:rw"]);
+  });
+});
diff --git a/apps/cli/src/legacy/commands/start/services/supavisor.service.ts b/apps/cli/src/legacy/commands/start/services/supavisor.service.ts
new file mode 100644
index 0000000000..43724b538a
--- /dev/null
+++ b/apps/cli/src/legacy/commands/start/services/supavisor.service.ts
@@ -0,0 +1,208 @@
+/**
+ * Port of Go's "Start pooler" block (`apps/cli-go/internal/start/start.go:
+ * 1193-1268`), gated on `config.db.pooler.enabled` — the gate itself is
+ * `start.handler.ts`'s job (a later task), not this module's; this file only
+ * builds the `docker create` spec (plus the pure tenant-provisioning script it
+ * embeds — see below).
+ *
+ * IMPORTANT — how Go actually provisions the Supavisor tenant: it is NOT a
+ * post-start `docker exec`. Go renders `pooler.exs` (via
+ * `legacyRenderStartPoolerExs`, already ported in `../lib/template-render.ts`)
+ * BEFORE the container is created, then bakes the rendered script directly
+ * into the container's own startup `Cmd`
+ * (`/bin/sh -c "/app/bin/migrate && /app/bin/supavisor eval '<script>' &&
+ * /app/bin/server"`, `start.go:1234-1237`) — overriding the image's default
+ * `CMD` while keeping its own `ENTRYPOINT` (no `Entrypoint` field is set here
+ * at all, matching `docker-create-args.ts`'s documented Pooler precedent).
+ * There is no separate post-start step: tenant creation runs once, as part of
+ * the container's first boot, inside the same shell invocation that also runs
+ * `/app/bin/migrate`.
+ *
+ * Go's literal shell-embed of `<script>` (which carries the DB password) is
+ * safe in Go's own architecture — it calls `Docker.ContainerCreate` over the
+ * Engine API directly, so that `Cmd` string never becomes a subprocess's own
+ * argv. THIS PORT SHELLS OUT to a real `docker create`, so it deliberately
+ * diverges: the rendered script travels via
+ * {@link LegacyStartContainerSpec.secretFiles} instead (a HOST temp file,
+ * mode `0644`, bind-mounted read-only at
+ * {@link LEGACY_SUPAVISOR_POOLER_TENANT_CONTAINER_PATH}) — Supavisor itself
+ * runs fully as root in Go's image, so it is unaffected by the non-root
+ * bind-mount read issue that motivates `0644` for Kong/Postgres (see
+ * `legacyStageStartSecretFiles`'s doc comment); the file mode is simply
+ * widened here for consistency with the other staged secrets, and
+ * {@link legacyBuildSupavisorStartCmd} only ever references that FIXED path —
+ * never the secret content itself (CWE-214/522). See that function's doc
+ * comment for the resulting quoting nuance. {@link legacyBuildSupavisorStartCmd}
+ * is exported separately (rather than inlined) so a later orchestrator can
+ * unit-test or reuse the exact shell-embedding shape independently of the
+ * rest of the spec.
+ */
+
+import { legacyServiceContainerName } from "../../../shared/legacy-docker-ids.ts";
+import type { LegacyStartContainerSpec } from "../lib/docker-create-args.ts";
+import {
+  legacyRenderStartPoolerExs,
+  type LegacyStartPoolerExsFields,
+} from "../lib/template-render.ts";
+
+/** `utils.PoolerAliases[0]` (`apps/cli-go/internal/utils/config.go:49`) — also this service's `containerSuffix` in `LEGACY_SERVICE_CATALOG`. */
+const LEGACY_SUPAVISOR_CONTAINER_SUFFIX = "pooler";
+
+/** `Config.Db.Pooler.TenantId` default (`apps/cli-go/pkg/config/config.go:465`) — `toml:"-"`, never configurable, so hardcoded here exactly like Go's own compile-time constant. */
+const LEGACY_SUPAVISOR_TENANT_ID = "pooler-dev";
+/** `Config.Db.Pooler.EncryptionKey` default (`config.go:466`) — `toml:"-"`. */
+const LEGACY_SUPAVISOR_ENCRYPTION_KEY = "12345678901234567890123456789032";
+/** `Config.Db.Pooler.SecretKeyBase` default (`config.go:467`) — `toml:"-"`. */
+const LEGACY_SUPAVISOR_SECRET_KEY_BASE =
+  "EAx3IQ/wRG1v47ZD4NE4/9RzBI8Jmil3x0yhcW4V2NHBP6c2iPIzwjofi2Ep4HIG";
+
+/** `portSession` (`start.go:1195`). */
+const LEGACY_SUPAVISOR_SESSION_PORT = "5432";
+/** `portTransaction` (`start.go:1196`). */
+const LEGACY_SUPAVISOR_TRANSACTION_PORT = "6543";
+
+/**
+ * The fixed in-container path the rendered `pooler.exs` tenant script is
+ * bind-mounted to (see {@link legacyBuildSupavisorContainerSpec}'s
+ * `secretFiles`) — no Go equivalent, since Go never writes this script to a
+ * file at all.
+ */
+const LEGACY_SUPAVISOR_POOLER_TENANT_CONTAINER_PATH = "/app/pooler_tenant.exs";
+
+/**
+ * Go embeds the rendered `pooler.exs` script directly into the container's
+ * `Cmd` via an UNESCAPED single-quote wrap (`start.go:1234-1237`,
+ * `fmt.Sprintf("/app/bin/migrate && /app/bin/supavisor eval '%s' &&
+ * /app/bin/server", poolerTenantBuf.String())`, with NO shell-escaping of
+ * embedded characters) — this module's header comment explains why that's
+ * safe for Go's Engine-API architecture but not for this port's, which shells
+ * out to a real `docker create`.
+ *
+ * This `Cmd` instead reads the script from
+ * {@link LEGACY_SUPAVISOR_POOLER_TENANT_CONTAINER_PATH} at container startup:
+ * `eval "$(cat <path>)"`'s double-quoted command substitution passes the
+ * file's content to `eval` as a single argument, the same way Go's
+ * single-quote wrap passed the inline literal as a single argument. Two
+ * differences from Go's raw embed, both immaterial for every value these
+ * fields can take today: `$()` strips the script's own trailing newline
+ * (irrelevant to `Code.eval_string`), and the surrounding double quotes
+ * re-expand a `$`/backtick sequence in the file's content where Go's single
+ * quotes never would (every interpolated `pooler.exs` field is a fixed/
+ * internal value today — `db.password` in particular has no config.toml
+ * field at all, always literally `"postgres"`, see `postgres.service.ts`'s
+ * `LEGACY_POSTGRES_PASSWORD` — none of which contain `$`, a backtick, or a
+ * single quote). A future caller that ever makes one of these fields
+ * genuinely attacker-controlled must revisit this quoting, exactly as it
+ * would have had to revisit Go's own single-quote wrap.
+ */
+export function legacyBuildSupavisorStartCmd(): ReadonlyArray<string> {
+  return [
+    "/bin/sh",
+    "-c",
+    `/app/bin/migrate && /app/bin/supavisor eval "$(cat ${LEGACY_SUPAVISOR_POOLER_TENANT_CONTAINER_PATH})" && /app/bin/server`,
+  ];
+}
+
+export interface LegacySupavisorContainerSpecInput {
+  /**
+   * `container.Config.Image` — the already-resolved `config.db.pooler.image`.
+   * Not part of the decoded `@supabase/config` schema (Go's own
+   * `Pooler.Image` field is `toml:"-"`); resolution is the caller's
+   * responsibility.
+   */
+  readonly image: string;
+  /** Go's `Config.ProjectId`, used to derive `utils.PoolerId` via {@link legacyServiceContainerName}. */
+  readonly projectId: string;
+  /** `container.HostConfig.NetworkMode`'s target — resolved once per `start` run, not per-container. */
+  readonly networkId: string;
+  /** `config.db.pooler.port` — the single host port published, whose container-side target depends on {@link poolMode} (`start.go:1194-1200`). */
+  readonly port: number;
+  /** `config.db.pooler.pool_mode` — also the pooler.exs tenant's `ModeType`/`mode_type`. */
+  readonly poolMode: "transaction" | "session";
+  /** `config.db.pooler.default_pool_size` — also the tenant's `DefaultPoolSize`/`default_pool_size` (and each user's own `pool_size`). */
+  readonly defaultPoolSize: number;
+  /** `config.db.pooler.max_client_conn` — also the tenant's `DefaultMaxClients`/`default_max_clients`. */
+  readonly maxClientConn: number;
+  /** `config.auth.jwt_secret` (`Config.Auth.JwtSecret.Value`) — used for BOTH `API_JWT_SECRET` and `METRICS_JWT_SECRET` (`start.go:1227-1228`). */
+  readonly jwtSecret: string;
+  /** `dbConfig.Host` (`utils.DbId` on the default path). Also the tenant's `DbHost`/`db_host`. */
+  readonly dbHost: string;
+  /** `dbConfig.Port` (`5432` on the default path). Also the tenant's `DbPort`/`db_port`. */
+  readonly dbPort: number;
+  /** `dbConfig.User` (`"postgres"` on the default path) — used only for `DATABASE_URL` (Supavisor's own metadata store), NOT the tenant script. */
+  readonly dbUser: string;
+  /** `dbConfig.Password` — used for both `DATABASE_URL` and the tenant's `DbPassword`/`db_password`. */
+  readonly dbPassword: string;
+  /** `dbConfig.Database` (`"postgres"` on the default path) — the tenant's `DbDatabase`/`db_database` (the database Supavisor proxies, distinct from its own `_supabase` metadata database in `DATABASE_URL`). */
+  readonly dbDatabase: string;
+}
+
+/** Builds the `docker create` spec for the Supavisor/pooler container (`start.go:1193-1268`). */
+export function legacyBuildSupavisorContainerSpec(
+  input: LegacySupavisorContainerSpecInput,
+): LegacyStartContainerSpec {
+  const tenantFields: LegacyStartPoolerExsFields = {
+    dbHost: input.dbHost,
+    dbPort: input.dbPort,
+    dbDatabase: input.dbDatabase,
+    dbPassword: input.dbPassword,
+    externalId: LEGACY_SUPAVISOR_TENANT_ID,
+    modeType: input.poolMode,
+    defaultMaxClients: input.maxClientConn,
+    defaultPoolSize: input.defaultPoolSize,
+  };
+  const tenantScript = legacyRenderStartPoolerExs(tenantFields);
+  const dockerPort =
+    input.poolMode === "session"
+      ? LEGACY_SUPAVISOR_SESSION_PORT
+      : LEGACY_SUPAVISOR_TRANSACTION_PORT;
+
+  return {
+    image: input.image,
+    containerName: legacyServiceContainerName(LEGACY_SUPAVISOR_CONTAINER_SUFFIX, input.projectId),
+    env: {
+      PORT: "4000",
+      PROXY_PORT_SESSION: LEGACY_SUPAVISOR_SESSION_PORT,
+      PROXY_PORT_TRANSACTION: LEGACY_SUPAVISOR_TRANSACTION_PORT,
+      DATABASE_URL: `ecto://${input.dbUser}:${input.dbPassword}@${input.dbHost}:${input.dbPort}/_supabase`,
+      CLUSTER_POSTGRES: "true",
+      SECRET_KEY_BASE: LEGACY_SUPAVISOR_SECRET_KEY_BASE,
+      VAULT_ENC_KEY: LEGACY_SUPAVISOR_ENCRYPTION_KEY,
+      API_JWT_SECRET: input.jwtSecret,
+      METRICS_JWT_SECRET: input.jwtSecret,
+      REGION: "local",
+      RUN_JANITOR: "true",
+      ERL_AFLAGS: "-proto_dist inet_tcp",
+      RLIMIT_NOFILE: "",
+    },
+    cmd: legacyBuildSupavisorStartCmd(),
+    secretFiles: [
+      { containerPath: LEGACY_SUPAVISOR_POOLER_TENANT_CONTAINER_PATH, content: tenantScript },
+    ],
+    binds: [],
+    exposedPorts: [
+      { containerPort: "4000" },
+      { containerPort: LEGACY_SUPAVISOR_SESSION_PORT },
+      { containerPort: LEGACY_SUPAVISOR_TRANSACTION_PORT },
+    ],
+    ports: [{ hostPort: String(input.port), containerPort: dockerPort }],
+    healthcheck: {
+      test: [
+        "CMD",
+        "curl",
+        "-sSfL",
+        "--head",
+        "-o",
+        "/dev/null",
+        "http://127.0.0.1:4000/api/health",
+      ],
+      intervalSeconds: 10,
+      timeoutSeconds: 2,
+      retries: 3,
+    },
+    restartPolicy: "unless-stopped",
+    networkId: input.networkId,
+    networkAliases: [LEGACY_SUPAVISOR_CONTAINER_SUFFIX],
+    labels: {},
+  };
+}
diff --git a/apps/cli/src/legacy/commands/start/services/supavisor.service.unit.test.ts b/apps/cli/src/legacy/commands/start/services/supavisor.service.unit.test.ts
new file mode 100644
index 0000000000..cc22f6f63f
--- /dev/null
+++ b/apps/cli/src/legacy/commands/start/services/supavisor.service.unit.test.ts
@@ -0,0 +1,130 @@
+import { describe, expect, test } from "vitest";
+
+import {
+  legacyBuildSupavisorContainerSpec,
+  legacyBuildSupavisorStartCmd,
+  type LegacySupavisorContainerSpecInput,
+} from "./supavisor.service.ts";
+
+const base: LegacySupavisorContainerSpecInput = {
+  image: "supabase/supavisor:2.0.0",
+  projectId: "proj",
+  networkId: "supabase_network_proj",
+  port: 54329,
+  poolMode: "transaction",
+  defaultPoolSize: 20,
+  maxClientConn: 100,
+  jwtSecret: "jwt-secret",
+  dbHost: "supabase_db_proj",
+  dbPort: 5432,
+  dbUser: "postgres",
+  dbPassword: "secret",
+  dbDatabase: "postgres",
+};
+
+describe("legacyBuildSupavisorStartCmd", () => {
+  test("reads the tenant script from the fixed secretFiles path and evals its content, never embedding it inline (CWE-214/522)", () => {
+    expect(legacyBuildSupavisorStartCmd()).toEqual([
+      "/bin/sh",
+      "-c",
+      '/app/bin/migrate && /app/bin/supavisor eval "$(cat /app/pooler_tenant.exs)" && /app/bin/server',
+    ]);
+  });
+});
+
+describe("legacyBuildSupavisorContainerSpec", () => {
+  test("Cmd only ever references the fixed /app/pooler_tenant.exs path, with no Entrypoint override (start.go:1201-1237)", () => {
+    const spec = legacyBuildSupavisorContainerSpec(base);
+    expect(spec.entrypoint).toBeUndefined();
+    expect(spec.cmd).toEqual([
+      "/bin/sh",
+      "-c",
+      '/app/bin/migrate && /app/bin/supavisor eval "$(cat /app/pooler_tenant.exs)" && /app/bin/server',
+    ]);
+  });
+
+  test("carries the rendered pooler.exs tenant script as a secretFile bind-mounted at /app/pooler_tenant.exs, not a post-start docker exec (start.go:1201-1237)", () => {
+    const spec = legacyBuildSupavisorContainerSpec(base);
+    expect(spec.secretFiles).toHaveLength(1);
+    const tenantFile = spec.secretFiles?.[0];
+    expect(tenantFile?.containerPath).toBe("/app/pooler_tenant.exs");
+    const script = tenantFile?.content ?? "";
+    expect(script).toContain('"db_host" => "supabase_db_proj"');
+    expect(script).toContain('"db_port" => 5432');
+    expect(script).toContain('"db_database" => "postgres"');
+    expect(script).toContain('"db_password" => "secret"');
+    expect(script).toContain('"mode_type" => "transaction"');
+    expect(script).toContain('"default_max_clients" => 100');
+    expect(script).toContain('"default_pool_size" => 20');
+  });
+
+  test("never leaks the tenant script (db_password included) into Cmd itself", () => {
+    const spec = legacyBuildSupavisorContainerSpec(base);
+    const cmdText = (spec.cmd ?? []).join(" ");
+    expect(cmdText).not.toContain("secret");
+    expect(cmdText).not.toContain("db_password");
+  });
+
+  test("uses the hardcoded pooler-dev tenant id, not a config-supplied value (config.go:465)", () => {
+    const spec = legacyBuildSupavisorContainerSpec(base);
+    expect(spec.secretFiles?.[0]?.content).toContain('"external_id" => "pooler-dev"');
+  });
+
+  test("binds the transaction port (6543) to the host when pool_mode is transaction (start.go:1194-1200)", () => {
+    const spec = legacyBuildSupavisorContainerSpec({ ...base, poolMode: "transaction" });
+    expect(spec.ports).toEqual([{ hostPort: "54329", containerPort: "6543" }]);
+    expect(spec.exposedPorts).toEqual([
+      { containerPort: "4000" },
+      { containerPort: "5432" },
+      { containerPort: "6543" },
+    ]);
+  });
+
+  test("binds the session port (5432) to the host when pool_mode is session (start.go:1198-1199)", () => {
+    const spec = legacyBuildSupavisorContainerSpec({ ...base, poolMode: "session" });
+    expect(spec.ports).toEqual([{ hostPort: "54329", containerPort: "5432" }]);
+  });
+
+  test("sets the hardcoded local-dev secrets and both JWT env vars (start.go:1219-1232)", () => {
+    const spec = legacyBuildSupavisorContainerSpec(base);
+    expect(spec.env).toMatchObject({
+      PORT: "4000",
+      PROXY_PORT_SESSION: "5432",
+      PROXY_PORT_TRANSACTION: "6543",
+      DATABASE_URL: "ecto://postgres:secret@supabase_db_proj:5432/_supabase",
+      CLUSTER_POSTGRES: "true",
+      SECRET_KEY_BASE: "EAx3IQ/wRG1v47ZD4NE4/9RzBI8Jmil3x0yhcW4V2NHBP6c2iPIzwjofi2Ep4HIG",
+      VAULT_ENC_KEY: "12345678901234567890123456789032",
+      API_JWT_SECRET: "jwt-secret",
+      METRICS_JWT_SECRET: "jwt-secret",
+      REGION: "local",
+      RUN_JANITOR: "true",
+      ERL_AFLAGS: "-proto_dist inet_tcp",
+      RLIMIT_NOFILE: "",
+    });
+  });
+
+  test("builds the remaining identity/network fields (start.go:1215-1263)", () => {
+    const spec = legacyBuildSupavisorContainerSpec(base);
+    expect(spec.image).toBe("supabase/supavisor:2.0.0");
+    expect(spec.containerName).toBe("supabase_pooler_proj");
+    expect(spec.binds).toEqual([]);
+    expect(spec.healthcheck).toEqual({
+      test: [
+        "CMD",
+        "curl",
+        "-sSfL",
+        "--head",
+        "-o",
+        "/dev/null",
+        "http://127.0.0.1:4000/api/health",
+      ],
+      intervalSeconds: 10,
+      timeoutSeconds: 2,
+      retries: 3,
+    });
+    expect(spec.restartPolicy).toBe("unless-stopped");
+    expect(spec.networkId).toBe("supabase_network_proj");
+    expect(spec.networkAliases).toEqual(["pooler"]);
+  });
+});
diff --git a/apps/cli/src/legacy/commands/start/services/vector.service.ts b/apps/cli/src/legacy/commands/start/services/vector.service.ts
new file mode 100644
index 0000000000..383698b683
--- /dev/null
+++ b/apps/cli/src/legacy/commands/start/services/vector.service.ts
@@ -0,0 +1,373 @@
+/**
+ * Vector container spec builder — port of Go's "Start vector" block
+ * (`apps/cli-go/internal/start/start.go:396-484`), gated on
+ * `config.analytics.enabled && !isContainerExcluded(config.analytics.vector_image,
+ * excluded)` — see `legacy-service-catalog.ts`'s `vector` entry
+ * (`excludeKey: "vector"`, depends on `logflare` being healthy). Gating and
+ * image resolution/pre-pull are the caller's job (a future `start.handler.ts`);
+ * this module only assembles the container spec once the caller has already
+ * decided to start it, matching `docker-create-args.ts`'s "image already
+ * resolved/pulled" contract.
+ *
+ * Vector is the one `start` service that inspects the HOST's own Docker
+ * daemon endpoint (`utils.Docker.DaemonHost()`, `start.go:415`) to decide how
+ * to mount/reach that daemon's socket from INSIDE the Vector container for
+ * its `docker_logs` source. That decision is split into two independently
+ * exported, independently testable pieces, matching every other `start`
+ * service's "builder stays pure" shape:
+ *
+ * - {@link legacyResolveDockerDaemonHost} — the one IMPURE piece: discovers
+ *   the current `scheme://host` string a caller should feed into the pure
+ *   branch below. See its doc comment for exactly what it reads/shells out to
+ *   and why.
+ * - {@link legacyResolveVectorDockerSocketPlan} — the PURE scheme-branching
+ *   logic (`start.go:421-443`): given an already-resolved daemon host string,
+ *   decides the `DOCKER_HOST` env override, bind mount, and `--security-opt`
+ *   this container needs. This is the highest-parity-risk logic in this
+ *   module — Docker Desktop, Colima, OrbStack, and rootless Podman each take a
+ *   different branch.
+ *
+ * {@link legacyBuildVectorContainerSpec} itself stays a pure function of an
+ * already-resolved {@link LegacyVectorDockerSocketPlan}, exactly like every
+ * other `start`-service builder in this directory.
+ */
+
+import { Effect, Stream } from "effect";
+import * as ChildProcess from "effect/unstable/process/ChildProcess";
+import type { ChildProcessSpawner } from "effect/unstable/process/ChildProcessSpawner";
+
+import type { LegacyStartContainerSpec } from "../lib/docker-create-args.ts";
+import { legacyRenderStartVectorYaml } from "../lib/template-render.ts";
+
+type Spawner = ChildProcessSpawner["Service"];
+
+/** `utils.VectorAliases` (`apps/cli-go/internal/utils/config.go:48`) — a fixed, non-configurable constant. */
+const LEGACY_VECTOR_NETWORK_ALIASES = ["vector"];
+
+/** `utils.DinDHost` (`apps/cli-go/internal/utils/docker.go:58`) — the well-known Docker-Desktop-for-{Mac,Windows}/Colima/OrbStack hostname that resolves to the host machine from inside a container. */
+const LEGACY_DIND_HOST = "host.docker.internal";
+
+/** The default port `dindHost` targets before a `tcp` daemon host's own port overrides it (`start.go:420`). */
+const LEGACY_DIND_DEFAULT_PORT = "2375";
+
+export interface LegacyParsedDockerHostUrl {
+  readonly scheme: string;
+  readonly host: string;
+}
+
+/**
+ * Port of `client.ParseHostURL` (`docker/docker/client`, vendored by
+ * `apps/cli-go`): splits `scheme://addr` and, for a `tcp` host, strips any
+ * path/query so `.host` is exactly the `host:port` pair — docker host strings
+ * never carry a path in practice, so that extra round-trip through
+ * `net/url.Parse` Go performs is a no-op here. Throws on a string with no
+ * `://` separator or an empty address, matching Go's own hard error for a
+ * malformed host — `utils.Docker.DaemonHost()` is always a well-formed
+ * `scheme://` string in practice, so this should never actually throw outside
+ * a test feeding it garbage on purpose.
+ */
+export function legacyParseDockerHostUrl(host: string): LegacyParsedDockerHostUrl {
+  const separatorIndex = host.indexOf("://");
+  if (separatorIndex === -1) {
+    throw new Error(`unable to parse docker host \`${host}\``);
+  }
+  const scheme = host.slice(0, separatorIndex);
+  const addr = host.slice(separatorIndex + 3);
+  if (addr.length === 0) {
+    throw new Error(`unable to parse docker host \`${host}\``);
+  }
+  if (scheme === "tcp") {
+    const pathIndex = addr.indexOf("/");
+    return { scheme, host: pathIndex === -1 ? addr : addr.slice(0, pathIndex) };
+  }
+  return { scheme, host: addr };
+}
+
+/**
+ * Minimal port of `net.SplitHostPort`, covering exactly the shapes a Docker
+ * `tcp://` host string can take (`host:port` or `[ipv6]:port`) — Go's own use
+ * (`start.go:423`) only ever reads the returned port, so this returns just
+ * that (`undefined` when the string has no trailing `:<digits>`).
+ */
+export function legacySplitHostPortPort(hostPort: string): string | undefined {
+  const lastColon = hostPort.lastIndexOf(":");
+  if (lastColon === -1) return undefined;
+  const port = hostPort.slice(lastColon + 1);
+  return /^\d+$/.test(port) ? port : undefined;
+}
+
+/**
+ * Port of `shouldMountRootDockerSocket` (`start.go:131-136`): recognizes the
+ * KNOWN rootful-socket paths Docker Desktop for Mac (`.docker/run` and the
+ * older `.docker/desktop`) and Colima expose, where binding the STANDARD
+ * `/var/run/docker.sock` path (handled specially by those runtimes, "under
+ * the hood") is required instead of binding the detected path directly.
+ * Anything else (Podman, OrbStack, a bare Linux socket) is assumed
+ * bindable-as-is.
+ */
+export function legacyShouldMountRootDockerSocket(host: string): boolean {
+  return (
+    host.endsWith("/.docker/run/docker.sock") ||
+    host.endsWith("/.docker/desktop/docker.sock") ||
+    (host.includes("/.colima/") && host.endsWith("/docker.sock")) ||
+    host.endsWith("/.colima/docker.sock")
+  );
+}
+
+/**
+ * Port of `client.DefaultDockerHost`, which is a PLATFORM-COMPILE-TIME Go
+ * constant (`client_unix.go` vs `client_windows.go`) — `platform` defaults to
+ * `process.platform` as this binary's own per-platform equivalent.
+ */
+export function legacyPlatformDefaultDockerHost(
+  platform: NodeJS.Platform = process.platform,
+): string {
+  return platform === "win32" ? "npipe:////./pipe/docker_engine" : "unix:///var/run/docker.sock";
+}
+
+export interface LegacyVectorDockerSocketPlan {
+  /** `env` Go appends to (`start.go:413,426,430`) — empty for the `unix` scheme, which sets no `DOCKER_HOST` override at all. */
+  readonly env: Readonly<Record<string, string>>;
+  /** `binds` Go appends to (`start.go:413,437,440`) — only ever populated by the `unix` scheme's two sub-branches. */
+  readonly binds: ReadonlyArray<string>;
+  /** `securityOpts` Go appends to (`start.go:413,441`) — only the `unix`/non-root sub-branch sets `label:disable`. */
+  readonly securityOpt: ReadonlyArray<string>;
+  /**
+   * `parsed.Scheme == "npipe"` (`start.go:481`): Go still creates/starts the
+   * Vector container on this branch, but — uniquely among every `start`
+   * service — does NOT add it to the `started` slice a later
+   * `WaitForHealthyService` call waits on. Orchestration-only signal for a
+   * future `start.handler.ts`; this module's builder does not act on it.
+   */
+  readonly isNpipe: boolean;
+}
+
+/**
+ * Port of the `switch parsed.Scheme` block (`start.go:421-443`) — the pure
+ * decision of what `DOCKER_HOST` env override, bind mount, and
+ * `--security-opt` Vector's container needs to reach the REAL Docker daemon
+ * from inside its own container, given an already-resolved daemon host
+ * string (see {@link legacyResolveDockerDaemonHost} for how a caller obtains
+ * one). Every branch mirrors Go's exactly:
+ *
+ * - `tcp` — proxy through `host.docker.internal` on the SAME port the daemon
+ *   host itself specified (falling back to the default DinD port `2375` when
+ *   the host string has no parseable port).
+ * - `npipe` (Windows) — same `host.docker.internal:2375` proxy target; Go
+ *   additionally prints a stderr warning here, which is this module's
+ *   caller's responsibility (output side effects don't belong in a pure spec
+ *   builder).
+ * - `unix` — no env override; instead mounts the daemon socket read-only.
+ *   Docker Desktop/Colima's KNOWN rootful-socket paths
+ *   ({@link legacyShouldMountRootDockerSocket}) get the STANDARD
+ *   `/var/run/docker.sock` bound to itself (that path is special-cased by
+ *   those runtimes "under the hood", per Go's comment) — the ACTUAL detected
+ *   path is never used as the bind source in this sub-branch. Anything else
+ *   (Podman, OrbStack) binds the actual detected socket path onto the
+ *   standard path instead, plus `--security-opt label:disable` (needed for
+ *   Podman/OrbStack's differently-labeled socket to be readable from inside a
+ *   container with a different SELinux/AppArmor label).
+ */
+export function legacyResolveVectorDockerSocketPlan(
+  daemonHost: string,
+  platform: NodeJS.Platform = process.platform,
+): LegacyVectorDockerSocketPlan {
+  const parsed = legacyParseDockerHostUrl(daemonHost);
+  const env: Record<string, string> = {};
+  const binds: Array<string> = [];
+  const securityOpt: Array<string> = [];
+
+  switch (parsed.scheme) {
+    case "tcp": {
+      const port = legacySplitHostPortPort(parsed.host) ?? LEGACY_DIND_DEFAULT_PORT;
+      env.DOCKER_HOST = `http://${LEGACY_DIND_HOST}:${port}`;
+      break;
+    }
+    case "npipe": {
+      env.DOCKER_HOST = `http://${LEGACY_DIND_HOST}:${LEGACY_DIND_DEFAULT_PORT}`;
+      break;
+    }
+    case "unix": {
+      const defaultParsed = legacyParseDockerHostUrl(legacyPlatformDefaultDockerHost(platform));
+      if (legacyShouldMountRootDockerSocket(parsed.host)) {
+        binds.push(`${defaultParsed.host}:${defaultParsed.host}:ro`);
+      } else {
+        binds.push(`${parsed.host}:${defaultParsed.host}:ro`);
+        securityOpt.push("label:disable");
+      }
+      break;
+    }
+  }
+
+  return { env, binds, securityOpt, isNpipe: parsed.scheme === "npipe" };
+}
+
+function collectText(stream: Stream.Stream<Uint8Array, unknown>) {
+  const decoder = new TextDecoder();
+  return Stream.runFold(
+    stream,
+    () => "",
+    (text, chunk) => text + decoder.decode(chunk, { stream: true }),
+  ).pipe(Effect.map((text) => text + decoder.decode()));
+}
+
+/**
+ * Best-effort resolution of the CURRENT docker CLI context's daemon endpoint,
+ * mirroring the context-store branch of Go's vendored
+ * `command.NewAPIClientFromFlags`/`resolveDockerEndpoint` (the mechanism
+ * `utils.Docker.DaemonHost()` itself goes through when `DOCKER_HOST` is
+ * unset) WITHOUT reimplementing Docker's context store file format —
+ * `docker context inspect` already performs that exact resolution (context
+ * name from `$DOCKER_CONTEXT`/`~/.docker/config.json`'s `currentContext`,
+ * then that context's stored endpoint) using the same `docker` binary this
+ * CLI already shells out to elsewhere. Deliberately does NOT fall back to
+ * `podman` (unlike `spawnContainerCli`): Podman's own `context inspect`
+ * output has no equivalent `Endpoints.docker.Host` shape, and a Podman-only
+ * host is expected to set `DOCKER_HOST` directly (checked first by
+ * {@link legacyResolveDockerDaemonHost}, before this ever runs).
+ */
+function legacyInspectDockerContextHost(spawner: Spawner): Effect.Effect<string, string> {
+  return Effect.scoped(
+    Effect.gen(function* () {
+      const child = yield* spawner
+        .spawn(
+          ChildProcess.make(
+            "docker",
+            ["context", "inspect", "--format", "{{ .Endpoints.docker.Host }}"],
+            { stdin: "ignore", stdout: "pipe", stderr: "ignore" },
+          ),
+        )
+        .pipe(Effect.mapError(() => "failed to spawn docker"));
+      const [exitCode, stdout] = yield* Effect.all(
+        [child.exitCode.pipe(Effect.map(Number)), collectText(child.stdout)],
+        { concurrency: "unbounded" },
+      ).pipe(Effect.mapError(() => "failed to read docker context inspect output"));
+      if (exitCode !== 0) {
+        return yield* Effect.fail("docker context inspect exited non-zero");
+      }
+      const host = stdout.trim();
+      if (host.length === 0) {
+        return yield* Effect.fail("docker context inspect returned an empty host");
+      }
+      return host;
+    }),
+  );
+}
+
+/**
+ * Discovers the daemon host string {@link legacyResolveVectorDockerSocketPlan}
+ * branches on, mirroring `utils.Docker.DaemonHost()`'s own resolution order
+ * (the vendored `docker/cli` library's `NewAPIClientFromFlags`,
+ * `resolveContextName`): an explicit `DOCKER_HOST` env var always wins
+ * (checked first, no shell-out needed); otherwise the CURRENT docker context's
+ * own endpoint (Docker Desktop, Colima, and OrbStack all select a non-default
+ * context rather than setting `DOCKER_HOST`) via
+ * {@link legacyInspectDockerContextHost}; finally this platform's bare
+ * default socket/pipe path when neither source resolves (no context support,
+ * `docker` missing — `legacyEnsureImagesCached`/`spawnContainerCli` will
+ * already have surfaced a clearer "docker not found" error earlier in a real
+ * `start` run if that's the actual cause).
+ */
+export function legacyResolveDockerDaemonHost(
+  spawner: Spawner,
+  env: Readonly<Record<string, string | undefined>> = process.env,
+  platform: NodeJS.Platform = process.platform,
+): Effect.Effect<string> {
+  const fromEnv = env.DOCKER_HOST;
+  if (fromEnv !== undefined && fromEnv.length > 0) {
+    return Effect.succeed(fromEnv);
+  }
+  return legacyInspectDockerContextHost(spawner).pipe(
+    Effect.orElseSucceed(() => legacyPlatformDefaultDockerHost(platform)),
+  );
+}
+
+const LEGACY_VECTOR_HEALTHCHECK = {
+  test: ["CMD", "wget", "--no-verbose", "--tries=1", "--spider", "http://127.0.0.1:9001/health"],
+  intervalSeconds: 10,
+  timeoutSeconds: 2,
+  retries: 3,
+} as const;
+
+/**
+ * Reproduces Go's exact string concatenation for the Vector entrypoint
+ * (`start.go:449-454`): writes the rendered `vector.yaml` via a `cat <<'EOF'`
+ * heredoc, then blocks on a `wget`-poll loop against Logflare's own `/health`
+ * endpoint (Vector's `docker_logs`/HTTP sinks would otherwise start before
+ * Logflare is ready to receive them) before finally exec'ing `vector`.
+ */
+export function legacyBuildVectorEntrypointScript(vectorYaml: string, logflareId: string): string {
+  return (
+    "cat <<'EOF' > /etc/vector/vector.yaml\n" +
+    vectorYaml +
+    "\nEOF\nuntil wget --no-verbose --tries=1 --spider http://" +
+    logflareId +
+    ":4000/health 2>/dev/null; do sleep 2; done\nvector --config /etc/vector/vector.yaml\n"
+  );
+}
+
+export interface LegacyVectorContainerSpecInput {
+  /** `config.analytics.vector_image`, already resolved/pulled by the caller. */
+  readonly image: string;
+  /** `legacyServiceContainerName("vector", projectId)` — Go's `utils.VectorId`; also the `vectorConfig.VectorId` template field and the `ContainerName` `DockerStart` argument. */
+  readonly containerName: string;
+  /** Go's `utils.NetId` — the shared Docker network every `start` container joins. */
+  readonly networkId: string;
+  /** `config.analytics.api_key` — the `x-api-key` header value every `vector.yaml` sink sends to Logflare. */
+  readonly apiKey: string;
+  /** Go's `utils.LogflareId` — used both as a `vector.yaml` template field and in the entrypoint's `wget` wait-loop URL. */
+  readonly logflareId: string;
+  /** Go's `utils.KongId`. */
+  readonly kongId: string;
+  /** Go's `utils.GotrueId`. */
+  readonly gotrueId: string;
+  /** Go's `utils.RestId`. */
+  readonly restId: string;
+  /** Go's `utils.RealtimeId` — UNLIKE Kong's `kong.yml`, Vector's `vector.yaml` really does use Realtime's container id here, not `Config.Realtime.TenantId` (`start.go:406`). */
+  readonly realtimeId: string;
+  /** Go's `utils.StorageId`. */
+  readonly storageId: string;
+  /** Go's `utils.EdgeRuntimeId`. */
+  readonly edgeRuntimeId: string;
+  /** Go's `utils.DbId` — the local Postgres container's own name. */
+  readonly dbId: string;
+  /** Already-resolved via {@link legacyResolveDockerDaemonHost} + {@link legacyResolveVectorDockerSocketPlan}, keeping this builder a pure function of its `input`. */
+  readonly dockerSocketPlan: LegacyVectorDockerSocketPlan;
+}
+
+/**
+ * Assembles Vector's {@link LegacyStartContainerSpec}. Pure — no Effect or
+ * ambient I/O — matching every other `start`-service builder in this
+ * directory.
+ */
+export function legacyBuildVectorContainerSpec(
+  input: LegacyVectorContainerSpecInput,
+): LegacyStartContainerSpec {
+  const vectorYaml = legacyRenderStartVectorYaml({
+    apiKey: input.apiKey,
+    vectorId: input.containerName,
+    logflareId: input.logflareId,
+    kongId: input.kongId,
+    gotrueId: input.gotrueId,
+    restId: input.restId,
+    realtimeId: input.realtimeId,
+    storageId: input.storageId,
+    edgeRuntimeId: input.edgeRuntimeId,
+    dbId: input.dbId,
+  });
+
+  return {
+    image: input.image,
+    containerName: input.containerName,
+    env: input.dockerSocketPlan.env,
+    entrypoint: "sh",
+    cmd: ["-c", legacyBuildVectorEntrypointScript(vectorYaml, input.logflareId)],
+    binds: input.dockerSocketPlan.binds,
+    healthcheck: LEGACY_VECTOR_HEALTHCHECK,
+    restartPolicy: "unless-stopped",
+    securityOpt: input.dockerSocketPlan.securityOpt,
+    networkId: input.networkId,
+    networkAliases: LEGACY_VECTOR_NETWORK_ALIASES,
+    labels: {},
+  };
+}
diff --git a/apps/cli/src/legacy/commands/start/services/vector.service.unit.test.ts b/apps/cli/src/legacy/commands/start/services/vector.service.unit.test.ts
new file mode 100644
index 0000000000..69429ea9dd
--- /dev/null
+++ b/apps/cli/src/legacy/commands/start/services/vector.service.unit.test.ts
@@ -0,0 +1,366 @@
+import { describe, expect, it, test } from "@effect/vitest";
+import { Deferred, Effect, Sink, Stream } from "effect";
+import { ChildProcessSpawner } from "effect/unstable/process";
+
+import {
+  legacyBuildVectorContainerSpec,
+  legacyBuildVectorEntrypointScript,
+  legacyParseDockerHostUrl,
+  legacyPlatformDefaultDockerHost,
+  legacyResolveDockerDaemonHost,
+  legacyResolveVectorDockerSocketPlan,
+  legacyShouldMountRootDockerSocket,
+  legacySplitHostPortPort,
+  type LegacyVectorContainerSpecInput,
+  type LegacyVectorDockerSocketPlan,
+} from "./vector.service.ts";
+
+/** Matches the standing `mockSpawner` shape in `image-prepull.unit.test.ts`. */
+function mockSpawner(
+  handler: (args: ReadonlyArray<string>) => { exitCode: number; stdout?: string; stderr?: string },
+) {
+  const encoder = new TextEncoder();
+  const spawned: Array<ReadonlyArray<string>> = [];
+
+  const spawner = ChildProcessSpawner.make((command) =>
+    Effect.gen(function* () {
+      const args = command._tag === "StandardCommand" ? command.args : [];
+      spawned.push(args);
+      const result = handler(args);
+
+      const exitDeferred = yield* Deferred.make<ChildProcessSpawner.ExitCode>();
+      yield* Deferred.succeed(exitDeferred, ChildProcessSpawner.ExitCode(result.exitCode));
+
+      return ChildProcessSpawner.makeHandle({
+        pid: ChildProcessSpawner.ProcessId(1),
+        stdout: Stream.fromIterable(
+          result.stdout !== undefined ? [encoder.encode(result.stdout)] : [],
+        ),
+        stderr: Stream.fromIterable(
+          result.stderr !== undefined ? [encoder.encode(result.stderr)] : [],
+        ),
+        all: Stream.empty,
+        exitCode: Deferred.await(exitDeferred),
+        isRunning: Effect.succeed(false),
+        stdin: Sink.drain,
+        kill: () => Effect.void,
+        unref: Effect.succeed(Effect.void),
+        getInputFd: () => Sink.drain,
+        getOutputFd: () => Stream.empty,
+      });
+    }),
+  );
+
+  return {
+    spawner,
+    get spawned() {
+      return spawned;
+    },
+  };
+}
+
+describe("legacyParseDockerHostUrl", () => {
+  test("splits a tcp host into scheme/host", () => {
+    expect(legacyParseDockerHostUrl("tcp://127.0.0.1:2375")).toEqual({
+      scheme: "tcp",
+      host: "127.0.0.1:2375",
+    });
+  });
+
+  test("splits a unix socket host", () => {
+    expect(legacyParseDockerHostUrl("unix:///var/run/docker.sock")).toEqual({
+      scheme: "unix",
+      host: "/var/run/docker.sock",
+    });
+  });
+
+  test("splits an npipe host", () => {
+    expect(legacyParseDockerHostUrl("npipe:////./pipe/docker_engine")).toEqual({
+      scheme: "npipe",
+      host: "//./pipe/docker_engine",
+    });
+  });
+
+  test("strips a trailing path from a tcp host, matching Go's url.Parse round-trip", () => {
+    expect(legacyParseDockerHostUrl("tcp://127.0.0.1:2375/some/path")).toEqual({
+      scheme: "tcp",
+      host: "127.0.0.1:2375",
+    });
+  });
+
+  test("throws on a host with no scheme separator", () => {
+    expect(() => legacyParseDockerHostUrl("not-a-host")).toThrow();
+  });
+
+  test("throws on an empty address", () => {
+    expect(() => legacyParseDockerHostUrl("tcp://")).toThrow();
+  });
+});
+
+describe("legacySplitHostPortPort", () => {
+  test("extracts the port from host:port", () => {
+    expect(legacySplitHostPortPort("127.0.0.1:2375")).toBe("2375");
+  });
+
+  test("returns undefined when there is no port", () => {
+    expect(legacySplitHostPortPort("127.0.0.1")).toBeUndefined();
+  });
+
+  test("returns undefined when the trailing segment isn't numeric", () => {
+    expect(legacySplitHostPortPort("host:not-a-port")).toBeUndefined();
+  });
+});
+
+describe("legacyShouldMountRootDockerSocket", () => {
+  test("recognizes Docker Desktop's current rootful socket path", () => {
+    expect(legacyShouldMountRootDockerSocket("/Users/me/.docker/run/docker.sock")).toBe(true);
+  });
+
+  test("recognizes Docker Desktop's older rootful socket path", () => {
+    expect(legacyShouldMountRootDockerSocket("/Users/me/.docker/desktop/docker.sock")).toBe(true);
+  });
+
+  test("recognizes any Colima profile's socket path", () => {
+    expect(legacyShouldMountRootDockerSocket("/Users/me/.colima/default/docker.sock")).toBe(true);
+  });
+
+  test("recognizes Colima's default (unprofiled) socket path", () => {
+    expect(legacyShouldMountRootDockerSocket("/Users/me/.colima/docker.sock")).toBe(true);
+  });
+
+  test("does not match a Podman rootless socket path", () => {
+    expect(legacyShouldMountRootDockerSocket("/run/user/1000/podman/podman.sock")).toBe(false);
+  });
+
+  test("does not match an OrbStack socket path", () => {
+    expect(legacyShouldMountRootDockerSocket("/Users/me/.orbstack/run/docker.sock")).toBe(false);
+  });
+
+  test("does not match a bare Linux root socket path (never reached in practice, since that branch never checks it)", () => {
+    expect(legacyShouldMountRootDockerSocket("/var/run/docker.sock")).toBe(false);
+  });
+});
+
+describe("legacyPlatformDefaultDockerHost", () => {
+  test("resolves the unix default off Windows", () => {
+    expect(legacyPlatformDefaultDockerHost("darwin")).toBe("unix:///var/run/docker.sock");
+    expect(legacyPlatformDefaultDockerHost("linux")).toBe("unix:///var/run/docker.sock");
+  });
+
+  test("resolves the npipe default on Windows", () => {
+    expect(legacyPlatformDefaultDockerHost("win32")).toBe("npipe:////./pipe/docker_engine");
+  });
+});
+
+describe("legacyResolveVectorDockerSocketPlan", () => {
+  test("tcp: proxies through host.docker.internal on the daemon's own port, no binds/securityOpt (start.go:422-426)", () => {
+    const plan = legacyResolveVectorDockerSocketPlan("tcp://127.0.0.1:2376");
+    expect(plan).toEqual<LegacyVectorDockerSocketPlan>({
+      env: { DOCKER_HOST: "http://host.docker.internal:2376" },
+      binds: [],
+      securityOpt: [],
+      isNpipe: false,
+    });
+  });
+
+  test("tcp: falls back to the default DinD port 2375 when the host string has no parseable port", () => {
+    const plan = legacyResolveVectorDockerSocketPlan("tcp://myhost");
+    expect(plan.env).toEqual({ DOCKER_HOST: "http://host.docker.internal:2375" });
+  });
+
+  test("npipe: proxies through host.docker.internal:2375 and flags isNpipe (start.go:427-430,481)", () => {
+    const plan = legacyResolveVectorDockerSocketPlan("npipe:////./pipe/docker_engine");
+    expect(plan).toEqual<LegacyVectorDockerSocketPlan>({
+      env: { DOCKER_HOST: "http://host.docker.internal:2375" },
+      binds: [],
+      securityOpt: [],
+      isNpipe: true,
+    });
+  });
+
+  test("unix + known rootful socket (Docker Desktop): binds the STANDARD socket path to itself, no env/securityOpt (start.go:431-437)", () => {
+    const plan = legacyResolveVectorDockerSocketPlan(
+      "unix:///Users/me/.docker/run/docker.sock",
+      "darwin",
+    );
+    expect(plan).toEqual<LegacyVectorDockerSocketPlan>({
+      env: {},
+      binds: ["/var/run/docker.sock:/var/run/docker.sock:ro"],
+      securityOpt: [],
+      isNpipe: false,
+    });
+  });
+
+  test("unix + known rootful socket (Colima): same standard-socket-to-itself bind", () => {
+    const plan = legacyResolveVectorDockerSocketPlan(
+      "unix:///Users/me/.colima/default/docker.sock",
+      "darwin",
+    );
+    expect(plan.binds).toEqual(["/var/run/docker.sock:/var/run/docker.sock:ro"]);
+    expect(plan.securityOpt).toEqual([]);
+  });
+
+  test("unix + rootless socket (Podman/OrbStack): binds the ACTUAL detected path onto the standard path, plus label:disable (start.go:438-442)", () => {
+    const plan = legacyResolveVectorDockerSocketPlan(
+      "unix:///run/user/1000/podman/podman.sock",
+      "linux",
+    );
+    expect(plan).toEqual<LegacyVectorDockerSocketPlan>({
+      env: {},
+      binds: ["/run/user/1000/podman/podman.sock:/var/run/docker.sock:ro"],
+      securityOpt: ["label:disable"],
+      isNpipe: false,
+    });
+  });
+
+  test("unix on a Windows-platform default (edge case): recomputes the platform default as npipe", () => {
+    const plan = legacyResolveVectorDockerSocketPlan("unix:///run/user/1000/podman.sock", "win32");
+    expect(plan.binds).toEqual(["/run/user/1000/podman.sock://./pipe/docker_engine:ro"]);
+    expect(plan.securityOpt).toEqual(["label:disable"]);
+  });
+});
+
+describe("legacyBuildVectorEntrypointScript", () => {
+  test("writes vector.yaml then waits on Logflare's health endpoint before exec'ing vector (start.go:449-454)", () => {
+    expect(legacyBuildVectorEntrypointScript("VECTOR_YAML", "supabase_analytics_proj")).toBe(
+      "cat <<'EOF' > /etc/vector/vector.yaml\n" +
+        "VECTOR_YAML" +
+        "\nEOF\nuntil wget --no-verbose --tries=1 --spider http://" +
+        "supabase_analytics_proj" +
+        ":4000/health 2>/dev/null; do sleep 2; done\nvector --config /etc/vector/vector.yaml\n",
+    );
+  });
+});
+
+const base: LegacyVectorContainerSpecInput = {
+  image: "supabase/vector:0.28.1",
+  containerName: "supabase_vector_proj",
+  networkId: "supabase_network_proj",
+  apiKey: "api-key",
+  logflareId: "supabase_analytics_proj",
+  kongId: "supabase_kong_proj",
+  gotrueId: "supabase_auth_proj",
+  restId: "supabase_rest_proj",
+  realtimeId: "supabase_realtime_proj",
+  storageId: "supabase_storage_proj",
+  edgeRuntimeId: "supabase_edge_runtime_proj",
+  dbId: "supabase_db_proj",
+  dockerSocketPlan: { env: {}, binds: [], securityOpt: [], isNpipe: false },
+};
+
+describe("legacyBuildVectorContainerSpec", () => {
+  test("builds identity, entrypoint, healthcheck, restart policy, network aliases (start.go:444-477)", () => {
+    const spec = legacyBuildVectorContainerSpec(base);
+    expect(spec.image).toBe("supabase/vector:0.28.1");
+    expect(spec.containerName).toBe("supabase_vector_proj");
+    expect(spec.entrypoint).toBe("sh");
+    expect(spec.cmd?.[0]).toBe("-c");
+    expect(spec.healthcheck).toEqual({
+      test: [
+        "CMD",
+        "wget",
+        "--no-verbose",
+        "--tries=1",
+        "--spider",
+        "http://127.0.0.1:9001/health",
+      ],
+      intervalSeconds: 10,
+      timeoutSeconds: 2,
+      retries: 3,
+    });
+    expect(spec.restartPolicy).toBe("unless-stopped");
+    expect(spec.networkId).toBe("supabase_network_proj");
+    expect(spec.networkAliases).toEqual(["vector"]);
+    expect(spec.labels).toEqual({});
+  });
+
+  test("passes the docker-socket plan's env/binds/securityOpt straight through", () => {
+    const spec = legacyBuildVectorContainerSpec({
+      ...base,
+      dockerSocketPlan: {
+        env: { DOCKER_HOST: "http://host.docker.internal:2375" },
+        binds: ["/var/run/docker.sock:/var/run/docker.sock:ro"],
+        securityOpt: ["label:disable"],
+        isNpipe: false,
+      },
+    });
+    expect(spec.env).toEqual({ DOCKER_HOST: "http://host.docker.internal:2375" });
+    expect(spec.binds).toEqual(["/var/run/docker.sock:/var/run/docker.sock:ro"]);
+    expect(spec.securityOpt).toEqual(["label:disable"]);
+  });
+
+  test("renders vector.yaml using the container's own name as VectorId and excludes it from docker_logs", () => {
+    const spec = legacyBuildVectorContainerSpec(base);
+    const script = String(spec.cmd?.[1]);
+    expect(script).toContain('"supabase_vector_proj"');
+    expect(script).toContain('.appname == "supabase_kong_proj"');
+  });
+});
+
+describe("legacyResolveDockerDaemonHost", () => {
+  it.live("prefers an explicit DOCKER_HOST env var over any context inspection", () => {
+    const mock = mockSpawner(() => ({ exitCode: 1 }));
+    return legacyResolveDockerDaemonHost(
+      mock.spawner,
+      { DOCKER_HOST: "tcp://127.0.0.1:2376" },
+      "darwin",
+    ).pipe(
+      Effect.map((host) => {
+        expect(host).toBe("tcp://127.0.0.1:2376");
+        expect(mock.spawned).toHaveLength(0);
+      }),
+    );
+  });
+
+  it.live("falls back to the current docker context's endpoint when DOCKER_HOST is unset", () => {
+    const mock = mockSpawner((args) => {
+      if (args[0] === "context" && args[1] === "inspect") {
+        return { exitCode: 0, stdout: "unix:///Users/me/.colima/default/docker.sock\n" };
+      }
+      return { exitCode: 1 };
+    });
+    return legacyResolveDockerDaemonHost(mock.spawner, {}, "darwin").pipe(
+      Effect.map((host) => {
+        expect(host).toBe("unix:///Users/me/.colima/default/docker.sock");
+      }),
+    );
+  });
+
+  it.live("falls back to the platform default when docker context inspect fails", () => {
+    const mock = mockSpawner(() => ({ exitCode: 1 }));
+    return legacyResolveDockerDaemonHost(mock.spawner, {}, "darwin").pipe(
+      Effect.map((host) => {
+        expect(host).toBe("unix:///var/run/docker.sock");
+      }),
+    );
+  });
+
+  it.live(
+    "falls back to the platform default when docker context inspect returns an empty host",
+    () => {
+      const mock = mockSpawner(() => ({ exitCode: 0, stdout: "\n" }));
+      return legacyResolveDockerDaemonHost(mock.spawner, {}, "win32").pipe(
+        Effect.map((host) => {
+          expect(host).toBe("npipe:////./pipe/docker_engine");
+        }),
+      );
+    },
+  );
+
+  it.live(
+    "treats an empty DOCKER_HOST value as unset, falling through to context inspection",
+    () => {
+      const mock = mockSpawner((args) => {
+        if (args[0] === "context" && args[1] === "inspect") {
+          return { exitCode: 0, stdout: "tcp://127.0.0.1:2376\n" };
+        }
+        return { exitCode: 1 };
+      });
+      return legacyResolveDockerDaemonHost(mock.spawner, { DOCKER_HOST: "" }, "darwin").pipe(
+        Effect.map((host) => {
+          expect(host).toBe("tcp://127.0.0.1:2376");
+        }),
+      );
+    },
+  );
+});
diff --git a/apps/cli/src/legacy/commands/start/start.command.ts b/apps/cli/src/legacy/commands/start/start.command.ts
index 652128002e..42a20b4dfd 100644
--- a/apps/cli/src/legacy/commands/start/start.command.ts
+++ b/apps/cli/src/legacy/commands/start/start.command.ts
@@ -1,12 +1,32 @@
+import { Layer } from "effect";
 import { Command, Flag } from "effect/unstable/cli";
 import type * as CliCommand from "effect/unstable/cli/Command";
+
+import { commandRuntimeLayer } from "../../../shared/runtime/command-runtime.layer.ts";
+import { withJsonErrorHandling } from "../../../shared/output/json-error-handling.ts";
+import { legacyHttpClientLayer } from "../../auth/legacy-http-debug.layer.ts";
+import { legacyCliConfigLayer } from "../../config/legacy-cli-config.layer.ts";
+import { legacyDbConnectionLayer } from "../../shared/legacy-db-connection.layer.ts";
+import { legacyDebugLoggerLayer } from "../../shared/legacy-debug-logger.layer.ts";
+import { legacyDockerRunLayer } from "../../shared/legacy-docker-run.layer.ts";
+import { legacyParseStringSliceFlag } from "../../shared/legacy-string-slice-flag.ts";
+import { legacyTelemetryStateLayer } from "../../telemetry/legacy-telemetry-state.layer.ts";
+import { withLegacyCommandInstrumentation } from "../../telemetry/legacy-command-instrumentation.ts";
+import { LEGACY_START_EXCLUDABLE_KEYS } from "./start.exclude.ts";
 import { legacyStart } from "./start.handler.ts";
 
 const config = {
+  // Go registers `--exclude`/`-x` as a pflag `StringSliceVarP` (`cmd/start.go:58`), which
+  // CSV-splits each occurrence (`--exclude gotrue,realtime` -> two values) and accumulates
+  // across repeats — matching `status`'s own `--exclude`/`--override-name` handling.
   exclude: Flag.string("exclude").pipe(
     Flag.atLeast(0),
+    Flag.mapTryCatch(
+      (rawValues) => legacyParseStringSliceFlag(rawValues),
+      (err) => (err instanceof Error ? err.message : String(err)),
+    ),
     Flag.withDescription(
-      "Names of containers to not start. [analytics,db,edge-runtime,functions,imgproxy,inbucket,kong,meta,realtime,rest,storage,studio,vector]",
+      `Names of containers to not start. [${LEGACY_START_EXCLUDABLE_KEYS.join(",")}]`,
     ),
     Flag.withDefault([] as ReadonlyArray<string>),
     Flag.withAlias("x"),
@@ -22,8 +42,38 @@ const config = {
 
 export type LegacyStartFlags = CliCommand.Command.Config.Infer<typeof config>;
 
+// `start` makes no Management API calls (Go's start needs no access token) and talks
+// directly to Docker, so it deliberately avoids `legacyManagementApiRuntimeLayer` —
+// it provides only the services the handler + instrumentation consume, mirroring
+// `stop`/`status`'s runtime shape. `ChildProcessSpawner`/`ProcessControl`/`RuntimeInfo`
+// are not listed here: they come from `BunServices`/`processControlLayer`/
+// `runtimeInfoLayer` in the root runtime (`shared/cli/run.ts`), the same way
+// `stop`/`status` rely on the former. `HttpClient.HttpClient` is NOT provided by the
+// root runtime — `BunServices.layer` never supplies it, and `unixHttpClientLayer` is a
+// different service tag entirely — so it's composed here via `legacyHttpClientLayer`,
+// the same `FetchHttpClient`-backed layer `db reset`/`seed buckets` use, needed for the
+// health-check probes (`legacyWaitForHealthyServices`) and `legacySeedBucketsRun`.
+// `legacyDockerRunLayer`/`legacyDbConnectionLayer` ARE listed here — the fresh-volume
+// `SetupLocalDatabase` equivalent (`start.handler.ts`'s `legacyStartSetupLocalDatabase`
+// call) needs both: the PG15+ one-shot migrate jobs run through `LegacyDockerRun`, and
+// the schema/globals/API-privileges SQL runs over a direct `LegacyDbConnection` session.
+const cliConfig = legacyCliConfigLayer.pipe(Layer.provide(legacyDebugLoggerLayer));
+const httpClient = legacyHttpClientLayer.pipe(Layer.provide(legacyDebugLoggerLayer));
+
+const legacyStartRuntimeLayer = Layer.mergeAll(
+  cliConfig,
+  legacyTelemetryStateLayer,
+  commandRuntimeLayer(["start"]),
+  legacyDockerRunLayer,
+  legacyDbConnectionLayer,
+  httpClient,
+);
+
 export const legacyStartCommand = Command.make("start", config).pipe(
   Command.withDescription("Start containers for Supabase local development."),
   Command.withShortDescription("Start local Supabase stack"),
-  Command.withHandler((flags) => legacyStart(flags)),
+  Command.withHandler((flags) =>
+    legacyStart(flags).pipe(withLegacyCommandInstrumentation({ flags }), withJsonErrorHandling),
+  ),
+  Command.provide(legacyStartRuntimeLayer),
 );
diff --git a/apps/cli/src/legacy/commands/start/start.e2e.test.ts b/apps/cli/src/legacy/commands/start/start.e2e.test.ts
new file mode 100644
index 0000000000..6b9932f1e7
--- /dev/null
+++ b/apps/cli/src/legacy/commands/start/start.e2e.test.ts
@@ -0,0 +1,55 @@
+import { mkdtempSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { afterEach, beforeEach, describe, expect, test } from "vitest";
+
+import { runSupabase } from "../../../../tests/helpers/cli.ts";
+
+const E2E_TIMEOUT_MS = 30_000;
+
+// Strip ANSI so the assertion is colour-independent — `legacyPartitionStartExcludeFlags`
+// styles the warning via `legacy-colors.ts`, matching `start.exclude.unit.test.ts`'s
+// own convention for the same text.
+// eslint-disable-next-line no-control-regex
+const stripAnsi = (text: string) => text.replace(/\x1b\[[0-9;]*m/gu, "");
+
+describe("supabase start (legacy)", () => {
+  let projectDir: string;
+
+  beforeEach(() => {
+    projectDir = mkdtempSync(join(tmpdir(), "sb-start-e2e-"));
+  });
+
+  afterEach(() => {
+    rmSync(projectDir, { recursive: true, force: true });
+  });
+
+  // Golden-path smoke test for the real subprocess boundary: `validateExcludedContainers`
+  // (`cmd/start.go:49`) runs unconditionally as `RunE`'s very first line, before config
+  // load or any Docker access, so an invalid `--exclude` value must print Go's `WARNING:`
+  // text regardless of what happens afterwards. No `supabase/config.toml` is seeded — an
+  // absent config is not itself a failure (Go/this port both proceed with defaults) — so
+  // the command runs past config loading and reaches a real Docker call, which this test
+  // forces to fail fast and deterministically via an unreachable `DOCKER_HOST` rather than
+  // relying on whether a real Docker daemon happens to be reachable in the sandbox: with a
+  // real daemon this pins the test to a fast, predictable failure instead of a slow real
+  // image pull; without one it fails just as fast because `docker`/`podman` can't be
+  // spawned at all. Either way the command must still exit non-zero cleanly after printing
+  // the warning — this is the only invariant asserted, not which downstream error fires.
+  test(
+    "prints the invalid --exclude warning then fails cleanly on the Docker call",
+    { timeout: E2E_TIMEOUT_MS },
+    async () => {
+      const { exitCode, stdout, stderr } = await runSupabase(["start", "--exclude", "bogus"], {
+        entrypoint: "legacy",
+        cwd: projectDir,
+        env: { DOCKER_HOST: "tcp://127.0.0.1:1" },
+      });
+
+      expect(stripAnsi(stderr), `stdout:\n${stdout}\nstderr:\n${stderr}`).toContain(
+        "WARNING: The following container names are not valid to exclude: bogus",
+      );
+      expect(exitCode, `stdout:\n${stdout}\nstderr:\n${stderr}`).not.toBe(0);
+    },
+  );
+});
diff --git a/apps/cli/src/legacy/commands/start/start.errors.ts b/apps/cli/src/legacy/commands/start/start.errors.ts
new file mode 100644
index 0000000000..ea029e2b48
--- /dev/null
+++ b/apps/cli/src/legacy/commands/start/start.errors.ts
@@ -0,0 +1,29 @@
+import { Data } from "effect";
+
+/**
+ * An explicit `--workdir`/`SUPABASE_WORKDIR` path doesn't exist or isn't a
+ * directory. Mirrors Go's `ChangeWorkDir` (`apps/cli-go/internal/utils/misc.go:
+ * 231-250`), which unconditionally `os.Chdir(workdir)`s in `PersistentPreRunE`
+ * (`apps/cli-go/cmd/root.go:93-105`) — before `start`'s own flag validation or
+ * `RunE`, so a bad explicit workdir must fail here first, before config load
+ * or any Docker access.
+ */
+export class LegacyStartWorkdirError extends Data.TaggedError("LegacyStartWorkdirError")<{
+  readonly message: string;
+}> {}
+
+/** Loading `config.toml` failed for a reason other than the file being absent (malformed TOML). */
+export class LegacyStartConfigLoadError extends Data.TaggedError("LegacyStartConfigLoadError")<{
+  readonly message: string;
+}> {}
+
+/**
+ * `config.toml` resolved to a value `Config.Validate` would reject before
+ * `start` ever brings up a container — e.g. an `auth.jwt_secret` shorter than
+ * 16 characters (`pkg/config/apikeys.go:45-47`).
+ */
+export class LegacyStartInvalidConfigError extends Data.TaggedError(
+  "LegacyStartInvalidConfigError",
+)<{
+  readonly message: string;
+}> {}
diff --git a/apps/cli/src/legacy/commands/start/start.exclude.ts b/apps/cli/src/legacy/commands/start/start.exclude.ts
new file mode 100644
index 0000000000..38691ef775
--- /dev/null
+++ b/apps/cli/src/legacy/commands/start/start.exclude.ts
@@ -0,0 +1,82 @@
+import { legacyAqua, legacyYellow } from "../../shared/legacy-colors.ts";
+import { LEGACY_SERVICE_CATALOG } from "../../shared/legacy-service-catalog.ts";
+
+/**
+ * Go's real `ExcludableContainers()` order (`apps/cli-go/internal/start/start.go:
+ * 1297-1303`), which walks `config.Images.Services()`
+ * (`apps/cli-go/pkg/config/constants.go:60-76`) in this exact sequence — Gotrue,
+ * Realtime, Storage, ImgProxy, Kong, Inbucket, Postgrest, Pgmeta, Studio,
+ * EdgeRuntime, Logflare, Vector, Supavisor. This is NOT
+ * `LEGACY_SERVICE_CATALOG`'s stored order, which is Go's *start* sequence
+ * (Postgres first, Kong before Gotrue, etc). Expressed here as `service` keys
+ * so the actual `excludeKey` strings stay single-sourced from the catalog.
+ */
+const EXCLUDABLE_SERVICE_KEYS_IN_GO_ORDER: ReadonlyArray<string> = [
+  "gotrue",
+  "realtime",
+  "storage",
+  "imgproxy",
+  "kong",
+  "mailpit",
+  "postgrest",
+  "pgMeta",
+  "studio",
+  "edgeRuntime",
+  "logflare",
+  "vector",
+  "supavisor",
+];
+
+const EXCLUDE_KEY_BY_SERVICE = new Map(
+  LEGACY_SERVICE_CATALOG.map((entry) => [entry.service, entry.excludeKey]),
+);
+
+/**
+ * The 13 valid `--exclude` values, in Go's `ExcludableContainers()` order.
+ * Postgres has no `excludeKey` (it is never excludable), so it is deliberately
+ * absent — matching Go, which rejects `db`/`postgres` as invalid `--exclude`
+ * values the same as any other unrecognized string.
+ */
+export const LEGACY_START_EXCLUDABLE_KEYS: ReadonlyArray<string> =
+  EXCLUDABLE_SERVICE_KEYS_IN_GO_ORDER.map((service) => EXCLUDE_KEY_BY_SERVICE.get(service) ?? "");
+
+export interface LegacyStartExcludePartition {
+  /** Raw `--exclude` values that matched a `LEGACY_START_EXCLUDABLE_KEYS` entry, in input order. */
+  readonly valid: ReadonlyArray<string>;
+  /** Raw `--exclude` values that matched nothing, in input order. */
+  readonly invalid: ReadonlyArray<string>;
+  /**
+   * Go's exact stderr `WARNING:` text (`cmd/start.go:16-36`'s
+   * `validateExcludedContainers`), present only when `invalid` is non-empty.
+   */
+  readonly warning?: string;
+}
+
+/**
+ * Port of `validateExcludedContainers` (`apps/cli-go/cmd/start.go:16-36`). Go
+ * never fails the command over an unrecognized `--exclude` value — it prints a
+ * `WARNING:` to stderr and `RunE` proceeds regardless. The valid-options list
+ * in the warning is alphabetically sorted (`sort.Strings(validContainers)`),
+ * unlike `LEGACY_START_EXCLUDABLE_KEYS`'s Go-start-order sequence used for the
+ * flag's help text.
+ */
+export function legacyPartitionStartExcludeFlags(
+  rawValues: ReadonlyArray<string>,
+): LegacyStartExcludePartition {
+  const validKeys = new Set(LEGACY_START_EXCLUDABLE_KEYS);
+  const valid: string[] = [];
+  const invalid: string[] = [];
+  for (const value of rawValues) {
+    if (validKeys.has(value)) valid.push(value);
+    else invalid.push(value);
+  }
+
+  if (invalid.length === 0) return { valid, invalid };
+
+  const sortedValidKeys = [...LEGACY_START_EXCLUDABLE_KEYS].sort();
+  const warning =
+    `${legacyYellow("WARNING:")} The following container names are not valid to exclude: ` +
+    `${legacyAqua(invalid.join(", "))}\n` +
+    `Valid containers to exclude are: ${legacyAqua(sortedValidKeys.join(", "))}\n`;
+  return { valid, invalid, warning };
+}
diff --git a/apps/cli/src/legacy/commands/start/start.exclude.unit.test.ts b/apps/cli/src/legacy/commands/start/start.exclude.unit.test.ts
new file mode 100644
index 0000000000..6964f40140
--- /dev/null
+++ b/apps/cli/src/legacy/commands/start/start.exclude.unit.test.ts
@@ -0,0 +1,91 @@
+import { describe, expect, it } from "vitest";
+
+import { LEGACY_START_EXCLUDABLE_KEYS, legacyPartitionStartExcludeFlags } from "./start.exclude.ts";
+
+// The warning applies Go-parity ANSI styling via `legacy-colors.ts`, which
+// no-ops on a real non-TTY stream but the vitest process presents its stderr
+// as color-capable. Strip escapes so these assertions target the plain text
+// content — matching `status.pretty.unit.test.ts`'s convention.
+// eslint-disable-next-line no-control-regex
+const stripAnsi = (text: string) => text.replace(/\x1b\[[0-9;]*m/gu, "");
+
+// Go's `ExcludableContainers()` order (`apps/cli-go/internal/start/start.go:
+// 1297-1303` walking `config.Images.Services()`,
+// `apps/cli-go/pkg/config/constants.go:60-76`), expressed as the exact
+// `--exclude` values Go's `utils.ShortContainerImageName` produces for each.
+const EXPECTED_ORDER = [
+  "gotrue",
+  "realtime",
+  "storage-api",
+  "imgproxy",
+  "kong",
+  "mailpit",
+  "postgrest",
+  "postgres-meta",
+  "studio",
+  "edge-runtime",
+  "logflare",
+  "vector",
+  "supavisor",
+];
+
+describe("LEGACY_START_EXCLUDABLE_KEYS", () => {
+  it("matches Go's ExcludableContainers() order exactly", () => {
+    expect(LEGACY_START_EXCLUDABLE_KEYS).toEqual(EXPECTED_ORDER);
+  });
+
+  it("has exactly 13 entries with no duplicates", () => {
+    expect(LEGACY_START_EXCLUDABLE_KEYS).toHaveLength(13);
+    expect(new Set(LEGACY_START_EXCLUDABLE_KEYS).size).toBe(13);
+  });
+
+  it("never includes db/postgres — Postgres has no excludeKey in Go", () => {
+    expect(LEGACY_START_EXCLUDABLE_KEYS).not.toContain("db");
+    expect(LEGACY_START_EXCLUDABLE_KEYS).not.toContain("postgres");
+  });
+});
+
+describe("legacyPartitionStartExcludeFlags", () => {
+  it("treats every excludable key as valid with no warning", () => {
+    const result = legacyPartitionStartExcludeFlags(EXPECTED_ORDER);
+    expect(result.valid).toEqual(EXPECTED_ORDER);
+    expect(result.invalid).toEqual([]);
+    expect(result.warning).toBeUndefined();
+  });
+
+  it("returns no warning for an empty --exclude list", () => {
+    const result = legacyPartitionStartExcludeFlags([]);
+    expect(result.valid).toEqual([]);
+    expect(result.invalid).toEqual([]);
+    expect(result.warning).toBeUndefined();
+  });
+
+  it("treats db/postgres as invalid, matching Go", () => {
+    const result = legacyPartitionStartExcludeFlags(["db", "postgres"]);
+    expect(result.valid).toEqual([]);
+    expect(result.invalid).toEqual(["db", "postgres"]);
+    expect(result.warning).toBeDefined();
+  });
+
+  it("partitions valid and invalid values, preserving input order", () => {
+    const result = legacyPartitionStartExcludeFlags(["kong", "bogus", "gotrue", "nope"]);
+    expect(result.valid).toEqual(["kong", "gotrue"]);
+    expect(result.invalid).toEqual(["bogus", "nope"]);
+  });
+
+  it("produces Go's exact WARNING: text, with the valid list alphabetically sorted", () => {
+    const result = legacyPartitionStartExcludeFlags(["bogus"]);
+    const sortedValid = [...EXPECTED_ORDER].sort();
+    expect(stripAnsi(result.warning ?? "")).toBe(
+      "WARNING: The following container names are not valid to exclude: bogus\n" +
+        `Valid containers to exclude are: ${sortedValid.join(", ")}\n`,
+    );
+  });
+
+  it("joins multiple invalid values with ', ' in input order", () => {
+    const result = legacyPartitionStartExcludeFlags(["zeta", "alpha"]);
+    expect(stripAnsi(result.warning ?? "")).toContain(
+      "The following container names are not valid to exclude: zeta, alpha\n",
+    );
+  });
+});
diff --git a/apps/cli/src/legacy/commands/start/start.format.ts b/apps/cli/src/legacy/commands/start/start.format.ts
new file mode 100644
index 0000000000..0afe71febc
--- /dev/null
+++ b/apps/cli/src/legacy/commands/start/start.format.ts
@@ -0,0 +1,84 @@
+import { legacyAqua, legacyYellow } from "../../shared/legacy-colors.ts";
+
+/**
+ * Pure text formatters for `start`'s stderr progress/status lines. No Effect,
+ * no I/O — each export returns the exact bytes Go writes via
+ * `fmt.Fprintln`/`fmt.Fprintf`, trailing newline(s) included, so a caller can
+ * write the result straight to stderr (`output.raw(..., "stderr")` or
+ * `process.stderr.write`) without reassembling Go's spacing itself.
+ */
+
+/**
+ * Go's `fmt.Fprintln(os.Stderr, utils.Aqua("supabase start")+" is already
+ * running.")` (`apps/cli-go/internal/start/start.go:55`) — printed when
+ * `AssertSupabaseDbIsRunning` finds the db container already present, before
+ * `start` delegates entirely to `status`'s own rendering.
+ */
+export function legacyStartAlreadyRunningMessage(): string {
+  return `${legacyAqua("supabase start")} is already running.\n`;
+}
+
+/**
+ * Go's `fmt.Fprintln(os.Stderr, "Starting containers...")`
+ * (`apps/cli-go/internal/start/start.go:300`) — printed after Postgres itself
+ * has already started and health-checked, immediately before the other 13
+ * services begin creating.
+ */
+export const LEGACY_START_STARTING_CONTAINERS_MESSAGE = "Starting containers...\n";
+
+/**
+ * Go's `fmt.Fprintln(os.Stderr, "Waiting for health checks...")`
+ * (`apps/cli-go/internal/start/start.go:1270`) — printed once every
+ * non-Postgres container has been created and started, immediately before the
+ * shared health-check polling loop begins.
+ */
+export const LEGACY_START_WAITING_FOR_HEALTH_CHECKS_MESSAGE = "Waiting for health checks...\n";
+
+/**
+ * Go's `fmt.Fprintln(w, "Starting database...")`
+ * (`apps/cli-go/internal/db/start/start.go:165-175`) — printed right before
+ * the Postgres container itself is created/started, when the pre-create
+ * volume-existence check finds no existing volume (a brand-new, first-ever
+ * `start`).
+ */
+export const LEGACY_START_STARTING_DATABASE_MESSAGE = "Starting database...\n";
+
+/**
+ * Go's `fmt.Fprintln(w, "Starting database from backup...")`
+ * (`apps/cli-go/internal/db/start/start.go:165-175`) — printed instead of
+ * {@link LEGACY_START_STARTING_DATABASE_MESSAGE} when the pre-create
+ * volume-existence check finds an EXISTING volume (a restart reusing the
+ * already-persisted Postgres data). Despite the wording, this has nothing to
+ * do with any `--from-backup` file-restore flag — Go's own `fromBackup`
+ * parameter is always empty for a plain `start`, so this is the only branch
+ * ever reached in that call path.
+ */
+export const LEGACY_START_STARTING_DATABASE_FROM_BACKUP_MESSAGE =
+  "Starting database from backup...\n";
+
+/**
+ * Go's `fmt.Fprintf(os.Stderr, "Started %s local development setup.\n\n",
+ * utils.Aqua("supabase"))` (`apps/cli-go/internal/start/start.go:84`) —
+ * printed on success (or an ignored unhealthy-timeout), immediately before the
+ * status table renders to stdout.
+ */
+export function legacyStartCompletedMessage(): string {
+  return `Started ${legacyAqua("supabase")} local development setup.\n\n`;
+}
+
+/**
+ * Port of Go's `printSecurityNotice` (`apps/cli-go/internal/start/start.go:
+ * 1503-1509`), byte-for-byte: 4 `fmt.Fprintln(os.Stderr, ...)` lines followed
+ * by a bare `fmt.Fprintln(os.Stderr)` (a single trailing blank line). Only the
+ * header is colored (Go's `utils.Yellow`); the remaining 3 lines are plain
+ * text.
+ */
+export function legacyStartSecurityNotice(): string {
+  return (
+    `${legacyYellow("Local dev security notice")}\n` +
+    "All services bind to 0.0.0.0 (network-accessible, not just localhost)\n" +
+    "API keys and JWT secrets are shared defaults. Do not use in production\n" +
+    "Studio, pgMeta (/pg/*), and analytics have no authentication\n" +
+    "\n"
+  );
+}
diff --git a/apps/cli/src/legacy/commands/start/start.format.unit.test.ts b/apps/cli/src/legacy/commands/start/start.format.unit.test.ts
new file mode 100644
index 0000000000..3f104d7a11
--- /dev/null
+++ b/apps/cli/src/legacy/commands/start/start.format.unit.test.ts
@@ -0,0 +1,82 @@
+import { describe, expect, it } from "vitest";
+
+import {
+  LEGACY_START_STARTING_CONTAINERS_MESSAGE,
+  LEGACY_START_STARTING_DATABASE_FROM_BACKUP_MESSAGE,
+  LEGACY_START_STARTING_DATABASE_MESSAGE,
+  LEGACY_START_WAITING_FOR_HEALTH_CHECKS_MESSAGE,
+  legacyStartAlreadyRunningMessage,
+  legacyStartCompletedMessage,
+  legacyStartSecurityNotice,
+} from "./start.format.ts";
+
+// The formatters apply Go-parity ANSI styling via `legacy-colors.ts`, which
+// no-ops on a real non-TTY stream but the vitest process presents its stderr
+// as color-capable. Strip escapes so these assertions target the plain text
+// content — matching `status.pretty.unit.test.ts`'s convention.
+// eslint-disable-next-line no-control-regex
+const stripAnsi = (text: string) => text.replace(/\x1b\[[0-9;]*m/gu, "");
+
+describe("legacyStartAlreadyRunningMessage", () => {
+  it("matches Go's exact stderr line, with a single trailing newline", () => {
+    expect(stripAnsi(legacyStartAlreadyRunningMessage())).toBe(
+      "supabase start is already running.\n",
+    );
+  });
+});
+
+describe("LEGACY_START_STARTING_CONTAINERS_MESSAGE", () => {
+  it("matches Go's exact stderr line, with a single trailing newline", () => {
+    expect(LEGACY_START_STARTING_CONTAINERS_MESSAGE).toBe("Starting containers...\n");
+  });
+});
+
+describe("LEGACY_START_WAITING_FOR_HEALTH_CHECKS_MESSAGE", () => {
+  it("matches Go's exact stderr line, with a single trailing newline", () => {
+    expect(LEGACY_START_WAITING_FOR_HEALTH_CHECKS_MESSAGE).toBe("Waiting for health checks...\n");
+  });
+});
+
+describe("LEGACY_START_STARTING_DATABASE_MESSAGE", () => {
+  it("matches Go's exact stderr line, with a single trailing newline", () => {
+    expect(LEGACY_START_STARTING_DATABASE_MESSAGE).toBe("Starting database...\n");
+  });
+});
+
+describe("LEGACY_START_STARTING_DATABASE_FROM_BACKUP_MESSAGE", () => {
+  it("matches Go's exact stderr line, with a single trailing newline", () => {
+    expect(LEGACY_START_STARTING_DATABASE_FROM_BACKUP_MESSAGE).toBe(
+      "Starting database from backup...\n",
+    );
+  });
+});
+
+describe("legacyStartCompletedMessage", () => {
+  it("matches Go's exact stderr line, with two trailing newlines", () => {
+    expect(stripAnsi(legacyStartCompletedMessage())).toBe(
+      "Started supabase local development setup.\n\n",
+    );
+  });
+});
+
+describe("legacyStartSecurityNotice", () => {
+  it("matches Go's exact 4-line notice plus a trailing blank line", () => {
+    expect(stripAnsi(legacyStartSecurityNotice())).toBe(
+      "Local dev security notice\n" +
+        "All services bind to 0.0.0.0 (network-accessible, not just localhost)\n" +
+        "API keys and JWT secrets are shared defaults. Do not use in production\n" +
+        "Studio, pgMeta (/pg/*), and analytics have no authentication\n" +
+        "\n",
+    );
+  });
+
+  it("ends with exactly one blank line, matching Go's bare fmt.Fprintln(os.Stderr)", () => {
+    const notice = stripAnsi(legacyStartSecurityNotice());
+    const lines = notice.split("\n");
+    // 4 content lines + 1 trailing blank line from the bare Fprintln + the
+    // empty string after the final "\n" that `split` always produces.
+    expect(lines).toHaveLength(6);
+    expect(lines.at(-2)).toBe("");
+    expect(lines.at(-1)).toBe("");
+  });
+});
diff --git a/apps/cli/src/legacy/commands/start/start.gates.ts b/apps/cli/src/legacy/commands/start/start.gates.ts
new file mode 100644
index 0000000000..041132597a
--- /dev/null
+++ b/apps/cli/src/legacy/commands/start/start.gates.ts
@@ -0,0 +1,291 @@
+import type { ProjectConfig } from "@supabase/config";
+
+import { dockerfileServiceImage } from "../../../shared/services/dockerfile-images.ts";
+import {
+  replaceImageTag,
+  type LocalServiceVersionName,
+  type LocalServiceVersionOverrides,
+} from "../../../shared/services/services.shared.ts";
+import { legacyEnvOverrideBool } from "../../shared/legacy-local-config-values.ts";
+import { LEGACY_START_SERVICES } from "./start.services.ts";
+
+/**
+ * Pure port of every per-service `if` guard in Go's `run()`
+ * (`apps/cli-go/internal/start/start.go:293-1268`), minus Postgres (`enabledGate:
+ * "always"`, unconditional — handled directly by the caller, before any other
+ * service). Each boolean is `<section>.enabled` (resolved through
+ * {@link legacyEnvOverrideBool}, matching Go's generic Viper `SUPABASE_<SECTION>_
+ * ENABLED` binding — the same mechanism `legacy-status-values.ts`'s
+ * `legacyResolveStatusLocalState` already uses for its own overlapping subset of
+ * these fields) AND-ed with "not excluded" (the service's `--exclude` key absent
+ * from `excludedKeys`, per `legacyPartitionStartExcludeFlags`'s `valid` set).
+ *
+ * `storage-api`'s exclude key backs BOTH `storage` and (compounded further)
+ * `imgproxy` — `imgproxy` is additionally gated on `storage` already being
+ * enabled (ImgProxy mounts Storage's own volumes, `start.go:1060`) and on
+ * `storage.image_transformation.enabled`, mirroring Go's shared `isImgProxyEnabled`
+ * local (`start.go:302-303`) — the SAME boolean feeds both the actual container
+ * gate here and `storage.service.ts`'s `LegacyStorageEnvInput.
+ * imageTransformationEnabled` (`ENABLE_IMAGE_TRANSFORMATION`), so callers must
+ * reuse `gates.imgproxy`, not recompute a second, possibly-diverging boolean.
+ *
+ * `edgeRuntime` is deliberately excluded from `GATE_KEY_BY_SERVICE`/
+ * `DOCKERFILE_ALIAS_BY_SERVICE`/{@link legacyResolveStartImagePlan} below — Edge
+ * Runtime doesn't go through the generic `LegacyStartContainerSpec` bring-up path
+ * (`services/edge-runtime.service.ts`'s header explains why it doesn't map
+ * cleanly), so `start.handler.ts` reads this boolean directly and calls
+ * `legacyStartEdgeRuntimeContainer` itself, in Go's real container-start position
+ * (between ImgProxy and pg-meta).
+ */
+export interface LegacyStartGates {
+  readonly kong: boolean;
+  readonly gotrue: boolean;
+  readonly mailpit: boolean;
+  readonly realtime: boolean;
+  readonly postgrest: boolean;
+  readonly storage: boolean;
+  readonly imgproxy: boolean;
+  readonly logflare: boolean;
+  readonly vector: boolean;
+  readonly pgMeta: boolean;
+  readonly studio: boolean;
+  readonly supavisor: boolean;
+  readonly edgeRuntime: boolean;
+}
+
+export interface LegacyStartGateInputs {
+  readonly config: ProjectConfig;
+  readonly projectEnvValues: Readonly<Record<string, string>> | undefined;
+  /** `legacyPartitionStartExcludeFlags(flags.exclude).valid`, as a `Set` for O(1) lookup. */
+  readonly excludedKeys: ReadonlySet<string>;
+  readonly document: Readonly<Record<string, unknown>> | undefined;
+}
+
+function asRecord(value: unknown): Record<string, unknown> | undefined {
+  return typeof value === "object" && value !== null && !Array.isArray(value)
+    ? (value as Record<string, unknown>)
+    : undefined;
+}
+
+/**
+ * Evaluates all 12 excludable "should this container actually start" gates in
+ * one pass (Postgres and Edge Runtime are handled separately by the caller —
+ * see this module's header). Pure — no Effect, no I/O — so every gate
+ * combination is unit-testable without a Docker mock.
+ */
+export function legacyResolveStartGates(inputs: LegacyStartGateInputs): LegacyStartGates {
+  const { config, projectEnvValues, excludedKeys, document } = inputs;
+  const isExcluded = (key: string) => excludedKeys.has(key);
+
+  const analyticsEnabled = legacyEnvOverrideBool(
+    "SUPABASE_ANALYTICS_ENABLED",
+    config.analytics.enabled,
+    "analytics.enabled",
+    projectEnvValues,
+  );
+  const apiEnabled = legacyEnvOverrideBool(
+    "SUPABASE_API_ENABLED",
+    config.api.enabled,
+    "api.enabled",
+    projectEnvValues,
+  );
+  const authEnabled = legacyEnvOverrideBool(
+    "SUPABASE_AUTH_ENABLED",
+    config.auth.enabled,
+    "auth.enabled",
+    projectEnvValues,
+  );
+  const inbucketEnabled = legacyEnvOverrideBool(
+    "SUPABASE_LOCAL_SMTP_ENABLED",
+    config.local_smtp.enabled,
+    "local_smtp.enabled",
+    projectEnvValues,
+  );
+  const realtimeEnabled = legacyEnvOverrideBool(
+    "SUPABASE_REALTIME_ENABLED",
+    config.realtime.enabled,
+    "realtime.enabled",
+    projectEnvValues,
+  );
+  const storageEnabled = legacyEnvOverrideBool(
+    "SUPABASE_STORAGE_ENABLED",
+    config.storage.enabled,
+    "storage.enabled",
+    projectEnvValues,
+  );
+  // Go's `Storage.ImageTransformation` is a nil-unless-declared pointer
+  // (`pkg/config/storage.go:16`) — with no `[storage.image_transformation]`
+  // table in config.toml, that field never becomes a resolvable Viper key at
+  // all, so `SUPABASE_STORAGE_IMAGE_TRANSFORMATION_ENABLED` alone can never
+  // flip it on (`start.go:302-303`'s `ImageTransformation != nil && .Enabled`
+  // gate short-circuits on the nil check first). `@supabase/config`'s decoded
+  // `config.storage.image_transformation` can't be used as a presence proxy
+  // either — it always decodes to a defaulted `{enabled: false}`, never
+  // `undefined` — so presence must come from the raw document, same
+  // `asRecord(document?.[...])` gate `legacyResolveAuthEmailSmtp`/
+  // `resolveGotruePasskeyWebauthn`/`legacyResolveAuthSms` already use for the
+  // identical Go-pointer-section shape.
+  const imageTransformationSectionPresent =
+    asRecord(asRecord(document?.["storage"])?.["image_transformation"]) !== undefined;
+  const configuredImageTransformationEnabled =
+    config.storage.image_transformation?.enabled ?? false;
+  const imageTransformationEnabled = imageTransformationSectionPresent
+    ? legacyEnvOverrideBool(
+        "SUPABASE_STORAGE_IMAGE_TRANSFORMATION_ENABLED",
+        configuredImageTransformationEnabled,
+        "storage.image_transformation.enabled",
+        projectEnvValues,
+      )
+    : configuredImageTransformationEnabled;
+  const studioEnabled = legacyEnvOverrideBool(
+    "SUPABASE_STUDIO_ENABLED",
+    config.studio.enabled,
+    "studio.enabled",
+    projectEnvValues,
+  );
+  const poolerEnabled = legacyEnvOverrideBool(
+    "SUPABASE_DB_POOLER_ENABLED",
+    config.db.pooler.enabled,
+    "db.pooler.enabled",
+    projectEnvValues,
+  );
+  const edgeRuntimeEnabled = legacyEnvOverrideBool(
+    "SUPABASE_EDGE_RUNTIME_ENABLED",
+    config.edge_runtime.enabled,
+    "edge_runtime.enabled",
+    projectEnvValues,
+  );
+
+  const storage = storageEnabled && !isExcluded("storage-api");
+
+  return {
+    kong: !isExcluded("kong"),
+    gotrue: authEnabled && !isExcluded("gotrue"),
+    mailpit: inbucketEnabled && !isExcluded("mailpit"),
+    realtime: realtimeEnabled && !isExcluded("realtime"),
+    postgrest: apiEnabled && !isExcluded("postgrest"),
+    storage,
+    imgproxy: storage && imageTransformationEnabled && !isExcluded("imgproxy"),
+    logflare: analyticsEnabled && !isExcluded("logflare"),
+    vector: analyticsEnabled && !isExcluded("vector"),
+    pgMeta: studioEnabled && !isExcluded("postgres-meta"),
+    studio: studioEnabled && !isExcluded("studio"),
+    supavisor: poolerEnabled && !isExcluded("supavisor"),
+    edgeRuntime: edgeRuntimeEnabled && !isExcluded("edge-runtime"),
+  };
+}
+
+const GATE_KEY_BY_SERVICE: Readonly<Record<string, keyof LegacyStartGates>> = {
+  logflare: "logflare",
+  vector: "vector",
+  kong: "kong",
+  gotrue: "gotrue",
+  mailpit: "mailpit",
+  realtime: "realtime",
+  postgrest: "postgrest",
+  storage: "storage",
+  imgproxy: "imgproxy",
+  pgMeta: "pgMeta",
+  studio: "studio",
+  supavisor: "supavisor",
+};
+
+/** `shared/services/dockerfile-images.ts`'s `alias` for each excludable service — see the Dockerfile manifest's `FROM ... AS <alias>` lines. */
+const DOCKERFILE_ALIAS_BY_SERVICE: Readonly<Record<string, string>> = {
+  logflare: "logflare",
+  vector: "vector",
+  kong: "kong",
+  gotrue: "gotrue",
+  mailpit: "mailpit",
+  realtime: "realtime",
+  postgrest: "postgrest",
+  storage: "storage",
+  imgproxy: "imgproxy",
+  pgMeta: "pgmeta",
+  studio: "studio",
+  supavisor: "supavisor",
+};
+
+/**
+ * `LEGACY_START_SERVICES`' `service` key -> `services.shared.ts`'s
+ * `LocalServiceVersionName`, for the subset of start's services that have a
+ * `supabase/.temp/*-version` linked-project pin (Go's `pkg/config/config.go:
+ * 827-863`). Kong and ImgProxy have no such pin in Go and are deliberately
+ * absent here.
+ */
+const START_SERVICE_TO_LOCAL_VERSION_NAME: Readonly<Record<string, LocalServiceVersionName>> = {
+  gotrue: "auth",
+  postgrest: "postgrest",
+  realtime: "realtime",
+  storage: "storage",
+  studio: "studio",
+  pgMeta: "pgmeta",
+  logflare: "analytics",
+  supavisor: "pooler",
+};
+
+/**
+ * The embedded Dockerfile default image for `alias`, with its tag replaced by
+ * `serviceVersions`' pin for `localServiceName` when one is present — Go's
+ * `Config.Load` rewriting `c.Auth.Image`/etc. from `supabase/.temp/*-version`
+ * (`pkg/config/config.go:827-863`) before `start`/`db start` ever read them.
+ * Exported so `start.handler.ts` can resolve the SAME pinned image for the
+ * one-shot fresh-DB setup jobs (`realtime`/`storage`/`auth`), which Go runs
+ * regardless of `--exclude` and therefore can't go through
+ * {@link legacyResolveStartImagePlan}'s gate-filtered plan.
+ */
+export function legacyResolvePinnedImage(
+  alias: string,
+  localServiceName: LocalServiceVersionName,
+  serviceVersions: LocalServiceVersionOverrides,
+): string {
+  const baseImage = dockerfileServiceImage(alias);
+  const pinnedVersion = serviceVersions[localServiceName];
+  return pinnedVersion === undefined ? baseImage : replaceImageTag(baseImage, pinnedVersion);
+}
+
+export interface LegacyStartImagePlanEntry {
+  /** `LEGACY_SERVICE_CATALOG`'s `service` key. */
+  readonly service: string;
+  /** The default (unregistry-resolved) image reference for this service. */
+  readonly image: string;
+}
+
+/**
+ * The ordered list of non-Postgres, non-EdgeRuntime services that will
+ * actually start this run, each paired with its default image reference —
+ * Go's `ensureImagesCached`/ `pullImagesUsingCompose` input (`start.go:264-291`),
+ * built from `utils.GetServices()`'s own per-section `.Enabled` gates
+ * (`internal/utils/config.go:102-193`). Iterates `LEGACY_START_SERVICES` (already
+ * in Go's real container-start order) so the returned order IS the order the
+ * caller should both pre-pull images in and create+start containers in.
+ *
+ * Deliberately gates `imgproxy`'s image on the SAME compound `gates.imgproxy`
+ * boolean the actual container-start gate uses, rather than Go's slightly
+ * looser `Config.Storage.Enabled` pre-pull scope (`utils.GetServices`,
+ * `config.go:143-153`, which pre-pulls the ImgProxy image whenever Storage is
+ * enabled, even with image transformation disabled) — a deliberate, documented
+ * simplification: pre-pulling an image for a container that will never be
+ * created has no user-visible benefit and this port has no compose-based
+ * best-effort pre-pull pass to mirror in the first place (see
+ * `lib/image-prepull.ts`'s header).
+ */
+export function legacyResolveStartImagePlan(
+  gates: LegacyStartGates,
+  serviceVersions: LocalServiceVersionOverrides = {},
+): ReadonlyArray<LegacyStartImagePlanEntry> {
+  const plan: Array<LegacyStartImagePlanEntry> = [];
+  for (const entry of LEGACY_START_SERVICES) {
+    const gateKey = GATE_KEY_BY_SERVICE[entry.service];
+    if (gateKey === undefined || !gates[gateKey]) continue;
+    const alias = DOCKERFILE_ALIAS_BY_SERVICE[entry.service];
+    if (alias === undefined) continue;
+    const localServiceName = START_SERVICE_TO_LOCAL_VERSION_NAME[entry.service];
+    const image =
+      localServiceName === undefined
+        ? dockerfileServiceImage(alias)
+        : legacyResolvePinnedImage(alias, localServiceName, serviceVersions);
+    plan.push({ service: entry.service, image });
+  }
+  return plan;
+}
diff --git a/apps/cli/src/legacy/commands/start/start.handler.ts b/apps/cli/src/legacy/commands/start/start.handler.ts
index def6ab08b2..c60cc99ed9 100644
--- a/apps/cli/src/legacy/commands/start/start.handler.ts
+++ b/apps/cli/src/legacy/commands/start/start.handler.ts
@@ -1,61 +1,2585 @@
-import { Effect, Option } from "effect";
-import { LegacyOutputFlag } from "../../../shared/legacy/global-flags.ts";
-import { LegacyGoProxy } from "../../../shared/legacy/go-proxy.service.ts";
+import {
+  inferFunctionsManifest,
+  resolveProjectSubtree,
+  type ProjectConfig,
+} from "@supabase/config";
+import { join } from "node:path";
+import { Effect, FileSystem, Option, Path, Result } from "effect";
+import { FetchHttpClient } from "effect/unstable/http";
+import { ChildProcessSpawner } from "effect/unstable/process";
+
+import { CLI_VERSION } from "../../../shared/cli/version.ts";
+import { rawFunctionConfigRecord } from "../../../shared/functions/deploy.ts";
+import {
+  resolveFunctionBindMounts,
+  toPlainEdgeRuntimeConfig,
+  toPlainFunctionRecord,
+  type StartedRuntime,
+} from "../../../shared/functions/serve.ts";
+import { LegacyDebugFlag, LegacyNetworkIdFlag } from "../../../shared/legacy/global-flags.ts";
 import { Output } from "../../../shared/output/output.service.ts";
+import { RuntimeInfo } from "../../../shared/runtime/runtime-info.service.ts";
+import { Analytics } from "../../../shared/telemetry/analytics.service.ts";
+import { EventStackStarted } from "../../../shared/telemetry/event-catalog.ts";
+import { LegacyCliConfig } from "../../config/legacy-cli-config.service.ts";
+import { LegacyTelemetryState } from "../../telemetry/legacy-telemetry-state.service.ts";
+import { legacyResolveStudioApiUrl } from "../../shared/legacy-api-url.ts";
+import { legacyIsBitbucketPipeline } from "../../shared/legacy-bitbucket-pipeline.ts";
+import { legacyAqua, legacyYellow } from "../../shared/legacy-colors.ts";
+import {
+  legacyResolveApiTlsPath,
+  legacyResolveEmailTemplateContentPath,
+} from "../../shared/legacy-config-validate.ts";
+import { legacyCheckDbToml } from "../../shared/legacy-db-config.toml-read.ts";
+import { LegacyDbConnection } from "../../shared/legacy-db-connection.service.ts";
+import { legacyResolveEdgeRuntimeImage } from "../../shared/legacy-edge-runtime-image.ts";
+import { legacyResolveDbImage } from "../../shared/legacy-db-image.ts";
+import {
+  legacyResolveStorageCredentials,
+  legacyStorageGatewayFetch,
+} from "../../shared/legacy-storage-credentials.ts";
+import { legacyReadServiceVersionOverrides } from "../../shared/legacy-service-version-overrides.ts";
+import {
+  legacyCollectDotenvPrivateKeys,
+  legacyDecryptSecret,
+  legacyIsEncryptedSecret,
+} from "../../shared/legacy-vault-decrypt.ts";
+import { ramInBytes } from "../../shared/legacy-size-units.ts";
+import { legacyTempPaths } from "../../shared/legacy-temp-paths.ts";
+import { legacyParseGoDuration } from "../../shared/legacy-go-duration.ts";
+import {
+  LEGACY_CLI_PROJECT_LABEL,
+  legacyCliProjectFilterValue,
+  legacyServiceContainerIds,
+  legacyServiceContainerName,
+  localDbContainerId,
+  localNetworkId,
+} from "../../shared/legacy-docker-ids.ts";
+import {
+  legacyInspectContainerState,
+  legacyListContainersByLabel,
+} from "../../shared/legacy-docker-lifecycle.ts";
+import {
+  legacyEnvOverride,
+  legacyEnvOverrideApiMaxRows,
+  legacyEnvOverrideBool,
+  legacyEnvOverrideDefaultPoolSize,
+  legacyEnvOverrideDenoVersion,
+  legacyEnvOverrideEdgeRuntimePolicy,
+  legacyEnvOverrideMajorVersion,
+  legacyEnvOverrideMaxClientConn,
+  legacyEnvOverridePoolMode,
+  legacyEnvOverridePort,
+  legacyEnvOverrideRealtimeIpVersion,
+  legacyEnvOverrideRealtimeMaxHeaderLength,
+  legacyEnvOverrideUint,
+  legacyRawUnmodeledBool,
+  legacyResolveAuthCaptcha,
+  legacyResolveAuthEmail,
+  legacyResolveAuthEmailSmtp,
+  legacyResolveAuthExternalProviders,
+  legacyResolveAuthHooks,
+  legacyResolveAuthMfa,
+  legacyResolveAuthSms,
+  legacyResolveConfiguredSigningKeys,
+  legacyResolveDbSettingsEnvOverrides,
+  legacyResolveLocalConfigValues,
+  legacyResolveLocalJwks,
+  legacyStrToArr,
+  type LegacyLocalConfigValues,
+  type LegacyResolvedAuthEmail,
+} from "../../shared/legacy-local-config-values.ts";
+import {
+  legacyLoadLocalProjectContext,
+  type LegacyLocalProjectContext,
+} from "../../shared/legacy-local-project-context.ts";
+import { legacySeedBucketsRun } from "../../shared/legacy-seed-buckets.ts";
+import {
+  LegacyStatusDbInspectError,
+  LegacyStatusDbNotReadyError,
+  LegacyStatusDbNotRunningError,
+  LegacyStatusInvalidConfigError,
+  LegacyStatusListError,
+} from "../../shared/legacy-status-errors.ts";
+import { legacyRenderStatusPretty } from "../../shared/legacy-status-pretty.ts";
+import {
+  legacyGateStatusState,
+  legacyResolveStatusLocalState,
+  legacyStatusContainerIds,
+  legacyStatusValuesFromState,
+} from "../../shared/legacy-status-values.ts";
+import { legacyValidateWorkdirIsDirectory } from "../../shared/legacy-workdir-validation.ts";
 import type { LegacyStartFlags } from "./start.command.ts";
+import {
+  LegacyStartConfigLoadError,
+  LegacyStartInvalidConfigError,
+  LegacyStartWorkdirError,
+} from "./start.errors.ts";
+import { legacyPartitionStartExcludeFlags } from "./start.exclude.ts";
+import {
+  legacyStartAlreadyRunningMessage,
+  legacyStartCompletedMessage,
+  legacyStartSecurityNotice,
+  LEGACY_START_STARTING_CONTAINERS_MESSAGE,
+  LEGACY_START_STARTING_DATABASE_FROM_BACKUP_MESSAGE,
+  LEGACY_START_STARTING_DATABASE_MESSAGE,
+  LEGACY_START_WAITING_FOR_HEALTH_CHECKS_MESSAGE,
+} from "./start.format.ts";
+import {
+  legacyResolvePinnedImage,
+  legacyResolveStartGates,
+  legacyResolveStartImagePlan,
+} from "./start.gates.ts";
+import { legacyIsUnhealthyStartError, legacyRollbackStart } from "./start.rollback.ts";
+import { LEGACY_START_SERVICES } from "./start.services.ts";
+import {
+  legacyEnsureStartNetwork,
+  legacyStartContainer,
+  legacyStartVolumeExists,
+  LEGACY_COMPOSE_PROJECT_LABEL,
+  type LegacyStartContainerOpts,
+} from "./lib/container-lifecycle.ts";
+import {
+  legacyStartInitCurrentBranch,
+  legacyStartSetupLocalDatabase,
+  type LegacyStartDbSetupImages,
+} from "./lib/db-setup.ts";
+import { legacyEnsureImagesCached } from "./lib/image-prepull.ts";
+import {
+  legacyWaitForHealthyServices,
+  type LegacyHealthCheckPostgrestGateway,
+} from "./lib/health-check.ts";
+import {
+  legacyStartInternalDbPassword,
+  LEGACY_START_INTERNAL_DB_NAME,
+  LEGACY_START_INTERNAL_DB_PORT,
+} from "./lib/internal-db-connection.ts";
+import {
+  LEGACY_KONG_LOCAL_TLS_CERT,
+  LEGACY_KONG_LOCAL_TLS_KEY,
+} from "./templates/kong-local-tls.ts";
+import { legacyBuildLogflareContainerSpec } from "./services/logflare.service.ts";
+import {
+  legacyBuildVectorContainerSpec,
+  legacyResolveDockerDaemonHost,
+  legacyResolveVectorDockerSocketPlan,
+} from "./services/vector.service.ts";
+import {
+  legacyBuildKongContainerSpec,
+  legacyResolveKongNginxWorkerProcesses,
+  type LegacyKongEmailTemplateMount,
+} from "./services/kong.service.ts";
+import {
+  legacyStartEdgeRuntimeContainer,
+  type LegacyEdgeRuntimeBringUpInput,
+} from "./services/edge-runtime.service.ts";
+import {
+  legacyBuildGotrueContainerSpec,
+  type LegacyBuildGotrueEnvInput,
+} from "./services/gotrue.service.ts";
+import { legacyBuildMailpitContainerSpec } from "./services/mailpit.service.ts";
+import {
+  legacyBuildRealtimeContainerSpec,
+  LEGACY_REALTIME_TENANT_ID,
+} from "./services/realtime.service.ts";
+import { legacyBuildPostgrestContainerSpec } from "./services/postgrest.service.ts";
+import { legacyBuildStorageContainerSpec } from "./services/storage.service.ts";
+import { legacyBuildImgproxyContainerSpec } from "./services/imgproxy.service.ts";
+import { legacyBuildPostgresStartContainerSpec } from "./services/postgres.service.ts";
+import { legacyBuildPgMetaContainerSpec } from "./services/pg-meta.service.ts";
+import { legacyBuildStudioContainerSpec } from "./services/studio.service.ts";
+import { legacyBuildSupavisorContainerSpec } from "./services/supavisor.service.ts";
+
+/**
+ * `Config.Analytics.ApiKey`'s only possible value (`apps/cli-go/pkg/config/
+ * config.go:307,529`) — `toml:"-"`, so never configurable. Duplicated locally
+ * rather than hoisted: `logflare.service.ts`/`studio.service.ts` each already
+ * hardcode this same Go compile-time literal independently, matching that
+ * existing precedent instead of introducing a new shared constant for it.
+ */
+const LEGACY_ANALYTICS_API_KEY = "api-key";
+
+function asRecord(value: unknown): Record<string, unknown> | undefined {
+  return typeof value === "object" && value !== null && !Array.isArray(value)
+    ? (value as Record<string, unknown>)
+    : undefined;
+}
+
+/**
+ * Docker's/Podman's "container doesn't exist" stderr shapes for `container inspect`: "No such
+ * container" or "No such object" depending on daemon version/CLI path — the same pair already
+ * handled in `shared/functions/serve.ts`/`legacy-db-bootstrap.seam.layer.ts`/`legacy-pgdelta.seam.
+ * layer.ts`.
+ */
+function isContainerNotFoundMessage(message: string): boolean {
+  return (
+    /no such container/iu.test(message) ||
+    /no such object/iu.test(message) ||
+    /no container with name or id/iu.test(message)
+  );
+}
 
-const helperStatusEnv: Record<string, string> = { SUPABASE_TELEMETRY_DISABLED: "1" };
-
-function machineStatusOutput(
-  outputFormat: "text" | "json" | "stream-json",
-  legacyOutput: "env" | "pretty" | "json" | "toml" | "yaml" | "table" | "csv" | undefined,
-) {
-  switch (legacyOutput) {
-    case "env":
-    case "json":
-    case "toml":
-    case "yaml":
-      return legacyOutput;
-    case undefined:
-      return outputFormat === "json" || outputFormat === "stream-json" ? "json" : undefined;
-    case "pretty":
-    case "table":
-    case "csv":
-      return undefined;
-  }
-}
-
-function parseJsonOutput(json: string) {
-  return Effect.sync(() => {
-    const data: unknown = JSON.parse(json);
-    return data;
+/**
+ * Wraps a synchronous `legacyEnvOverride*`/`legacyEnvOverride*` config-override read that throws on a
+ * malformed value into a typed `LegacyStartInvalidConfigError` failure, matching Go's
+ * `Config.Load` hard-failing on a bad Viper decode (`pkg/config/config.go:749-756`) before any
+ * Docker work runs — instead of leaking an untyped Effect defect that bypasses
+ * `withJsonErrorHandling`'s `Effect.catch` (which, unlike this pipeline's `Effect.onError`
+ * rollback, only intercepts typed failures, never defects).
+ */
+function wrapConfigOverride<T>(
+  dottedFieldPath: string,
+  thunk: () => T,
+): Effect.Effect<T, LegacyStartInvalidConfigError> {
+  return Effect.try({
+    try: thunk,
+    catch: (cause) =>
+      new LegacyStartInvalidConfigError({
+        message: `invalid config for ${dottedFieldPath}: ${cause instanceof Error ? cause.message : String(cause)}`,
+      }),
   });
 }
 
+/**
+ * Go's `Db.HealthTimeout` (`internal/db/start/start.go:180`) — a duration
+ * STRING (`"2m"` default, `packages/config/src/db.ts`), unlike every other
+ * `start` health wait, which uses the fixed 30s `serviceTimeout` global
+ * (`apps/cli-go/internal/start/start.go:161,1271`). Go decodes this field via
+ * `mapstructure.StringToTimeDurationHookFunc()` inside the same
+ * `v.UnmarshalExact` call every `SUPABASE_*` override goes through
+ * (`pkg/config/config.go:749-756,775-784`) — a malformed value hard-fails
+ * `Config.Load` (`"failed to parse config: %w"`) before `start` ever runs; it
+ * is never silently replaced with a default. A valid-but-degenerate value
+ * (e.g. `"0s"`) isn't special-cased either: Go's backoff policy computes
+ * `uint64(timeout.Seconds())` as the retry count
+ * (`internal/db/start/start.go:192-198`), and the backoff library returns
+ * `Stop` immediately when that count is `0` — i.e. exactly one immediate
+ * health probe with no wait, not a 30s fallback. Throws on a malformed
+ * value; the caller wraps that into `LegacyStartInvalidConfigError` so
+ * rollback still fires (a plain throw here would surface as an
+ * Effect defect instead of a typed failure).
+ */
+function resolveDbHealthTimeoutSeconds(healthTimeout: string): number {
+  return Math.trunc(legacyParseGoDuration(healthTimeout) / 1_000_000_000);
+}
+
+/**
+ * Go's `appendGotruePasskeyEnv`/`Auth.Passkey`/`Auth.Webauthn` presence gate
+ * (`start.go:1427-1440`, `pkg/config/config.go:1117-1134`): `@supabase/config`
+ * has no `auth.passkey`/`auth.webauthn` schema fields at all, so presence and
+ * every field must come from the raw, pre-schema TOML document instead — same
+ * document-based approach `legacy-local-config-values.ts` already uses for
+ * these two sections.
+ */
+/**
+ * `auth.passkey.enabled`/`auth.webauthn.*` are Viper-bound like every other
+ * nested field once `[auth.passkey]`/`[auth.webauthn]` are present in
+ * config.toml (`ExperimentalBindStruct`/`AutomaticEnv`, `config.go:581-586`),
+ * so `SUPABASE_AUTH_PASSKEY_ENABLED`/`SUPABASE_AUTH_WEBAUTHN_{RP_ID,
+ * RP_DISPLAY_NAME,RP_ORIGINS}` overrides apply before `appendGotruePasskeyEnv`
+ * (`start.go:1427-1436`) builds GoTrue's env — same reasoning, and same
+ * presence-gating (an absent section is never synthesized from an env
+ * override alone), as `legacy-local-config-values.ts`'s identical
+ * `Config.Validate`-parity resolution for this raw-document pair.
+ * `rp_display_name` has no validation-path precedent (Go's `Config.Validate`
+ * never checks it), but GoTrue's env does consume it, so it gets the same
+ * treatment here.
+ */
+function resolveGotruePasskeyWebauthn(
+  document: Readonly<Record<string, unknown>> | undefined,
+  projectEnvValues: Readonly<Record<string, string>> | undefined,
+): {
+  readonly passkeyEnabled: boolean | undefined;
+  readonly webauthn:
+    | {
+        readonly rpId: string;
+        readonly rpDisplayName: string;
+        readonly rpOrigins: ReadonlyArray<string>;
+      }
+    | undefined;
+} {
+  const authDoc = asRecord(document?.["auth"]);
+  const passkeyDoc = asRecord(authDoc?.["passkey"]);
+  const webauthnDoc = asRecord(authDoc?.["webauthn"]);
+  const passkeyEnabled =
+    passkeyDoc !== undefined
+      ? legacyEnvOverrideBool(
+          "SUPABASE_AUTH_PASSKEY_ENABLED",
+          legacyRawUnmodeledBool(passkeyDoc["enabled"], "auth.passkey.enabled"),
+          "auth.passkey.enabled",
+          projectEnvValues,
+        )
+      : undefined;
+  const rpOriginsOverride =
+    webauthnDoc !== undefined
+      ? legacyEnvOverride("SUPABASE_AUTH_WEBAUTHN_RP_ORIGINS", undefined, projectEnvValues)
+      : undefined;
+  const webauthn =
+    webauthnDoc !== undefined
+      ? {
+          rpId:
+            legacyEnvOverride(
+              "SUPABASE_AUTH_WEBAUTHN_RP_ID",
+              typeof webauthnDoc["rp_id"] === "string" ? webauthnDoc["rp_id"] : "",
+              projectEnvValues,
+            ) ?? "",
+          rpDisplayName:
+            legacyEnvOverride(
+              "SUPABASE_AUTH_WEBAUTHN_RP_DISPLAY_NAME",
+              typeof webauthnDoc["rp_display_name"] === "string"
+                ? webauthnDoc["rp_display_name"]
+                : "",
+              projectEnvValues,
+            ) ?? "",
+          // Go's mapstructure decode chain applies `StringToSliceHookFunc(",")`
+          // unconditionally to every `[]string`-typed field (`config.go:775-784`) — a raw or
+          // `env(...)`-resolved `rp_origins` string (this section has no `@supabase/config`
+          // schema at all) is comma-split, not silently dropped to `[]`.
+          rpOrigins: (() => {
+            if (rpOriginsOverride !== undefined) return legacyStrToArr(rpOriginsOverride);
+            const raw = webauthnDoc["rp_origins"];
+            if (Array.isArray(raw)) {
+              return raw.filter((item): item is string => typeof item === "string");
+            }
+            return typeof raw === "string" ? legacyStrToArr(raw) : [];
+          })(),
+        }
+      : undefined;
+  return { passkeyEnabled, webauthn };
+}
+
+/**
+ * Go's `Auth.Sessions` (`pkg/config/auth.go:330-333`) is a value-typed struct,
+ * always merged with a Viper default (empty durations) regardless of
+ * `[auth.sessions]` presence in config.toml — so
+ * `SUPABASE_AUTH_SESSIONS_{TIMEBOX,INACTIVITY_TIMEOUT}` overrides always apply
+ * before `start.go` builds `GOTRUE_SESSIONS_*`, no raw-document presence gate
+ * needed (same reasoning as {@link resolveGotrueRateLimit}/mfa below).
+ * `@supabase/config`'s `sessions` schema is `Schema.optionalKey` at the
+ * `auth` level though (`config.auth.sessions` can be `undefined`), unlike
+ * Go's always-present struct — an env override must still be able to
+ * introduce a value even when the section was never in config.toml at all,
+ * matching Go's real behavior.
+ */
+function resolveGotrueSessions(
+  sessions: ProjectConfig["auth"]["sessions"],
+  projectEnvValues: Readonly<Record<string, string>> | undefined,
+): ProjectConfig["auth"]["sessions"] {
+  const timebox = legacyEnvOverride(
+    "SUPABASE_AUTH_SESSIONS_TIMEBOX",
+    sessions?.timebox,
+    projectEnvValues,
+  );
+  const inactivityTimeout = legacyEnvOverride(
+    "SUPABASE_AUTH_SESSIONS_INACTIVITY_TIMEOUT",
+    sessions?.inactivity_timeout,
+    projectEnvValues,
+  );
+  if (timebox === undefined && inactivityTimeout === undefined) return sessions;
+  return { timebox, inactivity_timeout: inactivityTimeout };
+}
+
+/**
+ * Go's `Auth.RateLimit` (`pkg/config/auth.go:200-208`) is a value-typed
+ * struct of plain `uint`s, always Viper-bound regardless of `[auth.rate_
+ * limit]` presence, so every `SUPABASE_AUTH_RATE_LIMIT_*` override applies
+ * before `start.go` builds `GOTRUE_RATE_LIMIT_*` — no raw-document presence
+ * gate needed, matching the existing `db.pooler`/SMS numeric-field precedent.
+ */
+function resolveGotrueRateLimit(
+  rateLimit: ProjectConfig["auth"]["rate_limit"],
+  projectEnvValues: Readonly<Record<string, string>> | undefined,
+): ProjectConfig["auth"]["rate_limit"] {
+  return {
+    anonymous_users: legacyEnvOverrideUint(
+      "SUPABASE_AUTH_RATE_LIMIT_ANONYMOUS_USERS",
+      "auth.rate_limit.anonymous_users",
+      rateLimit.anonymous_users,
+      projectEnvValues,
+    ),
+    token_refresh: legacyEnvOverrideUint(
+      "SUPABASE_AUTH_RATE_LIMIT_TOKEN_REFRESH",
+      "auth.rate_limit.token_refresh",
+      rateLimit.token_refresh,
+      projectEnvValues,
+    ),
+    sign_in_sign_ups: legacyEnvOverrideUint(
+      "SUPABASE_AUTH_RATE_LIMIT_SIGN_IN_SIGN_UPS",
+      "auth.rate_limit.sign_in_sign_ups",
+      rateLimit.sign_in_sign_ups,
+      projectEnvValues,
+    ),
+    token_verifications: legacyEnvOverrideUint(
+      "SUPABASE_AUTH_RATE_LIMIT_TOKEN_VERIFICATIONS",
+      "auth.rate_limit.token_verifications",
+      rateLimit.token_verifications,
+      projectEnvValues,
+    ),
+    email_sent: legacyEnvOverrideUint(
+      "SUPABASE_AUTH_RATE_LIMIT_EMAIL_SENT",
+      "auth.rate_limit.email_sent",
+      rateLimit.email_sent,
+      projectEnvValues,
+    ),
+    sms_sent: legacyEnvOverrideUint(
+      "SUPABASE_AUTH_RATE_LIMIT_SMS_SENT",
+      "auth.rate_limit.sms_sent",
+      rateLimit.sms_sent,
+      projectEnvValues,
+    ),
+    web3: legacyEnvOverrideUint(
+      "SUPABASE_AUTH_RATE_LIMIT_WEB3",
+      "auth.rate_limit.web3",
+      rateLimit.web3,
+      projectEnvValues,
+    ),
+  };
+}
+
+/**
+ * Go's `Auth.Web3` (`pkg/config/auth.go:379-382`) is a value-typed struct —
+ * same no-presence-gate reasoning as {@link resolveGotrueRateLimit}.
+ */
+function resolveGotrueWeb3(
+  web3: ProjectConfig["auth"]["web3"],
+  projectEnvValues: Readonly<Record<string, string>> | undefined,
+): ProjectConfig["auth"]["web3"] {
+  return {
+    solana: {
+      enabled: legacyEnvOverrideBool(
+        "SUPABASE_AUTH_WEB3_SOLANA_ENABLED",
+        web3.solana.enabled,
+        "auth.web3.solana.enabled",
+        projectEnvValues,
+      ),
+    },
+    ethereum: {
+      enabled: legacyEnvOverrideBool(
+        "SUPABASE_AUTH_WEB3_ETHEREUM_ENABLED",
+        web3.ethereum.enabled,
+        "auth.web3.ethereum.enabled",
+        projectEnvValues,
+      ),
+    },
+  };
+}
+
+/**
+ * Go's `Auth.OAuthServer` (`pkg/config/auth.go:394-398`) is a value-typed
+ * struct — same no-presence-gate reasoning as {@link resolveGotrueRateLimit}.
+ */
+function resolveGotrueOAuthServer(
+  oauthServer: ProjectConfig["auth"]["oauth_server"],
+  projectEnvValues: Readonly<Record<string, string>> | undefined,
+): ProjectConfig["auth"]["oauth_server"] {
+  return {
+    enabled: legacyEnvOverrideBool(
+      "SUPABASE_AUTH_OAUTH_SERVER_ENABLED",
+      oauthServer.enabled,
+      "auth.oauth_server.enabled",
+      projectEnvValues,
+    ),
+    authorization_url_path:
+      legacyEnvOverride(
+        "SUPABASE_AUTH_OAUTH_SERVER_AUTHORIZATION_URL_PATH",
+        oauthServer.authorization_url_path,
+        projectEnvValues,
+      ) ?? oauthServer.authorization_url_path,
+    allow_dynamic_registration: legacyEnvOverrideBool(
+      "SUPABASE_AUTH_OAUTH_SERVER_ALLOW_DYNAMIC_REGISTRATION",
+      oauthServer.allow_dynamic_registration,
+      "auth.oauth_server.allow_dynamic_registration",
+      projectEnvValues,
+    ),
+  };
+}
+
+/**
+ * Every value {@link legacyBuildGotrueContainerSpec} needs from `config`/
+ * `values`, minus `dbHost`/`dbPassword` (which that builder derives itself
+ * from `projectId`/`dbUrl`). See this module's header for the `@supabase/
+ * config` schema gaps (`captcha`/`passkey`/`webauthn`/`email.smtp` presence,
+ * `external` provider filtering) `gotrue.service.ts`'s own doc comment
+ * documents — reused here.
+ *
+ * A configured `auth.signing_keys_path` is honored for anon/service_role JWT
+ * SIGNING (`values.jwtSecret`/`legacyResolveLocalConfigValues`'s own
+ * `loadFirstSigningKey`), for the stack-wide JWKS document
+ * (`legacyResolveLocalJwks`), AND here as GoTrue's own `GOTRUE_JWT_KEYS` (Go's
+ * `GOTRUE_JWT_KEYS = utils.Config.Auth.SigningKeys`, `start.go:640`) — all
+ * three resolve the SAME file via {@link legacyResolveConfiguredSigningKeys},
+ * so GoTrue always signs with (one of) the key(s) the published JWKS
+ * advertises. `undefined` (Go's own default ES256 key, matching
+ * `gotrue.service.ts`'s hardcoded `LEGACY_GOTRUE_DEFAULT_SIGNING_KEY`) only
+ * when no `signing_keys_path` is configured or auth is disabled.
+ */
+
+/**
+ * `auth.external_url` isn't modeled in `@supabase/config`'s schema, so it's
+ * read off the raw document — same presence-based pattern as passkey/
+ * webauthn/external. Go's `auth.GetExternalURL` (`pkg/config/auth.go:401-405`)
+ * prefers this explicit value over deriving from `apiUrl`, and feeds it into
+ * `API_EXTERNAL_URL`, the mailer verify URL, the default JWT issuer, and
+ * OAuth redirect-URI fallbacks (`start.go:1354,1357,1374,1446`) for the
+ * long-running GoTrue container — AND into the identical `API_EXTERNAL_URL`
+ * Go's one-shot fresh-DB auth migration job builds (`db/start/start.go:323`).
+ * Both callers must resolve the SAME value, hence this standalone helper
+ * instead of two independent derivations.
+ */
+function resolveAuthExternalUrl(
+  document: Readonly<Record<string, unknown>> | undefined,
+  projectEnvValues: Readonly<Record<string, string>> | undefined,
+): string | undefined {
+  const rawAuthExternalUrl = asRecord(document?.["auth"])?.["external_url"];
+  return legacyEnvOverride(
+    "SUPABASE_AUTH_EXTERNAL_URL",
+    typeof rawAuthExternalUrl === "string" ? rawAuthExternalUrl : undefined,
+    projectEnvValues,
+  );
+}
+
+function resolveGotrueEnvInput(params: {
+  readonly context: LegacyLocalProjectContext;
+  readonly values: LegacyLocalConfigValues;
+  readonly workdir: string;
+  readonly kongContainerName: string;
+  readonly mailpitContainerName: string;
+  readonly resolvedEmail: LegacyResolvedAuthEmail;
+}): Omit<LegacyBuildGotrueEnvInput, "dbHost" | "dbPassword"> {
+  const { context, values, workdir, kongContainerName, mailpitContainerName, resolvedEmail } =
+    params;
+  const { config, projectEnvValues, loaded } = context;
+  const document = loaded?.document;
+
+  const inbucketEnabled = legacyEnvOverrideBool(
+    "SUPABASE_LOCAL_SMTP_ENABLED",
+    config.local_smtp.enabled,
+    "local_smtp.enabled",
+    projectEnvValues,
+  );
+  // Go's `[auth.email.smtp]` presence-based `enabled` default — reading the
+  // schema-decoded `config.auth.email.smtp` here would always see `enabled:
+  // false` when the key is merely absent from the TOML table (`@supabase/
+  // config`'s decode-time default), silently falling back to Mailpit even
+  // when a real SMTP server is configured. `legacyResolveAuthEmailSmtp`
+  // resolves this correctly off the raw document, same as the passkey/
+  // webauthn/external-provider reads below.
+  const resolvedSmtp = legacyResolveAuthEmailSmtp(asRecord(document?.["auth"]), projectEnvValues);
+  const smtp =
+    resolvedSmtp?.enabled === true
+      ? {
+          host: resolvedSmtp.host,
+          port: resolvedSmtp.port,
+          user: resolvedSmtp.user,
+          pass: resolvedSmtp.pass,
+          adminEmail: resolvedSmtp.adminEmail,
+          senderName: resolvedSmtp.senderName,
+        }
+      : undefined;
+  // Same generic-Viper-override gap as `inbucketEnabled` above, for
+  // `local_smtp.admin_email`/`sender_name` — value-typed fields, so no
+  // raw-document presence gate needed, matching `local_smtp.port`'s
+  // existing treatment.
+  const mailpitAdminEmail = legacyEnvOverride(
+    "SUPABASE_LOCAL_SMTP_ADMIN_EMAIL",
+    config.local_smtp.admin_email,
+    projectEnvValues,
+  );
+  const mailpitSenderName = legacyEnvOverride(
+    "SUPABASE_LOCAL_SMTP_SENDER_NAME",
+    config.local_smtp.sender_name,
+    projectEnvValues,
+  );
+  const mailpit =
+    smtp === undefined && inbucketEnabled
+      ? {
+          containerName: mailpitContainerName,
+          adminEmail: mailpitAdminEmail,
+          senderName: mailpitSenderName,
+        }
+      : undefined;
+
+  const { passkeyEnabled, webauthn } = resolveGotruePasskeyWebauthn(document, projectEnvValues);
+  const externalProviders = legacyResolveAuthExternalProviders(
+    asRecord(document?.["auth"]),
+    config.auth.external,
+    projectEnvValues,
+  );
+  const authExternalUrl = resolveAuthExternalUrl(document, projectEnvValues);
+
+  return {
+    apiUrl: values.apiUrl,
+    authExternalUrl,
+    jwtSecret: values.jwtSecret,
+    jwtIssuer: values.authJwtIssuer,
+    jwtExpiry: values.authJwtExpiry,
+    siteUrl: values.authSiteUrl,
+    additionalRedirectUrls: values.authAdditionalRedirectUrls,
+    enableSignup: values.authEnableSignup,
+    enableAnonymousSignIns: values.authEnableAnonymousSignIns,
+    enableRefreshTokenRotation: values.authEnableRefreshTokenRotation,
+    refreshTokenReuseInterval: values.authRefreshTokenReuseInterval,
+    enableManualLinking: values.authEnableManualLinking,
+    minimumPasswordLength: values.authMinimumPasswordLength,
+    passwordRequirements: values.authPasswordRequirements,
+    email: resolvedEmail,
+    kongContainerName,
+    smtp,
+    mailpit,
+    sms: legacyResolveAuthSms(asRecord(document?.["auth"]), config.auth.sms, projectEnvValues),
+    sessions: resolveGotrueSessions(config.auth.sessions, projectEnvValues),
+    mfa: legacyResolveAuthMfa(config.auth.mfa, projectEnvValues),
+    rateLimit: resolveGotrueRateLimit(config.auth.rate_limit, projectEnvValues),
+    web3: resolveGotrueWeb3(config.auth.web3, projectEnvValues),
+    oauthServer: resolveGotrueOAuthServer(config.auth.oauth_server, projectEnvValues),
+    hooks: legacyResolveAuthHooks(asRecord(document?.["auth"]), config.auth.hook, projectEnvValues),
+    captcha: legacyResolveAuthCaptcha(
+      asRecord(document?.["auth"]),
+      config.auth.captcha,
+      projectEnvValues,
+    ),
+    passkeyEnabled,
+    webauthn,
+    externalProviders,
+    signingKeys: legacyResolveConfiguredSigningKeys(config, workdir, projectEnvValues),
+  };
+}
+
+/**
+ * Go's `mountEmailTemplates` call sites for Kong (`start.go:544-558`): every configured template,
+ * then every ENABLED notification, suffixed `_notification`.
+ *
+ * Go's `baseConfig.resolve` (`config.go:901-916`) rebases `ContentPath` once at config-load time,
+ * BEFORE `mountEmailTemplates` ever runs: templates against `workdir`, notifications against
+ * `join(workdir, "supabase")` — the same asymmetric base `legacyResolveEmailTemplateContentPath`
+ * already applies for the file-existence check in `readAuthEmailTemplateContent`. Notification
+ * `content_path` here must go through that same rebase before reaching Kong's mount builder, or a
+ * relative notification path gets validated against `<workdir>/supabase/...` but mounted from
+ * `<workdir>/...`. Template entries need no rebase — `workdir` is already their correct base.
+ */
+function buildKongEmailTemplateMounts(
+  email: LegacyResolvedAuthEmail,
+  workdir: string,
+): ReadonlyArray<LegacyKongEmailTemplateMount> {
+  return [
+    ...Object.entries(email.template).map(([id, template]) => ({
+      id,
+      contentPath: template.content_path,
+    })),
+    ...Object.entries(email.notification)
+      .filter(([, notification]) => notification.enabled)
+      .map(([id, notification]) => ({
+        id: `${id}_notification`,
+        contentPath:
+          legacyResolveEmailTemplateContentPath({
+            section: "notification",
+            name: id,
+            contentPath: notification.content_path,
+            contentPresent: false,
+            base: join(workdir, "supabase"),
+          }) ?? "",
+      })),
+  ];
+}
+
 export const legacyStart = Effect.fn("legacy.start")(function* (flags: LegacyStartFlags) {
-  const proxy = yield* LegacyGoProxy;
   const output = yield* Output;
-  const legacyOutput = Option.getOrUndefined(yield* LegacyOutputFlag);
-  const args: string[] = ["start"];
-  for (const name of flags.exclude) args.push("--exclude", name);
-  if (flags.ignoreHealthCheck) args.push("--ignore-health-check");
-  if (flags.preview) args.push("--preview");
-
-  const statusOutput = machineStatusOutput(output.format, legacyOutput);
-  if (statusOutput !== undefined) {
-    yield* proxy.execCapture(args, { stdin: "inherit" });
-    const statusArgs = ["status", "--output", statusOutput];
-    for (const name of flags.exclude) statusArgs.push("--exclude", name);
-    if (flags.ignoreHealthCheck) statusArgs.push("--ignore-health-check");
-    if (output.format === "stream-json" && legacyOutput === undefined) {
-      const statusJson = yield* proxy.execCapture(statusArgs, { env: helperStatusEnv });
-      const status = yield* parseJsonOutput(statusJson);
-      yield* output.event({ type: "result", data: status, timestamp: new Date().toISOString() });
-    } else {
-      yield* proxy.exec(statusArgs, { env: helperStatusEnv });
+  const cliConfig = yield* LegacyCliConfig;
+  const telemetryState = yield* LegacyTelemetryState;
+  const analytics = yield* Analytics;
+  const spawner = yield* ChildProcessSpawner.ChildProcessSpawner;
+  const fs = yield* FileSystem.FileSystem;
+  const path = yield* Path.Path;
+  const dbConnection = yield* LegacyDbConnection;
+  const runtimeInfo = yield* RuntimeInfo;
+
+  yield* Effect.gen(function* () {
+    // 0. Go's `ChangeWorkDir` (`apps/cli-go/internal/utils/misc.go:231-250`) —
+    // unconditional, before `start`'s own `RunE` (see step 1's citation).
+    yield* legacyValidateWorkdirIsDirectory(cliConfig.workdir, fs).pipe(
+      Effect.mapError((error) => new LegacyStartWorkdirError({ message: error.message })),
+    );
+
+    // 1. Go's `startCmd.RunE` calls `validateExcludedContainers` as its VERY
+    // FIRST line (`cmd/start.go:49`) — before `start.Run` even loads config or
+    // checks whether the stack is already running, so this warning fires
+    // unconditionally on every invocation with an invalid `--exclude` value,
+    // including the already-running short-circuit below. `excludedKeys` (the
+    // VALID subset) is what actually gates container bring-up later.
+    const partition = legacyPartitionStartExcludeFlags(flags.exclude);
+    if (partition.warning !== undefined && output.format === "text") {
+      yield* output.raw(partition.warning, "stderr");
+    }
+    const excludedKeys = new Set(partition.valid);
+
+    // 2. Go's `flags.LoadConfig` (config load + `Validate`,
+    // `internal/utils/flags/config_path.go:10-14` -> `pkg/config/config.go:882`)
+    // — same config-load/env/project-id resolution sequence as `stop`/`status`.
+    const context = yield* legacyLoadLocalProjectContext(
+      cliConfig.workdir,
+      (message) => new LegacyStartConfigLoadError({ message }),
+    );
+    const values = yield* Effect.try({
+      try: () =>
+        legacyResolveLocalConfigValues(
+          context.config,
+          context.hostname,
+          cliConfig.workdir,
+          context.projectEnvValues,
+          context.loaded?.document,
+        ),
+      catch: (cause) =>
+        new LegacyStartInvalidConfigError({
+          message: cause instanceof Error ? cause.message : String(cause),
+        }),
+    });
+    const { config, projectId, projectEnvValues } = context;
+    // Single source resolved once, fed to both Kong's template mounts and GoTrue's env builder —
+    // see {@link legacyResolveAuthEmail}'s doc comment.
+    const resolvedEmail = yield* Effect.try({
+      try: () =>
+        legacyResolveAuthEmail(
+          config.auth.email,
+          asRecord(context.loaded?.document?.["auth"]),
+          projectEnvValues,
+        ),
+      catch: (cause) =>
+        new LegacyStartInvalidConfigError({
+          message: cause instanceof Error ? cause.message : String(cause),
+        }),
+    });
+    // Go decodes every `time.Duration` config field — including these 5 — in the same single,
+    // unconditional `Config.Load` pass (`mapstructure.StringToTimeDurationHookFunc()`,
+    // `pkg/config/config.go:749-756,777`), before `start` touches Docker at all
+    // (`internal/start/start.go:51,73`). The TS port only parses them inside GoTrue's own env
+    // builder (`gotrue.service.ts`), which never runs at all when auth is disabled or `gotrue` is
+    // excluded — so a malformed value would otherwise be silently accepted instead of failing the
+    // command, unlike Go. Validate eagerly here, discarding the parsed nanosecond counts, since
+    // `resolveGotrueEnvInput` (below) re-resolves and re-parses these same fields for the actual
+    // GoTrue container build.
+    const gotrueSessionsForValidation = resolveGotrueSessions(
+      config.auth.sessions,
+      projectEnvValues,
+    );
+    yield* wrapConfigOverride("auth.email.max_frequency", () =>
+      legacyParseGoDuration(resolvedEmail.max_frequency),
+    );
+    // Wrapped like `resolvedEmail` above: `legacyResolveLocalConfigValues`'s own SMS validation
+    // only runs `if (authEnabled)` (`legacy-local-config-values.ts`), so this direct call is the
+    // ONLY place a malformed `auth.sms.*` override is ever caught when auth is disabled — an
+    // unwrapped throw here would surface as an Effect defect instead of the normal
+    // `LegacyStartInvalidConfigError` config-load failure.
+    const smsForValidation = yield* Effect.try({
+      try: () =>
+        legacyResolveAuthSms(
+          asRecord(context.loaded?.document?.["auth"]),
+          config.auth.sms,
+          projectEnvValues,
+        ),
+      catch: (cause) =>
+        new LegacyStartInvalidConfigError({
+          message: cause instanceof Error ? cause.message : String(cause),
+        }),
+    });
+    yield* wrapConfigOverride("auth.sms.max_frequency", () =>
+      legacyParseGoDuration(smsForValidation.max_frequency),
+    );
+    // Go's `(s *sms) validate()` (`config.go:1412-1415`) prints this and downgrades
+    // `EnableSignup` to `false` when no provider is enabled — `legacyResolveAuthSms` already
+    // applies the downgrade itself, so this only needs to detect whether that branch fired (the
+    // user configured `enable_signup = true` with every provider disabled) to reproduce the
+    // matching warning.
+    if (
+      !smsForValidation.twilio.enabled &&
+      !smsForValidation.twilio_verify.enabled &&
+      !smsForValidation.messagebird.enabled &&
+      !smsForValidation.textlocal.enabled &&
+      !smsForValidation.vonage.enabled &&
+      legacyEnvOverrideBool(
+        "SUPABASE_AUTH_SMS_ENABLE_SIGNUP",
+        config.auth.sms.enable_signup,
+        "auth.sms.enable_signup",
+        projectEnvValues,
+      )
+    ) {
+      yield* output.raw("WARN: no SMS provider is enabled. Disabling phone login\n", "stderr");
+    }
+    if (gotrueSessionsForValidation?.timebox !== undefined) {
+      yield* wrapConfigOverride("auth.sessions.timebox", () =>
+        legacyParseGoDuration(gotrueSessionsForValidation.timebox!),
+      );
+    }
+    if (gotrueSessionsForValidation?.inactivity_timeout !== undefined) {
+      yield* wrapConfigOverride("auth.sessions.inactivity_timeout", () =>
+        legacyParseGoDuration(gotrueSessionsForValidation.inactivity_timeout!),
+      );
+    }
+    yield* wrapConfigOverride("auth.mfa.phone.max_frequency", () =>
+      legacyParseGoDuration(
+        legacyResolveAuthMfa(config.auth.mfa, projectEnvValues).phone.max_frequency,
+      ),
+    );
+    // Same gap for the remaining GoTrue overrides: `auth.rate_limit.*` (plain `uint`s) and
+    // `auth.web3.*.enabled`/`auth.oauth_server.{enabled,allow_dynamic_registration}` (plain
+    // `bool`s) are all decoded unconditionally in Go's single `Config.Load` pass
+    // (`pkg/config/auth.go:200-208,371-382,394-398`), regardless of `auth.enabled`/`--exclude
+    // gotrue`. `resolveGotrueRateLimit`/`resolveGotrueWeb3`/`resolveGotrueOAuthServer` already
+    // throw internally on a bad override, so — unlike the duration fields above — calling each
+    // whole (pure) function once here is simpler than re-deriving every field individually;
+    // `resolveGotrueEnvInput` below re-resolves them a second time for the real container build,
+    // which is safe since they're pure. `auth.oauth_server.authorization_url_path` is a plain
+    // string and can't throw, so it needs no eager check.
+    yield* wrapConfigOverride("auth.rate_limit", () =>
+      resolveGotrueRateLimit(config.auth.rate_limit, projectEnvValues),
+    );
+    yield* wrapConfigOverride("auth.web3", () =>
+      resolveGotrueWeb3(config.auth.web3, projectEnvValues),
+    );
+    yield* wrapConfigOverride("auth.oauth_server", () =>
+      resolveGotrueOAuthServer(config.auth.oauth_server, projectEnvValues),
+    );
+    // Same gap for `auth.passkey.enabled`/`auth.webauthn.*` and per-provider `auth.external.
+    // <name>.{enabled,skip_nonce_check,email_optional}` — Go decodes these raw (unmodeled by
+    // `@supabase/config`) booleans in the same unconditional `Config.Load` pass as the fields
+    // above (`pkg/config/auth.go:166-176,190,361-391`), regardless of `auth.enabled`/`--exclude
+    // gotrue`. Both resolvers already throw internally on a bad raw bool (`legacyRawUnmodeledBool`)
+    // and are otherwise only reached from `resolveGotrueEnvInput`'s `case "gotrue":` branch below —
+    // itself gated on auth being enabled and gotrue not excluded — so calling each here, once,
+    // eagerly and discarding the result, closes the same "validates but doesn't reach it" gap.
+    yield* wrapConfigOverride("auth.passkey", () =>
+      resolveGotruePasskeyWebauthn(context.loaded?.document, projectEnvValues),
+    );
+    yield* wrapConfigOverride("auth.external", () =>
+      legacyResolveAuthExternalProviders(
+        asRecord(context.loaded?.document?.["auth"]),
+        config.auth.external,
+        projectEnvValues,
+      ),
+    );
+    // Go's `function` struct (`pkg/config/config.go:290-296`) has no `env` field — `Config.Load`'s
+    // `v.UnmarshalExact` (`ErrorUnused: true`, `config.go:749,1041`) rejects any unknown key
+    // unconditionally, well before any Docker work. `@supabase/config`'s own schema DOES model
+    // `[functions.<slug>.env]` (`packages/config/src/functions.ts`) — a legitimate `next/`-only
+    // feature shared infrastructure the legacy shell can't remove — so this is a legacy-only
+    // rejection, not a schema change. Empirically confirmed against the real Go binary: a config
+    // with `[functions.foo.env]` fails with `'functions[foo]' has invalid keys: env`.
+    for (const [slug, func] of Object.entries(config.functions)) {
+      if (Object.keys(func.env).length > 0) {
+        yield* Effect.fail(
+          new LegacyStartInvalidConfigError({
+            message: `failed to parse config: decoding failed due to the following error(s):\n\n'functions[${slug}]' has invalid keys: env`,
+          }),
+        );
+      }
+    }
+    // `legacyCheckDbToml` resolves `[db.vault]`/`[db.seed]`/`db.migrations.enabled`/the effective
+    // `api.auto_expose_new_tables` tri-state the same way Go's `Config.Load`/`Validate` does —
+    // unconditionally, before any Docker work (`config.go` decode + validate pass). The port only
+    // ran this inside `legacyStartSetupLocalDatabase`, which is itself gated on the DB container's
+    // healthcheck passing AND a fresh volume (Go's `NoBackupVolume` gate) — so a malformed
+    // `SUPABASE_DB_SEED_ENABLED`/an undecryptable `[db.vault]` secret went completely unvalidated
+    // whenever `start` reused an existing volume. Called here purely for its validation side
+    // effect and discarded — `legacyStartSetupLocalDatabase`'s own internal call (an already-
+    // accepted duplicate config-load pass, matching `db start`'s own independent resolution — see
+    // `lib/db-setup.ts`'s header) still resolves the real value for its own use when it runs.
+    yield* legacyCheckDbToml(fs, path, cliConfig.workdir).pipe(Effect.asVoid);
+
+    const dbContainerId = localDbContainerId(projectId);
+    const filterValue = legacyCliProjectFilterValue(projectId);
+
+    // Shared status-values helper — reused by BOTH the already-running branch
+    // (full `status.Run` pipeline, health-checked + "stopped" diffed) and the
+    // success path at the end (Go's direct `status.PrettyPrint`/`toValues`
+    // call, no re-health-check — see each call site's own comment for why
+    // they differ).
+    //
+    // `precomputedLocal` is only ever passed by the success-path call: Go's
+    // already-running branch delegates to `status.Run`, which calls
+    // `flags.LoadConfig` (and therefore re-derives keys) a SECOND time in that
+    // same process (`start.go:51` then `status.go:101`), so recomputing here
+    // matches Go exactly. The success path, by contrast, never calls
+    // `LoadConfig` again after bring-up — it prints straight from the
+    // already-populated config (`start.go:85`) — so it must reuse the SAME
+    // `values` that were already used to build every container spec, instead
+    // of re-deriving (and, for asymmetric JWTs, re-signing with a new `exp`) a
+    // second time. See {@link legacyResolveStatusLocalState}'s
+    // `precomputedLocal` param doc for why a second derivation is unsafe.
+    const buildStatusValues = Effect.fnUntraced(function* (
+      excluded: ReadonlyArray<string>,
+      precomputedLocal?: LegacyLocalConfigValues,
+    ) {
+      const localState = yield* Effect.try({
+        try: () =>
+          legacyResolveStatusLocalState(
+            context.config,
+            context.hostname,
+            cliConfig.workdir,
+            context.projectEnvValues,
+            context.loaded?.document,
+            precomputedLocal,
+          ),
+        catch: (cause) =>
+          new LegacyStatusInvalidConfigError({
+            message: cause instanceof Error ? cause.message : String(cause),
+          }),
+      });
+      const containerIds = legacyStatusContainerIds(projectId);
+      const state = legacyGateStatusState(localState, containerIds, excluded);
+      return legacyStatusValuesFromState(state, new Map());
+    });
+
+    // 3. Go's `AssertSupabaseDbIsRunning` (`internal/utils/misc.go:144-146`) —
+    // a bare `ContainerInspect` EXISTENCE check, true even for a merely
+    // present-but-stopped container. "Not found" is the ONE outcome that means
+    // "proceed to bring up the stack"; any OTHER inspect failure (e.g. the
+    // Docker daemon itself being unreachable) must propagate and fail `start`
+    // outright, matching Go's `!errors.Is(err, utils.ErrNotRunning)` branch.
+    const alreadyRunning = yield* legacyInspectContainerState(spawner, dbContainerId).pipe(
+      Effect.map(() => true),
+      Effect.catch((error) =>
+        isContainerNotFoundMessage(error.message) ? Effect.succeed(false) : Effect.fail(error),
+      ),
+    );
+
+    if (alreadyRunning) {
+      // `start.go:55`: printed unconditionally in Go (which has no JSON output
+      // mode to protect); gated here on text mode for internal consistency
+      // with every other supplementary stderr line this handler prints (see
+      // the exclude warning above and the success-path messages below) — this
+      // port's `--output-format json|stream-json` callers get a clean
+      // structured payload with no extra text noise.
+      if (output.format === "text") {
+        yield* output.raw(legacyStartAlreadyRunningMessage(), "stderr");
+      }
+
+      // Mirrors Go's `status.Run` (`internal/status/status.go:99-123`), which
+      // `start.go:57` delegates to for this branch — full health-check +
+      // "stopped services" diffing pipeline, distinct from the success path's
+      // direct `status.PrettyPrint` call below (see that branch's own
+      // comment for why the two differ).
+      if (!flags.ignoreHealthCheck) {
+        const state = yield* legacyInspectContainerState(spawner, dbContainerId).pipe(
+          Effect.mapError((cause) => new LegacyStatusDbInspectError({ message: cause.message })),
+        );
+        if (!state.running) {
+          return yield* Effect.fail(
+            new LegacyStatusDbNotRunningError({
+              message: `${dbContainerId} container is not running: ${state.status}`,
+            }),
+          );
+        }
+        if (state.health !== undefined && state.health !== "healthy") {
+          return yield* Effect.fail(
+            new LegacyStatusDbNotReadyError({
+              message: `${dbContainerId} container is not ready: ${state.health}`,
+            }),
+          );
+        }
+      }
+
+      const runningNames = yield* legacyListContainersByLabel(spawner, {
+        projectIdFilter: filterValue,
+        all: false,
+        format: "names",
+      }).pipe(Effect.mapError((cause) => new LegacyStatusListError({ message: cause.message })));
+      const runningSet = new Set(runningNames);
+      const serviceIds = legacyServiceContainerIds(projectId);
+      const stopped = serviceIds.filter((id) => !runningSet.has(id));
+      // Unconditional in Go (`status.go:114`) and here — stderr text, never
+      // corrupts a JSON stdout payload.
+      if (stopped.length > 0) {
+        yield* output.raw(`Stopped services: [${stopped.join(" ")}]\n`, "stderr");
+      }
+      const excluded = [...stopped, ...flags.exclude];
+
+      if (output.format === "text") {
+        // `status.go:118`'s pretty-branch banner -- distinct from (and printed
+        // in ADDITION to) `legacyStartAlreadyRunningMessage()` above; Go
+        // really does stack both lines in this branch.
+        yield* output.raw(
+          `${legacyAqua("supabase")} local development setup is running.\n\n`,
+          "stderr",
+        );
+        const { values: statusValues, names } = yield* buildStatusValues(excluded);
+        yield* output.raw(legacyRenderStatusPretty(statusValues, names));
+      } else {
+        const { values: statusValues } = yield* buildStatusValues(excluded);
+        yield* output.success("", statusValues);
+      }
+      return;
+    }
+
+    // 4. Go's `flags.LoadProjectRef`/`services.CheckVersions` best-effort
+    // update-suggestion (`start.go:61-63`): a Management API call gated on the
+    // project being linked AND the user being logged in, purely to print an
+    // "update available" hint, every error silently swallowed. Deliberately
+    // NOT implemented — this command has zero Management API dependency by
+    // design; omission confirmed against source, not missed.
+
+    // 5. Gate evaluation — see `start.gates.ts` for the full boolean table.
+    // `legacyEnvOverrideBool` throws synchronously on an unparsable value (matching Go's
+    // `Config.Load` hard-failing on a bad Viper bool decode, `pkg/config/config.go:749-756`) —
+    // wrapped so that throw becomes the typed `LegacyStartInvalidConfigError` every other
+    // malformed-config path in this handler uses, not an untyped Effect defect.
+    const gates = yield* Effect.try({
+      try: () =>
+        legacyResolveStartGates({
+          config,
+          projectEnvValues,
+          excludedKeys,
+          document: context.loaded?.document,
+        }),
+      catch: (cause) =>
+        new LegacyStartInvalidConfigError({
+          message: cause instanceof Error ? cause.message : String(cause),
+        }),
+    });
+
+    // 6. Go's `utils.Config.Auth.ResolveJWKS(ctx)` (`start.go:274-277`) — runs
+    // UNCONDITIONALLY, before any image pull, regardless of whether
+    // auth/realtime/postgrest/storage end up enabled.
+    const jwks = yield* Effect.tryPromise({
+      try: () =>
+        legacyResolveLocalJwks(config, cliConfig.workdir, values.jwtSecret, projectEnvValues),
+      catch: (cause) =>
+        new LegacyStartInvalidConfigError({
+          message: cause instanceof Error ? cause.message : String(cause),
+        }),
+    });
+
+    // Go's `Config.Load` folds `SUPABASE_DB_MAJOR_VERSION` into
+    // `c.Db.MajorVersion` before the image-selection switch runs
+    // (`pkg/config/config.go:585-586,819-827`), and every later Go read of
+    // `utils.Config.Db.MajorVersion` — image, version-pin gating, the
+    // PG14/PG15+ branch, migration-job selection — sees that SAME
+    // already-overridden value. `legacyResolveLocalConfigValues` already
+    // computed/validated this exact value above; recomputing it here (rather
+    // than threading it out of `values`) matches this file's own precedent
+    // for the realtime/storage/auth `enabled` overrides a few dozen lines
+    // below.
+    const majorVersion = legacyEnvOverrideMajorVersion(config.db.major_version, projectEnvValues);
+    // Same treatment as `majorVersion` above, for the sibling
+    // `edge_runtime.deno_version` -> `Config.EdgeRuntime.Image` switch
+    // (`pkg/config/config.go:1164-1173`), applied before `Validate` at the
+    // end of `Config.Load` (`config.go:882`).
+    const denoVersion = legacyEnvOverrideDenoVersion(
+      config.edge_runtime.deno_version,
+      projectEnvValues,
+    );
+    // Same generic-Viper-override gap as `majorVersion`/`denoVersion` above,
+    // for `experimental.orioledb_version` -> `Config.Db.Image` rewrite
+    // (`pkg/config/config.go:1041-1046`), applied at the end of `Config.Load`
+    // (`config.go:882`) before `start` reads it. Also threaded into the
+    // Postgres container spec below, since `postgres.service.ts`'s
+    // `legacyPostgresExtraEnv` reads this same field to decide whether to add
+    // the S3/`POSTGRES_INITDB_ARGS` env vars — both consumers must agree.
+    const orioledbVersion = legacyEnvOverride(
+      "SUPABASE_EXPERIMENTAL_ORIOLEDB_VERSION",
+      config.experimental.orioledb_version,
+      projectEnvValues,
+    );
+    // Same generic-Viper-override gap as `orioledbVersion` above, for its four
+    // sibling S3 fields Go reads into the Postgres container's `S3_*` env
+    // alongside `orioledb_version` (`apps/cli-go/internal/db/start/
+    // start.go:70-77`) — also threaded into the Postgres container spec
+    // below, since `legacyPostgresExtraEnv` reads these same fields raw.
+    const s3Host = legacyEnvOverride(
+      "SUPABASE_EXPERIMENTAL_S3_HOST",
+      config.experimental.s3_host,
+      projectEnvValues,
+    );
+    // Go's one-shot fresh-DB setup jobs (`initSchema15`) read `utils.Config.
+    // {Realtime,Storage,Auth}.Enabled` — the EFFECTIVE, env-overridden value — and run
+    // regardless of `--exclude` (`internal/db/start/start.go:270,299,321`) WHENEVER they
+    // actually execute (see the `isFreshVolume`/`majorVersion >= 15` gate further down,
+    // where these booleans also gate that conditional image resolve). Hoisted here
+    // (rather than recomputed only inside the `isFreshVolume` block below) since
+    // `legacyStartSetupLocalDatabase`'s own config object a few hundred lines down also
+    // needs them, and computing them once keeps both consumers in agreement.
+    const realtimeEnabledForSetup = legacyEnvOverrideBool(
+      "SUPABASE_REALTIME_ENABLED",
+      config.realtime.enabled,
+      "realtime.enabled",
+      projectEnvValues,
+    );
+    const storageEnabledForSetup = legacyEnvOverrideBool(
+      "SUPABASE_STORAGE_ENABLED",
+      config.storage.enabled,
+      "storage.enabled",
+      projectEnvValues,
+    );
+    const authEnabledForSetup = legacyEnvOverrideBool(
+      "SUPABASE_AUTH_ENABLED",
+      config.auth.enabled,
+      "auth.enabled",
+      projectEnvValues,
+    );
+    const s3Region = legacyEnvOverride(
+      "SUPABASE_EXPERIMENTAL_S3_REGION",
+      config.experimental.s3_region,
+      projectEnvValues,
+    );
+    const s3AccessKey = legacyEnvOverride(
+      "SUPABASE_EXPERIMENTAL_S3_ACCESS_KEY",
+      config.experimental.s3_access_key,
+      projectEnvValues,
+    );
+    const s3SecretKey = legacyEnvOverride(
+      "SUPABASE_EXPERIMENTAL_S3_SECRET_KEY",
+      config.experimental.s3_secret_key,
+      projectEnvValues,
+    );
+
+    // 7. Resolve every image that will actually be pulled (Go's
+    // `ensureImagesCached`, `start.go:225-262,289`) BEFORE any container is
+    // created.
+    const postgresImage = yield* legacyResolveDbImage(
+      fs,
+      path,
+      cliConfig.workdir,
+      majorVersion,
+      orioledbVersion,
+    );
+    // Go's `Config.Load` rewrites `c.Auth.Image`/`c.Api.Image`/etc. from
+    // `supabase/.temp/{gotrue,rest,storage,realtime,studio,pgmeta,logflare,
+    // pooler}-version` (linked-project pins written by `supabase link`)
+    // BEFORE `start` ever reads them (`pkg/config/config.go:827-863`) — read
+    // once, reused by both the image plan below and the fresh-DB one-shot
+    // setup jobs' images, which Go resolves from the same already-rewritten
+    // `utils.Config.*.Image` fields regardless of `--exclude`.
+    const serviceVersionOverrides = yield* legacyReadServiceVersionOverrides(
+      fs,
+      path,
+      cliConfig.workdir,
+      majorVersion,
+    );
+    const imagePlan = legacyResolveStartImagePlan(gates, serviceVersionOverrides);
+    // Edge Runtime doesn't go through `legacyResolveStartImagePlan` (see
+    // `start.gates.ts`'s header) — its default image is resolved independently,
+    // matching Go's own `pullImagesUsingCompose`/`ensureImagesCached` also
+    // pre-pulling `utils.Config.EdgeRuntime.Image` whenever it's enabled and not
+    // excluded.
+    const edgeRuntimeDefaultImage = gates.edgeRuntime
+      ? yield* legacyResolveEdgeRuntimeImage(fs, path, cliConfig.workdir, denoVersion)
+      : undefined;
+    // Go's own pre-pull (`ensureImagesCached`, `start.go:237-262`) only ever touches
+    // `project.Services`, already filtered to non-excluded services (`start.go:269-282`)
+    // — the fresh-DB one-shot setup jobs' images are NOT pre-pulled here; Go resolves
+    // those lazily, later, only from inside `initSchema15` when it actually runs (see the
+    // conditional resolve further down, gated the same way that job itself is gated).
+    const resolvedImages = yield* legacyEnsureImagesCached(
+      spawner,
+      [
+        postgresImage,
+        ...imagePlan.map((entry) => entry.image),
+        ...(edgeRuntimeDefaultImage !== undefined ? [edgeRuntimeDefaultImage] : []),
+      ],
+      projectEnvValues,
+    );
+    const resolveImage = (image: string) => resolvedImages.get(image) ?? image;
+
+    // Hoisted out of the Edge Runtime bring-up below: Go's Studio bring-up
+    // (`start.go:1149-1159`) calls `serve.PopulatePerFunctionConfigs` for its
+    // own bind mounts UNCONDITIONALLY of `Config.EdgeRuntime.Enabled`, so
+    // these manifest values must be available to `buildSpecForService`'s
+    // "studio" case regardless of whether Edge Runtime itself is enabled.
+    //
+    // `config.functions.<slug>.env.<VAR>` is schema-marked deferred
+    // (`env(...)`, `packages/config/src/lib/env.ts`) and only gets its
+    // literal interpolated by `resolveProjectSubtree` — without this step, a
+    // configured `[functions.<slug>.env]` entry reaches Edge Runtime as the
+    // literal string `"env(API_KEY)"` instead of the real secret.
+    // `functions serve`'s own call site already resolves this subtree first
+    // (`shared/functions/serve.ts:615-622`) before the same
+    // `toPlainFunctionRecord` call — same reasoning as `resolvedEdgeRuntime`
+    // below, just for the sibling `functions` subtree.
+    const resolvedFunctions = yield* resolveProjectSubtree(
+      config.functions,
+      { values: projectEnvValues ?? {} },
+      "functions",
+      { goViperCompat: true },
+    );
+    const configDeclaredFunctions = toPlainFunctionRecord(resolvedFunctions);
+    const configFunctions = yield* inferFunctionsManifest({
+      cwd: cliConfig.workdir,
+      config: { ...config, functions: configDeclaredFunctions },
+      // `search: false`: `cliConfig.workdir` is already Go's fully-resolved chdir target (same
+      // reasoning as `legacy-local-project-context.ts`'s `loadProjectEnvironment` call) — letting
+      // `findProjectPaths` climb ancestors again here would let an unrelated ancestor project's
+      // `supabase/functions` win when `--workdir`/`SUPABASE_WORKDIR` points at a subdirectory with
+      // no `supabase/config.toml` of its own.
+      search: false,
+    });
+    const rawConfigFunctions = rawFunctionConfigRecord(context.loaded?.document);
+
+    // Go's `config.Load` reads `supabase/.temp/storage-migration` (written by
+    // `supabase link`) into `Config.Storage.TargetMigration` whenever present
+    // (`pkg/config/config.go:844-846`), and that value feeds
+    // `DB_MIGRATIONS_FREEZE_AT` for both the Storage container and the
+    // fresh-DB one-shot Storage migrate job. Any read error (including
+    // not-exist) or blank content resolves to "", matching Go's `err == nil
+    // && len(version) > 0` gate.
+    const storageTargetMigration = yield* fs
+      .readFileString(legacyTempPaths(path, cliConfig.workdir).storageMigration)
+      .pipe(
+        Effect.map((content) => content.trim()),
+        Effect.orElseSucceed(() => ""),
+      );
+
+    // Go's `DockerStart` forces every container's network mode (and the
+    // network it creates) to `--network-id` when set, ahead of the generated
+    // `supabase_network_<project>` fallback (`docker.go:379-383`).
+    const networkIdFlag = yield* LegacyNetworkIdFlag;
+    const networkId = Option.isSome(networkIdFlag)
+      ? networkIdFlag.value
+      : localNetworkId(projectId);
+    const isBitbucketPipeline = legacyIsBitbucketPipeline();
+    // Go's `DockerStart` unconditionally appends the Linux-only
+    // `host.docker.internal:host-gateway` extra host for every container it
+    // starts (`docker_linux.go`; empty on darwin/windows, where Docker
+    // Desktop already resolves that hostname) — same expression already used
+    // for the one-shot migrate jobs (`db-setup.ts`) and Edge Runtime bring-up
+    // (`legacy-edge-runtime-script.layer.ts`).
+    const extraHosts =
+      runtimeInfo.platform === "linux" ? ["host.docker.internal:host-gateway"] : [];
+    const startOpts: LegacyStartContainerOpts = {
+      projectId,
+      isBitbucketPipeline,
+      workdir: cliConfig.workdir,
+      extraHosts,
+    };
+    const dbHost = dbContainerId;
+    const dbPassword = legacyStartInternalDbPassword(values.dbUrl);
+
+    const kongContainerName = legacyServiceContainerName("kong", projectId);
+    const gotrueContainerName = legacyServiceContainerName("auth", projectId);
+    const restContainerName = legacyServiceContainerName("rest", projectId);
+    const realtimeContainerName = legacyServiceContainerName("realtime", projectId);
+    const storageContainerName = legacyServiceContainerName("storage", projectId);
+    const studioContainerName = legacyServiceContainerName("studio", projectId);
+    const pgMetaContainerName = legacyServiceContainerName("pg_meta", projectId);
+    const edgeRuntimeContainerName = legacyServiceContainerName("edge_runtime", projectId);
+    const logflareContainerName = legacyServiceContainerName("analytics", projectId);
+    const poolerContainerName = legacyServiceContainerName("pooler", projectId);
+    const vectorContainerName = legacyServiceContainerName("vector", projectId);
+    const mailpitContainerName = legacyServiceContainerName("inbucket", projectId);
+
+    // Go gates the TLS cert/key disk read on the post-Viper-override `Api.Enabled` itself, not
+    // just `Api.Tls.Enabled` (`pkg/config/config.go:1006-1027`: the whole `if c.Api.Enabled`
+    // block, including the nested `if c.Api.Tls.Enabled` cert read, is skipped when API is
+    // disabled, leaving `CertContent`/`KeyContent` at their embedded defaults). Not the SAME
+    // `apiEnabled` `legacyResolveStartGates` (`start.gates.ts:87-92`) computes for its own
+    // `gates.postgrest` — that one is additionally ANDed with `--exclude postgrest`, which has no
+    // equivalent in Go's `Validate()` — so this is resolved separately here.
+    const apiEnabled = yield* wrapConfigOverride("api.enabled", () =>
+      legacyEnvOverrideBool(
+        "SUPABASE_API_ENABLED",
+        config.api.enabled,
+        "api.enabled",
+        projectEnvValues,
+      ),
+    );
+    // Hoisted out of the "kong" case below (it used to be computed only
+    // there): the post-bring-up health-probe CA-trust lookup near the end of
+    // this function needs the SAME env-overridden value, not the raw
+    // `config.api.tls.enabled` — Go has one source of truth here (`Config.
+    // Load` applies `SUPABASE_API_TLS_ENABLED` before `Validate` populates
+    // `Api.Tls.CertContent`, `pkg/config/config.go:586,749,882,1006-1019`),
+    // and `status.NewKongClient`'s trust pool + its health probe's target URL
+    // both read that same already-overridden global (`internal/status/
+    // status.go:181-229`).
+    const apiTlsEnabled = yield* wrapConfigOverride("api.tls.enabled", () =>
+      legacyEnvOverrideBool(
+        "SUPABASE_API_TLS_ENABLED",
+        config.api.tls.enabled,
+        "api.tls.enabled",
+        projectEnvValues,
+      ),
+    );
+    // Same generic-Viper-override gap as `apiTlsEnabled` above, for the two
+    // custom cert/key path fields — Go's `Config.Load` applies
+    // `SUPABASE_API_TLS_CERT_PATH`/`SUPABASE_API_TLS_KEY_PATH` before
+    // `Validate` reads `CertPath`/`KeyPath` from disk into `CertContent`/
+    // `KeyContent` (`pkg/config/config.go:1012-1024`). Mirrors the identical
+    // resolution `legacy-local-config-values.ts` already does for `status`/`stop`.
+    const apiTlsCertPath = legacyEnvOverride(
+      "SUPABASE_API_TLS_CERT_PATH",
+      config.api.tls.cert_path,
+      projectEnvValues,
+    );
+    const apiTlsKeyPath = legacyEnvOverride(
+      "SUPABASE_API_TLS_KEY_PATH",
+      config.api.tls.key_path,
+      projectEnvValues,
+    );
+
+    // Same generic-Viper-override gap as `apiTlsEnabled` above, for Realtime's
+    // two `SUPABASE_REALTIME_*` fields — both the Realtime container spec
+    // below AND the PG15+ Realtime setup job (`legacyStartSetupLocalDatabase`,
+    // via the `realtime` splice further down) must see the SAME
+    // already-overridden values, matching Go's single `utils.Config.Realtime`
+    // source of truth (`internal/start/start.go:922,928`,
+    // `internal/db/start/start.go:283,290`).
+    const realtimeIpVersion = yield* wrapConfigOverride("realtime.ip_version", () =>
+      legacyEnvOverrideRealtimeIpVersion(config.realtime.ip_version, projectEnvValues),
+    );
+    const realtimeMaxHeaderLength = yield* wrapConfigOverride("realtime.max_header_length", () =>
+      legacyEnvOverrideRealtimeMaxHeaderLength(config.realtime.max_header_length, projectEnvValues),
+    );
+
+    // Same gap for Storage's file-size limit — both the long-running
+    // container below AND the one-shot storage migrate job
+    // (`legacyStartSetupLocalDatabase`, via the `storage` splice further
+    // down) must see the same already-overridden value (Go's
+    // `internal/start/start.go:1004`, `internal/db/start/start.go:307`, both
+    // reading the single `utils.Config.Storage.FileSizeLimit`).
+    const storageFileSizeLimit =
+      legacyEnvOverride(
+        "SUPABASE_STORAGE_FILE_SIZE_LIMIT",
+        config.storage.file_size_limit,
+        projectEnvValues,
+      ) ?? config.storage.file_size_limit;
+    // `@supabase/config`'s schema accepts `file_size_limit` as a plain string — it does not parse
+    // the size grammar itself, so a malformed value (e.g. "foobar") would otherwise only surface
+    // when `storage.service.ts`'s `ramInBytes` call builds the container env, well after
+    // network/image/Postgres work, and never at all when Storage is excluded/disabled. Go's
+    // `sizeInBytes.UnmarshalText` (`pkg/config/config.go:39-49`) decodes this unconditionally in
+    // the same `Config.Load` pass as everything else (`config.go:749-756,775-784`), before `start`
+    // touches Docker or looks at `--exclude` — validate eagerly here to match, discarding the
+    // parsed byte count since every consumer re-parses `storageFileSizeLimit` itself.
+    yield* wrapConfigOverride("storage.file_size_limit", () => ramInBytes(storageFileSizeLimit));
+    // Same gap for `storage.vector.enabled` — both the long-running Storage
+    // container AND `legacySeedBucketsRun`'s `effectiveLocalStorageConfig`
+    // splice further down must see the same already-overridden value (Go's
+    // `internal/seed/buckets/buckets.go:54` reads the single
+    // `utils.Config.Storage.VectorBuckets.Enabled`).
+    const storageVectorEnabled = yield* wrapConfigOverride("storage.vector.enabled", () =>
+      legacyEnvOverrideBool(
+        "SUPABASE_STORAGE_VECTOR_ENABLED",
+        config.storage.vector.enabled,
+        "storage.vector.enabled",
+        projectEnvValues,
+      ),
+    );
+    // Same gap for `storage.s3_protocol.enabled` — a plain bool decoded via Go's generic
+    // Viper/mapstructure `Config.Load` pass (`storage.go:43-45`, `s3Protocol.Enabled`), the exact
+    // same mechanism as `storage.vector.enabled` above, unconditionally before any Docker work.
+    // The Storage spec builder below only parsed this lazily, so it was silently accepted when
+    // Storage is excluded/disabled — same class of gap already fixed for `storage.file_size_limit`,
+    // the GoTrue duration fields, and `db.health_timeout`.
+    const storageS3ProtocolEnabled = yield* wrapConfigOverride("storage.s3_protocol.enabled", () =>
+      legacyEnvOverrideBool(
+        "SUPABASE_STORAGE_S3_PROTOCOL_ENABLED",
+        config.storage.s3_protocol.enabled,
+        "storage.s3_protocol.enabled",
+        projectEnvValues,
+      ),
+    );
+    // Same gap for `storage.analytics.enabled` — the `Enabled` bool sibling of the
+    // `max_namespaces`/`max_tables`/`max_catalogs` uint fields validated below, all decoded in
+    // the same generic Viper/mapstructure `Config.Load` pass, unconditionally, before any Docker
+    // work. `start` itself never reads this field locally (only `seed buckets --linked` does,
+    // unreachable from `start`'s own inline seeding since every call here passes
+    // `projectRef: ""`) — validate purely for Go's fail-fast parity and discard the result, same
+    // as the uint siblings below.
+    yield* wrapConfigOverride("storage.analytics.enabled", () =>
+      legacyEnvOverrideBool(
+        "SUPABASE_STORAGE_ANALYTICS_ENABLED",
+        config.storage.analytics.enabled,
+        "storage.analytics.enabled",
+        projectEnvValues,
+      ),
+    );
+    // Go decodes `storage.analytics.{max_namespaces,max_tables,max_catalogs}` and
+    // `storage.vector.{max_buckets,max_indexes}` as plain `uint`s in the same generic
+    // Viper/mapstructure `Config.Load` pass as every other field above (`pkg/config/
+    // storage.go:28-39`) — unconditionally, before any Docker work. Unlike their `enabled`
+    // siblings above, `start`'s own logic never reads these fields (only `config push`/`pull`
+    // do), so there is no downstream re-resolution to reuse — validate purely for Go's
+    // fail-fast parity and discard the result.
+    yield* wrapConfigOverride("storage.analytics.max_namespaces", () =>
+      legacyEnvOverrideUint(
+        "SUPABASE_STORAGE_ANALYTICS_MAX_NAMESPACES",
+        "storage.analytics.max_namespaces",
+        config.storage.analytics.max_namespaces,
+        projectEnvValues,
+      ),
+    );
+    yield* wrapConfigOverride("storage.analytics.max_tables", () =>
+      legacyEnvOverrideUint(
+        "SUPABASE_STORAGE_ANALYTICS_MAX_TABLES",
+        "storage.analytics.max_tables",
+        config.storage.analytics.max_tables,
+        projectEnvValues,
+      ),
+    );
+    yield* wrapConfigOverride("storage.analytics.max_catalogs", () =>
+      legacyEnvOverrideUint(
+        "SUPABASE_STORAGE_ANALYTICS_MAX_CATALOGS",
+        "storage.analytics.max_catalogs",
+        config.storage.analytics.max_catalogs,
+        projectEnvValues,
+      ),
+    );
+    yield* wrapConfigOverride("storage.vector.max_buckets", () =>
+      legacyEnvOverrideUint(
+        "SUPABASE_STORAGE_VECTOR_MAX_BUCKETS",
+        "storage.vector.max_buckets",
+        config.storage.vector.max_buckets,
+        projectEnvValues,
+      ),
+    );
+    yield* wrapConfigOverride("storage.vector.max_indexes", () =>
+      legacyEnvOverrideUint(
+        "SUPABASE_STORAGE_VECTOR_MAX_INDEXES",
+        "storage.vector.max_indexes",
+        config.storage.vector.max_indexes,
+        projectEnvValues,
+      ),
+    );
+
+    // Same gap for `api.schemas`/`api.extra_search_path`/`api.max_rows` — both
+    // PostgREST's own container AND Studio's copy of the same PGRST_DB_* env
+    // must see the same already-overridden values (Go's
+    // `internal/start/start.go:968-970,1335-1337`, both reading the single
+    // `utils.Config.Api.{Schemas,ExtraSearchPath,MaxRows}`). The two array
+    // fields use the same comma-split-override pattern as
+    // `auth.additional_redirect_urls`/`auth.webauthn.rp_origins` above.
+    const apiSchemasOverride = legacyEnvOverride(
+      "SUPABASE_API_SCHEMAS",
+      undefined,
+      projectEnvValues,
+    );
+    const apiSchemas =
+      apiSchemasOverride !== undefined ? apiSchemasOverride.split(",") : config.api.schemas;
+    const apiExtraSearchPathOverride = legacyEnvOverride(
+      "SUPABASE_API_EXTRA_SEARCH_PATH",
+      undefined,
+      projectEnvValues,
+    );
+    const apiExtraSearchPath =
+      apiExtraSearchPathOverride !== undefined
+        ? apiExtraSearchPathOverride.split(",")
+        : config.api.extra_search_path;
+    const apiMaxRows = yield* wrapConfigOverride("api.max_rows", () =>
+      legacyEnvOverrideApiMaxRows(config.api.max_rows, projectEnvValues),
+    );
+
+    // Same gap for Mailpit's three ports — Go's Config.Load applies
+    // SUPABASE_LOCAL_SMTP_PORT/_SMTP_PORT/_POP3_PORT generically
+    // (pkg/config/config.go:580-586) before internal/start/start.go:853-867
+    // reads utils.Config.Inbucket.{Port,SmtpPort,Pop3Port} to build Mailpit's
+    // port bindings. `smtp_port`/`pop3_port` have no TOML default (Go's
+    // zero-value uint16), matching mailpit.service.ts's own `!== 0` publish
+    // guard, so `?? 0` here preserves that "unconfigured" signal.
+    const mailpitPort = yield* wrapConfigOverride("local_smtp.port", () =>
+      legacyEnvOverridePort(
+        "SUPABASE_LOCAL_SMTP_PORT",
+        config.local_smtp.port,
+        "local_smtp.port",
+        projectEnvValues,
+      ),
+    );
+    const mailpitSmtpPort = yield* wrapConfigOverride("local_smtp.smtp_port", () =>
+      legacyEnvOverridePort(
+        "SUPABASE_LOCAL_SMTP_SMTP_PORT",
+        config.local_smtp.smtp_port ?? 0,
+        "local_smtp.smtp_port",
+        projectEnvValues,
+      ),
+    );
+    const mailpitPop3Port = yield* wrapConfigOverride("local_smtp.pop3_port", () =>
+      legacyEnvOverridePort(
+        "SUPABASE_LOCAL_SMTP_POP3_PORT",
+        config.local_smtp.pop3_port ?? 0,
+        "local_smtp.pop3_port",
+        projectEnvValues,
+      ),
+    );
+
+    // Same gap for Logflare's port — Go's Config.Load applies
+    // SUPABASE_ANALYTICS_PORT generically (pkg/config/config.go:582-586)
+    // before start.go:378 reads utils.Config.Analytics.Port to build
+    // Logflare's HostPort.
+    const analyticsPort = yield* wrapConfigOverride("analytics.port", () =>
+      legacyEnvOverridePort(
+        "SUPABASE_ANALYTICS_PORT",
+        config.analytics.port,
+        "analytics.port",
+        projectEnvValues,
+      ),
+    );
+    // Same gap for Logflare's deprecated Vector port — Go's Config.Load decodes
+    // `analytics.vector_port` (a `uint16`, "Deprecated together with syslog") unconditionally in
+    // the same pass as `analytics.port` above; nothing downstream in `start` reads the resolved
+    // value, but a malformed override must still fail before any Docker work, matching Go.
+    // Result discarded — no native code path consumes it.
+    yield* wrapConfigOverride("analytics.vector_port", () =>
+      legacyEnvOverridePort(
+        "SUPABASE_ANALYTICS_VECTOR_PORT",
+        config.analytics.vector_port ?? 0,
+        "analytics.vector_port",
+        projectEnvValues,
+      ),
+    );
+
+    // Same gap for Supavisor's pooler fields — Go's Config.Load applies
+    // SUPABASE_DB_POOLER_* generically (pkg/config/config.go:580-586) before
+    // start.go:1194-1211 reads utils.Config.Db.Pooler.{Port,PoolMode,
+    // DefaultPoolSize,MaxClientConn}; PoolMode specifically decides the
+    // published host port (5432 session vs 6543 transaction). All four throw
+    // synchronously on a malformed override — wrapped via `wrapConfigOverride` so a bad
+    // value fails as a typed `LegacyStartInvalidConfigError` (matching Go's
+    // `Config.Load` rejecting it before any Docker work) instead of an
+    // untyped Effect defect bypassing `withJsonErrorHandling`'s `Effect.catch`
+    // (see `wrapConfigOverride`'s doc comment) — same bug class already fixed
+    // for `dbHealthTimeoutSeconds`/`db.settings`/the Edge Runtime
+    // `policy`/`inspector_port` overrides elsewhere in this function.
+    const poolerPort = yield* wrapConfigOverride("db.pooler.port", () =>
+      legacyEnvOverridePort(
+        "SUPABASE_DB_POOLER_PORT",
+        config.db.pooler.port,
+        "db.pooler.port",
+        projectEnvValues,
+      ),
+    );
+    const poolMode = yield* wrapConfigOverride("db.pooler.pool_mode", () =>
+      legacyEnvOverridePoolMode(config.db.pooler.pool_mode, projectEnvValues),
+    );
+    const poolerDefaultPoolSize = yield* wrapConfigOverride("db.pooler.default_pool_size", () =>
+      legacyEnvOverrideDefaultPoolSize(config.db.pooler.default_pool_size, projectEnvValues),
+    );
+    const poolerMaxClientConn = yield* wrapConfigOverride("db.pooler.max_client_conn", () =>
+      legacyEnvOverrideMaxClientConn(config.db.pooler.max_client_conn, projectEnvValues),
+    );
+
+    // Overridden by SUPABASE_DB_HEALTH_TIMEOUT — Go's Config.Load binds this
+    // generically before StartDatabase's health wait reads it
+    // (pkg/config/config.go:580-586, internal/db/start/start.go:180). Resolved
+    // here, before any Docker work, rather than inside `bringUp` right before the
+    // health wait: Go's `mapstructure.StringToTimeDurationHookFunc()` decodes this
+    // in the same unconditional `Config.Load` pass as every other field
+    // (`pkg/config/config.go:749-756,777`), which runs before `start.Run` touches
+    // Docker at all (`internal/start/start.go:51,73`) — a malformed value must
+    // fail before network/image/Postgres work, not after Postgres's own container
+    // has already been created and started.
+    const dbHealthTimeout = legacyEnvOverride(
+      "SUPABASE_DB_HEALTH_TIMEOUT",
+      config.db.health_timeout,
+      projectEnvValues,
+    );
+    const dbHealthTimeoutSeconds = yield* Effect.try({
+      try: () => resolveDbHealthTimeoutSeconds(dbHealthTimeout ?? config.db.health_timeout),
+      catch: (cause) =>
+        new LegacyStartInvalidConfigError({
+          message: `failed to parse config: ${cause instanceof Error ? cause.message : String(cause)}`,
+        }),
+    });
+
+    // Same bug class as `dbHealthTimeoutSeconds` above: Go decodes `edge_runtime.policy`
+    // (an enum via `UnmarshalText`) and `edge_runtime.inspector_port` (a plain `uint`) during
+    // the same unconditional `Config.Load` pass (`pkg/config/config.go:749-756,777`), before
+    // `start.Run` touches Docker — regardless of `--exclude edge-runtime`. The Edge Runtime
+    // branch below re-resolves both against `resolvedEdgeRuntime`'s env-interpolated subtree
+    // for the real container build; this eager call only needs the raw `config.edge_runtime`
+    // value to prove it parses.
+    const edgeRuntimePolicy = yield* wrapConfigOverride("edge_runtime.policy", () =>
+      legacyEnvOverrideEdgeRuntimePolicy(config.edge_runtime.policy, projectEnvValues),
+    );
+    const edgeRuntimeInspectorPort = yield* wrapConfigOverride("edge_runtime.inspector_port", () =>
+      legacyEnvOverridePort(
+        "SUPABASE_EDGE_RUNTIME_INSPECTOR_PORT",
+        config.edge_runtime.inspector_port,
+        "edge_runtime.inspector_port",
+        projectEnvValues,
+      ),
+    );
+
+    /**
+     * Every case returns `{ spec, excludeFromHealthWatch? }`: `spec` is the
+     * {@link LegacyStartContainerSpec} to bring up; `excludeFromHealthWatch`
+     * (only ever set by "vector") is returned explicitly instead of a captured
+     * mutable variable — Go's Vector `parsed.Scheme != "npipe"` exception
+     * (`start.go:481`) is the only case that ever sets it.
+     */
+    const buildSpecForService = Effect.fnUntraced(function* (service: string, image: string) {
+      switch (service) {
+        case "logflare":
+          return {
+            spec: legacyBuildLogflareContainerSpec({
+              image,
+              projectId,
+              networkId,
+              port: analyticsPort,
+              backend: values.analyticsBackend,
+              gcpProjectId: values.gcpProjectId,
+              gcpProjectNumber: values.gcpProjectNumber,
+              gcpJwtPath: values.gcpJwtPath,
+              workdir: cliConfig.workdir,
+              dbHost,
+              dbPort: LEGACY_START_INTERNAL_DB_PORT,
+              dbUser: "postgres",
+              dbPassword,
+            }),
+          };
+
+        case "vector": {
+          const daemonHost = yield* legacyResolveDockerDaemonHost(spawner);
+          const dockerSocketPlan = legacyResolveVectorDockerSocketPlan(daemonHost);
+          // Go's Windows-only warning (`start.go:428-429`) — gated on text
+          // mode for the same reason as every other supplementary line here.
+          if (dockerSocketPlan.isNpipe && output.format === "text") {
+            yield* output.raw(
+              `${legacyYellow("WARNING:")} Analytics on Windows requires Docker daemon exposed on tcp://localhost:2375.\n` +
+                "See https://supabase.com/docs/guides/local-development/cli/getting-started?queryGroups=platform&platform=windows#running-supabase-locally for more details.\n",
+              "stderr",
+            );
+          }
+          return {
+            spec: legacyBuildVectorContainerSpec({
+              image,
+              containerName: vectorContainerName,
+              networkId,
+              apiKey: LEGACY_ANALYTICS_API_KEY,
+              logflareId: logflareContainerName,
+              kongId: kongContainerName,
+              gotrueId: gotrueContainerName,
+              restId: restContainerName,
+              realtimeId: realtimeContainerName,
+              storageId: storageContainerName,
+              edgeRuntimeId: edgeRuntimeContainerName,
+              dbId: dbContainerId,
+              dockerSocketPlan,
+            }),
+            // Go's Vector `parsed.Scheme != "npipe"` exception (`start.go:481`):
+            // still created/started, just never added to the health-wait watch list.
+            excludeFromHealthWatch: dockerSocketPlan.isNpipe,
+          };
+        }
+
+        case "kong": {
+          // Go's `NewConfig` seeds `Api.Tls.{CertContent,KeyContent}`
+          // unconditionally from the embedded default cert/key
+          // (`pkg/config/config.go:452-455`); `Validate` only overwrites them
+          // from disk when API itself is enabled, TLS is enabled, AND both
+          // `cert_path`/`key_path` are set (`config.go:1006-1027` — the whole
+          // disk-read branch is nested inside `if c.Api.Enabled`). So a
+          // `[api.tls] enabled = true` project with no custom paths still
+          // gets a real cert/key here — never empty strings — matching
+          // Kong's own unconditional write of these fields to
+          // `/home/kong/localhost.{crt,key}` (`start.go:585-601`).
+          let tlsCertContent: string = LEGACY_KONG_LOCAL_TLS_CERT;
+          let tlsKeyContent: string = LEGACY_KONG_LOCAL_TLS_KEY;
+          if (
+            apiEnabled &&
+            apiTlsEnabled &&
+            apiTlsCertPath !== undefined &&
+            apiTlsCertPath.length > 0 &&
+            apiTlsKeyPath !== undefined &&
+            apiTlsKeyPath.length > 0
+          ) {
+            tlsCertContent = yield* fs
+              .readFileString(legacyResolveApiTlsPath(cliConfig.workdir, apiTlsCertPath))
+              .pipe(
+                Effect.mapError(
+                  (cause) =>
+                    new LegacyStartInvalidConfigError({
+                      message: `failed to read api tls cert: ${String(cause)}`,
+                    }),
+                ),
+              );
+            tlsKeyContent = yield* fs
+              .readFileString(legacyResolveApiTlsPath(cliConfig.workdir, apiTlsKeyPath))
+              .pipe(
+                Effect.mapError(
+                  (cause) =>
+                    new LegacyStartInvalidConfigError({
+                      message: `failed to read api tls key: ${String(cause)}`,
+                    }),
+                ),
+              );
+          }
+          return {
+            spec: legacyBuildKongContainerSpec({
+              image,
+              containerName: kongContainerName,
+              networkId,
+              apiHost: context.hostname,
+              apiPort: values.apiPort,
+              apiTlsEnabled,
+              tlsCertContent,
+              tlsKeyContent,
+              apiKeys: {
+                secretKey: values.secretKey,
+                serviceRoleKey: values.serviceRoleKey,
+                publishableKey: values.publishableKey,
+                anonKey: values.anonKey,
+              },
+              gotrueId: gotrueContainerName,
+              restId: restContainerName,
+              realtimeTenantId: LEGACY_REALTIME_TENANT_ID,
+              storageId: storageContainerName,
+              studioId: studioContainerName,
+              pgmetaId: pgMetaContainerName,
+              edgeRuntimeId: edgeRuntimeContainerName,
+              logflareId: logflareContainerName,
+              poolerId: poolerContainerName,
+              nginxWorkerProcesses: legacyResolveKongNginxWorkerProcesses(projectEnvValues),
+              workdir: cliConfig.workdir,
+              emailTemplateMounts: buildKongEmailTemplateMounts(resolvedEmail, cliConfig.workdir),
+            }),
+          };
+        }
+
+        case "gotrue":
+          return {
+            spec: legacyBuildGotrueContainerSpec({
+              image,
+              projectId,
+              networkId,
+              dbUrl: values.dbUrl,
+              env: resolveGotrueEnvInput({
+                context,
+                values,
+                workdir: cliConfig.workdir,
+                kongContainerName,
+                mailpitContainerName,
+                resolvedEmail,
+              }),
+            }),
+          };
+
+        case "mailpit":
+          return {
+            spec: legacyBuildMailpitContainerSpec({
+              image,
+              projectId,
+              networkId,
+              port: mailpitPort,
+              smtpPort: mailpitSmtpPort,
+              pop3Port: mailpitPop3Port,
+            }),
+          };
+
+        case "realtime":
+          return {
+            spec: legacyBuildRealtimeContainerSpec({
+              projectId,
+              networkId,
+              image,
+              ipVersion: realtimeIpVersion,
+              maxHeaderLength: realtimeMaxHeaderLength,
+              dbUrl: values.dbUrl,
+              jwtSecret: values.jwtSecret,
+              jwks,
+            }),
+          };
+
+        case "postgrest":
+          return {
+            spec: legacyBuildPostgrestContainerSpec({
+              projectId,
+              networkId,
+              image,
+              schemas: apiSchemas,
+              extraSearchPath: apiExtraSearchPath,
+              maxRows: apiMaxRows,
+              dbUrl: values.dbUrl,
+              jwks,
+            }),
+          };
+
+        case "storage":
+          return {
+            spec: legacyBuildStorageContainerSpec({
+              projectId,
+              networkId,
+              image,
+              targetMigration: storageTargetMigration,
+              fileSizeLimit: storageFileSizeLimit,
+              s3Region: values.storageS3Region,
+              s3AccessKeyId: values.storageS3AccessKeyId,
+              s3SecretAccessKey: values.storageS3SecretAccessKey,
+              s3ProtocolEnabled: storageS3ProtocolEnabled,
+              imageTransformationEnabled: gates.imgproxy,
+              vectorBucketsEnabled: storageVectorEnabled,
+              dbUrl: values.dbUrl,
+              jwtSecret: values.jwtSecret,
+              jwks,
+              anonKey: values.anonKey,
+              serviceRoleKey: values.serviceRoleKey,
+              projectEnvValues,
+            }),
+          };
+
+        case "imgproxy":
+          return { spec: legacyBuildImgproxyContainerSpec({ projectId, networkId, image }) };
+
+        case "pgMeta":
+          return {
+            spec: legacyBuildPgMetaContainerSpec({
+              image,
+              containerName: pgMetaContainerName,
+              dbHost,
+              dbPort: LEGACY_START_INTERNAL_DB_PORT,
+              dbUser: "postgres",
+              dbPassword,
+              dbName: LEGACY_START_INTERNAL_DB_NAME,
+              networkId,
+            }),
+          };
+
+        case "studio": {
+          // Go's `start.go:1149-1159` computes Studio's function bind mounts
+          // via `serve.PopulatePerFunctionConfigs` unconditionally whenever
+          // Studio is enabled — NOT gated on `Config.EdgeRuntime.Enabled` —
+          // so function sources/import maps/static assets stay mounted for
+          // Studio's local function management even when Edge Runtime itself
+          // is disabled or excluded.
+          const functionBinds = yield* resolveFunctionBindMounts(
+            projectId,
+            cliConfig.workdir,
+            `${cliConfig.workdir}/supabase`,
+            { configDeclaredFunctions, configFunctions, rawConfigFunctions },
+            Option.none(),
+            Option.none(),
+            cliConfig.workdir,
+          );
+          return {
+            spec: legacyBuildStudioContainerSpec({
+              image,
+              containerName: studioContainerName,
+              networkId,
+              port: values.studioPort,
+              functionBinds: [...functionBinds],
+              env: {
+                dbPassword,
+                workdir: cliConfig.workdir,
+                cliVersion: CLI_VERSION,
+                pgMetaContainerName,
+                kongContainerName,
+                logflareContainerName,
+                studioApiUrl: legacyResolveStudioApiUrl(
+                  legacyEnvOverride(
+                    "SUPABASE_STUDIO_API_URL",
+                    config.studio.api_url,
+                    projectEnvValues,
+                  ) ?? config.studio.api_url,
+                  context.hostname,
+                  values.apiUrl,
+                ),
+                jwtSecret: values.jwtSecret,
+                anonKey: values.anonKey,
+                serviceRoleKey: values.serviceRoleKey,
+                publishableKey: values.publishableKey,
+                secretKey: values.secretKey,
+                s3AccessKeyId: values.storageS3AccessKeyId,
+                s3SecretAccessKey: values.storageS3SecretAccessKey,
+                openaiApiKey: values.openaiApiKey,
+                apiSchemas: apiSchemas,
+                apiExtraSearchPath: apiExtraSearchPath,
+                apiMaxRows: apiMaxRows,
+                analyticsEnabled: values.analyticsEnabled,
+                analyticsBackend: values.analyticsBackend,
+              },
+            }),
+          };
+        }
+
+        case "supavisor":
+          return {
+            spec: legacyBuildSupavisorContainerSpec({
+              image,
+              projectId,
+              networkId,
+              port: poolerPort,
+              poolMode,
+              defaultPoolSize: poolerDefaultPoolSize,
+              maxClientConn: poolerMaxClientConn,
+              jwtSecret: values.jwtSecret,
+              dbHost,
+              dbPort: LEGACY_START_INTERNAL_DB_PORT,
+              dbUser: "postgres",
+              dbPassword,
+              dbDatabase: LEGACY_START_INTERNAL_DB_NAME,
+            }),
+          };
+
+        default:
+          return yield* Effect.die(`legacyStart: unrecognized service "${service}"`);
+      }
+    });
+
+    // Go's real, package-level `utils.NoBackupVolume` global (`docker.go:94`):
+    // set once, inside `StartDatabase`'s pre-create volume-existence check
+    // (`internal/db/start/start.go:165-167`), then read much later by
+    // `DockerRemoveAll` on a rollback (`docker.go:126`). A plain outer `let`
+    // is this port's equivalent of that mutable global — unlike
+    // `excludeFromHealthWatch` (returned explicitly from `buildSpecForService`
+    // because a clean return-value alternative existed there), `isFreshVolume`
+    // must survive PAST `bringUp`'s own failure path (`Effect.onError` below,
+    // which runs on ANY failure — including a defect or interrupt — and has no
+    // access to a value `bringUp` only returns on success) — there is no
+    // non-mutable way to thread a value computed mid-effect into a sibling
+    // failure handler.
+    let isFreshVolume = false;
+
+    // 8. Bring-up: network -> Postgres (+ its own health wait, GATED on
+    // `--ignore-health-check` exactly like every other service's wait below —
+    // Go's `Run()` checks `ignoreHealthCheck && IsUnhealthyError(err)` against
+    // whatever `run()` returns AS A WHOLE (`start.go:73-81`), and `run()`
+    // propagates `StartDatabase`'s error immediately (`start.go:294-298` ->
+    // `db/start/start.go:180`), before "Starting containers..." even prints —
+    // there is no Postgres-specific carve-out anywhere in Go) -> the
+    // fresh-volume-gated `SetupLocalDatabase` equivalent (`db/start/
+    // start.go:184-188`, BEFORE any other service starts) -> the 12 remaining
+    // enabled+non-excluded services plus Edge Runtime, in Go's real start
+    // order (`start.gates.ts`'s `imagePlan` + `edgeRuntime`). Any OTHER
+    // failure in this whole phase (including a NON-ignored Postgres timeout)
+    // rolls back and fails the command outright (Go's per-block `if err !=
+    // nil { return err }`, propagated to `Run`'s rollback branch, `start.go:
+    // 73-81`). An IGNORED Postgres timeout instead short-circuits to `{ kind:
+    // "postgresUnhealthyIgnored" }` below — skipping every later step in this
+    // phase, and the bulk health check/bucket seeding/`cli_stack_started`
+    // capture after it — while still letting the command reach the final
+    // "Started..." tail, matching Go's `Run()`, which prints the warning and
+    // falls through to that SAME unconditional tail (`start.go:74-87`) rather
+    // than returning early from the whole command.
+    const bringUp = Effect.gen(function* () {
+      yield* legacyEnsureStartNetwork(spawner, networkId, {
+        [LEGACY_CLI_PROJECT_LABEL]: projectId,
+        [LEGACY_COMPOSE_PROJECT_LABEL]: projectId,
+      });
+
+      // Go's pre-create volume-existence check (`internal/db/start/start.go:
+      // 165-167`) — MUST run before Postgres's own volume gets created by
+      // `legacyStartContainer` below: `docker volume create` is idempotent, so
+      // creating first would make "did this volume already exist" unobservable.
+      isFreshVolume = !(yield* legacyStartVolumeExists(spawner, dbContainerId));
+      if (output.format === "text") {
+        yield* output.raw(
+          isFreshVolume
+            ? LEGACY_START_STARTING_DATABASE_MESSAGE
+            : LEGACY_START_STARTING_DATABASE_FROM_BACKUP_MESSAGE,
+          "stderr",
+        );
+      }
+
+      const postgresSpec = legacyBuildPostgresStartContainerSpec({
+        // `port` overridden by SUPABASE_DB_PORT (Go's NewHostConfig binds the
+        // published port straight from the already-overridden
+        // utils.Config.Db.Port, apps/cli-go/internal/db/start/start.go:119-121).
+        // `settings` overridden by any `SUPABASE_DB_SETTINGS_*` field (Go's
+        // `(a *settings) ToPostgresConfig()` serializes the same
+        // already-overridden global `Config.Db.Settings`, `pkg/config/db.go:181-190`).
+        db: {
+          ...config.db,
+          port: values.dbPort,
+          major_version: majorVersion,
+          settings: legacyResolveDbSettingsEnvOverrides(config.db.settings, projectEnvValues),
+        },
+        // `orioledb_version` overridden by SUPABASE_EXPERIMENTAL_ORIOLEDB_VERSION,
+        // matching the value already used to select `postgresImage` above —
+        // `legacyPostgresExtraEnv` reads this same field, and its four sibling
+        // S3 fields, for its S3/`POSTGRES_INITDB_ARGS` branch.
+        experimental: {
+          ...config.experimental,
+          orioledb_version: orioledbVersion,
+          s3_host: s3Host,
+          s3_region: s3Region,
+          s3_access_key: s3AccessKey,
+          s3_secret_key: s3SecretKey,
+        },
+        jwtSecret: values.jwtSecret,
+        // Overridden by SUPABASE_AUTH_JWT_EXPIRY — Postgres's JWT_EXP (seeding
+        // app.settings.jwt_exp) and GoTrue's GOTRUE_JWT_EXP both read the same
+        // already-overridden utils.Config.Auth.JwtExpiry in Go
+        // (internal/db/start/start.go:68, internal/start/start.go:1372); using
+        // the raw config value here would let Postgres and GoTrue disagree.
+        jwtExpiry: values.authJwtExpiry,
+        projectId,
+        networkId,
+        image: resolveImage(postgresImage),
+        configImage: postgresImage,
+        rootKey: values.rootKey,
+      });
+      const postgresContainerId = yield* legacyStartContainer(spawner, postgresSpec, startOpts);
+      // `dbHealthTimeoutSeconds` is resolved eagerly, before any Docker work — see its
+      // definition above, alongside the other eagerly-validated config-override fields.
+      const postgresHealthResult = yield* legacyWaitForHealthyServices(
+        spawner,
+        [postgresContainerId],
+        { timeoutSeconds: dbHealthTimeoutSeconds },
+      ).pipe(Effect.result);
+      if (Result.isFailure(postgresHealthResult)) {
+        const error = postgresHealthResult.failure;
+        if (flags.ignoreHealthCheck && legacyIsUnhealthyStartError(error)) {
+          // Go's outer `Run()` check (`ignoreHealthCheck &&
+          // IsUnhealthyError(err)`, `start.go:74-75`) applies uniformly to
+          // whatever `run()` returns AS A WHOLE — including Postgres's own
+          // health-wait error, which `run()` propagates immediately via
+          // `StartDatabase`'s `if err != nil { return err }` (`start.go:
+          // 294-296`), before any of the steps below (fresh-volume setup,
+          // `initCurrentBranch`, every other service, the bulk health check)
+          // ever run. Downgrade to a warning and short-circuit the rest of
+          // this phase — matching Go's `Run()`, which prints the warning and
+          // falls through to the SAME unconditional tail every other path
+          // reaches (`start.go:84-87`), not an early return from the whole
+          // command.
+          yield* output.raw(`${error.message}\n`, "stderr");
+          return { kind: "postgresUnhealthyIgnored" as const };
+        }
+        return yield* Effect.fail(error);
+      }
+
+      // Go's `if utils.NoBackupVolume { SetupLocalDatabase(...) }` (`db/start/
+      // start.go:184-188`) — runs immediately after Postgres's OWN health wait,
+      // BEFORE "Starting containers..." prints and before any other service
+      // starts: `internal/start/start.go:293-298` calls `StartDatabase` (which
+      // performs this whole sequence internally) before any other service's own
+      // `if` block even runs.
+      if (isFreshVolume) {
+        yield* Effect.scoped(
+          Effect.gen(function* () {
+            const session = yield* dbConnection.connect(
+              {
+                host: context.hostname,
+                port: values.dbPort,
+                user: "postgres",
+                password: dbPassword,
+                database: "postgres",
+              },
+              { isLocal: true, dnsResolver: "native" },
+            );
+            // Go's one-shot fresh-DB setup jobs (`initSchema15`) use the SAME
+            // already-pin-rewritten `utils.Config.{Realtime,Storage,Auth}.Image`
+            // fields the long-running containers use (`internal/db/start/
+            // start.go:270,299,321`), regardless of `--exclude` — resolve through
+            // `legacyResolvePinnedImage` (not the raw Dockerfile default) so a
+            // linked project's version pins apply here too. Resolved HERE, inside
+            // this `isFreshVolume` block and additionally gated on `majorVersion
+            // >= 15` (this schema-init path is PG15+-only, `db-setup.ts`'s own
+            // `majorVersion <= 14` branch never reads `images`) — NOT pre-pulled
+            // unconditionally up front, matching Go's own `ensureImagesCached`
+            // (`start.go:237-262`), which only pre-pulls non-excluded services;
+            // these images are resolved lazily inside `initSchema15` itself
+            // (`DockerStart` -> `DockerResolveImageIfNotCached`,
+            // `internal/utils/docker.go:363-365`), only when the job genuinely
+            // runs. Still resolved through the SAME `projectEnvValues`-aware
+            // `legacyEnsureImagesCached` used above (not the raw image string) so
+            // a project-dotenv-only `SUPABASE_INTERNAL_IMAGE_REGISTRY` override
+            // still applies whenever the job WILL run.
+            const rawSetupJobImages = {
+              realtime: legacyResolvePinnedImage("realtime", "realtime", serviceVersionOverrides),
+              storage: legacyResolvePinnedImage("storage", "storage", serviceVersionOverrides),
+              auth: legacyResolvePinnedImage("gotrue", "auth", serviceVersionOverrides),
+            };
+            const setupJobImagesToResolve =
+              majorVersion >= 15
+                ? [
+                    ...(realtimeEnabledForSetup ? [rawSetupJobImages.realtime] : []),
+                    ...(storageEnabledForSetup ? [rawSetupJobImages.storage] : []),
+                    ...(authEnabledForSetup ? [rawSetupJobImages.auth] : []),
+                  ]
+                : [];
+            const resolvedSetupJobImages =
+              setupJobImagesToResolve.length > 0
+                ? yield* legacyEnsureImagesCached(
+                    spawner,
+                    setupJobImagesToResolve,
+                    projectEnvValues,
+                  )
+                : new Map<string, string>();
+            const resolveSetupJobImage = (image: string) =>
+              resolvedSetupJobImages.get(image) ?? image;
+            const dbSetupImages: LegacyStartDbSetupImages = {
+              realtime: resolveSetupJobImage(rawSetupJobImages.realtime),
+              storage: resolveSetupJobImage(rawSetupJobImages.storage),
+              auth: resolveSetupJobImage(rawSetupJobImages.auth),
+            };
+            yield* legacyStartSetupLocalDatabase({
+              session,
+              fs,
+              path,
+              workdir: cliConfig.workdir,
+              // Go's `initSchema15`'s per-job gates read `utils.Config.
+              // {Realtime,Storage,Auth}.Enabled` — the EFFECTIVE, env-overridden
+              // value (Viper's `AutomaticEnv` already folds any `SUPABASE_*_
+              // ENABLED` override into the single global `Config`), NOT
+              // additionally filtered by `--exclude` the way `gates.*` is (Go's
+              // one-shot migration jobs run regardless of `--exclude` — they're
+              // part of `StartDatabase`, which finishes before `run()`'s own
+              // excluded-services filtering even begins). Reuses
+              // `{realtime,storage,auth}EnabledForSetup`, hoisted above (also
+              // needed by `setupJobImages`) instead of recomputing them here.
+              config: {
+                ...config,
+                realtime: {
+                  ...config.realtime,
+                  enabled: realtimeEnabledForSetup,
+                  ip_version: realtimeIpVersion,
+                  max_header_length: realtimeMaxHeaderLength,
+                },
+                storage: {
+                  ...config.storage,
+                  enabled: storageEnabledForSetup,
+                  file_size_limit: storageFileSizeLimit,
+                },
+                auth: {
+                  ...config.auth,
+                  enabled: authEnabledForSetup,
+                },
+              },
+              majorVersion,
+              projectId,
+              networkId,
+              dbUrl: values.dbUrl,
+              jwtSecret: values.jwtSecret,
+              jwks,
+              apiUrl: values.apiUrl,
+              authExternalUrl: resolveAuthExternalUrl(context.loaded?.document, projectEnvValues),
+              siteUrl: values.authSiteUrl,
+              anonKey: values.anonKey,
+              serviceRoleKey: values.serviceRoleKey,
+              storageTargetMigration,
+              images: dbSetupImages,
+            });
+          }),
+        );
+      }
+
+      // Go's `initCurrentBranch` (`db/start/start.go:189`) runs on every start
+      // regardless of `isFreshVolume` — unlike `SetupLocalDatabase`, which only
+      // runs on a fresh volume. Moved out of `legacyStartSetupLocalDatabase` (see
+      // that module's own comment) so it isn't accidentally skipped on a restart.
+      yield* legacyStartInitCurrentBranch(fs, path, cliConfig.workdir);
+
+      if (output.format === "text") {
+        yield* output.raw(LEGACY_START_STARTING_CONTAINERS_MESSAGE, "stderr");
+      }
+
+      const started: Array<string> = [];
+      let postgrestGateway: LegacyHealthCheckPostgrestGateway | undefined;
+      let edgeRuntimeGateway: LegacyHealthCheckPostgrestGateway | undefined;
+      let storageContainerId: string | undefined;
+      const imagePlanByService = new Map(imagePlan.map((entry) => [entry.service, entry.image]));
+      for (const entry of LEGACY_START_SERVICES) {
+        if (entry.service === "postgres") continue;
+
+        // Edge Runtime doesn't go through `imagePlan`/`buildSpecForService` —
+        // see `start.gates.ts`'s header — so it's special-cased here, in Go's
+        // real relative position (between ImgProxy and pg-meta).
+        if (entry.service === "edgeRuntime") {
+          if (!gates.edgeRuntime || edgeRuntimeDefaultImage === undefined) continue;
+          const debug = yield* LegacyDebugFlag;
+          // `config.edge_runtime.secrets` is still schema-decoded plain
+          // strings here — `toPlainEdgeRuntimeConfig` only emits entries
+          // whose values are `Redacted` (`shared/functions/serve.ts`), and a
+          // value only becomes `Redacted` after `resolveProjectSubtree`'s
+          // env-interpolation + secret-path-redaction pass. Without this step
+          // every configured `[edge_runtime.secrets]` entry is silently
+          // dropped — `functions serve`'s own call site already resolves the
+          // subtree first (`shared/functions/serve.ts:603-610`) before
+          // calling the same helper.
+          const resolvedEdgeRuntime = yield* resolveProjectSubtree(
+            config.edge_runtime,
+            { values: projectEnvValues ?? {} },
+            "edge_runtime",
+            { goViperCompat: true },
+          );
+          // Go's `DecryptSecretHookFunc` decode hook decrypts every `config.Secret`-typed field
+          // (including `edge_runtime.secrets`) unconditionally during `Config.Load`, so the real
+          // Edge Runtime container always receives plaintext. `toPlainEdgeRuntimeConfig` only
+          // does `env()` interpolation and `Redacted`-unwrapping — it never decrypts a dotenvx
+          // `encrypted:` value — so without this step the literal ciphertext would reach the
+          // container's env file. `legacyCheckDbToml` (called unconditionally, before any Docker
+          // work) already validates every `edge_runtime.secrets.*` entry is decryptable via
+          // `legacyAssertDecryptableSecrets`, but only for that validation's own side effect — the
+          // decrypted plaintext is discarded there, not threaded back into this value.
+          const rawEdgeRuntimeSecrets = toPlainEdgeRuntimeConfig(resolvedEdgeRuntime).secrets;
+          const dotenvPrivateKeys = legacyCollectDotenvPrivateKeys({
+            ...projectEnvValues,
+            ...process.env,
+          });
+          const edgeRuntimeSecrets: Record<string, string> = {};
+          for (const [secretName, secretValue] of Object.entries(rawEdgeRuntimeSecrets)) {
+            if (!legacyIsEncryptedSecret(secretValue)) {
+              edgeRuntimeSecrets[secretName] = secretValue;
+              continue;
+            }
+            const decrypted = legacyDecryptSecret(secretValue, dotenvPrivateKeys);
+            if (!decrypted.ok) {
+              return yield* Effect.fail(
+                new LegacyStartInvalidConfigError({
+                  message: `failed to parse config: ${decrypted.error}`,
+                }),
+              );
+            }
+            edgeRuntimeSecrets[secretName] = decrypted.value;
+          }
+          // `edgeRuntimePolicy`/`edgeRuntimeInspectorPort` are resolved eagerly, before any
+          // Docker work — see their hoisted `wrapConfigOverride` calls next to
+          // `dbHealthTimeoutSeconds` above.
+          const edgeRuntimeInput: LegacyEdgeRuntimeBringUpInput = {
+            projectId,
+            networkId,
+            image: resolveImage(edgeRuntimeDefaultImage),
+            workdir: cliConfig.workdir,
+            dbUrl: values.dbUrl,
+            apiPort: values.apiPort,
+            edgeRuntimePolicy,
+            edgeRuntimeInspectorPort,
+            edgeRuntimeSecrets,
+            configDeclaredFunctions,
+            configFunctions,
+            rawConfigFunctions,
+            authArtifacts: {
+              publishableKey: values.publishableKey,
+              secretKey: values.secretKey,
+              jwtSecret: values.jwtSecret,
+              anonKey: values.anonKey,
+              serviceRoleKey: values.serviceRoleKey,
+              jwks,
+            },
+            debug,
+            platform: runtimeInfo.platform,
+          };
+          const runtime: StartedRuntime = yield* legacyStartEdgeRuntimeContainer(edgeRuntimeInput);
+          // Deliberately NOT calling `runtime.cleanup` here — see
+          // `edge-runtime.service.ts`'s header for why. Unlike every other
+          // service built here (`legacyStartContainer`'s `restartPolicy:
+          // "unless-stopped"`), Go's own Edge Runtime bring-up sets no Docker
+          // restart policy at all, so this container's `docker run` matches
+          // that — but its bind-mounted host temp files must still exist for
+          // as long as the container can be reattached to; `legacyStart
+          // EdgeRuntimeContainer` already runs `cleanup` on a failed or
+          // interrupted bring-up internally, so only the success path must
+          // leave it alone.
+          started.push(runtime.containerId);
+          edgeRuntimeGateway = {
+            containerId: runtime.containerId,
+            apiExternalUrl: values.apiUrl,
+            secretKey: values.secretKey,
+          };
+          continue;
+        }
+
+        const image = imagePlanByService.get(entry.service);
+        if (image === undefined) continue;
+
+        // Several service builders do synchronous, throwing work over config.toml string fields
+        // `@supabase/config`'s schema does not itself validate as durations/sizes (GoTrue's
+        // `auth.email/sms.max_frequency`/sessions/mfa Go-duration parsing and Storage's
+        // file-size-limit parsing are now caught earlier, eagerly, before any Docker work — see
+        // the `resolvedEmail`/`storageFileSizeLimit` validation above — but this `catchDefect`
+        // stays as defense-in-depth for any other field of this shape). A malformed value would
+        // otherwise surface as an uncaught Effect defect — `Effect.onError` below still rolls back
+        // on a defect either way, but the user would see an opaque defect instead of a typed
+        // config error. `catchDefect` converts any such throw into the same typed config error
+        // every other malformed-config path in this handler already produces, matching Go's
+        // fail-at-config-decode behavior (Go's `time.Duration`/size fields fail at TOML decode,
+        // before any Docker work starts).
+        const { spec, excludeFromHealthWatch } = yield* buildSpecForService(
+          entry.service,
+          resolveImage(image),
+        ).pipe(
+          Effect.catchDefect((defect) =>
+            Effect.fail(
+              new LegacyStartInvalidConfigError({
+                message: `invalid config for ${entry.service}: ${defect instanceof Error ? defect.message : String(defect)}`,
+              }),
+            ),
+          ),
+        );
+        const containerId = yield* legacyStartContainer(spawner, spec, startOpts);
+        if (excludeFromHealthWatch !== true) {
+          started.push(containerId);
+        }
+        if (entry.service === "postgrest") {
+          postgrestGateway = {
+            containerId,
+            apiExternalUrl: values.apiUrl,
+            secretKey: values.secretKey,
+          };
+        }
+        if (entry.service === "storage") {
+          storageContainerId = containerId;
+        }
+      }
+
+      return {
+        kind: "started" as const,
+        started,
+        postgrestGateway,
+        edgeRuntimeGateway,
+        storageContainerId,
+      };
+    }).pipe(
+      // Go's `DockerRemoveAll`'s real `utils.NoBackupVolume` value
+      // (`docker.go:94,126`) — `true` only when this run's Postgres volume was
+      // freshly created (see `isFreshVolume` above), matching Go exactly: a
+      // rollback prunes volumes on a brand-new, empty first-ever `start`, but
+      // never touches a pre-existing user's data on a failed restart.
+      //
+      // `Effect.onError`, not `Effect.tapError`: Go's own `Run()` (`start.go:73-82`)
+      // rolls back on ANY non-nil error from `run()`, including `context.Canceled`
+      // from a SIGINT during bring-up (`cmd/root.go:99,155` wraps every command's
+      // context with `signal.NotifyContext`). `tapError` is built on `Cause.findError`,
+      // which only matches `Fail` reasons — a pure fiber interrupt never reaches it.
+      // `onError` fires on any failure outcome (including interruption) and its
+      // cleanup effect runs uninterruptibly, matching Go's unconditional check.
+      Effect.onError(() =>
+        legacyRollbackStart(spawner, filterValue, isFreshVolume, cliConfig.workdir),
+      ),
+    );
+
+    const bringUpResult = yield* bringUp;
+
+    // Only reached when Postgres itself became healthy (or the volume already
+    // existed) — the `postgresUnhealthyIgnored` short-circuit above skips this
+    // entire block, matching Go's `Run()`, which falls through to the tail
+    // below either way but never re-enters `run()`'s later steps once
+    // `StartDatabase` has already returned.
+    if (bringUpResult.kind === "started") {
+      const { started, postgrestGateway, edgeRuntimeGateway, storageContainerId } = bringUpResult;
+
+      // Wraps steps 9-11 below (bulk health wait, the ignore-health-check
+      // storage-only recheck-and-seed, the success-path bucket seeding, and
+      // the `cli_stack_started` capture) in the same `Effect.onError` rollback
+      // `bringUp`'s own pipe uses above. Go's `run()` keeps this entire tail in
+      // the SAME function body as bring-up (`start.go:264-1288`), and `Run()`
+      // checks `run()`'s one returned error exactly once (`start.go:73-81`) —
+      // a SIGINT/SIGTERM landing anywhere in this tail, not just during
+      // bring-up, must roll back too. Per-step manual `legacyRollbackStart`
+      // calls would miss a pure fiber interrupt between steps (see the
+      // `bringUp` pipe's doc comment for why `onError`, not `tapError`, is
+      // required), so every fail path below just fails and lets this single
+      // outer `onError` roll back.
+      yield* Effect.gen(function* () {
+        // 9. Bulk health check over every non-Postgres started container, at the
+        // generic 30s `serviceTimeout` (`start.go:161,1270-1271`).
+        if (output.format === "text") {
+          yield* output.raw(LEGACY_START_WAITING_FOR_HEALTH_CHECKS_MESSAGE, "stderr");
+        }
+        // The PostgREST/Edge Runtime readiness probes go through Kong over HTTP(S) —
+        // when `api.tls.enabled`, Kong's local cert is self-signed, so the root
+        // runtime's `HttpClient.HttpClient` (built from `FetchHttpClient.layer` over
+        // plain `fetch`) would fail TLS verification on every probe and the health
+        // check would exhaust its full timeout even though the services are
+        // actually healthy. Resolve the same local Kong CA `legacySeedBucketsRun`'s
+        // own gateway calls already trust (`projectRef: ""` never touches the
+        // network — see `legacyResolveStorageCredentials`'s local branch) and
+        // override just the underlying `FetchHttpClient.Fetch` primitive — NOT the
+        // whole `HttpClient.HttpClient` layer — so this only takes effect for a
+        // `FetchHttpClient`-backed client (production) and is a no-op against a
+        // hand-rolled `HttpClient.make(...)` mock (this file's own integration
+        // tests), which never reads `FetchHttpClient.Fetch` at all.
+        //
+        // Folds the hoisted, env-overridden `apiEnabled`/`apiPort`/`apiTlsEnabled`/
+        // `apiTlsCertPath`/`apiTlsKeyPath`/`values.apiUrl` into `config` (not the
+        // raw values) so a `SUPABASE_API_ENABLED`/`SUPABASE_API_PORT`/
+        // `SUPABASE_API_TLS_{ENABLED,CERT_PATH,KEY_PATH}`/`SUPABASE_API_EXTERNAL_URL`
+        // override that actually brought Kong up on a different port/TLS/cert/
+        // external URL also reaches every local Storage-gateway caller below —
+        // otherwise `resolveLocalBaseUrl` derives its URL from the un-overridden
+        // `config.api.{port,tls.enabled,external_url}` and points at a
+        // port/scheme/host nothing is actually listening on, and
+        // `validateLocalKongTls`'s own `opts.config.api.enabled &&
+        // opts.config.api.tls.enabled` gate (`legacy-storage-credentials.ts`)
+        // validates against a cert/key path Kong itself isn't actually serving
+        // from when `api.enabled` disagrees with the raw config (Kong's own spec
+        // uses these same resolved `apiEnabled`/`apiTlsCertPath`/`apiTlsKeyPath`
+        // locals). Also folds in the
+        // already-resolved `values.jwtSecret`/`values.serviceRoleKey` (decrypted,
+        // env/dotenv-overridden — the same values the real GoTrue/Storage containers
+        // were started with) instead of the raw `config.auth.*`
+        // `legacyResolveStorageCredentials`'s local branch would otherwise
+        // re-derive from a narrower, dotenv-blind `process.env`-only check —
+        // mirroring Go's single `utils.Config.Auth.*.Value`/`Api.ExternalUrl` read
+        // by both the container env and `newLocalClient` (`internal/storage/
+        // client/api.go:30-37`). Also folds in `storageFileSizeLimit`/
+        // `storageVectorEnabled` so `legacySeedBucketsRun` (which reads
+        // `config.storage.file_size_limit`/`config.storage.vector.enabled` to fill
+        // bucket defaults and gate vector-upsert seeding, `legacy-seed-buckets.ts`)
+        // sees the same values the real Storage container was started with, not the
+        // raw un-overridden config — mirroring Go's `internal/seed/buckets/
+        // buckets.go:54` and `pkg/config/config.go:919-920`, both reading the
+        // single `utils.Config.Storage.{FileSizeLimit,VectorBuckets.Enabled}`.
+        // Reused for both this health-check CA lookup and the two
+        // `legacySeedBucketsRun` calls below (`resolvedConfig`), so bucket
+        // seeding never independently reloads config.toml and silently drops
+        // these same overrides — mirroring Go's `buckets.Run` reading the single
+        // process-wide `utils.Config` instead of reloading.
+        const effectiveLocalStorageConfig = {
+          ...config,
+          api: {
+            ...config.api,
+            enabled: apiEnabled,
+            port: values.apiPort,
+            external_url: values.apiUrl,
+            tls: {
+              ...config.api.tls,
+              enabled: apiTlsEnabled,
+              cert_path: apiTlsCertPath,
+              key_path: apiTlsKeyPath,
+            },
+          },
+          auth: {
+            ...config.auth,
+            jwt_secret: values.jwtSecret,
+            service_role_key: values.serviceRoleKey,
+          },
+          storage: {
+            ...config.storage,
+            file_size_limit: storageFileSizeLimit,
+            vector: {
+              ...config.storage.vector,
+              enabled: storageVectorEnabled,
+            },
+          },
+        };
+        const { localKongCa } = yield* legacyResolveStorageCredentials({
+          projectRef: "",
+          config: effectiveLocalStorageConfig,
+        });
+        const healthResult = yield* legacyWaitForHealthyServices(spawner, started, {
+          postgrest: postgrestGateway,
+          edgeRuntime: edgeRuntimeGateway,
+        }).pipe(
+          Effect.result,
+          localKongCa !== undefined
+            ? Effect.provideService(FetchHttpClient.Fetch, legacyStorageGatewayFetch(localKongCa))
+            : (effect) => effect,
+        );
+        if (Result.isFailure(healthResult)) {
+          const error = healthResult.failure;
+          if (flags.ignoreHealthCheck && legacyIsUnhealthyStartError(error)) {
+            // `ignoreHealthCheck`/`IsUnhealthyError` only gates THIS wait
+            // (`start.go:1271`), not Postgres's own earlier one. Go additionally
+            // runs a narrower, storage-only recheck-and-seed here (`start.go:
+            // 1272-1277`): when it's a fresh volume and Storage was among the
+            // started containers, wait for Storage alone to become healthy, and
+            // if it does, seed buckets. A seed FAILURE there REPLACES this
+            // original health error and hard-fails (with rollback) — Go's
+            // `return seedErr` — since a plain seed error never satisfies
+            // `IsUnhealthyError` and so never gets this branch's own
+            // downgrade-to-warning treatment. A seed SUCCESS (or a storage
+            // recheck that never turns healthy) changes nothing: fall through to
+            // the same downgrade-to-warning as every other ignored-unhealthy
+            // failure.
+            if (isFreshVolume && storageContainerId !== undefined) {
+              const storageHealthResult = yield* legacyWaitForHealthyServices(spawner, [
+                storageContainerId,
+              ]).pipe(Effect.result);
+              if (Result.isSuccess(storageHealthResult)) {
+                const seedResult = yield* legacySeedBucketsRun({
+                  projectRef: "",
+                  emitSummary: false,
+                  interactive: false,
+                  yes: true,
+                  resolvedConfig: {
+                    config: effectiveLocalStorageConfig,
+                    document: context.loaded?.document,
+                  },
+                }).pipe(Effect.result);
+                if (Result.isFailure(seedResult)) {
+                  // No manual `legacyRollbackStart` here — the outer
+                  // `Effect.onError` below rolls back on this failure too.
+                  return yield* Effect.fail(seedResult.failure);
+                }
+              }
+            }
+            // Downgrade to a warning and fall through to the success path, no rollback.
+            yield* output.raw(`${error.message}\n`, "stderr");
+          } else {
+            // No manual `legacyRollbackStart` here — the outer `Effect.onError`
+            // below rolls back on this failure too.
+            return yield* Effect.fail(error);
+          }
+        }
+
+        // 10. Go's `buckets.Run(...)` storage-bucket seeding (`start.go:1281-
+        // 1286`), gated on `utils.NoBackupVolume && slices.Contains(started,
+        // utils.StorageId)` — only when the Postgres data volume was freshly
+        // created this run AND Storage actually started. Reached only on a
+        // genuine health-check SUCCESS (`Result.isSuccess`): Go's simple
+        // `buckets.Run` call sits AFTER the `if err != nil { ...; return err }`
+        // block above (`start.go:1271-1280`), so it's unreachable on the
+        // `--ignore-health-check` downgrade-to-warning fallthrough — that
+        // fallthrough still `return`s the original unhealthy error before ever
+        // reaching it (mutually exclusive with the narrower storage-only
+        // recheck-and-seed path implemented above, inside the
+        // `Result.isFailure(healthResult)` branch: that branch only runs when
+        // this one's `Result.isSuccess(healthResult)` guard is false).
+        //
+        // A seeding failure propagates as a normal command failure and still
+        // rolls back via the same outer `Effect.onError` as everything else in
+        // this tail: Go's top-level `Run()` (`start.go:73-81`) wraps `run()`'s
+        // ENTIRE body — including this tail — in the same `DockerRemoveAll`-on-
+        // error branch, and a plain seed error (unlike the health-check timeout
+        // above) never satisfies `IsUnhealthyError`, so it always takes that
+        // branch regardless of `--ignore-health-check`.
+        if (Result.isSuccess(healthResult) && isFreshVolume && storageContainerId !== undefined) {
+          yield* legacySeedBucketsRun({
+            projectRef: "",
+            emitSummary: false,
+            interactive: false,
+            yes: true,
+            resolvedConfig: {
+              config: effectiveLocalStorageConfig,
+              document: context.loaded?.document,
+            },
+          });
+        }
+
+        // 11. Success ONLY: fire `cli_stack_started` exactly once, no
+        // properties/groups, matching Go's real tail order (`start.go:1287`) —
+        // that capture sits AFTER the entire `if err != nil { ...; return err }`
+        // block (including the ignore-health-check downgrade path above), so a
+        // genuine bulk-health-check failure never reaches it even when
+        // `--ignore-health-check` downgrades it to a warning: Go's `run()`
+        // itself still returns that error, and its caller (`Run()`) downgrades
+        // it without ever re-invoking this capture.
+        if (Result.isSuccess(healthResult)) {
+          yield* analytics.capture(EventStackStarted, {});
+        }
+      }).pipe(
+        Effect.onError(() =>
+          legacyRollbackStart(spawner, filterValue, isFreshVolume, cliConfig.workdir),
+        ),
+      );
     }
-    return;
-  }
 
-  yield* proxy.exec(args);
+    // Go's `status.PrettyPrint(os.Stdout, excludedContainers...)` (`start.go:85`)
+    // trusts "config-enabled + not --exclude'd" as a proxy for "actually
+    // running" — true whenever `run()` reaches this line normally (it would
+    // have already failed and rolled back before getting here if any enabled,
+    // non-excluded container's `DockerStart` failed). The one exception, in Go
+    // and here alike: an IGNORED Postgres health-check timeout
+    // (`bringUpResult.kind === "postgresUnhealthyIgnored"` above) reaches this
+    // same tail via the SAME fallthrough Go's `Run()` uses (`start.go:74-87`)
+    // even though every OTHER enabled, non-excluded container was never even
+    // created — `status.PrettyPrint`/`buildStatusValues` render them anyway,
+    // purely from config, with no Docker query to contradict it. Edge Runtime
+    // now genuinely starts under that same "config-enabled" gate (no more
+    // force-exclusion from status rendering), so the raw `--exclude` values
+    // are enough on their own.
+    const statusExcluded = flags.exclude;
+
+    if (output.format === "text") {
+      yield* output.raw(legacyStartCompletedMessage(), "stderr");
+      // Called DIRECTLY, unlike the already-running branch's `status.Run`: no
+      // re-health-check, no "stopped services" diffing, just the raw
+      // `--exclude` values against the config/values already resolved (and
+      // just health-checked) above. `values` is passed through as
+      // `precomputedLocal` so this reuses the exact keys already baked into
+      // the containers `bringUp` just created, instead of re-deriving them.
+      const { values: statusValues, names } = yield* buildStatusValues(statusExcluded, values);
+      yield* output.raw(legacyRenderStatusPretty(statusValues, names));
+      yield* output.raw(legacyStartSecurityNotice(), "stderr");
+    } else {
+      const { values: statusValues } = yield* buildStatusValues(statusExcluded, values);
+      yield* output.success("", statusValues);
+    }
+  }).pipe(Effect.ensuring(telemetryState.flush));
 });
diff --git a/apps/cli/src/legacy/commands/start/start.integration.test.ts b/apps/cli/src/legacy/commands/start/start.integration.test.ts
index 3b2dcf1480..cf600de22e 100644
--- a/apps/cli/src/legacy/commands/start/start.integration.test.ts
+++ b/apps/cli/src/legacy/commands/start/start.integration.test.ts
@@ -1,199 +1,4741 @@
+import { generateKeyPairSync } from "node:crypto";
+import { existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+
+import { BunServices } from "@effect/platform-bun";
 import { describe, expect, it } from "@effect/vitest";
-import { Effect, Layer, Option } from "effect";
+import { Effect, Exit, Fiber, Layer, Option, PlatformError, Sink, Stream } from "effect";
+import { ChildProcessSpawner } from "effect/unstable/process";
+import * as HttpClient from "effect/unstable/http/HttpClient";
+import * as HttpClientResponse from "effect/unstable/http/HttpClientResponse";
+import { vi } from "vitest";
 
-import { mockOutput } from "../../../../tests/helpers/mocks.ts";
-import { LegacyOutputFlag } from "../../../shared/legacy/global-flags.ts";
-import { LegacyGoProxy } from "../../../shared/legacy/go-proxy.service.ts";
-import type { OutputFormat } from "../../../shared/output/types.ts";
+import {
+  mockAnalytics,
+  mockOutput,
+  mockProcessControl,
+  mockRuntimeInfo,
+  mockStdin,
+  mockTty,
+} from "../../../../tests/helpers/mocks.ts";
+import {
+  mockLegacyCliConfig,
+  mockLegacyTelemetryStateTracked,
+  useLegacyTempWorkdir,
+} from "../../../../tests/helpers/legacy-mocks.ts";
+import { CliArgs } from "../../../shared/cli/cli-args.service.ts";
+import {
+  LegacyDebugFlag,
+  LegacyNetworkIdFlag,
+  LegacyYesFlag,
+} from "../../../shared/legacy/global-flags.ts";
+import { LegacyPlatformApiFactory } from "../../auth/legacy-platform-api-factory.service.ts";
+import {
+  legacyServiceContainerIds,
+  legacyServiceContainerName,
+} from "../../shared/legacy-docker-ids.ts";
+import {
+  LegacyDbConnection,
+  type LegacyDbSession,
+} from "../../shared/legacy-db-connection.service.ts";
+import { legacyDockerRunLayer } from "../../shared/legacy-docker-run.layer.ts";
+import { LEGACY_START_EXCLUDABLE_KEYS } from "./start.exclude.ts";
 import type { LegacyStartFlags } from "./start.command.ts";
 import { legacyStart } from "./start.handler.ts";
+import {
+  LEGACY_KONG_LOCAL_TLS_CERT,
+  LEGACY_KONG_LOCAL_TLS_KEY,
+} from "./templates/kong-local-tls.ts";
+
+/**
+ * Counts real invocations of `legacyResolveLocalConfigValues` across this
+ * whole file — every test transparently delegates to the real
+ * implementation, so this is purely an observation point. It exists for the
+ * "resolved once, reused everywhere" regression test below (CLI-1323's
+ * status-print/bring-up JWT divergence): `start`'s success-path status print
+ * must reuse the SAME resolved `values` bring-up already used to build every
+ * container spec, not call this a second time — a second call re-signs
+ * `auth.signing_keys_path` JWTs with a different `exp` claim
+ * ({@link legacyGenerateAsymmetricGoJwt}), producing a byte-different
+ * anon/service-role key than the one already baked into the running
+ * containers.
+ */
+const legacyResolveLocalConfigValuesCalls = vi.hoisted(() => ({ count: 0 }));
+
+vi.mock("../../shared/legacy-local-config-values.ts", async () => {
+  const actual = await vi.importActual<typeof import("../../shared/legacy-local-config-values.ts")>(
+    "../../shared/legacy-local-config-values.ts",
+  );
+  return {
+    ...actual,
+    legacyResolveLocalConfigValues: (
+      ...args: Parameters<typeof actual.legacyResolveLocalConfigValues>
+    ) => {
+      legacyResolveLocalConfigValuesCalls.count++;
+      return actual.legacyResolveLocalConfigValues(...args);
+    },
+  };
+});
+
+const tempRoot = useLegacyTempWorkdir("supabase-start-int-");
 
-type LegacyGoOutput = "env" | "pretty" | "json" | "toml" | "yaml" | "table" | "csv";
+function flags(overrides: Partial<LegacyStartFlags> = {}): LegacyStartFlags {
+  return {
+    exclude: overrides.exclude ?? [],
+    ignoreHealthCheck: overrides.ignoreHealthCheck ?? false,
+    preview: overrides.preview ?? false,
+  };
+}
+
+function writeConfig(workdir: string, contents: string) {
+  const supabaseDir = join(workdir, "supabase");
+  mkdirSync(supabaseDir, { recursive: true });
+  writeFileSync(join(supabaseDir, "config.toml"), contents);
+}
 
-interface ProxyCall {
+interface SpawnRecord {
+  readonly command: string;
   readonly args: ReadonlyArray<string>;
-  readonly stdin?: "inherit" | "ignore";
-  readonly env?: Record<string, string>;
+  /** Bare `-e KEY` (no inline value) flags deliver their value via the spawned process's own env, not argv — see `edge-runtime.service.ts`'s header. */
+  readonly env: Readonly<Record<string, string | undefined>>;
 }
 
-const helperStatusEnv = { SUPABASE_TELEMETRY_DISABLED: "1" };
+type RouteResult = {
+  readonly exitCode?: number;
+  readonly stdout?: ReadonlyArray<string>;
+  readonly stderr?: ReadonlyArray<string>;
+};
 
-function setup(
-  opts: {
-    readonly format?: OutputFormat;
-    readonly goOutput?: LegacyGoOutput;
-    readonly captureStdout?: string;
-    readonly statusStdout?: string;
-  } = {},
+/**
+ * Resolves each spawned invocation immediately (no fake async delay) — unlike
+ * `stop.integration.test.ts`'s `mockRoutedContainerCliSpawner`, `start`'s own
+ * bring-up creates 10+ containers per scenario and never needs to exercise a
+ * Docker-CLI-level race, so a synchronous mock keeps these tests fast.
+ *
+ * `failSpawn` mirrors `status.integration.test.ts`'s `failSpawnFor` — every
+ * spawn attempt (both `docker` and its `podman` fallback) fails to even start,
+ * distinct from a spawned process exiting non-zero.
+ */
+function mockStartContainerCliSpawner(
+  route: (args: ReadonlyArray<string>) => RouteResult,
+  opts: { readonly failSpawn?: boolean } = {},
 ) {
-  const out = mockOutput({ format: opts.format ?? "text" });
-  const execCalls: ProxyCall[] = [];
-  const execCaptureCalls: ProxyCall[] = [];
-  const proxy = Layer.succeed(LegacyGoProxy, {
-    exec: (args, execOpts) =>
+  const spawned: Array<SpawnRecord> = [];
+  const encoder = new TextEncoder();
+
+  const layer = Layer.succeed(
+    ChildProcessSpawner.ChildProcessSpawner,
+    ChildProcessSpawner.make((command) =>
+      Effect.gen(function* () {
+        const cmd = command._tag === "StandardCommand" ? command.command : "";
+        const args = command._tag === "StandardCommand" ? command.args : [];
+        const env = command._tag === "StandardCommand" ? (command.options?.env ?? {}) : {};
+        spawned.push({ command: cmd, args, env });
+
+        if (opts.failSpawn === true) {
+          return yield* Effect.fail(
+            PlatformError.systemError({
+              _tag: "NotFound",
+              module: "ChildProcess",
+              method: "spawn",
+              description: "spawn failed",
+            }),
+          );
+        }
+
+        const result = route(args);
+        const stdoutBytes = (result.stdout ?? []).map((line) => encoder.encode(`${line}\n`));
+        const stderrBytes = (result.stderr ?? []).map((line) => encoder.encode(`${line}\n`));
+        return ChildProcessSpawner.makeHandle({
+          pid: ChildProcessSpawner.ProcessId(5000 + spawned.length),
+          stdout: Stream.fromIterable(stdoutBytes),
+          stderr: Stream.fromIterable(stderrBytes),
+          all: Stream.empty,
+          exitCode: Effect.succeed(ChildProcessSpawner.ExitCode(result.exitCode ?? 0)),
+          isRunning: Effect.succeed(false),
+          stdin: Sink.drain,
+          kill: () => Effect.void,
+          unref: Effect.succeed(Effect.void),
+          getInputFd: () => Sink.drain,
+          getOutputFd: () => Stream.empty,
+        });
+      }),
+    ),
+  );
+
+  return {
+    layer,
+    get spawned() {
+      return spawned;
+    },
+  };
+}
+
+const HEALTHY_STATE = '{"Running":true,"Status":"running","Health":{"Status":"healthy"}}';
+const STARTING_STATE = '{"Running":true,"Status":"running","Health":{"Status":"starting"}}';
+
+function containerNameFromCreateArgs(args: ReadonlyArray<string>): string {
+  const nameIndex = args.indexOf("--name");
+  return nameIndex !== -1 ? (args[nameIndex + 1] ?? "unknown") : "unknown";
+}
+
+function createdContainerNames(spawned: ReadonlyArray<SpawnRecord>): ReadonlyArray<string> {
+  return spawned
+    .filter((s) => s.args[0] === "create")
+    .map((s) => containerNameFromCreateArgs(s.args));
+}
+
+function rollbackWasAttempted(spawned: ReadonlyArray<SpawnRecord>): boolean {
+  return spawned.some((s) => s.args[0] === "container" && s.args[1] === "prune");
+}
+
+/**
+ * Stateful default route: a container only inspects successfully once it has
+ * actually been "created" — mirrors real Docker semantics and is what makes
+ * `legacyStart`'s own "already running" existence check correctly report
+ * `false` before bring-up and `true` for any container this same run created
+ * (e.g. Postgres's own post-create health wait).
+ */
+function defaultRoute(opts: { readonly neverHealthy?: ReadonlySet<string> } = {}) {
+  const created = new Set<string>();
+  return (args: ReadonlyArray<string>): RouteResult => {
+    if (args[0] === "image" && args[1] === "inspect") return { exitCode: 0 };
+    if (args[0] === "network" && args[1] === "create") return { exitCode: 0 };
+    if (args[0] === "volume" && args[1] === "create") return { exitCode: 0 };
+    if (args[0] === "context" && args[1] === "inspect") return { exitCode: 1 };
+    if (args[0] === "create") {
+      const name = containerNameFromCreateArgs(args);
+      created.add(name);
+      return { stdout: [name] };
+    }
+    if (args[0] === "start") return { exitCode: 0 };
+    if (args[0] === "container" && args[1] === "inspect") {
+      const id = args[2] ?? "";
+      if (!created.has(id)) {
+        return { exitCode: 1, stderr: [`Error: No such container: ${id}`] };
+      }
+      if (opts.neverHealthy?.has(id) === true) return { stdout: [STARTING_STATE] };
+      return { stdout: [HEALTHY_STATE] };
+    }
+    if (args[0] === "logs") return { exitCode: 0 };
+    if (args[0] === "ps") return { stdout: [] };
+    return { exitCode: 0 };
+  };
+}
+
+/** A `HttpClient` that always answers 200 — the default config's PostgREST/Kong readiness probe. */
+const alwaysReadyHttpClientLayer = Layer.succeed(
+  HttpClient.HttpClient,
+  HttpClient.make((request) =>
+    Effect.succeed(HttpClientResponse.fromWeb(request, new Response(null, { status: 200 }))),
+  ),
+);
+
+/** Fails loudly if called — for scenarios that exclude/disable `postgrest` and must never reach HTTP. */
+const unusedHttpClientLayer = Layer.succeed(
+  HttpClient.HttpClient,
+  HttpClient.make(() => Effect.die("HttpClient should not be called for this scenario")),
+);
+
+/** Overrides the default route's "volume already exists" answer to simulate a brand-new Postgres volume. */
+function freshVolumeRoute(
+  base: (args: ReadonlyArray<string>) => RouteResult,
+): (args: ReadonlyArray<string>) => RouteResult {
+  return (args) => {
+    // `legacyStartVolumeExists` now distinguishes a confirmed "not found" from
+    // any other inspect error (matching Go's `errdefs.IsNotFound` gate) — the
+    // stderr text is what makes this simulate a genuinely fresh/non-existent
+    // volume rather than an ambiguous inspect failure.
+    if (args[0] === "volume" && args[1] === "inspect") {
+      return { exitCode: 1, stderr: [`Error: No such volume: ${args[2] ?? ""}`] };
+    }
+    return base(args);
+  };
+}
+
+/** Storage's `/storage/v1/bucket` GET (list)/POST (create) endpoints — every other request answers a bare 200, matching `alwaysReadyHttpClientLayer`'s permissiveness for the PostgREST/Edge Runtime readiness probes some scenarios also exercise. */
+function mockStorageBucketHttpClient() {
+  const createdBucketRequests: Array<string> = [];
+  const createdBucketBodies: Array<unknown> = [];
+  const layer = Layer.succeed(
+    HttpClient.HttpClient,
+    HttpClient.make((request) => {
+      if (request.method === "GET" && request.url.includes("/storage/v1/bucket")) {
+        return Effect.succeed(
+          HttpClientResponse.fromWeb(
+            request,
+            new Response("[]", {
+              status: 200,
+              headers: { "content-type": "application/json" },
+            }),
+          ),
+        );
+      }
+      if (request.method === "POST" && request.url.includes("/storage/v1/bucket")) {
+        createdBucketRequests.push(request.url);
+        if (request.body._tag === "Uint8Array") {
+          try {
+            createdBucketBodies.push(JSON.parse(new TextDecoder().decode(request.body.body)));
+          } catch {
+            createdBucketBodies.push(undefined);
+          }
+        } else {
+          createdBucketBodies.push(undefined);
+        }
+        return Effect.succeed(
+          HttpClientResponse.fromWeb(
+            request,
+            new Response(JSON.stringify({ name: "avatars" }), {
+              status: 200,
+              headers: { "content-type": "application/json" },
+            }),
+          ),
+        );
+      }
+      return Effect.succeed(
+        HttpClientResponse.fromWeb(request, new Response(null, { status: 200 })),
+      );
+    }),
+  );
+  return { layer, createdBucketRequests, createdBucketBodies };
+}
+
+/**
+ * A fake `LegacyDbSession` recording every `exec`/`query` call — the fresh-volume
+ * `SetupLocalDatabase`-equivalent path (`legacyStartSetupLocalDatabase`) needs an
+ * open session for PG<=14's schema SQL / `ApplyApiPrivileges`; PG15+ (this suite's
+ * default) never calls `exec`/`query` at all (its schema init is three one-shot
+ * `LegacyDockerRun` jobs instead — see `db-setup.ts`'s header), so this mostly just
+ * needs to exist and satisfy the type. Mirrors `db-setup.unit.test.ts`'s own
+ * `fakeSession()`.
+ */
+function fakeDbSession() {
+  const calls: Array<{ kind: "exec" | "query"; sql: string }> = [];
+  const session: LegacyDbSession = {
+    exec: (sql) =>
       Effect.sync(() => {
-        execCalls.push(execOpts?.env === undefined ? { args } : { args, env: execOpts.env });
+        calls.push({ kind: "exec", sql });
       }),
-    execCapture: (args, execOpts) =>
+    query: (sql) =>
       Effect.sync(() => {
-        execCaptureCalls.push({
-          args,
-          ...(execOpts?.stdin === undefined ? {} : { stdin: execOpts.stdin }),
-          ...(execOpts?.env === undefined ? {} : { env: execOpts.env }),
-        });
-        return args[0] === "status" ? (opts.statusStdout ?? "{}\n") : (opts.captureStdout ?? "");
+        calls.push({ kind: "query", sql });
+        return [];
       }),
+    extensionExists: () => Effect.succeed(false),
+    copyToCsv: () => Effect.succeed(new Uint8Array()),
+    queryRaw: () => Effect.succeed({ fields: [], rows: [], commandTag: "" }),
+  };
+  return { session, calls };
+}
+
+interface SetupOpts {
+  readonly format?: "text" | "json" | "stream-json";
+  readonly route?: (args: ReadonlyArray<string>) => RouteResult;
+  readonly httpClientLayer?: Layer.Layer<HttpClient.HttpClient>;
+  readonly configuredProjectId?: string;
+  /** Raw `config.toml` contents — overrides `configuredProjectId`'s single-line default. */
+  readonly configContents?: string;
+  /** Skip writing `config.toml` entirely — the test writes its own (e.g. a malformed file). */
+  readonly skipConfig?: boolean;
+  /** Every spawn attempt (docker AND its podman fallback) fails outright — neither runtime found. */
+  readonly failSpawn?: boolean;
+  /** Defaults to `tempRoot.current` — override for `--workdir`-resolution failure tests. */
+  readonly workdir?: string;
+  /** `--network-id` override. Defaults to unset (the generated `supabase_network_<project>` name applies). */
+  readonly networkId?: Option.Option<string>;
+}
+
+function setup(opts: SetupOpts = {}) {
+  const workdir = opts.workdir ?? tempRoot.current;
+  if (opts.skipConfig !== true) {
+    writeConfig(
+      workdir,
+      opts.configContents ?? `project_id = "${opts.configuredProjectId ?? "demo"}"\n`,
+    );
+  }
+  const out = mockOutput({ format: opts.format ?? "text" });
+  const telemetry = mockLegacyTelemetryStateTracked();
+  const analytics = mockAnalytics();
+  const cliConfig = mockLegacyCliConfig({ workdir });
+  const child = mockStartContainerCliSpawner(opts.route ?? defaultRoute(), {
+    failSpawn: opts.failSpawn,
   });
+  const dbSession = fakeDbSession();
 
   const layer = Layer.mergeAll(
+    BunServices.layer,
     out.layer,
-    proxy,
-    Layer.succeed(
-      LegacyOutputFlag,
-      opts.goOutput === undefined ? Option.none() : Option.some(opts.goOutput),
+    cliConfig,
+    telemetry.layer,
+    analytics.layer,
+    child.layer,
+    opts.httpClientLayer ?? alwaysReadyHttpClientLayer,
+    // Only ever exercised by a fresh-volume scenario (`volume inspect` exiting
+    // non-zero) — every other scenario's default "volume already exists" route
+    // never reaches `legacyStartSetupLocalDatabase`/`legacySeedBucketsRun`, but
+    // both are still part of `legacyStart`'s aggregate Effect type, so every
+    // scenario needs these satisfied regardless of whether it exercises them.
+    Layer.succeed(LegacyDbConnection, { connect: () => Effect.succeed(dbSession.session) }),
+    // `Layer.mergeAll` never cross-wires sibling requirements (see
+    // `apps/cli/CLAUDE.md`'s "Layer.provide does not share to siblings"
+    // note) — `legacyDockerRunLayer` needs `ChildProcessSpawner`/
+    // `ProcessControl` provided to IT explicitly, not just present elsewhere
+    // in this same merge.
+    legacyDockerRunLayer.pipe(
+      Layer.provide(child.layer),
+      Layer.provide(mockProcessControl().layer),
     ),
+    mockProcessControl().layer,
+    mockRuntimeInfo({ platform: "linux" }),
+    Layer.succeed(LegacyPlatformApiFactory, {
+      make: Effect.die("LegacyPlatformApiFactory should not be used by a local start"),
+    }),
+    Layer.succeed(CliArgs, { args: ["start"] }),
+    Layer.succeed(LegacyDebugFlag, false),
+    Layer.succeed(LegacyYesFlag, false),
+    Layer.succeed(LegacyNetworkIdFlag, opts.networkId ?? Option.none()),
+    mockTty({ stdinIsTty: false }),
+    mockStdin(false),
   );
 
-  return { layer, out, execCalls, execCaptureCalls };
+  return { workdir, out, telemetry, analytics, child, dbSession, layer };
 }
 
-const flags = (overrides: Partial<LegacyStartFlags> = {}): LegacyStartFlags => ({
-  exclude: overrides.exclude ?? [],
-  ignoreHealthCheck: overrides.ignoreHealthCheck ?? false,
-  preview: overrides.preview ?? false,
-});
+/**
+ * Maps each of the 13 valid `--exclude` keys (`start.exclude.ts`) to the
+ * container-name suffix(es) that key skips, for the parameterized exclusion
+ * matrix test below. `storage-api` is compound: excluding it also disables
+ * ImgProxy (`start.gates.ts`'s `imgproxy: storage && ...` dependency).
+ * `edge-runtime` maps to no suffix at all here — it DOES really start now
+ * (`legacyStartEdgeRuntimeContainer`, a direct `docker run -d`, never a
+ * `docker create`), so `--exclude edge-runtime` is exercised by its own
+ * dedicated scenarios below rather than through this `docker create`-based
+ * matrix.
+ */
+const CONTAINER_SUFFIX_BY_EXCLUDE_KEY: Readonly<Record<string, string>> = {
+  gotrue: "auth",
+  realtime: "realtime",
+  "storage-api": "storage",
+  imgproxy: "imgproxy",
+  kong: "kong",
+  mailpit: "inbucket",
+  postgrest: "rest",
+  "postgres-meta": "pg_meta",
+  studio: "studio",
+  "edge-runtime": "",
+  logflare: "analytics",
+  vector: "vector",
+  supavisor: "pooler",
+};
+
+/** Every container suffix a clean host creates when nothing is excluded, given a config that turns on ImgProxy + the pooler (see the matrix test's own config). */
+const ALL_EXCLUDABLE_SUFFIXES: ReadonlyArray<string> = [
+  "kong",
+  "auth",
+  "inbucket",
+  "realtime",
+  "rest",
+  "storage",
+  "imgproxy",
+  "pg_meta",
+  "studio",
+  "analytics",
+  "vector",
+  "pooler",
+];
+
+function missingSuffixesForExcludeKey(excludeKey: string): ReadonlyArray<string> {
+  if (excludeKey === "edge-runtime") return [];
+  if (excludeKey === "storage-api") {
+    return [
+      CONTAINER_SUFFIX_BY_EXCLUDE_KEY["storage-api"]!,
+      CONTAINER_SUFFIX_BY_EXCLUDE_KEY.imgproxy!,
+    ];
+  }
+  return [CONTAINER_SUFFIX_BY_EXCLUDE_KEY[excludeKey]!];
+}
+
+// Go's test vector (`apps/cli-go/pkg/config/secret_test.go`): this ciphertext decrypts to
+// "value" under the keypair below — same fixture used by `legacy-local-config-values.unit.test.ts`'s
+// "encrypted auth secrets" suite. Hoisted to file scope so both the GoTrue-secret suite and the
+// Edge-Runtime-secret suite below reuse the exact same known-good dotenvx ciphertext instead of
+// each needing to produce their own (that requires the real ECIES encryption this fixture already
+// captures).
+const VAULT_PRIVATE_KEY = "7fd7210cef8f331ee8c55897996aaaafd853a2b20a4dc73d6d75759f65d2a7eb";
+const VAULT_ENCRYPTED =
+  "encrypted:BKiXH15AyRzeohGyUrmB6cGjSklCrrBjdesQlX1VcXo/Xp20Bi2gGZ3AlIqxPQDmjVAALnhZamKnuY73l8Dz1P+BYiZUgxTSLzdCvdYUyVbNekj2UudbdUizBViERtZkuQwZHIv/";
 
-describe("legacy start", () => {
-  it.live("delegates text mode directly to Go start", () => {
-    const s = setup();
+describe("legacy start integration", () => {
+  describe("--exclude validation", () => {
+    it.live("warns on stderr for an invalid --exclude value, even when already running", () => {
+      const { layer, out } = setup({
+        route: (args) => {
+          if (args[0] === "container" && args[1] === "inspect") {
+            return { stdout: [HEALTHY_STATE] };
+          }
+          if (args[0] === "ps") return { stdout: [] };
+          return { exitCode: 0 };
+        },
+      });
+      return Effect.gen(function* () {
+        yield* legacyStart(flags({ exclude: ["not-a-real-service"] }));
+        expect(out.stderrText).toContain("WARNING:");
+        expect(out.stderrText).toContain("not-a-real-service");
+        expect(out.stderrText).toContain("not valid to exclude");
+      }).pipe(Effect.provide(layer));
+    });
+
+    it.live(
+      "rejects --exclude db and --exclude postgres as invalid, since Postgres has no exclude key",
+      () => {
+        const { layer, out, child } = setup();
+        return Effect.gen(function* () {
+          yield* legacyStart(flags({ exclude: ["db", "postgres"] }));
+          expect(out.stderrText).toContain("WARNING:");
+          expect(out.stderrText).toContain("db, postgres");
+          expect(out.stderrText).toContain("not valid to exclude");
+          // An invalid --exclude value must never silently skip Postgres itself.
+          expect(createdContainerNames(child.spawned).some((name) => name.includes("_db_"))).toBe(
+            true,
+          );
+        }).pipe(Effect.provide(layer));
+      },
+    );
+  });
+
+  describe("already running", () => {
+    it.live(
+      "prints the already-running banner and renders status without creating any containers",
+      () => {
+        const { layer, out, child } = setup({
+          route: (args) => {
+            if (args[0] === "container" && args[1] === "inspect") {
+              return { stdout: [HEALTHY_STATE] };
+            }
+            if (args[0] === "ps") return { stdout: [] };
+            return { exitCode: 0 };
+          },
+        });
+        return Effect.gen(function* () {
+          yield* legacyStart(flags());
+          expect(out.stderrText).toContain("supabase start");
+          expect(out.stderrText).toContain("is already running");
+          expect(child.spawned.some((s) => s.args[0] === "create")).toBe(false);
+        }).pipe(Effect.provide(layer));
+      },
+    );
+
+    it.live("reports the stack is already running with a machine payload in json mode", () => {
+      const { layer, out } = setup({
+        format: "json",
+        route: (args) => {
+          if (args[0] === "container" && args[1] === "inspect") {
+            return { stdout: [HEALTHY_STATE] };
+          }
+          if (args[0] === "ps") return { stdout: [] };
+          return { exitCode: 0 };
+        },
+      });
+      return Effect.gen(function* () {
+        yield* legacyStart(flags());
+        const success = out.messages.find((m) => m.type === "success");
+        expect(success?.data).toMatchObject({ DB_URL: expect.any(String) });
+        expect(out.stderrText).not.toContain("is already running");
+      }).pipe(Effect.provide(layer));
+    });
+
+    it.live(
+      "reports the stack is already running with a machine payload in stream-json mode",
+      () => {
+        const { layer, out } = setup({
+          format: "stream-json",
+          route: (args) => {
+            if (args[0] === "container" && args[1] === "inspect") {
+              return { stdout: [HEALTHY_STATE] };
+            }
+            if (args[0] === "ps") return { stdout: [] };
+            return { exitCode: 0 };
+          },
+        });
+        return Effect.gen(function* () {
+          yield* legacyStart(flags());
+          const success = out.messages.find((m) => m.type === "success");
+          expect(success?.data).toMatchObject({ DB_URL: expect.any(String) });
+          expect(out.stderrText).not.toContain("is already running");
+        }).pipe(Effect.provide(layer));
+      },
+    );
+
+    it.live(
+      "fails when the already-running DB container stops running before the health re-check",
+      () => {
+        // The FIRST inspect (`AssertSupabaseDbIsRunning`) only needs to prove the container
+        // exists; the SECOND inspect (Go's `status.Run` re-check, `!ignoreHealthCheck`) is what
+        // actually gates on `Running`/`Health` — a container can transition between the two.
+        let inspectCalls = 0;
+        const { layer, child } = setup({
+          route: (args) => {
+            if (args[0] === "container" && args[1] === "inspect") {
+              inspectCalls += 1;
+              if (inspectCalls === 1) return { stdout: [HEALTHY_STATE] };
+              return { stdout: [JSON.stringify({ Status: "exited", Running: false })] };
+            }
+            return { exitCode: 0 };
+          },
+        });
+        return Effect.gen(function* () {
+          const exit = yield* Effect.exit(legacyStart(flags()));
+          expect(Exit.isFailure(exit)).toBe(true);
+          if (Exit.isFailure(exit)) {
+            expect(JSON.stringify(exit.cause)).toContain("LegacyStatusDbNotRunningError");
+          }
+          expect(child.spawned.some((s) => s.args[0] === "create")).toBe(false);
+        }).pipe(Effect.provide(layer));
+      },
+    );
+
+    it.live(
+      "fails when the already-running DB container is unhealthy on the health re-check",
+      () => {
+        let inspectCalls = 0;
+        const { layer } = setup({
+          route: (args) => {
+            if (args[0] === "container" && args[1] === "inspect") {
+              inspectCalls += 1;
+              if (inspectCalls === 1) return { stdout: [HEALTHY_STATE] };
+              return { stdout: [STARTING_STATE] };
+            }
+            return { exitCode: 0 };
+          },
+        });
+        return Effect.gen(function* () {
+          const exit = yield* Effect.exit(legacyStart(flags()));
+          expect(Exit.isFailure(exit)).toBe(true);
+          if (Exit.isFailure(exit)) {
+            expect(JSON.stringify(exit.cause)).toContain("LegacyStatusDbNotReadyError");
+          }
+        }).pipe(Effect.provide(layer));
+      },
+    );
+
+    it.live(
+      "fails when the already-running DB container's health re-check inspect itself errors",
+      () => {
+        let inspectCalls = 0;
+        const { layer } = setup({
+          route: (args) => {
+            if (args[0] === "container" && args[1] === "inspect") {
+              inspectCalls += 1;
+              if (inspectCalls === 1) return { stdout: [HEALTHY_STATE] };
+              return { exitCode: 1, stderr: ["permission denied"] };
+            }
+            return { exitCode: 0 };
+          },
+        });
+        return Effect.gen(function* () {
+          const exit = yield* Effect.exit(legacyStart(flags()));
+          expect(Exit.isFailure(exit)).toBe(true);
+          if (Exit.isFailure(exit)) {
+            const serialized = JSON.stringify(exit.cause);
+            expect(serialized).toContain("LegacyStatusDbInspectError");
+            expect(serialized).toContain("permission denied");
+          }
+        }).pipe(Effect.provide(layer));
+      },
+    );
+
+    it.live("fails when listing running containers errors while already running", () => {
+      const { layer } = setup({
+        route: (args) => {
+          if (args[0] === "container" && args[1] === "inspect") {
+            return { stdout: [HEALTHY_STATE] };
+          }
+          if (args[0] === "ps") return { exitCode: 1, stderr: ["daemon down"] };
+          return { exitCode: 0 };
+        },
+      });
+      return Effect.gen(function* () {
+        const exit = yield* Effect.exit(legacyStart(flags()));
+        expect(Exit.isFailure(exit)).toBe(true);
+        if (Exit.isFailure(exit)) {
+          expect(JSON.stringify(exit.cause)).toContain("LegacyStatusListError");
+        }
+      }).pipe(Effect.provide(layer));
+    });
+
+    it.live("already running, --ignore-health-check skips the health re-check entirely", () => {
+      let inspectCalls = 0;
+      const { layer, child } = setup({
+        route: (args) => {
+          if (args[0] === "container" && args[1] === "inspect") {
+            inspectCalls += 1;
+            // Only the FIRST inspect (`AssertSupabaseDbIsRunning`) should ever fire — a second
+            // call here would mean the health re-check ran despite the flag.
+            if (inspectCalls === 1) return { stdout: [HEALTHY_STATE] };
+            return { exitCode: 1, stderr: ["should not be called"] };
+          }
+          if (args[0] === "ps") return { stdout: [] };
+          return { exitCode: 0 };
+        },
+      });
+      return Effect.gen(function* () {
+        yield* legacyStart(flags({ ignoreHealthCheck: true }));
+        expect(inspectCalls).toBe(1);
+        expect(child.spawned.some((s) => s.args[0] === "ps")).toBe(true);
+      }).pipe(Effect.provide(layer));
+    });
 
-    return Effect.gen(function* () {
-      yield* legacyStart(flags({ exclude: ["db"] }));
+    it.live("already running with every service still up omits the 'Stopped services' line", () => {
+      const { layer, out } = setup({
+        route: (args) => {
+          if (args[0] === "container" && args[1] === "inspect") {
+            return { stdout: [HEALTHY_STATE] };
+          }
+          if (args[0] === "ps") return { stdout: [...legacyServiceContainerIds("demo")] };
+          return { exitCode: 0 };
+        },
+      });
+      return Effect.gen(function* () {
+        yield* legacyStart(flags());
+        expect(out.stderrText).not.toContain("Stopped services");
+      }).pipe(Effect.provide(layer));
+    });
 
-      expect(s.execCalls).toEqual([{ args: ["start", "--exclude", "db"] }]);
-      expect(s.execCaptureCalls).toEqual([]);
-    }).pipe(Effect.provide(s.layer));
+    it.live(
+      "fails on a bucket's invalid file_size_limit even when already running, matching Go's Config.Load",
+      () => {
+        // `legacyCheckDbToml` runs unconditionally at the very top of this handler, before
+        // `dbContainerId`/the already-running short-circuit are even computed — unlike the later
+        // wrapConfigOverride checks (e.g. storage.analytics.enabled), which sit AFTER the
+        // already-running early return and therefore never run in this branch. A malformed
+        // per-bucket file_size_limit must still fail here, before the already-running banner ever
+        // prints, matching Go's Config.Load decrypting/decoding unconditionally regardless of
+        // whether the stack is already up.
+        const { layer, child } = setup({
+          configContents:
+            'project_id = "demo"\n[storage.buckets.avatars]\nfile_size_limit = "bogus"\n',
+          route: (args) => {
+            if (args[0] === "container" && args[1] === "inspect") {
+              return { stdout: [HEALTHY_STATE] };
+            }
+            if (args[0] === "ps") return { stdout: [] };
+            return { exitCode: 0 };
+          },
+        });
+        return Effect.gen(function* () {
+          const exit = yield* Effect.exit(legacyStart(flags()));
+          expect(Exit.isFailure(exit)).toBe(true);
+          if (Exit.isFailure(exit)) {
+            const serialized = JSON.stringify(exit.cause);
+            expect(serialized).toContain("LegacyDbConfigLoadError");
+            expect(serialized).toContain(
+              "failed to parse config: invalid storage.buckets.avatars.file_size_limit.",
+            );
+          }
+          expect(child.spawned.some((s) => s.args[0] === "create")).toBe(false);
+        }).pipe(Effect.provide(layer));
+      },
+    );
   });
 
-  it.live("captures Go start then emits Go status for --output json", () => {
-    const s = setup({ goOutput: "json" });
+  describe("config load / validation failures", () => {
+    it.live("fails when --workdir/SUPABASE_WORKDIR points at a missing path", () => {
+      // Go's `ChangeWorkDir` (`apps/cli-go/internal/utils/misc.go:231-250`) `os.Chdir`s the
+      // explicit workdir before config load or any Docker call — a missing path must fail
+      // immediately, matching `status`/`stop`'s own equivalent test.
+      const missingWorkdir = join(tempRoot.current, "does-not-exist");
+      const { layer, child } = setup({ workdir: missingWorkdir, skipConfig: true });
+      return Effect.gen(function* () {
+        const exit = yield* Effect.exit(legacyStart(flags()));
+        expect(Exit.isFailure(exit)).toBe(true);
+        if (Exit.isFailure(exit)) {
+          const serialized = JSON.stringify(exit.cause);
+          expect(serialized).toContain("LegacyStartWorkdirError");
+          expect(serialized).toContain(
+            `failed to change workdir: chdir ${missingWorkdir}: no such file or directory`,
+          );
+        }
+        expect(child.spawned).toEqual([]);
+      }).pipe(Effect.provide(layer));
+    });
+
+    it.live("fails when the DB container inspect fails for a reason other than not-found", () => {
+      const { layer, child } = setup({
+        route: (args) => {
+          if (args[0] === "container" && args[1] === "inspect") {
+            return { exitCode: 1, stderr: ["Error response from daemon: permission denied"] };
+          }
+          return { exitCode: 0 };
+        },
+      });
+      return Effect.gen(function* () {
+        const exit = yield* Effect.exit(legacyStart(flags()));
+        expect(Exit.isFailure(exit)).toBe(true);
+        if (Exit.isFailure(exit)) {
+          const serialized = JSON.stringify(exit.cause);
+          expect(serialized).toContain("LegacyDockerLifecycleInspectError");
+          expect(serialized).toContain("permission denied");
+        }
+        expect(child.spawned.some((s) => s.args[0] === "create")).toBe(false);
+      }).pipe(Effect.provide(layer));
+    });
+
+    it.live(
+      "fails with a docker-unavailable error when neither docker nor podman can be spawned",
+      () => {
+        const { layer } = setup({ failSpawn: true });
+        return Effect.gen(function* () {
+          const exit = yield* Effect.exit(legacyStart(flags()));
+          expect(Exit.isFailure(exit)).toBe(true);
+          if (Exit.isFailure(exit)) {
+            const serialized = JSON.stringify(exit.cause);
+            expect(serialized).toContain("LegacyDockerLifecycleInspectError");
+            expect(serialized).toContain("docker: command not found (podman also not found)");
+          }
+        }).pipe(Effect.provide(layer));
+      },
+    );
 
-    return Effect.gen(function* () {
-      yield* legacyStart(flags());
+    it.live("fails on a malformed config.toml", () => {
+      const workdir = tempRoot.current;
+      mkdirSync(join(workdir, "supabase"), { recursive: true });
+      writeFileSync(join(workdir, "supabase", "config.toml"), "not valid toml =====");
+      const { layer, child } = setup({ skipConfig: true });
+      return Effect.gen(function* () {
+        const exit = yield* Effect.exit(legacyStart(flags()));
+        expect(Exit.isFailure(exit)).toBe(true);
+        if (Exit.isFailure(exit)) {
+          expect(JSON.stringify(exit.cause)).toContain("LegacyStartConfigLoadError");
+        }
+        expect(child.spawned).toEqual([]);
+      }).pipe(Effect.provide(layer));
+    });
 
-      expect(s.execCaptureCalls).toEqual([{ args: ["start"], stdin: "inherit" }]);
-      expect(s.execCalls).toEqual([{ args: ["status", "--output", "json"], env: helperStatusEnv }]);
-    }).pipe(Effect.provide(s.layer));
+    it.live("fails when auth.jwt_secret is configured but shorter than 16 characters", () => {
+      const { layer, child } = setup({
+        configContents: 'project_id = "demo"\n[auth]\njwt_secret = "too-short"\n',
+      });
+      return Effect.gen(function* () {
+        const exit = yield* Effect.exit(legacyStart(flags()));
+        expect(Exit.isFailure(exit)).toBe(true);
+        if (Exit.isFailure(exit)) {
+          const serialized = JSON.stringify(exit.cause);
+          expect(serialized).toContain("LegacyStartInvalidConfigError");
+          expect(serialized).toContain(
+            "Invalid config for auth.jwt_secret. Must be at least 16 characters",
+          );
+        }
+        expect(child.spawned).toEqual([]);
+      }).pipe(Effect.provide(layer));
+    });
   });
 
-  it.live("captures Go start then emits Go status for --output-format json", () => {
-    const s = setup({ format: "json" });
+  describe("happy path", () => {
+    it.live(
+      "brings up the full default stack (clean host, every container immediately healthy)",
+      () => {
+        const { layer, out, child, analytics } = setup();
+        return Effect.gen(function* () {
+          yield* legacyStart(flags());
+
+          const createdNames = createdContainerNames(child.spawned);
+          // Postgres + the 10 excludable services enabled by default
+          // (imgproxy/supavisor stay off: `storage.image_transformation.enabled`/
+          // `db.pooler.enabled` both default `false`).
+          expect(createdNames.filter((name) => name.includes("_db_"))).toHaveLength(1);
+          expect(createdNames.filter((name) => name.includes("_kong_"))).toHaveLength(1);
+          expect(createdNames.filter((name) => name.includes("_auth_"))).toHaveLength(1);
+          expect(createdNames.filter((name) => name.includes("_inbucket_"))).toHaveLength(1);
+          expect(createdNames.filter((name) => name.includes("_realtime_"))).toHaveLength(1);
+          expect(createdNames.filter((name) => name.includes("_rest_"))).toHaveLength(1);
+          expect(createdNames.filter((name) => name.includes("_storage_"))).toHaveLength(1);
+          expect(createdNames.filter((name) => name.includes("_analytics_"))).toHaveLength(1);
+          expect(createdNames.filter((name) => name.includes("_vector_"))).toHaveLength(1);
+          expect(createdNames.filter((name) => name.includes("_pg_meta_"))).toHaveLength(1);
+          expect(createdNames.filter((name) => name.includes("_studio_"))).toHaveLength(1);
+          expect(createdNames.some((name) => name.includes("_imgproxy_"))).toBe(false);
+          expect(createdNames.some((name) => name.includes("_pooler_"))).toBe(false);
+
+          expect(out.stderrText).toContain("Starting containers...");
+          expect(out.stderrText).toContain("Waiting for health checks...");
+          expect(out.stderrText).toContain("Started");
+          expect(out.stderrText).toContain("local development setup.");
+          expect(analytics.captured).toContainEqual(
+            expect.objectContaining({ event: "cli_stack_started" }),
+          );
+        }).pipe(Effect.provide(layer));
+      },
+    );
+
+    it.live("emits a machine status payload in json mode instead of the pretty table", () => {
+      const { layer, out } = setup({ format: "json" });
+      return Effect.gen(function* () {
+        yield* legacyStart(flags());
+        const success = out.messages.find((m) => m.type === "success");
+        expect(success?.data).toMatchObject({ DB_URL: expect.any(String) });
+        expect(out.stderrText).not.toContain("Started");
+      }).pipe(Effect.provide(layer));
+    });
+
+    it.live(
+      "emits a machine status payload in stream-json mode instead of the pretty table",
+      () => {
+        const { layer, out } = setup({ format: "stream-json" });
+        return Effect.gen(function* () {
+          yield* legacyStart(flags());
+          const success = out.messages.find((m) => m.type === "success");
+          expect(success?.data).toMatchObject({ DB_URL: expect.any(String) });
+          expect(out.stderrText).not.toContain("Started");
+        }).pipe(Effect.provide(layer));
+      },
+    );
+
+    it.live("fires cli_stack_started exactly once on a successful start", () => {
+      const { layer, analytics } = setup();
+      return Effect.gen(function* () {
+        yield* legacyStart(flags());
+        const stackStartedEvents = analytics.captured.filter(
+          (c) => c.event === "cli_stack_started",
+        );
+        expect(stackStartedEvents).toEqual([{ event: "cli_stack_started", properties: {} }]);
+      }).pipe(Effect.provide(layer));
+    });
 
-    return Effect.gen(function* () {
-      yield* legacyStart(flags());
+    it.live(
+      "reuses the bring-up-resolved local config values for the final status print instead of re-deriving them",
+      () => {
+        // Regression test for the CLI-1323 status-print/bring-up divergence:
+        // `legacyResolveLocalConfigValues` embeds a fresh `exp` claim
+        // (`Date.now()`-derived) into the anon/service-role key every time it
+        // asymmetrically signs them via `auth.signing_keys_path`
+        // (`legacyGenerateAsymmetricGoJwt`, `legacy-go-jwt.ts:212`). A second,
+        // independent resolution for the final status print — rather than
+        // reusing the SAME `values` already used to build every container
+        // spec — would mint a byte-different key than the one baked into the
+        // already-running containers. Asserting a single resolution call is
+        // both the most direct way to pin this invariant and immune to the
+        // test itself racing real wall-clock time (unlike comparing two
+        // independently-generated JWTs, which could coincidentally still
+        // match if both calls land within the same clock second).
+        const { layer, workdir } = setup({
+          format: "json",
+          configContents: 'project_id = "demo"\n[auth]\nsigning_keys_path = "signing_keys.json"\n',
+        });
+        const { privateKey } = generateKeyPairSync("rsa", { modulusLength: 2048 });
+        const jwk = { ...privateKey.export({ format: "jwk" }), alg: "RS256", kid: "test-kid" };
+        writeFileSync(join(workdir, "supabase", "signing_keys.json"), JSON.stringify([jwk]));
+        legacyResolveLocalConfigValuesCalls.count = 0;
 
-      expect(s.execCaptureCalls).toEqual([{ args: ["start"], stdin: "inherit" }]);
-      expect(s.execCalls).toEqual([{ args: ["status", "--output", "json"], env: helperStatusEnv }]);
-    }).pipe(Effect.provide(s.layer));
+        return Effect.gen(function* () {
+          yield* legacyStart(flags());
+          expect(legacyResolveLocalConfigValuesCalls.count).toBe(1);
+        }).pipe(Effect.provide(layer));
+      },
+    );
   });
 
-  it.live("emits captured Go status as a result event for --output-format stream-json", () => {
-    const s = setup({
-      format: "stream-json",
-      statusStdout: '{\n  "API_URL": "http://127.0.0.1:54321"\n}\n',
+  describe("config-driven container-spec branches", () => {
+    it.live(
+      "fails when a configured third-party auth issuer's JWKS endpoint is unreachable",
+      () => {
+        // `legacyResolveLocalJwks` (step 6, unconditional) fetches the third-party issuer's own
+        // JWKS document via a raw `fetch` — a real network boundary, not the `HttpClient` service
+        // this suite otherwise mocks, so it needs its own `globalThis.fetch` stub. A valid
+        // firebase config passes config load/validation cleanly (step 2 never performs this
+        // fetch), so this is the only way this specific failure surfaces.
+        const previousFetch = globalThis.fetch;
+        globalThis.fetch = Object.assign(() => Promise.reject(new Error("ECONNREFUSED")), {
+          preconnect: previousFetch.preconnect,
+        });
+        const { layer, child } = setup({
+          configContents:
+            'project_id = "demo"\n[auth.third_party.firebase]\nenabled = true\nproject_id = "fb-project"\n',
+        });
+        return Effect.gen(function* () {
+          const exit = yield* Effect.exit(legacyStart(flags()));
+          expect(Exit.isFailure(exit)).toBe(true);
+          if (Exit.isFailure(exit)) {
+            expect(JSON.stringify(exit.cause)).toContain("LegacyStartInvalidConfigError");
+          }
+          expect(child.spawned.some((s) => s.args[0] === "create")).toBe(false);
+        }).pipe(
+          Effect.provide(layer),
+          Effect.ensuring(
+            Effect.sync(() => {
+              globalThis.fetch = previousFetch;
+            }),
+          ),
+        );
+      },
+    );
+
+    it.live("reads and mounts a configured API TLS cert/key pair for Kong", () => {
+      const { layer, workdir, child } = setup({
+        configContents:
+          'project_id = "demo"\n[api.tls]\nenabled = true\ncert_path = "certs/server.crt"\nkey_path = "certs/server.key"\n',
+      });
+      mkdirSync(join(workdir, "supabase", "certs"), { recursive: true });
+      writeFileSync(
+        join(workdir, "supabase", "certs", "server.crt"),
+        "-----BEGIN CERTIFICATE-----",
+      );
+      writeFileSync(
+        join(workdir, "supabase", "certs", "server.key"),
+        "-----BEGIN PRIVATE KEY-----",
+      );
+      return Effect.gen(function* () {
+        yield* legacyStart(flags());
+        expect(createdContainerNames(child.spawned).some((name) => name.includes("_kong_"))).toBe(
+          true,
+        );
+      }).pipe(Effect.provide(layer));
+    });
+
+    it.live("fails when a configured API TLS cert file cannot be read", () => {
+      const { layer, workdir, child } = setup({
+        configContents:
+          'project_id = "demo"\n[api.tls]\nenabled = true\ncert_path = "certs/server.crt"\nkey_path = "certs/server.key"\n',
+      });
+      mkdirSync(join(workdir, "supabase", "certs"), { recursive: true });
+      writeFileSync(
+        join(workdir, "supabase", "certs", "server.key"),
+        "-----BEGIN PRIVATE KEY-----",
+      );
+      return Effect.gen(function* () {
+        const exit = yield* Effect.exit(legacyStart(flags()));
+        expect(Exit.isFailure(exit)).toBe(true);
+        if (Exit.isFailure(exit)) {
+          const serialized = JSON.stringify(exit.cause);
+          expect(serialized).toContain("LegacyStartInvalidConfigError");
+          expect(serialized).toContain("failed to read TLS cert");
+        }
+        expect(child.spawned.some((s) => s.args[0] === "create")).toBe(false);
+      }).pipe(Effect.provide(layer));
+    });
+
+    it.live("fails when a configured API TLS key file cannot be read", () => {
+      const { layer, workdir, child } = setup({
+        configContents:
+          'project_id = "demo"\n[api.tls]\nenabled = true\ncert_path = "certs/server.crt"\nkey_path = "certs/server.key"\n',
+      });
+      mkdirSync(join(workdir, "supabase", "certs"), { recursive: true });
+      writeFileSync(
+        join(workdir, "supabase", "certs", "server.crt"),
+        "-----BEGIN CERTIFICATE-----",
+      );
+      return Effect.gen(function* () {
+        const exit = yield* Effect.exit(legacyStart(flags()));
+        expect(Exit.isFailure(exit)).toBe(true);
+        if (Exit.isFailure(exit)) {
+          const serialized = JSON.stringify(exit.cause);
+          expect(serialized).toContain("LegacyStartInvalidConfigError");
+          expect(serialized).toContain("failed to read TLS key");
+        }
+        expect(child.spawned.some((s) => s.args[0] === "create")).toBe(false);
+      }).pipe(Effect.provide(layer));
     });
 
-    return Effect.gen(function* () {
-      yield* legacyStart(flags());
+    it.live(
+      "brings up the stack with every optional config.toml section populated (bigquery analytics, session pool mode, passkey/webauthn, external provider, SMTP, email templates)",
+      () => {
+        // Exercises the config-document-shape branches `start.handler.ts` itself owns
+        // (`resolveGotruePasskeyWebauthn`, `resolveGotrueExternalProviders`,
+        // `buildKongEmailTemplateMounts`, `values.analyticsBackend`) in one pass, none of
+        // which interact with each other. A malformed `db.health_timeout` is exercised
+        // separately below (it now hard-fails the whole command, matching Go, so it can't
+        // be bundled into this "successful bring-up" scenario anymore).
+        const { layer, workdir, child } = setup({
+          configContents: `project_id = "demo"
+
+[analytics]
+backend = "bigquery"
+gcp_project_id = "gcp-project"
+gcp_project_number = "123456789"
+gcp_jwt_path = "gcp-key.json"
+
+[db.pooler]
+enabled = true
+pool_mode = "session"
+
+[auth.passkey]
+enabled = true
+
+[auth.webauthn]
+rp_id = "localhost"
+rp_display_name = "Test App"
+rp_origins = ["http://localhost:3000"]
+
+[auth.external.github]
+enabled = true
+client_id = "gh-client-id"
+secret = "gh-secret"
+
+[auth.email.smtp]
+enabled = true
+host = "smtp.example.com"
+port = 587
+user = "smtp-user"
+pass = "smtp-pass"
+admin_email = "admin@example.com"
+
+[auth.email.template.confirmation]
+content_path = "./templates/confirmation.html"
+
+[auth.email.notification.custom_notice]
+enabled = true
+content_path = "./templates/custom_notice.html"
+`,
+        });
+        // `Config.Validate` (step 2, before this handler's own `buildKongEmailTemplateMounts`
+        // ever runs) reads both content_path files for real — template paths resolve against
+        // the workdir itself, notification paths against `<workdir>/supabase`.
+        mkdirSync(join(workdir, "templates"), { recursive: true });
+        writeFileSync(join(workdir, "templates", "confirmation.html"), "<html></html>");
+        mkdirSync(join(workdir, "supabase", "templates"), { recursive: true });
+        writeFileSync(
+          join(workdir, "supabase", "templates", "custom_notice.html"),
+          "<html></html>",
+        );
+        return Effect.gen(function* () {
+          yield* legacyStart(flags());
+          const createdNames = createdContainerNames(child.spawned);
+          expect(createdNames.some((name) => name.includes("_pooler_"))).toBe(true);
+          expect(createdNames.some((name) => name.includes("_auth_"))).toBe(true);
+          // Go's `baseConfig.resolve` rebases a relative notification content_path against
+          // `<workdir>/supabase`, not the template base (`workdir`) — the Kong mount must read
+          // from the same file `Config.Validate` already confirmed exists.
+          const kongCreate = child.spawned.find(
+            (s) => s.args[0] === "create" && containerNameFromCreateArgs(s.args).includes("_kong_"),
+          );
+          const notificationBind = kongCreate?.args.find(
+            (arg, index) =>
+              kongCreate.args[index - 1] === "-v" && arg.includes("custom_notice_notification"),
+          );
+          expect(notificationBind).toContain(
+            join(workdir, "supabase", "templates/custom_notice.html"),
+          );
+        }).pipe(Effect.provide(layer));
+      },
+    );
+
+    it.live(
+      // Go's own backoff policy for "0s" performs exactly one immediate health
+      // probe with no retries (`internal/db/start/start.go:192-198` — the retry
+      // count is `uint64(timeout.Seconds())`, and the backoff library stops
+      // immediately at 0) — this is NOT a 30s fallback. The mock's default route
+      // heals on the very first check either way, so this only proves "0s" is
+      // accepted and doesn't hang/fail, not the exact retry count.
+      "accepts a zero db.health_timeout without hanging, and blanks webauthn fields on an empty [auth.webauthn] section",
+      () => {
+        const { layer } = setup({
+          configContents: 'project_id = "demo"\n[db]\nhealth_timeout = "0s"\n[auth.webauthn]\n',
+        });
+        return Effect.gen(function* () {
+          yield* legacyStart(flags());
+        }).pipe(Effect.provide(layer));
+      },
+    );
+
+    it.live(
+      "fails config loading on an unparseable db.health_timeout before any Docker work, matching Go's Config.Load",
+      () => {
+        // Go's Config.Load decodes db.health_timeout in the same unconditional mapstructure pass
+        // as every other duration field, before start.Run touches Docker at all — a malformed
+        // value fails before network/image/Postgres work, so Go's own rollback (only reached when
+        // run() itself fails) never even runs. Resolved eagerly here, alongside the other
+        // config-override fields, for the same reason — no containers should ever be created.
+        const { layer, child } = setup({
+          configContents: 'project_id = "demo"\n[db]\nhealth_timeout = "not-a-duration"\n',
+        });
+        return Effect.gen(function* () {
+          const exit = yield* Effect.exit(legacyStart(flags()));
+          expect(Exit.isFailure(exit)).toBe(true);
+          if (Exit.isFailure(exit)) {
+            const serialized = JSON.stringify(exit.cause);
+            expect(serialized).toContain("LegacyStartInvalidConfigError");
+            expect(serialized).toContain("failed to parse config");
+          }
+          expect(child.spawned.some((s) => s.args[0] === "create")).toBe(false);
+        }).pipe(Effect.provide(layer));
+      },
+    );
+
+    it.live(
+      "fails on an invalid storage.file_size_limit even when storage is excluded, matching Go's Config.Load",
+      () => {
+        // Go's sizeInBytes decoder rejects a malformed file_size_limit unconditionally at
+        // Config.Load, regardless of --exclude — this proves the eager validation in
+        // start.handler.ts really is unconditional, not merely earlier-but-still-gated on
+        // Storage actually running.
+        const { layer, child } = setup({
+          configContents: 'project_id = "demo"\n[storage]\nfile_size_limit = "not-a-size"\n',
+        });
+        return Effect.gen(function* () {
+          const exit = yield* Effect.exit(legacyStart(flags({ exclude: ["storage"] })));
+          expect(Exit.isFailure(exit)).toBe(true);
+          if (Exit.isFailure(exit)) {
+            const serialized = JSON.stringify(exit.cause);
+            expect(serialized).toContain("LegacyStartInvalidConfigError");
+            expect(serialized).toContain("invalid config for storage.file_size_limit");
+          }
+          expect(child.spawned.some((s) => s.args[0] === "create")).toBe(false);
+        }).pipe(Effect.provide(layer));
+      },
+    );
+
+    it.live(
+      "fails on an invalid SUPABASE_STORAGE_S3_PROTOCOL_ENABLED even when storage is excluded, matching Go's Config.Load",
+      () => {
+        // `storage.s3_protocol.enabled` is a plain bool decoded via Go's generic Viper pass in
+        // Config.Load, unconditionally — same class of gap as storage.file_size_limit above,
+        // now fixed the same way (hoisted eager wrapConfigOverride in start.handler.ts).
+        const previous = process.env["SUPABASE_STORAGE_S3_PROTOCOL_ENABLED"];
+        process.env["SUPABASE_STORAGE_S3_PROTOCOL_ENABLED"] = "not-a-bool";
+        const { layer, child } = setup();
+        return Effect.gen(function* () {
+          const exit = yield* Effect.exit(legacyStart(flags({ exclude: ["storage"] })));
+          expect(Exit.isFailure(exit)).toBe(true);
+          if (Exit.isFailure(exit)) {
+            const serialized = JSON.stringify(exit.cause);
+            expect(serialized).toContain("LegacyStartInvalidConfigError");
+            expect(serialized).toContain("invalid config for storage.s3_protocol.enabled");
+          }
+          expect(child.spawned.some((s) => s.args[0] === "create")).toBe(false);
+        }).pipe(
+          Effect.provide(layer),
+          Effect.ensuring(
+            Effect.sync(() => {
+              if (previous === undefined)
+                delete process.env["SUPABASE_STORAGE_S3_PROTOCOL_ENABLED"];
+              else process.env["SUPABASE_STORAGE_S3_PROTOCOL_ENABLED"] = previous;
+            }),
+          ),
+        );
+      },
+    );
+
+    it.live(
+      "fails on an invalid SUPABASE_STORAGE_ANALYTICS_ENABLED even when storage is excluded, matching Go's Config.Load",
+      () => {
+        // `storage.analytics.enabled` is the `Enabled` bool sibling of the
+        // max_namespaces/max_tables/max_catalogs uint fields below, decoded via Go's generic
+        // Viper pass in Config.Load, unconditionally — same class of gap as
+        // storage.s3_protocol.enabled above, now fixed the same way (hoisted eager
+        // wrapConfigOverride in start.handler.ts).
+        const previous = process.env["SUPABASE_STORAGE_ANALYTICS_ENABLED"];
+        process.env["SUPABASE_STORAGE_ANALYTICS_ENABLED"] = "not-a-bool";
+        const { layer, child } = setup();
+        return Effect.gen(function* () {
+          const exit = yield* Effect.exit(legacyStart(flags({ exclude: ["storage"] })));
+          expect(Exit.isFailure(exit)).toBe(true);
+          if (Exit.isFailure(exit)) {
+            const serialized = JSON.stringify(exit.cause);
+            expect(serialized).toContain("LegacyStartInvalidConfigError");
+            expect(serialized).toContain("invalid config for storage.analytics.enabled");
+          }
+          expect(child.spawned.some((s) => s.args[0] === "create")).toBe(false);
+        }).pipe(
+          Effect.provide(layer),
+          Effect.ensuring(
+            Effect.sync(() => {
+              if (previous === undefined) delete process.env["SUPABASE_STORAGE_ANALYTICS_ENABLED"];
+              else process.env["SUPABASE_STORAGE_ANALYTICS_ENABLED"] = previous;
+            }),
+          ),
+        );
+      },
+    );
+
+    it.live(
+      "fails on an invalid SUPABASE_STORAGE_ANALYTICS_MAX_NAMESPACES even when storage is excluded, matching Go's Config.Load",
+      () => {
+        // `storage.analytics.max_namespaces` is a plain uint decoded via Go's generic
+        // Viper/mapstructure Config.Load pass (pkg/config/storage.go:28-39), unconditionally —
+        // same class of gap as storage.s3_protocol.enabled above, now fixed the same way
+        // (hoisted eager wrapConfigOverride in start.handler.ts).
+        const previous = process.env["SUPABASE_STORAGE_ANALYTICS_MAX_NAMESPACES"];
+        process.env["SUPABASE_STORAGE_ANALYTICS_MAX_NAMESPACES"] = "not-a-uint";
+        const { layer, child } = setup();
+        return Effect.gen(function* () {
+          const exit = yield* Effect.exit(legacyStart(flags({ exclude: ["storage"] })));
+          expect(Exit.isFailure(exit)).toBe(true);
+          if (Exit.isFailure(exit)) {
+            const serialized = JSON.stringify(exit.cause);
+            expect(serialized).toContain("LegacyStartInvalidConfigError");
+            expect(serialized).toContain("invalid config for storage.analytics.max_namespaces");
+          }
+          expect(child.spawned.some((s) => s.args[0] === "create")).toBe(false);
+        }).pipe(
+          Effect.provide(layer),
+          Effect.ensuring(
+            Effect.sync(() => {
+              if (previous === undefined)
+                delete process.env["SUPABASE_STORAGE_ANALYTICS_MAX_NAMESPACES"];
+              else process.env["SUPABASE_STORAGE_ANALYTICS_MAX_NAMESPACES"] = previous;
+            }),
+          ),
+        );
+      },
+    );
+
+    it.live(
+      "fails on an invalid SUPABASE_STORAGE_ANALYTICS_MAX_TABLES even when storage is excluded, matching Go's Config.Load",
+      () => {
+        // Same gap as storage.analytics.max_namespaces above — `storage.analytics.max_tables`
+        // is decoded in the same Config.Load pass (pkg/config/storage.go:28-39).
+        const previous = process.env["SUPABASE_STORAGE_ANALYTICS_MAX_TABLES"];
+        process.env["SUPABASE_STORAGE_ANALYTICS_MAX_TABLES"] = "not-a-uint";
+        const { layer, child } = setup();
+        return Effect.gen(function* () {
+          const exit = yield* Effect.exit(legacyStart(flags({ exclude: ["storage"] })));
+          expect(Exit.isFailure(exit)).toBe(true);
+          if (Exit.isFailure(exit)) {
+            const serialized = JSON.stringify(exit.cause);
+            expect(serialized).toContain("LegacyStartInvalidConfigError");
+            expect(serialized).toContain("invalid config for storage.analytics.max_tables");
+          }
+          expect(child.spawned.some((s) => s.args[0] === "create")).toBe(false);
+        }).pipe(
+          Effect.provide(layer),
+          Effect.ensuring(
+            Effect.sync(() => {
+              if (previous === undefined)
+                delete process.env["SUPABASE_STORAGE_ANALYTICS_MAX_TABLES"];
+              else process.env["SUPABASE_STORAGE_ANALYTICS_MAX_TABLES"] = previous;
+            }),
+          ),
+        );
+      },
+    );
+
+    it.live(
+      "fails on an invalid SUPABASE_STORAGE_ANALYTICS_MAX_CATALOGS even when storage is excluded, matching Go's Config.Load",
+      () => {
+        // Same gap as storage.analytics.max_namespaces above — `storage.analytics.max_catalogs`
+        // is decoded in the same Config.Load pass (pkg/config/storage.go:28-39).
+        const previous = process.env["SUPABASE_STORAGE_ANALYTICS_MAX_CATALOGS"];
+        process.env["SUPABASE_STORAGE_ANALYTICS_MAX_CATALOGS"] = "not-a-uint";
+        const { layer, child } = setup();
+        return Effect.gen(function* () {
+          const exit = yield* Effect.exit(legacyStart(flags({ exclude: ["storage"] })));
+          expect(Exit.isFailure(exit)).toBe(true);
+          if (Exit.isFailure(exit)) {
+            const serialized = JSON.stringify(exit.cause);
+            expect(serialized).toContain("LegacyStartInvalidConfigError");
+            expect(serialized).toContain("invalid config for storage.analytics.max_catalogs");
+          }
+          expect(child.spawned.some((s) => s.args[0] === "create")).toBe(false);
+        }).pipe(
+          Effect.provide(layer),
+          Effect.ensuring(
+            Effect.sync(() => {
+              if (previous === undefined)
+                delete process.env["SUPABASE_STORAGE_ANALYTICS_MAX_CATALOGS"];
+              else process.env["SUPABASE_STORAGE_ANALYTICS_MAX_CATALOGS"] = previous;
+            }),
+          ),
+        );
+      },
+    );
+
+    it.live(
+      "fails on an invalid SUPABASE_STORAGE_VECTOR_MAX_BUCKETS even when storage is excluded, matching Go's Config.Load",
+      () => {
+        // `storage.vector.max_buckets` is a plain uint decoded in the same Config.Load pass as
+        // storage.analytics.* above (pkg/config/storage.go:28-39), unconditionally.
+        const previous = process.env["SUPABASE_STORAGE_VECTOR_MAX_BUCKETS"];
+        process.env["SUPABASE_STORAGE_VECTOR_MAX_BUCKETS"] = "not-a-uint";
+        const { layer, child } = setup();
+        return Effect.gen(function* () {
+          const exit = yield* Effect.exit(legacyStart(flags({ exclude: ["storage"] })));
+          expect(Exit.isFailure(exit)).toBe(true);
+          if (Exit.isFailure(exit)) {
+            const serialized = JSON.stringify(exit.cause);
+            expect(serialized).toContain("LegacyStartInvalidConfigError");
+            expect(serialized).toContain("invalid config for storage.vector.max_buckets");
+          }
+          expect(child.spawned.some((s) => s.args[0] === "create")).toBe(false);
+        }).pipe(
+          Effect.provide(layer),
+          Effect.ensuring(
+            Effect.sync(() => {
+              if (previous === undefined) delete process.env["SUPABASE_STORAGE_VECTOR_MAX_BUCKETS"];
+              else process.env["SUPABASE_STORAGE_VECTOR_MAX_BUCKETS"] = previous;
+            }),
+          ),
+        );
+      },
+    );
+
+    it.live(
+      "fails on an invalid SUPABASE_STORAGE_VECTOR_MAX_INDEXES even when storage is excluded, matching Go's Config.Load",
+      () => {
+        // `storage.vector.max_indexes` is a plain uint decoded in the same Config.Load pass as
+        // storage.vector.max_buckets above (pkg/config/storage.go:28-39), unconditionally.
+        const previous = process.env["SUPABASE_STORAGE_VECTOR_MAX_INDEXES"];
+        process.env["SUPABASE_STORAGE_VECTOR_MAX_INDEXES"] = "not-a-uint";
+        const { layer, child } = setup();
+        return Effect.gen(function* () {
+          const exit = yield* Effect.exit(legacyStart(flags({ exclude: ["storage"] })));
+          expect(Exit.isFailure(exit)).toBe(true);
+          if (Exit.isFailure(exit)) {
+            const serialized = JSON.stringify(exit.cause);
+            expect(serialized).toContain("LegacyStartInvalidConfigError");
+            expect(serialized).toContain("invalid config for storage.vector.max_indexes");
+          }
+          expect(child.spawned.some((s) => s.args[0] === "create")).toBe(false);
+        }).pipe(
+          Effect.provide(layer),
+          Effect.ensuring(
+            Effect.sync(() => {
+              if (previous === undefined) delete process.env["SUPABASE_STORAGE_VECTOR_MAX_INDEXES"];
+              else process.env["SUPABASE_STORAGE_VECTOR_MAX_INDEXES"] = previous;
+            }),
+          ),
+        );
+      },
+    );
+
+    it.live(
+      "fails on an invalid auth.sms.max_frequency even when auth is disabled, matching Go's Config.Load",
+      () => {
+        // Go's Config.Load decodes every GoTrue duration field unconditionally, regardless of
+        // auth.enabled — proving the eager validation covers fields beyond auth.email.max_frequency
+        // and really is independent of whether GoTrue's own spec builder ever runs.
+        const { layer, child } = setup({
+          configContents:
+            'project_id = "demo"\n[auth]\nenabled = false\n[auth.sms]\nmax_frequency = "not-a-duration"\n',
+        });
+        return Effect.gen(function* () {
+          const exit = yield* Effect.exit(legacyStart(flags()));
+          expect(Exit.isFailure(exit)).toBe(true);
+          if (Exit.isFailure(exit)) {
+            const serialized = JSON.stringify(exit.cause);
+            expect(serialized).toContain("LegacyStartInvalidConfigError");
+            expect(serialized).toContain("invalid config for auth.sms.max_frequency");
+          }
+          expect(child.spawned.some((s) => s.args[0] === "create")).toBe(false);
+        }).pipe(Effect.provide(layer));
+      },
+    );
+
+    it.live(
+      "fails on an invalid SUPABASE_AUTH_RATE_LIMIT_ANONYMOUS_USERS even when auth is disabled, matching Go's Config.Load",
+      () => {
+        // `auth.rate_limit.*` are plain uints decoded unconditionally in Go's Config.Load
+        // (pkg/config/auth.go:200-208) — `resolveGotrueRateLimit` only throws via an env var
+        // override (a bad TOML value is caught by @supabase/config's own schema first), so this
+        // models the override directly, same as the storage.s3_protocol.enabled test above.
+        const previous = process.env["SUPABASE_AUTH_RATE_LIMIT_ANONYMOUS_USERS"];
+        process.env["SUPABASE_AUTH_RATE_LIMIT_ANONYMOUS_USERS"] = "not-a-uint";
+        const { layer, child } = setup({
+          configContents: 'project_id = "demo"\n[auth]\nenabled = false\n',
+        });
+        return Effect.gen(function* () {
+          const exit = yield* Effect.exit(legacyStart(flags()));
+          expect(Exit.isFailure(exit)).toBe(true);
+          if (Exit.isFailure(exit)) {
+            const serialized = JSON.stringify(exit.cause);
+            expect(serialized).toContain("LegacyStartInvalidConfigError");
+            expect(serialized).toContain("invalid config for auth.rate_limit");
+          }
+          expect(child.spawned.some((s) => s.args[0] === "create")).toBe(false);
+        }).pipe(
+          Effect.provide(layer),
+          Effect.ensuring(
+            Effect.sync(() => {
+              if (previous === undefined)
+                delete process.env["SUPABASE_AUTH_RATE_LIMIT_ANONYMOUS_USERS"];
+              else process.env["SUPABASE_AUTH_RATE_LIMIT_ANONYMOUS_USERS"] = previous;
+            }),
+          ),
+        );
+      },
+    );
+
+    it.live(
+      "fails on an invalid SUPABASE_AUTH_WEB3_SOLANA_ENABLED even when auth is disabled, matching Go's Config.Load",
+      () => {
+        // `auth.web3.*.enabled` are plain bools decoded unconditionally in Go's Config.Load
+        // (pkg/config/auth.go:379-382) — same override-only-throw reasoning as the rate_limit
+        // test above.
+        const previous = process.env["SUPABASE_AUTH_WEB3_SOLANA_ENABLED"];
+        process.env["SUPABASE_AUTH_WEB3_SOLANA_ENABLED"] = "not-a-bool";
+        const { layer, child } = setup({
+          configContents: 'project_id = "demo"\n[auth]\nenabled = false\n',
+        });
+        return Effect.gen(function* () {
+          const exit = yield* Effect.exit(legacyStart(flags()));
+          expect(Exit.isFailure(exit)).toBe(true);
+          if (Exit.isFailure(exit)) {
+            const serialized = JSON.stringify(exit.cause);
+            expect(serialized).toContain("LegacyStartInvalidConfigError");
+            expect(serialized).toContain("invalid config for auth.web3");
+          }
+          expect(child.spawned.some((s) => s.args[0] === "create")).toBe(false);
+        }).pipe(
+          Effect.provide(layer),
+          Effect.ensuring(
+            Effect.sync(() => {
+              if (previous === undefined) delete process.env["SUPABASE_AUTH_WEB3_SOLANA_ENABLED"];
+              else process.env["SUPABASE_AUTH_WEB3_SOLANA_ENABLED"] = previous;
+            }),
+          ),
+        );
+      },
+    );
+
+    it.live(
+      "fails on an invalid SUPABASE_AUTH_OAUTH_SERVER_ENABLED even when auth is disabled, matching Go's Config.Load",
+      () => {
+        // `auth.oauth_server.enabled`/`allow_dynamic_registration` are plain bools decoded
+        // unconditionally in Go's Config.Load (pkg/config/auth.go:394-398) — same
+        // override-only-throw reasoning as the two tests above.
+        const previous = process.env["SUPABASE_AUTH_OAUTH_SERVER_ENABLED"];
+        process.env["SUPABASE_AUTH_OAUTH_SERVER_ENABLED"] = "not-a-bool";
+        const { layer, child } = setup({
+          configContents: 'project_id = "demo"\n[auth]\nenabled = false\n',
+        });
+        return Effect.gen(function* () {
+          const exit = yield* Effect.exit(legacyStart(flags()));
+          expect(Exit.isFailure(exit)).toBe(true);
+          if (Exit.isFailure(exit)) {
+            const serialized = JSON.stringify(exit.cause);
+            expect(serialized).toContain("LegacyStartInvalidConfigError");
+            expect(serialized).toContain("invalid config for auth.oauth_server");
+          }
+          expect(child.spawned.some((s) => s.args[0] === "create")).toBe(false);
+        }).pipe(
+          Effect.provide(layer),
+          Effect.ensuring(
+            Effect.sync(() => {
+              if (previous === undefined) delete process.env["SUPABASE_AUTH_OAUTH_SERVER_ENABLED"];
+              else process.env["SUPABASE_AUTH_OAUTH_SERVER_ENABLED"] = previous;
+            }),
+          ),
+        );
+      },
+    );
+
+    it.live(
+      "fails on an invalid auth.passkey.enabled even when auth is disabled, matching Go's Config.Load",
+      () => {
+        // `auth.passkey`/`auth.webauthn` have no `@supabase/config` schema at all — Go decodes
+        // `auth.passkey.enabled` unconditionally in Config.Load (pkg/config/auth.go:384-386) via
+        // `resolveGotruePasskeyWebauthn`'s raw-document read, same override-only-throw reasoning as
+        // the web3/oauth_server tests above, except the malformed value lives directly in
+        // config.toml here since `@supabase/config` never sees (or rejects) this unmodeled field —
+        // there's no schema-level bool coercion to catch it first.
+        const { layer, child } = setup({
+          configContents:
+            'project_id = "demo"\n[auth]\nenabled = false\n[auth.passkey]\nenabled = "bad"\n',
+        });
+        return Effect.gen(function* () {
+          const exit = yield* Effect.exit(legacyStart(flags()));
+          expect(Exit.isFailure(exit)).toBe(true);
+          if (Exit.isFailure(exit)) {
+            const serialized = JSON.stringify(exit.cause);
+            expect(serialized).toContain("LegacyStartInvalidConfigError");
+            expect(serialized).toContain("invalid config for auth.passkey");
+          }
+          expect(child.spawned.some((s) => s.args[0] === "create")).toBe(false);
+        }).pipe(Effect.provide(layer));
+      },
+    );
+
+    it.live(
+      "fails on an invalid auth.external.<custom>.enabled even when auth is disabled, matching Go's Config.Load",
+      () => {
+        // `auth.external` is a genuine Go `map[string]provider` (auth.go:190) — an unmodeled/
+        // custom provider name like `custom` is a legitimate config shape `@supabase/config`'s
+        // schema silently drops at decode time (see the "custom auth.external providers" describe
+        // block below for the accepted-value counterpart), so
+        // `legacyResolveAuthExternalProviders`'s raw-document read is the only place this malformed
+        // value is ever seen — same override-only-throw reasoning as the passkey test above.
+        const { layer, child } = setup({
+          configContents:
+            'project_id = "demo"\n[auth]\nenabled = false\n[auth.external.custom]\nenabled = "bad"\n',
+        });
+        return Effect.gen(function* () {
+          const exit = yield* Effect.exit(legacyStart(flags()));
+          expect(Exit.isFailure(exit)).toBe(true);
+          if (Exit.isFailure(exit)) {
+            const serialized = JSON.stringify(exit.cause);
+            expect(serialized).toContain("LegacyStartInvalidConfigError");
+            expect(serialized).toContain("invalid config for auth.external");
+          }
+          expect(child.spawned.some((s) => s.args[0] === "create")).toBe(false);
+        }).pipe(Effect.provide(layer));
+      },
+    );
+
+    it.live(
+      "fails on a per-function env field, matching Go's Config.Load rejecting an unknown functions[slug] key",
+      () => {
+        // Go's `function` struct (pkg/config/config.go:290-296) has no `env` field — `Config.Load`'s
+        // `v.UnmarshalExact` (ErrorUnused: true) rejects it unconditionally, before any Docker
+        // work. Empirically confirmed against the real Go binary: `'functions[foo]' has invalid
+        // keys: env`. `@supabase/config`'s own schema DOES model `[functions.<slug>.env]` (a
+        // legitimate next/-only feature), so this must be a legacy-only rejection.
+        const { layer, child } = setup({
+          configContents:
+            'project_id = "demo"\n[functions.foo]\nenabled = true\n[functions.foo.env]\nFOO = "env(SOME_VAR)"\n',
+        });
+        return Effect.gen(function* () {
+          const exit = yield* Effect.exit(legacyStart(flags()));
+          expect(Exit.isFailure(exit)).toBe(true);
+          if (Exit.isFailure(exit)) {
+            const serialized = JSON.stringify(exit.cause);
+            expect(serialized).toContain("LegacyStartInvalidConfigError");
+            expect(serialized).toContain("'functions[foo]' has invalid keys: env");
+          }
+          expect(child.spawned.some((s) => s.args[0] === "create")).toBe(false);
+        }).pipe(Effect.provide(layer));
+      },
+    );
+
+    it.live(
+      "fails on an invalid SUPABASE_EDGE_RUNTIME_POLICY even when edge-runtime is excluded, matching Go's Config.Load",
+      () => {
+        // `edge_runtime.policy` is a strict enum in @supabase/config's schema, so a bad TOML
+        // value is already rejected at config load, before start.handler.ts runs — only the env
+        // var override path (a plain string, unchecked by the schema) can reach
+        // `legacyEnvOverrideEdgeRuntimePolicy`'s own throw, same reasoning as the GoTrue
+        // override-only tests above.
+        const previous = process.env["SUPABASE_EDGE_RUNTIME_POLICY"];
+        process.env["SUPABASE_EDGE_RUNTIME_POLICY"] = "not-a-policy";
+        const { layer, child } = setup();
+        return Effect.gen(function* () {
+          const exit = yield* Effect.exit(legacyStart(flags({ exclude: ["edge-runtime"] })));
+          expect(Exit.isFailure(exit)).toBe(true);
+          if (Exit.isFailure(exit)) {
+            const serialized = JSON.stringify(exit.cause);
+            expect(serialized).toContain("LegacyStartInvalidConfigError");
+            expect(serialized).toContain("invalid config for edge_runtime.policy");
+          }
+          expect(child.spawned.some((s) => s.args[0] === "create")).toBe(false);
+        }).pipe(
+          Effect.provide(layer),
+          Effect.ensuring(
+            Effect.sync(() => {
+              if (previous === undefined) delete process.env["SUPABASE_EDGE_RUNTIME_POLICY"];
+              else process.env["SUPABASE_EDGE_RUNTIME_POLICY"] = previous;
+            }),
+          ),
+        );
+      },
+    );
+
+    it.live(
+      "fails on an invalid SUPABASE_EDGE_RUNTIME_INSPECTOR_PORT even when edge-runtime is excluded, matching Go's Config.Load",
+      () => {
+        // `edge_runtime.inspector_port` is a plain number in @supabase/config's schema, so a bad
+        // TOML value is already rejected at config load — only the env var override path (a
+        // string parsed by `envOverridePort`) can throw here, same reasoning as the policy test
+        // above.
+        const previous = process.env["SUPABASE_EDGE_RUNTIME_INSPECTOR_PORT"];
+        process.env["SUPABASE_EDGE_RUNTIME_INSPECTOR_PORT"] = "not-a-port";
+        const { layer, child } = setup();
+        return Effect.gen(function* () {
+          const exit = yield* Effect.exit(legacyStart(flags({ exclude: ["edge-runtime"] })));
+          expect(Exit.isFailure(exit)).toBe(true);
+          if (Exit.isFailure(exit)) {
+            const serialized = JSON.stringify(exit.cause);
+            expect(serialized).toContain("LegacyStartInvalidConfigError");
+            expect(serialized).toContain("invalid config for edge_runtime.inspector_port");
+          }
+          expect(child.spawned.some((s) => s.args[0] === "create")).toBe(false);
+        }).pipe(
+          Effect.provide(layer),
+          Effect.ensuring(
+            Effect.sync(() => {
+              if (previous === undefined)
+                delete process.env["SUPABASE_EDGE_RUNTIME_INSPECTOR_PORT"];
+              else process.env["SUPABASE_EDGE_RUNTIME_INSPECTOR_PORT"] = previous;
+            }),
+          ),
+        );
+      },
+    );
+
+    it.live(
+      "warns about a Windows npipe Docker daemon before starting Vector, in text mode, and excludes it from the health watch list",
+      () => {
+        // `legacyResolveDockerDaemonHost` checks `DOCKER_HOST` before ever shelling out to
+        // `docker context inspect`, so setting it directly is a reliable way to force the
+        // npipe branch without needing a real Windows Docker Desktop context.
+        const previousDockerHost = process.env["DOCKER_HOST"];
+        process.env["DOCKER_HOST"] = "npipe:////./pipe/docker_engine";
+        const { layer, out } = setup();
+        return Effect.gen(function* () {
+          yield* legacyStart(flags());
+          expect(out.stderrText).toContain(
+            "Analytics on Windows requires Docker daemon exposed on tcp://localhost:2375.",
+          );
+          expect(out.stderrText).toContain("Started");
+        }).pipe(
+          Effect.provide(layer),
+          Effect.ensuring(
+            Effect.sync(() => {
+              if (previousDockerHost === undefined) delete process.env["DOCKER_HOST"];
+              else process.env["DOCKER_HOST"] = previousDockerHost;
+            }),
+          ),
+        );
+      },
+    );
+  });
+
+  describe("service gating", () => {
+    it.live(
+      "skips analytics services (logflare + vector) together when analytics.enabled = false",
+      () => {
+        const { layer, child } = setup({
+          configContents: 'project_id = "demo"\n[analytics]\nenabled = false\n',
+        });
+        return Effect.gen(function* () {
+          yield* legacyStart(flags());
+          const createdNames = createdContainerNames(child.spawned);
+          expect(createdNames.some((name) => name.includes("_analytics_"))).toBe(false);
+          expect(createdNames.some((name) => name.includes("_vector_"))).toBe(false);
+          expect(createdNames.some((name) => name.includes("_kong_"))).toBe(true);
+          expect(createdNames.some((name) => name.includes("_auth_"))).toBe(true);
+          expect(createdNames.some((name) => name.includes("_storage_"))).toBe(true);
+          expect(createdNames.some((name) => name.includes("_studio_"))).toBe(true);
+        }).pipe(Effect.provide(layer));
+      },
+    );
+
+    it.live(
+      "skips storage and imgproxy together when storage.enabled = false, even with image_transformation on",
+      () => {
+        // ImgProxy mounts Storage's own volumes (`start.gates.ts`'s `imgproxy: storage && ...`
+        // dependency) — disabling storage must take ImgProxy down with it, even though
+        // `storage.image_transformation.enabled` on its own would otherwise turn ImgProxy on.
+        const { layer, child } = setup({
+          configContents:
+            'project_id = "demo"\n[storage]\nenabled = false\n[storage.image_transformation]\nenabled = true\n',
+        });
+        return Effect.gen(function* () {
+          yield* legacyStart(flags());
+          const createdNames = createdContainerNames(child.spawned);
+          expect(createdNames.some((name) => name.includes("_storage_"))).toBe(false);
+          expect(createdNames.some((name) => name.includes("_imgproxy_"))).toBe(false);
+          expect(createdNames.some((name) => name.includes("_kong_"))).toBe(true);
+        }).pipe(Effect.provide(layer));
+      },
+    );
+
+    it.live(
+      "ignores SUPABASE_STORAGE_IMAGE_TRANSFORMATION_ENABLED when [storage.image_transformation] is absent from config.toml",
+      () => {
+        // Go's `Storage.ImageTransformation` is a nil-unless-declared pointer
+        // (`pkg/config/storage.go:16`) — with no `[storage.image_transformation]` table, the env
+        // var is never even looked up (`start.go:302-303`'s `!= nil && .Enabled` gate), so ImgProxy
+        // must stay off even though storage itself is enabled.
+        const previous = process.env["SUPABASE_STORAGE_IMAGE_TRANSFORMATION_ENABLED"];
+        process.env["SUPABASE_STORAGE_IMAGE_TRANSFORMATION_ENABLED"] = "true";
+        const { layer, child } = setup();
+        return Effect.gen(function* () {
+          yield* legacyStart(flags());
+          const createdNames = createdContainerNames(child.spawned);
+          expect(createdNames.some((name) => name.includes("_storage_"))).toBe(true);
+          expect(createdNames.some((name) => name.includes("_imgproxy_"))).toBe(false);
+        }).pipe(
+          Effect.provide(layer),
+          Effect.ensuring(
+            Effect.sync(() => {
+              if (previous === undefined) {
+                delete process.env["SUPABASE_STORAGE_IMAGE_TRANSFORMATION_ENABLED"];
+              } else {
+                process.env["SUPABASE_STORAGE_IMAGE_TRANSFORMATION_ENABLED"] = previous;
+              }
+            }),
+          ),
+        );
+      },
+    );
+
+    it.live(
+      "starts Kong and Realtime even when api.enabled is false, since only Postgrest depends on it",
+      () => {
+        const { layer, child } = setup({
+          configContents: 'project_id = "demo"\n[api]\nenabled = false\n',
+          httpClientLayer: unusedHttpClientLayer,
+        });
+        return Effect.gen(function* () {
+          // `edge-runtime` excluded so its own HTTP readiness probe never reaches
+          // `unusedHttpClientLayer` — this scenario is only about Postgrest/Kong/
+          // Realtime's `api.enabled` independence.
+          yield* legacyStart(flags({ exclude: ["edge-runtime"] }));
+          const createdNames = createdContainerNames(child.spawned);
+          expect(createdNames.some((name) => name.includes("_kong_"))).toBe(true);
+          expect(createdNames.some((name) => name.includes("_realtime_"))).toBe(true);
+          expect(createdNames.some((name) => name.includes("_rest_"))).toBe(false);
+        }).pipe(Effect.provide(layer));
+      },
+    );
+
+    it.live(
+      "excluding a single --exclude key skips exactly that container and starts every other excludable service",
+      () => {
+        expect(new Set(LEGACY_START_EXCLUDABLE_KEYS)).toEqual(
+          new Set(Object.keys(CONTAINER_SUFFIX_BY_EXCLUDE_KEY)),
+        );
+
+        return Effect.gen(function* () {
+          for (const excludeKey of LEGACY_START_EXCLUDABLE_KEYS) {
+            const { layer, child } = setup({
+              configContents:
+                'project_id = "demo"\n[storage.image_transformation]\nenabled = true\n[db.pooler]\nenabled = true\n',
+            });
+            yield* legacyStart(flags({ exclude: [excludeKey] })).pipe(Effect.provide(layer));
 
-      expect(s.execCaptureCalls).toEqual([
-        { args: ["start"], stdin: "inherit" },
-        { args: ["status", "--output", "json"], env: helperStatusEnv },
-      ]);
-      expect(s.execCalls).toEqual([]);
-      expect(s.out.events).toEqual([
-        expect.objectContaining({
-          type: "result",
-          data: { API_URL: "http://127.0.0.1:54321" },
-        }),
-      ]);
-    }).pipe(Effect.provide(s.layer));
+            const createdNames = createdContainerNames(child.spawned);
+            expect(
+              createdNames.filter((name) => name.includes("_db_")),
+              excludeKey,
+            ).toHaveLength(1);
+            const missing = missingSuffixesForExcludeKey(excludeKey);
+            for (const suffix of ALL_EXCLUDABLE_SUFFIXES) {
+              const shouldExist = !missing.includes(suffix);
+              const actuallyExists = createdNames.some((name) => name.includes(`_${suffix}_`));
+              expect(actuallyExists, `excludeKey=${excludeKey} suffix=${suffix}`).toBe(shouldExist);
+            }
+          }
+        });
+      },
+      15_000,
+    );
   });
 
-  it.live("lets --output pretty win over --output-format json", () => {
-    const s = setup({ format: "json", goOutput: "pretty" });
+  describe("fresh volume: DB setup + bucket seeding", () => {
+    /** The three PG15+ one-shot migrate jobs (`legacyStartSetupLocalDatabase`'s `LegacyDockerRun` calls) — a plain `docker run --rm ...`, never `-d`, distinct from Edge Runtime's own detached `docker run -d`. */
+    function dbSetupJobCalls(spawned: ReadonlyArray<SpawnRecord>): ReadonlyArray<SpawnRecord> {
+      return spawned.filter((s) => s.args[0] === "run" && s.args[1] === "--rm");
+    }
+
+    it.live(
+      "triggers the SetupLocalDatabase-equivalent pipeline (PG15+ one-shot migrate jobs) on a fresh volume",
+      () => {
+        const { layer, out, child } = setup({ route: freshVolumeRoute(defaultRoute()) });
+        return Effect.gen(function* () {
+          // Excludes edge-runtime to keep this scenario focused on the fresh-volume
+          // DB-setup path only.
+          yield* legacyStart(flags({ exclude: ["edge-runtime"] }));
+          expect(out.stderrText).toContain("Initialising schema...");
+          // Default config: realtime, storage, and auth are all enabled.
+          expect(dbSetupJobCalls(child.spawned)).toHaveLength(3);
+        }).pipe(Effect.provide(layer));
+      },
+    );
+
+    it.live(
+      "resolves an excluded service's migrate-job image through a project-dotenv-only registry override",
+      () => {
+        // The auth/realtime/storage migrate jobs run regardless of `--exclude` (Go parity —
+        // see this describe block's own header comment), but `--exclude gotrue` removes the
+        // gotrue image from `imagePlan`, which used to make its migrate-job image fall back to
+        // `LegacyDockerRun`'s ambient-`process.env`-only registry resolver — invisible to a
+        // registry override that only exists in the project's own `.env` file.
+        const workdir = tempRoot.current;
+        const { layer, child } = setup({ route: freshVolumeRoute(defaultRoute()) });
+        // `loadProjectEnvironment`'s `envPath` is `<workdir>/supabase/.env` (`findProjectPaths`),
+        // written after `setup()` so the `supabase/` dir (created by `writeConfig`) already exists.
+        writeFileSync(
+          join(workdir, "supabase", ".env"),
+          "SUPABASE_INTERNAL_IMAGE_REGISTRY=registry.example.com\n",
+        );
+        return Effect.gen(function* () {
+          yield* legacyStart(flags({ exclude: ["gotrue"] }));
+          expect(dbSetupJobCalls(child.spawned)).toHaveLength(3);
+          const authMigrateJob = dbSetupJobCalls(child.spawned).find((s) =>
+            s.args.some((arg) => arg.includes("gotrue")),
+          );
+          expect(authMigrateJob?.args.some((arg) => arg.includes("registry.example.com"))).toBe(
+            true,
+          );
+        }).pipe(Effect.provide(layer));
+      },
+    );
+
+    it.live(
+      "does not attempt to resolve an excluded service's migrate-job image on a non-fresh-volume restart",
+      () => {
+        // Go's own pre-pull (`ensureImagesCached`, `start.go:237-262`) only ever touches
+        // non-excluded services, and the one-shot setup-job images are resolved lazily,
+        // only from inside `initSchema15` when it actually runs — a fresh volume AND
+        // PG15+. On an ordinary restart (this test's default, non-fresh-volume setup),
+        // `--exclude storage-api` must not even attempt to resolve Storage's image, or an
+        // unavailable/rate-limited Storage image would fail `start` even though nothing
+        // in this run needs it.
+        const base = defaultRoute();
+        const route = (args: ReadonlyArray<string>): RouteResult => {
+          const targetsStorageImage =
+            (args[0] === "image" && args[1] === "inspect" && args[2]?.includes("storage-api")) ===
+              true ||
+            (args[0] === "pull" && args[1]?.includes("storage-api") === true);
+          if (targetsStorageImage) {
+            return { exitCode: 1, stderr: ["Error: toomanyrequests: rate limit exceeded"] };
+          }
+          return base(args);
+        };
+        const { layer, child } = setup({ route });
+        return Effect.gen(function* () {
+          yield* legacyStart(flags({ exclude: ["storage-api"] }));
+          const createdNames = createdContainerNames(child.spawned);
+          expect(createdNames.some((name) => name.includes("_storage_"))).toBe(false);
+          expect(createdNames.some((name) => name.includes("_kong_"))).toBe(true);
+        }).pipe(Effect.provide(layer));
+      },
+    );
+
+    it.live("skips the SetupLocalDatabase-equivalent pipeline on a non-fresh volume", () => {
+      const { layer, out, child } = setup();
+      return Effect.gen(function* () {
+        yield* legacyStart(flags({ exclude: ["edge-runtime"] }));
+        expect(out.stderrText).not.toContain("Initialising schema...");
+        expect(dbSetupJobCalls(child.spawned)).toHaveLength(0);
+      }).pipe(Effect.provide(layer));
+    });
+
+    it.live(
+      "fails on an undecryptable [db.vault] secret even on a non-fresh volume, matching Go's Config.Load",
+      () => {
+        // `legacyCheckDbToml`'s own internal call inside `legacyStartSetupLocalDatabase` only
+        // runs on a fresh volume (Go's `NoBackupVolume` gate) — an undecryptable `[db.vault]`
+        // secret (a DB-specific field `@supabase/config`'s own schema never decrypts, only
+        // `legacyCheckDbToml`'s pipeline does) must still fail eagerly, before any Docker work,
+        // on an ordinary restart against an existing (non-fresh) volume, matching Go's
+        // `Config.Load`, which decrypts every `encrypted:` value unconditionally regardless of
+        // volume state.
+        const previous = process.env["DOTENV_PRIVATE_KEY"];
+        delete process.env["DOTENV_PRIVATE_KEY"];
+        const encrypted =
+          "encrypted:BKiXH15AyRzeohGyUrmB6cGjSklCrrBjdesQlX1VcXo/Xp20Bi2gGZ3AlIqxPQDmjVAALnhZamKnuY73l8Dz1P+BYiZUgxTSLzdCvdYUyVbNekj2UudbdUizBViERtZkuQwZHIv/";
+        const { layer, child } = setup({
+          configContents: `project_id = "demo"\n[db.vault]\nmy_secret = "${encrypted}"\n`,
+        });
+        return Effect.gen(function* () {
+          const exit = yield* Effect.exit(legacyStart(flags()));
+          expect(Exit.isFailure(exit)).toBe(true);
+          if (Exit.isFailure(exit)) {
+            const serialized = JSON.stringify(exit.cause);
+            expect(serialized).toContain("failed to parse config: missing private key");
+          }
+          expect(child.spawned.some((s) => s.args[0] === "create")).toBe(false);
+        }).pipe(
+          Effect.provide(layer),
+          Effect.ensuring(
+            Effect.sync(() => {
+              if (previous === undefined) delete process.env["DOTENV_PRIVATE_KEY"];
+              else process.env["DOTENV_PRIVATE_KEY"] = previous;
+            }),
+          ),
+        );
+      },
+    );
+
+    it.live(
+      "fails on a bucket's invalid file_size_limit even on a non-fresh volume, matching Go's Config.Load",
+      () => {
+        // Same class of gap as the `[db.vault]` test above: the per-bucket `file_size_limit`
+        // (Go's same `sizeInBytes` decode hook as the storage-level default) was previously only
+        // parsed deep inside `legacySeedBucketsRun`, reached only on a fresh volume with Storage
+        // actually seeding — a malformed value on an ordinary restart against an existing
+        // (non-fresh) volume went completely unvalidated. `legacyCheckDbToml` now catches it
+        // eagerly, before any Docker work, regardless of volume state.
+        const { layer, child } = setup({
+          configContents:
+            'project_id = "demo"\n[storage.buckets.avatars]\nfile_size_limit = "bogus"\n',
+        });
+        return Effect.gen(function* () {
+          const exit = yield* Effect.exit(legacyStart(flags()));
+          expect(Exit.isFailure(exit)).toBe(true);
+          if (Exit.isFailure(exit)) {
+            const serialized = JSON.stringify(exit.cause);
+            expect(serialized).toContain("LegacyDbConfigLoadError");
+            expect(serialized).toContain(
+              "failed to parse config: invalid storage.buckets.avatars.file_size_limit.",
+            );
+          }
+          expect(child.spawned.some((s) => s.args[0] === "create")).toBe(false);
+        }).pipe(Effect.provide(layer));
+      },
+    );
+
+    it.live('prints "Starting database..." on a fresh volume, before Postgres is created', () => {
+      const { layer, out } = setup({ route: freshVolumeRoute(defaultRoute()) });
+      return Effect.gen(function* () {
+        yield* legacyStart(flags({ exclude: ["edge-runtime"] }));
+        expect(out.stderrText).toContain("Starting database...\n");
+        expect(out.stderrText).not.toContain("Starting database from backup...");
+        expect(out.stderrText.indexOf("Starting database...\n")).toBeLessThan(
+          out.stderrText.indexOf("Initialising schema..."),
+        );
+      }).pipe(Effect.provide(layer));
+    });
+
+    it.live(
+      'prints "Starting database from backup..." on a restart (an already-existing volume)',
+      () => {
+        const { layer, out } = setup();
+        return Effect.gen(function* () {
+          yield* legacyStart(flags({ exclude: ["edge-runtime"] }));
+          expect(out.stderrText).toContain("Starting database from backup...\n");
+          expect(out.stderrText).not.toContain("Starting database...\n");
+        }).pipe(Effect.provide(layer));
+      },
+    );
+
+    it.live(
+      "still writes supabase/.branches/_current_branch on a restart, even though the fresh-volume DB setup is skipped",
+      () => {
+        const { layer, workdir } = setup();
+        return Effect.gen(function* () {
+          yield* legacyStart(flags({ exclude: ["edge-runtime"] }));
+          const content = readFileSync(
+            join(workdir, "supabase", ".branches", "_current_branch"),
+            "utf8",
+          );
+          expect(content).toBe("main");
+        }).pipe(Effect.provide(layer));
+      },
+    );
+
+    it.live("seeds a configured bucket on a fresh volume with storage enabled", () => {
+      const http = mockStorageBucketHttpClient();
+      const { layer } = setup({
+        configContents: 'project_id = "demo"\n[storage.buckets.avatars]\npublic = false\n',
+        route: freshVolumeRoute(defaultRoute()),
+        httpClientLayer: http.layer,
+      });
+      return Effect.gen(function* () {
+        yield* legacyStart(flags({ exclude: ["edge-runtime"] }));
+        expect(http.createdBucketRequests).toHaveLength(1);
+      }).pipe(Effect.provide(layer));
+    });
+
+    it.live(
+      "does not seed a configured bucket on a non-fresh volume, even with storage enabled",
+      () => {
+        const http = mockStorageBucketHttpClient();
+        const { layer } = setup({
+          configContents: 'project_id = "demo"\n[storage.buckets.avatars]\npublic = false\n',
+          httpClientLayer: http.layer,
+        });
+        return Effect.gen(function* () {
+          yield* legacyStart(flags({ exclude: ["edge-runtime"] }));
+          expect(http.createdBucketRequests).toHaveLength(0);
+        }).pipe(Effect.provide(layer));
+      },
+    );
+
+    it.live(
+      "seeds against the env-overridden SUPABASE_API_PORT, not config.toml's raw port",
+      () => {
+        // legacySeedBucketsRun previously reloaded config.toml independently instead of
+        // reusing start's own already env-overridden config, so a SUPABASE_API_PORT
+        // override that actually brought Kong up on a different port never reached
+        // the bucket-seeding gateway's base URL.
+        const previous = process.env["SUPABASE_API_PORT"];
+        process.env["SUPABASE_API_PORT"] = "65432";
+        const http = mockStorageBucketHttpClient();
+        const { layer } = setup({
+          configContents: 'project_id = "demo"\n[storage.buckets.avatars]\npublic = false\n',
+          route: freshVolumeRoute(defaultRoute()),
+          httpClientLayer: http.layer,
+        });
+        return Effect.gen(function* () {
+          yield* legacyStart(flags({ exclude: ["edge-runtime"] }));
+          expect(http.createdBucketRequests).toHaveLength(1);
+          expect(http.createdBucketRequests[0]).toContain(":65432/");
+        }).pipe(
+          Effect.provide(layer),
+          Effect.ensuring(
+            Effect.sync(() => {
+              if (previous === undefined) delete process.env["SUPABASE_API_PORT"];
+              else process.env["SUPABASE_API_PORT"] = previous;
+            }),
+          ),
+        );
+      },
+    );
 
-    return Effect.gen(function* () {
-      yield* legacyStart(flags());
+    it.live(
+      "seeds against the env-overridden SUPABASE_API_EXTERNAL_URL, not config.toml's raw value",
+      () => {
+        // `effectiveLocalStorageConfig` previously left `api.external_url` as the raw,
+        // un-overridden config value, so a `SUPABASE_API_EXTERNAL_URL` override that
+        // actually brought Kong/GoTrue up under a different external URL never reached
+        // the bucket-seeding gateway's base URL.
+        const previous = process.env["SUPABASE_API_EXTERNAL_URL"];
+        process.env["SUPABASE_API_EXTERNAL_URL"] = "http://override.example.com:9999";
+        const http = mockStorageBucketHttpClient();
+        const { layer } = setup({
+          configContents: 'project_id = "demo"\n[storage.buckets.avatars]\npublic = false\n',
+          route: freshVolumeRoute(defaultRoute()),
+          httpClientLayer: http.layer,
+        });
+        return Effect.gen(function* () {
+          yield* legacyStart(flags({ exclude: ["edge-runtime"] }));
+          expect(http.createdBucketRequests).toHaveLength(1);
+          expect(http.createdBucketRequests[0]).toContain("override.example.com:9999");
+        }).pipe(
+          Effect.provide(layer),
+          Effect.ensuring(
+            Effect.sync(() => {
+              if (previous === undefined) delete process.env["SUPABASE_API_EXTERNAL_URL"];
+              else process.env["SUPABASE_API_EXTERNAL_URL"] = previous;
+            }),
+          ),
+        );
+      },
+    );
 
-      expect(s.execCaptureCalls).toEqual([]);
-      expect(s.execCalls).toEqual([{ args: ["start"] }]);
-    }).pipe(Effect.provide(s.layer));
+    it.live(
+      "seeds a bucket's default file_size_limit from the env-overridden SUPABASE_STORAGE_FILE_SIZE_LIMIT",
+      () => {
+        // `effectiveLocalStorageConfig` previously left `storage.file_size_limit` as the
+        // raw, un-overridden config value, so `legacySeedBucketsRun`'s per-bucket default
+        // (for a bucket with no explicit `file_size_limit` of its own) never reflected an
+        // env/dotenv-only `SUPABASE_STORAGE_FILE_SIZE_LIMIT` override.
+        const previous = process.env["SUPABASE_STORAGE_FILE_SIZE_LIMIT"];
+        process.env["SUPABASE_STORAGE_FILE_SIZE_LIMIT"] = "10MiB";
+        const http = mockStorageBucketHttpClient();
+        const { layer } = setup({
+          configContents: 'project_id = "demo"\n[storage.buckets.avatars]\npublic = false\n',
+          route: freshVolumeRoute(defaultRoute()),
+          httpClientLayer: http.layer,
+        });
+        return Effect.gen(function* () {
+          yield* legacyStart(flags({ exclude: ["edge-runtime"] }));
+          expect(http.createdBucketBodies).toHaveLength(1);
+          expect(
+            (http.createdBucketBodies[0] as { file_size_limit?: number })?.file_size_limit,
+          ).toBe(10 * 1024 * 1024);
+        }).pipe(
+          Effect.provide(layer),
+          Effect.ensuring(
+            Effect.sync(() => {
+              if (previous === undefined) delete process.env["SUPABASE_STORAGE_FILE_SIZE_LIMIT"];
+              else process.env["SUPABASE_STORAGE_FILE_SIZE_LIMIT"] = previous;
+            }),
+          ),
+        );
+      },
+    );
   });
 
-  it.live("delegates --output yaml through Go status after start succeeds", () => {
-    const s = setup({ goOutput: "yaml" });
+  describe("edge runtime", () => {
+    /** Edge Runtime's own bring-up (`legacyStartEdgeRuntimeContainer`) is a direct, detached `docker run -d ...`, never a `docker create`+`docker start` pair like every other service. */
+    function edgeRuntimeRunCalls(spawned: ReadonlyArray<SpawnRecord>): ReadonlyArray<SpawnRecord> {
+      return spawned.filter((s) => s.args[0] === "run" && s.args[1] === "-d");
+    }
+
+    it.live("starts a real container via docker run -d when enabled and not excluded", () => {
+      const { layer, child } = setup();
+      return Effect.gen(function* () {
+        yield* legacyStart(flags());
+        const runCalls = edgeRuntimeRunCalls(child.spawned);
+        expect(runCalls).toHaveLength(1);
+        expect(runCalls[0]?.args).toContain("--name");
+        const nameIndex = runCalls[0]?.args.indexOf("--name") ?? -1;
+        expect(runCalls[0]?.args[nameIndex + 1]).toContain("_edge_runtime_");
+      }).pipe(Effect.provide(layer));
+    });
+
+    it.live("--exclude edge-runtime skips its container entirely", () => {
+      const { layer, child } = setup();
+      return Effect.gen(function* () {
+        yield* legacyStart(flags({ exclude: ["edge-runtime"] }));
+        expect(edgeRuntimeRunCalls(child.spawned)).toHaveLength(0);
+      }).pipe(Effect.provide(layer));
+    });
+
+    it.live(
+      "keeps the host-side bind-mount temp files after a successful bring-up (no eager cleanup)",
+      () => {
+        // Staged under `<workdir>/supabase/.temp/start-secrets/<container>/main/`
+        // — a deterministic, persistent path (not `os.tmpdir()`), so a later
+        // `stop`/rollback can reclaim it via `legacyCleanupStartSecrets`. See
+        // the "reclaims Edge Runtime's own temp secret artifacts on stop" test
+        // below for that cleanup behavior.
+        const { layer, child, workdir } = setup();
+        return Effect.gen(function* () {
+          yield* legacyStart(flags());
+          const runArgs = edgeRuntimeRunCalls(child.spawned)[0]?.args ?? [];
+          const bindValues = runArgs.flatMap((arg, i) => (runArgs[i - 1] === "-v" ? [arg] : []));
+          const stagingRoot = join(workdir, "supabase", ".temp", "start-secrets");
+          const mainTemplateBind = bindValues.find(
+            (bind) => bind.startsWith(stagingRoot) && bind.includes(`${join("main", "index.ts")}:`),
+          );
+          expect(mainTemplateBind).toBeDefined();
+          const hostPath = mainTemplateBind?.split(":")[0] ?? "";
+          try {
+            expect(existsSync(hostPath)).toBe(true);
+          } finally {
+            rmSync(stagingRoot, { recursive: true, force: true });
+          }
+        }).pipe(Effect.provide(layer));
+      },
+    );
+
+    it.live(
+      "logs 'Skipped serving Function' for a disabled function via Studio's bind mounts, even with Edge Runtime excluded",
+      () => {
+        // `resolveFunctionBindMounts` backs Studio's function bind mounts
+        // unconditionally of Edge Runtime being enabled (see
+        // `start.handler.ts`'s "studio" case doc comment) — Go's
+        // `PopulatePerFunctionConfigs` still logs the skip line via that path
+        // alone here, since Edge Runtime itself never runs to log it too.
+        const workdir = tempRoot.current;
+        mkdirSync(join(workdir, "supabase", "functions", "foo"), { recursive: true });
+        writeFileSync(join(workdir, "supabase", "functions", "foo", "index.ts"), "export {};\n");
+        const { layer, out } = setup({
+          configContents: 'project_id = "demo"\n[functions.foo]\nenabled = false\n',
+        });
+        return Effect.gen(function* () {
+          yield* legacyStart(flags({ exclude: ["edge-runtime"] }));
+          expect(out.stderrText).toContain("Skipped serving Function: foo");
+        }).pipe(
+          Effect.provide(layer),
+          Effect.ensuring(
+            Effect.sync(() => {
+              rmSync(join(workdir, "supabase", "functions"), { recursive: true, force: true });
+            }),
+          ),
+        );
+      },
+    );
 
-    return Effect.gen(function* () {
-      yield* legacyStart(flags());
+    it.live(
+      "does not pick up an unrelated ancestor project's functions for a config-less --workdir subdirectory",
+      () => {
+        // `--workdir`/`SUPABASE_WORKDIR` pointing at a subdirectory with no
+        // `supabase/config.toml` of its own is a legitimate, reachable state
+        // (see `start.e2e.test.ts`'s "absent config" comment) — `start` still
+        // proceeds, resolving the main config with `search: false`
+        // (`legacy-local-project-context.ts`). `inferFunctionsManifest`'s own
+        // `search: false` here (CLI-1323 functions-manifest fix) must keep an
+        // UNRELATED ancestor project's `supabase/functions` from silently
+        // winning for this workdir, mirroring that same `search: false`.
+        const ancestorRoot = tempRoot.current;
+        mkdirSync(join(ancestorRoot, "supabase", "functions", "foo"), { recursive: true });
+        writeFileSync(
+          join(ancestorRoot, "supabase", "functions", "foo", "index.ts"),
+          "export {};\n",
+        );
+        writeFileSync(
+          join(ancestorRoot, "supabase", "config.toml"),
+          'project_id = "ancestor"\n[functions.foo]\nenabled = true\n',
+        );
+        const workdir = join(ancestorRoot, "nested", "workdir");
+        mkdirSync(workdir, { recursive: true });
 
-      expect(s.execCaptureCalls).toEqual([{ args: ["start"], stdin: "inherit" }]);
-      expect(s.execCalls).toEqual([{ args: ["status", "--output", "yaml"], env: helperStatusEnv }]);
-    }).pipe(Effect.provide(s.layer));
+        const { layer, out, child } = setup({ workdir, skipConfig: true });
+        return Effect.gen(function* () {
+          yield* legacyStart(flags());
+          const runArgs = edgeRuntimeRunCalls(child.spawned)[0]?.args ?? [];
+          const bindValues = runArgs.flatMap((arg, i) => (runArgs[i - 1] === "-v" ? [arg] : []));
+          expect(bindValues.some((bind) => bind.includes(join("functions", "foo")))).toBe(false);
+          expect(out.stderrText).not.toContain("foo");
+        }).pipe(
+          Effect.provide(layer),
+          Effect.ensuring(
+            Effect.sync(() => {
+              rmSync(join(ancestorRoot, "supabase", "functions"), { recursive: true, force: true });
+            }),
+          ),
+        );
+      },
+    );
   });
 
-  it.live("preserves start flags and forwards ignore-health-check to helper status", () => {
-    const s = setup({ goOutput: "json" });
+  describe("image pull", () => {
+    it.live(
+      "retries a rate-limited image pull and succeeds",
+      () => {
+        const pullAttempts = new Map<string, number>();
+        const base = defaultRoute();
+        const route = (args: ReadonlyArray<string>): RouteResult => {
+          // Force every image through the pull path instead of the "already cached" shortcut.
+          if (args[0] === "image" && args[1] === "inspect") return { exitCode: 1 };
+          if (args[0] === "pull") {
+            const image = args[1] ?? "";
+            if (image.includes("kong")) {
+              const attempt = (pullAttempts.get(image) ?? 0) + 1;
+              pullAttempts.set(image, attempt);
+              if (attempt === 1) {
+                return {
+                  exitCode: 1,
+                  stderr: ["toomanyrequests: You have reached your pull rate limit"],
+                };
+              }
+            }
+            return { exitCode: 0 };
+          }
+          return base(args);
+        };
+        const { layer, out, child } = setup({ route });
+        return Effect.gen(function* () {
+          yield* legacyStart(flags());
+          const kongPulls = child.spawned.filter(
+            (s) => s.args[0] === "pull" && (s.args[1] ?? "").includes("kong"),
+          );
+          expect(kongPulls.length).toBeGreaterThanOrEqual(2);
+          expect(out.stderrText).toContain("Started");
+        }).pipe(Effect.provide(layer));
+      },
+      10_000,
+    );
 
-    return Effect.gen(function* () {
-      yield* legacyStart(
-        flags({
-          exclude: ["analytics", "studio"],
-          ignoreHealthCheck: true,
-          preview: true,
-        }),
-      );
+    it.live(
+      "fails with a pull error once all registry candidates are exhausted, without a rollback (nothing was created yet)",
+      () => {
+        // Image pre-pull (`legacyEnsureImagesCached`) runs entirely before `bringUp` creates
+        // the network or any container, so a pull failure here has nothing to roll back —
+        // unlike a failure inside `bringUp` itself (see the "rollback" describe block below).
+        const base = defaultRoute();
+        const route = (args: ReadonlyArray<string>): RouteResult => {
+          if (args[0] === "image" && args[1] === "inspect") return { exitCode: 1 };
+          if (args[0] === "pull") {
+            const image = args[1] ?? "";
+            if (image.includes("kong")) {
+              return { exitCode: 1, stderr: ["toomanyrequests: rate limit exceeded"] };
+            }
+            return { exitCode: 0 };
+          }
+          return base(args);
+        };
+        const { layer, child } = setup({ route });
+        return Effect.gen(function* () {
+          const exit = yield* Effect.exit(legacyStart(flags()));
+          expect(Exit.isFailure(exit)).toBe(true);
+          if (Exit.isFailure(exit)) {
+            expect(JSON.stringify(exit.cause)).toContain("LegacyImagePrepullError");
+          }
+          expect(child.spawned.some((s) => s.args[0] === "create")).toBe(false);
+          expect(rollbackWasAttempted(child.spawned)).toBe(false);
+        }).pipe(Effect.provide(layer));
+      },
+      45_000,
+    );
+  });
 
-      expect(s.execCaptureCalls).toEqual([
-        {
-          args: [
-            "start",
-            "--exclude",
-            "analytics",
-            "--exclude",
-            "studio",
-            "--ignore-health-check",
-            "--preview",
-          ],
-          stdin: "inherit",
-        },
-      ]);
-      expect(s.execCalls).toEqual([
-        {
-          args: [
-            "status",
-            "--output",
-            "json",
-            "--exclude",
-            "analytics",
-            "--exclude",
-            "studio",
-            "--ignore-health-check",
-          ],
-          env: helperStatusEnv,
+  describe("rollback on bring-up failure", () => {
+    it.live(
+      "rolls back on a SIGINT-style interruption mid-bring-up, matching Go's context.Canceled rollback",
+      () => {
+        // Go's `start` rolls back on Ctrl-C: `cmd/root.go:99,155` wraps every command's context
+        // with `signal.NotifyContext`, and `internal/start/start.go:73-82` rolls back on ANY
+        // non-nil `run()` error, including the `context.Canceled` a SIGINT produces. The native
+        // port installs no signal handling of its own, so this relies entirely on the global
+        // `signalAwareProgram` wrapper (`shared/cli/run.ts`) calling `Fiber.interrupt`, and on
+        // rollback being wired via `Effect.onError` (not `Effect.tapError`, which never sees a
+        // pure interrupt's `Cause`).
+        //
+        // Marking the `db` container never-healthy (mirroring the neighboring "post-bring-up
+        // bulk health-check" test below) keeps `bringUp`'s own Postgres health-check wait
+        // genuinely retrying on its real 1-second `Schedule.spaced` backoff, rather than relying
+        // on merely observing a `create` call: `mockStartContainerCliSpawner`'s synchronous,
+        // zero-delay mock lets a whole bring-up (10+ containers, no real waits of its own) run to
+        // full completion inside `Effect.forkChild({ startImmediately: true })`'s synchronous
+        // startup window, before this test's own polling loop ever gets scheduled — making
+        // `Fiber.interrupt` a no-op on an already-succeeded fiber and `rollbackWasAttempted`
+        // flakily `false`.
+        const neverHealthy = new Set<string>();
+        const route = defaultRoute({ neverHealthy });
+        let dbContainerId: string | undefined;
+        const { layer, child } = setup({
+          route: (args) => {
+            if (args[0] === "create") {
+              const name = containerNameFromCreateArgs(args);
+              if (name.includes("_db_")) {
+                neverHealthy.add(name);
+                dbContainerId = name;
+              }
+            }
+            return route(args);
+          },
+        });
+        return Effect.gen(function* () {
+          const fiber = yield* legacyStart(flags()).pipe(
+            Effect.provide(layer),
+            Effect.forkChild({ startImmediately: true }),
+          );
+          // Wait until Postgres's own health check has actually probed the never-healthy `db`
+          // container at least once — proving the fiber is genuinely suspended inside
+          // `bringUp`'s health-check retry loop, not merely past the `create` call.
+          while (
+            dbContainerId === undefined ||
+            !child.spawned.some(
+              (s) =>
+                s.args[0] === "container" && s.args[1] === "inspect" && s.args[2] === dbContainerId,
+            )
+          ) {
+            yield* Effect.sleep("5 millis");
+          }
+          // `Fiber.interrupt` only resolves once the target fiber (and its finalizers,
+          // including the `Effect.onError` rollback) has fully completed.
+          yield* Fiber.interrupt(fiber);
+          expect(rollbackWasAttempted(child.spawned)).toBe(true);
+        });
+      },
+    );
+
+    it.live(
+      "rolls back on a SIGINT-style interruption during the post-bring-up bulk health-check wait",
+      () => {
+        // Regression test for the post-bring-up tail rollback fix: before it, the ONLY
+        // `Effect.onError` rollback wrapper covered `bringUp` itself (see the test above),
+        // which already resolves the instant every container has been created — a fiber
+        // interrupt landing anywhere in the tail that follows (the bulk health-check wait
+        // below, the `--ignore-health-check` storage-only recheck-and-seed, the success-path
+        // bucket seed, or the `cli_stack_started` capture) would slip past that earlier
+        // wrapper entirely and never call `legacyRollbackStart`. Marking `auth` as
+        // never-healthy (mirroring the "non-Postgres service never becomes healthy" scenario
+        // below) keeps `legacyWaitForHealthyServices` genuinely retrying on its real 1-second
+        // `Schedule.spaced` backoff — not hung on `Effect.never` — so interrupting the fiber
+        // right after its first `container inspect` of that container lands the interrupt
+        // while still inside this exact step, not before "Waiting for health checks..." prints
+        // and not after the step has already failed/timed out on its own.
+        const neverHealthy = new Set<string>();
+        const route = defaultRoute({ neverHealthy });
+        let authContainerId: string | undefined;
+        const { layer, child } = setup({
+          route: (args) => {
+            if (args[0] === "create") {
+              const name = containerNameFromCreateArgs(args);
+              if (name.includes("_auth_")) {
+                neverHealthy.add(name);
+                authContainerId = name;
+              }
+            }
+            return route(args);
+          },
+          // Sidesteps the PostgREST/Edge Runtime HTTP-HEAD readiness probes entirely, so this
+          // scenario only exercises the Docker-inspect health path (mirrors the
+          // non-interrupt-based scenario below).
+          httpClientLayer: unusedHttpClientLayer,
+        });
+        return Effect.gen(function* () {
+          const fiber = yield* legacyStart(flags({ exclude: ["postgrest", "edge-runtime"] })).pipe(
+            Effect.provide(layer),
+            Effect.forkChild({ startImmediately: true }),
+          );
+          // Wait until the bulk health check has actually probed the never-healthy auth
+          // container at least once — proving the fiber is genuinely suspended inside
+          // `legacyWaitForHealthyServices`'s retry loop, not merely past the "Waiting for
+          // health checks..." message that precedes it.
+          while (
+            authContainerId === undefined ||
+            !child.spawned.some(
+              (s) =>
+                s.args[0] === "container" &&
+                s.args[1] === "inspect" &&
+                s.args[2] === authContainerId,
+            )
+          ) {
+            yield* Effect.sleep("5 millis");
+          }
+          // `Fiber.interrupt` only resolves once the target fiber (and its finalizers,
+          // including the `Effect.onError` rollback) has fully completed.
+          yield* Fiber.interrupt(fiber);
+          expect(rollbackWasAttempted(child.spawned)).toBe(true);
+        });
+      },
+    );
+
+    it.live("fails and rolls back on a network create failure", () => {
+      const base = defaultRoute();
+      const route = (args: ReadonlyArray<string>): RouteResult => {
+        if (args[0] === "network" && args[1] === "create") {
+          return {
+            exitCode: 1,
+            stderr: ["Error response from daemon: some other network failure"],
+          };
+        }
+        return base(args);
+      };
+      const { layer, child } = setup({ route });
+      return Effect.gen(function* () {
+        const exit = yield* Effect.exit(legacyStart(flags()));
+        expect(Exit.isFailure(exit)).toBe(true);
+        if (Exit.isFailure(exit)) {
+          const serialized = JSON.stringify(exit.cause);
+          expect(serialized).toContain("LegacyStartNetworkCreateError");
+          expect(serialized).toContain("failed to create docker network");
+        }
+        expect(child.spawned.some((s) => s.args[0] === "create")).toBe(false);
+        expect(rollbackWasAttempted(child.spawned)).toBe(true);
+        expect(child.spawned.some((s) => s.args[0] === "network" && s.args[1] === "prune")).toBe(
+          true,
+        );
+      }).pipe(Effect.provide(layer));
+    });
+
+    it.live("fails and rolls back on a container create failure", () => {
+      const base = defaultRoute();
+      const route = (args: ReadonlyArray<string>): RouteResult => {
+        if (args[0] === "create") {
+          return { exitCode: 1, stderr: ["Error: no space left on device"] };
+        }
+        return base(args);
+      };
+      const { layer, child } = setup({ route });
+      return Effect.gen(function* () {
+        const exit = yield* Effect.exit(legacyStart(flags()));
+        expect(Exit.isFailure(exit)).toBe(true);
+        if (Exit.isFailure(exit)) {
+          const serialized = JSON.stringify(exit.cause);
+          expect(serialized).toContain("LegacyStartContainerCreateError");
+          expect(serialized).toContain("failed to create docker container");
+        }
+        expect(rollbackWasAttempted(child.spawned)).toBe(true);
+      }).pipe(Effect.provide(layer));
+    });
+
+    it.live(
+      "fails and rolls back on a container start failure, surfacing the port-conflict suggestion",
+      () => {
+        const base = defaultRoute();
+        const route = (args: ReadonlyArray<string>): RouteResult => {
+          if (args[0] === "start") {
+            return {
+              exitCode: 1,
+              stderr: ["Bind for 0.0.0.0:54322 failed: port is already allocated"],
+            };
+          }
+          return base(args);
+        };
+        const { layer, child } = setup({ route });
+        return Effect.gen(function* () {
+          const exit = yield* Effect.exit(legacyStart(flags()));
+          expect(Exit.isFailure(exit)).toBe(true);
+          if (Exit.isFailure(exit)) {
+            const serialized = JSON.stringify(exit.cause);
+            expect(serialized).toContain("LegacyStartContainerStartError");
+            expect(serialized).toContain("port is already allocated");
+            expect(serialized).toContain(
+              "Try stopping the project or container already using 0.0.0.0:54322",
+            );
+          }
+          expect(rollbackWasAttempted(child.spawned)).toBe(true);
+        }).pipe(Effect.provide(layer));
+      },
+    );
+
+    it.live(
+      "fails on a malformed auth.email.max_frequency before any Docker work, matching Go's Config.Load",
+      () => {
+        // `auth.email.max_frequency` is a plain, unvalidated string in `@supabase/config`'s
+        // schema. Go decodes it in the same unconditional Config.Load mapstructure pass as every
+        // other duration field, before start.Run touches Docker at all — this is now validated
+        // eagerly here too (see the `resolvedEmail` validation in start.handler.ts), so a
+        // malformed value fails before the network/Postgres/Kong/GoTrue sequence ever begins,
+        // not partway through it.
+        const { layer, child } = setup({
+          configContents: 'project_id = "demo"\n[auth.email]\nmax_frequency = "not-a-duration"\n',
+        });
+        return Effect.gen(function* () {
+          const exit = yield* Effect.exit(legacyStart(flags()));
+          expect(Exit.isFailure(exit)).toBe(true);
+          if (Exit.isFailure(exit)) {
+            const serialized = JSON.stringify(exit.cause);
+            expect(serialized).toContain("LegacyStartInvalidConfigError");
+            expect(serialized).toContain("invalid config for auth.email.max_frequency");
+          }
+          expect(child.spawned.some((s) => s.args[0] === "create")).toBe(false);
+        }).pipe(Effect.provide(layer));
+      },
+    );
+
+    it.live(
+      "fails with a typed config error on a malformed auth.email override even when auth itself is disabled",
+      () => {
+        // `legacyResolveLocalConfigValues` only validates `auth.email.*` overrides inside its
+        // own `authEnabled` branch, so with auth disabled the unwrapped `legacyResolveAuthEmail`
+        // call in `start.handler.ts` (used unconditionally for Kong's template mounts) becomes
+        // the FIRST place `SUPABASE_AUTH_EMAIL_OTP_LENGTH` gets parsed — a synchronous throw
+        // there would surface as an uncaught Effect defect instead. Unlike the max_frequency
+        // case above, this override is read before any network/container work starts, so
+        // there is nothing yet for rollback to prune — the point of this test is solely that
+        // the typed LegacyStartInvalidConfigError surfaces instead of a defect.
+        const previous = process.env["SUPABASE_AUTH_EMAIL_OTP_LENGTH"];
+        process.env["SUPABASE_AUTH_EMAIL_OTP_LENGTH"] = "abc";
+        const { layer, child } = setup({
+          configContents: 'project_id = "demo"\n[auth]\nenabled = false\n',
+        });
+        return Effect.gen(function* () {
+          const exit = yield* Effect.exit(legacyStart(flags()));
+          expect(Exit.isFailure(exit)).toBe(true);
+          if (Exit.isFailure(exit)) {
+            const serialized = JSON.stringify(exit.cause);
+            expect(serialized).toContain("LegacyStartInvalidConfigError");
+          }
+          expect(child.spawned).toHaveLength(0);
+        }).pipe(
+          Effect.provide(layer),
+          Effect.ensuring(
+            Effect.sync(() => {
+              if (previous === undefined) delete process.env["SUPABASE_AUTH_EMAIL_OTP_LENGTH"];
+              else process.env["SUPABASE_AUTH_EMAIL_OTP_LENGTH"] = previous;
+            }),
+          ),
+        );
+      },
+    );
+
+    it.live(
+      "fails with a typed config error on a malformed auth.sms override even when auth itself is disabled",
+      () => {
+        // `legacyResolveLocalConfigValues` only validates `auth.sms.*` overrides inside its
+        // own `authEnabled` branch, so with auth disabled the unwrapped `legacyResolveAuthSms`
+        // call in `start.handler.ts` (used to detect the "no SMS provider enabled" warning)
+        // becomes the FIRST place `SUPABASE_AUTH_SMS_ENABLE_SIGNUP` gets parsed — a synchronous
+        // throw there would surface as an uncaught Effect defect instead. Same shape as the
+        // auth.email override regression test above, this override is read before any
+        // network/container work starts, so there is nothing yet for rollback to prune — the
+        // point of this test is solely that the typed LegacyStartInvalidConfigError surfaces
+        // instead of a defect.
+        const previous = process.env["SUPABASE_AUTH_SMS_ENABLE_SIGNUP"];
+        process.env["SUPABASE_AUTH_SMS_ENABLE_SIGNUP"] = "bad";
+        const { layer, child } = setup({
+          configContents: 'project_id = "demo"\n[auth]\nenabled = false\n',
+        });
+        return Effect.gen(function* () {
+          const exit = yield* Effect.exit(legacyStart(flags()));
+          expect(Exit.isFailure(exit)).toBe(true);
+          if (Exit.isFailure(exit)) {
+            const serialized = JSON.stringify(exit.cause);
+            expect(serialized).toContain("LegacyStartInvalidConfigError");
+          }
+          expect(child.spawned).toHaveLength(0);
+        }).pipe(
+          Effect.provide(layer),
+          Effect.ensuring(
+            Effect.sync(() => {
+              if (previous === undefined) delete process.env["SUPABASE_AUTH_SMS_ENABLE_SIGNUP"];
+              else process.env["SUPABASE_AUTH_SMS_ENABLE_SIGNUP"] = previous;
+            }),
+          ),
+        );
+      },
+    );
+
+    it.live(
+      "fails and rolls back when Postgres itself never becomes healthy within its configured health_timeout",
+      () => {
+        // `db.health_timeout` (unlike the generic 30s `serviceTimeout` every other service
+        // waits on) is a real config.toml-configurable seam — this keeps the scenario fast
+        // instead of waiting out a real default.
+        const neverHealthy = new Set<string>();
+        const base = defaultRoute({ neverHealthy });
+        const route = (args: ReadonlyArray<string>): RouteResult => {
+          if (args[0] === "create") {
+            const name = containerNameFromCreateArgs(args);
+            if (name.includes("_db_")) neverHealthy.add(name);
+          }
+          return base(args);
+        };
+        const { layer, child } = setup({
+          configContents: 'project_id = "demo"\n[db]\nhealth_timeout = "2s"\n',
+          route,
+        });
+        return Effect.gen(function* () {
+          const exit = yield* Effect.exit(legacyStart(flags()));
+          expect(Exit.isFailure(exit)).toBe(true);
+          if (Exit.isFailure(exit)) {
+            expect(JSON.stringify(exit.cause)).toContain("LegacyHealthCheckTimeoutError");
+          }
+          expect(rollbackWasAttempted(child.spawned)).toBe(true);
+          // Postgres's own health wait fails before any other service is ever created.
+          expect(createdContainerNames(child.spawned)).toEqual([expect.stringContaining("_db_")]);
+        }).pipe(Effect.provide(layer));
+      },
+      10_000,
+    );
+
+    it.live(
+      "exits 0 on --ignore-health-check when Postgres itself never becomes healthy, without rolling back and without starting any other service",
+      () => {
+        // Mirrors the regression test above, but with `--ignore-health-check` set — Go's
+        // `Run()` (`start.go:74-75`) applies `ignoreHealthCheck && IsUnhealthyError(err)`
+        // uniformly to whatever `run()` returns, including Postgres's own health-wait
+        // failure, which `run()` propagates immediately (`start.go:294-296`) before any
+        // other service is even created.
+        const neverHealthy = new Set<string>();
+        const base = defaultRoute({ neverHealthy });
+        const route = (args: ReadonlyArray<string>): RouteResult => {
+          if (args[0] === "create") {
+            const name = containerNameFromCreateArgs(args);
+            if (name.includes("_db_")) neverHealthy.add(name);
+          }
+          return base(args);
+        };
+        const { layer, out, child, analytics } = setup({
+          configContents: 'project_id = "demo"\n[db]\nhealth_timeout = "2s"\n',
+          route,
+        });
+        return Effect.gen(function* () {
+          yield* legacyStart(flags({ ignoreHealthCheck: true }));
+          expect(out.stderrText).toContain("is not ready");
+          expect(out.stderrText).toContain("Started");
+          expect(rollbackWasAttempted(child.spawned)).toBe(false);
+          // No other service's container is ever created — Go's `StartDatabase`
+          // returns before `run()`'s "Starting containers..." message or any other
+          // service's bring-up even begins.
+          expect(createdContainerNames(child.spawned)).toEqual([expect.stringContaining("_db_")]);
+          // Go never fires `cli_stack_started` on this fallthrough either — the
+          // capture sits after the entire bring-up + bulk health check, neither of
+          // which is reached once Postgres's own wait is downgraded to a warning.
+          expect(analytics.captured.some((c) => c.event === "cli_stack_started")).toBe(false);
+        }).pipe(Effect.provide(layer));
+      },
+      10_000,
+    );
+
+    // Real time, not `it.effect`/`TestClock`: same constraint as the `--ignore-health-check`
+    // scenario below — `legacyStart` performs genuine async I/O that never resolves under a
+    // virtualized clock. Unlike Postgres's own wait above, this second bulk health check has no
+    // config-configurable timeout seam in `start.handler.ts` (`legacyWaitForHealthyServices`
+    // is called with no `timeoutSeconds` override, so it falls back to the hardcoded 30s
+    // default) — there is no way to shorten this without editing production code, which is out
+    // of scope for this task, so this reuses the same generous real-time budget instead.
+    it.live(
+      "fails and rolls back when a non-Postgres service never becomes healthy within the timeout (no --ignore-health-check)",
+      () => {
+        const neverHealthy = new Set<string>();
+        const route = defaultRoute({ neverHealthy });
+        const { layer, out, child } = setup({
+          route: (args) => {
+            if (args[0] === "create") {
+              const name = containerNameFromCreateArgs(args);
+              if (name.includes("_auth_")) neverHealthy.add(name);
+            }
+            return route(args);
+          },
+          httpClientLayer: unusedHttpClientLayer,
+        });
+
+        return Effect.gen(function* () {
+          // `edge-runtime` also excluded so its own HTTP readiness probe never
+          // reaches `unusedHttpClientLayer` — this scenario is only about the
+          // Docker-inspect health path.
+          const exit = yield* Effect.exit(
+            legacyStart(flags({ exclude: ["postgrest", "edge-runtime"] })),
+          );
+          expect(Exit.isFailure(exit)).toBe(true);
+          if (Exit.isFailure(exit)) {
+            expect(JSON.stringify(exit.cause)).toContain("LegacyHealthCheckTimeoutError");
+          }
+          expect(out.stderrText).not.toContain("Started");
+          expect(rollbackWasAttempted(child.spawned)).toBe(true);
+        }).pipe(Effect.provide(layer));
+      },
+      45_000,
+    );
+  });
+
+  // Real time, not `it.effect`/`TestClock`: `legacyStart` performs genuine
+  // async I/O deep inside the forked effect (`legacyResolveLocalJwks`'s
+  // `Effect.tryPromise`, `legacyResolveDbImage`'s file read) that needs real
+  // Node event-loop turns to settle — under a virtualized `TestClock` those
+  // never resolve, so the forked fiber never even reaches the health-check
+  // phase. This exercises the real 30s `serviceTimeout` bulk health-check
+  // wait (`lib/health-check.ts`'s default), hence the generous timeout.
+  it.live(
+    "exits 0 on --ignore-health-check when a non-Postgres container never turns healthy, without rolling back",
+    () => {
+      // GoTrue's own (post-create) container name is only known once `docker
+      // create` reports it — wrap `defaultRoute` to capture it into
+      // `neverHealthy` the moment it's created, so every later `container
+      // inspect` call on that same id reports "starting", never "healthy".
+      const neverHealthy = new Set<string>();
+      const route = defaultRoute({ neverHealthy });
+      const { layer, out, child, analytics } = setup({
+        route: (args) => {
+          if (args[0] === "create") {
+            const name = containerNameFromCreateArgs(args);
+            if (name.includes("_auth_")) neverHealthy.add(name);
+          }
+          return route(args);
         },
-      ]);
-    }).pipe(Effect.provide(s.layer));
+        // Sidesteps the PostgREST/Edge Runtime HTTP-HEAD readiness probes
+        // entirely, so this scenario only exercises the Docker-inspect health
+        // path.
+        httpClientLayer: unusedHttpClientLayer,
+      });
+
+      return Effect.gen(function* () {
+        yield* legacyStart(
+          flags({ exclude: ["postgrest", "edge-runtime"], ignoreHealthCheck: true }),
+        );
+        expect(out.stderrText).toContain("is not ready");
+        expect(out.stderrText).toContain("Started");
+        expect(rollbackWasAttempted(child.spawned)).toBe(false);
+        // Go never fires `cli_stack_started` on the ignored-unhealthy
+        // fallthrough (`start.go:1287` sits after the `if err != nil` block) —
+        // only a genuine bulk health-check SUCCESS reaches that capture.
+        expect(analytics.captured.some((c) => c.event === "cli_stack_started")).toBe(false);
+      }).pipe(Effect.provide(layer));
+    },
+    45_000,
+  );
+
+  describe("--ignore-health-check storage-only recheck and seed on a fresh volume", () => {
+    it.live(
+      "recheck-and-seeds buckets when storage itself is healthy, then still downgrades the original error to a warning",
+      () => {
+        const http = mockStorageBucketHttpClient();
+        const neverHealthy = new Set<string>();
+        const route = freshVolumeRoute(defaultRoute({ neverHealthy }));
+        const { layer, out, child, analytics } = setup({
+          configContents: 'project_id = "demo"\n[storage.buckets.avatars]\npublic = false\n',
+          route: (args) => {
+            if (args[0] === "create") {
+              const name = containerNameFromCreateArgs(args);
+              if (name.includes("_auth_")) neverHealthy.add(name);
+            }
+            return route(args);
+          },
+          httpClientLayer: http.layer,
+        });
+        return Effect.gen(function* () {
+          yield* legacyStart(
+            flags({ exclude: ["postgrest", "edge-runtime"], ignoreHealthCheck: true }),
+          );
+          expect(http.createdBucketRequests).toHaveLength(1);
+          expect(out.stderrText).toContain("is not ready");
+          expect(out.stderrText).toContain("Started");
+          expect(rollbackWasAttempted(child.spawned)).toBe(false);
+          expect(analytics.captured.some((c) => c.event === "cli_stack_started")).toBe(false);
+        }).pipe(Effect.provide(layer));
+      },
+      45_000,
+    );
+
+    it.live(
+      "a bucket-seed failure during the recheck becomes a hard failure with rollback, replacing the original health error",
+      () => {
+        // A non-200 bucket-create response fails `legacySeedBucketsRun` deep inside
+        // its Storage-gateway call (`LegacyStorageGatewayStatusError`) — unlike an
+        // invalid bucket NAME, which `legacyResolveLocalConfigValues`'s own
+        // `legacyValidateResolvedConfig` call (step 2 of `legacyStart`, long before
+        // any container exists) would already reject before ever reaching Docker.
+        const failingBucketCreateHttpClientLayer = Layer.succeed(
+          HttpClient.HttpClient,
+          HttpClient.make((request) => {
+            if (request.method === "GET" && request.url.includes("/storage/v1/bucket")) {
+              return Effect.succeed(
+                HttpClientResponse.fromWeb(
+                  request,
+                  new Response("[]", {
+                    status: 200,
+                    headers: { "content-type": "application/json" },
+                  }),
+                ),
+              );
+            }
+            if (request.method === "POST" && request.url.includes("/storage/v1/bucket")) {
+              return Effect.succeed(
+                HttpClientResponse.fromWeb(
+                  request,
+                  new Response("internal error", { status: 500 }),
+                ),
+              );
+            }
+            return Effect.succeed(
+              HttpClientResponse.fromWeb(request, new Response(null, { status: 200 })),
+            );
+          }),
+        );
+        const neverHealthy = new Set<string>();
+        const route = freshVolumeRoute(defaultRoute({ neverHealthy }));
+        const { layer, child, analytics } = setup({
+          configContents: 'project_id = "demo"\n[storage.buckets.avatars]\npublic = false\n',
+          route: (args) => {
+            if (args[0] === "create") {
+              const name = containerNameFromCreateArgs(args);
+              if (name.includes("_auth_")) neverHealthy.add(name);
+            }
+            return route(args);
+          },
+          httpClientLayer: failingBucketCreateHttpClientLayer,
+        });
+        return Effect.gen(function* () {
+          const exit = yield* Effect.exit(
+            legacyStart(flags({ exclude: ["postgrest", "edge-runtime"], ignoreHealthCheck: true })),
+          );
+          expect(Exit.isFailure(exit)).toBe(true);
+          if (Exit.isFailure(exit)) {
+            const serialized = JSON.stringify(exit.cause);
+            expect(serialized).toContain("LegacyStorageGatewayStatusError");
+            // The seed error REPLACES the original health-check timeout entirely.
+            expect(serialized).not.toContain("LegacyHealthCheckTimeoutError");
+          }
+          expect(rollbackWasAttempted(child.spawned)).toBe(true);
+          expect(analytics.captured.some((c) => c.event === "cli_stack_started")).toBe(false);
+        }).pipe(Effect.provide(layer));
+      },
+      45_000,
+    );
+
+    // Both the main bulk health check (auth) and this storage-only recheck run
+    // out their own full ~30s real-time retry budget in this scenario — hence
+    // the doubled timeout relative to every other real-time health-check test
+    // in this file.
+    it.live(
+      "falls through to the original warning without attempting to seed when the storage recheck itself never turns healthy",
+      () => {
+        const neverHealthy = new Set<string>();
+        const route = freshVolumeRoute(defaultRoute({ neverHealthy }));
+        const http = mockStorageBucketHttpClient();
+        const { layer, out, child, analytics } = setup({
+          configContents: 'project_id = "demo"\n[storage.buckets.avatars]\npublic = false\n',
+          route: (args) => {
+            if (args[0] === "create") {
+              const name = containerNameFromCreateArgs(args);
+              // Both auth (fails the main bulk check) and storage (fails the
+              // narrower recheck) never turn healthy.
+              if (name.includes("_auth_") || name.includes("_storage_")) neverHealthy.add(name);
+            }
+            return route(args);
+          },
+          httpClientLayer: http.layer,
+        });
+        return Effect.gen(function* () {
+          yield* legacyStart(
+            flags({ exclude: ["postgrest", "edge-runtime"], ignoreHealthCheck: true }),
+          );
+          expect(http.createdBucketRequests).toHaveLength(0);
+          expect(out.stderrText).toContain("is not ready");
+          expect(out.stderrText).toContain("Started");
+          expect(rollbackWasAttempted(child.spawned)).toBe(false);
+          expect(analytics.captured.some((c) => c.event === "cli_stack_started")).toBe(false);
+        }).pipe(Effect.provide(layer));
+      },
+      90_000,
+    );
+  });
+
+  describe("--network-id", () => {
+    it.live("overrides the generated network name and every container's --network flag", () => {
+      const { layer, child } = setup({ networkId: Option.some("custom-net") });
+      return Effect.gen(function* () {
+        yield* legacyStart(flags());
+        const networkCreate = child.spawned.find(
+          (s) => s.args[0] === "network" && s.args[1] === "create",
+        );
+        expect(networkCreate?.args.at(-1)).toBe("custom-net");
+        const kongCreate = child.spawned.find(
+          (s) => s.args[0] === "create" && containerNameFromCreateArgs(s.args).includes("_kong_"),
+        );
+        const networkFlagIndex = kongCreate?.args.indexOf("--network") ?? -1;
+        expect(kongCreate?.args[networkFlagIndex + 1]).toBe("custom-net");
+      }).pipe(Effect.provide(layer));
+    });
+  });
+
+  describe("SUPABASE_API_PORT override", () => {
+    it.live("publishes Kong on the env-overridden API port, not config.api.port", () => {
+      const previous = process.env["SUPABASE_API_PORT"];
+      process.env["SUPABASE_API_PORT"] = "61234";
+      const { layer, child } = setup();
+      return Effect.gen(function* () {
+        yield* legacyStart(flags());
+        const kongCreate = child.spawned.find(
+          (s) => s.args[0] === "create" && containerNameFromCreateArgs(s.args).includes("_kong_"),
+        );
+        expect(kongCreate?.args).toContain("61234:8000");
+        expect(kongCreate?.args).not.toContain("54321:8000");
+      }).pipe(
+        Effect.provide(layer),
+        Effect.ensuring(
+          Effect.sync(() => {
+            if (previous === undefined) delete process.env["SUPABASE_API_PORT"];
+            else process.env["SUPABASE_API_PORT"] = previous;
+          }),
+        ),
+      );
+    });
+  });
+
+  describe("storage migration pin", () => {
+    it.live(
+      "threads a linked project's supabase/.temp/storage-migration pin into DB_MIGRATIONS_FREEZE_AT",
+      () => {
+        const { layer, workdir, child } = setup();
+        mkdirSync(join(workdir, "supabase", ".temp"), { recursive: true });
+        writeFileSync(join(workdir, "supabase", ".temp", "storage-migration"), "20240102030405\n");
+        return Effect.gen(function* () {
+          yield* legacyStart(flags());
+          const storageCreate = child.spawned.find(
+            (s) =>
+              s.args[0] === "create" && containerNameFromCreateArgs(s.args).includes("_storage_"),
+          );
+          expect(storageCreate?.env["DB_MIGRATIONS_FREEZE_AT"]).toBe("20240102030405");
+        }).pipe(Effect.provide(layer));
+      },
+    );
+
+    it.live('resolves to "" when no pin file exists', () => {
+      const { layer, child } = setup();
+      return Effect.gen(function* () {
+        yield* legacyStart(flags());
+        const storageCreate = child.spawned.find(
+          (s) =>
+            s.args[0] === "create" && containerNameFromCreateArgs(s.args).includes("_storage_"),
+        );
+        expect(storageCreate?.env["DB_MIGRATIONS_FREEZE_AT"]).toBe("");
+      }).pipe(Effect.provide(layer));
+    });
+  });
+
+  describe("linked service version pins", () => {
+    it.live(
+      "resolves a supabase/.temp/storage-version pin into the pulled/created storage image tag",
+      () => {
+        const { layer, workdir, child } = setup();
+        mkdirSync(join(workdir, "supabase", ".temp"), { recursive: true });
+        writeFileSync(join(workdir, "supabase", ".temp", "storage-version"), "1.2.3\n");
+        return Effect.gen(function* () {
+          yield* legacyStart(flags());
+          const storageImageInspect = child.spawned.find(
+            (s) =>
+              s.args[0] === "image" &&
+              s.args[1] === "inspect" &&
+              (s.args[2] ?? "").includes("storage"),
+          );
+          expect(storageImageInspect?.args[2]).toMatch(/:1\.2\.3$/);
+        }).pipe(Effect.provide(layer));
+      },
+    );
+  });
+
+  describe("db.root_key", () => {
+    it.live("stages a configured db.root_key as the Postgres container's pgsodium root key", () => {
+      const { layer, workdir, child } = setup({
+        configContents: 'project_id = "demo"\n[db]\nroot_key = "custom-root-key-value"\n',
+      });
+      return Effect.gen(function* () {
+        yield* legacyStart(flags());
+        const containerName = legacyServiceContainerName("db", "demo");
+        const secretDir = join(workdir, "supabase", ".temp", "start-secrets", containerName);
+        const staged = readFileSync(join(secretDir, "secret-0"), "utf8");
+        expect(staged).toBe("custom-root-key-value");
+        expect(child.spawned.some((s) => s.args[0] === "create")).toBe(true);
+      }).pipe(Effect.provide(layer));
+    });
+  });
+
+  describe("container-not-found stderr shapes", () => {
+    it.live(
+      "brings up the stack when the DB container's inspect reports 'No such object' instead of 'No such container'",
+      () => {
+        // Docker/Podman report a missing container as either "No such container" or "No such
+        // object" depending on daemon version/CLI path — `isContainerNotFoundMessage` must
+        // recognize both, or `legacyStart`'s "not running, bring up the stack" branch never
+        // fires and the inspect failure propagates instead.
+        const created = new Set<string>();
+        const route = (args: ReadonlyArray<string>): RouteResult => {
+          if (args[0] === "container" && args[1] === "inspect") {
+            const id = args[2] ?? "";
+            if (!created.has(id)) {
+              return { exitCode: 1, stderr: [`Error: no such object: ${id}`] };
+            }
+            return { stdout: [HEALTHY_STATE] };
+          }
+          if (args[0] === "image" && args[1] === "inspect") return { exitCode: 0 };
+          if (args[0] === "network" && args[1] === "create") return { exitCode: 0 };
+          if (args[0] === "volume" && args[1] === "create") return { exitCode: 0 };
+          if (args[0] === "context" && args[1] === "inspect") return { exitCode: 1 };
+          if (args[0] === "create") {
+            const name = containerNameFromCreateArgs(args);
+            created.add(name);
+            return { stdout: [name] };
+          }
+          if (args[0] === "start") return { exitCode: 0 };
+          if (args[0] === "logs") return { exitCode: 0 };
+          if (args[0] === "ps") return { stdout: [] };
+          return { exitCode: 0 };
+        };
+        const { layer, child } = setup({ route });
+        return Effect.gen(function* () {
+          yield* legacyStart(flags());
+          const createdNames = createdContainerNames(child.spawned);
+          expect(createdNames.some((name) => name.includes("_db_"))).toBe(true);
+        }).pipe(Effect.provide(layer));
+      },
+    );
+  });
+
+  describe("Linux host-gateway mapping", () => {
+    it.live("adds --add-host host.docker.internal:host-gateway on Linux", () => {
+      const { layer, child } = setup();
+      return Effect.gen(function* () {
+        yield* legacyStart(flags());
+        const kongCreate = child.spawned.find(
+          (s) => s.args[0] === "create" && containerNameFromCreateArgs(s.args).includes("_kong_"),
+        );
+        const addHostIndex = kongCreate?.args.indexOf("--add-host") ?? -1;
+        expect(kongCreate?.args[addHostIndex + 1]).toBe("host.docker.internal:host-gateway");
+      }).pipe(Effect.provide(layer));
+    });
+  });
+
+  describe("auth.email.smtp table-present default", () => {
+    it.live(
+      "uses the configured SMTP server (not Mailpit) when [auth.email.smtp] omits enabled",
+      () => {
+        const { layer, child } = setup({
+          configContents:
+            'project_id = "demo"\n[auth.email.smtp]\nhost = "smtp.example.com"\nport = 587\nuser = "smtp-user"\npass = "smtp-pass"\nadmin_email = "admin@example.com"\n',
+        });
+        return Effect.gen(function* () {
+          yield* legacyStart(flags());
+          const gotrueCreate = child.spawned.find(
+            (s) => s.args[0] === "create" && containerNameFromCreateArgs(s.args).includes("_auth_"),
+          );
+          expect(gotrueCreate?.env["GOTRUE_SMTP_HOST"]).toBe("smtp.example.com");
+          expect(gotrueCreate?.env["GOTRUE_SMTP_PORT"]).toBe("587");
+        }).pipe(Effect.provide(layer));
+      },
+    );
+  });
+
+  describe("custom auth.external providers", () => {
+    it.live("emits GOTRUE_EXTERNAL_* env vars for a provider outside the fixed schema set", () => {
+      const { layer, child } = setup({
+        configContents:
+          'project_id = "demo"\n[auth.external.my_oidc]\nenabled = true\nclient_id = "custom-client-id"\nsecret = "custom-secret"\n',
+      });
+      return Effect.gen(function* () {
+        yield* legacyStart(flags());
+        const gotrueCreate = child.spawned.find(
+          (s) => s.args[0] === "create" && containerNameFromCreateArgs(s.args).includes("_auth_"),
+        );
+        expect(gotrueCreate?.env["GOTRUE_EXTERNAL_MY_OIDC_ENABLED"]).toBe("true");
+        expect(gotrueCreate?.env["GOTRUE_EXTERNAL_MY_OIDC_CLIENT_ID"]).toBe("custom-client-id");
+      }).pipe(Effect.provide(layer));
+    });
+  });
+
+  describe("SUPABASE_LOCAL_SMTP_ADMIN_EMAIL / SUPABASE_LOCAL_SMTP_SENDER_NAME overrides", () => {
+    it.live("honors env overrides for the Mailpit fallback's admin email and sender name", () => {
+      const previousAdminEmail = process.env["SUPABASE_LOCAL_SMTP_ADMIN_EMAIL"];
+      const previousSenderName = process.env["SUPABASE_LOCAL_SMTP_SENDER_NAME"];
+      process.env["SUPABASE_LOCAL_SMTP_ADMIN_EMAIL"] = "override-admin@example.com";
+      process.env["SUPABASE_LOCAL_SMTP_SENDER_NAME"] = "Override Sender";
+      const { layer, child } = setup();
+      return Effect.gen(function* () {
+        yield* legacyStart(flags());
+        const gotrueCreate = child.spawned.find(
+          (s) => s.args[0] === "create" && containerNameFromCreateArgs(s.args).includes("_auth_"),
+        );
+        expect(gotrueCreate?.env["GOTRUE_SMTP_ADMIN_EMAIL"]).toBe("override-admin@example.com");
+        expect(gotrueCreate?.env["GOTRUE_SMTP_SENDER_NAME"]).toBe("Override Sender");
+      }).pipe(
+        Effect.provide(layer),
+        Effect.ensuring(
+          Effect.sync(() => {
+            if (previousAdminEmail === undefined) {
+              delete process.env["SUPABASE_LOCAL_SMTP_ADMIN_EMAIL"];
+            } else {
+              process.env["SUPABASE_LOCAL_SMTP_ADMIN_EMAIL"] = previousAdminEmail;
+            }
+            if (previousSenderName === undefined) {
+              delete process.env["SUPABASE_LOCAL_SMTP_SENDER_NAME"];
+            } else {
+              process.env["SUPABASE_LOCAL_SMTP_SENDER_NAME"] = previousSenderName;
+            }
+          }),
+        ),
+      );
+    });
+  });
+
+  describe("SUPABASE_LOCAL_SMTP_SMTP_PORT override", () => {
+    it.live(
+      "fails with a typed config error, before any container is created, on an invalid SUPABASE_LOCAL_SMTP_SMTP_PORT",
+      () => {
+        const previous = process.env["SUPABASE_LOCAL_SMTP_SMTP_PORT"];
+        process.env["SUPABASE_LOCAL_SMTP_SMTP_PORT"] = "not-a-port";
+        const { layer, child } = setup();
+        return Effect.gen(function* () {
+          const exit = yield* Effect.exit(legacyStart(flags()));
+          expect(Exit.isFailure(exit)).toBe(true);
+          if (Exit.isFailure(exit)) {
+            expect(JSON.stringify(exit.cause)).toContain("LegacyStartInvalidConfigError");
+          }
+          expect(child.spawned.some((s) => s.args[0] === "create")).toBe(false);
+        }).pipe(
+          Effect.provide(layer),
+          Effect.ensuring(
+            Effect.sync(() => {
+              if (previous === undefined) delete process.env["SUPABASE_LOCAL_SMTP_SMTP_PORT"];
+              else process.env["SUPABASE_LOCAL_SMTP_SMTP_PORT"] = previous;
+            }),
+          ),
+        );
+      },
+    );
+  });
+
+  describe("SUPABASE_AUTH_SMS_<PROVIDER>_* overrides", () => {
+    it.live(
+      "honors env overrides enabling Twilio SMS even when config.toml has it disabled",
+      () => {
+        const envKeys = [
+          "SUPABASE_AUTH_SMS_TWILIO_ENABLED",
+          "SUPABASE_AUTH_SMS_TWILIO_ACCOUNT_SID",
+          "SUPABASE_AUTH_SMS_TWILIO_MESSAGE_SERVICE_SID",
+          "SUPABASE_AUTH_SMS_TWILIO_AUTH_TOKEN",
+        ] as const;
+        const previous = Object.fromEntries(envKeys.map((key) => [key, process.env[key]]));
+        process.env["SUPABASE_AUTH_SMS_TWILIO_ENABLED"] = "true";
+        process.env["SUPABASE_AUTH_SMS_TWILIO_ACCOUNT_SID"] = "override-account-sid";
+        process.env["SUPABASE_AUTH_SMS_TWILIO_MESSAGE_SERVICE_SID"] =
+          "override-message-service-sid";
+        process.env["SUPABASE_AUTH_SMS_TWILIO_AUTH_TOKEN"] = "override-auth-token";
+        const { layer, child } = setup({
+          configContents: 'project_id = "demo"\n[auth.sms.twilio]\nenabled = false\n',
+        });
+        return Effect.gen(function* () {
+          yield* legacyStart(flags());
+          const gotrueCreate = child.spawned.find(
+            (s) => s.args[0] === "create" && containerNameFromCreateArgs(s.args).includes("_auth_"),
+          );
+          expect(gotrueCreate?.env["GOTRUE_SMS_PROVIDER"]).toBe("twilio");
+          expect(gotrueCreate?.env["GOTRUE_SMS_TWILIO_ACCOUNT_SID"]).toBe("override-account-sid");
+          expect(gotrueCreate?.env["GOTRUE_SMS_TWILIO_MESSAGE_SERVICE_SID"]).toBe(
+            "override-message-service-sid",
+          );
+          expect(gotrueCreate?.env["GOTRUE_SMS_TWILIO_AUTH_TOKEN"]).toBe("override-auth-token");
+        }).pipe(
+          Effect.provide(layer),
+          Effect.ensuring(
+            Effect.sync(() => {
+              for (const key of envKeys) {
+                const value = previous[key];
+                if (value === undefined) delete process.env[key];
+                else process.env[key] = value;
+              }
+            }),
+          ),
+        );
+      },
+    );
+
+    it.live(
+      "honors SUPABASE_AUTH_SMS_ENABLE_SIGNUP and SUPABASE_AUTH_SMS_MAX_FREQUENCY in GoTrue's env",
+      () => {
+        const previousEnableSignup = process.env["SUPABASE_AUTH_SMS_ENABLE_SIGNUP"];
+        const previousMaxFrequency = process.env["SUPABASE_AUTH_SMS_MAX_FREQUENCY"];
+        process.env["SUPABASE_AUTH_SMS_ENABLE_SIGNUP"] = "true";
+        process.env["SUPABASE_AUTH_SMS_MAX_FREQUENCY"] = "10s";
+        // A complete, enabled provider is required, or Go's own `sms.validate()` downgrades
+        // enable_signup to false regardless of the override — see the "disables phone login"
+        // test below for that behavior itself.
+        const { layer, child } = setup({
+          configContents:
+            'project_id = "demo"\n[auth.sms.twilio]\nenabled = true\naccount_sid = "AC123"\nauth_token = "test-auth-token"\nmessage_service_sid = "MG123"\n',
+        });
+        return Effect.gen(function* () {
+          yield* legacyStart(flags());
+          const gotrueCreate = child.spawned.find(
+            (s) => s.args[0] === "create" && containerNameFromCreateArgs(s.args).includes("_auth_"),
+          );
+          expect(gotrueCreate?.env["GOTRUE_EXTERNAL_PHONE_ENABLED"]).toBe("true");
+          expect(gotrueCreate?.env["GOTRUE_SMS_MAX_FREQUENCY"]).toBe("10s");
+        }).pipe(
+          Effect.provide(layer),
+          Effect.ensuring(
+            Effect.sync(() => {
+              if (previousEnableSignup === undefined) {
+                delete process.env["SUPABASE_AUTH_SMS_ENABLE_SIGNUP"];
+              } else {
+                process.env["SUPABASE_AUTH_SMS_ENABLE_SIGNUP"] = previousEnableSignup;
+              }
+              if (previousMaxFrequency === undefined) {
+                delete process.env["SUPABASE_AUTH_SMS_MAX_FREQUENCY"];
+              } else {
+                process.env["SUPABASE_AUTH_SMS_MAX_FREQUENCY"] = previousMaxFrequency;
+              }
+            }),
+          ),
+        );
+      },
+    );
+
+    it.live(
+      "disables phone login and warns when enable_signup is true with no SMS provider enabled",
+      () => {
+        // Go's `(s *sms) validate()` (`config.go:1412-1415`) takes the `case s.EnableSignup:`
+        // switch branch — reached only when every named provider is disabled — and mutates
+        // `EnableSignup = false` (plus a stderr warning) before `buildGotrueEnv` ever reads it.
+        const previous = process.env["SUPABASE_AUTH_SMS_ENABLE_SIGNUP"];
+        process.env["SUPABASE_AUTH_SMS_ENABLE_SIGNUP"] = "true";
+        const { layer, child, out } = setup();
+        return Effect.gen(function* () {
+          yield* legacyStart(flags());
+          const gotrueCreate = child.spawned.find(
+            (s) => s.args[0] === "create" && containerNameFromCreateArgs(s.args).includes("_auth_"),
+          );
+          expect(gotrueCreate?.env["GOTRUE_EXTERNAL_PHONE_ENABLED"]).toBe("false");
+          expect(out.stderrText).toContain(
+            "WARN: no SMS provider is enabled. Disabling phone login",
+          );
+        }).pipe(
+          Effect.provide(layer),
+          Effect.ensuring(
+            Effect.sync(() => {
+              if (previous === undefined) delete process.env["SUPABASE_AUTH_SMS_ENABLE_SIGNUP"];
+              else process.env["SUPABASE_AUTH_SMS_ENABLE_SIGNUP"] = previous;
+            }),
+          ),
+        );
+      },
+    );
+  });
+
+  describe("SUPABASE_AUTH_EMAIL_* overrides", () => {
+    it.live(
+      "honors SUPABASE_AUTH_EMAIL_ENABLE_SIGNUP and SUPABASE_AUTH_EMAIL_OTP_LENGTH in GoTrue's env",
+      () => {
+        const previousEnableSignup = process.env["SUPABASE_AUTH_EMAIL_ENABLE_SIGNUP"];
+        const previousOtpLength = process.env["SUPABASE_AUTH_EMAIL_OTP_LENGTH"];
+        process.env["SUPABASE_AUTH_EMAIL_ENABLE_SIGNUP"] = "false";
+        process.env["SUPABASE_AUTH_EMAIL_OTP_LENGTH"] = "8";
+        const { layer, child } = setup();
+        return Effect.gen(function* () {
+          yield* legacyStart(flags());
+          const gotrueCreate = child.spawned.find(
+            (s) => s.args[0] === "create" && containerNameFromCreateArgs(s.args).includes("_auth_"),
+          );
+          expect(gotrueCreate?.env["GOTRUE_EXTERNAL_EMAIL_ENABLED"]).toBe("false");
+          expect(gotrueCreate?.env["GOTRUE_MAILER_OTP_LENGTH"]).toBe("8");
+        }).pipe(
+          Effect.provide(layer),
+          Effect.ensuring(
+            Effect.sync(() => {
+              if (previousEnableSignup === undefined) {
+                delete process.env["SUPABASE_AUTH_EMAIL_ENABLE_SIGNUP"];
+              } else {
+                process.env["SUPABASE_AUTH_EMAIL_ENABLE_SIGNUP"] = previousEnableSignup;
+              }
+              if (previousOtpLength === undefined) {
+                delete process.env["SUPABASE_AUTH_EMAIL_OTP_LENGTH"];
+              } else {
+                process.env["SUPABASE_AUTH_EMAIL_OTP_LENGTH"] = previousOtpLength;
+              }
+            }),
+          ),
+        );
+      },
+    );
+
+    it.live(
+      "honors SUPABASE_AUTH_EMAIL_TEMPLATE_<NAME>_SUBJECT in GoTrue's mailer subject env",
+      () => {
+        const previous = process.env["SUPABASE_AUTH_EMAIL_TEMPLATE_CONFIRMATION_SUBJECT"];
+        process.env["SUPABASE_AUTH_EMAIL_TEMPLATE_CONFIRMATION_SUBJECT"] = "Override subject";
+        const { layer, workdir, child } = setup({
+          configContents:
+            'project_id = "demo"\n[auth.email.template.confirmation]\ncontent_path = "./templates/confirmation.html"\n',
+        });
+        mkdirSync(join(workdir, "templates"), { recursive: true });
+        writeFileSync(join(workdir, "templates", "confirmation.html"), "<html></html>");
+        return Effect.gen(function* () {
+          yield* legacyStart(flags());
+          const gotrueCreate = child.spawned.find(
+            (s) => s.args[0] === "create" && containerNameFromCreateArgs(s.args).includes("_auth_"),
+          );
+          expect(gotrueCreate?.env["GOTRUE_MAILER_SUBJECTS_CONFIRMATION"]).toBe("Override subject");
+        }).pipe(
+          Effect.provide(layer),
+          Effect.ensuring(
+            Effect.sync(() => {
+              if (previous === undefined) {
+                delete process.env["SUPABASE_AUTH_EMAIL_TEMPLATE_CONFIRMATION_SUBJECT"];
+              } else {
+                process.env["SUPABASE_AUTH_EMAIL_TEMPLATE_CONFIRMATION_SUBJECT"] = previous;
+              }
+            }),
+          ),
+        );
+      },
+    );
+
+    it.live(
+      "fails fast on SUPABASE_AUTH_EMAIL_TEMPLATE_<NAME>_CONTENT with no content_path configured, matching Go's Config.Validate",
+      () => {
+        // Go's Viper `AutomaticEnv` folds this override into `Content *string` before
+        // `Config.Validate` runs (`config.go:749,882`), so `(e *email) validate` rejects it
+        // exactly like a raw TOML `content` key with no `content_path` — before start touches
+        // Docker at all.
+        const previous = process.env["SUPABASE_AUTH_EMAIL_TEMPLATE_CONFIRMATION_CONTENT"];
+        process.env["SUPABASE_AUTH_EMAIL_TEMPLATE_CONFIRMATION_CONTENT"] = "<html>Hi</html>";
+        const { layer, child } = setup({
+          configContents: 'project_id = "demo"\n[auth.email.template.confirmation]\n',
+        });
+        return Effect.gen(function* () {
+          const exit = yield* Effect.exit(legacyStart(flags()));
+          expect(Exit.isFailure(exit)).toBe(true);
+          if (Exit.isFailure(exit)) {
+            const serialized = JSON.stringify(exit.cause);
+            expect(serialized).toContain("LegacyStartInvalidConfigError");
+            expect(serialized).toContain(
+              "Invalid config for auth.email.template.confirmation.content: please use content_path instead",
+            );
+          }
+          expect(child.spawned.some((s) => s.args[0] === "create")).toBe(false);
+        }).pipe(
+          Effect.provide(layer),
+          Effect.ensuring(
+            Effect.sync(() => {
+              if (previous === undefined) {
+                delete process.env["SUPABASE_AUTH_EMAIL_TEMPLATE_CONFIRMATION_CONTENT"];
+              } else {
+                process.env["SUPABASE_AUTH_EMAIL_TEMPLATE_CONFIRMATION_CONTENT"] = previous;
+              }
+            }),
+          ),
+        );
+      },
+    );
+  });
+
+  describe("SUPABASE_DB_PORT override", () => {
+    it.live("publishes Postgres on the env-overridden DB port, not config.db.port", () => {
+      const previous = process.env["SUPABASE_DB_PORT"];
+      process.env["SUPABASE_DB_PORT"] = "54329";
+      const { layer, child } = setup();
+      return Effect.gen(function* () {
+        yield* legacyStart(flags());
+        const dbCreate = child.spawned.find(
+          (s) => s.args[0] === "create" && containerNameFromCreateArgs(s.args).includes("_db_"),
+        );
+        expect(dbCreate?.args).toContain("54329:5432");
+        expect(dbCreate?.args).not.toContain("54322:5432");
+      }).pipe(
+        Effect.provide(layer),
+        Effect.ensuring(
+          Effect.sync(() => {
+            if (previous === undefined) delete process.env["SUPABASE_DB_PORT"];
+            else process.env["SUPABASE_DB_PORT"] = previous;
+          }),
+        ),
+      );
+    });
+  });
+
+  describe("SUPABASE_DB_SETTINGS_* env overrides", () => {
+    it.live("honors SUPABASE_DB_SETTINGS_SHARED_BUFFERS in the rendered postgresql.conf", () => {
+      const previous = process.env["SUPABASE_DB_SETTINGS_SHARED_BUFFERS"];
+      process.env["SUPABASE_DB_SETTINGS_SHARED_BUFFERS"] = "256MB";
+      const { layer, child } = setup();
+      return Effect.gen(function* () {
+        yield* legacyStart(flags());
+        const dbCreate = child.spawned.find(
+          (s) => s.args[0] === "create" && containerNameFromCreateArgs(s.args).includes("_db_"),
+        );
+        expect(dbCreate?.args.some((arg) => arg.includes("shared_buffers = '256MB'"))).toBe(true);
+      }).pipe(
+        Effect.provide(layer),
+        Effect.ensuring(
+          Effect.sync(() => {
+            if (previous === undefined) delete process.env["SUPABASE_DB_SETTINGS_SHARED_BUFFERS"];
+            else process.env["SUPABASE_DB_SETTINGS_SHARED_BUFFERS"] = previous;
+          }),
+        ),
+      );
+    });
+  });
+
+  describe("storage feature env overrides", () => {
+    it.live(
+      "honors SUPABASE_STORAGE_S3_PROTOCOL_ENABLED and SUPABASE_STORAGE_VECTOR_ENABLED",
+      () => {
+        const previousS3 = process.env["SUPABASE_STORAGE_S3_PROTOCOL_ENABLED"];
+        const previousVector = process.env["SUPABASE_STORAGE_VECTOR_ENABLED"];
+        process.env["SUPABASE_STORAGE_S3_PROTOCOL_ENABLED"] = "false";
+        process.env["SUPABASE_STORAGE_VECTOR_ENABLED"] = "false";
+        const { layer, child } = setup();
+        return Effect.gen(function* () {
+          yield* legacyStart(flags());
+          const storageCreate = child.spawned.find(
+            (s) =>
+              s.args[0] === "create" && containerNameFromCreateArgs(s.args).includes("_storage_"),
+          );
+          expect(storageCreate?.env["S3_PROTOCOL_ENABLED"]).toBe("false");
+        }).pipe(
+          Effect.provide(layer),
+          Effect.ensuring(
+            Effect.sync(() => {
+              if (previousS3 === undefined)
+                delete process.env["SUPABASE_STORAGE_S3_PROTOCOL_ENABLED"];
+              else process.env["SUPABASE_STORAGE_S3_PROTOCOL_ENABLED"] = previousS3;
+              if (previousVector === undefined)
+                delete process.env["SUPABASE_STORAGE_VECTOR_ENABLED"];
+              else process.env["SUPABASE_STORAGE_VECTOR_ENABLED"] = previousVector;
+            }),
+          ),
+        );
+      },
+    );
+  });
+
+  describe("SUPABASE_ANALYTICS_* env overrides", () => {
+    it.live("honors SUPABASE_ANALYTICS_BACKEND/_GCP_* for both Logflare and Studio", () => {
+      const previousBackend = process.env["SUPABASE_ANALYTICS_BACKEND"];
+      const previousProjectId = process.env["SUPABASE_ANALYTICS_GCP_PROJECT_ID"];
+      const previousProjectNumber = process.env["SUPABASE_ANALYTICS_GCP_PROJECT_NUMBER"];
+      const previousJwtPath = process.env["SUPABASE_ANALYTICS_GCP_JWT_PATH"];
+      process.env["SUPABASE_ANALYTICS_BACKEND"] = "bigquery";
+      process.env["SUPABASE_ANALYTICS_GCP_PROJECT_ID"] = "env-gcp-project";
+      process.env["SUPABASE_ANALYTICS_GCP_PROJECT_NUMBER"] = "987654321";
+      process.env["SUPABASE_ANALYTICS_GCP_JWT_PATH"] = "gcp-key.json";
+      const { layer, child } = setup();
+      return Effect.gen(function* () {
+        yield* legacyStart(flags());
+        const logflareCreate = child.spawned.find(
+          (s) =>
+            s.args[0] === "create" && containerNameFromCreateArgs(s.args).includes("_analytics_"),
+        );
+        expect(logflareCreate?.env["GOOGLE_PROJECT_ID"]).toBe("env-gcp-project");
+        expect(logflareCreate?.env["GOOGLE_PROJECT_NUMBER"]).toBe("987654321");
+        const studioCreate = child.spawned.find(
+          (s) => s.args[0] === "create" && containerNameFromCreateArgs(s.args).includes("_studio_"),
+        );
+        expect(studioCreate?.env["NEXT_ANALYTICS_BACKEND_PROVIDER"]).toBe("bigquery");
+      }).pipe(
+        Effect.provide(layer),
+        Effect.ensuring(
+          Effect.sync(() => {
+            if (previousBackend === undefined) delete process.env["SUPABASE_ANALYTICS_BACKEND"];
+            else process.env["SUPABASE_ANALYTICS_BACKEND"] = previousBackend;
+            if (previousProjectId === undefined)
+              delete process.env["SUPABASE_ANALYTICS_GCP_PROJECT_ID"];
+            else process.env["SUPABASE_ANALYTICS_GCP_PROJECT_ID"] = previousProjectId;
+            if (previousProjectNumber === undefined)
+              delete process.env["SUPABASE_ANALYTICS_GCP_PROJECT_NUMBER"];
+            else process.env["SUPABASE_ANALYTICS_GCP_PROJECT_NUMBER"] = previousProjectNumber;
+            if (previousJwtPath === undefined)
+              delete process.env["SUPABASE_ANALYTICS_GCP_JWT_PATH"];
+            else process.env["SUPABASE_ANALYTICS_GCP_JWT_PATH"] = previousJwtPath;
+          }),
+        ),
+      );
+    });
+  });
+
+  describe("auth.* env overrides reach GoTrue's container", () => {
+    it.live("honors SUPABASE_AUTH_ENABLE_SIGNUP for GOTRUE_DISABLE_SIGNUP", () => {
+      const previous = process.env["SUPABASE_AUTH_ENABLE_SIGNUP"];
+      process.env["SUPABASE_AUTH_ENABLE_SIGNUP"] = "false";
+      const { layer, child } = setup();
+      return Effect.gen(function* () {
+        yield* legacyStart(flags());
+        const gotrueCreate = child.spawned.find(
+          (s) => s.args[0] === "create" && containerNameFromCreateArgs(s.args).includes("_auth_"),
+        );
+        expect(gotrueCreate?.env["GOTRUE_DISABLE_SIGNUP"]).toBe("true");
+      }).pipe(
+        Effect.provide(layer),
+        Effect.ensuring(
+          Effect.sync(() => {
+            if (previous === undefined) delete process.env["SUPABASE_AUTH_ENABLE_SIGNUP"];
+            else process.env["SUPABASE_AUTH_ENABLE_SIGNUP"] = previous;
+          }),
+        ),
+      );
+    });
+  });
+
+  describe("SUPABASE_EDGE_RUNTIME_DENO_VERSION override", () => {
+    it.live("resolves the Deno 1 edge-runtime image tag, not the Deno 2 default", () => {
+      const previous = process.env["SUPABASE_EDGE_RUNTIME_DENO_VERSION"];
+      process.env["SUPABASE_EDGE_RUNTIME_DENO_VERSION"] = "1";
+      const { layer, child } = setup();
+      return Effect.gen(function* () {
+        yield* legacyStart(flags());
+        const edgeRuntimeImageInspect = child.spawned.find(
+          (s) =>
+            s.args[0] === "image" &&
+            s.args[1] === "inspect" &&
+            (s.args[2] ?? "").includes("edge-runtime"),
+        );
+        expect(edgeRuntimeImageInspect?.args[2]).toBe(
+          "public.ecr.aws/supabase/edge-runtime:v1.68.4",
+        );
+      }).pipe(
+        Effect.provide(layer),
+        Effect.ensuring(
+          Effect.sync(() => {
+            if (previous === undefined) delete process.env["SUPABASE_EDGE_RUNTIME_DENO_VERSION"];
+            else process.env["SUPABASE_EDGE_RUNTIME_DENO_VERSION"] = previous;
+          }),
+        ),
+      );
+    });
+  });
+
+  describe("SUPABASE_REALTIME_* env overrides", () => {
+    it.live(
+      "honors SUPABASE_REALTIME_IP_VERSION/_MAX_HEADER_LENGTH for both the long-running container and the PG15+ setup job",
+      () => {
+        const previousIpVersion = process.env["SUPABASE_REALTIME_IP_VERSION"];
+        const previousMaxHeaderLength = process.env["SUPABASE_REALTIME_MAX_HEADER_LENGTH"];
+        process.env["SUPABASE_REALTIME_IP_VERSION"] = "IPv6";
+        process.env["SUPABASE_REALTIME_MAX_HEADER_LENGTH"] = "8192";
+        const { layer, child } = setup({ route: freshVolumeRoute(defaultRoute()) });
+        return Effect.gen(function* () {
+          yield* legacyStart(flags({ exclude: ["edge-runtime"] }));
+          const realtimeCreate = child.spawned.find(
+            (s) =>
+              s.args[0] === "create" && containerNameFromCreateArgs(s.args).includes("_realtime_"),
+          );
+          expect(realtimeCreate?.env["ERL_AFLAGS"]).toBe("-proto_dist inet6_tcp");
+          expect(realtimeCreate?.env["MAX_HEADER_LENGTH"]).toBe("8192");
+
+          // The first of the three PG15+ one-shot migrate jobs (realtime, storage, auth
+          // order) — see the "fresh volume: DB setup" describe block's own
+          // `dbSetupJobCalls` helper for the same `run --rm` shape.
+          const realtimeSetupJob = child.spawned.find(
+            (s) => s.args[0] === "run" && s.args[1] === "--rm",
+          );
+          expect(realtimeSetupJob?.env["ERL_AFLAGS"]).toBe("-proto_dist inet6_tcp");
+          expect(realtimeSetupJob?.env["MAX_HEADER_LENGTH"]).toBe("8192");
+        }).pipe(
+          Effect.provide(layer),
+          Effect.ensuring(
+            Effect.sync(() => {
+              if (previousIpVersion === undefined)
+                delete process.env["SUPABASE_REALTIME_IP_VERSION"];
+              else process.env["SUPABASE_REALTIME_IP_VERSION"] = previousIpVersion;
+              if (previousMaxHeaderLength === undefined)
+                delete process.env["SUPABASE_REALTIME_MAX_HEADER_LENGTH"];
+              else process.env["SUPABASE_REALTIME_MAX_HEADER_LENGTH"] = previousMaxHeaderLength;
+            }),
+          ),
+        );
+      },
+    );
+
+    it.live(
+      "fails with a typed config error, before any container is created, on an invalid SUPABASE_REALTIME_IP_VERSION",
+      () => {
+        const previous = process.env["SUPABASE_REALTIME_IP_VERSION"];
+        process.env["SUPABASE_REALTIME_IP_VERSION"] = "IPv5";
+        const { layer, child } = setup();
+        return Effect.gen(function* () {
+          const exit = yield* Effect.exit(legacyStart(flags()));
+          expect(Exit.isFailure(exit)).toBe(true);
+          if (Exit.isFailure(exit)) {
+            expect(JSON.stringify(exit.cause)).toContain("LegacyStartInvalidConfigError");
+          }
+          expect(child.spawned.some((s) => s.args[0] === "create")).toBe(false);
+        }).pipe(
+          Effect.provide(layer),
+          Effect.ensuring(
+            Effect.sync(() => {
+              if (previous === undefined) delete process.env["SUPABASE_REALTIME_IP_VERSION"];
+              else process.env["SUPABASE_REALTIME_IP_VERSION"] = previous;
+            }),
+          ),
+        );
+      },
+    );
+  });
+
+  describe("Studio API URL normalization", () => {
+    it.live(
+      "rewrites the default studio.api_url to the Kong URL rather than passing it through raw",
+      () => {
+        const { layer, child } = setup();
+        return Effect.gen(function* () {
+          yield* legacyStart(flags());
+          const studioCreate = child.spawned.find(
+            (s) =>
+              s.args[0] === "create" && containerNameFromCreateArgs(s.args).includes("_studio_"),
+          );
+          expect(studioCreate?.env["SUPABASE_PUBLIC_URL"]).toBe("http://127.0.0.1:54321");
+          expect(studioCreate?.env["SUPABASE_PUBLIC_URL"]).not.toBe("http://127.0.0.1");
+        }).pipe(Effect.provide(layer));
+      },
+    );
+  });
+
+  describe("SUPABASE_STORAGE_FILE_SIZE_LIMIT override", () => {
+    it.live(
+      "honors the override for both Storage's container and the fresh-volume migrate job",
+      () => {
+        const previous = process.env["SUPABASE_STORAGE_FILE_SIZE_LIMIT"];
+        process.env["SUPABASE_STORAGE_FILE_SIZE_LIMIT"] = "5MiB";
+        const { layer, child } = setup({ route: freshVolumeRoute(defaultRoute()) });
+        return Effect.gen(function* () {
+          yield* legacyStart(flags({ exclude: ["edge-runtime"] }));
+          const storageCreate = child.spawned.find(
+            (s) =>
+              s.args[0] === "create" && containerNameFromCreateArgs(s.args).includes("_storage_"),
+          );
+          expect(storageCreate?.env["FILE_SIZE_LIMIT"]).toBe(String(5 * 1024 * 1024));
+
+          // Second of the three PG15+ one-shot migrate jobs (realtime, storage, auth order).
+          const migrateJobs = child.spawned.filter(
+            (s) => s.args[0] === "run" && s.args[1] === "--rm",
+          );
+          expect(migrateJobs[1]?.env["FILE_SIZE_LIMIT"]).toBe(String(5 * 1024 * 1024));
+        }).pipe(
+          Effect.provide(layer),
+          Effect.ensuring(
+            Effect.sync(() => {
+              if (previous === undefined) delete process.env["SUPABASE_STORAGE_FILE_SIZE_LIMIT"];
+              else process.env["SUPABASE_STORAGE_FILE_SIZE_LIMIT"] = previous;
+            }),
+          ),
+        );
+      },
+    );
+  });
+
+  describe("SUPABASE_EXPERIMENTAL_ORIOLEDB_VERSION override", () => {
+    it.live(
+      "selects the OrioleDB Postgres image and enables the container's S3 env when set only via env",
+      () => {
+        const previous = process.env["SUPABASE_EXPERIMENTAL_ORIOLEDB_VERSION"];
+        process.env["SUPABASE_EXPERIMENTAL_ORIOLEDB_VERSION"] = "16.0.0.1";
+        const { layer, child } = setup();
+        return Effect.gen(function* () {
+          yield* legacyStart(flags());
+          const dbImageInspect = child.spawned.find(
+            (s) =>
+              s.args[0] === "image" &&
+              s.args[1] === "inspect" &&
+              (s.args[2] ?? "").includes("postgres"),
+          );
+          expect(dbImageInspect?.args[2]).toContain("16.0.0.1-orioledb");
+
+          const dbCreate = child.spawned.find(
+            (s) => s.args[0] === "create" && containerNameFromCreateArgs(s.args).includes("_db_"),
+          );
+          expect(dbCreate?.env["S3_ENABLED"]).toBe("true");
+        }).pipe(
+          Effect.provide(layer),
+          Effect.ensuring(
+            Effect.sync(() => {
+              if (previous === undefined)
+                delete process.env["SUPABASE_EXPERIMENTAL_ORIOLEDB_VERSION"];
+              else process.env["SUPABASE_EXPERIMENTAL_ORIOLEDB_VERSION"] = previous;
+            }),
+          ),
+        );
+      },
+    );
+
+    it.live("honors SUPABASE_EXPERIMENTAL_S3_HOST/_REGION/_ACCESS_KEY/_SECRET_KEY", () => {
+      const previousVersion = process.env["SUPABASE_EXPERIMENTAL_ORIOLEDB_VERSION"];
+      const previousHost = process.env["SUPABASE_EXPERIMENTAL_S3_HOST"];
+      const previousRegion = process.env["SUPABASE_EXPERIMENTAL_S3_REGION"];
+      const previousAccessKey = process.env["SUPABASE_EXPERIMENTAL_S3_ACCESS_KEY"];
+      const previousSecretKey = process.env["SUPABASE_EXPERIMENTAL_S3_SECRET_KEY"];
+      process.env["SUPABASE_EXPERIMENTAL_ORIOLEDB_VERSION"] = "16.0.0.1";
+      process.env["SUPABASE_EXPERIMENTAL_S3_HOST"] = "env-s3-host";
+      process.env["SUPABASE_EXPERIMENTAL_S3_REGION"] = "env-s3-region";
+      process.env["SUPABASE_EXPERIMENTAL_S3_ACCESS_KEY"] = "env-s3-access-key";
+      process.env["SUPABASE_EXPERIMENTAL_S3_SECRET_KEY"] = "env-s3-secret-key";
+      const { layer, child } = setup();
+      return Effect.gen(function* () {
+        yield* legacyStart(flags());
+        const dbCreate = child.spawned.find(
+          (s) => s.args[0] === "create" && containerNameFromCreateArgs(s.args).includes("_db_"),
+        );
+        expect(dbCreate?.env["S3_HOST"]).toBe("env-s3-host");
+        expect(dbCreate?.env["S3_REGION"]).toBe("env-s3-region");
+        expect(dbCreate?.env["S3_ACCESS_KEY"]).toBe("env-s3-access-key");
+        expect(dbCreate?.env["S3_SECRET_KEY"]).toBe("env-s3-secret-key");
+      }).pipe(
+        Effect.provide(layer),
+        Effect.ensuring(
+          Effect.sync(() => {
+            if (previousVersion === undefined)
+              delete process.env["SUPABASE_EXPERIMENTAL_ORIOLEDB_VERSION"];
+            else process.env["SUPABASE_EXPERIMENTAL_ORIOLEDB_VERSION"] = previousVersion;
+            if (previousHost === undefined) delete process.env["SUPABASE_EXPERIMENTAL_S3_HOST"];
+            else process.env["SUPABASE_EXPERIMENTAL_S3_HOST"] = previousHost;
+            if (previousRegion === undefined) delete process.env["SUPABASE_EXPERIMENTAL_S3_REGION"];
+            else process.env["SUPABASE_EXPERIMENTAL_S3_REGION"] = previousRegion;
+            if (previousAccessKey === undefined)
+              delete process.env["SUPABASE_EXPERIMENTAL_S3_ACCESS_KEY"];
+            else process.env["SUPABASE_EXPERIMENTAL_S3_ACCESS_KEY"] = previousAccessKey;
+            if (previousSecretKey === undefined)
+              delete process.env["SUPABASE_EXPERIMENTAL_S3_SECRET_KEY"];
+            else process.env["SUPABASE_EXPERIMENTAL_S3_SECRET_KEY"] = previousSecretKey;
+          }),
+        ),
+      );
+    });
+  });
+
+  describe("Kong's embedded default TLS cert/key", () => {
+    it.live(
+      "writes the embedded default cert/key when TLS is unconfigured, never empty files",
+      () => {
+        const { layer, child, workdir } = setup();
+        return Effect.gen(function* () {
+          yield* legacyStart(flags());
+          const kongCreate = child.spawned.find(
+            (s) => s.args[0] === "create" && containerNameFromCreateArgs(s.args).includes("_kong_"),
+          );
+          const kongContainerName = containerNameFromCreateArgs(kongCreate?.args ?? []);
+          const secretsDir = join(workdir, "supabase", ".temp", "start-secrets", kongContainerName);
+          // secretFiles order in kong.service.ts: [kong.yml, localhost.crt, localhost.key].
+          const crtContent = readFileSync(join(secretsDir, "secret-1"), "utf-8");
+          const keyContent = readFileSync(join(secretsDir, "secret-2"), "utf-8");
+          expect(crtContent).toBe(LEGACY_KONG_LOCAL_TLS_CERT);
+          expect(keyContent).toBe(LEGACY_KONG_LOCAL_TLS_KEY);
+        }).pipe(Effect.provide(layer));
+      },
+    );
+
+    // Go's `len(c.Api.Tls.CertPath) > 0` gate (`pkg/config/config.go:1006-1027`) treats an empty
+    // but present `cert_path`/`key_path` the same as absent — it must NOT attempt a disk read.
+    it.live(
+      "falls back to the embedded default cert/key when cert_path/key_path are present but empty",
+      () => {
+        const { layer, child, workdir } = setup({
+          configContents:
+            'project_id = "demo"\n[api.tls]\nenabled = true\ncert_path = ""\nkey_path = ""\n',
+        });
+        return Effect.gen(function* () {
+          yield* legacyStart(flags());
+          const kongCreate = child.spawned.find(
+            (s) => s.args[0] === "create" && containerNameFromCreateArgs(s.args).includes("_kong_"),
+          );
+          const kongContainerName = containerNameFromCreateArgs(kongCreate?.args ?? []);
+          const secretsDir = join(workdir, "supabase", ".temp", "start-secrets", kongContainerName);
+          const crtContent = readFileSync(join(secretsDir, "secret-1"), "utf-8");
+          const keyContent = readFileSync(join(secretsDir, "secret-2"), "utf-8");
+          expect(crtContent).toBe(LEGACY_KONG_LOCAL_TLS_CERT);
+          expect(keyContent).toBe(LEGACY_KONG_LOCAL_TLS_KEY);
+        }).pipe(Effect.provide(layer));
+      },
+    );
+  });
+
+  describe("SUPABASE_API_TLS_CERT_PATH/_KEY_PATH overrides", () => {
+    it.live(
+      "reads the env-overridden cert/key paths for Kong, not the (absent) TOML fields",
+      () => {
+        const previousCert = process.env["SUPABASE_API_TLS_CERT_PATH"];
+        const previousKey = process.env["SUPABASE_API_TLS_KEY_PATH"];
+        const { layer, workdir, child } = setup({
+          configContents: 'project_id = "demo"\n[api.tls]\nenabled = true\n',
+        });
+        mkdirSync(join(workdir, "supabase", "certs"), { recursive: true });
+        writeFileSync(
+          join(workdir, "supabase", "certs", "env-server.crt"),
+          "-----BEGIN CERTIFICATE-----env-cert",
+        );
+        writeFileSync(
+          join(workdir, "supabase", "certs", "env-server.key"),
+          "-----BEGIN PRIVATE KEY-----env-key",
+        );
+        process.env["SUPABASE_API_TLS_CERT_PATH"] = "certs/env-server.crt";
+        process.env["SUPABASE_API_TLS_KEY_PATH"] = "certs/env-server.key";
+        return Effect.gen(function* () {
+          yield* legacyStart(flags());
+          const kongCreate = child.spawned.find(
+            (s) => s.args[0] === "create" && containerNameFromCreateArgs(s.args).includes("_kong_"),
+          );
+          const kongContainerName = containerNameFromCreateArgs(kongCreate?.args ?? []);
+          const secretsDir = join(workdir, "supabase", ".temp", "start-secrets", kongContainerName);
+          const crtContent = readFileSync(join(secretsDir, "secret-1"), "utf-8");
+          const keyContent = readFileSync(join(secretsDir, "secret-2"), "utf-8");
+          expect(crtContent).toBe("-----BEGIN CERTIFICATE-----env-cert");
+          expect(keyContent).toBe("-----BEGIN PRIVATE KEY-----env-key");
+        }).pipe(
+          Effect.provide(layer),
+          Effect.ensuring(
+            Effect.sync(() => {
+              if (previousCert === undefined) delete process.env["SUPABASE_API_TLS_CERT_PATH"];
+              else process.env["SUPABASE_API_TLS_CERT_PATH"] = previousCert;
+              if (previousKey === undefined) delete process.env["SUPABASE_API_TLS_KEY_PATH"];
+              else process.env["SUPABASE_API_TLS_KEY_PATH"] = previousKey;
+            }),
+          ),
+        );
+      },
+    );
+  });
+
+  describe("SUPABASE_API_ENABLED override", () => {
+    // Go nests the entire TLS cert/key disk read inside `if c.Api.Enabled`
+    // (`pkg/config/config.go:1006-1027`) — when API is disabled (however that happened), Kong
+    // keeps its embedded default cert/key regardless of `api.tls.enabled`/cert_path/key_path.
+    it.live(
+      "skips the configured cert/key read for Kong when API is disabled only via env override",
+      () => {
+        const previous = process.env["SUPABASE_API_ENABLED"];
+        process.env["SUPABASE_API_ENABLED"] = "false";
+        const { layer, workdir, child } = setup({
+          configContents: 'project_id = "demo"\n[api.tls]\nenabled = true\n',
+        });
+        mkdirSync(join(workdir, "supabase", "certs"), { recursive: true });
+        writeFileSync(
+          join(workdir, "supabase", "certs", "server.crt"),
+          "-----BEGIN CERTIFICATE-----custom-cert",
+        );
+        writeFileSync(
+          join(workdir, "supabase", "certs", "server.key"),
+          "-----BEGIN PRIVATE KEY-----custom-key",
+        );
+        return Effect.gen(function* () {
+          yield* legacyStart(flags());
+          const kongCreate = child.spawned.find(
+            (s) => s.args[0] === "create" && containerNameFromCreateArgs(s.args).includes("_kong_"),
+          );
+          const kongContainerName = containerNameFromCreateArgs(kongCreate?.args ?? []);
+          const secretsDir = join(workdir, "supabase", ".temp", "start-secrets", kongContainerName);
+          const crtContent = readFileSync(join(secretsDir, "secret-1"), "utf-8");
+          const keyContent = readFileSync(join(secretsDir, "secret-2"), "utf-8");
+          expect(crtContent).toBe(LEGACY_KONG_LOCAL_TLS_CERT);
+          expect(keyContent).toBe(LEGACY_KONG_LOCAL_TLS_KEY);
+        }).pipe(
+          Effect.provide(layer),
+          Effect.ensuring(
+            Effect.sync(() => {
+              if (previous === undefined) delete process.env["SUPABASE_API_ENABLED"];
+              else process.env["SUPABASE_API_ENABLED"] = previous;
+            }),
+          ),
+        );
+      },
+    );
+
+    it.live(
+      "fails with a typed config error, before any container is created, on an invalid SUPABASE_API_ENABLED",
+      () => {
+        const previous = process.env["SUPABASE_API_ENABLED"];
+        process.env["SUPABASE_API_ENABLED"] = "not-a-bool";
+        const { layer, child } = setup();
+        return Effect.gen(function* () {
+          const exit = yield* Effect.exit(legacyStart(flags()));
+          expect(Exit.isFailure(exit)).toBe(true);
+          if (Exit.isFailure(exit)) {
+            expect(JSON.stringify(exit.cause)).toContain("LegacyStartInvalidConfigError");
+          }
+          expect(child.spawned.some((s) => s.args[0] === "create")).toBe(false);
+        }).pipe(
+          Effect.provide(layer),
+          Effect.ensuring(
+            Effect.sync(() => {
+              if (previous === undefined) delete process.env["SUPABASE_API_ENABLED"];
+              else process.env["SUPABASE_API_ENABLED"] = previous;
+            }),
+          ),
+        );
+      },
+    );
+  });
+
+  describe("SUPABASE_AUTH_JWT_EXPIRY reaches Postgres init", () => {
+    it.live("honors the override for Postgres's JWT_EXP, not just GoTrue's GOTRUE_JWT_EXP", () => {
+      const previous = process.env["SUPABASE_AUTH_JWT_EXPIRY"];
+      process.env["SUPABASE_AUTH_JWT_EXPIRY"] = "7200";
+      const { layer, child } = setup();
+      return Effect.gen(function* () {
+        yield* legacyStart(flags());
+        const dbCreate = child.spawned.find(
+          (s) => s.args[0] === "create" && containerNameFromCreateArgs(s.args).includes("_db_"),
+        );
+        expect(dbCreate?.env["JWT_EXP"]).toBe("7200");
+        const gotrueCreate = child.spawned.find(
+          (s) => s.args[0] === "create" && containerNameFromCreateArgs(s.args).includes("_auth_"),
+        );
+        expect(gotrueCreate?.env["GOTRUE_JWT_EXP"]).toBe("7200");
+      }).pipe(
+        Effect.provide(layer),
+        Effect.ensuring(
+          Effect.sync(() => {
+            if (previous === undefined) delete process.env["SUPABASE_AUTH_JWT_EXPIRY"];
+            else process.env["SUPABASE_AUTH_JWT_EXPIRY"] = previous;
+          }),
+        ),
+      );
+    });
+  });
+
+  describe("encrypted secrets reach GoTrue's container", () => {
+    it.live("decrypts an encrypted external OAuth provider secret (known provider)", () => {
+      const previous = process.env["DOTENV_PRIVATE_KEY"];
+      process.env["DOTENV_PRIVATE_KEY"] = VAULT_PRIVATE_KEY;
+      const { layer, child } = setup({
+        configContents: `project_id = "demo"\n[auth.external.github]\nenabled = true\nclient_id = "gh-client-id"\nsecret = "${VAULT_ENCRYPTED}"\n`,
+      });
+      return Effect.gen(function* () {
+        yield* legacyStart(flags());
+        const gotrueCreate = child.spawned.find(
+          (s) => s.args[0] === "create" && containerNameFromCreateArgs(s.args).includes("_auth_"),
+        );
+        expect(gotrueCreate?.env["GOTRUE_EXTERNAL_GITHUB_SECRET"]).toBe("value");
+      }).pipe(
+        Effect.provide(layer),
+        Effect.ensuring(
+          Effect.sync(() => {
+            if (previous === undefined) delete process.env["DOTENV_PRIVATE_KEY"];
+            else process.env["DOTENV_PRIVATE_KEY"] = previous;
+          }),
+        ),
+      );
+    });
+
+    it.live(
+      "decrypts an encrypted external OAuth provider secret (custom/unmodeled provider)",
+      () => {
+        const previous = process.env["DOTENV_PRIVATE_KEY"];
+        process.env["DOTENV_PRIVATE_KEY"] = VAULT_PRIVATE_KEY;
+        const { layer, child } = setup({
+          configContents: `project_id = "demo"\n[auth.external.my_oidc]\nenabled = true\nclient_id = "custom-client-id"\nsecret = "${VAULT_ENCRYPTED}"\n`,
+        });
+        return Effect.gen(function* () {
+          yield* legacyStart(flags());
+          const gotrueCreate = child.spawned.find(
+            (s) => s.args[0] === "create" && containerNameFromCreateArgs(s.args).includes("_auth_"),
+          );
+          expect(gotrueCreate?.env["GOTRUE_EXTERNAL_MY_OIDC_SECRET"]).toBe("value");
+        }).pipe(
+          Effect.provide(layer),
+          Effect.ensuring(
+            Effect.sync(() => {
+              if (previous === undefined) delete process.env["DOTENV_PRIVATE_KEY"];
+              else process.env["DOTENV_PRIVATE_KEY"] = previous;
+            }),
+          ),
+        );
+      },
+    );
+
+    it.live("decrypts an encrypted Twilio SMS auth_token", () => {
+      const previous = process.env["DOTENV_PRIVATE_KEY"];
+      process.env["DOTENV_PRIVATE_KEY"] = VAULT_PRIVATE_KEY;
+      const { layer, child } = setup({
+        configContents: `project_id = "demo"\n[auth.sms.twilio]\nenabled = true\naccount_sid = "AC123"\nauth_token = "${VAULT_ENCRYPTED}"\nmessage_service_sid = "MG123"\n`,
+      });
+      return Effect.gen(function* () {
+        yield* legacyStart(flags());
+        const gotrueCreate = child.spawned.find(
+          (s) => s.args[0] === "create" && containerNameFromCreateArgs(s.args).includes("_auth_"),
+        );
+        expect(gotrueCreate?.env["GOTRUE_SMS_TWILIO_AUTH_TOKEN"]).toBe("value");
+      }).pipe(
+        Effect.provide(layer),
+        Effect.ensuring(
+          Effect.sync(() => {
+            if (previous === undefined) delete process.env["DOTENV_PRIVATE_KEY"];
+            else process.env["DOTENV_PRIVATE_KEY"] = previous;
+          }),
+        ),
+      );
+    });
+  });
+
+  describe("Edge Runtime secrets", () => {
+    it.live(
+      "resolves configured [edge_runtime.secrets] into the runtime's env, not dropped",
+      () => {
+        const { layer, child } = setup({
+          configContents:
+            'project_id = "demo"\n[edge_runtime.secrets]\nMY_SECRET = "shh-do-not-tell"\n',
+        });
+        return Effect.gen(function* () {
+          yield* legacyStart(flags());
+          const edgeRuntimeRunCall = child.spawned.find(
+            (s) => s.args[0] === "run" && s.args[1] === "-d",
+          );
+          const args = edgeRuntimeRunCall?.args ?? [];
+          const envFileIndex = args.indexOf("--env-file");
+          const envFilePath = envFileIndex !== -1 ? args[envFileIndex + 1] : undefined;
+          expect(envFilePath).toBeDefined();
+          const envFileContent = readFileSync(envFilePath ?? "", "utf-8");
+          expect(envFileContent).toContain("MY_SECRET=shh-do-not-tell");
+        }).pipe(Effect.provide(layer));
+      },
+    );
+
+    it.live(
+      "decrypts an encrypted [edge_runtime.secrets] entry into plaintext, not the raw ciphertext",
+      () => {
+        // Mirrors "encrypted secrets reach GoTrue's container" above, but for
+        // `edge_runtime.secrets` — Go's `DecryptSecretHookFunc` decrypts this field during
+        // `Config.Load` too, so the real Edge Runtime container's env file must contain the
+        // decrypted "value", never the literal `encrypted:...` string.
+        const previous = process.env["DOTENV_PRIVATE_KEY"];
+        process.env["DOTENV_PRIVATE_KEY"] = VAULT_PRIVATE_KEY;
+        const { layer, child } = setup({
+          configContents: `project_id = "demo"\n[edge_runtime.secrets]\nMY_SECRET = "${VAULT_ENCRYPTED}"\n`,
+        });
+        return Effect.gen(function* () {
+          yield* legacyStart(flags());
+          const edgeRuntimeRunCall = child.spawned.find(
+            (s) => s.args[0] === "run" && s.args[1] === "-d",
+          );
+          const args = edgeRuntimeRunCall?.args ?? [];
+          const envFileIndex = args.indexOf("--env-file");
+          const envFilePath = envFileIndex !== -1 ? args[envFileIndex + 1] : undefined;
+          expect(envFilePath).toBeDefined();
+          const envFileContent = readFileSync(envFilePath ?? "", "utf-8");
+          expect(envFileContent).toContain("MY_SECRET=value");
+          expect(envFileContent).not.toContain("encrypted:");
+        }).pipe(
+          Effect.provide(layer),
+          Effect.ensuring(
+            Effect.sync(() => {
+              if (previous === undefined) delete process.env["DOTENV_PRIVATE_KEY"];
+              else process.env["DOTENV_PRIVATE_KEY"] = previous;
+            }),
+          ),
+        );
+      },
+    );
+
+    it.live(
+      "fails with a typed config error, before any container is created, on an undecryptable [edge_runtime.secrets] entry",
+      () => {
+        // Caught eagerly by `legacyCheckDbToml`'s `legacyAssertDecryptableSecrets` pre-check
+        // (`edge_runtime.secrets.*` is one of `LEGACY_SECRET_PATHS`), well before the bring-up
+        // loop's own edge-runtime-specific decrypt — same shape as the sibling `[db.vault]`
+        // "even on a non-fresh volume" test above.
+        const previous = process.env["DOTENV_PRIVATE_KEY"];
+        delete process.env["DOTENV_PRIVATE_KEY"];
+        const { layer, child } = setup({
+          configContents: `project_id = "demo"\n[edge_runtime.secrets]\nMY_SECRET = "${VAULT_ENCRYPTED}"\n`,
+        });
+        return Effect.gen(function* () {
+          const exit = yield* Effect.exit(legacyStart(flags()));
+          expect(Exit.isFailure(exit)).toBe(true);
+          if (Exit.isFailure(exit)) {
+            const serialized = JSON.stringify(exit.cause);
+            expect(serialized).toContain("LegacyDbConfigLoadError");
+            expect(serialized).toContain("failed to parse config: missing private key");
+          }
+          expect(child.spawned.some((s) => s.args[0] === "create")).toBe(false);
+        }).pipe(
+          Effect.provide(layer),
+          Effect.ensuring(
+            Effect.sync(() => {
+              if (previous === undefined) delete process.env["DOTENV_PRIVATE_KEY"];
+              else process.env["DOTENV_PRIVATE_KEY"] = previous;
+            }),
+          ),
+        );
+      },
+    );
+  });
+
+  describe("SUPABASE_API_* env overrides reach PostgREST and Studio", () => {
+    it.live("honors SUPABASE_API_SCHEMAS/_EXTRA_SEARCH_PATH/_MAX_ROWS in both containers", () => {
+      const previousSchemas = process.env["SUPABASE_API_SCHEMAS"];
+      const previousSearchPath = process.env["SUPABASE_API_EXTRA_SEARCH_PATH"];
+      const previousMaxRows = process.env["SUPABASE_API_MAX_ROWS"];
+      process.env["SUPABASE_API_SCHEMAS"] = "public,custom";
+      process.env["SUPABASE_API_EXTRA_SEARCH_PATH"] = "extensions,other";
+      process.env["SUPABASE_API_MAX_ROWS"] = "500";
+      const { layer, child } = setup();
+      return Effect.gen(function* () {
+        yield* legacyStart(flags());
+        const restCreate = child.spawned.find(
+          (s) => s.args[0] === "create" && containerNameFromCreateArgs(s.args).includes("_rest_"),
+        );
+        expect(restCreate?.env["PGRST_DB_SCHEMAS"]).toBe("public,custom");
+        expect(restCreate?.env["PGRST_DB_EXTRA_SEARCH_PATH"]).toBe("extensions,other");
+        expect(restCreate?.env["PGRST_DB_MAX_ROWS"]).toBe("500");
+        const studioCreate = child.spawned.find(
+          (s) => s.args[0] === "create" && containerNameFromCreateArgs(s.args).includes("_studio_"),
+        );
+        expect(studioCreate?.env["PGRST_DB_SCHEMAS"]).toBe("public,custom");
+        expect(studioCreate?.env["PGRST_DB_EXTRA_SEARCH_PATH"]).toBe("extensions,other");
+        expect(studioCreate?.env["PGRST_DB_MAX_ROWS"]).toBe("500");
+      }).pipe(
+        Effect.provide(layer),
+        Effect.ensuring(
+          Effect.sync(() => {
+            if (previousSchemas === undefined) delete process.env["SUPABASE_API_SCHEMAS"];
+            else process.env["SUPABASE_API_SCHEMAS"] = previousSchemas;
+            if (previousSearchPath === undefined)
+              delete process.env["SUPABASE_API_EXTRA_SEARCH_PATH"];
+            else process.env["SUPABASE_API_EXTRA_SEARCH_PATH"] = previousSearchPath;
+            if (previousMaxRows === undefined) delete process.env["SUPABASE_API_MAX_ROWS"];
+            else process.env["SUPABASE_API_MAX_ROWS"] = previousMaxRows;
+          }),
+        ),
+      );
+    });
+
+    it.live(
+      "fails with a typed config error, before any container is created, on an invalid SUPABASE_API_MAX_ROWS",
+      () => {
+        const previous = process.env["SUPABASE_API_MAX_ROWS"];
+        process.env["SUPABASE_API_MAX_ROWS"] = "not-a-number";
+        const { layer, child } = setup();
+        return Effect.gen(function* () {
+          const exit = yield* Effect.exit(legacyStart(flags()));
+          expect(Exit.isFailure(exit)).toBe(true);
+          if (Exit.isFailure(exit)) {
+            expect(JSON.stringify(exit.cause)).toContain("LegacyStartInvalidConfigError");
+          }
+          expect(child.spawned.some((s) => s.args[0] === "create")).toBe(false);
+        }).pipe(
+          Effect.provide(layer),
+          Effect.ensuring(
+            Effect.sync(() => {
+              if (previous === undefined) delete process.env["SUPABASE_API_MAX_ROWS"];
+              else process.env["SUPABASE_API_MAX_ROWS"] = previous;
+            }),
+          ),
+        );
+      },
+    );
+  });
+
+  describe("SUPABASE_DB_POOLER_* env overrides reach Supavisor", () => {
+    it.live("SUPABASE_DB_POOLER_POOL_MODE=session flips the published host port to 5432", () => {
+      const previous = process.env["SUPABASE_DB_POOLER_POOL_MODE"];
+      process.env["SUPABASE_DB_POOLER_POOL_MODE"] = "session";
+      const { layer, child } = setup({
+        configContents: 'project_id = "demo"\n[db.pooler]\nenabled = true\n',
+      });
+      return Effect.gen(function* () {
+        yield* legacyStart(flags());
+        const poolerCreate = child.spawned.find(
+          (s) => s.args[0] === "create" && containerNameFromCreateArgs(s.args).includes("_pooler_"),
+        );
+        // `db.pooler.port` defaults to 54329 (`packages/config/src/db.ts`) —
+        // the published `-p <hostPort>:<containerPort>` mapping is what
+        // changes with pool mode; the exposed-ports list always lists both
+        // 5432 and 6543 regardless, so assert on the specific mapping string.
+        expect(poolerCreate?.args).toContain("54329:5432");
+        expect(poolerCreate?.args).not.toContain("54329:6543");
+      }).pipe(
+        Effect.provide(layer),
+        Effect.ensuring(
+          Effect.sync(() => {
+            if (previous === undefined) delete process.env["SUPABASE_DB_POOLER_POOL_MODE"];
+            else process.env["SUPABASE_DB_POOLER_POOL_MODE"] = previous;
+          }),
+        ),
+      );
+    });
+
+    it.live(
+      "fails with a typed config error, before any container is created, on an invalid SUPABASE_DB_POOLER_POOL_MODE",
+      () => {
+        const previous = process.env["SUPABASE_DB_POOLER_POOL_MODE"];
+        process.env["SUPABASE_DB_POOLER_POOL_MODE"] = "bogus";
+        const { layer, child } = setup({
+          configContents: 'project_id = "demo"\n[db.pooler]\nenabled = true\n',
+        });
+        return Effect.gen(function* () {
+          const exit = yield* Effect.exit(legacyStart(flags()));
+          expect(Exit.isFailure(exit)).toBe(true);
+          if (Exit.isFailure(exit)) {
+            expect(JSON.stringify(exit.cause)).toContain("LegacyStartInvalidConfigError");
+          }
+          expect(child.spawned.some((s) => s.args[0] === "create")).toBe(false);
+        }).pipe(
+          Effect.provide(layer),
+          Effect.ensuring(
+            Effect.sync(() => {
+              if (previous === undefined) delete process.env["SUPABASE_DB_POOLER_POOL_MODE"];
+              else process.env["SUPABASE_DB_POOLER_POOL_MODE"] = previous;
+            }),
+          ),
+        );
+      },
+    );
+
+    it.live(
+      "fails with a typed config error, before any container is created, on an invalid SUPABASE_REALTIME_ENABLED",
+      () => {
+        const previous = process.env["SUPABASE_REALTIME_ENABLED"];
+        process.env["SUPABASE_REALTIME_ENABLED"] = "maybe";
+        const { layer, child } = setup({ configContents: 'project_id = "demo"\n' });
+        return Effect.gen(function* () {
+          const exit = yield* Effect.exit(legacyStart(flags()));
+          expect(Exit.isFailure(exit)).toBe(true);
+          if (Exit.isFailure(exit)) {
+            expect(JSON.stringify(exit.cause)).toContain("LegacyStartInvalidConfigError");
+          }
+          expect(child.spawned.some((s) => s.args[0] === "create")).toBe(false);
+        }).pipe(
+          Effect.provide(layer),
+          Effect.ensuring(
+            Effect.sync(() => {
+              if (previous === undefined) delete process.env["SUPABASE_REALTIME_ENABLED"];
+              else process.env["SUPABASE_REALTIME_ENABLED"] = previous;
+            }),
+          ),
+        );
+      },
+    );
+
+    it.live("SUPABASE_DB_POOLER_PORT overrides the published host port", () => {
+      const previous = process.env["SUPABASE_DB_POOLER_PORT"];
+      process.env["SUPABASE_DB_POOLER_PORT"] = "60001";
+      const { layer, child } = setup({
+        configContents: 'project_id = "demo"\n[db.pooler]\nenabled = true\n',
+      });
+      return Effect.gen(function* () {
+        yield* legacyStart(flags());
+        const poolerCreate = child.spawned.find(
+          (s) => s.args[0] === "create" && containerNameFromCreateArgs(s.args).includes("_pooler_"),
+        );
+        // Default pool_mode ("transaction") publishes the pooler port against
+        // container port 6543 — see the SUPABASE_DB_POOLER_POOL_MODE test above.
+        expect(poolerCreate?.args).toContain("60001:6543");
+        expect(poolerCreate?.args).not.toContain("54329:6543");
+      }).pipe(
+        Effect.provide(layer),
+        Effect.ensuring(
+          Effect.sync(() => {
+            if (previous === undefined) delete process.env["SUPABASE_DB_POOLER_PORT"];
+            else process.env["SUPABASE_DB_POOLER_PORT"] = previous;
+          }),
+        ),
+      );
+    });
+  });
+
+  describe("SUPABASE_ANALYTICS_PORT override", () => {
+    it.live("overrides the published Logflare host port", () => {
+      const previous = process.env["SUPABASE_ANALYTICS_PORT"];
+      process.env["SUPABASE_ANALYTICS_PORT"] = "60002";
+      const { layer, child } = setup();
+      return Effect.gen(function* () {
+        yield* legacyStart(flags());
+        const logflareCreate = child.spawned.find(
+          (s) =>
+            s.args[0] === "create" && containerNameFromCreateArgs(s.args).includes("_analytics_"),
+        );
+        expect(logflareCreate?.args).toContain("60002:4000");
+        expect(logflareCreate?.args).not.toContain("54327:4000");
+      }).pipe(
+        Effect.provide(layer),
+        Effect.ensuring(
+          Effect.sync(() => {
+            if (previous === undefined) delete process.env["SUPABASE_ANALYTICS_PORT"];
+            else process.env["SUPABASE_ANALYTICS_PORT"] = previous;
+          }),
+        ),
+      );
+    });
+
+    it.live(
+      "fails with a typed config error, before any container is created, on an invalid SUPABASE_ANALYTICS_VECTOR_PORT",
+      () => {
+        // `analytics.vector_port` (Logflare's deprecated Vector port) is decoded in the same
+        // Config.Load pass as `analytics.port` above — nothing downstream in `start` reads the
+        // resolved value, but a malformed override must still fail eagerly, same reasoning as
+        // the SUPABASE_LOCAL_SMTP_SMTP_PORT/SUPABASE_EDGE_RUNTIME_INSPECTOR_PORT tests elsewhere
+        // in this file.
+        const previous = process.env["SUPABASE_ANALYTICS_VECTOR_PORT"];
+        process.env["SUPABASE_ANALYTICS_VECTOR_PORT"] = "not-a-port";
+        const { layer, child } = setup();
+        return Effect.gen(function* () {
+          const exit = yield* Effect.exit(legacyStart(flags()));
+          expect(Exit.isFailure(exit)).toBe(true);
+          if (Exit.isFailure(exit)) {
+            const serialized = JSON.stringify(exit.cause);
+            expect(serialized).toContain("LegacyStartInvalidConfigError");
+            expect(serialized).toContain("invalid config for analytics.vector_port");
+          }
+          expect(child.spawned.some((s) => s.args[0] === "create")).toBe(false);
+        }).pipe(
+          Effect.provide(layer),
+          Effect.ensuring(
+            Effect.sync(() => {
+              if (previous === undefined) delete process.env["SUPABASE_ANALYTICS_VECTOR_PORT"];
+              else process.env["SUPABASE_ANALYTICS_VECTOR_PORT"] = previous;
+            }),
+          ),
+        );
+      },
+    );
+  });
+
+  describe("SUPABASE_DB_HEALTH_TIMEOUT override", () => {
+    it.live(
+      "honors an env-overridden health_timeout, not just the config.toml/default value",
+      () => {
+        const previous = process.env["SUPABASE_DB_HEALTH_TIMEOUT"];
+        process.env["SUPABASE_DB_HEALTH_TIMEOUT"] = "2s";
+        const neverHealthy = new Set<string>();
+        const base = defaultRoute({ neverHealthy });
+        const route = (args: ReadonlyArray<string>): RouteResult => {
+          if (args[0] === "create") {
+            const name = containerNameFromCreateArgs(args);
+            if (name.includes("_db_")) neverHealthy.add(name);
+          }
+          return base(args);
+        };
+        const { layer, child } = setup({ route });
+        return Effect.gen(function* () {
+          const exit = yield* Effect.exit(legacyStart(flags()));
+          expect(Exit.isFailure(exit)).toBe(true);
+          if (Exit.isFailure(exit)) {
+            expect(JSON.stringify(exit.cause)).toContain("LegacyHealthCheckTimeoutError");
+          }
+          // Postgres's own health wait fails before any other service is ever created —
+          // proving the short env-overridden timeout took effect (the default is much longer).
+          expect(createdContainerNames(child.spawned)).toEqual([expect.stringContaining("_db_")]);
+        }).pipe(
+          Effect.provide(layer),
+          Effect.ensuring(
+            Effect.sync(() => {
+              if (previous === undefined) delete process.env["SUPABASE_DB_HEALTH_TIMEOUT"];
+              else process.env["SUPABASE_DB_HEALTH_TIMEOUT"] = previous;
+            }),
+          ),
+        );
+      },
+      10_000,
+    );
+  });
+
+  describe("auth.hook.* env overrides reach GoTrue's container", () => {
+    it.live("honors SUPABASE_AUTH_HOOK_CUSTOM_ACCESS_TOKEN_ENABLED/_URI", () => {
+      const previousEnabled = process.env["SUPABASE_AUTH_HOOK_CUSTOM_ACCESS_TOKEN_ENABLED"];
+      const previousUri = process.env["SUPABASE_AUTH_HOOK_CUSTOM_ACCESS_TOKEN_URI"];
+      process.env["SUPABASE_AUTH_HOOK_CUSTOM_ACCESS_TOKEN_ENABLED"] = "true";
+      // A pg-functions URI needs no `secrets` (unlike http/https, validated by
+      // `legacyValidateResolvedConfig`), keeping this scenario focused on the
+      // enabled/uri override reaching GoTrue.
+      process.env["SUPABASE_AUTH_HOOK_CUSTOM_ACCESS_TOKEN_URI"] =
+        "pg-functions://postgres/auth/custom-access-token-hook";
+      const { layer, child } = setup({
+        configContents: 'project_id = "demo"\n[auth.hook.custom_access_token]\nenabled = false\n',
+      });
+      return Effect.gen(function* () {
+        yield* legacyStart(flags());
+        const gotrueCreate = child.spawned.find(
+          (s) => s.args[0] === "create" && containerNameFromCreateArgs(s.args).includes("_auth_"),
+        );
+        expect(gotrueCreate?.env["GOTRUE_HOOK_CUSTOM_ACCESS_TOKEN_ENABLED"]).toBe("true");
+        expect(gotrueCreate?.env["GOTRUE_HOOK_CUSTOM_ACCESS_TOKEN_URI"]).toBe(
+          "pg-functions://postgres/auth/custom-access-token-hook",
+        );
+      }).pipe(
+        Effect.provide(layer),
+        Effect.ensuring(
+          Effect.sync(() => {
+            if (previousEnabled === undefined)
+              delete process.env["SUPABASE_AUTH_HOOK_CUSTOM_ACCESS_TOKEN_ENABLED"];
+            else process.env["SUPABASE_AUTH_HOOK_CUSTOM_ACCESS_TOKEN_ENABLED"] = previousEnabled;
+            if (previousUri === undefined)
+              delete process.env["SUPABASE_AUTH_HOOK_CUSTOM_ACCESS_TOKEN_URI"];
+            else process.env["SUPABASE_AUTH_HOOK_CUSTOM_ACCESS_TOKEN_URI"] = previousUri;
+          }),
+        ),
+      );
+    });
+  });
+
+  describe("auth.captcha.* env overrides reach GoTrue's container", () => {
+    it.live("honors SUPABASE_AUTH_CAPTCHA_ENABLED/_PROVIDER", () => {
+      const previousEnabled = process.env["SUPABASE_AUTH_CAPTCHA_ENABLED"];
+      const previousProvider = process.env["SUPABASE_AUTH_CAPTCHA_PROVIDER"];
+      process.env["SUPABASE_AUTH_CAPTCHA_ENABLED"] = "true";
+      process.env["SUPABASE_AUTH_CAPTCHA_PROVIDER"] = "turnstile";
+      const { layer, child } = setup({
+        configContents:
+          'project_id = "demo"\n[auth.captcha]\nenabled = false\nprovider = "hcaptcha"\nsecret = "test-secret"\n',
+      });
+      return Effect.gen(function* () {
+        yield* legacyStart(flags());
+        const gotrueCreate = child.spawned.find(
+          (s) => s.args[0] === "create" && containerNameFromCreateArgs(s.args).includes("_auth_"),
+        );
+        expect(gotrueCreate?.env["GOTRUE_SECURITY_CAPTCHA_ENABLED"]).toBe("true");
+        expect(gotrueCreate?.env["GOTRUE_SECURITY_CAPTCHA_PROVIDER"]).toBe("turnstile");
+      }).pipe(
+        Effect.provide(layer),
+        Effect.ensuring(
+          Effect.sync(() => {
+            if (previousEnabled === undefined) delete process.env["SUPABASE_AUTH_CAPTCHA_ENABLED"];
+            else process.env["SUPABASE_AUTH_CAPTCHA_ENABLED"] = previousEnabled;
+            if (previousProvider === undefined)
+              delete process.env["SUPABASE_AUTH_CAPTCHA_PROVIDER"];
+            else process.env["SUPABASE_AUTH_CAPTCHA_PROVIDER"] = previousProvider;
+          }),
+        ),
+      );
+    });
+  });
+
+  describe("nested auth security env overrides reach GoTrue's container", () => {
+    it.live("honors SUPABASE_AUTH_SESSIONS_TIMEBOX", () => {
+      const previous = process.env["SUPABASE_AUTH_SESSIONS_TIMEBOX"];
+      process.env["SUPABASE_AUTH_SESSIONS_TIMEBOX"] = "24h";
+      const { layer, child } = setup({ configContents: 'project_id = "demo"\n' });
+      return Effect.gen(function* () {
+        yield* legacyStart(flags());
+        const gotrueCreate = child.spawned.find(
+          (s) => s.args[0] === "create" && containerNameFromCreateArgs(s.args).includes("_auth_"),
+        );
+        expect(gotrueCreate?.env["GOTRUE_SESSIONS_TIMEBOX"]).toBe("24h0m0s");
+      }).pipe(
+        Effect.provide(layer),
+        Effect.ensuring(
+          Effect.sync(() => {
+            if (previous === undefined) delete process.env["SUPABASE_AUTH_SESSIONS_TIMEBOX"];
+            else process.env["SUPABASE_AUTH_SESSIONS_TIMEBOX"] = previous;
+          }),
+        ),
+      );
+    });
+
+    it.live("honors SUPABASE_AUTH_MFA_TOTP_ENROLL_ENABLED/_VERIFY_ENABLED", () => {
+      const previousEnroll = process.env["SUPABASE_AUTH_MFA_TOTP_ENROLL_ENABLED"];
+      const previousVerify = process.env["SUPABASE_AUTH_MFA_TOTP_VERIFY_ENABLED"];
+      process.env["SUPABASE_AUTH_MFA_TOTP_ENROLL_ENABLED"] = "true";
+      process.env["SUPABASE_AUTH_MFA_TOTP_VERIFY_ENABLED"] = "true";
+      const { layer, child } = setup({
+        configContents: 'project_id = "demo"\n[auth.mfa.totp]\nenroll_enabled = false\n',
+      });
+      return Effect.gen(function* () {
+        yield* legacyStart(flags());
+        const gotrueCreate = child.spawned.find(
+          (s) => s.args[0] === "create" && containerNameFromCreateArgs(s.args).includes("_auth_"),
+        );
+        expect(gotrueCreate?.env["GOTRUE_MFA_TOTP_ENROLL_ENABLED"]).toBe("true");
+        expect(gotrueCreate?.env["GOTRUE_MFA_TOTP_VERIFY_ENABLED"]).toBe("true");
+      }).pipe(
+        Effect.provide(layer),
+        Effect.ensuring(
+          Effect.sync(() => {
+            if (previousEnroll === undefined)
+              delete process.env["SUPABASE_AUTH_MFA_TOTP_ENROLL_ENABLED"];
+            else process.env["SUPABASE_AUTH_MFA_TOTP_ENROLL_ENABLED"] = previousEnroll;
+            if (previousVerify === undefined)
+              delete process.env["SUPABASE_AUTH_MFA_TOTP_VERIFY_ENABLED"];
+            else process.env["SUPABASE_AUTH_MFA_TOTP_VERIFY_ENABLED"] = previousVerify;
+          }),
+        ),
+      );
+    });
+
+    it.live("honors SUPABASE_AUTH_RATE_LIMIT_SMS_SENT", () => {
+      const previous = process.env["SUPABASE_AUTH_RATE_LIMIT_SMS_SENT"];
+      process.env["SUPABASE_AUTH_RATE_LIMIT_SMS_SENT"] = "99";
+      const { layer, child } = setup({ configContents: 'project_id = "demo"\n' });
+      return Effect.gen(function* () {
+        yield* legacyStart(flags());
+        const gotrueCreate = child.spawned.find(
+          (s) => s.args[0] === "create" && containerNameFromCreateArgs(s.args).includes("_auth_"),
+        );
+        expect(gotrueCreate?.env["GOTRUE_RATE_LIMIT_SMS_SENT"]).toBe("99");
+      }).pipe(
+        Effect.provide(layer),
+        Effect.ensuring(
+          Effect.sync(() => {
+            if (previous === undefined) delete process.env["SUPABASE_AUTH_RATE_LIMIT_SMS_SENT"];
+            else process.env["SUPABASE_AUTH_RATE_LIMIT_SMS_SENT"] = previous;
+          }),
+        ),
+      );
+    });
+
+    it.live("honors SUPABASE_AUTH_WEB3_SOLANA_ENABLED", () => {
+      const previous = process.env["SUPABASE_AUTH_WEB3_SOLANA_ENABLED"];
+      process.env["SUPABASE_AUTH_WEB3_SOLANA_ENABLED"] = "true";
+      const { layer, child } = setup({ configContents: 'project_id = "demo"\n' });
+      return Effect.gen(function* () {
+        yield* legacyStart(flags());
+        const gotrueCreate = child.spawned.find(
+          (s) => s.args[0] === "create" && containerNameFromCreateArgs(s.args).includes("_auth_"),
+        );
+        expect(gotrueCreate?.env["GOTRUE_EXTERNAL_WEB3_SOLANA_ENABLED"]).toBe("true");
+      }).pipe(
+        Effect.provide(layer),
+        Effect.ensuring(
+          Effect.sync(() => {
+            if (previous === undefined) delete process.env["SUPABASE_AUTH_WEB3_SOLANA_ENABLED"];
+            else process.env["SUPABASE_AUTH_WEB3_SOLANA_ENABLED"] = previous;
+          }),
+        ),
+      );
+    });
+
+    it.live("honors SUPABASE_AUTH_OAUTH_SERVER_ENABLED", () => {
+      const previous = process.env["SUPABASE_AUTH_OAUTH_SERVER_ENABLED"];
+      process.env["SUPABASE_AUTH_OAUTH_SERVER_ENABLED"] = "true";
+      const { layer, child } = setup({ configContents: 'project_id = "demo"\n' });
+      return Effect.gen(function* () {
+        yield* legacyStart(flags());
+        const gotrueCreate = child.spawned.find(
+          (s) => s.args[0] === "create" && containerNameFromCreateArgs(s.args).includes("_auth_"),
+        );
+        expect(gotrueCreate?.env["GOTRUE_OAUTH_SERVER_ENABLED"]).toBe("true");
+      }).pipe(
+        Effect.provide(layer),
+        Effect.ensuring(
+          Effect.sync(() => {
+            if (previous === undefined) delete process.env["SUPABASE_AUTH_OAUTH_SERVER_ENABLED"];
+            else process.env["SUPABASE_AUTH_OAUTH_SERVER_ENABLED"] = previous;
+          }),
+        ),
+      );
+    });
   });
 
-  it.live("does not write captured Go start stdout to output", () => {
-    const s = setup({ goOutput: "json", captureStdout: "pretty status table\n" });
+  describe("auth.passkey/auth.webauthn env overrides reach GoTrue's container", () => {
+    it.live("honors SUPABASE_AUTH_PASSKEY_ENABLED", () => {
+      const previous = process.env["SUPABASE_AUTH_PASSKEY_ENABLED"];
+      process.env["SUPABASE_AUTH_PASSKEY_ENABLED"] = "true";
+      const { layer, child } = setup({
+        configContents:
+          'project_id = "demo"\n[auth.passkey]\nenabled = false\n[auth.webauthn]\nrp_id = "localhost"\nrp_origins = ["http://localhost:3000"]\n',
+      });
+      return Effect.gen(function* () {
+        yield* legacyStart(flags());
+        const gotrueCreate = child.spawned.find(
+          (s) => s.args[0] === "create" && containerNameFromCreateArgs(s.args).includes("_auth_"),
+        );
+        expect(gotrueCreate?.env["GOTRUE_PASSKEY_ENABLED"]).toBe("true");
+      }).pipe(
+        Effect.provide(layer),
+        Effect.ensuring(
+          Effect.sync(() => {
+            if (previous === undefined) delete process.env["SUPABASE_AUTH_PASSKEY_ENABLED"];
+            else process.env["SUPABASE_AUTH_PASSKEY_ENABLED"] = previous;
+          }),
+        ),
+      );
+    });
+
+    it.live("honors SUPABASE_AUTH_WEBAUTHN_RP_ID/_RP_DISPLAY_NAME/_RP_ORIGINS", () => {
+      const previousRpId = process.env["SUPABASE_AUTH_WEBAUTHN_RP_ID"];
+      const previousDisplayName = process.env["SUPABASE_AUTH_WEBAUTHN_RP_DISPLAY_NAME"];
+      const previousOrigins = process.env["SUPABASE_AUTH_WEBAUTHN_RP_ORIGINS"];
+      process.env["SUPABASE_AUTH_WEBAUTHN_RP_ID"] = "env-rp-id";
+      process.env["SUPABASE_AUTH_WEBAUTHN_RP_DISPLAY_NAME"] = "Env Display Name";
+      process.env["SUPABASE_AUTH_WEBAUTHN_RP_ORIGINS"] = "http://a.example,http://b.example";
+      const { layer, child } = setup({
+        configContents:
+          'project_id = "demo"\n[auth.webauthn]\nrp_id = "toml-rp-id"\nrp_display_name = "TOML Display Name"\nrp_origins = ["http://toml.example"]\n',
+      });
+      return Effect.gen(function* () {
+        yield* legacyStart(flags());
+        const gotrueCreate = child.spawned.find(
+          (s) => s.args[0] === "create" && containerNameFromCreateArgs(s.args).includes("_auth_"),
+        );
+        expect(gotrueCreate?.env["GOTRUE_WEBAUTHN_RP_ID"]).toBe("env-rp-id");
+        expect(gotrueCreate?.env["GOTRUE_WEBAUTHN_RP_DISPLAY_NAME"]).toBe("Env Display Name");
+        expect(gotrueCreate?.env["GOTRUE_WEBAUTHN_RP_ORIGINS"]).toBe(
+          "http://a.example,http://b.example",
+        );
+      }).pipe(
+        Effect.provide(layer),
+        Effect.ensuring(
+          Effect.sync(() => {
+            if (previousRpId === undefined) delete process.env["SUPABASE_AUTH_WEBAUTHN_RP_ID"];
+            else process.env["SUPABASE_AUTH_WEBAUTHN_RP_ID"] = previousRpId;
+            if (previousDisplayName === undefined)
+              delete process.env["SUPABASE_AUTH_WEBAUTHN_RP_DISPLAY_NAME"];
+            else process.env["SUPABASE_AUTH_WEBAUTHN_RP_DISPLAY_NAME"] = previousDisplayName;
+            if (previousOrigins === undefined)
+              delete process.env["SUPABASE_AUTH_WEBAUTHN_RP_ORIGINS"];
+            else process.env["SUPABASE_AUTH_WEBAUTHN_RP_ORIGINS"] = previousOrigins;
+          }),
+        ),
+      );
+    });
+
+    it.live(
+      "coerces an env(...)-resolved passkey enabled string instead of reading it as disabled",
+      () => {
+        // `auth.passkey`/`auth.webauthn` have no `@supabase/config` schema, so the pre-decode
+        // `env(...)` walker substitutes the real value but leaves it a raw string (no type
+        // coercion for schema-unmodeled paths) — a strict `=== true` check would silently read
+        // this valid Go config as disabled.
+        const previous = process.env["PASSKEY_ENABLED"];
+        process.env["PASSKEY_ENABLED"] = "true";
+        const { layer, child } = setup({
+          configContents:
+            'project_id = "demo"\n[auth.passkey]\nenabled = "env(PASSKEY_ENABLED)"\n[auth.webauthn]\nrp_id = "localhost"\nrp_origins = ["http://localhost:3000"]\n',
+        });
+        return Effect.gen(function* () {
+          yield* legacyStart(flags());
+          const gotrueCreate = child.spawned.find(
+            (s) => s.args[0] === "create" && containerNameFromCreateArgs(s.args).includes("_auth_"),
+          );
+          expect(gotrueCreate?.env["GOTRUE_PASSKEY_ENABLED"]).toBe("true");
+        }).pipe(
+          Effect.provide(layer),
+          Effect.ensuring(
+            Effect.sync(() => {
+              if (previous === undefined) delete process.env["PASSKEY_ENABLED"];
+              else process.env["PASSKEY_ENABLED"] = previous;
+            }),
+          ),
+        );
+      },
+    );
 
-    return Effect.gen(function* () {
-      yield* legacyStart(flags());
+    it.live(
+      "splits an env(...)-resolved comma-separated rp_origins string instead of dropping it to []",
+      () => {
+        const previous = process.env["RP_ORIGINS"];
+        process.env["RP_ORIGINS"] = "http://a.example,http://b.example";
+        const { layer, child } = setup({
+          configContents:
+            'project_id = "demo"\n[auth.passkey]\nenabled = true\n[auth.webauthn]\nrp_id = "localhost"\nrp_origins = "env(RP_ORIGINS)"\n',
+        });
+        return Effect.gen(function* () {
+          yield* legacyStart(flags());
+          const gotrueCreate = child.spawned.find(
+            (s) => s.args[0] === "create" && containerNameFromCreateArgs(s.args).includes("_auth_"),
+          );
+          expect(gotrueCreate?.env["GOTRUE_WEBAUTHN_RP_ORIGINS"]).toBe(
+            "http://a.example,http://b.example",
+          );
+        }).pipe(
+          Effect.provide(layer),
+          Effect.ensuring(
+            Effect.sync(() => {
+              if (previous === undefined) delete process.env["RP_ORIGINS"];
+              else process.env["RP_ORIGINS"] = previous;
+            }),
+          ),
+        );
+      },
+    );
+  });
 
-      expect(s.out.stdoutText).toBe("");
-      expect(s.out.rawChunks).toEqual([]);
-    }).pipe(Effect.provide(s.layer));
+  describe("SUPABASE_EDGE_RUNTIME_POLICY override", () => {
+    it.live("honors the env-overridden Edge Runtime request policy", () => {
+      const previous = process.env["SUPABASE_EDGE_RUNTIME_POLICY"];
+      process.env["SUPABASE_EDGE_RUNTIME_POLICY"] = "per_worker";
+      const { layer, child } = setup({
+        configContents: 'project_id = "demo"\n[edge_runtime]\npolicy = "oneshot"\n',
+      });
+      return Effect.gen(function* () {
+        yield* legacyStart(flags());
+        const runCalls = child.spawned.filter((s) => s.args[0] === "run" && s.args[1] === "-d");
+        const entrypointCommand = runCalls[0]?.args.at(-1) ?? "";
+        expect(entrypointCommand).toContain("--policy=per_worker");
+        expect(entrypointCommand).not.toContain("--policy=oneshot");
+      }).pipe(
+        Effect.provide(layer),
+        Effect.ensuring(
+          Effect.sync(() => {
+            if (previous === undefined) delete process.env["SUPABASE_EDGE_RUNTIME_POLICY"];
+            else process.env["SUPABASE_EDGE_RUNTIME_POLICY"] = previous;
+          }),
+        ),
+      );
+    });
   });
 });
diff --git a/apps/cli/src/legacy/commands/start/start.live.test.ts b/apps/cli/src/legacy/commands/start/start.live.test.ts
new file mode 100644
index 0000000000..8b816d9e87
--- /dev/null
+++ b/apps/cli/src/legacy/commands/start/start.live.test.ts
@@ -0,0 +1,131 @@
+import { execFile } from "node:child_process";
+import { mkdtemp, rm } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import path from "node:path";
+import { promisify } from "node:util";
+import { afterEach, expect, test } from "vitest";
+
+import { describeLive, runSupabaseLive } from "../../../../tests/helpers/live.ts";
+import {
+  legacySanitizeProjectId,
+  legacyServiceContainerName,
+} from "../../shared/legacy-docker-ids.ts";
+import { LEGACY_SERVICE_CATALOG } from "../../shared/legacy-service-catalog.ts";
+
+const execFileAsync = promisify(execFile);
+
+const START_TIMEOUT_MS = 280_000;
+const SHORT_LIVE_TIMEOUT_MS = 30_000;
+
+/**
+ * `--exclude` values for the 3 heaviest/least-relevant services — same intent
+ * `stop.live.test.ts`/`status.live.test.ts` already documented for their own
+ * reduced-stack `start` call (Studio's Next.js build, the Logflare/Vector
+ * logging pipeline), but "logflare" here, NOT "analytics" like those two
+ * siblings. `LEGACY_SERVICE_CATALOG`'s `excludeKey` for the logflare service
+ * (Go's `utils.ShortContainerImageName` applied to the logflare image,
+ * `apps/cli-go/internal/utils/misc.go:33-39`) is "logflare" — "analytics" is
+ * only that service's *container suffix* (`legacy-service-catalog.ts`), never
+ * a valid `--exclude` value in either Go or this port. The siblings'
+ * `--exclude analytics` was a silent no-op passed straight through to `start`
+ * while it was still a Go-binary proxy — harmless for their own coarse "is
+ * the stack up/down" assertions, but this suite's exact-container-set
+ * assertions need the genuinely valid key so logflare is actually excluded.
+ */
+const EXCLUDED_SERVICE_KEYS: ReadonlySet<string> = new Set(["studio", "logflare", "vector"]);
+
+/**
+ * Services the running-container assertion below must NOT expect to be running, even though
+ * they are neither in `EXCLUDED_SERVICE_KEYS` nor `--exclude`d on the `start` call itself:
+ *  - `supavisor` — `db.pooler.enabled` defaults to `false` (`packages/config/src/db.ts`,
+ *    `defaultPoolerEnabled`), and `runSupabaseLive(["init"], ...)` above writes a config.toml
+ *    with no override, so it's genuinely disabled on this test's stack, not merely unasserted.
+ *  - `imgproxy` — gated on `storage.image_transformation.enabled` (`start.gates.ts:169`,
+ *    mirroring Go's `isImgProxyEnabled`, `apps/cli-go/internal/start/start.go:302-303`), which
+ *    defaults to `false`/absent; `runSupabaseLive(["init"], ...)` writes a config.toml with
+ *    `[storage.image_transformation]` still commented out (`project-init.templates.ts:132-133`,
+ *    byte-identical to Go's own template), so imgproxy is genuinely disabled on this test's stack.
+ */
+const NEVER_RUNNING_SERVICE_KEYS: ReadonlySet<string> = new Set(["supavisor", "imgproxy"]);
+
+function splitNonEmptyLines(text: string): ReadonlyArray<string> {
+  return text
+    .split(/\r?\n/u)
+    .map((line) => line.trim())
+    .filter((line) => line.length > 0);
+}
+
+// `start` is the one local-dev-stack command whose correctness genuinely
+// depends on a real Docker daemon — real label filtering and real container
+// lifecycle, not just CLI exit codes. `describeLive` is reused purely as the
+// "we're in the full cli-e2e-ci runner" signal (see stop.live.test.ts's own
+// comment for why this, not a Management-API gate, is correct here). See
+// AGENTS.md's "Live tests" section for the full convention.
+describeLive("supabase start (live)", () => {
+  let projectDir: string | undefined;
+
+  afterEach(async () => {
+    if (projectDir === undefined) return;
+    // Best-effort cleanup even if an assertion above failed mid-lifecycle — a
+    // leaked local stack would otherwise pollute the CI runner for later jobs.
+    await runSupabaseLive(["stop", "--no-backup"], { cwd: projectDir }).catch(() => undefined);
+    await rm(projectDir, { recursive: true, force: true }).catch(() => undefined);
+    projectDir = undefined;
+  });
+
+  test(
+    "starts a reduced real local stack, running only the non-excluded containers",
+    { timeout: START_TIMEOUT_MS },
+    async () => {
+      projectDir = await mkdtemp(path.join(tmpdir(), "sb-start-live-"));
+      // No `project_id` override, so the cli resolves it from the workdir
+      // basename — matching Go's precedence exactly (see legacy-docker-ids.ts).
+      // Sanitizing is a no-op for a `mkdtemp`-generated basename (already
+      // alphanumeric/`-`), but mirrors the port's actual resolution rather
+      // than assuming that stays true.
+      const projectId = legacySanitizeProjectId(path.basename(projectDir));
+
+      const init = await runSupabaseLive(["init"], {
+        cwd: projectDir,
+        exitTimeoutMs: SHORT_LIVE_TIMEOUT_MS,
+      });
+      expect(init.exitCode, `stdout:\n${init.stdout}\nstderr:\n${init.stderr}`).toBe(0);
+
+      const start = await runSupabaseLive(
+        ["start", "--exclude", "studio", "--exclude", "logflare", "--exclude", "vector"],
+        { cwd: projectDir, exitTimeoutMs: START_TIMEOUT_MS },
+      );
+      expect(start.exitCode, `stdout:\n${start.stdout}\nstderr:\n${start.stderr}`).toBe(0);
+
+      // The real Docker daemon must agree with the CLI's own exit code: every
+      // non-excluded service is actually running under this project's label,
+      // AND every excluded service is genuinely absent — not merely reported
+      // "stopped" by a status diff.
+      const { stdout: psOutput } = await execFileAsync("docker", [
+        "ps",
+        "--filter",
+        `label=com.supabase.cli.project=${projectId}`,
+        "--format",
+        "{{.Names}}",
+      ]);
+      const runningNames = new Set(splitNonEmptyLines(psOutput));
+
+      for (const entry of LEGACY_SERVICE_CATALOG) {
+        const containerName = legacyServiceContainerName(entry.containerSuffix, projectId);
+        const isExcluded =
+          (entry.excludeKey !== undefined && EXCLUDED_SERVICE_KEYS.has(entry.excludeKey)) ||
+          NEVER_RUNNING_SERVICE_KEYS.has(entry.service);
+        expect(
+          runningNames.has(containerName),
+          `expected ${containerName} to be ${isExcluded ? "excluded" : "running"}; docker ps names: ${[...runningNames].join(", ")}`,
+        ).toBe(!isExcluded);
+      }
+
+      const status = await runSupabaseLive(["status"], {
+        cwd: projectDir,
+        exitTimeoutMs: SHORT_LIVE_TIMEOUT_MS,
+      });
+      expect(status.exitCode, `stdout:\n${status.stdout}\nstderr:\n${status.stderr}`).toBe(0);
+    },
+  );
+});
diff --git a/apps/cli/src/legacy/commands/start/start.rollback.ts b/apps/cli/src/legacy/commands/start/start.rollback.ts
new file mode 100644
index 0000000000..b46956059c
--- /dev/null
+++ b/apps/cli/src/legacy/commands/start/start.rollback.ts
@@ -0,0 +1,82 @@
+import { Effect } from "effect";
+import type { ChildProcessSpawner } from "effect/unstable/process/ChildProcessSpawner";
+
+import type { LegacyContainerIdName } from "../../shared/legacy-docker-lifecycle.ts";
+import { legacyDockerRemoveAll } from "../../shared/legacy-docker-remove-all.ts";
+import { legacyCleanupStartSecrets } from "../../shared/legacy-start-secrets-cleanup.ts";
+import { LegacyHealthCheckTimeoutError } from "./lib/health-check.ts";
+
+type Spawner = ChildProcessSpawner["Service"];
+
+/**
+ * Port of Go's `start.IsUnhealthyError` (`apps/cli-go/internal/db/start/
+ * start.go:227-231`): Go tests whether the failure unwraps as a joined
+ * multi-error, which is exactly the shape `WaitForHealthyService` produces on
+ * timeout and nothing else in `run()` ever produces. This port's equivalent
+ * "only the health-check timeout produces this shape" failure is
+ * {@link LegacyHealthCheckTimeoutError} (`lib/health-check.ts`), so the
+ * classification collapses to an `instanceof` check against that one class —
+ * the caller (`start.handler.ts`) uses this to decide whether
+ * `--ignore-health-check` should downgrade a failure to a warning instead of
+ * triggering rollback + a hard exit.
+ */
+export function legacyIsUnhealthyStartError(
+  error: unknown,
+): error is LegacyHealthCheckTimeoutError {
+  return error instanceof LegacyHealthCheckTimeoutError;
+}
+
+/**
+ * Port of Go's rollback-on-failure step in `start.Run`
+ * (`apps/cli-go/internal/start/start.go:76-81`):
+ *
+ * ```go
+ * if err := utils.DockerRemoveAll(context.Background(), os.Stderr, utils.Config.ProjectId); err != nil {
+ *   fmt.Fprintln(os.Stderr, err)
+ * }
+ * ```
+ *
+ * Tears down every container/volume/network the failed `start` run created
+ * (by project label) via {@link legacyDockerRemoveAll}. A rollback failure is
+ * itself only logged to stderr, never propagated — it must never mask the
+ * original failure that triggered the rollback in the first place, matching
+ * Go's `fmt.Fprintln(os.Stderr, err)` swallow exactly. `deleteVolumes` mirrors
+ * Go's `utils.NoBackupVolume` global (set elsewhere, based on whether the
+ * Postgres volume already existed before this run) — the caller decides its
+ * value, this wrapper only forwards it to {@link legacyDockerRemoveAll}.
+ *
+ * Also reclaims any {@link legacyCleanupStartSecrets} staged-secret
+ * directories for the containers this run created — a TS-port-only hygiene
+ * step with no Go equivalent (see that function's doc comment). The matching
+ * containers come from {@link legacyDockerRemoveAll}'s own
+ * `onContainersRemoved` hook, which fires only once `container prune` has
+ * CONFIRMED they're actually gone — not merely listed, and not before the
+ * stop/prune stages have run — from that function's single internal `docker
+ * ps` listing, never a second, separately listed call, which would cost an
+ * extra real Docker Engine API request Go never makes (see that function's
+ * doc comment for the parity rationale). `workdir` (this run's own
+ * `LegacyCliConfig.workdir`) is passed through only as
+ * {@link legacyCleanupStartSecrets}'s fallback — every container this same
+ * `start` run just created carries its own matching `LEGACY_CLI_WORKDIR_LABEL`
+ * (see `container-lifecycle.ts`), so the fallback path is only ever exercised
+ * by a container created before that label existed.
+ */
+export const legacyRollbackStart = (
+  spawner: Spawner,
+  filterValue: string,
+  deleteVolumes: boolean,
+  workdir: string,
+): Effect.Effect<void, never> =>
+  Effect.gen(function* () {
+    let removedContainers: ReadonlyArray<LegacyContainerIdName> = [];
+    yield* legacyDockerRemoveAll(spawner, filterValue, deleteVolumes, (containers) => {
+      removedContainers = containers;
+    }).pipe(
+      Effect.catch((error) =>
+        Effect.sync(() => {
+          globalThis.process.stderr.write(`${error.message}\n`);
+        }),
+      ),
+    );
+    yield* legacyCleanupStartSecrets(removedContainers, workdir);
+  });
diff --git a/apps/cli/src/legacy/commands/start/start.rollback.unit.test.ts b/apps/cli/src/legacy/commands/start/start.rollback.unit.test.ts
new file mode 100644
index 0000000000..bff777ba6f
--- /dev/null
+++ b/apps/cli/src/legacy/commands/start/start.rollback.unit.test.ts
@@ -0,0 +1,159 @@
+import { afterEach, describe, expect, it, vi } from "@effect/vitest";
+import { Data, Deferred, Effect, Sink, Stream } from "effect";
+import { ChildProcessSpawner } from "effect/unstable/process";
+
+import { LegacyHealthCheckTimeoutError } from "./lib/health-check.ts";
+import { legacyIsUnhealthyStartError, legacyRollbackStart } from "./start.rollback.ts";
+
+function captureStderr() {
+  return vi.spyOn(process.stderr, "write").mockImplementation(() => true);
+}
+
+afterEach(() => {
+  vi.restoreAllMocks();
+});
+
+/**
+ * Mirrors `legacy-docker-lifecycle.unit.test.ts`'s `mockSpawner`: every
+ * command spawned (list/stop/prune) answers with the same fixed
+ * `exitCode`/`stdout`/`stderr`, which is enough to drive
+ * `legacyDockerRemoveAll` through either its success path (empty container
+ * list, every prune exits 0) or its very first failure branch (a non-zero
+ * `docker ps` exit).
+ */
+function mockSpawner(
+  opts: {
+    readonly exitCode?: number;
+    readonly stdout?: string;
+    readonly stderr?: string;
+  } = {},
+) {
+  const encoder = new TextEncoder();
+  const spawned: Array<ReadonlyArray<string>> = [];
+
+  const spawner = ChildProcessSpawner.make((command) =>
+    Effect.gen(function* () {
+      const args = command._tag === "StandardCommand" ? command.args : [];
+      spawned.push(args);
+
+      const exitDeferred = yield* Deferred.make<ChildProcessSpawner.ExitCode>();
+      yield* Deferred.succeed(exitDeferred, ChildProcessSpawner.ExitCode(opts.exitCode ?? 0));
+
+      return ChildProcessSpawner.makeHandle({
+        pid: ChildProcessSpawner.ProcessId(1),
+        stdout: Stream.fromIterable(opts.stdout !== undefined ? [encoder.encode(opts.stdout)] : []),
+        stderr: Stream.fromIterable(opts.stderr !== undefined ? [encoder.encode(opts.stderr)] : []),
+        all: Stream.empty,
+        exitCode: Deferred.await(exitDeferred),
+        isRunning: Effect.succeed(false),
+        stdin: Sink.drain,
+        kill: () => Effect.void,
+        unref: Effect.succeed(Effect.void),
+        getInputFd: () => Sink.drain,
+        getOutputFd: () => Stream.empty,
+      });
+    }),
+  );
+
+  return {
+    spawner,
+    get spawned() {
+      return spawned;
+    },
+  };
+}
+
+describe("legacyRollbackStart", () => {
+  it.live("tears down every container/volume/network by project label on success", () => {
+    const mock = mockSpawner({ exitCode: 0, stdout: "" });
+    const stderr = captureStderr();
+    return Effect.gen(function* () {
+      yield* legacyRollbackStart(
+        mock.spawner,
+        "com.supabase.cli.project=my-app",
+        false,
+        "/tmp/legacy-rollback-unit-test-workdir",
+      );
+      expect(stderr).not.toHaveBeenCalled();
+      // legacyDockerRemoveAll's own list (its `onContainersListed` hook feeds
+      // legacyCleanupStartSecrets the same container names, no second `ps`
+      // call) -> container prune -> network prune; no stop calls (empty list)
+      // and no volume prune (deleteVolumes: false).
+      expect(mock.spawned.map((args) => args[0])).toEqual(["ps", "container", "network"]);
+    });
+  });
+
+  it.live("requests a volume prune when deleteVolumes is true", () => {
+    const mock = mockSpawner({ exitCode: 0, stdout: "" });
+    return Effect.gen(function* () {
+      yield* legacyRollbackStart(
+        mock.spawner,
+        "com.supabase.cli.project=my-app",
+        true,
+        "/tmp/legacy-rollback-unit-test-workdir",
+      );
+      expect(mock.spawned.map((args) => args[0])).toEqual([
+        "ps",
+        "container",
+        "version",
+        "volume",
+        "network",
+      ]);
+    });
+  });
+
+  it.live("swallows a rollback failure, logging it to stderr instead of failing the effect", () => {
+    const mock = mockSpawner({ exitCode: 1, stderr: "permission denied" });
+    const stderr = captureStderr();
+    return Effect.gen(function* () {
+      // Never fails — Effect.Effect<void, never> — a rollback failure is
+      // logged, never propagated (Go's `fmt.Fprintln(os.Stderr, err)` swallow).
+      yield* legacyRollbackStart(
+        mock.spawner,
+        "com.supabase.cli.project=my-app",
+        false,
+        "/tmp/legacy-rollback-unit-test-workdir",
+      );
+      expect(stderr).toHaveBeenCalledTimes(1);
+      expect(stderr).toHaveBeenCalledWith("failed to list containers: permission denied\n");
+    });
+  });
+
+  it.live("logs a generic message to stderr when the underlying failure has no stderr text", () => {
+    const mock = mockSpawner({ exitCode: 1, stderr: "" });
+    const stderr = captureStderr();
+    return Effect.gen(function* () {
+      yield* legacyRollbackStart(
+        mock.spawner,
+        "com.supabase.cli.project=my-app",
+        false,
+        "/tmp/legacy-rollback-unit-test-workdir",
+      );
+      expect(stderr).toHaveBeenCalledTimes(1);
+      expect(stderr).toHaveBeenCalledWith("failed to list containers\n");
+    });
+  });
+});
+
+class LegacyOtherTaggedError extends Data.TaggedError("LegacyOtherTaggedError")<{
+  readonly message: string;
+}> {}
+
+describe("legacyIsUnhealthyStartError", () => {
+  it("returns true for a LegacyHealthCheckTimeoutError", () => {
+    const error = new LegacyHealthCheckTimeoutError({ message: "timed out", unhealthy: [] });
+    expect(legacyIsUnhealthyStartError(error)).toBe(true);
+  });
+
+  it("returns false for an unrelated tagged error", () => {
+    const error = new LegacyOtherTaggedError({ message: "boom" });
+    expect(legacyIsUnhealthyStartError(error)).toBe(false);
+  });
+
+  it("returns false for a plain Error, string, or nullish value", () => {
+    expect(legacyIsUnhealthyStartError(new Error("boom"))).toBe(false);
+    expect(legacyIsUnhealthyStartError("boom")).toBe(false);
+    expect(legacyIsUnhealthyStartError(undefined)).toBe(false);
+    expect(legacyIsUnhealthyStartError(null)).toBe(false);
+  });
+});
diff --git a/apps/cli/src/legacy/commands/start/start.services.ts b/apps/cli/src/legacy/commands/start/start.services.ts
new file mode 100644
index 0000000000..b618afb142
--- /dev/null
+++ b/apps/cli/src/legacy/commands/start/start.services.ts
@@ -0,0 +1,102 @@
+import {
+  LEGACY_SERVICE_CATALOG,
+  type LegacyServiceCatalogEntry,
+} from "../../shared/legacy-service-catalog.ts";
+
+/**
+ * Per-service orchestration metadata `start.handler.ts` (a later task) reads
+ * ON TOP OF `LEGACY_SERVICE_CATALOG`'s identity fields (`containerSuffix`,
+ * `excludeKey`, `startOrder`). Deliberately descriptive, not executable: the
+ * real config-boolean gating and image resolution live in the handler and
+ * each service's own module.
+ */
+export interface LegacyStartServiceMeta {
+  /**
+   * Which `config.toml`-resolved image field feeds this service's container.
+   * A string identifier only — actual resolution happens in the service's
+   * own module.
+   */
+  readonly imageConfigField: string;
+  /**
+   * The condition under which Go starts this service, expressed as a
+   * `config.toml` dotted-path boolean expression, or one of the sentinels
+   * `"always"` (Postgres, unconditional) / `"none"` (gated only by
+   * `!excluded`, e.g. Kong).
+   */
+  readonly enabledGate: string;
+  /**
+   * Other catalog `service` keys this service's startup additionally depends
+   * on (e.g. Vector waits on Logflare being healthy; Studio waits on
+   * pg-meta). Not a full dependency graph — just a note for the handler to
+   * sequence against.
+   */
+  readonly dependsOn?: ReadonlyArray<string>;
+}
+
+export interface LegacyStartServiceEntry
+  extends LegacyServiceCatalogEntry, LegacyStartServiceMeta {}
+
+/**
+ * Source: the approved start-port plan's per-service table, cross-referenced
+ * against `apps/cli-go/internal/start/start.go`'s per-service `if` blocks
+ * (lines 293-1267) and `pkg/config/config.go`'s image field resolution.
+ * Keyed by `LEGACY_SERVICE_CATALOG`'s `service` field.
+ */
+const START_SERVICE_META_BY_SERVICE: ReadonlyMap<string, LegacyStartServiceMeta> = new Map([
+  ["postgres", { imageConfigField: "db.image", enabledGate: "always" }],
+  ["logflare", { imageConfigField: "analytics.image", enabledGate: "analytics.enabled" }],
+  [
+    "vector",
+    {
+      imageConfigField: "analytics.vector_image",
+      enabledGate: "analytics.enabled",
+      dependsOn: ["logflare"],
+    },
+  ],
+  ["kong", { imageConfigField: "api.kong_image", enabledGate: "none" }],
+  ["gotrue", { imageConfigField: "auth.image", enabledGate: "auth.enabled" }],
+  ["mailpit", { imageConfigField: "local_smtp.image", enabledGate: "local_smtp.enabled" }],
+  ["realtime", { imageConfigField: "realtime.image", enabledGate: "realtime.enabled" }],
+  ["postgrest", { imageConfigField: "api.image", enabledGate: "api.enabled" }],
+  ["storage", { imageConfigField: "storage.image", enabledGate: "storage.enabled" }],
+  [
+    "imgproxy",
+    {
+      imageConfigField: "storage.imgproxy_image",
+      enabledGate: "storage.enabled && storage.image_transformation.enabled",
+      dependsOn: ["storage"],
+    },
+  ],
+  ["edgeRuntime", { imageConfigField: "edge_runtime.image", enabledGate: "edge_runtime.enabled" }],
+  ["pgMeta", { imageConfigField: "studio.pgmeta_image", enabledGate: "studio.enabled" }],
+  [
+    "studio",
+    {
+      imageConfigField: "studio.image",
+      enabledGate: "studio.enabled",
+      dependsOn: ["pgMeta"],
+    },
+  ],
+  ["supavisor", { imageConfigField: "db.pooler.image", enabledGate: "db.pooler.enabled" }],
+]);
+
+/** Looks up a single service's start orchestration metadata by its catalog `service` key. */
+export function legacyStartServiceMeta(service: string): LegacyStartServiceMeta | undefined {
+  return START_SERVICE_META_BY_SERVICE.get(service);
+}
+
+/**
+ * `LEGACY_SERVICE_CATALOG`, augmented with this file's orchestration metadata.
+ * Preserves the catalog's `startOrder` ordering — `start.handler.ts` can
+ * iterate this array directly to bring services up in Go's real sequence.
+ */
+export const LEGACY_START_SERVICES: ReadonlyArray<LegacyStartServiceEntry> =
+  LEGACY_SERVICE_CATALOG.map((entry) => {
+    const meta = START_SERVICE_META_BY_SERVICE.get(entry.service);
+    return {
+      ...entry,
+      imageConfigField: meta?.imageConfigField ?? "",
+      enabledGate: meta?.enabledGate ?? "",
+      dependsOn: meta?.dependsOn,
+    };
+  });
diff --git a/apps/cli/src/legacy/commands/start/start.services.unit.test.ts b/apps/cli/src/legacy/commands/start/start.services.unit.test.ts
new file mode 100644
index 0000000000..fec1cd789c
--- /dev/null
+++ b/apps/cli/src/legacy/commands/start/start.services.unit.test.ts
@@ -0,0 +1,214 @@
+import { ProjectConfigSchema, type ProjectConfig } from "@supabase/config";
+import { Schema } from "effect";
+import { describe, expect, it } from "vitest";
+
+import { legacyServiceContainerIds, localDbContainerId } from "../../shared/legacy-docker-ids.ts";
+import { LEGACY_SERVICE_CATALOG } from "../../shared/legacy-service-catalog.ts";
+import { legacyResolveStartGates, type LegacyStartGates } from "./start.gates.ts";
+import { LEGACY_START_SERVICES, legacyStartServiceMeta } from "./start.services.ts";
+
+describe("LEGACY_START_SERVICES", () => {
+  it("has one row per LEGACY_SERVICE_CATALOG entry, in the catalog's startOrder", () => {
+    expect(LEGACY_START_SERVICES).toHaveLength(LEGACY_SERVICE_CATALOG.length);
+    expect(LEGACY_START_SERVICES.map((entry) => entry.service)).toEqual(
+      LEGACY_SERVICE_CATALOG.map((entry) => entry.service),
+    );
+    expect(LEGACY_START_SERVICES.map((entry) => entry.startOrder)).toEqual(
+      LEGACY_SERVICE_CATALOG.map((entry) => entry.startOrder),
+    );
+  });
+
+  it("has exactly 13 excludable rows and 1 non-excludable row (Postgres)", () => {
+    const excludable = LEGACY_START_SERVICES.filter((entry) => entry.excludeKey !== undefined);
+    const nonExcludable = LEGACY_START_SERVICES.filter((entry) => entry.excludeKey === undefined);
+    expect(excludable).toHaveLength(13);
+    expect(nonExcludable).toHaveLength(1);
+    expect(nonExcludable[0]?.service).toBe("postgres");
+    expect(nonExcludable[0]?.enabledGate).toBe("always");
+  });
+
+  it("carries a non-empty imageConfigField and enabledGate for every entry", () => {
+    for (const entry of LEGACY_START_SERVICES) {
+      expect(entry.imageConfigField.length).toBeGreaterThan(0);
+      expect(entry.enabledGate.length).toBeGreaterThan(0);
+    }
+  });
+
+  it("has no duplicate service, containerSuffix, or imageConfigField values", () => {
+    const services = LEGACY_START_SERVICES.map((entry) => entry.service);
+    const suffixes = LEGACY_START_SERVICES.map((entry) => entry.containerSuffix);
+    const imageConfigFields = LEGACY_START_SERVICES.map((entry) => entry.imageConfigField);
+
+    expect(new Set(services).size).toBe(services.length);
+    expect(new Set(suffixes).size).toBe(suffixes.length);
+    expect(new Set(imageConfigFields).size).toBe(imageConfigFields.length);
+  });
+
+  it("every non-Postgres containerSuffix matches a legacyServiceContainerIds suffix", () => {
+    const projectId = "start-services-cross-check";
+    const containerIds = legacyServiceContainerIds(projectId);
+    const suffixesFromContainerIds = containerIds.map((id) =>
+      id.replace(/^supabase_/, "").replace(new RegExp(`_${projectId}$`), ""),
+    );
+
+    for (const entry of LEGACY_START_SERVICES) {
+      if (entry.service === "postgres") continue;
+      expect(suffixesFromContainerIds).toContain(entry.containerSuffix);
+    }
+  });
+
+  it("Postgres's containerSuffix matches localDbContainerId's suffix", () => {
+    const projectId = "start-services-cross-check";
+    const postgres = LEGACY_START_SERVICES.find((entry) => entry.service === "postgres");
+    expect(postgres?.containerSuffix).toBe("db");
+    expect(localDbContainerId(projectId)).toBe(
+      `supabase_${postgres?.containerSuffix}_${projectId}`,
+    );
+  });
+
+  it("notes Vector's dependency on Logflare", () => {
+    const vector = LEGACY_START_SERVICES.find((entry) => entry.service === "vector");
+    expect(vector?.enabledGate).toBe("analytics.enabled");
+    expect(vector?.dependsOn).toEqual(["logflare"]);
+  });
+
+  it("notes ImgProxy's dependency on Storage", () => {
+    const imgproxy = LEGACY_START_SERVICES.find((entry) => entry.service === "imgproxy");
+    expect(imgproxy?.enabledGate).toBe("storage.enabled && storage.image_transformation.enabled");
+    expect(imgproxy?.dependsOn).toEqual(["storage"]);
+  });
+
+  it("notes Studio's dependency on pg-meta", () => {
+    const studio = LEGACY_START_SERVICES.find((entry) => entry.service === "studio");
+    expect(studio?.enabledGate).toBe("studio.enabled");
+    expect(studio?.dependsOn).toEqual(["pgMeta"]);
+  });
+
+  it("gates Kong on !excluded only, with no config field", () => {
+    const kong = LEGACY_START_SERVICES.find((entry) => entry.service === "kong");
+    expect(kong?.enabledGate).toBe("none");
+  });
+});
+
+describe("legacyStartServiceMeta", () => {
+  it("returns the same metadata as the joined LEGACY_START_SERVICES row", () => {
+    const meta = legacyStartServiceMeta("gotrue");
+    const entry = LEGACY_START_SERVICES.find((candidate) => candidate.service === "gotrue");
+    expect(meta).toEqual({
+      imageConfigField: entry?.imageConfigField,
+      enabledGate: entry?.enabledGate,
+      dependsOn: entry?.dependsOn,
+    });
+  });
+
+  it("returns undefined for an unknown service key", () => {
+    expect(legacyStartServiceMeta("not-a-real-service")).toBeUndefined();
+  });
+});
+
+/**
+ * Cross-check: `start.services.ts`'s `enabledGate` metadata (descriptive
+ * only, never read by runtime code — see that module's header) against
+ * `start.gates.ts`'s `legacyResolveStartGates` (the REAL, executable gate).
+ * The two are hand-maintained separately and can silently drift (e.g. a gate
+ * condition changes in `start.gates.ts` without the matching `enabledGate`
+ * string being updated) — this mechanically evaluates every `enabledGate`
+ * boolean-string expression against a synthetic config and compares it
+ * against what `legacyResolveStartGates` actually computes for the SAME
+ * config, so a future drift fails loudly here instead of silently.
+ */
+describe("LEGACY_START_SERVICES enabledGate cross-check against start.gates.ts", () => {
+  const decodeConfig = Schema.decodeUnknownSync(ProjectConfigSchema);
+
+  /** Every `config.toml` boolean atom referenced by a `LEGACY_START_SERVICES` `enabledGate` expression (the `"always"`/`"none"` sentinels aside). */
+  const GATE_ATOMS = [
+    "analytics.enabled",
+    "api.enabled",
+    "auth.enabled",
+    "local_smtp.enabled",
+    "realtime.enabled",
+    "storage.enabled",
+    "storage.image_transformation.enabled",
+    "studio.enabled",
+    "db.pooler.enabled",
+    "edge_runtime.enabled",
+  ] as const;
+
+  /** Builds a `ProjectConfig` with every {@link GATE_ATOMS} atom explicitly set true/false per `enabled` membership. */
+  function configWithEnabled(enabled: ReadonlySet<string>): ProjectConfig {
+    const overrides: Record<string, unknown> = {};
+    for (const atom of GATE_ATOMS) {
+      const segments = atom.split(".");
+      let node = overrides;
+      for (let index = 0; index < segments.length - 1; index++) {
+        const segment = segments[index]!;
+        node[segment] ??= {};
+        node = node[segment] as Record<string, unknown>;
+      }
+      node[segments.at(-1)!] = enabled.has(atom);
+    }
+    return decodeConfig({ project_id: "start-services-gate-cross-check", ...overrides });
+  }
+
+  function getPath(config: ProjectConfig, path: string): unknown {
+    return path
+      .split(".")
+      .reduce<unknown>(
+        (value, key) =>
+          value && typeof value === "object" ? (value as Record<string, unknown>)[key] : undefined,
+        config,
+      );
+  }
+
+  /**
+   * Evaluates an `enabledGate` string ("x.enabled", "x.enabled && y.enabled",
+   * or the `"none"` sentinel) against a synthetic config. Deliberately
+   * ignores the `!excluded(...)` factor every real gate also ANDs in — the
+   * caller isolates that by resolving with `excludedKeys` empty.
+   */
+  function evaluateEnabledGate(expr: string, config: ProjectConfig): boolean {
+    if (expr === "none") return true;
+    return expr.split("&&").every((atom) => getPath(config, atom.trim()) === true);
+  }
+
+  /** Real gates for `config`, with the exclusion factor neutralized (nothing excluded). */
+  function realGatesFor(config: ProjectConfig): LegacyStartGates {
+    return legacyResolveStartGates({
+      config,
+      projectEnvValues: undefined,
+      excludedKeys: new Set(),
+      document: undefined,
+    });
+  }
+
+  function expectGatesMatchMetadata(config: ProjectConfig, label: string) {
+    const realGates = realGatesFor(config);
+    for (const service of Object.keys(realGates) as ReadonlyArray<keyof LegacyStartGates>) {
+      const meta = legacyStartServiceMeta(service);
+      expect(meta, `start.services.ts is missing metadata for "${service}"`).toBeDefined();
+      const expected = evaluateEnabledGate(meta!.enabledGate, config);
+      expect(realGates[service], `${service} (${label})`).toBe(expected);
+    }
+  }
+
+  it("matches for every gate atom toggled on its own (isolates each atom's effect)", () => {
+    for (const atom of GATE_ATOMS) {
+      expectGatesMatchMetadata(configWithEnabled(new Set([atom])), `only "${atom}" enabled`);
+    }
+  });
+
+  it("matches with every gate atom enabled", () => {
+    expectGatesMatchMetadata(configWithEnabled(new Set(GATE_ATOMS)), "every atom enabled");
+  });
+
+  it("matches with every gate atom disabled", () => {
+    expectGatesMatchMetadata(configWithEnabled(new Set()), "every atom disabled");
+  });
+
+  it("only omits Postgres (unconditional, handled directly by the caller) from the real gate set", () => {
+    const realGates = realGatesFor(configWithEnabled(new Set()));
+    const gatedServices = new Set(Object.keys(realGates));
+    const ungated = LEGACY_START_SERVICES.filter((entry) => !gatedServices.has(entry.service));
+    expect(ungated.map((entry) => entry.service).toSorted()).toEqual(["postgres"]);
+  });
+});
diff --git a/apps/cli/src/legacy/commands/start/templates/custom_nginx.template.ts b/apps/cli/src/legacy/commands/start/templates/custom_nginx.template.ts
new file mode 100644
index 0000000000..cf4a8eee78
--- /dev/null
+++ b/apps/cli/src/legacy/commands/start/templates/custom_nginx.template.ts
@@ -0,0 +1,45 @@
+/**
+ * Transcribed verbatim from
+ * `apps/cli-go/internal/start/templates/custom_nginx.template` (Go
+ * `//go:embed templates/custom_nginx.template`,
+ * `apps/cli-go/internal/start/start.go:111-115`). Unlike `kong.yml`, this file
+ * is NOT parsed as a Go `text/template` — it's passed through unmodified into
+ * the Kong container, where Kong's own openresty templating substitutes the
+ * `${{VAR}}` placeholders (`LOG_LEVEL`, `NGINX_DAEMON`,
+ * `NGINX_WORKER_PROCESSES`) from its own container env at boot. Do not
+ * hand-edit the body — re-transcribe from the Go source if it changes.
+ *
+ * The `\${{...}}` sequences below are literal Kong template syntax, not a JS
+ * template-literal interpolation — the backslash escapes are required so this
+ * TS template literal doesn't try to evaluate `{{VAR}}` as an object literal.
+ */
+export const LEGACY_START_CUSTOM_NGINX_TEMPLATE = `pid pids/nginx.pid;                      # this setting is mandatory
+error_log logs/error.log \${{LOG_LEVEL}}; # can be set by kong.conf
+
+daemon \${{NGINX_DAEMON}};                     # can be set by kong.conf
+worker_processes \${{NGINX_WORKER_PROCESSES}}; # can be set by kong.conf
+
+events {
+    multi_accept on;
+}
+
+http {
+    # here, we declare our custom location serving our website
+    # (or API portal) which we can optimize for serving static assets
+    server {
+        server_name email_templates;
+        listen 0.0.0.0:8088 reuseport backlog=16384;
+
+        access_log logs/email_templates_access.log;
+        error_log  logs/error.log notice;
+
+        location /email {
+            autoindex on;
+            root /home/kong/templates;
+        }
+    }
+
+    # include default Kong Nginx config
+    include 'nginx-kong.conf';
+}
+`;
diff --git a/apps/cli/src/legacy/commands/start/templates/db-globals.sql.ts b/apps/cli/src/legacy/commands/start/templates/db-globals.sql.ts
new file mode 100644
index 0000000000..3e08d7a932
--- /dev/null
+++ b/apps/cli/src/legacy/commands/start/templates/db-globals.sql.ts
@@ -0,0 +1,154 @@
+/**
+ * Transcribed verbatim from `apps/cli-go/internal/utils/templates/globals.sql`
+ * (Go `//go:embed templates/globals.sql`, `apps/cli-go/internal/utils/misc.go:67-68`,
+ * exported as `utils.GlobalsSql`). Run via `ExecBatch` against a fresh PG<=14 local
+ * database as the first step of `initSchema` (`apps/cli-go/internal/db/start/start.go:243-251`).
+ * Not a Go `text/template`. Do not hand-edit — re-transcribe from the Go source if it changes.
+ */
+export const LEGACY_START_DB_GLOBALS_SQL = `--
+-- PostgreSQL database cluster dump
+--
+
+SET default_transaction_read_only = off;
+
+SET client_encoding = 'UTF8';
+SET standard_conforming_strings = on;
+
+--
+-- Roles
+--
+
+CREATE ROLE anon;
+ALTER ROLE anon WITH NOSUPERUSER NOINHERIT NOCREATEROLE NOCREATEDB NOLOGIN NOREPLICATION NOBYPASSRLS;
+CREATE ROLE authenticated;
+ALTER ROLE authenticated WITH NOSUPERUSER NOINHERIT NOCREATEROLE NOCREATEDB NOLOGIN NOREPLICATION NOBYPASSRLS;
+CREATE ROLE authenticator;
+ALTER ROLE authenticator WITH NOSUPERUSER NOINHERIT NOCREATEROLE NOCREATEDB LOGIN NOREPLICATION NOBYPASSRLS PASSWORD 'postgres';
+CREATE ROLE dashboard_user;
+ALTER ROLE dashboard_user WITH NOSUPERUSER INHERIT CREATEROLE CREATEDB NOLOGIN REPLICATION NOBYPASSRLS;
+CREATE ROLE pgbouncer;
+ALTER ROLE pgbouncer WITH NOSUPERUSER INHERIT NOCREATEROLE NOCREATEDB LOGIN NOREPLICATION NOBYPASSRLS PASSWORD 'postgres';
+-- CREATE ROLE pgsodium_keyholder;
+-- ALTER ROLE pgsodium_keyholder WITH NOSUPERUSER INHERIT NOCREATEROLE NOCREATEDB NOLOGIN NOREPLICATION NOBYPASSRLS;
+-- CREATE ROLE pgsodium_keyiduser;
+-- ALTER ROLE pgsodium_keyiduser WITH NOSUPERUSER INHERIT NOCREATEROLE NOCREATEDB NOLOGIN NOREPLICATION NOBYPASSRLS;
+-- CREATE ROLE pgsodium_keymaker;
+-- ALTER ROLE pgsodium_keymaker WITH NOSUPERUSER INHERIT NOCREATEROLE NOCREATEDB NOLOGIN NOREPLICATION NOBYPASSRLS;
+-- CREATE ROLE postgres;
+-- ALTER ROLE postgres WITH NOSUPERUSER INHERIT CREATEROLE CREATEDB LOGIN REPLICATION BYPASSRLS;
+CREATE ROLE service_role;
+ALTER ROLE service_role WITH NOSUPERUSER NOINHERIT NOCREATEROLE NOCREATEDB NOLOGIN NOREPLICATION BYPASSRLS;
+CREATE ROLE supabase_admin;
+ALTER ROLE supabase_admin WITH SUPERUSER INHERIT CREATEROLE CREATEDB LOGIN REPLICATION BYPASSRLS PASSWORD 'postgres';
+CREATE ROLE supabase_auth_admin;
+ALTER ROLE supabase_auth_admin WITH NOSUPERUSER NOINHERIT CREATEROLE NOCREATEDB LOGIN NOREPLICATION NOBYPASSRLS PASSWORD 'postgres';
+CREATE ROLE supabase_functions_admin;
+ALTER ROLE supabase_functions_admin WITH NOSUPERUSER NOINHERIT CREATEROLE NOCREATEDB LOGIN NOREPLICATION NOBYPASSRLS PASSWORD 'postgres';
+CREATE ROLE supabase_read_only_user;
+ALTER ROLE supabase_read_only_user WITH NOSUPERUSER INHERIT NOCREATEROLE NOCREATEDB LOGIN NOREPLICATION BYPASSRLS PASSWORD 'postgres';
+CREATE ROLE supabase_replication_admin;
+ALTER ROLE supabase_replication_admin WITH NOSUPERUSER INHERIT NOCREATEROLE NOCREATEDB LOGIN REPLICATION NOBYPASSRLS PASSWORD 'postgres';
+CREATE ROLE supabase_storage_admin;
+ALTER ROLE supabase_storage_admin WITH NOSUPERUSER NOINHERIT CREATEROLE NOCREATEDB LOGIN NOREPLICATION NOBYPASSRLS PASSWORD 'postgres';
+
+--
+-- User Configurations
+--
+
+--
+-- User Config "anon"
+--
+
+ALTER ROLE anon SET statement_timeout TO '3s';
+
+--
+-- User Config "authenticated"
+--
+
+ALTER ROLE authenticated SET statement_timeout TO '8s';
+
+--
+-- User Config "authenticator"
+--
+
+ALTER ROLE authenticator SET session_preload_libraries TO 'safeupdate';
+ALTER ROLE authenticator SET statement_timeout TO '8s';
+
+--
+-- User Config "postgres"
+--
+
+ALTER ROLE postgres SET search_path TO E'\\\\$user', 'public', 'extensions';
+
+--
+-- User Config "supabase_admin"
+--
+
+ALTER ROLE supabase_admin SET search_path TO E'\\\\$user', 'public', 'auth', 'extensions';
+
+--
+-- User Config "supabase_auth_admin"
+--
+
+ALTER ROLE supabase_auth_admin SET search_path TO 'auth';
+ALTER ROLE supabase_auth_admin SET idle_in_transaction_session_timeout TO '60000';
+
+--
+-- User Config "supabase_functions_admin"
+--
+
+ALTER ROLE supabase_functions_admin SET search_path TO 'supabase_functions';
+
+--
+-- User Config "supabase_storage_admin"
+--
+
+ALTER ROLE supabase_storage_admin SET search_path TO 'storage';
+
+
+--
+-- Role memberships
+--
+
+GRANT anon TO authenticator GRANTED BY postgres;
+GRANT anon TO postgres GRANTED BY supabase_admin;
+GRANT anon TO supabase_storage_admin GRANTED BY supabase_admin;
+GRANT authenticated TO authenticator GRANTED BY postgres;
+GRANT authenticated TO postgres GRANTED BY supabase_admin;
+GRANT authenticated TO supabase_storage_admin GRANTED BY supabase_admin;
+GRANT pg_monitor TO postgres GRANTED BY supabase_admin;
+-- GRANT pg_read_all_data TO supabase_read_only_user GRANTED BY postgres;
+-- GRANT pgsodium_keyholder TO pgsodium_keymaker GRANTED BY postgres;
+-- GRANT pgsodium_keyholder TO postgres WITH ADMIN OPTION GRANTED BY postgres;
+-- GRANT pgsodium_keyiduser TO pgsodium_keyholder GRANTED BY postgres;
+-- GRANT pgsodium_keyiduser TO pgsodium_keymaker GRANTED BY postgres;
+-- GRANT pgsodium_keyiduser TO postgres WITH ADMIN OPTION GRANTED BY postgres;
+-- GRANT pgsodium_keymaker TO postgres WITH ADMIN OPTION GRANTED BY postgres;
+GRANT service_role TO authenticator GRANTED BY postgres;
+GRANT service_role TO postgres GRANTED BY supabase_admin;
+GRANT service_role TO supabase_storage_admin GRANTED BY supabase_admin;
+GRANT supabase_auth_admin TO postgres GRANTED BY supabase_admin;
+GRANT supabase_functions_admin TO postgres GRANTED BY supabase_admin;
+GRANT supabase_storage_admin TO postgres GRANTED BY supabase_admin;
+
+
+
+
+--
+-- PostgreSQL database cluster dump complete
+--
+
+DO $$
+BEGIN
+    -- role pg_read_all_data is not available on pg13
+    IF EXISTS (
+        SELECT FROM pg_catalog.pg_roles
+        WHERE rolname = 'pg_read_all_data'
+    ) THEN
+        GRANT pg_read_all_data TO supabase_read_only_user GRANTED BY postgres;
+    END IF;
+END
+$$;
+
+RESET ALL;
+`;
diff --git a/apps/cli/src/legacy/commands/start/templates/db-initial-schema-13.sql.ts b/apps/cli/src/legacy/commands/start/templates/db-initial-schema-13.sql.ts
new file mode 100644
index 0000000000..21ba71f53a
--- /dev/null
+++ b/apps/cli/src/legacy/commands/start/templates/db-initial-schema-13.sql.ts
@@ -0,0 +1,3104 @@
+/**
+ * Transcribed verbatim from `apps/cli-go/internal/utils/templates/initial_schemas/13.sql`
+ * (Go `//go:embed templates/initial_schemas/13.sql`, `apps/cli-go/internal/utils/config.go:51-52`,
+ * exported as `utils.InitialSchemaPg13Sql`). Run via `ExecBatch` against a fresh
+ * `db.major_version == 13` local database by `InitSchema14`
+ * (`apps/cli-go/internal/db/start/start.go:256-266`), right after
+ * {@link LEGACY_START_DB_GLOBALS_SQL}. Not a Go `text/template`. Do not hand-edit —
+ * re-transcribe from the Go source if it changes.
+ */
+export const LEGACY_START_DB_INITIAL_SCHEMA_13_SQL = `--
+-- PostgreSQL database dump
+--
+
+-- Dumped from database version 13.3 (Debian 13.3-1.pgdg100+1)
+-- Dumped by pg_dump version 15.3
+
+SET statement_timeout = 0;
+SET lock_timeout = 0;
+SET idle_in_transaction_session_timeout = 0;
+SET client_encoding = 'UTF8';
+SET standard_conforming_strings = on;
+SELECT pg_catalog.set_config('search_path', '', false);
+SET check_function_bodies = false;
+SET xmloption = content;
+SET client_min_messages = warning;
+SET row_security = off;
+
+--
+-- Name: _analytics; Type: SCHEMA; Schema: -; Owner: postgres
+--
+
+CREATE SCHEMA IF NOT EXISTS _analytics;
+
+
+ALTER SCHEMA _analytics OWNER TO postgres;
+
+--
+-- Name: _realtime; Type: SCHEMA; Schema: -; Owner: postgres
+--
+
+CREATE SCHEMA IF NOT EXISTS _realtime;
+
+
+ALTER SCHEMA _realtime OWNER TO postgres;
+
+--
+-- Name: auth; Type: SCHEMA; Schema: -; Owner: supabase_admin
+--
+
+CREATE SCHEMA IF NOT EXISTS auth;
+
+
+ALTER SCHEMA auth OWNER TO supabase_admin;
+
+--
+-- Name: extensions; Type: SCHEMA; Schema: -; Owner: postgres
+--
+
+CREATE SCHEMA IF NOT EXISTS extensions;
+
+
+ALTER SCHEMA extensions OWNER TO postgres;
+
+--
+-- Name: graphql_public; Type: SCHEMA; Schema: -; Owner: supabase_admin
+--
+
+CREATE SCHEMA IF NOT EXISTS graphql_public;
+
+
+ALTER SCHEMA graphql_public OWNER TO supabase_admin;
+
+--
+-- Name: public; Type: SCHEMA; Schema: -; Owner: postgres
+--
+
+-- *not* creating schema, since initdb creates it
+
+
+ALTER SCHEMA public OWNER TO postgres;
+
+--
+-- Name: realtime; Type: SCHEMA; Schema: -; Owner: supabase_admin
+--
+
+CREATE SCHEMA IF NOT EXISTS realtime;
+
+
+ALTER SCHEMA realtime OWNER TO supabase_admin;
+
+--
+-- Name: storage; Type: SCHEMA; Schema: -; Owner: supabase_admin
+--
+
+CREATE SCHEMA IF NOT EXISTS storage;
+
+
+ALTER SCHEMA storage OWNER TO supabase_admin;
+
+--
+-- Name: pgcrypto; Type: EXTENSION; Schema: -; Owner: -
+--
+
+CREATE EXTENSION IF NOT EXISTS pgcrypto WITH SCHEMA extensions;
+
+
+--
+-- Name: EXTENSION pgcrypto; Type: COMMENT; Schema: -; Owner: 
+--
+
+COMMENT ON EXTENSION pgcrypto IS 'cryptographic functions';
+
+
+--
+-- Name: pgjwt; Type: EXTENSION; Schema: -; Owner: -
+--
+
+CREATE EXTENSION IF NOT EXISTS pgjwt WITH SCHEMA extensions;
+
+
+--
+-- Name: EXTENSION pgjwt; Type: COMMENT; Schema: -; Owner: 
+--
+
+COMMENT ON EXTENSION pgjwt IS 'JSON Web Token API for Postgresql';
+
+
+--
+-- Name: uuid-ossp; Type: EXTENSION; Schema: -; Owner: -
+--
+
+CREATE EXTENSION IF NOT EXISTS "uuid-ossp" WITH SCHEMA extensions;
+
+
+--
+-- Name: EXTENSION "uuid-ossp"; Type: COMMENT; Schema: -; Owner: 
+--
+
+COMMENT ON EXTENSION "uuid-ossp" IS 'generate universally unique identifiers (UUIDs)';
+
+
+--
+-- Name: aal_level; Type: TYPE; Schema: auth; Owner: supabase_auth_admin
+--
+
+CREATE TYPE auth.aal_level AS ENUM (
+    'aal1',
+    'aal2',
+    'aal3'
+);
+
+
+ALTER TYPE auth.aal_level OWNER TO supabase_auth_admin;
+
+--
+-- Name: code_challenge_method; Type: TYPE; Schema: auth; Owner: supabase_auth_admin
+--
+
+CREATE TYPE auth.code_challenge_method AS ENUM (
+    's256',
+    'plain'
+);
+
+
+ALTER TYPE auth.code_challenge_method OWNER TO supabase_auth_admin;
+
+--
+-- Name: factor_status; Type: TYPE; Schema: auth; Owner: supabase_auth_admin
+--
+
+CREATE TYPE auth.factor_status AS ENUM (
+    'unverified',
+    'verified'
+);
+
+
+ALTER TYPE auth.factor_status OWNER TO supabase_auth_admin;
+
+--
+-- Name: factor_type; Type: TYPE; Schema: auth; Owner: supabase_auth_admin
+--
+
+CREATE TYPE auth.factor_type AS ENUM (
+    'totp',
+    'webauthn'
+);
+
+
+ALTER TYPE auth.factor_type OWNER TO supabase_auth_admin;
+
+--
+-- Name: email(); Type: FUNCTION; Schema: auth; Owner: supabase_auth_admin
+--
+
+CREATE OR REPLACE FUNCTION auth.email() RETURNS text
+    LANGUAGE sql STABLE
+    AS $$
+  select 
+  	coalesce(
+		nullif(current_setting('request.jwt.claim.email', true), ''),
+		(nullif(current_setting('request.jwt.claims', true), '')::jsonb ->> 'email')
+	)::text
+$$;
+
+
+ALTER FUNCTION auth.email() OWNER TO supabase_auth_admin;
+
+--
+-- Name: FUNCTION email(); Type: COMMENT; Schema: auth; Owner: supabase_auth_admin
+--
+
+COMMENT ON FUNCTION auth.email() IS 'Deprecated. Use auth.jwt() -> ''email'' instead.';
+
+
+--
+-- Name: jwt(); Type: FUNCTION; Schema: auth; Owner: supabase_auth_admin
+--
+
+CREATE OR REPLACE FUNCTION auth.jwt() RETURNS jsonb
+    LANGUAGE sql STABLE
+    AS $$
+  select 
+    coalesce(
+        nullif(current_setting('request.jwt.claim', true), ''),
+        nullif(current_setting('request.jwt.claims', true), '')
+    )::jsonb
+$$;
+
+
+ALTER FUNCTION auth.jwt() OWNER TO supabase_auth_admin;
+
+--
+-- Name: role(); Type: FUNCTION; Schema: auth; Owner: supabase_auth_admin
+--
+
+CREATE OR REPLACE FUNCTION auth.role() RETURNS text
+    LANGUAGE sql STABLE
+    AS $$
+  select 
+  	coalesce(
+		nullif(current_setting('request.jwt.claim.role', true), ''),
+		(nullif(current_setting('request.jwt.claims', true), '')::jsonb ->> 'role')
+	)::text
+$$;
+
+
+ALTER FUNCTION auth.role() OWNER TO supabase_auth_admin;
+
+--
+-- Name: FUNCTION role(); Type: COMMENT; Schema: auth; Owner: supabase_auth_admin
+--
+
+COMMENT ON FUNCTION auth.role() IS 'Deprecated. Use auth.jwt() -> ''role'' instead.';
+
+
+--
+-- Name: uid(); Type: FUNCTION; Schema: auth; Owner: supabase_auth_admin
+--
+
+CREATE OR REPLACE FUNCTION auth.uid() RETURNS uuid
+    LANGUAGE sql STABLE
+    AS $$
+  select 
+  	coalesce(
+		nullif(current_setting('request.jwt.claim.sub', true), ''),
+		(nullif(current_setting('request.jwt.claims', true), '')::jsonb ->> 'sub')
+	)::uuid
+$$;
+
+
+ALTER FUNCTION auth.uid() OWNER TO supabase_auth_admin;
+
+--
+-- Name: FUNCTION uid(); Type: COMMENT; Schema: auth; Owner: supabase_auth_admin
+--
+
+COMMENT ON FUNCTION auth.uid() IS 'Deprecated. Use auth.jwt() -> ''sub'' instead.';
+
+
+--
+-- Name: grant_pg_cron_access(); Type: FUNCTION; Schema: extensions; Owner: postgres
+--
+
+CREATE OR REPLACE FUNCTION extensions.grant_pg_cron_access() RETURNS event_trigger
+    LANGUAGE plpgsql
+    AS $$
+DECLARE
+  schema_is_cron bool;
+BEGIN
+  schema_is_cron = (
+    SELECT n.nspname = 'cron'
+    FROM pg_event_trigger_ddl_commands() AS ev
+    LEFT JOIN pg_catalog.pg_namespace AS n
+      ON ev.objid = n.oid
+  );
+
+  IF schema_is_cron
+  THEN
+    grant usage on schema cron to postgres with grant option;
+
+    alter default privileges in schema cron grant all on tables to postgres with grant option;
+    alter default privileges in schema cron grant all on functions to postgres with grant option;
+    alter default privileges in schema cron grant all on sequences to postgres with grant option;
+
+    alter default privileges for user supabase_admin in schema cron grant all
+        on sequences to postgres with grant option;
+    alter default privileges for user supabase_admin in schema cron grant all
+        on tables to postgres with grant option;
+    alter default privileges for user supabase_admin in schema cron grant all
+        on functions to postgres with grant option;
+
+    grant all privileges on all tables in schema cron to postgres with grant option; 
+
+  END IF;
+
+END;
+$$;
+
+
+ALTER FUNCTION extensions.grant_pg_cron_access() OWNER TO postgres;
+
+--
+-- Name: FUNCTION grant_pg_cron_access(); Type: COMMENT; Schema: extensions; Owner: postgres
+--
+
+COMMENT ON FUNCTION extensions.grant_pg_cron_access() IS 'Grants access to pg_cron';
+
+
+--
+-- Name: grant_pg_graphql_access(); Type: FUNCTION; Schema: extensions; Owner: supabase_admin
+--
+
+CREATE OR REPLACE FUNCTION extensions.grant_pg_graphql_access() RETURNS event_trigger
+    LANGUAGE plpgsql
+    AS $_$
+DECLARE
+    func_is_graphql_resolve bool;
+BEGIN
+    func_is_graphql_resolve = (
+        SELECT n.proname = 'resolve'
+        FROM pg_event_trigger_ddl_commands() AS ev
+        LEFT JOIN pg_catalog.pg_proc AS n
+        ON ev.objid = n.oid
+    );
+
+    IF func_is_graphql_resolve
+    THEN
+
+        -- Update public wrapper to pass all arguments through to the pg_graphql resolve func
+        create or replace function graphql_public.graphql(
+            "operationName" text default null,
+            query text default null,
+            variables jsonb default null,
+            extensions jsonb default null
+        )
+            returns jsonb
+            language sql
+        as $$
+            select graphql.resolve(
+                query := query,
+                variables := coalesce(variables, '{}'),
+                "operationName" := "operationName",
+                extensions := extensions
+            );
+        $$;
+
+		-- This hook executes when \`graphql.resolve\` is created. That is not necessarily the last
+		-- function in the extension so we need to grant permissions on existing entities AND
+		-- update default permissions to any others that are created after \`graphql.resolve\`
+        grant usage on schema graphql to postgres, anon, authenticated, service_role;
+        grant select on all tables in schema graphql to postgres, anon, authenticated, service_role;
+        grant execute on all functions in schema graphql to postgres, anon, authenticated, service_role;
+        grant all on all sequences in schema graphql to postgres, anon, authenticated, service_role;
+		alter default privileges in schema graphql grant all on tables to postgres, anon, authenticated, service_role;
+        alter default privileges in schema graphql grant all on functions to postgres, anon, authenticated, service_role;
+        alter default privileges in schema graphql grant all on sequences to postgres, anon, authenticated, service_role;
+    END IF;
+
+END;
+$_$;
+
+
+ALTER FUNCTION extensions.grant_pg_graphql_access() OWNER TO supabase_admin;
+
+--
+-- Name: FUNCTION grant_pg_graphql_access(); Type: COMMENT; Schema: extensions; Owner: supabase_admin
+--
+
+COMMENT ON FUNCTION extensions.grant_pg_graphql_access() IS 'Grants access to pg_graphql';
+
+
+--
+-- Name: grant_pg_net_access(); Type: FUNCTION; Schema: extensions; Owner: postgres
+--
+
+CREATE OR REPLACE FUNCTION extensions.grant_pg_net_access() RETURNS event_trigger
+    LANGUAGE plpgsql
+    AS $$
+BEGIN
+  IF EXISTS (
+    SELECT 1
+    FROM pg_event_trigger_ddl_commands() AS ev
+    JOIN pg_extension AS ext
+    ON ev.objid = ext.oid
+    WHERE ext.extname = 'pg_net'
+  )
+  THEN
+    IF NOT EXISTS (
+      SELECT 1
+      FROM pg_roles
+      WHERE rolname = 'supabase_functions_admin'
+    )
+    THEN
+      CREATE USER supabase_functions_admin NOINHERIT CREATEROLE LOGIN NOREPLICATION;
+    END IF;
+
+    GRANT USAGE ON SCHEMA net TO supabase_functions_admin, postgres, anon, authenticated, service_role;
+
+    ALTER function net.http_get(url text, params jsonb, headers jsonb, timeout_milliseconds integer) SECURITY DEFINER;
+    ALTER function net.http_post(url text, body jsonb, params jsonb, headers jsonb, timeout_milliseconds integer) SECURITY DEFINER;
+    ALTER function net.http_collect_response(request_id bigint, async boolean) SECURITY DEFINER;
+
+    ALTER function net.http_get(url text, params jsonb, headers jsonb, timeout_milliseconds integer) SET search_path = net;
+    ALTER function net.http_post(url text, body jsonb, params jsonb, headers jsonb, timeout_milliseconds integer) SET search_path = net;
+    ALTER function net.http_collect_response(request_id bigint, async boolean) SET search_path = net;
+
+    REVOKE ALL ON FUNCTION net.http_get(url text, params jsonb, headers jsonb, timeout_milliseconds integer) FROM PUBLIC;
+    REVOKE ALL ON FUNCTION net.http_post(url text, body jsonb, params jsonb, headers jsonb, timeout_milliseconds integer) FROM PUBLIC;
+    REVOKE ALL ON FUNCTION net.http_collect_response(request_id bigint, async boolean) FROM PUBLIC;
+
+    GRANT EXECUTE ON FUNCTION net.http_get(url text, params jsonb, headers jsonb, timeout_milliseconds integer) TO supabase_functions_admin, postgres, anon, authenticated, service_role;
+    GRANT EXECUTE ON FUNCTION net.http_post(url text, body jsonb, params jsonb, headers jsonb, timeout_milliseconds integer) TO supabase_functions_admin, postgres, anon, authenticated, service_role;
+    GRANT EXECUTE ON FUNCTION net.http_collect_response(request_id bigint, async boolean) TO supabase_functions_admin, postgres, anon, authenticated, service_role;
+  END IF;
+END;
+$$;
+
+
+ALTER FUNCTION extensions.grant_pg_net_access() OWNER TO postgres;
+
+--
+-- Name: FUNCTION grant_pg_net_access(); Type: COMMENT; Schema: extensions; Owner: postgres
+--
+
+COMMENT ON FUNCTION extensions.grant_pg_net_access() IS 'Grants access to pg_net';
+
+
+--
+-- Name: pgrst_ddl_watch(); Type: FUNCTION; Schema: extensions; Owner: supabase_admin
+--
+
+CREATE OR REPLACE FUNCTION extensions.pgrst_ddl_watch() RETURNS event_trigger
+    LANGUAGE plpgsql
+    AS $$
+DECLARE
+  cmd record;
+BEGIN
+  FOR cmd IN SELECT * FROM pg_event_trigger_ddl_commands()
+  LOOP
+    IF cmd.command_tag IN (
+      'CREATE SCHEMA', 'ALTER SCHEMA'
+    , 'CREATE TABLE', 'CREATE TABLE AS', 'SELECT INTO', 'ALTER TABLE'
+    , 'CREATE FOREIGN TABLE', 'ALTER FOREIGN TABLE'
+    , 'CREATE VIEW', 'ALTER VIEW'
+    , 'CREATE MATERIALIZED VIEW', 'ALTER MATERIALIZED VIEW'
+    , 'CREATE FUNCTION', 'ALTER FUNCTION'
+    , 'CREATE TRIGGER'
+    , 'CREATE TYPE', 'ALTER TYPE'
+    , 'CREATE RULE'
+    , 'COMMENT'
+    )
+    -- don't notify in case of CREATE TEMP table or other objects created on pg_temp
+    AND cmd.schema_name is distinct from 'pg_temp'
+    THEN
+      NOTIFY pgrst, 'reload schema';
+    END IF;
+  END LOOP;
+END; $$;
+
+
+ALTER FUNCTION extensions.pgrst_ddl_watch() OWNER TO supabase_admin;
+
+--
+-- Name: pgrst_drop_watch(); Type: FUNCTION; Schema: extensions; Owner: supabase_admin
+--
+
+CREATE OR REPLACE FUNCTION extensions.pgrst_drop_watch() RETURNS event_trigger
+    LANGUAGE plpgsql
+    AS $$
+DECLARE
+  obj record;
+BEGIN
+  FOR obj IN SELECT * FROM pg_event_trigger_dropped_objects()
+  LOOP
+    IF obj.object_type IN (
+      'schema'
+    , 'table'
+    , 'foreign table'
+    , 'view'
+    , 'materialized view'
+    , 'function'
+    , 'trigger'
+    , 'type'
+    , 'rule'
+    )
+    AND obj.is_temporary IS false -- no pg_temp objects
+    THEN
+      NOTIFY pgrst, 'reload schema';
+    END IF;
+  END LOOP;
+END; $$;
+
+
+ALTER FUNCTION extensions.pgrst_drop_watch() OWNER TO supabase_admin;
+
+--
+-- Name: set_graphql_placeholder(); Type: FUNCTION; Schema: extensions; Owner: supabase_admin
+--
+
+CREATE OR REPLACE FUNCTION extensions.set_graphql_placeholder() RETURNS event_trigger
+    LANGUAGE plpgsql
+    AS $_$
+    DECLARE
+    graphql_is_dropped bool;
+    BEGIN
+    graphql_is_dropped = (
+        SELECT ev.schema_name = 'graphql_public'
+        FROM pg_event_trigger_dropped_objects() AS ev
+        WHERE ev.schema_name = 'graphql_public'
+    );
+
+    IF graphql_is_dropped
+    THEN
+        create or replace function graphql_public.graphql(
+            "operationName" text default null,
+            query text default null,
+            variables jsonb default null,
+            extensions jsonb default null
+        )
+            returns jsonb
+            language plpgsql
+        as $$
+            DECLARE
+                server_version float;
+            BEGIN
+                server_version = (SELECT (SPLIT_PART((select version()), ' ', 2))::float);
+
+                IF server_version >= 14 THEN
+                    RETURN jsonb_build_object(
+                        'errors', jsonb_build_array(
+                            jsonb_build_object(
+                                'message', 'pg_graphql extension is not enabled.'
+                            )
+                        )
+                    );
+                ELSE
+                    RETURN jsonb_build_object(
+                        'errors', jsonb_build_array(
+                            jsonb_build_object(
+                                'message', 'pg_graphql is only available on projects running Postgres 14 onwards.'
+                            )
+                        )
+                    );
+                END IF;
+            END;
+        $$;
+    END IF;
+
+    END;
+$_$;
+
+
+ALTER FUNCTION extensions.set_graphql_placeholder() OWNER TO supabase_admin;
+
+--
+-- Name: FUNCTION set_graphql_placeholder(); Type: COMMENT; Schema: extensions; Owner: supabase_admin
+--
+
+COMMENT ON FUNCTION extensions.set_graphql_placeholder() IS 'Reintroduces placeholder function for graphql_public.graphql';
+
+
+--
+-- Name: graphql(text, text, jsonb, jsonb); Type: FUNCTION; Schema: graphql_public; Owner: supabase_admin
+--
+
+CREATE OR REPLACE FUNCTION graphql_public.graphql("operationName" text DEFAULT NULL::text, query text DEFAULT NULL::text, variables jsonb DEFAULT NULL::jsonb, extensions jsonb DEFAULT NULL::jsonb) RETURNS jsonb
+    LANGUAGE plpgsql
+    AS $$
+    DECLARE
+        server_version float;
+    BEGIN
+        server_version = (SELECT (SPLIT_PART((select version()), ' ', 2))::float);
+
+        IF server_version >= 14 THEN
+            RETURN jsonb_build_object(
+                'errors', jsonb_build_array(
+                    jsonb_build_object(
+                        'message', 'pg_graphql extension is not enabled.'
+                    )
+                )
+            );
+        ELSE
+   	        RETURN jsonb_build_object(
+                'errors', jsonb_build_array(
+                    jsonb_build_object(
+                        'message', 'pg_graphql is only available on projects running Postgres 14 onwards.'
+                    )
+                )
+            );
+        END IF;
+    END;
+$$;
+
+
+ALTER FUNCTION graphql_public.graphql("operationName" text, query text, variables jsonb, extensions jsonb) OWNER TO supabase_admin;
+
+--
+-- Name: can_insert_object(text, text, uuid, jsonb); Type: FUNCTION; Schema: storage; Owner: supabase_storage_admin
+--
+
+CREATE OR REPLACE FUNCTION storage.can_insert_object(bucketid text, name text, owner uuid, metadata jsonb) RETURNS void
+    LANGUAGE plpgsql
+    AS $$
+BEGIN
+  INSERT INTO "storage"."objects" ("bucket_id", "name", "owner", "metadata") VALUES (bucketid, name, owner, metadata);
+  -- hack to rollback the successful insert
+  RAISE sqlstate 'PT200' using
+  message = 'ROLLBACK',
+  detail = 'rollback successful insert';
+END
+$$;
+
+
+ALTER FUNCTION storage.can_insert_object(bucketid text, name text, owner uuid, metadata jsonb) OWNER TO supabase_storage_admin;
+
+--
+-- Name: extension(text); Type: FUNCTION; Schema: storage; Owner: supabase_storage_admin
+--
+
+CREATE OR REPLACE FUNCTION storage.extension(name text) RETURNS text
+    LANGUAGE plpgsql
+    AS $$
+DECLARE
+_parts text[];
+_filename text;
+BEGIN
+	select string_to_array(name, '/') into _parts;
+	select _parts[array_length(_parts,1)] into _filename;
+	-- @todo return the last part instead of 2
+	return split_part(_filename, '.', 2);
+END
+$$;
+
+
+ALTER FUNCTION storage.extension(name text) OWNER TO supabase_storage_admin;
+
+--
+-- Name: filename(text); Type: FUNCTION; Schema: storage; Owner: supabase_storage_admin
+--
+
+CREATE OR REPLACE FUNCTION storage.filename(name text) RETURNS text
+    LANGUAGE plpgsql
+    AS $$
+DECLARE
+_parts text[];
+BEGIN
+	select string_to_array(name, '/') into _parts;
+	return _parts[array_length(_parts,1)];
+END
+$$;
+
+
+ALTER FUNCTION storage.filename(name text) OWNER TO supabase_storage_admin;
+
+--
+-- Name: foldername(text); Type: FUNCTION; Schema: storage; Owner: supabase_storage_admin
+--
+
+CREATE OR REPLACE FUNCTION storage.foldername(name text) RETURNS text[]
+    LANGUAGE plpgsql
+    AS $$
+DECLARE
+_parts text[];
+BEGIN
+	select string_to_array(name, '/') into _parts;
+	return _parts[1:array_length(_parts,1)-1];
+END
+$$;
+
+
+ALTER FUNCTION storage.foldername(name text) OWNER TO supabase_storage_admin;
+
+--
+-- Name: get_size_by_bucket(); Type: FUNCTION; Schema: storage; Owner: supabase_storage_admin
+--
+
+CREATE OR REPLACE FUNCTION storage.get_size_by_bucket() RETURNS TABLE(size bigint, bucket_id text)
+    LANGUAGE plpgsql
+    AS $$
+BEGIN
+    return query
+        select sum((metadata->>'size')::int) as size, obj.bucket_id
+        from "storage".objects as obj
+        group by obj.bucket_id;
+END
+$$;
+
+
+ALTER FUNCTION storage.get_size_by_bucket() OWNER TO supabase_storage_admin;
+
+--
+-- Name: search(text, text, integer, integer, integer, text, text, text); Type: FUNCTION; Schema: storage; Owner: supabase_storage_admin
+--
+
+CREATE OR REPLACE FUNCTION storage.search(prefix text, bucketname text, limits integer DEFAULT 100, levels integer DEFAULT 1, offsets integer DEFAULT 0, search text DEFAULT ''::text, sortcolumn text DEFAULT 'name'::text, sortorder text DEFAULT 'asc'::text) RETURNS TABLE(name text, id uuid, updated_at timestamp with time zone, created_at timestamp with time zone, last_accessed_at timestamp with time zone, metadata jsonb)
+    LANGUAGE plpgsql STABLE
+    AS $_$
+declare
+  v_order_by text;
+  v_sort_order text;
+begin
+  case
+    when sortcolumn = 'name' then
+      v_order_by = 'name';
+    when sortcolumn = 'updated_at' then
+      v_order_by = 'updated_at';
+    when sortcolumn = 'created_at' then
+      v_order_by = 'created_at';
+    when sortcolumn = 'last_accessed_at' then
+      v_order_by = 'last_accessed_at';
+    else
+      v_order_by = 'name';
+  end case;
+
+  case
+    when sortorder = 'asc' then
+      v_sort_order = 'asc';
+    when sortorder = 'desc' then
+      v_sort_order = 'desc';
+    else
+      v_sort_order = 'asc';
+  end case;
+
+  v_order_by = v_order_by || ' ' || v_sort_order;
+
+  return query execute
+    'with folders as (
+       select path_tokens[$1] as folder
+       from storage.objects
+         where objects.name ilike $2 || $3 || ''%''
+           and bucket_id = $4
+           and array_length(regexp_split_to_array(objects.name, ''/''), 1) <> $1
+       group by folder
+       order by folder ' || v_sort_order || '
+     )
+     (select folder as "name",
+            null as id,
+            null as updated_at,
+            null as created_at,
+            null as last_accessed_at,
+            null as metadata from folders)
+     union all
+     (select path_tokens[$1] as "name",
+            id,
+            updated_at,
+            created_at,
+            last_accessed_at,
+            metadata
+     from storage.objects
+     where objects.name ilike $2 || $3 || ''%''
+       and bucket_id = $4
+       and array_length(regexp_split_to_array(objects.name, ''/''), 1) = $1
+     order by ' || v_order_by || ')
+     limit $5
+     offset $6' using levels, prefix, search, bucketname, limits, offsets;
+end;
+$_$;
+
+
+ALTER FUNCTION storage.search(prefix text, bucketname text, limits integer, levels integer, offsets integer, search text, sortcolumn text, sortorder text) OWNER TO supabase_storage_admin;
+
+--
+-- Name: update_updated_at_column(); Type: FUNCTION; Schema: storage; Owner: supabase_storage_admin
+--
+
+CREATE OR REPLACE FUNCTION storage.update_updated_at_column() RETURNS trigger
+    LANGUAGE plpgsql
+    AS $$
+BEGIN
+    NEW.updated_at = now();
+    RETURN NEW; 
+END;
+$$;
+
+
+ALTER FUNCTION storage.update_updated_at_column() OWNER TO supabase_storage_admin;
+
+SET default_tablespace = '';
+
+SET default_table_access_method = heap;
+
+--
+-- Name: extensions; Type: TABLE; Schema: _realtime; Owner: postgres
+--
+
+CREATE TABLE IF NOT EXISTS _realtime.extensions (
+    id uuid NOT NULL,
+    type text,
+    settings jsonb,
+    tenant_external_id text,
+    inserted_at timestamp(0) without time zone NOT NULL,
+    updated_at timestamp(0) without time zone NOT NULL
+);
+
+
+ALTER TABLE _realtime.extensions OWNER TO postgres;
+
+--
+-- Name: schema_migrations; Type: TABLE; Schema: _realtime; Owner: postgres
+--
+
+CREATE TABLE IF NOT EXISTS _realtime.schema_migrations (
+    version bigint NOT NULL,
+    inserted_at timestamp(0) without time zone
+);
+
+
+ALTER TABLE _realtime.schema_migrations OWNER TO postgres;
+
+--
+-- Name: tenants; Type: TABLE; Schema: _realtime; Owner: postgres
+--
+
+CREATE TABLE IF NOT EXISTS _realtime.tenants (
+    id uuid NOT NULL,
+    name text,
+    external_id text,
+    jwt_secret text,
+    max_concurrent_users integer DEFAULT 200 NOT NULL,
+    inserted_at timestamp(0) without time zone NOT NULL,
+    updated_at timestamp(0) without time zone NOT NULL,
+    max_events_per_second integer DEFAULT 100 NOT NULL,
+    postgres_cdc_default text DEFAULT 'postgres_cdc_rls'::text,
+    max_bytes_per_second integer DEFAULT 100000 NOT NULL,
+    max_channels_per_client integer DEFAULT 100 NOT NULL,
+    max_joins_per_second integer DEFAULT 500 NOT NULL,
+    suspend boolean DEFAULT false
+);
+
+
+ALTER TABLE _realtime.tenants OWNER TO postgres;
+
+--
+-- Name: audit_log_entries; Type: TABLE; Schema: auth; Owner: supabase_auth_admin
+--
+
+CREATE TABLE IF NOT EXISTS auth.audit_log_entries (
+    instance_id uuid,
+    id uuid NOT NULL,
+    payload json,
+    created_at timestamp with time zone,
+    ip_address character varying(64) DEFAULT ''::character varying NOT NULL
+);
+
+
+ALTER TABLE auth.audit_log_entries OWNER TO supabase_auth_admin;
+
+--
+-- Name: TABLE audit_log_entries; Type: COMMENT; Schema: auth; Owner: supabase_auth_admin
+--
+
+COMMENT ON TABLE auth.audit_log_entries IS 'Auth: Audit trail for user actions.';
+
+
+--
+-- Name: flow_state; Type: TABLE; Schema: auth; Owner: supabase_auth_admin
+--
+
+CREATE TABLE IF NOT EXISTS auth.flow_state (
+    id uuid NOT NULL,
+    user_id uuid,
+    auth_code text NOT NULL,
+    code_challenge_method auth.code_challenge_method NOT NULL,
+    code_challenge text NOT NULL,
+    provider_type text NOT NULL,
+    provider_access_token text,
+    provider_refresh_token text,
+    created_at timestamp with time zone,
+    updated_at timestamp with time zone,
+    authentication_method text NOT NULL
+);
+
+
+ALTER TABLE auth.flow_state OWNER TO supabase_auth_admin;
+
+--
+-- Name: TABLE flow_state; Type: COMMENT; Schema: auth; Owner: supabase_auth_admin
+--
+
+COMMENT ON TABLE auth.flow_state IS 'stores metadata for pkce logins';
+
+
+--
+-- Name: identities; Type: TABLE; Schema: auth; Owner: supabase_auth_admin
+--
+
+CREATE TABLE IF NOT EXISTS auth.identities (
+    provider_id text NOT NULL,
+    user_id uuid NOT NULL,
+    identity_data jsonb NOT NULL,
+    provider text NOT NULL,
+    last_sign_in_at timestamp with time zone,
+    created_at timestamp with time zone,
+    updated_at timestamp with time zone,
+    email text GENERATED ALWAYS AS (lower((identity_data ->> 'email'::text))) STORED,
+    id uuid DEFAULT gen_random_uuid() NOT NULL
+);
+
+
+ALTER TABLE auth.identities OWNER TO supabase_auth_admin;
+
+--
+-- Name: TABLE identities; Type: COMMENT; Schema: auth; Owner: supabase_auth_admin
+--
+
+COMMENT ON TABLE auth.identities IS 'Auth: Stores identities associated to a user.';
+
+
+--
+-- Name: COLUMN identities.email; Type: COMMENT; Schema: auth; Owner: supabase_auth_admin
+--
+
+COMMENT ON COLUMN auth.identities.email IS 'Auth: Email is a generated column that references the optional email property in the identity_data';
+
+
+--
+-- Name: instances; Type: TABLE; Schema: auth; Owner: supabase_auth_admin
+--
+
+CREATE TABLE IF NOT EXISTS auth.instances (
+    id uuid NOT NULL,
+    uuid uuid,
+    raw_base_config text,
+    created_at timestamp with time zone,
+    updated_at timestamp with time zone
+);
+
+
+ALTER TABLE auth.instances OWNER TO supabase_auth_admin;
+
+--
+-- Name: TABLE instances; Type: COMMENT; Schema: auth; Owner: supabase_auth_admin
+--
+
+COMMENT ON TABLE auth.instances IS 'Auth: Manages users across multiple sites.';
+
+
+--
+-- Name: mfa_amr_claims; Type: TABLE; Schema: auth; Owner: supabase_auth_admin
+--
+
+CREATE TABLE IF NOT EXISTS auth.mfa_amr_claims (
+    session_id uuid NOT NULL,
+    created_at timestamp with time zone NOT NULL,
+    updated_at timestamp with time zone NOT NULL,
+    authentication_method text NOT NULL,
+    id uuid NOT NULL
+);
+
+
+ALTER TABLE auth.mfa_amr_claims OWNER TO supabase_auth_admin;
+
+--
+-- Name: TABLE mfa_amr_claims; Type: COMMENT; Schema: auth; Owner: supabase_auth_admin
+--
+
+COMMENT ON TABLE auth.mfa_amr_claims IS 'auth: stores authenticator method reference claims for multi factor authentication';
+
+
+--
+-- Name: mfa_challenges; Type: TABLE; Schema: auth; Owner: supabase_auth_admin
+--
+
+CREATE TABLE IF NOT EXISTS auth.mfa_challenges (
+    id uuid NOT NULL,
+    factor_id uuid NOT NULL,
+    created_at timestamp with time zone NOT NULL,
+    verified_at timestamp with time zone,
+    ip_address inet NOT NULL
+);
+
+
+ALTER TABLE auth.mfa_challenges OWNER TO supabase_auth_admin;
+
+--
+-- Name: TABLE mfa_challenges; Type: COMMENT; Schema: auth; Owner: supabase_auth_admin
+--
+
+COMMENT ON TABLE auth.mfa_challenges IS 'auth: stores metadata about challenge requests made';
+
+
+--
+-- Name: mfa_factors; Type: TABLE; Schema: auth; Owner: supabase_auth_admin
+--
+
+CREATE TABLE IF NOT EXISTS auth.mfa_factors (
+    id uuid NOT NULL,
+    user_id uuid NOT NULL,
+    friendly_name text,
+    factor_type auth.factor_type NOT NULL,
+    status auth.factor_status NOT NULL,
+    created_at timestamp with time zone NOT NULL,
+    updated_at timestamp with time zone NOT NULL,
+    secret text
+);
+
+
+ALTER TABLE auth.mfa_factors OWNER TO supabase_auth_admin;
+
+--
+-- Name: TABLE mfa_factors; Type: COMMENT; Schema: auth; Owner: supabase_auth_admin
+--
+
+COMMENT ON TABLE auth.mfa_factors IS 'auth: stores metadata about factors';
+
+
+--
+-- Name: refresh_tokens; Type: TABLE; Schema: auth; Owner: supabase_auth_admin
+--
+
+CREATE TABLE IF NOT EXISTS auth.refresh_tokens (
+    instance_id uuid,
+    id bigint NOT NULL,
+    token character varying(255),
+    user_id character varying(255),
+    revoked boolean,
+    created_at timestamp with time zone,
+    updated_at timestamp with time zone,
+    parent character varying(255),
+    session_id uuid
+);
+
+
+ALTER TABLE auth.refresh_tokens OWNER TO supabase_auth_admin;
+
+--
+-- Name: TABLE refresh_tokens; Type: COMMENT; Schema: auth; Owner: supabase_auth_admin
+--
+
+COMMENT ON TABLE auth.refresh_tokens IS 'Auth: Store of tokens used to refresh JWT tokens once they expire.';
+
+
+--
+-- Name: refresh_tokens_id_seq; Type: SEQUENCE; Schema: auth; Owner: supabase_auth_admin
+--
+
+CREATE SEQUENCE IF NOT EXISTS auth.refresh_tokens_id_seq
+    START WITH 1
+    INCREMENT BY 1
+    NO MINVALUE
+    NO MAXVALUE
+    CACHE 1;
+
+
+ALTER TABLE auth.refresh_tokens_id_seq OWNER TO supabase_auth_admin;
+
+--
+-- Name: refresh_tokens_id_seq; Type: SEQUENCE OWNED BY; Schema: auth; Owner: supabase_auth_admin
+--
+
+ALTER SEQUENCE auth.refresh_tokens_id_seq OWNED BY auth.refresh_tokens.id;
+
+
+--
+-- Name: saml_providers; Type: TABLE; Schema: auth; Owner: supabase_auth_admin
+--
+
+CREATE TABLE IF NOT EXISTS auth.saml_providers (
+    id uuid NOT NULL,
+    sso_provider_id uuid NOT NULL,
+    entity_id text NOT NULL,
+    metadata_xml text NOT NULL,
+    metadata_url text,
+    attribute_mapping jsonb,
+    created_at timestamp with time zone,
+    updated_at timestamp with time zone,
+    CONSTRAINT "entity_id not empty" CHECK ((char_length(entity_id) > 0)),
+    CONSTRAINT "metadata_url not empty" CHECK (((metadata_url = NULL::text) OR (char_length(metadata_url) > 0))),
+    CONSTRAINT "metadata_xml not empty" CHECK ((char_length(metadata_xml) > 0))
+);
+
+
+ALTER TABLE auth.saml_providers OWNER TO supabase_auth_admin;
+
+--
+-- Name: TABLE saml_providers; Type: COMMENT; Schema: auth; Owner: supabase_auth_admin
+--
+
+COMMENT ON TABLE auth.saml_providers IS 'Auth: Manages SAML Identity Provider connections.';
+
+
+--
+-- Name: saml_relay_states; Type: TABLE; Schema: auth; Owner: supabase_auth_admin
+--
+
+CREATE TABLE IF NOT EXISTS auth.saml_relay_states (
+    id uuid NOT NULL,
+    sso_provider_id uuid NOT NULL,
+    request_id text NOT NULL,
+    for_email text,
+    redirect_to text,
+    from_ip_address inet,
+    created_at timestamp with time zone,
+    updated_at timestamp with time zone,
+    flow_state_id uuid,
+    CONSTRAINT "request_id not empty" CHECK ((char_length(request_id) > 0))
+);
+
+
+ALTER TABLE auth.saml_relay_states OWNER TO supabase_auth_admin;
+
+--
+-- Name: TABLE saml_relay_states; Type: COMMENT; Schema: auth; Owner: supabase_auth_admin
+--
+
+COMMENT ON TABLE auth.saml_relay_states IS 'Auth: Contains SAML Relay State information for each Service Provider initiated login.';
+
+
+--
+-- Name: schema_migrations; Type: TABLE; Schema: auth; Owner: supabase_auth_admin
+--
+
+CREATE TABLE IF NOT EXISTS auth.schema_migrations (
+    version character varying(255) NOT NULL
+);
+
+
+ALTER TABLE auth.schema_migrations OWNER TO supabase_auth_admin;
+
+--
+-- Name: TABLE schema_migrations; Type: COMMENT; Schema: auth; Owner: supabase_auth_admin
+--
+
+COMMENT ON TABLE auth.schema_migrations IS 'Auth: Manages updates to the auth system.';
+
+
+--
+-- Name: sessions; Type: TABLE; Schema: auth; Owner: supabase_auth_admin
+--
+
+CREATE TABLE IF NOT EXISTS auth.sessions (
+    id uuid NOT NULL,
+    user_id uuid NOT NULL,
+    created_at timestamp with time zone,
+    updated_at timestamp with time zone,
+    factor_id uuid,
+    aal auth.aal_level,
+    not_after timestamp with time zone,
+    refreshed_at timestamp without time zone,
+    user_agent text,
+    ip inet,
+    tag text
+);
+
+
+ALTER TABLE auth.sessions OWNER TO supabase_auth_admin;
+
+--
+-- Name: TABLE sessions; Type: COMMENT; Schema: auth; Owner: supabase_auth_admin
+--
+
+COMMENT ON TABLE auth.sessions IS 'Auth: Stores session data associated to a user.';
+
+
+--
+-- Name: COLUMN sessions.not_after; Type: COMMENT; Schema: auth; Owner: supabase_auth_admin
+--
+
+COMMENT ON COLUMN auth.sessions.not_after IS 'Auth: Not after is a nullable column that contains a timestamp after which the session should be regarded as expired.';
+
+
+--
+-- Name: sso_domains; Type: TABLE; Schema: auth; Owner: supabase_auth_admin
+--
+
+CREATE TABLE IF NOT EXISTS auth.sso_domains (
+    id uuid NOT NULL,
+    sso_provider_id uuid NOT NULL,
+    domain text NOT NULL,
+    created_at timestamp with time zone,
+    updated_at timestamp with time zone,
+    CONSTRAINT "domain not empty" CHECK ((char_length(domain) > 0))
+);
+
+
+ALTER TABLE auth.sso_domains OWNER TO supabase_auth_admin;
+
+--
+-- Name: TABLE sso_domains; Type: COMMENT; Schema: auth; Owner: supabase_auth_admin
+--
+
+COMMENT ON TABLE auth.sso_domains IS 'Auth: Manages SSO email address domain mapping to an SSO Identity Provider.';
+
+
+--
+-- Name: sso_providers; Type: TABLE; Schema: auth; Owner: supabase_auth_admin
+--
+
+CREATE TABLE IF NOT EXISTS auth.sso_providers (
+    id uuid NOT NULL,
+    resource_id text,
+    created_at timestamp with time zone,
+    updated_at timestamp with time zone,
+    CONSTRAINT "resource_id not empty" CHECK (((resource_id = NULL::text) OR (char_length(resource_id) > 0)))
+);
+
+
+ALTER TABLE auth.sso_providers OWNER TO supabase_auth_admin;
+
+--
+-- Name: TABLE sso_providers; Type: COMMENT; Schema: auth; Owner: supabase_auth_admin
+--
+
+COMMENT ON TABLE auth.sso_providers IS 'Auth: Manages SSO identity provider information; see saml_providers for SAML.';
+
+
+--
+-- Name: COLUMN sso_providers.resource_id; Type: COMMENT; Schema: auth; Owner: supabase_auth_admin
+--
+
+COMMENT ON COLUMN auth.sso_providers.resource_id IS 'Auth: Uniquely identifies a SSO provider according to a user-chosen resource ID (case insensitive), useful in infrastructure as code.';
+
+
+--
+-- Name: users; Type: TABLE; Schema: auth; Owner: supabase_auth_admin
+--
+
+CREATE TABLE IF NOT EXISTS auth.users (
+    instance_id uuid,
+    id uuid NOT NULL,
+    aud character varying(255),
+    role character varying(255),
+    email character varying(255),
+    encrypted_password character varying(255),
+    email_confirmed_at timestamp with time zone,
+    invited_at timestamp with time zone,
+    confirmation_token character varying(255),
+    confirmation_sent_at timestamp with time zone,
+    recovery_token character varying(255),
+    recovery_sent_at timestamp with time zone,
+    email_change_token_new character varying(255),
+    email_change character varying(255),
+    email_change_sent_at timestamp with time zone,
+    last_sign_in_at timestamp with time zone,
+    raw_app_meta_data jsonb,
+    raw_user_meta_data jsonb,
+    is_super_admin boolean,
+    created_at timestamp with time zone,
+    updated_at timestamp with time zone,
+    phone text DEFAULT NULL::character varying,
+    phone_confirmed_at timestamp with time zone,
+    phone_change text DEFAULT ''::character varying,
+    phone_change_token character varying(255) DEFAULT ''::character varying,
+    phone_change_sent_at timestamp with time zone,
+    confirmed_at timestamp with time zone GENERATED ALWAYS AS (LEAST(email_confirmed_at, phone_confirmed_at)) STORED,
+    email_change_token_current character varying(255) DEFAULT ''::character varying,
+    email_change_confirm_status smallint DEFAULT 0,
+    banned_until timestamp with time zone,
+    reauthentication_token character varying(255) DEFAULT ''::character varying,
+    reauthentication_sent_at timestamp with time zone,
+    is_sso_user boolean DEFAULT false NOT NULL,
+    deleted_at timestamp with time zone,
+    CONSTRAINT users_email_change_confirm_status_check CHECK (((email_change_confirm_status >= 0) AND (email_change_confirm_status <= 2)))
+);
+
+
+ALTER TABLE auth.users OWNER TO supabase_auth_admin;
+
+--
+-- Name: TABLE users; Type: COMMENT; Schema: auth; Owner: supabase_auth_admin
+--
+
+COMMENT ON TABLE auth.users IS 'Auth: Stores user login data within a secure schema.';
+
+
+--
+-- Name: COLUMN users.is_sso_user; Type: COMMENT; Schema: auth; Owner: supabase_auth_admin
+--
+
+COMMENT ON COLUMN auth.users.is_sso_user IS 'Auth: Set this column to true when the account comes from SSO. These accounts can have duplicate emails.';
+
+
+--
+-- Name: buckets; Type: TABLE; Schema: storage; Owner: supabase_storage_admin
+--
+
+CREATE TABLE IF NOT EXISTS storage.buckets (
+    id text NOT NULL,
+    name text NOT NULL,
+    owner uuid,
+    created_at timestamp with time zone DEFAULT now(),
+    updated_at timestamp with time zone DEFAULT now(),
+    public boolean DEFAULT false,
+    avif_autodetection boolean DEFAULT false,
+    file_size_limit bigint,
+    allowed_mime_types text[],
+    owner_id text
+);
+
+
+ALTER TABLE storage.buckets OWNER TO supabase_storage_admin;
+
+--
+-- Name: COLUMN buckets.owner; Type: COMMENT; Schema: storage; Owner: supabase_storage_admin
+--
+
+COMMENT ON COLUMN storage.buckets.owner IS 'Field is deprecated, use owner_id instead';
+
+
+--
+-- Name: migrations; Type: TABLE; Schema: storage; Owner: supabase_storage_admin
+--
+
+CREATE TABLE IF NOT EXISTS storage.migrations (
+    id integer NOT NULL,
+    name character varying(100) NOT NULL,
+    hash character varying(40) NOT NULL,
+    executed_at timestamp without time zone DEFAULT CURRENT_TIMESTAMP
+);
+
+
+ALTER TABLE storage.migrations OWNER TO supabase_storage_admin;
+
+--
+-- Name: objects; Type: TABLE; Schema: storage; Owner: supabase_storage_admin
+--
+
+CREATE TABLE IF NOT EXISTS storage.objects (
+    id uuid DEFAULT extensions.uuid_generate_v4() NOT NULL,
+    bucket_id text,
+    name text,
+    owner uuid,
+    created_at timestamp with time zone DEFAULT now(),
+    updated_at timestamp with time zone DEFAULT now(),
+    last_accessed_at timestamp with time zone DEFAULT now(),
+    metadata jsonb,
+    path_tokens text[] GENERATED ALWAYS AS (string_to_array(name, '/'::text)) STORED,
+    version text,
+    owner_id text
+);
+
+
+ALTER TABLE storage.objects OWNER TO supabase_storage_admin;
+
+--
+-- Name: COLUMN objects.owner; Type: COMMENT; Schema: storage; Owner: supabase_storage_admin
+--
+
+COMMENT ON COLUMN storage.objects.owner IS 'Field is deprecated, use owner_id instead';
+
+
+--
+-- Name: refresh_tokens id; Type: DEFAULT; Schema: auth; Owner: supabase_auth_admin
+--
+
+ALTER TABLE ONLY auth.refresh_tokens ALTER COLUMN id SET DEFAULT nextval('auth.refresh_tokens_id_seq'::regclass);
+
+
+--
+-- Data for Name: extensions; Type: TABLE DATA; Schema: _realtime; Owner: postgres
+--
+
+INSERT INTO _realtime.extensions (id, type, settings, tenant_external_id, inserted_at, updated_at) VALUES ('5518e2da-548e-499c-ab1c-664fd6446714', 'postgres_cdc_rls', '{"region": "us-east-1", "db_host": "ABK7kBu27y/PVdL10i/b+A==", "db_name": "sWBpZNdjggEPTQVlI52Zfw==", "db_port": "+enMDFi1J/3IrrquHHwUmA==", "db_user": "uxbEq/zz8DXVD53TOI1zmw==", "slot_name": "supabase_realtime_replication_slot", "ip_version": 4, "db_password": "sWBpZNdjggEPTQVlI52Zfw==", "publication": "supabase_realtime", "ssl_enforced": false, "poll_interval_ms": 100, "poll_max_changes": 100, "poll_max_record_bytes": 1048576}', 'realtime-dev', '2023-12-12 15:25:21', '2023-12-12 15:25:21');
+
+
+--
+-- Data for Name: schema_migrations; Type: TABLE DATA; Schema: _realtime; Owner: postgres
+--
+
+INSERT INTO _realtime.schema_migrations (version, inserted_at) VALUES (20210706140551, '2023-01-09 07:15:13');
+INSERT INTO _realtime.schema_migrations (version, inserted_at) VALUES (20220329161857, '2023-01-09 07:15:13');
+INSERT INTO _realtime.schema_migrations (version, inserted_at) VALUES (20220410212326, '2023-01-09 07:15:13');
+INSERT INTO _realtime.schema_migrations (version, inserted_at) VALUES (20220506102948, '2023-01-09 07:15:13');
+INSERT INTO _realtime.schema_migrations (version, inserted_at) VALUES (20220527210857, '2023-01-09 07:15:13');
+INSERT INTO _realtime.schema_migrations (version, inserted_at) VALUES (20220815211129, '2023-01-09 07:15:13');
+INSERT INTO _realtime.schema_migrations (version, inserted_at) VALUES (20220815215024, '2023-01-09 07:15:13');
+INSERT INTO _realtime.schema_migrations (version, inserted_at) VALUES (20220818141501, '2023-01-09 07:15:13');
+INSERT INTO _realtime.schema_migrations (version, inserted_at) VALUES (20221018173709, '2023-01-09 07:15:13');
+INSERT INTO _realtime.schema_migrations (version, inserted_at) VALUES (20221102172703, '2023-01-09 07:15:13');
+INSERT INTO _realtime.schema_migrations (version, inserted_at) VALUES (20221223010058, '2023-01-09 07:15:13');
+INSERT INTO _realtime.schema_migrations (version, inserted_at) VALUES (20230110180046, '2023-04-06 09:25:28');
+INSERT INTO _realtime.schema_migrations (version, inserted_at) VALUES (20230810220907, '2023-12-12 15:25:19');
+INSERT INTO _realtime.schema_migrations (version, inserted_at) VALUES (20230810220924, '2023-12-12 15:25:19');
+INSERT INTO _realtime.schema_migrations (version, inserted_at) VALUES (20231024094642, '2023-12-12 15:25:19');
+
+
+--
+-- Data for Name: tenants; Type: TABLE DATA; Schema: _realtime; Owner: postgres
+--
+
+INSERT INTO _realtime.tenants (id, name, external_id, jwt_secret, max_concurrent_users, inserted_at, updated_at, max_events_per_second, postgres_cdc_default, max_bytes_per_second, max_channels_per_client, max_joins_per_second, suspend) VALUES ('e6edd492-6586-4c5d-9c2e-4e4de2e5c64d', 'realtime-dev', 'realtime-dev', 'iNjicxc4+llvc9wovDvqymwfnj9teWMlyOIbJ8Fh6j2WNU8CIJ2ZgjR6MUIKqSmeDmvpsKLsZ9jgXJmQPpwL8w==', 200, '2023-12-12 15:25:21', '2023-12-12 15:25:21', 100, 'postgres_cdc_rls', 100000, 100, 100, false);
+
+
+--
+-- Data for Name: audit_log_entries; Type: TABLE DATA; Schema: auth; Owner: supabase_auth_admin
+--
+
+
+
+--
+-- Data for Name: flow_state; Type: TABLE DATA; Schema: auth; Owner: supabase_auth_admin
+--
+
+
+
+--
+-- Data for Name: identities; Type: TABLE DATA; Schema: auth; Owner: supabase_auth_admin
+--
+
+
+
+--
+-- Data for Name: instances; Type: TABLE DATA; Schema: auth; Owner: supabase_auth_admin
+--
+
+
+
+--
+-- Data for Name: mfa_amr_claims; Type: TABLE DATA; Schema: auth; Owner: supabase_auth_admin
+--
+
+
+
+--
+-- Data for Name: mfa_challenges; Type: TABLE DATA; Schema: auth; Owner: supabase_auth_admin
+--
+
+
+
+--
+-- Data for Name: mfa_factors; Type: TABLE DATA; Schema: auth; Owner: supabase_auth_admin
+--
+
+
+
+--
+-- Data for Name: refresh_tokens; Type: TABLE DATA; Schema: auth; Owner: supabase_auth_admin
+--
+
+
+
+--
+-- Data for Name: saml_providers; Type: TABLE DATA; Schema: auth; Owner: supabase_auth_admin
+--
+
+
+
+--
+-- Data for Name: saml_relay_states; Type: TABLE DATA; Schema: auth; Owner: supabase_auth_admin
+--
+
+
+
+--
+-- Data for Name: schema_migrations; Type: TABLE DATA; Schema: auth; Owner: supabase_auth_admin
+--
+
+INSERT INTO auth.schema_migrations (version) VALUES ('20171026211738');
+INSERT INTO auth.schema_migrations (version) VALUES ('20171026211808');
+INSERT INTO auth.schema_migrations (version) VALUES ('20171026211834');
+INSERT INTO auth.schema_migrations (version) VALUES ('20180103212743');
+INSERT INTO auth.schema_migrations (version) VALUES ('20180108183307');
+INSERT INTO auth.schema_migrations (version) VALUES ('20180119214651');
+INSERT INTO auth.schema_migrations (version) VALUES ('20180125194653');
+INSERT INTO auth.schema_migrations (version) VALUES ('00');
+INSERT INTO auth.schema_migrations (version) VALUES ('20210710035447');
+INSERT INTO auth.schema_migrations (version) VALUES ('20210722035447');
+INSERT INTO auth.schema_migrations (version) VALUES ('20210730183235');
+INSERT INTO auth.schema_migrations (version) VALUES ('20210909172000');
+INSERT INTO auth.schema_migrations (version) VALUES ('20210927181326');
+INSERT INTO auth.schema_migrations (version) VALUES ('20211122151130');
+INSERT INTO auth.schema_migrations (version) VALUES ('20211124214934');
+INSERT INTO auth.schema_migrations (version) VALUES ('20211202183645');
+INSERT INTO auth.schema_migrations (version) VALUES ('20220114185221');
+INSERT INTO auth.schema_migrations (version) VALUES ('20220114185340');
+INSERT INTO auth.schema_migrations (version) VALUES ('20220224000811');
+INSERT INTO auth.schema_migrations (version) VALUES ('20220323170000');
+INSERT INTO auth.schema_migrations (version) VALUES ('20220429102000');
+INSERT INTO auth.schema_migrations (version) VALUES ('20220531120530');
+INSERT INTO auth.schema_migrations (version) VALUES ('20220614074223');
+INSERT INTO auth.schema_migrations (version) VALUES ('20220811173540');
+INSERT INTO auth.schema_migrations (version) VALUES ('20221003041349');
+INSERT INTO auth.schema_migrations (version) VALUES ('20221003041400');
+INSERT INTO auth.schema_migrations (version) VALUES ('20221011041400');
+INSERT INTO auth.schema_migrations (version) VALUES ('20221020193600');
+INSERT INTO auth.schema_migrations (version) VALUES ('20221021073300');
+INSERT INTO auth.schema_migrations (version) VALUES ('20221021082433');
+INSERT INTO auth.schema_migrations (version) VALUES ('20221027105023');
+INSERT INTO auth.schema_migrations (version) VALUES ('20221114143122');
+INSERT INTO auth.schema_migrations (version) VALUES ('20221114143410');
+INSERT INTO auth.schema_migrations (version) VALUES ('20221125140132');
+INSERT INTO auth.schema_migrations (version) VALUES ('20221208132122');
+INSERT INTO auth.schema_migrations (version) VALUES ('20221215195500');
+INSERT INTO auth.schema_migrations (version) VALUES ('20221215195800');
+INSERT INTO auth.schema_migrations (version) VALUES ('20221215195900');
+INSERT INTO auth.schema_migrations (version) VALUES ('20230116124310');
+INSERT INTO auth.schema_migrations (version) VALUES ('20230116124412');
+INSERT INTO auth.schema_migrations (version) VALUES ('20230131181311');
+INSERT INTO auth.schema_migrations (version) VALUES ('20230322519590');
+INSERT INTO auth.schema_migrations (version) VALUES ('20230402418590');
+INSERT INTO auth.schema_migrations (version) VALUES ('20230411005111');
+INSERT INTO auth.schema_migrations (version) VALUES ('20230508135423');
+INSERT INTO auth.schema_migrations (version) VALUES ('20230523124323');
+INSERT INTO auth.schema_migrations (version) VALUES ('20230818113222');
+INSERT INTO auth.schema_migrations (version) VALUES ('20230914180801');
+INSERT INTO auth.schema_migrations (version) VALUES ('20231027141322');
+INSERT INTO auth.schema_migrations (version) VALUES ('20231114161723');
+INSERT INTO auth.schema_migrations (version) VALUES ('20231117164230');
+
+
+--
+-- Data for Name: sessions; Type: TABLE DATA; Schema: auth; Owner: supabase_auth_admin
+--
+
+
+
+--
+-- Data for Name: sso_domains; Type: TABLE DATA; Schema: auth; Owner: supabase_auth_admin
+--
+
+
+
+--
+-- Data for Name: sso_providers; Type: TABLE DATA; Schema: auth; Owner: supabase_auth_admin
+--
+
+
+
+--
+-- Data for Name: users; Type: TABLE DATA; Schema: auth; Owner: supabase_auth_admin
+--
+
+
+
+--
+-- Data for Name: buckets; Type: TABLE DATA; Schema: storage; Owner: supabase_storage_admin
+--
+
+
+
+--
+-- Data for Name: migrations; Type: TABLE DATA; Schema: storage; Owner: supabase_storage_admin
+--
+
+INSERT INTO storage.migrations (id, name, hash, executed_at) VALUES (0, 'create-migrations-table', 'e18db593bcde2aca2a408c4d1100f6abba2195df', '2022-04-14 09:52:39.214681');
+INSERT INTO storage.migrations (id, name, hash, executed_at) VALUES (1, 'initialmigration', '6ab16121fbaa08bbd11b712d05f358f9b555d777', '2022-04-14 09:52:39.255149');
+INSERT INTO storage.migrations (id, name, hash, executed_at) VALUES (2, 'pathtoken-column', '49756be03be4c17bb85fe70d4a861f27de7e49ad', '2022-04-14 09:52:39.276667');
+INSERT INTO storage.migrations (id, name, hash, executed_at) VALUES (3, 'add-migrations-rls', 'bb5d124c53d68635a883e399426c6a5a25fc893d', '2022-04-14 09:52:39.587158');
+INSERT INTO storage.migrations (id, name, hash, executed_at) VALUES (4, 'add-size-functions', '6d79007d04f5acd288c9c250c42d2d5fd286c54d', '2022-04-14 09:52:39.621747');
+INSERT INTO storage.migrations (id, name, hash, executed_at) VALUES (5, 'change-column-name-in-get-size', 'fd65688505d2ffa9fbdc58a944348dd8604d688c', '2022-04-14 09:52:39.658796');
+INSERT INTO storage.migrations (id, name, hash, executed_at) VALUES (6, 'add-rls-to-buckets', '63e2bab75a2040fee8e3fb3f15a0d26f3380e9b6', '2022-04-14 09:52:39.702011');
+INSERT INTO storage.migrations (id, name, hash, executed_at) VALUES (7, 'add-public-to-buckets', '82568934f8a4d9e0a85f126f6fb483ad8214c418', '2022-04-14 09:52:39.739731');
+INSERT INTO storage.migrations (id, name, hash, executed_at) VALUES (8, 'fix-search-function', '1a43a40eddb525f2e2f26efd709e6c06e58e059c', '2022-04-14 09:52:39.781062');
+INSERT INTO storage.migrations (id, name, hash, executed_at) VALUES (9, 'search-files-search-function', '34c096597eb8b9d077fdfdde9878c88501b2fafc', '2022-08-23 04:48:07.728336');
+INSERT INTO storage.migrations (id, name, hash, executed_at) VALUES (10, 'add-trigger-to-auto-update-updated_at-column', '37d6bb964a70a822e6d37f22f457b9bca7885928', '2022-08-23 04:48:07.736527');
+INSERT INTO storage.migrations (id, name, hash, executed_at) VALUES (11, 'add-automatic-avif-detection-flag', 'bd76c53a9c564c80d98d119c1b3a28e16c8152db', '2023-04-06 09:25:29.356743');
+INSERT INTO storage.migrations (id, name, hash, executed_at) VALUES (12, 'add-bucket-custom-limits', 'cbe0a4c32a0e891554a21020433b7a4423c07ee7', '2023-04-06 09:25:29.390303');
+INSERT INTO storage.migrations (id, name, hash, executed_at) VALUES (13, 'use-bytes-for-max-size', '7a158ebce8a0c2801c9c65b7e9b2f98f68b3874e', '2023-04-06 09:25:29.402124');
+INSERT INTO storage.migrations (id, name, hash, executed_at) VALUES (14, 'add-can-insert-object-function', '273193826bca7e0990b458d1ba72f8aa27c0d825', '2023-04-06 09:25:29.426206');
+INSERT INTO storage.migrations (id, name, hash, executed_at) VALUES (15, 'add-version', 'e821a779d26612899b8c2dfe20245f904a327c4f', '2023-04-06 09:25:29.439561');
+INSERT INTO storage.migrations (id, name, hash, executed_at) VALUES (16, 'drop-owner-foreign-key', '536b33f8878eed09d0144219777dcac96bdb25da', '2023-12-12 15:25:21.258059');
+INSERT INTO storage.migrations (id, name, hash, executed_at) VALUES (17, 'add_owner_id_column_deprecate_owner', '7545f216a39358b5487df75d941d05dbcd75eb46', '2023-12-12 15:25:21.271667');
+
+
+--
+-- Data for Name: objects; Type: TABLE DATA; Schema: storage; Owner: supabase_storage_admin
+--
+
+
+
+--
+-- Name: refresh_tokens_id_seq; Type: SEQUENCE SET; Schema: auth; Owner: supabase_auth_admin
+--
+
+SELECT pg_catalog.setval('auth.refresh_tokens_id_seq', 1, false);
+
+
+--
+-- Name: extensions extensions_pkey; Type: CONSTRAINT; Schema: _realtime; Owner: postgres
+--
+
+ALTER TABLE ONLY _realtime.extensions
+    ADD CONSTRAINT extensions_pkey PRIMARY KEY (id);
+
+
+--
+-- Name: schema_migrations schema_migrations_pkey; Type: CONSTRAINT; Schema: _realtime; Owner: postgres
+--
+
+ALTER TABLE ONLY _realtime.schema_migrations
+    ADD CONSTRAINT schema_migrations_pkey PRIMARY KEY (version);
+
+
+--
+-- Name: tenants tenants_pkey; Type: CONSTRAINT; Schema: _realtime; Owner: postgres
+--
+
+ALTER TABLE ONLY _realtime.tenants
+    ADD CONSTRAINT tenants_pkey PRIMARY KEY (id);
+
+
+--
+-- Name: mfa_amr_claims amr_id_pk; Type: CONSTRAINT; Schema: auth; Owner: supabase_auth_admin
+--
+
+ALTER TABLE ONLY auth.mfa_amr_claims
+    ADD CONSTRAINT amr_id_pk PRIMARY KEY (id);
+
+
+--
+-- Name: audit_log_entries audit_log_entries_pkey; Type: CONSTRAINT; Schema: auth; Owner: supabase_auth_admin
+--
+
+ALTER TABLE ONLY auth.audit_log_entries
+    ADD CONSTRAINT audit_log_entries_pkey PRIMARY KEY (id);
+
+
+--
+-- Name: flow_state flow_state_pkey; Type: CONSTRAINT; Schema: auth; Owner: supabase_auth_admin
+--
+
+ALTER TABLE ONLY auth.flow_state
+    ADD CONSTRAINT flow_state_pkey PRIMARY KEY (id);
+
+
+--
+-- Name: identities identities_pkey; Type: CONSTRAINT; Schema: auth; Owner: supabase_auth_admin
+--
+
+ALTER TABLE ONLY auth.identities
+    ADD CONSTRAINT identities_pkey PRIMARY KEY (id);
+
+
+--
+-- Name: identities identities_provider_id_provider_unique; Type: CONSTRAINT; Schema: auth; Owner: supabase_auth_admin
+--
+
+ALTER TABLE ONLY auth.identities
+    ADD CONSTRAINT identities_provider_id_provider_unique UNIQUE (provider_id, provider);
+
+
+--
+-- Name: instances instances_pkey; Type: CONSTRAINT; Schema: auth; Owner: supabase_auth_admin
+--
+
+ALTER TABLE ONLY auth.instances
+    ADD CONSTRAINT instances_pkey PRIMARY KEY (id);
+
+
+--
+-- Name: mfa_amr_claims mfa_amr_claims_session_id_authentication_method_pkey; Type: CONSTRAINT; Schema: auth; Owner: supabase_auth_admin
+--
+
+ALTER TABLE ONLY auth.mfa_amr_claims
+    ADD CONSTRAINT mfa_amr_claims_session_id_authentication_method_pkey UNIQUE (session_id, authentication_method);
+
+
+--
+-- Name: mfa_challenges mfa_challenges_pkey; Type: CONSTRAINT; Schema: auth; Owner: supabase_auth_admin
+--
+
+ALTER TABLE ONLY auth.mfa_challenges
+    ADD CONSTRAINT mfa_challenges_pkey PRIMARY KEY (id);
+
+
+--
+-- Name: mfa_factors mfa_factors_pkey; Type: CONSTRAINT; Schema: auth; Owner: supabase_auth_admin
+--
+
+ALTER TABLE ONLY auth.mfa_factors
+    ADD CONSTRAINT mfa_factors_pkey PRIMARY KEY (id);
+
+
+--
+-- Name: refresh_tokens refresh_tokens_pkey; Type: CONSTRAINT; Schema: auth; Owner: supabase_auth_admin
+--
+
+ALTER TABLE ONLY auth.refresh_tokens
+    ADD CONSTRAINT refresh_tokens_pkey PRIMARY KEY (id);
+
+
+--
+-- Name: refresh_tokens refresh_tokens_token_unique; Type: CONSTRAINT; Schema: auth; Owner: supabase_auth_admin
+--
+
+ALTER TABLE ONLY auth.refresh_tokens
+    ADD CONSTRAINT refresh_tokens_token_unique UNIQUE (token);
+
+
+--
+-- Name: saml_providers saml_providers_entity_id_key; Type: CONSTRAINT; Schema: auth; Owner: supabase_auth_admin
+--
+
+ALTER TABLE ONLY auth.saml_providers
+    ADD CONSTRAINT saml_providers_entity_id_key UNIQUE (entity_id);
+
+
+--
+-- Name: saml_providers saml_providers_pkey; Type: CONSTRAINT; Schema: auth; Owner: supabase_auth_admin
+--
+
+ALTER TABLE ONLY auth.saml_providers
+    ADD CONSTRAINT saml_providers_pkey PRIMARY KEY (id);
+
+
+--
+-- Name: saml_relay_states saml_relay_states_pkey; Type: CONSTRAINT; Schema: auth; Owner: supabase_auth_admin
+--
+
+ALTER TABLE ONLY auth.saml_relay_states
+    ADD CONSTRAINT saml_relay_states_pkey PRIMARY KEY (id);
+
+
+--
+-- Name: schema_migrations schema_migrations_pkey; Type: CONSTRAINT; Schema: auth; Owner: supabase_auth_admin
+--
+
+ALTER TABLE ONLY auth.schema_migrations
+    ADD CONSTRAINT schema_migrations_pkey PRIMARY KEY (version);
+
+
+--
+-- Name: sessions sessions_pkey; Type: CONSTRAINT; Schema: auth; Owner: supabase_auth_admin
+--
+
+ALTER TABLE ONLY auth.sessions
+    ADD CONSTRAINT sessions_pkey PRIMARY KEY (id);
+
+
+--
+-- Name: sso_domains sso_domains_pkey; Type: CONSTRAINT; Schema: auth; Owner: supabase_auth_admin
+--
+
+ALTER TABLE ONLY auth.sso_domains
+    ADD CONSTRAINT sso_domains_pkey PRIMARY KEY (id);
+
+
+--
+-- Name: sso_providers sso_providers_pkey; Type: CONSTRAINT; Schema: auth; Owner: supabase_auth_admin
+--
+
+ALTER TABLE ONLY auth.sso_providers
+    ADD CONSTRAINT sso_providers_pkey PRIMARY KEY (id);
+
+
+--
+-- Name: users users_phone_key; Type: CONSTRAINT; Schema: auth; Owner: supabase_auth_admin
+--
+
+ALTER TABLE ONLY auth.users
+    ADD CONSTRAINT users_phone_key UNIQUE (phone);
+
+
+--
+-- Name: users users_pkey; Type: CONSTRAINT; Schema: auth; Owner: supabase_auth_admin
+--
+
+ALTER TABLE ONLY auth.users
+    ADD CONSTRAINT users_pkey PRIMARY KEY (id);
+
+
+--
+-- Name: buckets buckets_pkey; Type: CONSTRAINT; Schema: storage; Owner: supabase_storage_admin
+--
+
+ALTER TABLE ONLY storage.buckets
+    ADD CONSTRAINT buckets_pkey PRIMARY KEY (id);
+
+
+--
+-- Name: migrations migrations_name_key; Type: CONSTRAINT; Schema: storage; Owner: supabase_storage_admin
+--
+
+ALTER TABLE ONLY storage.migrations
+    ADD CONSTRAINT migrations_name_key UNIQUE (name);
+
+
+--
+-- Name: migrations migrations_pkey; Type: CONSTRAINT; Schema: storage; Owner: supabase_storage_admin
+--
+
+ALTER TABLE ONLY storage.migrations
+    ADD CONSTRAINT migrations_pkey PRIMARY KEY (id);
+
+
+--
+-- Name: objects objects_pkey; Type: CONSTRAINT; Schema: storage; Owner: supabase_storage_admin
+--
+
+ALTER TABLE ONLY storage.objects
+    ADD CONSTRAINT objects_pkey PRIMARY KEY (id);
+
+
+--
+-- Name: extensions_tenant_external_id_type_index; Type: INDEX; Schema: _realtime; Owner: postgres
+--
+
+CREATE UNIQUE INDEX extensions_tenant_external_id_type_index ON _realtime.extensions USING btree (tenant_external_id, type);
+
+
+--
+-- Name: tenants_external_id_index; Type: INDEX; Schema: _realtime; Owner: postgres
+--
+
+CREATE UNIQUE INDEX tenants_external_id_index ON _realtime.tenants USING btree (external_id);
+
+
+--
+-- Name: audit_logs_instance_id_idx; Type: INDEX; Schema: auth; Owner: supabase_auth_admin
+--
+
+CREATE INDEX audit_logs_instance_id_idx ON auth.audit_log_entries USING btree (instance_id);
+
+
+--
+-- Name: confirmation_token_idx; Type: INDEX; Schema: auth; Owner: supabase_auth_admin
+--
+
+CREATE UNIQUE INDEX confirmation_token_idx ON auth.users USING btree (confirmation_token) WHERE ((confirmation_token)::text !~ '^[0-9 ]*$'::text);
+
+
+--
+-- Name: email_change_token_current_idx; Type: INDEX; Schema: auth; Owner: supabase_auth_admin
+--
+
+CREATE UNIQUE INDEX email_change_token_current_idx ON auth.users USING btree (email_change_token_current) WHERE ((email_change_token_current)::text !~ '^[0-9 ]*$'::text);
+
+
+--
+-- Name: email_change_token_new_idx; Type: INDEX; Schema: auth; Owner: supabase_auth_admin
+--
+
+CREATE UNIQUE INDEX email_change_token_new_idx ON auth.users USING btree (email_change_token_new) WHERE ((email_change_token_new)::text !~ '^[0-9 ]*$'::text);
+
+
+--
+-- Name: factor_id_created_at_idx; Type: INDEX; Schema: auth; Owner: supabase_auth_admin
+--
+
+CREATE INDEX factor_id_created_at_idx ON auth.mfa_factors USING btree (user_id, created_at);
+
+
+--
+-- Name: flow_state_created_at_idx; Type: INDEX; Schema: auth; Owner: supabase_auth_admin
+--
+
+CREATE INDEX flow_state_created_at_idx ON auth.flow_state USING btree (created_at DESC);
+
+
+--
+-- Name: identities_email_idx; Type: INDEX; Schema: auth; Owner: supabase_auth_admin
+--
+
+CREATE INDEX identities_email_idx ON auth.identities USING btree (email text_pattern_ops);
+
+
+--
+-- Name: INDEX identities_email_idx; Type: COMMENT; Schema: auth; Owner: supabase_auth_admin
+--
+
+COMMENT ON INDEX auth.identities_email_idx IS 'Auth: Ensures indexed queries on the email column';
+
+
+--
+-- Name: identities_user_id_idx; Type: INDEX; Schema: auth; Owner: supabase_auth_admin
+--
+
+CREATE INDEX identities_user_id_idx ON auth.identities USING btree (user_id);
+
+
+--
+-- Name: idx_auth_code; Type: INDEX; Schema: auth; Owner: supabase_auth_admin
+--
+
+CREATE INDEX idx_auth_code ON auth.flow_state USING btree (auth_code);
+
+
+--
+-- Name: idx_user_id_auth_method; Type: INDEX; Schema: auth; Owner: supabase_auth_admin
+--
+
+CREATE INDEX idx_user_id_auth_method ON auth.flow_state USING btree (user_id, authentication_method);
+
+
+--
+-- Name: mfa_challenge_created_at_idx; Type: INDEX; Schema: auth; Owner: supabase_auth_admin
+--
+
+CREATE INDEX mfa_challenge_created_at_idx ON auth.mfa_challenges USING btree (created_at DESC);
+
+
+--
+-- Name: mfa_factors_user_friendly_name_unique; Type: INDEX; Schema: auth; Owner: supabase_auth_admin
+--
+
+CREATE UNIQUE INDEX mfa_factors_user_friendly_name_unique ON auth.mfa_factors USING btree (friendly_name, user_id) WHERE (btrim(friendly_name) <> ''::text);
+
+
+--
+-- Name: mfa_factors_user_id_idx; Type: INDEX; Schema: auth; Owner: supabase_auth_admin
+--
+
+CREATE INDEX mfa_factors_user_id_idx ON auth.mfa_factors USING btree (user_id);
+
+
+--
+-- Name: reauthentication_token_idx; Type: INDEX; Schema: auth; Owner: supabase_auth_admin
+--
+
+CREATE UNIQUE INDEX reauthentication_token_idx ON auth.users USING btree (reauthentication_token) WHERE ((reauthentication_token)::text !~ '^[0-9 ]*$'::text);
+
+
+--
+-- Name: recovery_token_idx; Type: INDEX; Schema: auth; Owner: supabase_auth_admin
+--
+
+CREATE UNIQUE INDEX recovery_token_idx ON auth.users USING btree (recovery_token) WHERE ((recovery_token)::text !~ '^[0-9 ]*$'::text);
+
+
+--
+-- Name: refresh_tokens_instance_id_idx; Type: INDEX; Schema: auth; Owner: supabase_auth_admin
+--
+
+CREATE INDEX refresh_tokens_instance_id_idx ON auth.refresh_tokens USING btree (instance_id);
+
+
+--
+-- Name: refresh_tokens_instance_id_user_id_idx; Type: INDEX; Schema: auth; Owner: supabase_auth_admin
+--
+
+CREATE INDEX refresh_tokens_instance_id_user_id_idx ON auth.refresh_tokens USING btree (instance_id, user_id);
+
+
+--
+-- Name: refresh_tokens_parent_idx; Type: INDEX; Schema: auth; Owner: supabase_auth_admin
+--
+
+CREATE INDEX refresh_tokens_parent_idx ON auth.refresh_tokens USING btree (parent);
+
+
+--
+-- Name: refresh_tokens_session_id_revoked_idx; Type: INDEX; Schema: auth; Owner: supabase_auth_admin
+--
+
+CREATE INDEX refresh_tokens_session_id_revoked_idx ON auth.refresh_tokens USING btree (session_id, revoked);
+
+
+--
+-- Name: refresh_tokens_updated_at_idx; Type: INDEX; Schema: auth; Owner: supabase_auth_admin
+--
+
+CREATE INDEX refresh_tokens_updated_at_idx ON auth.refresh_tokens USING btree (updated_at DESC);
+
+
+--
+-- Name: saml_providers_sso_provider_id_idx; Type: INDEX; Schema: auth; Owner: supabase_auth_admin
+--
+
+CREATE INDEX saml_providers_sso_provider_id_idx ON auth.saml_providers USING btree (sso_provider_id);
+
+
+--
+-- Name: saml_relay_states_created_at_idx; Type: INDEX; Schema: auth; Owner: supabase_auth_admin
+--
+
+CREATE INDEX saml_relay_states_created_at_idx ON auth.saml_relay_states USING btree (created_at DESC);
+
+
+--
+-- Name: saml_relay_states_for_email_idx; Type: INDEX; Schema: auth; Owner: supabase_auth_admin
+--
+
+CREATE INDEX saml_relay_states_for_email_idx ON auth.saml_relay_states USING btree (for_email);
+
+
+--
+-- Name: saml_relay_states_sso_provider_id_idx; Type: INDEX; Schema: auth; Owner: supabase_auth_admin
+--
+
+CREATE INDEX saml_relay_states_sso_provider_id_idx ON auth.saml_relay_states USING btree (sso_provider_id);
+
+
+--
+-- Name: sessions_not_after_idx; Type: INDEX; Schema: auth; Owner: supabase_auth_admin
+--
+
+CREATE INDEX sessions_not_after_idx ON auth.sessions USING btree (not_after DESC);
+
+
+--
+-- Name: sessions_user_id_idx; Type: INDEX; Schema: auth; Owner: supabase_auth_admin
+--
+
+CREATE INDEX sessions_user_id_idx ON auth.sessions USING btree (user_id);
+
+
+--
+-- Name: sso_domains_domain_idx; Type: INDEX; Schema: auth; Owner: supabase_auth_admin
+--
+
+CREATE UNIQUE INDEX sso_domains_domain_idx ON auth.sso_domains USING btree (lower(domain));
+
+
+--
+-- Name: sso_domains_sso_provider_id_idx; Type: INDEX; Schema: auth; Owner: supabase_auth_admin
+--
+
+CREATE INDEX sso_domains_sso_provider_id_idx ON auth.sso_domains USING btree (sso_provider_id);
+
+
+--
+-- Name: sso_providers_resource_id_idx; Type: INDEX; Schema: auth; Owner: supabase_auth_admin
+--
+
+CREATE UNIQUE INDEX sso_providers_resource_id_idx ON auth.sso_providers USING btree (lower(resource_id));
+
+
+--
+-- Name: user_id_created_at_idx; Type: INDEX; Schema: auth; Owner: supabase_auth_admin
+--
+
+CREATE INDEX user_id_created_at_idx ON auth.sessions USING btree (user_id, created_at);
+
+
+--
+-- Name: users_email_partial_key; Type: INDEX; Schema: auth; Owner: supabase_auth_admin
+--
+
+CREATE UNIQUE INDEX users_email_partial_key ON auth.users USING btree (email) WHERE (is_sso_user = false);
+
+
+--
+-- Name: INDEX users_email_partial_key; Type: COMMENT; Schema: auth; Owner: supabase_auth_admin
+--
+
+COMMENT ON INDEX auth.users_email_partial_key IS 'Auth: A partial unique index that applies only when is_sso_user is false';
+
+
+--
+-- Name: users_instance_id_email_idx; Type: INDEX; Schema: auth; Owner: supabase_auth_admin
+--
+
+CREATE INDEX users_instance_id_email_idx ON auth.users USING btree (instance_id, lower((email)::text));
+
+
+--
+-- Name: users_instance_id_idx; Type: INDEX; Schema: auth; Owner: supabase_auth_admin
+--
+
+CREATE INDEX users_instance_id_idx ON auth.users USING btree (instance_id);
+
+
+--
+-- Name: bname; Type: INDEX; Schema: storage; Owner: supabase_storage_admin
+--
+
+CREATE UNIQUE INDEX bname ON storage.buckets USING btree (name);
+
+
+--
+-- Name: bucketid_objname; Type: INDEX; Schema: storage; Owner: supabase_storage_admin
+--
+
+CREATE UNIQUE INDEX bucketid_objname ON storage.objects USING btree (bucket_id, name);
+
+
+--
+-- Name: name_prefix_search; Type: INDEX; Schema: storage; Owner: supabase_storage_admin
+--
+
+CREATE INDEX name_prefix_search ON storage.objects USING btree (name text_pattern_ops);
+
+
+--
+-- Name: objects update_objects_updated_at; Type: TRIGGER; Schema: storage; Owner: supabase_storage_admin
+--
+
+CREATE TRIGGER update_objects_updated_at BEFORE UPDATE ON storage.objects FOR EACH ROW EXECUTE FUNCTION storage.update_updated_at_column();
+
+
+--
+-- Name: extensions extensions_tenant_external_id_fkey; Type: FK CONSTRAINT; Schema: _realtime; Owner: postgres
+--
+
+ALTER TABLE ONLY _realtime.extensions
+    ADD CONSTRAINT extensions_tenant_external_id_fkey FOREIGN KEY (tenant_external_id) REFERENCES _realtime.tenants(external_id) ON DELETE CASCADE;
+
+
+--
+-- Name: identities identities_user_id_fkey; Type: FK CONSTRAINT; Schema: auth; Owner: supabase_auth_admin
+--
+
+ALTER TABLE ONLY auth.identities
+    ADD CONSTRAINT identities_user_id_fkey FOREIGN KEY (user_id) REFERENCES auth.users(id) ON DELETE CASCADE;
+
+
+--
+-- Name: mfa_amr_claims mfa_amr_claims_session_id_fkey; Type: FK CONSTRAINT; Schema: auth; Owner: supabase_auth_admin
+--
+
+ALTER TABLE ONLY auth.mfa_amr_claims
+    ADD CONSTRAINT mfa_amr_claims_session_id_fkey FOREIGN KEY (session_id) REFERENCES auth.sessions(id) ON DELETE CASCADE;
+
+
+--
+-- Name: mfa_challenges mfa_challenges_auth_factor_id_fkey; Type: FK CONSTRAINT; Schema: auth; Owner: supabase_auth_admin
+--
+
+ALTER TABLE ONLY auth.mfa_challenges
+    ADD CONSTRAINT mfa_challenges_auth_factor_id_fkey FOREIGN KEY (factor_id) REFERENCES auth.mfa_factors(id) ON DELETE CASCADE;
+
+
+--
+-- Name: mfa_factors mfa_factors_user_id_fkey; Type: FK CONSTRAINT; Schema: auth; Owner: supabase_auth_admin
+--
+
+ALTER TABLE ONLY auth.mfa_factors
+    ADD CONSTRAINT mfa_factors_user_id_fkey FOREIGN KEY (user_id) REFERENCES auth.users(id) ON DELETE CASCADE;
+
+
+--
+-- Name: refresh_tokens refresh_tokens_session_id_fkey; Type: FK CONSTRAINT; Schema: auth; Owner: supabase_auth_admin
+--
+
+ALTER TABLE ONLY auth.refresh_tokens
+    ADD CONSTRAINT refresh_tokens_session_id_fkey FOREIGN KEY (session_id) REFERENCES auth.sessions(id) ON DELETE CASCADE;
+
+
+--
+-- Name: saml_providers saml_providers_sso_provider_id_fkey; Type: FK CONSTRAINT; Schema: auth; Owner: supabase_auth_admin
+--
+
+ALTER TABLE ONLY auth.saml_providers
+    ADD CONSTRAINT saml_providers_sso_provider_id_fkey FOREIGN KEY (sso_provider_id) REFERENCES auth.sso_providers(id) ON DELETE CASCADE;
+
+
+--
+-- Name: saml_relay_states saml_relay_states_flow_state_id_fkey; Type: FK CONSTRAINT; Schema: auth; Owner: supabase_auth_admin
+--
+
+ALTER TABLE ONLY auth.saml_relay_states
+    ADD CONSTRAINT saml_relay_states_flow_state_id_fkey FOREIGN KEY (flow_state_id) REFERENCES auth.flow_state(id) ON DELETE CASCADE;
+
+
+--
+-- Name: saml_relay_states saml_relay_states_sso_provider_id_fkey; Type: FK CONSTRAINT; Schema: auth; Owner: supabase_auth_admin
+--
+
+ALTER TABLE ONLY auth.saml_relay_states
+    ADD CONSTRAINT saml_relay_states_sso_provider_id_fkey FOREIGN KEY (sso_provider_id) REFERENCES auth.sso_providers(id) ON DELETE CASCADE;
+
+
+--
+-- Name: sessions sessions_user_id_fkey; Type: FK CONSTRAINT; Schema: auth; Owner: supabase_auth_admin
+--
+
+ALTER TABLE ONLY auth.sessions
+    ADD CONSTRAINT sessions_user_id_fkey FOREIGN KEY (user_id) REFERENCES auth.users(id) ON DELETE CASCADE;
+
+
+--
+-- Name: sso_domains sso_domains_sso_provider_id_fkey; Type: FK CONSTRAINT; Schema: auth; Owner: supabase_auth_admin
+--
+
+ALTER TABLE ONLY auth.sso_domains
+    ADD CONSTRAINT sso_domains_sso_provider_id_fkey FOREIGN KEY (sso_provider_id) REFERENCES auth.sso_providers(id) ON DELETE CASCADE;
+
+
+--
+-- Name: objects objects_bucketId_fkey; Type: FK CONSTRAINT; Schema: storage; Owner: supabase_storage_admin
+--
+
+ALTER TABLE ONLY storage.objects
+    ADD CONSTRAINT "objects_bucketId_fkey" FOREIGN KEY (bucket_id) REFERENCES storage.buckets(id);
+
+
+--
+-- Name: buckets; Type: ROW SECURITY; Schema: storage; Owner: supabase_storage_admin
+--
+
+ALTER TABLE storage.buckets ENABLE ROW LEVEL SECURITY;
+
+--
+-- Name: migrations; Type: ROW SECURITY; Schema: storage; Owner: supabase_storage_admin
+--
+
+ALTER TABLE storage.migrations ENABLE ROW LEVEL SECURITY;
+
+--
+-- Name: objects; Type: ROW SECURITY; Schema: storage; Owner: supabase_storage_admin
+--
+
+ALTER TABLE storage.objects ENABLE ROW LEVEL SECURITY;
+
+--
+-- Name: supabase_realtime; Type: PUBLICATION; Schema: -; Owner: postgres
+--
+
+CREATE PUBLICATION supabase_realtime WITH (publish = 'insert, update, delete, truncate');
+
+
+ALTER PUBLICATION supabase_realtime OWNER TO postgres;
+
+--
+-- Name: SCHEMA auth; Type: ACL; Schema: -; Owner: supabase_admin
+--
+
+GRANT USAGE ON SCHEMA auth TO anon;
+GRANT USAGE ON SCHEMA auth TO authenticated;
+GRANT USAGE ON SCHEMA auth TO service_role;
+GRANT ALL ON SCHEMA auth TO supabase_auth_admin;
+GRANT ALL ON SCHEMA auth TO dashboard_user;
+GRANT ALL ON SCHEMA auth TO postgres;
+
+
+--
+-- Name: SCHEMA extensions; Type: ACL; Schema: -; Owner: postgres
+--
+
+GRANT USAGE ON SCHEMA extensions TO anon;
+GRANT USAGE ON SCHEMA extensions TO authenticated;
+GRANT USAGE ON SCHEMA extensions TO service_role;
+GRANT ALL ON SCHEMA extensions TO dashboard_user;
+
+
+--
+-- Name: SCHEMA graphql_public; Type: ACL; Schema: -; Owner: supabase_admin
+--
+
+GRANT USAGE ON SCHEMA graphql_public TO postgres;
+GRANT USAGE ON SCHEMA graphql_public TO anon;
+GRANT USAGE ON SCHEMA graphql_public TO authenticated;
+GRANT USAGE ON SCHEMA graphql_public TO service_role;
+
+
+--
+-- Name: SCHEMA public; Type: ACL; Schema: -; Owner: postgres
+--
+
+REVOKE USAGE ON SCHEMA public FROM PUBLIC;
+GRANT ALL ON SCHEMA public TO PUBLIC;
+GRANT USAGE ON SCHEMA public TO anon;
+GRANT USAGE ON SCHEMA public TO authenticated;
+GRANT USAGE ON SCHEMA public TO service_role;
+
+
+--
+-- Name: SCHEMA realtime; Type: ACL; Schema: -; Owner: supabase_admin
+--
+
+GRANT USAGE ON SCHEMA realtime TO postgres;
+
+
+--
+-- Name: SCHEMA storage; Type: ACL; Schema: -; Owner: supabase_admin
+--
+
+GRANT ALL ON SCHEMA storage TO postgres;
+GRANT USAGE ON SCHEMA storage TO anon;
+GRANT USAGE ON SCHEMA storage TO authenticated;
+GRANT USAGE ON SCHEMA storage TO service_role;
+GRANT ALL ON SCHEMA storage TO supabase_storage_admin;
+GRANT ALL ON SCHEMA storage TO dashboard_user;
+
+
+--
+-- Name: FUNCTION email(); Type: ACL; Schema: auth; Owner: supabase_auth_admin
+--
+
+GRANT ALL ON FUNCTION auth.email() TO dashboard_user;
+
+
+--
+-- Name: FUNCTION jwt(); Type: ACL; Schema: auth; Owner: supabase_auth_admin
+--
+
+GRANT ALL ON FUNCTION auth.jwt() TO postgres;
+GRANT ALL ON FUNCTION auth.jwt() TO dashboard_user;
+
+
+--
+-- Name: FUNCTION role(); Type: ACL; Schema: auth; Owner: supabase_auth_admin
+--
+
+GRANT ALL ON FUNCTION auth.role() TO dashboard_user;
+
+
+--
+-- Name: FUNCTION uid(); Type: ACL; Schema: auth; Owner: supabase_auth_admin
+--
+
+GRANT ALL ON FUNCTION auth.uid() TO dashboard_user;
+
+
+--
+-- Name: FUNCTION algorithm_sign(signables text, secret text, algorithm text); Type: ACL; Schema: extensions; Owner: postgres
+--
+
+GRANT ALL ON FUNCTION extensions.algorithm_sign(signables text, secret text, algorithm text) TO dashboard_user;
+
+
+--
+-- Name: FUNCTION armor(bytea); Type: ACL; Schema: extensions; Owner: postgres
+--
+
+GRANT ALL ON FUNCTION extensions.armor(bytea) TO dashboard_user;
+
+
+--
+-- Name: FUNCTION armor(bytea, text[], text[]); Type: ACL; Schema: extensions; Owner: postgres
+--
+
+GRANT ALL ON FUNCTION extensions.armor(bytea, text[], text[]) TO dashboard_user;
+
+
+--
+-- Name: FUNCTION crypt(text, text); Type: ACL; Schema: extensions; Owner: postgres
+--
+
+GRANT ALL ON FUNCTION extensions.crypt(text, text) TO dashboard_user;
+
+
+--
+-- Name: FUNCTION dearmor(text); Type: ACL; Schema: extensions; Owner: postgres
+--
+
+GRANT ALL ON FUNCTION extensions.dearmor(text) TO dashboard_user;
+
+
+--
+-- Name: FUNCTION decrypt(bytea, bytea, text); Type: ACL; Schema: extensions; Owner: postgres
+--
+
+GRANT ALL ON FUNCTION extensions.decrypt(bytea, bytea, text) TO dashboard_user;
+
+
+--
+-- Name: FUNCTION decrypt_iv(bytea, bytea, bytea, text); Type: ACL; Schema: extensions; Owner: postgres
+--
+
+GRANT ALL ON FUNCTION extensions.decrypt_iv(bytea, bytea, bytea, text) TO dashboard_user;
+
+
+--
+-- Name: FUNCTION digest(bytea, text); Type: ACL; Schema: extensions; Owner: postgres
+--
+
+GRANT ALL ON FUNCTION extensions.digest(bytea, text) TO dashboard_user;
+
+
+--
+-- Name: FUNCTION digest(text, text); Type: ACL; Schema: extensions; Owner: postgres
+--
+
+GRANT ALL ON FUNCTION extensions.digest(text, text) TO dashboard_user;
+
+
+--
+-- Name: FUNCTION encrypt(bytea, bytea, text); Type: ACL; Schema: extensions; Owner: postgres
+--
+
+GRANT ALL ON FUNCTION extensions.encrypt(bytea, bytea, text) TO dashboard_user;
+
+
+--
+-- Name: FUNCTION encrypt_iv(bytea, bytea, bytea, text); Type: ACL; Schema: extensions; Owner: postgres
+--
+
+GRANT ALL ON FUNCTION extensions.encrypt_iv(bytea, bytea, bytea, text) TO dashboard_user;
+
+
+--
+-- Name: FUNCTION gen_random_bytes(integer); Type: ACL; Schema: extensions; Owner: postgres
+--
+
+GRANT ALL ON FUNCTION extensions.gen_random_bytes(integer) TO dashboard_user;
+
+
+--
+-- Name: FUNCTION gen_random_uuid(); Type: ACL; Schema: extensions; Owner: postgres
+--
+
+GRANT ALL ON FUNCTION extensions.gen_random_uuid() TO dashboard_user;
+
+
+--
+-- Name: FUNCTION gen_salt(text); Type: ACL; Schema: extensions; Owner: postgres
+--
+
+GRANT ALL ON FUNCTION extensions.gen_salt(text) TO dashboard_user;
+
+
+--
+-- Name: FUNCTION gen_salt(text, integer); Type: ACL; Schema: extensions; Owner: postgres
+--
+
+GRANT ALL ON FUNCTION extensions.gen_salt(text, integer) TO dashboard_user;
+
+
+--
+-- Name: FUNCTION grant_pg_cron_access(); Type: ACL; Schema: extensions; Owner: postgres
+--
+
+GRANT ALL ON FUNCTION extensions.grant_pg_cron_access() TO dashboard_user;
+
+
+--
+-- Name: FUNCTION grant_pg_net_access(); Type: ACL; Schema: extensions; Owner: postgres
+--
+
+GRANT ALL ON FUNCTION extensions.grant_pg_net_access() TO dashboard_user;
+
+
+--
+-- Name: FUNCTION hmac(bytea, bytea, text); Type: ACL; Schema: extensions; Owner: postgres
+--
+
+GRANT ALL ON FUNCTION extensions.hmac(bytea, bytea, text) TO dashboard_user;
+
+
+--
+-- Name: FUNCTION hmac(text, text, text); Type: ACL; Schema: extensions; Owner: postgres
+--
+
+GRANT ALL ON FUNCTION extensions.hmac(text, text, text) TO dashboard_user;
+
+
+--
+-- Name: FUNCTION pgp_armor_headers(text, OUT key text, OUT value text); Type: ACL; Schema: extensions; Owner: postgres
+--
+
+GRANT ALL ON FUNCTION extensions.pgp_armor_headers(text, OUT key text, OUT value text) TO dashboard_user;
+
+
+--
+-- Name: FUNCTION pgp_key_id(bytea); Type: ACL; Schema: extensions; Owner: postgres
+--
+
+GRANT ALL ON FUNCTION extensions.pgp_key_id(bytea) TO dashboard_user;
+
+
+--
+-- Name: FUNCTION pgp_pub_decrypt(bytea, bytea); Type: ACL; Schema: extensions; Owner: postgres
+--
+
+GRANT ALL ON FUNCTION extensions.pgp_pub_decrypt(bytea, bytea) TO dashboard_user;
+
+
+--
+-- Name: FUNCTION pgp_pub_decrypt(bytea, bytea, text); Type: ACL; Schema: extensions; Owner: postgres
+--
+
+GRANT ALL ON FUNCTION extensions.pgp_pub_decrypt(bytea, bytea, text) TO dashboard_user;
+
+
+--
+-- Name: FUNCTION pgp_pub_decrypt(bytea, bytea, text, text); Type: ACL; Schema: extensions; Owner: postgres
+--
+
+GRANT ALL ON FUNCTION extensions.pgp_pub_decrypt(bytea, bytea, text, text) TO dashboard_user;
+
+
+--
+-- Name: FUNCTION pgp_pub_decrypt_bytea(bytea, bytea); Type: ACL; Schema: extensions; Owner: postgres
+--
+
+GRANT ALL ON FUNCTION extensions.pgp_pub_decrypt_bytea(bytea, bytea) TO dashboard_user;
+
+
+--
+-- Name: FUNCTION pgp_pub_decrypt_bytea(bytea, bytea, text); Type: ACL; Schema: extensions; Owner: postgres
+--
+
+GRANT ALL ON FUNCTION extensions.pgp_pub_decrypt_bytea(bytea, bytea, text) TO dashboard_user;
+
+
+--
+-- Name: FUNCTION pgp_pub_decrypt_bytea(bytea, bytea, text, text); Type: ACL; Schema: extensions; Owner: postgres
+--
+
+GRANT ALL ON FUNCTION extensions.pgp_pub_decrypt_bytea(bytea, bytea, text, text) TO dashboard_user;
+
+
+--
+-- Name: FUNCTION pgp_pub_encrypt(text, bytea); Type: ACL; Schema: extensions; Owner: postgres
+--
+
+GRANT ALL ON FUNCTION extensions.pgp_pub_encrypt(text, bytea) TO dashboard_user;
+
+
+--
+-- Name: FUNCTION pgp_pub_encrypt(text, bytea, text); Type: ACL; Schema: extensions; Owner: postgres
+--
+
+GRANT ALL ON FUNCTION extensions.pgp_pub_encrypt(text, bytea, text) TO dashboard_user;
+
+
+--
+-- Name: FUNCTION pgp_pub_encrypt_bytea(bytea, bytea); Type: ACL; Schema: extensions; Owner: postgres
+--
+
+GRANT ALL ON FUNCTION extensions.pgp_pub_encrypt_bytea(bytea, bytea) TO dashboard_user;
+
+
+--
+-- Name: FUNCTION pgp_pub_encrypt_bytea(bytea, bytea, text); Type: ACL; Schema: extensions; Owner: postgres
+--
+
+GRANT ALL ON FUNCTION extensions.pgp_pub_encrypt_bytea(bytea, bytea, text) TO dashboard_user;
+
+
+--
+-- Name: FUNCTION pgp_sym_decrypt(bytea, text); Type: ACL; Schema: extensions; Owner: postgres
+--
+
+GRANT ALL ON FUNCTION extensions.pgp_sym_decrypt(bytea, text) TO dashboard_user;
+
+
+--
+-- Name: FUNCTION pgp_sym_decrypt(bytea, text, text); Type: ACL; Schema: extensions; Owner: postgres
+--
+
+GRANT ALL ON FUNCTION extensions.pgp_sym_decrypt(bytea, text, text) TO dashboard_user;
+
+
+--
+-- Name: FUNCTION pgp_sym_decrypt_bytea(bytea, text); Type: ACL; Schema: extensions; Owner: postgres
+--
+
+GRANT ALL ON FUNCTION extensions.pgp_sym_decrypt_bytea(bytea, text) TO dashboard_user;
+
+
+--
+-- Name: FUNCTION pgp_sym_decrypt_bytea(bytea, text, text); Type: ACL; Schema: extensions; Owner: postgres
+--
+
+GRANT ALL ON FUNCTION extensions.pgp_sym_decrypt_bytea(bytea, text, text) TO dashboard_user;
+
+
+--
+-- Name: FUNCTION pgp_sym_encrypt(text, text); Type: ACL; Schema: extensions; Owner: postgres
+--
+
+GRANT ALL ON FUNCTION extensions.pgp_sym_encrypt(text, text) TO dashboard_user;
+
+
+--
+-- Name: FUNCTION pgp_sym_encrypt(text, text, text); Type: ACL; Schema: extensions; Owner: postgres
+--
+
+GRANT ALL ON FUNCTION extensions.pgp_sym_encrypt(text, text, text) TO dashboard_user;
+
+
+--
+-- Name: FUNCTION pgp_sym_encrypt_bytea(bytea, text); Type: ACL; Schema: extensions; Owner: postgres
+--
+
+GRANT ALL ON FUNCTION extensions.pgp_sym_encrypt_bytea(bytea, text) TO dashboard_user;
+
+
+--
+-- Name: FUNCTION pgp_sym_encrypt_bytea(bytea, text, text); Type: ACL; Schema: extensions; Owner: postgres
+--
+
+GRANT ALL ON FUNCTION extensions.pgp_sym_encrypt_bytea(bytea, text, text) TO dashboard_user;
+
+
+--
+-- Name: FUNCTION sign(payload json, secret text, algorithm text); Type: ACL; Schema: extensions; Owner: postgres
+--
+
+GRANT ALL ON FUNCTION extensions.sign(payload json, secret text, algorithm text) TO dashboard_user;
+
+
+--
+-- Name: FUNCTION url_decode(data text); Type: ACL; Schema: extensions; Owner: postgres
+--
+
+GRANT ALL ON FUNCTION extensions.url_decode(data text) TO dashboard_user;
+
+
+--
+-- Name: FUNCTION url_encode(data bytea); Type: ACL; Schema: extensions; Owner: postgres
+--
+
+GRANT ALL ON FUNCTION extensions.url_encode(data bytea) TO dashboard_user;
+
+
+--
+-- Name: FUNCTION uuid_generate_v1(); Type: ACL; Schema: extensions; Owner: postgres
+--
+
+GRANT ALL ON FUNCTION extensions.uuid_generate_v1() TO dashboard_user;
+
+
+--
+-- Name: FUNCTION uuid_generate_v1mc(); Type: ACL; Schema: extensions; Owner: postgres
+--
+
+GRANT ALL ON FUNCTION extensions.uuid_generate_v1mc() TO dashboard_user;
+
+
+--
+-- Name: FUNCTION uuid_generate_v3(namespace uuid, name text); Type: ACL; Schema: extensions; Owner: postgres
+--
+
+GRANT ALL ON FUNCTION extensions.uuid_generate_v3(namespace uuid, name text) TO dashboard_user;
+
+
+--
+-- Name: FUNCTION uuid_generate_v4(); Type: ACL; Schema: extensions; Owner: postgres
+--
+
+GRANT ALL ON FUNCTION extensions.uuid_generate_v4() TO dashboard_user;
+
+
+--
+-- Name: FUNCTION uuid_generate_v5(namespace uuid, name text); Type: ACL; Schema: extensions; Owner: postgres
+--
+
+GRANT ALL ON FUNCTION extensions.uuid_generate_v5(namespace uuid, name text) TO dashboard_user;
+
+
+--
+-- Name: FUNCTION uuid_nil(); Type: ACL; Schema: extensions; Owner: postgres
+--
+
+GRANT ALL ON FUNCTION extensions.uuid_nil() TO dashboard_user;
+
+
+--
+-- Name: FUNCTION uuid_ns_dns(); Type: ACL; Schema: extensions; Owner: postgres
+--
+
+GRANT ALL ON FUNCTION extensions.uuid_ns_dns() TO dashboard_user;
+
+
+--
+-- Name: FUNCTION uuid_ns_oid(); Type: ACL; Schema: extensions; Owner: postgres
+--
+
+GRANT ALL ON FUNCTION extensions.uuid_ns_oid() TO dashboard_user;
+
+
+--
+-- Name: FUNCTION uuid_ns_url(); Type: ACL; Schema: extensions; Owner: postgres
+--
+
+GRANT ALL ON FUNCTION extensions.uuid_ns_url() TO dashboard_user;
+
+
+--
+-- Name: FUNCTION uuid_ns_x500(); Type: ACL; Schema: extensions; Owner: postgres
+--
+
+GRANT ALL ON FUNCTION extensions.uuid_ns_x500() TO dashboard_user;
+
+
+--
+-- Name: FUNCTION verify(token text, secret text, algorithm text); Type: ACL; Schema: extensions; Owner: postgres
+--
+
+GRANT ALL ON FUNCTION extensions.verify(token text, secret text, algorithm text) TO dashboard_user;
+
+
+--
+-- Name: FUNCTION extension(name text); Type: ACL; Schema: storage; Owner: supabase_storage_admin
+--
+
+GRANT ALL ON FUNCTION storage.extension(name text) TO anon;
+GRANT ALL ON FUNCTION storage.extension(name text) TO authenticated;
+GRANT ALL ON FUNCTION storage.extension(name text) TO service_role;
+GRANT ALL ON FUNCTION storage.extension(name text) TO dashboard_user;
+GRANT ALL ON FUNCTION storage.extension(name text) TO postgres;
+
+
+--
+-- Name: FUNCTION filename(name text); Type: ACL; Schema: storage; Owner: supabase_storage_admin
+--
+
+GRANT ALL ON FUNCTION storage.filename(name text) TO anon;
+GRANT ALL ON FUNCTION storage.filename(name text) TO authenticated;
+GRANT ALL ON FUNCTION storage.filename(name text) TO service_role;
+GRANT ALL ON FUNCTION storage.filename(name text) TO dashboard_user;
+GRANT ALL ON FUNCTION storage.filename(name text) TO postgres;
+
+
+--
+-- Name: FUNCTION foldername(name text); Type: ACL; Schema: storage; Owner: supabase_storage_admin
+--
+
+GRANT ALL ON FUNCTION storage.foldername(name text) TO anon;
+GRANT ALL ON FUNCTION storage.foldername(name text) TO authenticated;
+GRANT ALL ON FUNCTION storage.foldername(name text) TO service_role;
+GRANT ALL ON FUNCTION storage.foldername(name text) TO dashboard_user;
+GRANT ALL ON FUNCTION storage.foldername(name text) TO postgres;
+
+
+--
+-- Name: TABLE audit_log_entries; Type: ACL; Schema: auth; Owner: supabase_auth_admin
+--
+
+GRANT ALL ON TABLE auth.audit_log_entries TO dashboard_user;
+GRANT ALL ON TABLE auth.audit_log_entries TO postgres;
+
+
+--
+-- Name: TABLE flow_state; Type: ACL; Schema: auth; Owner: supabase_auth_admin
+--
+
+GRANT ALL ON TABLE auth.flow_state TO postgres;
+GRANT ALL ON TABLE auth.flow_state TO dashboard_user;
+
+
+--
+-- Name: TABLE identities; Type: ACL; Schema: auth; Owner: supabase_auth_admin
+--
+
+GRANT ALL ON TABLE auth.identities TO postgres;
+GRANT ALL ON TABLE auth.identities TO dashboard_user;
+
+
+--
+-- Name: TABLE instances; Type: ACL; Schema: auth; Owner: supabase_auth_admin
+--
+
+GRANT ALL ON TABLE auth.instances TO dashboard_user;
+GRANT ALL ON TABLE auth.instances TO postgres;
+
+
+--
+-- Name: TABLE mfa_amr_claims; Type: ACL; Schema: auth; Owner: supabase_auth_admin
+--
+
+GRANT ALL ON TABLE auth.mfa_amr_claims TO postgres;
+GRANT ALL ON TABLE auth.mfa_amr_claims TO dashboard_user;
+
+
+--
+-- Name: TABLE mfa_challenges; Type: ACL; Schema: auth; Owner: supabase_auth_admin
+--
+
+GRANT ALL ON TABLE auth.mfa_challenges TO postgres;
+GRANT ALL ON TABLE auth.mfa_challenges TO dashboard_user;
+
+
+--
+-- Name: TABLE mfa_factors; Type: ACL; Schema: auth; Owner: supabase_auth_admin
+--
+
+GRANT ALL ON TABLE auth.mfa_factors TO postgres;
+GRANT ALL ON TABLE auth.mfa_factors TO dashboard_user;
+
+
+--
+-- Name: TABLE refresh_tokens; Type: ACL; Schema: auth; Owner: supabase_auth_admin
+--
+
+GRANT ALL ON TABLE auth.refresh_tokens TO dashboard_user;
+GRANT ALL ON TABLE auth.refresh_tokens TO postgres;
+
+
+--
+-- Name: SEQUENCE refresh_tokens_id_seq; Type: ACL; Schema: auth; Owner: supabase_auth_admin
+--
+
+GRANT ALL ON SEQUENCE auth.refresh_tokens_id_seq TO dashboard_user;
+GRANT ALL ON SEQUENCE auth.refresh_tokens_id_seq TO postgres;
+
+
+--
+-- Name: TABLE saml_providers; Type: ACL; Schema: auth; Owner: supabase_auth_admin
+--
+
+GRANT ALL ON TABLE auth.saml_providers TO postgres;
+GRANT ALL ON TABLE auth.saml_providers TO dashboard_user;
+
+
+--
+-- Name: TABLE saml_relay_states; Type: ACL; Schema: auth; Owner: supabase_auth_admin
+--
+
+GRANT ALL ON TABLE auth.saml_relay_states TO postgres;
+GRANT ALL ON TABLE auth.saml_relay_states TO dashboard_user;
+
+
+--
+-- Name: TABLE schema_migrations; Type: ACL; Schema: auth; Owner: supabase_auth_admin
+--
+
+GRANT ALL ON TABLE auth.schema_migrations TO dashboard_user;
+GRANT ALL ON TABLE auth.schema_migrations TO postgres;
+
+
+--
+-- Name: TABLE sessions; Type: ACL; Schema: auth; Owner: supabase_auth_admin
+--
+
+GRANT ALL ON TABLE auth.sessions TO postgres;
+GRANT ALL ON TABLE auth.sessions TO dashboard_user;
+
+
+--
+-- Name: TABLE sso_domains; Type: ACL; Schema: auth; Owner: supabase_auth_admin
+--
+
+GRANT ALL ON TABLE auth.sso_domains TO postgres;
+GRANT ALL ON TABLE auth.sso_domains TO dashboard_user;
+
+
+--
+-- Name: TABLE sso_providers; Type: ACL; Schema: auth; Owner: supabase_auth_admin
+--
+
+GRANT ALL ON TABLE auth.sso_providers TO postgres;
+GRANT ALL ON TABLE auth.sso_providers TO dashboard_user;
+
+
+--
+-- Name: TABLE users; Type: ACL; Schema: auth; Owner: supabase_auth_admin
+--
+
+GRANT ALL ON TABLE auth.users TO dashboard_user;
+GRANT ALL ON TABLE auth.users TO postgres;
+
+
+--
+-- Name: TABLE buckets; Type: ACL; Schema: storage; Owner: supabase_storage_admin
+--
+
+GRANT ALL ON TABLE storage.buckets TO anon;
+GRANT ALL ON TABLE storage.buckets TO authenticated;
+GRANT ALL ON TABLE storage.buckets TO service_role;
+GRANT ALL ON TABLE storage.buckets TO postgres;
+
+
+--
+-- Name: TABLE migrations; Type: ACL; Schema: storage; Owner: supabase_storage_admin
+--
+
+GRANT ALL ON TABLE storage.migrations TO anon;
+GRANT ALL ON TABLE storage.migrations TO authenticated;
+GRANT ALL ON TABLE storage.migrations TO service_role;
+GRANT ALL ON TABLE storage.migrations TO postgres;
+
+
+--
+-- Name: TABLE objects; Type: ACL; Schema: storage; Owner: supabase_storage_admin
+--
+
+GRANT ALL ON TABLE storage.objects TO anon;
+GRANT ALL ON TABLE storage.objects TO authenticated;
+GRANT ALL ON TABLE storage.objects TO service_role;
+GRANT ALL ON TABLE storage.objects TO postgres;
+
+
+--
+-- Name: DEFAULT PRIVILEGES FOR SEQUENCES; Type: DEFAULT ACL; Schema: auth; Owner: supabase_auth_admin
+--
+
+ALTER DEFAULT PRIVILEGES FOR ROLE supabase_auth_admin IN SCHEMA auth GRANT ALL ON SEQUENCES  TO postgres;
+ALTER DEFAULT PRIVILEGES FOR ROLE supabase_auth_admin IN SCHEMA auth GRANT ALL ON SEQUENCES  TO dashboard_user;
+
+
+--
+-- Name: DEFAULT PRIVILEGES FOR FUNCTIONS; Type: DEFAULT ACL; Schema: auth; Owner: supabase_auth_admin
+--
+
+ALTER DEFAULT PRIVILEGES FOR ROLE supabase_auth_admin IN SCHEMA auth GRANT ALL ON FUNCTIONS  TO postgres;
+ALTER DEFAULT PRIVILEGES FOR ROLE supabase_auth_admin IN SCHEMA auth GRANT ALL ON FUNCTIONS  TO dashboard_user;
+
+
+--
+-- Name: DEFAULT PRIVILEGES FOR TABLES; Type: DEFAULT ACL; Schema: auth; Owner: supabase_auth_admin
+--
+
+ALTER DEFAULT PRIVILEGES FOR ROLE supabase_auth_admin IN SCHEMA auth GRANT ALL ON TABLES  TO postgres;
+ALTER DEFAULT PRIVILEGES FOR ROLE supabase_auth_admin IN SCHEMA auth GRANT ALL ON TABLES  TO dashboard_user;
+
+
+--
+-- Name: DEFAULT PRIVILEGES FOR SEQUENCES; Type: DEFAULT ACL; Schema: graphql_public; Owner: supabase_admin
+--
+
+ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA graphql_public GRANT ALL ON SEQUENCES  TO postgres;
+ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA graphql_public GRANT ALL ON SEQUENCES  TO anon;
+ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA graphql_public GRANT ALL ON SEQUENCES  TO authenticated;
+ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA graphql_public GRANT ALL ON SEQUENCES  TO service_role;
+
+
+--
+-- Name: DEFAULT PRIVILEGES FOR FUNCTIONS; Type: DEFAULT ACL; Schema: graphql_public; Owner: supabase_admin
+--
+
+ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA graphql_public GRANT ALL ON FUNCTIONS  TO postgres;
+ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA graphql_public GRANT ALL ON FUNCTIONS  TO anon;
+ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA graphql_public GRANT ALL ON FUNCTIONS  TO authenticated;
+ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA graphql_public GRANT ALL ON FUNCTIONS  TO service_role;
+
+
+--
+-- Name: DEFAULT PRIVILEGES FOR TABLES; Type: DEFAULT ACL; Schema: graphql_public; Owner: supabase_admin
+--
+
+ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA graphql_public GRANT ALL ON TABLES  TO postgres;
+ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA graphql_public GRANT ALL ON TABLES  TO anon;
+ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA graphql_public GRANT ALL ON TABLES  TO authenticated;
+ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA graphql_public GRANT ALL ON TABLES  TO service_role;
+
+
+--
+-- Name: DEFAULT PRIVILEGES FOR SEQUENCES; Type: DEFAULT ACL; Schema: public; Owner: postgres
+--
+
+ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON SEQUENCES  TO postgres;
+ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON SEQUENCES  TO anon;
+ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON SEQUENCES  TO authenticated;
+ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON SEQUENCES  TO service_role;
+
+
+--
+-- Name: DEFAULT PRIVILEGES FOR SEQUENCES; Type: DEFAULT ACL; Schema: public; Owner: supabase_admin
+--
+
+ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON SEQUENCES  TO postgres;
+ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON SEQUENCES  TO anon;
+ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON SEQUENCES  TO authenticated;
+ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON SEQUENCES  TO service_role;
+
+
+--
+-- Name: DEFAULT PRIVILEGES FOR FUNCTIONS; Type: DEFAULT ACL; Schema: public; Owner: postgres
+--
+
+ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON FUNCTIONS  TO postgres;
+ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON FUNCTIONS  TO anon;
+ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON FUNCTIONS  TO authenticated;
+ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON FUNCTIONS  TO service_role;
+
+
+--
+-- Name: DEFAULT PRIVILEGES FOR FUNCTIONS; Type: DEFAULT ACL; Schema: public; Owner: supabase_admin
+--
+
+ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON FUNCTIONS  TO postgres;
+ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON FUNCTIONS  TO anon;
+ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON FUNCTIONS  TO authenticated;
+ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON FUNCTIONS  TO service_role;
+
+
+--
+-- Name: DEFAULT PRIVILEGES FOR TABLES; Type: DEFAULT ACL; Schema: public; Owner: postgres
+--
+
+ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON TABLES  TO postgres;
+ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON TABLES  TO anon;
+ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON TABLES  TO authenticated;
+ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON TABLES  TO service_role;
+
+
+--
+-- Name: DEFAULT PRIVILEGES FOR TABLES; Type: DEFAULT ACL; Schema: public; Owner: supabase_admin
+--
+
+ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON TABLES  TO postgres;
+ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON TABLES  TO anon;
+ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON TABLES  TO authenticated;
+ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON TABLES  TO service_role;
+
+
+--
+-- Name: DEFAULT PRIVILEGES FOR SEQUENCES; Type: DEFAULT ACL; Schema: realtime; Owner: supabase_admin
+--
+
+ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA realtime GRANT ALL ON SEQUENCES  TO postgres;
+ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA realtime GRANT ALL ON SEQUENCES  TO dashboard_user;
+
+
+--
+-- Name: DEFAULT PRIVILEGES FOR FUNCTIONS; Type: DEFAULT ACL; Schema: realtime; Owner: supabase_admin
+--
+
+ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA realtime GRANT ALL ON FUNCTIONS  TO postgres;
+ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA realtime GRANT ALL ON FUNCTIONS  TO dashboard_user;
+
+
+--
+-- Name: DEFAULT PRIVILEGES FOR TABLES; Type: DEFAULT ACL; Schema: realtime; Owner: supabase_admin
+--
+
+ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA realtime GRANT ALL ON TABLES  TO postgres;
+ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA realtime GRANT ALL ON TABLES  TO dashboard_user;
+
+
+--
+-- Name: DEFAULT PRIVILEGES FOR SEQUENCES; Type: DEFAULT ACL; Schema: storage; Owner: postgres
+--
+
+ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA storage GRANT ALL ON SEQUENCES  TO postgres;
+ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA storage GRANT ALL ON SEQUENCES  TO anon;
+ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA storage GRANT ALL ON SEQUENCES  TO authenticated;
+ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA storage GRANT ALL ON SEQUENCES  TO service_role;
+
+
+--
+-- Name: DEFAULT PRIVILEGES FOR FUNCTIONS; Type: DEFAULT ACL; Schema: storage; Owner: postgres
+--
+
+ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA storage GRANT ALL ON FUNCTIONS  TO postgres;
+ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA storage GRANT ALL ON FUNCTIONS  TO anon;
+ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA storage GRANT ALL ON FUNCTIONS  TO authenticated;
+ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA storage GRANT ALL ON FUNCTIONS  TO service_role;
+
+
+--
+-- Name: DEFAULT PRIVILEGES FOR TABLES; Type: DEFAULT ACL; Schema: storage; Owner: postgres
+--
+
+ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA storage GRANT ALL ON TABLES  TO postgres;
+ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA storage GRANT ALL ON TABLES  TO anon;
+ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA storage GRANT ALL ON TABLES  TO authenticated;
+ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA storage GRANT ALL ON TABLES  TO service_role;
+
+
+--
+-- Name: issue_graphql_placeholder; Type: EVENT TRIGGER; Schema: -; Owner: supabase_admin
+--
+
+CREATE EVENT TRIGGER issue_graphql_placeholder ON sql_drop
+         WHEN TAG IN ('DROP EXTENSION')
+   EXECUTE FUNCTION extensions.set_graphql_placeholder();
+
+
+ALTER EVENT TRIGGER issue_graphql_placeholder OWNER TO supabase_admin;
+
+--
+-- Name: issue_pg_cron_access; Type: EVENT TRIGGER; Schema: -; Owner: supabase_admin
+--
+
+CREATE EVENT TRIGGER issue_pg_cron_access ON ddl_command_end
+         WHEN TAG IN ('CREATE SCHEMA')
+   EXECUTE FUNCTION extensions.grant_pg_cron_access();
+
+
+ALTER EVENT TRIGGER issue_pg_cron_access OWNER TO supabase_admin;
+
+--
+-- Name: issue_pg_graphql_access; Type: EVENT TRIGGER; Schema: -; Owner: supabase_admin
+--
+
+CREATE EVENT TRIGGER issue_pg_graphql_access ON ddl_command_end
+         WHEN TAG IN ('CREATE FUNCTION')
+   EXECUTE FUNCTION extensions.grant_pg_graphql_access();
+
+
+ALTER EVENT TRIGGER issue_pg_graphql_access OWNER TO supabase_admin;
+
+--
+-- Name: issue_pg_net_access; Type: EVENT TRIGGER; Schema: -; Owner: supabase_admin
+--
+
+CREATE EVENT TRIGGER issue_pg_net_access ON ddl_command_end
+         WHEN TAG IN ('CREATE EXTENSION')
+   EXECUTE FUNCTION extensions.grant_pg_net_access();
+
+
+ALTER EVENT TRIGGER issue_pg_net_access OWNER TO supabase_admin;
+
+--
+-- Name: pgrst_ddl_watch; Type: EVENT TRIGGER; Schema: -; Owner: supabase_admin
+--
+
+CREATE EVENT TRIGGER pgrst_ddl_watch ON ddl_command_end
+   EXECUTE FUNCTION extensions.pgrst_ddl_watch();
+
+
+ALTER EVENT TRIGGER pgrst_ddl_watch OWNER TO supabase_admin;
+
+--
+-- Name: pgrst_drop_watch; Type: EVENT TRIGGER; Schema: -; Owner: supabase_admin
+--
+
+CREATE EVENT TRIGGER pgrst_drop_watch ON sql_drop
+   EXECUTE FUNCTION extensions.pgrst_drop_watch();
+
+
+ALTER EVENT TRIGGER pgrst_drop_watch OWNER TO supabase_admin;
+
+--
+-- PostgreSQL database dump complete
+--
+
+RESET ALL;
+`;
diff --git a/apps/cli/src/legacy/commands/start/templates/db-initial-schema-14.sql.ts b/apps/cli/src/legacy/commands/start/templates/db-initial-schema-14.sql.ts
new file mode 100644
index 0000000000..8199aaad59
--- /dev/null
+++ b/apps/cli/src/legacy/commands/start/templates/db-initial-schema-14.sql.ts
@@ -0,0 +1,3700 @@
+/**
+ * Transcribed verbatim from `apps/cli-go/internal/utils/templates/initial_schemas/14.sql`
+ * (Go `//go:embed templates/initial_schemas/14.sql`, `apps/cli-go/internal/utils/config.go:53-54`,
+ * exported as `utils.InitialSchemaPg14Sql`). Run via `ExecBatch` against a fresh
+ * PG14 (`db.major_version != 13`, `<= 14`) local database by `InitSchema14`
+ * (`apps/cli-go/internal/db/start/start.go:256-266`), right after
+ * {@link LEGACY_START_DB_GLOBALS_SQL}. Not a Go `text/template`. Do not hand-edit —
+ * re-transcribe from the Go source if it changes.
+ */
+export const LEGACY_START_DB_INITIAL_SCHEMA_14_SQL = `--
+-- PostgreSQL database dump
+--
+
+-- Dumped from database version 14.5 (Debian 14.5-2.pgdg110+2)
+-- Dumped by pg_dump version 15.3
+
+SET statement_timeout = 0;
+SET lock_timeout = 0;
+SET idle_in_transaction_session_timeout = 0;
+SET client_encoding = 'UTF8';
+SET standard_conforming_strings = on;
+SELECT pg_catalog.set_config('search_path', '', false);
+SET check_function_bodies = false;
+SET xmloption = content;
+SET client_min_messages = warning;
+SET row_security = off;
+
+--
+-- Name: _analytics; Type: SCHEMA; Schema: -; Owner: postgres
+--
+
+CREATE SCHEMA IF NOT EXISTS _analytics;
+
+
+ALTER SCHEMA _analytics OWNER TO postgres;
+
+--
+-- Name: _realtime; Type: SCHEMA; Schema: -; Owner: postgres
+--
+
+CREATE SCHEMA IF NOT EXISTS _realtime;
+
+
+ALTER SCHEMA _realtime OWNER TO postgres;
+
+--
+-- Name: auth; Type: SCHEMA; Schema: -; Owner: supabase_admin
+--
+
+CREATE SCHEMA IF NOT EXISTS auth;
+
+
+ALTER SCHEMA auth OWNER TO supabase_admin;
+
+--
+-- Name: extensions; Type: SCHEMA; Schema: -; Owner: postgres
+--
+
+CREATE SCHEMA IF NOT EXISTS extensions;
+
+
+ALTER SCHEMA extensions OWNER TO postgres;
+
+--
+-- Name: graphql; Type: SCHEMA; Schema: -; Owner: supabase_admin
+--
+
+CREATE SCHEMA IF NOT EXISTS graphql;
+
+
+ALTER SCHEMA graphql OWNER TO supabase_admin;
+
+--
+-- Name: graphql_public; Type: SCHEMA; Schema: -; Owner: supabase_admin
+--
+
+CREATE SCHEMA IF NOT EXISTS graphql_public;
+
+
+ALTER SCHEMA graphql_public OWNER TO supabase_admin;
+
+--
+-- Name: pg_net; Type: EXTENSION; Schema: -; Owner: -
+--
+
+CREATE EXTENSION IF NOT EXISTS pg_net WITH SCHEMA extensions;
+
+
+--
+-- Name: EXTENSION pg_net; Type: COMMENT; Schema: -; Owner: 
+--
+
+COMMENT ON EXTENSION pg_net IS 'Async HTTP';
+
+
+--
+-- Name: pgbouncer; Type: SCHEMA; Schema: -; Owner: pgbouncer
+--
+
+CREATE SCHEMA IF NOT EXISTS pgbouncer;
+
+
+ALTER SCHEMA pgbouncer OWNER TO pgbouncer;
+
+--
+-- Name: pgsodium; Type: SCHEMA; Schema: -; Owner: postgres
+--
+
+CREATE SCHEMA IF NOT EXISTS pgsodium;
+
+
+ALTER SCHEMA pgsodium OWNER TO postgres;
+
+--
+-- Name: pgsodium; Type: EXTENSION; Schema: -; Owner: -
+--
+
+CREATE EXTENSION IF NOT EXISTS pgsodium WITH SCHEMA pgsodium;
+
+
+--
+-- Name: EXTENSION pgsodium; Type: COMMENT; Schema: -; Owner: 
+--
+
+COMMENT ON EXTENSION pgsodium IS 'Pgsodium is a modern cryptography library for Postgres.';
+
+
+--
+-- Name: public; Type: SCHEMA; Schema: -; Owner: postgres
+--
+
+-- *not* creating schema, since initdb creates it
+
+
+ALTER SCHEMA public OWNER TO postgres;
+
+--
+-- Name: realtime; Type: SCHEMA; Schema: -; Owner: supabase_admin
+--
+
+CREATE SCHEMA IF NOT EXISTS realtime;
+
+
+ALTER SCHEMA realtime OWNER TO supabase_admin;
+
+--
+-- Name: storage; Type: SCHEMA; Schema: -; Owner: supabase_admin
+--
+
+CREATE SCHEMA IF NOT EXISTS storage;
+
+
+ALTER SCHEMA storage OWNER TO supabase_admin;
+
+--
+-- Name: supabase_functions; Type: SCHEMA; Schema: -; Owner: supabase_admin
+--
+
+CREATE SCHEMA IF NOT EXISTS supabase_functions;
+
+
+ALTER SCHEMA supabase_functions OWNER TO supabase_admin;
+
+--
+-- Name: pg_graphql; Type: EXTENSION; Schema: -; Owner: -
+--
+
+CREATE EXTENSION IF NOT EXISTS pg_graphql WITH SCHEMA graphql;
+
+
+--
+-- Name: EXTENSION pg_graphql; Type: COMMENT; Schema: -; Owner: 
+--
+
+COMMENT ON EXTENSION pg_graphql IS 'pg_graphql: GraphQL support';
+
+
+--
+-- Name: pg_stat_statements; Type: EXTENSION; Schema: -; Owner: -
+--
+
+CREATE EXTENSION IF NOT EXISTS pg_stat_statements WITH SCHEMA extensions;
+
+
+--
+-- Name: EXTENSION pg_stat_statements; Type: COMMENT; Schema: -; Owner: 
+--
+
+COMMENT ON EXTENSION pg_stat_statements IS 'track planning and execution statistics of all SQL statements executed';
+
+
+--
+-- Name: pgcrypto; Type: EXTENSION; Schema: -; Owner: -
+--
+
+CREATE EXTENSION IF NOT EXISTS pgcrypto WITH SCHEMA extensions;
+
+
+--
+-- Name: EXTENSION pgcrypto; Type: COMMENT; Schema: -; Owner: 
+--
+
+COMMENT ON EXTENSION pgcrypto IS 'cryptographic functions';
+
+
+--
+-- Name: pgjwt; Type: EXTENSION; Schema: -; Owner: -
+--
+
+CREATE EXTENSION IF NOT EXISTS pgjwt WITH SCHEMA extensions;
+
+
+--
+-- Name: EXTENSION pgjwt; Type: COMMENT; Schema: -; Owner: 
+--
+
+COMMENT ON EXTENSION pgjwt IS 'JSON Web Token API for Postgresql';
+
+
+--
+-- Name: uuid-ossp; Type: EXTENSION; Schema: -; Owner: -
+--
+
+CREATE EXTENSION IF NOT EXISTS "uuid-ossp" WITH SCHEMA extensions;
+
+
+--
+-- Name: EXTENSION "uuid-ossp"; Type: COMMENT; Schema: -; Owner: 
+--
+
+COMMENT ON EXTENSION "uuid-ossp" IS 'generate universally unique identifiers (UUIDs)';
+
+
+--
+-- Name: aal_level; Type: TYPE; Schema: auth; Owner: supabase_auth_admin
+--
+
+CREATE TYPE auth.aal_level AS ENUM (
+    'aal1',
+    'aal2',
+    'aal3'
+);
+
+
+ALTER TYPE auth.aal_level OWNER TO supabase_auth_admin;
+
+--
+-- Name: code_challenge_method; Type: TYPE; Schema: auth; Owner: supabase_auth_admin
+--
+
+CREATE TYPE auth.code_challenge_method AS ENUM (
+    's256',
+    'plain'
+);
+
+
+ALTER TYPE auth.code_challenge_method OWNER TO supabase_auth_admin;
+
+--
+-- Name: factor_status; Type: TYPE; Schema: auth; Owner: supabase_auth_admin
+--
+
+CREATE TYPE auth.factor_status AS ENUM (
+    'unverified',
+    'verified'
+);
+
+
+ALTER TYPE auth.factor_status OWNER TO supabase_auth_admin;
+
+--
+-- Name: factor_type; Type: TYPE; Schema: auth; Owner: supabase_auth_admin
+--
+
+CREATE TYPE auth.factor_type AS ENUM (
+    'totp',
+    'webauthn'
+);
+
+
+ALTER TYPE auth.factor_type OWNER TO supabase_auth_admin;
+
+--
+-- Name: email(); Type: FUNCTION; Schema: auth; Owner: supabase_auth_admin
+--
+
+CREATE OR REPLACE FUNCTION auth.email() RETURNS text
+    LANGUAGE sql STABLE
+    AS $$
+  select 
+  coalesce(
+    nullif(current_setting('request.jwt.claim.email', true), ''),
+    (nullif(current_setting('request.jwt.claims', true), '')::jsonb ->> 'email')
+  )::text
+$$;
+
+
+ALTER FUNCTION auth.email() OWNER TO supabase_auth_admin;
+
+--
+-- Name: FUNCTION email(); Type: COMMENT; Schema: auth; Owner: supabase_auth_admin
+--
+
+COMMENT ON FUNCTION auth.email() IS 'Deprecated. Use auth.jwt() -> ''email'' instead.';
+
+
+--
+-- Name: jwt(); Type: FUNCTION; Schema: auth; Owner: supabase_auth_admin
+--
+
+CREATE OR REPLACE FUNCTION auth.jwt() RETURNS jsonb
+    LANGUAGE sql STABLE
+    AS $$
+  select 
+    coalesce(
+        nullif(current_setting('request.jwt.claim', true), ''),
+        nullif(current_setting('request.jwt.claims', true), '')
+    )::jsonb
+$$;
+
+
+ALTER FUNCTION auth.jwt() OWNER TO supabase_auth_admin;
+
+--
+-- Name: role(); Type: FUNCTION; Schema: auth; Owner: supabase_auth_admin
+--
+
+CREATE OR REPLACE FUNCTION auth.role() RETURNS text
+    LANGUAGE sql STABLE
+    AS $$
+  select 
+  coalesce(
+    nullif(current_setting('request.jwt.claim.role', true), ''),
+    (nullif(current_setting('request.jwt.claims', true), '')::jsonb ->> 'role')
+  )::text
+$$;
+
+
+ALTER FUNCTION auth.role() OWNER TO supabase_auth_admin;
+
+--
+-- Name: FUNCTION role(); Type: COMMENT; Schema: auth; Owner: supabase_auth_admin
+--
+
+COMMENT ON FUNCTION auth.role() IS 'Deprecated. Use auth.jwt() -> ''role'' instead.';
+
+
+--
+-- Name: uid(); Type: FUNCTION; Schema: auth; Owner: supabase_auth_admin
+--
+
+CREATE OR REPLACE FUNCTION auth.uid() RETURNS uuid
+    LANGUAGE sql STABLE
+    AS $$
+  select 
+  coalesce(
+    nullif(current_setting('request.jwt.claim.sub', true), ''),
+    (nullif(current_setting('request.jwt.claims', true), '')::jsonb ->> 'sub')
+  )::uuid
+$$;
+
+
+ALTER FUNCTION auth.uid() OWNER TO supabase_auth_admin;
+
+--
+-- Name: FUNCTION uid(); Type: COMMENT; Schema: auth; Owner: supabase_auth_admin
+--
+
+COMMENT ON FUNCTION auth.uid() IS 'Deprecated. Use auth.jwt() -> ''sub'' instead.';
+
+
+--
+-- Name: grant_pg_cron_access(); Type: FUNCTION; Schema: extensions; Owner: postgres
+--
+
+CREATE OR REPLACE FUNCTION extensions.grant_pg_cron_access() RETURNS event_trigger
+    LANGUAGE plpgsql
+    AS $$
+DECLARE
+  schema_is_cron bool;
+BEGIN
+  schema_is_cron = (
+    SELECT n.nspname = 'cron'
+    FROM pg_event_trigger_ddl_commands() AS ev
+    LEFT JOIN pg_catalog.pg_namespace AS n
+      ON ev.objid = n.oid
+  );
+
+  IF schema_is_cron
+  THEN
+    grant usage on schema cron to postgres with grant option;
+
+    alter default privileges in schema cron grant all on tables to postgres with grant option;
+    alter default privileges in schema cron grant all on functions to postgres with grant option;
+    alter default privileges in schema cron grant all on sequences to postgres with grant option;
+
+    alter default privileges for user supabase_admin in schema cron grant all
+        on sequences to postgres with grant option;
+    alter default privileges for user supabase_admin in schema cron grant all
+        on tables to postgres with grant option;
+    alter default privileges for user supabase_admin in schema cron grant all
+        on functions to postgres with grant option;
+
+    grant all privileges on all tables in schema cron to postgres with grant option;
+
+  END IF;
+
+END;
+$$;
+
+
+ALTER FUNCTION extensions.grant_pg_cron_access() OWNER TO postgres;
+
+--
+-- Name: FUNCTION grant_pg_cron_access(); Type: COMMENT; Schema: extensions; Owner: postgres
+--
+
+COMMENT ON FUNCTION extensions.grant_pg_cron_access() IS 'Grants access to pg_cron';
+
+
+--
+-- Name: grant_pg_graphql_access(); Type: FUNCTION; Schema: extensions; Owner: supabase_admin
+--
+
+CREATE OR REPLACE FUNCTION extensions.grant_pg_graphql_access() RETURNS event_trigger
+    LANGUAGE plpgsql
+    AS $_$
+DECLARE
+    func_is_graphql_resolve bool;
+BEGIN
+    func_is_graphql_resolve = (
+        SELECT n.proname = 'resolve'
+        FROM pg_event_trigger_ddl_commands() AS ev
+        LEFT JOIN pg_catalog.pg_proc AS n
+        ON ev.objid = n.oid
+    );
+
+    IF func_is_graphql_resolve
+    THEN
+        -- Update public wrapper to pass all arguments through to the pg_graphql resolve func
+        DROP FUNCTION IF EXISTS graphql_public.graphql;
+        create or replace function graphql_public.graphql(
+            "operationName" text default null,
+            query text default null,
+            variables jsonb default null,
+            extensions jsonb default null
+        )
+            returns jsonb
+            language sql
+        as $$
+            select graphql.resolve(
+                query := query,
+                variables := coalesce(variables, '{}'),
+                "operationName" := "operationName",
+                extensions := extensions
+            );
+        $$;
+
+        -- This hook executes when \`graphql.resolve\` is created. That is not necessarily the last
+        -- function in the extension so we need to grant permissions on existing entities AND
+        -- update default permissions to any others that are created after \`graphql.resolve\`
+        grant usage on schema graphql to postgres, anon, authenticated, service_role;
+        grant select on all tables in schema graphql to postgres, anon, authenticated, service_role;
+        grant execute on all functions in schema graphql to postgres, anon, authenticated, service_role;
+        grant all on all sequences in schema graphql to postgres, anon, authenticated, service_role;
+        alter default privileges in schema graphql grant all on tables to postgres, anon, authenticated, service_role;
+        alter default privileges in schema graphql grant all on functions to postgres, anon, authenticated, service_role;
+        alter default privileges in schema graphql grant all on sequences to postgres, anon, authenticated, service_role;
+    END IF;
+
+END;
+$_$;
+
+
+ALTER FUNCTION extensions.grant_pg_graphql_access() OWNER TO supabase_admin;
+
+--
+-- Name: FUNCTION grant_pg_graphql_access(); Type: COMMENT; Schema: extensions; Owner: supabase_admin
+--
+
+COMMENT ON FUNCTION extensions.grant_pg_graphql_access() IS 'Grants access to pg_graphql';
+
+
+--
+-- Name: grant_pg_net_access(); Type: FUNCTION; Schema: extensions; Owner: postgres
+--
+
+CREATE OR REPLACE FUNCTION extensions.grant_pg_net_access() RETURNS event_trigger
+    LANGUAGE plpgsql
+    AS $$
+BEGIN
+  IF EXISTS (
+    SELECT 1
+    FROM pg_event_trigger_ddl_commands() AS ev
+    JOIN pg_extension AS ext
+    ON ev.objid = ext.oid
+    WHERE ext.extname = 'pg_net'
+  )
+  THEN
+    GRANT USAGE ON SCHEMA net TO supabase_functions_admin, postgres, anon, authenticated, service_role;
+
+    ALTER function net.http_get(url text, params jsonb, headers jsonb, timeout_milliseconds integer) SECURITY DEFINER;
+    ALTER function net.http_post(url text, body jsonb, params jsonb, headers jsonb, timeout_milliseconds integer) SECURITY DEFINER;
+
+    ALTER function net.http_get(url text, params jsonb, headers jsonb, timeout_milliseconds integer) SET search_path = net;
+    ALTER function net.http_post(url text, body jsonb, params jsonb, headers jsonb, timeout_milliseconds integer) SET search_path = net;
+
+    REVOKE ALL ON FUNCTION net.http_get(url text, params jsonb, headers jsonb, timeout_milliseconds integer) FROM PUBLIC;
+    REVOKE ALL ON FUNCTION net.http_post(url text, body jsonb, params jsonb, headers jsonb, timeout_milliseconds integer) FROM PUBLIC;
+
+    GRANT EXECUTE ON FUNCTION net.http_get(url text, params jsonb, headers jsonb, timeout_milliseconds integer) TO supabase_functions_admin, postgres, anon, authenticated, service_role;
+    GRANT EXECUTE ON FUNCTION net.http_post(url text, body jsonb, params jsonb, headers jsonb, timeout_milliseconds integer) TO supabase_functions_admin, postgres, anon, authenticated, service_role;
+  END IF;
+END;
+$$;
+
+
+ALTER FUNCTION extensions.grant_pg_net_access() OWNER TO postgres;
+
+--
+-- Name: FUNCTION grant_pg_net_access(); Type: COMMENT; Schema: extensions; Owner: postgres
+--
+
+COMMENT ON FUNCTION extensions.grant_pg_net_access() IS 'Grants access to pg_net';
+
+
+--
+-- Name: pgrst_ddl_watch(); Type: FUNCTION; Schema: extensions; Owner: supabase_admin
+--
+
+CREATE OR REPLACE FUNCTION extensions.pgrst_ddl_watch() RETURNS event_trigger
+    LANGUAGE plpgsql
+    AS $$
+DECLARE
+  cmd record;
+BEGIN
+  FOR cmd IN SELECT * FROM pg_event_trigger_ddl_commands()
+  LOOP
+    IF cmd.command_tag IN (
+      'CREATE SCHEMA', 'ALTER SCHEMA'
+    , 'CREATE TABLE', 'CREATE TABLE AS', 'SELECT INTO', 'ALTER TABLE'
+    , 'CREATE FOREIGN TABLE', 'ALTER FOREIGN TABLE'
+    , 'CREATE VIEW', 'ALTER VIEW'
+    , 'CREATE MATERIALIZED VIEW', 'ALTER MATERIALIZED VIEW'
+    , 'CREATE FUNCTION', 'ALTER FUNCTION'
+    , 'CREATE TRIGGER'
+    , 'CREATE TYPE', 'ALTER TYPE'
+    , 'CREATE RULE'
+    , 'COMMENT'
+    )
+    -- don't notify in case of CREATE TEMP table or other objects created on pg_temp
+    AND cmd.schema_name is distinct from 'pg_temp'
+    THEN
+      NOTIFY pgrst, 'reload schema';
+    END IF;
+  END LOOP;
+END; $$;
+
+
+ALTER FUNCTION extensions.pgrst_ddl_watch() OWNER TO supabase_admin;
+
+--
+-- Name: pgrst_drop_watch(); Type: FUNCTION; Schema: extensions; Owner: supabase_admin
+--
+
+CREATE OR REPLACE FUNCTION extensions.pgrst_drop_watch() RETURNS event_trigger
+    LANGUAGE plpgsql
+    AS $$
+DECLARE
+  obj record;
+BEGIN
+  FOR obj IN SELECT * FROM pg_event_trigger_dropped_objects()
+  LOOP
+    IF obj.object_type IN (
+      'schema'
+    , 'table'
+    , 'foreign table'
+    , 'view'
+    , 'materialized view'
+    , 'function'
+    , 'trigger'
+    , 'type'
+    , 'rule'
+    )
+    AND obj.is_temporary IS false -- no pg_temp objects
+    THEN
+      NOTIFY pgrst, 'reload schema';
+    END IF;
+  END LOOP;
+END; $$;
+
+
+ALTER FUNCTION extensions.pgrst_drop_watch() OWNER TO supabase_admin;
+
+--
+-- Name: set_graphql_placeholder(); Type: FUNCTION; Schema: extensions; Owner: supabase_admin
+--
+
+CREATE OR REPLACE FUNCTION extensions.set_graphql_placeholder() RETURNS event_trigger
+    LANGUAGE plpgsql
+    AS $_$
+    DECLARE
+    graphql_is_dropped bool;
+    BEGIN
+    graphql_is_dropped = (
+        SELECT ev.schema_name = 'graphql_public'
+        FROM pg_event_trigger_dropped_objects() AS ev
+        WHERE ev.schema_name = 'graphql_public'
+    );
+
+    IF graphql_is_dropped
+    THEN
+        create or replace function graphql_public.graphql(
+            "operationName" text default null,
+            query text default null,
+            variables jsonb default null,
+            extensions jsonb default null
+        )
+            returns jsonb
+            language plpgsql
+        as $$
+            DECLARE
+                server_version float;
+            BEGIN
+                server_version = (SELECT (SPLIT_PART((select version()), ' ', 2))::float);
+
+                IF server_version >= 14 THEN
+                    RETURN jsonb_build_object(
+                        'errors', jsonb_build_array(
+                            jsonb_build_object(
+                                'message', 'pg_graphql extension is not enabled.'
+                            )
+                        )
+                    );
+                ELSE
+                    RETURN jsonb_build_object(
+                        'errors', jsonb_build_array(
+                            jsonb_build_object(
+                                'message', 'pg_graphql is only available on projects running Postgres 14 onwards.'
+                            )
+                        )
+                    );
+                END IF;
+            END;
+        $$;
+    END IF;
+
+    END;
+$_$;
+
+
+ALTER FUNCTION extensions.set_graphql_placeholder() OWNER TO supabase_admin;
+
+--
+-- Name: FUNCTION set_graphql_placeholder(); Type: COMMENT; Schema: extensions; Owner: supabase_admin
+--
+
+COMMENT ON FUNCTION extensions.set_graphql_placeholder() IS 'Reintroduces placeholder function for graphql_public.graphql';
+
+
+--
+-- Name: get_auth(text); Type: FUNCTION; Schema: pgbouncer; Owner: postgres
+--
+
+CREATE OR REPLACE FUNCTION pgbouncer.get_auth(p_usename text) RETURNS TABLE(username text, password text)
+    LANGUAGE plpgsql SECURITY DEFINER
+    AS $$
+BEGIN
+    RAISE WARNING 'PgBouncer auth request: %', p_usename;
+
+    RETURN QUERY
+    SELECT usename::TEXT, passwd::TEXT FROM pg_catalog.pg_shadow
+    WHERE usename = p_usename;
+END;
+$$;
+
+
+ALTER FUNCTION pgbouncer.get_auth(p_usename text) OWNER TO postgres;
+
+--
+-- Name: can_insert_object(text, text, uuid, jsonb); Type: FUNCTION; Schema: storage; Owner: supabase_storage_admin
+--
+
+CREATE OR REPLACE FUNCTION storage.can_insert_object(bucketid text, name text, owner uuid, metadata jsonb) RETURNS void
+    LANGUAGE plpgsql
+    AS $$
+BEGIN
+  INSERT INTO "storage"."objects" ("bucket_id", "name", "owner", "metadata") VALUES (bucketid, name, owner, metadata);
+  -- hack to rollback the successful insert
+  RAISE sqlstate 'PT200' using
+  message = 'ROLLBACK',
+  detail = 'rollback successful insert';
+END
+$$;
+
+
+ALTER FUNCTION storage.can_insert_object(bucketid text, name text, owner uuid, metadata jsonb) OWNER TO supabase_storage_admin;
+
+--
+-- Name: extension(text); Type: FUNCTION; Schema: storage; Owner: supabase_storage_admin
+--
+
+CREATE OR REPLACE FUNCTION storage.extension(name text) RETURNS text
+    LANGUAGE plpgsql
+    AS $$
+DECLARE
+_parts text[];
+_filename text;
+BEGIN
+	select string_to_array(name, '/') into _parts;
+	select _parts[array_length(_parts,1)] into _filename;
+	-- @todo return the last part instead of 2
+	return split_part(_filename, '.', 2);
+END
+$$;
+
+
+ALTER FUNCTION storage.extension(name text) OWNER TO supabase_storage_admin;
+
+--
+-- Name: filename(text); Type: FUNCTION; Schema: storage; Owner: supabase_storage_admin
+--
+
+CREATE OR REPLACE FUNCTION storage.filename(name text) RETURNS text
+    LANGUAGE plpgsql
+    AS $$
+DECLARE
+_parts text[];
+BEGIN
+	select string_to_array(name, '/') into _parts;
+	return _parts[array_length(_parts,1)];
+END
+$$;
+
+
+ALTER FUNCTION storage.filename(name text) OWNER TO supabase_storage_admin;
+
+--
+-- Name: foldername(text); Type: FUNCTION; Schema: storage; Owner: supabase_storage_admin
+--
+
+CREATE OR REPLACE FUNCTION storage.foldername(name text) RETURNS text[]
+    LANGUAGE plpgsql
+    AS $$
+DECLARE
+_parts text[];
+BEGIN
+	select string_to_array(name, '/') into _parts;
+	return _parts[1:array_length(_parts,1)-1];
+END
+$$;
+
+
+ALTER FUNCTION storage.foldername(name text) OWNER TO supabase_storage_admin;
+
+--
+-- Name: get_size_by_bucket(); Type: FUNCTION; Schema: storage; Owner: supabase_storage_admin
+--
+
+CREATE OR REPLACE FUNCTION storage.get_size_by_bucket() RETURNS TABLE(size bigint, bucket_id text)
+    LANGUAGE plpgsql
+    AS $$
+BEGIN
+    return query
+        select sum((metadata->>'size')::int) as size, obj.bucket_id
+        from "storage".objects as obj
+        group by obj.bucket_id;
+END
+$$;
+
+
+ALTER FUNCTION storage.get_size_by_bucket() OWNER TO supabase_storage_admin;
+
+--
+-- Name: search(text, text, integer, integer, integer, text, text, text); Type: FUNCTION; Schema: storage; Owner: supabase_storage_admin
+--
+
+CREATE OR REPLACE FUNCTION storage.search(prefix text, bucketname text, limits integer DEFAULT 100, levels integer DEFAULT 1, offsets integer DEFAULT 0, search text DEFAULT ''::text, sortcolumn text DEFAULT 'name'::text, sortorder text DEFAULT 'asc'::text) RETURNS TABLE(name text, id uuid, updated_at timestamp with time zone, created_at timestamp with time zone, last_accessed_at timestamp with time zone, metadata jsonb)
+    LANGUAGE plpgsql STABLE
+    AS $_$
+declare
+  v_order_by text;
+  v_sort_order text;
+begin
+  case
+    when sortcolumn = 'name' then
+      v_order_by = 'name';
+    when sortcolumn = 'updated_at' then
+      v_order_by = 'updated_at';
+    when sortcolumn = 'created_at' then
+      v_order_by = 'created_at';
+    when sortcolumn = 'last_accessed_at' then
+      v_order_by = 'last_accessed_at';
+    else
+      v_order_by = 'name';
+  end case;
+
+  case
+    when sortorder = 'asc' then
+      v_sort_order = 'asc';
+    when sortorder = 'desc' then
+      v_sort_order = 'desc';
+    else
+      v_sort_order = 'asc';
+  end case;
+
+  v_order_by = v_order_by || ' ' || v_sort_order;
+
+  return query execute
+    'with folders as (
+       select path_tokens[$1] as folder
+       from storage.objects
+         where objects.name ilike $2 || $3 || ''%''
+           and bucket_id = $4
+           and array_length(regexp_split_to_array(objects.name, ''/''), 1) <> $1
+       group by folder
+       order by folder ' || v_sort_order || '
+     )
+     (select folder as "name",
+            null as id,
+            null as updated_at,
+            null as created_at,
+            null as last_accessed_at,
+            null as metadata from folders)
+     union all
+     (select path_tokens[$1] as "name",
+            id,
+            updated_at,
+            created_at,
+            last_accessed_at,
+            metadata
+     from storage.objects
+     where objects.name ilike $2 || $3 || ''%''
+       and bucket_id = $4
+       and array_length(regexp_split_to_array(objects.name, ''/''), 1) = $1
+     order by ' || v_order_by || ')
+     limit $5
+     offset $6' using levels, prefix, search, bucketname, limits, offsets;
+end;
+$_$;
+
+
+ALTER FUNCTION storage.search(prefix text, bucketname text, limits integer, levels integer, offsets integer, search text, sortcolumn text, sortorder text) OWNER TO supabase_storage_admin;
+
+--
+-- Name: update_updated_at_column(); Type: FUNCTION; Schema: storage; Owner: supabase_storage_admin
+--
+
+CREATE OR REPLACE FUNCTION storage.update_updated_at_column() RETURNS trigger
+    LANGUAGE plpgsql
+    AS $$
+BEGIN
+    NEW.updated_at = now();
+    RETURN NEW; 
+END;
+$$;
+
+
+ALTER FUNCTION storage.update_updated_at_column() OWNER TO supabase_storage_admin;
+
+--
+-- Name: http_request(); Type: FUNCTION; Schema: supabase_functions; Owner: supabase_functions_admin
+--
+
+CREATE OR REPLACE FUNCTION supabase_functions.http_request() RETURNS trigger
+    LANGUAGE plpgsql SECURITY DEFINER
+    SET search_path TO 'supabase_functions'
+    AS $$
+  DECLARE
+    request_id bigint;
+    payload jsonb;
+    url text := TG_ARGV[0]::text;
+    method text := TG_ARGV[1]::text;
+    headers jsonb DEFAULT '{}'::jsonb;
+    params jsonb DEFAULT '{}'::jsonb;
+    timeout_ms integer DEFAULT 1000;
+  BEGIN
+    IF url IS NULL OR url = 'null' THEN
+      RAISE EXCEPTION 'url argument is missing';
+    END IF;
+
+    IF method IS NULL OR method = 'null' THEN
+      RAISE EXCEPTION 'method argument is missing';
+    END IF;
+
+    IF TG_ARGV[2] IS NULL OR TG_ARGV[2] = 'null' THEN
+      headers = '{"Content-Type": "application/json"}'::jsonb;
+    ELSE
+      headers = TG_ARGV[2]::jsonb;
+    END IF;
+
+    IF TG_ARGV[3] IS NULL OR TG_ARGV[3] = 'null' THEN
+      params = '{}'::jsonb;
+    ELSE
+      params = TG_ARGV[3]::jsonb;
+    END IF;
+
+    IF TG_ARGV[4] IS NULL OR TG_ARGV[4] = 'null' THEN
+      timeout_ms = 1000;
+    ELSE
+      timeout_ms = TG_ARGV[4]::integer;
+    END IF;
+
+    CASE
+      WHEN method = 'GET' THEN
+        SELECT http_get INTO request_id FROM net.http_get(
+          url,
+          params,
+          headers,
+          timeout_ms
+        );
+      WHEN method = 'POST' THEN
+        payload = jsonb_build_object(
+          'old_record', OLD,
+          'record', NEW,
+          'type', TG_OP,
+          'table', TG_TABLE_NAME,
+          'schema', TG_TABLE_SCHEMA
+        );
+
+        SELECT http_post INTO request_id FROM net.http_post(
+          url,
+          payload,
+          params,
+          headers,
+          timeout_ms
+        );
+      ELSE
+        RAISE EXCEPTION 'method argument % is invalid', method;
+    END CASE;
+
+    INSERT INTO supabase_functions.hooks
+      (hook_table_id, hook_name, request_id)
+    VALUES
+      (TG_RELID, TG_NAME, request_id);
+
+    RETURN NEW;
+  END
+$$;
+
+
+ALTER FUNCTION supabase_functions.http_request() OWNER TO supabase_functions_admin;
+
+SET default_tablespace = '';
+
+SET default_table_access_method = heap;
+
+--
+-- Name: extensions; Type: TABLE; Schema: _realtime; Owner: postgres
+--
+
+CREATE TABLE IF NOT EXISTS _realtime.extensions (
+    id uuid NOT NULL,
+    type text,
+    settings jsonb,
+    tenant_external_id text,
+    inserted_at timestamp(0) without time zone NOT NULL,
+    updated_at timestamp(0) without time zone NOT NULL
+);
+
+
+ALTER TABLE _realtime.extensions OWNER TO postgres;
+
+--
+-- Name: schema_migrations; Type: TABLE; Schema: _realtime; Owner: postgres
+--
+
+CREATE TABLE IF NOT EXISTS _realtime.schema_migrations (
+    version bigint NOT NULL,
+    inserted_at timestamp(0) without time zone
+);
+
+
+ALTER TABLE _realtime.schema_migrations OWNER TO postgres;
+
+--
+-- Name: tenants; Type: TABLE; Schema: _realtime; Owner: postgres
+--
+
+CREATE TABLE IF NOT EXISTS _realtime.tenants (
+    id uuid NOT NULL,
+    name text,
+    external_id text,
+    jwt_secret text,
+    max_concurrent_users integer DEFAULT 200 NOT NULL,
+    inserted_at timestamp(0) without time zone NOT NULL,
+    updated_at timestamp(0) without time zone NOT NULL,
+    max_events_per_second integer DEFAULT 100 NOT NULL,
+    postgres_cdc_default text DEFAULT 'postgres_cdc_rls'::text,
+    max_bytes_per_second integer DEFAULT 100000 NOT NULL,
+    max_channels_per_client integer DEFAULT 100 NOT NULL,
+    max_joins_per_second integer DEFAULT 500 NOT NULL,
+    suspend boolean DEFAULT false
+);
+
+
+ALTER TABLE _realtime.tenants OWNER TO postgres;
+
+--
+-- Name: audit_log_entries; Type: TABLE; Schema: auth; Owner: supabase_auth_admin
+--
+
+CREATE TABLE IF NOT EXISTS auth.audit_log_entries (
+    instance_id uuid,
+    id uuid NOT NULL,
+    payload json,
+    created_at timestamp with time zone,
+    ip_address character varying(64) DEFAULT ''::character varying NOT NULL
+);
+
+
+ALTER TABLE auth.audit_log_entries OWNER TO supabase_auth_admin;
+
+--
+-- Name: TABLE audit_log_entries; Type: COMMENT; Schema: auth; Owner: supabase_auth_admin
+--
+
+COMMENT ON TABLE auth.audit_log_entries IS 'Auth: Audit trail for user actions.';
+
+
+--
+-- Name: flow_state; Type: TABLE; Schema: auth; Owner: supabase_auth_admin
+--
+
+CREATE TABLE IF NOT EXISTS auth.flow_state (
+    id uuid NOT NULL,
+    user_id uuid,
+    auth_code text NOT NULL,
+    code_challenge_method auth.code_challenge_method NOT NULL,
+    code_challenge text NOT NULL,
+    provider_type text NOT NULL,
+    provider_access_token text,
+    provider_refresh_token text,
+    created_at timestamp with time zone,
+    updated_at timestamp with time zone,
+    authentication_method text NOT NULL
+);
+
+
+ALTER TABLE auth.flow_state OWNER TO supabase_auth_admin;
+
+--
+-- Name: TABLE flow_state; Type: COMMENT; Schema: auth; Owner: supabase_auth_admin
+--
+
+COMMENT ON TABLE auth.flow_state IS 'stores metadata for pkce logins';
+
+
+--
+-- Name: identities; Type: TABLE; Schema: auth; Owner: supabase_auth_admin
+--
+
+CREATE TABLE IF NOT EXISTS auth.identities (
+    provider_id text NOT NULL,
+    user_id uuid NOT NULL,
+    identity_data jsonb NOT NULL,
+    provider text NOT NULL,
+    last_sign_in_at timestamp with time zone,
+    created_at timestamp with time zone,
+    updated_at timestamp with time zone,
+    email text GENERATED ALWAYS AS (lower((identity_data ->> 'email'::text))) STORED,
+    id uuid DEFAULT gen_random_uuid() NOT NULL
+);
+
+
+ALTER TABLE auth.identities OWNER TO supabase_auth_admin;
+
+--
+-- Name: TABLE identities; Type: COMMENT; Schema: auth; Owner: supabase_auth_admin
+--
+
+COMMENT ON TABLE auth.identities IS 'Auth: Stores identities associated to a user.';
+
+
+--
+-- Name: COLUMN identities.email; Type: COMMENT; Schema: auth; Owner: supabase_auth_admin
+--
+
+COMMENT ON COLUMN auth.identities.email IS 'Auth: Email is a generated column that references the optional email property in the identity_data';
+
+
+--
+-- Name: instances; Type: TABLE; Schema: auth; Owner: supabase_auth_admin
+--
+
+CREATE TABLE IF NOT EXISTS auth.instances (
+    id uuid NOT NULL,
+    uuid uuid,
+    raw_base_config text,
+    created_at timestamp with time zone,
+    updated_at timestamp with time zone
+);
+
+
+ALTER TABLE auth.instances OWNER TO supabase_auth_admin;
+
+--
+-- Name: TABLE instances; Type: COMMENT; Schema: auth; Owner: supabase_auth_admin
+--
+
+COMMENT ON TABLE auth.instances IS 'Auth: Manages users across multiple sites.';
+
+
+--
+-- Name: mfa_amr_claims; Type: TABLE; Schema: auth; Owner: supabase_auth_admin
+--
+
+CREATE TABLE IF NOT EXISTS auth.mfa_amr_claims (
+    session_id uuid NOT NULL,
+    created_at timestamp with time zone NOT NULL,
+    updated_at timestamp with time zone NOT NULL,
+    authentication_method text NOT NULL,
+    id uuid NOT NULL
+);
+
+
+ALTER TABLE auth.mfa_amr_claims OWNER TO supabase_auth_admin;
+
+--
+-- Name: TABLE mfa_amr_claims; Type: COMMENT; Schema: auth; Owner: supabase_auth_admin
+--
+
+COMMENT ON TABLE auth.mfa_amr_claims IS 'auth: stores authenticator method reference claims for multi factor authentication';
+
+
+--
+-- Name: mfa_challenges; Type: TABLE; Schema: auth; Owner: supabase_auth_admin
+--
+
+CREATE TABLE IF NOT EXISTS auth.mfa_challenges (
+    id uuid NOT NULL,
+    factor_id uuid NOT NULL,
+    created_at timestamp with time zone NOT NULL,
+    verified_at timestamp with time zone,
+    ip_address inet NOT NULL
+);
+
+
+ALTER TABLE auth.mfa_challenges OWNER TO supabase_auth_admin;
+
+--
+-- Name: TABLE mfa_challenges; Type: COMMENT; Schema: auth; Owner: supabase_auth_admin
+--
+
+COMMENT ON TABLE auth.mfa_challenges IS 'auth: stores metadata about challenge requests made';
+
+
+--
+-- Name: mfa_factors; Type: TABLE; Schema: auth; Owner: supabase_auth_admin
+--
+
+CREATE TABLE IF NOT EXISTS auth.mfa_factors (
+    id uuid NOT NULL,
+    user_id uuid NOT NULL,
+    friendly_name text,
+    factor_type auth.factor_type NOT NULL,
+    status auth.factor_status NOT NULL,
+    created_at timestamp with time zone NOT NULL,
+    updated_at timestamp with time zone NOT NULL,
+    secret text
+);
+
+
+ALTER TABLE auth.mfa_factors OWNER TO supabase_auth_admin;
+
+--
+-- Name: TABLE mfa_factors; Type: COMMENT; Schema: auth; Owner: supabase_auth_admin
+--
+
+COMMENT ON TABLE auth.mfa_factors IS 'auth: stores metadata about factors';
+
+
+--
+-- Name: refresh_tokens; Type: TABLE; Schema: auth; Owner: supabase_auth_admin
+--
+
+CREATE TABLE IF NOT EXISTS auth.refresh_tokens (
+    instance_id uuid,
+    id bigint NOT NULL,
+    token character varying(255),
+    user_id character varying(255),
+    revoked boolean,
+    created_at timestamp with time zone,
+    updated_at timestamp with time zone,
+    parent character varying(255),
+    session_id uuid
+);
+
+
+ALTER TABLE auth.refresh_tokens OWNER TO supabase_auth_admin;
+
+--
+-- Name: TABLE refresh_tokens; Type: COMMENT; Schema: auth; Owner: supabase_auth_admin
+--
+
+COMMENT ON TABLE auth.refresh_tokens IS 'Auth: Store of tokens used to refresh JWT tokens once they expire.';
+
+
+--
+-- Name: refresh_tokens_id_seq; Type: SEQUENCE; Schema: auth; Owner: supabase_auth_admin
+--
+
+CREATE SEQUENCE IF NOT EXISTS auth.refresh_tokens_id_seq
+    START WITH 1
+    INCREMENT BY 1
+    NO MINVALUE
+    NO MAXVALUE
+    CACHE 1;
+
+
+ALTER TABLE auth.refresh_tokens_id_seq OWNER TO supabase_auth_admin;
+
+--
+-- Name: refresh_tokens_id_seq; Type: SEQUENCE OWNED BY; Schema: auth; Owner: supabase_auth_admin
+--
+
+ALTER SEQUENCE auth.refresh_tokens_id_seq OWNED BY auth.refresh_tokens.id;
+
+
+--
+-- Name: saml_providers; Type: TABLE; Schema: auth; Owner: supabase_auth_admin
+--
+
+CREATE TABLE IF NOT EXISTS auth.saml_providers (
+    id uuid NOT NULL,
+    sso_provider_id uuid NOT NULL,
+    entity_id text NOT NULL,
+    metadata_xml text NOT NULL,
+    metadata_url text,
+    attribute_mapping jsonb,
+    created_at timestamp with time zone,
+    updated_at timestamp with time zone,
+    CONSTRAINT "entity_id not empty" CHECK ((char_length(entity_id) > 0)),
+    CONSTRAINT "metadata_url not empty" CHECK (((metadata_url = NULL::text) OR (char_length(metadata_url) > 0))),
+    CONSTRAINT "metadata_xml not empty" CHECK ((char_length(metadata_xml) > 0))
+);
+
+
+ALTER TABLE auth.saml_providers OWNER TO supabase_auth_admin;
+
+--
+-- Name: TABLE saml_providers; Type: COMMENT; Schema: auth; Owner: supabase_auth_admin
+--
+
+COMMENT ON TABLE auth.saml_providers IS 'Auth: Manages SAML Identity Provider connections.';
+
+
+--
+-- Name: saml_relay_states; Type: TABLE; Schema: auth; Owner: supabase_auth_admin
+--
+
+CREATE TABLE IF NOT EXISTS auth.saml_relay_states (
+    id uuid NOT NULL,
+    sso_provider_id uuid NOT NULL,
+    request_id text NOT NULL,
+    for_email text,
+    redirect_to text,
+    from_ip_address inet,
+    created_at timestamp with time zone,
+    updated_at timestamp with time zone,
+    flow_state_id uuid,
+    CONSTRAINT "request_id not empty" CHECK ((char_length(request_id) > 0))
+);
+
+
+ALTER TABLE auth.saml_relay_states OWNER TO supabase_auth_admin;
+
+--
+-- Name: TABLE saml_relay_states; Type: COMMENT; Schema: auth; Owner: supabase_auth_admin
+--
+
+COMMENT ON TABLE auth.saml_relay_states IS 'Auth: Contains SAML Relay State information for each Service Provider initiated login.';
+
+
+--
+-- Name: schema_migrations; Type: TABLE; Schema: auth; Owner: supabase_auth_admin
+--
+
+CREATE TABLE IF NOT EXISTS auth.schema_migrations (
+    version character varying(255) NOT NULL
+);
+
+
+ALTER TABLE auth.schema_migrations OWNER TO supabase_auth_admin;
+
+--
+-- Name: TABLE schema_migrations; Type: COMMENT; Schema: auth; Owner: supabase_auth_admin
+--
+
+COMMENT ON TABLE auth.schema_migrations IS 'Auth: Manages updates to the auth system.';
+
+
+--
+-- Name: sessions; Type: TABLE; Schema: auth; Owner: supabase_auth_admin
+--
+
+CREATE TABLE IF NOT EXISTS auth.sessions (
+    id uuid NOT NULL,
+    user_id uuid NOT NULL,
+    created_at timestamp with time zone,
+    updated_at timestamp with time zone,
+    factor_id uuid,
+    aal auth.aal_level,
+    not_after timestamp with time zone,
+    refreshed_at timestamp without time zone,
+    user_agent text,
+    ip inet,
+    tag text
+);
+
+
+ALTER TABLE auth.sessions OWNER TO supabase_auth_admin;
+
+--
+-- Name: TABLE sessions; Type: COMMENT; Schema: auth; Owner: supabase_auth_admin
+--
+
+COMMENT ON TABLE auth.sessions IS 'Auth: Stores session data associated to a user.';
+
+
+--
+-- Name: COLUMN sessions.not_after; Type: COMMENT; Schema: auth; Owner: supabase_auth_admin
+--
+
+COMMENT ON COLUMN auth.sessions.not_after IS 'Auth: Not after is a nullable column that contains a timestamp after which the session should be regarded as expired.';
+
+
+--
+-- Name: sso_domains; Type: TABLE; Schema: auth; Owner: supabase_auth_admin
+--
+
+CREATE TABLE IF NOT EXISTS auth.sso_domains (
+    id uuid NOT NULL,
+    sso_provider_id uuid NOT NULL,
+    domain text NOT NULL,
+    created_at timestamp with time zone,
+    updated_at timestamp with time zone,
+    CONSTRAINT "domain not empty" CHECK ((char_length(domain) > 0))
+);
+
+
+ALTER TABLE auth.sso_domains OWNER TO supabase_auth_admin;
+
+--
+-- Name: TABLE sso_domains; Type: COMMENT; Schema: auth; Owner: supabase_auth_admin
+--
+
+COMMENT ON TABLE auth.sso_domains IS 'Auth: Manages SSO email address domain mapping to an SSO Identity Provider.';
+
+
+--
+-- Name: sso_providers; Type: TABLE; Schema: auth; Owner: supabase_auth_admin
+--
+
+CREATE TABLE IF NOT EXISTS auth.sso_providers (
+    id uuid NOT NULL,
+    resource_id text,
+    created_at timestamp with time zone,
+    updated_at timestamp with time zone,
+    CONSTRAINT "resource_id not empty" CHECK (((resource_id = NULL::text) OR (char_length(resource_id) > 0)))
+);
+
+
+ALTER TABLE auth.sso_providers OWNER TO supabase_auth_admin;
+
+--
+-- Name: TABLE sso_providers; Type: COMMENT; Schema: auth; Owner: supabase_auth_admin
+--
+
+COMMENT ON TABLE auth.sso_providers IS 'Auth: Manages SSO identity provider information; see saml_providers for SAML.';
+
+
+--
+-- Name: COLUMN sso_providers.resource_id; Type: COMMENT; Schema: auth; Owner: supabase_auth_admin
+--
+
+COMMENT ON COLUMN auth.sso_providers.resource_id IS 'Auth: Uniquely identifies a SSO provider according to a user-chosen resource ID (case insensitive), useful in infrastructure as code.';
+
+
+--
+-- Name: users; Type: TABLE; Schema: auth; Owner: supabase_auth_admin
+--
+
+CREATE TABLE IF NOT EXISTS auth.users (
+    instance_id uuid,
+    id uuid NOT NULL,
+    aud character varying(255),
+    role character varying(255),
+    email character varying(255),
+    encrypted_password character varying(255),
+    email_confirmed_at timestamp with time zone,
+    invited_at timestamp with time zone,
+    confirmation_token character varying(255),
+    confirmation_sent_at timestamp with time zone,
+    recovery_token character varying(255),
+    recovery_sent_at timestamp with time zone,
+    email_change_token_new character varying(255),
+    email_change character varying(255),
+    email_change_sent_at timestamp with time zone,
+    last_sign_in_at timestamp with time zone,
+    raw_app_meta_data jsonb,
+    raw_user_meta_data jsonb,
+    is_super_admin boolean,
+    created_at timestamp with time zone,
+    updated_at timestamp with time zone,
+    phone text DEFAULT NULL::character varying,
+    phone_confirmed_at timestamp with time zone,
+    phone_change text DEFAULT ''::character varying,
+    phone_change_token character varying(255) DEFAULT ''::character varying,
+    phone_change_sent_at timestamp with time zone,
+    confirmed_at timestamp with time zone GENERATED ALWAYS AS (LEAST(email_confirmed_at, phone_confirmed_at)) STORED,
+    email_change_token_current character varying(255) DEFAULT ''::character varying,
+    email_change_confirm_status smallint DEFAULT 0,
+    banned_until timestamp with time zone,
+    reauthentication_token character varying(255) DEFAULT ''::character varying,
+    reauthentication_sent_at timestamp with time zone,
+    is_sso_user boolean DEFAULT false NOT NULL,
+    deleted_at timestamp with time zone,
+    CONSTRAINT users_email_change_confirm_status_check CHECK (((email_change_confirm_status >= 0) AND (email_change_confirm_status <= 2)))
+);
+
+
+ALTER TABLE auth.users OWNER TO supabase_auth_admin;
+
+--
+-- Name: TABLE users; Type: COMMENT; Schema: auth; Owner: supabase_auth_admin
+--
+
+COMMENT ON TABLE auth.users IS 'Auth: Stores user login data within a secure schema.';
+
+
+--
+-- Name: COLUMN users.is_sso_user; Type: COMMENT; Schema: auth; Owner: supabase_auth_admin
+--
+
+COMMENT ON COLUMN auth.users.is_sso_user IS 'Auth: Set this column to true when the account comes from SSO. These accounts can have duplicate emails.';
+
+
+--
+-- Name: buckets; Type: TABLE; Schema: storage; Owner: supabase_storage_admin
+--
+
+CREATE TABLE IF NOT EXISTS storage.buckets (
+    id text NOT NULL,
+    name text NOT NULL,
+    owner uuid,
+    created_at timestamp with time zone DEFAULT now(),
+    updated_at timestamp with time zone DEFAULT now(),
+    public boolean DEFAULT false,
+    avif_autodetection boolean DEFAULT false,
+    file_size_limit bigint,
+    allowed_mime_types text[],
+    owner_id text
+);
+
+
+ALTER TABLE storage.buckets OWNER TO supabase_storage_admin;
+
+--
+-- Name: COLUMN buckets.owner; Type: COMMENT; Schema: storage; Owner: supabase_storage_admin
+--
+
+COMMENT ON COLUMN storage.buckets.owner IS 'Field is deprecated, use owner_id instead';
+
+
+--
+-- Name: migrations; Type: TABLE; Schema: storage; Owner: supabase_storage_admin
+--
+
+CREATE TABLE IF NOT EXISTS storage.migrations (
+    id integer NOT NULL,
+    name character varying(100) NOT NULL,
+    hash character varying(40) NOT NULL,
+    executed_at timestamp without time zone DEFAULT CURRENT_TIMESTAMP
+);
+
+
+ALTER TABLE storage.migrations OWNER TO supabase_storage_admin;
+
+--
+-- Name: objects; Type: TABLE; Schema: storage; Owner: supabase_storage_admin
+--
+
+CREATE TABLE IF NOT EXISTS storage.objects (
+    id uuid DEFAULT extensions.uuid_generate_v4() NOT NULL,
+    bucket_id text,
+    name text,
+    owner uuid,
+    created_at timestamp with time zone DEFAULT now(),
+    updated_at timestamp with time zone DEFAULT now(),
+    last_accessed_at timestamp with time zone DEFAULT now(),
+    metadata jsonb,
+    path_tokens text[] GENERATED ALWAYS AS (string_to_array(name, '/'::text)) STORED,
+    version text,
+    owner_id text
+);
+
+
+ALTER TABLE storage.objects OWNER TO supabase_storage_admin;
+
+--
+-- Name: COLUMN objects.owner; Type: COMMENT; Schema: storage; Owner: supabase_storage_admin
+--
+
+COMMENT ON COLUMN storage.objects.owner IS 'Field is deprecated, use owner_id instead';
+
+
+--
+-- Name: hooks; Type: TABLE; Schema: supabase_functions; Owner: supabase_functions_admin
+--
+
+CREATE TABLE IF NOT EXISTS supabase_functions.hooks (
+    id bigint NOT NULL,
+    hook_table_id integer NOT NULL,
+    hook_name text NOT NULL,
+    created_at timestamp with time zone DEFAULT now() NOT NULL,
+    request_id bigint
+);
+
+
+ALTER TABLE supabase_functions.hooks OWNER TO supabase_functions_admin;
+
+--
+-- Name: TABLE hooks; Type: COMMENT; Schema: supabase_functions; Owner: supabase_functions_admin
+--
+
+COMMENT ON TABLE supabase_functions.hooks IS 'Supabase Functions Hooks: Audit trail for triggered hooks.';
+
+
+--
+-- Name: hooks_id_seq; Type: SEQUENCE; Schema: supabase_functions; Owner: supabase_functions_admin
+--
+
+CREATE SEQUENCE IF NOT EXISTS supabase_functions.hooks_id_seq
+    START WITH 1
+    INCREMENT BY 1
+    NO MINVALUE
+    NO MAXVALUE
+    CACHE 1;
+
+
+ALTER TABLE supabase_functions.hooks_id_seq OWNER TO supabase_functions_admin;
+
+--
+-- Name: hooks_id_seq; Type: SEQUENCE OWNED BY; Schema: supabase_functions; Owner: supabase_functions_admin
+--
+
+ALTER SEQUENCE supabase_functions.hooks_id_seq OWNED BY supabase_functions.hooks.id;
+
+
+--
+-- Name: migrations; Type: TABLE; Schema: supabase_functions; Owner: supabase_functions_admin
+--
+
+CREATE TABLE IF NOT EXISTS supabase_functions.migrations (
+    version text NOT NULL,
+    inserted_at timestamp with time zone DEFAULT now() NOT NULL
+);
+
+
+ALTER TABLE supabase_functions.migrations OWNER TO supabase_functions_admin;
+
+--
+-- Name: refresh_tokens id; Type: DEFAULT; Schema: auth; Owner: supabase_auth_admin
+--
+
+ALTER TABLE ONLY auth.refresh_tokens ALTER COLUMN id SET DEFAULT nextval('auth.refresh_tokens_id_seq'::regclass);
+
+
+--
+-- Name: hooks id; Type: DEFAULT; Schema: supabase_functions; Owner: supabase_functions_admin
+--
+
+ALTER TABLE ONLY supabase_functions.hooks ALTER COLUMN id SET DEFAULT nextval('supabase_functions.hooks_id_seq'::regclass);
+
+
+--
+-- Data for Name: extensions; Type: TABLE DATA; Schema: _realtime; Owner: postgres
+--
+
+INSERT INTO _realtime.extensions (id, type, settings, tenant_external_id, inserted_at, updated_at) VALUES ('832b3aeb-9d7f-41aa-ad31-60ea054c294f', 'postgres_cdc_rls', '{"region": "us-east-1", "db_host": "ABK7kBu27y/PVdL10i/b+A==", "db_name": "sWBpZNdjggEPTQVlI52Zfw==", "db_port": "+enMDFi1J/3IrrquHHwUmA==", "db_user": "uxbEq/zz8DXVD53TOI1zmw==", "slot_name": "supabase_realtime_replication_slot", "ip_version": 4, "db_password": "sWBpZNdjggEPTQVlI52Zfw==", "publication": "supabase_realtime", "ssl_enforced": false, "poll_interval_ms": 100, "poll_max_changes": 100, "poll_max_record_bytes": 1048576}', 'realtime-dev', '2023-11-20 22:04:38', '2023-11-20 22:04:38');
+
+
+--
+-- Data for Name: schema_migrations; Type: TABLE DATA; Schema: _realtime; Owner: postgres
+--
+
+INSERT INTO _realtime.schema_migrations (version, inserted_at) VALUES (20210706140551, '2023-03-16 02:25:35');
+INSERT INTO _realtime.schema_migrations (version, inserted_at) VALUES (20220329161857, '2023-03-16 02:25:35');
+INSERT INTO _realtime.schema_migrations (version, inserted_at) VALUES (20220410212326, '2023-03-16 02:25:35');
+INSERT INTO _realtime.schema_migrations (version, inserted_at) VALUES (20220506102948, '2023-03-16 02:25:35');
+INSERT INTO _realtime.schema_migrations (version, inserted_at) VALUES (20220527210857, '2023-03-16 02:25:36');
+INSERT INTO _realtime.schema_migrations (version, inserted_at) VALUES (20220815211129, '2023-03-16 02:25:36');
+INSERT INTO _realtime.schema_migrations (version, inserted_at) VALUES (20220815215024, '2023-03-16 02:25:36');
+INSERT INTO _realtime.schema_migrations (version, inserted_at) VALUES (20220818141501, '2023-03-16 02:25:36');
+INSERT INTO _realtime.schema_migrations (version, inserted_at) VALUES (20221018173709, '2023-03-16 02:25:36');
+INSERT INTO _realtime.schema_migrations (version, inserted_at) VALUES (20221102172703, '2023-03-16 02:25:36');
+INSERT INTO _realtime.schema_migrations (version, inserted_at) VALUES (20221223010058, '2023-03-16 02:25:36');
+INSERT INTO _realtime.schema_migrations (version, inserted_at) VALUES (20230110180046, '2023-03-16 02:25:36');
+INSERT INTO _realtime.schema_migrations (version, inserted_at) VALUES (20230810220907, '2023-11-20 21:54:23');
+INSERT INTO _realtime.schema_migrations (version, inserted_at) VALUES (20230810220924, '2023-11-20 21:54:23');
+INSERT INTO _realtime.schema_migrations (version, inserted_at) VALUES (20231024094642, '2023-11-20 21:54:23');
+
+
+--
+-- Data for Name: tenants; Type: TABLE DATA; Schema: _realtime; Owner: postgres
+--
+
+INSERT INTO _realtime.tenants (id, name, external_id, jwt_secret, max_concurrent_users, inserted_at, updated_at, max_events_per_second, postgres_cdc_default, max_bytes_per_second, max_channels_per_client, max_joins_per_second, suspend) VALUES ('f418662c-07b5-4160-9338-4db7fbaaabbd', 'realtime-dev', 'realtime-dev', 'iNjicxc4+llvc9wovDvqymwfnj9teWMlyOIbJ8Fh6j2WNU8CIJ2ZgjR6MUIKqSmeDmvpsKLsZ9jgXJmQPpwL8w==', 200, '2023-11-20 22:04:38', '2023-11-20 22:04:38', 100, 'postgres_cdc_rls', 100000, 100, 100, false);
+
+
+--
+-- Data for Name: audit_log_entries; Type: TABLE DATA; Schema: auth; Owner: supabase_auth_admin
+--
+
+
+
+--
+-- Data for Name: flow_state; Type: TABLE DATA; Schema: auth; Owner: supabase_auth_admin
+--
+
+
+
+--
+-- Data for Name: identities; Type: TABLE DATA; Schema: auth; Owner: supabase_auth_admin
+--
+
+
+
+--
+-- Data for Name: instances; Type: TABLE DATA; Schema: auth; Owner: supabase_auth_admin
+--
+
+
+
+--
+-- Data for Name: mfa_amr_claims; Type: TABLE DATA; Schema: auth; Owner: supabase_auth_admin
+--
+
+
+
+--
+-- Data for Name: mfa_challenges; Type: TABLE DATA; Schema: auth; Owner: supabase_auth_admin
+--
+
+
+
+--
+-- Data for Name: mfa_factors; Type: TABLE DATA; Schema: auth; Owner: supabase_auth_admin
+--
+
+
+
+--
+-- Data for Name: refresh_tokens; Type: TABLE DATA; Schema: auth; Owner: supabase_auth_admin
+--
+
+
+
+--
+-- Data for Name: saml_providers; Type: TABLE DATA; Schema: auth; Owner: supabase_auth_admin
+--
+
+
+
+--
+-- Data for Name: saml_relay_states; Type: TABLE DATA; Schema: auth; Owner: supabase_auth_admin
+--
+
+
+
+--
+-- Data for Name: schema_migrations; Type: TABLE DATA; Schema: auth; Owner: supabase_auth_admin
+--
+
+INSERT INTO auth.schema_migrations (version) VALUES ('20171026211738');
+INSERT INTO auth.schema_migrations (version) VALUES ('20171026211808');
+INSERT INTO auth.schema_migrations (version) VALUES ('20171026211834');
+INSERT INTO auth.schema_migrations (version) VALUES ('20180103212743');
+INSERT INTO auth.schema_migrations (version) VALUES ('20180108183307');
+INSERT INTO auth.schema_migrations (version) VALUES ('20180119214651');
+INSERT INTO auth.schema_migrations (version) VALUES ('20180125194653');
+INSERT INTO auth.schema_migrations (version) VALUES ('00');
+INSERT INTO auth.schema_migrations (version) VALUES ('20210710035447');
+INSERT INTO auth.schema_migrations (version) VALUES ('20210722035447');
+INSERT INTO auth.schema_migrations (version) VALUES ('20210730183235');
+INSERT INTO auth.schema_migrations (version) VALUES ('20210909172000');
+INSERT INTO auth.schema_migrations (version) VALUES ('20210927181326');
+INSERT INTO auth.schema_migrations (version) VALUES ('20211122151130');
+INSERT INTO auth.schema_migrations (version) VALUES ('20211124214934');
+INSERT INTO auth.schema_migrations (version) VALUES ('20211202183645');
+INSERT INTO auth.schema_migrations (version) VALUES ('20220114185221');
+INSERT INTO auth.schema_migrations (version) VALUES ('20220114185340');
+INSERT INTO auth.schema_migrations (version) VALUES ('20220224000811');
+INSERT INTO auth.schema_migrations (version) VALUES ('20220323170000');
+INSERT INTO auth.schema_migrations (version) VALUES ('20220429102000');
+INSERT INTO auth.schema_migrations (version) VALUES ('20220531120530');
+INSERT INTO auth.schema_migrations (version) VALUES ('20220614074223');
+INSERT INTO auth.schema_migrations (version) VALUES ('20220811173540');
+INSERT INTO auth.schema_migrations (version) VALUES ('20221003041349');
+INSERT INTO auth.schema_migrations (version) VALUES ('20221003041400');
+INSERT INTO auth.schema_migrations (version) VALUES ('20221011041400');
+INSERT INTO auth.schema_migrations (version) VALUES ('20221020193600');
+INSERT INTO auth.schema_migrations (version) VALUES ('20221021073300');
+INSERT INTO auth.schema_migrations (version) VALUES ('20221021082433');
+INSERT INTO auth.schema_migrations (version) VALUES ('20221027105023');
+INSERT INTO auth.schema_migrations (version) VALUES ('20221114143122');
+INSERT INTO auth.schema_migrations (version) VALUES ('20221114143410');
+INSERT INTO auth.schema_migrations (version) VALUES ('20221125140132');
+INSERT INTO auth.schema_migrations (version) VALUES ('20221208132122');
+INSERT INTO auth.schema_migrations (version) VALUES ('20221215195500');
+INSERT INTO auth.schema_migrations (version) VALUES ('20221215195800');
+INSERT INTO auth.schema_migrations (version) VALUES ('20221215195900');
+INSERT INTO auth.schema_migrations (version) VALUES ('20230116124310');
+INSERT INTO auth.schema_migrations (version) VALUES ('20230116124412');
+INSERT INTO auth.schema_migrations (version) VALUES ('20230131181311');
+INSERT INTO auth.schema_migrations (version) VALUES ('20230322519590');
+INSERT INTO auth.schema_migrations (version) VALUES ('20230402418590');
+INSERT INTO auth.schema_migrations (version) VALUES ('20230411005111');
+INSERT INTO auth.schema_migrations (version) VALUES ('20230508135423');
+INSERT INTO auth.schema_migrations (version) VALUES ('20230523124323');
+INSERT INTO auth.schema_migrations (version) VALUES ('20230818113222');
+INSERT INTO auth.schema_migrations (version) VALUES ('20230914180801');
+INSERT INTO auth.schema_migrations (version) VALUES ('20231027141322');
+INSERT INTO auth.schema_migrations (version) VALUES ('20231114161723');
+INSERT INTO auth.schema_migrations (version) VALUES ('20231117164230');
+
+
+--
+-- Data for Name: sessions; Type: TABLE DATA; Schema: auth; Owner: supabase_auth_admin
+--
+
+
+
+--
+-- Data for Name: sso_domains; Type: TABLE DATA; Schema: auth; Owner: supabase_auth_admin
+--
+
+
+
+--
+-- Data for Name: sso_providers; Type: TABLE DATA; Schema: auth; Owner: supabase_auth_admin
+--
+
+
+
+--
+-- Data for Name: users; Type: TABLE DATA; Schema: auth; Owner: supabase_auth_admin
+--
+
+
+
+--
+-- Data for Name: buckets; Type: TABLE DATA; Schema: storage; Owner: supabase_storage_admin
+--
+
+
+
+--
+-- Data for Name: migrations; Type: TABLE DATA; Schema: storage; Owner: supabase_storage_admin
+--
+
+INSERT INTO storage.migrations (id, name, hash, executed_at) VALUES (0, 'create-migrations-table', 'e18db593bcde2aca2a408c4d1100f6abba2195df', '2023-03-16 02:25:37.548482');
+INSERT INTO storage.migrations (id, name, hash, executed_at) VALUES (1, 'initialmigration', '6ab16121fbaa08bbd11b712d05f358f9b555d777', '2023-03-16 02:25:37.55595');
+INSERT INTO storage.migrations (id, name, hash, executed_at) VALUES (2, 'pathtoken-column', '49756be03be4c17bb85fe70d4a861f27de7e49ad', '2023-03-16 02:25:37.560258');
+INSERT INTO storage.migrations (id, name, hash, executed_at) VALUES (3, 'add-migrations-rls', 'bb5d124c53d68635a883e399426c6a5a25fc893d', '2023-03-16 02:25:37.594153');
+INSERT INTO storage.migrations (id, name, hash, executed_at) VALUES (4, 'add-size-functions', '6d79007d04f5acd288c9c250c42d2d5fd286c54d', '2023-03-16 02:25:37.599194');
+INSERT INTO storage.migrations (id, name, hash, executed_at) VALUES (5, 'change-column-name-in-get-size', 'fd65688505d2ffa9fbdc58a944348dd8604d688c', '2023-03-16 02:25:37.604658');
+INSERT INTO storage.migrations (id, name, hash, executed_at) VALUES (6, 'add-rls-to-buckets', '63e2bab75a2040fee8e3fb3f15a0d26f3380e9b6', '2023-03-16 02:25:37.609563');
+INSERT INTO storage.migrations (id, name, hash, executed_at) VALUES (7, 'add-public-to-buckets', '82568934f8a4d9e0a85f126f6fb483ad8214c418', '2023-03-16 02:25:37.615929');
+INSERT INTO storage.migrations (id, name, hash, executed_at) VALUES (8, 'fix-search-function', '1a43a40eddb525f2e2f26efd709e6c06e58e059c', '2023-03-16 02:25:37.620171');
+INSERT INTO storage.migrations (id, name, hash, executed_at) VALUES (9, 'search-files-search-function', '34c096597eb8b9d077fdfdde9878c88501b2fafc', '2023-03-16 02:25:37.624484');
+INSERT INTO storage.migrations (id, name, hash, executed_at) VALUES (10, 'add-trigger-to-auto-update-updated_at-column', '37d6bb964a70a822e6d37f22f457b9bca7885928', '2023-03-16 02:25:37.629534');
+INSERT INTO storage.migrations (id, name, hash, executed_at) VALUES (11, 'add-automatic-avif-detection-flag', 'bd76c53a9c564c80d98d119c1b3a28e16c8152db', '2023-03-16 02:25:37.634022');
+INSERT INTO storage.migrations (id, name, hash, executed_at) VALUES (12, 'add-bucket-custom-limits', 'cbe0a4c32a0e891554a21020433b7a4423c07ee7', '2023-03-16 02:25:37.639132');
+INSERT INTO storage.migrations (id, name, hash, executed_at) VALUES (13, 'use-bytes-for-max-size', '7a158ebce8a0c2801c9c65b7e9b2f98f68b3874e', '2023-03-16 02:25:37.643598');
+INSERT INTO storage.migrations (id, name, hash, executed_at) VALUES (14, 'add-can-insert-object-function', '273193826bca7e0990b458d1ba72f8aa27c0d825', '2023-04-06 09:18:55.232202');
+INSERT INTO storage.migrations (id, name, hash, executed_at) VALUES (15, 'add-version', 'e821a779d26612899b8c2dfe20245f904a327c4f', '2023-04-06 09:18:55.239444');
+INSERT INTO storage.migrations (id, name, hash, executed_at) VALUES (16, 'drop-owner-foreign-key', '536b33f8878eed09d0144219777dcac96bdb25da', '2023-11-20 21:54:33.540386');
+INSERT INTO storage.migrations (id, name, hash, executed_at) VALUES (17, 'add_owner_id_column_deprecate_owner', '7545f216a39358b5487df75d941d05dbcd75eb46', '2023-11-20 22:04:38.959686');
+
+
+--
+-- Data for Name: objects; Type: TABLE DATA; Schema: storage; Owner: supabase_storage_admin
+--
+
+
+
+--
+-- Data for Name: hooks; Type: TABLE DATA; Schema: supabase_functions; Owner: supabase_functions_admin
+--
+
+
+
+--
+-- Data for Name: migrations; Type: TABLE DATA; Schema: supabase_functions; Owner: supabase_functions_admin
+--
+
+INSERT INTO supabase_functions.migrations (version, inserted_at) VALUES ('initial', '2023-03-16 02:25:30.966697+00');
+INSERT INTO supabase_functions.migrations (version, inserted_at) VALUES ('20210809183423_update_grants', '2023-03-16 02:25:30.966697+00');
+
+
+--
+-- Name: refresh_tokens_id_seq; Type: SEQUENCE SET; Schema: auth; Owner: supabase_auth_admin
+--
+
+SELECT pg_catalog.setval('auth.refresh_tokens_id_seq', 1, false);
+
+
+--
+-- Name: hooks_id_seq; Type: SEQUENCE SET; Schema: supabase_functions; Owner: supabase_functions_admin
+--
+
+SELECT pg_catalog.setval('supabase_functions.hooks_id_seq', 1, false);
+
+
+--
+-- Name: extensions extensions_pkey; Type: CONSTRAINT; Schema: _realtime; Owner: postgres
+--
+
+ALTER TABLE ONLY _realtime.extensions
+    ADD CONSTRAINT extensions_pkey PRIMARY KEY (id);
+
+
+--
+-- Name: schema_migrations schema_migrations_pkey; Type: CONSTRAINT; Schema: _realtime; Owner: postgres
+--
+
+ALTER TABLE ONLY _realtime.schema_migrations
+    ADD CONSTRAINT schema_migrations_pkey PRIMARY KEY (version);
+
+
+--
+-- Name: tenants tenants_pkey; Type: CONSTRAINT; Schema: _realtime; Owner: postgres
+--
+
+ALTER TABLE ONLY _realtime.tenants
+    ADD CONSTRAINT tenants_pkey PRIMARY KEY (id);
+
+
+--
+-- Name: mfa_amr_claims amr_id_pk; Type: CONSTRAINT; Schema: auth; Owner: supabase_auth_admin
+--
+
+ALTER TABLE ONLY auth.mfa_amr_claims
+    ADD CONSTRAINT amr_id_pk PRIMARY KEY (id);
+
+
+--
+-- Name: audit_log_entries audit_log_entries_pkey; Type: CONSTRAINT; Schema: auth; Owner: supabase_auth_admin
+--
+
+ALTER TABLE ONLY auth.audit_log_entries
+    ADD CONSTRAINT audit_log_entries_pkey PRIMARY KEY (id);
+
+
+--
+-- Name: flow_state flow_state_pkey; Type: CONSTRAINT; Schema: auth; Owner: supabase_auth_admin
+--
+
+ALTER TABLE ONLY auth.flow_state
+    ADD CONSTRAINT flow_state_pkey PRIMARY KEY (id);
+
+
+--
+-- Name: identities identities_pkey; Type: CONSTRAINT; Schema: auth; Owner: supabase_auth_admin
+--
+
+ALTER TABLE ONLY auth.identities
+    ADD CONSTRAINT identities_pkey PRIMARY KEY (id);
+
+
+--
+-- Name: identities identities_provider_id_provider_unique; Type: CONSTRAINT; Schema: auth; Owner: supabase_auth_admin
+--
+
+ALTER TABLE ONLY auth.identities
+    ADD CONSTRAINT identities_provider_id_provider_unique UNIQUE (provider_id, provider);
+
+
+--
+-- Name: instances instances_pkey; Type: CONSTRAINT; Schema: auth; Owner: supabase_auth_admin
+--
+
+ALTER TABLE ONLY auth.instances
+    ADD CONSTRAINT instances_pkey PRIMARY KEY (id);
+
+
+--
+-- Name: mfa_amr_claims mfa_amr_claims_session_id_authentication_method_pkey; Type: CONSTRAINT; Schema: auth; Owner: supabase_auth_admin
+--
+
+ALTER TABLE ONLY auth.mfa_amr_claims
+    ADD CONSTRAINT mfa_amr_claims_session_id_authentication_method_pkey UNIQUE (session_id, authentication_method);
+
+
+--
+-- Name: mfa_challenges mfa_challenges_pkey; Type: CONSTRAINT; Schema: auth; Owner: supabase_auth_admin
+--
+
+ALTER TABLE ONLY auth.mfa_challenges
+    ADD CONSTRAINT mfa_challenges_pkey PRIMARY KEY (id);
+
+
+--
+-- Name: mfa_factors mfa_factors_pkey; Type: CONSTRAINT; Schema: auth; Owner: supabase_auth_admin
+--
+
+ALTER TABLE ONLY auth.mfa_factors
+    ADD CONSTRAINT mfa_factors_pkey PRIMARY KEY (id);
+
+
+--
+-- Name: refresh_tokens refresh_tokens_pkey; Type: CONSTRAINT; Schema: auth; Owner: supabase_auth_admin
+--
+
+ALTER TABLE ONLY auth.refresh_tokens
+    ADD CONSTRAINT refresh_tokens_pkey PRIMARY KEY (id);
+
+
+--
+-- Name: refresh_tokens refresh_tokens_token_unique; Type: CONSTRAINT; Schema: auth; Owner: supabase_auth_admin
+--
+
+ALTER TABLE ONLY auth.refresh_tokens
+    ADD CONSTRAINT refresh_tokens_token_unique UNIQUE (token);
+
+
+--
+-- Name: saml_providers saml_providers_entity_id_key; Type: CONSTRAINT; Schema: auth; Owner: supabase_auth_admin
+--
+
+ALTER TABLE ONLY auth.saml_providers
+    ADD CONSTRAINT saml_providers_entity_id_key UNIQUE (entity_id);
+
+
+--
+-- Name: saml_providers saml_providers_pkey; Type: CONSTRAINT; Schema: auth; Owner: supabase_auth_admin
+--
+
+ALTER TABLE ONLY auth.saml_providers
+    ADD CONSTRAINT saml_providers_pkey PRIMARY KEY (id);
+
+
+--
+-- Name: saml_relay_states saml_relay_states_pkey; Type: CONSTRAINT; Schema: auth; Owner: supabase_auth_admin
+--
+
+ALTER TABLE ONLY auth.saml_relay_states
+    ADD CONSTRAINT saml_relay_states_pkey PRIMARY KEY (id);
+
+
+--
+-- Name: schema_migrations schema_migrations_pkey; Type: CONSTRAINT; Schema: auth; Owner: supabase_auth_admin
+--
+
+ALTER TABLE ONLY auth.schema_migrations
+    ADD CONSTRAINT schema_migrations_pkey PRIMARY KEY (version);
+
+
+--
+-- Name: sessions sessions_pkey; Type: CONSTRAINT; Schema: auth; Owner: supabase_auth_admin
+--
+
+ALTER TABLE ONLY auth.sessions
+    ADD CONSTRAINT sessions_pkey PRIMARY KEY (id);
+
+
+--
+-- Name: sso_domains sso_domains_pkey; Type: CONSTRAINT; Schema: auth; Owner: supabase_auth_admin
+--
+
+ALTER TABLE ONLY auth.sso_domains
+    ADD CONSTRAINT sso_domains_pkey PRIMARY KEY (id);
+
+
+--
+-- Name: sso_providers sso_providers_pkey; Type: CONSTRAINT; Schema: auth; Owner: supabase_auth_admin
+--
+
+ALTER TABLE ONLY auth.sso_providers
+    ADD CONSTRAINT sso_providers_pkey PRIMARY KEY (id);
+
+
+--
+-- Name: users users_phone_key; Type: CONSTRAINT; Schema: auth; Owner: supabase_auth_admin
+--
+
+ALTER TABLE ONLY auth.users
+    ADD CONSTRAINT users_phone_key UNIQUE (phone);
+
+
+--
+-- Name: users users_pkey; Type: CONSTRAINT; Schema: auth; Owner: supabase_auth_admin
+--
+
+ALTER TABLE ONLY auth.users
+    ADD CONSTRAINT users_pkey PRIMARY KEY (id);
+
+
+--
+-- Name: buckets buckets_pkey; Type: CONSTRAINT; Schema: storage; Owner: supabase_storage_admin
+--
+
+ALTER TABLE ONLY storage.buckets
+    ADD CONSTRAINT buckets_pkey PRIMARY KEY (id);
+
+
+--
+-- Name: migrations migrations_name_key; Type: CONSTRAINT; Schema: storage; Owner: supabase_storage_admin
+--
+
+ALTER TABLE ONLY storage.migrations
+    ADD CONSTRAINT migrations_name_key UNIQUE (name);
+
+
+--
+-- Name: migrations migrations_pkey; Type: CONSTRAINT; Schema: storage; Owner: supabase_storage_admin
+--
+
+ALTER TABLE ONLY storage.migrations
+    ADD CONSTRAINT migrations_pkey PRIMARY KEY (id);
+
+
+--
+-- Name: objects objects_pkey; Type: CONSTRAINT; Schema: storage; Owner: supabase_storage_admin
+--
+
+ALTER TABLE ONLY storage.objects
+    ADD CONSTRAINT objects_pkey PRIMARY KEY (id);
+
+
+--
+-- Name: hooks hooks_pkey; Type: CONSTRAINT; Schema: supabase_functions; Owner: supabase_functions_admin
+--
+
+ALTER TABLE ONLY supabase_functions.hooks
+    ADD CONSTRAINT hooks_pkey PRIMARY KEY (id);
+
+
+--
+-- Name: migrations migrations_pkey; Type: CONSTRAINT; Schema: supabase_functions; Owner: supabase_functions_admin
+--
+
+ALTER TABLE ONLY supabase_functions.migrations
+    ADD CONSTRAINT migrations_pkey PRIMARY KEY (version);
+
+
+--
+-- Name: extensions_tenant_external_id_type_index; Type: INDEX; Schema: _realtime; Owner: postgres
+--
+
+CREATE UNIQUE INDEX extensions_tenant_external_id_type_index ON _realtime.extensions USING btree (tenant_external_id, type);
+
+
+--
+-- Name: tenants_external_id_index; Type: INDEX; Schema: _realtime; Owner: postgres
+--
+
+CREATE UNIQUE INDEX tenants_external_id_index ON _realtime.tenants USING btree (external_id);
+
+
+--
+-- Name: audit_logs_instance_id_idx; Type: INDEX; Schema: auth; Owner: supabase_auth_admin
+--
+
+CREATE INDEX audit_logs_instance_id_idx ON auth.audit_log_entries USING btree (instance_id);
+
+
+--
+-- Name: confirmation_token_idx; Type: INDEX; Schema: auth; Owner: supabase_auth_admin
+--
+
+CREATE UNIQUE INDEX confirmation_token_idx ON auth.users USING btree (confirmation_token) WHERE ((confirmation_token)::text !~ '^[0-9 ]*$'::text);
+
+
+--
+-- Name: email_change_token_current_idx; Type: INDEX; Schema: auth; Owner: supabase_auth_admin
+--
+
+CREATE UNIQUE INDEX email_change_token_current_idx ON auth.users USING btree (email_change_token_current) WHERE ((email_change_token_current)::text !~ '^[0-9 ]*$'::text);
+
+
+--
+-- Name: email_change_token_new_idx; Type: INDEX; Schema: auth; Owner: supabase_auth_admin
+--
+
+CREATE UNIQUE INDEX email_change_token_new_idx ON auth.users USING btree (email_change_token_new) WHERE ((email_change_token_new)::text !~ '^[0-9 ]*$'::text);
+
+
+--
+-- Name: factor_id_created_at_idx; Type: INDEX; Schema: auth; Owner: supabase_auth_admin
+--
+
+CREATE INDEX factor_id_created_at_idx ON auth.mfa_factors USING btree (user_id, created_at);
+
+
+--
+-- Name: flow_state_created_at_idx; Type: INDEX; Schema: auth; Owner: supabase_auth_admin
+--
+
+CREATE INDEX flow_state_created_at_idx ON auth.flow_state USING btree (created_at DESC);
+
+
+--
+-- Name: identities_email_idx; Type: INDEX; Schema: auth; Owner: supabase_auth_admin
+--
+
+CREATE INDEX identities_email_idx ON auth.identities USING btree (email text_pattern_ops);
+
+
+--
+-- Name: INDEX identities_email_idx; Type: COMMENT; Schema: auth; Owner: supabase_auth_admin
+--
+
+COMMENT ON INDEX auth.identities_email_idx IS 'Auth: Ensures indexed queries on the email column';
+
+
+--
+-- Name: identities_user_id_idx; Type: INDEX; Schema: auth; Owner: supabase_auth_admin
+--
+
+CREATE INDEX identities_user_id_idx ON auth.identities USING btree (user_id);
+
+
+--
+-- Name: idx_auth_code; Type: INDEX; Schema: auth; Owner: supabase_auth_admin
+--
+
+CREATE INDEX idx_auth_code ON auth.flow_state USING btree (auth_code);
+
+
+--
+-- Name: idx_user_id_auth_method; Type: INDEX; Schema: auth; Owner: supabase_auth_admin
+--
+
+CREATE INDEX idx_user_id_auth_method ON auth.flow_state USING btree (user_id, authentication_method);
+
+
+--
+-- Name: mfa_challenge_created_at_idx; Type: INDEX; Schema: auth; Owner: supabase_auth_admin
+--
+
+CREATE INDEX mfa_challenge_created_at_idx ON auth.mfa_challenges USING btree (created_at DESC);
+
+
+--
+-- Name: mfa_factors_user_friendly_name_unique; Type: INDEX; Schema: auth; Owner: supabase_auth_admin
+--
+
+CREATE UNIQUE INDEX mfa_factors_user_friendly_name_unique ON auth.mfa_factors USING btree (friendly_name, user_id) WHERE (TRIM(BOTH FROM friendly_name) <> ''::text);
+
+
+--
+-- Name: mfa_factors_user_id_idx; Type: INDEX; Schema: auth; Owner: supabase_auth_admin
+--
+
+CREATE INDEX mfa_factors_user_id_idx ON auth.mfa_factors USING btree (user_id);
+
+
+--
+-- Name: reauthentication_token_idx; Type: INDEX; Schema: auth; Owner: supabase_auth_admin
+--
+
+CREATE UNIQUE INDEX reauthentication_token_idx ON auth.users USING btree (reauthentication_token) WHERE ((reauthentication_token)::text !~ '^[0-9 ]*$'::text);
+
+
+--
+-- Name: recovery_token_idx; Type: INDEX; Schema: auth; Owner: supabase_auth_admin
+--
+
+CREATE UNIQUE INDEX recovery_token_idx ON auth.users USING btree (recovery_token) WHERE ((recovery_token)::text !~ '^[0-9 ]*$'::text);
+
+
+--
+-- Name: refresh_tokens_instance_id_idx; Type: INDEX; Schema: auth; Owner: supabase_auth_admin
+--
+
+CREATE INDEX refresh_tokens_instance_id_idx ON auth.refresh_tokens USING btree (instance_id);
+
+
+--
+-- Name: refresh_tokens_instance_id_user_id_idx; Type: INDEX; Schema: auth; Owner: supabase_auth_admin
+--
+
+CREATE INDEX refresh_tokens_instance_id_user_id_idx ON auth.refresh_tokens USING btree (instance_id, user_id);
+
+
+--
+-- Name: refresh_tokens_parent_idx; Type: INDEX; Schema: auth; Owner: supabase_auth_admin
+--
+
+CREATE INDEX refresh_tokens_parent_idx ON auth.refresh_tokens USING btree (parent);
+
+
+--
+-- Name: refresh_tokens_session_id_revoked_idx; Type: INDEX; Schema: auth; Owner: supabase_auth_admin
+--
+
+CREATE INDEX refresh_tokens_session_id_revoked_idx ON auth.refresh_tokens USING btree (session_id, revoked);
+
+
+--
+-- Name: refresh_tokens_updated_at_idx; Type: INDEX; Schema: auth; Owner: supabase_auth_admin
+--
+
+CREATE INDEX refresh_tokens_updated_at_idx ON auth.refresh_tokens USING btree (updated_at DESC);
+
+
+--
+-- Name: saml_providers_sso_provider_id_idx; Type: INDEX; Schema: auth; Owner: supabase_auth_admin
+--
+
+CREATE INDEX saml_providers_sso_provider_id_idx ON auth.saml_providers USING btree (sso_provider_id);
+
+
+--
+-- Name: saml_relay_states_created_at_idx; Type: INDEX; Schema: auth; Owner: supabase_auth_admin
+--
+
+CREATE INDEX saml_relay_states_created_at_idx ON auth.saml_relay_states USING btree (created_at DESC);
+
+
+--
+-- Name: saml_relay_states_for_email_idx; Type: INDEX; Schema: auth; Owner: supabase_auth_admin
+--
+
+CREATE INDEX saml_relay_states_for_email_idx ON auth.saml_relay_states USING btree (for_email);
+
+
+--
+-- Name: saml_relay_states_sso_provider_id_idx; Type: INDEX; Schema: auth; Owner: supabase_auth_admin
+--
+
+CREATE INDEX saml_relay_states_sso_provider_id_idx ON auth.saml_relay_states USING btree (sso_provider_id);
+
+
+--
+-- Name: sessions_not_after_idx; Type: INDEX; Schema: auth; Owner: supabase_auth_admin
+--
+
+CREATE INDEX sessions_not_after_idx ON auth.sessions USING btree (not_after DESC);
+
+
+--
+-- Name: sessions_user_id_idx; Type: INDEX; Schema: auth; Owner: supabase_auth_admin
+--
+
+CREATE INDEX sessions_user_id_idx ON auth.sessions USING btree (user_id);
+
+
+--
+-- Name: sso_domains_domain_idx; Type: INDEX; Schema: auth; Owner: supabase_auth_admin
+--
+
+CREATE UNIQUE INDEX sso_domains_domain_idx ON auth.sso_domains USING btree (lower(domain));
+
+
+--
+-- Name: sso_domains_sso_provider_id_idx; Type: INDEX; Schema: auth; Owner: supabase_auth_admin
+--
+
+CREATE INDEX sso_domains_sso_provider_id_idx ON auth.sso_domains USING btree (sso_provider_id);
+
+
+--
+-- Name: sso_providers_resource_id_idx; Type: INDEX; Schema: auth; Owner: supabase_auth_admin
+--
+
+CREATE UNIQUE INDEX sso_providers_resource_id_idx ON auth.sso_providers USING btree (lower(resource_id));
+
+
+--
+-- Name: user_id_created_at_idx; Type: INDEX; Schema: auth; Owner: supabase_auth_admin
+--
+
+CREATE INDEX user_id_created_at_idx ON auth.sessions USING btree (user_id, created_at);
+
+
+--
+-- Name: users_email_partial_key; Type: INDEX; Schema: auth; Owner: supabase_auth_admin
+--
+
+CREATE UNIQUE INDEX users_email_partial_key ON auth.users USING btree (email) WHERE (is_sso_user = false);
+
+
+--
+-- Name: INDEX users_email_partial_key; Type: COMMENT; Schema: auth; Owner: supabase_auth_admin
+--
+
+COMMENT ON INDEX auth.users_email_partial_key IS 'Auth: A partial unique index that applies only when is_sso_user is false';
+
+
+--
+-- Name: users_instance_id_email_idx; Type: INDEX; Schema: auth; Owner: supabase_auth_admin
+--
+
+CREATE INDEX users_instance_id_email_idx ON auth.users USING btree (instance_id, lower((email)::text));
+
+
+--
+-- Name: users_instance_id_idx; Type: INDEX; Schema: auth; Owner: supabase_auth_admin
+--
+
+CREATE INDEX users_instance_id_idx ON auth.users USING btree (instance_id);
+
+
+--
+-- Name: bname; Type: INDEX; Schema: storage; Owner: supabase_storage_admin
+--
+
+CREATE UNIQUE INDEX bname ON storage.buckets USING btree (name);
+
+
+--
+-- Name: bucketid_objname; Type: INDEX; Schema: storage; Owner: supabase_storage_admin
+--
+
+CREATE UNIQUE INDEX bucketid_objname ON storage.objects USING btree (bucket_id, name);
+
+
+--
+-- Name: name_prefix_search; Type: INDEX; Schema: storage; Owner: supabase_storage_admin
+--
+
+CREATE INDEX name_prefix_search ON storage.objects USING btree (name text_pattern_ops);
+
+
+--
+-- Name: supabase_functions_hooks_h_table_id_h_name_idx; Type: INDEX; Schema: supabase_functions; Owner: supabase_functions_admin
+--
+
+CREATE INDEX supabase_functions_hooks_h_table_id_h_name_idx ON supabase_functions.hooks USING btree (hook_table_id, hook_name);
+
+
+--
+-- Name: supabase_functions_hooks_request_id_idx; Type: INDEX; Schema: supabase_functions; Owner: supabase_functions_admin
+--
+
+CREATE INDEX supabase_functions_hooks_request_id_idx ON supabase_functions.hooks USING btree (request_id);
+
+
+--
+-- Name: objects update_objects_updated_at; Type: TRIGGER; Schema: storage; Owner: supabase_storage_admin
+--
+
+CREATE TRIGGER update_objects_updated_at BEFORE UPDATE ON storage.objects FOR EACH ROW EXECUTE FUNCTION storage.update_updated_at_column();
+
+
+--
+-- Name: extensions extensions_tenant_external_id_fkey; Type: FK CONSTRAINT; Schema: _realtime; Owner: postgres
+--
+
+ALTER TABLE ONLY _realtime.extensions
+    ADD CONSTRAINT extensions_tenant_external_id_fkey FOREIGN KEY (tenant_external_id) REFERENCES _realtime.tenants(external_id) ON DELETE CASCADE;
+
+
+--
+-- Name: identities identities_user_id_fkey; Type: FK CONSTRAINT; Schema: auth; Owner: supabase_auth_admin
+--
+
+ALTER TABLE ONLY auth.identities
+    ADD CONSTRAINT identities_user_id_fkey FOREIGN KEY (user_id) REFERENCES auth.users(id) ON DELETE CASCADE;
+
+
+--
+-- Name: mfa_amr_claims mfa_amr_claims_session_id_fkey; Type: FK CONSTRAINT; Schema: auth; Owner: supabase_auth_admin
+--
+
+ALTER TABLE ONLY auth.mfa_amr_claims
+    ADD CONSTRAINT mfa_amr_claims_session_id_fkey FOREIGN KEY (session_id) REFERENCES auth.sessions(id) ON DELETE CASCADE;
+
+
+--
+-- Name: mfa_challenges mfa_challenges_auth_factor_id_fkey; Type: FK CONSTRAINT; Schema: auth; Owner: supabase_auth_admin
+--
+
+ALTER TABLE ONLY auth.mfa_challenges
+    ADD CONSTRAINT mfa_challenges_auth_factor_id_fkey FOREIGN KEY (factor_id) REFERENCES auth.mfa_factors(id) ON DELETE CASCADE;
+
+
+--
+-- Name: mfa_factors mfa_factors_user_id_fkey; Type: FK CONSTRAINT; Schema: auth; Owner: supabase_auth_admin
+--
+
+ALTER TABLE ONLY auth.mfa_factors
+    ADD CONSTRAINT mfa_factors_user_id_fkey FOREIGN KEY (user_id) REFERENCES auth.users(id) ON DELETE CASCADE;
+
+
+--
+-- Name: refresh_tokens refresh_tokens_session_id_fkey; Type: FK CONSTRAINT; Schema: auth; Owner: supabase_auth_admin
+--
+
+ALTER TABLE ONLY auth.refresh_tokens
+    ADD CONSTRAINT refresh_tokens_session_id_fkey FOREIGN KEY (session_id) REFERENCES auth.sessions(id) ON DELETE CASCADE;
+
+
+--
+-- Name: saml_providers saml_providers_sso_provider_id_fkey; Type: FK CONSTRAINT; Schema: auth; Owner: supabase_auth_admin
+--
+
+ALTER TABLE ONLY auth.saml_providers
+    ADD CONSTRAINT saml_providers_sso_provider_id_fkey FOREIGN KEY (sso_provider_id) REFERENCES auth.sso_providers(id) ON DELETE CASCADE;
+
+
+--
+-- Name: saml_relay_states saml_relay_states_flow_state_id_fkey; Type: FK CONSTRAINT; Schema: auth; Owner: supabase_auth_admin
+--
+
+ALTER TABLE ONLY auth.saml_relay_states
+    ADD CONSTRAINT saml_relay_states_flow_state_id_fkey FOREIGN KEY (flow_state_id) REFERENCES auth.flow_state(id) ON DELETE CASCADE;
+
+
+--
+-- Name: saml_relay_states saml_relay_states_sso_provider_id_fkey; Type: FK CONSTRAINT; Schema: auth; Owner: supabase_auth_admin
+--
+
+ALTER TABLE ONLY auth.saml_relay_states
+    ADD CONSTRAINT saml_relay_states_sso_provider_id_fkey FOREIGN KEY (sso_provider_id) REFERENCES auth.sso_providers(id) ON DELETE CASCADE;
+
+
+--
+-- Name: sessions sessions_user_id_fkey; Type: FK CONSTRAINT; Schema: auth; Owner: supabase_auth_admin
+--
+
+ALTER TABLE ONLY auth.sessions
+    ADD CONSTRAINT sessions_user_id_fkey FOREIGN KEY (user_id) REFERENCES auth.users(id) ON DELETE CASCADE;
+
+
+--
+-- Name: sso_domains sso_domains_sso_provider_id_fkey; Type: FK CONSTRAINT; Schema: auth; Owner: supabase_auth_admin
+--
+
+ALTER TABLE ONLY auth.sso_domains
+    ADD CONSTRAINT sso_domains_sso_provider_id_fkey FOREIGN KEY (sso_provider_id) REFERENCES auth.sso_providers(id) ON DELETE CASCADE;
+
+
+--
+-- Name: objects objects_bucketId_fkey; Type: FK CONSTRAINT; Schema: storage; Owner: supabase_storage_admin
+--
+
+ALTER TABLE ONLY storage.objects
+    ADD CONSTRAINT "objects_bucketId_fkey" FOREIGN KEY (bucket_id) REFERENCES storage.buckets(id);
+
+
+--
+-- Name: buckets; Type: ROW SECURITY; Schema: storage; Owner: supabase_storage_admin
+--
+
+ALTER TABLE storage.buckets ENABLE ROW LEVEL SECURITY;
+
+--
+-- Name: migrations; Type: ROW SECURITY; Schema: storage; Owner: supabase_storage_admin
+--
+
+ALTER TABLE storage.migrations ENABLE ROW LEVEL SECURITY;
+
+--
+-- Name: objects; Type: ROW SECURITY; Schema: storage; Owner: supabase_storage_admin
+--
+
+ALTER TABLE storage.objects ENABLE ROW LEVEL SECURITY;
+
+--
+-- Name: supabase_realtime; Type: PUBLICATION; Schema: -; Owner: postgres
+--
+
+CREATE PUBLICATION supabase_realtime WITH (publish = 'insert, update, delete, truncate');
+
+
+ALTER PUBLICATION supabase_realtime OWNER TO postgres;
+
+--
+-- Name: SCHEMA auth; Type: ACL; Schema: -; Owner: supabase_admin
+--
+
+GRANT USAGE ON SCHEMA auth TO anon;
+GRANT USAGE ON SCHEMA auth TO authenticated;
+GRANT USAGE ON SCHEMA auth TO service_role;
+GRANT ALL ON SCHEMA auth TO supabase_auth_admin;
+GRANT ALL ON SCHEMA auth TO dashboard_user;
+GRANT ALL ON SCHEMA auth TO postgres;
+
+
+--
+-- Name: SCHEMA extensions; Type: ACL; Schema: -; Owner: postgres
+--
+
+GRANT USAGE ON SCHEMA extensions TO anon;
+GRANT USAGE ON SCHEMA extensions TO authenticated;
+GRANT USAGE ON SCHEMA extensions TO service_role;
+GRANT ALL ON SCHEMA extensions TO dashboard_user;
+
+
+--
+-- Name: SCHEMA graphql_public; Type: ACL; Schema: -; Owner: supabase_admin
+--
+
+GRANT USAGE ON SCHEMA graphql_public TO postgres;
+GRANT USAGE ON SCHEMA graphql_public TO anon;
+GRANT USAGE ON SCHEMA graphql_public TO authenticated;
+GRANT USAGE ON SCHEMA graphql_public TO service_role;
+
+
+--
+-- Name: SCHEMA net; Type: ACL; Schema: -; Owner: postgres
+--
+
+GRANT USAGE ON SCHEMA net TO supabase_functions_admin;
+GRANT USAGE ON SCHEMA net TO anon;
+GRANT USAGE ON SCHEMA net TO authenticated;
+GRANT USAGE ON SCHEMA net TO service_role;
+
+
+--
+-- Name: SCHEMA public; Type: ACL; Schema: -; Owner: postgres
+--
+
+REVOKE USAGE ON SCHEMA public FROM PUBLIC;
+GRANT ALL ON SCHEMA public TO PUBLIC;
+GRANT USAGE ON SCHEMA public TO anon;
+GRANT USAGE ON SCHEMA public TO authenticated;
+GRANT USAGE ON SCHEMA public TO service_role;
+
+
+--
+-- Name: SCHEMA realtime; Type: ACL; Schema: -; Owner: supabase_admin
+--
+
+GRANT USAGE ON SCHEMA realtime TO postgres;
+
+
+--
+-- Name: SCHEMA storage; Type: ACL; Schema: -; Owner: supabase_admin
+--
+
+GRANT ALL ON SCHEMA storage TO postgres;
+GRANT USAGE ON SCHEMA storage TO anon;
+GRANT USAGE ON SCHEMA storage TO authenticated;
+GRANT USAGE ON SCHEMA storage TO service_role;
+GRANT ALL ON SCHEMA storage TO supabase_storage_admin;
+GRANT ALL ON SCHEMA storage TO dashboard_user;
+
+
+--
+-- Name: SCHEMA supabase_functions; Type: ACL; Schema: -; Owner: supabase_admin
+--
+
+GRANT USAGE ON SCHEMA supabase_functions TO postgres;
+GRANT USAGE ON SCHEMA supabase_functions TO anon;
+GRANT USAGE ON SCHEMA supabase_functions TO authenticated;
+GRANT USAGE ON SCHEMA supabase_functions TO service_role;
+GRANT ALL ON SCHEMA supabase_functions TO supabase_functions_admin;
+
+
+--
+-- Name: FUNCTION email(); Type: ACL; Schema: auth; Owner: supabase_auth_admin
+--
+
+GRANT ALL ON FUNCTION auth.email() TO dashboard_user;
+
+
+--
+-- Name: FUNCTION jwt(); Type: ACL; Schema: auth; Owner: supabase_auth_admin
+--
+
+GRANT ALL ON FUNCTION auth.jwt() TO postgres;
+GRANT ALL ON FUNCTION auth.jwt() TO dashboard_user;
+
+
+--
+-- Name: FUNCTION role(); Type: ACL; Schema: auth; Owner: supabase_auth_admin
+--
+
+GRANT ALL ON FUNCTION auth.role() TO dashboard_user;
+
+
+--
+-- Name: FUNCTION uid(); Type: ACL; Schema: auth; Owner: supabase_auth_admin
+--
+
+GRANT ALL ON FUNCTION auth.uid() TO dashboard_user;
+
+
+--
+-- Name: FUNCTION algorithm_sign(signables text, secret text, algorithm text); Type: ACL; Schema: extensions; Owner: postgres
+--
+
+GRANT ALL ON FUNCTION extensions.algorithm_sign(signables text, secret text, algorithm text) TO dashboard_user;
+
+
+--
+-- Name: FUNCTION armor(bytea); Type: ACL; Schema: extensions; Owner: postgres
+--
+
+GRANT ALL ON FUNCTION extensions.armor(bytea) TO dashboard_user;
+
+
+--
+-- Name: FUNCTION armor(bytea, text[], text[]); Type: ACL; Schema: extensions; Owner: postgres
+--
+
+GRANT ALL ON FUNCTION extensions.armor(bytea, text[], text[]) TO dashboard_user;
+
+
+--
+-- Name: FUNCTION crypt(text, text); Type: ACL; Schema: extensions; Owner: postgres
+--
+
+GRANT ALL ON FUNCTION extensions.crypt(text, text) TO dashboard_user;
+
+
+--
+-- Name: FUNCTION dearmor(text); Type: ACL; Schema: extensions; Owner: postgres
+--
+
+GRANT ALL ON FUNCTION extensions.dearmor(text) TO dashboard_user;
+
+
+--
+-- Name: FUNCTION decrypt(bytea, bytea, text); Type: ACL; Schema: extensions; Owner: postgres
+--
+
+GRANT ALL ON FUNCTION extensions.decrypt(bytea, bytea, text) TO dashboard_user;
+
+
+--
+-- Name: FUNCTION decrypt_iv(bytea, bytea, bytea, text); Type: ACL; Schema: extensions; Owner: postgres
+--
+
+GRANT ALL ON FUNCTION extensions.decrypt_iv(bytea, bytea, bytea, text) TO dashboard_user;
+
+
+--
+-- Name: FUNCTION digest(bytea, text); Type: ACL; Schema: extensions; Owner: postgres
+--
+
+GRANT ALL ON FUNCTION extensions.digest(bytea, text) TO dashboard_user;
+
+
+--
+-- Name: FUNCTION digest(text, text); Type: ACL; Schema: extensions; Owner: postgres
+--
+
+GRANT ALL ON FUNCTION extensions.digest(text, text) TO dashboard_user;
+
+
+--
+-- Name: FUNCTION encrypt(bytea, bytea, text); Type: ACL; Schema: extensions; Owner: postgres
+--
+
+GRANT ALL ON FUNCTION extensions.encrypt(bytea, bytea, text) TO dashboard_user;
+
+
+--
+-- Name: FUNCTION encrypt_iv(bytea, bytea, bytea, text); Type: ACL; Schema: extensions; Owner: postgres
+--
+
+GRANT ALL ON FUNCTION extensions.encrypt_iv(bytea, bytea, bytea, text) TO dashboard_user;
+
+
+--
+-- Name: FUNCTION gen_random_bytes(integer); Type: ACL; Schema: extensions; Owner: postgres
+--
+
+GRANT ALL ON FUNCTION extensions.gen_random_bytes(integer) TO dashboard_user;
+
+
+--
+-- Name: FUNCTION gen_random_uuid(); Type: ACL; Schema: extensions; Owner: postgres
+--
+
+GRANT ALL ON FUNCTION extensions.gen_random_uuid() TO dashboard_user;
+
+
+--
+-- Name: FUNCTION gen_salt(text); Type: ACL; Schema: extensions; Owner: postgres
+--
+
+GRANT ALL ON FUNCTION extensions.gen_salt(text) TO dashboard_user;
+
+
+--
+-- Name: FUNCTION gen_salt(text, integer); Type: ACL; Schema: extensions; Owner: postgres
+--
+
+GRANT ALL ON FUNCTION extensions.gen_salt(text, integer) TO dashboard_user;
+
+
+--
+-- Name: FUNCTION grant_pg_cron_access(); Type: ACL; Schema: extensions; Owner: postgres
+--
+
+GRANT ALL ON FUNCTION extensions.grant_pg_cron_access() TO dashboard_user;
+
+
+--
+-- Name: FUNCTION grant_pg_net_access(); Type: ACL; Schema: extensions; Owner: postgres
+--
+
+GRANT ALL ON FUNCTION extensions.grant_pg_net_access() TO dashboard_user;
+
+
+--
+-- Name: FUNCTION hmac(bytea, bytea, text); Type: ACL; Schema: extensions; Owner: postgres
+--
+
+GRANT ALL ON FUNCTION extensions.hmac(bytea, bytea, text) TO dashboard_user;
+
+
+--
+-- Name: FUNCTION hmac(text, text, text); Type: ACL; Schema: extensions; Owner: postgres
+--
+
+GRANT ALL ON FUNCTION extensions.hmac(text, text, text) TO dashboard_user;
+
+
+--
+-- Name: FUNCTION pg_stat_statements(showtext boolean, OUT userid oid, OUT dbid oid, OUT toplevel boolean, OUT queryid bigint, OUT query text, OUT plans bigint, OUT total_plan_time double precision, OUT min_plan_time double precision, OUT max_plan_time double precision, OUT mean_plan_time double precision, OUT stddev_plan_time double precision, OUT calls bigint, OUT total_exec_time double precision, OUT min_exec_time double precision, OUT max_exec_time double precision, OUT mean_exec_time double precision, OUT stddev_exec_time double precision, OUT rows bigint, OUT shared_blks_hit bigint, OUT shared_blks_read bigint, OUT shared_blks_dirtied bigint, OUT shared_blks_written bigint, OUT local_blks_hit bigint, OUT local_blks_read bigint, OUT local_blks_dirtied bigint, OUT local_blks_written bigint, OUT temp_blks_read bigint, OUT temp_blks_written bigint, OUT blk_read_time double precision, OUT blk_write_time double precision, OUT wal_records bigint, OUT wal_fpi bigint, OUT wal_bytes numeric); Type: ACL; Schema: extensions; Owner: postgres
+--
+
+GRANT ALL ON FUNCTION extensions.pg_stat_statements(showtext boolean, OUT userid oid, OUT dbid oid, OUT toplevel boolean, OUT queryid bigint, OUT query text, OUT plans bigint, OUT total_plan_time double precision, OUT min_plan_time double precision, OUT max_plan_time double precision, OUT mean_plan_time double precision, OUT stddev_plan_time double precision, OUT calls bigint, OUT total_exec_time double precision, OUT min_exec_time double precision, OUT max_exec_time double precision, OUT mean_exec_time double precision, OUT stddev_exec_time double precision, OUT rows bigint, OUT shared_blks_hit bigint, OUT shared_blks_read bigint, OUT shared_blks_dirtied bigint, OUT shared_blks_written bigint, OUT local_blks_hit bigint, OUT local_blks_read bigint, OUT local_blks_dirtied bigint, OUT local_blks_written bigint, OUT temp_blks_read bigint, OUT temp_blks_written bigint, OUT blk_read_time double precision, OUT blk_write_time double precision, OUT wal_records bigint, OUT wal_fpi bigint, OUT wal_bytes numeric) TO dashboard_user;
+
+
+--
+-- Name: FUNCTION pg_stat_statements_info(OUT dealloc bigint, OUT stats_reset timestamp with time zone); Type: ACL; Schema: extensions; Owner: postgres
+--
+
+GRANT ALL ON FUNCTION extensions.pg_stat_statements_info(OUT dealloc bigint, OUT stats_reset timestamp with time zone) TO dashboard_user;
+
+
+--
+-- Name: FUNCTION pg_stat_statements_reset(userid oid, dbid oid, queryid bigint); Type: ACL; Schema: extensions; Owner: postgres
+--
+
+GRANT ALL ON FUNCTION extensions.pg_stat_statements_reset(userid oid, dbid oid, queryid bigint) TO dashboard_user;
+
+
+--
+-- Name: FUNCTION pgp_armor_headers(text, OUT key text, OUT value text); Type: ACL; Schema: extensions; Owner: postgres
+--
+
+GRANT ALL ON FUNCTION extensions.pgp_armor_headers(text, OUT key text, OUT value text) TO dashboard_user;
+
+
+--
+-- Name: FUNCTION pgp_key_id(bytea); Type: ACL; Schema: extensions; Owner: postgres
+--
+
+GRANT ALL ON FUNCTION extensions.pgp_key_id(bytea) TO dashboard_user;
+
+
+--
+-- Name: FUNCTION pgp_pub_decrypt(bytea, bytea); Type: ACL; Schema: extensions; Owner: postgres
+--
+
+GRANT ALL ON FUNCTION extensions.pgp_pub_decrypt(bytea, bytea) TO dashboard_user;
+
+
+--
+-- Name: FUNCTION pgp_pub_decrypt(bytea, bytea, text); Type: ACL; Schema: extensions; Owner: postgres
+--
+
+GRANT ALL ON FUNCTION extensions.pgp_pub_decrypt(bytea, bytea, text) TO dashboard_user;
+
+
+--
+-- Name: FUNCTION pgp_pub_decrypt(bytea, bytea, text, text); Type: ACL; Schema: extensions; Owner: postgres
+--
+
+GRANT ALL ON FUNCTION extensions.pgp_pub_decrypt(bytea, bytea, text, text) TO dashboard_user;
+
+
+--
+-- Name: FUNCTION pgp_pub_decrypt_bytea(bytea, bytea); Type: ACL; Schema: extensions; Owner: postgres
+--
+
+GRANT ALL ON FUNCTION extensions.pgp_pub_decrypt_bytea(bytea, bytea) TO dashboard_user;
+
+
+--
+-- Name: FUNCTION pgp_pub_decrypt_bytea(bytea, bytea, text); Type: ACL; Schema: extensions; Owner: postgres
+--
+
+GRANT ALL ON FUNCTION extensions.pgp_pub_decrypt_bytea(bytea, bytea, text) TO dashboard_user;
+
+
+--
+-- Name: FUNCTION pgp_pub_decrypt_bytea(bytea, bytea, text, text); Type: ACL; Schema: extensions; Owner: postgres
+--
+
+GRANT ALL ON FUNCTION extensions.pgp_pub_decrypt_bytea(bytea, bytea, text, text) TO dashboard_user;
+
+
+--
+-- Name: FUNCTION pgp_pub_encrypt(text, bytea); Type: ACL; Schema: extensions; Owner: postgres
+--
+
+GRANT ALL ON FUNCTION extensions.pgp_pub_encrypt(text, bytea) TO dashboard_user;
+
+
+--
+-- Name: FUNCTION pgp_pub_encrypt(text, bytea, text); Type: ACL; Schema: extensions; Owner: postgres
+--
+
+GRANT ALL ON FUNCTION extensions.pgp_pub_encrypt(text, bytea, text) TO dashboard_user;
+
+
+--
+-- Name: FUNCTION pgp_pub_encrypt_bytea(bytea, bytea); Type: ACL; Schema: extensions; Owner: postgres
+--
+
+GRANT ALL ON FUNCTION extensions.pgp_pub_encrypt_bytea(bytea, bytea) TO dashboard_user;
+
+
+--
+-- Name: FUNCTION pgp_pub_encrypt_bytea(bytea, bytea, text); Type: ACL; Schema: extensions; Owner: postgres
+--
+
+GRANT ALL ON FUNCTION extensions.pgp_pub_encrypt_bytea(bytea, bytea, text) TO dashboard_user;
+
+
+--
+-- Name: FUNCTION pgp_sym_decrypt(bytea, text); Type: ACL; Schema: extensions; Owner: postgres
+--
+
+GRANT ALL ON FUNCTION extensions.pgp_sym_decrypt(bytea, text) TO dashboard_user;
+
+
+--
+-- Name: FUNCTION pgp_sym_decrypt(bytea, text, text); Type: ACL; Schema: extensions; Owner: postgres
+--
+
+GRANT ALL ON FUNCTION extensions.pgp_sym_decrypt(bytea, text, text) TO dashboard_user;
+
+
+--
+-- Name: FUNCTION pgp_sym_decrypt_bytea(bytea, text); Type: ACL; Schema: extensions; Owner: postgres
+--
+
+GRANT ALL ON FUNCTION extensions.pgp_sym_decrypt_bytea(bytea, text) TO dashboard_user;
+
+
+--
+-- Name: FUNCTION pgp_sym_decrypt_bytea(bytea, text, text); Type: ACL; Schema: extensions; Owner: postgres
+--
+
+GRANT ALL ON FUNCTION extensions.pgp_sym_decrypt_bytea(bytea, text, text) TO dashboard_user;
+
+
+--
+-- Name: FUNCTION pgp_sym_encrypt(text, text); Type: ACL; Schema: extensions; Owner: postgres
+--
+
+GRANT ALL ON FUNCTION extensions.pgp_sym_encrypt(text, text) TO dashboard_user;
+
+
+--
+-- Name: FUNCTION pgp_sym_encrypt(text, text, text); Type: ACL; Schema: extensions; Owner: postgres
+--
+
+GRANT ALL ON FUNCTION extensions.pgp_sym_encrypt(text, text, text) TO dashboard_user;
+
+
+--
+-- Name: FUNCTION pgp_sym_encrypt_bytea(bytea, text); Type: ACL; Schema: extensions; Owner: postgres
+--
+
+GRANT ALL ON FUNCTION extensions.pgp_sym_encrypt_bytea(bytea, text) TO dashboard_user;
+
+
+--
+-- Name: FUNCTION pgp_sym_encrypt_bytea(bytea, text, text); Type: ACL; Schema: extensions; Owner: postgres
+--
+
+GRANT ALL ON FUNCTION extensions.pgp_sym_encrypt_bytea(bytea, text, text) TO dashboard_user;
+
+
+--
+-- Name: FUNCTION sign(payload json, secret text, algorithm text); Type: ACL; Schema: extensions; Owner: postgres
+--
+
+GRANT ALL ON FUNCTION extensions.sign(payload json, secret text, algorithm text) TO dashboard_user;
+
+
+--
+-- Name: FUNCTION try_cast_double(inp text); Type: ACL; Schema: extensions; Owner: postgres
+--
+
+GRANT ALL ON FUNCTION extensions.try_cast_double(inp text) TO dashboard_user;
+
+
+--
+-- Name: FUNCTION url_decode(data text); Type: ACL; Schema: extensions; Owner: postgres
+--
+
+GRANT ALL ON FUNCTION extensions.url_decode(data text) TO dashboard_user;
+
+
+--
+-- Name: FUNCTION url_encode(data bytea); Type: ACL; Schema: extensions; Owner: postgres
+--
+
+GRANT ALL ON FUNCTION extensions.url_encode(data bytea) TO dashboard_user;
+
+
+--
+-- Name: FUNCTION uuid_generate_v1(); Type: ACL; Schema: extensions; Owner: postgres
+--
+
+GRANT ALL ON FUNCTION extensions.uuid_generate_v1() TO dashboard_user;
+
+
+--
+-- Name: FUNCTION uuid_generate_v1mc(); Type: ACL; Schema: extensions; Owner: postgres
+--
+
+GRANT ALL ON FUNCTION extensions.uuid_generate_v1mc() TO dashboard_user;
+
+
+--
+-- Name: FUNCTION uuid_generate_v3(namespace uuid, name text); Type: ACL; Schema: extensions; Owner: postgres
+--
+
+GRANT ALL ON FUNCTION extensions.uuid_generate_v3(namespace uuid, name text) TO dashboard_user;
+
+
+--
+-- Name: FUNCTION uuid_generate_v4(); Type: ACL; Schema: extensions; Owner: postgres
+--
+
+GRANT ALL ON FUNCTION extensions.uuid_generate_v4() TO dashboard_user;
+
+
+--
+-- Name: FUNCTION uuid_generate_v5(namespace uuid, name text); Type: ACL; Schema: extensions; Owner: postgres
+--
+
+GRANT ALL ON FUNCTION extensions.uuid_generate_v5(namespace uuid, name text) TO dashboard_user;
+
+
+--
+-- Name: FUNCTION uuid_nil(); Type: ACL; Schema: extensions; Owner: postgres
+--
+
+GRANT ALL ON FUNCTION extensions.uuid_nil() TO dashboard_user;
+
+
+--
+-- Name: FUNCTION uuid_ns_dns(); Type: ACL; Schema: extensions; Owner: postgres
+--
+
+GRANT ALL ON FUNCTION extensions.uuid_ns_dns() TO dashboard_user;
+
+
+--
+-- Name: FUNCTION uuid_ns_oid(); Type: ACL; Schema: extensions; Owner: postgres
+--
+
+GRANT ALL ON FUNCTION extensions.uuid_ns_oid() TO dashboard_user;
+
+
+--
+-- Name: FUNCTION uuid_ns_url(); Type: ACL; Schema: extensions; Owner: postgres
+--
+
+GRANT ALL ON FUNCTION extensions.uuid_ns_url() TO dashboard_user;
+
+
+--
+-- Name: FUNCTION uuid_ns_x500(); Type: ACL; Schema: extensions; Owner: postgres
+--
+
+GRANT ALL ON FUNCTION extensions.uuid_ns_x500() TO dashboard_user;
+
+
+--
+-- Name: FUNCTION verify(token text, secret text, algorithm text); Type: ACL; Schema: extensions; Owner: postgres
+--
+
+GRANT ALL ON FUNCTION extensions.verify(token text, secret text, algorithm text) TO dashboard_user;
+
+
+--
+-- Name: FUNCTION comment_directive(comment_ text); Type: ACL; Schema: graphql; Owner: supabase_admin
+--
+
+GRANT ALL ON FUNCTION graphql.comment_directive(comment_ text) TO postgres;
+GRANT ALL ON FUNCTION graphql.comment_directive(comment_ text) TO anon;
+GRANT ALL ON FUNCTION graphql.comment_directive(comment_ text) TO authenticated;
+GRANT ALL ON FUNCTION graphql.comment_directive(comment_ text) TO service_role;
+
+
+--
+-- Name: FUNCTION exception(message text); Type: ACL; Schema: graphql; Owner: supabase_admin
+--
+
+GRANT ALL ON FUNCTION graphql.exception(message text) TO postgres;
+GRANT ALL ON FUNCTION graphql.exception(message text) TO anon;
+GRANT ALL ON FUNCTION graphql.exception(message text) TO authenticated;
+GRANT ALL ON FUNCTION graphql.exception(message text) TO service_role;
+
+
+--
+-- Name: FUNCTION get_schema_version(); Type: ACL; Schema: graphql; Owner: supabase_admin
+--
+
+GRANT ALL ON FUNCTION graphql.get_schema_version() TO postgres;
+GRANT ALL ON FUNCTION graphql.get_schema_version() TO anon;
+GRANT ALL ON FUNCTION graphql.get_schema_version() TO authenticated;
+GRANT ALL ON FUNCTION graphql.get_schema_version() TO service_role;
+
+
+--
+-- Name: FUNCTION increment_schema_version(); Type: ACL; Schema: graphql; Owner: supabase_admin
+--
+
+GRANT ALL ON FUNCTION graphql.increment_schema_version() TO postgres;
+GRANT ALL ON FUNCTION graphql.increment_schema_version() TO anon;
+GRANT ALL ON FUNCTION graphql.increment_schema_version() TO authenticated;
+GRANT ALL ON FUNCTION graphql.increment_schema_version() TO service_role;
+
+
+--
+-- Name: FUNCTION sequential_executor(prepared_statement_names text[]); Type: ACL; Schema: graphql; Owner: supabase_admin
+--
+
+GRANT ALL ON FUNCTION graphql.sequential_executor(prepared_statement_names text[]) TO postgres;
+GRANT ALL ON FUNCTION graphql.sequential_executor(prepared_statement_names text[]) TO anon;
+GRANT ALL ON FUNCTION graphql.sequential_executor(prepared_statement_names text[]) TO authenticated;
+GRANT ALL ON FUNCTION graphql.sequential_executor(prepared_statement_names text[]) TO service_role;
+
+
+--
+-- Name: FUNCTION graphql("operationName" text, query text, variables jsonb, extensions jsonb); Type: ACL; Schema: graphql_public; Owner: supabase_admin
+--
+
+-- GRANT ALL ON FUNCTION graphql_public.graphql("operationName" text, query text, variables jsonb, extensions jsonb) TO postgres;
+-- GRANT ALL ON FUNCTION graphql_public.graphql("operationName" text, query text, variables jsonb, extensions jsonb) TO anon;
+-- GRANT ALL ON FUNCTION graphql_public.graphql("operationName" text, query text, variables jsonb, extensions jsonb) TO authenticated;
+-- GRANT ALL ON FUNCTION graphql_public.graphql("operationName" text, query text, variables jsonb, extensions jsonb) TO service_role;
+
+
+--
+-- Name: FUNCTION http_collect_response(request_id bigint, async boolean); Type: ACL; Schema: net; Owner: supabase_admin
+--
+
+REVOKE ALL ON FUNCTION net.http_collect_response(request_id bigint, async boolean) FROM PUBLIC;
+GRANT ALL ON FUNCTION net.http_collect_response(request_id bigint, async boolean) TO supabase_functions_admin;
+GRANT ALL ON FUNCTION net.http_collect_response(request_id bigint, async boolean) TO postgres;
+GRANT ALL ON FUNCTION net.http_collect_response(request_id bigint, async boolean) TO anon;
+GRANT ALL ON FUNCTION net.http_collect_response(request_id bigint, async boolean) TO authenticated;
+GRANT ALL ON FUNCTION net.http_collect_response(request_id bigint, async boolean) TO service_role;
+
+
+--
+-- Name: FUNCTION http_get(url text, params jsonb, headers jsonb, timeout_milliseconds integer); Type: ACL; Schema: net; Owner: supabase_admin
+--
+
+REVOKE ALL ON FUNCTION net.http_get(url text, params jsonb, headers jsonb, timeout_milliseconds integer) FROM PUBLIC;
+GRANT ALL ON FUNCTION net.http_get(url text, params jsonb, headers jsonb, timeout_milliseconds integer) TO supabase_functions_admin;
+GRANT ALL ON FUNCTION net.http_get(url text, params jsonb, headers jsonb, timeout_milliseconds integer) TO postgres;
+GRANT ALL ON FUNCTION net.http_get(url text, params jsonb, headers jsonb, timeout_milliseconds integer) TO anon;
+GRANT ALL ON FUNCTION net.http_get(url text, params jsonb, headers jsonb, timeout_milliseconds integer) TO authenticated;
+GRANT ALL ON FUNCTION net.http_get(url text, params jsonb, headers jsonb, timeout_milliseconds integer) TO service_role;
+
+
+--
+-- Name: FUNCTION http_post(url text, body jsonb, params jsonb, headers jsonb, timeout_milliseconds integer); Type: ACL; Schema: net; Owner: supabase_admin
+--
+
+REVOKE ALL ON FUNCTION net.http_post(url text, body jsonb, params jsonb, headers jsonb, timeout_milliseconds integer) FROM PUBLIC;
+GRANT ALL ON FUNCTION net.http_post(url text, body jsonb, params jsonb, headers jsonb, timeout_milliseconds integer) TO supabase_functions_admin;
+GRANT ALL ON FUNCTION net.http_post(url text, body jsonb, params jsonb, headers jsonb, timeout_milliseconds integer) TO postgres;
+GRANT ALL ON FUNCTION net.http_post(url text, body jsonb, params jsonb, headers jsonb, timeout_milliseconds integer) TO anon;
+GRANT ALL ON FUNCTION net.http_post(url text, body jsonb, params jsonb, headers jsonb, timeout_milliseconds integer) TO authenticated;
+GRANT ALL ON FUNCTION net.http_post(url text, body jsonb, params jsonb, headers jsonb, timeout_milliseconds integer) TO service_role;
+
+
+--
+-- Name: FUNCTION get_auth(p_usename text); Type: ACL; Schema: pgbouncer; Owner: postgres
+--
+
+REVOKE ALL ON FUNCTION pgbouncer.get_auth(p_usename text) FROM PUBLIC;
+GRANT ALL ON FUNCTION pgbouncer.get_auth(p_usename text) TO pgbouncer;
+
+
+--
+-- Name: SEQUENCE key_key_id_seq; Type: ACL; Schema: pgsodium; Owner: postgres
+--
+
+GRANT ALL ON SEQUENCE pgsodium.key_key_id_seq TO pgsodium_keyiduser;
+
+
+--
+-- Name: FUNCTION extension(name text); Type: ACL; Schema: storage; Owner: supabase_storage_admin
+--
+
+GRANT ALL ON FUNCTION storage.extension(name text) TO anon;
+GRANT ALL ON FUNCTION storage.extension(name text) TO authenticated;
+GRANT ALL ON FUNCTION storage.extension(name text) TO service_role;
+GRANT ALL ON FUNCTION storage.extension(name text) TO dashboard_user;
+GRANT ALL ON FUNCTION storage.extension(name text) TO postgres;
+
+
+--
+-- Name: FUNCTION filename(name text); Type: ACL; Schema: storage; Owner: supabase_storage_admin
+--
+
+GRANT ALL ON FUNCTION storage.filename(name text) TO anon;
+GRANT ALL ON FUNCTION storage.filename(name text) TO authenticated;
+GRANT ALL ON FUNCTION storage.filename(name text) TO service_role;
+GRANT ALL ON FUNCTION storage.filename(name text) TO dashboard_user;
+GRANT ALL ON FUNCTION storage.filename(name text) TO postgres;
+
+
+--
+-- Name: FUNCTION foldername(name text); Type: ACL; Schema: storage; Owner: supabase_storage_admin
+--
+
+GRANT ALL ON FUNCTION storage.foldername(name text) TO anon;
+GRANT ALL ON FUNCTION storage.foldername(name text) TO authenticated;
+GRANT ALL ON FUNCTION storage.foldername(name text) TO service_role;
+GRANT ALL ON FUNCTION storage.foldername(name text) TO dashboard_user;
+GRANT ALL ON FUNCTION storage.foldername(name text) TO postgres;
+
+
+--
+-- Name: FUNCTION http_request(); Type: ACL; Schema: supabase_functions; Owner: supabase_functions_admin
+--
+
+REVOKE ALL ON FUNCTION supabase_functions.http_request() FROM PUBLIC;
+GRANT ALL ON FUNCTION supabase_functions.http_request() TO postgres;
+GRANT ALL ON FUNCTION supabase_functions.http_request() TO anon;
+GRANT ALL ON FUNCTION supabase_functions.http_request() TO authenticated;
+GRANT ALL ON FUNCTION supabase_functions.http_request() TO service_role;
+
+
+--
+-- Name: TABLE audit_log_entries; Type: ACL; Schema: auth; Owner: supabase_auth_admin
+--
+
+GRANT ALL ON TABLE auth.audit_log_entries TO dashboard_user;
+GRANT ALL ON TABLE auth.audit_log_entries TO postgres;
+
+
+--
+-- Name: TABLE flow_state; Type: ACL; Schema: auth; Owner: supabase_auth_admin
+--
+
+GRANT ALL ON TABLE auth.flow_state TO postgres;
+GRANT ALL ON TABLE auth.flow_state TO dashboard_user;
+
+
+--
+-- Name: TABLE identities; Type: ACL; Schema: auth; Owner: supabase_auth_admin
+--
+
+GRANT ALL ON TABLE auth.identities TO postgres;
+GRANT ALL ON TABLE auth.identities TO dashboard_user;
+
+
+--
+-- Name: TABLE instances; Type: ACL; Schema: auth; Owner: supabase_auth_admin
+--
+
+GRANT ALL ON TABLE auth.instances TO dashboard_user;
+GRANT ALL ON TABLE auth.instances TO postgres;
+
+
+--
+-- Name: TABLE mfa_amr_claims; Type: ACL; Schema: auth; Owner: supabase_auth_admin
+--
+
+GRANT ALL ON TABLE auth.mfa_amr_claims TO postgres;
+GRANT ALL ON TABLE auth.mfa_amr_claims TO dashboard_user;
+
+
+--
+-- Name: TABLE mfa_challenges; Type: ACL; Schema: auth; Owner: supabase_auth_admin
+--
+
+GRANT ALL ON TABLE auth.mfa_challenges TO postgres;
+GRANT ALL ON TABLE auth.mfa_challenges TO dashboard_user;
+
+
+--
+-- Name: TABLE mfa_factors; Type: ACL; Schema: auth; Owner: supabase_auth_admin
+--
+
+GRANT ALL ON TABLE auth.mfa_factors TO postgres;
+GRANT ALL ON TABLE auth.mfa_factors TO dashboard_user;
+
+
+--
+-- Name: TABLE refresh_tokens; Type: ACL; Schema: auth; Owner: supabase_auth_admin
+--
+
+GRANT ALL ON TABLE auth.refresh_tokens TO dashboard_user;
+GRANT ALL ON TABLE auth.refresh_tokens TO postgres;
+
+
+--
+-- Name: SEQUENCE refresh_tokens_id_seq; Type: ACL; Schema: auth; Owner: supabase_auth_admin
+--
+
+GRANT ALL ON SEQUENCE auth.refresh_tokens_id_seq TO dashboard_user;
+GRANT ALL ON SEQUENCE auth.refresh_tokens_id_seq TO postgres;
+
+
+--
+-- Name: TABLE saml_providers; Type: ACL; Schema: auth; Owner: supabase_auth_admin
+--
+
+GRANT ALL ON TABLE auth.saml_providers TO postgres;
+GRANT ALL ON TABLE auth.saml_providers TO dashboard_user;
+
+
+--
+-- Name: TABLE saml_relay_states; Type: ACL; Schema: auth; Owner: supabase_auth_admin
+--
+
+GRANT ALL ON TABLE auth.saml_relay_states TO postgres;
+GRANT ALL ON TABLE auth.saml_relay_states TO dashboard_user;
+
+
+--
+-- Name: TABLE schema_migrations; Type: ACL; Schema: auth; Owner: supabase_auth_admin
+--
+
+GRANT ALL ON TABLE auth.schema_migrations TO dashboard_user;
+GRANT ALL ON TABLE auth.schema_migrations TO postgres;
+
+
+--
+-- Name: TABLE sessions; Type: ACL; Schema: auth; Owner: supabase_auth_admin
+--
+
+GRANT ALL ON TABLE auth.sessions TO postgres;
+GRANT ALL ON TABLE auth.sessions TO dashboard_user;
+
+
+--
+-- Name: TABLE sso_domains; Type: ACL; Schema: auth; Owner: supabase_auth_admin
+--
+
+GRANT ALL ON TABLE auth.sso_domains TO postgres;
+GRANT ALL ON TABLE auth.sso_domains TO dashboard_user;
+
+
+--
+-- Name: TABLE sso_providers; Type: ACL; Schema: auth; Owner: supabase_auth_admin
+--
+
+GRANT ALL ON TABLE auth.sso_providers TO postgres;
+GRANT ALL ON TABLE auth.sso_providers TO dashboard_user;
+
+
+--
+-- Name: TABLE users; Type: ACL; Schema: auth; Owner: supabase_auth_admin
+--
+
+GRANT ALL ON TABLE auth.users TO dashboard_user;
+GRANT ALL ON TABLE auth.users TO postgres;
+
+
+--
+-- Name: TABLE pg_stat_statements; Type: ACL; Schema: extensions; Owner: postgres
+--
+
+GRANT ALL ON TABLE extensions.pg_stat_statements TO dashboard_user;
+
+
+--
+-- Name: TABLE pg_stat_statements_info; Type: ACL; Schema: extensions; Owner: postgres
+--
+
+GRANT ALL ON TABLE extensions.pg_stat_statements_info TO dashboard_user;
+
+
+--
+-- Name: SEQUENCE seq_schema_version; Type: ACL; Schema: graphql; Owner: supabase_admin
+--
+
+GRANT ALL ON SEQUENCE graphql.seq_schema_version TO postgres;
+GRANT ALL ON SEQUENCE graphql.seq_schema_version TO anon;
+GRANT ALL ON SEQUENCE graphql.seq_schema_version TO authenticated;
+GRANT ALL ON SEQUENCE graphql.seq_schema_version TO service_role;
+
+
+--
+-- Name: TABLE valid_key; Type: ACL; Schema: pgsodium; Owner: postgres
+--
+
+GRANT ALL ON TABLE pgsodium.valid_key TO pgsodium_keyiduser;
+
+
+--
+-- Name: TABLE buckets; Type: ACL; Schema: storage; Owner: supabase_storage_admin
+--
+
+GRANT ALL ON TABLE storage.buckets TO anon;
+GRANT ALL ON TABLE storage.buckets TO authenticated;
+GRANT ALL ON TABLE storage.buckets TO service_role;
+GRANT ALL ON TABLE storage.buckets TO postgres;
+
+
+--
+-- Name: TABLE migrations; Type: ACL; Schema: storage; Owner: supabase_storage_admin
+--
+
+GRANT ALL ON TABLE storage.migrations TO anon;
+GRANT ALL ON TABLE storage.migrations TO authenticated;
+GRANT ALL ON TABLE storage.migrations TO service_role;
+GRANT ALL ON TABLE storage.migrations TO postgres;
+
+
+--
+-- Name: TABLE objects; Type: ACL; Schema: storage; Owner: supabase_storage_admin
+--
+
+GRANT ALL ON TABLE storage.objects TO anon;
+GRANT ALL ON TABLE storage.objects TO authenticated;
+GRANT ALL ON TABLE storage.objects TO service_role;
+GRANT ALL ON TABLE storage.objects TO postgres;
+
+
+--
+-- Name: TABLE hooks; Type: ACL; Schema: supabase_functions; Owner: supabase_functions_admin
+--
+
+GRANT ALL ON TABLE supabase_functions.hooks TO postgres;
+GRANT ALL ON TABLE supabase_functions.hooks TO anon;
+GRANT ALL ON TABLE supabase_functions.hooks TO authenticated;
+GRANT ALL ON TABLE supabase_functions.hooks TO service_role;
+
+
+--
+-- Name: SEQUENCE hooks_id_seq; Type: ACL; Schema: supabase_functions; Owner: supabase_functions_admin
+--
+
+GRANT ALL ON SEQUENCE supabase_functions.hooks_id_seq TO postgres;
+GRANT ALL ON SEQUENCE supabase_functions.hooks_id_seq TO anon;
+GRANT ALL ON SEQUENCE supabase_functions.hooks_id_seq TO authenticated;
+GRANT ALL ON SEQUENCE supabase_functions.hooks_id_seq TO service_role;
+
+
+--
+-- Name: TABLE migrations; Type: ACL; Schema: supabase_functions; Owner: supabase_functions_admin
+--
+
+GRANT ALL ON TABLE supabase_functions.migrations TO postgres;
+GRANT ALL ON TABLE supabase_functions.migrations TO anon;
+GRANT ALL ON TABLE supabase_functions.migrations TO authenticated;
+GRANT ALL ON TABLE supabase_functions.migrations TO service_role;
+
+
+--
+-- Name: DEFAULT PRIVILEGES FOR SEQUENCES; Type: DEFAULT ACL; Schema: auth; Owner: supabase_auth_admin
+--
+
+ALTER DEFAULT PRIVILEGES FOR ROLE supabase_auth_admin IN SCHEMA auth GRANT ALL ON SEQUENCES  TO postgres;
+ALTER DEFAULT PRIVILEGES FOR ROLE supabase_auth_admin IN SCHEMA auth GRANT ALL ON SEQUENCES  TO dashboard_user;
+
+
+--
+-- Name: DEFAULT PRIVILEGES FOR FUNCTIONS; Type: DEFAULT ACL; Schema: auth; Owner: supabase_auth_admin
+--
+
+ALTER DEFAULT PRIVILEGES FOR ROLE supabase_auth_admin IN SCHEMA auth GRANT ALL ON FUNCTIONS  TO postgres;
+ALTER DEFAULT PRIVILEGES FOR ROLE supabase_auth_admin IN SCHEMA auth GRANT ALL ON FUNCTIONS  TO dashboard_user;
+
+
+--
+-- Name: DEFAULT PRIVILEGES FOR TABLES; Type: DEFAULT ACL; Schema: auth; Owner: supabase_auth_admin
+--
+
+ALTER DEFAULT PRIVILEGES FOR ROLE supabase_auth_admin IN SCHEMA auth GRANT ALL ON TABLES  TO postgres;
+ALTER DEFAULT PRIVILEGES FOR ROLE supabase_auth_admin IN SCHEMA auth GRANT ALL ON TABLES  TO dashboard_user;
+
+
+--
+-- Name: DEFAULT PRIVILEGES FOR SEQUENCES; Type: DEFAULT ACL; Schema: graphql; Owner: supabase_admin
+--
+
+ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA graphql GRANT ALL ON SEQUENCES  TO postgres;
+ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA graphql GRANT ALL ON SEQUENCES  TO anon;
+ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA graphql GRANT ALL ON SEQUENCES  TO authenticated;
+ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA graphql GRANT ALL ON SEQUENCES  TO service_role;
+
+
+--
+-- Name: DEFAULT PRIVILEGES FOR SEQUENCES; Type: DEFAULT ACL; Schema: graphql; Owner: postgres
+--
+
+ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA graphql GRANT ALL ON SEQUENCES  TO postgres;
+ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA graphql GRANT ALL ON SEQUENCES  TO anon;
+ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA graphql GRANT ALL ON SEQUENCES  TO authenticated;
+ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA graphql GRANT ALL ON SEQUENCES  TO service_role;
+
+
+--
+-- Name: DEFAULT PRIVILEGES FOR FUNCTIONS; Type: DEFAULT ACL; Schema: graphql; Owner: supabase_admin
+--
+
+ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA graphql GRANT ALL ON FUNCTIONS  TO postgres;
+ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA graphql GRANT ALL ON FUNCTIONS  TO anon;
+ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA graphql GRANT ALL ON FUNCTIONS  TO authenticated;
+ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA graphql GRANT ALL ON FUNCTIONS  TO service_role;
+
+
+--
+-- Name: DEFAULT PRIVILEGES FOR FUNCTIONS; Type: DEFAULT ACL; Schema: graphql; Owner: postgres
+--
+
+ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA graphql GRANT ALL ON FUNCTIONS  TO postgres;
+ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA graphql GRANT ALL ON FUNCTIONS  TO anon;
+ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA graphql GRANT ALL ON FUNCTIONS  TO authenticated;
+ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA graphql GRANT ALL ON FUNCTIONS  TO service_role;
+
+
+--
+-- Name: DEFAULT PRIVILEGES FOR TABLES; Type: DEFAULT ACL; Schema: graphql; Owner: supabase_admin
+--
+
+ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA graphql GRANT ALL ON TABLES  TO postgres;
+ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA graphql GRANT ALL ON TABLES  TO anon;
+ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA graphql GRANT ALL ON TABLES  TO authenticated;
+ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA graphql GRANT ALL ON TABLES  TO service_role;
+
+
+--
+-- Name: DEFAULT PRIVILEGES FOR TABLES; Type: DEFAULT ACL; Schema: graphql; Owner: postgres
+--
+
+ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA graphql GRANT ALL ON TABLES  TO postgres;
+ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA graphql GRANT ALL ON TABLES  TO anon;
+ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA graphql GRANT ALL ON TABLES  TO authenticated;
+ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA graphql GRANT ALL ON TABLES  TO service_role;
+
+
+--
+-- Name: DEFAULT PRIVILEGES FOR SEQUENCES; Type: DEFAULT ACL; Schema: graphql_public; Owner: supabase_admin
+--
+
+ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA graphql_public GRANT ALL ON SEQUENCES  TO postgres;
+ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA graphql_public GRANT ALL ON SEQUENCES  TO anon;
+ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA graphql_public GRANT ALL ON SEQUENCES  TO authenticated;
+ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA graphql_public GRANT ALL ON SEQUENCES  TO service_role;
+
+
+--
+-- Name: DEFAULT PRIVILEGES FOR FUNCTIONS; Type: DEFAULT ACL; Schema: graphql_public; Owner: supabase_admin
+--
+
+ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA graphql_public GRANT ALL ON FUNCTIONS  TO postgres;
+ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA graphql_public GRANT ALL ON FUNCTIONS  TO anon;
+ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA graphql_public GRANT ALL ON FUNCTIONS  TO authenticated;
+ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA graphql_public GRANT ALL ON FUNCTIONS  TO service_role;
+
+
+--
+-- Name: DEFAULT PRIVILEGES FOR TABLES; Type: DEFAULT ACL; Schema: graphql_public; Owner: supabase_admin
+--
+
+ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA graphql_public GRANT ALL ON TABLES  TO postgres;
+ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA graphql_public GRANT ALL ON TABLES  TO anon;
+ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA graphql_public GRANT ALL ON TABLES  TO authenticated;
+ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA graphql_public GRANT ALL ON TABLES  TO service_role;
+
+
+--
+-- Name: DEFAULT PRIVILEGES FOR SEQUENCES; Type: DEFAULT ACL; Schema: pgsodium; Owner: postgres
+--
+
+ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA pgsodium GRANT ALL ON SEQUENCES  TO pgsodium_keyiduser;
+
+
+--
+-- Name: DEFAULT PRIVILEGES FOR TABLES; Type: DEFAULT ACL; Schema: pgsodium; Owner: postgres
+--
+
+ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA pgsodium GRANT ALL ON TABLES  TO pgsodium_keyiduser;
+
+
+--
+-- Name: DEFAULT PRIVILEGES FOR SEQUENCES; Type: DEFAULT ACL; Schema: public; Owner: postgres
+--
+
+ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON SEQUENCES  TO postgres;
+ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON SEQUENCES  TO anon;
+ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON SEQUENCES  TO authenticated;
+ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON SEQUENCES  TO service_role;
+
+
+--
+-- Name: DEFAULT PRIVILEGES FOR SEQUENCES; Type: DEFAULT ACL; Schema: public; Owner: supabase_admin
+--
+
+ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON SEQUENCES  TO postgres;
+ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON SEQUENCES  TO anon;
+ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON SEQUENCES  TO authenticated;
+ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON SEQUENCES  TO service_role;
+
+
+--
+-- Name: DEFAULT PRIVILEGES FOR FUNCTIONS; Type: DEFAULT ACL; Schema: public; Owner: postgres
+--
+
+ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON FUNCTIONS  TO postgres;
+ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON FUNCTIONS  TO anon;
+ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON FUNCTIONS  TO authenticated;
+ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON FUNCTIONS  TO service_role;
+
+
+--
+-- Name: DEFAULT PRIVILEGES FOR FUNCTIONS; Type: DEFAULT ACL; Schema: public; Owner: supabase_admin
+--
+
+ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON FUNCTIONS  TO postgres;
+ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON FUNCTIONS  TO anon;
+ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON FUNCTIONS  TO authenticated;
+ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON FUNCTIONS  TO service_role;
+
+
+--
+-- Name: DEFAULT PRIVILEGES FOR TABLES; Type: DEFAULT ACL; Schema: public; Owner: postgres
+--
+
+ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON TABLES  TO postgres;
+ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON TABLES  TO anon;
+ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON TABLES  TO authenticated;
+ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON TABLES  TO service_role;
+
+
+--
+-- Name: DEFAULT PRIVILEGES FOR TABLES; Type: DEFAULT ACL; Schema: public; Owner: supabase_admin
+--
+
+ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON TABLES  TO postgres;
+ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON TABLES  TO anon;
+ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON TABLES  TO authenticated;
+ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON TABLES  TO service_role;
+
+
+--
+-- Name: DEFAULT PRIVILEGES FOR SEQUENCES; Type: DEFAULT ACL; Schema: realtime; Owner: supabase_admin
+--
+
+ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA realtime GRANT ALL ON SEQUENCES  TO postgres;
+ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA realtime GRANT ALL ON SEQUENCES  TO dashboard_user;
+
+
+--
+-- Name: DEFAULT PRIVILEGES FOR FUNCTIONS; Type: DEFAULT ACL; Schema: realtime; Owner: supabase_admin
+--
+
+ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA realtime GRANT ALL ON FUNCTIONS  TO postgres;
+ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA realtime GRANT ALL ON FUNCTIONS  TO dashboard_user;
+
+
+--
+-- Name: DEFAULT PRIVILEGES FOR TABLES; Type: DEFAULT ACL; Schema: realtime; Owner: supabase_admin
+--
+
+ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA realtime GRANT ALL ON TABLES  TO postgres;
+ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA realtime GRANT ALL ON TABLES  TO dashboard_user;
+
+
+--
+-- Name: DEFAULT PRIVILEGES FOR SEQUENCES; Type: DEFAULT ACL; Schema: storage; Owner: postgres
+--
+
+ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA storage GRANT ALL ON SEQUENCES  TO postgres;
+ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA storage GRANT ALL ON SEQUENCES  TO anon;
+ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA storage GRANT ALL ON SEQUENCES  TO authenticated;
+ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA storage GRANT ALL ON SEQUENCES  TO service_role;
+
+
+--
+-- Name: DEFAULT PRIVILEGES FOR FUNCTIONS; Type: DEFAULT ACL; Schema: storage; Owner: postgres
+--
+
+ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA storage GRANT ALL ON FUNCTIONS  TO postgres;
+ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA storage GRANT ALL ON FUNCTIONS  TO anon;
+ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA storage GRANT ALL ON FUNCTIONS  TO authenticated;
+ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA storage GRANT ALL ON FUNCTIONS  TO service_role;
+
+
+--
+-- Name: DEFAULT PRIVILEGES FOR TABLES; Type: DEFAULT ACL; Schema: storage; Owner: postgres
+--
+
+ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA storage GRANT ALL ON TABLES  TO postgres;
+ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA storage GRANT ALL ON TABLES  TO anon;
+ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA storage GRANT ALL ON TABLES  TO authenticated;
+ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA storage GRANT ALL ON TABLES  TO service_role;
+
+
+--
+-- Name: DEFAULT PRIVILEGES FOR SEQUENCES; Type: DEFAULT ACL; Schema: supabase_functions; Owner: supabase_admin
+--
+
+ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA supabase_functions GRANT ALL ON SEQUENCES  TO postgres;
+ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA supabase_functions GRANT ALL ON SEQUENCES  TO anon;
+ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA supabase_functions GRANT ALL ON SEQUENCES  TO authenticated;
+ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA supabase_functions GRANT ALL ON SEQUENCES  TO service_role;
+
+
+--
+-- Name: DEFAULT PRIVILEGES FOR FUNCTIONS; Type: DEFAULT ACL; Schema: supabase_functions; Owner: supabase_admin
+--
+
+ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA supabase_functions GRANT ALL ON FUNCTIONS  TO postgres;
+ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA supabase_functions GRANT ALL ON FUNCTIONS  TO anon;
+ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA supabase_functions GRANT ALL ON FUNCTIONS  TO authenticated;
+ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA supabase_functions GRANT ALL ON FUNCTIONS  TO service_role;
+
+
+--
+-- Name: DEFAULT PRIVILEGES FOR TABLES; Type: DEFAULT ACL; Schema: supabase_functions; Owner: supabase_admin
+--
+
+ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA supabase_functions GRANT ALL ON TABLES  TO postgres;
+ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA supabase_functions GRANT ALL ON TABLES  TO anon;
+ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA supabase_functions GRANT ALL ON TABLES  TO authenticated;
+ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA supabase_functions GRANT ALL ON TABLES  TO service_role;
+
+
+--
+-- Name: issue_graphql_placeholder; Type: EVENT TRIGGER; Schema: -; Owner: supabase_admin
+--
+
+CREATE EVENT TRIGGER issue_graphql_placeholder ON sql_drop
+         WHEN TAG IN ('DROP EXTENSION')
+   EXECUTE FUNCTION extensions.set_graphql_placeholder();
+
+
+ALTER EVENT TRIGGER issue_graphql_placeholder OWNER TO supabase_admin;
+
+--
+-- Name: issue_pg_cron_access; Type: EVENT TRIGGER; Schema: -; Owner: supabase_admin
+--
+
+CREATE EVENT TRIGGER issue_pg_cron_access ON ddl_command_end
+         WHEN TAG IN ('CREATE SCHEMA')
+   EXECUTE FUNCTION extensions.grant_pg_cron_access();
+
+
+ALTER EVENT TRIGGER issue_pg_cron_access OWNER TO supabase_admin;
+
+--
+-- Name: issue_pg_graphql_access; Type: EVENT TRIGGER; Schema: -; Owner: supabase_admin
+--
+
+CREATE EVENT TRIGGER issue_pg_graphql_access ON ddl_command_end
+         WHEN TAG IN ('CREATE FUNCTION')
+   EXECUTE FUNCTION extensions.grant_pg_graphql_access();
+
+
+ALTER EVENT TRIGGER issue_pg_graphql_access OWNER TO supabase_admin;
+
+--
+-- Name: issue_pg_net_access; Type: EVENT TRIGGER; Schema: -; Owner: supabase_admin
+--
+
+CREATE EVENT TRIGGER issue_pg_net_access ON ddl_command_end
+         WHEN TAG IN ('CREATE EXTENSION')
+   EXECUTE FUNCTION extensions.grant_pg_net_access();
+
+
+ALTER EVENT TRIGGER issue_pg_net_access OWNER TO supabase_admin;
+
+--
+-- Name: pgrst_ddl_watch; Type: EVENT TRIGGER; Schema: -; Owner: supabase_admin
+--
+
+CREATE EVENT TRIGGER pgrst_ddl_watch ON ddl_command_end
+   EXECUTE FUNCTION extensions.pgrst_ddl_watch();
+
+
+ALTER EVENT TRIGGER pgrst_ddl_watch OWNER TO supabase_admin;
+
+--
+-- Name: pgrst_drop_watch; Type: EVENT TRIGGER; Schema: -; Owner: supabase_admin
+--
+
+CREATE EVENT TRIGGER pgrst_drop_watch ON sql_drop
+   EXECUTE FUNCTION extensions.pgrst_drop_watch();
+
+
+ALTER EVENT TRIGGER pgrst_drop_watch OWNER TO supabase_admin;
+
+--
+-- PostgreSQL database dump complete
+--
+
+DROP EXTENSION pg_graphql; CREATE EXTENSION pg_graphql WITH SCHEMA graphql;
+RESET ALL;
+`;
diff --git a/apps/cli/src/legacy/commands/start/templates/db-schema.sql.ts b/apps/cli/src/legacy/commands/start/templates/db-schema.sql.ts
new file mode 100644
index 0000000000..57900f5d82
--- /dev/null
+++ b/apps/cli/src/legacy/commands/start/templates/db-schema.sql.ts
@@ -0,0 +1,25 @@
+/**
+ * Transcribed verbatim from `apps/cli-go/internal/db/start/templates/schema.sql`
+ * (Go `//go:embed templates/schema.sql`, `apps/cli-go/internal/db/start/start.go:33-35`).
+ * Not a Go `text/template` — embedded byte-for-byte into the Postgres
+ * container's entrypoint heredoc (`NewContainerConfig`, `start.go:63-116`) for
+ * PG >= 15. Do not hand-edit — re-transcribe from the Go source if it changes.
+ */
+export const LEGACY_START_DB_SCHEMA_SQL = `\\set pgpass \`echo "$PGPASSWORD"\`
+\\set jwt_secret \`echo "$JWT_SECRET"\`
+\\set jwt_exp \`echo "$JWT_EXP"\`
+
+ALTER DATABASE postgres SET "app.settings.jwt_secret" TO :'jwt_secret';
+ALTER DATABASE postgres SET "app.settings.jwt_exp" TO :'jwt_exp';
+
+ALTER USER postgres WITH PASSWORD :'pgpass';
+ALTER USER authenticator WITH PASSWORD :'pgpass';
+ALTER USER pgbouncer WITH PASSWORD :'pgpass';
+ALTER USER supabase_auth_admin WITH PASSWORD :'pgpass';
+ALTER USER supabase_storage_admin WITH PASSWORD :'pgpass';
+ALTER USER supabase_replication_admin WITH PASSWORD :'pgpass';
+ALTER USER supabase_read_only_user WITH PASSWORD :'pgpass';
+
+create schema if not exists _realtime;
+alter schema _realtime owner to postgres;
+`;
diff --git a/apps/cli/src/legacy/commands/start/templates/db-supabase.sql.ts b/apps/cli/src/legacy/commands/start/templates/db-supabase.sql.ts
new file mode 100644
index 0000000000..09638c094a
--- /dev/null
+++ b/apps/cli/src/legacy/commands/start/templates/db-supabase.sql.ts
@@ -0,0 +1,22 @@
+/**
+ * Transcribed verbatim from `apps/cli-go/internal/db/start/templates/_supabase.sql`
+ * (Go `//go:embed templates/_supabase.sql`, `apps/cli-go/internal/db/start/start.go:38-39`).
+ * Not a Go `text/template` — embedded byte-for-byte into the Postgres
+ * container's entrypoint heredoc (`NewContainerConfig`, `start.go:63-116`), for
+ * both the PG >= 15 and PG <= 14 branches. Do not hand-edit — re-transcribe
+ * from the Go source if it changes.
+ */
+export const LEGACY_START_DB_SUPABASE_SQL = `CREATE DATABASE _supabase WITH OWNER postgres;
+
+-- Switch to the newly created _supabase database
+\\c _supabase
+-- Create schemas in _supabase database for
+-- internals tools and reports to not overload user database
+-- with non-user activity
+CREATE SCHEMA IF NOT EXISTS _analytics;
+ALTER SCHEMA _analytics OWNER TO postgres;
+
+CREATE SCHEMA IF NOT EXISTS _supavisor;
+ALTER SCHEMA _supavisor OWNER TO postgres;
+\\c postgres
+`;
diff --git a/apps/cli/src/legacy/commands/start/templates/db-webhook.sql.ts b/apps/cli/src/legacy/commands/start/templates/db-webhook.sql.ts
new file mode 100644
index 0000000000..5aa85e84a5
--- /dev/null
+++ b/apps/cli/src/legacy/commands/start/templates/db-webhook.sql.ts
@@ -0,0 +1,240 @@
+/**
+ * Transcribed verbatim from `apps/cli-go/internal/db/start/templates/webhook.sql`
+ * (Go `//go:embed templates/webhook.sql`, `apps/cli-go/internal/db/start/start.go:36-37`).
+ * Not a Go `text/template` — embedded byte-for-byte into the Postgres
+ * container's entrypoint heredoc (`NewContainerConfig`, `start.go:63-116`) for
+ * PG >= 15 only. Do not hand-edit — re-transcribe from the Go source if it changes.
+ */
+export const LEGACY_START_DB_WEBHOOK_SQL = `BEGIN;
+
+-- Create pg_net extension
+CREATE EXTENSION IF NOT EXISTS pg_net SCHEMA extensions;
+
+-- Create supabase_functions schema
+CREATE SCHEMA supabase_functions AUTHORIZATION supabase_admin;
+
+GRANT USAGE ON SCHEMA supabase_functions TO postgres, anon, authenticated, service_role;
+ALTER DEFAULT PRIVILEGES IN SCHEMA supabase_functions GRANT ALL ON TABLES TO postgres, anon, authenticated, service_role;
+ALTER DEFAULT PRIVILEGES IN SCHEMA supabase_functions GRANT ALL ON FUNCTIONS TO postgres, anon, authenticated, service_role;
+ALTER DEFAULT PRIVILEGES IN SCHEMA supabase_functions GRANT ALL ON SEQUENCES TO postgres, anon, authenticated, service_role;
+
+-- supabase_functions.migrations definition
+CREATE TABLE supabase_functions.migrations (
+  version text PRIMARY KEY,
+  inserted_at timestamptz NOT NULL DEFAULT NOW()
+);
+
+-- Initial supabase_functions migration
+INSERT INTO supabase_functions.migrations (version) VALUES ('initial');
+
+-- supabase_functions.hooks definition
+CREATE TABLE supabase_functions.hooks (
+  id bigserial PRIMARY KEY,
+  hook_table_id integer NOT NULL,
+  hook_name text NOT NULL,
+  created_at timestamptz NOT NULL DEFAULT NOW(),
+  request_id bigint
+);
+CREATE INDEX supabase_functions_hooks_request_id_idx ON supabase_functions.hooks USING btree (request_id);
+CREATE INDEX supabase_functions_hooks_h_table_id_h_name_idx ON supabase_functions.hooks USING btree (hook_table_id, hook_name);
+COMMENT ON TABLE supabase_functions.hooks IS 'Supabase Functions Hooks: Audit trail for triggered hooks.';
+
+CREATE FUNCTION supabase_functions.http_request()
+  RETURNS trigger
+  LANGUAGE plpgsql
+  AS $function$
+  DECLARE
+    request_id bigint;
+    payload jsonb;
+    url text := TG_ARGV[0]::text;
+    method text := TG_ARGV[1]::text;
+    headers jsonb DEFAULT '{}'::jsonb;
+    params jsonb DEFAULT '{}'::jsonb;
+    timeout_ms integer DEFAULT 1000;
+  BEGIN
+    IF url IS NULL OR url = 'null' THEN
+      RAISE EXCEPTION 'url argument is missing';
+    END IF;
+
+    IF method IS NULL OR method = 'null' THEN
+      RAISE EXCEPTION 'method argument is missing';
+    END IF;
+
+    IF TG_ARGV[2] IS NULL OR TG_ARGV[2] = 'null' THEN
+      headers = '{"Content-Type": "application/json"}'::jsonb;
+    ELSE
+      headers = TG_ARGV[2]::jsonb;
+    END IF;
+
+    IF TG_ARGV[3] IS NULL OR TG_ARGV[3] = 'null' THEN
+      params = '{}'::jsonb;
+    ELSE
+      params = TG_ARGV[3]::jsonb;
+    END IF;
+
+    IF TG_ARGV[4] IS NULL OR TG_ARGV[4] = 'null' THEN
+      timeout_ms = 1000;
+    ELSE
+      timeout_ms = TG_ARGV[4]::integer;
+    END IF;
+
+    CASE
+      WHEN method = 'GET' THEN
+        SELECT http_get INTO request_id FROM net.http_get(
+          url,
+          params,
+          headers,
+          timeout_ms
+        );
+      WHEN method = 'POST' THEN
+        payload = jsonb_build_object(
+          'old_record', OLD,
+          'record', NEW,
+          'type', TG_OP,
+          'table', TG_TABLE_NAME,
+          'schema', TG_TABLE_SCHEMA
+        );
+
+        SELECT http_post INTO request_id FROM net.http_post(
+          url,
+          payload,
+          params,
+          headers,
+          timeout_ms
+        );
+      ELSE
+        RAISE EXCEPTION 'method argument % is invalid', method;
+    END CASE;
+
+    INSERT INTO supabase_functions.hooks
+      (hook_table_id, hook_name, request_id)
+    VALUES
+      (TG_RELID, TG_NAME, request_id);
+
+    RETURN NEW;
+  END
+$function$;
+
+-- Supabase super admin
+DO
+$$
+BEGIN
+  IF NOT EXISTS (
+    SELECT 1
+    FROM pg_roles
+    WHERE rolname = 'supabase_functions_admin'
+  )
+  THEN
+    CREATE USER supabase_functions_admin NOINHERIT CREATEROLE LOGIN NOREPLICATION;
+  END IF;
+END
+$$;
+
+GRANT ALL PRIVILEGES ON SCHEMA supabase_functions TO supabase_functions_admin;
+GRANT ALL PRIVILEGES ON ALL TABLES IN SCHEMA supabase_functions TO supabase_functions_admin;
+GRANT ALL PRIVILEGES ON ALL SEQUENCES IN SCHEMA supabase_functions TO supabase_functions_admin;
+ALTER USER supabase_functions_admin SET search_path = "supabase_functions";
+ALTER table "supabase_functions".migrations OWNER TO supabase_functions_admin;
+ALTER table "supabase_functions".hooks OWNER TO supabase_functions_admin;
+ALTER function "supabase_functions".http_request() OWNER TO supabase_functions_admin;
+GRANT supabase_functions_admin TO postgres;
+
+-- Remove unused supabase_pg_net_admin role
+DO
+$$
+BEGIN
+  IF EXISTS (
+    SELECT 1
+    FROM pg_roles
+    WHERE rolname = 'supabase_pg_net_admin'
+  )
+  THEN
+    REASSIGN OWNED BY supabase_pg_net_admin TO supabase_admin;
+    DROP OWNED BY supabase_pg_net_admin;
+    DROP ROLE supabase_pg_net_admin;
+  END IF;
+END
+$$;
+
+-- pg_net grants when extension is already enabled
+DO
+$$
+BEGIN
+  IF EXISTS (
+    SELECT 1
+    FROM pg_extension
+    WHERE extname = 'pg_net'
+  )
+  THEN
+    GRANT USAGE ON SCHEMA net TO supabase_functions_admin, postgres, anon, authenticated, service_role;
+
+    ALTER function net.http_get(url text, params jsonb, headers jsonb, timeout_milliseconds integer) SECURITY DEFINER;
+    ALTER function net.http_post(url text, body jsonb, params jsonb, headers jsonb, timeout_milliseconds integer) SECURITY DEFINER;
+
+    ALTER function net.http_get(url text, params jsonb, headers jsonb, timeout_milliseconds integer) SET search_path = net;
+    ALTER function net.http_post(url text, body jsonb, params jsonb, headers jsonb, timeout_milliseconds integer) SET search_path = net;
+
+    REVOKE ALL ON FUNCTION net.http_get(url text, params jsonb, headers jsonb, timeout_milliseconds integer) FROM PUBLIC;
+    REVOKE ALL ON FUNCTION net.http_post(url text, body jsonb, params jsonb, headers jsonb, timeout_milliseconds integer) FROM PUBLIC;
+
+    GRANT EXECUTE ON FUNCTION net.http_get(url text, params jsonb, headers jsonb, timeout_milliseconds integer) TO supabase_functions_admin, postgres, anon, authenticated, service_role;
+    GRANT EXECUTE ON FUNCTION net.http_post(url text, body jsonb, params jsonb, headers jsonb, timeout_milliseconds integer) TO supabase_functions_admin, postgres, anon, authenticated, service_role;
+  END IF;
+END
+$$;
+
+-- Event trigger for pg_net
+CREATE OR REPLACE FUNCTION extensions.grant_pg_net_access()
+RETURNS event_trigger
+LANGUAGE plpgsql
+AS $$
+BEGIN
+  IF EXISTS (
+    SELECT 1
+    FROM pg_event_trigger_ddl_commands() AS ev
+    JOIN pg_extension AS ext
+    ON ev.objid = ext.oid
+    WHERE ext.extname = 'pg_net'
+  )
+  THEN
+    GRANT USAGE ON SCHEMA net TO supabase_functions_admin, postgres, anon, authenticated, service_role;
+
+    ALTER function net.http_get(url text, params jsonb, headers jsonb, timeout_milliseconds integer) SECURITY DEFINER;
+    ALTER function net.http_post(url text, body jsonb, params jsonb, headers jsonb, timeout_milliseconds integer) SECURITY DEFINER;
+
+    ALTER function net.http_get(url text, params jsonb, headers jsonb, timeout_milliseconds integer) SET search_path = net;
+    ALTER function net.http_post(url text, body jsonb, params jsonb, headers jsonb, timeout_milliseconds integer) SET search_path = net;
+
+    REVOKE ALL ON FUNCTION net.http_get(url text, params jsonb, headers jsonb, timeout_milliseconds integer) FROM PUBLIC;
+    REVOKE ALL ON FUNCTION net.http_post(url text, body jsonb, params jsonb, headers jsonb, timeout_milliseconds integer) FROM PUBLIC;
+
+    GRANT EXECUTE ON FUNCTION net.http_get(url text, params jsonb, headers jsonb, timeout_milliseconds integer) TO supabase_functions_admin, postgres, anon, authenticated, service_role;
+    GRANT EXECUTE ON FUNCTION net.http_post(url text, body jsonb, params jsonb, headers jsonb, timeout_milliseconds integer) TO supabase_functions_admin, postgres, anon, authenticated, service_role;
+  END IF;
+END;
+$$;
+COMMENT ON FUNCTION extensions.grant_pg_net_access IS 'Grants access to pg_net';
+
+DO
+$$
+BEGIN
+  IF NOT EXISTS (
+    SELECT 1
+    FROM pg_event_trigger
+    WHERE evtname = 'issue_pg_net_access'
+  ) THEN
+    CREATE EVENT TRIGGER issue_pg_net_access ON ddl_command_end WHEN TAG IN ('CREATE EXTENSION')
+    EXECUTE PROCEDURE extensions.grant_pg_net_access();
+  END IF;
+END
+$$;
+
+INSERT INTO supabase_functions.migrations (version) VALUES ('20210809183423_update_grants');
+
+ALTER function supabase_functions.http_request() SECURITY DEFINER;
+ALTER function supabase_functions.http_request() SET search_path = supabase_functions;
+REVOKE ALL ON FUNCTION supabase_functions.http_request() FROM PUBLIC;
+GRANT EXECUTE ON FUNCTION supabase_functions.http_request() TO postgres, anon, authenticated, service_role;
+
+COMMIT;
+`;
diff --git a/apps/cli/src/legacy/commands/start/templates/kong-local-tls.ts b/apps/cli/src/legacy/commands/start/templates/kong-local-tls.ts
new file mode 100644
index 0000000000..9334105c86
--- /dev/null
+++ b/apps/cli/src/legacy/commands/start/templates/kong-local-tls.ts
@@ -0,0 +1,23 @@
+/**
+ * Go's embedded default Kong TLS cert/key
+ * (`apps/cli-go/pkg/config/templates/certs/kong.local.{crt,key}`,
+ * `//go:embed`, `pkg/config/config.go:547-551`), seeded unconditionally onto
+ * `Api.Tls.{CertContent,KeyContent}` in `NewConfig` (`config.go:452-455`) —
+ * `Config.Validate` only overwrites them from disk when TLS is enabled AND
+ * both `api.tls.cert_path`/`key_path` are configured (`config.go:1010-1027`);
+ * otherwise this embedded pair survives untouched, and Kong's entrypoint
+ * always writes `CertContent`/`KeyContent` to `/home/kong/localhost.{crt,key}`
+ * regardless of `api.tls.enabled` (`start.go:585-601`) — only the published
+ * host port (8000 vs 8443) depends on that flag.
+ *
+ * A real (if long-expired-eventually, valid until 2034-07-03) self-signed
+ * `CN=localhost` cert/key pair — copied byte-for-byte (including the single
+ * trailing newline each source file ends with) from the Go source above.
+ * Must stay byte-identical to that source; do not reformat or re-wrap.
+ */
+
+export const LEGACY_KONG_LOCAL_TLS_CERT =
+  "-----BEGIN CERTIFICATE-----\nMIIFJTCCAw2gAwIBAgIURUQAFIOhttOg0D12xZvx+pScX4cwDQYJKoZIhvcNAQEL\nBQAwFDESMBAGA1UEAwwJbG9jYWxob3N0MB4XDTI0MDcwNTE0MjI1NFoXDTM0MDcw\nMzE0MjI1NFowFDESMBAGA1UEAwwJbG9jYWxob3N0MIICIjANBgkqhkiG9w0BAQEF\nAAOCAg8AMIICCgKCAgEAyL79RrCl78/XutDm7tVNyIJNZqbNSfX+3AsnP1dQc37Q\n7QkxmNJ2EmfklTLyvY1A+CY/o+3S1blK+O8lm40yTHP+GC30InKS7lSnCUNqSrHy\nDaGNShtphqJoao9vo69/anI6I2tKc8VQ2tebvMVzmjrsvGtWcU4ciyzbUterKQas\nIin8Aw5gDCLswVNZnl6wUvlcgbLmiTLPaJKnNsbYcBJxST2SFxY5q5YWzlugm9Q0\n3913XB64rVoKAyQ86Yabl4UXyVXknyJcbpfnsmn6ORxnZJebnuU0O9y8ys/E9hGw\n5rkVTm7QjzsbczMYOgvpPbR1miyDQaZ1bGyj9SmJo1H5e12xO0RNi+awuMnpt3cB\n8NeTsZctOgnEQB1Gidq2XcYV48e2OGJTNtVVVPu1UKCNeJur1AfLNPRz8fJq06A+\nXy5xeRNGFsaeYRt/IO+/CZUOHcY/vR55i8PeeTj9cB1f9KjfmQVeOt25widxrhFK\nRkpRgA1ofQ4O8/gPSOcnroQgSs2Whr9RXIF71uSLJyZU0IBxru0cznuEpXxkh7oK\nFb6t/n1SZB2WEQXHh5iG49fw7MT29CzNpJIP1ApT3LKasHZHf4yBn9ZwVAagCGSL\nW7kMDhIUhOfVwpyfkXYHzQE2aaCdQ9IfZy9ybO/Y8sbUg6B5i5t8xODutv+fmd0C\nAwEAAaNvMG0wHQYDVR0OBBYEFGtw+BogdJ6GJRCe+BHGQdA0f85XMB8GA1UdIwQY\nMBaAFGtw+BogdJ6GJRCe+BHGQdA0f85XMA8GA1UdEwEB/wQFMAMBAf8wGgYDVR0R\nBBMwEYIJbG9jYWxob3N0hwR/AAABMA0GCSqGSIb3DQEBCwUAA4ICAQCO9ITlkXil\n+dLTddpSq06UuRTYLx8vWGLnd8uEoUg4qlLKi/hKnqTEP9dePw+QeuIM+aLjvvXY\nbP4SqBOUi192OohQs7ZPCpjXizmabDNl4/Z+qyiGvZK/N0gWPEaTn6tzeQ03hECK\nvY8lRrAP7xLrEYmA6unjfaj3inNUJeqL26i3SIAq/koK4jPm1F/AzwslNH00MJld\nxKormGzvNJtaZPr5xrtuLQAmeCotE6av+R5k9zmSYa25Nel50JTk31fNiuUFmECD\nqop+Yqfzw9/UkObDWw+g1+N3uHlH9CB2RvfkB2fW9SFMsznjQlq+MyQCwKFs699Q\nrNMeHbUEwovDEcPUaLc3d5gCk/dvH9aR8mVLEcs7lMyHSsiG1Co1QXg6UjpMCrIV\nTvk+MrSQVVxw0rKS4H7ZEhfC2PfEVe1az24HrrPWJDZKnRhv1Ohj4jsxkBSprXsu\n3qxcMCr7yr4hjsu9BsKtmvRfHTrMOwY1WtZBcl7hjgAItfMs29Fd4Tkn0aZs5f+n\nGSwG5BeJL3kfEKwOjw8j+EAqRBu/7mbcoUyErnuLK7FimU4jtL8VX03n6nTgLJzS\nxjUTaplgerrazAvV31vMaiINoaGM0RDnGjSCgZT4Va33noqo3qVJJOnWpheFmaXq\nbUMQtwrAWTt12NECJt1nWAT4VWhfDoBE7A==\n-----END CERTIFICATE-----\n";
+
+export const LEGACY_KONG_LOCAL_TLS_KEY =
+  "-----BEGIN PRIVATE KEY-----\nMIIJQwIBADANBgkqhkiG9w0BAQEFAASCCS0wggkpAgEAAoICAQDIvv1GsKXvz9e6\n0Obu1U3Igk1mps1J9f7cCyc/V1BzftDtCTGY0nYSZ+SVMvK9jUD4Jj+j7dLVuUr4\n7yWbjTJMc/4YLfQicpLuVKcJQ2pKsfINoY1KG2mGomhqj2+jr39qcjoja0pzxVDa\n15u8xXOaOuy8a1ZxThyLLNtS16spBqwiKfwDDmAMIuzBU1meXrBS+VyBsuaJMs9o\nkqc2xthwEnFJPZIXFjmrlhbOW6Cb1DTf3XdcHritWgoDJDzphpuXhRfJVeSfIlxu\nl+eyafo5HGdkl5ue5TQ73LzKz8T2EbDmuRVObtCPOxtzMxg6C+k9tHWaLINBpnVs\nbKP1KYmjUfl7XbE7RE2L5rC4yem3dwHw15Oxly06CcRAHUaJ2rZdxhXjx7Y4YlM2\n1VVU+7VQoI14m6vUB8s09HPx8mrToD5fLnF5E0YWxp5hG38g778JlQ4dxj+9HnmL\nw955OP1wHV/0qN+ZBV463bnCJ3GuEUpGSlGADWh9Dg7z+A9I5yeuhCBKzZaGv1Fc\ngXvW5IsnJlTQgHGu7RzOe4SlfGSHugoVvq3+fVJkHZYRBceHmIbj1/DsxPb0LM2k\nkg/UClPcspqwdkd/jIGf1nBUBqAIZItbuQwOEhSE59XCnJ+RdgfNATZpoJ1D0h9n\nL3Js79jyxtSDoHmLm3zE4O62/5+Z3QIDAQABAoICAAnou5HYuGgtB0YWd7/EUbGb\nFP0DMND8zpbICijrQ3JgCSoaMRONF/zymervd+H5bgKRyMRrweOA4P2GuIGEJ750\nX0+MPSfSJgSTsycW59FGFV+s4M+OqNfXfnX8HJOk3xI/DzWeXy91xvb2e56G1J0B\nWZw3ZC31oB0SmsTtFmrRBIAvOFxiQkV3F963IY5auDNwUaupTA3rrydHTe+7QwXN\nM0BdRK/VDgW1Q+ztwvDOOcnvIawvbAhKkIH1MPiKB3YkQLdUgROF27At2WcKKirV\nhxkFDs56G+j0jXEpblyDJQtOiYm0mKDpVwKJvCFpYxsDpGZ22gfMkrFGb5VzdnK9\n6iMyz6eGCKBPd0I66nynZSfZwf+E3n0kGruBAEkTtGztyBxa1EUNul6uzv+Jw3No\no6cb5S7d/+4gFe6g1GoLMuWwtZyC7uXm0aZa64VgY713qkr1dDa5VHjLSs9+o2Jy\nLeV6t/9/gcSn7uqtT6kQomYtpYVuEevKt/Bwj/r9Lc+KfPwOUsl5h0zUMw7c+1cL\nNfCLadH1lpjB7AIiZwmKyGII4yiiIHSCZU8AKizJUvkW4TaPbtBhLkK6YYOJM+CY\nDondkhlnyINaDKyH247Bfl0Ju2yl7IS3s3KUHZGbK1dBc5wC1jW7cp7yA9ZGxk8X\n+5NIuozgp6Qd0swh/7XVAoIBAQD3wjJdMgqiuhveVY1tOpKa9mwdW/dSyY421Dvi\nXUOEhgWPyheu78aahF3qrhY5yqX4oh643R4qQrok+7wphigLelMboqqb9qM/NL8R\nm4jLvlHygHUQhrF8aGjRAKzfnOU0djpCLK1TJrvkxdZfo1ngzxfE9vo4OwtLcRuZ\nGMWZNTthUyXEIkw6e4yoJvpk+cb7+TvTnVMjuks5tqI4OgXQ0fYmRixImRg/6PTC\nQgsbG3FFxs71vrVJfcFmeymjq0gXHnviMDAgbqjnnHdqhsIauA0cByBfAQWrujUK\nN9sTy/Fwni3j8Lxin5HxP8cZxkr2p7ynG98sfGMZFoqGn8JLAoIBAQDPbHRfJz69\n5Os82zumYXfNQw0pfiKn8Jve+dw1i/gSzj8wb98sRZ9w9scY5KBFH1tG5UcWdYtv\nUJnUc1OO4mKmVpzrsQjS/qsGTPj2WkXEy3icoyJcDMFw6LBhctNHBwjtKL8Fe+ez\nEPHR+Sy7WuvJphZhm817VQXFK5AAmfYJbraI7B9Qm7uP7o1+pv94+886BxWi6Kqm\nwlEz+YhCQNPol5Lzth9/a3Ty0cwkaF5hG844Zu+feNWPdT7+nPs4QMWtCuQXD7cY\n/UVjyUp8R5lL35woVqTyh2DUbawnAgvy5VR/q6nvnnorBSS5CCEokFTbcC2+5g2s\ncquTixmnnzt3AoIBAEEAOApvWI782NbqByLDHTd+szq4qBiWPLNx1ww6f75DEy54\nTOJekfJ0C9fIOJiM7CJhFkJV8NYRj5ioWuNiCRuJykgT00L74DRy+DX8YlVh50oC\nHbRqQiJrmiRLUw+PsCqlYf9+jTKllOIebXHF/4yViJzqVxdtljcCw8TU1PKvHpcY\nI25juTAWvf5Xy5W2Wlg9OU75lZhoBdhsa/7oaiIxE61S98dMMyqBScW1YgiImJ0/\n3YhnslRHo/fpFDGWfGFkZAghsF6x6apqSIIwPLiZ1Qanb/y83eoB/mxh3x5AgWWU\nemG1BRey2a07mFbQyVYRB9On4lNfhvhMC6fqPiUCggEBAIWznv+GyIaW/JrppfWF\ndje1NNK+H5CpI5AC9tL9OhbFIy4RroVXC4NBTuzY0gY8RBXazIvJkOtbxQyQmhfM\nDVKzGctC/jEjPxJ8oy4I2lgT39b3wLoc7sPc+XSXE2EBQ9u7HAZo690c2wNB3neW\nD86XZG3ehAEvuNxzTAtXMqS53Kc9rKHFAI2yczpkYuCVT+pTjrrHxthfAQDDo/Uw\n3Gdc7LhzeLIljejHGxOMwulNhwwMLgFZXi9uoAB3J+gGuGTmVEgZNSjCeOvtYDnj\n3QhvRrUpxIEgimXjm8g5JYKYGHODL7LpME5yrk0m1FjVUB1yncojeETkVXxxeUP2\n+9kCggEBAMcsbVgvNVwt7bBf1zuw/AiXX4e3Lc2019M/z9SFsu6WfA+OgNMM90lQ\nEqq6XGhlNSDw+Zz8JDPq5RIM3rGlKFWAFSQ+h/4q67LgIDTOKjk7EXpbt/bJIFud\nxyiG6uvMSX35OZ5vLsBvv2AzkzR5x2v9kcKD1b5eWn6haEXMOX/X0yGHux9vRylw\nzEW1IOA5+2FZvZhwLy+F3XxY3Vrf04mWGyCxiBy4aMvbmp0BcWBg+tRLOmc6h7rX\n2Bi8TfeE+GnmJkezD44MH/S+EEfafOkiDqoDCxxgYpJzXiE6DZNEUGdpUm87hdx4\nMviBG5FCtAAJp+5btxy72dIKBYBVUJ8=\n-----END PRIVATE KEY-----\n";
diff --git a/apps/cli/src/legacy/commands/start/templates/kong.yml.ts b/apps/cli/src/legacy/commands/start/templates/kong.yml.ts
new file mode 100644
index 0000000000..e39fa56c5f
--- /dev/null
+++ b/apps/cli/src/legacy/commands/start/templates/kong.yml.ts
@@ -0,0 +1,252 @@
+/**
+ * Transcribed verbatim from `apps/cli-go/internal/start/templates/kong.yml`
+ * (Go `//go:embed templates/kong.yml`, parsed as a `text/template` named
+ * `kongConfig`, `apps/cli-go/internal/start/start.go:106-109`). Do not hand-edit
+ * the YAML body — re-transcribe from the Go source if it changes.
+ *
+ * Placeholders (`{{ .Field }}`) are Go's `kongConfig` struct fields
+ * (`start.go:90-104`): GotrueId, RestId, RealtimeId, StorageId, StudioId,
+ * PgmetaId, EdgeRuntimeId, LogflareId, PoolerId, ApiHost, ApiPort, BearerToken,
+ * QueryToken. Rendered by `lib/template-render.ts`.
+ */
+export const LEGACY_START_KONG_YML_TEMPLATE = `_format_version: "1.1"
+services:
+  # Tenant project endpoints
+  - name: auth-v1-open
+    _comment: "GoTrue external /auth/v1/verify* -> internal root /verify*"
+    url: http://{{ .GotrueId }}:9999/verify
+    routes:
+      - name: auth-v1-open
+        strip_path: true
+        paths:
+          - /auth/v1/verify
+    plugins:
+      - name: cors
+  - name: auth-v1-open-callback
+    _comment: "GoTrue external /auth/v1/callback* -> internal root /callback*"
+    url: http://{{ .GotrueId }}:9999/callback
+    routes:
+      - name: auth-v1-open-callback
+        strip_path: true
+        paths:
+          - /auth/v1/callback
+    plugins:
+      - name: cors
+  - name: auth-v1-open-authorize
+    _comment: "GoTrue external /auth/v1/authorize* -> internal root /authorize*"
+    url: http://{{ .GotrueId }}:9999/authorize
+    routes:
+      - name: auth-v1-open-authorize
+        strip_path: true
+        paths:
+          - /auth/v1/authorize
+    plugins:
+      - name: cors
+  - name: auth-v1
+    _comment: "GoTrue external /auth/v1/* -> internal root /*"
+    url: http://{{ .GotrueId }}:9999/
+    routes:
+      - name: auth-v1-all
+        strip_path: true
+        paths:
+          - /auth/v1/
+    plugins:
+      - name: cors
+      - name: request-transformer
+        config:
+          add:
+            headers:
+              - "Authorization: {{ .BearerToken }}"
+          replace:
+            headers:
+              - "Authorization: {{ .BearerToken }}"
+  - name: rest-v1
+    _comment: "PostgREST: /rest/v1/* -> http://rest:3000/*"
+    url: http://{{ .RestId }}:3000/
+    routes:
+      - name: rest-v1-all
+        strip_path: true
+        paths:
+          - /rest/v1/
+    plugins:
+      - name: cors
+      - name: request-transformer
+        config:
+          add:
+            headers:
+              - "Authorization: {{ .BearerToken }}"
+          replace:
+            headers:
+              - "Authorization: {{ .BearerToken }}"
+  - name: rest-admin-v1
+    _comment: "PostgREST: /rest-admin/v1/* -> http://rest:3001/*"
+    url: http://{{ .RestId }}:3001/
+    routes:
+      - name: rest-admin-v1-all
+        strip_path: true
+        paths:
+          - /rest-admin/v1/
+    plugins:
+      - name: cors
+      # TODO: validate apikey
+  - name: graphql-v1
+    _comment: "PostgREST: /graphql/v1 -> http://rest:3000/rpc/graphql"
+    url: http://{{ .RestId }}:3000/rpc/graphql
+    routes:
+      - name: graphql-v1-all
+        strip_path: true
+        paths:
+          - /graphql/v1
+    plugins:
+      - name: cors
+      - name: request-transformer
+        config:
+          add:
+            headers:
+              - "Content-Profile: graphql_public"
+              - "Authorization: {{ .BearerToken }}"
+          replace:
+            headers:
+              - "Authorization: {{ .BearerToken }}"
+  - name: realtime-v1-ws
+    _comment: "Realtime: /realtime/v1/* -> ws://realtime:4000/socket/websocket"
+    url: http://{{ .RealtimeId }}:4000/socket
+    protocol: ws
+    routes:
+      - name: realtime-v1-ws
+        strip_path: true
+        paths:
+          - /realtime/v1/
+    plugins:
+      - name: cors
+      - name: request-transformer
+        config:
+          replace:
+            querystring:
+              - "apikey:{{ .QueryToken }}"
+  - name: realtime-v1-rest
+    _comment: "Realtime: /realtime/v1/* -> http://realtime:4000/api/*"
+    url: http://{{ .RealtimeId }}:4000/api
+    protocol: http
+    routes:
+      - name: realtime-v1-rest
+        strip_path: true
+        paths:
+          - /realtime/v1/api
+    plugins:
+      - name: cors
+      - name: request-transformer
+        config:
+          add:
+            headers:
+              - "Authorization: {{ .BearerToken }}"
+          replace:
+            headers:
+              - "Authorization: {{ .BearerToken }}"
+  # S3-compatible storage endpoint (no Authorization header transformation)
+  - name: storage-v1-s3
+    _comment: "Storage S3: /storage/v1/s3/* -> http://storage-api:5000/s3/*"
+    url: http://{{ .StorageId }}:5000/s3
+    routes:
+      - name: storage-v1-s3-all
+        strip_path: true
+        paths:
+          - /storage/v1/s3/
+    plugins:
+      - name: cors
+      # Note: No request-transformer plugin for Authorization header
+      # S3 presigned URLs require the original AWS signature in the Authorization header
+      # Adding/replacing with Bearer token would break S3 signature validation
+  # Regular storage API endpoint (with Authorization header transformation)
+  - name: storage-v1
+    _comment: "Storage API: /storage/v1/* -> http://storage-api:5000/*"
+    url: http://{{ .StorageId }}:5000/
+    routes:
+      - name: storage-v1-all
+        strip_path: true
+        paths:
+          - /storage/v1/
+    plugins:
+      - name: cors
+      - name: request-transformer
+        config:
+          add:
+            headers:
+              - "Authorization: {{ .BearerToken }}"
+          replace:
+            headers:
+              - "Authorization: {{ .BearerToken }}"
+  - name: functions-v1
+    _comment: "Functions: /functions/v1/* -> http://edge-runtime:8081/*"
+    url: http://{{ .EdgeRuntimeId }}:8081/
+    # Set request idle timeout to 150s to match hosted project
+    # Ref: https://supabase.com/docs/guides/functions/limits
+    read_timeout: 150000
+    routes:
+      - name: functions-v1-all
+        strip_path: true
+        paths:
+          - /functions/v1/
+    plugins:
+      - name: cors
+      - name: request-transformer
+        config:
+          add:
+            headers:
+              - "sb-api-key: {{ .BearerToken }}"
+          replace:
+            headers:
+              - "sb-api-key: {{ .BearerToken }}"
+  # Management API endpoints
+  - name: well-known-oauth
+    _comment: "GoTrue: /.well-known/oauth-authorization-server -> http://auth:9999/.well-known/oauth-authorization-server"
+    url: http://{{ .GotrueId }}:9999/.well-known/oauth-authorization-server
+    routes:
+      - name: well-known-oauth
+        strip_path: true
+        paths:
+          - /.well-known/oauth-authorization-server
+    plugins:
+      - name: cors
+  - name: pg-meta
+    _comment: "pg-meta: /pg/* -> http://pg-meta:8080/*"
+    url: http://{{ .PgmetaId }}:8080/
+    routes:
+      - name: pg-meta-all
+        strip_path: true
+        paths:
+          - /pg/
+    plugins:
+      - name: cors
+  - name: analytics-v1
+    _comment: "Analytics: /analytics/v1/* -> http://logflare:4000/*"
+    url: http://{{ .LogflareId }}:4000/
+    routes:
+      - name: analytics-v1-all
+        strip_path: true
+        paths:
+          - /analytics/v1/
+    plugins:
+      - name: cors
+  - name: pooler-v2-ws
+    _comment: "Pooler: /pooler/v2/* -> ws://pooler:4000/v2/*"
+    url: http://{{ .PoolerId }}:4000/v2
+    protocol: ws
+    routes:
+      - name: pooler-v2-ws
+        strip_path: true
+        paths:
+          - /pooler/v2/
+    plugins:
+      - name: cors
+  - name: mcp
+    _comment: "MCP: /mcp -> http://studio:3000/api/mcp"
+    url: http://{{ .StudioId }}:3000/api/mcp
+    routes:
+      - name: mcp
+        strip_path: true
+        paths:
+          - /mcp
+    plugins:
+      - name: cors
+`;
diff --git a/apps/cli/src/legacy/commands/start/templates/pooler.exs.ts b/apps/cli/src/legacy/commands/start/templates/pooler.exs.ts
new file mode 100644
index 0000000000..c1da75c001
--- /dev/null
+++ b/apps/cli/src/legacy/commands/start/templates/pooler.exs.ts
@@ -0,0 +1,42 @@
+/**
+ * Transcribed verbatim from `apps/cli-go/internal/start/templates/pooler.exs`
+ * (Go `//go:embed templates/pooler.exs`, parsed as a `text/template` named
+ * `poolerTenant`, `apps/cli-go/internal/start/start.go:155-158`). Do not
+ * hand-edit the Elixir body — re-transcribe from the Go source if it changes.
+ *
+ * Placeholders (`{{ .Field }}`) are Go's `poolerTenant` struct fields
+ * (`start.go:144-153`): DbHost, DbPort, DbDatabase, DbPassword, ExternalId,
+ * ModeType, DefaultMaxClients, DefaultPoolSize. Rendered by
+ * `lib/template-render.ts`.
+ */
+export const LEGACY_START_POOLER_EXS_TEMPLATE = `{:ok, _} = Application.ensure_all_started(:supavisor)
+
+{:ok, version} =
+  case Supavisor.Repo.query!("select version()") do
+    %{rows: [[ver]]} -> Supavisor.Helpers.parse_pg_version(ver)
+    _ -> nil
+  end
+
+params = %{
+  "external_id" => "{{ .ExternalId }}",
+  "db_host" => "{{ .DbHost }}",
+  "db_port" => {{ .DbPort }},
+  "db_database" => "{{ .DbDatabase }}",
+  "require_user" => false,
+  "auth_query" => "SELECT * FROM pgbouncer.get_auth($1)",
+  "default_max_clients" => {{ .DefaultMaxClients }},
+  "default_pool_size" => {{ .DefaultPoolSize }},
+  "default_parameter_status" => %{"server_version" => version},
+  "users" => [%{
+    "db_user" => "pgbouncer",
+    "db_password" => "{{ .DbPassword }}",
+    "mode_type" => "{{ .ModeType }}",
+    "pool_size" => {{ .DefaultPoolSize }},
+    "is_manager" => true
+  }]
+}
+
+if !Supavisor.Tenants.get_tenant_by_external_id(params["external_id"]) do
+  {:ok, _} = Supavisor.Tenants.create_tenant(params)
+end
+`;
diff --git a/apps/cli/src/legacy/commands/start/templates/vector.yaml.ts b/apps/cli/src/legacy/commands/start/templates/vector.yaml.ts
new file mode 100644
index 0000000000..34227cd6f9
--- /dev/null
+++ b/apps/cli/src/legacy/commands/start/templates/vector.yaml.ts
@@ -0,0 +1,264 @@
+/**
+ * Transcribed verbatim from `apps/cli-go/internal/start/templates/vector.yaml`
+ * (Go `//go:embed templates/vector.yaml`, parsed as a `text/template` named
+ * `vectorConfig`, `apps/cli-go/internal/start/start.go:138-141`). Do not
+ * hand-edit the YAML body — re-transcribe from the Go source if it changes.
+ *
+ * Placeholders (`{{ .Field }}`) are Go's `vectorConfig` struct fields
+ * (`start.go:118-129`): ApiKey, VectorId, LogflareId, KongId, GotrueId,
+ * RestId, RealtimeId, StorageId, EdgeRuntimeId, DbId. Rendered by
+ * `lib/template-render.ts`.
+ */
+export const LEGACY_START_VECTOR_YAML_TEMPLATE = `api:
+  enabled: true
+  address: 0.0.0.0:9001
+
+sources:
+  docker_host:
+    type: docker_logs
+    exclude_containers:
+      - "{{ .VectorId }}"
+
+transforms:
+  project_logs:
+    type: remap
+    inputs:
+      - docker_host
+    source: |-
+      .project = "default"
+      .event_message = del(.message)
+      .appname = del(.container_name)
+      del(.container_created_at)
+      del(.container_id)
+      del(.source_type)
+      del(.stream)
+      del(.label)
+      del(.image)
+      del(.host)
+      del(.stream)
+  router:
+    type: route
+    inputs:
+      - project_logs
+    route:
+      kong: '.appname == "{{ .KongId }}"'
+      auth: '.appname == "{{ .GotrueId }}"'
+      rest: '.appname == "{{ .RestId }}"'
+      realtime: '.appname == "{{ .RealtimeId }}"'
+      storage: '.appname == "{{ .StorageId }}"'
+      functions: '.appname == "{{ .EdgeRuntimeId }}"'
+      db: '.appname == "{{ .DbId }}"'
+  # Ignores non nginx errors since they are related with kong booting up
+  kong_logs:
+    type: remap
+    inputs:
+      - router.kong
+    source: |-
+      req, err = parse_nginx_log(.event_message, "combined")
+      if err == null {
+          .timestamp = req.timestamp
+          .metadata.request.headers.referer = req.referer
+          .metadata.request.headers.user_agent = req.agent
+          .metadata.request.headers.cf_connecting_ip = req.client
+          .metadata.response.status_code = req.status
+          url, split_err = split(req.request, " ")
+          if split_err == null {
+              .metadata.request.method = url[0]
+              .metadata.request.path = url[1]
+              .metadata.request.protocol = url[2]
+          }
+      }
+      if err != null {
+        abort
+      }
+  # Ignores non nginx errors since they are related with kong booting up
+  kong_err:
+    type: remap
+    inputs:
+      - router.kong
+    source: |-
+      .metadata.request.method = "GET"
+      .metadata.response.status_code = 200
+      parsed, err = parse_nginx_log(.event_message, "error")
+      if err == null {
+          .timestamp = parsed.timestamp
+          .severity = parsed.severity
+          .metadata.request.host = parsed.host
+          .metadata.request.headers.cf_connecting_ip = parsed.client
+          url, err = split(parsed.request, " ")
+          if err == null {
+              .metadata.request.method = url[0]
+              .metadata.request.path = url[1]
+              .metadata.request.protocol = url[2]
+          }
+      }
+      if err != null {
+        abort
+      }
+  # Gotrue logs are structured json strings which frontend parses directly. But we keep metadata for consistency.
+  auth_logs:
+    type: remap
+    inputs:
+      - router.auth
+    source: |-
+      parsed, err = parse_json(.event_message)
+      if err == null {
+          .metadata.timestamp = parsed.time
+          .metadata = merge!(.metadata, parsed)
+      }
+  # PostgREST logs are structured so we separate timestamp from message using regex
+  rest_logs:
+    type: remap
+    inputs:
+      - router.rest
+    source: |-
+      parsed, err = parse_regex(.event_message, r'^(?P<time>.*): (?P<msg>.*)$')
+      if err == null {
+          .event_message = parsed.msg
+          .timestamp = parse_timestamp!(value: parsed.time, format: "%d/%b/%Y:%H:%M:%S %z")
+          .metadata.host = .project
+      }
+  # Realtime logs are structured so we parse the severity level using regex (ignore time because it has no date)
+  realtime_logs:
+    type: remap
+    inputs:
+      - router.realtime
+    source: |-
+      .metadata.project = del(.project)
+      .metadata.external_id = .metadata.project
+      parsed, err = parse_regex(.event_message, r'^(?P<time>\\d+:\\d+:\\d+\\.\\d+) \\[(?P<level>\\w+)\\] (?P<msg>.*)$')
+      if err == null {
+          .event_message = parsed.msg
+          .metadata.level = parsed.level
+      }
+  # Function logs are unstructured messages on stderr
+  functions_logs:
+    type: remap
+    inputs:
+      - router.functions
+    source: |-
+      .metadata.project_ref = del(.project)
+  # Storage logs may contain json objects so we parse them for completeness
+  storage_logs:
+    type: remap
+    inputs:
+      - router.storage
+    source: |-
+      .metadata.project = del(.project)
+      .metadata.tenantId = .metadata.project
+      parsed, err = parse_json(.event_message)
+      if err == null {
+          .event_message = parsed.msg
+          .metadata.level = parsed.level
+          .metadata.timestamp = parsed.time
+          .metadata.context[0].host = parsed.hostname
+          .metadata.context[0].pid = parsed.pid
+      }
+  # Postgres logs some messages to stderr which we map to warning severity level
+  db_logs:
+    type: remap
+    inputs:
+      - router.db
+    source: |-
+      .metadata.host = "db-default"
+      .metadata.parsed.timestamp = .timestamp
+
+      parsed, err = parse_regex(.event_message, r'.*(?P<level>INFO|NOTICE|WARNING|ERROR|LOG|FATAL|PANIC?):.*', numeric_groups: true)
+
+      if err != null || parsed == null || parsed.level == null {
+        .metadata.parsed.error_severity = "info"
+      } else {
+        .metadata.parsed.error_severity = parsed.level
+      }
+      if .metadata.parsed.error_severity == "info" {
+          .metadata.parsed.error_severity = "log"
+      }
+      .metadata.parsed.error_severity = upcase!(.metadata.parsed.error_severity)
+
+sinks:
+  logflare_auth:
+    type: "http"
+    inputs:
+      - auth_logs
+    encoding:
+      codec: "json"
+    method: "post"
+    request:
+      retry_max_duration_secs: 10
+      headers:
+        x-api-key: "{{ .ApiKey }}"
+    uri: "http://{{ .LogflareId }}:4000/api/logs?source_name=gotrue.logs.prod"
+  logflare_realtime:
+    type: "http"
+    inputs:
+      - realtime_logs
+    encoding:
+      codec: "json"
+    method: "post"
+    request:
+      retry_max_duration_secs: 10
+      headers:
+        x-api-key: "{{ .ApiKey }}"
+    uri: "http://{{ .LogflareId }}:4000/api/logs?source_name=realtime.logs.prod"
+  logflare_rest:
+    type: "http"
+    inputs:
+      - rest_logs
+    encoding:
+      codec: "json"
+    method: "post"
+    request:
+      retry_max_duration_secs: 10
+      headers:
+        x-api-key: "{{ .ApiKey }}"
+    uri: "http://{{ .LogflareId }}:4000/api/logs?source_name=postgREST.logs.prod"
+  logflare_db:
+    type: "http"
+    inputs:
+      - db_logs
+    encoding:
+      codec: "json"
+    method: "post"
+    request:
+      retry_max_duration_secs: 10
+      headers:
+        x-api-key: "{{ .ApiKey }}"
+    uri: "http://{{ .LogflareId }}:4000/api/logs?source_name=postgres.logs"
+  logflare_functions:
+    type: "http"
+    inputs:
+      - functions_logs
+    encoding:
+      codec: "json"
+    method: "post"
+    request:
+      retry_max_duration_secs: 10
+      headers:
+        x-api-key: "{{ .ApiKey }}"
+    uri: "http://{{ .LogflareId }}:4000/api/logs?source_name=deno-relay-logs"
+  logflare_storage:
+    type: "http"
+    inputs:
+      - storage_logs
+    encoding:
+      codec: "json"
+    method: "post"
+    request:
+      retry_max_duration_secs: 10
+      headers:
+        x-api-key: "{{ .ApiKey }}"
+    uri: "http://{{ .LogflareId }}:4000/api/logs?source_name=storage.logs.prod.2"
+  logflare_kong:
+    type: "http"
+    inputs:
+      - kong_logs
+      - kong_err
+    encoding:
+      codec: "json"
+    method: "post"
+    request:
+      retry_max_duration_secs: 10
+      headers:
+        x-api-key: "{{ .ApiKey }}"
+    uri: "http://{{ .LogflareId }}:4000/api/logs?source_name=cloudflare.logs.prod"
+`;
diff --git a/apps/cli/src/legacy/commands/status/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/status/SIDE_EFFECTS.md
index 089b2340c3..bc43278256 100644
--- a/apps/cli/src/legacy/commands/status/SIDE_EFFECTS.md
+++ b/apps/cli/src/legacy/commands/status/SIDE_EFFECTS.md
@@ -2,15 +2,17 @@
 
 ## Files Read
 
-| Path                             | Format | When                                     |
-| -------------------------------- | ------ | ---------------------------------------- |
-| `<workdir>/supabase/config.toml` | TOML   | always, to resolve project configuration |
+| Path                                                                                                                | Format    | When                                                                          |
+| ------------------------------------------------------------------------------------------------------------------- | --------- | ----------------------------------------------------------------------------- |
+| `<workdir>/supabase/config.toml`                                                                                    | TOML      | always, to resolve project configuration                                      |
+| `auth.signing_keys_path` (config-relative or absolute)                                                              | JSON      | only when `auth.signing_keys_path` is set in config.toml                      |
+| `api.tls.cert_path` / `api.tls.key_path` (unconditionally joined with `<workdir>/supabase`, no absolute-path guard) | raw bytes | only when `api.enabled` and `api.tls.enabled`, and the respective path is set |
 
 ## Files Written
 
-| Path | Format | When |
-| ---- | ------ | ---- |
-| —    | —      | —    |
+| Path                         | Format | When   |
+| ---------------------------- | ------ | ------ |
+| `~/.supabase/telemetry.json` | JSON   | always |
 
 ## API Routes
 
@@ -18,67 +20,186 @@
 | ------ | ---- | ---- | ------------ | ---------------------- |
 | —      | —    | —    | —            | —                      |
 
+Neither this command nor any of its dependencies make a Management API call — everything is
+resolved from local `config.toml` and the local Docker daemon.
+
 ## Environment Variables
 
-| Variable | Purpose | Required? |
-| -------- | ------- | --------- |
-| —        | —       | —         |
+| Variable                         | Purpose                                                 | Required?                                                               |
+| -------------------------------- | ------------------------------------------------------- | ----------------------------------------------------------------------- |
+| `SUPABASE_PROJECT_ID`            | overrides the resolved local project id                 | no (falls back to config.toml `project_id` → workdir basename)          |
+| `SUPABASE_WORKDIR`               | overrides the resolved project workdir                  | no (falls back to `--workdir` → walk-up search for `config.toml` → cwd) |
+| `SUPABASE_SERVICES_HOSTNAME`     | overrides the hostname used to build local service URLs | no (falls back to `DOCKER_HOST`'s tcp host → `127.0.0.1`)               |
+| `SUPABASE_AUTH_JWT_SECRET`       | overrides `auth.jwt_secret`                             | no                                                                      |
+| `SUPABASE_AUTH_PUBLISHABLE_KEY`  | overrides `auth.publishable_key`                        | no                                                                      |
+| `SUPABASE_AUTH_SECRET_KEY`       | overrides `auth.secret_key`                             | no                                                                      |
+| `SUPABASE_AUTH_ANON_KEY`         | overrides `auth.anon_key`                               | no                                                                      |
+| `SUPABASE_AUTH_SERVICE_ROLE_KEY` | overrides `auth.service_role_key`                       | no                                                                      |
+
+The `SUPABASE_AUTH_*` vars mirror Go's Viper `AutomaticEnv` (`SetEnvPrefix("SUPABASE")` +
+`.`→`_` key replacer, `pkg/config/config.go:529-535`) and take precedence over the corresponding
+`config.toml` value, matching Viper's real precedence order.
+
+`docker` (or `podman` as a fallback) must be on `PATH`.
 
 ## Exit Codes
 
-| Code | Condition                                     |
-| ---- | --------------------------------------------- |
-| `0`  | success — status displayed                    |
-| `1`  | malformed config                              |
-| `1`  | Docker daemon not running or connection error |
+| Code | Condition                                                                                                                                                    |
+| ---- | ------------------------------------------------------------------------------------------------------------------------------------------------------------ |
+| `0`  | success — status displayed                                                                                                                                   |
+| `0`  | **`--ignore-health-check` is set** — skips the health assertion below entirely, so an unhealthy/not-running db never fails the command                       |
+| `1`  | `supabase/config.toml` missing or malformed                                                                                                                  |
+| `1`  | a malformed `--override-name` entry                                                                                                                          |
+| `1`  | listing running containers failed (Docker daemon unreachable, etc.)                                                                                          |
+| `1`  | the db container inspect call failed (including "not found") — health assertion, skipped by `--ignore-health-check` above                                    |
+| `1`  | the db container is present but not in the `running` state — health assertion, skipped by `--ignore-health-check` above                                      |
+| `1`  | the db container is running but its Docker health check isn't `healthy` — health assertion, skipped by `--ignore-health-check` above                         |
+| `1`  | `auth.jwt_secret` is configured but shorter than 16 characters (Go's `Config.Validate` rejects this at config-load time)                                     |
+| `1`  | `auth.signing_keys_path` is configured but the file is missing/malformed, or its first key's algorithm is not `RS256`/`ES256`                                |
+| `1`  | `api.enabled` and `api.tls.enabled` are true and only one of `api.tls.cert_path`/`key_path` is set (Go's `Config.Validate` rejects this at config-load time) |
+| `1`  | `api.enabled` and `api.tls.enabled` are true, both `cert_path` and `key_path` are set, but one of the files can't be read                                    |
+
+## Telemetry Events Fired
+
+| Event                  | When                                       | Notable properties / groups         |
+| ---------------------- | ------------------------------------------ | ----------------------------------- |
+| `cli_command_executed` | post-run, success or failure (via wrapper) | `exit_code`, `duration_ms`, `flags` |
 
 ## Output
 
 ### `--output-format text` (Go CLI compatible)
 
-Prints a table of service names, container IDs, images, and URLs.
+Default (`-o` unset or `-o pretty`): a stderr banner, then 5 grouped rounded-border tables on
+stdout. Empty rows (a value with nothing resolved) and entirely empty groups are skipped; a
+blank line follows every group, rendered or not.
 
 ```
-         supabase local development setup is running.
-
-         API URL: http://127.0.0.1:54321
-     GraphQL URL: http://127.0.0.1:54321/graphql/v1
-  S3 Storage URL: http://127.0.0.1:54321/storage/v1/s3
-          DB URL: postgresql://postgres:postgres@127.0.0.1:54322/postgres
-      Studio URL: http://127.0.0.1:54323
-    Inbucket URL: http://127.0.0.1:54324
-      JWT secret: super-secret-jwt-token-with-at-least-32-characters-long
-        anon key: ...
-service_role key: ...
-   S3 Access Key: 625729a08b95bf1b7ff351a663f3a23c
-   S3 Secret Key: 850181e4652dd023b7a98c58ae0d2d34bd487ee0ead3abe0
-       S3 Region: local
+supabase local development setup is running.
+
+╭──────────────────────────────────────╮
+│ 🔧 Development Tools                 │
+├─────────┬────────────────────────────┤
+│ Studio  │ http://127.0.0.1:54323     │
+│ Mailpit │ http://127.0.0.1:54324     │
+│ MCP     │ http://127.0.0.1:54321/mcp │
+╰─────────┴────────────────────────────╯
+
+╭──────────────────────────────────────────────────────╮
+│ 🌐 APIs                                              │
+├────────────────┬─────────────────────────────────────┤
+│ Project URL    │ http://127.0.0.1:54321              │
+│ REST           │ http://127.0.0.1:54321/rest/v1      │
+│ GraphQL        │ http://127.0.0.1:54321/graphql/v1   │
+│ Edge Functions │ http://127.0.0.1:54321/functions/v1 │
+╰────────────────┴─────────────────────────────────────╯
+
+╭───────────────────────────────────────────────────────────────╮
+│ ⛁ Database                                                    │
+├─────┬─────────────────────────────────────────────────────────┤
+│ URL │ postgresql://postgres:postgres@127.0.0.1:54322/postgres │
+╰─────┴─────────────────────────────────────────────────────────╯
+
+╭──────────────────────────────────────────────────────────────╮
+│ 🔑 Authentication Keys                                       │
+├─────────────┬────────────────────────────────────────────────┤
+│ Publishable │ sb_publishable_ACJWlzQHlZjBrEguHvfOxg_3BJgxAaH │
+│ Secret      │ sb_secret_N7UND0UgjKTVK-Uodkm0Hg_xSvEMPvz      │
+╰─────────────┴────────────────────────────────────────────────╯
+
+╭───────────────────────────────────────────────────────────────────────────────╮
+│ 📦 Storage (S3)                                                               │
+├────────────┬──────────────────────────────────────────────────────────────────┤
+│ URL        │ http://127.0.0.1:54321/storage/v1/s3                             │
+│ Access Key │ 625729a08b95bf1b7ff351a663f3a23c                                 │
+│ Secret Key │ 850181e4652dd023b7a98c58ae0d2d34bd487ee0cc3254aed6eda37307425907 │
+│ Region     │ local                                                            │
+╰────────────┴──────────────────────────────────────────────────────────────────╯
 ```
 
-### `--output-format json`
+Group table cells are colored on a TTY (Aqua for links, Yellow for keys, Green for labels, bold
+headers); colors are stripped on non-TTY/piped output.
+
+`Stopped services: [<container-id> ...]` is written to stderr (Go slice format, e.g.
+`[supabase_storage_test supabase_studio_test]`) whenever one of the 13 expected service
+containers isn't in the running set.
+
+### `-o env`
+
+`KEY="VALUE"` lines (unquoted for integer-looking values), one per resolved field, sorted by
+key — see `legacy-go-output.encoders.ts`'s `encodeEnv`.
+
+### `-o json`
 
 ```json
 {
   "API_URL": "http://127.0.0.1:54321",
-  "DB_URL": "postgresql://...",
+  "DB_URL": "postgresql://postgres:postgres@127.0.0.1:54322/postgres",
   "ANON_KEY": "...",
   "SERVICE_ROLE_KEY": "...",
+  "PUBLISHABLE_KEY": "...",
+  "SECRET_KEY": "...",
   "JWT_SECRET": "...",
-  "S3_ACCESS_KEY": "...",
-  "S3_SECRET_KEY": "...",
-  "S3_REGION": "local"
+  "S3_PROTOCOL_ACCESS_KEY_ID": "625729a08b95bf1b7ff351a663f3a23c",
+  "S3_PROTOCOL_ACCESS_KEY_SECRET": "...",
+  "S3_PROTOCOL_REGION": "local"
 }
 ```
 
-### `--output-format stream-json`
+Top-level keys sorted alphabetically, 2-space indent, trailing newline (Go `encoding/json`
+parity). Fields whose owning service is disabled or excluded are omitted entirely (not emitted
+as `null`/`""`).
+
+### `-o yaml` / `-o toml`
+
+Same value set as `-o json`, encoded via `encodeYaml`/`encodeToml`.
+
+### `--output-format json` / `stream-json` (when `-o` is unset or `pretty`)
 
-Not applicable.
+Additive — no Go CLI equivalent. Emits the same resolved value map via
+`output.success("", values)` / the NDJSON `result` event.
 
 ## Notes
 
-- `--override-name` flag overrides specific variable names in env output.
-- `-o env` output format uses KEY=VALUE pairs.
-- `-o json` output format uses a JSON object.
-- `-o pretty` (default) uses the human-readable table format.
-- `--exclude` (hidden, repeatable) omits named containers from the output; matches Go's `cmd/status.go:39-40`.
-- `--ignore-health-check` (hidden, boolean) exits `0` even when a service is unhealthy; matches Go's `cmd/status.go:41-42`.
+- `-o`/`--output` (`env|pretty|json|toml|yaml`) takes priority over `--output-format` whenever
+  it is set, matching the Go-parity checklist's dual-output-flag rule. `-o pretty` (or `-o`
+  unset) falls through to `--output-format`'s text/json/stream-json handling.
+- `--override-name api.url=NEXT_PUBLIC_SUPABASE_URL` remaps a single field's output KEY; the
+  value and group layout are unaffected. An unknown key or a malformed (non `KEY=VALUE`) entry
+  fails with `LegacyStatusOverrideParseError`. This only affects the `env`/`json`/`toml`/`yaml`
+  (`printStatus`) output path — matching Go, the pretty table (`-o pretty` or unset) always
+  renders with un-overridden names, since Go's `PrettyPrint` unmarshals a fresh, empty `EnvSet{}`
+  rather than reusing the CLI-supplied, override-populated `CustomName` (`status.go:236-243`).
+- When neither `docker` nor `podman` can be spawned at all, the error message names the actual
+  root cause (e.g. "docker: command not found (podman also not found) — install Docker Desktop or
+  Podman and ensure it is on PATH") rather than a generic "failed to ..." string.
+- `--exclude <value>` (hidden) omits a service from the value map when `value` matches either its
+  container id or its default Docker image short name (Go's `ShortContainerImageName`, e.g.
+  `storage-api` for the storage service, `edge-runtime` for edge functions) — the default image
+  is read from the same embedded Dockerfile manifest Go parses, so a version bump there is picked
+  up automatically without needing to read the `.temp/<service>-version` pin file.
+- `--ignore-health-check` (hidden) skips the db container health assertion entirely and always
+  exits `0`, matching Go's early-return in `Run()`.
+- Default `auth.anon_key`/`auth.service_role_key`/`auth.jwt_secret` values are generated via a
+  Go-byte-exact HS256 signer (`legacy-go-jwt.ts`), not `@supabase/stack`'s `generateJwt` — the
+  latter uses a different issuer, expiry, and claim order that would not match what Go prints
+  for local dev keys. A configured `auth.jwt_secret` shorter than 16 characters fails the command
+  (`LegacyStatusInvalidConfigError`), matching Go's `Config.Validate` rejecting it at config-load
+  time before any command can render output.
+- When `auth.signing_keys_path` is set and resolves to a non-empty JWK array, `anon_key`/
+  `service_role_key` are instead signed asymmetrically (RS256/ES256) with the file's first key,
+  matching Go's `generateJWT` (`pkg/config/apikeys.go:76-113`) — a relative path resolves against
+  `<workdir>/supabase`. This path is skipped entirely when `auth.anon_key`/`auth.service_role_key`
+  are explicitly configured. A missing/malformed file, or a first key with an algorithm other than
+  `RS256`/`ES256`, fails the command (`LegacyStatusInvalidConfigError`).
+- `SUPABASE_AUTH_JWT_SECRET`/`SUPABASE_AUTH_PUBLISHABLE_KEY`/`SUPABASE_AUTH_SECRET_KEY`/
+  `SUPABASE_AUTH_ANON_KEY`/`SUPABASE_AUTH_SERVICE_ROLE_KEY` override the corresponding
+  `config.toml` value at higher precedence, matching Go's Viper `AutomaticEnv` — an empty env var
+  is treated as unset. This is scoped to exactly the 5 auth fields `status` reads; it is not a
+  general `@supabase/config` port of Viper's `AutomaticEnv` (which applies to every config field).
+- `db.password` and the `storage.s3_credentials` triple have no `@supabase/config` schema field;
+  Go hardcodes both (`"postgres"` and the S3 access key/secret/region seen above), reproduced
+  identically in `legacy-local-config-values.ts`.
+- No e2e test is planned for this command: there is no Docker-daemon-free golden path, and the
+  e2e harness (`runSupabase()`) does not provision a real local stack. This is a scope reduction
+  relative to the Linear issue's "E2E compatibility test added" checkbox; see the port plan for
+  the full justification.
diff --git a/apps/cli/src/legacy/commands/status/status.command.ts b/apps/cli/src/legacy/commands/status/status.command.ts
index 201bce98f0..12be889ebb 100644
--- a/apps/cli/src/legacy/commands/status/status.command.ts
+++ b/apps/cli/src/legacy/commands/status/status.command.ts
@@ -1,19 +1,47 @@
+import { Layer } from "effect";
 import { Command, Flag } from "effect/unstable/cli";
 import type * as CliCommand from "effect/unstable/cli/Command";
+
+import { legacyCliConfigLayer } from "../../config/legacy-cli-config.layer.ts";
+import { legacyDebugLoggerLayer } from "../../shared/legacy-debug-logger.layer.ts";
+import { LEGACY_RESOURCE_OUTPUT_FORMATS } from "../../shared/legacy-go-output-flag.ts";
+import { legacyParseStringSliceFlag } from "../../shared/legacy-string-slice-flag.ts";
+import { legacyTelemetryStateLayer } from "../../telemetry/legacy-telemetry-state.layer.ts";
+import { commandRuntimeLayer } from "../../../shared/runtime/command-runtime.layer.ts";
+import { withJsonErrorHandling } from "../../../shared/output/json-error-handling.ts";
+import { withLegacyCommandInstrumentation } from "../../telemetry/legacy-command-instrumentation.ts";
 import { legacyStatus } from "./status.handler.ts";
 
-const config = {
-  overrideName: Flag.string("override-name").pipe(
-    Flag.atLeast(0),
-    Flag.withDescription("Override specific variable names."),
-    Flag.withDefault([] as ReadonlyArray<string>),
-  ),
-  exclude: Flag.string("exclude").pipe(
+/**
+ * Go registers both `--override-name` and `--exclude` as pflag `StringSliceVar`
+ * (`cmd/status.go:36-37`), which CSV-splits each occurrence and accumulates
+ * across repeats — `--override-name a=1,b=2` is two overrides, not one. Effect's
+ * `Flag.atLeast(0)` only handles repetition, so every occurrence needs the same
+ * `legacyParseStringSliceFlag` normalization already used for `sso`/`postgres-config`.
+ */
+function csvStringSliceFlag(name: string) {
+  return Flag.string(name).pipe(
     Flag.atLeast(0),
-    Flag.withDescription("Names of containers to omit from output."),
+    Flag.mapTryCatch(
+      (rawValues) => legacyParseStringSliceFlag(rawValues),
+      (err) => (err instanceof Error ? err.message : String(err)),
+    ),
     Flag.withDefault([] as ReadonlyArray<string>),
-    Flag.withHidden,
-  ),
+  );
+}
+
+export const legacyStatusOverrideNameFlag = csvStringSliceFlag("override-name").pipe(
+  Flag.withDescription("Override specific variable names."),
+);
+
+export const legacyStatusExcludeFlag = csvStringSliceFlag("exclude").pipe(
+  Flag.withDescription("Names of containers to omit from output."),
+  Flag.withHidden,
+);
+
+const config = {
+  overrideName: legacyStatusOverrideNameFlag,
+  exclude: legacyStatusExcludeFlag,
   ignoreHealthCheck: Flag.boolean("ignore-health-check").pipe(
     Flag.withDescription("Ignore unhealthy services and exit 0"),
     Flag.withHidden,
@@ -22,6 +50,18 @@ const config = {
 
 export type LegacyStatusFlags = CliCommand.Command.Config.Infer<typeof config>;
 
+// `status` makes no Management API calls (Go's status needs no access token), so
+// it deliberately avoids `legacyManagementApiRuntimeLayer` — mirrors `unlink`'s
+// runtime shape. `legacyCliConfigLayer` is exposed at the top level directly
+// (nothing else in this runtime needs to consume it internally).
+const cliConfig = legacyCliConfigLayer.pipe(Layer.provide(legacyDebugLoggerLayer));
+
+const legacyStatusRuntimeLayer = Layer.mergeAll(
+  cliConfig,
+  legacyTelemetryStateLayer,
+  commandRuntimeLayer(["status"]),
+);
+
 export const legacyStatusCommand = Command.make("status", config).pipe(
   Command.withDescription("Show status of local Supabase containers."),
   Command.withShortDescription("Show status of local Supabase containers"),
@@ -35,5 +75,14 @@ export const legacyStatusCommand = Command.make("status", config).pipe(
       description: "Output status as JSON",
     },
   ]),
-  Command.withHandler((flags) => legacyStatus(flags)),
+  Command.withHandler((flags) =>
+    legacyStatus(flags).pipe(
+      withLegacyCommandInstrumentation({
+        flags,
+        outputFormats: LEGACY_RESOURCE_OUTPUT_FORMATS,
+      }),
+      withJsonErrorHandling,
+    ),
+  ),
+  Command.provide(legacyStatusRuntimeLayer),
 );
diff --git a/apps/cli/src/legacy/commands/status/status.command.unit.test.ts b/apps/cli/src/legacy/commands/status/status.command.unit.test.ts
new file mode 100644
index 0000000000..257f805382
--- /dev/null
+++ b/apps/cli/src/legacy/commands/status/status.command.unit.test.ts
@@ -0,0 +1,75 @@
+import { BunServices } from "@effect/platform-bun";
+import { Effect, Exit } from "effect";
+import { describe, expect, test } from "vitest";
+import { legacyStatusExcludeFlag, legacyStatusOverrideNameFlag } from "./status.command.ts";
+
+describe("legacy status --override-name flag (pflag StringSlice parity)", () => {
+  test("splits a comma-separated value into multiple overrides", async () => {
+    const [, overrideName] = await Effect.runPromise(
+      legacyStatusOverrideNameFlag
+        .parse({
+          flags: { "override-name": ["api.url=FOO,db.url=BAR"] },
+          arguments: [],
+        })
+        .pipe(Effect.provide(BunServices.layer)),
+    );
+
+    expect(overrideName).toEqual(["api.url=FOO", "db.url=BAR"]);
+  });
+
+  test("accumulates repeated occurrences, each CSV-split", async () => {
+    const [, overrideName] = await Effect.runPromise(
+      legacyStatusOverrideNameFlag
+        .parse({
+          flags: { "override-name": ["api.url=FOO,db.url=BAR", "studio.url=BAZ"] },
+          arguments: [],
+        })
+        .pipe(Effect.provide(BunServices.layer)),
+    );
+
+    expect(overrideName).toEqual(["api.url=FOO", "db.url=BAR", "studio.url=BAZ"]);
+  });
+
+  test("defaults to an empty array when unset", async () => {
+    const [, overrideName] = await Effect.runPromise(
+      legacyStatusOverrideNameFlag
+        .parse({ flags: {}, arguments: [] })
+        .pipe(Effect.provide(BunServices.layer)),
+    );
+
+    expect(overrideName).toEqual([]);
+  });
+
+  test("rejects malformed CSV (unterminated quote)", async () => {
+    const exit = await Effect.runPromise(
+      legacyStatusOverrideNameFlag
+        .parse({ flags: { "override-name": ['"api.url=FOO'] }, arguments: [] })
+        .pipe(Effect.provide(BunServices.layer))
+        .pipe(Effect.exit),
+    );
+
+    expect(Exit.isFailure(exit)).toBe(true);
+  });
+});
+
+describe("legacy status --exclude flag (pflag StringSlice parity)", () => {
+  test("splits a comma-separated value into multiple exclusions", async () => {
+    const [, exclude] = await Effect.runPromise(
+      legacyStatusExcludeFlag
+        .parse({ flags: { exclude: ["kong,auth"] }, arguments: [] })
+        .pipe(Effect.provide(BunServices.layer)),
+    );
+
+    expect(exclude).toEqual(["kong", "auth"]);
+  });
+
+  test("defaults to an empty array when unset", async () => {
+    const [, exclude] = await Effect.runPromise(
+      legacyStatusExcludeFlag
+        .parse({ flags: {}, arguments: [] })
+        .pipe(Effect.provide(BunServices.layer)),
+    );
+
+    expect(exclude).toEqual([]);
+  });
+});
diff --git a/apps/cli/src/legacy/commands/status/status.handler.ts b/apps/cli/src/legacy/commands/status/status.handler.ts
index 566427260c..99ca871702 100644
--- a/apps/cli/src/legacy/commands/status/status.handler.ts
+++ b/apps/cli/src/legacy/commands/status/status.handler.ts
@@ -1,12 +1,274 @@
-import { Effect } from "effect";
-import { LegacyGoProxy } from "../../../shared/legacy/go-proxy.service.ts";
+import { ChildProcessSpawner } from "effect/unstable/process";
+import { Effect, FileSystem, Option } from "effect";
+
+import { LegacyCliConfig } from "../../config/legacy-cli-config.service.ts";
+import { LegacyTelemetryState } from "../../telemetry/legacy-telemetry-state.service.ts";
+import { LegacyOutputFlag } from "../../../shared/legacy/global-flags.ts";
+import { Output } from "../../../shared/output/output.service.ts";
+import { legacyAqua } from "../../shared/legacy-colors.ts";
+import {
+  legacyCliProjectFilterValue,
+  legacyServiceContainerIds,
+  localDbContainerId,
+} from "../../shared/legacy-docker-ids.ts";
+import {
+  legacyInspectContainerState,
+  legacyListContainersByLabel,
+} from "../../shared/legacy-docker-lifecycle.ts";
+import {
+  encodeEnv,
+  encodeGoJson,
+  encodeToml,
+  encodeYaml,
+} from "../../shared/legacy-go-output.encoders.ts";
+import { legacyLoadLocalProjectContext } from "../../shared/legacy-local-project-context.ts";
+import {
+  LegacyStatusConfigLoadError,
+  LegacyStatusDbInspectError,
+  LegacyStatusDbNotReadyError,
+  LegacyStatusDbNotRunningError,
+  LegacyStatusInvalidConfigError,
+  LegacyStatusListError,
+  LegacyStatusOverrideParseError,
+  LegacyStatusWorkdirError,
+} from "../../shared/legacy-status-errors.ts";
+import { legacyRenderStatusPretty } from "../../shared/legacy-status-pretty.ts";
+import {
+  LEGACY_STATUS_FIELDS,
+  legacyGateStatusState,
+  legacyResolveStatusLocalState,
+  legacyStatusContainerIds,
+  legacyStatusValuesFromState,
+} from "../../shared/legacy-status-values.ts";
+import { legacyValidateWorkdirIsDirectory } from "../../shared/legacy-workdir-validation.ts";
 import type { LegacyStatusFlags } from "./status.command.ts";
 
+/**
+ * Parses `--override-name api.url=NEXT_PUBLIC_SUPABASE_URL` entries into a
+ * `fieldKey -> outputName` map, mirroring Go's `env.EnvironToEnvSet` +
+ * `env.Unmarshal` (`cmd/status.go:21-27`): each entry must be a `KEY=VALUE`
+ * pair. `env.EnvironToEnvSet` only validates that shape (`go-env`'s
+ * `ErrInvalidEnviron`); the Netflix `go-env` library's `Unmarshal` then walks
+ * `CustomName`'s own struct fields and looks up each field's tag in the
+ * resulting map — it never checks the map for leftover/unmatched keys, so an
+ * entry whose `KEY` isn't one of the 18 known `CustomName` field keys is
+ * silently ignored, not an error (verified against `go-env@v0.1.2`'s
+ * `env.go`/`transform.go`).
+ */
+function parseOverrides(
+  entries: ReadonlyArray<string>,
+): Effect.Effect<ReadonlyMap<string, string>, LegacyStatusOverrideParseError> {
+  const knownKeys = new Set(LEGACY_STATUS_FIELDS.map((field) => field.fieldKey));
+  const overrides = new Map<string, string>();
+  for (const entry of entries) {
+    const separatorIndex = entry.indexOf("=");
+    if (separatorIndex <= 0) {
+      return Effect.fail(
+        new LegacyStatusOverrideParseError({
+          message: `invalid override-name entry, expected KEY=VALUE: ${entry}`,
+        }),
+      );
+    }
+    const key = entry.slice(0, separatorIndex);
+    const value = entry.slice(separatorIndex + 1);
+    if (!knownKeys.has(key)) {
+      continue;
+    }
+    overrides.set(key, value);
+  }
+  return Effect.succeed(overrides);
+}
+
+/** Go's `fmt.Fprintln(os.Stderr, "Stopped services:", stopped)` slice format. */
+function formatGoStringSlice(items: ReadonlyArray<string>): string {
+  return `[${items.join(" ")}]`;
+}
+
 export const legacyStatus = Effect.fn("legacy.status")(function* (flags: LegacyStatusFlags) {
-  const proxy = yield* LegacyGoProxy;
-  const args: string[] = ["status"];
-  for (const override of flags.overrideName) args.push("--override-name", override);
-  for (const name of flags.exclude) args.push("--exclude", name);
-  if (flags.ignoreHealthCheck) args.push("--ignore-health-check");
-  yield* proxy.exec(args);
+  const output = yield* Output;
+  const goOutputFlag = yield* LegacyOutputFlag;
+  const cliConfig = yield* LegacyCliConfig;
+  const telemetryState = yield* LegacyTelemetryState;
+  const spawner = yield* ChildProcessSpawner.ChildProcessSpawner;
+  const fs = yield* FileSystem.FileSystem;
+
+  yield* Effect.gen(function* () {
+    // 0. Go's `ChangeWorkDir` (`apps/cli-go/internal/utils/misc.go:231-250`)
+    // unconditionally `os.Chdir`s the resolved `--workdir`/`SUPABASE_WORKDIR`
+    // in `PersistentPreRunE` (`cmd/root.go:93-105`) — before `status`'s own
+    // `PreRunE` (override-name parsing) or `RunE`. A missing or non-directory
+    // path fails immediately, so this must win over every later error.
+    yield* legacyValidateWorkdirIsDirectory(cliConfig.workdir, fs).pipe(
+      Effect.mapError((error) => new LegacyStatusWorkdirError({ message: error.message })),
+    );
+
+    // 1. `--override-name KEY=VALUE` parsing — mirroring Go's Cobra wiring,
+    // where override validation runs in `PreRunE` (`cmd/status.go:21-27`) and
+    // Cobra's execute loop returns as soon as `PreRunE` errors, never calling
+    // `RunE` (`spf13/cobra@v1.10.2/command.go:999-1015`). So a malformed
+    // `--override-name` entry fails before `status.Run` ever loads config or
+    // touches Docker (`internal/status/status.go:101-116`) — it must win over
+    // a config-load error or a Docker/DB health-check error, not be masked by
+    // either. `overrides` itself is only consumed much later, by
+    // `legacyStatusValuesFromState` below.
+    const overrides = yield* parseOverrides(flags.overrideName);
+
+    // 2. `status` always needs config, unlike `stop` (status.go:99-103). An
+    // ABSENT config.toml is not a hard failure in Go: `flags.LoadConfig` ->
+    // `Config.Load` -> `loadFromFile` -> `mergeFileConfig` treats a missing
+    // file as a no-op (`os.ErrNotExist` -> nil, pkg/config/config.go:655-656)
+    // and proceeds with template defaults (`mergeDefaultValues`,
+    // pkg/config/config.go:639-648). Only a MALFORMED file is a hard error.
+    // `legacyLoadLocalProjectContext` mirrors that (decoding an empty document
+    // through the schema for its defaults) and also resolves the sanitized,
+    // config/env-derived project id used below — see its own doc comment for
+    // the full Go-parity rationale (including why workdir validation stays out
+    // of it and is instead handled by step 0 above).
+    const context = yield* legacyLoadLocalProjectContext(
+      cliConfig.workdir,
+      (message) => new LegacyStatusConfigLoadError({ message }),
+    );
+
+    // 3. Resolve + VALIDATE config-derived state before any Docker call —
+    // matching Go's `flags.LoadConfig` (config load + `Validate`,
+    // `internal/utils/flags/config_path.go:12` -> `pkg/config/config.go:882`),
+    // which runs entirely before `assertContainerHealthy`/container listing
+    // (`internal/status/status.go:101-116`). `legacyResolveStatusLocalState`
+    // can throw `LegacyInvalidJwtSecretError` (a short `auth.jwt_secret`),
+    // `LegacyInvalidPortEnvOverrideError`/`LegacyInvalidBoolEnvOverrideError`
+    // (a malformed `SUPABASE_*_PORT`/`SUPABASE_*_ENABLED` override), or a
+    // signing-keys-file read/parse error — all of these must fail here, not
+    // be masked by a Docker/DB error when the local stack happens to be
+    // unavailable.
+    const localState = yield* Effect.try({
+      try: () =>
+        legacyResolveStatusLocalState(
+          context.config,
+          context.hostname,
+          cliConfig.workdir,
+          context.projectEnvValues,
+          context.loaded?.document,
+        ),
+      catch: (cause) =>
+        new LegacyStatusInvalidConfigError({
+          message: cause instanceof Error ? cause.message : String(cause),
+        }),
+    });
+
+    // 4. status has no --project-id flag; resolution is always env → toml →
+    // workdir basename, then sanitized to match the singleton Go's
+    // `Config.Validate` produces once at config-load time
+    // (`pkg/config/config.go:938-944`) — every reader, including the Docker
+    // LABEL `start` writes (`internal/utils/docker.go:375`), sees that same
+    // sanitized string, so `status` must filter on it too (see
+    // `legacyCliProjectFilterValue`'s doc comment).
+    const projectId = context.projectId;
+    const dbContainerId = localDbContainerId(projectId);
+
+    // 5. Health check, skipped entirely with --ignore-health-check (status.go:104-108).
+    // Go's `assertContainerHealthy` never special-cases "not found" — an absent
+    // container fails `ContainerInspect` itself, which surfaces as the generic
+    // inspect error (status.go:147-150), not the "not running" branch (which
+    // only applies to a present-but-stopped container, status.go:150-151).
+    // `legacyInspectContainerState` mirrors that: a missing container is just
+    // another non-zero exit, mapped below with the real Docker stderr text.
+    if (!flags.ignoreHealthCheck) {
+      const state = yield* legacyInspectContainerState(spawner, dbContainerId).pipe(
+        Effect.mapError((cause) => new LegacyStatusDbInspectError({ message: cause.message })),
+      );
+      if (!state.running) {
+        return yield* Effect.fail(
+          new LegacyStatusDbNotRunningError({
+            message: `${dbContainerId} container is not running: ${state.status}`,
+          }),
+        );
+      }
+      if (state.health !== undefined && state.health !== "healthy") {
+        return yield* Effect.fail(
+          new LegacyStatusDbNotReadyError({
+            message: `${dbContainerId} container is not ready: ${state.health}`,
+          }),
+        );
+      }
+    }
+
+    // 6. List running containers, diff against the 13 expected service ids
+    // (status.go:125-145), and report any that are stopped.
+    const filterValue = legacyCliProjectFilterValue(projectId);
+    const runningNames = yield* legacyListContainersByLabel(spawner, {
+      projectIdFilter: filterValue,
+      all: false,
+      format: "names",
+    }).pipe(Effect.mapError((cause) => new LegacyStatusListError({ message: cause.message })));
+    const runningSet = new Set(runningNames);
+    const serviceIds = legacyServiceContainerIds(projectId);
+    const stopped = serviceIds.filter((id) => !runningSet.has(id));
+    if (stopped.length > 0) {
+      yield* output.raw(`Stopped services: ${formatGoStringSlice(stopped)}\n`, "stderr");
+    }
+
+    // 7. Merge health-derived exclusions with the user's --exclude flag.
+    const excluded = [...stopped, ...flags.exclude];
+
+    // 8. Apply the exclude-based gating on top of the already-validated
+    // `localState` (Go's `toValues()` exclude filtering, `status.go:55-61`).
+    // Pure/non-throwing — see `legacyGateStatusState`'s doc comment. Reused
+    // for both the real and pretty-mode (empty-override) value maps below,
+    // matching this handler's pre-split behavior.
+    const containerIds = legacyStatusContainerIds(projectId);
+    const state = legacyGateStatusState(localState, containerIds, excluded);
+    const { values } = legacyStatusValuesFromState(state, overrides);
+
+    // Go's `PrettyPrint` (`status.go:236-243`) unmarshals a FRESH, empty
+    // `EnvSet{}` into a brand-new `CustomName{}` rather than reusing the
+    // CLI-supplied, override-populated `names` — `--override-name` only ever
+    // affects `printStatus`'s env/json/toml/yaml path, never the pretty table.
+    // Remap names from the already-resolved `state` (empty override map) so the
+    // rendered table matches Go exactly without leaking `--override-name` into
+    // pretty-mode output, and without a second (throwing) state resolution.
+    const renderPretty = Effect.fnUntraced(function* () {
+      yield* output.raw(
+        `${legacyAqua("supabase")} local development setup is running.\n\n`,
+        "stderr",
+      );
+      const pretty = legacyStatusValuesFromState(state, new Map());
+      yield* output.raw(legacyRenderStatusPretty(pretty.values, pretty.names));
+    });
+
+    // 9. Output branching: Go's -o (env|json|toml|yaml|pretty) is a complete
+    // format choice and takes priority over --output-format (root.ts:119-121,
+    // matching functions/list's list.handler.ts:115-118) — only an ABSENT -o
+    // defers to --output-format for json/stream-json.
+    const goFmt = Option.getOrUndefined(goOutputFlag);
+
+    if (goFmt === "env") {
+      yield* output.raw(encodeEnv(values) + "\n");
+      return;
+    }
+    if (goFmt === "json") {
+      yield* output.raw(encodeGoJson(values));
+      return;
+    }
+    if (goFmt === "toml") {
+      yield* output.raw(encodeToml(values) + "\n");
+      return;
+    }
+    if (goFmt === "yaml") {
+      yield* output.raw(encodeYaml(values));
+      return;
+    }
+    if (goFmt === "pretty") {
+      yield* renderPretty();
+      return;
+    }
+
+    // goFmt is undefined — defer to TS --output-format for json/stream-json,
+    // otherwise render the grouped rounded-table (Go's `-o pretty` default).
+    if (output.format === "json" || output.format === "stream-json") {
+      yield* output.success("", values);
+      return;
+    }
+
+    yield* renderPretty();
+  }).pipe(Effect.ensuring(telemetryState.flush));
 });
diff --git a/apps/cli/src/legacy/commands/status/status.integration.test.ts b/apps/cli/src/legacy/commands/status/status.integration.test.ts
index 1c87049978..d1988d5569 100644
--- a/apps/cli/src/legacy/commands/status/status.integration.test.ts
+++ b/apps/cli/src/legacy/commands/status/status.integration.test.ts
@@ -1,58 +1,958 @@
+import { generateKeyPairSync } from "node:crypto";
+import { mkdirSync, writeFileSync } from "node:fs";
+import { basename, join } from "node:path";
+
+import { BunServices } from "@effect/platform-bun";
 import { describe, expect, it } from "@effect/vitest";
-import { Effect, Layer } from "effect";
-import { LegacyGoProxy } from "../../../shared/legacy/go-proxy.service.ts";
-import { legacyStatus } from "./status.handler.ts";
+import { Deferred, Effect, Exit, Layer, Option, PlatformError, Sink, Stream } from "effect";
+import { ChildProcessSpawner } from "effect/unstable/process";
+import { afterEach, vi } from "vitest";
+
+import { mockOutput } from "../../../../tests/helpers/mocks.ts";
+import {
+  mockLegacyCliConfig,
+  mockLegacyTelemetryStateTracked,
+  useLegacyTempWorkdir,
+} from "../../../../tests/helpers/legacy-mocks.ts";
+import { LegacyOutputFlag } from "../../../shared/legacy/global-flags.ts";
+import { legacyServiceContainerIds, localDbContainerId } from "../../shared/legacy-docker-ids.ts";
 import type { LegacyStatusFlags } from "./status.command.ts";
+import { legacyStatus } from "./status.handler.ts";
+
+const tempRoot = useLegacyTempWorkdir("supabase-status-int-");
+
+afterEach(() => {
+  delete process.env["SUPABASE_AUTH_JWT_SECRET"];
+});
+
+function flags(overrides: Partial<LegacyStatusFlags> = {}): LegacyStatusFlags {
+  return {
+    overrideName: [],
+    exclude: [],
+    ignoreHealthCheck: false,
+    ...overrides,
+  };
+}
+
+function writeConfig(workdir: string, contents = 'project_id = "demo"\n') {
+  const supabaseDir = join(workdir, "supabase");
+  mkdirSync(supabaseDir, { recursive: true });
+  writeFileSync(join(supabaseDir, "config.toml"), contents);
+}
+
+interface SpawnRecord {
+  readonly command: string;
+  readonly args: ReadonlyArray<string>;
+}
+
+type RouteResult = {
+  readonly exitCode?: number;
+  readonly stdout?: ReadonlyArray<string>;
+  readonly stderr?: ReadonlyArray<string>;
+};
+
+/** Same routing-by-argv mock spawner shape as `stop.integration.test.ts`. */
+function mockRoutedContainerCliSpawner(
+  route: (args: ReadonlyArray<string>) => RouteResult,
+  opts: {
+    readonly dockerMissing?: boolean;
+    readonly failSpawnFor?: (args: ReadonlyArray<string>) => boolean;
+  } = {},
+) {
+  const spawned: Array<SpawnRecord> = [];
+
+  const layer = Layer.succeed(
+    ChildProcessSpawner.ChildProcessSpawner,
+    ChildProcessSpawner.make((command) =>
+      Effect.gen(function* () {
+        const cmd = command._tag === "StandardCommand" ? command.command : "";
+        const args = command._tag === "StandardCommand" ? command.args : [];
+        spawned.push({ command: cmd, args });
+
+        if (opts.dockerMissing === true && cmd === "docker") {
+          return yield* Effect.fail(
+            PlatformError.systemError({
+              _tag: "NotFound",
+              module: "ChildProcess",
+              method: "spawn",
+              description: "docker not found",
+            }),
+          );
+        }
 
-function setupLegacyStatus() {
-  const calls: Array<ReadonlyArray<string>> = [];
-  const layer = Layer.succeed(LegacyGoProxy, {
-    exec: (args) =>
-      Effect.sync(() => {
-        calls.push(args);
+        if (opts.failSpawnFor?.(args) === true) {
+          return yield* Effect.fail(
+            PlatformError.systemError({
+              _tag: "NotFound",
+              module: "ChildProcess",
+              method: "spawn",
+              description: "spawn failed",
+            }),
+          );
+        }
+
+        const encoder = new TextEncoder();
+        const result = route(args);
+        const exitDeferred = yield* Deferred.make<ChildProcessSpawner.ExitCode>();
+        yield* Effect.forkDetach(
+          Effect.gen(function* () {
+            yield* Effect.sleep("5 millis");
+            yield* Deferred.succeed(
+              exitDeferred,
+              ChildProcessSpawner.ExitCode(result.exitCode ?? 0),
+            );
+          }),
+        );
+        const stdoutBytes = (result.stdout ?? []).map((line) => encoder.encode(`${line}\n`));
+        const stderrBytes = (result.stderr ?? []).map((line) => encoder.encode(`${line}\n`));
+
+        return ChildProcessSpawner.makeHandle({
+          pid: ChildProcessSpawner.ProcessId(5000 + spawned.length),
+          stdout: Stream.fromIterable(stdoutBytes),
+          stderr: Stream.fromIterable(stderrBytes),
+          all: Stream.empty,
+          exitCode: Deferred.await(exitDeferred),
+          isRunning: Effect.succeed(false),
+          stdin: Sink.drain,
+          kill: () => Effect.void,
+          unref: Effect.succeed(Effect.void),
+          getInputFd: () => Sink.drain,
+          getOutputFd: () => Stream.empty,
+        });
       }),
-    execCapture: () => Effect.succeed(""),
+    ),
+  );
+
+  return {
+    layer,
+    get spawned() {
+      return spawned;
+    },
+  };
+}
+
+const ALL_RUNNING_NAMES = legacyServiceContainerIds("demo");
+const HEALTHY_DB_STATE = JSON.stringify({
+  Status: "running",
+  Running: true,
+  Health: { Status: "healthy" },
+});
+
+/**
+ * Default happy-path router: db container inspect reports healthy+running, `ps`
+ * (names format) lists every one of the 13 expected services as running.
+ */
+function defaultRoute(
+  opts: {
+    readonly runningNames?: ReadonlyArray<string>;
+    readonly dbInspectStdout?: string;
+    readonly dbInspectExitCode?: number;
+    readonly dbInspectStderr?: ReadonlyArray<string>;
+  } = {},
+) {
+  const runningNames = opts.runningNames ?? ALL_RUNNING_NAMES;
+  return (args: ReadonlyArray<string>): RouteResult => {
+    if (args[0] === "container" && args[1] === "inspect") {
+      return {
+        exitCode: opts.dbInspectExitCode ?? 0,
+        stdout: [opts.dbInspectStdout ?? HEALTHY_DB_STATE],
+        stderr: opts.dbInspectStderr,
+      };
+    }
+    if (args[0] === "ps") return { stdout: runningNames };
+    return { exitCode: 0 };
+  };
+}
+
+interface SetupOpts {
+  readonly format?: "text" | "json" | "stream-json";
+  readonly goOutput?: Option.Option<"env" | "pretty" | "json" | "toml" | "yaml">;
+  readonly route?: (args: ReadonlyArray<string>) => RouteResult;
+  readonly dockerMissing?: boolean;
+  readonly failSpawnFor?: (args: ReadonlyArray<string>) => boolean;
+  readonly skipConfig?: boolean;
+  readonly configContents?: string;
+  /** Defaults to `tempRoot.current` — override for `--workdir`-resolution tests. */
+  readonly workdir?: string;
+}
+
+function setup(opts: SetupOpts = {}) {
+  const workdir = opts.workdir ?? tempRoot.current;
+  if (opts.skipConfig !== true) {
+    writeConfig(workdir, opts.configContents);
+  }
+  const out = mockOutput({
+    format: opts.format ?? "text",
+    interactive: (opts.format ?? "text") === "text",
+  });
+  const telemetry = mockLegacyTelemetryStateTracked();
+  const cliConfig = mockLegacyCliConfig({ workdir, projectId: Option.none() });
+  const child = mockRoutedContainerCliSpawner(opts.route ?? defaultRoute(), {
+    dockerMissing: opts.dockerMissing,
+    failSpawnFor: opts.failSpawnFor,
   });
-  return { layer, calls };
+
+  const layer = Layer.mergeAll(
+    BunServices.layer,
+    out.layer,
+    cliConfig,
+    telemetry.layer,
+    child.layer,
+    Layer.succeed(LegacyOutputFlag, opts.goOutput ?? Option.none()),
+  );
+
+  return { workdir, out, telemetry, child, layer };
 }
 
-const baseFlags: LegacyStatusFlags = {
-  overrideName: [],
-  exclude: [],
-  ignoreHealthCheck: false,
-};
+describe("legacy status integration", () => {
+  it.live("shows the running stack as a pretty table", () => {
+    const { layer, out } = setup();
+    return Effect.gen(function* () {
+      yield* legacyStatus(flags());
+      expect(out.stderrText).toContain("local development setup is running.");
+      expect(out.stdoutText).toContain("🔧 Development Tools");
+      expect(out.stdoutText).toContain("🌐 APIs");
+      expect(out.stdoutText).toContain("⛁ Database");
+      expect(out.stdoutText).toContain("🔑 Authentication Keys");
+      expect(out.stdoutText).toContain("📦 Storage (S3)");
+      expect(out.stdoutText).toContain("postgresql://postgres:postgres@");
+      expect(out.stderrText).not.toContain("Stopped services:");
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live(
+    "sanitizes a dirty config.toml project_id before filtering, matching start's label",
+    () => {
+      // Go's Config.Validate rewrites Config.ProjectId to its sanitized form once
+      // at config-load time (pkg/config/config.go:938-944); every later reader —
+      // including the Docker label `start` writes — sees that same sanitized
+      // string. Filtering/inspecting with the raw value here would target
+      // containers `start` never created.
+      const { layer, child } = setup({ configContents: 'project_id = "My App!!"\n' });
+      return Effect.gen(function* () {
+        yield* legacyStatus(flags());
+        const inspectCall = child.spawned.find(
+          (s) => s.args[0] === "container" && s.args[1] === "inspect",
+        );
+        expect(inspectCall?.args[2]).toBe(localDbContainerId("My_App_"));
+        const psCall = child.spawned.find((s) => s.args[0] === "ps");
+        expect(psCall?.args).toContain("label=com.supabase.cli.project=My_App_");
+      }).pipe(Effect.provide(layer));
+    },
+  );
+
+  it.live("skips the db health check with --ignore-health-check", () => {
+    const { layer, child } = setup({
+      route: (args) => {
+        // db inspect would fail if called; ps still needs to succeed.
+        if (args[0] === "container" && args[1] === "inspect") return { exitCode: 1 };
+        if (args[0] === "ps") return { stdout: ALL_RUNNING_NAMES };
+        return { exitCode: 0 };
+      },
+    });
+    return Effect.gen(function* () {
+      yield* legacyStatus(flags({ ignoreHealthCheck: true }));
+      expect(child.spawned.some((s) => s.args[0] === "container" && s.args[1] === "inspect")).toBe(
+        false,
+      );
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live(
+    "succeeds against an unhealthy db when --ignore-health-check is set (status.go:104-108)",
+    () => {
+      // Pairs with "fails when the db container is unhealthy" below (ignoreHealthCheck: false,
+      // the default) to cover both sides of Go's `if !ignoreHealthCheck { assertContainerHealthy }`.
+      const { layer, child } = setup({
+        route: defaultRoute({
+          dbInspectStdout: JSON.stringify({
+            Status: "running",
+            Running: true,
+            Health: { Status: "starting" },
+          }),
+        }),
+      });
+      return Effect.gen(function* () {
+        yield* legacyStatus(flags({ ignoreHealthCheck: true }));
+        expect(
+          child.spawned.some((s) => s.args[0] === "container" && s.args[1] === "inspect"),
+        ).toBe(false);
+      }).pipe(Effect.provide(layer));
+    },
+  );
+
+  it.live("reports stopped services on stderr", () => {
+    const { layer, out } = setup({
+      route: defaultRoute({ runningNames: ALL_RUNNING_NAMES.slice(1) }),
+    });
+    return Effect.gen(function* () {
+      yield* legacyStatus(flags());
+      const missing = ALL_RUNNING_NAMES[0];
+      expect(out.stderrText).toContain(`Stopped services: [${missing}]`);
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("fails when config.toml is malformed", () => {
+    const workdir = tempRoot.current;
+    mkdirSync(join(workdir, "supabase"), { recursive: true });
+    writeFileSync(join(workdir, "supabase", "config.toml"), "not valid toml =====");
+    const { layer, child } = setup({ skipConfig: true });
+    return Effect.gen(function* () {
+      const exit = yield* Effect.exit(legacyStatus(flags()));
+      expect(Exit.isFailure(exit)).toBe(true);
+      if (Exit.isFailure(exit)) {
+        expect(JSON.stringify(exit.cause)).toContain("LegacyStatusConfigLoadError");
+      }
+      expect(child.spawned).toEqual([]);
+    }).pipe(Effect.provide(layer));
+  });
 
-describe("legacy status", () => {
-  it.live("forwards no extra flags when defaults are used", () => {
-    const { layer, calls } = setupLegacyStatus();
+  it.live("fails when [remotes.*] has a duplicate project_id, even with no projectRef", () => {
+    // Go's duplicate-project_id check (config.go:594-602) runs unconditionally
+    // on every config load, inside the same loop that resolves the [remotes.*]
+    // override — it is not gated on a caller actually selecting a remote.
+    // `status` never binds a --project-ref flag, so it must still fail on a
+    // config-wide duplicate, before ever reaching Docker.
+    const workdir = tempRoot.current;
+    mkdirSync(join(workdir, "supabase"), { recursive: true });
+    writeFileSync(
+      join(workdir, "supabase", "config.toml"),
+      `project_id = "baseref"
+
+[remotes.a]
+project_id = "previewrefaaaaaaaaaa"
+
+[remotes.b]
+project_id = "previewrefaaaaaaaaaa"
+`,
+    );
+    const { layer, child } = setup({ skipConfig: true });
     return Effect.gen(function* () {
-      yield* legacyStatus(baseFlags);
-      expect(calls).toEqual([["status"]]);
+      const exit = yield* Effect.exit(legacyStatus(flags()));
+      expect(Exit.isFailure(exit)).toBe(true);
+      if (Exit.isFailure(exit)) {
+        expect(JSON.stringify(exit.cause)).toContain("LegacyStatusConfigLoadError");
+      }
+      expect(child.spawned).toEqual([]);
     }).pipe(Effect.provide(layer));
   });
 
-  it.live("forwards --override-name for each provided override", () => {
-    const { layer, calls } = setupLegacyStatus();
+  it.live("fails when a [remotes.*] project_id is not a valid 20-letter ref", () => {
+    // Go's Config.Validate (config.go:996-1001) checks every [remotes.*].project_id
+    // against refPattern unconditionally on every config load — not only a
+    // remote that ends up selected — so this must fail closed before status
+    // reaches Docker, even with no --project-ref requested.
+    const workdir = tempRoot.current;
+    mkdirSync(join(workdir, "supabase"), { recursive: true });
+    writeFileSync(
+      join(workdir, "supabase", "config.toml"),
+      `project_id = "baseref"
+
+[remotes.bad]
+project_id = "short"
+`,
+    );
+    const { layer, child } = setup({ skipConfig: true });
     return Effect.gen(function* () {
-      yield* legacyStatus({
-        ...baseFlags,
-        overrideName: ["api.url=NEXT_PUBLIC_SUPABASE_URL"],
+      const exit = yield* Effect.exit(legacyStatus(flags()));
+      expect(Exit.isFailure(exit)).toBe(true);
+      if (Exit.isFailure(exit)) {
+        expect(JSON.stringify(exit.cause)).toContain("LegacyStatusConfigLoadError");
+      }
+      expect(child.spawned).toEqual([]);
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live(
+    "decodes a comma-separated string into an array field ([]string) for status to proceed",
+    () => {
+      // Go's StringToSliceHookFunc (mapstructure) splits a plain string literal
+      // into a []string for a []string field like additional_redirect_urls —
+      // this only runs when goViperCompat is on. Pin that status still proceeds
+      // past config load (and on to a successful Docker inspect/list) rather
+      // than treating the string literal as a decode error.
+      const { layer } = setup({
+        configContents:
+          'project_id = "demo"\n[auth]\nadditional_redirect_urls = "http://a,http://b"\n',
       });
-      expect(calls).toEqual([["status", "--override-name", "api.url=NEXT_PUBLIC_SUPABASE_URL"]]);
+      return Effect.gen(function* () {
+        yield* legacyStatus(flags());
+      }).pipe(Effect.provide(layer));
+    },
+  );
+
+  it.live("warns on stderr for a deprecated auth.external provider", () => {
+    // Go's `external.validate()` (config.go:1418-1423) disables a bare
+    // [auth.external.slack] block and warns — mirrored by
+    // `normalizeDeprecatedExternalProviders` in packages/config's io.ts, gated
+    // on `goViperCompat` (confirmed already wired in status.handler.ts). The
+    // WARN goes out via Effect's `Console.error`, not this file's `Output`
+    // service, so it must be observed with a raw console.error spy — same
+    // idiom as packages/config/src/io.unit.test.ts's deprecated-provider tests.
+    const { layer } = setup({
+      configContents: 'project_id = "demo"\n[auth.external.slack]\nenabled = true\n',
+    });
+    const errorSpy = vi.spyOn(console, "error").mockImplementation(() => {});
+    return Effect.gen(function* () {
+      yield* legacyStatus(flags());
+      expect(errorSpy).toHaveBeenCalledWith(
+        expect.stringContaining('WARN: disabling deprecated "slack" provider'),
+      );
+    }).pipe(Effect.provide(layer), Effect.ensuring(Effect.sync(() => errorSpy.mockRestore())));
+  });
+
+  it.live("fails when --workdir/SUPABASE_WORKDIR points at a missing path", () => {
+    // Go's `ChangeWorkDir` (`apps/cli-go/internal/utils/misc.go:231-250`)
+    // `os.Chdir`s the explicit workdir in `PersistentPreRunE`, before config
+    // load or any Docker call — a missing path must fail immediately, not
+    // fall through to the workdir-basename default and inspect Docker.
+    const missingWorkdir = join(tempRoot.current, "does-not-exist");
+    const { layer, child } = setup({ workdir: missingWorkdir, skipConfig: true });
+    return Effect.gen(function* () {
+      const exit = yield* Effect.exit(legacyStatus(flags()));
+      expect(Exit.isFailure(exit)).toBe(true);
+      if (Exit.isFailure(exit)) {
+        expect(JSON.stringify(exit.cause)).toContain("LegacyStatusWorkdirError");
+        expect(JSON.stringify(exit.cause)).toContain(
+          `failed to change workdir: chdir ${missingWorkdir}: no such file or directory`,
+        );
+      }
+      expect(child.spawned).toEqual([]);
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("fails when --workdir/SUPABASE_WORKDIR points at a file, not a directory", () => {
+    const filePath = join(tempRoot.current, "not-a-directory");
+    writeFileSync(filePath, "");
+    const { layer, child } = setup({ workdir: filePath, skipConfig: true });
+    return Effect.gen(function* () {
+      const exit = yield* Effect.exit(legacyStatus(flags()));
+      expect(Exit.isFailure(exit)).toBe(true);
+      if (Exit.isFailure(exit)) {
+        expect(JSON.stringify(exit.cause)).toContain("LegacyStatusWorkdirError");
+        expect(JSON.stringify(exit.cause)).toContain(
+          `failed to change workdir: chdir ${filePath}: not a directory`,
+        );
+      }
+      expect(child.spawned).toEqual([]);
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("fails when auth.jwt_secret is configured but shorter than 16 characters", () => {
+    // Go's Config.Validate rejects this at config-load time
+    // (pkg/config/apikeys.go:45-47), entirely before assertContainerHealthy/
+    // container listing (internal/status/status.go:101-116) — so no Docker
+    // call happens, same as the malformed config.toml case above.
+    const { layer, child } = setup({
+      configContents: 'project_id = "demo"\n[auth]\njwt_secret = "too-short"\n',
+    });
+    return Effect.gen(function* () {
+      const exit = yield* Effect.exit(legacyStatus(flags()));
+      expect(Exit.isFailure(exit)).toBe(true);
+      if (Exit.isFailure(exit)) {
+        expect(JSON.stringify(exit.cause)).toContain("LegacyStatusInvalidConfigError");
+        expect(JSON.stringify(exit.cause)).toContain(
+          "Invalid config for auth.jwt_secret. Must be at least 16 characters",
+        );
+      }
+      expect(child.spawned).toEqual([]);
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("honors SUPABASE_AUTH_JWT_SECRET over a config.toml value with -o env", () => {
+    // Go's Viper AutomaticEnv gives env vars higher precedence than config.toml
+    // (pkg/config/config.go:529-535) — a stack started with this env var set
+    // must report the env-derived secret, not the one in config.toml.
+    const { layer, out } = setup({
+      goOutput: Option.some("env"),
+      configContents: `project_id = "demo"\n[auth]\njwt_secret = "${"a".repeat(32)}"\n`,
+    });
+    process.env["SUPABASE_AUTH_JWT_SECRET"] = "b".repeat(32);
+    return Effect.gen(function* () {
+      yield* legacyStatus(flags());
+      expect(out.stdoutText).toContain(`JWT_SECRET="${"b".repeat(32)}"`);
+      expect(out.stdoutText).not.toContain("a".repeat(32));
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("signs anon/service_role keys asymmetrically when signing_keys_path is set", () => {
+    // Go's generateJWT signs with the first key in auth.signing_keys_path
+    // (RS256/ES256) instead of HMAC when that file resolves to a non-empty JWK
+    // array (pkg/config/apikeys.go:76-113).
+    const { layer, out, workdir } = setup({
+      goOutput: Option.some("json"),
+      configContents: 'project_id = "demo"\n[auth]\nsigning_keys_path = "signing_keys.json"\n',
+    });
+    const { privateKey } = generateKeyPairSync("rsa", { modulusLength: 2048 });
+    const jwk = { ...privateKey.export({ format: "jwk" }), alg: "RS256", kid: "test-kid" };
+    writeFileSync(join(workdir, "supabase", "signing_keys.json"), JSON.stringify([jwk]));
+    return Effect.gen(function* () {
+      yield* legacyStatus(flags());
+      const parsed = JSON.parse(out.stdoutText) as Record<string, string>;
+      const [headerSegment] = parsed.ANON_KEY?.split(".") ?? [];
+      const header = JSON.parse(Buffer.from(headerSegment ?? "", "base64url").toString());
+      expect(header).toEqual({ alg: "RS256", kid: "test-kid", typ: "JWT" });
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("reports status using schema defaults when config.toml is missing entirely", () => {
+    // Matches Go: `flags.LoadConfig` -> `Config.Load` -> `loadFromFile` ->
+    // `mergeFileConfig` treats a missing file as a no-op (`os.ErrNotExist` ->
+    // nil, pkg/config/config.go:655-656), not an error — `status` proceeds
+    // using template defaults. Only a malformed file is a hard failure (see
+    // the sibling "malformed" test above).
+    //
+    // Without config.toml, the resolved project id falls back to the workdir
+    // basename (not the module-level `ALL_RUNNING_NAMES`, which is fixed to
+    // "demo") — route `ps` off that so the expected services actually show as
+    // running rather than all appearing "stopped" and excluded.
+    const projectId = basename(tempRoot.current);
+    const { layer, out } = setup({
+      skipConfig: true,
+      route: defaultRoute({ runningNames: legacyServiceContainerIds(projectId) }),
+    });
+    return Effect.gen(function* () {
+      yield* legacyStatus(flags());
+      expect(out.stderrText).toContain("local development setup is running.");
+      expect(out.stdoutText).toContain("Project URL");
+      expect(out.stdoutText).toContain("Database");
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("resolves SUPABASE_PROJECT_ID from supabase/.env over config.toml", () => {
+    // Go's Config.Load runs loadNestedEnv (supabase/.env(.local) via godotenv)
+    // before loadFromFile's AutomaticEnv reads SUPABASE_PROJECT_ID
+    // (pkg/config/config.go:735-738) — an env-file-only value overrides
+    // config.toml's project_id too, not just an ambient shell export.
+    const supabaseDir = join(tempRoot.current, "supabase");
+    mkdirSync(supabaseDir, { recursive: true });
+    writeFileSync(join(supabaseDir, ".env"), "SUPABASE_PROJECT_ID=env-file-project\n");
+    const { layer, child } = setup({
+      configContents: 'project_id = "toml-project"\n',
+      route: defaultRoute({ runningNames: legacyServiceContainerIds("env-file-project") }),
+    });
+    return Effect.gen(function* () {
+      yield* legacyStatus(flags());
+      const inspectCall = child.spawned.find(
+        (s) => s.args[0] === "container" && s.args[1] === "inspect",
+      );
+      expect(inspectCall?.args).toContain(localDbContainerId("env-file-project"));
     }).pipe(Effect.provide(layer));
   });
 
-  it.live("forwards the hidden --exclude and --ignore-health-check flags", () => {
-    const { layer, calls } = setupLegacyStatus();
+  it.live("prefers ambient SUPABASE_PROJECT_ID over supabase/.env", () => {
+    const supabaseDir = join(tempRoot.current, "supabase");
+    mkdirSync(supabaseDir, { recursive: true });
+    writeFileSync(join(supabaseDir, ".env"), "SUPABASE_PROJECT_ID=env-file-project\n");
+    process.env["SUPABASE_PROJECT_ID"] = "ambient-project";
+    const { layer, child } = setup({
+      configContents: 'project_id = "toml-project"\n',
+      route: defaultRoute({ runningNames: legacyServiceContainerIds("ambient-project") }),
+    });
+    return Effect.gen(function* () {
+      yield* legacyStatus(flags());
+      const inspectCall = child.spawned.find(
+        (s) => s.args[0] === "container" && s.args[1] === "inspect",
+      );
+      expect(inspectCall?.args).toContain(localDbContainerId("ambient-project"));
+    }).pipe(
+      Effect.provide(layer),
+      Effect.ensuring(Effect.sync(() => delete process.env["SUPABASE_PROJECT_ID"])),
+    );
+  });
+
+  it.live("resolves SUPABASE_PROJECT_ID from a project-root .env file", () => {
+    // Go's loadNestedEnv walks past supabase/ one more level, to the project
+    // root/workdir (pkg/config/config.go:1169-1190) — a project-root-only
+    // dotenv value must override config.toml too, not just supabase/.env.
+    writeFileSync(join(tempRoot.current, ".env"), "SUPABASE_PROJECT_ID=root-env-project\n");
+    const { layer, child } = setup({
+      configContents: 'project_id = "toml-project"\n',
+      route: defaultRoute({ runningNames: legacyServiceContainerIds("root-env-project") }),
+    });
     return Effect.gen(function* () {
-      yield* legacyStatus({
-        overrideName: [],
-        exclude: ["db", "kong"],
-        ignoreHealthCheck: true,
+      yield* legacyStatus(flags());
+      const inspectCall = child.spawned.find(
+        (s) => s.args[0] === "container" && s.args[1] === "inspect",
+      );
+      expect(inspectCall?.args).toContain(localDbContainerId("root-env-project"));
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live(
+    "does not climb to an ancestor project's config.toml when workdir has none of its own",
+    () => {
+      // Go's ChangeWorkDir uses an explicit/defaulted workdir exactly, with no
+      // ancestor search (apps/cli-go/internal/utils/misc.go:231-247) — mirrored
+      // here by `search: false`. A workdir with no supabase/config.toml of its
+      // own must fall back to defaults (workdir-basename project id), not an
+      // ancestor project's config.toml, even though `cliConfig.workdir` sits
+      // right inside one.
+      const nestedWorkdir = join(tempRoot.current, "nested");
+      mkdirSync(nestedWorkdir, { recursive: true });
+      writeConfig(tempRoot.current, 'project_id = "ancestor-project"\n');
+      const projectId = basename(nestedWorkdir);
+      const { layer, child } = setup({
+        workdir: nestedWorkdir,
+        skipConfig: true,
+        route: defaultRoute({ runningNames: legacyServiceContainerIds(projectId) }),
       });
-      expect(calls).toEqual([
-        ["status", "--exclude", "db", "--exclude", "kong", "--ignore-health-check"],
-      ]);
+      return Effect.gen(function* () {
+        yield* legacyStatus(flags());
+        const inspectCall = child.spawned.find(
+          (s) => s.args[0] === "container" && s.args[1] === "inspect",
+        );
+        expect(inspectCall?.args).toContain(localDbContainerId(projectId));
+        expect(inspectCall?.args).not.toContain(localDbContainerId("ancestor-project"));
+      }).pipe(Effect.provide(layer));
+    },
+  );
+
+  it.live("resolves SUPABASE_PROJECT_ID from supabase/.env even when config.toml is absent", () => {
+    // Go's loadNestedEnv runs unconditionally, before config.toml is ever
+    // opened (pkg/config/config.go:786-793) — a supabase/.env-only project id
+    // must still be honored even when there's no config.toml to fall back to
+    // template defaults from.
+    const supabaseDir = join(tempRoot.current, "supabase");
+    mkdirSync(supabaseDir, { recursive: true });
+    writeFileSync(join(supabaseDir, ".env"), "SUPABASE_PROJECT_ID=no-config-project\n");
+    const { layer, child } = setup({
+      skipConfig: true,
+      route: defaultRoute({ runningNames: legacyServiceContainerIds("no-config-project") }),
+    });
+    return Effect.gen(function* () {
+      yield* legacyStatus(flags());
+      const inspectCall = child.spawned.find(
+        (s) => s.args[0] === "container" && s.args[1] === "inspect",
+      );
+      expect(inspectCall?.args).toContain(localDbContainerId("no-config-project"));
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("honors SUPABASE_AUTH_JWT_SECRET from supabase/.env, not just the ambient shell", () => {
+    // Go's Config.Load runs loadNestedEnv (supabase/.env(.local) via godotenv)
+    // before AutomaticEnv reads SUPABASE_AUTH_JWT_SECRET (config.go:735-738) —
+    // a dotenv-file-only value must be visible here too, not just an ambient
+    // shell export (see the sibling "-o env" ambient test above).
+    const supabaseDir = join(tempRoot.current, "supabase");
+    mkdirSync(supabaseDir, { recursive: true });
+    writeFileSync(join(supabaseDir, ".env"), `SUPABASE_AUTH_JWT_SECRET=${"c".repeat(32)}\n`);
+    const { layer, out } = setup({
+      goOutput: Option.some("env"),
+      configContents: `project_id = "demo"\n[auth]\njwt_secret = "${"a".repeat(32)}"\n`,
+    });
+    return Effect.gen(function* () {
+      yield* legacyStatus(flags());
+      expect(out.stdoutText).toContain(`JWT_SECRET="${"c".repeat(32)}"`);
+      expect(out.stdoutText).not.toContain("a".repeat(32));
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("fails when both docker and podman are missing", () => {
+    // Neither container runtime can be spawned at all — distinct from a spawned
+    // process exiting non-zero (covered by the malformed/unhealthy scenarios
+    // above).
+    const { layer } = setup({ failSpawnFor: () => true });
+    return Effect.gen(function* () {
+      const exit = yield* Effect.exit(legacyStatus(flags()));
+      expect(Exit.isFailure(exit)).toBe(true);
+      if (Exit.isFailure(exit)) {
+        expect(JSON.stringify(exit.cause)).toContain("LegacyStatusDbInspectError");
+      }
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("falls back to podman when docker is absent", () => {
+    const { layer, child } = setup({ dockerMissing: true });
+    return Effect.gen(function* () {
+      yield* legacyStatus(flags());
+      // The failed `docker` attempt is recorded before the `podman` fallback fires
+      // (`spawnContainerCli`'s `Effect.catch` retries the same argv), so the last
+      // matching record for a given argv is the successful one.
+      const psCalls = child.spawned.filter((s) => s.args[0] === "ps");
+      expect(psCalls.at(-1)?.command).toBe("podman");
+      expect(psCalls.some((s) => s.command === "docker")).toBe(true);
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("fails when listing running containers errors", () => {
+    const { layer } = setup({
+      route: (args) => {
+        if (args[0] === "container" && args[1] === "inspect") {
+          return { exitCode: 0, stdout: [HEALTHY_DB_STATE] };
+        }
+        if (args[0] === "ps") return { exitCode: 1, stderr: ["daemon down"] };
+        return { exitCode: 0 };
+      },
+    });
+    return Effect.gen(function* () {
+      const exit = yield* Effect.exit(legacyStatus(flags()));
+      expect(Exit.isFailure(exit)).toBe(true);
+      if (Exit.isFailure(exit)) {
+        expect(JSON.stringify(exit.cause)).toContain("LegacyStatusListError");
+      }
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("fails when the db container is not running", () => {
+    const { layer } = setup({
+      route: defaultRoute({
+        dbInspectStdout: JSON.stringify({ Status: "exited", Running: false }),
+      }),
+    });
+    return Effect.gen(function* () {
+      const exit = yield* Effect.exit(legacyStatus(flags()));
+      expect(Exit.isFailure(exit)).toBe(true);
+      if (Exit.isFailure(exit)) {
+        const serialized = JSON.stringify(exit.cause);
+        expect(serialized).toContain("LegacyStatusDbNotRunningError");
+        expect(serialized).toContain(localDbContainerId("demo"));
+      }
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live(
+    "succeeds against a paused-but-healthy db, matching Go's boolean-based running gate",
+    () => {
+      // Go's `assertContainerHealthy` (`status.go:150`) gates on the boolean
+      // `resp.State.Running`, not the status string — a paused container can
+      // report `Running: true` alongside `Status: "paused"`, and Go continues
+      // past the not-running branch to the health check in that case.
+      const { layer } = setup({
+        route: defaultRoute({
+          dbInspectStdout: JSON.stringify({
+            Status: "paused",
+            Running: true,
+            Health: { Status: "healthy" },
+          }),
+        }),
+      });
+      return Effect.gen(function* () {
+        yield* legacyStatus(flags());
+      }).pipe(Effect.provide(layer));
+    },
+  );
+
+  it.live("fails when the db container is absent, preserving the real Docker stderr text", () => {
+    // Go's `assertContainerHealthy` never special-cases "not found" — it wraps
+    // whatever `ContainerInspect` returns (`status.go:148-149`), so the real
+    // Docker stderr must flow through rather than a hardcoded TS string.
+    const { layer } = setup({
+      route: defaultRoute({
+        dbInspectExitCode: 1,
+        dbInspectStderr: ["Error response from daemon: No such container: x"],
+      }),
+    });
+    return Effect.gen(function* () {
+      const exit = yield* Effect.exit(legacyStatus(flags()));
+      expect(Exit.isFailure(exit)).toBe(true);
+      if (Exit.isFailure(exit)) {
+        const serialized = JSON.stringify(exit.cause);
+        expect(serialized).toContain("LegacyStatusDbInspectError");
+        expect(serialized).toContain(
+          "failed to inspect container health: Error response from daemon: No such container: x",
+        );
+      }
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("fails when the db container is unhealthy", () => {
+    const { layer } = setup({
+      route: defaultRoute({
+        dbInspectStdout: JSON.stringify({
+          Status: "running",
+          Running: true,
+          Health: { Status: "starting" },
+        }),
+      }),
+    });
+    return Effect.gen(function* () {
+      const exit = yield* Effect.exit(legacyStatus(flags()));
+      expect(Exit.isFailure(exit)).toBe(true);
+      if (Exit.isFailure(exit)) {
+        expect(JSON.stringify(exit.cause)).toContain("LegacyStatusDbNotReadyError");
+      }
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("fails when db inspect errors for a reason other than not-found", () => {
+    const { layer } = setup({
+      route: defaultRoute({ dbInspectExitCode: 1, dbInspectStderr: ["permission denied"] }),
+    });
+    return Effect.gen(function* () {
+      const exit = yield* Effect.exit(legacyStatus(flags()));
+      expect(Exit.isFailure(exit)).toBe(true);
+      if (Exit.isFailure(exit)) {
+        expect(JSON.stringify(exit.cause)).toContain("LegacyStatusDbInspectError");
+      }
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("outputs env vars with -o env", () => {
+    const { layer, out } = setup({ goOutput: Option.some("env") });
+    return Effect.gen(function* () {
+      yield* legacyStatus(flags());
+      expect(out.stdoutText).toContain('API_URL="http://127.0.0.1:54321"');
+      expect(out.stdoutText).toContain("DB_URL=");
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("outputs a json object with -o json", () => {
+    const { layer, out } = setup({ goOutput: Option.some("json") });
+    return Effect.gen(function* () {
+      yield* legacyStatus(flags());
+      const parsed = JSON.parse(out.stdoutText) as Record<string, string>;
+      expect(parsed.API_URL).toBe("http://127.0.0.1:54321");
+      expect(parsed.DB_URL).toContain("postgresql://postgres:postgres@");
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("omits excluded services from -o json", () => {
+    const { layer, out } = setup({ goOutput: Option.some("json") });
+    return Effect.gen(function* () {
+      const storageId = legacyServiceContainerIds("demo")[5]!;
+      yield* legacyStatus(flags({ exclude: [storageId] }));
+      const parsed = JSON.parse(out.stdoutText) as Record<string, string>;
+      expect(parsed.STORAGE_S3_URL).toBeUndefined();
+      expect(parsed.API_URL).toBeDefined();
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("omits every service named across multiple --exclude entries", () => {
+    const { layer, out } = setup({ goOutput: Option.some("json") });
+    return Effect.gen(function* () {
+      const authId = legacyServiceContainerIds("demo")[1]!;
+      const storageId = legacyServiceContainerIds("demo")[5]!;
+      yield* legacyStatus(flags({ exclude: [authId, storageId] }));
+      const parsed = JSON.parse(out.stdoutText) as Record<string, string>;
+      expect(parsed.PUBLISHABLE_KEY).toBeUndefined();
+      expect(parsed.STORAGE_S3_URL).toBeUndefined();
+      expect(parsed.API_URL).toBeDefined();
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("merges an auto-detected stopped service with a --exclude entry (status.go:116)", () => {
+    // Go's `excluded := append(stopped, exclude...)` merges the health-derived
+    // stopped list with the user-supplied --exclude list — both must take effect
+    // together, not just whichever one the command would have applied alone.
+    const { layer, out } = setup({
+      goOutput: Option.some("json"),
+      // kong (index 0) is absent from the running set, so it's auto-detected as stopped.
+      route: defaultRoute({ runningNames: ALL_RUNNING_NAMES.slice(1) }),
+    });
+    return Effect.gen(function* () {
+      const authId = legacyServiceContainerIds("demo")[1]!;
+      yield* legacyStatus(flags({ exclude: [authId] }));
+      const parsed = JSON.parse(out.stdoutText) as Record<string, string>;
+      expect(parsed.API_URL).toBeUndefined(); // excluded via the auto-detected stopped kong
+      expect(parsed.PUBLISHABLE_KEY).toBeUndefined(); // excluded via --exclude
+      expect(parsed.DB_URL).toBeDefined(); // db.url is set unconditionally, before any gating
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("outputs yaml with -o yaml", () => {
+    const { layer, out } = setup({ goOutput: Option.some("yaml") });
+    return Effect.gen(function* () {
+      yield* legacyStatus(flags());
+      expect(out.stdoutText).toContain("API_URL:");
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("outputs toml with -o toml", () => {
+    const { layer, out } = setup({ goOutput: Option.some("toml") });
+    return Effect.gen(function* () {
+      yield* legacyStatus(flags());
+      expect(out.stdoutText).toContain("API_URL =");
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("remaps an output key with --override-name api.url=NEXT_PUBLIC_SUPABASE_URL", () => {
+    const { layer, out } = setup({ goOutput: Option.some("json") });
+    return Effect.gen(function* () {
+      yield* legacyStatus(flags({ overrideName: ["api.url=NEXT_PUBLIC_SUPABASE_URL"] }));
+      const parsed = JSON.parse(out.stdoutText) as Record<string, string>;
+      expect(parsed.NEXT_PUBLIC_SUPABASE_URL).toBe("http://127.0.0.1:54321");
+      expect(parsed.API_URL).toBeUndefined();
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("fails on a malformed --override-name entry", () => {
+    const { layer } = setup();
+    return Effect.gen(function* () {
+      const exit = yield* Effect.exit(legacyStatus(flags({ overrideName: ["not-a-kv-pair"] })));
+      expect(Exit.isFailure(exit)).toBe(true);
+      if (Exit.isFailure(exit)) {
+        expect(JSON.stringify(exit.cause)).toContain("LegacyStatusOverrideParseError");
+      }
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("silently ignores an --override-name entry with an unknown field key", () => {
+    // Matches Go: `env.Unmarshal` (Netflix go-env) walks CustomName's own struct
+    // fields and looks up each field's tag in the override map — it never checks
+    // for leftover/unmatched keys, so an unrecognized key is a no-op, not an error.
+    const { layer, out } = setup({ goOutput: Option.some("json") });
+    return Effect.gen(function* () {
+      yield* legacyStatus(flags({ overrideName: ["not.a.real.field=NAME"] }));
+      const parsed = JSON.parse(out.stdoutText) as Record<string, string>;
+      expect(parsed.NAME).toBeUndefined();
+      expect(parsed.API_URL).toBe("http://127.0.0.1:54321");
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("applies a valid --override-name entry alongside an unknown one", () => {
+    const { layer, out } = setup({ goOutput: Option.some("json") });
+    return Effect.gen(function* () {
+      yield* legacyStatus(
+        flags({ overrideName: ["not.a.real.field=NAME", "api.url=NEXT_PUBLIC_SUPABASE_URL"] }),
+      );
+      const parsed = JSON.parse(out.stdoutText) as Record<string, string>;
+      expect(parsed.NEXT_PUBLIC_SUPABASE_URL).toBe("http://127.0.0.1:54321");
+      expect(parsed.NAME).toBeUndefined();
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("emits a machine result with --output-format json when -o is unset", () => {
+    const { layer, out } = setup({ format: "json" });
+    return Effect.gen(function* () {
+      yield* legacyStatus(flags());
+      const success = out.messages.find((m) => m.type === "success");
+      expect(success?.data).toMatchObject({ API_URL: "http://127.0.0.1:54321" });
+      expect(out.stdoutText).not.toContain("\x1b[?25l");
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("-o takes priority over --output-format when both are passed", () => {
+    const { layer, out } = setup({ format: "json", goOutput: Option.some("env") });
+    return Effect.gen(function* () {
+      yield* legacyStatus(flags());
+      // -o env wins: raw KEY="VALUE" text on stdout, not a structured success message.
+      expect(out.stdoutText).toContain('API_URL="http://127.0.0.1:54321"');
+      expect(out.messages.find((m) => m.type === "success")).toBeUndefined();
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("lets --output pretty win over --output-format json", () => {
+    // Explicit `-o pretty` is a complete Go format choice (root.ts:119-121,
+    // matching functions/list) and must render the table, not defer to the
+    // TS-only --output-format json/stream-json branch.
+    const { layer, out } = setup({ format: "json", goOutput: Option.some("pretty") });
+    return Effect.gen(function* () {
+      yield* legacyStatus(flags());
+      expect(out.stderrText).toContain("local development setup is running.");
+      expect(out.stdoutText).toContain("🌐 APIs");
+      expect(out.messages.find((m) => m.type === "success")).toBeUndefined();
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("flushes telemetry via ensuring even on failure", () => {
+    const { layer, telemetry } = setup({
+      route: (args) =>
+        args[0] === "container" && args[1] === "inspect" ? { exitCode: 1 } : { exitCode: 0 },
+    });
+    return Effect.gen(function* () {
+      yield* Effect.exit(legacyStatus(flags()));
+      expect(telemetry.flushed).toBe(true);
     }).pipe(Effect.provide(layer));
   });
 });
diff --git a/apps/cli/src/legacy/commands/status/status.live.test.ts b/apps/cli/src/legacy/commands/status/status.live.test.ts
new file mode 100644
index 0000000000..64569c118c
--- /dev/null
+++ b/apps/cli/src/legacy/commands/status/status.live.test.ts
@@ -0,0 +1,54 @@
+import { mkdtemp, rm } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import path from "node:path";
+import { afterEach, expect, test } from "vitest";
+
+import { describeLive, runSupabaseLive } from "../../../../tests/helpers/live.ts";
+
+const START_TIMEOUT_MS = 280_000;
+
+// See stop.live.test.ts for why `describeLive` (not a Management-API gate) is
+// the right reuse here: `status` never calls the Management API, only the real
+// Docker daemon the cli-e2e-ci runner provides. See AGENTS.md's "Live tests"
+// section for the full convention.
+describeLive("supabase status (live)", () => {
+  let projectDir: string | undefined;
+
+  afterEach(async () => {
+    if (projectDir === undefined) return;
+    await runSupabaseLive(["stop", "--no-backup"], { cwd: projectDir }).catch(() => undefined);
+    await rm(projectDir, { recursive: true, force: true }).catch(() => undefined);
+    projectDir = undefined;
+  });
+
+  test(
+    "reports a running local stack in pretty and json modes",
+    { timeout: START_TIMEOUT_MS },
+    async () => {
+      projectDir = await mkdtemp(path.join(tmpdir(), "sb-status-live-"));
+
+      const init = await runSupabaseLive(["init"], { cwd: projectDir });
+      expect(init.exitCode, `stdout:\n${init.stdout}\nstderr:\n${init.stderr}`).toBe(0);
+
+      const start = await runSupabaseLive(
+        ["start", "--exclude", "studio", "--exclude", "analytics", "--exclude", "vector"],
+        { cwd: projectDir, exitTimeoutMs: START_TIMEOUT_MS },
+      );
+      expect(start.exitCode, `stdout:\n${start.stdout}\nstderr:\n${start.stderr}`).toBe(0);
+
+      const pretty = await runSupabaseLive(["status"], { cwd: projectDir });
+      expect(pretty.exitCode, `stdout:\n${pretty.stdout}\nstderr:\n${pretty.stderr}`).toBe(0);
+      expect(`${pretty.stdout}${pretty.stderr}`).toContain("is running");
+      expect(pretty.stdout).toContain("Project URL");
+      expect(pretty.stdout).toContain("Database");
+
+      const json = await runSupabaseLive(["status", "-o", "json"], { cwd: projectDir });
+      expect(json.exitCode, `stdout:\n${json.stdout}\nstderr:\n${json.stderr}`).toBe(0);
+      const parsed: unknown = JSON.parse(json.stdout);
+      expect(parsed).toMatchObject({
+        API_URL: expect.stringContaining("http"),
+        DB_URL: expect.stringContaining("postgresql://"),
+      });
+    },
+  );
+});
diff --git a/apps/cli/src/legacy/commands/stop/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/stop/SIDE_EFFECTS.md
index 09cf725258..d73a2c77d5 100644
--- a/apps/cli/src/legacy/commands/stop/SIDE_EFFECTS.md
+++ b/apps/cli/src/legacy/commands/stop/SIDE_EFFECTS.md
@@ -1,16 +1,56 @@
 # `supabase stop`
 
+Native TypeScript port of Go's `internal/stop`. Talks directly to Docker via subprocess
+(`docker`/`podman`), replicating Go's label-filtering and container-naming scheme
+byte-for-byte — it does not go through `@supabase/stack/effect`'s orchestration model
+(see the CLI-1324 plan's "Critical architectural finding" for why).
+
 ## Files Read
 
-| Path                             | Format | When                                     |
-| -------------------------------- | ------ | ---------------------------------------- |
-| `<workdir>/supabase/config.toml` | TOML   | always, to resolve project configuration |
+| Path                             | Format | When                                                                       |
+| -------------------------------- | ------ | -------------------------------------------------------------------------- |
+| `<workdir>/supabase/config.toml` | TOML   | default path only — skipped entirely when `--project-id` or `--all` is set |
 
 ## Files Written
 
-| Path | Format | When |
-| ---- | ------ | ---- |
-| —    | —      | —    |
+| Path                                                                | Format              | When                                                                                    |
+| ------------------------------------------------------------------- | ------------------- | --------------------------------------------------------------------------------------- |
+| `~/.supabase/telemetry.json`                                        | JSON                | always (in `Effect.ensuring`) at end of command — Go parity                             |
+| `<workdir>/supabase/.temp/start-secrets/<container-name>` (removed) | plaintext, per-file | after teardown succeeds, for every container name torn down that had a staged directory |
+
+The `start-secrets` removal is a TS-port-only hygiene step (`legacyCleanupStartSecrets`,
+`legacy/shared/legacy-start-secrets-cleanup.ts`) — Go never stages secrets on host disk in
+the first place, so it has nothing to clean up here. `start` stages plaintext Kong TLS/
+`kong.yml`, Postgres pgsodium root key, Supavisor pooler tenant-script content
+(`legacyStageStartSecretFiles`, `start/lib/container-lifecycle.ts`), and Edge Runtime's own
+JWT/service-role-key/secret env artifacts (`shared/functions/serve.ts`'s
+`writeDockerEnvFile`/`writeDockerMultilineEnvScript`/`writeServeMainTemplateFile`) on host
+disk because this port shells out to `docker create`/`docker run` instead of using the
+Docker Engine API directly; without this cleanup those directories would survive `stop`
+indefinitely. The containers to clean are captured via `legacyDockerRemoveAll`'s own
+`onContainersRemoved` hook, which fires only once `docker container prune` has CONFIRMED
+they're actually gone — not at the initial `docker ps` listing, and not before the
+stop/prune stages have even run — so a container the stop stage itself failed on (meaning
+`container prune` never ran and nothing was actually removed) keeps its secrets, and a
+container still running after a later, unrelated failure (volume/network prune) is never
+touched. The hook is fed by `legacyDockerRemoveAll`'s single internal `docker ps` listing
+(no separate, second `docker ps` call — see that function's doc comment for the parity
+rationale), so cleanup targets exactly the containers this run actually tore down — never
+a blanket delete of the whole `start-secrets/` parent (unsafe if a workdir's project id
+ever changes across `start` runs without an intervening `stop`).
+
+Each container's own directory is resolved using THAT container's `com.supabase.cli.workdir`
+label (stamped on every container `start` creates, `container-lifecycle.ts`) rather than
+this invocation's own `<workdir>`: `stop --all`/`stop --project-id <other>` can tear down a
+DIFFERENT project's containers than the one this invocation's own cwd/`--workdir` points
+at, and using this invocation's workdir unconditionally would look in the wrong directory,
+silently orphaning that other project's staged secret files forever (the containers are
+now gone, so no future `stop` could rediscover them via `docker ps` either). This
+invocation's own `<workdir>` is used only as a fallback, for a container with no such label
+(created before this label existed).
+
+Best-effort: a missing directory (every service besides Kong/Postgres/Supavisor/Edge
+Runtime) is a no-op, and a real deletion error does not fail the command.
 
 ## API Routes
 
@@ -18,37 +58,109 @@
 | ------ | ---- | ---- | ------------ | ---------------------- |
 | —      | —    | —    | —            | —                      |
 
+Neither `stop` nor its Go counterpart make any Management API call. Everything is local
+Docker + local `config.toml`.
+
 ## Environment Variables
 
-| Variable | Purpose | Required? |
-| -------- | ------- | --------- |
-| —        | —       | —         |
+| Variable              | Purpose                                                                                            | Required?                                                         |
+| --------------------- | -------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------- |
+| `SUPABASE_PROJECT_ID` | overrides the resolved local project id on the default path (env → config.toml → workdir basename) | no                                                                |
+| `SUPABASE_WORKDIR`    | resolves `LegacyCliConfig.workdir`, which locates `config.toml` on the default path                | no (falls back to walking up from cwd for `supabase/config.toml`) |
+
+`docker`/`podman` must be resolvable on `PATH` (or reachable via the configured Docker
+context) — `spawnContainerCli` tries `docker` first and falls back to `podman`. When
+neither can be spawned at all, the error message names the actual root cause (e.g.
+"docker: command not found (podman also not found) — install Docker Desktop or Podman
+and ensure it is on PATH") rather than a generic "failed to ..." string.
 
 ## Exit Codes
 
-| Code | Condition                                     |
-| ---- | --------------------------------------------- |
-| `0`  | success — all containers stopped              |
-| `1`  | Docker daemon not running or connection error |
+| Code | Condition                                                                                                |
+| ---- | -------------------------------------------------------------------------------------------------------- |
+| `0`  | success — containers/volumes/networks pruned                                                             |
+| `1`  | `--project-id` and `--all` both set (`LegacyStopMutuallyExclusiveError`)                                 |
+| `1`  | `config.toml` present but malformed (`LegacyStopConfigLoadError`) — an **absent** file is not an error   |
+| `1`  | listing containers failed (`LegacyStopListError`)                                                        |
+| `1`  | stopping one or more containers failed (`LegacyStopContainerError`)                                      |
+| `1`  | `docker container prune` failed (`LegacyStopContainerPruneError`)                                        |
+| `1`  | `docker volume prune` failed, only reached when volumes are being deleted (`LegacyStopVolumePruneError`) |
+| `1`  | `docker network prune` failed (`LegacyStopNetworkPruneError`)                                            |
+| `1`  | `docker`/`podman` both absent from `PATH` (surfaces as one of the errors above)                          |
+
+## Telemetry Events Fired
+
+| Event                  | When                                       | Notable properties / groups         |
+| ---------------------- | ------------------------------------------ | ----------------------------------- |
+| `cli_command_executed` | post-run, success or failure (via wrapper) | `exit_code`, `duration_ms`, `flags` |
+
+Matches `apps/cli-go/internal/stop/`. Go does not fire any custom telemetry event for
+this command.
 
 ## Output
 
+Go's `stop.RunE` never reads `-o`/`--output` itself, but the flag is still registered
+on the root command as a `PersistentFlags()` enum (`cmd/root.go:330`,
+`env|pretty|json|toml|yaml`) that every subcommand inherits, so `stop -o csv`/`-o table`
+is rejected by pflag at parse time, before `RunE` runs — Go never reaches this command's
+body with an unsupported value. `stop.command.ts` matches this: it wraps the handler
+with `withLegacyCommandInstrumentation`, whose default `outputFormats`
+(`LEGACY_RESOURCE_OUTPUT_FORMATS`, same `env|pretty|json|toml|yaml` set) validates and
+rejects the flag before the handler runs — not a divergence, just enforced one layer up
+rather than read inside this handler. Only the TS-native `--output-format` is consulted
+by this handler's own logic below.
+
 ### `--output-format text` (Go CLI compatible)
 
-Prints "Stopped supabase local development setup." on success.
+- stdout: `Stopping containers...` (printed unconditionally before any Docker call,
+  matching Go's `fmt.Fprintln` — see `docker.go:97`)
+- stdout: `Stopped supabase local development setup.` (`supabase` rendered in Aqua/cyan
+  when the output stream is a TTY, plain otherwise)
+- stderr (conditional): when any Docker volume still carries the project's
+  `com.supabase.cli.project` label after stopping, an additional suggestion line:
+  - with a project id filter: `Local data are backed up to docker volume. Use docker to show them: docker volume ls --filter label=com.supabase.cli.project=<id>`
+  - with `--all` (empty filter): `Local data are backed up to docker volume. Use docker to show them: docker volume ls --filter label=com.supabase.cli.project`
 
 ### `--output-format json`
 
-Not applicable — stop is a local-dev workflow command.
+Additive — no Go CLI equivalent. Single JSON object via `Output.success`:
+
+```json
+{ "project_id_filter": "demo", "backup": true }
+```
 
 ### `--output-format stream-json`
 
-Not applicable — stop is a local-dev workflow command.
+Same payload as `json`, delivered as a `result` NDJSON event.
 
 ## Notes
 
-- `--no-backup` deletes all data volumes after stopping.
-- `--project-id` targets a specific local project ID to stop.
-- `--all` stops all local Supabase instances across all projects on the machine.
-- `--project-id` and `--all` are mutually exclusive.
-- The hidden `--backup` flag (default true) is the inverse of `--no-backup`.
+- `--project-id` and `--all` are **directory-independent** pure Docker-label filters —
+  neither reads `config.toml`. Only the no-flags default path resolves the project id
+  from `LegacyCliConfig.workdir` (env → config.toml `project_id` → workdir basename).
+- The hidden `--backup` flag exists only for Go CLI surface parity — it has **no effect**.
+  Go declares it via `flags.Bool("backup", true, ...)` (`cmd/stop.go:26`) but never binds
+  the return value to a variable, so `RunE` always passes `!noBackup` to `stop.Run`
+  regardless of `--backup`. The TS port matches this exactly: `deleteVolumes =
+flags.noBackup`. `--backup=false` alone does **not** delete volumes; only
+  `--no-backup` does.
+- Volume prune gates `--all` on the Docker daemon's API version (`legacy-container-cli.ts`'s
+  `legacyDockerSupportsVolumePruneAllFlag`, checked via `docker version --format
+'{{.Server.APIVersion}}'`), matching Go's `Docker.ClientVersion() >= "1.42"` check
+  (`docker.go:126-133`) exactly. This isn't cosmetic: Docker CLI's own `--all` flag on
+  `volume prune` is annotated `version: "1.42"` and enforced by Cobra's `Args` validator
+  _before_ pruning runs, so sending it unconditionally on a pre-1.42 daemon hard-fails the
+  whole call instead of just pruning a narrower set. On the Podman fallback, `--all` is
+  omitted unconditionally instead: no released Podman `volume prune` (checked v4.3 through
+  the current v5.7) accepts that flag, and Podman already prunes every unused volume by
+  default, so dropping it there is lossless. Podman itself is a TS-only fallback (Go never
+  shells out to a `docker`/`podman` binary), so this has no Go-parity implication either way.
+- Containers are stopped concurrently (`Effect.all(..., { concurrency: "unbounded" })`),
+  mirroring Go's `WaitAll` goroutine fan-out. Every container's failure is checked before
+  failing the command (rather than stopping at the first failure), matching Go's
+  `errors.Join` over the full result set — though the surfaced message is a single fixed
+  string rather than a joined list of per-container errors, since Docker CLI subprocess
+  stderr isn't captured per-container the way Go's SDK error is.
+- No e2e test is planned: there is no Docker-daemon-free golden path for this command,
+  and the e2e harness (`runSupabase()`) does not provision a real local stack. See the
+  CLI-1324 plan's "E2e tests" section for the full justification.
diff --git a/apps/cli/src/legacy/commands/stop/stop.command.ts b/apps/cli/src/legacy/commands/stop/stop.command.ts
index c89e0c3d1d..64fb443c6b 100644
--- a/apps/cli/src/legacy/commands/stop/stop.command.ts
+++ b/apps/cli/src/legacy/commands/stop/stop.command.ts
@@ -1,5 +1,13 @@
+import { Layer } from "effect";
 import { Command, Flag } from "effect/unstable/cli";
 import type * as CliCommand from "effect/unstable/cli/Command";
+
+import { commandRuntimeLayer } from "../../../shared/runtime/command-runtime.layer.ts";
+import { withJsonErrorHandling } from "../../../shared/output/json-error-handling.ts";
+import { legacyCliConfigLayer } from "../../config/legacy-cli-config.layer.ts";
+import { legacyDebugLoggerLayer } from "../../shared/legacy-debug-logger.layer.ts";
+import { legacyTelemetryStateLayer } from "../../telemetry/legacy-telemetry-state.layer.ts";
+import { withLegacyCommandInstrumentation } from "../../telemetry/legacy-command-instrumentation.ts";
 import { legacyStop } from "./stop.handler.ts";
 
 const config = {
@@ -17,15 +25,41 @@ const config = {
   noBackup: Flag.boolean("no-backup").pipe(
     Flag.withDescription("Deletes all data volumes after stopping."),
   ),
+  // Modelled as `Option<boolean>` (presence = pflag `Changed`), not a plain
+  // boolean: Cobra's `MarkFlagsMutuallyExclusive("project-id", "all")`
+  // (`apps/cli-go/cmd/stop.go:31`) rejects the command whenever BOTH flags
+  // were explicitly set, regardless of the value `--all` was set to — the
+  // vendored cobra@v1.10.2 `flag_groups.go:139` check is
+  // `groupStatus[group][name] = flag.Changed`, not the flag's boolean value.
+  // A plain `Flag.boolean` here would make `--project-id x --all=false`
+  // indistinguishable from `--project-id x` (no `--all` at all), silently
+  // accepting a combination Go rejects.
   all: Flag.boolean("all").pipe(
     Flag.withDescription("Stop all local Supabase instances from all projects across the machine."),
+    Flag.optional,
   ),
 } as const;
 
 export type LegacyStopFlags = CliCommand.Command.Config.Infer<typeof config>;
 
+// `stop` makes no Management API calls (Go's stop needs no access token) and talks
+// directly to Docker, so it deliberately avoids `legacyManagementApiRuntimeLayer` —
+// it provides only the services the handler + instrumentation consume.
+// `ChildProcessSpawner` is not listed here: it comes from `BunServices` in the root
+// runtime (`shared/cli/run.ts`), the same way `gen types`/`unlink` rely on it.
+const cliConfig = legacyCliConfigLayer.pipe(Layer.provide(legacyDebugLoggerLayer));
+
+const legacyStopRuntimeLayer = Layer.mergeAll(
+  cliConfig,
+  legacyTelemetryStateLayer,
+  commandRuntimeLayer(["stop"]),
+);
+
 export const legacyStopCommand = Command.make("stop", config).pipe(
   Command.withDescription("Stop all local Supabase containers."),
   Command.withShortDescription("Stop all local Supabase containers"),
-  Command.withHandler((flags) => legacyStop(flags)),
+  Command.withHandler((flags) =>
+    legacyStop(flags).pipe(withLegacyCommandInstrumentation({ flags }), withJsonErrorHandling),
+  ),
+  Command.provide(legacyStopRuntimeLayer),
 );
diff --git a/apps/cli/src/legacy/commands/stop/stop.errors.ts b/apps/cli/src/legacy/commands/stop/stop.errors.ts
new file mode 100644
index 0000000000..ac8d49db97
--- /dev/null
+++ b/apps/cli/src/legacy/commands/stop/stop.errors.ts
@@ -0,0 +1,62 @@
+import { Data } from "effect";
+
+/**
+ * An explicit `--workdir`/`SUPABASE_WORKDIR` path doesn't exist or isn't a
+ * directory. Mirrors Go's `ChangeWorkDir` (`apps/cli-go/internal/utils/misc.go:
+ * 231-250`), which unconditionally `os.Chdir(workdir)`s in `PersistentPreRunE`
+ * (`apps/cli-go/cmd/root.go:93-105`) — before `stop`'s own flag validation or
+ * `RunE`, so a bad explicit workdir must fail here first, before config load
+ * or any Docker access.
+ */
+export class LegacyStopWorkdirError extends Data.TaggedError("LegacyStopWorkdirError")<{
+  readonly message: string;
+}> {}
+
+/**
+ * `--project-id` and `--all` were both set. Best-effort match of cobra's
+ * `MarkFlagsMutuallyExclusive` message shape (`stopCmd.MarkFlagsMutuallyExclusive("project-id",
+ * "all")`, `apps/cli-go/cmd/stop.go`). Cobra isn't vendored in this repo, so the exact
+ * wording could not be verified against source; this mirrors the same phrasing already
+ * used for `gen types`'s mutually-exclusive flag groups (`types.handler.ts`).
+ */
+export class LegacyStopMutuallyExclusiveError extends Data.TaggedError(
+  "LegacyStopMutuallyExclusiveError",
+)<{
+  readonly message: string;
+}> {}
+
+/** Loading `config.toml` failed for a reason other than the file being absent (malformed TOML). */
+export class LegacyStopConfigLoadError extends Data.TaggedError("LegacyStopConfigLoadError")<{
+  readonly message: string;
+}> {}
+
+/**
+ * Listing containers to stop failed. `stop`-specific wrapper over
+ * `LegacyDockerLifecycleListError` (see `legacy-docker-lifecycle.ts`) so this command's
+ * errors are all in one file with a `LegacyStop*` tag, matching the plan's error list.
+ */
+export class LegacyStopListError extends Data.TaggedError("LegacyStopListError")<{
+  readonly message: string;
+}> {}
+
+/** Stopping one or more containers failed (`DockerRemoveAll`'s `WaitAll` step). */
+export class LegacyStopContainerError extends Data.TaggedError("LegacyStopContainerError")<{
+  readonly message: string;
+}> {}
+
+/** `docker container prune` failed. */
+export class LegacyStopContainerPruneError extends Data.TaggedError(
+  "LegacyStopContainerPruneError",
+)<{
+  readonly message: string;
+}> {}
+
+/** `docker volume prune` failed (only run when `--no-backup`/`--backup=false`). */
+export class LegacyStopVolumePruneError extends Data.TaggedError("LegacyStopVolumePruneError")<{
+  readonly message: string;
+}> {}
+
+/** `docker network prune` failed. */
+export class LegacyStopNetworkPruneError extends Data.TaggedError("LegacyStopNetworkPruneError")<{
+  readonly message: string;
+}> {}
diff --git a/apps/cli/src/legacy/commands/stop/stop.handler.ts b/apps/cli/src/legacy/commands/stop/stop.handler.ts
index ab7f5f9ad8..ff8e8e5bfc 100644
--- a/apps/cli/src/legacy/commands/stop/stop.handler.ts
+++ b/apps/cli/src/legacy/commands/stop/stop.handler.ts
@@ -1,15 +1,258 @@
-import { Effect, Option } from "effect";
-import { LegacyGoProxy } from "../../../shared/legacy/go-proxy.service.ts";
+import { Effect, FileSystem, Option } from "effect";
+import { ChildProcessSpawner } from "effect/unstable/process";
+
+import { Output } from "../../../shared/output/output.service.ts";
+import { LegacyCliConfig } from "../../config/legacy-cli-config.service.ts";
+import { LegacyTelemetryState } from "../../telemetry/legacy-telemetry-state.service.ts";
+import { legacyAqua } from "../../shared/legacy-colors.ts";
+import { legacyCliProjectFilterValue } from "../../shared/legacy-docker-ids.ts";
+import {
+  legacyListVolumesByLabel,
+  type LegacyContainerIdName,
+} from "../../shared/legacy-docker-lifecycle.ts";
+import { legacyDockerRemoveAll } from "../../shared/legacy-docker-remove-all.ts";
+import { legacyCleanupStartSecrets } from "../../shared/legacy-start-secrets-cleanup.ts";
+import { legacyResolveLocalConfigValues } from "../../shared/legacy-local-config-values.ts";
+import { legacyLoadLocalProjectContext } from "../../shared/legacy-local-project-context.ts";
+import { legacyValidateWorkdirIsDirectory } from "../../shared/legacy-workdir-validation.ts";
 import type { LegacyStopFlags } from "./stop.command.ts";
+import {
+  LegacyStopConfigLoadError,
+  LegacyStopContainerError,
+  LegacyStopContainerPruneError,
+  LegacyStopListError,
+  LegacyStopMutuallyExclusiveError,
+  LegacyStopNetworkPruneError,
+  LegacyStopVolumePruneError,
+  LegacyStopWorkdirError,
+} from "./stop.errors.ts";
+
+/**
+ * Resolve the Docker label filter `stop` searches on. Go's flag precedence
+ * (`stop.go:14-22`): `--all` bypasses config entirely with an empty filter;
+ * `--project-id` overrides `Config.ProjectId` directly, also bypassing
+ * config.toml; otherwise `flags.LoadConfig` reads config.toml and
+ * `Config.ProjectId` (env → toml → workdir basename) is used.
+ *
+ * "env" is Go's post-`loadNestedEnv` value, not just the ambient shell
+ * environment: `Config.Load` loads `supabase/.env`/`.env.local` *and*
+ * project-root/`SUPABASE_ENV`-selected dotenv files into the process env via
+ * `godotenv.Load` (`pkg/config/config.go:735-738,1169-1207`; godotenv never
+ * overrides an already-set var) *before* Viper's `AutomaticEnv` reads
+ * `SUPABASE_PROJECT_ID` (`config.go:534-535`) — so an env-file-only value
+ * overrides config.toml too, not only an ambient shell export.
+ * `legacyResolveProjectEnvironmentValues` implements that full precedence
+ * chain (see its doc comment) on top of `loadProjectEnvironment`'s
+ * `supabase/`-dir-only result, so it's used here instead of reading
+ * `process.env` directly. It still returns a usable map (falling back to
+ * `<workdir>/supabase`/`workdir` and `process.env` itself) even when no
+ * `supabase/` config file exists at `workdir`, matching Go's `loadNestedEnv`
+ * running unconditionally before `config.toml` is ever opened
+ * (`pkg/config/config.go:786-793`) — the `?? process.env[...]` fallback below
+ * only still matters for keys neither source produced.
+ *
+ * The config/env-derived (default) branch is sanitized with
+ * `legacySanitizeProjectId` before it's used as a filter value,
+ * matching Go's `Config.Validate` sanitizing the `Config.ProjectId`
+ * singleton once at config-load time (`pkg/config/config.go:938-944`) — every
+ * later reader, including the Docker LABEL `start` writes
+ * (`internal/utils/docker.go:375`), sees that same sanitized string. The
+ * explicit `--project-id` bypass stays RAW to match: Go assigns the flag
+ * value straight to `Config.ProjectId` without going through `Validate`
+ * (`internal/stop/stop.go:19-20`).
+ *
+ * Go's check is `len(projectId) > 0` (`internal/stop/stop.go:18`), not merely
+ * "was the flag set" — an explicit but empty `--project-id ""` falls through
+ * to the config.toml branch exactly like an absent flag, so that's mirrored
+ * here with a non-empty check rather than `Option.isSome` alone.
+ */
+const resolveSearchProjectIdFilter = Effect.fn("legacy.stop.resolveSearchProjectIdFilter")(
+  function* (flags: LegacyStopFlags, cliConfig: LegacyCliConfig["Service"]) {
+    // `internal/stop/stop.go:17`'s `if !all` reads the resolved value (not
+    // presence), so this branch stays value-based — `Option.getOrElse` mirrors
+    // Cobra's `BoolVar` default of `false` when `--all` was never passed.
+    if (Option.getOrElse(flags.all, () => false)) return "";
+    if (Option.isSome(flags.projectId) && flags.projectId.value.length > 0) {
+      return flags.projectId.value;
+    }
+
+    // `legacyLoadLocalProjectContext` covers the config-load/env/project-id
+    // resolution sequence Go's `flags.LoadConfig` performs (config load +
+    // project-id resolution, `internal/utils/flags/config_path.go:10-14` ->
+    // `pkg/config/config.go:882`) — see its own doc comment for the full
+    // Go-parity rationale (including why workdir validation stays out of it
+    // and is instead handled by `legacyStop`'s own unconditional call above).
+    const context = yield* legacyLoadLocalProjectContext(
+      cliConfig.workdir,
+      (message) => new LegacyStopConfigLoadError({ message }),
+    );
+
+    // VALIDATE config before any Docker call, matching Go's `flags.LoadConfig`
+    // (config load + `Validate`, `internal/utils/flags/config_path.go:10-14` ->
+    // `pkg/config/config.go:882`), which the default `stop` path runs in full
+    // (`internal/stop/stop.go:15-25`) before ever touching Docker — unlike the
+    // `--all`/`--project-id` branches above, which bypass config loading
+    // entirely and so must NOT run this. `legacyResolveLocalConfigValues` is
+    // reused purely for its throwing side effects (its resolved URLs/keys are
+    // discarded); it gives `stop` the same partial-but-growing `Config.Validate`
+    // parity `status` already has (`status.handler.ts`), rather than a one-off
+    // re-implementation.
+    yield* Effect.try({
+      try: () =>
+        legacyResolveLocalConfigValues(
+          context.config,
+          context.hostname,
+          cliConfig.workdir,
+          context.projectEnvValues,
+          context.loaded?.document,
+        ),
+      catch: (cause) =>
+        new LegacyStopConfigLoadError({
+          message: cause instanceof Error ? cause.message : String(cause),
+        }),
+    });
+
+    return context.projectId;
+  },
+);
 
 export const legacyStop = Effect.fn("legacy.stop")(function* (flags: LegacyStopFlags) {
-  const proxy = yield* LegacyGoProxy;
-  const args: string[] = ["stop"];
-  if (Option.isSome(flags.projectId)) args.push("--project-id", flags.projectId.value);
-  // `--backup` defaults to true; only forward when explicitly disabled, which
-  // matches the Go CLI semantics (`!noBackup` && `--backup=false`).
-  if (!flags.backup) args.push("--backup=false");
-  if (flags.noBackup) args.push("--no-backup");
-  if (flags.all) args.push("--all");
-  yield* proxy.exec(args);
+  const output = yield* Output;
+  const cliConfig = yield* LegacyCliConfig;
+  const telemetryState = yield* LegacyTelemetryState;
+  const spawner = yield* ChildProcessSpawner.ChildProcessSpawner;
+  const fs = yield* FileSystem.FileSystem;
+
+  yield* Effect.gen(function* () {
+    // Go's `ChangeWorkDir` (`apps/cli-go/internal/utils/misc.go:231-250`)
+    // unconditionally `os.Chdir`s the resolved `--workdir`/`SUPABASE_WORKDIR`
+    // in `PersistentPreRunE` (`cmd/root.go:93-105`) — before any of `stop`'s
+    // own flag validation or `RunE`. A missing or non-directory path fails
+    // immediately, so this must win over every later error, including the
+    // `--project-id`/`--all` mutual-exclusivity check below.
+    yield* legacyValidateWorkdirIsDirectory(cliConfig.workdir, fs).pipe(
+      Effect.mapError((error) => new LegacyStopWorkdirError({ message: error.message })),
+    );
+
+    // Presence-based, matching Cobra's `Changed` check (see the doc comment on
+    // `all`'s flag definition in `stop.command.ts`) — `--project-id x --all=false`
+    // must reject too, not just `--all`/`--all=true`.
+    if (Option.isSome(flags.projectId) && Option.isSome(flags.all)) {
+      return yield* Effect.fail(
+        new LegacyStopMutuallyExclusiveError({
+          // Cobra's `validateExclusiveFlagGroups` (spf13/cobra flag_groups.go):
+          // the group name keeps declaration order (`strings.Join(flagNames, " ")`),
+          // but the "were all set" list is `sort.Strings`-ed — verified against
+          // the vendored cobra@v1.10.2 source, not guessed.
+          message:
+            "if any flags in the group [project-id all] are set none of the others can be; [all project-id] were all set",
+        }),
+      );
+    }
+
+    const searchProjectIdFilter = yield* resolveSearchProjectIdFilter(flags, cliConfig);
+    // Go's hidden `--backup` flag is declared via `flags.Bool("backup", true, ...)`
+    // (`cmd/stop.go:26`) but its return value is discarded — never bound to a
+    // variable, so `RunE` always passes `!noBackup` to `stop.Run` regardless of
+    // `--backup`'s value. `--backup=false` is a no-op in the real Go binary
+    // today; only `--no-backup` deletes volumes. Matching that exactly (not the
+    // seemingly-intended-but-dead semantics of the flag's own description).
+    const deleteVolumes = flags.noBackup;
+    const filterValue = legacyCliProjectFilterValue(searchProjectIdFilter);
+
+    // Go prints this line unconditionally and immediately — `docker.go:97`'s
+    // `fmt.Fprintln(w, "Stopping containers...")`, where `w` is a
+    // `StatusWriter` that `fmt.Println`s straight to stdout in non-interactive
+    // mode (`tea.go:59-60,87-90`) before any Docker call runs. The debounced
+    // `output.task` spinner used elsewhere in this codebase gates its message
+    // behind a delay, which drops this line whenever the underlying calls
+    // resolve faster than that threshold — exactly what happens against the
+    // mocked/replayed Docker CLI. Print it directly so it always appears.
+    if (output.format === "text") {
+      yield* output.raw("Stopping containers...\n");
+    }
+
+    // Go's `DockerRemoveAll` (`apps/cli-go/internal/utils/docker.go:96-146`): list -> stop
+    // concurrently -> container prune -> conditional volume prune -> network prune. See
+    // `legacy-docker-remove-all.ts` for the full Go-parity rationale. Its 5 neutral, stage-tagged
+    // failure variants are remapped here into `stop`'s own tagged errors.
+    //
+    // The containers its listing step finds are captured via `onContainersRemoved` — fired only
+    // once `container prune` has CONFIRMED they're actually gone (not merely listed), so
+    // `legacyCleanupStartSecrets` reclaims exactly the staged-secret directories
+    // (`<workdir>/supabase/.temp/start-secrets/<name>`) belonging to containers this run actually
+    // tore down, never a guess, never a container the stop stage itself failed on (so `container
+    // prune` never ran and nothing was actually removed), and never a blanket delete of the whole
+    // parent directory (see that function's doc comment for why that'd be unsafe) — and without a
+    // second, separately `docker ps`'d listing call, which would cost an extra real Docker Engine
+    // API request Go never makes (see `legacyDockerRemoveAll`'s doc comment). Each container's own
+    // `LEGACY_CLI_WORKDIR_LABEL` value is used to locate its directory — NOT `cliConfig.workdir`
+    // unconditionally — since `stop --all`/`stop --project-id <other>` may be tearing down a
+    // DIFFERENT project's containers than the one this invocation's own cwd/`--workdir` points at;
+    // `cliConfig.workdir` is passed through only as the fallback for a container with no such label
+    // (created before this label existed).
+    //
+    // Run via `Effect.ensuring` rather than a plain statement after this pipe: `legacyDockerRemoveAll`'s
+    // LATER stages (volume prune, network prune) can still independently fail AFTER `container
+    // prune` has already confirmed removal, and a plain `yield*` below would never run once that
+    // later failure propagates — leaking staged secret directories for containers a later `stop`
+    // can no longer rediscover (they're already gone). `legacyRollbackStart` (`start.rollback.ts`)
+    // already runs this same cleanup unconditionally after its own `legacyDockerRemoveAll` call for
+    // the identical reason; this makes `stop` consistent with that sibling caller, just without
+    // swallowing the teardown error itself. The finalizer is wrapped in `Effect.suspend` so
+    // `removedContainers` is read at FINALIZER-RUN time, not at pipe-construction time (before
+    // `onContainersRemoved` has fired) — same pattern as
+    // `storage/ls/ls.handler.ts`/`storage/rm/rm.handler.ts`.
+    let removedContainers: ReadonlyArray<LegacyContainerIdName> = [];
+    yield* legacyDockerRemoveAll(spawner, filterValue, deleteVolumes, (containers) => {
+      removedContainers = containers;
+    }).pipe(
+      Effect.catchTags({
+        LegacyDockerRemoveAllListError: (error) =>
+          Effect.fail(new LegacyStopListError({ message: error.message })),
+        LegacyDockerRemoveAllStopError: (error) =>
+          Effect.fail(new LegacyStopContainerError({ message: error.message })),
+        LegacyDockerRemoveAllContainerPruneError: (error) =>
+          Effect.fail(new LegacyStopContainerPruneError({ message: error.message })),
+        LegacyDockerRemoveAllVolumePruneError: (error) =>
+          Effect.fail(new LegacyStopVolumePruneError({ message: error.message })),
+        LegacyDockerRemoveAllNetworkPruneError: (error) =>
+          Effect.fail(new LegacyStopNetworkPruneError({ message: error.message })),
+      }),
+      Effect.ensuring(
+        Effect.suspend(() => legacyCleanupStartSecrets(removedContainers, cliConfig.workdir)),
+      ),
+    );
+
+    if (output.format === "text") {
+      // Written to stdout (no stream arg): `legacyAqua` must target stdout's own
+      // TTY status, not stderr's — see `legacy-colors.ts`'s doc comment.
+      yield* output.raw(
+        `Stopped ${legacyAqua("supabase", process.stdout)} local development setup.\n`,
+      );
+    } else {
+      yield* output.success("Stopped supabase local development setup.", {
+        project_id_filter: searchProjectIdFilter,
+        backup: !deleteVolumes,
+      });
+    }
+
+    // Post-run suggestion (stop.go:26-37): only meaningful in text mode — json/
+    // stream-json payloads have no equivalent field to carry this hint.
+    if (output.format === "text") {
+      const remainingVolumes = yield* legacyListVolumesByLabel(spawner, filterValue).pipe(
+        Effect.orElseSucceed(() => []),
+      );
+      if (remainingVolumes.length > 0) {
+        const listVolumeCommand =
+          searchProjectIdFilter.length > 0
+            ? `docker volume ls --filter label=com.supabase.cli.project=${searchProjectIdFilter}`
+            : "docker volume ls --filter label=com.supabase.cli.project";
+        yield* output.raw(
+          `Local data are backed up to docker volume. Use docker to show them: ${legacyAqua(listVolumeCommand)}\n`,
+          "stderr",
+        );
+      }
+    }
+  }).pipe(Effect.ensuring(telemetryState.flush));
 });
diff --git a/apps/cli/src/legacy/commands/stop/stop.integration.test.ts b/apps/cli/src/legacy/commands/stop/stop.integration.test.ts
index c9c9d83fea..04fe4fa074 100644
--- a/apps/cli/src/legacy/commands/stop/stop.integration.test.ts
+++ b/apps/cli/src/legacy/commands/stop/stop.integration.test.ts
@@ -1,55 +1,1258 @@
+import { existsSync, mkdirSync, writeFileSync } from "node:fs";
+import { basename, join } from "node:path";
+
+import { BunServices } from "@effect/platform-bun";
 import { describe, expect, it } from "@effect/vitest";
-import { Effect, Layer, Option } from "effect";
-import { LegacyGoProxy } from "../../../shared/legacy/go-proxy.service.ts";
+import { Deferred, Effect, Exit, Layer, Option, PlatformError, Sink, Stream } from "effect";
+import { ChildProcessSpawner } from "effect/unstable/process";
+import { vi } from "vitest";
+
+import { mockOutput } from "../../../../tests/helpers/mocks.ts";
+import {
+  mockLegacyCliConfig,
+  mockLegacyTelemetryStateTracked,
+  useLegacyTempWorkdir,
+} from "../../../../tests/helpers/legacy-mocks.ts";
 import { legacyStop } from "./stop.handler.ts";
 import type { LegacyStopFlags } from "./stop.command.ts";
 
-function setupLegacyStop() {
-  const calls: Array<ReadonlyArray<string>> = [];
-  const layer = Layer.succeed(LegacyGoProxy, {
-    exec: (args) =>
-      Effect.sync(() => {
-        calls.push(args);
+const tempRoot = useLegacyTempWorkdir("supabase-stop-int-");
+
+function flags(overrides: Partial<LegacyStopFlags> = {}): LegacyStopFlags {
+  return {
+    projectId: Option.none(),
+    backup: true,
+    noBackup: false,
+    all: Option.none(),
+    ...overrides,
+  };
+}
+
+function writeConfig(workdir: string, projectId: string) {
+  const supabaseDir = join(workdir, "supabase");
+  mkdirSync(supabaseDir, { recursive: true });
+  writeFileSync(join(supabaseDir, "config.toml"), `project_id = "${projectId}"\n`);
+}
+
+function writeEnvFile(workdir: string, fileName: ".env" | ".env.local", contents: string) {
+  const supabaseDir = join(workdir, "supabase");
+  mkdirSync(supabaseDir, { recursive: true });
+  writeFileSync(join(supabaseDir, fileName), contents);
+}
+
+interface SpawnRecord {
+  readonly command: string;
+  readonly args: ReadonlyArray<string>;
+}
+
+type RouteResult = {
+  readonly exitCode?: number;
+  readonly stdout?: ReadonlyArray<string>;
+  readonly stderr?: ReadonlyArray<string>;
+};
+
+/**
+ * Routes each spawned invocation to a caller-supplied result by matching argv
+ * (rather than a fixed call sequence): `stop` issues five distinct docker
+ * subcommands (`ps`, `stop`, `container prune`, `volume prune`, `network prune`,
+ * `volume ls`) whose relative order/count varies per scenario (N `stop` calls for
+ * N listed containers), so a routing table is a better fit than the sequential
+ * step-array mock `gen types` uses for its single linear pipeline.
+ *
+ * `stop`'s single `ps` listing uses the combined `--format "{{.ID}}\t{{.Names}}\t{{.Label
+ * \"com.supabase.cli.workdir\"}}"` (via `legacyDockerRemoveAll`'s `onContainersRemoved`
+ * hook, see that function's doc comment) so `legacyCleanupStartSecrets` gets container
+ * names/workdirs from the same request that lists ids to stop, rather than a second,
+ * separately-formatted `docker ps` call — which would cost an extra real Docker Engine
+ * API request Go never makes. `stdout` for a `ps` route response is one `<id>\t<name>`
+ * line per container (no third, workdir column — every test here exercises the
+ * `cliConfig.workdir` fallback path); `defaultRoute` below tab-joins each configured id
+ * with itself.
+ */
+function mockRoutedContainerCliSpawner(
+  route: (args: ReadonlyArray<string>) => RouteResult,
+  opts: {
+    readonly dockerMissing?: boolean;
+    // Fails BOTH docker and podman spawn attempts for argv matching this predicate,
+    // simulating a runtime that cannot be spawned at all (as opposed to a spawned
+    // process exiting non-zero) — exercises the `Effect.mapError`/`orElseSucceed`
+    // spawn-failure branches distinct from the exit-code-checking branches.
+    readonly failSpawnFor?: (args: ReadonlyArray<string>) => boolean;
+  } = {},
+) {
+  const spawned: Array<SpawnRecord> = [];
+
+  const layer = Layer.succeed(
+    ChildProcessSpawner.ChildProcessSpawner,
+    ChildProcessSpawner.make((command) =>
+      Effect.gen(function* () {
+        const cmd = command._tag === "StandardCommand" ? command.command : "";
+        const args = command._tag === "StandardCommand" ? command.args : [];
+        spawned.push({ command: cmd, args });
+
+        if (opts.dockerMissing === true && cmd === "docker") {
+          return yield* Effect.fail(
+            PlatformError.systemError({
+              _tag: "NotFound",
+              module: "ChildProcess",
+              method: "spawn",
+              description: "docker not found",
+            }),
+          );
+        }
+
+        if (opts.failSpawnFor?.(args) === true) {
+          return yield* Effect.fail(
+            PlatformError.systemError({
+              _tag: "NotFound",
+              module: "ChildProcess",
+              method: "spawn",
+              description: "spawn failed",
+            }),
+          );
+        }
+
+        const encoder = new TextEncoder();
+        const result = route(args);
+        const exitDeferred = yield* Deferred.make<ChildProcessSpawner.ExitCode>();
+        yield* Effect.forkDetach(
+          Effect.gen(function* () {
+            yield* Effect.sleep("5 millis");
+            yield* Deferred.succeed(
+              exitDeferred,
+              ChildProcessSpawner.ExitCode(result.exitCode ?? 0),
+            );
+          }),
+        );
+        const stdoutBytes = (result.stdout ?? []).map((line) => encoder.encode(`${line}\n`));
+        const stderrBytes = (result.stderr ?? []).map((line) => encoder.encode(`${line}\n`));
+
+        return ChildProcessSpawner.makeHandle({
+          pid: ChildProcessSpawner.ProcessId(4000 + spawned.length),
+          stdout: Stream.fromIterable(stdoutBytes),
+          stderr: Stream.fromIterable(stderrBytes),
+          all: Stream.empty,
+          exitCode: Deferred.await(exitDeferred),
+          isRunning: Effect.succeed(false),
+          stdin: Sink.drain,
+          kill: () => Effect.void,
+          unref: Effect.succeed(Effect.void),
+          getInputFd: () => Sink.drain,
+          getOutputFd: () => Stream.empty,
+        });
       }),
-    execCapture: () => Effect.succeed(""),
+    ),
+  );
+
+  return {
+    layer,
+    get spawned() {
+      return spawned;
+    },
+  };
+}
+
+/**
+ * Default happy-path router: `ps` lists one container, `docker version` reports
+ * an API version comfortably at/above the `volume prune --all` gate (1.42, see
+ * `legacyDockerSupportsVolumePruneAllFlag`), everything else succeeds empty.
+ */
+function defaultRoute(
+  opts: {
+    readonly containerIds?: ReadonlyArray<string>;
+    readonly volumeNames?: ReadonlyArray<string>;
+    readonly dockerApiVersion?: string;
+  } = {},
+) {
+  const containerIds = opts.containerIds ?? ["c1"];
+  const volumeNames = opts.volumeNames ?? [];
+  const dockerApiVersion = opts.dockerApiVersion ?? "1.45";
+  return (args: ReadonlyArray<string>): RouteResult => {
+    if (args[0] === "ps") return { stdout: containerIds.map((id) => `${id}\t${id}`) };
+    if (args[0] === "volume" && args[1] === "ls") return { stdout: volumeNames };
+    if (args[0] === "version") return { stdout: [dockerApiVersion] };
+    return { exitCode: 0 };
+  };
+}
+
+interface SetupOpts {
+  readonly format?: "text" | "json" | "stream-json";
+  readonly route?: (args: ReadonlyArray<string>) => RouteResult;
+  readonly dockerMissing?: boolean;
+  readonly failSpawnFor?: (args: ReadonlyArray<string>) => boolean;
+  readonly configuredProjectId?: string;
+  readonly skipConfig?: boolean;
+  /** Defaults to `tempRoot.current` — override for `--workdir`-resolution tests. */
+  readonly workdir?: string;
+}
+
+function setup(opts: SetupOpts = {}) {
+  const workdir = opts.workdir ?? tempRoot.current;
+  if (opts.skipConfig !== true) {
+    writeConfig(workdir, opts.configuredProjectId ?? "demo");
+  }
+  const out = mockOutput({
+    format: opts.format ?? "text",
+    interactive: (opts.format ?? "text") === "text",
   });
-  return { layer, calls };
+  const telemetry = mockLegacyTelemetryStateTracked();
+  const cliConfig = mockLegacyCliConfig({ workdir, projectId: Option.none() });
+  const child = mockRoutedContainerCliSpawner(opts.route ?? defaultRoute(), {
+    dockerMissing: opts.dockerMissing,
+    failSpawnFor: opts.failSpawnFor,
+  });
+
+  const layer = Layer.mergeAll(
+    BunServices.layer,
+    out.layer,
+    cliConfig,
+    telemetry.layer,
+    child.layer,
+  );
+
+  return { workdir, out, telemetry, child, layer };
 }
 
-const baseFlags: LegacyStopFlags = {
-  projectId: Option.none(),
-  backup: true,
-  noBackup: false,
-  all: false,
-};
+describe("legacy stop integration", () => {
+  it.live(
+    "stops the current project's containers with backup and suggests the volume command",
+    () => {
+      const { layer, out, child } = setup({
+        configuredProjectId: "demo",
+        route: defaultRoute({ containerIds: ["c1", "c2"], volumeNames: ["supabase_db_demo"] }),
+      });
+      return Effect.gen(function* () {
+        yield* legacyStop(flags());
+        const psCall = child.spawned.find((s) => s.args[0] === "ps");
+        expect(psCall?.args).toEqual([
+          "ps",
+          "--filter",
+          "label=com.supabase.cli.project=demo",
+          "--all",
+          "--format",
+          '{{.ID}}\t{{.Names}}\t{{.Label "com.supabase.cli.workdir"}}',
+        ]);
+        const stopCalls = child.spawned.filter((s) => s.args[0] === "stop");
+        expect(stopCalls.map((s) => s.args)).toEqual([
+          ["stop", "c1"],
+          ["stop", "c2"],
+        ]);
+        expect(out.stdoutText).toContain("Stopping containers...");
+        expect(out.stdoutText).toContain("Stopped");
+        expect(out.stdoutText).toContain("local development setup.");
+        expect(out.stderrText).toContain(
+          "Local data are backed up to docker volume. Use docker to show them:",
+        );
+        expect(out.stderrText).toContain(
+          "docker volume ls --filter label=com.supabase.cli.project=demo",
+        );
+      }).pipe(Effect.provide(layer));
+    },
+  );
+
+  it.live(
+    "reclaims staged-secret directories for containers it tears down, leaving unrelated ones alone",
+    () => {
+      // legacyCleanupStartSecrets (legacy/shared/legacy-start-secrets-cleanup.ts)
+      // reclaims start's staged plaintext-secret directories
+      // (<workdir>/supabase/.temp/start-secrets/<container-name>) for exactly
+      // the containers this stop run tore down — captured via
+      // `legacyDockerRemoveAll`'s `onContainersRemoved` hook, never a blanket
+      // delete of the whole start-secrets/ parent (see that function's doc
+      // comment for why). `defaultRoute`'s `ps` stdout carries no third
+      // (workdir-label) column, so this also exercises the backward-compatible
+      // fallback to `cliConfig.workdir` for a container with no
+      // `com.supabase.cli.workdir` label (created before that label existed).
+      const { layer, workdir } = setup({
+        configuredProjectId: "demo",
+        route: defaultRoute({ containerIds: ["supabase_kong_demo"] }),
+      });
+      const startSecretsDir = join(workdir, "supabase", ".temp", "start-secrets");
+      const matchedDir = join(startSecretsDir, "supabase_kong_demo");
+      const unmatchedDir = join(startSecretsDir, "supabase_kong_other-project");
+      mkdirSync(matchedDir, { recursive: true });
+      writeFileSync(join(matchedDir, "secret-0"), "kong.yml contents");
+      mkdirSync(unmatchedDir, { recursive: true });
+      writeFileSync(join(unmatchedDir, "secret-0"), "unrelated project's secret");
+      return Effect.gen(function* () {
+        yield* legacyStop(flags());
+        expect(existsSync(matchedDir)).toBe(false);
+        expect(existsSync(unmatchedDir)).toBe(true);
+      }).pipe(Effect.provide(layer));
+    },
+  );
+
+  it.live(
+    "reclaims a container's staged-secret directory at its OWN labeled workdir, not this invocation's cwd",
+    () => {
+      // `stop --all`/`stop --project-id <other>` can tear down a DIFFERENT project's containers
+      // than the one this invocation's own cwd/`--workdir` points at. Each container's own
+      // `com.supabase.cli.workdir` label (read back via the widened `docker ps --format`, see
+      // `legacyListContainerIdsAndNames`) must be used to locate its staged-secret directory —
+      // never this invocation's `cliConfig.workdir` unconditionally, which would look in the
+      // wrong place and silently orphan the other project's secrets forever.
+      const workdir = tempRoot.current;
+      const otherProjectWorkdir = join(workdir, "other-project-root");
+      const { layer } = setup({
+        workdir,
+        skipConfig: true,
+        route: (args) => {
+          if (args[0] === "ps") {
+            return { stdout: [`c1\tsupabase_kong_other\t${otherProjectWorkdir}`] };
+          }
+          return defaultRoute()(args);
+        },
+      });
+      const correctDir = join(
+        otherProjectWorkdir,
+        "supabase",
+        ".temp",
+        "start-secrets",
+        "supabase_kong_other",
+      );
+      // Same container name, but rooted at THIS invocation's own workdir — must survive, proving
+      // cleanup never falls back to `cliConfig.workdir` while a real label is present.
+      const wrongDir = join(workdir, "supabase", ".temp", "start-secrets", "supabase_kong_other");
+      mkdirSync(correctDir, { recursive: true });
+      writeFileSync(join(correctDir, "secret-0"), "kong.yml contents");
+      mkdirSync(wrongDir, { recursive: true });
+      writeFileSync(join(wrongDir, "secret-0"), "must not be touched");
+      return Effect.gen(function* () {
+        yield* legacyStop(flags({ all: Option.some(true) }));
+        expect(existsSync(correctDir)).toBe(false);
+        expect(existsSync(wrongDir)).toBe(true);
+      }).pipe(Effect.provide(layer));
+    },
+  );
+
+  it.live(
+    "sanitizes a dirty config.toml project_id before filtering, matching start's label",
+    () => {
+      // Go's Config.Validate rewrites Config.ProjectId to its sanitized form once
+      // at config-load time (pkg/config/config.go:938-944); every later reader —
+      // including the Docker label `start` writes — sees that same sanitized
+      // string. Filtering on the raw value here would match nothing `start`
+      // ever labeled.
+      const { layer, child } = setup({
+        configuredProjectId: "My App!!",
+        route: defaultRoute(),
+      });
+      return Effect.gen(function* () {
+        yield* legacyStop(flags());
+        const psCall = child.spawned.find((s) => s.args[0] === "ps");
+        expect(psCall?.args).toEqual([
+          "ps",
+          "--filter",
+          "label=com.supabase.cli.project=My_App_",
+          "--all",
+          "--format",
+          '{{.ID}}\t{{.Names}}\t{{.Label "com.supabase.cli.workdir"}}',
+        ]);
+      }).pipe(Effect.provide(layer));
+    },
+  );
+
+  it.live("keeps an explicit --project-id raw, unsanitized (Go's bypass)", () => {
+    // Go assigns the --project-id flag value straight to Config.ProjectId
+    // without going through Validate (internal/stop/stop.go:19-20), so this
+    // path must NOT sanitize even though the default (config-derived) path does.
+    const { layer, child } = setup({ skipConfig: true, route: defaultRoute() });
+    return Effect.gen(function* () {
+      yield* legacyStop(flags({ projectId: Option.some("Raw Value!!") }));
+      const psCall = child.spawned.find((s) => s.args[0] === "ps");
+      expect(psCall?.args).toEqual([
+        "ps",
+        "--filter",
+        "label=com.supabase.cli.project=Raw Value!!",
+        "--all",
+        "--format",
+        '{{.ID}}\t{{.Names}}\t{{.Label "com.supabase.cli.workdir"}}',
+      ]);
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("stops every project's containers with --all without reading config.toml", () => {
+    const { layer, child } = setup({ skipConfig: true, route: defaultRoute() });
+    return Effect.gen(function* () {
+      yield* legacyStop(flags({ all: Option.some(true) }));
+      const psCall = child.spawned.find((s) => s.args[0] === "ps");
+      expect(psCall?.args).toEqual([
+        "ps",
+        "--filter",
+        "label=com.supabase.cli.project",
+        "--all",
+        "--format",
+        '{{.ID}}\t{{.Names}}\t{{.Label "com.supabase.cli.workdir"}}',
+      ]);
+      const pruneCalls = child.spawned.filter(
+        (s) => s.args[0] === "container" && s.args[1] === "prune",
+      );
+      expect(pruneCalls[0]?.args).toEqual([
+        "container",
+        "prune",
+        "--force",
+        "--filter",
+        "label=com.supabase.cli.project",
+      ]);
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("suggests the bare-label volume command with --all when volumes remain", () => {
+    const { layer, out } = setup({
+      skipConfig: true,
+      route: defaultRoute({ volumeNames: ["supabase_db_demo"] }),
+    });
+    return Effect.gen(function* () {
+      yield* legacyStop(flags({ all: Option.some(true) }));
+      expect(out.stderrText).toContain(
+        "Local data are backed up to docker volume. Use docker to show them:",
+      );
+      expect(out.stderrText).toContain("docker volume ls --filter label=com.supabase.cli.project");
+      expect(out.stderrText).not.toContain("com.supabase.cli.project=");
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("stops a named project with --project-id without reading config.toml", () => {
+    const { layer, child } = setup({ skipConfig: true, route: defaultRoute() });
+    return Effect.gen(function* () {
+      yield* legacyStop(flags({ projectId: Option.some("other-project") }));
+      const psCall = child.spawned.find((s) => s.args[0] === "ps");
+      expect(psCall?.args).toEqual([
+        "ps",
+        "--filter",
+        "label=com.supabase.cli.project=other-project",
+        "--all",
+        "--format",
+        '{{.ID}}\t{{.Names}}\t{{.Label "com.supabase.cli.workdir"}}',
+      ]);
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("falls back to config.toml when --project-id is an empty string", () => {
+    // Go's check is `len(projectId) > 0` (internal/stop/stop.go:18), not just
+    // "was --project-id set" — an empty value must fall through to config.toml
+    // exactly like an absent flag, not resolve to the bare/all-projects filter.
+    const { layer, child } = setup({ configuredProjectId: "demo", route: defaultRoute() });
+    return Effect.gen(function* () {
+      yield* legacyStop(flags({ projectId: Option.some("") }));
+      const psCall = child.spawned.find((s) => s.args[0] === "ps");
+      expect(psCall?.args).toEqual([
+        "ps",
+        "--filter",
+        "label=com.supabase.cli.project=demo",
+        "--all",
+        "--format",
+        '{{.ID}}\t{{.Names}}\t{{.Label "com.supabase.cli.workdir"}}',
+      ]);
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("resolves SUPABASE_PROJECT_ID from supabase/.env over config.toml", () => {
+    // Go's Config.Load runs loadNestedEnv (supabase/.env(.local) via godotenv)
+    // before loadFromFile's AutomaticEnv reads SUPABASE_PROJECT_ID
+    // (pkg/config/config.go:735-738) — an env-file-only value overrides
+    // config.toml's project_id too, not just an ambient shell export.
+    const { layer, child } = setup({ configuredProjectId: "toml-project", route: defaultRoute() });
+    writeEnvFile(tempRoot.current, ".env", "SUPABASE_PROJECT_ID=env-file-project\n");
+    return Effect.gen(function* () {
+      yield* legacyStop(flags());
+      const psCall = child.spawned.find((s) => s.args[0] === "ps");
+      expect(psCall?.args).toEqual([
+        "ps",
+        "--filter",
+        "label=com.supabase.cli.project=env-file-project",
+        "--all",
+        "--format",
+        '{{.ID}}\t{{.Names}}\t{{.Label "com.supabase.cli.workdir"}}',
+      ]);
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("prefers ambient SUPABASE_PROJECT_ID over supabase/.env", () => {
+    const { layer, child } = setup({ configuredProjectId: "toml-project", route: defaultRoute() });
+    writeEnvFile(tempRoot.current, ".env", "SUPABASE_PROJECT_ID=env-file-project\n");
+    process.env["SUPABASE_PROJECT_ID"] = "ambient-project";
+    return Effect.gen(function* () {
+      yield* legacyStop(flags());
+      const psCall = child.spawned.find((s) => s.args[0] === "ps");
+      expect(psCall?.args).toEqual([
+        "ps",
+        "--filter",
+        "label=com.supabase.cli.project=ambient-project",
+        "--all",
+        "--format",
+        '{{.ID}}\t{{.Names}}\t{{.Label "com.supabase.cli.workdir"}}',
+      ]);
+    }).pipe(
+      Effect.provide(layer),
+      Effect.ensuring(Effect.sync(() => delete process.env["SUPABASE_PROJECT_ID"])),
+    );
+  });
+
+  it.live(
+    "does not climb to an ancestor project's config.toml when workdir has none of its own",
+    () => {
+      // Go's ChangeWorkDir uses an explicit/defaulted workdir exactly, with no
+      // ancestor search (apps/cli-go/internal/utils/misc.go:231-247) — mirrored
+      // here by `search: false`. A workdir with no supabase/config.toml of its
+      // own must fall back to defaults (workdir-basename project id), not an
+      // ancestor project's config.toml, even though `cliConfig.workdir` sits
+      // right inside one.
+      const nestedWorkdir = join(tempRoot.current, "nested");
+      mkdirSync(nestedWorkdir, { recursive: true });
+      writeConfig(tempRoot.current, "ancestor-project");
+      const projectId = basename(nestedWorkdir);
+      const { layer, child } = setup({
+        workdir: nestedWorkdir,
+        skipConfig: true,
+        route: defaultRoute(),
+      });
+      return Effect.gen(function* () {
+        yield* legacyStop(flags());
+        const psCall = child.spawned.find((s) => s.args[0] === "ps");
+        expect(psCall?.args).toEqual([
+          "ps",
+          "--filter",
+          `label=com.supabase.cli.project=${projectId}`,
+          "--all",
+          "--format",
+          '{{.ID}}\t{{.Names}}\t{{.Label "com.supabase.cli.workdir"}}',
+        ]);
+      }).pipe(Effect.provide(layer));
+    },
+  );
+
+  it.live("resolves SUPABASE_PROJECT_ID from supabase/.env even when config.toml is absent", () => {
+    // Go's loadNestedEnv runs unconditionally, before config.toml is ever
+    // opened (pkg/config/config.go:786-793) — a supabase/.env-only project id
+    // must still be honored even when there's no config.toml to fall back to
+    // template defaults from.
+    const { layer, child } = setup({ skipConfig: true, route: defaultRoute() });
+    writeEnvFile(tempRoot.current, ".env", "SUPABASE_PROJECT_ID=no-config-project\n");
+    return Effect.gen(function* () {
+      yield* legacyStop(flags());
+      const psCall = child.spawned.find((s) => s.args[0] === "ps");
+      expect(psCall?.args).toEqual([
+        "ps",
+        "--filter",
+        "label=com.supabase.cli.project=no-config-project",
+        "--all",
+        "--format",
+        '{{.ID}}\t{{.Names}}\t{{.Label "com.supabase.cli.workdir"}}',
+      ]);
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("resolves SUPABASE_PROJECT_ID from a project-root .env file", () => {
+    // Go's loadNestedEnv walks past supabase/ one more level, to the project
+    // root/workdir (pkg/config/config.go:1169-1190) — a project-root-only
+    // dotenv value must override config.toml too, not just supabase/.env.
+    const { layer, child } = setup({ configuredProjectId: "toml-project", route: defaultRoute() });
+    writeFileSync(join(tempRoot.current, ".env"), "SUPABASE_PROJECT_ID=root-env-project\n");
+    return Effect.gen(function* () {
+      yield* legacyStop(flags());
+      const psCall = child.spawned.find((s) => s.args[0] === "ps");
+      expect(psCall?.args).toEqual([
+        "ps",
+        "--filter",
+        "label=com.supabase.cli.project=root-env-project",
+        "--all",
+        "--format",
+        '{{.ID}}\t{{.Names}}\t{{.Label "com.supabase.cli.workdir"}}',
+      ]);
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("fails when --workdir/SUPABASE_WORKDIR points at a missing path", () => {
+    // Go's `ChangeWorkDir` (`apps/cli-go/internal/utils/misc.go:231-250`)
+    // `os.Chdir`s the explicit workdir in `PersistentPreRunE`, before any of
+    // `stop`'s own flag validation, config load, or Docker access — a missing
+    // path must fail immediately, not fall through to the workdir-basename
+    // default and prune under that name.
+    const missingWorkdir = join(tempRoot.current, "does-not-exist");
+    const { layer, child } = setup({ workdir: missingWorkdir, skipConfig: true });
+    return Effect.gen(function* () {
+      const exit = yield* Effect.exit(legacyStop(flags()));
+      expect(Exit.isFailure(exit)).toBe(true);
+      if (Exit.isFailure(exit)) {
+        expect(JSON.stringify(exit.cause)).toContain("LegacyStopWorkdirError");
+        expect(JSON.stringify(exit.cause)).toContain(
+          `failed to change workdir: chdir ${missingWorkdir}: no such file or directory`,
+        );
+      }
+      expect(child.spawned).toEqual([]);
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("fails when --workdir/SUPABASE_WORKDIR points at a file, not a directory", () => {
+    const filePath = join(tempRoot.current, "not-a-directory");
+    writeFileSync(filePath, "");
+    const { layer, child } = setup({ workdir: filePath, skipConfig: true });
+    return Effect.gen(function* () {
+      const exit = yield* Effect.exit(legacyStop(flags()));
+      expect(Exit.isFailure(exit)).toBe(true);
+      if (Exit.isFailure(exit)) {
+        expect(JSON.stringify(exit.cause)).toContain("LegacyStopWorkdirError");
+        expect(JSON.stringify(exit.cause)).toContain(
+          `failed to change workdir: chdir ${filePath}: not a directory`,
+        );
+      }
+      expect(child.spawned).toEqual([]);
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("rejects --project-id together with --all", () => {
+    const { layer, child } = setup({ skipConfig: true, route: defaultRoute() });
+    return Effect.gen(function* () {
+      const exit = yield* Effect.exit(
+        legacyStop(flags({ projectId: Option.some("other-project"), all: Option.some(true) })),
+      );
+      expect(Exit.isFailure(exit)).toBe(true);
+      if (Exit.isFailure(exit)) {
+        expect(JSON.stringify(exit.cause)).toContain("LegacyStopMutuallyExclusiveError");
+      }
+      expect(child.spawned).toEqual([]);
+    }).pipe(Effect.provide(layer));
+  });
+
+  // Cobra's `MarkFlagsMutuallyExclusive` mutex is presence-based (`Changed`),
+  // not value-based — `--all=false` still counts as "set" alongside
+  // `--project-id`, so this must reject too, not just `--all`/`--all=true`.
+  it.live("rejects --project-id together with an explicit --all=false", () => {
+    const { layer, child } = setup({ skipConfig: true, route: defaultRoute() });
+    return Effect.gen(function* () {
+      const exit = yield* Effect.exit(
+        legacyStop(flags({ projectId: Option.some("other-project"), all: Option.some(false) })),
+      );
+      expect(Exit.isFailure(exit)).toBe(true);
+      if (Exit.isFailure(exit)) {
+        expect(JSON.stringify(exit.cause)).toContain("LegacyStopMutuallyExclusiveError");
+      }
+      expect(child.spawned).toEqual([]);
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("deletes data volumes with --no-backup", () => {
+    const { layer, child } = setup({ configuredProjectId: "demo", route: defaultRoute() });
+    return Effect.gen(function* () {
+      yield* legacyStop(flags({ noBackup: true }));
+      const volumePrune = child.spawned.find(
+        (s) => s.args[0] === "volume" && s.args[1] === "prune",
+      );
+      expect(volumePrune?.args).toEqual([
+        "volume",
+        "prune",
+        "--force",
+        "--all",
+        "--filter",
+        "label=com.supabase.cli.project=demo",
+      ]);
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live(
+    "omits --all from docker's volume prune on a pre-1.42 API host, matching Go's gate",
+    () => {
+      // Docker CLI's own `volume prune --all` flag requires API >= 1.42 and
+      // hard-fails (pruning nothing) on an older daemon — Go avoids ever
+      // sending it by checking `Docker.ClientVersion() >= "1.42"`
+      // (docker.go:126-133). This mirrors that gate via `docker version`.
+      const { layer, child } = setup({
+        configuredProjectId: "demo",
+        route: defaultRoute({ dockerApiVersion: "1.41" }),
+      });
+      return Effect.gen(function* () {
+        yield* legacyStop(flags({ noBackup: true }));
+        const volumePrune = child.spawned.find(
+          (s) => s.command === "docker" && s.args[0] === "volume" && s.args[1] === "prune",
+        );
+        expect(volumePrune?.args).toEqual([
+          "volume",
+          "prune",
+          "--force",
+          "--filter",
+          "label=com.supabase.cli.project=demo",
+        ]);
+      }).pipe(Effect.provide(layer));
+    },
+  );
+
+  it.live("includes --all in docker's volume prune when the API is exactly 1.42", () => {
+    const { layer, child } = setup({
+      configuredProjectId: "demo",
+      route: defaultRoute({ dockerApiVersion: "1.42" }),
+    });
+    return Effect.gen(function* () {
+      yield* legacyStop(flags({ noBackup: true }));
+      const volumePrune = child.spawned.find(
+        (s) => s.command === "docker" && s.args[0] === "volume" && s.args[1] === "prune",
+      );
+      expect(volumePrune?.args).toEqual([
+        "volume",
+        "prune",
+        "--force",
+        "--all",
+        "--filter",
+        "label=com.supabase.cli.project=demo",
+      ]);
+    }).pipe(Effect.provide(layer));
+  });
 
-describe("legacy stop", () => {
-  it.live("forwards no extra flags when defaults are used", () => {
-    const { layer, calls } = setupLegacyStop();
+  it.live("--backup=false alone does not delete data volumes, matching Go's dead flag", () => {
+    // Go's `--backup` is declared but never bound to a variable (`cmd/stop.go:26`) —
+    // `RunE` always passes `!noBackup`, so `--backup=false` has zero effect in the
+    // real Go binary today. Only `--no-backup` deletes volumes.
+    const { layer, child } = setup({ configuredProjectId: "demo", route: defaultRoute() });
     return Effect.gen(function* () {
-      yield* legacyStop(baseFlags);
-      expect(calls).toEqual([["stop"]]);
+      yield* legacyStop(flags({ backup: false }));
+      const volumePrune = child.spawned.find(
+        (s) => s.args[0] === "volume" && s.args[1] === "prune",
+      );
+      expect(volumePrune).toBeUndefined();
     }).pipe(Effect.provide(layer));
   });
 
-  it.live("forwards --backup=false when the hidden --backup flag is disabled", () => {
-    const { layer, calls } = setupLegacyStop();
+  it.live("--no-backup still deletes data volumes even when --backup stays true", () => {
+    const { layer, child } = setup({ configuredProjectId: "demo", route: defaultRoute() });
     return Effect.gen(function* () {
-      yield* legacyStop({ ...baseFlags, backup: false });
-      expect(calls).toEqual([["stop", "--backup=false"]]);
+      yield* legacyStop(flags({ backup: true, noBackup: true }));
+      const volumePrune = child.spawned.find(
+        (s) => s.args[0] === "volume" && s.args[1] === "prune",
+      );
+      expect(volumePrune?.args).toEqual([
+        "volume",
+        "prune",
+        "--force",
+        "--all",
+        "--filter",
+        "label=com.supabase.cli.project=demo",
+      ]);
     }).pipe(Effect.provide(layer));
   });
 
-  it.live("forwards --no-backup, --project-id and --all", () => {
-    const { layer, calls } = setupLegacyStop();
+  it.live("keeps data volumes by default (no volume prune call)", () => {
+    const { layer, child } = setup({ configuredProjectId: "demo", route: defaultRoute() });
     return Effect.gen(function* () {
-      yield* legacyStop({
-        projectId: Option.some("abc"),
-        backup: true,
-        noBackup: true,
-        all: true,
+      yield* legacyStop(flags());
+      const volumePrune = child.spawned.find(
+        (s) => s.args[0] === "volume" && s.args[1] === "prune",
+      );
+      expect(volumePrune).toBeUndefined();
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("fails when config.toml is malformed", () => {
+    const workdir = tempRoot.current;
+    mkdirSync(join(workdir, "supabase"), { recursive: true });
+    writeFileSync(join(workdir, "supabase", "config.toml"), "not valid toml =====");
+    const { layer, child } = setup({ skipConfig: true, route: defaultRoute() });
+    return Effect.gen(function* () {
+      const exit = yield* Effect.exit(legacyStop(flags()));
+      expect(Exit.isFailure(exit)).toBe(true);
+      if (Exit.isFailure(exit)) {
+        expect(JSON.stringify(exit.cause)).toContain("LegacyStopConfigLoadError");
+      }
+      expect(child.spawned).toEqual([]);
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("fails when [remotes.*] has a duplicate project_id, even with no projectRef", () => {
+    // Go's Config.Validate builds the duplicate map across all [remotes.*]
+    // blocks unconditionally (config.go:503-518), so this must fail before
+    // stop ever selects a remote or touches Docker — not just when a
+    // matching --project-ref is requested.
+    const workdir = tempRoot.current;
+    mkdirSync(join(workdir, "supabase"), { recursive: true });
+    writeFileSync(
+      join(workdir, "supabase", "config.toml"),
+      `project_id = "baseref"
+
+[remotes.a]
+project_id = "aaaaaaaaaaaaaaaaaaaa"
+
+[remotes.b]
+project_id = "aaaaaaaaaaaaaaaaaaaa"
+`,
+    );
+    const { layer, child } = setup({ skipConfig: true, route: defaultRoute() });
+    return Effect.gen(function* () {
+      const exit = yield* Effect.exit(legacyStop(flags()));
+      expect(Exit.isFailure(exit)).toBe(true);
+      if (Exit.isFailure(exit)) {
+        expect(JSON.stringify(exit.cause)).toContain("LegacyStopConfigLoadError");
+      }
+      expect(child.spawned).toEqual([]);
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("fails when a [remotes.*] project_id is not a valid 20-letter ref", () => {
+    // Go's Config.Validate (config.go:996-1001) checks every [remotes.*].project_id
+    // against refPattern unconditionally on every config load, so an invalid
+    // format must fail closed before stop reaches Docker.
+    const workdir = tempRoot.current;
+    mkdirSync(join(workdir, "supabase"), { recursive: true });
+    writeFileSync(
+      join(workdir, "supabase", "config.toml"),
+      `project_id = "baseref"
+
+[remotes.bad]
+project_id = "short"
+`,
+    );
+    const { layer, child } = setup({ skipConfig: true, route: defaultRoute() });
+    return Effect.gen(function* () {
+      const exit = yield* Effect.exit(legacyStop(flags()));
+      expect(Exit.isFailure(exit)).toBe(true);
+      if (Exit.isFailure(exit)) {
+        expect(JSON.stringify(exit.cause)).toContain("LegacyStopConfigLoadError");
+      }
+      expect(child.spawned).toEqual([]);
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live(
+    "decodes a comma-separated string into an array field ([]string) for stop to proceed",
+    () => {
+      // Go's `newDecodeHook` wires `mapstructure.StringToSliceHookFunc(",")`
+      // unconditionally, so a plain string value for a `[]string` field like
+      // `additional_redirect_urls` decodes fine and must not block stop from
+      // reaching Docker.
+      const workdir = tempRoot.current;
+      mkdirSync(join(workdir, "supabase"), { recursive: true });
+      writeFileSync(
+        join(workdir, "supabase", "config.toml"),
+        `project_id = "demo"
+
+[auth]
+additional_redirect_urls = "http://a,http://b"
+`,
+      );
+      const { layer, child } = setup({ skipConfig: true, route: defaultRoute() });
+      return Effect.gen(function* () {
+        yield* legacyStop(flags());
+        const psCall = child.spawned.find((s) => s.args[0] === "ps");
+        expect(psCall?.args).toEqual([
+          "ps",
+          "--filter",
+          "label=com.supabase.cli.project=demo",
+          "--all",
+          "--format",
+          '{{.ID}}\t{{.Names}}\t{{.Label "com.supabase.cli.workdir"}}',
+        ]);
+      }).pipe(Effect.provide(layer));
+    },
+  );
+
+  it.live("warns on stderr for a deprecated auth.external provider", () => {
+    // `normalizeDeprecatedExternalProviders` (packages/config/src/io.ts) emits
+    // this WARN via `Console.error` only when `goViperCompat` is set — verify
+    // legacy stop keeps that Go-parity behavior wired on.
+    const workdir = tempRoot.current;
+    mkdirSync(join(workdir, "supabase"), { recursive: true });
+    writeFileSync(
+      join(workdir, "supabase", "config.toml"),
+      `project_id = "demo"
+
+[auth.external.slack]
+enabled = true
+`,
+    );
+    const { layer } = setup({ skipConfig: true, route: defaultRoute() });
+    const warnings: Array<string> = [];
+    const errorSpy = vi.spyOn(console, "error").mockImplementation((...args) => {
+      warnings.push(args.map((a) => String(a)).join(" "));
+    });
+    return Effect.gen(function* () {
+      yield* legacyStop(flags());
+      expect(warnings.some((m) => m.includes('WARN: disabling deprecated "slack" provider'))).toBe(
+        true,
+      );
+    }).pipe(Effect.provide(layer), Effect.ensuring(Effect.sync(() => errorSpy.mockRestore())));
+  });
+
+  it.live(
+    "fails and never spawns docker when config.toml has an unsupported db.major_version",
+    () => {
+      // Matches Go's default `stop` path, which runs `flags.LoadConfig` (config
+      // load + `Validate`) entirely before any Docker call
+      // (`internal/stop/stop.go:15-25` -> `pkg/config/config.go:882`) — a config
+      // Go rejects must fail `stop` before it touches containers, not just when
+      // reading `project_id`.
+      const workdir = tempRoot.current;
+      mkdirSync(join(workdir, "supabase"), { recursive: true });
+      writeFileSync(
+        join(workdir, "supabase", "config.toml"),
+        'project_id = "demo"\n[db]\nmajor_version = 12\n',
+      );
+      const { layer, child } = setup({ skipConfig: true, route: defaultRoute() });
+      return Effect.gen(function* () {
+        const exit = yield* Effect.exit(legacyStop(flags()));
+        expect(Exit.isFailure(exit)).toBe(true);
+        if (Exit.isFailure(exit)) {
+          expect(JSON.stringify(exit.cause)).toContain("LegacyStopConfigLoadError");
+          expect(JSON.stringify(exit.cause)).toContain("Postgres version 12.x is unsupported");
+        }
+        expect(child.spawned).toEqual([]);
+      }).pipe(Effect.provide(layer));
+    },
+  );
+
+  it.live("does not run config Validate for --all (bypasses config entirely)", () => {
+    // `internal/stop/stop.go:15-25`: the `--all` branch never calls
+    // `flags.LoadConfig`, so an otherwise-invalid config.toml must not block it.
+    const workdir = tempRoot.current;
+    mkdirSync(join(workdir, "supabase"), { recursive: true });
+    writeFileSync(
+      join(workdir, "supabase", "config.toml"),
+      'project_id = "demo"\n[db]\nmajor_version = 12\n',
+    );
+    const { layer, child } = setup({ skipConfig: true, route: defaultRoute() });
+    return Effect.gen(function* () {
+      const exit = yield* Effect.exit(legacyStop(flags({ all: Option.some(true) })));
+      expect(Exit.isSuccess(exit)).toBe(true);
+      const psCall = child.spawned.find((s) => s.args[0] === "ps");
+      expect(psCall?.args).toContain("label=com.supabase.cli.project");
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("does not run config Validate for --project-id (bypasses config entirely)", () => {
+    // `internal/stop/stop.go:15-25`: an explicit `--project-id` sets
+    // `Config.ProjectId` directly and never calls `flags.LoadConfig`.
+    const workdir = tempRoot.current;
+    mkdirSync(join(workdir, "supabase"), { recursive: true });
+    writeFileSync(
+      join(workdir, "supabase", "config.toml"),
+      'project_id = "demo"\n[db]\nmajor_version = 12\n',
+    );
+    const { layer, child } = setup({ skipConfig: true, route: defaultRoute() });
+    return Effect.gen(function* () {
+      const exit = yield* Effect.exit(legacyStop(flags({ projectId: Option.some("explicit") })));
+      expect(Exit.isSuccess(exit)).toBe(true);
+      const psCall = child.spawned.find((s) => s.args[0] === "ps");
+      expect(psCall?.args).toContain("label=com.supabase.cli.project=explicit");
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("fails when stopping a container errors", () => {
+    const { layer } = setup({
+      configuredProjectId: "demo",
+      route: (args) => {
+        if (args[0] === "ps") return { stdout: ["c1"] };
+        if (args[0] === "stop") return { exitCode: 1, stderr: ["boom"] };
+        return { exitCode: 0 };
+      },
+    });
+    return Effect.gen(function* () {
+      const exit = yield* Effect.exit(legacyStop(flags()));
+      expect(Exit.isFailure(exit)).toBe(true);
+      if (Exit.isFailure(exit)) {
+        expect(JSON.stringify(exit.cause)).toContain("LegacyStopContainerError");
+      }
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live(
+    "preserves a container's staged-secret directory when the stop stage itself fails",
+    () => {
+      // The stop stage failing means `container prune` never even runs, so none of the listed
+      // containers were actually removed — some may still be live. `onContainersRemoved` only
+      // fires once `container prune` confirms removal, so it never fires here, and
+      // `legacyCleanupStartSecrets` must not delete anything.
+      const { layer, workdir } = setup({
+        configuredProjectId: "demo",
+        route: (args) => {
+          if (args[0] === "ps") return { stdout: ["c1\tsupabase_kong_demo"] };
+          if (args[0] === "stop") return { exitCode: 1, stderr: ["boom"] };
+          return { exitCode: 0 };
+        },
+      });
+      const stagedDir = join(workdir, "supabase", ".temp", "start-secrets", "supabase_kong_demo");
+      mkdirSync(stagedDir, { recursive: true });
+      writeFileSync(join(stagedDir, "secret-0"), "kong.yml contents");
+      return Effect.gen(function* () {
+        const exit = yield* Effect.exit(legacyStop(flags()));
+        expect(Exit.isFailure(exit)).toBe(true);
+        if (Exit.isFailure(exit)) {
+          expect(JSON.stringify(exit.cause)).toContain("LegacyStopContainerError");
+        }
+        expect(existsSync(stagedDir)).toBe(true);
+      }).pipe(Effect.provide(layer));
+    },
+  );
+
+  it.live("fails when a container cannot be spawned to stop it at all", () => {
+    // Distinct from a spawned `docker stop` exiting non-zero (covered above) —
+    // this exercises the branch where docker AND podman both fail to spawn for
+    // the `stop <id>` argv specifically.
+    const { layer } = setup({
+      configuredProjectId: "demo",
+      route: (args) => (args[0] === "ps" ? { stdout: ["c1"] } : { exitCode: 0 }),
+      failSpawnFor: (args) => args[0] === "stop",
+    });
+    return Effect.gen(function* () {
+      const exit = yield* Effect.exit(legacyStop(flags()));
+      expect(Exit.isFailure(exit)).toBe(true);
+      if (Exit.isFailure(exit)) {
+        expect(JSON.stringify(exit.cause)).toContain("LegacyStopContainerError");
+      }
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live(
+    "fails the same way in json mode, where 'Stopping containers...' is never printed",
+    () => {
+      // The `output.format === "text"` gate around the "Stopping containers..."
+      // line means json mode skips it entirely; this exercises that the
+      // list/stop/prune failure path is unaffected by that gate.
+      const { layer } = setup({
+        format: "json",
+        configuredProjectId: "demo",
+        route: (args) => {
+          if (args[0] === "ps") return { stdout: ["c1"] };
+          if (args[0] === "stop") return { exitCode: 1, stderr: ["boom"] };
+          return { exitCode: 0 };
+        },
       });
-      expect(calls).toEqual([["stop", "--project-id", "abc", "--no-backup", "--all"]]);
+      return Effect.gen(function* () {
+        const exit = yield* Effect.exit(legacyStop(flags()));
+        expect(Exit.isFailure(exit)).toBe(true);
+        if (Exit.isFailure(exit)) {
+          expect(JSON.stringify(exit.cause)).toContain("LegacyStopContainerError");
+        }
+      }).pipe(Effect.provide(layer));
+    },
+  );
+
+  it.live("fails when container prune errors", () => {
+    const { layer } = setup({
+      configuredProjectId: "demo",
+      route: (args) => {
+        if (args[0] === "container" && args[1] === "prune") return { exitCode: 1 };
+        return defaultRoute()(args);
+      },
+    });
+    return Effect.gen(function* () {
+      const exit = yield* Effect.exit(legacyStop(flags()));
+      expect(Exit.isFailure(exit)).toBe(true);
+      if (Exit.isFailure(exit)) {
+        expect(JSON.stringify(exit.cause)).toContain("LegacyStopContainerPruneError");
+      }
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("fails when volume prune errors", () => {
+    const { layer } = setup({
+      configuredProjectId: "demo",
+      route: (args) => {
+        if (args[0] === "volume" && args[1] === "prune") return { exitCode: 1 };
+        return defaultRoute()(args);
+      },
+    });
+    return Effect.gen(function* () {
+      const exit = yield* Effect.exit(legacyStop(flags({ noBackup: true })));
+      expect(Exit.isFailure(exit)).toBe(true);
+      if (Exit.isFailure(exit)) {
+        expect(JSON.stringify(exit.cause)).toContain("LegacyStopVolumePruneError");
+      }
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("fails when network prune errors", () => {
+    const { layer } = setup({
+      configuredProjectId: "demo",
+      route: (args) => {
+        if (args[0] === "network" && args[1] === "prune") return { exitCode: 1 };
+        return defaultRoute()(args);
+      },
+    });
+    return Effect.gen(function* () {
+      const exit = yield* Effect.exit(legacyStop(flags()));
+      expect(Exit.isFailure(exit)).toBe(true);
+      if (Exit.isFailure(exit)) {
+        expect(JSON.stringify(exit.cause)).toContain("LegacyStopNetworkPruneError");
+      }
+    }).pipe(Effect.provide(layer));
+  });
+
+  // By the time volume/network prune fails, the container-prune stage before it has already
+  // `docker rm`'d the matching containers — a subsequent `stop` can no longer rediscover their
+  // names via `docker ps` to reclaim their staged-secret directories, so this cleanup must run
+  // even though the command itself still fails (see the `Effect.ensuring` finalizer above).
+  it.live("still reclaims staged-secret directories when a later prune stage fails", () => {
+    const { layer, workdir } = setup({
+      configuredProjectId: "demo",
+      route: (args) => {
+        if (args[0] === "network" && args[1] === "prune") return { exitCode: 1 };
+        return defaultRoute({ containerIds: ["supabase_kong_demo"] })(args);
+      },
+    });
+    const matchedDir = join(workdir, "supabase", ".temp", "start-secrets", "supabase_kong_demo");
+    mkdirSync(matchedDir, { recursive: true });
+    writeFileSync(join(matchedDir, "secret-0"), "kong.yml contents");
+    return Effect.gen(function* () {
+      const exit = yield* Effect.exit(legacyStop(flags()));
+      expect(Exit.isFailure(exit)).toBe(true);
+      expect(existsSync(matchedDir)).toBe(false);
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("fails when the container list errors", () => {
+    const { layer } = setup({
+      configuredProjectId: "demo",
+      route: (args) => {
+        if (args[0] === "ps") return { exitCode: 1, stderr: ["daemon down"] };
+        return { exitCode: 0 };
+      },
+    });
+    return Effect.gen(function* () {
+      const exit = yield* Effect.exit(legacyStop(flags()));
+      expect(Exit.isFailure(exit)).toBe(true);
+      if (Exit.isFailure(exit)) {
+        expect(JSON.stringify(exit.cause)).toContain("LegacyStopListError");
+      }
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("falls back to podman when docker is absent", () => {
+    const { layer, child } = setup({
+      configuredProjectId: "demo",
+      route: defaultRoute(),
+      dockerMissing: true,
+    });
+    return Effect.gen(function* () {
+      yield* legacyStop(flags());
+      // The failed `docker` attempt is recorded before the `podman` fallback fires
+      // (`spawnContainerCli`'s `Effect.catch` retries the same argv), so the
+      // successful call is the LAST matching record, not the first.
+      const psCalls = child.spawned.filter((s) => s.args[0] === "ps");
+      expect(psCalls.at(-1)?.command).toBe("podman");
+      expect(psCalls.some((s) => s.command === "docker")).toBe(true);
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("omits --all from podman's volume prune (not a real Podman flag)", () => {
+    // No released Podman `volume prune` accepts `--all` (only `--filter`/`--force`/
+    // `--help`), so passing Docker's `--all` argv straight through to the Podman
+    // fallback would hard-fail after containers are already stopped. Podman prunes
+    // every unused volume by default, so dropping `--all` there is lossless.
+    const { layer, child } = setup({
+      configuredProjectId: "demo",
+      route: defaultRoute(),
+      dockerMissing: true,
+    });
+    return Effect.gen(function* () {
+      yield* legacyStop(flags({ noBackup: true }));
+      const volumePruneCalls = child.spawned.filter(
+        (s) => s.args[0] === "volume" && s.args[1] === "prune",
+      );
+      expect(volumePruneCalls.at(-1)?.command).toBe("podman");
+      expect(volumePruneCalls.at(-1)?.args).toEqual([
+        "volume",
+        "prune",
+        "--force",
+        "--filter",
+        "label=com.supabase.cli.project=demo",
+      ]);
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("emits a machine result in json mode without spinner text", () => {
+    const { layer, out } = setup({
+      format: "json",
+      configuredProjectId: "demo",
+      route: defaultRoute({ volumeNames: ["supabase_db_demo"] }),
+    });
+    return Effect.gen(function* () {
+      yield* legacyStop(flags());
+      const success = out.messages.find((m) => m.type === "success");
+      expect(success?.data).toMatchObject({ project_id_filter: "demo", backup: true });
+      expect(out.stdoutText).not.toContain("\x1b[?25l");
+      // json mode has no volume-suggestion equivalent — only text mode emits it.
+      expect(out.stderrText).not.toContain("Local data are backed up");
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("shows no volume suggestion when no volumes remain", () => {
+    const { layer, out } = setup({
+      configuredProjectId: "demo",
+      route: defaultRoute({ volumeNames: [] }),
+    });
+    return Effect.gen(function* () {
+      yield* legacyStop(flags());
+      expect(out.stderrText).not.toContain("Local data are backed up");
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("flushes telemetry via ensuring even on failure", () => {
+    const { layer, telemetry } = setup({
+      configuredProjectId: "demo",
+      route: (args) => (args[0] === "ps" ? { exitCode: 1 } : { exitCode: 0 }),
+    });
+    return Effect.gen(function* () {
+      yield* Effect.exit(legacyStop(flags()));
+      expect(telemetry.flushed).toBe(true);
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("fails when container prune cannot spawn any container runtime", () => {
+    const { layer } = setup({
+      configuredProjectId: "demo",
+      route: defaultRoute(),
+      failSpawnFor: (args) => args[0] === "container" && args[1] === "prune",
+    });
+    return Effect.gen(function* () {
+      const exit = yield* Effect.exit(legacyStop(flags()));
+      expect(Exit.isFailure(exit)).toBe(true);
+      if (Exit.isFailure(exit)) {
+        expect(JSON.stringify(exit.cause)).toContain("LegacyStopContainerPruneError");
+      }
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("fails when volume prune cannot spawn any container runtime", () => {
+    const { layer } = setup({
+      configuredProjectId: "demo",
+      route: defaultRoute(),
+      failSpawnFor: (args) => args[0] === "volume" && args[1] === "prune",
+    });
+    return Effect.gen(function* () {
+      const exit = yield* Effect.exit(legacyStop(flags({ noBackup: true })));
+      expect(Exit.isFailure(exit)).toBe(true);
+      if (Exit.isFailure(exit)) {
+        expect(JSON.stringify(exit.cause)).toContain("LegacyStopVolumePruneError");
+      }
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("fails when network prune cannot spawn any container runtime", () => {
+    const { layer } = setup({
+      configuredProjectId: "demo",
+      route: defaultRoute(),
+      failSpawnFor: (args) => args[0] === "network" && args[1] === "prune",
+    });
+    return Effect.gen(function* () {
+      const exit = yield* Effect.exit(legacyStop(flags()));
+      expect(Exit.isFailure(exit)).toBe(true);
+      if (Exit.isFailure(exit)) {
+        expect(JSON.stringify(exit.cause)).toContain("LegacyStopNetworkPruneError");
+      }
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("still reports success when the post-run volume listing fails", () => {
+    // The volume-suggestion check is best-effort (`Effect.orElseSucceed`): a
+    // failure listing volumes after a successful stop must not fail the command,
+    // matching Go's `if resp, err := ...; err == nil && ...` (stop.go:29) — a
+    // listing error there is silently ignored, not surfaced.
+    const { layer, out } = setup({
+      configuredProjectId: "demo",
+      route: defaultRoute(),
+      failSpawnFor: (args) => args[0] === "volume" && args[1] === "ls",
+    });
+    return Effect.gen(function* () {
+      yield* legacyStop(flags());
+      expect(out.stdoutText).toContain("Stopped");
+      expect(out.stderrText).not.toContain("Local data are backed up");
     }).pipe(Effect.provide(layer));
   });
 });
diff --git a/apps/cli/src/legacy/commands/stop/stop.live.test.ts b/apps/cli/src/legacy/commands/stop/stop.live.test.ts
new file mode 100644
index 0000000000..95452c78c7
--- /dev/null
+++ b/apps/cli/src/legacy/commands/stop/stop.live.test.ts
@@ -0,0 +1,78 @@
+import { execFile } from "node:child_process";
+import { mkdtemp, rm } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import path from "node:path";
+import { promisify } from "node:util";
+import { afterEach, expect, test } from "vitest";
+
+import { describeLive, runSupabaseLive } from "../../../../tests/helpers/live.ts";
+
+const execFileAsync = promisify(execFile);
+
+const START_TIMEOUT_MS = 280_000;
+
+// `stop` never calls the Management API — it talks directly to the real local
+// Docker stack `start` (still a Go-proxy) creates. `describeLive` is reused
+// purely as the "we're in the full cli-e2e-ci runner" signal (it also has a
+// real Docker daemon, since that's how supabox itself runs); the
+// SUPABASE_ACCESS_TOKEN it gates on is otherwise irrelevant here. See
+// AGENTS.md's "Live tests" section for the full convention.
+describeLive("supabase stop (live)", () => {
+  let projectDir: string | undefined;
+  let projectId: string | undefined;
+
+  afterEach(async () => {
+    if (projectDir === undefined) return;
+    // Best-effort cleanup even if an assertion above failed mid-lifecycle — a
+    // leaked local stack would otherwise pollute the CI runner for later jobs.
+    await runSupabaseLive(["stop", "--no-backup"], { cwd: projectDir }).catch(() => undefined);
+    await rm(projectDir, { recursive: true, force: true }).catch(() => undefined);
+    projectDir = undefined;
+    projectId = undefined;
+  });
+
+  test(
+    "starts a real local stack, then stops it and removes its containers",
+    { timeout: START_TIMEOUT_MS },
+    async () => {
+      projectDir = await mkdtemp(path.join(tmpdir(), "sb-stop-live-"));
+      // No `project_id` override, so the cli resolves it from the workdir
+      // basename — matching Go's precedence exactly (see legacy-docker-ids.ts).
+      projectId = path.basename(projectDir);
+
+      const init = await runSupabaseLive(["init"], { cwd: projectDir });
+      expect(init.exitCode, `stdout:\n${init.stdout}\nstderr:\n${init.stderr}`).toBe(0);
+
+      // Exclude the heaviest, least relevant services (Next.js Studio build, the
+      // logging pipeline) — `stop`'s Docker label-filtering logic doesn't care
+      // which services are running, only that at least one real container
+      // exists to stop.
+      const start = await runSupabaseLive(
+        ["start", "--exclude", "studio", "--exclude", "analytics", "--exclude", "vector"],
+        { cwd: projectDir, exitTimeoutMs: START_TIMEOUT_MS },
+      );
+      expect(start.exitCode, `stdout:\n${start.stdout}\nstderr:\n${start.stderr}`).toBe(0);
+
+      // Sanity: confirm the stack is actually up before testing `stop` against it.
+      const before = await runSupabaseLive(["status"], { cwd: projectDir });
+      expect(before.exitCode, `stdout:\n${before.stdout}\nstderr:\n${before.stderr}`).toBe(0);
+
+      const stop = await runSupabaseLive(["stop"], { cwd: projectDir });
+      expect(stop.exitCode, `stdout:\n${stop.stdout}\nstderr:\n${stop.stderr}`).toBe(0);
+      expect(stop.stdout).toContain("Stopped");
+
+      // The real Docker daemon must agree: no container carrying this project's
+      // label survives `stop` — the actual behavior under test, not just the
+      // cli's own exit code.
+      const { stdout: remaining } = await execFileAsync("docker", [
+        "ps",
+        "-a",
+        "--filter",
+        `label=com.supabase.cli.project=${projectId}`,
+        "--format",
+        "{{.ID}}",
+      ]);
+      expect(remaining.trim()).toBe("");
+    },
+  );
+});
diff --git a/apps/cli/src/legacy/commands/storage/rm/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/storage/rm/SIDE_EFFECTS.md
index 92ad3b6ccd..5bf3726586 100644
--- a/apps/cli/src/legacy/commands/storage/rm/SIDE_EFFECTS.md
+++ b/apps/cli/src/legacy/commands/storage/rm/SIDE_EFFECTS.md
@@ -7,12 +7,13 @@ when `-r` is set. With no paths and `-r`, every bucket is cleared and deleted.
 
 ## Files Read
 
-| Path                                     | Format     | When                                                  |
-| ---------------------------------------- | ---------- | ----------------------------------------------------- |
-| `<workdir>/supabase/config.toml`         | TOML       | always (local creds; `[remotes.*]` merge when linked) |
-| `~/.supabase/access-token`               | plain text | linked path, when `SUPABASE_ACCESS_TOKEN` unset       |
-| `~/.supabase/<hash>/linked-project.json` | JSON       | linked path, to resolve the project ref               |
-| local Kong TLS cert/key                  | PEM        | local + `api.enabled` + `api.tls.enabled`             |
+| Path                                          | Format     | When                                                               |
+| --------------------------------------------- | ---------- | ------------------------------------------------------------------ |
+| `<workdir>/supabase/config.toml`              | TOML       | always (local creds; `[remotes.*]` merge when linked)              |
+| `~/.supabase/access-token`                    | plain text | linked path, when `SUPABASE_ACCESS_TOKEN` unset                    |
+| `~/.supabase/<hash>/linked-project.json`      | JSON       | linked path, to resolve the project ref                            |
+| local Kong TLS cert/key                       | PEM        | local + `api.enabled` + `api.tls.enabled`                          |
+| `<workdir>/supabase/.env*`, `<workdir>/.env*` | dotenv     | always, to resolve `SUPABASE_YES` (CLI-1878; Go's `loadNestedEnv`) |
 
 ## Files Written
 
@@ -36,7 +37,9 @@ Auth: `apikey` always; `Authorization: Bearer <key>` unless the key is `sb_`-pre
 ## Environment Variables
 
 `SUPABASE_AUTH_SERVICE_ROLE_KEY`, `SUPABASE_AUTH_JWT_SECRET`, `SUPABASE_ACCESS_TOKEN`,
-`SUPABASE_PROJECT_ID`, `SUPABASE_SERVICES_HOSTNAME`, plus `SUPABASE_YES` (auto-confirm).
+`SUPABASE_PROJECT_ID`, `SUPABASE_SERVICES_HOSTNAME`, plus `SUPABASE_YES` (auto-confirm) —
+read from the shell env OR the project `.env`/`.env.local`/`.env.<env>[.local]` files
+(shell wins; CLI-1878, matching Go's `loadNestedEnv` before `viper.GetBool("YES")`).
 
 `storage` is an experimental command (Go `root.go:63`): `rm` requires `--experimental`
 (or `SUPABASE_EXPERIMENTAL`), else it exits 1 with
diff --git a/apps/cli/src/legacy/commands/storage/rm/rm.handler.ts b/apps/cli/src/legacy/commands/storage/rm/rm.handler.ts
index dda8bc12fe..aa361c58e9 100644
--- a/apps/cli/src/legacy/commands/storage/rm/rm.handler.ts
+++ b/apps/cli/src/legacy/commands/storage/rm/rm.handler.ts
@@ -1,12 +1,13 @@
-import { Effect, Option } from "effect";
+import { Effect, FileSystem, Option, Path } from "effect";
 
 import { LegacyCliConfig } from "../../../config/legacy-cli-config.service.ts";
 import { LegacyProjectRefResolver } from "../../../config/legacy-project-ref.service.ts";
 import { LegacyLinkedProjectCache } from "../../../telemetry/legacy-linked-project-cache.service.ts";
 import { LegacyTelemetryState } from "../../../telemetry/legacy-telemetry-state.service.ts";
-import { legacyResolveYes } from "../../../../shared/legacy/global-flags.ts";
+import { legacyResolveYesWithProjectEnv } from "../../../../shared/legacy/global-flags.ts";
 import { Output } from "../../../../shared/output/output.service.ts";
 import { legacyBold } from "../../../shared/legacy-colors.ts";
+import { legacyLoadProjectEnv } from "../../../shared/legacy-db-config.toml-read.ts";
 import { legacyPromptYesNo } from "../../../shared/legacy-prompt-yes-no.ts";
 import {
   LEGACY_DELETE_OBJECTS_LIMIT,
@@ -54,14 +55,27 @@ export const legacyStorageRm = Effect.fn("legacy.storage.rm")(function* (
   const telemetryState = yield* LegacyTelemetryState;
   const linkedProjectCache = yield* LegacyLinkedProjectCache;
   const resolver = yield* LegacyProjectRefResolver;
-  // `--yes` OR `SUPABASE_YES` (Go's viper AutomaticEnv, root.go:318-320).
-  const yes = yield* legacyResolveYes;
+  const fs = yield* FileSystem.FileSystem;
+  const path = yield* Path.Path;
 
   let linkedRef = "";
 
   yield* Effect.gen(function* () {
+    // Resolve the project ref BEFORE reading the project `.env`, matching Go's
+    // `ParseDatabaseConfig` `case linked:` (`db_url.go:87-93`), which calls
+    // `LoadProjectRef` strictly before `LoadConfig` (the `.env`/`loadNestedEnv`
+    // work). An unlinked workdir must fail fast with the not-linked guidance
+    // before a malformed/unreadable `supabase/.env` gets a chance to mask it
+    // with an env-parse error.
     const projectRef = flags.local ? "" : yield* resolver.loadProjectRef(Option.none());
     linkedRef = projectRef;
+    // `--yes` OR `SUPABASE_YES` (Go's viper AutomaticEnv, root.go:318-320). Both the
+    // `--local` and (default) `--linked` branches of `ParseDatabaseConfig` call
+    // `LoadConfig` — which loads the project `.env` files — before `rm.Run`'s
+    // confirmation prompt (`root.go:118` → `db_url.go:78` (`local`) / `:91` (`linked`)),
+    // so a `SUPABASE_YES` set only in `supabase/.env` must auto-confirm here too.
+    const projectEnv = yield* legacyLoadProjectEnv(fs, path, cliConfig.workdir);
+    const yes = yield* legacyResolveYesWithProjectEnv(projectEnv);
     const loaded = yield* legacyLoadStorageConfig(cliConfig.workdir, projectRef);
     if (loaded.appliedRemote !== undefined) {
       yield* output.raw(`Loading config override: [remotes.${loaded.appliedRemote}]\n`, "stderr");
diff --git a/apps/cli/src/legacy/commands/storage/rm/rm.integration.test.ts b/apps/cli/src/legacy/commands/storage/rm/rm.integration.test.ts
index c279b49460..858ea9953a 100644
--- a/apps/cli/src/legacy/commands/storage/rm/rm.integration.test.ts
+++ b/apps/cli/src/legacy/commands/storage/rm/rm.integration.test.ts
@@ -100,6 +100,57 @@ describe("legacy storage rm", () => {
     });
   });
 
+  it.live("auto-confirms from SUPABASE_YES in the project .env (Go loadNestedEnv)", () => {
+    // SUPABASE_YES lives only in supabase/.env, not the shell — both the `--local` and
+    // (default) `--linked` branches of Go's `ParseDatabaseConfig` load the project `.env`
+    // files before `rm.Run`'s confirmation prompt (root.go:118), so the deletion
+    // auto-confirms with no --yes flag and no env var set in the shell (CLI-1878).
+    const { layer, out, requests } = setupLegacyStorage(tmp.current, {
+      toml: 'project_id = "test"\n',
+      local: true,
+      files: { "supabase/.env": "SUPABASE_YES=true\n" },
+      routes: [{ method: "DELETE", match: DELETE_OBJECT("private"), body: [{ name: "a.pdf" }] }],
+    });
+    return Effect.gen(function* () {
+      const exit = yield* legacyStorageRm({
+        files: ["ss:///private/a.pdf"],
+        recursive: false,
+        linked: true,
+        local: true,
+      }).pipe(Effect.provide(layer), Effect.exit);
+      expect(Exit.isSuccess(exit)).toBe(true);
+      expect(out.stderrText).toContain("[y/N] y");
+      expect(requests.some((r) => r.method === "DELETE")).toBe(true);
+    });
+  });
+
+  it.live(
+    "surfaces not-linked guidance before a malformed project .env (Go LoadProjectRef-before-LoadConfig)",
+    () => {
+      // Go's `ParseDatabaseConfig` `case linked:` (db_url.go:87-93) calls `LoadProjectRef`
+      // strictly before `LoadConfig` (which reads the project `.env` files), so an unlinked
+      // workdir must fail with the not-linked guidance even when `supabase/.env` is malformed
+      // — the malformed file must never be reached (CLI-1878).
+      const { layer, requests } = setupLegacyStorage(tmp.current, {
+        toml: 'project_id = "test"\n',
+        linkedFails: true,
+        files: { "supabase/.env": "!=\n" },
+      });
+      return Effect.gen(function* () {
+        const exit = yield* legacyStorageRm({
+          files: ["ss:///private/a.pdf"],
+          recursive: false,
+          linked: true,
+          local: false,
+        }).pipe(Effect.provide(layer), Effect.exit);
+        expect(Exit.isFailure(exit)).toBe(true);
+        expect(JSON.stringify(exit)).toContain("Cannot find project ref");
+        expect(JSON.stringify(exit)).not.toContain("failed to parse environment file");
+        expect(requests).toHaveLength(0);
+      });
+    },
+  );
+
   it.live("skips the bucket when the confirmation is declined", () => {
     const { layer, requests } = setupLegacyStorage(tmp.current, {
       toml: 'project_id = "test"\n',
diff --git a/apps/cli/src/legacy/commands/storage/storage.frame.ts b/apps/cli/src/legacy/commands/storage/storage.frame.ts
index f4d5fd15f9..dfad46cac2 100644
--- a/apps/cli/src/legacy/commands/storage/storage.frame.ts
+++ b/apps/cli/src/legacy/commands/storage/storage.frame.ts
@@ -50,8 +50,8 @@ export const legacyLoadStorageConfig = Effect.fnUntraced(function* (
   workdir: string,
   projectRef: string,
 ) {
-  const loadOptions: LoadProjectConfigOptions | undefined =
-    projectRef !== "" ? { projectRef } : undefined;
+  const loadOptions: LoadProjectConfigOptions =
+    projectRef !== "" ? { projectRef, goViperCompat: true } : { goViperCompat: true };
   const loaded = yield* loadProjectConfig(workdir, loadOptions).pipe(
     Effect.catchTag(
       "ProjectConfigParseError",
diff --git a/apps/cli/src/legacy/commands/telemetry/disable/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/telemetry/disable/SIDE_EFFECTS.md
index 1be0ffbf9f..cb0719af81 100644
--- a/apps/cli/src/legacy/commands/telemetry/disable/SIDE_EFFECTS.md
+++ b/apps/cli/src/legacy/commands/telemetry/disable/SIDE_EFFECTS.md
@@ -17,7 +17,8 @@ instead of `~/.supabase/telemetry.json`.
 
 ## API Routes
 
-`disable` is fully local. No network calls are made.
+None called directly. `cli_command_executed` may be sent to PostHog — see
+Telemetry Events Fired below.
 
 ## Environment Variables
 
@@ -34,8 +35,26 @@ instead of `~/.supabase/telemetry.json`.
 
 ## Telemetry Events Fired
 
-None. The command disables analytics capture so toggling telemetry does not emit
-`cli_command_executed`, matching Go.
+| Event                  | When                                                                      |
+| ---------------------- | ------------------------------------------------------------------------- |
+| `cli_command_executed` | when telemetry was **already enabled** before this invocation (see below) |
+
+Go parity (`apps/cli-go/cmd/root.go:131-138,171-181`): the event is gated on
+the consent state read at process start, before this command's handler
+rewrites `telemetry.json` — not on the value the command just wrote. Running
+`disable` while telemetry is enabled fires the event one last time (using
+the pre-toggle, still-enabled snapshot); running it while telemetry is
+already disabled stays silent. See `telemetry/enable/SIDE_EFFECTS.md` for
+the mirror-image case.
+
+When the event fires, the process waits (bounded, up to ~5s) for a PostHog
+flush attempt to complete or time out before exiting, since the analytics
+client's shutdown is a finalizer around the whole command run. Previously
+`disable`/`enable` never queued an event and returned immediately; on a
+slow or fully offline network, this invocation can now take noticeably
+longer than before, though the `Telemetry is disabled.` stdout line is
+still written before that wait (it comes from the handler, which completes
+before the surrounding instrumentation's post-run capture/flush step).
 
 ## Output
 
diff --git a/apps/cli/src/legacy/commands/telemetry/disable/disable.command.ts b/apps/cli/src/legacy/commands/telemetry/disable/disable.command.ts
index 4914b2c2a6..4618901625 100644
--- a/apps/cli/src/legacy/commands/telemetry/disable/disable.command.ts
+++ b/apps/cli/src/legacy/commands/telemetry/disable/disable.command.ts
@@ -12,8 +12,17 @@ export const legacyTelemetryDisableCommand = Command.make("disable", config).pip
   Command.withDescription("Disable CLI telemetry."),
   Command.withShortDescription("Disable telemetry"),
   Command.withHandler((flags) =>
+    // Go parity (`cmd/root.go:131-138,171-181`): `cli_command_executed` fires
+    // gated on the CONSENT SNAPSHOT TAKEN BEFORE this command's handler runs
+    // (Go's PersistentPreRunE reads the on-disk state before `disable`'s RunE
+    // mutates it), not on the just-written `false`. `legacyAnalyticsLayer`
+    // reproduces that naturally: it reads `TelemetryRuntime.consent` once, at
+    // layer-construction time, before the handler below ever executes, so
+    // leaving analytics enabled here fires the event exactly when telemetry
+    // was enabled prior to this invocation, and stays silent when it was
+    // already disabled — see `enable.command.ts` for the mirror-image case.
     legacyTelemetryDisable(flags).pipe(
-      withLegacyCommandInstrumentation({ analytics: false, flags }),
+      withLegacyCommandInstrumentation({ flags }),
       withJsonErrorHandling,
     ),
   ),
diff --git a/apps/cli/src/legacy/commands/telemetry/enable/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/telemetry/enable/SIDE_EFFECTS.md
index 3942a107dc..d9b81200ab 100644
--- a/apps/cli/src/legacy/commands/telemetry/enable/SIDE_EFFECTS.md
+++ b/apps/cli/src/legacy/commands/telemetry/enable/SIDE_EFFECTS.md
@@ -17,7 +17,8 @@ instead of `~/.supabase/telemetry.json`.
 
 ## API Routes
 
-`enable` is fully local. No network calls are made.
+None called directly. `cli_command_executed` may be sent to PostHog — see
+Telemetry Events Fired below.
 
 ## Environment Variables
 
@@ -34,8 +35,27 @@ instead of `~/.supabase/telemetry.json`.
 
 ## Telemetry Events Fired
 
-None. The command disables analytics capture so toggling telemetry does not emit
-`cli_command_executed`, matching Go.
+| Event                  | When                                                                      |
+| ---------------------- | ------------------------------------------------------------------------- |
+| `cli_command_executed` | when telemetry was **already enabled** before this invocation (see below) |
+
+Go parity (`apps/cli-go/cmd/root.go:131-138,171-181`): the event is gated on
+the consent state read at process start, before this command's handler
+rewrites `telemetry.json` — not on the value the command just wrote. In the
+common case (enabling from a disabled state) the pre-toggle snapshot is
+`false`, so nothing fires; running `enable` while telemetry is already
+enabled fires the event, matching Go's uniform, state-based (not
+command-based) gate. See `telemetry/disable/SIDE_EFFECTS.md` for the
+mirror-image case.
+
+When the event fires, the process waits (bounded, up to ~5s) for a PostHog
+flush attempt to complete or time out before exiting, since the analytics
+client's shutdown is a finalizer around the whole command run. Previously
+`disable`/`enable` never queued an event and returned immediately; on a
+slow or fully offline network, this invocation can now take noticeably
+longer than before, though the `Telemetry is enabled.` stdout line is
+still written before that wait (it comes from the handler, which completes
+before the surrounding instrumentation's post-run capture/flush step).
 
 ## Output
 
diff --git a/apps/cli/src/legacy/commands/telemetry/enable/enable.command.ts b/apps/cli/src/legacy/commands/telemetry/enable/enable.command.ts
index 5497f0e929..df79ad2505 100644
--- a/apps/cli/src/legacy/commands/telemetry/enable/enable.command.ts
+++ b/apps/cli/src/legacy/commands/telemetry/enable/enable.command.ts
@@ -12,8 +12,14 @@ export const legacyTelemetryEnableCommand = Command.make("enable", config).pipe(
   Command.withDescription("Enable CLI telemetry."),
   Command.withShortDescription("Enable telemetry"),
   Command.withHandler((flags) =>
+    // Go parity (`cmd/root.go:131-138,171-181`): `cli_command_executed` fires
+    // gated on the pre-toggle consent snapshot, same as `disable` — see that
+    // command's comment. In the common case (enabling from a disabled state)
+    // the snapshot is `false`, so the event stays silent; running `enable`
+    // when telemetry is ALREADY enabled fires it, matching Go's uniform,
+    // state-based (not command-based) gate.
     legacyTelemetryEnable(flags).pipe(
-      withLegacyCommandInstrumentation({ analytics: false, flags }),
+      withLegacyCommandInstrumentation({ flags }),
       withJsonErrorHandling,
     ),
   ),
diff --git a/apps/cli/src/legacy/commands/telemetry/telemetry.integration.test.ts b/apps/cli/src/legacy/commands/telemetry/telemetry.integration.test.ts
index 99af77c201..870403c99e 100644
--- a/apps/cli/src/legacy/commands/telemetry/telemetry.integration.test.ts
+++ b/apps/cli/src/legacy/commands/telemetry/telemetry.integration.test.ts
@@ -6,8 +6,18 @@ import path from "node:path";
 import { Effect, Layer } from "effect";
 import { Command } from "effect/unstable/cli";
 
-import { mockAnalytics, mockOutput, processEnvLayer } from "../../../../tests/helpers/mocks.ts";
+import {
+  mockAnalytics,
+  mockOutput,
+  mockProjectContext,
+  mockRuntimeInfo,
+  mockTty,
+  processEnvLayer,
+} from "../../../../tests/helpers/mocks.ts";
+import { cliConfigLayer } from "../../../next/config/cli-config.layer.ts";
 import { processControlLayer } from "../../../shared/runtime/process-control.layer.ts";
+import { EventCommandExecuted } from "../../../shared/telemetry/event-catalog.ts";
+import { legacyAnalyticsLayer } from "../../telemetry/legacy-analytics.layer.ts";
 import { legacyTelemetryCommand } from "./telemetry.command.ts";
 
 function makeTempDir(): string {
@@ -32,6 +42,42 @@ function setup(dir: string) {
     processControlLayer,
     processEnvLayer({ SUPABASE_HOME: dir }),
   );
+  return { out, analytics, layer };
+}
+
+// Wires the REAL `legacyAnalyticsLayer` (consent-gated, backed by
+// `telemetryRuntimeLayer` reading `dir`'s telemetry.json) instead of
+// `mockAnalytics()` — the un-mocked boundary `Analytics.capture` calls
+// actually pass through. No PostHog key is set in the test env, so
+// `legacyAnalyticsLayer` resolves to its no-op branch regardless of consent
+// (real-network PostHog delivery has no test double anywhere in this repo);
+// this proves the command runs the real consent-gated layer end-to-end
+// without crashing, not the exact PostHog call count. The snapshot-timing
+// mechanism itself (pre-toggle consent surviving the handler's own disk
+// write) is proven directly in `runtime.layer.unit.test.ts`.
+function setupWithRealAnalytics(dir: string) {
+  const out = mockOutput();
+  const runtimeInfoLayer = mockRuntimeInfo({ homeDir: dir });
+  const ttyLayer = mockTty();
+  const envLayer = processEnvLayer({ SUPABASE_HOME: dir });
+  const projectContextLayer = mockProjectContext();
+  const configLayer = cliConfigLayer.pipe(
+    Layer.provide(runtimeInfoLayer),
+    Layer.provide(projectContextLayer),
+  );
+  const analyticsLayer = legacyAnalyticsLayer.pipe(
+    Layer.provide(configLayer),
+    Layer.provide(runtimeInfoLayer),
+    Layer.provide(ttyLayer),
+    Layer.provide(BunServices.layer),
+  );
+  const layer = Layer.mergeAll(
+    out.layer,
+    analyticsLayer,
+    BunServices.layer,
+    processControlLayer,
+    envLayer,
+  );
   return { out, layer };
 }
 
@@ -135,6 +181,91 @@ describe("legacy telemetry integration", () => {
     ) as Effect.Effect<void>;
   });
 
+  // Go parity (`cmd/root.go:131-138,171-181`): `cli_command_executed` is gated on
+  // the consent SNAPSHOT taken before the handler runs, not the value the handler
+  // just wrote. These two assert the narrower wiring fix using `mockAnalytics()`
+  // (which unconditionally records every capture, bypassing consent entirely):
+  // `disable`/`enable` no longer force-suppress analytics via `analytics: false`,
+  // so the shared instrumentation wrapper actually reaches `Analytics.capture`.
+  // The snapshot-timing mechanism itself — that the pre-toggle value survives the
+  // handler's own on-disk write — is proven directly against `telemetryRuntimeLayer`
+  // in `shared/telemetry/runtime.layer.unit.test.ts`. The two tests further below
+  // run the same commands through the REAL, consent-gated `legacyAnalyticsLayer`
+  // (not this mock) to prove the production wiring doesn't crash end-to-end.
+  it.live("disable no longer force-suppresses cli_command_executed", () => {
+    const dir = makeTempDir();
+    const { analytics, layer } = setup(dir);
+
+    return Effect.gen(function* () {
+      yield* Command.runWith(legacyTestRoot(), { version: "0.0.0-test" })(["telemetry", "disable"]);
+      expect(analytics.captured.map((event) => event.event)).toContain(EventCommandExecuted);
+    }).pipe(
+      Effect.provide(layer),
+      Effect.ensuring(Effect.sync(() => rmSync(dir, { recursive: true, force: true }))),
+    ) as Effect.Effect<void>;
+  });
+
+  it.live("enable no longer force-suppresses cli_command_executed", () => {
+    const dir = makeTempDir();
+    const { analytics, layer } = setup(dir);
+
+    return Effect.gen(function* () {
+      yield* Command.runWith(legacyTestRoot(), { version: "0.0.0-test" })(["telemetry", "enable"]);
+      expect(analytics.captured.map((event) => event.event)).toContain(EventCommandExecuted);
+    }).pipe(
+      Effect.provide(layer),
+      Effect.ensuring(Effect.sync(() => rmSync(dir, { recursive: true, force: true }))),
+    ) as Effect.Effect<void>;
+  });
+
+  it.live("disable runs cleanly through the real consent-gated analytics layer", () => {
+    const dir = makeTempDir();
+    writeFileSync(
+      telemetryPath(dir),
+      JSON.stringify({
+        enabled: true,
+        device_id: "device-123",
+        session_id: "session-123",
+        session_last_active: "2026-01-01T00:00:00.000Z",
+        schema_version: 1,
+      }),
+    );
+    const { out, layer } = setupWithRealAnalytics(dir);
+
+    return Effect.gen(function* () {
+      yield* Command.runWith(legacyTestRoot(), { version: "0.0.0-test" })(["telemetry", "disable"]);
+      expect(out.stdoutText).toBe("Telemetry is disabled.\n");
+      expect(readTelemetryConfig(dir).enabled).toBe(false);
+    }).pipe(
+      Effect.provide(layer),
+      Effect.ensuring(Effect.sync(() => rmSync(dir, { recursive: true, force: true }))),
+    ) as Effect.Effect<void>;
+  });
+
+  it.live("enable runs cleanly through the real consent-gated analytics layer", () => {
+    const dir = makeTempDir();
+    writeFileSync(
+      telemetryPath(dir),
+      JSON.stringify({
+        enabled: false,
+        device_id: "device-123",
+        session_id: "session-123",
+        session_last_active: "2026-01-01T00:00:00.000Z",
+        schema_version: 1,
+      }),
+    );
+    const { out, layer } = setupWithRealAnalytics(dir);
+
+    return Effect.gen(function* () {
+      yield* Command.runWith(legacyTestRoot(), { version: "0.0.0-test" })(["telemetry", "enable"]);
+      expect(out.stdoutText).toBe("Telemetry is enabled.\n");
+      expect(readTelemetryConfig(dir).enabled).toBe(true);
+    }).pipe(
+      Effect.provide(layer),
+      Effect.ensuring(Effect.sync(() => rmSync(dir, { recursive: true, force: true }))),
+    ) as Effect.Effect<void>;
+  });
+
   it.live(
     "status treats malformed typed fields as a corrupted file and regenerates identity",
     () => {
diff --git a/apps/cli/src/legacy/commands/test/db/db.pg-prove-args.ts b/apps/cli/src/legacy/commands/test/db/db.pg-prove-args.ts
index aafdd35458..6e1c171b4d 100644
--- a/apps/cli/src/legacy/commands/test/db/db.pg-prove-args.ts
+++ b/apps/cli/src/legacy/commands/test/db/db.pg-prove-args.ts
@@ -1,6 +1,8 @@
 import * as nodePath from "node:path";
 import { Option } from "effect";
 
+import { legacyToDockerPath } from "../../../shared/legacy-docker-path.ts";
+
 export interface LegacyPgProveArgs {
   /** Full `pg_prove` argv (without the leading binary, which the image provides). */
   readonly cmd: ReadonlyArray<string>;
@@ -10,17 +12,6 @@ export interface LegacyPgProveArgs {
   readonly workingDir: Option.Option<string>;
 }
 
-/**
- * Translate an absolute host path to its in-container mount path. Mirrors Go's
- * `utils.ToDockerPath` (`apps/cli-go/internal/utils/deno.go:268`): strip a
- * Windows volume name (`C:`) and convert backslashes to forward slashes.
- */
-export function legacyToDockerPath(absHostPath: string): string {
-  const slashed = absHostPath.replaceAll("\\", "/");
-  const volumeMatch = /^[A-Za-z]:/.exec(absHostPath);
-  return volumeMatch === null ? slashed : slashed.slice(volumeMatch[0].length);
-}
-
 /**
  * Build the `pg_prove` command, volume binds, and working directory for a
  * `test db` run. Pure port of the loop in `apps/cli-go/internal/db/test/test.go:29-56`.
diff --git a/apps/cli/src/legacy/commands/test/db/db.pg-prove-args.unit.test.ts b/apps/cli/src/legacy/commands/test/db/db.pg-prove-args.unit.test.ts
index c23060b76f..a7d5997684 100644
--- a/apps/cli/src/legacy/commands/test/db/db.pg-prove-args.unit.test.ts
+++ b/apps/cli/src/legacy/commands/test/db/db.pg-prove-args.unit.test.ts
@@ -1,19 +1,7 @@
 import { describe, expect, test } from "vitest";
 import { Option } from "effect";
 
-import { buildLegacyPgProveArgs, legacyToDockerPath } from "./db.pg-prove-args.ts";
-
-describe("legacyToDockerPath", () => {
-  test("leaves a posix path unchanged", () => {
-    expect(legacyToDockerPath("/work/project/supabase/tests")).toBe("/work/project/supabase/tests");
-  });
-
-  test("strips a Windows volume and converts backslashes", () => {
-    expect(legacyToDockerPath("C:\\Users\\me\\tests\\a_test.sql")).toBe(
-      "/Users/me/tests/a_test.sql",
-    );
-  });
-});
+import { buildLegacyPgProveArgs } from "./db.pg-prove-args.ts";
 
 describe("buildLegacyPgProveArgs", () => {
   test("defaults to <workdir>/supabase/tests when no paths are given", () => {
diff --git a/apps/cli/src/legacy/commands/test/new/new.command.ts b/apps/cli/src/legacy/commands/test/new/new.command.ts
index 047d0b16ab..cb423da1a9 100644
--- a/apps/cli/src/legacy/commands/test/new/new.command.ts
+++ b/apps/cli/src/legacy/commands/test/new/new.command.ts
@@ -39,7 +39,19 @@ export const legacyTestNewCommand = Command.make("new", config).pipe(
   Command.withDescription("Create a new test file."),
   Command.withShortDescription("Create a new test file"),
   Command.withHandler((flags) =>
-    legacyTestNew(flags).pipe(withLegacyCommandInstrumentation({ flags }), withJsonErrorHandling),
+    legacyTestNew(flags).pipe(
+      withLegacyCommandInstrumentation({
+        flags,
+        config,
+        // `--template` registers `-t` (Flag.withAlias above); without this,
+        // `-t pgtap` never resolves to the canonical `template` name in
+        // extractChangedFlagNames, so it wouldn't appear in telemetry at all
+        // (Go's pflag.Visit reports the canonical name regardless of shorthand —
+        // cmd/root_analytics.go:53-76).
+        aliases: { t: "template" },
+      }),
+      withJsonErrorHandling,
+    ),
   ),
   Command.provide(legacyTestNewRuntimeLayer),
 );
diff --git a/apps/cli/src/legacy/commands/vanity-subdomains/activate/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/vanity-subdomains/activate/SIDE_EFFECTS.md
index 23fbe98051..aace0d1a0b 100644
--- a/apps/cli/src/legacy/commands/vanity-subdomains/activate/SIDE_EFFECTS.md
+++ b/apps/cli/src/legacy/commands/vanity-subdomains/activate/SIDE_EFFECTS.md
@@ -2,10 +2,10 @@
 
 ## Files Read
 
-| Path                                   | Format                    | When                                                          |
-| -------------------------------------- | ------------------------- | ------------------------------------------------------------- |
-| `~/.supabase/access-token`             | plain text (token string) | when `SUPABASE_ACCESS_TOKEN` unset and keyring unavailable    |
-| `<workdir>/supabase/.temp/project-ref` | plain text (project ref)  | when `--project-ref` flag and `PROJECT_ID` env are both unset |
+| Path                                   | Format                    | When                                                                   |
+| -------------------------------------- | ------------------------- | ---------------------------------------------------------------------- |
+| `~/.supabase/access-token`             | plain text (token string) | when `SUPABASE_ACCESS_TOKEN` unset and keyring unavailable             |
+| `<workdir>/supabase/.temp/project-ref` | plain text (project ref)  | when `--project-ref` flag and `SUPABASE_PROJECT_ID` env are both unset |
 
 ## Files Written
 
@@ -25,8 +25,8 @@
 | Variable                | Purpose                                              | Required?                                                  |
 | ----------------------- | ---------------------------------------------------- | ---------------------------------------------------------- |
 | `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring then `~/.supabase/access-token`) |
-| `SUPABASE_API_URL`      | override Management API base URL                     | no (defaults to `https://api.supabase.com`)                |
-| `PROJECT_ID`            | project ref fallback when `--project-ref` is unset   | no (falls back to `supabase/.temp/project-ref`)            |
+| `SUPABASE_PROFILE`      | built-in profile name or YAML file path              | no (falls back to `~/.supabase/profile` -> `supabase`)     |
+| `SUPABASE_PROJECT_ID`   | project ref fallback when `--project-ref` is unset   | no (falls back to `supabase/.temp/project-ref`)            |
 
 ## Exit Codes
 
diff --git a/apps/cli/src/legacy/commands/vanity-subdomains/check-availability/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/vanity-subdomains/check-availability/SIDE_EFFECTS.md
index dc361d9fbc..9fc14225dc 100644
--- a/apps/cli/src/legacy/commands/vanity-subdomains/check-availability/SIDE_EFFECTS.md
+++ b/apps/cli/src/legacy/commands/vanity-subdomains/check-availability/SIDE_EFFECTS.md
@@ -2,10 +2,10 @@
 
 ## Files Read
 
-| Path                                   | Format                    | When                                                          |
-| -------------------------------------- | ------------------------- | ------------------------------------------------------------- |
-| `~/.supabase/access-token`             | plain text (token string) | when `SUPABASE_ACCESS_TOKEN` unset and keyring unavailable    |
-| `<workdir>/supabase/.temp/project-ref` | plain text (project ref)  | when `--project-ref` flag and `PROJECT_ID` env are both unset |
+| Path                                   | Format                    | When                                                                   |
+| -------------------------------------- | ------------------------- | ---------------------------------------------------------------------- |
+| `~/.supabase/access-token`             | plain text (token string) | when `SUPABASE_ACCESS_TOKEN` unset and keyring unavailable             |
+| `<workdir>/supabase/.temp/project-ref` | plain text (project ref)  | when `--project-ref` flag and `SUPABASE_PROJECT_ID` env are both unset |
 
 ## Files Written
 
@@ -25,8 +25,8 @@
 | Variable                | Purpose                                              | Required?                                                  |
 | ----------------------- | ---------------------------------------------------- | ---------------------------------------------------------- |
 | `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring then `~/.supabase/access-token`) |
-| `SUPABASE_API_URL`      | override Management API base URL                     | no (defaults to `https://api.supabase.com`)                |
-| `PROJECT_ID`            | project ref fallback when `--project-ref` is unset   | no (falls back to `supabase/.temp/project-ref`)            |
+| `SUPABASE_PROFILE`      | built-in profile name or YAML file path              | no (falls back to `~/.supabase/profile` -> `supabase`)     |
+| `SUPABASE_PROJECT_ID`   | project ref fallback when `--project-ref` is unset   | no (falls back to `supabase/.temp/project-ref`)            |
 
 ## Exit Codes
 
diff --git a/apps/cli/src/legacy/commands/vanity-subdomains/delete/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/vanity-subdomains/delete/SIDE_EFFECTS.md
index 2596dc4cb6..5e67410233 100644
--- a/apps/cli/src/legacy/commands/vanity-subdomains/delete/SIDE_EFFECTS.md
+++ b/apps/cli/src/legacy/commands/vanity-subdomains/delete/SIDE_EFFECTS.md
@@ -2,10 +2,10 @@
 
 ## Files Read
 
-| Path                                   | Format                    | When                                                          |
-| -------------------------------------- | ------------------------- | ------------------------------------------------------------- |
-| `~/.supabase/access-token`             | plain text (token string) | when `SUPABASE_ACCESS_TOKEN` unset and keyring unavailable    |
-| `<workdir>/supabase/.temp/project-ref` | plain text (project ref)  | when `--project-ref` flag and `PROJECT_ID` env are both unset |
+| Path                                   | Format                    | When                                                                   |
+| -------------------------------------- | ------------------------- | ---------------------------------------------------------------------- |
+| `~/.supabase/access-token`             | plain text (token string) | when `SUPABASE_ACCESS_TOKEN` unset and keyring unavailable             |
+| `<workdir>/supabase/.temp/project-ref` | plain text (project ref)  | when `--project-ref` flag and `SUPABASE_PROJECT_ID` env are both unset |
 
 ## Files Written
 
@@ -25,8 +25,8 @@
 | Variable                | Purpose                                              | Required?                                                  |
 | ----------------------- | ---------------------------------------------------- | ---------------------------------------------------------- |
 | `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring then `~/.supabase/access-token`) |
-| `SUPABASE_API_URL`      | override Management API base URL                     | no (defaults to `https://api.supabase.com`)                |
-| `PROJECT_ID`            | project ref fallback when `--project-ref` is unset   | no (falls back to `supabase/.temp/project-ref`)            |
+| `SUPABASE_PROFILE`      | built-in profile name or YAML file path              | no (falls back to `~/.supabase/profile` -> `supabase`)     |
+| `SUPABASE_PROJECT_ID`   | project ref fallback when `--project-ref` is unset   | no (falls back to `supabase/.temp/project-ref`)            |
 
 ## Exit Codes
 
diff --git a/apps/cli/src/legacy/commands/vanity-subdomains/get/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/vanity-subdomains/get/SIDE_EFFECTS.md
index 15c79abde7..73b367ec63 100644
--- a/apps/cli/src/legacy/commands/vanity-subdomains/get/SIDE_EFFECTS.md
+++ b/apps/cli/src/legacy/commands/vanity-subdomains/get/SIDE_EFFECTS.md
@@ -2,10 +2,10 @@
 
 ## Files Read
 
-| Path                                   | Format                    | When                                                          |
-| -------------------------------------- | ------------------------- | ------------------------------------------------------------- |
-| `~/.supabase/access-token`             | plain text (token string) | when `SUPABASE_ACCESS_TOKEN` unset and keyring unavailable    |
-| `<workdir>/supabase/.temp/project-ref` | plain text (project ref)  | when `--project-ref` flag and `PROJECT_ID` env are both unset |
+| Path                                   | Format                    | When                                                                   |
+| -------------------------------------- | ------------------------- | ---------------------------------------------------------------------- |
+| `~/.supabase/access-token`             | plain text (token string) | when `SUPABASE_ACCESS_TOKEN` unset and keyring unavailable             |
+| `<workdir>/supabase/.temp/project-ref` | plain text (project ref)  | when `--project-ref` flag and `SUPABASE_PROJECT_ID` env are both unset |
 
 ## Files Written
 
@@ -25,8 +25,8 @@
 | Variable                | Purpose                                              | Required?                                                  |
 | ----------------------- | ---------------------------------------------------- | ---------------------------------------------------------- |
 | `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring then `~/.supabase/access-token`) |
-| `SUPABASE_API_URL`      | override Management API base URL                     | no (defaults to `https://api.supabase.com`)                |
-| `PROJECT_ID`            | project ref fallback when `--project-ref` is unset   | no (falls back to `supabase/.temp/project-ref`)            |
+| `SUPABASE_PROFILE`      | built-in profile name or YAML file path              | no (falls back to `~/.supabase/profile` -> `supabase`)     |
+| `SUPABASE_PROJECT_ID`   | project ref fallback when `--project-ref` is unset   | no (falls back to `supabase/.temp/project-ref`)            |
 
 ## Exit Codes
 
diff --git a/apps/cli/src/legacy/config/legacy-cli-config.layer.ts b/apps/cli/src/legacy/config/legacy-cli-config.layer.ts
index 70ec567d30..843059bf59 100644
--- a/apps/cli/src/legacy/config/legacy-cli-config.layer.ts
+++ b/apps/cli/src/legacy/config/legacy-cli-config.layer.ts
@@ -2,7 +2,11 @@ import { Effect, FileSystem, Layer, Option, Path, Redacted } from "effect";
 import { parse as parseYaml } from "yaml";
 import { CLI_VERSION } from "../../shared/cli/version.ts";
 import { LegacyProfileFlag, LegacyWorkdirFlag } from "../../shared/legacy/global-flags.ts";
-import { legacyPoolerHost, legacyProjectHost } from "../shared/legacy-profile.ts";
+import {
+  legacyDashboardUrl,
+  legacyPoolerHost,
+  legacyProjectHost,
+} from "../shared/legacy-profile.ts";
 import {
   LegacyDebugLogger,
   type LegacyDebugLoggerShape,
@@ -16,6 +20,7 @@ interface ResolvedProfile {
   readonly apiUrl: string;
   readonly projectHost: string;
   readonly poolerHost: string;
+  readonly dashboardUrl: string;
 }
 
 const BUILTIN_PROFILE_API_URLS: Record<LegacyProfileName, string> = {
@@ -38,6 +43,7 @@ function resolvedBuiltin(name: LegacyProfileName): ResolvedProfile {
     apiUrl: BUILTIN_PROFILE_API_URLS[name],
     projectHost: legacyProjectHost(name),
     poolerHost: legacyPoolerHost(name),
+    dashboardUrl: legacyDashboardUrl(name),
   };
 }
 
@@ -47,6 +53,7 @@ function safeParseYaml(text: string):
       api_url?: unknown;
       project_host?: unknown;
       pooler_host?: unknown;
+      dashboard_url?: unknown;
     }
   | undefined {
   try {
@@ -57,6 +64,7 @@ function safeParseYaml(text: string):
           api_url?: unknown;
           project_host?: unknown;
           pooler_host?: unknown;
+          dashboard_url?: unknown;
         })
       : undefined;
   } catch {
@@ -147,10 +155,33 @@ function resolveProfile(
       // that omits `pooler_host:` yields an empty host, which disables the MITM
       // domain assertion — it must NOT fall back to the production `supabase.com`.
       poolerHost: typeof parsed.pooler_host === "string" ? parsed.pooler_host : "",
+      // Go's `Profile.DashboardURL` is `required` (`profile.go:20`); a YAML profile
+      // that omits it falls back to the built-in `supabase` dashboard here rather
+      // than erroring, since it only feeds the connect-failure suggestion text.
+      dashboardUrl:
+        typeof parsed.dashboard_url === "string"
+          ? parsed.dashboard_url
+          : legacyDashboardUrl("supabase"),
     };
   });
 }
 
+/**
+ * Go's `ChangeWorkDir` (`apps/cli-go/internal/utils/misc.go:231-250`) always
+ * `os.Chdir(workdir)`s using the raw `--workdir`/`SUPABASE_WORKDIR` string,
+ * which can be relative (e.g. `.`) — but every later reader of the resolved
+ * workdir (including the `Config.ProjectId` cwd-basename default, `Eject`,
+ * `pkg/config/config.go:561-570`, run on every `Config.Load()` via
+ * `mergeDefaultValues`, `config.go:690-699`) reads `os.Getwd()`, the real
+ * ABSOLUTE directory, never the raw configured string. `os.Chdir(".")` is a
+ * no-op syscall-wise, so Go's `cwd` is unaffected by the flag/env value being
+ * relative. This resolves the flag/env value against the real process `cwd`
+ * the same way, so `LegacyCliConfig.workdir` is always absolute — matching
+ * Go's invariant that basename-ing it (e.g. `legacyResolveLocalProjectId`'s
+ * workdir-basename fallback) operates on a real directory name, not a
+ * relative-path fragment like `.` (which would sanitize to an empty project
+ * id and build a bare, all-projects-matching Docker label filter).
+ */
 function resolveWorkdir(
   flagValue: Option.Option<string>,
   envValue: string | undefined,
@@ -160,10 +191,10 @@ function resolveWorkdir(
 ): Effect.Effect<string> {
   return Effect.gen(function* () {
     if (Option.isSome(flagValue) && flagValue.value.length > 0) {
-      return flagValue.value;
+      return path.resolve(cwd, flagValue.value);
     }
     if (envValue !== undefined && envValue.length > 0) {
-      return envValue;
+      return path.resolve(cwd, envValue);
     }
     let current = cwd;
     // Walk up until we hit a directory containing supabase/config.toml or the FS root.
@@ -200,6 +231,7 @@ export const legacyCliConfigLayer = Layer.unwrap(
           apiUrl,
           projectHost,
           poolerHost,
+          dashboardUrl,
         } = yield* resolveProfile(
           profileFlag,
           env["SUPABASE_PROFILE"],
@@ -236,6 +268,7 @@ export const legacyCliConfigLayer = Layer.unwrap(
           apiUrl,
           projectHost,
           poolerHost,
+          dashboardUrl,
           accessToken,
           projectId,
           workdir,
diff --git a/apps/cli/src/legacy/config/legacy-cli-config.layer.unit.test.ts b/apps/cli/src/legacy/config/legacy-cli-config.layer.unit.test.ts
index 541e2d4a9b..0bb042b435 100644
--- a/apps/cli/src/legacy/config/legacy-cli-config.layer.unit.test.ts
+++ b/apps/cli/src/legacy/config/legacy-cli-config.layer.unit.test.ts
@@ -56,6 +56,7 @@ describe("legacyCliConfigLayer", () => {
       expect(config.apiUrl).toBe("https://api.supabase.com");
       expect(config.projectHost).toBe("supabase.co");
       expect(config.poolerHost).toBe("supabase.com");
+      expect(config.dashboardUrl).toBe("https://supabase.com/dashboard");
     }).pipe(Effect.provide(makeLayer({ cwd: tempRoot }))),
   );
 
@@ -154,7 +155,7 @@ describe("legacyCliConfigLayer", () => {
       ),
   );
 
-  it.effect("loads api_url, name, and pooler_host from a YAML profile file", () => {
+  it.effect("loads api_url, name, pooler_host, and dashboard_url from a YAML profile file", () => {
     const profilePath = join(tempRoot, "profile.yaml");
     writeFileSync(
       profilePath,
@@ -163,6 +164,7 @@ describe("legacyCliConfigLayer", () => {
         'api_url: "http://127.0.0.1:9999"',
         "project_host: localhost",
         "pooler_host: staging.example.com",
+        'dashboard_url: "http://127.0.0.1:9999"',
       ].join("\n"),
     );
     return Effect.gen(function* () {
@@ -171,6 +173,9 @@ describe("legacyCliConfigLayer", () => {
       expect(config.apiUrl).toBe("http://127.0.0.1:9999");
       expect(config.projectHost).toBe("localhost");
       expect(config.poolerHost).toBe("staging.example.com");
+      // Go reads `dashboard_url` from the profile (used by the connect-failure hint);
+      // the cli-e2e harness points it at the replay server for parity.
+      expect(config.dashboardUrl).toBe("http://127.0.0.1:9999");
     }).pipe(Effect.provide(makeLayer({ env: { SUPABASE_PROFILE: profilePath }, cwd: tempRoot })));
   });
 
@@ -183,6 +188,8 @@ describe("legacyCliConfigLayer", () => {
       // Go's Profile.PoolerHost is `omitempty`: an absent pooler_host disables the
       // MITM domain assertion rather than falling back to supabase.com.
       expect(config.poolerHost).toBe("");
+      // An omitted dashboard_url falls back to the built-in supabase dashboard.
+      expect(config.dashboardUrl).toBe("https://supabase.com/dashboard");
     }).pipe(Effect.provide(makeLayer({ env: { SUPABASE_PROFILE: profilePath }, cwd: tempRoot })));
   });
 
@@ -271,6 +278,43 @@ describe("legacyCliConfigLayer", () => {
     ),
   );
 
+  // Go's `ChangeWorkDir` (`apps/cli-go/internal/utils/misc.go:231-250`) always
+  // `os.Chdir`s the raw flag/env value, but every later reader — including the
+  // `Config.ProjectId` cwd-basename default (`Eject`, `pkg/config/config.go:
+  // 561-570`) — reads `os.Getwd()`, the real absolute directory, never the raw
+  // string. A relative `--workdir .`/`SUPABASE_WORKDIR=.` must therefore resolve
+  // to an absolute path here too, not stay `"."` (which would later basename to
+  // an empty project id).
+  it.effect("resolves a relative --workdir flag against the real cwd", () =>
+    Effect.gen(function* () {
+      const config = yield* LegacyCliConfig;
+      expect(config.workdir).toBe(tempRoot);
+    }).pipe(Effect.provide(makeLayer({ workdirFlag: Option.some("."), cwd: tempRoot }))),
+  );
+
+  it.effect("resolves a relative --workdir flag with a subdirectory against the real cwd", () =>
+    Effect.gen(function* () {
+      const config = yield* LegacyCliConfig;
+      expect(config.workdir).toBe(join(tempRoot, "sub"));
+    }).pipe(Effect.provide(makeLayer({ workdirFlag: Option.some("sub"), cwd: tempRoot }))),
+  );
+
+  it.effect("resolves a relative SUPABASE_WORKDIR env value against the real cwd", () =>
+    Effect.gen(function* () {
+      const config = yield* LegacyCliConfig;
+      expect(config.workdir).toBe(tempRoot);
+    }).pipe(Effect.provide(makeLayer({ env: { SUPABASE_WORKDIR: "." }, cwd: tempRoot }))),
+  );
+
+  it.effect("keeps an absolute --workdir flag unchanged", () =>
+    Effect.gen(function* () {
+      const config = yield* LegacyCliConfig;
+      expect(config.workdir).toBe("/flag/workdir");
+    }).pipe(
+      Effect.provide(makeLayer({ workdirFlag: Option.some("/flag/workdir"), cwd: tempRoot })),
+    ),
+  );
+
   it.effect("walks up from CWD looking for supabase/config.toml", () => {
     const projectRoot = join(tempRoot, "project");
     const nested = join(projectRoot, "deep", "child");
diff --git a/apps/cli/src/legacy/config/legacy-cli-config.service.ts b/apps/cli/src/legacy/config/legacy-cli-config.service.ts
index 3bef2e2a1c..432d3d267a 100644
--- a/apps/cli/src/legacy/config/legacy-cli-config.service.ts
+++ b/apps/cli/src/legacy/config/legacy-cli-config.service.ts
@@ -29,6 +29,14 @@ interface LegacyCliConfigShape {
    * db-config resolver's MITM domain check.
    */
   readonly poolerHost: string;
+  /**
+   * Dashboard base URL for the active profile (Go's `Profile.DashboardURL`,
+   * `apps/cli-go/internal/utils/profile.go:20`). Sourced from the resolved profile —
+   * the built-in table for named profiles, or the `dashboard_url:` key of a YAML
+   * profile file — so staging/custom dashboards are honored. Used by the
+   * connect-failure suggestion (Go's `SetConnectSuggestion` network-restrictions hint).
+   */
+  readonly dashboardUrl: string;
   readonly accessToken: Option.Option<Redacted.Redacted<string>>;
   readonly projectId: Option.Option<string>;
   readonly workdir: string;
diff --git a/apps/cli/src/legacy/config/legacy-project-ref.layer.unit.test.ts b/apps/cli/src/legacy/config/legacy-project-ref.layer.unit.test.ts
index 3990163113..04b64ff06b 100644
--- a/apps/cli/src/legacy/config/legacy-project-ref.layer.unit.test.ts
+++ b/apps/cli/src/legacy/config/legacy-project-ref.layer.unit.test.ts
@@ -24,6 +24,7 @@ function mockCliConfig(opts: { workdir: string; projectId?: string }) {
     apiUrl: "https://api.supabase.com",
     projectHost: "supabase.co",
     poolerHost: "supabase.com",
+    dashboardUrl: "https://supabase.com/dashboard",
     accessToken: Option.none(),
     projectId: opts.projectId === undefined ? Option.none() : Option.some(opts.projectId),
     workdir: opts.workdir,
diff --git a/apps/cli/src/legacy/config/legacy-project-ref.service.ts b/apps/cli/src/legacy/config/legacy-project-ref.service.ts
index 5c5e74f94b..f54579c331 100644
--- a/apps/cli/src/legacy/config/legacy-project-ref.service.ts
+++ b/apps/cli/src/legacy/config/legacy-project-ref.service.ts
@@ -41,9 +41,14 @@ interface LegacyProjectRefResolverShape {
    * `projects list` (`list.go:31-33`), which ignores `ErrNotLinked` and only
    * uses the value as a "linked" marker. Returns `None` when nothing resolves.
    *
-   * Unlike `resolve`, the returned value is **not** format-validated — Go's
-   * soft load also skips validation here, and the value is only used as a
-   * display marker, never injected into an API path.
+   * Unlike `resolve`, the returned value is **not** format-validated. Note this
+   * is a caller-side simplification, not a Go behavior match: Go's
+   * `LoadProjectRef` still validates and warns to stderr on a malformed ref
+   * (see `services`'s equivalent handling, CLI-1872), it just doesn't fail the
+   * command. `resolveOptional` skips the warning too, which is safe only
+   * because every current caller uses the value purely as a display marker,
+   * never injected into an API path — a caller that needs the Go-parity
+   * warning should validate and warn itself rather than assume this does it.
    */
   readonly resolveOptional: (
     flagValue: Option.Option<string>,
diff --git a/apps/cli/src/legacy/shared/legacy-api-url.ts b/apps/cli/src/legacy/shared/legacy-api-url.ts
new file mode 100644
index 0000000000..b5508eca37
--- /dev/null
+++ b/apps/cli/src/legacy/shared/legacy-api-url.ts
@@ -0,0 +1,53 @@
+import { legacyGoUrlParse } from "./legacy-storage-url.ts";
+
+/**
+ * Local API URL derivation, mirroring Go's `config.go:634-644` + `misc.go:298`:
+ * an explicit `api.external_url` wins, otherwise `<scheme>://<host>:<port>`
+ * where the scheme follows `api.tls.enabled` and the port is `api.port`.
+ * Hoisted here because `legacy-storage-credentials.ts` and
+ * `legacy-local-config-values.ts` both need this exact computation.
+ */
+export function legacyResolveApiExternalUrl(
+  config: {
+    readonly external_url?: string;
+    readonly port: number;
+    readonly tls: { readonly enabled: boolean };
+  },
+  hostname: string,
+): string {
+  if (config.external_url !== undefined && config.external_url.length > 0) {
+    return config.external_url;
+  }
+  const scheme = config.tls.enabled ? "https" : "http";
+  // Go builds host:port with net.JoinHostPort (config.go:636-638), bracketing an
+  // IPv6 host.
+  const hostPort = hostname.includes(":")
+    ? `[${hostname}]:${config.port}`
+    : `${hostname}:${config.port}`;
+  return `${scheme}://${hostPort}`;
+}
+
+/**
+ * Go's `Config.Validate` rewrite of `Studio.ApiUrl` (`pkg/config/config.go:1074-1078`):
+ * ```go
+ * } else if parsed.Host == "" || parsed.Host == c.Hostname {
+ *     c.Studio.ApiUrl = c.Api.ExternalUrl
+ * }
+ * ```
+ * Runs as the last step of `Config.Load` (`config.go:882`), so by the time
+ * `start` builds Studio's env, `studio.api_url` has already been rewritten to
+ * the resolved API external URL (the Kong URL) whenever its host is empty
+ * (a relative/schemeless value) or matches the bare local hostname exactly
+ * (no port) — which is the default-config case, since `studio.api_url`
+ * defaults to `http://127.0.0.1` and `Hostname` defaults to the same
+ * `"127.0.0.1"`. An explicit, non-matching host (e.g. a custom domain, or a
+ * host:port pair) is left untouched.
+ */
+export function legacyResolveStudioApiUrl(
+  rawApiUrl: string,
+  hostname: string,
+  apiExternalUrl: string,
+): string {
+  const { host } = legacyGoUrlParse(rawApiUrl);
+  return host === "" || host === hostname ? apiExternalUrl : rawApiUrl;
+}
diff --git a/apps/cli/src/legacy/shared/legacy-api-url.unit.test.ts b/apps/cli/src/legacy/shared/legacy-api-url.unit.test.ts
new file mode 100644
index 0000000000..7b0f836ee0
--- /dev/null
+++ b/apps/cli/src/legacy/shared/legacy-api-url.unit.test.ts
@@ -0,0 +1,40 @@
+import { describe, expect, it } from "vitest";
+
+import { legacyResolveStudioApiUrl } from "./legacy-api-url.ts";
+
+describe("legacyResolveStudioApiUrl", () => {
+  // Go's `Config.Validate` (`pkg/config/config.go:1074-1078`): a default
+  // `studio.api_url` (`http://127.0.0.1`) has host `127.0.0.1`, matching the
+  // default hostname, so it's rewritten to the resolved API external URL.
+  it("rewrites the default studio.api_url to the API external URL", () => {
+    expect(
+      legacyResolveStudioApiUrl("http://127.0.0.1", "127.0.0.1", "http://127.0.0.1:54321"),
+    ).toBe("http://127.0.0.1:54321");
+  });
+
+  it("rewrites a schemeless/empty-host value to the API external URL", () => {
+    expect(legacyResolveStudioApiUrl("", "127.0.0.1", "http://127.0.0.1:54321")).toBe(
+      "http://127.0.0.1:54321",
+    );
+  });
+
+  it("leaves an explicit external host untouched", () => {
+    expect(
+      legacyResolveStudioApiUrl("https://api.example.com", "127.0.0.1", "http://127.0.0.1:54321"),
+    ).toBe("https://api.example.com");
+  });
+
+  it("leaves a value with the matching host but an explicit port untouched", () => {
+    // Go's `parsed.Host` includes the port when one is present, so `127.0.0.1:3000`
+    // does not equal the bare `Hostname` `127.0.0.1` and is not rewritten.
+    expect(
+      legacyResolveStudioApiUrl("http://127.0.0.1:3000", "127.0.0.1", "http://127.0.0.1:54321"),
+    ).toBe("http://127.0.0.1:3000");
+  });
+
+  it("rewrites when the host matches a non-default configured hostname", () => {
+    expect(legacyResolveStudioApiUrl("http://my-host", "my-host", "http://my-host:54321")).toBe(
+      "http://my-host:54321",
+    );
+  });
+});
diff --git a/apps/cli/src/legacy/shared/legacy-bitbucket-pipeline.ts b/apps/cli/src/legacy/shared/legacy-bitbucket-pipeline.ts
new file mode 100644
index 0000000000..3fcdcc96bd
--- /dev/null
+++ b/apps/cli/src/legacy/shared/legacy-bitbucket-pipeline.ts
@@ -0,0 +1,17 @@
+/**
+ * Whether the current process is running inside a Bitbucket Pipelines runner,
+ * mirroring Go's `os.Getenv("BITBUCKET_CLONE_DIR") != ""` check
+ * (`apps/cli-go/internal/utils/docker.go:401`). Bitbucket's Docker-in-Docker
+ * runner disallows named volumes and `--security-opt`
+ * (https://support.atlassian.com/bitbucket-cloud/docs/run-docker-commands-in-bitbucket-pipelines/#Full-list-of-restricted-commands),
+ * so every container-runtime call site that creates volumes or sets security
+ * options needs this same check.
+ *
+ * Hoisted here because it is needed by ≥2 call sites: `legacy-docker-run.layer.ts`
+ * (`docker run`, e.g. `db dump`/`db test`) and `start`'s per-service container
+ * creation (`commands/start/lib/container-lifecycle.ts`).
+ */
+export function legacyIsBitbucketPipeline(): boolean {
+  const value = globalThis.process.env["BITBUCKET_CLONE_DIR"];
+  return value !== undefined && value.length > 0;
+}
diff --git a/apps/cli/src/legacy/shared/legacy-colors.ts b/apps/cli/src/legacy/shared/legacy-colors.ts
index c41cfae7d4..25d32d7c42 100644
--- a/apps/cli/src/legacy/shared/legacy-colors.ts
+++ b/apps/cli/src/legacy/shared/legacy-colors.ts
@@ -6,27 +6,38 @@ import { styleText } from "node:util";
  * Go uses lipgloss, which auto-detects the output profile and renders **plain**
  * text when the stream is not a TTY (piped output, CI, tests). `styleText`
  * mirrors that: with `validateStream` (the default) it checks the target stream
- * and `NO_COLOR`, returning the unstyled string when colour is unsupported. We
- * point it at `process.stderr` because the bootstrap progress / suggestion lines
- * these style are written to stderr.
+ * and `NO_COLOR`, returning the unstyled string when colour is unsupported.
+ *
+ * `stream` defaults to `process.stderr` because every original call site styles
+ * progress/suggestion lines written to stderr. A caller styling content that is
+ * itself written to **stdout** (e.g. `status`'s pretty table) must pass
+ * `process.stdout` explicitly — otherwise the TTY check runs against the wrong
+ * stream, and piping stdout while stderr stays a TTY (`supabase status | less`)
+ * would corrupt the piped output with ANSI escapes (the same bug class CLI-1546
+ * fixed for the progress spinner).
  *
  * lipgloss colour "14" is bright cyan; `"cyan"` is the closest faithful match,
  * matching `branches.prompt.ts`'s existing port of `utils.Aqua`.
  */
-export function legacyAqua(text: string): string {
-  return styleText("cyan", text, { stream: process.stderr });
+export function legacyAqua(text: string, stream: NodeJS.WriteStream = process.stderr): string {
+  return styleText("cyan", text, { stream });
 }
 
-export function legacyBold(text: string): string {
-  return styleText("bold", text, { stream: process.stderr });
+export function legacyBold(text: string, stream: NodeJS.WriteStream = process.stderr): string {
+  return styleText("bold", text, { stream });
 }
 
 /** Port of Go's `utils.Yellow` — lipgloss colour "11" (bright yellow). */
-export function legacyYellow(text: string): string {
-  return styleText("yellow", text, { stream: process.stderr });
+export function legacyYellow(text: string, stream: NodeJS.WriteStream = process.stderr): string {
+  return styleText("yellow", text, { stream });
 }
 
 /** Port of Go's `utils.Red` — lipgloss colour "9" (bright red). */
-export function legacyRed(text: string): string {
-  return styleText("red", text, { stream: process.stderr });
+export function legacyRed(text: string, stream: NodeJS.WriteStream = process.stderr): string {
+  return styleText("red", text, { stream });
+}
+
+/** Port of Go's `utils.Green` — lipgloss colour "10" (bright green). */
+export function legacyGreen(text: string, stream: NodeJS.WriteStream = process.stderr): string {
+  return styleText("green", text, { stream });
 }
diff --git a/apps/cli/src/legacy/shared/legacy-colors.unit.test.ts b/apps/cli/src/legacy/shared/legacy-colors.unit.test.ts
new file mode 100644
index 0000000000..e1f5e7873b
--- /dev/null
+++ b/apps/cli/src/legacy/shared/legacy-colors.unit.test.ts
@@ -0,0 +1,50 @@
+import { describe, expect, it } from "vitest";
+
+import { legacyAqua, legacyBold, legacyGreen, legacyRed, legacyYellow } from "./legacy-colors.ts";
+
+// These tests only assert that each helper runs without throwing and returns a
+// string containing the input text — actual color application depends on the
+// stream's live TTY/NO_COLOR state, which isn't controllable from a test
+// process. The behavior worth protecting here is the `stream` parameter
+// threading through to `styleText`, not a specific ANSI byte sequence.
+describe("legacy-colors", () => {
+  it("legacyAqua defaults to stderr when no stream is given", () => {
+    expect(legacyAqua("supabase")).toContain("supabase");
+  });
+
+  it("legacyAqua accepts an explicit stream", () => {
+    expect(legacyAqua("supabase", process.stdout)).toContain("supabase");
+  });
+
+  it("legacyBold defaults to stderr when no stream is given", () => {
+    expect(legacyBold("text")).toContain("text");
+  });
+
+  it("legacyBold accepts an explicit stream", () => {
+    expect(legacyBold("text", process.stdout)).toContain("text");
+  });
+
+  it("legacyYellow defaults to stderr when no stream is given", () => {
+    expect(legacyYellow("warning")).toContain("warning");
+  });
+
+  it("legacyYellow accepts an explicit stream", () => {
+    expect(legacyYellow("warning", process.stdout)).toContain("warning");
+  });
+
+  it("legacyRed defaults to stderr when no stream is given", () => {
+    expect(legacyRed("error")).toContain("error");
+  });
+
+  it("legacyRed accepts an explicit stream", () => {
+    expect(legacyRed("error", process.stdout)).toContain("error");
+  });
+
+  it("legacyGreen defaults to stderr when no stream is given", () => {
+    expect(legacyGreen("label")).toContain("label");
+  });
+
+  it("legacyGreen accepts an explicit stream", () => {
+    expect(legacyGreen("label", process.stdout)).toContain("label");
+  });
+});
diff --git a/apps/cli/src/legacy/shared/legacy-config-validate.parity.unit.test.ts b/apps/cli/src/legacy/shared/legacy-config-validate.parity.unit.test.ts
new file mode 100644
index 0000000000..d62db6a815
--- /dev/null
+++ b/apps/cli/src/legacy/shared/legacy-config-validate.parity.unit.test.ts
@@ -0,0 +1,266 @@
+import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { BunServices } from "@effect/platform-bun";
+import { describe, expect, it } from "@effect/vitest";
+import { ProjectConfigSchema, type ProjectConfig } from "@supabase/config";
+import { Effect, Exit, FileSystem, Path, Schema } from "effect";
+
+import { legacyReadDbToml } from "./legacy-db-config.toml-read.ts";
+import { legacyResolveLocalConfigValues } from "./legacy-local-config-values.ts";
+
+/**
+ * Cross-caller parity coverage: for a table of Go-parity misconfigurations, drives BOTH real
+ * pipelines — D (`legacyReadDbToml`, Effect/raw-TOML) and L (`legacyResolveLocalConfigValues`,
+ * `@supabase/config`-decoded) — and asserts they fail with the SAME shared error-message
+ * substring, since both now route through the single `legacyValidateResolvedConfig`. The two
+ * pipelines don't need byte-identical exception wrapping, just the same core Go-parity message
+ * text (`.toContain(...)` on both sides with the same expected string).
+ *
+ * D's harness replicates the `withConfig`/`read`/`failsWith` pattern from
+ * `legacy-db-config.toml-read.unit.test.ts` (file-local there, not exported — faithfully
+ * reproduced here rather than imported). L's harness replicates the `baseConfig`/`WORKDIR`
+ * pattern from `legacy-local-config-values.unit.test.ts` (same reasoning).
+ */
+
+function withConfig(content: string) {
+  const dir = mkdtempSync(join(tmpdir(), "legacy-config-validate-parity-"));
+  mkdirSync(join(dir, "supabase"), { recursive: true });
+  writeFileSync(join(dir, "supabase", "config.toml"), content);
+  return dir;
+}
+
+const readD = (workdir: string) =>
+  Effect.gen(function* () {
+    const fs = yield* FileSystem.FileSystem;
+    const path = yield* Path.Path;
+    return yield* legacyReadDbToml(fs, path, workdir);
+  }).pipe(Effect.provide(BunServices.layer));
+
+/** Drives D's real pipeline and asserts the failure message contains `message`. */
+function failsWithD(tomlLines: ReadonlyArray<string>, message: string) {
+  return Effect.gen(function* () {
+    const dir = withConfig(tomlLines.join("\n"));
+    const exit = yield* readD(dir).pipe(Effect.exit);
+    expect(Exit.isFailure(exit), `D: expected failure containing: ${message}`).toBe(true);
+    if (Exit.isFailure(exit)) {
+      expect(JSON.stringify(exit.cause)).toContain(message);
+    }
+    rmSync(dir, { recursive: true, force: true });
+  });
+}
+
+const decodeConfig = Schema.decodeUnknownSync(ProjectConfigSchema);
+const WORKDIR = "/tmp/legacy-config-validate-parity-test";
+
+function baseConfig(overrides: Record<string, unknown> = {}): ProjectConfig {
+  return decodeConfig({ project_id: "test", ...overrides });
+}
+
+/** Drives L's real pipeline and asserts the failure message contains `message`. */
+function failsWithL(
+  overrides: Record<string, unknown>,
+  message: string,
+  document?: Readonly<Record<string, unknown>>,
+) {
+  const config = baseConfig(overrides);
+  expect(() =>
+    legacyResolveLocalConfigValues(config, "127.0.0.1", WORKDIR, undefined, document),
+  ).toThrow(message);
+}
+
+interface ParityScenario {
+  readonly name: string;
+  readonly toml: ReadonlyArray<string>;
+  readonly overrides: Record<string, unknown>;
+  readonly document?: Readonly<Record<string, unknown>>;
+  readonly message: string;
+}
+
+const scenarios: ReadonlyArray<ParityScenario> = [
+  {
+    name: "db.port = 0",
+    toml: ["[db]", "port = 0"],
+    overrides: { db: { port: 0 } },
+    message: "Missing required field in config: db.port",
+  },
+  {
+    name: "db.major_version = 0",
+    toml: ["[db]", "major_version = 0"],
+    overrides: { db: { major_version: 0 } },
+    message: "Missing required field in config: db.major_version",
+  },
+  {
+    name: "db.major_version unsupported (16)",
+    toml: ["[db]", "major_version = 16"],
+    overrides: { db: { major_version: 16 } },
+    message: "Failed reading config: Invalid db.major_version: 16.",
+  },
+  {
+    name: "storage bucket name with an invalid pattern",
+    toml: ['[storage.buckets."bad#name"]'],
+    overrides: { storage: { buckets: { "bad#name": {} } } },
+    message:
+      "Invalid Bucket name: bad#name. Only lowercase letters, numbers, dots, hyphens, and spaces are allowed.",
+  },
+  {
+    name: "function slug with an invalid pattern",
+    toml: ["[functions.123]"],
+    overrides: { functions: { "123": {} } },
+    message:
+      "Invalid Function name: 123. Must start with at least one letter, and only include alphanumeric characters, underscores, and hyphens.",
+  },
+  {
+    name: "edge_runtime.deno_version = 0",
+    toml: ["[edge_runtime]", "deno_version = 0"],
+    overrides: { edge_runtime: { deno_version: 0 } },
+    message: "Missing required field in config: edge_runtime.deno_version",
+  },
+  {
+    name: "edge_runtime.deno_version unsupported (3)",
+    toml: ["[edge_runtime]", "deno_version = 3"],
+    overrides: { edge_runtime: { deno_version: 3 } },
+    message: "Failed reading config: Invalid edge_runtime.deno_version: 3.",
+  },
+  {
+    name: "auth.site_url empty with auth enabled",
+    toml: ["[auth]", "enabled = true", 'site_url = ""'],
+    overrides: { auth: { enabled: true, site_url: "" } },
+    message: "Missing required field in config: auth.site_url",
+  },
+  {
+    name: "auth.captcha enabled without a provider",
+    toml: ["[auth.captcha]", "enabled = true"],
+    overrides: {
+      auth: {
+        enabled: true,
+        site_url: "http://localhost:3000",
+        captcha: { enabled: true },
+      },
+    },
+    message: "Missing required field in config: auth.captcha.provider",
+  },
+  {
+    name: "auth.captcha enabled with a provider but no secret",
+    toml: ["[auth.captcha]", "enabled = true", 'provider = "hcaptcha"'],
+    overrides: {
+      auth: {
+        enabled: true,
+        site_url: "http://localhost:3000",
+        captcha: { enabled: true, provider: "hcaptcha" },
+      },
+    },
+    message: "Missing required field in config: auth.captcha.secret",
+  },
+  {
+    name: "auth.hook.* with a badly-formatted secret",
+    toml: [
+      "[auth.hook.custom_access_token]",
+      "enabled = true",
+      'uri = "https://example.test/hook"',
+      'secrets = "not-a-valid-secret"',
+    ],
+    overrides: {
+      auth: {
+        enabled: true,
+        site_url: "http://localhost:3000",
+        hook: {
+          custom_access_token: {
+            enabled: true,
+            uri: "https://example.test/hook",
+            secrets: "not-a-valid-secret",
+          },
+        },
+      },
+    },
+    // D's assertion goes through `JSON.stringify(exit.cause)`, which backslash-escapes the
+    // message's embedded double quotes — trim the substring to the quote-free prefix, same
+    // convention D's own suite uses for this message.
+    message: "auth.hook.custom_access_token.secrets must be formatted as",
+  },
+  {
+    name: "auth.mfa.* enroll_enabled without verify_enabled",
+    toml: ["[auth.mfa.totp]", "enroll_enabled = true", "verify_enabled = false"],
+    overrides: {
+      auth: {
+        enabled: true,
+        site_url: "http://localhost:3000",
+        mfa: { totp: { enroll_enabled: true, verify_enabled: false } },
+      },
+    },
+    message: "Invalid MFA config: auth.mfa.totp.enroll_enabled requires verify_enabled",
+  },
+  {
+    name: "auth.third_party.* enabled without its required field",
+    toml: ["[auth.third_party.firebase]", "enabled = true"],
+    overrides: {
+      auth: {
+        enabled: true,
+        site_url: "http://localhost:3000",
+        third_party: { firebase: { enabled: true } },
+      },
+    },
+    message: "Invalid config: auth.third_party.firebase is enabled but without a project_id.",
+  },
+  {
+    name: "auth.third_party.* more than one provider enabled",
+    toml: [
+      "[auth.third_party.firebase]",
+      "enabled = true",
+      'project_id = "proj"',
+      "[auth.third_party.auth0]",
+      "enabled = true",
+      'tenant = "tenant"',
+    ],
+    overrides: {
+      auth: {
+        enabled: true,
+        site_url: "http://localhost:3000",
+        third_party: {
+          firebase: { enabled: true, project_id: "proj" },
+          auth0: { enabled: true, tenant: "tenant" },
+        },
+      },
+    },
+    message: "Invalid config: Only one third_party provider allowed to be enabled at a time.",
+  },
+  {
+    name: "auth.email.smtp present table missing a required field",
+    // Both pipelines read every smtp field straight off the raw TOML/document rather than a
+    // schema-decoded, always-defaulted value (Go's presence-based `enabled` default,
+    // config.go:743-748) — L needs the raw `document` (5th param) for this, matching D's raw
+    // smol-toml document.
+    toml: ["[auth.email.smtp]", 'user = "u"'],
+    overrides: { auth: { enabled: true, site_url: "http://localhost:3000" } },
+    document: { auth: { email: { smtp: { user: "u" } } } },
+    message: "Missing required field in config: auth.email.smtp.host",
+  },
+  {
+    name: "experimental.pgdelta.format_options invalid JSON",
+    toml: ["[experimental.pgdelta]", 'format_options = "{not json"'],
+    overrides: { experimental: { pgdelta: { format_options: "{not json" } } },
+    message: "Invalid config for experimental.pgdelta.format_options: must be valid JSON",
+  },
+];
+
+// Explicitly SKIPPED (only one caller runs the branch, or the branch isn't exercised the same
+// way by both — see the module header in `legacy-config-validate.ts` for the full explicitly
+// out-of-scope list):
+// - `remotes[*].project_id`, `auth.sms`, `auth.external` — D-only, never part of the shared
+//   validator (`LegacyConfigValidationInput` has no fields for these at all).
+// - `api.tls`, `project_id`, `studio`, `local_smtp` — L-only, D has no equivalent sections.
+// - `experimental.webhooks` — L reads webhooks presence from a raw `document` that D's
+//   `legacyReadDbToml` doesn't thread through `legacyValidateResolvedConfig` at all (D has no
+//   `experimental` presence-based input field for this — verified: `legacy-db-config.toml-read.ts`
+//   never sets `experimental.webhooksPresent`/`webhooksEnabled` on its `LegacyExperimentalInput`),
+//   so this branch is D-unreachable and skipped here too.
+describe("legacyValidateResolvedConfig cross-caller parity (D vs L)", () => {
+  for (const scenario of scenarios) {
+    it.effect(`${scenario.name}: D and L fail with the same message`, () =>
+      Effect.gen(function* () {
+        yield* failsWithD(scenario.toml, scenario.message);
+        failsWithL(scenario.overrides, scenario.message, scenario.document);
+      }),
+    );
+  }
+});
diff --git a/apps/cli/src/legacy/shared/legacy-config-validate.ts b/apps/cli/src/legacy/shared/legacy-config-validate.ts
new file mode 100644
index 0000000000..4fbc5f5be1
--- /dev/null
+++ b/apps/cli/src/legacy/shared/legacy-config-validate.ts
@@ -0,0 +1,778 @@
+import { isAbsolute, join } from "node:path";
+
+import { legacyGoUrlParse } from "./legacy-storage-url.ts";
+
+/**
+ * Single home for Go's `Config.Validate` parity (`apps/cli-go/pkg/config/config.go:989-1192`),
+ * consolidating the two independent TypeScript ports of that logic:
+ *
+ * - **D** = `legacy-db-config.toml-read.ts` — raw smol-toml document + `EnvLookup`,
+ *   Effect-based, fails with `LegacyDbConfigLoadError`. Feeds ~15 db/migration commands via
+ *   `legacy-db-config.layer.ts`.
+ * - **L** = `legacy-local-config-values.ts` — decoded `@supabase/config` `ProjectConfig`,
+ *   synchronous `node:fs`, throws plain `Error`. Feeds `legacy-status-values.ts` and
+ *   `stop/stop.handler.ts`.
+ *
+ * **This file is the SINGLE home for `Config.Validate` parity going forward.
+ * Per-command reimplementations of any branch below are forbidden** — hoist here instead,
+ * per `apps/cli/AGENTS.md`'s "Hoist Before You Duplicate" policy.
+ *
+ * ## Status of this commit
+ *
+ * {@link legacyValidateResolvedConfig} is now IMPLEMENTED and fully wired into BOTH callers: L
+ * (`legacy-local-config-values.ts`'s `legacyResolveLocalConfigValues`) and D
+ * (`legacy-db-config.toml-read.ts`'s `legacyReadDbToml`) each build a
+ * {@link LegacyConfigValidationInput} from their own decoded config (a `ProjectConfig` + raw
+ * `document` for L, a raw smol-toml document + `EnvLookup` for D) and call this function once,
+ * at the correct Go position. Wiring D through this module also fixed D's `db.major_version
+ * === 0` divergence (D used to fall through to the generic invalid-value message; it now
+ * throws the same "Missing required field in config: db.major_version" as Go and as L already
+ * did).
+ *
+ * ## Full eventual scope: every `Config.Validate` branch this module owns
+ *
+ * In Go's exact `Validate()` order (`config.go:989-1192`), first-failure-wins:
+ *
+ * | Go line(s)                    | Check |
+ * |--------------------------------|-------|
+ * | 990-991                        | `project_id` required |
+ * | 1006-1027                      | `api.port` / `api.tls.{cert,key}_path` presence (the actual file reads stay per-caller I/O) |
+ * | 1031-1062                      | `db.port`, `db.major_version` (0 / 12 / 13-17 switch) |
+ * | 1064-1068, pattern @ 1549-1554 | `storage.buckets.*` names vs `LEGACY_BUCKET_NAME_PATTERN` |
+ * | 1070-1079                      | `studio.port` / `studio.api_url` (L-only — D has no studio section) |
+ * | 1081-1085                      | `local_smtp.port` (L-only) |
+ * | 1087-1153                      | `auth.*` sub-sequence, in order: site_url (1088-1090); captcha enum + presence (1099-1109, enum itself decode-time per `auth.go:58-71`); signing_keys read (1110-1116, caller-side I/O); passkey/webauthn (1117-1134); hooks (1136-1138, checks @ 1453-1521, vs `LEGACY_HOOK_SECRET_PATTERN`); mfa (1139-1141, checks @ 1523-1534); email template/notification content-vs-content_path (1293-1323, caller-side I/O) + smtp (1325-1344); third_party (1151-1153, checks @ 1635-1683, vs `LEGACY_CLERK_DOMAIN_PATTERN`) |
+ * | 1159-1163, pattern @ 1539-1544 | `functions.*` slugs vs `LEGACY_FUNCTION_SLUG_PATTERN` |
+ * | 1164-1173                      | `edge_runtime.deno_version` (0 / 1 / 2 switch) |
+ * | (decode-time enum)             | `analytics.backend` must be `postgres`/`bigquery` |
+ * | 1175-1187                      | `analytics.gcp_*` fields, gated on `backend === "bigquery"` |
+ * | 1846-1854                      | `experimental.webhooks` / `experimental.pgdelta.format_options` |
+ *
+ * ## Explicitly OUT of scope forever (D-only, NEVER part of this module)
+ *
+ * - `remotes[*].project_id` pattern (`config.go:997-1001`, vs `LEGACY_PROJECT_REF_PATTERN`) —
+ *   D's own remote-merge-phase check (`findInvalidRemoteProjectId`), never shared with L.
+ * - `auth.sms` (`config.go:1145-1147`/`1348-1417`) — stays 100% inline in D; L instead relies on
+ *   `@supabase/config`'s `sms` schema enforcing the same provider-switch priority at decode time
+ *   (`packages/config/src/auth/sms.ts`), since L decodes through that schema and D doesn't.
+ * - `auth.external` (`config.go:1148-1150`/`1419-1451`) — inline in BOTH D
+ *   (`legacy-db-config.toml-read.ts`'s "B5: external providers") and L
+ *   ({@link legacyResolveLocalConfigValues}'s `validateAuthExternalProviders`, called after this
+ *   module's shared check, same ordering tradeoff as sms below) — never routed through this
+ *   shared module, since it needs the RAW pre-decode document to see provider names
+ *   `@supabase/config`'s schema doesn't model.
+ * - `auth.jwt_secret` length check (`apikeys.go:43-73`, `generateAPIKeys`) — each caller's own
+ *   key-generation flow (D and L both already implement this separately), not part of
+ *   `Config.Validate`'s pure-check set.
+ *
+ * `legacyExpandEnv` also stays in D (env-substitution machinery, not a validation leaf).
+ *
+ * ## Known ordering tradeoff (accepted — do not "fix")
+ *
+ * Go's real auth-block order is site_url → captcha → signing_keys[IO] → passkey → hooks → mfa →
+ * email[IO]+smtp → **sms → external** → third_party. Since sms/external are D-only and never
+ * part of this module, but third_party IS shared, D cannot call
+ * {@link legacyValidateResolvedConfig} in a way that preserves relative ordering across the
+ * sms/external ↔ third_party boundary without complex multi-phase calls. Decision (applies once
+ * D is wired up in a follow-up commit): D calls {@link legacyValidateResolvedConfig} ONCE with
+ * the full input (including third_party), positioned after D's own signing-keys and
+ * email-template I/O reads; D's inline sms/external checks then run AFTER that single call
+ * succeeds. This means: if third_party is broken, its error surfaces (matching Go); D's
+ * sms/external checks never run in that case. The only real behavior change from today: for the
+ * (untested, unrealistic) case where sms/external AND third_party are BOTH simultaneously
+ * broken in the same config.toml, Go/today's-D would report the sms/external error first, but
+ * the refactored D reports third_party's error first, since third_party is checked inside the
+ * single earlier shared call. This is an accepted, narrow, documented parity gap.
+ *
+ * The same category of tradeoff now also applies to L: `legacyResolveLocalConfigValues` calls
+ * {@link legacyValidateResolvedConfig} exactly ONCE, at the very end, after every value this
+ * module needs has been derived — including L's 3 I/O reads (signing keys, `api.tls` cert/key,
+ * email template/notification content), which stay at their original textual position (per-caller
+ * I/O, same as D's). Every pure check this module owns is therefore checked in Go's exact
+ * relative order against every OTHER pure check, but an I/O read that in L's source sits
+ * between two pure sections (e.g. the signing-keys read sits between the captcha check and the
+ * passkey/hooks/mfa/email/smtp/third_party checks) now effectively runs BEFORE any of those
+ * later pure checks, rather than interleaved at its original relative position — the same
+ * narrow, accepted, documented tradeoff, not something to "fix" by splitting this function into
+ * multiple calls. Every existing test constructs exactly one validation failure at a time, so
+ * this has zero effect on any real test.
+ */
+
+// Go's project-ref pattern (`apps/cli-go/pkg/config/config.go:470`): exactly 20 lowercase
+// ASCII letters. Exported from this module (was private in D before this relocation) as the
+// canonical home; D's `findInvalidRemoteProjectId` is today the only consumer — the
+// `remotes[*].project_id` check itself stays D-only forever, see the module header above.
+export const LEGACY_PROJECT_REF_PATTERN = /^[a-z]{20}$/;
+
+// Go's storage bucket-name pattern (`apps/cli-go/pkg/config/config.go:1382`).
+// `config.Validate` runs `ValidateBucketName` over every `[storage.buckets.*]` key
+// during config load (`config.go:898-903`), aborting before any db command when a
+// name does not match. The source string is reused verbatim in the error message via
+// `.source` so it byte-matches Go's `bucketNamePattern.String()`. Used by both D
+// (`legacy-db-config.toml-read.ts`) and L (`legacy-local-config-values.ts`), and internally by
+// {@link legacyValidateResolvedConfig}'s storage-bucket-names step (`config.go:1064-1068`).
+export const LEGACY_BUCKET_NAME_PATTERN = /^(\w|!|-|\.|\*|'|\(|\)| |&|\$|@|=|;|:|\+|,|\?)*$/;
+
+// Go's function-slug pattern (`apps/cli-go/pkg/config/config.go:1372`). `config.Validate`
+// runs `ValidateFunctionSlug` over every `[functions.*]` key during config load
+// (`config.go:993-998`), rejecting the config before any db command. `.source` is reused
+// in the message so it byte-matches Go's `funcSlugPattern.String()`. Used by both D and L
+// (same reason as {@link LEGACY_BUCKET_NAME_PATTERN} above), and internally by
+// {@link legacyValidateResolvedConfig}'s function-slugs step (`config.go:1159-1163`).
+export const LEGACY_FUNCTION_SLUG_PATTERN = /^[A-Za-z][A-Za-z0-9_-]*$/;
+
+// Go's `hookSecretPattern` (`apps/cli-go/pkg/config/config.go:1436`). Used by both D and L
+// (same reason as {@link LEGACY_BUCKET_NAME_PATTERN} above), and internally by
+// {@link legacyValidateResolvedConfig}'s hooks step (`config.go:1453-1521`).
+export const LEGACY_HOOK_SECRET_PATTERN = /^v1,whsec_[A-Za-z0-9+/=]{32,88}$/u;
+
+// Go's `clerkDomainPattern` (`apps/cli-go/pkg/config/config.go:1553`). Used by both D and L
+// (same reason as {@link LEGACY_BUCKET_NAME_PATTERN} above), and internally by
+// {@link legacyValidateResolvedConfig}'s third_party step (`config.go:1635-1683`).
+export const LEGACY_CLERK_DOMAIN_PATTERN =
+  /^(clerk([.][a-z0-9-]+){2,}|([a-z0-9-]+[.])+clerk[.]accounts[.]dev)$/u;
+
+// Go's `strconv.ParseBool` accepted forms (`go-viper/mapstructure` `decodeBool` under
+// viper's forced `WeaklyTypedInput`): a string decodes to bool via ParseBool, an empty
+// string is `false`, and any other value is a parse error.
+const GO_BOOL_TRUE = new Set(["1", "t", "T", "TRUE", "true", "True"]);
+const GO_BOOL_FALSE = new Set(["0", "f", "F", "FALSE", "false", "False", ""]);
+
+/**
+ * Parse a config bool the way Go does (`strconv.ParseBool` via mapstructure's weakly
+ * typed decode). Returns the bool, or `undefined` for a malformed value (which Go
+ * surfaces as a `failed to parse config` error).
+ *
+ * Used by both D (`legacy-db-config.toml-read.ts`'s `resolveBool`/`resolveBoolOrFail`) and
+ * L (`legacy-local-config-values.ts`'s `legacyEnvOverrideBool`) for their `SUPABASE_*`
+ * bool-flavored env overrides and TOML bool decoding.
+ */
+export function legacyParseGoBool(value: string): boolean | undefined {
+  if (GO_BOOL_TRUE.has(value)) return true;
+  if (GO_BOOL_FALSE.has(value)) return false;
+  return undefined;
+}
+
+/**
+ * Thrown by {@link legacyValidateResolvedConfig}. Deliberately does NOT override `.name` in a
+ * constructor — it stays the inherited `"Error"` — so `.toString()`/`.name`/`instanceof Error`
+ * checks are indistinguishable from a plain `new Error(message)`. Both D and L's existing
+ * callers/tests observe only `.message` (via `cause instanceof Error ? cause.message : ...` or
+ * `.toThrow("substring")`), so swapping their inline `throw new Error(...)` calls for this class
+ * is a byte-identical, purely internal refactor.
+ */
+export class LegacyConfigValidateError extends Error {}
+
+/** One `[api.tls]` section, post-env-override. See {@link LegacyConfigValidationInput}. */
+export interface LegacyApiInput {
+  readonly enabled: boolean;
+  readonly port: number;
+  readonly tls: {
+    readonly enabled: boolean;
+    readonly certPath: string | undefined;
+    readonly keyPath: string | undefined;
+  };
+}
+
+/** `[db]`, post-env-override. Required — Go validates `db.port`/`db.major_version` unconditionally. */
+export interface LegacyDbInput {
+  readonly port: number;
+  readonly majorVersion: number;
+}
+
+/** `[studio]`, post-env-override. L-only — D has no studio section. */
+export interface LegacyStudioInput {
+  readonly enabled: boolean;
+  readonly port: number;
+  readonly apiUrl: string;
+}
+
+/** `[local_smtp]` (Go's `Inbucket`), post-env-override. L-only. */
+export interface LegacyLocalSmtpInput {
+  readonly enabled: boolean;
+  readonly port: number;
+}
+
+/** `[auth.captcha]`. `provider` is deliberately `string | undefined`, not a narrow union — see
+ * divergence #2 in the module's port plan: D passes a raw, untyped TOML string (the enum check
+ * is live for D); L's `@supabase/config`-decoded value is already schema-narrowed to
+ * `"hcaptcha" | "turnstile" | undefined` before this function ever sees it, making the branch
+ * dead-but-harmless for L specifically, while still needing the same widened type to keep this
+ * field honest and reusable across both callers.
+ */
+export interface LegacyCaptchaInput {
+  readonly enabled: boolean;
+  readonly provider: string | undefined;
+  readonly secret: string | undefined;
+}
+
+/** `[auth.passkey]` + `[auth.webauthn]`. Present iff `passkey.enabled === true`. */
+export interface LegacyPasskeyInput {
+  readonly webauthnPresent: boolean;
+  readonly rpId: string | undefined;
+  readonly rpOrigins: ReadonlyArray<unknown> | undefined;
+}
+
+/** One enabled `[auth.hook.<type>]` entry. Caller pre-filters to enabled-only and pre-orders
+ * per Go's fixed hook-type iteration order (`config.go:1453-1485`). */
+export interface LegacyHookInput {
+  readonly type:
+    | "mfa_verification_attempt"
+    | "password_verification_attempt"
+    | "custom_access_token"
+    | "send_sms"
+    | "send_email"
+    | "before_user_created";
+  /** Post-env-expand; `""` = absent. */
+  readonly uri: string;
+  /** Post-env-expand; `""` = absent. */
+  readonly secrets: string;
+}
+
+/** One `[auth.mfa.<factor>]` entry. Caller pre-orders totp, phone, web_authn. */
+export interface LegacyMfaFactorInput {
+  readonly label: "totp" | "phone" | "web_authn";
+  readonly enrollEnabled: boolean;
+  readonly verifyEnabled: boolean;
+}
+
+/** `[auth.email.smtp]`. Present iff the raw TOML table itself is present (Go's presence-based
+ * `enabled` default, `config.go:743-748` — NOT the decoded, always-defaulted value). */
+export interface LegacySmtpInput {
+  readonly enabled: boolean;
+  readonly host: string;
+  readonly port: number;
+  readonly user: string;
+  readonly pass: string;
+  readonly adminEmail: string;
+}
+
+/** One enabled `[auth.third_party.<provider>]` entry. Caller pre-filters to enabled-only and
+ * pre-orders per Go's fixed provider order (firebase, auth0, cognito, clerk, workos). */
+export interface LegacyThirdPartyInput {
+  readonly provider: "firebase" | "auth0" | "cognito" | "clerk" | "workos";
+  /** `project_id` / `tenant` / `user_pool_id` / `domain` / `issuer_url`, per provider. */
+  readonly requiredField: string;
+  /** cognito's second required field only. */
+  readonly cognitoUserPoolRegion?: string;
+}
+
+/** `[auth]`. Present in {@link LegacyConfigValidationInput} iff auth is enabled — matches Go's
+ * `if c.Auth.Enabled` gate wrapping this entire sub-sequence (`config.go:1087-1153`). */
+export interface LegacyAuthInput {
+  readonly siteUrl: string;
+  readonly captcha?: LegacyCaptchaInput;
+  readonly passkey?: LegacyPasskeyInput;
+  readonly hooks: ReadonlyArray<LegacyHookInput>;
+  readonly mfa: ReadonlyArray<LegacyMfaFactorInput>;
+  readonly smtp?: LegacySmtpInput;
+  readonly thirdParty: ReadonlyArray<LegacyThirdPartyInput>;
+}
+
+/** `[analytics]`, post-env-override. Unconditional entry — internally gated on `enabled` +
+ * `backend === "bigquery"`. `backend` is `string | undefined` for the same dead-but-harmless-for-L
+ * reason as {@link LegacyCaptchaInput.provider} — see divergence #2. */
+export interface LegacyAnalyticsInput {
+  readonly enabled: boolean;
+  readonly backend: string | undefined;
+  readonly gcpProjectId: string;
+  readonly gcpProjectNumber: string;
+  readonly gcpJwtPath: string;
+}
+
+/** `[experimental]`. Unconditional entry — internally gated. `webhooksPresent`/`webhooksEnabled`
+ * hinge on TOML-section PRESENCE (not the decoded, always-defaulted `enabled` value) — see
+ * `config.go:1846-1854` and the callers' own doc comments for why. */
+export interface LegacyExperimentalInput {
+  readonly webhooksPresent?: boolean;
+  readonly webhooksEnabled?: boolean;
+  readonly pgdeltaFormatOptions: string;
+}
+
+/**
+ * Normalized POST-env-override primitives mirroring Go's decoded config, for VALIDATED fields
+ * only. Every section is OPTIONAL — an absent section means "this caller doesn't run that Go
+ * branch, skip it" (e.g. D omits `studio`/`localSmtp` entirely; both D and L omit `auth` when
+ * auth is disabled). See the module header for the full ported-branch table and out-of-scope
+ * list.
+ */
+export interface LegacyConfigValidationInput {
+  /** L only — D's `project_id` isn't part of `Config.Validate`'s shared surface. */
+  readonly projectId?: string;
+  /** L only — D has no `[api]` section. */
+  readonly api?: LegacyApiInput;
+  /** Both, unconditional in Go. */
+  readonly db: LegacyDbInput;
+  /** Both, unconditional (`[]` = none). */
+  readonly storageBucketNames: ReadonlyArray<string>;
+  /** L only. */
+  readonly studio?: LegacyStudioInput;
+  /** L only. */
+  readonly localSmtp?: LegacyLocalSmtpInput;
+  /** Both, present iff auth is enabled. */
+  readonly auth?: LegacyAuthInput;
+  /** Both, unconditional (`[]` = none). */
+  readonly functionSlugs: ReadonlyArray<string>;
+  /** Both, unconditional. */
+  readonly edgeRuntimeDenoVersion: number;
+  /** Both, unconditional entry (internally gated). */
+  readonly analytics: LegacyAnalyticsInput;
+  /** Both, unconditional entry (internally gated). */
+  readonly experimental: LegacyExperimentalInput;
+}
+
+function messageOf(cause: unknown): string {
+  return cause instanceof Error ? cause.message : String(cause);
+}
+
+/**
+ * Runs every `Config.Validate` branch this module owns (see the module header's table), in
+ * Go's exact order, first-failure-wins. Pure — no I/O, no Effect. Callers own their own
+ * per-section I/O reads (signing keys, `api.tls` cert/key, email template/notification content)
+ * at the correct Go position themselves, using the pure helpers exported below.
+ */
+export function legacyValidateResolvedConfig(input: LegacyConfigValidationInput): void {
+  // config.go:990-991 — checked FIRST, before every other field.
+  if (input.projectId !== undefined && input.projectId.length === 0) {
+    throw new LegacyConfigValidateError("Missing required field in config: project_id");
+  }
+
+  // config.go:1006-1027 — api.port / api.tls.{cert,key}_path, gated on api.enabled. The actual
+  // cert/key file reads are caller-side I/O (see legacyResolveApiTlsPath below); this only
+  // checks the "exactly one of cert/key set" presence rule.
+  if (input.api?.enabled) {
+    if (input.api.port === 0) {
+      throw new LegacyConfigValidateError("Missing required field in config: api.port");
+    }
+    if (input.api.tls.enabled) {
+      const hasCert = input.api.tls.certPath !== undefined && input.api.tls.certPath.length > 0;
+      const hasKey = input.api.tls.keyPath !== undefined && input.api.tls.keyPath.length > 0;
+      if (hasCert && !hasKey) {
+        throw new LegacyConfigValidateError("Missing required field in config: api.tls.key_path");
+      }
+      if (hasKey && !hasCert) {
+        throw new LegacyConfigValidateError("Missing required field in config: api.tls.cert_path");
+      }
+    }
+  }
+
+  // config.go:1031-1033 — db.port, unconditional, no `enabled` gate.
+  if (input.db.port === 0) {
+    throw new LegacyConfigValidateError("Missing required field in config: db.port");
+  }
+  // config.go:1034-1062 — db.major_version switch: 0 / 12 have dedicated messages, 13/14/15/17
+  // are supported, anything else is the generic invalid-value message.
+  if (input.db.majorVersion === 0) {
+    throw new LegacyConfigValidateError("Missing required field in config: db.major_version");
+  }
+  if (input.db.majorVersion === 12) {
+    throw new LegacyConfigValidateError(
+      "Postgres version 12.x is unsupported. To use the CLI, either start a new project or follow project migration steps here: https://supabase.com/docs/guides/database#migrating-between-projects.",
+    );
+  }
+  if (![13, 14, 15, 17].includes(input.db.majorVersion)) {
+    throw new LegacyConfigValidateError(
+      `Failed reading config: Invalid db.major_version: ${input.db.majorVersion}.`,
+    );
+  }
+
+  // config.go:1064-1068, pattern @ 1549-1554 — every [storage.buckets.*] key, unconditional.
+  for (const name of input.storageBucketNames) {
+    if (!LEGACY_BUCKET_NAME_PATTERN.test(name)) {
+      throw new LegacyConfigValidateError(
+        `Invalid Bucket name: ${name}. Only lowercase letters, numbers, dots, hyphens, and spaces are allowed. (${LEGACY_BUCKET_NAME_PATTERN.source})`,
+      );
+    }
+  }
+
+  // config.go:1070-1079 — studio.port / studio.api_url, gated on studio.enabled. L-only.
+  if (input.studio?.enabled) {
+    if (input.studio.port === 0) {
+      throw new LegacyConfigValidateError("Missing required field in config: studio.port");
+    }
+    try {
+      legacyGoUrlParse(input.studio.apiUrl);
+    } catch (cause) {
+      throw new LegacyConfigValidateError(`Invalid config for studio.api_url: ${messageOf(cause)}`);
+    }
+  }
+
+  // config.go:1081-1085 — local_smtp.port, gated on local_smtp.enabled. L-only.
+  if (input.localSmtp?.enabled && input.localSmtp.port === 0) {
+    throw new LegacyConfigValidateError("Missing required field in config: local_smtp.port");
+  }
+
+  // config.go:1087-1153 — the auth.* sub-sequence, all inside `if c.Auth.Enabled`.
+  if (input.auth !== undefined) {
+    const auth = input.auth;
+
+    // config.go:1088-1090 — auth.site_url.
+    if (auth.siteUrl.length === 0) {
+      throw new LegacyConfigValidateError("Missing required field in config: auth.site_url");
+    }
+
+    // config.go:1099-1109 + auth.go:58-71 — auth.captcha. The provider enum check runs FIRST,
+    // regardless of `enabled` (it's actually a decode-time check in Go, reproduced here so both
+    // callers see it from one place); only then does the `enabled`-gated presence check run.
+    if (auth.captcha !== undefined) {
+      const provider = auth.captcha.provider;
+      if (
+        provider !== undefined &&
+        provider.length > 0 &&
+        provider !== "hcaptcha" &&
+        provider !== "turnstile"
+      ) {
+        throw new LegacyConfigValidateError(
+          "failed to parse config: decoding failed due to the following error(s):\n\n'auth.captcha.provider' must be one of [hcaptcha turnstile]",
+        );
+      }
+      if (auth.captcha.enabled) {
+        if (auth.captcha.provider === undefined) {
+          throw new LegacyConfigValidateError(
+            "Missing required field in config: auth.captcha.provider",
+          );
+        }
+        if (auth.captcha.secret === undefined || auth.captcha.secret.length === 0) {
+          throw new LegacyConfigValidateError(
+            "Missing required field in config: auth.captcha.secret",
+          );
+        }
+      }
+    }
+
+    // config.go:1110-1116 — signing_keys read is caller-side I/O, not part of this function.
+
+    // config.go:1117-1134 — auth.passkey / auth.webauthn. Caller only builds `passkey` when
+    // `[auth.passkey] enabled` is true.
+    if (auth.passkey !== undefined) {
+      if (!auth.passkey.webauthnPresent) {
+        throw new LegacyConfigValidateError(
+          "Missing required config section: auth.webauthn (required when auth.passkey.enabled is true)",
+        );
+      }
+      if (auth.passkey.rpId === undefined || auth.passkey.rpId.length === 0) {
+        throw new LegacyConfigValidateError(
+          "Missing required field in config: auth.webauthn.rp_id",
+        );
+      }
+      if (auth.passkey.rpOrigins === undefined || auth.passkey.rpOrigins.length === 0) {
+        throw new LegacyConfigValidateError(
+          "Missing required field in config: auth.webauthn.rp_origins",
+        );
+      }
+    }
+
+    // config.go:1136-1138, checks @ 1453-1521 — auth.hook.*, caller pre-filtered to
+    // enabled-only and pre-ordered per Go's fixed hook-type iteration order.
+    for (const hook of auth.hooks) {
+      if (hook.uri.length === 0) {
+        throw new LegacyConfigValidateError(
+          `Missing required field in config: auth.hook.${hook.type}.uri`,
+        );
+      }
+      // Go calls `url.Parse` before the scheme switch (`config.go:1497-1499`) and fails the
+      // whole load on a malformed URI (e.g. an unterminated IPv6 host like `http://[::1`) —
+      // a bare scheme-prefix regex would accept that. Reuse `legacyGoUrlParse` (the same
+      // `net/url.Parse` port already used for `studio.api_url` above) instead of re-deriving
+      // a scheme by hand.
+      let scheme: string;
+      try {
+        scheme = legacyGoUrlParse(hook.uri).scheme;
+      } catch (cause) {
+        throw new LegacyConfigValidateError(`failed to parse template url: ${messageOf(cause)}`);
+      }
+      if (scheme === "http" || scheme === "https") {
+        if (hook.secrets.length === 0) {
+          throw new LegacyConfigValidateError(
+            `Missing required field in config: auth.hook.${hook.type}.secrets`,
+          );
+        }
+        for (const secret of hook.secrets.split("|")) {
+          if (!LEGACY_HOOK_SECRET_PATTERN.test(secret)) {
+            throw new LegacyConfigValidateError(
+              `Invalid hook config: auth.hook.${hook.type}.secrets must be formatted as "v1,whsec_<base64_encoded_secret>" with a minimum length of 32 characters.`,
+            );
+          }
+        }
+      } else if (scheme === "pg-functions") {
+        if (hook.secrets.length > 0) {
+          throw new LegacyConfigValidateError(
+            `Invalid hook config: auth.hook.${hook.type}.secrets is unsupported for pg-functions URI`,
+          );
+        }
+      } else {
+        throw new LegacyConfigValidateError(
+          `Invalid hook config: auth.hook.${hook.type}.uri should be a HTTP, HTTPS, or pg-functions URI`,
+        );
+      }
+    }
+
+    // config.go:1139-1141, checks @ 1523-1534 — auth.mfa.*, caller pre-ordered totp/phone/web_authn.
+    for (const factor of auth.mfa) {
+      if (factor.enrollEnabled && !factor.verifyEnabled) {
+        throw new LegacyConfigValidateError(
+          `Invalid MFA config: auth.mfa.${factor.label}.enroll_enabled requires verify_enabled`,
+        );
+      }
+    }
+
+    // config.go:1293-1323 — email template/notification content read + exclusivity is
+    // caller-side, via legacyResolveEmailTemplateContentPath below.
+
+    // config.go:1325-1344 — auth.email.smtp, gated on the raw table being present AND enabled.
+    if (auth.smtp !== undefined && auth.smtp.enabled) {
+      if (auth.smtp.host.length === 0) {
+        throw new LegacyConfigValidateError(
+          "Missing required field in config: auth.email.smtp.host",
+        );
+      }
+      if (auth.smtp.port === 0) {
+        throw new LegacyConfigValidateError(
+          "Missing required field in config: auth.email.smtp.port",
+        );
+      }
+      if (auth.smtp.user.length === 0) {
+        throw new LegacyConfigValidateError(
+          "Missing required field in config: auth.email.smtp.user",
+        );
+      }
+      if (auth.smtp.pass.length === 0) {
+        throw new LegacyConfigValidateError(
+          "Missing required field in config: auth.email.smtp.pass",
+        );
+      }
+      if (auth.smtp.adminEmail.length === 0) {
+        throw new LegacyConfigValidateError(
+          "Missing required field in config: auth.email.smtp.admin_email",
+        );
+      }
+    }
+
+    // config.go:1151-1153, checks @ 1635-1683 — auth.third_party.*, caller pre-filtered to
+    // enabled-only and pre-ordered firebase, auth0, cognito, clerk, workos. Each provider's
+    // required field(s) are checked as encountered; the "more than one enabled" check runs only
+    // after every entry has individually validated.
+    for (const thirdParty of auth.thirdParty) {
+      switch (thirdParty.provider) {
+        case "firebase": {
+          if (thirdParty.requiredField.length === 0) {
+            throw new LegacyConfigValidateError(
+              "Invalid config: auth.third_party.firebase is enabled but without a project_id.",
+            );
+          }
+          break;
+        }
+        case "auth0": {
+          if (thirdParty.requiredField.length === 0) {
+            throw new LegacyConfigValidateError(
+              "Invalid config: auth.third_party.auth0 is enabled but without a tenant.",
+            );
+          }
+          break;
+        }
+        case "cognito": {
+          if (thirdParty.requiredField.length === 0) {
+            throw new LegacyConfigValidateError(
+              "Invalid config: auth.third_party.cognito is enabled but without a user_pool_id.",
+            );
+          }
+          if (
+            thirdParty.cognitoUserPoolRegion === undefined ||
+            thirdParty.cognitoUserPoolRegion.length === 0
+          ) {
+            throw new LegacyConfigValidateError(
+              "Invalid config: auth.third_party.cognito is enabled but without a user_pool_region.",
+            );
+          }
+          break;
+        }
+        case "clerk": {
+          if (thirdParty.requiredField.length === 0) {
+            throw new LegacyConfigValidateError(
+              "Invalid config: auth.third_party.clerk is enabled but without a domain.",
+            );
+          }
+          if (!LEGACY_CLERK_DOMAIN_PATTERN.test(thirdParty.requiredField)) {
+            throw new LegacyConfigValidateError(
+              "Invalid config: auth.third_party.clerk has invalid domain, it usually is like clerk.example.com or example.clerk.accounts.dev. Check https://clerk.com/setup/supabase on how to find the correct value.",
+            );
+          }
+          break;
+        }
+        case "workos": {
+          if (thirdParty.requiredField.length === 0) {
+            throw new LegacyConfigValidateError(
+              "Invalid config: auth.third_party.workos is enabled but without a issuer_url.",
+            );
+          }
+          break;
+        }
+      }
+    }
+    if (auth.thirdParty.length > 1) {
+      throw new LegacyConfigValidateError(
+        "Invalid config: Only one third_party provider allowed to be enabled at a time.",
+      );
+    }
+  }
+
+  // config.go:1159-1163, pattern @ 1539-1544 — every [functions.*] key, unconditional, not
+  // gated on auth.enabled.
+  for (const slug of input.functionSlugs) {
+    if (!LEGACY_FUNCTION_SLUG_PATTERN.test(slug)) {
+      throw new LegacyConfigValidateError(
+        `Invalid Function name: ${slug}. Must start with at least one letter, and only include alphanumeric characters, underscores, and hyphens. (${LEGACY_FUNCTION_SLUG_PATTERN.source})`,
+      );
+    }
+  }
+
+  // config.go:1164-1173 — edge_runtime.deno_version switch, unconditional, not gated on
+  // edge_runtime.enabled.
+  if (input.edgeRuntimeDenoVersion === 0) {
+    throw new LegacyConfigValidateError(
+      "Missing required field in config: edge_runtime.deno_version",
+    );
+  }
+  if (input.edgeRuntimeDenoVersion !== 1 && input.edgeRuntimeDenoVersion !== 2) {
+    throw new LegacyConfigValidateError(
+      `Failed reading config: Invalid edge_runtime.deno_version: ${input.edgeRuntimeDenoVersion}.`,
+    );
+  }
+
+  // Decode-time enum (`LogflareBackend.UnmarshalText`, config.go:60-65) — reproduced here so
+  // both callers' env-override paths (which bypass their own decode-time schema guard) see it.
+  const backend = input.analytics.backend;
+  if (
+    backend !== undefined &&
+    backend.length > 0 &&
+    backend !== "postgres" &&
+    backend !== "bigquery"
+  ) {
+    throw new LegacyConfigValidateError(
+      "failed to parse config: decoding failed due to the following error(s):\n\n'analytics.backend' must be one of [postgres bigquery]",
+    );
+  }
+  // config.go:1175-1187 — analytics.gcp_*, gated on enabled && backend === "bigquery".
+  if (input.analytics.enabled && backend === "bigquery") {
+    if (input.analytics.gcpProjectId.length === 0) {
+      throw new LegacyConfigValidateError(
+        "Missing required field in config: analytics.gcp_project_id",
+      );
+    }
+    if (input.analytics.gcpProjectNumber.length === 0) {
+      throw new LegacyConfigValidateError(
+        "Missing required field in config: analytics.gcp_project_number",
+      );
+    }
+    if (input.analytics.gcpJwtPath.length === 0) {
+      throw new LegacyConfigValidateError(
+        "Path to GCP Service Account Key must be provided in config, relative to config.toml: analytics.gcp_jwt_path",
+      );
+    }
+  }
+
+  // config.go:1847-1848 — experimental.webhooks, hinges on TOML-section PRESENCE, not the
+  // decoded (always-defaulted) `enabled` value.
+  if (input.experimental.webhooksPresent === true && input.experimental.webhooksEnabled !== true) {
+    throw new LegacyConfigValidateError(
+      "Webhooks cannot be deactivated. [experimental.webhooks] enabled can either be true or left undefined",
+    );
+  }
+  // config.go:1850-1851 — experimental.pgdelta.format_options, must be valid JSON when set.
+  if (
+    input.experimental.pgdeltaFormatOptions !== "" &&
+    !isValidJson(input.experimental.pgdeltaFormatOptions)
+  ) {
+    throw new LegacyConfigValidateError(
+      "Invalid config for experimental.pgdelta.format_options: must be valid JSON",
+    );
+  }
+}
+
+function isValidJson(value: string): boolean {
+  try {
+    JSON.parse(value);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+// ── signing keys (config.go:1110-1116, path rule config.go:877-878 filepath.IsAbs guard) ──
+
+/** Absolute → verbatim; relative → join(workdir, "supabase", p). */
+export function legacyResolveSigningKeysPath(workdir: string, signingKeysPath: string): string {
+  return isAbsolute(signingKeysPath) ? signingKeysPath : join(workdir, "supabase", signingKeysPath);
+}
+
+/** `failed to read signing keys: ${msg(cause)}` */
+export function legacySigningKeysReadErrorMessage(cause: unknown): string {
+  return `failed to read signing keys: ${messageOf(cause)}`;
+}
+
+/** `failed to decode signing keys: ${msg(cause)}` */
+export function legacySigningKeysDecodeErrorMessage(cause: unknown): string {
+  return `failed to decode signing keys: ${messageOf(cause)}`;
+}
+// D only asserts Array.isArray(JSON.parse(text)); L further decodes into LegacyJwk[] to sign
+// with the first key — that JWK-specific decode/signing logic stays in L, unrelated to parity.
+
+// ── email template / notification (config.go:1293-1323) ──
+
+/**
+ * Pure exclusivity decision + path to read for one template/notification entry. Throws
+ * {@link LegacyConfigValidateError} with the exclusivity message when `contentPath === ""` and
+ * `contentPresent`. Returns the absolute path to read, or `undefined` when there's nothing to
+ * read (both `contentPath` and `content` absent — skip, not an error). `contentPath` set (even
+ * when `content` is ALSO set) always wins — Go does not reject "both set", `content_path`
+ * silently wins/overwrites.
+ *
+ * `base` is caller-resolved: TEMPLATE section → workdir; NOTIFICATION section →
+ * join(workdir, "supabase") (this asymmetry is real, intentional Go behavior — config.go's own
+ * FIXME comment flags it, do not "fix" it).
+ */
+export function legacyResolveEmailTemplateContentPath(args: {
+  readonly section: "template" | "notification";
+  readonly name: string;
+  /** Post-env-expand; `""` = absent. */
+  readonly contentPath: string;
+  /** Raw `content` key present in the TOML document. */
+  readonly contentPresent: boolean;
+  readonly base: string;
+}): string | undefined {
+  if (args.contentPath.length === 0) {
+    if (args.contentPresent) {
+      throw new LegacyConfigValidateError(
+        `Invalid config for auth.email.${args.section}.${args.name}.content: please use content_path instead`,
+      );
+    }
+    return undefined;
+  }
+  return isAbsolute(args.contentPath) ? args.contentPath : join(args.base, args.contentPath);
+}
+
+/** `Invalid config for auth.email.${section}.${name}.content_path: ${msg(cause)}` */
+export function legacyEmailContentPathReadErrorMessage(
+  section: "template" | "notification",
+  name: string,
+  cause: unknown,
+): string {
+  return `Invalid config for auth.email.${section}.${name}.content_path: ${messageOf(cause)}`;
+}
+
+// ── api.tls cert/key (config.go:1016-1026, path rule ~961-965, NO isAbsolute guard) ──
+
+/** Unconditional join(workdir, "supabase", p) — Go's path.Join absorbs a leading "/" too. */
+export function legacyResolveApiTlsPath(workdir: string, p: string): string {
+  return join(workdir, "supabase", p);
+}
+
+/** `failed to read TLS cert: ${msg(cause)}` */
+export function legacyApiTlsCertReadErrorMessage(cause: unknown): string {
+  return `failed to read TLS cert: ${messageOf(cause)}`;
+}
+
+/** `failed to read TLS key: ${msg(cause)}` */
+export function legacyApiTlsKeyReadErrorMessage(cause: unknown): string {
+  return `failed to read TLS key: ${messageOf(cause)}`;
+}
diff --git a/apps/cli/src/legacy/shared/legacy-config-validate.unit.test.ts b/apps/cli/src/legacy/shared/legacy-config-validate.unit.test.ts
new file mode 100644
index 0000000000..c66d1db6c9
--- /dev/null
+++ b/apps/cli/src/legacy/shared/legacy-config-validate.unit.test.ts
@@ -0,0 +1,1034 @@
+import { describe, expect, it } from "vitest";
+
+import {
+  LEGACY_BUCKET_NAME_PATTERN,
+  LEGACY_CLERK_DOMAIN_PATTERN,
+  LEGACY_FUNCTION_SLUG_PATTERN,
+  LEGACY_HOOK_SECRET_PATTERN,
+  LEGACY_PROJECT_REF_PATTERN,
+  type LegacyAuthInput,
+  type LegacyConfigValidationInput,
+  legacyParseGoBool,
+  legacyValidateResolvedConfig,
+} from "./legacy-config-validate.ts";
+
+// Starter suite for the symbols relocated from `legacy-db-config.toml-read.ts` in an earlier
+// commit (see the module header in `legacy-config-validate.ts`). The bulk of `Config.Validate`
+// behavioral coverage — direct calls to `legacyValidateResolvedConfig`, covering every branch
+// this module owns regardless of which caller (D or L) exercises it — lives further down this
+// file; it was consolidated here from `legacy-local-config-values.unit.test.ts`, where it used
+// to be exercised only indirectly through `legacyResolveLocalConfigValues`.
+
+describe("legacyParseGoBool", () => {
+  it("accepts Go's strconv.ParseBool true forms", () => {
+    for (const value of ["1", "t", "T", "TRUE", "true", "True"]) {
+      expect(legacyParseGoBool(value)).toBe(true);
+    }
+  });
+
+  it("accepts Go's strconv.ParseBool false forms, including the empty string", () => {
+    for (const value of ["0", "f", "F", "FALSE", "false", "False", ""]) {
+      expect(legacyParseGoBool(value)).toBe(false);
+    }
+  });
+
+  it("returns undefined for a value outside Go's strconv.ParseBool acceptance set", () => {
+    expect(legacyParseGoBool("yes")).toBeUndefined();
+    expect(legacyParseGoBool("2")).toBeUndefined();
+  });
+});
+
+describe("LEGACY_PROJECT_REF_PATTERN", () => {
+  it("matches a valid 20-character lowercase project ref", () => {
+    expect(LEGACY_PROJECT_REF_PATTERN.test("abcdefghijklmnopqrst")).toBe(true);
+  });
+
+  it("rejects refs of the wrong length or case", () => {
+    expect(LEGACY_PROJECT_REF_PATTERN.test("short")).toBe(false);
+    expect(LEGACY_PROJECT_REF_PATTERN.test("ABCDEFGHIJKLMNOPQRST")).toBe(false);
+  });
+});
+
+describe("LEGACY_BUCKET_NAME_PATTERN", () => {
+  it("matches Go-legal bucket name characters", () => {
+    expect(LEGACY_BUCKET_NAME_PATTERN.test("my-bucket.1")).toBe(true);
+  });
+
+  it("rejects characters outside Go's bucketNamePattern", () => {
+    expect(LEGACY_BUCKET_NAME_PATTERN.test("bad#name")).toBe(false);
+    expect(LEGACY_BUCKET_NAME_PATTERN.test("bad/name")).toBe(false);
+  });
+});
+
+describe("LEGACY_FUNCTION_SLUG_PATTERN", () => {
+  it("matches a valid function slug (letters, digits, _ and -)", () => {
+    expect(LEGACY_FUNCTION_SLUG_PATTERN.test("my-function")).toBe(true);
+    expect(LEGACY_FUNCTION_SLUG_PATTERN.test("function_1")).toBe(true);
+  });
+
+  it("rejects a slug that doesn't start with a letter", () => {
+    expect(LEGACY_FUNCTION_SLUG_PATTERN.test("123")).toBe(false);
+    expect(LEGACY_FUNCTION_SLUG_PATTERN.test("1bad")).toBe(false);
+  });
+});
+
+describe("LEGACY_HOOK_SECRET_PATTERN", () => {
+  it("matches a valid v1,whsec_ secret", () => {
+    expect(LEGACY_HOOK_SECRET_PATTERN.test(`v1,whsec_${"a".repeat(32)}`)).toBe(true);
+  });
+
+  it("rejects a secret that doesn't match Go's hookSecretPattern", () => {
+    expect(LEGACY_HOOK_SECRET_PATTERN.test("not-a-valid-secret")).toBe(false);
+  });
+});
+
+describe("LEGACY_CLERK_DOMAIN_PATTERN", () => {
+  it("matches a valid clerk.example.com domain", () => {
+    expect(LEGACY_CLERK_DOMAIN_PATTERN.test("clerk.example.com")).toBe(true);
+  });
+
+  it("matches a valid <slug>.clerk.accounts.dev domain", () => {
+    expect(LEGACY_CLERK_DOMAIN_PATTERN.test("example.clerk.accounts.dev")).toBe(true);
+  });
+
+  it("rejects a domain that doesn't match Go's clerkDomainPattern", () => {
+    expect(LEGACY_CLERK_DOMAIN_PATTERN.test("not-a-clerk-domain")).toBe(false);
+  });
+});
+
+/**
+ * A trivially-passing full input. Every test below spreads/overrides only the field(s) its
+ * check cares about, matching the fixture-building style of `legacy-local-config-values.unit
+ * .test.ts`'s own `baseConfig()` helper.
+ */
+function minimalInput(
+  overrides: Partial<LegacyConfigValidationInput> = {},
+): LegacyConfigValidationInput {
+  return {
+    db: { port: 5432, majorVersion: 17 },
+    storageBucketNames: [],
+    functionSlugs: [],
+    edgeRuntimeDenoVersion: 2,
+    analytics: {
+      enabled: false,
+      backend: undefined,
+      gcpProjectId: "",
+      gcpProjectNumber: "",
+      gcpJwtPath: "",
+    },
+    experimental: { pgdeltaFormatOptions: "" },
+    ...overrides,
+  };
+}
+
+/** A trivially-passing `[auth]` section — auth enabled, nothing else configured. */
+function minimalAuthInput(overrides: Partial<LegacyAuthInput> = {}): LegacyAuthInput {
+  return {
+    siteUrl: "http://localhost:3000",
+    hooks: [],
+    mfa: [],
+    thirdParty: [],
+    ...overrides,
+  };
+}
+
+// Moved from `legacy-local-config-values.unit.test.ts`: these describe blocks exercise checks
+// that now live entirely inside `legacyValidateResolvedConfig` and can be phrased as direct
+// calls with a hand-built `LegacyConfigValidationInput` — no `ProjectConfig`/schema decode, no
+// env-override machinery, no file I/O, no `document` threading. Everything that still needs
+// one of those (value derivation, env-override mechanics, the 3 I/O checks' actual file reads)
+// stays in `legacy-local-config-values.unit.test.ts`.
+describe("legacyValidateResolvedConfig", () => {
+  // config.go:1034-1062 — db.major_version switch. The env-override
+  // (SUPABASE_DB_MAJOR_VERSION) variants stay in legacy-local-config-values.unit.test.ts.
+  describe("db.major_version", () => {
+    it("rejects a configured major_version of 0", () => {
+      expect(() =>
+        legacyValidateResolvedConfig(minimalInput({ db: { port: 5432, majorVersion: 0 } })),
+      ).toThrow("Missing required field in config: db.major_version");
+    });
+
+    it("rejects the unsupported Postgres 12.x major_version with Go's dedicated message", () => {
+      expect(() =>
+        legacyValidateResolvedConfig(minimalInput({ db: { port: 5432, majorVersion: 12 } })),
+      ).toThrow("Postgres version 12.x is unsupported.");
+    });
+
+    it.each([13, 14, 15, 17])("accepts the supported major_version %d", (majorVersion) => {
+      expect(() =>
+        legacyValidateResolvedConfig(minimalInput({ db: { port: 5432, majorVersion } })),
+      ).not.toThrow();
+    });
+
+    it("rejects an unsupported major_version with the generic invalid-value message", () => {
+      expect(() =>
+        legacyValidateResolvedConfig(minimalInput({ db: { port: 5432, majorVersion: 16 } })),
+      ).toThrow("Failed reading config: Invalid db.major_version: 16.");
+    });
+  });
+
+  // config.go:1064-1068, pattern @ 1549-1554 — unconditional, no storage.enabled-style gate.
+  describe("storage.buckets", () => {
+    it("rejects a bucket name Go's ValidateBucketName refuses", () => {
+      expect(() =>
+        legacyValidateResolvedConfig(minimalInput({ storageBucketNames: ["bad/name"] })),
+      ).toThrow("Invalid Bucket name: bad/name.");
+    });
+
+    it("does not throw for a valid bucket name", () => {
+      expect(() =>
+        legacyValidateResolvedConfig(minimalInput({ storageBucketNames: ["avatars.public"] })),
+      ).not.toThrow();
+    });
+
+    it("does not throw when no buckets are configured", () => {
+      expect(() => legacyValidateResolvedConfig(minimalInput())).not.toThrow();
+    });
+  });
+
+  // config.go:1164-1173 — edge_runtime.deno_version switch, unconditional, not gated on
+  // edge_runtime.enabled (there is no such field on LegacyConfigValidationInput at all). The
+  // env-override (SUPABASE_EDGE_RUNTIME_DENO_VERSION) variants stay in
+  // legacy-local-config-values.unit.test.ts.
+  describe("edge_runtime.deno_version", () => {
+    it("rejects a configured deno_version of 0", () => {
+      expect(() =>
+        legacyValidateResolvedConfig(minimalInput({ edgeRuntimeDenoVersion: 0 })),
+      ).toThrow("Missing required field in config: edge_runtime.deno_version");
+    });
+
+    it.each([1, 2])("accepts the supported deno_version %d", (denoVersion) => {
+      expect(() =>
+        legacyValidateResolvedConfig(minimalInput({ edgeRuntimeDenoVersion: denoVersion })),
+      ).not.toThrow();
+    });
+
+    it("rejects an unsupported deno_version with the generic invalid-value message", () => {
+      expect(() =>
+        legacyValidateResolvedConfig(minimalInput({ edgeRuntimeDenoVersion: 3 })),
+      ).toThrow("Failed reading config: Invalid edge_runtime.deno_version: 3.");
+    });
+
+    it("rejects an invalid deno_version even when edge_runtime is disabled", () => {
+      // There is no `edgeRuntime.enabled`-style gate on `LegacyConfigValidationInput` at
+      // all — this is identical to the "rejects a configured deno_version of 0" case above,
+      // which is itself the point: Go never gates this check on edge_runtime.enabled.
+      expect(() =>
+        legacyValidateResolvedConfig(minimalInput({ edgeRuntimeDenoVersion: 0 })),
+      ).toThrow("Missing required field in config: edge_runtime.deno_version");
+    });
+  });
+
+  // config.go:1174-1187 — analytics.gcp_*, gated on enabled && backend === "bigquery". The
+  // env-override (SUPABASE_ANALYTICS_*) variants stay in legacy-local-config-values.unit.test.ts.
+  describe("analytics (BigQuery backend required fields)", () => {
+    it("rejects an enabled bigquery backend without gcp_project_id", () => {
+      expect(() =>
+        legacyValidateResolvedConfig(
+          minimalInput({
+            analytics: {
+              enabled: true,
+              backend: "bigquery",
+              gcpProjectId: "",
+              gcpProjectNumber: "",
+              gcpJwtPath: "",
+            },
+          }),
+        ),
+      ).toThrow("Missing required field in config: analytics.gcp_project_id");
+    });
+
+    it("rejects an enabled bigquery backend without gcp_project_number", () => {
+      expect(() =>
+        legacyValidateResolvedConfig(
+          minimalInput({
+            analytics: {
+              enabled: true,
+              backend: "bigquery",
+              gcpProjectId: "proj",
+              gcpProjectNumber: "",
+              gcpJwtPath: "",
+            },
+          }),
+        ),
+      ).toThrow("Missing required field in config: analytics.gcp_project_number");
+    });
+
+    it("rejects an enabled bigquery backend without gcp_jwt_path", () => {
+      expect(() =>
+        legacyValidateResolvedConfig(
+          minimalInput({
+            analytics: {
+              enabled: true,
+              backend: "bigquery",
+              gcpProjectId: "proj",
+              gcpProjectNumber: "123",
+              gcpJwtPath: "",
+            },
+          }),
+        ),
+      ).toThrow(
+        "Path to GCP Service Account Key must be provided in config, relative to config.toml: analytics.gcp_jwt_path",
+      );
+    });
+
+    it("does not throw when an enabled bigquery backend has all three GCP fields", () => {
+      expect(() =>
+        legacyValidateResolvedConfig(
+          minimalInput({
+            analytics: {
+              enabled: true,
+              backend: "bigquery",
+              gcpProjectId: "proj",
+              gcpProjectNumber: "123",
+              gcpJwtPath: "gcp.json",
+            },
+          }),
+        ),
+      ).not.toThrow();
+    });
+
+    it("does not throw for the postgres backend, however incomplete the GCP fields are", () => {
+      expect(() =>
+        legacyValidateResolvedConfig(
+          minimalInput({
+            analytics: {
+              enabled: true,
+              backend: "postgres",
+              gcpProjectId: "",
+              gcpProjectNumber: "",
+              gcpJwtPath: "",
+            },
+          }),
+        ),
+      ).not.toThrow();
+    });
+
+    it("does not throw when analytics is disabled, however incomplete the GCP fields are", () => {
+      expect(() =>
+        legacyValidateResolvedConfig(
+          minimalInput({
+            analytics: {
+              enabled: false,
+              backend: "bigquery",
+              gcpProjectId: "",
+              gcpProjectNumber: "",
+              gcpJwtPath: "",
+            },
+          }),
+        ),
+      ).not.toThrow();
+    });
+  });
+
+  // config.go:1846-1854 — experimental.validate(), unconditional, internally gated.
+  describe("experimental.*", () => {
+    it("rejects a present [experimental.webhooks] section with enabled omitted", () => {
+      expect(() =>
+        legacyValidateResolvedConfig(
+          minimalInput({ experimental: { webhooksPresent: true, pgdeltaFormatOptions: "" } }),
+        ),
+      ).toThrow(
+        "Webhooks cannot be deactivated. [experimental.webhooks] enabled can either be true or left undefined",
+      );
+    });
+
+    it("rejects a present [experimental.webhooks] section with enabled = false", () => {
+      expect(() =>
+        legacyValidateResolvedConfig(
+          minimalInput({
+            experimental: {
+              webhooksPresent: true,
+              webhooksEnabled: false,
+              pgdeltaFormatOptions: "",
+            },
+          }),
+        ),
+      ).toThrow(
+        "Webhooks cannot be deactivated. [experimental.webhooks] enabled can either be true or left undefined",
+      );
+    });
+
+    it("does not throw when [experimental.webhooks] enabled = true", () => {
+      expect(() =>
+        legacyValidateResolvedConfig(
+          minimalInput({
+            experimental: {
+              webhooksPresent: true,
+              webhooksEnabled: true,
+              pgdeltaFormatOptions: "",
+            },
+          }),
+        ),
+      ).not.toThrow();
+    });
+
+    it("does not throw when [experimental.webhooks] is absent entirely", () => {
+      expect(() => legacyValidateResolvedConfig(minimalInput())).not.toThrow();
+    });
+
+    it("rejects invalid JSON in experimental.pgdelta.format_options", () => {
+      expect(() =>
+        legacyValidateResolvedConfig(
+          minimalInput({ experimental: { pgdeltaFormatOptions: "{not json" } }),
+        ),
+      ).toThrow("Invalid config for experimental.pgdelta.format_options: must be valid JSON");
+    });
+
+    it("does not throw for valid JSON in experimental.pgdelta.format_options", () => {
+      expect(() =>
+        legacyValidateResolvedConfig(
+          minimalInput({ experimental: { pgdeltaFormatOptions: '{"keywordCase":"upper"}' } }),
+        ),
+      ).not.toThrow();
+    });
+
+    it("does not throw when experimental.pgdelta.format_options is unset", () => {
+      expect(() =>
+        legacyValidateResolvedConfig(minimalInput({ experimental: { pgdeltaFormatOptions: "" } })),
+      ).not.toThrow();
+    });
+  });
+
+  // config.go:1088-1090 — auth.site_url, checked first inside `if c.Auth.Enabled`. An absent
+  // `auth` section on `LegacyConfigValidationInput` IS "auth disabled" from this function's
+  // perspective. The SUPABASE_AUTH_ENABLED/SUPABASE_AUTH_SITE_URL env-override variants stay in
+  // legacy-local-config-values.unit.test.ts.
+  describe("auth.site_url", () => {
+    it("rejects an explicit empty site_url when auth is enabled", () => {
+      expect(() =>
+        legacyValidateResolvedConfig(minimalInput({ auth: minimalAuthInput({ siteUrl: "" }) })),
+      ).toThrow("Missing required field in config: auth.site_url");
+    });
+
+    it("does not throw when site_url is set and auth is enabled", () => {
+      expect(() =>
+        legacyValidateResolvedConfig(
+          minimalInput({ auth: minimalAuthInput({ siteUrl: "http://localhost:3000" }) }),
+        ),
+      ).not.toThrow();
+    });
+
+    it("does not throw an explicit empty site_url when auth is disabled", () => {
+      expect(() => legacyValidateResolvedConfig(minimalInput())).not.toThrow();
+    });
+  });
+
+  // config.go:1099-1109 + auth.go:58-71 — auth.captcha, checked right after auth.site_url.
+  describe("auth.captcha", () => {
+    it("rejects an enabled captcha without a provider", () => {
+      expect(() =>
+        legacyValidateResolvedConfig(
+          minimalInput({
+            auth: minimalAuthInput({
+              captcha: { enabled: true, provider: undefined, secret: undefined },
+            }),
+          }),
+        ),
+      ).toThrow("Missing required field in config: auth.captcha.provider");
+    });
+
+    it("rejects an enabled captcha with a provider but no secret", () => {
+      expect(() =>
+        legacyValidateResolvedConfig(
+          minimalInput({
+            auth: minimalAuthInput({
+              captcha: { enabled: true, provider: "hcaptcha", secret: undefined },
+            }),
+          }),
+        ),
+      ).toThrow("Missing required field in config: auth.captcha.secret");
+    });
+
+    it("does not throw when an enabled captcha has both provider and secret", () => {
+      expect(() =>
+        legacyValidateResolvedConfig(
+          minimalInput({
+            auth: minimalAuthInput({
+              captcha: { enabled: true, provider: "hcaptcha", secret: "shh" },
+            }),
+          }),
+        ),
+      ).not.toThrow();
+    });
+
+    it("does not throw when captcha is disabled, however incomplete", () => {
+      expect(() =>
+        legacyValidateResolvedConfig(
+          minimalInput({
+            auth: minimalAuthInput({
+              captcha: { enabled: false, provider: undefined, secret: undefined },
+            }),
+          }),
+        ),
+      ).not.toThrow();
+    });
+
+    it("does not throw an enabled captcha without provider/secret when auth is disabled", () => {
+      expect(() => legacyValidateResolvedConfig(minimalInput())).not.toThrow();
+    });
+  });
+
+  // config.go:1117-1134 — auth.passkey/auth.webauthn, right after the (caller-side) signing-keys
+  // read.
+  describe("auth.passkey / auth.webauthn", () => {
+    it("rejects passkey.enabled without an [auth.webauthn] section", () => {
+      expect(() =>
+        legacyValidateResolvedConfig(
+          minimalInput({
+            auth: minimalAuthInput({
+              passkey: { webauthnPresent: false, rpId: undefined, rpOrigins: undefined },
+            }),
+          }),
+        ),
+      ).toThrow(
+        "Missing required config section: auth.webauthn (required when auth.passkey.enabled is true)",
+      );
+    });
+
+    it("rejects passkey.enabled with [auth.webauthn] missing rp_id", () => {
+      expect(() =>
+        legacyValidateResolvedConfig(
+          minimalInput({
+            auth: minimalAuthInput({
+              passkey: {
+                webauthnPresent: true,
+                rpId: undefined,
+                rpOrigins: ["http://localhost:3000"],
+              },
+            }),
+          }),
+        ),
+      ).toThrow("Missing required field in config: auth.webauthn.rp_id");
+    });
+
+    it("rejects passkey.enabled with [auth.webauthn] missing rp_origins", () => {
+      expect(() =>
+        legacyValidateResolvedConfig(
+          minimalInput({
+            auth: minimalAuthInput({
+              passkey: { webauthnPresent: true, rpId: "localhost", rpOrigins: undefined },
+            }),
+          }),
+        ),
+      ).toThrow("Missing required field in config: auth.webauthn.rp_origins");
+    });
+
+    it("does not throw when passkey.enabled has a complete [auth.webauthn] section", () => {
+      expect(() =>
+        legacyValidateResolvedConfig(
+          minimalInput({
+            auth: minimalAuthInput({
+              passkey: {
+                webauthnPresent: true,
+                rpId: "localhost",
+                rpOrigins: ["http://localhost:3000"],
+              },
+            }),
+          }),
+        ),
+      ).not.toThrow();
+    });
+
+    it("does not throw when passkey is absent from the input", () => {
+      expect(() =>
+        legacyValidateResolvedConfig(
+          minimalInput({ auth: minimalAuthInput({ passkey: undefined }) }),
+        ),
+      ).not.toThrow();
+    });
+
+    it("does not throw when auth carries no passkey data at all", () => {
+      // Distinct from the previous test only in the original (L-level) caller's derivation —
+      // "webauthn absent from the document" vs. "no document was threaded through at all".
+      // Both collapse to `passkey: undefined` at this shared, direct-call layer.
+      expect(() =>
+        legacyValidateResolvedConfig(minimalInput({ auth: minimalAuthInput() })),
+      ).not.toThrow();
+    });
+
+    it("does not throw an enabled passkey without webauthn when auth is disabled", () => {
+      expect(() => legacyValidateResolvedConfig(minimalInput())).not.toThrow();
+    });
+  });
+
+  // config.go:1325-1344 — auth.email.smtp, gated on the raw table being present AND enabled.
+  describe("auth.email.smtp", () => {
+    it("rejects a present [auth.email.smtp] table with no fields", () => {
+      expect(() =>
+        legacyValidateResolvedConfig(
+          minimalInput({
+            auth: minimalAuthInput({
+              smtp: { enabled: true, host: "", port: 0, user: "", pass: "", adminEmail: "" },
+            }),
+          }),
+        ),
+      ).toThrow("Missing required field in config: auth.email.smtp.host");
+    });
+
+    it("rejects a present [auth.email.smtp] table missing port/user/pass/admin_email", () => {
+      expect(() =>
+        legacyValidateResolvedConfig(
+          minimalInput({
+            auth: minimalAuthInput({
+              smtp: {
+                enabled: true,
+                host: "smtp.example.com",
+                port: 0,
+                user: "",
+                pass: "",
+                adminEmail: "",
+              },
+            }),
+          }),
+        ),
+      ).toThrow("Missing required field in config: auth.email.smtp.port");
+    });
+
+    it("does not throw when [auth.email.smtp] explicitly sets enabled = false", () => {
+      expect(() =>
+        legacyValidateResolvedConfig(
+          minimalInput({
+            auth: minimalAuthInput({
+              smtp: {
+                enabled: false,
+                host: "smtp.example.com",
+                port: 0,
+                user: "",
+                pass: "",
+                adminEmail: "",
+              },
+            }),
+          }),
+        ),
+      ).not.toThrow();
+    });
+
+    it("does not throw when [auth.email.smtp] is a complete table", () => {
+      expect(() =>
+        legacyValidateResolvedConfig(
+          minimalInput({
+            auth: minimalAuthInput({
+              smtp: {
+                enabled: true,
+                host: "smtp.example.com",
+                port: 587,
+                user: "user",
+                pass: "pass",
+                adminEmail: "admin@example.com",
+              },
+            }),
+          }),
+        ),
+      ).not.toThrow();
+    });
+
+    it("does not throw when [auth.email.smtp] is absent from the input", () => {
+      expect(() =>
+        legacyValidateResolvedConfig(minimalInput({ auth: minimalAuthInput({ smtp: undefined }) })),
+      ).not.toThrow();
+    });
+
+    it("does not throw when auth carries no smtp data at all", () => {
+      // See the equivalent passkey note above — both collapse to `smtp: undefined` here.
+      expect(() =>
+        legacyValidateResolvedConfig(minimalInput({ auth: minimalAuthInput() })),
+      ).not.toThrow();
+    });
+
+    it("does not throw a present but incomplete [auth.email.smtp] table when auth is disabled", () => {
+      expect(() => legacyValidateResolvedConfig(minimalInput())).not.toThrow();
+    });
+  });
+
+  // config.go:1136-1138, checks @ 1453-1521 — auth.hook.*, caller pre-filters to enabled-only.
+  describe("auth.hook.*", () => {
+    it("rejects an enabled hook without a uri", () => {
+      expect(() =>
+        legacyValidateResolvedConfig(
+          minimalInput({
+            auth: minimalAuthInput({
+              hooks: [{ type: "custom_access_token", uri: "", secrets: "" }],
+            }),
+          }),
+        ),
+      ).toThrow("Missing required field in config: auth.hook.custom_access_token.uri");
+    });
+
+    it("rejects an http(s) hook uri without secrets", () => {
+      expect(() =>
+        legacyValidateResolvedConfig(
+          minimalInput({
+            auth: minimalAuthInput({
+              hooks: [
+                { type: "custom_access_token", uri: "https://example.test/hook", secrets: "" },
+              ],
+            }),
+          }),
+        ),
+      ).toThrow("Missing required field in config: auth.hook.custom_access_token.secrets");
+    });
+
+    it("rejects an http(s) hook secret that doesn't match Go's hookSecretPattern", () => {
+      expect(() =>
+        legacyValidateResolvedConfig(
+          minimalInput({
+            auth: minimalAuthInput({
+              hooks: [
+                {
+                  type: "custom_access_token",
+                  uri: "https://example.test/hook",
+                  secrets: "not-a-valid-secret",
+                },
+              ],
+            }),
+          }),
+        ),
+      ).toThrow(
+        'auth.hook.custom_access_token.secrets must be formatted as "v1,whsec_<base64_encoded_secret>"',
+      );
+    });
+
+    it("does not throw for a valid http(s) hook secret", () => {
+      expect(() =>
+        legacyValidateResolvedConfig(
+          minimalInput({
+            auth: minimalAuthInput({
+              hooks: [
+                {
+                  type: "custom_access_token",
+                  uri: "https://example.test/hook",
+                  secrets: `v1,whsec_${"a".repeat(32)}`,
+                },
+              ],
+            }),
+          }),
+        ),
+      ).not.toThrow();
+    });
+
+    it("rejects a pg-functions hook uri with secrets set", () => {
+      expect(() =>
+        legacyValidateResolvedConfig(
+          minimalInput({
+            auth: minimalAuthInput({
+              hooks: [
+                {
+                  type: "custom_access_token",
+                  uri: "pg-functions://postgres/public/hook",
+                  secrets: `v1,whsec_${"a".repeat(32)}`,
+                },
+              ],
+            }),
+          }),
+        ),
+      ).toThrow("auth.hook.custom_access_token.secrets is unsupported for pg-functions URI");
+    });
+
+    it("does not throw for a pg-functions hook uri without secrets", () => {
+      expect(() =>
+        legacyValidateResolvedConfig(
+          minimalInput({
+            auth: minimalAuthInput({
+              hooks: [
+                {
+                  type: "custom_access_token",
+                  uri: "pg-functions://postgres/public/hook",
+                  secrets: "",
+                },
+              ],
+            }),
+          }),
+        ),
+      ).not.toThrow();
+    });
+
+    it("rejects a hook uri with an unsupported scheme", () => {
+      expect(() =>
+        legacyValidateResolvedConfig(
+          minimalInput({
+            auth: minimalAuthInput({
+              hooks: [{ type: "custom_access_token", uri: "ftp://example.test/hook", secrets: "" }],
+            }),
+          }),
+        ),
+      ).toThrow("auth.hook.custom_access_token.uri should be a HTTP, HTTPS, or pg-functions URI");
+    });
+
+    // Go calls `url.Parse` before the scheme switch (config.go:1497-1499) and fails the whole
+    // load on a malformed URI, rather than treating any `http:`/`https:` prefix as valid.
+    it("rejects a hook uri that fails Go's url.Parse (malformed IPv6 host)", () => {
+      expect(() =>
+        legacyValidateResolvedConfig(
+          minimalInput({
+            auth: minimalAuthInput({
+              hooks: [{ type: "custom_access_token", uri: "http://[::1", secrets: "" }],
+            }),
+          }),
+        ),
+      ).toThrow("failed to parse template url:");
+    });
+
+    it("does not throw for a disabled hook, however incomplete", () => {
+      // The caller pre-filters to enabled-only hooks — a disabled hook is simply absent from
+      // `hooks`, matching an empty array here.
+      expect(() =>
+        legacyValidateResolvedConfig(minimalInput({ auth: minimalAuthInput({ hooks: [] }) })),
+      ).not.toThrow();
+    });
+
+    it("does not throw an enabled hook without a uri when auth is disabled", () => {
+      expect(() => legacyValidateResolvedConfig(minimalInput())).not.toThrow();
+    });
+  });
+
+  // config.go:1139-1141, checks @ 1523-1534 — auth.mfa.*, fixed totp/phone/web_authn order.
+  describe("auth.mfa.*", () => {
+    it.each([
+      ["totp", "auth.mfa.totp.enroll_enabled requires verify_enabled"],
+      ["phone", "auth.mfa.phone.enroll_enabled requires verify_enabled"],
+      ["web_authn", "auth.mfa.web_authn.enroll_enabled requires verify_enabled"],
+    ] as const)("rejects %s enroll_enabled without verify_enabled", (label, message) => {
+      expect(() =>
+        legacyValidateResolvedConfig(
+          minimalInput({
+            auth: minimalAuthInput({
+              mfa: [{ label, enrollEnabled: true, verifyEnabled: false }],
+            }),
+          }),
+        ),
+      ).toThrow(message);
+    });
+
+    it("does not throw when enroll_enabled and verify_enabled are both true", () => {
+      expect(() =>
+        legacyValidateResolvedConfig(
+          minimalInput({
+            auth: minimalAuthInput({
+              mfa: [{ label: "totp", enrollEnabled: true, verifyEnabled: true }],
+            }),
+          }),
+        ),
+      ).not.toThrow();
+    });
+
+    it("does not throw an enroll_enabled MFA factor without verify_enabled when auth is disabled", () => {
+      expect(() => legacyValidateResolvedConfig(minimalInput())).not.toThrow();
+    });
+  });
+
+  // config.go:1151-1153, checks @ 1635-1683 — auth.third_party.*, fixed provider order, caller
+  // pre-filters to enabled-only.
+  describe("auth.third_party.*", () => {
+    it("rejects firebase enabled without a project_id", () => {
+      expect(() =>
+        legacyValidateResolvedConfig(
+          minimalInput({
+            auth: minimalAuthInput({ thirdParty: [{ provider: "firebase", requiredField: "" }] }),
+          }),
+        ),
+      ).toThrow("Invalid config: auth.third_party.firebase is enabled but without a project_id.");
+    });
+
+    it("rejects auth0 enabled without a tenant", () => {
+      expect(() =>
+        legacyValidateResolvedConfig(
+          minimalInput({
+            auth: minimalAuthInput({ thirdParty: [{ provider: "auth0", requiredField: "" }] }),
+          }),
+        ),
+      ).toThrow("Invalid config: auth.third_party.auth0 is enabled but without a tenant.");
+    });
+
+    it("rejects aws_cognito enabled without a user_pool_id", () => {
+      expect(() =>
+        legacyValidateResolvedConfig(
+          minimalInput({
+            auth: minimalAuthInput({ thirdParty: [{ provider: "cognito", requiredField: "" }] }),
+          }),
+        ),
+      ).toThrow("Invalid config: auth.third_party.cognito is enabled but without a user_pool_id.");
+    });
+
+    it("rejects aws_cognito enabled with a user_pool_id but no user_pool_region", () => {
+      expect(() =>
+        legacyValidateResolvedConfig(
+          minimalInput({
+            auth: minimalAuthInput({
+              thirdParty: [
+                { provider: "cognito", requiredField: "pool-1", cognitoUserPoolRegion: undefined },
+              ],
+            }),
+          }),
+        ),
+      ).toThrow(
+        "Invalid config: auth.third_party.cognito is enabled but without a user_pool_region.",
+      );
+    });
+
+    it("rejects clerk enabled without a domain", () => {
+      expect(() =>
+        legacyValidateResolvedConfig(
+          minimalInput({
+            auth: minimalAuthInput({ thirdParty: [{ provider: "clerk", requiredField: "" }] }),
+          }),
+        ),
+      ).toThrow("Invalid config: auth.third_party.clerk is enabled but without a domain.");
+    });
+
+    it("rejects clerk enabled with a domain that doesn't match Go's clerkDomainPattern", () => {
+      expect(() =>
+        legacyValidateResolvedConfig(
+          minimalInput({
+            auth: minimalAuthInput({
+              thirdParty: [{ provider: "clerk", requiredField: "not-a-clerk-domain" }],
+            }),
+          }),
+        ),
+      ).toThrow("Invalid config: auth.third_party.clerk has invalid domain");
+    });
+
+    it("does not throw for a valid clerk.example.com domain", () => {
+      expect(() =>
+        legacyValidateResolvedConfig(
+          minimalInput({
+            auth: minimalAuthInput({
+              thirdParty: [{ provider: "clerk", requiredField: "clerk.example.com" }],
+            }),
+          }),
+        ),
+      ).not.toThrow();
+    });
+
+    it("rejects workos enabled without an issuer_url", () => {
+      expect(() =>
+        legacyValidateResolvedConfig(
+          minimalInput({
+            auth: minimalAuthInput({ thirdParty: [{ provider: "workos", requiredField: "" }] }),
+          }),
+        ),
+      ).toThrow("Invalid config: auth.third_party.workos is enabled but without a issuer_url.");
+    });
+
+    it("rejects more than one third_party provider enabled at once", () => {
+      expect(() =>
+        legacyValidateResolvedConfig(
+          minimalInput({
+            auth: minimalAuthInput({
+              thirdParty: [
+                { provider: "firebase", requiredField: "proj" },
+                { provider: "auth0", requiredField: "tenant" },
+              ],
+            }),
+          }),
+        ),
+      ).toThrow("Invalid config: Only one third_party provider allowed to be enabled at a time.");
+    });
+
+    it("does not throw when no third_party provider is enabled", () => {
+      expect(() =>
+        legacyValidateResolvedConfig(minimalInput({ auth: minimalAuthInput() })),
+      ).not.toThrow();
+    });
+
+    it("does not throw an enabled third_party provider missing its required field when auth is disabled", () => {
+      expect(() => legacyValidateResolvedConfig(minimalInput())).not.toThrow();
+    });
+  });
+
+  // config.go:1159-1163, pattern @ 1539-1544 — every [functions.*] key, unconditional, not
+  // gated on auth.enabled.
+  describe("functions.*", () => {
+    it("rejects a function slug Go's ValidateFunctionSlug refuses", () => {
+      expect(() => legacyValidateResolvedConfig(minimalInput({ functionSlugs: ["1bad"] }))).toThrow(
+        "Invalid Function name: 1bad.",
+      );
+    });
+
+    it("does not throw for a valid function slug", () => {
+      expect(() =>
+        legacyValidateResolvedConfig(minimalInput({ functionSlugs: ["hello-world_v2"] })),
+      ).not.toThrow();
+    });
+
+    it("does not throw when no functions are configured", () => {
+      expect(() => legacyValidateResolvedConfig(minimalInput())).not.toThrow();
+    });
+
+    it("rejects an invalid function slug even when auth is disabled", () => {
+      expect(() => legacyValidateResolvedConfig(minimalInput({ functionSlugs: ["1bad"] }))).toThrow(
+        "Invalid Function name: 1bad.",
+      );
+    });
+  });
+
+  // config.go:1006-1027 — only the "exactly one of cert/key set" presence rule; the actual
+  // file reads and the disabled-skip/env-override tests stay in
+  // legacy-local-config-values.unit.test.ts.
+  describe("api.tls", () => {
+    it("rejects cert_path set without key_path", () => {
+      expect(() =>
+        legacyValidateResolvedConfig(
+          minimalInput({
+            api: {
+              enabled: true,
+              port: 54321,
+              tls: { enabled: true, certPath: "cert.pem", keyPath: undefined },
+            },
+          }),
+        ),
+      ).toThrow("Missing required field in config: api.tls.key_path");
+    });
+
+    it("rejects key_path set without cert_path", () => {
+      expect(() =>
+        legacyValidateResolvedConfig(
+          minimalInput({
+            api: {
+              enabled: true,
+              port: 54321,
+              tls: { enabled: true, certPath: undefined, keyPath: "key.pem" },
+            },
+          }),
+        ),
+      ).toThrow("Missing required field in config: api.tls.cert_path");
+    });
+  });
+
+  // Direct-shared-level regression/divergence coverage (Part C) — behavior that's either new
+  // (the D fix) or only meaningfully testable at this exact layer (the captcha enum), not a
+  // move from either caller's own suite.
+  describe("Config.Validate divergence regression coverage", () => {
+    it("throws the Go-parity missing-required message for db.major_version = 0 (regression for the D fix in 0c62a914)", () => {
+      // D used to fall through to the generic "Invalid db.major_version: 0" message; both D
+      // and L now go through this exact branch, so pin it directly here too, not just via
+      // D's/L's own suites.
+      expect(() =>
+        legacyValidateResolvedConfig({ ...minimalInput(), db: { port: 5432, majorVersion: 0 } }),
+      ).toThrow("Missing required field in config: db.major_version");
+    });
+
+    it("throws Go's decode-time enum message for an invalid auth.captcha.provider, regardless of enabled", () => {
+      // This scenario is only meaningful at this direct shared-validator level: it's
+      // unreachable through L's real ProjectConfig-typed flow — `@supabase/config`'s schema
+      // (packages/config/src/auth/captcha.ts, stringEnum(["hcaptcha", "turnstile"])) already
+      // narrows `provider` to "hcaptcha" | "turnstile" | undefined before it ever reaches
+      // `legacyResolveLocalConfigValues`, so an invalid provider value would fail schema
+      // decoding first, on a completely different code path. D's real TOML flow CAN reach
+      // this branch (an untyped raw string) — D's own suite
+      // (`legacy-db-config.toml-read.unit.test.ts`) covers that separately. This test's job is
+      // only to pin the shared function's own behavior directly.
+      expect(() =>
+        legacyValidateResolvedConfig(
+          minimalInput({
+            auth: minimalAuthInput({
+              captcha: { enabled: false, provider: "not-a-real-provider", secret: undefined },
+            }),
+          }),
+        ),
+      ).toThrow(
+        "failed to parse config: decoding failed due to the following error(s):\n\n'auth.captcha.provider' must be one of [hcaptcha turnstile]",
+      );
+    });
+  });
+});
diff --git a/apps/cli/src/legacy/shared/legacy-connect-errors.ts b/apps/cli/src/legacy/shared/legacy-connect-errors.ts
index 504deb471e..5a269abf87 100644
--- a/apps/cli/src/legacy/shared/legacy-connect-errors.ts
+++ b/apps/cli/src/legacy/shared/legacy-connect-errors.ts
@@ -51,6 +51,97 @@ export function legacyIsIPv6ConnectivityError(message: string): boolean {
   return false;
 }
 
+/**
+ * Go's `utils.SuggestEnvVar` (`internal/utils/connect.go:191`): the hint shown when
+ * a connection fails on password authentication, pointing users at the
+ * `SUPABASE_DB_PASSWORD` env var.
+ */
+export const LEGACY_SUGGEST_ENV_VAR =
+  "Connect to your database by setting the env var correctly: SUPABASE_DB_PASSWORD";
+
+/** Context the connect-suggestion needs but cannot derive from the error alone. */
+export interface LegacyConnectSuggestionContext {
+  /** Active profile's dashboard URL (Go's `CurrentProfile.DashboardURL`). */
+  readonly dashboardUrl: string;
+  /** Active profile name (Go's `CurrentProfile.Name`). */
+  readonly profileName: string;
+  /** Whether `--debug` is set (Go's `viper.GetBool("DEBUG")`). */
+  readonly debug: boolean;
+}
+
+/**
+ * Flatten an error's `cause` chain and any `AggregateError.errors` into a single
+ * searchable string of every nested `message` and `code`. The `@effect/sql`
+ * `SqlError` wraps the node-postgres / node `net` driver error on its `cause`; a
+ * multi-address dial wraps an `AggregateError` whose `errors[]` carry the per-IP
+ * `ECONNREFUSED` / `ENETUNREACH` system errors. Including the `code` strings lets
+ * the matcher key off node's `ECONNREFUSED` the way Go keys off pgconn's
+ * `connect: connection refused`.
+ */
+function legacyCollectConnectErrorText(error: unknown): string {
+  const parts: string[] = [];
+  const seen = new Set<unknown>();
+  const visit = (node: unknown, depth: number): void => {
+    if (depth > 8 || typeof node !== "object" || node === null || seen.has(node)) return;
+    seen.add(node);
+    const message = Reflect.get(node, "message");
+    if (typeof message === "string") parts.push(message);
+    const code = Reflect.get(node, "code");
+    if (typeof code === "string") parts.push(code);
+    visit(Reflect.get(node, "cause"), depth + 1);
+    const errors = Reflect.get(node, "errors");
+    if (Array.isArray(errors)) for (const child of errors) visit(child, depth + 1);
+  };
+  visit(error, 0);
+  return parts.join("\n");
+}
+
+/**
+ * Port of Go's `SetConnectSuggestion` (`internal/utils/connect.go:313-335`): map a
+ * Postgres connect failure to an actionable hint that replaces the generic
+ * "Try rerunning the command with --debug" suggestion. Go matches `pgconn`'s
+ * error text; this matches the equivalent node-postgres / node `net` driver text
+ * and codes (e.g. `ECONNREFUSED` for `connect: connection refused`) gathered from
+ * the `SqlError` cause/aggregate chain. The branch order mirrors Go's `if/else if`.
+ * Returns `undefined` when no specific suggestion applies (the caller then falls
+ * back to the generic suggestion, like Go leaving `CmdSuggestion` empty).
+ */
+export function legacyConnectSuggestion(
+  error: unknown,
+  ctx: LegacyConnectSuggestionContext,
+): string | undefined {
+  const text = legacyCollectConnectErrorText(error);
+  // connect: connection refused / Address not in tenant allow_list → network restrictions.
+  if (
+    text.includes("ECONNREFUSED") ||
+    text.includes("connection refused") ||
+    text.includes("Address not in tenant allow_list")
+  ) {
+    return `Make sure your local IP is allowed in Network Restrictions and Network Bans.\n${ctx.dashboardUrl}/project/_/database/settings`;
+  }
+  // SSL connection is required (only under --debug, which disables TLS).
+  if (text.includes("SSL connection is required") && ctx.debug) {
+    return "SSL connection is not supported with --debug flag";
+  }
+  // Wrong password (Go: "SCRAM exchange: Wrong password" / "failed SASL auth";
+  // node-postgres surfaces the server's `28P01` "password authentication failed").
+  if (
+    text.includes("SCRAM exchange: Wrong password") ||
+    text.includes("failed SASL auth") ||
+    text.includes("password authentication failed")
+  ) {
+    return LEGACY_SUGGEST_ENV_VAR;
+  }
+  if (legacyIsIPv6ConnectivityError(text)) {
+    return legacyIpv6Suggestion();
+  }
+  // no route to host / Tenant or user not found → wrong profile.
+  if (text.includes("no route to host") || text.includes("Tenant or user not found")) {
+    return `Make sure your project exists on profile: ${ctx.profileName}`;
+  }
+  return undefined;
+}
+
 function hasStringCode(error: unknown): error is {
   readonly code: string;
   readonly address?: unknown;
diff --git a/apps/cli/src/legacy/shared/legacy-connect-errors.unit.test.ts b/apps/cli/src/legacy/shared/legacy-connect-errors.unit.test.ts
index 05ff60186c..844cda45e0 100644
--- a/apps/cli/src/legacy/shared/legacy-connect-errors.unit.test.ts
+++ b/apps/cli/src/legacy/shared/legacy-connect-errors.unit.test.ts
@@ -1,6 +1,9 @@
 import { describe, expect, it } from "vitest";
 
 import {
+  LEGACY_SUGGEST_ENV_VAR,
+  legacyConnectSuggestion,
+  legacyIpv6Suggestion,
   legacyIsIPv6ConnectivityError,
   legacyIsIPv6ConnectivityErrorCause,
 } from "./legacy-connect-errors.ts";
@@ -44,6 +47,77 @@ describe("legacyIsIPv6ConnectivityError", () => {
   });
 });
 
+describe("legacyConnectSuggestion", () => {
+  const ctx = {
+    dashboardUrl: "https://supabase.com/dashboard",
+    profileName: "supabase",
+    debug: false,
+  } as const;
+
+  // The @effect/sql SqlError wraps the node driver error on `.cause`; a multi-address
+  // dial wraps an AggregateError whose `.errors[]` carry the per-IP system errors.
+  const sqlError = (cause: unknown) =>
+    Object.assign(new Error("PgClient: Failed to connect"), { cause });
+  const systemError = (message: string, code: string) =>
+    Object.assign(new Error(message), { code });
+
+  it("maps a refused connection (node ECONNREFUSED) to the network-restrictions hint", () => {
+    const err = sqlError(systemError("connect ECONNREFUSED 127.0.0.1:54322", "ECONNREFUSED"));
+    expect(legacyConnectSuggestion(err, ctx)).toBe(
+      "Make sure your local IP is allowed in Network Restrictions and Network Bans.\nhttps://supabase.com/dashboard/project/_/database/settings",
+    );
+  });
+
+  it("maps an AggregateError of refused dials to the network-restrictions hint", () => {
+    const err = sqlError(
+      Object.assign(new AggregateError([], "all attempts failed"), {
+        errors: [systemError("connect ECONNREFUSED [::1]:54322", "ECONNREFUSED")],
+      }),
+    );
+    expect(legacyConnectSuggestion(err, ctx)).toContain(
+      "Make sure your local IP is allowed in Network Restrictions and Network Bans.",
+    );
+  });
+
+  it("maps the pooler allow_list rejection to the network-restrictions hint", () => {
+    const err = sqlError(new Error("Address not in tenant allow_list"));
+    expect(legacyConnectSuggestion(err, ctx)).toContain("Network Restrictions and Network Bans");
+  });
+
+  it("maps a password-auth failure to the env-var suggestion", () => {
+    const err = sqlError(
+      Object.assign(new Error('password authentication failed for user "postgres"'), {
+        code: "28P01",
+      }),
+    );
+    expect(legacyConnectSuggestion(err, ctx)).toBe(LEGACY_SUGGEST_ENV_VAR);
+  });
+
+  it("suggests the --debug SSL note only under --debug", () => {
+    const err = sqlError(new Error("SSL connection is required"));
+    expect(legacyConnectSuggestion(err, ctx)).toBeUndefined();
+    expect(legacyConnectSuggestion(err, { ...ctx, debug: true })).toBe(
+      "SSL connection is not supported with --debug flag",
+    );
+  });
+
+  it("maps an IPv6-only connectivity failure to the IPv6 pooler suggestion", () => {
+    const err = sqlError(new Error("dial tcp: network is unreachable"));
+    expect(legacyConnectSuggestion(err, ctx)).toBe(legacyIpv6Suggestion());
+  });
+
+  it("maps a tenant-not-found error to the wrong-profile hint", () => {
+    const err = sqlError(new Error("Tenant or user not found"));
+    expect(legacyConnectSuggestion(err, ctx)).toBe(
+      "Make sure your project exists on profile: supabase",
+    );
+  });
+
+  it("returns undefined for an unrecognized connect error", () => {
+    expect(legacyConnectSuggestion(sqlError(new Error("some other failure")), ctx)).toBeUndefined();
+  });
+});
+
 describe("legacyIsIPv6ConnectivityErrorCause", () => {
   it("classifies Node getaddrinfo and network-unreachable errors", () => {
     expect(
diff --git a/apps/cli/src/legacy/shared/legacy-container-cli.ts b/apps/cli/src/legacy/shared/legacy-container-cli.ts
index 3bf5f4244f..53bfb6e947 100644
--- a/apps/cli/src/legacy/shared/legacy-container-cli.ts
+++ b/apps/cli/src/legacy/shared/legacy-container-cli.ts
@@ -1,4 +1,4 @@
-import { Effect } from "effect";
+import { Data, Effect, Stream } from "effect";
 import * as ChildProcess from "effect/unstable/process/ChildProcess";
 import { ChildProcessSpawner } from "effect/unstable/process/ChildProcessSpawner";
 
@@ -14,6 +14,36 @@ import { ChildProcessSpawner } from "effect/unstable/process/ChildProcessSpawner
 
 type Spawner = ChildProcessSpawner["Service"];
 
+/**
+ * Raised when neither `docker` nor `podman` can be spawned at all (e.g. neither
+ * is installed or on `PATH`) — distinct from a spawned process exiting non-zero.
+ * Not exported: callers never need to match on this type directly, they fold it
+ * into their own tagged error via {@link legacyDescribeContainerCliFailure} so
+ * the "no runtime found" root cause survives instead of collapsing into a
+ * generic "failed to ..." message.
+ */
+class LegacyContainerRuntimeNotFoundError extends Data.TaggedError(
+  "LegacyContainerRuntimeNotFoundError",
+)<{
+  readonly message: string;
+}> {}
+
+const RUNTIME_NOT_FOUND_MESSAGE =
+  "docker: command not found (podman also not found) — install Docker Desktop or Podman and ensure it is on PATH";
+
+/**
+ * Renders a caller-facing suffix for a `spawnContainerCli`/`containerCliExitCode`
+ * failure: the clear "neither runtime found" message when that's the cause,
+ * otherwise the underlying cause's own message (falling back to `String(cause)`
+ * for non-`Error` causes) so callers never collapse a real failure reason into a
+ * bare, uninformative "failed to ..." string.
+ */
+export function legacyDescribeContainerCliFailure(cause: unknown): string {
+  if (cause instanceof LegacyContainerRuntimeNotFoundError) return cause.message;
+  if (cause instanceof Error) return cause.message;
+  return String(cause);
+}
+
 /**
  * Spawn a container-CLI command and return the process handle. Use when the
  * caller needs to read stdout/stderr or await the exit code itself.
@@ -25,17 +55,115 @@ export const spawnContainerCli = (
 ) =>
   spawner
     .spawn(ChildProcess.make("docker", args, options))
-    .pipe(Effect.catch(() => spawner.spawn(ChildProcess.make("podman", args, options))));
+    .pipe(
+      Effect.catch(() =>
+        spawner
+          .spawn(ChildProcess.make("podman", args, options))
+          .pipe(
+            Effect.catch(() =>
+              Effect.fail(
+                new LegacyContainerRuntimeNotFoundError({ message: RUNTIME_NOT_FOUND_MESSAGE }),
+              ),
+            ),
+          ),
+      ),
+    );
 
 /**
  * Run a container-CLI command and resolve to its exit code, mirroring the
  * spawner's `exitCode` convenience for callers that only need the status.
+ *
+ * `podmanArgs` lets a caller pass different argv to the Podman fallback than to
+ * Docker, for the rare case where the two aren't drop-in compatible on a given
+ * subcommand (e.g. `volume prune --all` — Docker-only, see
+ * `stop.handler.ts`'s volume-prune call). Defaults to reusing `args` unchanged,
+ * which is correct for every other call site.
  */
 export const containerCliExitCode = (
   spawner: Spawner,
   args: ReadonlyArray<string>,
   options?: ChildProcess.CommandOptions,
+  podmanArgs?: ReadonlyArray<string>,
 ) =>
   spawner
     .exitCode(ChildProcess.make("docker", args, options))
-    .pipe(Effect.catch(() => spawner.exitCode(ChildProcess.make("podman", args, options))));
+    .pipe(
+      Effect.catch(() =>
+        spawner
+          .exitCode(ChildProcess.make("podman", podmanArgs ?? args, options))
+          .pipe(
+            Effect.catch(() =>
+              Effect.fail(
+                new LegacyContainerRuntimeNotFoundError({ message: RUNTIME_NOT_FOUND_MESSAGE }),
+              ),
+            ),
+          ),
+      ),
+    );
+
+function collectDockerCliText(stream: Stream.Stream<Uint8Array, unknown>) {
+  const decoder = new TextDecoder();
+  return Stream.runFold(
+    stream,
+    () => "",
+    (text, chunk) => text + decoder.decode(chunk, { stream: true }),
+  ).pipe(Effect.map((text) => text + decoder.decode()));
+}
+
+/**
+ * Mirrors Go's `versions.GreaterThanOrEqualTo` (`docker/api/types/versions`,
+ * used by `apps/cli-go/internal/utils/docker.go:128`): splits each version on
+ * `.` and compares the parts numerically, component by component — not a
+ * naive string/float compare, which would misorder e.g. `"1.9"` vs `"1.10"`.
+ */
+function isDockerApiVersionAtLeast(version: string, minVersion: string): boolean {
+  const parts = version.split(".").map((part) => Number.parseInt(part, 10));
+  const minParts = minVersion.split(".").map((part) => Number.parseInt(part, 10));
+  for (let index = 0; index < Math.max(parts.length, minParts.length); index++) {
+    const part = parts[index] ?? 0;
+    const minPart = minParts[index] ?? 0;
+    if (part !== minPart) return part > minPart;
+  }
+  return true;
+}
+
+/**
+ * Docker CLI's own `volume prune --all` flag is annotated `version: "1.42"`
+ * (vendored `docker/cli@v28.5.2` `cli/command/volume/prune.go:53`) and
+ * enforced by Cobra's `Args` validator *before* `RunE` runs
+ * (`cmd/docker/docker.go:659-660`): against a daemon with a lower negotiated
+ * API version, `docker volume prune --all ...` exits nonzero without pruning
+ * anything at all, rather than degrading gracefully. Go avoids ever hitting
+ * that by gating the equivalent `all=true` filter on
+ * `Docker.ClientVersion() >= "1.42"` (`docker.go:126-133`); there is no
+ * persistent Engine API client here to ask, so this asks the `docker` CLI
+ * itself via `docker version`.
+ *
+ * Deliberately does not fall back to Podman like {@link containerCliExitCode}
+ * does: Podman's `volume prune` never has an `--all` flag to gate in the
+ * first place (callers already omit it from their Podman argv
+ * unconditionally), so this check is meaningless on that path. Resolves to
+ * `false` (omit `--all`, matching how a pre-1.42 daemon's own `volume prune`
+ * already prunes every unused volume without it) whenever `docker` can't be
+ * spawned, its `version` call fails, or the reported version can't be read —
+ * the side that can never turn into a hard failure of the prune call itself.
+ */
+export const legacyDockerSupportsVolumePruneAllFlag = (spawner: Spawner) =>
+  Effect.scoped(
+    Effect.gen(function* () {
+      const child = yield* spawner.spawn(
+        ChildProcess.make("docker", ["version", "--format", "{{.Server.APIVersion}}"], {
+          stdin: "ignore",
+          stdout: "pipe",
+          stderr: "ignore",
+        }),
+      );
+      const [exitCode, stdout] = yield* Effect.all(
+        [child.exitCode.pipe(Effect.map(Number)), collectDockerCliText(child.stdout)],
+        { concurrency: "unbounded" },
+      );
+      if (exitCode !== 0) return false;
+      const version = stdout.trim();
+      return version.length > 0 && isDockerApiVersionAtLeast(version, "1.42");
+    }),
+  ).pipe(Effect.orElseSucceed(() => false));
diff --git a/apps/cli/src/legacy/shared/legacy-container-cli.unit.test.ts b/apps/cli/src/legacy/shared/legacy-container-cli.unit.test.ts
index 7c6f97aeca..e80dbf5ae8 100644
--- a/apps/cli/src/legacy/shared/legacy-container-cli.unit.test.ts
+++ b/apps/cli/src/legacy/shared/legacy-container-cli.unit.test.ts
@@ -2,9 +2,21 @@ import { describe, expect, it } from "@effect/vitest";
 import { Deferred, Effect, PlatformError, Sink, Stream } from "effect";
 import { ChildProcessSpawner } from "effect/unstable/process";
 
-import { containerCliExitCode, spawnContainerCli } from "./legacy-container-cli.ts";
+import {
+  containerCliExitCode,
+  legacyDescribeContainerCliFailure,
+  legacyDockerSupportsVolumePruneAllFlag,
+  spawnContainerCli,
+} from "./legacy-container-cli.ts";
 
-function mockSpawner(opts: { readonly dockerMissing?: boolean; readonly exitCode?: number } = {}) {
+function mockSpawner(
+  opts: {
+    readonly dockerMissing?: boolean;
+    readonly bothMissing?: boolean;
+    readonly exitCode?: number;
+    readonly stdout?: string;
+  } = {},
+) {
   const spawned: Array<{ readonly command: string; readonly args: ReadonlyArray<string> }> = [];
 
   const spawner = ChildProcessSpawner.make((command) =>
@@ -13,13 +25,13 @@ function mockSpawner(opts: { readonly dockerMissing?: boolean; readonly exitCode
       const args = command._tag === "StandardCommand" ? command.args : [];
       spawned.push({ command: cmd, args });
 
-      if (opts.dockerMissing && cmd === "docker") {
+      if ((opts.dockerMissing && cmd === "docker") || opts.bothMissing === true) {
         return yield* Effect.fail(
           PlatformError.systemError({
             _tag: "NotFound",
             module: "ChildProcess",
             method: "spawn",
-            description: "docker not found",
+            description: `${cmd} not found`,
           }),
         );
       }
@@ -29,7 +41,10 @@ function mockSpawner(opts: { readonly dockerMissing?: boolean; readonly exitCode
 
       return ChildProcessSpawner.makeHandle({
         pid: ChildProcessSpawner.ProcessId(1),
-        stdout: Stream.empty,
+        stdout:
+          opts.stdout !== undefined
+            ? Stream.fromIterable([new TextEncoder().encode(opts.stdout)])
+            : Stream.empty,
         stderr: Stream.empty,
         all: Stream.empty,
         exitCode: Deferred.await(exitDeferred),
@@ -98,4 +113,108 @@ describe("containerCliExitCode", () => {
       }),
     );
   });
+
+  it.live("fails with a clear message when neither docker nor podman can be spawned", () => {
+    const mock = mockSpawner({ bothMissing: true });
+    return containerCliExitCode(mock.spawner, ["image", "inspect", "img"]).pipe(
+      Effect.flip,
+      Effect.map((error) => {
+        expect(legacyDescribeContainerCliFailure(error)).toBe(
+          "docker: command not found (podman also not found) — install Docker Desktop or Podman and ensure it is on PATH",
+        );
+      }),
+    );
+  });
+});
+
+describe("legacyDockerSupportsVolumePruneAllFlag", () => {
+  it.live("returns true when the daemon reports an API version at or above 1.42", () => {
+    const mock = mockSpawner({ stdout: "1.42" });
+    return legacyDockerSupportsVolumePruneAllFlag(mock.spawner).pipe(
+      Effect.map((supportsAll) => {
+        expect(supportsAll).toBe(true);
+        expect(mock.spawned).toEqual([
+          { command: "docker", args: ["version", "--format", "{{.Server.APIVersion}}"] },
+        ]);
+      }),
+    );
+  });
+
+  it.live("returns true for a version comfortably above 1.42", () => {
+    const mock = mockSpawner({ stdout: "1.51" });
+    return legacyDockerSupportsVolumePruneAllFlag(mock.spawner).pipe(
+      Effect.map((supportsAll) => {
+        expect(supportsAll).toBe(true);
+      }),
+    );
+  });
+
+  it.live("returns false when the daemon reports an API version below 1.42", () => {
+    const mock = mockSpawner({ stdout: "1.41" });
+    return legacyDockerSupportsVolumePruneAllFlag(mock.spawner).pipe(
+      Effect.map((supportsAll) => {
+        expect(supportsAll).toBe(false);
+      }),
+    );
+  });
+
+  it.live("compares version components numerically, not lexicographically", () => {
+    // A naive string compare would misorder "1.9" as greater than "1.42" — this
+    // guards the numeric, component-by-component comparison instead.
+    const mock = mockSpawner({ stdout: "1.9" });
+    return legacyDockerSupportsVolumePruneAllFlag(mock.spawner).pipe(
+      Effect.map((supportsAll) => {
+        expect(supportsAll).toBe(false);
+      }),
+    );
+  });
+
+  it.live("returns false when the version command exits non-zero", () => {
+    const mock = mockSpawner({ exitCode: 1, stdout: "1.51" });
+    return legacyDockerSupportsVolumePruneAllFlag(mock.spawner).pipe(
+      Effect.map((supportsAll) => {
+        expect(supportsAll).toBe(false);
+      }),
+    );
+  });
+
+  it.live("returns false when the reported version is empty", () => {
+    const mock = mockSpawner({ stdout: "" });
+    return legacyDockerSupportsVolumePruneAllFlag(mock.spawner).pipe(
+      Effect.map((supportsAll) => {
+        expect(supportsAll).toBe(false);
+      }),
+    );
+  });
+
+  it.live("returns false without falling back to podman when docker cannot be spawned", () => {
+    const mock = mockSpawner({ dockerMissing: true });
+    return legacyDockerSupportsVolumePruneAllFlag(mock.spawner).pipe(
+      Effect.map((supportsAll) => {
+        expect(supportsAll).toBe(false);
+        expect(mock.spawned.map((entry) => entry.command)).toEqual(["docker"]);
+      }),
+    );
+  });
+});
+
+describe("legacyDescribeContainerCliFailure", () => {
+  it.live("describes a both-runtimes-missing failure with its clear message", () => {
+    const mock = mockSpawner({ bothMissing: true });
+    return containerCliExitCode(mock.spawner, ["ps"]).pipe(
+      Effect.flip,
+      Effect.map((error) => {
+        expect(legacyDescribeContainerCliFailure(error)).toContain("docker: command not found");
+      }),
+    );
+  });
+
+  it("falls back to an Error instance's own message", () => {
+    expect(legacyDescribeContainerCliFailure(new Error("boom"))).toBe("boom");
+  });
+
+  it("stringifies a non-Error cause", () => {
+    expect(legacyDescribeContainerCliFailure("boom")).toBe("boom");
+    expect(legacyDescribeContainerCliFailure(42)).toBe("42");
+  });
 });
diff --git a/apps/cli/src/legacy/shared/legacy-db-config.integration.test.ts b/apps/cli/src/legacy/shared/legacy-db-config.integration.test.ts
index 78549ac06f..c277d2930e 100644
--- a/apps/cli/src/legacy/shared/legacy-db-config.integration.test.ts
+++ b/apps/cli/src/legacy/shared/legacy-db-config.integration.test.ts
@@ -158,6 +158,13 @@ describe("legacyDbConfigResolver (local + db-url)", () => {
             user: "postgres",
             password: "hunter2",
             database: "postgres",
+            // The resolver attaches the connect-failure suggestion context (Go's
+            // ambient CurrentProfile) to every resolved connection.
+            suggestionContext: {
+              dashboardUrl: "https://supabase.com/dashboard",
+              profileName: "supabase",
+              debug: false,
+            },
           });
           expect(r.isLocal).toBe(true);
           rmSync(dir, { recursive: true, force: true });
@@ -206,6 +213,11 @@ describe("legacyDbConfigResolver (local + db-url)", () => {
             user: "alice",
             password: "p@ss",
             database: "appdb",
+            suggestionContext: {
+              dashboardUrl: "https://supabase.com/dashboard",
+              profileName: "supabase",
+              debug: false,
+            },
           });
           expect(r.isLocal).toBe(false);
           rmSync(dir, { recursive: true, force: true });
@@ -495,6 +507,11 @@ describe("legacyDbConfigResolver (linked config ordering)", () => {
             user: `cli_login_role.${adHocRef}`,
             password: "temporary-role-password",
             database: "postgres",
+            suggestionContext: {
+              dashboardUrl: "https://supabase.com/dashboard",
+              profileName: "supabase",
+              debug: false,
+            },
           });
           expect(r.ref).toEqual(Option.some(adHocRef));
           expect(requests).toEqual([
@@ -648,6 +665,11 @@ describe("legacyDbConfigResolver (linked config ordering)", () => {
                 user: `cli_login_role.${adHocRef}`,
                 password: "temporary-role-password",
                 database: "postgres",
+                suggestionContext: {
+                  dashboardUrl: "https://supabase.com/dashboard",
+                  profileName: "supabase",
+                  debug: false,
+                },
               });
             }
             expect(requests).toEqual([
@@ -785,6 +807,11 @@ describe("legacyDbConfigResolver (linked config ordering)", () => {
               user: `postgres.${linkedRef}`,
               password: "linked-password",
               database: "postgres",
+              suggestionContext: {
+                dashboardUrl: "https://supabase.com/dashboard",
+                profileName: "supabase",
+                debug: false,
+              },
             });
           }
           expect(requests).toEqual([
diff --git a/apps/cli/src/legacy/shared/legacy-db-config.layer.ts b/apps/cli/src/legacy/shared/legacy-db-config.layer.ts
index 9bc7e00f45..45714feb97 100644
--- a/apps/cli/src/legacy/shared/legacy-db-config.layer.ts
+++ b/apps/cli/src/legacy/shared/legacy-db-config.layer.ts
@@ -20,6 +20,10 @@ import { RuntimeInfo } from "../../shared/runtime/runtime-info.service.ts";
 import { Tty } from "../../shared/runtime/tty.service.ts";
 import { Analytics } from "../../shared/telemetry/analytics.service.ts";
 import { TelemetryRuntime } from "../../shared/telemetry/runtime.service.ts";
+import {
+  type LegacyConnectSuggestionContext,
+  LEGACY_SUGGEST_ENV_VAR,
+} from "./legacy-connect-errors.ts";
 import { LegacyDbConnection, type LegacyPgConnInput } from "./legacy-db-connection.service.ts";
 import { LegacyIdentityStitch } from "./legacy-identity-stitch.ts";
 import {
@@ -44,9 +48,6 @@ const TCP_PROBE_TIMEOUT = Duration.seconds(5);
 const MAX_RETRIES = 8;
 const BACKOFF_INITIAL = Duration.seconds(3);
 const BACKOFF_MAX = Duration.seconds(60);
-// Go: utils.SuggestEnvVar (`apps/cli-go/internal/utils/connect.go:174`).
-const SUGGEST_ENV_VAR =
-  "Connect to your database by setting the env var correctly: SUPABASE_DB_PASSWORD";
 
 const loginRoleErrorMapper = mapLegacyHttpError({
   networkError: Errors.LegacyDbConfigLoginRoleNetworkError,
@@ -106,6 +107,16 @@ export const legacyDbConfigLayer = Layer.effect(
     const fs = yield* FileSystem.FileSystem;
     const path = yield* Path.Path;
 
+    // Profile context for the connect-failure suggestion (Go's `SetConnectSuggestion`
+    // reads the ambient `CurrentProfile` + `viper.GetBool("DEBUG")`). Snapshot it once
+    // and attach it to every resolved connection so the driver layer can render Go's
+    // hint on a refused/auth/IPv6 connect error.
+    const suggestionContext: LegacyConnectSuggestionContext = {
+      dashboardUrl: cliConfig.dashboardUrl,
+      profileName: cliConfig.profile,
+      debug: yield* LegacyDebugFlag,
+    };
+
     // Capture the ambient services the Management API stack needs, so the
     // lazily-built linked stack is fully self-provided and `resolve`'s R stays
     // `never` (handler tests can mock this resolver without wiring the whole
@@ -203,7 +214,7 @@ export const legacyDbConfigLayer = Layer.effect(
               return Effect.fail(
                 new Errors.LegacyDbConfigConnectTempRoleError({
                   message: `failed to connect as temp role: ${cause.message}`,
-                  suggestion: SUGGEST_ENV_VAR,
+                  suggestion: LEGACY_SUGGEST_ENV_VAR,
                 }),
               );
             }
@@ -549,6 +560,18 @@ export const legacyDbConfigLayer = Layer.effect(
         );
       });
 
-    return LegacyDbConfigResolver.of({ resolve, resolvePoolerFallback });
+    // Attach the connect-failure suggestion context to every resolved connection in
+    // one place (Go sets it ambiently via `CurrentProfile`), so each connecting
+    // command inherits Go's `SetConnectSuggestion` hint without per-call-site wiring.
+    const withSuggestion = (conn: LegacyPgConnInput): LegacyPgConnInput => ({
+      ...conn,
+      suggestionContext,
+    });
+    return LegacyDbConfigResolver.of({
+      resolve: (flags) =>
+        resolve(flags).pipe(Effect.map((r) => ({ ...r, conn: withSuggestion(r.conn) }))),
+      resolvePoolerFallback: (flags) =>
+        resolvePoolerFallback(flags).pipe(Effect.map(Option.map(withSuggestion))),
+    });
   }),
 );
diff --git a/apps/cli/src/legacy/shared/legacy-db-config.toml-read.ts b/apps/cli/src/legacy/shared/legacy-db-config.toml-read.ts
index 0e4bc28028..77c95dd3b0 100644
--- a/apps/cli/src/legacy/shared/legacy-db-config.toml-read.ts
+++ b/apps/cli/src/legacy/shared/legacy-db-config.toml-read.ts
@@ -1,7 +1,30 @@
 import { Effect, type FileSystem, Option, type Path } from "effect";
 import * as SmolToml from "smol-toml";
+import {
+  LEGACY_PROJECT_REF_PATTERN,
+  type LegacyAnalyticsInput,
+  type LegacyAuthInput,
+  type LegacyCaptchaInput,
+  type LegacyConfigValidationInput,
+  type LegacyDbInput,
+  legacyEmailContentPathReadErrorMessage,
+  type LegacyExperimentalInput,
+  type LegacyHookInput,
+  type LegacyMfaFactorInput,
+  legacyParseGoBool,
+  type LegacyPasskeyInput,
+  legacyResolveEmailTemplateContentPath,
+  legacyResolveSigningKeysPath,
+  legacySigningKeysDecodeErrorMessage,
+  legacySigningKeysReadErrorMessage,
+  type LegacySmtpInput,
+  type LegacyThirdPartyInput,
+  legacyValidateResolvedConfig,
+} from "./legacy-config-validate.ts";
 import { LegacyDbConfigLoadError } from "./legacy-db-config.errors.ts";
 import { parseDotEnv } from "./legacy-dotenv.ts";
+import { legacyStrToArr } from "./legacy-local-config-values.ts";
+import { ramInBytes } from "./legacy-size-units.ts";
 import {
   legacyCollectDotenvPrivateKeys,
   legacyDecryptSecret,
@@ -22,6 +45,7 @@ type EnvLookup = (name: string) => string | undefined;
  * and aborts the command rather than running against the default local database).
  */
 interface LegacyDbTomlValues {
+  readonly projectEnv: Readonly<Record<string, string>>;
   /**
    * Resolves a `SUPABASE_*` env var with Go's precedence: shell env (non-empty)
    * wins, then the loaded project `.env*` files (non-empty), else undefined.
@@ -30,6 +54,7 @@ interface LegacyDbTomlValues {
    * rather than `process.env` alone (e.g. `SUPABASE_EXPERIMENTAL_PG_DELTA`).
    */
   readonly envLookup: (name: string) => string | undefined;
+  readonly apiSchemas: ReadonlyArray<string>;
   /** `[db] port`, default 54322 (`packages/config/src/db.ts`). */
   readonly port: number;
   /** `[db] shadow_port`, default 54320. */
@@ -77,6 +102,11 @@ interface LegacyDbTomlValues {
   readonly seed: LegacyDbSeedTomlConfig;
   /** `[db.vault]` secrets (name → resolved value) — upserted by `up`/`down`. */
   readonly vault: ReadonlyArray<LegacyDbVaultSecretToml>;
+  /**
+   * The matched `[remotes.<name>]` block name when a linked ref merged its override
+   * (Go's `Loading config override: [remotes.<name>]` line), else `undefined`.
+   */
+  readonly appliedRemote: string | undefined;
 }
 
 /** `[db.seed]` config surfaced for `migration down`'s seed step. */
@@ -143,6 +173,7 @@ const DEFAULT_PORT = 54322;
 const DEFAULT_SHADOW_PORT = 54320;
 const DEFAULT_MAJOR_VERSION = 17;
 const DEFAULT_PASSWORD = "postgres";
+const DEFAULT_API_SCHEMAS = ["public", "graphql_public"] as const;
 /** `[edge_runtime] deno_version` default (`config.toml` template). 2 → the current edge-runtime image. */
 const DEFAULT_DENO_VERSION = 2;
 
@@ -180,6 +211,12 @@ function deepMergeDoc(base: RawDoc, override: RawDoc): RawDoc {
  */
 interface LegacyRemoteOverride {
   readonly doc: RawDoc | undefined;
+  /**
+   * The name of the matched `[remotes.<name>]` block whose `project_id` equals the
+   * resolved ref, or `undefined` when no block matched. Callers echo Go's
+   * `Loading config override: [remotes.<name>]` stderr line from this.
+   */
+  readonly appliedRemote?: string;
   /**
    * The config keys the matched remote block contributed at viper's OVERRIDE tier. Go's
    * `mergeRemoteConfig` applies every block key via `v.Set(...)` after `AutomaticEnv`
@@ -241,12 +278,14 @@ function legacyResolveValidatedRemoteProjectId(
  * `AutomaticEnv` — `config.go:635-637`), so the block value must beat the env override.
  */
 const LEGACY_ENV_OVERRIDABLE_KEYS: ReadonlyArray<string> = [
+  "api.schemas",
   "db.port",
   "db.shadow_port",
   "db.major_version",
   "db.migrations.enabled",
   "db.seed.enabled",
   "db.seed.sql_paths",
+  "auth.enabled",
   "edge_runtime.deno_version",
   "experimental.pgdelta.enabled",
   "experimental.pgdelta.declarative_schema_path",
@@ -302,10 +341,11 @@ function applyRemoteOverride(
       if (blockSeed?.["enabled"] === undefined) {
         return {
           doc: deepMergeDoc(merged, { db: { seed: { enabled: false } } }),
+          appliedRemote: name,
           remoteOverrideKeys,
         };
       }
-      return { doc: merged, remoteOverrideKeys };
+      return { doc: merged, appliedRemote: name, remoteOverrideKeys };
     }
   }
   return { doc, remoteOverrideKeys: new Set() };
@@ -336,23 +376,6 @@ function findDuplicateRemoteProjectId(
   return undefined;
 }
 
-// Go's project-ref pattern (`apps/cli-go/pkg/config/config.go:470`): exactly 20
-// lowercase ASCII letters.
-const LEGACY_PROJECT_REF_PATTERN = /^[a-z]{20}$/;
-
-// Go's storage bucket-name pattern (`apps/cli-go/pkg/config/config.go:1382`).
-// `config.Validate` runs `ValidateBucketName` over every `[storage.buckets.*]` key
-// during config load (`config.go:898-903`), aborting before any db command when a
-// name does not match. The source string is reused verbatim in the error message via
-// `.source` so it byte-matches Go's `bucketNamePattern.String()`.
-const LEGACY_BUCKET_NAME_PATTERN = /^(\w|!|-|\.|\*|'|\(|\)| |&|\$|@|=|;|:|\+|,|\?)*$/;
-
-// Go's function-slug pattern (`apps/cli-go/pkg/config/config.go:1372`). `config.Validate`
-// runs `ValidateFunctionSlug` over every `[functions.*]` key during config load
-// (`config.go:993-998`), rejecting the config before any db command. `.source` is reused
-// in the message so it byte-matches Go's `funcSlugPattern.String()`.
-const LEGACY_FUNCTION_SLUG_PATTERN = /^[A-Za-z][A-Za-z0-9_-]*$/;
-
 /**
  * Go's `config.Validate` rejects any `[remotes.<name>]` whose `project_id` is not a
  * valid project ref (`config.go:832-836`), on every config load — so a malformed or
@@ -453,6 +476,22 @@ function resolveConfigInt(value: unknown, lookup: EnvLookup): number | "absent"
   return "invalid";
 }
 
+function resolveStringSlice(
+  value: unknown,
+  fallback: ReadonlyArray<string>,
+  lookup: EnvLookup,
+): ReadonlyArray<string> | undefined {
+  if (value === undefined) return fallback;
+  if (typeof value === "string") {
+    const expanded = legacyExpandEnv(value, lookup);
+    return expanded.length === 0 ? [] : expanded.split(",");
+  }
+  if (!Array.isArray(value) || !value.every((item): item is string => typeof item === "string")) {
+    return undefined;
+  }
+  return value.map((item) => legacyExpandEnv(item, lookup));
+}
+
 /**
  * Replicates Go's `path.Join("supabase", pattern)` for a relative seed `sql_paths`
  * entry (`pkg/config/config.go:881-886`). Go's `path.Join` runs `path.Clean`, which
@@ -476,6 +515,18 @@ function legacyJoinSupabaseSeedPath(pattern: string): string {
   return out.length === 0 ? "." : out.join("/");
 }
 
+/**
+ * Resolves a single seed `sql_paths` entry to Go's config-load form: a relative
+ * pattern is joined under `supabase/` (Go's `path.Join`, `config.go:918-921`); an
+ * absolute (or empty) pattern is returned verbatim. Used by the reader for
+ * `[db.seed].sql_paths` and by `db reset` for its `--sql-paths` override (Go's
+ * `resolveSeedSqlPaths`, `cmd/db.go`) so both feed the glob the same resolved paths.
+ */
+export const legacyResolveSeedSqlPath = (pathSvc: Path.Path, pattern: string): string =>
+  pattern.length === 0 || pathSvc.isAbsolute(pattern)
+    ? pattern
+    : legacyJoinSupabaseSeedPath(pattern);
+
 /** `[db]` ports default through the development env unless `SUPABASE_ENV` overrides. */
 const DEFAULT_SUPABASE_ENV = "development";
 
@@ -574,9 +625,12 @@ export const legacyLoadProjectEnv = Effect.fnUntraced(function* (
  * re-checks). The `acquireRelease` finalizer deletes only the keys it set when the
  * scope closes, so in-process test workers don't leak env between cases.
  */
-export const legacyApplyProjectEnv = (loaded: Record<string, string>) =>
+export const legacyApplyProjectEnv = (
+  loaded: Readonly<Record<string, string>>,
+  keys: ReadonlyArray<string> = LEGACY_PROCESS_ENV_APPLY_KEYS,
+) =>
   Effect.forEach(
-    LEGACY_PROCESS_ENV_APPLY_KEYS,
+    keys,
     (key) => {
       const value = loaded[key];
       if (value === undefined || process.env[key] !== undefined) {
@@ -599,33 +653,6 @@ function nonEmptyString(value: unknown): Option.Option<string> {
   return typeof value === "string" && value.length > 0 ? Option.some(value) : Option.none();
 }
 
-/** Go's `json.Valid` (`encoding/json`): reports whether the string is well-formed JSON. */
-function legacyIsValidJson(value: string): boolean {
-  try {
-    JSON.parse(value);
-    return true;
-  } catch {
-    return false;
-  }
-}
-
-// Go's `strconv.ParseBool` accepted forms (`go-viper/mapstructure` `decodeBool` under
-// viper's forced `WeaklyTypedInput`): a string decodes to bool via ParseBool, an empty
-// string is `false`, and any other value is a parse error.
-const GO_BOOL_TRUE = new Set(["1", "t", "T", "TRUE", "true", "True"]);
-const GO_BOOL_FALSE = new Set(["0", "f", "F", "FALSE", "false", "False", ""]);
-
-/**
- * Parse a config bool the way Go does (`strconv.ParseBool` via mapstructure's weakly
- * typed decode). Returns the bool, or `undefined` for a malformed value (which Go
- * surfaces as a `failed to parse config` error).
- */
-function legacyParseGoBool(value: string): boolean | undefined {
-  if (GO_BOOL_TRUE.has(value)) return true;
-  if (GO_BOOL_FALSE.has(value)) return false;
-  return undefined;
-}
-
 /**
  * Resolve a `[section] enabled` style bool. Go decodes a TOML bool natively and a
  * string (incl. an `env(VAR)` reference) via `strconv.ParseBool` — so `"1"`/`"t"`/etc.
@@ -644,7 +671,12 @@ function resolveBool(value: unknown, fallback: boolean, lookup: EnvLookup): bool
   // width). A TOML number (`enabled = 0`) is therefore an explicit false, NOT absent — it
   // must not fall through to the schema default.
   if (typeof value === "number") return value !== 0;
-  return fallback;
+  // Absent → the schema default. A PRESENT non-scalar (array/inline table, e.g.
+  // `enabled = []`) is a decode error in Go's `UnmarshalExact` during `LoadConfig`, so it
+  // must NOT fall through to the default — otherwise `db reset` could accept the prompt and
+  // drop schemas on a config Go rejects up front.
+  if (value === undefined) return fallback;
+  return "invalid";
 }
 
 /**
@@ -717,453 +749,141 @@ const resolveOptionalBoolOrFail = Effect.fnUntraced(function* (
     }
     return Option.some(parsed);
   }
-  return Option.none<boolean>();
+  // Absent → `None` (Go's `*bool` stays nil). A present non-scalar value fails Go's
+  // `UnmarshalExact`, so reject it here rather than silently treating it as absent.
+  if (value === undefined) return Option.none<boolean>();
+  return yield* Effect.fail(
+    new LegacyDbConfigLoadError({ message: `failed to parse config: invalid ${field}.` }),
+  );
 });
 
 /**
- * Recursively asserts every `encrypted:` secret in the (merged) config can be decrypted,
- * mirroring Go's global `DecryptSecretHookFunc` (`pkg/config/secret.go:77-109`,
- * `config.go:730`), which decrypts every `config.Secret` field during `UnmarshalExact` and
- * aborts the load with `failed to parse config: <error>` when one cannot be decrypted (e.g.
- * no `DOTENV_PRIVATE_KEY`). The reader's `[db.vault]` walk only covered vault secrets, so
- * non-vault `Secret` fields (`db.root_key`, `auth.external.<p>.secret`, smtp `pass`, …) were
- * silently passed through. A recursive string scan tracks Go's "decode the entire config"
- * behaviour and stays robust as new `Secret` fields are added. The unset-`env(...)` and
- * plain-string forms are returned verbatim by Go's hook (no error), so they are no-ops here.
- * Returns the failure (or `undefined`); the caller surfaces it via `Effect.fail`.
+ * Dotted paths of every `config.Secret`-typed field Go decrypts via its global
+ * `DecryptSecretHookFunc` (`pkg/config/secret.go`, `config.go:730`) — the hook only runs
+ * while decoding INTO a `config.Secret`, never over arbitrary strings. `*` matches any map
+ * key (`auth.external.<provider>`, `auth.hook.<name>`, `db.vault.<name>`). `[db.vault]`
+ * (a `map[string]Secret`, `pkg/config/db.go:96`) IS included — the db-config reader below
+ * also decrypts it directly in its own body ({@link legacyReadDbToml}'s `vault` loop) with
+ * the same fail-on-undecryptable behaviour, so for that caller this just detects the same
+ * failure a little earlier (no observable difference: same `legacyDecryptSecret` call, same
+ * `failed to parse config: <cause>` message). For `config push` — the other caller of
+ * {@link legacyAssertDecryptableSecrets}, which has no such downstream vault pass — omitting
+ * `db.vault` here would let an undecryptable vault secret through to the API calls, unlike Go.
+ * Derived from the Go structs (`auth.go`, `db.go`, `config.go`); update alongside any new
+ * `Secret` field.
  */
-const legacyAssertDecryptableSecrets = (
-  value: unknown,
-  lookup: EnvLookup,
-  dotenvPrivateKeys: ReadonlyArray<string>,
-): LegacyDbConfigLoadError | undefined => {
-  if (typeof value === "string") {
-    const expanded = legacyExpandEnv(value, lookup);
-    if (ENV_PATTERN.test(expanded) || !legacyIsEncryptedSecret(expanded)) return undefined;
-    const decrypted = legacyDecryptSecret(expanded, dotenvPrivateKeys);
-    return decrypted.ok
-      ? undefined
-      : new LegacyDbConfigLoadError({ message: `failed to parse config: ${decrypted.error}` });
-  }
-  if (Array.isArray(value)) {
-    for (const item of value) {
-      const error = legacyAssertDecryptableSecrets(item, lookup, dotenvPrivateKeys);
-      if (error !== undefined) return error;
-    }
-    return undefined;
+const LEGACY_SECRET_PATHS: ReadonlyArray<ReadonlyArray<string>> = [
+  ["db", "root_key"],
+  ["db", "vault", "*"],
+  ["auth", "publishable_key"],
+  ["auth", "secret_key"],
+  ["auth", "jwt_secret"],
+  ["auth", "anon_key"],
+  ["auth", "service_role_key"],
+  ["auth", "email", "smtp", "pass"],
+  ["auth", "external", "*", "secret"],
+  ["auth", "hook", "*", "secrets"],
+  ["auth", "sms", "twilio", "auth_token"],
+  ["auth", "sms", "twilio_verify", "auth_token"],
+  ["auth", "sms", "messagebird", "access_key"],
+  ["auth", "sms", "textlocal", "api_key"],
+  ["auth", "sms", "vonage", "api_secret"],
+  ["auth", "captcha", "secret"],
+  ["studio", "openai_api_key"],
+  // Go decodes `[edge_runtime.secrets]` as `SecretsConfig map[string]Secret` (config.go:283,287),
+  // so every value is decrypted by the hook — `*` spans the arbitrary secret names.
+  ["edge_runtime", "secrets", "*"],
+];
+
+/** Collects the string leaves reachable from `node` along `segs` (`*` spans map keys). */
+const legacyCollectSecretStrings = (
+  node: unknown,
+  segs: ReadonlyArray<string>,
+  index: number,
+  out: Array<string>,
+): void => {
+  if (index === segs.length) {
+    if (typeof node === "string") out.push(node);
+    return;
   }
-  const record = asRecord(value);
-  if (record !== undefined) {
+  const record = asRecord(node);
+  if (record === undefined) return;
+  const seg = segs[index]!;
+  if (seg === "*") {
     for (const key of Object.keys(record)) {
-      const error = legacyAssertDecryptableSecrets(record[key], lookup, dotenvPrivateKeys);
-      if (error !== undefined) return error;
+      legacyCollectSecretStrings(record[key], segs, index + 1, out);
     }
+  } else {
+    legacyCollectSecretStrings(record[seg], segs, index + 1, out);
   }
-  return undefined;
 };
 
-// Go merges the template default before Validate (`templates/config.toml`), so an absent
-// `auth.site_url` is non-empty; only an explicit empty string fails A1 (`config.go:1037`).
-const DEFAULT_AUTH_SITE_URL = "http://127.0.0.1:3000";
-// Go's `hookSecretPattern` (`pkg/config/config.go:1436`).
-const LEGACY_HOOK_SECRET_PATTERN = /^v1,whsec_[A-Za-z0-9+/=]{32,88}$/u;
-// Go's `clerkDomainPattern` (`pkg/config/config.go:1553`).
-const LEGACY_CLERK_DOMAIN_PATTERN =
-  /^(clerk([.][a-z0-9-]+){2,}|([a-z0-9-]+[.])+clerk[.]accounts[.]dev)$/u;
+/** Returns Go's hook-error message when a single `encrypted:` secret value cannot be decrypted. */
+const legacyAssertSecretValue = (
+  value: string,
+  lookup: EnvLookup,
+  dotenvPrivateKeys: ReadonlyArray<string>,
+): string | undefined => {
+  const expanded = legacyExpandEnv(value, lookup);
+  // Unset `env(...)` and plain strings are returned verbatim by Go's hook (no error).
+  if (ENV_PATTERN.test(expanded) || !legacyIsEncryptedSecret(expanded)) return undefined;
+  const decrypted = legacyDecryptSecret(expanded, dotenvPrivateKeys);
+  return decrypted.ok ? undefined : `failed to parse config: ${decrypted.error}`;
+};
 
 /**
- * Ports the FATAL validations Go runs inside `if c.Auth.Enabled { … }` during
- * `config.Validate` (`apps/cli-go/pkg/config/config.go:1036-1102` + the nested
- * `.validate()` methods at 1242-1632), in Go's first-failure-wins order, so a db/migration
- * command aborts on an invalid auth config exactly like the Go CLI (the reviewer's case:
- * `migration down --local` must stop before any destructive work). Every check below mirrors
- * a Go `return errors.New(...)` site with the byte-exact message.
+ * Asserts every `config.Secret`-typed `encrypted:` value in the (merged) config can be
+ * decrypted, mirroring Go's global `DecryptSecretHookFunc`, which aborts the load with
+ * `failed to parse config: <error>` when a secret cannot be decrypted. Only the actual
+ * `Secret` field paths ({@link LEGACY_SECRET_PATHS}) are scanned — a non-secret string that
+ * merely starts with `encrypted:` (e.g. an auth email-template `subject`) stays plain text
+ * in Go and must not block the load. Go decodes every `[remotes.<name>]` block into the same
+ * struct, so the same paths are checked under each remote too. Returns Go's error message (or
+ * `undefined`); callers surface it as their own domain error (e.g. `Effect.fail`).
+ *
+ * Shared across command families: the db-config reader below uses it for `db push`/`db
+ * reset`/`migration up|down`/etc, and `config push`'s handler reuses it directly against its
+ * own (`@supabase/config`-decoded) document — both need the exact same "decrypt-or-abort before
+ * anything else runs" behaviour Go gets for free from `config.Load`.
  *
- * Deliberately NOT ported: the `assertEnvLoaded` WARN lines (Go's `config.go:1143-1148` only
- * prints a stderr warning and always returns nil — never fatal), and the non-fatal mutations
- * (the SMS "no provider → disable phone login" WARN, the linkedin/slack deprecation WARN);
- * those affect neither the exit code nor any value this subset reader exposes. The
- * linkedin/slack providers are still skipped (Go deletes them before validating).
+ * The "check every `[remotes.<name>]` block too" part of that contract only holds when `doc`
+ * still has an intact `remotes` key. The db-config reader's own remote-merge keeps it (so this
+ * function really does check every declared remote there), but `@supabase/config`'s
+ * `loadProjectConfig` strips `remotes` from the document once a block matches the target ref —
+ * so for `config push`, an undecryptable secret hiding in a *different, non-matching* remote
+ * block goes unchecked (see that command's SIDE_EFFECTS.md KNOWN GAPS).
  */
-const legacyValidateAuthConfig = Effect.fnUntraced(function* (
-  authRaw: RawDoc,
-  fs: FileSystem.FileSystem,
-  path: Path.Path,
-  workdir: string,
+export const legacyAssertDecryptableSecrets = (
+  doc: unknown,
   lookup: EnvLookup,
-) {
-  const fail = (message: string) => Effect.fail(new LegacyDbConfigLoadError({ message }));
-  const supabaseDir = path.join(workdir, "supabase");
-  // Env-expanded string of `rec[key]` ("" when absent/non-string). An unresolved `env(VAR)`
-  // stays literal (non-empty), matching Go's LoadEnvHook + the Secret decode hook.
-  const str = (rec: RawDoc | undefined, key: string): string => {
-    const value = rec?.[key];
-    return typeof value === "string" ? legacyExpandEnv(value, lookup) : "";
-  };
-  // Weak-bool decode (Go mapstructure): boolean | nonzero number | strconv.ParseBool string.
-  // A malformed string ABORTS the load like Go's decode (it does NOT coerce to false), using
-  // the reader's `failed to parse config: invalid <field>.` shape (the same simplification the
-  // db.* bools use; Go's verbose mapstructure string is not reproduced byte-for-byte there
-  // either). Absent / non-string → false (the default for every auth enable-flag).
-  const gate = (rec: RawDoc | undefined, key: string, field: string) =>
-    Effect.gen(function* () {
-      const value = rec?.[key];
-      if (typeof value === "boolean") return value;
-      if (typeof value === "number") return value !== 0;
-      if (typeof value !== "string") return false;
-      const parsed = legacyParseGoBool(legacyExpandEnv(value, lookup));
-      if (parsed === undefined) return yield* fail(`failed to parse config: invalid ${field}.`);
-      return parsed;
-    });
-  // Resolve a config file path: absolute → verbatim (Go opens it from the OS root after chdir);
-  // relative → joined under `base` (`filepath.IsAbs` guards, `config.go:854-878`).
-  const resolvePath = (p: string, base: string): string =>
-    path.isAbsolute(p) ? p : path.join(base, p);
-
-  // A1: site_url required (`config.go:1037-1039`).
-  const siteUrl =
-    authRaw["site_url"] === undefined ? DEFAULT_AUTH_SITE_URL : str(authRaw, "site_url");
-  if (siteUrl.length === 0) return yield* fail("Missing required field in config: auth.site_url");
-
-  // A4: [auth.captcha]. The provider enum is a decode-time check (`CaptchaProvider.UnmarshalText`,
-  // `auth.go:58-71`) that fires whenever `provider` is set, regardless of `enabled`; the
-  // required-field checks run only when enabled (`config.go:1048-1058`).
-  const captcha = asRecord(authRaw["captcha"]);
-  if (captcha !== undefined) {
-    const provider = str(captcha, "provider");
-    if (provider.length > 0 && provider !== "hcaptcha" && provider !== "turnstile")
-      return yield* fail(
-        "failed to parse config: decoding failed due to the following error(s):\n\n'auth.captcha.provider' must be one of [hcaptcha turnstile]",
-      );
-    if (yield* gate(captcha, "enabled", "auth.captcha.enabled")) {
-      if (provider.length === 0)
-        return yield* fail("Missing required field in config: auth.captcha.provider");
-      if (str(captcha, "secret").length === 0)
-        return yield* fail("Missing required field in config: auth.captcha.secret");
-    }
-  }
-
-  // A5: signing keys file load (`config.go:1059-1065`) — read + parse as a JSON array. A
-  // relative path resolves under the supabase dir (`config.go:877-878`); absolute is verbatim.
-  const signingKeysPath = str(authRaw, "signing_keys_path");
-  if (signingKeysPath.length > 0) {
-    const keysJson = yield* fs.readFileString(resolvePath(signingKeysPath, supabaseDir)).pipe(
-      Effect.mapError(
-        (cause) =>
-          new LegacyDbConfigLoadError({
-            message: `failed to read signing keys: ${cause.message}`,
-          }),
-      ),
-    );
-    yield* Effect.try({
-      try: () => {
-        const parsed: unknown = JSON.parse(keysJson);
-        if (!Array.isArray(parsed)) throw new Error("signing keys must be a JSON array of JWKs");
-        return parsed;
-      },
-      catch: (cause) =>
-        new LegacyDbConfigLoadError({
-          message: `failed to decode signing keys: ${cause instanceof Error ? cause.message : String(cause)}`,
-        }),
-    });
-  }
-
-  // A6: passkey/webauthn when passkey enabled (`config.go:1066-1084`).
-  const passkey = asRecord(authRaw["passkey"]);
-  if (passkey !== undefined && (yield* gate(passkey, "enabled", "auth.passkey.enabled"))) {
-    const webauthn = asRecord(authRaw["webauthn"]);
-    if (webauthn === undefined)
-      return yield* fail(
-        "Missing required config section: auth.webauthn (required when auth.passkey.enabled is true)",
-      );
-    if (str(webauthn, "rp_id").length === 0)
-      return yield* fail("Missing required field in config: auth.webauthn.rp_id");
-    const rpOrigins = webauthn["rp_origins"];
-    if (!Array.isArray(rpOrigins) || rpOrigins.length === 0)
-      return yield* fail("Missing required field in config: auth.webauthn.rp_origins");
-  }
-
-  // B1: hooks — each enabled hook (`config.go:1402-1470`).
-  const hook = asRecord(authRaw["hook"]);
-  if (hook !== undefined) {
-    const hookTypes = [
-      "mfa_verification_attempt",
-      "password_verification_attempt",
-      "custom_access_token",
-      "send_sms",
-      "send_email",
-      "before_user_created",
-    ] as const;
-    for (const hookType of hookTypes) {
-      const h = asRecord(hook[hookType]);
-      if (h === undefined) continue;
-      if (!(yield* gate(h, "enabled", `auth.hook.${hookType}.enabled`))) continue;
-      const uri = str(h, "uri");
-      if (uri.length === 0)
-        return yield* fail(`Missing required field in config: auth.hook.${hookType}.uri`);
-      // Go uses net/url.Parse, which (unlike `new URL`) does not throw on a missing scheme;
-      // extract the scheme the same lenient way so a no-scheme/other URI hits the default
-      // branch rather than erroring (the rare url.Parse error case is not separately ported).
-      const scheme = (/^([a-zA-Z][a-zA-Z0-9+.-]*):/u.exec(uri)?.[1] ?? "").toLowerCase();
-      const secrets = str(h, "secrets");
-      if (scheme === "http" || scheme === "https") {
-        if (secrets.length === 0)
-          return yield* fail(`Missing required field in config: auth.hook.${hookType}.secrets`);
-        for (const secret of secrets.split("|")) {
-          if (!LEGACY_HOOK_SECRET_PATTERN.test(secret))
-            return yield* fail(
-              `Invalid hook config: auth.hook.${hookType}.secrets must be formatted as "v1,whsec_<base64_encoded_secret>" with a minimum length of 32 characters.`,
-            );
-        }
-      } else if (scheme === "pg-functions") {
-        if (secrets.length > 0)
-          return yield* fail(
-            `Invalid hook config: auth.hook.${hookType}.secrets is unsupported for pg-functions URI`,
-          );
-      } else {
-        return yield* fail(
-          `Invalid hook config: auth.hook.${hookType}.uri should be a HTTP, HTTPS, or pg-functions URI`,
-        );
-      }
-    }
-  }
-
-  // B2: mfa — enroll requires verify (`config.go:1472-1483`).
-  const mfa = asRecord(authRaw["mfa"]);
-  if (mfa !== undefined) {
-    for (const [key, label] of [
-      ["totp", "totp"],
-      ["phone", "phone"],
-      ["web_authn", "web_authn"],
-    ] as const) {
-      const factor = asRecord(mfa[key]);
-      if (factor === undefined) continue;
-      const enroll = yield* gate(factor, "enroll_enabled", `auth.mfa.${label}.enroll_enabled`);
-      const verify = yield* gate(factor, "verify_enabled", `auth.mfa.${label}.verify_enabled`);
-      if (enroll && !verify)
-        return yield* fail(
-          `Invalid MFA config: auth.mfa.${label}.enroll_enabled requires verify_enabled`,
-        );
-    }
-  }
-
-  // B3: email (`config.go:1242-1295`).
-  const email = asRecord(authRaw["email"]);
-  if (email !== undefined) {
-    // Go resolves a relative `content_path` differently per section: email TEMPLATE paths are
-    // relative to the PROJECT ROOT (`config.go:854-856`, the `// FIXME` there), while
-    // NOTIFICATION paths are relative to the supabase dir (`config.go:861-862`); absolute → as-is.
-    const validateTemplate = (
-      section: "template" | "notification",
-      name: string,
-      tmpl: RawDoc,
-      base: string,
-    ) =>
-      Effect.gen(function* () {
-        const contentPath = str(tmpl, "content_path");
-        if (contentPath.length === 0) {
-          if (tmpl["content"] !== undefined)
-            return yield* fail(
-              `Invalid config for auth.email.${section}.${name}.content: please use content_path instead`,
-            );
-          return;
-        }
-        yield* fs.readFileString(resolvePath(contentPath, base)).pipe(
-          Effect.mapError(
-            (cause) =>
-              new LegacyDbConfigLoadError({
-                message: `Invalid config for auth.email.${section}.${name}.content_path: ${cause.message}`,
-              }),
-          ),
-        );
-      });
-    const templates = asRecord(email["template"]);
-    if (templates !== undefined) {
-      for (const name of Object.keys(templates)) {
-        const tmpl = asRecord(templates[name]);
-        if (tmpl !== undefined) yield* validateTemplate("template", name, tmpl, workdir);
-      }
-    }
-    const notifications = asRecord(email["notification"]);
-    if (notifications !== undefined) {
-      for (const name of Object.keys(notifications)) {
-        const tmpl = asRecord(notifications[name]);
-        if (
-          tmpl !== undefined &&
-          (yield* gate(tmpl, "enabled", `auth.email.notification.${name}.enabled`))
-        )
-          yield* validateTemplate("notification", name, tmpl, supabaseDir);
+  dotenvPrivateKeys: ReadonlyArray<string>,
+): string | undefined => {
+  const scan = (node: unknown): string | undefined => {
+    for (const segs of LEGACY_SECRET_PATHS) {
+      const values: Array<string> = [];
+      legacyCollectSecretStrings(node, segs, 0, values);
+      for (const value of values) {
+        const error = legacyAssertSecretValue(value, lookup, dotenvPrivateKeys);
+        if (error !== undefined) return error;
       }
     }
-    // Go defaults `auth.email.smtp.enabled = true` when the `[auth.email.smtp]` table is present
-    // but omits `enabled` (`config.go:692-696`), so a present table validates unless explicitly
-    // disabled.
-    const smtp = asRecord(email["smtp"]);
-    const smtpEnabled =
-      smtp !== undefined &&
-      (smtp["enabled"] === undefined
-        ? true
-        : yield* gate(smtp, "enabled", "auth.email.smtp.enabled"));
-    if (smtp !== undefined && smtpEnabled) {
-      if (str(smtp, "host").length === 0)
-        return yield* fail("Missing required field in config: auth.email.smtp.host");
-      const portRaw = smtp["port"];
-      const port =
-        typeof portRaw === "number"
-          ? portRaw
-          : typeof portRaw === "string"
-            ? Number(legacyExpandEnv(portRaw, lookup))
-            : 0;
-      if (!port) return yield* fail("Missing required field in config: auth.email.smtp.port");
-      if (str(smtp, "user").length === 0)
-        return yield* fail("Missing required field in config: auth.email.smtp.user");
-      if (str(smtp, "pass").length === 0)
-        return yield* fail("Missing required field in config: auth.email.smtp.pass");
-      if (str(smtp, "admin_email").length === 0)
-        return yield* fail("Missing required field in config: auth.email.smtp.admin_email");
-    }
-  }
-
-  // B4: sms — only the FIRST enabled provider is validated (Go's switch, `config.go:1297-1364`).
-  const sms = asRecord(authRaw["sms"]);
-  if (sms !== undefined) {
-    const twilio = asRecord(sms["twilio"]);
-    const twilioVerify = asRecord(sms["twilio_verify"]);
-    const messagebird = asRecord(sms["messagebird"]);
-    const textlocal = asRecord(sms["textlocal"]);
-    const vonage = asRecord(sms["vonage"]);
-    // Resolve every provider's enable-flag (a malformed bool aborts like Go's decode); Go's
-    // switch then validates only the FIRST enabled provider.
-    const twilioEnabled = yield* gate(twilio, "enabled", "auth.sms.twilio.enabled");
-    const twilioVerifyEnabled = yield* gate(
-      twilioVerify,
-      "enabled",
-      "auth.sms.twilio_verify.enabled",
-    );
-    const messagebirdEnabled = yield* gate(messagebird, "enabled", "auth.sms.messagebird.enabled");
-    const textlocalEnabled = yield* gate(textlocal, "enabled", "auth.sms.textlocal.enabled");
-    const vonageEnabled = yield* gate(vonage, "enabled", "auth.sms.vonage.enabled");
-    if (twilioEnabled) {
-      if (str(twilio, "account_sid").length === 0)
-        return yield* fail("Missing required field in config: auth.sms.twilio.account_sid");
-      if (str(twilio, "message_service_sid").length === 0)
-        return yield* fail("Missing required field in config: auth.sms.twilio.message_service_sid");
-      if (str(twilio, "auth_token").length === 0)
-        return yield* fail("Missing required field in config: auth.sms.twilio.auth_token");
-    } else if (twilioVerifyEnabled) {
-      if (str(twilioVerify, "account_sid").length === 0)
-        return yield* fail("Missing required field in config: auth.sms.twilio_verify.account_sid");
-      if (str(twilioVerify, "message_service_sid").length === 0)
-        return yield* fail(
-          "Missing required field in config: auth.sms.twilio_verify.message_service_sid",
-        );
-      if (str(twilioVerify, "auth_token").length === 0)
-        return yield* fail("Missing required field in config: auth.sms.twilio_verify.auth_token");
-    } else if (messagebirdEnabled) {
-      if (str(messagebird, "originator").length === 0)
-        return yield* fail("Missing required field in config: auth.sms.messagebird.originator");
-      if (str(messagebird, "access_key").length === 0)
-        return yield* fail("Missing required field in config: auth.sms.messagebird.access_key");
-    } else if (textlocalEnabled) {
-      if (str(textlocal, "sender").length === 0)
-        return yield* fail("Missing required field in config: auth.sms.textlocal.sender");
-      if (str(textlocal, "api_key").length === 0)
-        return yield* fail("Missing required field in config: auth.sms.textlocal.api_key");
-    } else if (vonageEnabled) {
-      if (str(vonage, "from").length === 0)
-        return yield* fail("Missing required field in config: auth.sms.vonage.from");
-      if (str(vonage, "api_key").length === 0)
-        return yield* fail("Missing required field in config: auth.sms.vonage.api_key");
-      if (str(vonage, "api_secret").length === 0)
-        return yield* fail("Missing required field in config: auth.sms.vonage.api_secret");
-    }
-  }
-
-  // B5: external providers (`config.go:1368-1398`). linkedin/slack are deprecated and deleted
-  // before validation, so they are never validated here.
-  const external = asRecord(authRaw["external"]);
-  if (external !== undefined) {
-    for (const name of Object.keys(external)) {
-      if (name === "linkedin" || name === "slack") continue;
-      const provider = asRecord(external[name]);
-      if (provider === undefined) continue;
-      if (!(yield* gate(provider, "enabled", `auth.external.${name}.enabled`))) continue;
-      if (str(provider, "client_id").length === 0)
-        return yield* fail(`Missing required field in config: auth.external.${name}.client_id`);
-      if (name !== "apple" && name !== "google" && str(provider, "secret").length === 0)
-        return yield* fail(`Missing required field in config: auth.external.${name}.secret`);
+    return undefined;
+  };
+  const topLevel = scan(doc);
+  if (topLevel !== undefined) return topLevel;
+  const remotes = asRecord(asRecord(doc)?.["remotes"]);
+  if (remotes !== undefined) {
+    for (const name of Object.keys(remotes)) {
+      const error = scan(remotes[name]);
+      if (error !== undefined) return error;
     }
   }
+  return undefined;
+};
 
-  // B6: third_party — validate each enabled provider in order, then mutual exclusivity
-  // (`config.go:1584-1632`). Note `aws_cognito`'s messages say `cognito` (Go's wording).
-  const thirdParty = asRecord(authRaw["third_party"]);
-  if (thirdParty !== undefined) {
-    let enabledCount = 0;
-    const firebase = asRecord(thirdParty["firebase"]);
-    if (
-      firebase !== undefined &&
-      (yield* gate(firebase, "enabled", "auth.third_party.firebase.enabled"))
-    ) {
-      enabledCount += 1;
-      if (str(firebase, "project_id").length === 0)
-        return yield* fail(
-          "Invalid config: auth.third_party.firebase is enabled but without a project_id.",
-        );
-    }
-    const auth0 = asRecord(thirdParty["auth0"]);
-    if (auth0 !== undefined && (yield* gate(auth0, "enabled", "auth.third_party.auth0.enabled"))) {
-      enabledCount += 1;
-      if (str(auth0, "tenant").length === 0)
-        return yield* fail(
-          "Invalid config: auth.third_party.auth0 is enabled but without a tenant.",
-        );
-    }
-    const cognito = asRecord(thirdParty["aws_cognito"]);
-    if (
-      cognito !== undefined &&
-      (yield* gate(cognito, "enabled", "auth.third_party.aws_cognito.enabled"))
-    ) {
-      enabledCount += 1;
-      if (str(cognito, "user_pool_id").length === 0)
-        return yield* fail(
-          "Invalid config: auth.third_party.cognito is enabled but without a user_pool_id.",
-        );
-      if (str(cognito, "user_pool_region").length === 0)
-        return yield* fail(
-          "Invalid config: auth.third_party.cognito is enabled but without a user_pool_region.",
-        );
-    }
-    const clerk = asRecord(thirdParty["clerk"]);
-    if (clerk !== undefined && (yield* gate(clerk, "enabled", "auth.third_party.clerk.enabled"))) {
-      enabledCount += 1;
-      const domain = str(clerk, "domain");
-      if (domain.length === 0)
-        return yield* fail(
-          "Invalid config: auth.third_party.clerk is enabled but without a domain.",
-        );
-      if (!LEGACY_CLERK_DOMAIN_PATTERN.test(domain))
-        return yield* fail(
-          "Invalid config: auth.third_party.clerk has invalid domain, it usually is like clerk.example.com or example.clerk.accounts.dev. Check https://clerk.com/setup/supabase on how to find the correct value.",
-        );
-    }
-    const workos = asRecord(thirdParty["workos"]);
-    if (
-      workos !== undefined &&
-      (yield* gate(workos, "enabled", "auth.third_party.workos.enabled"))
-    ) {
-      enabledCount += 1;
-      if (str(workos, "issuer_url").length === 0)
-        return yield* fail(
-          "Invalid config: auth.third_party.workos is enabled but without a issuer_url.",
-        );
-    }
-    if (enabledCount > 1)
-      return yield* fail(
-        "Invalid config: Only one third_party provider allowed to be enabled at a time.",
-      );
-  }
-});
+// Go merges the template default before Validate (`templates/config.toml`), so an absent
+// `auth.site_url` is non-empty; only an explicit empty string fails A1 (`config.go:1037`).
+const DEFAULT_AUTH_SITE_URL = "http://127.0.0.1:3000";
 
 /**
  * Reads `<workdir>/supabase/config.toml` (db subtree + project id) and the linked
@@ -1173,7 +893,7 @@ const legacyValidateAuthConfig = Effect.fnUntraced(function* (
  * Fails with `LegacyDbConfigLoadError` only when the config file is present but
  * unparseable; an absent file (and an absent/empty pooler-url file) is not an error.
  */
-export const legacyReadDbToml = Effect.fnUntraced(function* (
+const readDbTomlCore = Effect.fnUntraced(function* (
   fs: FileSystem.FileSystem,
   path: Path.Path,
   workdir: string,
@@ -1183,6 +903,12 @@ export const legacyReadDbToml = Effect.fnUntraced(function* (
   // `--local` / `--db-url` / declarative pass nothing and read the unmerged config,
   // matching Go (those paths never resolve a ref before config load).
   ref?: string,
+  // Internal: when true the on-disk `config.toml` is treated as absent so the body
+  // resolves pure defaults (still honoring `SUPABASE_*` env overrides, which Go binds
+  // regardless of a config file). The lenient `legacyReadDbToml({ validate: false })`
+  // wrapper uses this as its fallback after a config-load failure, mirroring the
+  // best-effort behavior the container-id seam relied on before.
+  ignoreConfigFile = false,
 ) {
   const supabaseDir = path.join(workdir, "supabase");
   const configPath = path.join(supabaseDir, "config.toml");
@@ -1192,18 +918,20 @@ export const legacyReadDbToml = Effect.fnUntraced(function* (
   // is swallowed, every other read error aborts rather than silently running against the
   // default local database. Effect surfaces "not found" as `PlatformError` with a
   // `SystemError` reason tagged `"NotFound"`.
-  const maybeContent = yield* fs.readFileString(configPath).pipe(
-    Effect.map(Option.some<string>),
-    Effect.catchTag("PlatformError", (error) =>
-      error.reason._tag === "NotFound"
-        ? Effect.succeed(Option.none<string>())
-        : Effect.fail(
-            new LegacyDbConfigLoadError({
-              message: `failed to read file config: ${error.message}`,
-            }),
-          ),
-    ),
-  );
+  const maybeContent = ignoreConfigFile
+    ? Option.none<string>()
+    : yield* fs.readFileString(configPath).pipe(
+        Effect.map(Option.some<string>),
+        Effect.catchTag("PlatformError", (error) =>
+          error.reason._tag === "NotFound"
+            ? Effect.succeed(Option.none<string>())
+            : Effect.fail(
+                new LegacyDbConfigLoadError({
+                  message: `failed to read file config: ${error.message}`,
+                }),
+              ),
+        ),
+      );
 
   // Resolve `env(VAR)` against the shell env first, then the project `.env` files
   // (Go's `loadNestedEnv` populates the process env before `LoadEnvHook`). Built
@@ -1228,9 +956,16 @@ export const legacyReadDbToml = Effect.fnUntraced(function* (
   let functionsRaw: RawDoc | undefined;
   let analyticsRaw: RawDoc | undefined;
   let projectId = Option.none<string>();
+  // Whether `config.toml` set a top-level `project_id` string that env-expanded to empty
+  // (`project_id = ""`). Go keeps that empty override and `config.Validate` fails with
+  // `Missing required field in config: project_id` (config.go:991); tracked here so the
+  // check can run after the `SUPABASE_PROJECT_ID` env override below may still rescue it.
+  let projectIdExplicitEmpty = false;
   // Config keys a matched remote block contributed at viper's override tier (Go's
   // `v.Set`), so they must beat the matching `SUPABASE_*` env overrides below.
   let remoteOverrideKeys: ReadonlySet<string> = new Set();
+  // The matched `[remotes.<name>]` block name, echoed as Go's config-override line.
+  let appliedRemote: string | undefined;
   if (Option.isSome(maybeContent)) {
     let doc: RawDoc | undefined;
     try {
@@ -1271,6 +1006,7 @@ export const legacyReadDbToml = Effect.fnUntraced(function* (
         : applyRemoteOverride(doc, ref, lookup);
     const effectiveDoc = remoteOverride.doc;
     remoteOverrideKeys = remoteOverride.remoteOverrideKeys;
+    appliedRemote = remoteOverride.appliedRemote;
     db = asRecord(effectiveDoc?.["db"]);
     experimentalRaw = asRecord(effectiveDoc?.["experimental"]);
     pgDeltaRaw = asRecord(experimentalRaw?.["pgdelta"]);
@@ -1289,16 +1025,20 @@ export const legacyReadDbToml = Effect.fnUntraced(function* (
     projectId = nonEmptyString(
       typeof rawProjectId === "string" ? legacyExpandEnv(rawProjectId, lookup) : rawProjectId,
     );
+    // A present `project_id` string that resolves to empty is Go's "kept empty override".
+    projectIdExplicitEmpty = typeof rawProjectId === "string" && Option.isNone(projectId);
 
     // Go's `DecryptSecretHookFunc` is a global decode hook (config.go:730) that decrypts
     // EVERY `config.Secret` field during `UnmarshalExact`, so an `encrypted:` secret anywhere
     // in the merged config that cannot be decrypted (e.g. no DOTENV_PRIVATE_KEY) aborts the
     // load with `failed to parse config: <error>` (secret.go:34,103; config.go:704) — before
-    // Validate and before connecting. The reader otherwise only decrypts `[db.vault]`, so
-    // assert decryptability across the whole document to match Go (a recursive scan tracks
-    // Go's "decode the entire config" better than a hand-listed set of Secret paths).
+    // Validate and before connecting. This also covers `[db.vault]` (see
+    // `LEGACY_SECRET_PATHS`), so the vault loop below never actually reaches an
+    // undecryptable value — it just decrypts-and-populates the already-asserted-valid ones.
     const secretError = legacyAssertDecryptableSecrets(effectiveDoc, lookup, dotenvPrivateKeys);
-    if (secretError !== undefined) return yield* Effect.fail(secretError);
+    if (secretError !== undefined) {
+      return yield* Effect.fail(new LegacyDbConfigLoadError({ message: secretError }));
+    }
   }
 
   // Go: `config.go:626` — read the linked pooler URL from `.temp/pooler-url` and
@@ -1344,6 +1084,16 @@ export const legacyReadDbToml = Effect.fnUntraced(function* (
     projectId = nonEmptyString(legacyExpandEnv(projectIdEnv, lookup));
   }
 
+  // Go's `config.Validate` rejects an empty top-level `project_id` (config.go:991). An
+  // absent field is tolerated here (deferred), but a present `project_id = ""` that the
+  // `SUPABASE_PROJECT_ID` override did not rescue is a load error, so a destructive command
+  // (e.g. remote `db reset`) fails fast rather than dropping schemas on a config Go rejects.
+  if (projectIdExplicitEmpty && Option.isNone(projectId)) {
+    return yield* Effect.fail(
+      new LegacyDbConfigLoadError({ message: "Missing required field in config: project_id" }),
+    );
+  }
+
   // A present-but-unmarshalable port aborts in Go rather than defaulting; mirror
   // that so `test db --local` never silently targets the default local database
   // while hiding a broken `[db]` config.
@@ -1407,22 +1157,10 @@ export const legacyReadDbToml = Effect.fnUntraced(function* (
       }),
     );
   }
-  // Reject unsupported major versions like Go's config.Validate ({13,14,15,17};
-  // `apps/cli-go/pkg/config/config.go:869-897`) before any image/container runs. An
-  // absent value falls through to the default (Go's zero-then-default).
-  if (
-    typeof majorVersionResolved === "number" &&
-    ![13, 14, 15, 17].includes(majorVersionResolved)
-  ) {
-    return yield* Effect.fail(
-      new LegacyDbConfigLoadError({
-        message:
-          majorVersionResolved === 12
-            ? "Postgres version 12.x is unsupported. To use the CLI, either start a new project or follow project migration steps here: https://supabase.com/docs/guides/database#migrating-between-projects."
-            : `Failed reading config: Invalid db.major_version: ${majorVersionResolved}.`,
-      }),
-    );
-  }
+  // Rejecting an unsupported major version ({13,14,15,17}; `apps/cli-go/pkg/config/config.go:
+  // 869-897`) is now `legacyValidateResolvedConfig`'s `db.major_version` switch (called once,
+  // below) — an absent value falls through to the default (Go's zero-then-default) and a present
+  // one (including `0`) flows into `input.db.majorVersion` for that switch to check.
   const majorVersion =
     typeof majorVersionResolved === "number" ? majorVersionResolved : DEFAULT_MAJOR_VERSION;
 
@@ -1475,25 +1213,10 @@ export const legacyReadDbToml = Effect.fnUntraced(function* (
       }),
     );
   }
-  // Go's config.Validate rejects a present-but-invalid deno_version before pg-delta
-  // runs (`config.go:999-1008`): 0 → missing-required, anything other than 1/2 →
-  // invalid. An absent key falls through to the default (Go merges deno_version=2).
-  if (typeof denoVersionResolved === "number") {
-    if (denoVersionResolved === 0) {
-      return yield* Effect.fail(
-        new LegacyDbConfigLoadError({
-          message: "Missing required field in config: edge_runtime.deno_version",
-        }),
-      );
-    }
-    if (denoVersionResolved !== 1 && denoVersionResolved !== 2) {
-      return yield* Effect.fail(
-        new LegacyDbConfigLoadError({
-          message: `Failed reading config: Invalid edge_runtime.deno_version: ${denoVersionResolved}.`,
-        }),
-      );
-    }
-  }
+  // Rejecting a present-but-invalid deno_version (`config.go:999-1008`: 0 → missing-required,
+  // anything other than 1/2 → invalid) is now `legacyValidateResolvedConfig`'s
+  // `edgeRuntimeDenoVersion` switch (called once, below). An absent key falls through to the
+  // default (Go merges deno_version=2).
   const denoVersion =
     typeof denoVersionResolved === "number" ? denoVersionResolved : DEFAULT_DENO_VERSION;
 
@@ -1577,102 +1300,358 @@ export const legacyReadDbToml = Effect.fnUntraced(function* (
       (typeof formatOptionsRaw === "string" ? formatOptionsRaw : ""),
     lookup,
   );
-  // Go's config.Validate aborts config load when a non-empty format_options is not
-  // valid JSON (`apps/cli-go/pkg/config/config.go:1685-1686`), before any shadow /
-  // catalog container runs. Fail here with Go's exact message so the user gets the
-  // actionable error up front rather than a later `JSON.parse` failure in the script.
-  if (formatOptionsExpanded.length > 0 && !legacyIsValidJson(formatOptionsExpanded)) {
-    return yield* Effect.fail(
-      new LegacyDbConfigLoadError({
-        message: "Invalid config for experimental.pgdelta.format_options: must be valid JSON",
-      }),
-    );
-  }
+  // Rejecting a non-empty, non-JSON `format_options` (`apps/cli-go/pkg/config/config.go:
+  // 1685-1686`) is now `legacyValidateResolvedConfig`'s `experimental.pgdeltaFormatOptions`
+  // check (called once, below).
   const formatOptions = nonEmptyString(formatOptionsExpanded);
 
-  // Go's config.Validate runs `ValidateBucketName` over every `[storage.buckets.*]`
-  // key on load (`apps/cli-go/pkg/config/config.go:898-903`), rejecting the config
-  // before any db command when a bucket name does not match `bucketNamePattern`.
-  // The reader otherwise drops `storage.buckets`, so port the check here with Go's
-  // exact message (the trailing `(%s)` is the regex source, `config.go:1386`).
+  // Bucket-name/function-slug validation (`config.go:898-903`/`993-998`) now lives in
+  // `legacyValidateResolvedConfig` (called once, below); only the pure extraction stays here.
   const bucketsRaw = asRecord(storageRaw?.["buckets"]);
+  // Same gap for each bucket's own `file_size_limit` — Go decodes it via the same `sizeInBytes`
+  // hook as the storage-level default (validated eagerly in `start.handler.ts`), unconditionally
+  // during `Config.Load`, for every configured bucket, before any command-specific logic runs.
+  // This reader only ever extracted bucket NAMES above — the per-bucket size itself was only
+  // parsed deep inside `legacySeedBucketsRun`, reached only on a fresh volume with Storage
+  // actually started, so a malformed value on a reused-volume restart (or the already-running
+  // short-circuit, which never reaches bring-up at all) went completely unvalidated. An absent
+  // key is skipped (Go's decode hook never fires over one; the bucket inherits the storage-level
+  // default later). Validate-only: `legacySeedBucketsRun`'s own call re-parses the real value.
   if (bucketsRaw !== undefined) {
-    for (const name of Object.keys(bucketsRaw)) {
-      if (!LEGACY_BUCKET_NAME_PATTERN.test(name)) {
-        return yield* Effect.fail(
-          new LegacyDbConfigLoadError({
-            message: `Invalid Bucket name: ${name}. Only lowercase letters, numbers, dots, hyphens, and spaces are allowed. (${LEGACY_BUCKET_NAME_PATTERN.source})`,
-          }),
-        );
-      }
-    }
-  }
-
-  // Go's config.Validate runs `ValidateFunctionSlug` over every `[functions.*]` key on
-  // load (`apps/cli-go/pkg/config/config.go:993-998`, immediately after the bucket loop),
-  // rejecting the config before any db command when a slug does not match
-  // `funcSlugPattern`. The reader otherwise drops `functions`, so port the check here
-  // with Go's exact message (the trailing `(%s)` is the regex source, `config.go:1376`).
-  if (functionsRaw !== undefined) {
-    for (const name of Object.keys(functionsRaw)) {
-      if (!LEGACY_FUNCTION_SLUG_PATTERN.test(name)) {
+    for (const [bucketName, bucketRaw] of Object.entries(bucketsRaw)) {
+      const rawLimit = asRecord(bucketRaw)?.["file_size_limit"];
+      if (typeof rawLimit !== "string" && typeof rawLimit !== "number") continue;
+      const limitString =
+        typeof rawLimit === "number" ? String(rawLimit) : legacyExpandEnv(rawLimit, lookup);
+      try {
+        ramInBytes(limitString);
+      } catch {
         return yield* Effect.fail(
           new LegacyDbConfigLoadError({
-            message: `Invalid Function name: ${name}. Must start with at least one letter, and only include alphanumeric characters, underscores, and hyphens. (${LEGACY_FUNCTION_SLUG_PATTERN.source})`,
+            message: `failed to parse config: invalid storage.buckets.${bucketName}.file_size_limit.`,
           }),
         );
       }
     }
   }
 
-  // Go's config.Validate runs the full `if c.Auth.Enabled` block (`config.go:1036-1102`)
-  // after the bucket/function checks — port its fatal validations so db/migration commands
-  // abort on an invalid auth config exactly like Go (e.g. an enabled passkey without a valid
-  // [auth.webauthn], or two third_party providers). Gated on `auth.enabled` (default true).
-  // Go's viper AutomaticEnv binds `auth.enabled` to `SUPABASE_AUTH_ENABLED` before Validate
-  // (`config.go:529-535`), so the env override decides whether the auth block is validated.
+  // Go's config.Validate runs the full `if c.Auth.Enabled` block (`config.go:1036-1102`) after
+  // the bucket/function checks. Gated on `auth.enabled` (default true); Go's viper AutomaticEnv
+  // binds `auth.enabled` to `SUPABASE_AUTH_ENABLED` before Validate (`config.go:529-535`), so the
+  // env override decides whether the auth block is validated — UNLESS a matched `[remotes.*]`
+  // block supplies `auth.enabled` itself, in which case `mergeRemoteConfig`'s `v.Set` (override
+  // tier, above `AutomaticEnv`) wins, matching the same suppression every other
+  // `LEGACY_ENV_OVERRIDABLE_KEYS` entry gets below.
   const authEnabled = yield* resolveBoolOrFail(
     "auth.enabled",
     authRaw?.["enabled"],
     true,
     lookup,
-    envOverride("SUPABASE_AUTH_ENABLED"),
+    remoteOverrideKeys.has("auth.enabled") ? undefined : envOverride("SUPABASE_AUTH_ENABLED"),
   );
+
+  // Local helpers mirroring the deleted `legacyValidateAuthConfig`'s closures — its Go-parity
+  // CHECKS now live in `legacyValidateResolvedConfig`; `str`/`gate`/`fail` are still needed here
+  // to build that call's `LegacyAuthInput`, and by the D-only sms/external checks below (never
+  // part of the shared validator — see `legacy-config-validate.ts`'s module header).
+  const fail = (message: string) => Effect.fail(new LegacyDbConfigLoadError({ message }));
+  // Env-expanded string of `rec[key]` ("" when absent/non-string). An unresolved `env(VAR)`
+  // stays literal (non-empty), matching Go's LoadEnvHook + the Secret decode hook.
+  const str = (rec: RawDoc | undefined, key: string): string => {
+    const value = rec?.[key];
+    return typeof value === "string" ? legacyExpandEnv(value, lookup) : "";
+  };
+  // Weak-bool decode (Go mapstructure): boolean | nonzero number | strconv.ParseBool string. A
+  // malformed string ABORTS the load like Go's decode (it does NOT coerce to false). Absent /
+  // non-string → false (the default for every auth enable-flag).
+  const gate = (rec: RawDoc | undefined, key: string, field: string) =>
+    Effect.gen(function* () {
+      const value = rec?.[key];
+      if (typeof value === "boolean") return value;
+      if (typeof value === "number") return value !== 0;
+      if (typeof value !== "string") return false;
+      const parsed = legacyParseGoBool(legacyExpandEnv(value, lookup));
+      if (parsed === undefined) return yield* fail(`failed to parse config: invalid ${field}.`);
+      return parsed;
+    });
+
+  const authRawResolved = authRaw ?? {};
+  let authInput: LegacyAuthInput | undefined;
   if (authEnabled) {
-    yield* legacyValidateAuthConfig(authRaw ?? {}, fs, path, workdir, lookup);
+    // A1: site_url required (`config.go:1037-1039`).
+    const siteUrl =
+      authRawResolved["site_url"] === undefined
+        ? DEFAULT_AUTH_SITE_URL
+        : str(authRawResolved, "site_url");
+
+    // A4: [auth.captcha]. The provider enum is a decode-time check (`CaptchaProvider.
+    // UnmarshalText`, `auth.go:58-71`); the required-field checks are `enabled`-gated
+    // (`config.go:1048-1058`) — both now live in `legacyValidateResolvedConfig`.
+    const captchaRaw = asRecord(authRawResolved["captcha"]);
+    let captchaInput: LegacyCaptchaInput | undefined;
+    if (captchaRaw !== undefined) {
+      const provider = str(captchaRaw, "provider");
+      const secret = str(captchaRaw, "secret");
+      captchaInput = {
+        enabled: yield* gate(captchaRaw, "enabled", "auth.captcha.enabled"),
+        // `str()` returns `""` for an absent key, but the shared validator's
+        // `provider === undefined` check needs a real `undefined` to fire correctly for an
+        // enabled captcha with no provider set.
+        provider: provider.length > 0 ? provider : undefined,
+        secret: secret.length > 0 ? secret : undefined,
+      };
+    }
+
+    // A5: signing keys file load (`config.go:1059-1065`) — I/O, stays in D. A relative path
+    // resolves under the supabase dir; absolute is verbatim.
+    const signingKeysPath = str(authRawResolved, "signing_keys_path");
+    if (signingKeysPath.length > 0) {
+      const keysJson = yield* fs
+        .readFileString(legacyResolveSigningKeysPath(workdir, signingKeysPath))
+        .pipe(
+          Effect.mapError(
+            (cause) =>
+              new LegacyDbConfigLoadError({ message: legacySigningKeysReadErrorMessage(cause) }),
+          ),
+        );
+      yield* Effect.try({
+        try: () => {
+          const parsed: unknown = JSON.parse(keysJson);
+          if (!Array.isArray(parsed)) {
+            throw new Error("signing keys must be a JSON array of JWKs");
+          }
+          return parsed;
+        },
+        catch: (cause) =>
+          new LegacyDbConfigLoadError({ message: legacySigningKeysDecodeErrorMessage(cause) }),
+      });
+    }
+
+    // A6: passkey/webauthn when passkey enabled (`config.go:1066-1084`).
+    const passkeyRaw = asRecord(authRawResolved["passkey"]);
+    let passkeyInput: LegacyPasskeyInput | undefined;
+    if (passkeyRaw !== undefined && (yield* gate(passkeyRaw, "enabled", "auth.passkey.enabled"))) {
+      const webauthnRaw = asRecord(authRawResolved["webauthn"]);
+      const rpOriginsRaw = webauthnRaw?.["rp_origins"];
+      // Go decodes `rp_origins` (a `[]string`) through the same
+      // `StringToSliceHookFunc(",")` mapstructure hook as every other `[]string` field
+      // (`config.go:775-784`) — a raw or `env(...)`-resolved comma-separated string must be
+      // split, not treated as "missing" just because it isn't already a literal TOML array.
+      // Matches `start.handler.ts`'s own `resolveGotruePasskeyWebauthn`/`legacyStrToArr` handling
+      // of this identical field.
+      const rpOrigins = Array.isArray(rpOriginsRaw)
+        ? rpOriginsRaw
+        : legacyStrToArr(str(webauthnRaw, "rp_origins"));
+      passkeyInput = {
+        webauthnPresent: webauthnRaw !== undefined,
+        rpId: str(webauthnRaw, "rp_id"),
+        rpOrigins: rpOrigins.length > 0 ? rpOrigins : undefined,
+      };
+    }
+
+    // B1: hooks — each enabled hook, Go's fixed iteration order (`config.go:1402-1470`).
+    const hookRaw = asRecord(authRawResolved["hook"]);
+    const hookTypes = [
+      "mfa_verification_attempt",
+      "password_verification_attempt",
+      "custom_access_token",
+      "send_sms",
+      "send_email",
+      "before_user_created",
+    ] as const;
+    const hooks: Array<LegacyHookInput> = [];
+    for (const hookType of hookTypes) {
+      const h = asRecord(hookRaw?.[hookType]);
+      if (h !== undefined && (yield* gate(h, "enabled", `auth.hook.${hookType}.enabled`))) {
+        hooks.push({ type: hookType, uri: str(h, "uri"), secrets: str(h, "secrets") });
+      }
+    }
+
+    // B2: mfa — enroll requires verify (`config.go:1472-1483`), fixed totp/phone/web_authn order.
+    const mfaRaw = asRecord(authRawResolved["mfa"]);
+    const mfa: Array<LegacyMfaFactorInput> = [];
+    for (const label of ["totp", "phone", "web_authn"] as const) {
+      const factor = asRecord(mfaRaw?.[label]);
+      mfa.push({
+        label,
+        enrollEnabled: yield* gate(factor, "enroll_enabled", `auth.mfa.${label}.enroll_enabled`),
+        verifyEnabled: yield* gate(factor, "verify_enabled", `auth.mfa.${label}.verify_enabled`),
+      });
+    }
+
+    // B3: email (`config.go:1242-1295`) — template/notification content is I/O, stays in D. Go
+    // resolves a relative `content_path` differently per section: TEMPLATE paths are relative to
+    // the PROJECT ROOT (`config.go:854-856`, the `// FIXME` there), NOTIFICATION paths are
+    // relative to the supabase dir (`config.go:861-862`); absolute → as-is.
+    const emailRaw = asRecord(authRawResolved["email"]);
+    const templatesRaw = asRecord(emailRaw?.["template"]);
+    if (templatesRaw !== undefined) {
+      for (const name of Object.keys(templatesRaw)) {
+        const tmpl = asRecord(templatesRaw[name]);
+        if (tmpl === undefined) continue;
+        const contentPath = yield* Effect.try({
+          try: () =>
+            legacyResolveEmailTemplateContentPath({
+              section: "template",
+              name,
+              contentPath: str(tmpl, "content_path"),
+              contentPresent: tmpl["content"] !== undefined,
+              base: workdir,
+            }),
+          catch: (cause) =>
+            new LegacyDbConfigLoadError({
+              message: cause instanceof Error ? cause.message : String(cause),
+            }),
+        });
+        if (contentPath === undefined) continue;
+        yield* fs.readFileString(contentPath).pipe(
+          Effect.mapError(
+            (cause) =>
+              new LegacyDbConfigLoadError({
+                message: legacyEmailContentPathReadErrorMessage("template", name, cause),
+              }),
+          ),
+        );
+      }
+    }
+    const notificationsRaw = asRecord(emailRaw?.["notification"]);
+    if (notificationsRaw !== undefined) {
+      for (const name of Object.keys(notificationsRaw)) {
+        const tmpl = asRecord(notificationsRaw[name]);
+        if (
+          tmpl === undefined ||
+          !(yield* gate(tmpl, "enabled", `auth.email.notification.${name}.enabled`))
+        ) {
+          continue;
+        }
+        const contentPath = yield* Effect.try({
+          try: () =>
+            legacyResolveEmailTemplateContentPath({
+              section: "notification",
+              name,
+              contentPath: str(tmpl, "content_path"),
+              contentPresent: tmpl["content"] !== undefined,
+              base: supabaseDir,
+            }),
+          catch: (cause) =>
+            new LegacyDbConfigLoadError({
+              message: cause instanceof Error ? cause.message : String(cause),
+            }),
+        });
+        if (contentPath === undefined) continue;
+        yield* fs.readFileString(contentPath).pipe(
+          Effect.mapError(
+            (cause) =>
+              new LegacyDbConfigLoadError({
+                message: legacyEmailContentPathReadErrorMessage("notification", name, cause),
+              }),
+          ),
+        );
+      }
+    }
+    // Go defaults `auth.email.smtp.enabled = true` when the `[auth.email.smtp]` table is present
+    // but omits `enabled` (`config.go:692-696`), so a present table validates unless explicitly
+    // disabled.
+    const smtpRaw = asRecord(emailRaw?.["smtp"]);
+    let smtpInput: LegacySmtpInput | undefined;
+    if (smtpRaw !== undefined) {
+      const smtpPortRaw = smtpRaw["port"];
+      // The shared validator's required-field check is `port === 0` (Go decodes `port` into a
+      // numeric type at the config-decode step, so it can never observe a non-numeric value here).
+      // D reads the raw TOML/env string directly, so a non-numeric `port` (or an unresolved
+      // `env(VAR)`) parses to `NaN` via `Number(...)` — normalize that to `0` so it still trips
+      // the "missing required field" check instead of silently passing config load.
+      const smtpPortNumeric =
+        typeof smtpPortRaw === "number"
+          ? smtpPortRaw
+          : typeof smtpPortRaw === "string"
+            ? Number(legacyExpandEnv(smtpPortRaw, lookup))
+            : 0;
+      smtpInput = {
+        enabled:
+          smtpRaw["enabled"] === undefined
+            ? true
+            : yield* gate(smtpRaw, "enabled", "auth.email.smtp.enabled"),
+        host: str(smtpRaw, "host"),
+        port: Number.isNaN(smtpPortNumeric) ? 0 : smtpPortNumeric,
+        user: str(smtpRaw, "user"),
+        pass: str(smtpRaw, "pass"),
+        adminEmail: str(smtpRaw, "admin_email"),
+      };
+    }
+
+    // B6: third_party — each enabled provider, Go's fixed order (`config.go:1584-1632`). Note
+    // `aws_cognito`'s messages say `cognito` (Go's wording).
+    const thirdPartyRaw = asRecord(authRawResolved["third_party"]);
+    const thirdParty: Array<LegacyThirdPartyInput> = [];
+    const firebaseRaw = asRecord(thirdPartyRaw?.["firebase"]);
+    if (
+      firebaseRaw !== undefined &&
+      (yield* gate(firebaseRaw, "enabled", "auth.third_party.firebase.enabled"))
+    ) {
+      thirdParty.push({ provider: "firebase", requiredField: str(firebaseRaw, "project_id") });
+    }
+    const auth0Raw = asRecord(thirdPartyRaw?.["auth0"]);
+    if (
+      auth0Raw !== undefined &&
+      (yield* gate(auth0Raw, "enabled", "auth.third_party.auth0.enabled"))
+    ) {
+      thirdParty.push({ provider: "auth0", requiredField: str(auth0Raw, "tenant") });
+    }
+    const cognitoRaw = asRecord(thirdPartyRaw?.["aws_cognito"]);
+    if (
+      cognitoRaw !== undefined &&
+      (yield* gate(cognitoRaw, "enabled", "auth.third_party.aws_cognito.enabled"))
+    ) {
+      thirdParty.push({
+        provider: "cognito",
+        requiredField: str(cognitoRaw, "user_pool_id"),
+        cognitoUserPoolRegion: str(cognitoRaw, "user_pool_region"),
+      });
+    }
+    const clerkRaw = asRecord(thirdPartyRaw?.["clerk"]);
+    if (
+      clerkRaw !== undefined &&
+      (yield* gate(clerkRaw, "enabled", "auth.third_party.clerk.enabled"))
+    ) {
+      thirdParty.push({ provider: "clerk", requiredField: str(clerkRaw, "domain") });
+    }
+    const workosRaw = asRecord(thirdPartyRaw?.["workos"]);
+    if (
+      workosRaw !== undefined &&
+      (yield* gate(workosRaw, "enabled", "auth.third_party.workos.enabled"))
+    ) {
+      thirdParty.push({ provider: "workos", requiredField: str(workosRaw, "issuer_url") });
+    }
+
+    authInput = {
+      siteUrl,
+      captcha: captchaInput,
+      passkey: passkeyInput,
+      hooks,
+      mfa,
+      smtp: smtpInput,
+      thirdParty,
+    };
   }
 
   // Go's config.Validate validates `[analytics]` after the auth block (`config.go:1123-1135`).
-  // Two fatal checks run on the db/migration path:
-  //   1. `LogflareBackend.UnmarshalText` (`config.go:60-66`) is a decode-time enum that rejects
-  //      any `backend` other than `postgres`/`bigquery` — regardless of `enabled` (it fires
-  //      during UnmarshalExact, like the captcha provider enum), so it gates here too.
-  //   2. When analytics is enabled with the BigQuery backend, the three GCP fields are required
-  //      (`config.go:1124-1134`), in order, with byte-exact messages.
-  // Go merges the template defaults `enabled = true`, `backend = "postgres"` before Validate
-  // (`templates/config.toml:388-392`), so an absent `[analytics]` section is enabled+postgres and
-  // passes (an empty backend never equals `bigquery`, so the GCP block is skipped). viper
-  // AutomaticEnv binds `SUPABASE_ANALYTICS_*`; a matched remote block makes those keys env-immune,
-  // same as every other `LEGACY_ENV_OVERRIDABLE_KEYS` field above.
+  // Computed here (after the auth block, before the single shared call) rather than pure-derived
+  // earlier: `analyticsEnabled` resolves through `resolveBoolOrFail`, which can itself FAIL on a
+  // malformed `SUPABASE_ANALYTICS_ENABLED`/`analytics.enabled` bool — positioning that failure
+  // point ahead of the auth block would report it before an auth-block error even for a config
+  // that's ALSO broken there, reversing Go's real order. Go merges the template defaults
+  // `enabled = true`, `backend = "postgres"` before Validate (`templates/config.toml:388-392`), so
+  // an absent `[analytics]` section is enabled+postgres and passes (an empty backend never equals
+  // `bigquery`, so the GCP block is skipped). viper AutomaticEnv binds `SUPABASE_ANALYTICS_*`; a
+  // matched remote block makes those keys env-immune, same as every other
+  // `LEGACY_ENV_OVERRIDABLE_KEYS` field above.
   const analyticsString = (key: string, envName: string): string => {
     const fromEnv = remoteOverrideKeys.has(`analytics.${key}`) ? undefined : envOverride(envName);
     const raw = fromEnv ?? analyticsRaw?.[key];
     return typeof raw === "string" ? legacyExpandEnv(raw, lookup) : "";
   };
   const analyticsBackend = analyticsString("backend", "SUPABASE_ANALYTICS_BACKEND");
-  if (
-    analyticsBackend.length > 0 &&
-    analyticsBackend !== "postgres" &&
-    analyticsBackend !== "bigquery"
-  ) {
-    // Mirror the captcha enum's mapstructure envelope (`%v` of the allowed `[]LogflareBackend`).
-    return yield* Effect.fail(
-      new LegacyDbConfigLoadError({
-        message:
-          "failed to parse config: decoding failed due to the following error(s):\n\n'analytics.backend' must be one of [postgres bigquery]",
-      }),
-    );
-  }
   const analyticsEnabled = yield* resolveBoolOrFail(
     "analytics.enabled",
     analyticsRaw?.["enabled"],
@@ -1682,32 +1661,128 @@ export const legacyReadDbToml = Effect.fnUntraced(function* (
       ? undefined
       : envOverride("SUPABASE_ANALYTICS_ENABLED"),
   );
-  if (analyticsEnabled && analyticsBackend === "bigquery") {
-    // Each GCP value is env-expanded (Go's LoadEnvHook), so an unresolved `env(VAR)` stays
-    // non-empty and passes the `len(...) == 0` check, exactly like Go.
-    if (analyticsString("gcp_project_id", "SUPABASE_ANALYTICS_GCP_PROJECT_ID").length === 0) {
-      return yield* Effect.fail(
-        new LegacyDbConfigLoadError({
-          message: "Missing required field in config: analytics.gcp_project_id",
-        }),
+  // Each GCP value is env-expanded (Go's LoadEnvHook), so an unresolved `env(VAR)` stays
+  // non-empty and passes the shared validator's `length === 0` check, exactly like Go.
+  const gcpProjectId = analyticsString("gcp_project_id", "SUPABASE_ANALYTICS_GCP_PROJECT_ID");
+  const gcpProjectNumber = analyticsString(
+    "gcp_project_number",
+    "SUPABASE_ANALYTICS_GCP_PROJECT_NUMBER",
+  );
+  const gcpJwtPath = analyticsString("gcp_jwt_path", "SUPABASE_ANALYTICS_GCP_JWT_PATH");
+
+  // Every PURE Config.Validate check this module/legacy-config-validate.ts jointly own (db.port
+  // is checked earlier, above, and stays there — see the comment at that check) is deferred to
+  // this single call, in Go's exact relative order. D's sms/external checks (D-only, never part
+  // of the shared validator) run AFTER this call succeeds, still gated on `authEnabled` — see
+  // `legacy-config-validate.ts`'s module header for the accepted ordering tradeoff this
+  // introduces against third_party.
+  const dbInput: LegacyDbInput = { port, majorVersion };
+  const analyticsInput: LegacyAnalyticsInput = {
+    enabled: analyticsEnabled,
+    backend: analyticsBackend.length > 0 ? analyticsBackend : undefined,
+    gcpProjectId,
+    gcpProjectNumber,
+    gcpJwtPath,
+  };
+  const experimentalInput: LegacyExperimentalInput = {
+    pgdeltaFormatOptions: formatOptionsExpanded,
+  };
+  const validationInput: LegacyConfigValidationInput = {
+    db: dbInput,
+    storageBucketNames: bucketsRaw !== undefined ? Object.keys(bucketsRaw) : [],
+    functionSlugs: functionsRaw !== undefined ? Object.keys(functionsRaw) : [],
+    auth: authInput,
+    edgeRuntimeDenoVersion: denoVersion,
+    analytics: analyticsInput,
+    experimental: experimentalInput,
+  };
+  yield* Effect.try({
+    try: () => legacyValidateResolvedConfig(validationInput),
+    catch: (cause) =>
+      new LegacyDbConfigLoadError({
+        message: cause instanceof Error ? cause.message : String(cause),
+      }),
+  });
+
+  if (authEnabled) {
+    // B4: sms — D-only (`config.go:1145-1147`/`1348-1417`, never part of the shared validator,
+    // see `legacy-config-validate.ts`'s module header). Only the FIRST enabled provider is
+    // validated (Go's switch).
+    const sms = asRecord(authRawResolved["sms"]);
+    if (sms !== undefined) {
+      const twilio = asRecord(sms["twilio"]);
+      const twilioVerify = asRecord(sms["twilio_verify"]);
+      const messagebird = asRecord(sms["messagebird"]);
+      const textlocal = asRecord(sms["textlocal"]);
+      const vonage = asRecord(sms["vonage"]);
+      const twilioEnabled = yield* gate(twilio, "enabled", "auth.sms.twilio.enabled");
+      const twilioVerifyEnabled = yield* gate(
+        twilioVerify,
+        "enabled",
+        "auth.sms.twilio_verify.enabled",
       );
-    }
-    if (
-      analyticsString("gcp_project_number", "SUPABASE_ANALYTICS_GCP_PROJECT_NUMBER").length === 0
-    ) {
-      return yield* Effect.fail(
-        new LegacyDbConfigLoadError({
-          message: "Missing required field in config: analytics.gcp_project_number",
-        }),
+      const messagebirdEnabled = yield* gate(
+        messagebird,
+        "enabled",
+        "auth.sms.messagebird.enabled",
       );
+      const textlocalEnabled = yield* gate(textlocal, "enabled", "auth.sms.textlocal.enabled");
+      const vonageEnabled = yield* gate(vonage, "enabled", "auth.sms.vonage.enabled");
+      if (twilioEnabled) {
+        if (str(twilio, "account_sid").length === 0)
+          return yield* fail("Missing required field in config: auth.sms.twilio.account_sid");
+        if (str(twilio, "message_service_sid").length === 0)
+          return yield* fail(
+            "Missing required field in config: auth.sms.twilio.message_service_sid",
+          );
+        if (str(twilio, "auth_token").length === 0)
+          return yield* fail("Missing required field in config: auth.sms.twilio.auth_token");
+      } else if (twilioVerifyEnabled) {
+        if (str(twilioVerify, "account_sid").length === 0)
+          return yield* fail(
+            "Missing required field in config: auth.sms.twilio_verify.account_sid",
+          );
+        if (str(twilioVerify, "message_service_sid").length === 0)
+          return yield* fail(
+            "Missing required field in config: auth.sms.twilio_verify.message_service_sid",
+          );
+        if (str(twilioVerify, "auth_token").length === 0)
+          return yield* fail("Missing required field in config: auth.sms.twilio_verify.auth_token");
+      } else if (messagebirdEnabled) {
+        if (str(messagebird, "originator").length === 0)
+          return yield* fail("Missing required field in config: auth.sms.messagebird.originator");
+        if (str(messagebird, "access_key").length === 0)
+          return yield* fail("Missing required field in config: auth.sms.messagebird.access_key");
+      } else if (textlocalEnabled) {
+        if (str(textlocal, "sender").length === 0)
+          return yield* fail("Missing required field in config: auth.sms.textlocal.sender");
+        if (str(textlocal, "api_key").length === 0)
+          return yield* fail("Missing required field in config: auth.sms.textlocal.api_key");
+      } else if (vonageEnabled) {
+        if (str(vonage, "from").length === 0)
+          return yield* fail("Missing required field in config: auth.sms.vonage.from");
+        if (str(vonage, "api_key").length === 0)
+          return yield* fail("Missing required field in config: auth.sms.vonage.api_key");
+        if (str(vonage, "api_secret").length === 0)
+          return yield* fail("Missing required field in config: auth.sms.vonage.api_secret");
+      }
     }
-    if (analyticsString("gcp_jwt_path", "SUPABASE_ANALYTICS_GCP_JWT_PATH").length === 0) {
-      return yield* Effect.fail(
-        new LegacyDbConfigLoadError({
-          message:
-            "Path to GCP Service Account Key must be provided in config, relative to config.toml: analytics.gcp_jwt_path",
-        }),
-      );
+
+    // B5: external providers — D-only (`config.go:1148-1150`/`1368-1398`, never part of the
+    // shared validator). linkedin/slack are deprecated and deleted before validation, so they are
+    // never validated here.
+    const external = asRecord(authRawResolved["external"]);
+    if (external !== undefined) {
+      for (const name of Object.keys(external)) {
+        if (name === "linkedin" || name === "slack") continue;
+        const provider = asRecord(external[name]);
+        if (provider === undefined) continue;
+        if (!(yield* gate(provider, "enabled", `auth.external.${name}.enabled`))) continue;
+        if (str(provider, "client_id").length === 0)
+          return yield* fail(`Missing required field in config: auth.external.${name}.client_id`);
+        if (name !== "apple" && name !== "google" && str(provider, "secret").length === 0)
+          return yield* fail(`Missing required field in config: auth.external.${name}.secret`);
+      }
     }
   }
 
@@ -1770,13 +1845,9 @@ export const legacyReadDbToml = Effect.fnUntraced(function* (
         : typeof rawSqlPaths === "string"
           ? splitGoSeedPaths(rawSqlPaths)
           : ["seed.sql"];
-  const seedSqlPaths = sqlPathPatterns.map((pattern) => {
-    // Patterns are already env-expanded above (Go's LoadEnvHook runs before the split), so
-    // an absolute path is used verbatim and a relative one is supabase-prefixed via Go's
-    // `path.Join("supabase", pattern)` → `path.Clean` (collapses `.`/`..`).
-    if (pattern.length === 0 || path.isAbsolute(pattern)) return pattern;
-    return legacyJoinSupabaseSeedPath(pattern);
-  });
+  // Patterns are already env-expanded above (Go's LoadEnvHook runs before the split);
+  // resolve each to Go's config-load form (absolute verbatim, relative supabase-joined).
+  const seedSqlPaths = sqlPathPatterns.map((pattern) => legacyResolveSeedSqlPath(path, pattern));
 
   // `[db.vault]` secrets: env-expand each value, then decrypt dotenvx `encrypted:`
   // ciphertext. `resolved` mirrors Go's `len(SHA256) > 0` gate (Go sets SHA256 only
@@ -1823,9 +1894,22 @@ export const legacyReadDbToml = Effect.fnUntraced(function* (
     apiRaw?.["auto_expose_new_tables"],
     lookup,
   );
+  const apiSchemas = resolveStringSlice(
+    (remoteOverrideKeys.has("api.schemas") ? undefined : envOverride("SUPABASE_API_SCHEMAS")) ??
+      apiRaw?.["schemas"],
+    DEFAULT_API_SCHEMAS,
+    lookup,
+  );
+  if (apiSchemas === undefined) {
+    return yield* Effect.fail(
+      new LegacyDbConfigLoadError({ message: "failed to parse config: invalid api.schemas." }),
+    );
+  }
 
   const values: LegacyDbTomlValues = {
+    projectEnv,
     envLookup: envOverride,
+    apiSchemas,
     port,
     shadowPort,
     password: passwordRaw !== undefined ? legacyExpandEnv(passwordRaw, lookup) : DEFAULT_PASSWORD,
@@ -1860,10 +1944,53 @@ export const legacyReadDbToml = Effect.fnUntraced(function* (
     migrationsEnabled,
     seed: { enabled: seedEnabled, sqlPaths: seedSqlPaths },
     vault,
+    appliedRemote,
   };
   return values;
 });
 
+/**
+ * Read + validate `config.toml` exactly like Go's `flags.LoadConfig` → `config.Load`
+ * → `Validate`: an absent file yields defaults, but a present config that is
+ * unreadable/malformed, references an undecryptable `encrypted:` secret, or fails any
+ * of Go's decode/Validate checks (remote refs, `db.port`, `db.major_version`,
+ * `edge_runtime.deno_version`, pgdelta gate, `format_options` JSON, bucket names,
+ * function slugs, auth, analytics) aborts with the matching Go error. Call this at the
+ * point Go fails fast — before asserting the stack is running, prompting, or any
+ * destructive work — so a broken config never runs against the default local database.
+ */
+export const legacyCheckDbToml = (
+  fs: FileSystem.FileSystem,
+  path: Path.Path,
+  workdir: string,
+  ref?: string,
+) => readDbTomlCore(fs, path, workdir, ref, false);
+
+/**
+ * Read `config.toml`. Defaults to Go's validating behavior (identical to
+ * {@link legacyCheckDbToml}); pass `{ validate: false }` for a best-effort read that
+ * never throws on an invalid config — a config-load failure falls back to pure
+ * defaults (env overrides still applied), matching the tolerant behavior the
+ * container-id seam needs when it only wants `projectId` and the handler has already
+ * validated the config. The throwing default keeps every existing caller at Go parity.
+ */
+export const legacyReadDbToml = (
+  fs: FileSystem.FileSystem,
+  path: Path.Path,
+  workdir: string,
+  ref?: string,
+  opts?: { readonly validate?: boolean },
+) =>
+  opts?.validate === false
+    ? readDbTomlCore(fs, path, workdir, ref, false).pipe(
+        // Fall back to the ignore-file defaults path (never re-reads the broken config)
+        // so a best-effort caller gets a well-formed defaults result instead of a throw.
+        Effect.catchTag("LegacyDbConfigLoadError", () =>
+          readDbTomlCore(fs, path, workdir, ref, true),
+        ),
+      )
+    : readDbTomlCore(fs, path, workdir, ref, false);
+
 /**
  * The effective declarative schema directory: the configured
  * `declarative_schema_path` (already `supabase/`-prefixed when relative) or the
diff --git a/apps/cli/src/legacy/shared/legacy-db-config.toml-read.unit.test.ts b/apps/cli/src/legacy/shared/legacy-db-config.toml-read.unit.test.ts
index 986c8a6075..17a6d1c4f9 100644
--- a/apps/cli/src/legacy/shared/legacy-db-config.toml-read.unit.test.ts
+++ b/apps/cli/src/legacy/shared/legacy-db-config.toml-read.unit.test.ts
@@ -7,6 +7,7 @@ import { Effect, Exit, FileSystem, Option, Path } from "effect";
 
 import {
   legacyApplyProjectEnv,
+  legacyCheckDbToml,
   legacyLoadProjectEnv,
   legacyReadDbToml,
   legacyResolveDeclarativeDir,
@@ -46,6 +47,69 @@ const loadEnv = (workdir: string) =>
     return yield* legacyLoadProjectEnv(fs, path, workdir);
   }).pipe(Effect.provide(BunServices.layer));
 
+describe("read (lenient) vs check (throws) split", () => {
+  const withServices = <A, E>(
+    dir: string,
+    run: (fs: FileSystem.FileSystem, path: Path.Path) => Effect.Effect<A, E, never>,
+  ) =>
+    Effect.gen(function* () {
+      const fs = yield* FileSystem.FileSystem;
+      const path = yield* Path.Path;
+      return yield* run(fs, path);
+    }).pipe(Effect.provide(BunServices.layer));
+
+  it.effect("legacyCheckDbToml throws on an undecryptable secret", () => {
+    const dir = withConfig('[db]\nroot_key = "encrypted:anything"\n');
+    return withServices(dir, (fs, path) => legacyCheckDbToml(fs, path, dir)).pipe(
+      Effect.exit,
+      Effect.tap((exit) =>
+        Effect.sync(() => {
+          expect(Exit.isFailure(exit)).toBe(true);
+          if (Exit.isFailure(exit)) {
+            expect(JSON.stringify(exit.cause)).toContain(
+              "failed to parse config: missing private key",
+            );
+          }
+          rmSync(dir, { recursive: true, force: true });
+        }),
+      ),
+    );
+  });
+
+  it.effect(
+    "legacyReadDbToml({ validate: false }) tolerates the same secret, returning defaults",
+    () => {
+      const dir = withConfig('[db]\nroot_key = "encrypted:anything"\n');
+      return withServices(dir, (fs, path) =>
+        legacyReadDbToml(fs, path, dir, undefined, { validate: false }),
+      ).pipe(
+        Effect.tap((v) =>
+          Effect.sync(() => {
+            // The broken config is swallowed → the ignore-file defaults path (no vault).
+            expect(v.vault).toEqual([]);
+            expect(v.port).toBeGreaterThan(0);
+            rmSync(dir, { recursive: true, force: true });
+          }),
+        ),
+      );
+    },
+  );
+
+  it.effect("legacyReadDbToml({ validate: false }) still returns a valid config's values", () => {
+    const dir = withConfig('project_id = "lenientproj"\n');
+    return withServices(dir, (fs, path) =>
+      legacyReadDbToml(fs, path, dir, undefined, { validate: false }),
+    ).pipe(
+      Effect.tap((v) =>
+        Effect.sync(() => {
+          expect(v.projectId).toEqual(Option.some("lenientproj"));
+          rmSync(dir, { recursive: true, force: true });
+        }),
+      ),
+    );
+  });
+});
+
 describe("legacyReadDbToml", () => {
   it.effect("returns defaults when config.toml is absent", () => {
     const dir = withConfig(undefined);
@@ -389,6 +453,61 @@ describe("legacyReadDbToml", () => {
     );
   });
 
+  it.effect("an explicit remote auth.enabled beats its SUPABASE_AUTH_ENABLED env var", () => {
+    // Same v.Set-above-AutomaticEnv precedence as db.migrations.enabled / pgdelta.enabled
+    // (config.go:635-637), but for auth.enabled specifically (CLI-1878): a matched remote
+    // block's auth.enabled must win over SUPABASE_AUTH_ENABLED.
+    const ref = "abcdefghijklmnopqrst";
+    const previous = process.env["SUPABASE_AUTH_ENABLED"];
+    process.env["SUPABASE_AUTH_ENABLED"] = "true";
+    const dir = withConfig(
+      [
+        "[remotes.prod]",
+        `project_id = "${ref}"`,
+        "[remotes.prod.auth]",
+        "enabled = false",
+        "",
+      ].join("\n"),
+    );
+    return readRef(dir, ref).pipe(
+      Effect.tap((v) =>
+        Effect.sync(() => {
+          expect(v.baseline.authEnabled).toBe(false);
+        }),
+      ),
+      Effect.ensuring(
+        Effect.sync(() => {
+          if (previous === undefined) delete process.env["SUPABASE_AUTH_ENABLED"];
+          else process.env["SUPABASE_AUTH_ENABLED"] = previous;
+          rmSync(dir, { recursive: true, force: true });
+        }),
+      ),
+    );
+  });
+
+  it.effect("SUPABASE_AUTH_ENABLED still wins when the remote block omits auth.enabled", () => {
+    // Control: the env override is suppressed only for keys the matched block explicitly
+    // set; a block that omits auth.enabled leaves the env override in force.
+    const ref = "abcdefghijklmnopqrst";
+    const previous = process.env["SUPABASE_AUTH_ENABLED"];
+    process.env["SUPABASE_AUTH_ENABLED"] = "false";
+    const dir = withConfig(["[remotes.prod]", `project_id = "${ref}"`, ""].join("\n"));
+    return readRef(dir, ref).pipe(
+      Effect.tap((v) =>
+        Effect.sync(() => {
+          expect(v.baseline.authEnabled).toBe(false);
+        }),
+      ),
+      Effect.ensuring(
+        Effect.sync(() => {
+          if (previous === undefined) delete process.env["SUPABASE_AUTH_ENABLED"];
+          else process.env["SUPABASE_AUTH_ENABLED"] = previous;
+          rmSync(dir, { recursive: true, force: true });
+        }),
+      ),
+    );
+  });
+
   it.effect("matches a remote block by a SUPABASE_REMOTES_<NAME>_PROJECT_ID env override", () => {
     // Viper AutomaticEnv supplies/overrides remotes.prod.project_id, so the block merges
     // even with no TOML project_id (here it lifts major_version 15 over the base default).
@@ -796,6 +915,39 @@ describe("legacyReadDbToml", () => {
     );
   });
 
+  it.effect("rejects an unparseable [storage.buckets.<name>].file_size_limit during load", () => {
+    // Go's config.Load decodes every bucket's file_size_limit via the sizeInBytes
+    // decode hook unconditionally (`pkg/config/config.go`), so a malformed value must
+    // fail config load itself — not only later, deep inside `legacySeedBucketsRun`,
+    // where it would go unvalidated on a reused-volume restart or the already-running
+    // short-circuit.
+    const dir = withConfig('[storage.buckets.avatars]\nfile_size_limit = "bogus"\n');
+    return read(dir).pipe(
+      Effect.exit,
+      Effect.tap((exit) =>
+        Effect.sync(() => {
+          expect(Exit.isFailure(exit)).toBe(true);
+          if (Exit.isFailure(exit)) {
+            const json = JSON.stringify(exit.cause);
+            expect(json).toContain("LegacyDbConfigLoadError");
+            expect(json).toContain("invalid storage.buckets.avatars.file_size_limit");
+          }
+          rmSync(dir, { recursive: true, force: true });
+        }),
+      ),
+    );
+  });
+
+  it.effect("accepts a bare-number [storage.buckets.<name>].file_size_limit", () => {
+    // `@supabase/config`'s schema allows file_size_limit as either a quoted
+    // human-readable string or a bare byte count; the numeric form must normalize to
+    // a string before `ramInBytes` parses it rather than being rejected outright.
+    const dir = withConfig("[storage.buckets.avatars]\nfile_size_limit = 5242880\n");
+    return read(dir).pipe(
+      Effect.tap(() => Effect.sync(() => rmSync(dir, { recursive: true, force: true }))),
+    );
+  });
+
   it.effect("parses [api] auto_expose_new_tables string with Go bool tokens (TRUE → true)", () => {
     // Go decodes the *bool via strconv.ParseBool, so `TRUE`/`1`/`t` are true — not only
     // the literal lowercase `true`.
@@ -810,11 +962,12 @@ describe("legacyReadDbToml", () => {
     );
   });
 
-  it.effect("keeps [api] auto_expose_new_tables tri-state None when absent", () => {
-    const dir = withConfig("[api]\n");
+  it.effect("decodes empty api schemas while keeping auto_expose_new_tables absent", () => {
+    const dir = withConfig('[api]\nschemas = ""\n');
     return read(dir).pipe(
       Effect.tap((v) =>
         Effect.sync(() => {
+          expect(v.apiSchemas).toEqual([]);
           expect(Option.isNone(v.baseline.apiAutoExposeNewTables)).toBe(true);
           rmSync(dir, { recursive: true, force: true });
         }),
@@ -1466,6 +1619,28 @@ describe("legacyReadDbToml", () => {
     );
   });
 
+  it.effect("rejects db.major_version = 0 with Go's missing-required message", () => {
+    // Divergence #1 fix: this used to fall through to the generic
+    // "Failed reading config: Invalid db.major_version: 0." message (the same branch that
+    // catches an unsupported value like 16) — `legacyValidateResolvedConfig`'s dedicated `0` case
+    // now matches Go's `Missing required field in config: db.major_version`.
+    const dir = withConfig(["[db]", "major_version = 0", ""].join("\n"));
+    return read(dir).pipe(
+      Effect.exit,
+      Effect.tap((exit) =>
+        Effect.sync(() => {
+          expect(Exit.isFailure(exit)).toBe(true);
+          if (Exit.isFailure(exit)) {
+            expect(JSON.stringify(exit.cause)).toContain(
+              "Missing required field in config: db.major_version",
+            );
+          }
+          rmSync(dir, { recursive: true, force: true });
+        }),
+      ),
+    );
+  });
+
   it.effect("rejects db.major_version = 12 with Go's 12.x message", () => {
     const dir = withConfig(["[db]", "major_version = 12", ""].join("\n"));
     return read(dir).pipe(
@@ -1975,6 +2150,19 @@ describe("legacyReadDbToml auth.Enabled validation (Go config.Validate parity)",
       'rp_origins = ["http://localhost:3000"]',
     ]),
   );
+  it.effect("accepts a comma-separated rp_origins string instead of rejecting it as missing", () =>
+    // Go decodes `rp_origins` (a `[]string`) through the same `StringToSliceHookFunc(",")`
+    // mapstructure hook as every other `[]string` field, so a raw string (not just a literal
+    // TOML array) must split, not read as absent — matches start.handler.ts's own
+    // resolveGotruePasskeyWebauthn/legacyStrToArr handling of this identical field.
+    succeeds([
+      "[auth.passkey]",
+      "enabled = true",
+      "[auth.webauthn]",
+      'rp_id = "localhost"',
+      'rp_origins = "http://a.example,http://b.example"',
+    ]),
+  );
 
   it.effect("rejects an http hook missing secrets", () =>
     failsWith(
@@ -2190,6 +2378,102 @@ describe("legacyReadDbToml encrypted secret decryption (Go DecryptSecretHookFunc
   it.effect("treats an unset env() secret as a no-op (verbatim, like Go's hook)", () =>
     expectLoads(["[db]", 'root_key = "env(SOME_UNSET_ROOT_KEY)"']),
   );
+  it.effect("does NOT decrypt a non-secret string that starts with encrypted:", () =>
+    // Go's hook only runs while decoding into `config.Secret`; a non-secret field like an
+    // email-template subject stays plain text, so `db push`/`reset`/`start` must not abort.
+    expectLoads([
+      "[auth.email.template.invite]",
+      'subject = "encrypted: your invite"',
+      "[db]",
+      'root_key = "env(SOME_UNSET_ROOT_KEY)"',
+    ]),
+  );
+  it.effect("fails on an undecryptable auth.captcha.secret (Secret-typed field)", () =>
+    expectFails(
+      [
+        "[auth.captcha]",
+        "enabled = false",
+        'provider = "hcaptcha"',
+        'secret = "encrypted:anything"',
+      ],
+      "failed to parse config: missing private key",
+    ),
+  );
+  it.effect("fails on an undecryptable [edge_runtime.secrets] value (map[string]Secret)", () =>
+    expectFails(
+      ["[edge_runtime.secrets]", 'MY_SECRET = "encrypted:anything"'],
+      "failed to parse config: missing private key",
+    ),
+  );
+  it.effect("fails on an undecryptable Secret inside a [remotes.*] block", () =>
+    // Go decodes every remote block into the same struct, so an undecryptable secret in any
+    // remote (matched or not) aborts the load.
+    expectFails(
+      [
+        "[remotes.preview]",
+        'project_id = "abcdefghijklmnopqrst"',
+        "[remotes.preview.db]",
+        'root_key = "encrypted:anything"',
+      ],
+      "failed to parse config: missing private key",
+    ),
+  );
+});
+
+describe("legacyReadDbToml non-scalar config booleans (Go UnmarshalExact parity)", () => {
+  // Go's `UnmarshalExact` fails to decode a bool field given an array/inline-table value,
+  // aborting `LoadConfig` before any destructive work. A present non-scalar must not fall
+  // through to the schema default (which would let `db reset` prompt + drop schemas).
+  const failsInvalid = (lines: ReadonlyArray<string>, field: string) =>
+    Effect.gen(function* () {
+      const dir = withConfig(lines.join("\n"));
+      const exit = yield* read(dir).pipe(Effect.exit);
+      expect(Exit.isFailure(exit)).toBe(true);
+      if (Exit.isFailure(exit)) {
+        expect(JSON.stringify(exit.cause)).toContain(`failed to parse config: invalid ${field}.`);
+      }
+      rmSync(dir, { recursive: true, force: true });
+    });
+  it.effect("rejects an array value for [db.migrations] enabled", () =>
+    failsInvalid(["[db.migrations]", "enabled = []"], "db.migrations.enabled"),
+  );
+  it.effect("rejects an inline-table value for [db.seed] enabled", () =>
+    failsInvalid(["[db.seed]", "enabled = {}"], "db.seed.enabled"),
+  );
+});
+
+describe("legacyReadDbToml empty project_id (Go config.Validate parity)", () => {
+  it.effect("rejects a present-but-empty top-level project_id", () => {
+    // Go keeps the empty override and `config.Validate` fails "Missing required field in
+    // config: project_id" (config.go:991) before any destructive command runs.
+    const dir = withConfig('project_id = ""\n');
+    return read(dir).pipe(
+      Effect.exit,
+      Effect.tap((exit) =>
+        Effect.sync(() => {
+          expect(Exit.isFailure(exit)).toBe(true);
+          if (Exit.isFailure(exit)) {
+            expect(JSON.stringify(exit.cause)).toContain(
+              "Missing required field in config: project_id",
+            );
+          }
+          rmSync(dir, { recursive: true, force: true });
+        }),
+      ),
+    );
+  });
+
+  it.effect("still tolerates an absent project_id (deferred broader requirement)", () => {
+    const dir = withConfig("[db]\nmajor_version = 15\n");
+    return read(dir).pipe(
+      Effect.tap((v) =>
+        Effect.sync(() => {
+          expect(v.baseline).toBeDefined();
+          rmSync(dir, { recursive: true, force: true });
+        }),
+      ),
+    );
+  });
 });
 
 describe("legacyReadDbToml [analytics] validation (Go config.Validate parity)", () => {
diff --git a/apps/cli/src/legacy/shared/legacy-db-connection.service.ts b/apps/cli/src/legacy/shared/legacy-db-connection.service.ts
index bbf1e81dbf..d2bfb2b261 100644
--- a/apps/cli/src/legacy/shared/legacy-db-connection.service.ts
+++ b/apps/cli/src/legacy/shared/legacy-db-connection.service.ts
@@ -1,4 +1,5 @@
 import { Context, type Effect, type Scope } from "effect";
+import type { LegacyConnectSuggestionContext } from "./legacy-connect-errors.ts";
 import type {
   LegacyDbConnectError,
   LegacyDbCopyError,
@@ -71,6 +72,13 @@ export interface LegacyPgConnInput {
    * `ToPostgresURL`/`ConnectLocalPostgres`).
    */
   readonly connectTimeoutSeconds?: number;
+  /**
+   * Profile context for the connect-failure suggestion (Go's `SetConnectSuggestion`,
+   * which reads the ambient `CurrentProfile` in `ConnectByUrl`). The resolver attaches
+   * it so the driver layer can map a refused/auth/IPv6 connect error to Go's actionable
+   * hint. Absent → the driver omits the suggestion (callers fall back to the generic one).
+   */
+  readonly suggestionContext?: LegacyConnectSuggestionContext;
 }
 
 /**
diff --git a/apps/cli/src/legacy/shared/legacy-db-connection.sql-pg.layer.ts b/apps/cli/src/legacy/shared/legacy-db-connection.sql-pg.layer.ts
index fbd5bfca90..7553b1a3e0 100644
--- a/apps/cli/src/legacy/shared/legacy-db-connection.sql-pg.layer.ts
+++ b/apps/cli/src/legacy/shared/legacy-db-connection.sql-pg.layer.ts
@@ -2,14 +2,16 @@ import { readFileSync } from "node:fs";
 import * as net from "node:net";
 import type { ConnectionOptions } from "node:tls";
 import { PgClient } from "@effect/sql-pg";
-import { Duration, Effect, Layer, Redacted, type Scope } from "effect";
+import { Duration, Effect, Exit, Layer, Scope } from "effect";
 import * as Reactivity from "effect/unstable/reactivity/Reactivity";
+import { ConnectionError, SqlError } from "effect/unstable/sql/SqlError";
 // `pg` is also `@effect/sql-pg`'s transitive driver; we depend on it directly only
 // for the COPY protocol (which `@effect/sql-pg` does not expose). Keep the direct
 // `pg` version constraint in package.json aligned with the one `@effect/sql-pg`
 // resolves, so the COPY path and the pooled path use the same driver.
 import * as Pg from "pg";
 import { to as pgCopyTo } from "pg-copy-streams";
+import { legacyConnectSuggestion } from "./legacy-connect-errors.ts";
 import {
   LegacyDbConnectError,
   LegacyDbCopyError,
@@ -26,10 +28,16 @@ import { legacyResolveHostsOverHttps } from "./legacy-db-dns.ts";
 // node-postgres honors `queryMode: "extended"` to force the Parse/Bind/Execute
 // protocol (`pg/lib/query.js` `requiresPreparation`), but `@types/pg` doesn't declare
 // it. Augment `QueryConfig` so `queryRaw` can request it without an `as` cast.
+// pg-pool likewise honors a `verify(client, callback)` option — run for every
+// brand-new physical connection before it is handed to a waiting checkout
+// (`pg-pool/index.js` `_acquireClient`) — that `@types/pg` doesn't declare either.
 declare module "pg" {
   interface QueryConfig {
     queryMode?: "extended" | "simple";
   }
+  interface PoolConfig {
+    verify?: (client: import("pg").PoolClient, callback: (err?: Error) => void) => void;
+  }
 }
 
 // Go's role step-down (`apps/cli-go/internal/utils/connect.go:200-220`,
@@ -326,6 +334,178 @@ export function legacySslConfigsFor(
   return [legacySslOptionFor(sslmode, false, servername, caCert, clientCert)];
 }
 
+/**
+ * The raw `pg.ClientConfig` for a dial target, choosing the connection-string form
+ * whenever a libpq `options`/`runtimeParams` payload must reach the server (see
+ * `legacyBuildConnectionUrl`) and discrete fields otherwise (to avoid round-tripping
+ * the password through a URL). `copyToCsv` / `queryRaw` reuse it to open a dedicated
+ * node-postgres client for the COPY protocol and full result metadata (neither is
+ * surfaced by `@effect/sql-pg`), against whichever target the primary connection won.
+ */
+export function legacyBuildRawPgConfig(
+  cfg: LegacyPgConnInput,
+  host: string,
+  port: number,
+  sslOption: boolean | ConnectionOptions | undefined,
+  connectTimeoutSeconds: number,
+): Pg.ClientConfig {
+  const hasOptions = legacyMergedConnectionOptions(cfg) !== undefined;
+  return {
+    ...(hasOptions
+      ? { connectionString: legacyBuildConnectionUrl(cfg, host, port) }
+      : { host, port, user: cfg.user, password: cfg.password, database: cfg.database }),
+    ...(sslOption === undefined ? {} : { ssl: sslOption }),
+    connectionTimeoutMillis: connectTimeoutSeconds * 1000,
+  };
+}
+
+/**
+ * The `pg.PoolConfig` for the primary pooled connection. Extends the raw client
+ * config with the two pool controls this layer depends on:
+ *
+ * - `max: 1` — a single physical connection, so a session-scoped `SET SESSION ROLE`
+ *   (the remote step-down) and any session GUCs persist across `exec`/`query` calls.
+ * - `idleTimeoutMillis: 0` — node-postgres documents `0` as disabling auto-reaping of
+ *   idle connections. `PgClient.make` leaves this unset (→ node-postgres default
+ *   10_000ms), which during a long-idle `db pull` (shadow-DB provisioning + diff +
+ *   interactive confirm prompt) reaps the stepped-down connection after 10s idle and
+ *   transparently redials a fresh one for the final migration-table write; that fresh
+ *   connection never ran the step-down, so the DDL executes as the bare `cli_login_*`
+ *   role and fails with `permission denied` (42501). Disabling the reaper keeps the
+ *   single stepped-down connection alive for the whole session.
+ *
+ * `application_name` mirrors `PgClient.make`'s default so the server-side session name
+ * is unchanged from the previous `PgClient.make` path.
+ *
+ * When `stepDownRequired`, the pool also gets the `verify` step-down hook so every
+ * new physical connection runs `SET SESSION ROLE postgres` before it is handed out
+ * (see `legacyPoolStepDownVerify`).
+ */
+export function legacyBuildPoolConfig(
+  cfg: LegacyPgConnInput,
+  host: string,
+  port: number,
+  sslOption: boolean | ConnectionOptions | undefined,
+  connectTimeoutSeconds: number,
+  stepDownRequired: boolean,
+): Pg.PoolConfig {
+  return {
+    ...legacyBuildRawPgConfig(cfg, host, port, sslOption, connectTimeoutSeconds),
+    idleTimeoutMillis: 0,
+    max: 1,
+    application_name: "@effect/sql-pg",
+    ...(stepDownRequired ? { verify: legacyPoolStepDownVerify } : {}),
+  };
+}
+
+// Minimal structural views of `pg.Pool` / `pg.PoolClient` used by the pool hooks,
+// so the wiring can be unit-tested with a tiny fake at the driver boundary instead
+// of a live pool. A real `pg.Pool`/`pg.PoolClient` satisfies these (their `on`
+// overloads and `query` signatures are wider).
+interface LegacyStepDownClient {
+  readonly query: (sql: string) => Promise<unknown>;
+}
+interface LegacyPoolErrorSource {
+  readonly on: (event: "error", listener: (error: Error) => void) => unknown;
+}
+
+/**
+ * pg-pool `verify` hook that re-runs the remote role step-down on EVERY new
+ * physical connection, matching Go's `AfterConnect` (`connect.go:355-361`) —
+ * including the silent redial after a dropped connection, which the post-connect
+ * one-shot in `connect` can't reach. pg-pool invokes `verify` for a brand-new
+ * client BEFORE resolving the pending checkout (`pg-pool/index.js`
+ * `_acquireClient`), so the `SET` completes before any caller query runs on that
+ * connection. (A `"connect"`-listener `client.query()` would instead overlap
+ * pg-pool's own synchronous dispatch of the checked-out query — node-postgres'
+ * "Calling client.query() when the client is already executing a query"
+ * deprecation, whose internal queueing pg@9 removes.) A failure propagates to
+ * the checkout and fails the caller's query, like Go's `AfterConnect` failing
+ * the connect.
+ */
+export function legacyPoolStepDownVerify(
+  client: LegacyStepDownClient,
+  callback: (err?: Error) => void,
+): void {
+  client.query(SET_SESSION_ROLE).then(
+    () => callback(),
+    (error) => callback(error instanceof Error ? error : new Error(String(error))),
+  );
+}
+
+/**
+ * Swallow the pool's async background errors, like `PgClient.make`: an idle
+ * client's connection-level failure emits `"error"` on the pool and would crash
+ * the process without a listener; the next checkout simply redials (and the
+ * redial re-runs the `verify` step-down).
+ */
+export function legacyInstallPoolErrorSwallow(pool: LegacyPoolErrorSource): void {
+  pool.on("error", () => {});
+}
+
+// Minimal structural view of the `pg.Pool` surface `legacyAcquireProbedPool`
+// drives — a real `pg.Pool` satisfies it (its `on`/`query`/`end` signatures are
+// wider), and a tiny fake can stand in at the driver boundary for unit tests.
+interface LegacyProbePool extends LegacyPoolErrorSource {
+  readonly query: (sql: string) => Promise<unknown>;
+  readonly end: () => Promise<void>;
+}
+
+/**
+ * Acquire a `pg` pool and probe it with `SELECT 1`, guaranteeing the pool is
+ * `.end()`ed on EVERY non-success path — a probe rejection, a
+ * `connectTimeoutSeconds` timeout, or an interruption.
+ *
+ * The pool.end() finalizer is registered the MOMENT the pool is constructed, via
+ * `Effect.acquireRelease` with a synchronous (never-failing) resource step, BEFORE
+ * the probe runs. So even if the probe rejects or the outer timeout fires (a
+ * black-holed host), the finalizer is already installed and closes the pool along
+ * with its in-flight dial (sockets/timers) when the scope unwinds. Upstream
+ * `@effect/sql-pg`'s `PgClient.make` instead probes INSIDE the acquireRelease
+ * acquire, so a failed/timed-out probe never installs the finalizer and leaks the
+ * pool — we deliberately diverge to fix that leak while keeping the SqlError /
+ * ConnectionError shapes identical.
+ *
+ * The probe pool is generic so tests can inject a lightweight fake at the driver
+ * boundary; a real `pg.Pool` is returned unchanged for `PgClient.fromPool`.
+ */
+export const legacyAcquireProbedPool = <P extends LegacyProbePool>(
+  makePool: () => P,
+  connectTimeoutSeconds: number,
+): Effect.Effect<P, SqlError, Scope.Scope> =>
+  Effect.gen(function* () {
+    const pool = yield* Effect.acquireRelease(Effect.sync(makePool), (pool) =>
+      Effect.promise(() => pool.end()).pipe(Effect.timeoutOption(1000)),
+    );
+    legacyInstallPoolErrorSwallow(pool);
+    yield* Effect.tryPromise({
+      try: () => pool.query("SELECT 1"),
+      catch: (cause) =>
+        new SqlError({
+          reason: new ConnectionError({
+            cause,
+            message: "PgClient: Failed to connect",
+            operation: "connect",
+          }),
+        }),
+    }).pipe(
+      Effect.timeoutOrElse({
+        duration: Duration.seconds(connectTimeoutSeconds),
+        orElse: () =>
+          Effect.fail(
+            new SqlError({
+              reason: new ConnectionError({
+                cause: new Error("Connection timed out"),
+                message: "PgClient: Connection timed out",
+                operation: "connect",
+              }),
+            }),
+          ),
+      }),
+    );
+    return pool;
+  });
+
 /**
  * Default `LegacyDbConnection` layer, backed by `@effect/sql-pg` (pure-JS `pg`
  * driver, no native addon — bundles under `bun build --compile`). Each
@@ -359,56 +539,61 @@ const connect = (
         dialTargets.push({ dialHost, port, servername: dialHost === host ? undefined : host });
       }
     }
-    // Route through the connection string whenever a libpq `options` param OR
-    // parsed `runtimeParams` are present, so both reach the live connection.
-    const hasOptions = legacyMergedConnectionOptions(cfg) !== undefined;
     // Connect timeout parity: Go's `ToPostgresURL` always sets `connect_timeout`,
     // defaulting to 10s (`connect.go:24-28`); `ConnectLocalPostgres` uses 2s for
     // local (`connect.go:143-145`). A DSN/`PGCONNECT_TIMEOUT` value (>0) overrides
     // both. Without this a black-holed host would hang to the OS/driver default.
     const connectTimeoutSeconds = cfg.connectTimeoutSeconds ?? (isLocal ? 2 : 10);
+    // Whether the remote step-down runs on this connection. Go installs the
+    // `AfterConnect` hook only on the remote path (`ConnectByConfigStream`,
+    // `connect.go:342-362`), not `ConnectLocalPostgres`, so gate on `!isLocal`.
+    const stepDownRequired = !isLocal && needsRoleStepDown(cfg.user);
+    // Build the primary connection over a self-managed `pg.Pool` (via
+    // `PgClient.fromPool`) rather than `PgClient.make`, so we control two pool
+    // behaviors `PgClient.make` does not expose: `idleTimeoutMillis: 0` (never reap
+    // the single pooled connection — see `legacyBuildPoolConfig`; the fix for the
+    // `db pull` step-down loss) and the per-connection role step-down `verify` hook
+    // (see `legacyPoolStepDownVerify`). The `acquire` uses `legacyAcquireProbedPool`:
+    // probe with `SELECT 1`, bound the connect by `connectTimeoutSeconds`, and close
+    // the pool on scope exit AND on every failure/timeout (the leak `PgClient.make`
+    // has). `probe` (below) runs each attempt in a forked scope so a failed fallback
+    // attempt's pool closes immediately, before the next host is dialed.
     const makeClient = (
       dialHost: string,
       port: number,
       sslOption: boolean | ConnectionOptions | undefined,
-    ) =>
-      PgClient.make({
-        // When a libpq `options` param is present, route everything through the
-        // connection string so it reaches the server (see `buildConnectionUrl`);
-        // otherwise pass discrete fields to avoid round-tripping the password.
-        ...(hasOptions
-          ? { url: Redacted.make(legacyBuildConnectionUrl(cfg, dialHost, port)) }
-          : {
-              host: dialHost,
+    ) => {
+      const acquire = legacyAcquireProbedPool(
+        () =>
+          new Pg.Pool(
+            legacyBuildPoolConfig(
+              cfg,
+              dialHost,
               port,
-              username: cfg.user,
-              password: Redacted.make(cfg.password),
-              database: cfg.database,
-            }),
-        // TLS parity with Go (`internal/utils/connect.go`): see `legacySslOptionFor`.
-        ...(sslOption === undefined ? {} : { ssl: sslOption }),
-        connectTimeout: Duration.seconds(connectTimeoutSeconds),
-        maxConnections: 1,
-      }).pipe(Effect.provide(Reactivity.layer));
-
-    // The raw `pg.ClientConfig` for the same dial target, mirroring `makeClient`'s
-    // discrete-vs-url choice. `copyToCsv` uses it to open a dedicated node-postgres
-    // connection for the COPY protocol (which `@effect/sql-pg` does not expose),
-    // against whichever target the primary connection won.
-    const buildRawPgConfig = (
-      dialHost: string,
-      port: number,
-      sslOption: boolean | ConnectionOptions | undefined,
-    ): Pg.ClientConfig => ({
-      ...(hasOptions
-        ? { connectionString: legacyBuildConnectionUrl(cfg, dialHost, port) }
-        : { host: dialHost, port, user: cfg.user, password: cfg.password, database: cfg.database }),
-      ...(sslOption === undefined ? {} : { ssl: sslOption }),
-      connectionTimeoutMillis: connectTimeoutSeconds * 1000,
-    });
+              sslOption,
+              connectTimeoutSeconds,
+              stepDownRequired,
+            ),
+          ),
+        connectTimeoutSeconds,
+      );
+      return PgClient.fromPool({ acquire }).pipe(Effect.provide(Reactivity.layer));
+    };
 
-    const toConnectError = (error: unknown) =>
-      new LegacyDbConnectError({ message: `failed to connect to postgres: ${error}` });
+    // Go's `ConnectByUrl` calls `SetConnectSuggestion(err)` on every connect failure
+    // (`connect.go:187`), mapping the driver error to an actionable hint that replaces
+    // the generic "--debug" suggestion. The resolver attaches the profile context to
+    // `cfg.suggestionContext`; map it here so the suggestion travels on the error.
+    const toConnectError = (error: unknown) => {
+      const suggestion =
+        cfg.suggestionContext === undefined
+          ? undefined
+          : legacyConnectSuggestion(error, cfg.suggestionContext);
+      return new LegacyDbConnectError({
+        message: `failed to connect to postgres: ${error}`,
+        ...(suggestion === undefined ? {} : { suggestion }),
+      });
+    };
 
     // Load the `sslrootcert` CA bundle (pgconn reads it into `RootCAs` at parse
     // time; a missing/unreadable file aborts). Skipped for local connections, which
@@ -470,7 +655,7 @@ const connect = (
           // failed attempt used TLS (`pgconn.go:182`, gated on `fc.TLSConfig != nil`);
           // a TLS config is any non-plaintext `ssl` value.
           usedTls: ssl !== undefined && ssl !== false,
-          rawConfig: buildRawPgConfig(dialHost, port, ssl),
+          rawConfig: legacyBuildRawPgConfig(cfg, dialHost, port, ssl, connectTimeoutSeconds),
         }),
       ),
     );
@@ -487,10 +672,26 @@ const connect = (
     // follow-up query. The winning attempt's `rawConfig` is carried out so `copyToCsv`
     // can reuse the exact dial target the primary connection succeeded against.
     const probe = (attempt: (typeof attempts)[number]) =>
-      attempt.client.pipe(
-        Effect.tap((candidate) => candidate`select 1`),
-        Effect.map((candidate) => ({ candidate, rawConfig: attempt.rawConfig })),
-      );
+      Effect.gen(function* () {
+        // Run each attempt's pool in its OWN scope, forked from the session scope.
+        // Forking (not a detached `Scope.make`) means an abandoned winner — e.g. a
+        // later step-down failure — is still closed when the session scope unwinds.
+        // On a probe FAILURE we close the child immediately, so a failed fallback
+        // attempt's pool (and its in-flight dial) is released before the next host is
+        // dialed, not left open until session end. On SUCCESS we leave the child open
+        // (a child of the session scope), so the winning pool lives for the whole
+        // session and closes with it.
+        const sessionScope = yield* Scope.Scope;
+        const attemptScope = yield* Scope.fork(sessionScope);
+        return yield* attempt.client.pipe(
+          Effect.tap((candidate) => candidate`select 1`),
+          Effect.map((candidate) => ({ candidate, rawConfig: attempt.rawConfig })),
+          Scope.provide(attemptScope),
+          Effect.onExit((exit) =>
+            Exit.isSuccess(exit) ? Effect.void : Scope.close(attemptScope, exit),
+          ),
+        );
+      });
     const lastIndex = attempts.length - 1;
     const { candidate: client, rawConfig: winningRawConfig } = yield* attempts
       .slice(0, lastIndex)
@@ -508,9 +709,13 @@ const connect = (
     // Step down from the temp/privileged login role before any further SQL — but
     // only for remote connections: Go installs this hook in `ConnectByConfigStream`,
     // not `ConnectLocalPostgres`, so a local `--db-url` using `supabase_admin`/
-    // `cli_login_*` must not run it. `maxConnections: 1` guarantees the single
-    // physical connection is reused, so the session-scoped role persists for `exec`.
-    if (!isLocal && needsRoleStepDown(cfg.user)) {
+    // `cli_login_*` must not run it. The pool's `"connect"` hook already ran this on
+    // the physical connection (and on any silent redial); this explicit one-shot is
+    // the fail-fast path — the hook swallows errors, so a real role-privilege problem
+    // only surfaces here, as `LegacyDbConnectError: failed to set session role: ...`
+    // (Go parity). `max: 1` + `idleTimeoutMillis: 0` keep the stepped-down connection
+    // alive so the session-scoped role persists for every later `exec`/`query`.
+    if (stepDownRequired) {
       yield* client.unsafe(SET_SESSION_ROLE).pipe(
         Effect.asVoid,
         Effect.mapError(
@@ -548,10 +753,9 @@ const connect = (
       const fresh = new Pg.Client(winningRawConfig);
       yield* Effect.tryPromise({
         try: () => fresh.connect(),
-        catch: (error) =>
-          new LegacyDbConnectError({ message: `failed to connect to postgres: ${error}` }),
+        catch: toConnectError,
       });
-      if (!isLocal && needsRoleStepDown(cfg.user)) {
+      if (stepDownRequired) {
         yield* Effect.tryPromise({
           try: () => fresh.query(SET_SESSION_ROLE),
           catch: (error) =>
diff --git a/apps/cli/src/legacy/shared/legacy-db-connection.sql-pg.unit.test.ts b/apps/cli/src/legacy/shared/legacy-db-connection.sql-pg.unit.test.ts
index c3407c8018..334ecda513 100644
--- a/apps/cli/src/legacy/shared/legacy-db-connection.sql-pg.unit.test.ts
+++ b/apps/cli/src/legacy/shared/legacy-db-connection.sql-pg.unit.test.ts
@@ -1,7 +1,14 @@
+import { EventEmitter } from "node:events";
+import { Effect, Exit } from "effect";
 import { describe, expect, it } from "vitest";
 
 import {
+  legacyAcquireProbedPool,
   legacyBuildConnectionUrl,
+  legacyBuildPoolConfig,
+  legacyBuildRawPgConfig,
+  legacyInstallPoolErrorSwallow,
+  legacyPoolStepDownVerify,
   legacyIsTerminalConnectError,
   legacyIsUnixSocketHost,
   legacyMergedConnectionOptions,
@@ -271,6 +278,185 @@ describe("legacySslConfigsFor (pgconn fallback list)", () => {
   });
 });
 
+describe("legacyBuildRawPgConfig", () => {
+  const base = { user: "postgres", password: "pw", port: 5432, database: "postgres", host: "h" };
+
+  it("uses discrete fields (no connection string) when no options/runtimeParams", () => {
+    const c = legacyBuildRawPgConfig(
+      { ...base },
+      "db.example.com",
+      5432,
+      { rejectUnauthorized: false },
+      10,
+    );
+    expect(c).toMatchObject({
+      host: "db.example.com",
+      port: 5432,
+      user: "postgres",
+      password: "pw",
+      database: "postgres",
+      connectionTimeoutMillis: 10_000,
+      ssl: { rejectUnauthorized: false },
+    });
+    expect(c.connectionString).toBeUndefined();
+  });
+
+  it("routes through a connection string when a libpq options payload is present", () => {
+    const c = legacyBuildRawPgConfig(
+      { ...base, options: "reference=abc" },
+      "db.example.com",
+      6543,
+      false,
+      2,
+    );
+    expect(c.connectionString).toContain("@db.example.com:6543/");
+    expect(c.connectionString).toContain("options=reference%3Dabc");
+    expect(c.host).toBeUndefined();
+    expect(c.connectionTimeoutMillis).toBe(2000);
+    expect(c.ssl).toBe(false);
+  });
+
+  it("omits the ssl field entirely when the ssl option is undefined", () => {
+    const c = legacyBuildRawPgConfig({ ...base }, "h", 5432, undefined, 5);
+    expect("ssl" in c).toBe(false);
+  });
+});
+
+describe("legacyBuildPoolConfig", () => {
+  const base = { user: "postgres", password: "pw", port: 5432, database: "postgres", host: "h" };
+
+  it("disables idle reaping (idleTimeoutMillis 0) and pins one connection (max 1) for a remote config", () => {
+    // The `db pull` bug: `PgClient.make` left idleTimeoutMillis unset (node-postgres
+    // default 10s), reaping the stepped-down connection during a long idle.
+    const c = legacyBuildPoolConfig(
+      { ...base },
+      "db.example.com",
+      5432,
+      { rejectUnauthorized: false },
+      10,
+      true,
+    );
+    expect(c.idleTimeoutMillis).toBe(0);
+    expect(c.max).toBe(1);
+    expect(c.application_name).toBe("@effect/sql-pg");
+    // carries the raw client config fields through
+    expect(c).toMatchObject({ host: "db.example.com", connectionTimeoutMillis: 10_000 });
+  });
+
+  it("disables idle reaping and pins one connection for a local (plaintext) config too", () => {
+    const c = legacyBuildPoolConfig({ ...base }, "127.0.0.1", 54322, false, 2, false);
+    expect(c.idleTimeoutMillis).toBe(0);
+    expect(c.max).toBe(1);
+    expect(c.ssl).toBe(false);
+  });
+
+  it("installs the step-down verify hook only when required", () => {
+    // Every NEW physical connection (initial + silent redials) runs the step-down
+    // before pg-pool hands it to a checkout, mirroring Go's per-connection
+    // AfterConnect.
+    const remote = legacyBuildPoolConfig({ ...base }, "db.example.com", 5432, false, 10, true);
+    expect(remote.verify).toBe(legacyPoolStepDownVerify);
+    const local = legacyBuildPoolConfig({ ...base }, "127.0.0.1", 54322, false, 2, false);
+    expect("verify" in local).toBe(false);
+  });
+});
+
+describe("legacyPoolStepDownVerify", () => {
+  it("runs SET SESSION ROLE postgres and reports success to the pool", async () => {
+    const queries: Array<string> = [];
+    const client = { query: (sql: string) => (queries.push(sql), Promise.resolve()) };
+    const done = await new Promise<Error | undefined>((resolve) => {
+      legacyPoolStepDownVerify(client, resolve);
+    });
+    expect(queries).toEqual(["SET SESSION ROLE postgres"]);
+    expect(done).toBeUndefined();
+  });
+
+  it("propagates a failing step-down to the pool callback so the checkout fails (Go AfterConnect parity)", async () => {
+    const failure = new Error("permission denied to set role");
+    const client = { query: () => Promise.reject(failure) };
+    const done = await new Promise<Error | undefined>((resolve) => {
+      legacyPoolStepDownVerify(client, resolve);
+    });
+    expect(done).toBe(failure);
+  });
+
+  it("wraps a non-Error rejection into an Error for the pool callback", async () => {
+    const client = { query: () => Promise.reject("boom") };
+    const done = await new Promise<Error | undefined>((resolve) => {
+      legacyPoolStepDownVerify(client, resolve);
+    });
+    expect(done).toBeInstanceOf(Error);
+    expect(String(done)).toContain("boom");
+  });
+});
+
+describe("legacyInstallPoolErrorSwallow", () => {
+  it("swallows pool background errors so a dropped idle client never crashes the process", () => {
+    const pool = new EventEmitter();
+    legacyInstallPoolErrorSwallow(pool);
+    expect(pool.listenerCount("error")).toBe(1);
+    expect(() => pool.emit("error", new Error("idle client boom"))).not.toThrow();
+  });
+});
+
+describe("legacyAcquireProbedPool", () => {
+  // Tiny fake at the driver boundary: records query/end calls. Standing in for a
+  // real `pg.Pool` proves the pool is always `.end()`ed — the leak this fixes.
+  function makeFakePool(query: () => Promise<unknown>) {
+    const calls = { query: 0, end: 0 };
+    const pool = {
+      query: (_sql: string) => {
+        calls.query += 1;
+        return query();
+      },
+      end: () => {
+        calls.end += 1;
+        return Promise.resolve();
+      },
+      on: (_event: "error", _listener: (error: Error) => void) => undefined,
+    };
+    return { pool, calls };
+  }
+
+  it("ends the pool when the connect probe rejects", async () => {
+    const fake = makeFakePool(() => Promise.reject(new Error("ECONNREFUSED")));
+    const exit = await Effect.runPromiseExit(
+      legacyAcquireProbedPool(() => fake.pool, 2).pipe(Effect.scoped),
+    );
+    expect(Exit.isFailure(exit)).toBe(true);
+    expect(fake.calls.query).toBe(1);
+    // The finalizer, installed the moment the pool exists, closes it on failure.
+    expect(fake.calls.end).toBe(1);
+  });
+
+  it("ends the pool when the connect probe times out (black-holed host)", async () => {
+    // A never-resolving probe models a black-holed host: `timeoutOrElse` fires and
+    // the already-installed finalizer still closes the pool + its in-flight dial.
+    const fake = makeFakePool(() => new Promise<unknown>(() => {}));
+    const exit = await Effect.runPromiseExit(
+      legacyAcquireProbedPool(() => fake.pool, 0.05).pipe(Effect.scoped),
+    );
+    expect(Exit.isFailure(exit)).toBe(true);
+    expect(fake.calls.end).toBe(1);
+  });
+
+  it("keeps the pool open until the scope closes on a successful probe", async () => {
+    const fake = makeFakePool(() => Promise.resolve({ rows: [{ "?column?": 1 }] }));
+    const observed = await Effect.runPromise(
+      Effect.gen(function* () {
+        const pool = yield* legacyAcquireProbedPool(() => fake.pool, 2);
+        // While the scope is open the pool is live and not yet ended.
+        return { isSamePool: pool === fake.pool, endWhileOpen: fake.calls.end };
+      }).pipe(Effect.scoped),
+    );
+    expect(observed.isSamePool).toBe(true);
+    expect(observed.endWhileOpen).toBe(0);
+    // Closing the scope ends the pool exactly once.
+    expect(fake.calls.end).toBe(1);
+  });
+});
+
 describe("legacyIsUnixSocketHost", () => {
   it("treats an absolute path as a unix socket and a hostname/IP as not", () => {
     expect(legacyIsUnixSocketHost("/var/run/postgresql")).toBe(true);
diff --git a/apps/cli/src/legacy/shared/legacy-db-target-flags.ts b/apps/cli/src/legacy/shared/legacy-db-target-flags.ts
index 2f47d3c84e..6eac57c3cd 100644
--- a/apps/cli/src/legacy/shared/legacy-db-target-flags.ts
+++ b/apps/cli/src/legacy/shared/legacy-db-target-flags.ts
@@ -45,10 +45,31 @@ export interface LegacyDbTargetSelection {
  * (`src/shared/legacy/global-flags.ts`, `src/shared/cli/global-flags.ts`).
  * `Flag.string` / `Flag.choice` / `Flag.integer` → value-consuming;
  * `Flag.boolean` → not.
+ *
+ * Also consulted by `extractChangedFlagNames`
+ * (`legacy/telemetry/legacy-command-instrumentation.ts`), which scans EVERY
+ * legacy command's raw argv, not just the db-target/global subset above — so
+ * this set additionally lists every other value-consuming (non-boolean) flag
+ * declared anywhere under `legacy/commands/`. Without an entry here, a bare
+ * `--some-local-flag <token>` is mis-scanned: the value token is treated as a
+ * separate flag rather than skipped, and if that token happens to look like a
+ * global flag's long name (e.g. `secrets set --env-file --debug`, where
+ * `--debug` is `--env-file`'s value under pflag semantics), CLI-1896's
+ * global-flag fallback fabricates a `flags.debug` value Go never records for
+ * that invocation. `legacy-db-target-flags.unit.test.ts` statically scans
+ * every `*.command.ts` file's directly-declared `Flag.string`/`Flag.integer`/
+ * `Flag.choice`/`Flag.choiceWithValue` calls and asserts they're all
+ * represented here, so a new command that adds a value-consuming flag and
+ * forgets to register it fails CI. That scan cannot see flag names built
+ * through a helper indirection (`issue.command.ts`'s
+ * `legacyIssueOptionalTextFlag`, `status.command.ts`'s `csvStringSliceFlag`)
+ * — those flags are listed below by hand and excluded from the scan.
  */
 export const VALUE_CONSUMING_LONG_FLAGS = new Set([
   // db-family command flags
   "db-url",
+  "password", // db push/pull/dump/remote (StringVarP, short -p)
+  "sql-paths",
   "schema",
   "level",
   "fail-on",
@@ -70,6 +91,74 @@ export const VALUE_CONSUMING_LONG_FLAGS = new Set([
   "network-id",
   "dns-resolver",
   "agent",
+  // Every other value-consuming flag declared directly across legacy/commands/
+  // (CLI-1896 review follow-up — see the doc comment above).
+  "add-domains",
+  "algorithm",
+  "attribute-mapping-file",
+  "auth",
+  "config",
+  "custom-hostname",
+  "db-allow-cidr",
+  "db-password",
+  "db-unban-ip",
+  "desired-subdomain",
+  "diff-engine",
+  "domains",
+  "env-file",
+  "exclude",
+  "exp",
+  "file",
+  "from",
+  "from-backup",
+  "git-branch",
+  "import-map",
+  "inspect-mode",
+  "lang",
+  "last",
+  "metadata-file",
+  "metadata-url",
+  "name",
+  "name-id-format",
+  "notify-url",
+  "org-id",
+  "override-name",
+  "payload",
+  "plan",
+  "project-id",
+  "project-ref",
+  "query-timeout",
+  "region",
+  "remove-domains",
+  "role",
+  "size",
+  "status",
+  "sub",
+  "swift-access-control",
+  "template",
+  "timestamp",
+  "to",
+  "token",
+  "valid-for",
+  "version",
+  // Declared through a name-parameterized helper, invisible to the static
+  // scan (see the doc comment above): `issue.command.ts`'s
+  // `legacyIssueOptionalTextFlag` and `status.command.ts`'s
+  // `csvStringSliceFlag`.
+  "additional-context",
+  "area",
+  "command",
+  "actual-output",
+  "expected-behavior",
+  "reproduce",
+  "crash-report-id",
+  "docker-services",
+  "problem",
+  "proposed-solution",
+  "alternatives",
+  "link",
+  "issue-type",
+  "improvement",
 ]);
 
 /**
@@ -79,8 +168,11 @@ export const VALUE_CONSUMING_LONG_FLAGS = new Set([
 export const VALUE_CONSUMING_SHORT_FLAGS = new Set([
   "s", // --schema / -s
   "o", // --output / -o
-  "p", // --password / -p
+  "p", // --password / -p (migration list, db push/pull/dump/remote)
   "j", // --jobs / -j (storage cp)
+  "f", // --file / -f (db dump/diff/query, db schema declarative sync)
+  "t", // --template / -t (test new); --type / -t (sso add); --timestamp / -t (backups restore)
+  "x", // --exclude / -x (start, db dump)
 ]);
 
 /**
diff --git a/apps/cli/src/legacy/shared/legacy-db-target-flags.unit.test.ts b/apps/cli/src/legacy/shared/legacy-db-target-flags.unit.test.ts
index 2b32ca5ca5..9799b0a636 100644
--- a/apps/cli/src/legacy/shared/legacy-db-target-flags.unit.test.ts
+++ b/apps/cli/src/legacy/shared/legacy-db-target-flags.unit.test.ts
@@ -1,5 +1,12 @@
+import { readdirSync, readFileSync, statSync } from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
 import { describe, expect, it } from "vitest";
-import { resolveLegacyDbTargetFlags } from "./legacy-db-target-flags.ts";
+import {
+  resolveLegacyDbTargetFlags,
+  VALUE_CONSUMING_LONG_FLAGS,
+  VALUE_CONSUMING_SHORT_FLAGS,
+} from "./legacy-db-target-flags.ts";
 
 describe("resolveLegacyDbTargetFlags", () => {
   it("returns empty setFlags and undefined connType when no args", () => {
@@ -185,3 +192,101 @@ describe("resolveLegacyDbTargetFlags", () => {
     expect(result.setFlags).toEqual(["local"]);
   });
 });
+
+describe("VALUE_CONSUMING_LONG_FLAGS / VALUE_CONSUMING_SHORT_FLAGS completeness (CLI-1896 review)", () => {
+  // `legacy/telemetry/legacy-command-instrumentation.ts`'s `extractChangedFlagNames`
+  // relies on these two sets to know which flag consumes the next raw-argv
+  // token as its value, across EVERY legacy command (not just the db-target
+  // subset this file's other describe block covers) — see the doc comment on
+  // `VALUE_CONSUMING_LONG_FLAGS` in `legacy-db-target-flags.ts`. This scan is
+  // static-source-based (same technique as
+  // `shared/cli/code-structure.unit.test.ts`) rather than importing every
+  // command module, so it can only see flag names declared as a literal
+  // string argument to `Flag.string`/`Flag.integer`/`Flag.choice`/
+  // `Flag.choiceWithValue`/`Flag.float` — it cannot trace a name passed
+  // through a helper function (`issue.command.ts`'s
+  // `legacyIssueOptionalTextFlag`, `status.command.ts`'s
+  // `csvStringSliceFlag`), so those two files are excluded below; their flag
+  // names are registered by hand in `VALUE_CONSUMING_LONG_FLAGS` instead.
+  const commandsDir = fileURLToPath(new URL("../commands", import.meta.url));
+  const INDIRECT_NAME_FILES = new Set(["issue.command.ts", "status.command.ts"]);
+  const VALUE_FLAG_KINDS = ["string", "integer", "choice", "choiceWithValue", "float"];
+
+  function walk(dir: string): Array<string> {
+    return readdirSync(dir).flatMap((entry) => {
+      const fullPath = path.join(dir, entry);
+      const stats = statSync(fullPath);
+      if (stats.isDirectory()) return walk(fullPath);
+      return entry.endsWith(".command.ts") ? [fullPath] : [];
+    });
+  }
+
+  interface DeclaredFlag {
+    readonly file: string;
+    readonly name: string;
+    readonly alias: string | undefined;
+  }
+
+  function extractDeclaredFlags(filePath: string): Array<DeclaredFlag> {
+    const source = readFileSync(filePath, "utf8");
+    const callRegex = /Flag\.(string|integer|choice|choiceWithValue|float|boolean)\(/g;
+    const calls = Array.from(source.matchAll(callRegex), (match) => ({
+      index: match.index,
+      kind: match[1]!,
+    }));
+
+    const declared: Array<DeclaredFlag> = [];
+    for (let i = 0; i < calls.length; i++) {
+      const current = calls[i]!;
+      if (!VALUE_FLAG_KINDS.includes(current.kind)) continue;
+
+      // Name declared as a literal string (e.g. `Flag.string("schema")`).
+      // A name passed as an identifier (`Flag.string(name)`) doesn't match
+      // and is silently skipped — see INDIRECT_NAME_FILES above.
+      const remainder = source.slice(current.index);
+      const nameMatch = remainder.match(/^Flag\.\w+\(\s*"([a-zA-Z0-9-]+)"/);
+      if (!nameMatch) continue;
+
+      // The alias, if any, is somewhere in the `.pipe(...)` chain between
+      // this flag declaration and the next one.
+      const windowEnd = i + 1 < calls.length ? calls[i + 1]!.index : source.length;
+      const window = source.slice(current.index, windowEnd);
+      const aliasMatch = window.match(/withAlias\(\s*"([a-zA-Z0-9])"\s*\)/);
+
+      declared.push({ file: filePath, name: nameMatch[1]!, alias: aliasMatch?.[1] });
+    }
+    return declared;
+  }
+
+  it("registers every directly-declared value-consuming flag name in VALUE_CONSUMING_LONG_FLAGS", () => {
+    const missing: Array<string> = [];
+
+    for (const filePath of walk(commandsDir)) {
+      if (INDIRECT_NAME_FILES.has(path.basename(filePath))) continue;
+
+      for (const flag of extractDeclaredFlags(filePath)) {
+        if (!VALUE_CONSUMING_LONG_FLAGS.has(flag.name)) {
+          missing.push(`${flag.name} (${path.relative(commandsDir, flag.file)})`);
+        }
+      }
+    }
+
+    expect(missing).toEqual([]);
+  });
+
+  it("registers every directly-declared value-consuming flag's shorthand in VALUE_CONSUMING_SHORT_FLAGS", () => {
+    const missing: Array<string> = [];
+
+    for (const filePath of walk(commandsDir)) {
+      if (INDIRECT_NAME_FILES.has(path.basename(filePath))) continue;
+
+      for (const flag of extractDeclaredFlags(filePath)) {
+        if (flag.alias !== undefined && !VALUE_CONSUMING_SHORT_FLAGS.has(flag.alias)) {
+          missing.push(`-${flag.alias} (--${flag.name}, ${path.relative(commandsDir, flag.file)})`);
+        }
+      }
+    }
+
+    expect(missing).toEqual([]);
+  });
+});
diff --git a/apps/cli/src/legacy/shared/legacy-docker-bind-classify.ts b/apps/cli/src/legacy/shared/legacy-docker-bind-classify.ts
new file mode 100644
index 0000000000..e811f7c17c
--- /dev/null
+++ b/apps/cli/src/legacy/shared/legacy-docker-bind-classify.ts
@@ -0,0 +1,34 @@
+/**
+ * Go's `loader.ParseVolume` bind-vs-named-volume classification (docker/cli's
+ * vendored `compose-go/v2/loader.ParseVolume`, read by `DockerStart` when it
+ * splits `HostConfig.Binds` into bind mounts vs named volumes —
+ * `apps/cli-go/internal/utils/docker.go:388-399`): a bind's source is a bind
+ * mount when it looks like a file path (starts with `.`, `/`, `~`, or a
+ * Windows drive/UNC prefix); otherwise it is a named volume.
+ *
+ * Hoisted here so every `docker run`/`docker create` argv builder that needs
+ * this classification — `legacy-docker-run.args.ts` (`docker run`) and
+ * `start/lib/docker-create-args.ts` (`docker create`) — shares one
+ * implementation instead of duplicating the regex.
+ */
+export function legacyIsBindMountSource(source: string): boolean {
+  return /^[.~/]/.test(source) || /^[A-Za-z]:[\\/]/.test(source) || source.startsWith("\\\\");
+}
+
+/**
+ * Extracts the `source` field from a `source:target[:mode]` bind spec, Windows-drive-aware.
+ * Go's `loader.ParseVolume` (vendored `compose-go/v2/format.ParseVolume`, `format/volume.go`) is a
+ * character-by-character state machine whose `isWindowsDrive` check treats the colon after a
+ * single-letter prefix as part of the path, not a field separator — so `C:\repo\functions:/home/
+ * deno/functions:ro` keeps `C:\repo\functions` as one field. A naive `bind.split(":")[0]` instead
+ * truncates that down to `"C"`, which {@link legacyIsBindMountSource} then misclassifies as a
+ * named-volume name instead of a bind-mount path. Every caller that needs the source field for
+ * classification must use this instead of a raw split.
+ */
+export function legacyBindMountSpecSource(bind: string): string {
+  if (/^[A-Za-z]:[\\/]/.test(bind)) {
+    const nextColon = bind.indexOf(":", 2);
+    return nextColon === -1 ? bind : bind.slice(0, nextColon);
+  }
+  return bind.split(":")[0] ?? "";
+}
diff --git a/apps/cli/src/legacy/shared/legacy-docker-bind-classify.unit.test.ts b/apps/cli/src/legacy/shared/legacy-docker-bind-classify.unit.test.ts
new file mode 100644
index 0000000000..7d79f7df92
--- /dev/null
+++ b/apps/cli/src/legacy/shared/legacy-docker-bind-classify.unit.test.ts
@@ -0,0 +1,63 @@
+import { describe, expect, test } from "vitest";
+
+import {
+  legacyBindMountSpecSource,
+  legacyIsBindMountSource,
+} from "./legacy-docker-bind-classify.ts";
+
+describe("legacyIsBindMountSource", () => {
+  test("treats a POSIX absolute path as a bind mount", () => {
+    expect(legacyIsBindMountSource("/host/functions")).toBe(true);
+  });
+
+  test("treats a relative-dot path as a bind mount", () => {
+    expect(legacyIsBindMountSource("./functions")).toBe(true);
+  });
+
+  test("treats a home-relative path as a bind mount", () => {
+    expect(legacyIsBindMountSource("~/functions")).toBe(true);
+  });
+
+  test("treats a Windows drive-letter path as a bind mount", () => {
+    expect(legacyIsBindMountSource("C:\\repo\\supabase\\functions")).toBe(true);
+  });
+
+  test("treats a UNC path as a bind mount", () => {
+    expect(legacyIsBindMountSource("\\\\server\\share")).toBe(true);
+  });
+
+  test("treats a bare name as a named volume, not a bind mount", () => {
+    expect(legacyIsBindMountSource("supabase_edge_runtime_proj")).toBe(false);
+  });
+});
+
+describe("legacyBindMountSpecSource", () => {
+  test("extracts the source from a POSIX bind spec", () => {
+    expect(legacyBindMountSpecSource("/host/functions:/home/deno/functions:ro")).toBe(
+      "/host/functions",
+    );
+  });
+
+  test("extracts the source from a named-volume spec", () => {
+    expect(legacyBindMountSpecSource("supabase_edge_runtime_proj:/root/.cache/deno:rw")).toBe(
+      "supabase_edge_runtime_proj",
+    );
+  });
+
+  test("keeps a Windows drive-letter path intact instead of truncating at its internal colon", () => {
+    expect(legacyBindMountSpecSource("C:\\repo\\supabase\\functions:/home/deno/functions:ro")).toBe(
+      "C:\\repo\\supabase\\functions",
+    );
+  });
+
+  test("extracts the source from a UNC bind spec", () => {
+    expect(legacyBindMountSpecSource("\\\\server\\share:/home/deno/functions:ro")).toBe(
+      "\\\\server\\share",
+    );
+  });
+
+  test("classifies a Windows drive-letter bind spec as a bind mount end-to-end", () => {
+    const bind = "C:\\repo\\supabase\\functions:/home/deno/functions:ro";
+    expect(legacyIsBindMountSource(legacyBindMountSpecSource(bind))).toBe(true);
+  });
+});
diff --git a/apps/cli/src/legacy/shared/legacy-docker-ids.ts b/apps/cli/src/legacy/shared/legacy-docker-ids.ts
index 41a5e74b14..5334a5ee30 100644
--- a/apps/cli/src/legacy/shared/legacy-docker-ids.ts
+++ b/apps/cli/src/legacy/shared/legacy-docker-ids.ts
@@ -32,23 +32,114 @@ function truncateText(text: string, maxLength: number) {
   return text.length > maxLength ? text.slice(0, maxLength) : text;
 }
 
-/** Go's `GetId` sanitisation: replace invalid runs with `_`, strip leading
- * `_.-`, and cap at 40 chars. */
-function sanitizeProjectId(src: string) {
+/**
+ * Go's `GetId` sanitisation: replace invalid runs with `_`, strip leading
+ * `_.-`, and cap at 40 chars.
+ *
+ * Exported because it is not only a container-*naming* concern: Go's
+ * `Config.Validate` (`pkg/config/config.go:938-944`) rewrites `c.ProjectId`
+ * to this same sanitized form **in place, once, at config-load time** (every
+ * `flags.LoadConfig` call ends in `Load` -> `Validate`), and every later use
+ * of `Config.ProjectId` — including the Docker LABEL value written by `start`
+ * (`internal/utils/docker.go:375`: `config.Labels[CliProjectLabel] =
+ * Config.ProjectId`) — reads that already-sanitized singleton. `GetId` itself
+ * performs no sanitisation of its own; it just reads the pre-sanitized value.
+ * So on the config/env-derived (non-`--project-id`) path, callers building a
+ * Docker label FILTER must sanitize too, or a `project_id` like `"my app"`
+ * filters on the raw string while `start` labeled the sanitized one and never
+ * matches anything (see `legacyCliProjectFilterValue`'s doc comment).
+ */
+export function legacySanitizeProjectId(src: string) {
   const sanitized = src.replaceAll(INVALID_PROJECT_ID, "_").replace(/^[_.-]+/, "");
   return truncateText(sanitized, MAX_PROJECT_ID_LENGTH);
 }
 
-function localDockerId(name: string, projectId: string) {
-  return `supabase_${name}_${sanitizeProjectId(projectId)}`;
+/**
+ * `supabase_<suffix>_<sanitizedProjectId>` — the naming scheme shared by every
+ * local Docker resource (`utils.GetId`, `apps/cli-go/internal/utils/config.go`).
+ * Exported so callers building a single service's container name (e.g. a
+ * future `legacy-service-catalog.ts` consumer) don't need to go through
+ * {@link legacyServiceContainerIds}'s fixed 13-element array.
+ */
+export function legacyServiceContainerName(suffix: string, projectId: string): string {
+  return `supabase_${suffix}_${legacySanitizeProjectId(projectId)}`;
 }
 
 /** `utils.DbId` — the local Postgres container name. */
 export function localDbContainerId(projectId: string) {
-  return localDockerId("db", projectId);
+  return legacyServiceContainerName("db", projectId);
 }
 
 /** `utils.NetId` fallback — the default generated docker network name. */
 export function localNetworkId(projectId: string) {
-  return localDockerId("network", projectId);
+  return legacyServiceContainerName("network", projectId);
+}
+
+/** Go's `utils.CliProjectLabel` (`apps/cli-go/internal/utils/docker.go:59`) — the
+ * Docker label every container/volume/network created by `supabase start` carries. */
+export const LEGACY_CLI_PROJECT_LABEL = "com.supabase.cli.project";
+
+/**
+ * TS-port-only Docker label (no Go equivalent — Go never stages secrets on host disk in
+ * the first place, see `legacy-start-secrets-cleanup.ts`'s doc comment) recording the
+ * absolute `LegacyCliConfig.workdir` a container was created under, set on every
+ * container `start` creates (`container-lifecycle.ts`'s `legacyStartContainer`).
+ *
+ * Read back by `legacyListContainerIdsAndNames` (`legacy-docker-lifecycle.ts`) so a later
+ * `stop`/`legacyRollbackStart` can reclaim `legacyCleanupStartSecrets`'s staged-secret
+ * directory using the CONTAINER's OWN workdir, rather than the caller's own cwd/
+ * `--workdir` — those can differ when tearing down another project's containers (e.g.
+ * `stop --all`/`stop --project-id <other>`), which would otherwise look in the wrong
+ * directory and orphan that project's staged secret files on disk forever.
+ */
+export const LEGACY_CLI_WORKDIR_LABEL = "com.supabase.cli.workdir";
+
+/**
+ * Go's `utils.GetDockerIds()` (`apps/cli-go/internal/utils/config.go:82-98`) — the
+ * 13 service container ids (excludes `db`, `network`, and the `differ` shadow
+ * container, which are not part of the "expected running services" set). Order and
+ * alias-name strings are taken verbatim from `config.go:36-49,61-79`.
+ */
+export function legacyServiceContainerIds(projectId: string): ReadonlyArray<string> {
+  return [
+    legacyServiceContainerName("kong", projectId),
+    legacyServiceContainerName("auth", projectId),
+    legacyServiceContainerName("inbucket", projectId),
+    legacyServiceContainerName("realtime", projectId),
+    legacyServiceContainerName("rest", projectId),
+    legacyServiceContainerName("storage", projectId),
+    legacyServiceContainerName("imgproxy", projectId),
+    legacyServiceContainerName("pg_meta", projectId),
+    legacyServiceContainerName("studio", projectId),
+    legacyServiceContainerName("edge_runtime", projectId),
+    legacyServiceContainerName("analytics", projectId),
+    legacyServiceContainerName("vector", projectId),
+    legacyServiceContainerName("pooler", projectId),
+  ];
+}
+
+/**
+ * Go's `utils.CliProjectFilter` (`apps/cli-go/internal/utils/docker.go:148-156`) —
+ * the value that follows `--filter label=` on the `docker`/`podman` CLI. An empty
+ * `projectId` (Go's `--all` path) filters on the bare label across every project.
+ *
+ * This function itself does not sanitize — by design, it's a pure pass-through.
+ * The caller is responsible for sanitizing `projectId` with
+ * {@link legacySanitizeProjectId} on the config/env-derived (default) path
+ * BEFORE calling this, matching Go's `Config.Validate` sanitizing the
+ * `Config.ProjectId` singleton once at config-load time so every later
+ * reader — including the Docker LABEL `start` writes — sees the same
+ * sanitized string. An explicit `--project-id <value>` (where one exists,
+ * e.g. `stop`) is Go's one exception: it assigns straight to
+ * `Config.ProjectId` without going through `Validate`
+ * (`apps/cli-go/internal/stop/stop.go:19-20`), so that path must stay raw/
+ * unsanitized to match. There is also no injection risk either way: this
+ * value is always passed as a single argv element to a spawned process
+ * (never through a shell), so a malformed value can only make Docker's own
+ * filter parsing reject it or match nothing — it cannot break out into
+ * another command.
+ */
+export function legacyCliProjectFilterValue(projectId: string): string {
+  if (projectId.length === 0) return LEGACY_CLI_PROJECT_LABEL;
+  return `${LEGACY_CLI_PROJECT_LABEL}=${projectId}`;
 }
diff --git a/apps/cli/src/legacy/shared/legacy-docker-ids.unit.test.ts b/apps/cli/src/legacy/shared/legacy-docker-ids.unit.test.ts
index ff967f18b8..9c07805652 100644
--- a/apps/cli/src/legacy/shared/legacy-docker-ids.unit.test.ts
+++ b/apps/cli/src/legacy/shared/legacy-docker-ids.unit.test.ts
@@ -1,6 +1,13 @@
 import { describe, expect, it } from "vitest";
 
-import { legacyResolveLocalProjectId, localDbContainerId } from "./legacy-docker-ids.ts";
+import {
+  LEGACY_CLI_PROJECT_LABEL,
+  legacyCliProjectFilterValue,
+  legacyResolveLocalProjectId,
+  legacySanitizeProjectId,
+  legacyServiceContainerIds,
+  localDbContainerId,
+} from "./legacy-docker-ids.ts";
 
 describe("legacyResolveLocalProjectId", () => {
   it("prefers SUPABASE_PROJECT_ID (env) over config.toml and the basename", () => {
@@ -23,3 +30,72 @@ describe("legacyResolveLocalProjectId", () => {
     expect(localDbContainerId(id)).toBe("supabase_db_env-id");
   });
 });
+
+describe("legacyServiceContainerIds", () => {
+  it("returns the 13 service container ids in Go's GetDockerIds() order", () => {
+    // apps/cli-go/internal/utils/config.go:82-98 — kong, auth, inbucket, realtime,
+    // rest, storage, imgproxy, pg_meta, studio, edge_runtime, analytics, vector, pooler.
+    expect(legacyServiceContainerIds("my-app")).toEqual([
+      "supabase_kong_my-app",
+      "supabase_auth_my-app",
+      "supabase_inbucket_my-app",
+      "supabase_realtime_my-app",
+      "supabase_rest_my-app",
+      "supabase_storage_my-app",
+      "supabase_imgproxy_my-app",
+      "supabase_pg_meta_my-app",
+      "supabase_studio_my-app",
+      "supabase_edge_runtime_my-app",
+      "supabase_analytics_my-app",
+      "supabase_vector_my-app",
+      "supabase_pooler_my-app",
+    ]);
+  });
+
+  it("sanitizes the project id the same way as localDbContainerId", () => {
+    const ids = legacyServiceContainerIds("My App!!");
+    expect(ids[0]).toBe("supabase_kong_My_App_");
+  });
+});
+
+describe("legacyCliProjectFilterValue", () => {
+  it("returns the bare label when the project id is empty (Go's --all path)", () => {
+    expect(legacyCliProjectFilterValue("")).toBe(LEGACY_CLI_PROJECT_LABEL);
+  });
+
+  it("returns label=projectId when a project id is given", () => {
+    expect(legacyCliProjectFilterValue("my-app")).toBe(`${LEGACY_CLI_PROJECT_LABEL}=my-app`);
+  });
+
+  it("must be sanitized by the caller for the label to match what start wrote", () => {
+    // This function is a pure pass-through by design (see its doc comment) — a
+    // dirty config/env-derived id must be sanitized by the caller BEFORE being
+    // passed here, matching Go's Config.Validate sanitizing Config.ProjectId
+    // once at config-load time so every reader (including the Docker label
+    // `start` writes) sees the same string.
+    const dirty = "My App!!";
+    expect(legacyCliProjectFilterValue(dirty)).toBe(`${LEGACY_CLI_PROJECT_LABEL}=My App!!`);
+    expect(legacyCliProjectFilterValue(legacySanitizeProjectId(dirty))).toBe(
+      `${LEGACY_CLI_PROJECT_LABEL}=My_App_`,
+    );
+  });
+});
+
+describe("legacySanitizeProjectId", () => {
+  it("replaces invalid character runs with a single underscore", () => {
+    expect(legacySanitizeProjectId("My App!!")).toBe("My_App_");
+  });
+
+  it("strips leading underscore/dot/dash runs", () => {
+    expect(legacySanitizeProjectId("...hidden-app")).toBe("hidden-app");
+  });
+
+  it("caps the result at 40 characters", () => {
+    const long = "a".repeat(50);
+    expect(legacySanitizeProjectId(long)).toBe("a".repeat(40));
+  });
+
+  it("leaves an already-clean id unchanged", () => {
+    expect(legacySanitizeProjectId("my-app_123")).toBe("my-app_123");
+  });
+});
diff --git a/apps/cli/src/legacy/shared/legacy-docker-image-resolve.ts b/apps/cli/src/legacy/shared/legacy-docker-image-resolve.ts
new file mode 100644
index 0000000000..d41d903c94
--- /dev/null
+++ b/apps/cli/src/legacy/shared/legacy-docker-image-resolve.ts
@@ -0,0 +1,203 @@
+import { Effect, Exit, Stream } from "effect";
+import type { ChildProcessSpawner } from "effect/unstable/process/ChildProcessSpawner";
+import { spawnContainerCli } from "./legacy-container-cli.ts";
+import { LegacyDockerRunError } from "./legacy-docker-run.errors.ts";
+import {
+  LEGACY_SUGGEST_DOCKER_INSTALL,
+  legacyIsDockerDaemonUnreachable,
+} from "./legacy-docker-suggest.ts";
+import { legacyGetRegistryImageUrlCandidates } from "./legacy-docker-registry.ts";
+
+type Spawner = ChildProcessSpawner["Service"];
+
+const DOCKER_PULL_RETRY_DELAYS_MS = [4_000, 8_000] as const;
+
+const spawnError = () =>
+  // Never embed the spawn error verbatim: it can leak the full argv and
+  // environment of the failed exec (CWE-214/209). Emit a fixed,
+  // credential-free message that still points at the likely cause.
+  new LegacyDockerRunError({
+    message: `failed to run docker. ${LEGACY_SUGGEST_DOCKER_INSTALL}`,
+  });
+
+const concat = (chunks: ReadonlyArray<Uint8Array>): Uint8Array => {
+  const total = chunks.reduce((size, chunk) => size + chunk.length, 0);
+  const bytes = new Uint8Array(total);
+  let offset = 0;
+  for (const chunk of chunks) {
+    bytes.set(chunk, offset);
+    offset += chunk.length;
+  }
+  return bytes;
+};
+
+/**
+ * Builds a Docker image resolver bound to `spawner`: given an image, finds the
+ * best registry candidate (already-local first, then pulled with retry),
+ * mirroring Go's `DockerResolveImageIfNotCached` /
+ * `DockerImagePullWithRetry` (`apps/cli-go/internal/utils/docker.go:304-343`).
+ * The local-image check fails fast (never reaching the pull loop at all) when
+ * the daemon itself is unreachable — Go's own inspect call distinguishes a
+ * typed `errdefs.IsNotFound` from any other inspect error and returns the
+ * latter immediately (`docker.go:326-334`); see `hasLocalImage` below for how
+ * this port makes the same distinction from a CLI subprocess's stderr instead
+ * of a typed Engine API error. Once past that gate, a pull failure IS retried
+ * unconditionally — Go retries on any non-nil error as long as the context
+ * wasn't canceled, with no message-pattern gating — up to 2 times per
+ * candidate (3 total attempts) with an escalating 4s/8s backoff
+ * (`DOCKER_PULL_RETRY_DELAYS_MS`), matching Go's `2<<(i+1)` seconds for `i` in
+ * `0,1`. A spawn failure (the Docker/Podman binary itself couldn't be run) is
+ * a different, non-retryable case — see `spawnError` below. Used by both the
+ * foreground `db dump`-style run-to-completion containers
+ * (`legacy-docker-run.layer.ts`) and `start`'s detached, long-running service
+ * containers — the resolve/pull/retry algorithm is identical for both, only
+ * the caller's process lifecycle differs.
+ *
+ * `projectEnvValues` is optional (see `legacy-docker-registry.ts`'s doc
+ * comment) — only `start` currently threads it through, since its caller
+ * already has the project's dotenv-merged values in scope; `legacy-docker-run.layer.ts`
+ * is a statically-composed `Layer` built before any `projectEnvValues` is
+ * known, so its own callers stay ambient-only for now.
+ */
+export function legacyMakeDockerImageResolver(
+  spawner: Spawner,
+  projectEnvValues?: Readonly<Record<string, string>>,
+): (image: string) => Effect.Effect<string, LegacyDockerRunError> {
+  const hasLocalImage = (image: string): Effect.Effect<boolean, LegacyDockerRunError> =>
+    Effect.gen(function* () {
+      // `stdout: "ignore"`: `docker image inspect` writes the full image JSON
+      // to stdout on a cache hit, which can exceed the OS pipe buffer and
+      // deadlock the child against an unread default `"pipe"` stdio — see
+      // `legacy-docker-remove-all.ts`'s fuller explanation of this same
+      // hazard. `stderr` IS captured (unlike a plain exit-code check) so a
+      // "daemon unreachable" response can be told apart from a genuine
+      // "image not found" — see this function's own doc comment above.
+      const handle = yield* spawnContainerCli(spawner, ["image", "inspect", image], {
+        stdin: "ignore",
+        stdout: "ignore",
+        stderr: "pipe",
+      }).pipe(Effect.mapError(() => spawnError()));
+      const stderrChunks: Array<Uint8Array> = [];
+      yield* Stream.runForEach(handle.stderr, (chunk) =>
+        Effect.sync(() => {
+          stderrChunks.push(chunk);
+        }),
+      ).pipe(Effect.mapError(() => spawnError()));
+      const exitCode = yield* handle.exitCode.pipe(
+        Effect.map(Number),
+        Effect.mapError(() => spawnError()),
+      );
+      if (exitCode === 0) return true;
+      const stderr = new TextDecoder().decode(concat(stderrChunks)).trim();
+      if (legacyIsDockerDaemonUnreachable(stderr)) {
+        return yield* Effect.fail(
+          new LegacyDockerRunError({
+            message: `failed to inspect docker image: ${stderr}\n\n${LEGACY_SUGGEST_DOCKER_INSTALL}`,
+          }),
+        );
+      }
+      return false;
+    }).pipe(Effect.scoped);
+
+  const pullImage = (
+    image: string,
+  ): Effect.Effect<{ readonly exitCode: number; readonly stderr: string }, Error> =>
+    Effect.gen(function* () {
+      const handle = yield* spawnContainerCli(spawner, ["pull", image], {
+        stdin: "inherit",
+        stdout: "pipe",
+        stderr: "pipe",
+        detached: false,
+        extendEnv: true,
+      }).pipe(Effect.mapError(() => new Error("spawn")));
+      // Tee pull progress to the parent terminal in real time so a large,
+      // uncached pull does not look frozen — Go streams the same progress via
+      // `jsonmessage.DisplayJSONMessagesToStream`. Progress goes to stderr so
+      // it never corrupts the captured stdout of the `db dump` run path. The
+      // buffered copies are kept only to report the error message on a
+      // non-zero exit. Decode each stream separately so a multi-byte UTF-8
+      // sequence is never split across interleaved chunks.
+      const stdoutChunks: Array<Uint8Array> = [];
+      const stderrChunks: Array<Uint8Array> = [];
+      yield* Effect.all(
+        [
+          Stream.runForEach(handle.stdout, (chunk) =>
+            Effect.sync(() => {
+              stdoutChunks.push(chunk);
+              globalThis.process.stderr.write(chunk);
+            }),
+          ),
+          Stream.runForEach(handle.stderr, (chunk) =>
+            Effect.sync(() => {
+              stderrChunks.push(chunk);
+              globalThis.process.stderr.write(chunk);
+            }),
+          ),
+        ],
+        { concurrency: "unbounded" },
+      );
+      const exitCode = yield* handle.exitCode.pipe(Effect.map(Number));
+      const stdout = new TextDecoder().decode(concat(stdoutChunks));
+      const stderr = new TextDecoder().decode(concat(stderrChunks));
+      return {
+        exitCode,
+        stderr: `${stdout}${stderr}`.trim(),
+      };
+    }).pipe(Effect.scoped);
+
+  return (image: string): Effect.Effect<string, LegacyDockerRunError> =>
+    Effect.gen(function* () {
+      const candidates = legacyGetRegistryImageUrlCandidates(image, projectEnvValues);
+      for (const candidate of candidates) {
+        if (yield* hasLocalImage(candidate)) {
+          return candidate;
+        }
+      }
+
+      const failures: Array<string> = [];
+      for (const candidate of candidates) {
+        for (
+          let attemptIndex = 0;
+          attemptIndex <= DOCKER_PULL_RETRY_DELAYS_MS.length;
+          attemptIndex += 1
+        ) {
+          const attempt = attemptIndex + 1;
+          const result = yield* Effect.exit(pullImage(candidate));
+          if (Exit.isSuccess(result)) {
+            if (result.value.exitCode === 0) {
+              return candidate;
+            }
+            const message =
+              result.value.stderr.length > 0
+                ? result.value.stderr
+                : `docker pull exited with code ${result.value.exitCode}`;
+            failures.push(`${candidate} attempt ${attempt}: ${message}`);
+            if (attemptIndex === DOCKER_PULL_RETRY_DELAYS_MS.length) {
+              break;
+            }
+          } else {
+            // A failed effect (rather than a non-zero exit, which returns a
+            // value) means the container runtime could not be spawned at all
+            // — a down daemon is caught earlier, by `hasLocalImage`'s own
+            // fail-fast check above, and never reaches this loop. No registry
+            // candidate can fix a missing Docker/Podman binary, so stop here
+            // and surface the install hint instead of an opaque, repeated
+            // spawn error across every candidate.
+            return yield* Effect.fail(spawnError());
+          }
+
+          const delay = DOCKER_PULL_RETRY_DELAYS_MS[attemptIndex];
+          if (delay === undefined) {
+            break;
+          }
+          yield* Effect.sleep(`${delay} millis`);
+        }
+      }
+
+      return yield* Effect.fail(
+        new LegacyDockerRunError({
+          message: `failed to pull docker image from all registries: ${failures.join("; ")}`,
+        }),
+      );
+    });
+}
diff --git a/apps/cli/src/legacy/shared/legacy-docker-image-resolve.unit.test.ts b/apps/cli/src/legacy/shared/legacy-docker-image-resolve.unit.test.ts
new file mode 100644
index 0000000000..633dab0a9c
--- /dev/null
+++ b/apps/cli/src/legacy/shared/legacy-docker-image-resolve.unit.test.ts
@@ -0,0 +1,199 @@
+import { describe, expect, it } from "@effect/vitest";
+import { Deferred, Effect, Fiber, Sink, Stream } from "effect";
+import type * as ChildProcess from "effect/unstable/process/ChildProcess";
+import { ChildProcessSpawner } from "effect/unstable/process";
+import * as TestClock from "effect/testing/TestClock";
+
+import { legacyMakeDockerImageResolver } from "./legacy-docker-image-resolve.ts";
+import { LEGACY_SUGGEST_DOCKER_INSTALL } from "./legacy-docker-suggest.ts";
+import { LegacyDockerRunError } from "./legacy-docker-run.errors.ts";
+
+const REGISTRY_ENV = "SUPABASE_INTERNAL_IMAGE_REGISTRY";
+
+function mockSpawner(
+  pullResults: ReadonlyArray<{ readonly exitCode: number; readonly stderr?: string }>,
+  // Defaults to a non-zero exit with empty stderr, which forces every
+  // candidate through the pull path instead of the already-cached shortcut —
+  // the behavior both existing pull-retry tests below rely on. A test
+  // covering `hasLocalImage`'s own fail-fast behavior overrides this to
+  // simulate a daemon-down `image inspect` response instead.
+  imageInspectResult: { readonly exitCode: number; readonly stderr?: string } = { exitCode: 1 },
+) {
+  const pulls: Array<string> = [];
+  const imageInspectOptions: Array<ChildProcess.CommandOptions> = [];
+
+  const spawner = ChildProcessSpawner.make((command) =>
+    Effect.gen(function* () {
+      const args = command._tag === "StandardCommand" ? command.args : [];
+
+      if (args[0] === "image" && args[1] === "inspect") {
+        if (command._tag === "StandardCommand") imageInspectOptions.push(command.options);
+        const exitDeferred = yield* Deferred.make<ChildProcessSpawner.ExitCode>();
+        yield* Deferred.succeed(
+          exitDeferred,
+          ChildProcessSpawner.ExitCode(imageInspectResult.exitCode),
+        );
+        return ChildProcessSpawner.makeHandle({
+          pid: ChildProcessSpawner.ProcessId(1),
+          stdout: Stream.empty,
+          stderr:
+            imageInspectResult.stderr !== undefined
+              ? Stream.fromIterable([new TextEncoder().encode(imageInspectResult.stderr)])
+              : Stream.empty,
+          all: Stream.empty,
+          exitCode: Deferred.await(exitDeferred),
+          isRunning: Effect.succeed(false),
+          stdin: Sink.drain,
+          kill: () => Effect.void,
+          unref: Effect.succeed(Effect.void),
+          getInputFd: () => Sink.drain,
+          getOutputFd: () => Stream.empty,
+        });
+      }
+
+      const result = pulls.length < pullResults.length ? pullResults[pulls.length] : undefined;
+      pulls.push(args[1] ?? "");
+      const exitDeferred = yield* Deferred.make<ChildProcessSpawner.ExitCode>();
+      yield* Deferred.succeed(exitDeferred, ChildProcessSpawner.ExitCode(result?.exitCode ?? 1));
+      return ChildProcessSpawner.makeHandle({
+        pid: ChildProcessSpawner.ProcessId(1),
+        stdout: Stream.empty,
+        stderr:
+          result?.stderr !== undefined
+            ? Stream.fromIterable([new TextEncoder().encode(result.stderr)])
+            : Stream.empty,
+        all: Stream.empty,
+        exitCode: Deferred.await(exitDeferred),
+        isRunning: Effect.succeed(false),
+        stdin: Sink.drain,
+        kill: () => Effect.void,
+        unref: Effect.succeed(Effect.void),
+        getInputFd: () => Sink.drain,
+        getOutputFd: () => Stream.empty,
+      });
+    }),
+  );
+
+  return {
+    spawner,
+    get pulls() {
+      return pulls;
+    },
+    get imageInspectOptions() {
+      return imageInspectOptions;
+    },
+  };
+}
+
+describe("legacyMakeDockerImageResolver", () => {
+  it.effect(
+    "retries a pull failure unconditionally through messages that wouldn't have matched the old retryable-pattern allowlist, giving up after 3 total attempts",
+    () =>
+      Effect.gen(function* () {
+        // Pins the resolver to a single registry candidate (the image
+        // unchanged) so the assertions below cover exactly one candidate's
+        // attempt count, rather than the full ECR/GHCR/Docker Hub fallback
+        // list built by `legacyGetRegistryImageUrlCandidates`.
+        const previousRegistry = process.env[REGISTRY_ENV];
+        process.env[REGISTRY_ENV] = "docker.io";
+        const originalWrite = globalThis.process.stderr.write.bind(globalThis.process.stderr);
+        globalThis.process.stderr.write = (() => true) as typeof globalThis.process.stderr.write;
+
+        try {
+          // Mirrors Go's own `docker_test.go` "throws error on failure to pull
+          // image" case: a bare, non-pattern-matching message (no
+          // "toomanyrequests"/"rate exceeded"/etc.) still exhausts every
+          // retry, because Go's `DockerImagePullWithRetry` retries on any
+          // non-nil error, with no message classification at all.
+          const mock = mockSpawner([
+            { exitCode: 1, stderr: "no space left on device" },
+            { exitCode: 1, stderr: "no space left on device" },
+            { exitCode: 1, stderr: "no space left on device" },
+          ]);
+          const resolve = legacyMakeDockerImageResolver(mock.spawner);
+          const fiber = yield* resolve("supabase/postgres:17.6.1.138").pipe(
+            Effect.forkChild({ startImmediately: true }),
+          );
+
+          // 2 retries after the initial attempt, with Go's escalating 4s/8s
+          // backoff (`2<<(i+1)` seconds for i=0,1) between them.
+          yield* TestClock.adjust("4 seconds");
+          yield* TestClock.adjust("8 seconds");
+          const error = yield* Fiber.join(fiber).pipe(Effect.flip);
+
+          expect(mock.pulls).toHaveLength(3);
+          expect(error.message).toContain("no space left on device");
+          expect(error.message).toContain("attempt 3");
+          // `image inspect`'s stdout must be fully ignored — the default
+          // `"pipe"` stdio risks a write-buffer deadlock on a cache hit (see
+          // the doc comment in `legacy-docker-image-resolve.ts`) — but
+          // stderr IS piped so a daemon-unreachable response can be told
+          // apart from a genuine cache miss.
+          expect(mock.imageInspectOptions.length).toBeGreaterThan(0);
+          for (const options of mock.imageInspectOptions) {
+            expect(options).toMatchObject({ stdin: "ignore", stdout: "ignore", stderr: "pipe" });
+          }
+        } finally {
+          globalThis.process.stderr.write = originalWrite;
+          if (previousRegistry === undefined) delete process.env[REGISTRY_ENV];
+          else process.env[REGISTRY_ENV] = previousRegistry;
+        }
+      }),
+  );
+
+  it.effect(
+    "resolves successfully once a retried pull succeeds, without waiting for the second backoff",
+    () =>
+      Effect.gen(function* () {
+        const previousRegistry = process.env[REGISTRY_ENV];
+        process.env[REGISTRY_ENV] = "docker.io";
+        const originalWrite = globalThis.process.stderr.write.bind(globalThis.process.stderr);
+        globalThis.process.stderr.write = (() => true) as typeof globalThis.process.stderr.write;
+
+        try {
+          const mock = mockSpawner([
+            { exitCode: 1, stderr: "no space left on device" },
+            { exitCode: 0 },
+          ]);
+          const resolve = legacyMakeDockerImageResolver(mock.spawner);
+          const fiber = yield* resolve("supabase/postgres:17.6.1.138").pipe(
+            Effect.forkChild({ startImmediately: true }),
+          );
+
+          yield* TestClock.adjust("4 seconds");
+          const image = yield* Fiber.join(fiber);
+
+          expect(mock.pulls).toHaveLength(2);
+          expect(image).toBe("supabase/postgres:17.6.1.138");
+        } finally {
+          globalThis.process.stderr.write = originalWrite;
+          if (previousRegistry === undefined) delete process.env[REGISTRY_ENV];
+          else process.env[REGISTRY_ENV] = previousRegistry;
+        }
+      }),
+  );
+
+  it.effect("fails fast on a daemon-unreachable image inspect without ever attempting a pull", () =>
+    Effect.gen(function* () {
+      const previousRegistry = process.env[REGISTRY_ENV];
+      process.env[REGISTRY_ENV] = "docker.io";
+
+      try {
+        const daemonUnreachableStderr =
+          "Cannot connect to the Docker daemon at unix:///var/run/docker.sock. Is the docker daemon running?";
+        const mock = mockSpawner([], { exitCode: 1, stderr: daemonUnreachableStderr });
+        const resolve = legacyMakeDockerImageResolver(mock.spawner);
+
+        const error = yield* resolve("supabase/postgres:17.6.1.138").pipe(Effect.flip);
+
+        expect(error).toBeInstanceOf(LegacyDockerRunError);
+        expect(error.message).toContain(daemonUnreachableStderr);
+        expect(error.message).toContain(LEGACY_SUGGEST_DOCKER_INSTALL);
+        expect(mock.pulls).toHaveLength(0);
+      } finally {
+        if (previousRegistry === undefined) delete process.env[REGISTRY_ENV];
+        else process.env[REGISTRY_ENV] = previousRegistry;
+      }
+    }),
+  );
+});
diff --git a/apps/cli/src/legacy/shared/legacy-docker-lifecycle.ts b/apps/cli/src/legacy/shared/legacy-docker-lifecycle.ts
new file mode 100644
index 0000000000..d76b01a168
--- /dev/null
+++ b/apps/cli/src/legacy/shared/legacy-docker-lifecycle.ts
@@ -0,0 +1,330 @@
+import { Data, Effect, Stream } from "effect";
+import type { ChildProcessSpawner } from "effect/unstable/process/ChildProcessSpawner";
+
+import { legacyDescribeContainerCliFailure, spawnContainerCli } from "./legacy-container-cli.ts";
+import { LEGACY_CLI_WORKDIR_LABEL } from "./legacy-docker-ids.ts";
+
+type Spawner = ChildProcessSpawner["Service"];
+
+/**
+ * Listing containers or volumes by Docker label failed. Wraps Go's
+ * `Docker.ContainerList`/`Docker.VolumeList` errors (`docker.go:99-104`,
+ * `docker.go:334-336` — see `checkServiceHealth`/`DockerRemoveAll`), which Go
+ * wraps as `"failed to list containers: %w"` / equivalent.
+ */
+export class LegacyDockerLifecycleListError extends Data.TaggedError(
+  "LegacyDockerLifecycleListError",
+)<{
+  readonly message: string;
+}> {}
+
+/** Inspecting a single container's state failed for a reason other than "not found". */
+export class LegacyDockerLifecycleInspectError extends Data.TaggedError(
+  "LegacyDockerLifecycleInspectError",
+)<{
+  readonly message: string;
+}> {}
+
+function collectByteStream(stream: Stream.Stream<Uint8Array, unknown>) {
+  const decoder = new TextDecoder();
+  return Stream.runFold(
+    stream,
+    () => "",
+    (text, chunk) => text + decoder.decode(chunk, { stream: true }),
+  ).pipe(Effect.map((text) => text + decoder.decode()));
+}
+
+function splitNonEmptyLines(text: string): ReadonlyArray<string> {
+  return text
+    .split(/\r?\n/u)
+    .map((line) => line.trim())
+    .filter((line) => line.length > 0);
+}
+
+/**
+ * Shared `docker ps --filter label=<filterValue> [--all] --format
+ * <formatArg>` spawn: one Docker CLI invocation is one underlying `GET
+ * /containers/json` Docker Engine API request regardless of `--format`
+ * (`--format` only controls how the CLI renders the already-returned JSON
+ * response client-side) — every exported listing function below funnels
+ * through here so two differently-formatted needs never accidentally cost
+ * two real requests. See {@link legacyListContainerIdsAndNames}'s doc
+ * comment for why that distinction matters for Go-parity request-log tests.
+ */
+function spawnDockerPsLines(
+  spawner: Spawner,
+  opts: { readonly projectIdFilter: string; readonly all: boolean; readonly formatArg: string },
+): Effect.Effect<ReadonlyArray<string>, LegacyDockerLifecycleListError> {
+  return Effect.scoped(
+    Effect.gen(function* () {
+      const args = [
+        "ps",
+        "--filter",
+        `label=${opts.projectIdFilter}`,
+        ...(opts.all ? ["--all"] : []),
+        "--format",
+        opts.formatArg,
+      ];
+      const child = yield* spawnContainerCli(spawner, args, {
+        stdin: "ignore",
+        stdout: "pipe",
+        stderr: "pipe",
+      }).pipe(
+        Effect.mapError(
+          (cause) =>
+            new LegacyDockerLifecycleListError({
+              message: `failed to list containers: ${legacyDescribeContainerCliFailure(cause)}`,
+            }),
+        ),
+      );
+      // Concurrency is required, not cosmetic: sequential `Effect.all` would
+      // await `exitCode` (resolved by Node's "exit" event) before subscribing
+      // to `stdout`/`stderr` at all. Node's "exit" can fire before a fast
+      // process's stdio pipes are drained, so a late subscriber sees an
+      // already-ended, empty stream instead of the buffered bytes.
+      const [exitCode, stdout, stderr] = yield* Effect.all(
+        [
+          child.exitCode.pipe(Effect.map(Number)),
+          collectByteStream(child.stdout),
+          collectByteStream(child.stderr),
+        ],
+        { concurrency: "unbounded" },
+      ).pipe(
+        Effect.mapError(
+          () => new LegacyDockerLifecycleListError({ message: "failed to list containers" }),
+        ),
+      );
+      if (exitCode !== 0) {
+        const message = stderr.trim();
+        return yield* Effect.fail(
+          new LegacyDockerLifecycleListError({
+            message:
+              message.length > 0
+                ? `failed to list containers: ${message}`
+                : "failed to list containers",
+          }),
+        );
+      }
+      return splitNonEmptyLines(stdout);
+    }),
+  );
+}
+
+/**
+ * Go's `Docker.ContainerList(ctx, container.ListOptions{All, Filters})`
+ * (`docker.go:99-104`, `status.go:126-131`) via `docker ps --filter
+ * label=<filterValue>`. `all: false` mirrors `status`'s running-only list;
+ * `all: true` mirrors `stop`'s "every container regardless of state" list.
+ */
+export const legacyListContainersByLabel = (
+  spawner: Spawner,
+  opts: {
+    readonly projectIdFilter: string;
+    readonly all: boolean;
+    readonly format: "id" | "names";
+  },
+) =>
+  spawnDockerPsLines(spawner, {
+    projectIdFilter: opts.projectIdFilter,
+    all: opts.all,
+    formatArg: opts.format === "names" ? "{{.Names}}" : "{{.ID}}",
+  });
+
+/**
+ * A single `docker ps` result row's id, name, and staging workdir together.
+ *
+ * `workdir` is `LEGACY_CLI_WORKDIR_LABEL`'s value read straight off the container (see
+ * that constant's doc comment) — empty when the container carries no such label, which
+ * `legacyCleanupStartSecrets` treats as "fall back to the caller's own workdir" (a
+ * container `start` created before this label existed, or created by a Go binary).
+ */
+export interface LegacyContainerIdName {
+  readonly id: string;
+  readonly name: string;
+  readonly workdir: string;
+}
+
+/**
+ * Combined-format sibling of {@link legacyListContainersByLabel}: fetches a
+ * container's id, name, AND staging workdir from a SINGLE `docker ps --format
+ * "{{.ID}}\t{{.Names}}\t{{.Label \"com.supabase.cli.workdir\"}}"` invocation,
+ * rather than one call per field. Go's SDK-based `Docker.ContainerList` gets
+ * all of this (and every other field) from the one Engine API response it
+ * already makes; two separately-`--format`ted CLI calls here would silently
+ * double the real Docker request count relative to Go even though each call's
+ * own output is individually correct — exactly the bug the cli-e2e-ci
+ * request-log parity harness caught for `stop` (an extra `GET /containers/json`
+ * versus Go's single call). Used by {@link legacyDockerRemoveAll}, which needs
+ * ids to stop containers, for callers (`stop`, `start`'s rollback) that ALSO
+ * need names and workdirs for {@link legacyCleanupStartSecrets} — see that
+ * function's doc comment and {@link legacyDockerRemoveAll}'s
+ * `onContainersRemoved` parameter.
+ */
+export const legacyListContainerIdsAndNames = (
+  spawner: Spawner,
+  opts: {
+    readonly projectIdFilter: string;
+    readonly all: boolean;
+  },
+): Effect.Effect<ReadonlyArray<LegacyContainerIdName>, LegacyDockerLifecycleListError> =>
+  spawnDockerPsLines(spawner, {
+    projectIdFilter: opts.projectIdFilter,
+    all: opts.all,
+    formatArg: `{{.ID}}\t{{.Names}}\t{{.Label "${LEGACY_CLI_WORKDIR_LABEL}"}}`,
+  }).pipe(
+    Effect.map((lines) =>
+      lines.map((line) => {
+        const [id = "", name = "", workdir = ""] = line.split("\t");
+        return { id, name, workdir };
+      }),
+    ),
+  );
+
+/**
+ * Go's `Docker.ContainerInspect(ctx, containerId)` (`docker.go:148`,
+ * `status.go:148-155`) via `docker container inspect <id> --format
+ * {{json .State}}`. Go's `assertContainerHealthy` does not special-case a
+ * missing container — it wraps whatever error `ContainerInspect` returns
+ * (`status.go:148-149`), so every non-zero exit, including "no such
+ * container", propagates as `LegacyDockerLifecycleInspectError` carrying the
+ * real Docker stderr text.
+ */
+export const legacyInspectContainerState = (spawner: Spawner, containerId: string) =>
+  Effect.scoped(
+    Effect.gen(function* () {
+      const child = yield* spawnContainerCli(
+        spawner,
+        ["container", "inspect", containerId, "--format", "{{json .State}}"],
+        {
+          stdin: "ignore",
+          stdout: "pipe",
+          stderr: "pipe",
+        },
+      ).pipe(
+        Effect.mapError(
+          (cause) =>
+            new LegacyDockerLifecycleInspectError({
+              message: `failed to inspect container health: ${legacyDescribeContainerCliFailure(cause)}`,
+            }),
+        ),
+      );
+      // Concurrency is required, not cosmetic — see the matching comment in
+      // `legacyListContainersByLabel` above.
+      const [exitCode, stdout, stderr] = yield* Effect.all(
+        [
+          child.exitCode.pipe(Effect.map(Number)),
+          collectByteStream(child.stdout),
+          collectByteStream(child.stderr),
+        ],
+        { concurrency: "unbounded" },
+      ).pipe(
+        Effect.mapError(
+          () =>
+            new LegacyDockerLifecycleInspectError({
+              message: "failed to inspect container health",
+            }),
+        ),
+      );
+      if (exitCode !== 0) {
+        const message = stderr.trim();
+        return yield* Effect.fail(
+          new LegacyDockerLifecycleInspectError({
+            message:
+              message.length > 0
+                ? `failed to inspect container health: ${message}`
+                : "failed to inspect container health",
+          }),
+        );
+      }
+      return parseContainerState(stdout);
+    }),
+  );
+
+function parseContainerState(stdout: string): {
+  readonly running: boolean;
+  readonly status: string;
+  readonly health?: string;
+} {
+  const trimmed = stdout.trim();
+  let parsed: unknown;
+  try {
+    parsed = trimmed.length > 0 ? JSON.parse(trimmed) : {};
+  } catch {
+    parsed = {};
+  }
+  const state = isJsonRecord(parsed) ? parsed : {};
+  // Go's `assertContainerHealthy` (`internal/status/status.go:147-156`) gates
+  // on the boolean `resp.State.Running`, not the status string — Docker's
+  // inspect `State` struct exposes both independently, and a paused or
+  // restarting container reports `Running: true` alongside a non-"running"
+  // `Status` (`"paused"`/`"restarting"`). `status` is kept as-is for the
+  // "container is not running: <status>" message text (`status.go:151`),
+  // which still reads the string, but the gate itself must read the boolean.
+  const status = typeof state["Status"] === "string" ? state["Status"] : "";
+  const running = state["Running"] === true;
+  const health = state["Health"];
+  const healthStatus =
+    isJsonRecord(health) && typeof health["Status"] === "string" ? health["Status"] : undefined;
+  return healthStatus !== undefined
+    ? { running, status, health: healthStatus }
+    : { running, status };
+}
+
+function isJsonRecord(value: unknown): value is { readonly [key: string]: unknown } {
+  return typeof value === "object" && value !== null;
+}
+
+/**
+ * Go's `Docker.VolumeList(ctx, volume.ListOptions{Filters})`
+ * (`docker.go` — used by the `stop` post-run volume-suggestion check) via
+ * `docker volume ls --filter label=<filterValue>`.
+ */
+export const legacyListVolumesByLabel = (spawner: Spawner, projectIdFilter: string) =>
+  Effect.scoped(
+    Effect.gen(function* () {
+      const args = [
+        "volume",
+        "ls",
+        "--filter",
+        `label=${projectIdFilter}`,
+        "--format",
+        "{{.Name}}",
+      ];
+      const child = yield* spawnContainerCli(spawner, args, {
+        stdin: "ignore",
+        stdout: "pipe",
+        stderr: "pipe",
+      }).pipe(
+        Effect.mapError(
+          (cause) =>
+            new LegacyDockerLifecycleListError({
+              message: `failed to list volumes: ${legacyDescribeContainerCliFailure(cause)}`,
+            }),
+        ),
+      );
+      // Concurrency is required, not cosmetic — see the matching comment in
+      // `legacyListContainersByLabel` above.
+      const [exitCode, stdout, stderr] = yield* Effect.all(
+        [
+          child.exitCode.pipe(Effect.map(Number)),
+          collectByteStream(child.stdout),
+          collectByteStream(child.stderr),
+        ],
+        { concurrency: "unbounded" },
+      ).pipe(
+        Effect.mapError(
+          () => new LegacyDockerLifecycleListError({ message: "failed to list volumes" }),
+        ),
+      );
+      if (exitCode !== 0) {
+        const message = stderr.trim();
+        return yield* Effect.fail(
+          new LegacyDockerLifecycleListError({
+            message:
+              message.length > 0 ? `failed to list volumes: ${message}` : "failed to list volumes",
+          }),
+        );
+      }
+      return splitNonEmptyLines(stdout);
+    }),
+  );
diff --git a/apps/cli/src/legacy/shared/legacy-docker-lifecycle.unit.test.ts b/apps/cli/src/legacy/shared/legacy-docker-lifecycle.unit.test.ts
new file mode 100644
index 0000000000..03a802f197
--- /dev/null
+++ b/apps/cli/src/legacy/shared/legacy-docker-lifecycle.unit.test.ts
@@ -0,0 +1,397 @@
+import { describe, expect, it } from "@effect/vitest";
+import { Deferred, Effect, Sink, Stream } from "effect";
+import { ChildProcessSpawner } from "effect/unstable/process";
+
+import {
+  LegacyDockerLifecycleInspectError,
+  LegacyDockerLifecycleListError,
+  legacyInspectContainerState,
+  legacyListContainerIdsAndNames,
+  legacyListContainersByLabel,
+  legacyListVolumesByLabel,
+} from "./legacy-docker-lifecycle.ts";
+
+function mockSpawner(
+  opts: {
+    readonly exitCode?: number;
+    readonly stdout?: string;
+    readonly stderr?: string;
+  } = {},
+) {
+  const encoder = new TextEncoder();
+  const spawned: Array<{ readonly command: string; readonly args: ReadonlyArray<string> }> = [];
+
+  const spawner = ChildProcessSpawner.make((command) =>
+    Effect.gen(function* () {
+      const cmd = command._tag === "StandardCommand" ? command.command : "";
+      const args = command._tag === "StandardCommand" ? command.args : [];
+      spawned.push({ command: cmd, args });
+
+      const exitDeferred = yield* Deferred.make<ChildProcessSpawner.ExitCode>();
+      yield* Deferred.succeed(exitDeferred, ChildProcessSpawner.ExitCode(opts.exitCode ?? 0));
+
+      return ChildProcessSpawner.makeHandle({
+        pid: ChildProcessSpawner.ProcessId(1),
+        stdout: Stream.fromIterable(opts.stdout !== undefined ? [encoder.encode(opts.stdout)] : []),
+        stderr: Stream.fromIterable(opts.stderr !== undefined ? [encoder.encode(opts.stderr)] : []),
+        all: Stream.empty,
+        exitCode: Deferred.await(exitDeferred),
+        isRunning: Effect.succeed(false),
+        stdin: Sink.drain,
+        kill: () => Effect.void,
+        unref: Effect.succeed(Effect.void),
+        getInputFd: () => Sink.drain,
+        getOutputFd: () => Stream.empty,
+      });
+    }),
+  );
+
+  return {
+    spawner,
+    get spawned() {
+      return spawned;
+    },
+  };
+}
+
+describe("legacyListContainersByLabel", () => {
+  it.live("returns container ids for a successful listing", () => {
+    const mock = mockSpawner({ stdout: "abc123\ndef456\n" });
+    return legacyListContainersByLabel(mock.spawner, {
+      projectIdFilter: "com.supabase.cli.project=my-app",
+      all: false,
+      format: "id",
+    }).pipe(
+      Effect.map((ids) => {
+        expect(ids).toEqual(["abc123", "def456"]);
+        expect(mock.spawned).toEqual([
+          {
+            command: "docker",
+            args: [
+              "ps",
+              "--filter",
+              "label=com.supabase.cli.project=my-app",
+              "--format",
+              "{{.ID}}",
+            ],
+          },
+        ]);
+      }),
+    );
+  });
+
+  it.live("passes --all and requests names when configured", () => {
+    const mock = mockSpawner({ stdout: "supabase_db_my-app\n" });
+    return legacyListContainersByLabel(mock.spawner, {
+      projectIdFilter: "com.supabase.cli.project",
+      all: true,
+      format: "names",
+    }).pipe(
+      Effect.map((names) => {
+        expect(names).toEqual(["supabase_db_my-app"]);
+        expect(mock.spawned).toEqual([
+          {
+            command: "docker",
+            args: [
+              "ps",
+              "--filter",
+              "label=com.supabase.cli.project",
+              "--all",
+              "--format",
+              "{{.Names}}",
+            ],
+          },
+        ]);
+      }),
+    );
+  });
+
+  it.live("returns an empty array when no containers match", () => {
+    const mock = mockSpawner({ stdout: "" });
+    return legacyListContainersByLabel(mock.spawner, {
+      projectIdFilter: "com.supabase.cli.project",
+      all: true,
+      format: "id",
+    }).pipe(
+      Effect.map((ids) => {
+        expect(ids).toEqual([]);
+      }),
+    );
+  });
+
+  it.live("filters out blank lines from the trimmed output", () => {
+    const mock = mockSpawner({ stdout: "abc123\n\n  \ndef456\n" });
+    return legacyListContainersByLabel(mock.spawner, {
+      projectIdFilter: "com.supabase.cli.project",
+      all: false,
+      format: "id",
+    }).pipe(
+      Effect.map((ids) => {
+        expect(ids).toEqual(["abc123", "def456"]);
+      }),
+    );
+  });
+
+  it.live("fails with LegacyDockerLifecycleListError on a non-zero exit", () => {
+    const mock = mockSpawner({ exitCode: 1, stderr: "Cannot connect to the Docker daemon\n" });
+    return legacyListContainersByLabel(mock.spawner, {
+      projectIdFilter: "com.supabase.cli.project",
+      all: false,
+      format: "id",
+    }).pipe(
+      Effect.flip,
+      Effect.map((error) => {
+        expect(error).toBeInstanceOf(LegacyDockerLifecycleListError);
+        expect(error.message).toBe(
+          "failed to list containers: Cannot connect to the Docker daemon",
+        );
+      }),
+    );
+  });
+
+  it.live("fails with a generic message when stderr is empty", () => {
+    const mock = mockSpawner({ exitCode: 1, stderr: "" });
+    return legacyListContainersByLabel(mock.spawner, {
+      projectIdFilter: "com.supabase.cli.project",
+      all: false,
+      format: "id",
+    }).pipe(
+      Effect.flip,
+      Effect.map((error) => {
+        expect(error).toBeInstanceOf(LegacyDockerLifecycleListError);
+        expect(error.message).toBe("failed to list containers");
+      }),
+    );
+  });
+});
+
+describe("legacyListContainerIdsAndNames", () => {
+  it.live("parses id, name, and the com.supabase.cli.workdir label from a single ps call", () => {
+    const mock = mockSpawner({
+      stdout:
+        "abc123\tsupabase_kong_demo\t/home/user/demo\ndef456\tsupabase_db_demo\t/home/user/demo\n",
+    });
+    return legacyListContainerIdsAndNames(mock.spawner, {
+      projectIdFilter: "com.supabase.cli.project=demo",
+      all: true,
+    }).pipe(
+      Effect.map((containers) => {
+        expect(containers).toEqual([
+          { id: "abc123", name: "supabase_kong_demo", workdir: "/home/user/demo" },
+          { id: "def456", name: "supabase_db_demo", workdir: "/home/user/demo" },
+        ]);
+        expect(mock.spawned).toEqual([
+          {
+            command: "docker",
+            args: [
+              "ps",
+              "--filter",
+              "label=com.supabase.cli.project=demo",
+              "--all",
+              "--format",
+              '{{.ID}}\t{{.Names}}\t{{.Label "com.supabase.cli.workdir"}}',
+            ],
+          },
+        ]);
+      }),
+    );
+  });
+
+  it.live(
+    "resolves an empty workdir for a container carrying no com.supabase.cli.workdir label",
+    () => {
+      // Docker's `{{.Label "key"}}` resolves to an empty string when the container has no such
+      // label — a container `start` created before this label existed, or one a Go binary
+      // created. `legacyCleanupStartSecrets` treats this empty string as "fall back to the
+      // caller's own workdir" (see that function's doc comment).
+      const mock = mockSpawner({ stdout: "abc123\tsupabase_kong_demo\t\n" });
+      return legacyListContainerIdsAndNames(mock.spawner, {
+        projectIdFilter: "com.supabase.cli.project=demo",
+        all: true,
+      }).pipe(
+        Effect.map((containers) => {
+          expect(containers).toEqual([{ id: "abc123", name: "supabase_kong_demo", workdir: "" }]);
+        }),
+      );
+    },
+  );
+});
+
+describe("legacyInspectContainerState", () => {
+  it.live("parses a running, healthy container's state", () => {
+    const mock = mockSpawner({
+      stdout: JSON.stringify({
+        Status: "running",
+        Running: true,
+        Health: { Status: "healthy" },
+      }),
+    });
+    return legacyInspectContainerState(mock.spawner, "supabase_db_my-app").pipe(
+      Effect.map((state) => {
+        expect(state).toEqual({ running: true, status: "running", health: "healthy" });
+        expect(mock.spawned).toEqual([
+          {
+            command: "docker",
+            args: ["container", "inspect", "supabase_db_my-app", "--format", "{{json .State}}"],
+          },
+        ]);
+      }),
+    );
+  });
+
+  it.live("parses a running container with no health check configured", () => {
+    const mock = mockSpawner({ stdout: JSON.stringify({ Status: "running", Running: true }) });
+    return legacyInspectContainerState(mock.spawner, "supabase_kong_my-app").pipe(
+      Effect.map((state) => {
+        expect(state).toEqual({ running: true, status: "running" });
+      }),
+    );
+  });
+
+  it.live("parses a stopped/exited container", () => {
+    const mock = mockSpawner({ stdout: JSON.stringify({ Status: "exited", Running: false }) });
+    return legacyInspectContainerState(mock.spawner, "supabase_kong_my-app").pipe(
+      Effect.map((state) => {
+        expect(state).toEqual({ running: false, status: "exited" });
+      }),
+    );
+  });
+
+  it.live(
+    "treats a paused/restarting container as running, matching Go's boolean-based gate",
+    () => {
+      // Go's `assertContainerHealthy` (`status.go:150`) checks `resp.State.Running`,
+      // not `resp.State.Status` — a paused or restarting container reports
+      // `Running: true` alongside a non-"running" status string, and Go
+      // continues past the not-running branch in that case.
+      const mock = mockSpawner({ stdout: JSON.stringify({ Status: "paused", Running: true }) });
+      return legacyInspectContainerState(mock.spawner, "supabase_db_my-app").pipe(
+        Effect.map((state) => {
+          expect(state).toEqual({ running: true, status: "paused" });
+        }),
+      );
+    },
+  );
+
+  it.live(
+    "fails with LegacyDockerLifecycleInspectError, preserving the real stderr, when the container does not exist",
+    () => {
+      // Go's `assertContainerHealthy` never special-cases "not found" — it
+      // wraps whatever `ContainerInspect` returns (`status.go:148-149`), so a
+      // missing container is just another non-zero exit here too.
+      const mock = mockSpawner({
+        exitCode: 1,
+        stderr: "Error response from daemon: No such container: supabase_db_my-app\n",
+      });
+      return legacyInspectContainerState(mock.spawner, "supabase_db_my-app").pipe(
+        Effect.flip,
+        Effect.map((error) => {
+          expect(error).toBeInstanceOf(LegacyDockerLifecycleInspectError);
+          expect(error.message).toBe(
+            "failed to inspect container health: Error response from daemon: No such container: supabase_db_my-app",
+          );
+        }),
+      );
+    },
+  );
+
+  it.live("fails with LegacyDockerLifecycleInspectError on any other inspect failure", () => {
+    const mock = mockSpawner({ exitCode: 1, stderr: "Cannot connect to the Docker daemon\n" });
+    return legacyInspectContainerState(mock.spawner, "supabase_db_my-app").pipe(
+      Effect.flip,
+      Effect.map((error) => {
+        expect(error).toBeInstanceOf(LegacyDockerLifecycleInspectError);
+        expect(error.message).toBe(
+          "failed to inspect container health: Cannot connect to the Docker daemon",
+        );
+      }),
+    );
+  });
+
+  it.live(
+    "fails with LegacyDockerLifecycleInspectError with a generic message when stderr is empty",
+    () => {
+      const mock = mockSpawner({ exitCode: 1, stderr: "" });
+      return legacyInspectContainerState(mock.spawner, "supabase_db_my-app").pipe(
+        Effect.flip,
+        Effect.map((error) => {
+          expect(error).toBeInstanceOf(LegacyDockerLifecycleInspectError);
+          expect(error.message).toBe("failed to inspect container health");
+        }),
+      );
+    },
+  );
+
+  it.live("treats empty inspect output as an unknown, not-running state", () => {
+    const mock = mockSpawner({ stdout: "" });
+    return legacyInspectContainerState(mock.spawner, "supabase_db_my-app").pipe(
+      Effect.map((state) => {
+        expect(state).toEqual({ running: false, status: "" });
+      }),
+    );
+  });
+
+  it.live("treats non-object inspect JSON as an unknown, not-running state", () => {
+    const mock = mockSpawner({ stdout: "null" });
+    return legacyInspectContainerState(mock.spawner, "supabase_db_my-app").pipe(
+      Effect.map((state) => {
+        expect(state).toEqual({ running: false, status: "" });
+      }),
+    );
+  });
+});
+
+describe("legacyListVolumesByLabel", () => {
+  it.live("returns volume names for a successful listing", () => {
+    const mock = mockSpawner({ stdout: "supabase_db_my-app\n" });
+    return legacyListVolumesByLabel(mock.spawner, "com.supabase.cli.project=my-app").pipe(
+      Effect.map((names) => {
+        expect(names).toEqual(["supabase_db_my-app"]);
+        expect(mock.spawned).toEqual([
+          {
+            command: "docker",
+            args: [
+              "volume",
+              "ls",
+              "--filter",
+              "label=com.supabase.cli.project=my-app",
+              "--format",
+              "{{.Name}}",
+            ],
+          },
+        ]);
+      }),
+    );
+  });
+
+  it.live("returns an empty array when no volumes remain", () => {
+    const mock = mockSpawner({ stdout: "" });
+    return legacyListVolumesByLabel(mock.spawner, "com.supabase.cli.project").pipe(
+      Effect.map((names) => {
+        expect(names).toEqual([]);
+      }),
+    );
+  });
+
+  it.live("fails with LegacyDockerLifecycleListError on a non-zero exit", () => {
+    const mock = mockSpawner({ exitCode: 1, stderr: "boom\n" });
+    return legacyListVolumesByLabel(mock.spawner, "com.supabase.cli.project").pipe(
+      Effect.flip,
+      Effect.map((error) => {
+        expect(error).toBeInstanceOf(LegacyDockerLifecycleListError);
+        expect(error.message).toBe("failed to list volumes: boom");
+      }),
+    );
+  });
+
+  it.live("fails with a generic message when stderr is empty", () => {
+    const mock = mockSpawner({ exitCode: 1, stderr: "" });
+    return legacyListVolumesByLabel(mock.spawner, "com.supabase.cli.project").pipe(
+      Effect.flip,
+      Effect.map((error) => {
+        expect(error).toBeInstanceOf(LegacyDockerLifecycleListError);
+        expect(error.message).toBe("failed to list volumes");
+      }),
+    );
+  });
+});
diff --git a/apps/cli/src/legacy/shared/legacy-docker-path.ts b/apps/cli/src/legacy/shared/legacy-docker-path.ts
new file mode 100644
index 0000000000..ee5f550ae1
--- /dev/null
+++ b/apps/cli/src/legacy/shared/legacy-docker-path.ts
@@ -0,0 +1,15 @@
+/**
+ * Translate an absolute host path to its in-container mount path. Mirrors Go's
+ * `utils.ToDockerPath` (`apps/cli-go/internal/utils/deno.go:268-272`): strip a
+ * Windows volume name (`C:`) and convert backslashes to forward slashes.
+ *
+ * Hoisted out of `db/test`'s `db.pg-prove-args.ts` (its original, single-command
+ * home) once `start`'s pg-meta/Studio service builders needed the same
+ * translation for their bind-mount paths — see `apps/cli/CLAUDE.md`'s "Hoist
+ * Before You Duplicate" rule ("used by ≥2 commands across families").
+ */
+export function legacyToDockerPath(absHostPath: string): string {
+  const slashed = absHostPath.replaceAll("\\", "/");
+  const volumeMatch = /^[A-Za-z]:/.exec(absHostPath);
+  return volumeMatch === null ? slashed : slashed.slice(volumeMatch[0].length);
+}
diff --git a/apps/cli/src/legacy/shared/legacy-docker-path.unit.test.ts b/apps/cli/src/legacy/shared/legacy-docker-path.unit.test.ts
new file mode 100644
index 0000000000..5ddaf1141a
--- /dev/null
+++ b/apps/cli/src/legacy/shared/legacy-docker-path.unit.test.ts
@@ -0,0 +1,15 @@
+import { describe, expect, test } from "vitest";
+
+import { legacyToDockerPath } from "./legacy-docker-path.ts";
+
+describe("legacyToDockerPath", () => {
+  test("leaves a posix path unchanged", () => {
+    expect(legacyToDockerPath("/work/project/supabase/tests")).toBe("/work/project/supabase/tests");
+  });
+
+  test("strips a Windows volume and converts backslashes", () => {
+    expect(legacyToDockerPath("C:\\Users\\me\\tests\\a_test.sql")).toBe(
+      "/Users/me/tests/a_test.sql",
+    );
+  });
+});
diff --git a/apps/cli/src/legacy/shared/legacy-docker-registry.ts b/apps/cli/src/legacy/shared/legacy-docker-registry.ts
index 2534067128..1dbe092d26 100644
--- a/apps/cli/src/legacy/shared/legacy-docker-registry.ts
+++ b/apps/cli/src/legacy/shared/legacy-docker-registry.ts
@@ -29,31 +29,53 @@ function getLastImageSegment(imageName: string): string {
   return parts[parts.length - 1] ?? imageName;
 }
 
-function legacyGetRegistryOverride(): string | undefined {
-  const registry = process.env[LEGACY_INTERNAL_IMAGE_REGISTRY_ENV]?.trim();
+/**
+ * `projectEnvValues` (dotenv-merged env, ambient-wins) is optional and
+ * additive — every existing caller that omits it keeps today's ambient-only
+ * behavior unchanged. Only callers that already have a project's dotenv
+ * values in scope (currently `start`, via `legacyGetRegistryImageUrlCandidates`)
+ * need to pass it so a `SUPABASE_INTERNAL_IMAGE_REGISTRY` set only in
+ * `supabase/.env`/project-root dotenv (not the ambient shell) is honored,
+ * matching Go's `Config.Load` loading dotenv files into the process env
+ * (`loadNestedEnv`, `pkg/config/config.go:789,1220-1258`) before `GetRegistry()`
+ * (`internal/utils/docker.go:221-227`) ever reads it.
+ */
+function legacyGetRegistryOverride(
+  projectEnvValues?: Readonly<Record<string, string>>,
+): string | undefined {
+  const registry = (
+    projectEnvValues?.[LEGACY_INTERNAL_IMAGE_REGISTRY_ENV] ??
+    process.env[LEGACY_INTERNAL_IMAGE_REGISTRY_ENV]
+  )?.trim();
   return registry === undefined || registry.length === 0 ? undefined : registry.toLowerCase();
 }
 
-function legacyGetRegistry(): string {
-  return legacyGetRegistryOverride() ?? DEFAULT_REGISTRY;
+function legacyGetRegistry(projectEnvValues?: Readonly<Record<string, string>>): string {
+  return legacyGetRegistryOverride(projectEnvValues) ?? DEFAULT_REGISTRY;
 }
 
-export function legacyGetRegistryImageUrl(imageName: string): string {
-  const registry = legacyGetRegistry();
+export function legacyGetRegistryImageUrl(
+  imageName: string,
+  projectEnvValues?: Readonly<Record<string, string>>,
+): string {
+  const registry = legacyGetRegistry(projectEnvValues);
   if (registry === DOCKER_HUB_REGISTRY) {
     return imageName;
   }
   return `${registry}/supabase/${getLastImageSegment(imageName)}`;
 }
 
-export function legacyGetRegistryImageUrlCandidates(imageName: string): ReadonlyArray<string> {
-  if (legacyGetRegistryOverride() !== undefined) {
-    return [legacyGetRegistryImageUrl(imageName)];
+export function legacyGetRegistryImageUrlCandidates(
+  imageName: string,
+  projectEnvValues?: Readonly<Record<string, string>>,
+): ReadonlyArray<string> {
+  if (legacyGetRegistryOverride(projectEnvValues) !== undefined) {
+    return [legacyGetRegistryImageUrl(imageName, projectEnvValues)];
   }
 
   const lastPart = getLastImageSegment(imageName);
   return dedupe([
-    legacyGetRegistryImageUrl(imageName),
+    legacyGetRegistryImageUrl(imageName, projectEnvValues),
     `${GHCR_SUPABASE_REGISTRY}/${lastPart}`,
     dockerHubFallbackImage(imageName, lastPart),
   ]);
diff --git a/apps/cli/src/legacy/shared/legacy-docker-registry.unit.test.ts b/apps/cli/src/legacy/shared/legacy-docker-registry.unit.test.ts
index 21ef80a438..47f1739320 100644
--- a/apps/cli/src/legacy/shared/legacy-docker-registry.unit.test.ts
+++ b/apps/cli/src/legacy/shared/legacy-docker-registry.unit.test.ts
@@ -86,4 +86,40 @@ describe("legacyGetRegistryImageUrl", () => {
       ),
     ).toEqual(["my.mirror.example/supabase/postgres:17.6.1.138"]);
   });
+
+  // Go's `Config.Load` runs `loadNestedEnv`/`godotenv.Load` (`pkg/config/config.go:789,1220-1258`)
+  // before any image resolution, so a project-dotenv-only `SUPABASE_INTERNAL_IMAGE_REGISTRY`
+  // (never set in the ambient shell) still reaches `GetRegistry()`.
+  it("honors a projectEnvValues (dotenv)-only registry override, matching Go's post-Load os.Getenv", () => {
+    expect(
+      withRegistry(undefined, () =>
+        legacyGetRegistryImageUrl("supabase/pg_prove:3.36", {
+          SUPABASE_INTERNAL_IMAGE_REGISTRY: "my.mirror.example",
+        }),
+      ),
+    ).toBe("my.mirror.example/supabase/pg_prove:3.36");
+    expect(
+      withRegistry(undefined, () =>
+        legacyGetRegistryImageUrlCandidates("supabase/postgres:17.6.1.138", {
+          SUPABASE_INTERNAL_IMAGE_REGISTRY: "my.mirror.example",
+        }),
+      ),
+    ).toEqual(["my.mirror.example/supabase/postgres:17.6.1.138"]);
+  });
+
+  // `projectEnvValues` is the caller's own dotenv+ambient MERGED view (ambient
+  // wins ties during that merge, matching `godotenv.Load`'s "don't override
+  // already-set" semantics — see `legacyEnvOrDefault`'s doc comment for the
+  // same precedent), so checking it first is equivalent to checking the
+  // already-correctly-merged value first; falling back to bare `process.env`
+  // only covers a caller with no project-env context at all.
+  it("prefers projectEnvValues over a bare process.env read when both are set", () => {
+    expect(
+      withRegistry("ambient.example", () =>
+        legacyGetRegistryImageUrl("supabase/pg_prove:3.36", {
+          SUPABASE_INTERNAL_IMAGE_REGISTRY: "merged.example",
+        }),
+      ),
+    ).toBe("merged.example/supabase/pg_prove:3.36");
+  });
 });
diff --git a/apps/cli/src/legacy/shared/legacy-docker-remove-all.ts b/apps/cli/src/legacy/shared/legacy-docker-remove-all.ts
new file mode 100644
index 0000000000..ae4e8bd59a
--- /dev/null
+++ b/apps/cli/src/legacy/shared/legacy-docker-remove-all.ts
@@ -0,0 +1,220 @@
+import { Data, Effect, Result } from "effect";
+import type { ChildProcessSpawner } from "effect/unstable/process/ChildProcessSpawner";
+
+import {
+  containerCliExitCode,
+  legacyDescribeContainerCliFailure,
+  legacyDockerSupportsVolumePruneAllFlag,
+} from "./legacy-container-cli.ts";
+import {
+  legacyListContainerIdsAndNames,
+  type LegacyContainerIdName,
+} from "./legacy-docker-lifecycle.ts";
+
+type Spawner = ChildProcessSpawner["Service"];
+
+/**
+ * Failure taxonomy for {@link legacyDockerRemoveAll}. Each variant is a neutral, stage-tagged
+ * cause carrying only a `.message` — same generalization pattern as `legacy-docker-lifecycle.ts`'s
+ * `LegacyDockerLifecycleListError`/`LegacyDockerLifecycleInspectError`. Callers (`stop.handler.ts`
+ * via `Effect.catchTags`; `start.rollback.ts` via a blanket swallow) discriminate/consume these by
+ * their string `_tag`, never by importing the classes themselves, so only the union below is
+ * exported — matching every constructor's actual usage (confirmed via `knip`).
+ */
+class LegacyDockerRemoveAllListError extends Data.TaggedError("LegacyDockerRemoveAllListError")<{
+  readonly message: string;
+}> {}
+
+class LegacyDockerRemoveAllStopError extends Data.TaggedError("LegacyDockerRemoveAllStopError")<{
+  readonly message: string;
+}> {}
+
+class LegacyDockerRemoveAllContainerPruneError extends Data.TaggedError(
+  "LegacyDockerRemoveAllContainerPruneError",
+)<{
+  readonly message: string;
+}> {}
+
+class LegacyDockerRemoveAllVolumePruneError extends Data.TaggedError(
+  "LegacyDockerRemoveAllVolumePruneError",
+)<{
+  readonly message: string;
+}> {}
+
+class LegacyDockerRemoveAllNetworkPruneError extends Data.TaggedError(
+  "LegacyDockerRemoveAllNetworkPruneError",
+)<{
+  readonly message: string;
+}> {}
+
+/** Every failure {@link legacyDockerRemoveAll} can produce. */
+export type LegacyDockerRemoveAllError =
+  | LegacyDockerRemoveAllListError
+  | LegacyDockerRemoveAllStopError
+  | LegacyDockerRemoveAllContainerPruneError
+  | LegacyDockerRemoveAllVolumePruneError
+  | LegacyDockerRemoveAllNetworkPruneError;
+
+/**
+ * Port of Go's `DockerRemoveAll` (`apps/cli-go/internal/utils/docker.go:96-146`): list every
+ * container matching `filterValue` regardless of state -> stop them all concurrently, joining
+ * every failure rather than short-circuiting on the first one (Go's `WaitAll`) -> `container
+ * prune --force --filter label=<filterValue>` -> when `deleteVolumes`, `volume prune --force
+ * [--all] --filter label=<filterValue>` (the `--all` flag itself gated on
+ * {@link legacyDockerSupportsVolumePruneAllFlag}, Docker API >= 1.42) -> `network prune --force
+ * --filter label=<filterValue>`.
+ *
+ * `onContainersRemoved`, if given, fires synchronously once `container prune` (the actual
+ * removal step below) has EXITED SUCCESSFULLY — not at the initial listing, and not before
+ * containers are even stopped — with the exact containers that listing found, id/name/workdir
+ * together. A TS-port-only hook with no Go equivalent, for callers (`stop.handler.ts`,
+ * `start.rollback.ts`) that need those same containers for {@link legacyCleanupStartSecrets}
+ * (Go itself doesn't stage host-disk secrets, so it has no reason to know them). It exists so
+ * those callers get this data from THIS function's own single `docker ps` listing instead of
+ * issuing a second, separately-formatted `docker ps` call, which would double the real Docker
+ * Engine API request count relative to Go and fail the cli-e2e-ci request-log parity check.
+ *
+ * Firing AFTER `container prune` succeeds (rather than at listing time) matters: the listing
+ * only snapshots what MIGHT be torn down, before the stop/prune stages have actually run — firing
+ * there let a caller reclaim a container's staged-secret directory even when the stop stage fails
+ * outright (so `container prune` never even runs and nothing was actually removed) or a
+ * still-running container survives. Firing here instead means a caller only ever reclaims
+ * secrets for containers `container prune` has ACTUALLY removed. It still fires even if a LATER
+ * stage (volume/network prune) then fails, so those confirmed-removed containers' secrets are
+ * still reclaimed on that partial failure — matching the fix landed in `983eab92`.
+ */
+export const legacyDockerRemoveAll = (
+  spawner: Spawner,
+  filterValue: string,
+  deleteVolumes: boolean,
+  onContainersRemoved?: (containers: ReadonlyArray<LegacyContainerIdName>) => void,
+): Effect.Effect<void, LegacyDockerRemoveAllError> =>
+  Effect.gen(function* () {
+    const containers = yield* legacyListContainerIdsAndNames(spawner, {
+      projectIdFilter: filterValue,
+      all: true,
+    }).pipe(
+      Effect.mapError((cause) => new LegacyDockerRemoveAllListError({ message: cause.message })),
+    );
+    const containerIds = containers.map((container) => container.id);
+
+    // Go stops containers concurrently via `WaitAll`, joining every failure rather than
+    // short-circuiting on the first one (`docker.go:96-146`).
+    //
+    // `stdout`/`stderr: "ignore"` on every exit-code-only call below: none of these read the
+    // child's own output, and the default `"pipe"` stdio otherwise leaves an OS pipe unread —
+    // once `docker`/`podman` write enough to it (e.g. `container prune`'s "Deleted Containers"
+    // ID list on a host with many stale containers, most likely under `stop --all`), the child
+    // blocks on write() and this hangs. Matches the existing `stdio: "ignore"` precedent for the
+    // same "exit-code-only" shape in `legacy-pgdelta.seam.layer.ts`.
+    const stopResults = yield* Effect.all(
+      containerIds.map((id) =>
+        containerCliExitCode(spawner, ["stop", id], {
+          stdin: "ignore",
+          stdout: "ignore",
+          stderr: "ignore",
+        }).pipe(Effect.result),
+      ),
+      { concurrency: "unbounded" },
+    );
+    const failedStop = stopResults.find(
+      (result) => Result.isFailure(result) || result.success !== 0,
+    );
+    if (failedStop !== undefined) {
+      return yield* Effect.fail(
+        new LegacyDockerRemoveAllStopError({
+          message: `failed to stop container: ${
+            Result.isFailure(failedStop)
+              ? legacyDescribeContainerCliFailure(failedStop.failure)
+              : `exit ${failedStop.success}`
+          }`,
+        }),
+      );
+    }
+
+    const containerPruneExitCode = yield* containerCliExitCode(
+      spawner,
+      ["container", "prune", "--force", "--filter", `label=${filterValue}`],
+      { stdin: "ignore", stdout: "ignore", stderr: "ignore" },
+    ).pipe(
+      Effect.mapError(
+        (cause) =>
+          new LegacyDockerRemoveAllContainerPruneError({
+            message: `failed to prune containers: ${legacyDescribeContainerCliFailure(cause)}`,
+          }),
+      ),
+    );
+    if (containerPruneExitCode !== 0) {
+      return yield* Effect.fail(
+        new LegacyDockerRemoveAllContainerPruneError({ message: "failed to prune containers" }),
+      );
+    }
+    // Containers are now CONFIRMED removed — see `onContainersRemoved`'s doc comment for why this
+    // must fire here rather than at the listing above, and why it still must fire even if a later
+    // stage (volume/network prune, below) goes on to fail.
+    onContainersRemoved?.(containers);
+
+    if (deleteVolumes) {
+      // Go gates the `--all` filter arg on Docker API >= 1.42 (`docker.go:126-133`,
+      // `Docker.ClientVersion() >= "1.42"`): Docker CLI's own `volume prune --all` flag is
+      // annotated `version: "1.42"` (`docker/cli@v28.5.2` `cli/command/volume/prune.go:53`) and
+      // enforced by Cobra's `Args` validator *before* `RunE` runs
+      // (`cmd/docker/docker.go:659-660`) — on an older daemon, passing `--all` unconditionally
+      // would hard-fail this whole call and prune nothing, not just prune a narrower set. There's
+      // no persistent Engine API client here to ask the negotiated version directly (Go talks to
+      // the Docker Engine API, never a `docker` binary), so
+      // {@link legacyDockerSupportsVolumePruneAllFlag} asks the `docker` CLI itself via `docker
+      // version` and mirrors Go's gate exactly.
+      //
+      // Podman is a Docker-CLI-compatible fallback this port adds, not something Go itself has,
+      // so there's no Go behavior to match on that path — but `--all` isn't a real flag on any
+      // released Podman `volume prune` (only `--filter`/`--force`/`--help`, checked v4.3 through
+      // the current v5.7; `--all` only exists in unreleased dev docs), so it hard-fails on a real
+      // Podman-only host. Podman already prunes every unused volume by default, so omitting
+      // `--all` on the Podman fallback is a lossless fix.
+      const dockerSupportsAll = yield* legacyDockerSupportsVolumePruneAllFlag(spawner);
+      const volumePruneExitCode = yield* containerCliExitCode(
+        spawner,
+        [
+          "volume",
+          "prune",
+          "--force",
+          ...(dockerSupportsAll ? ["--all"] : []),
+          "--filter",
+          `label=${filterValue}`,
+        ],
+        { stdin: "ignore", stdout: "ignore", stderr: "ignore" },
+        ["volume", "prune", "--force", "--filter", `label=${filterValue}`],
+      ).pipe(
+        Effect.mapError(
+          (cause) =>
+            new LegacyDockerRemoveAllVolumePruneError({
+              message: `failed to prune volumes: ${legacyDescribeContainerCliFailure(cause)}`,
+            }),
+        ),
+      );
+      if (volumePruneExitCode !== 0) {
+        return yield* Effect.fail(
+          new LegacyDockerRemoveAllVolumePruneError({ message: "failed to prune volumes" }),
+        );
+      }
+    }
+
+    const networkPruneExitCode = yield* containerCliExitCode(
+      spawner,
+      ["network", "prune", "--force", "--filter", `label=${filterValue}`],
+      { stdin: "ignore", stdout: "ignore", stderr: "ignore" },
+    ).pipe(
+      Effect.mapError(
+        (cause) =>
+          new LegacyDockerRemoveAllNetworkPruneError({
+            message: `failed to prune networks: ${legacyDescribeContainerCliFailure(cause)}`,
+          }),
+      ),
+    );
+    if (networkPruneExitCode !== 0) {
+      return yield* Effect.fail(
+        new LegacyDockerRemoveAllNetworkPruneError({ message: "failed to prune networks" }),
+      );
+    }
+  });
diff --git a/apps/cli/src/legacy/shared/legacy-docker-run.args.ts b/apps/cli/src/legacy/shared/legacy-docker-run.args.ts
index c3cb65151b..6f81fcab3e 100644
--- a/apps/cli/src/legacy/shared/legacy-docker-run.args.ts
+++ b/apps/cli/src/legacy/shared/legacy-docker-run.args.ts
@@ -1,4 +1,8 @@
 import { Option } from "effect";
+import {
+  legacyBindMountSpecSource,
+  legacyIsBindMountSource,
+} from "./legacy-docker-bind-classify.ts";
 import type { LegacyDockerRunOpts } from "./legacy-docker-run.service.ts";
 
 /**
@@ -40,13 +44,6 @@ export function buildLegacyDockerArgs(opts: LegacyDockerRunOpts): ReadonlyArray<
   ];
 }
 
-// Go's `loader.ParseVolume` bind-vs-named classification (docker/cli `volumespec`
-// `isFilePath`): a bind's source is a bind mount when it looks like a file path
-// (starts with `.`, `/`, `~`, or a Windows drive/UNC); otherwise it is a named volume.
-function isBindMountSource(source: string): boolean {
-  return /^[.~/]/.test(source) || /^[A-Za-z]:[\\/]/.test(source) || source.startsWith("\\\\");
-}
-
 /**
  * Mirror Go's `DockerStart` Bitbucket Pipelines handling
  * (`apps/cli-go/internal/utils/docker.go:275-304`): when `BITBUCKET_CLONE_DIR` is set,
@@ -62,7 +59,7 @@ export function legacyApplyBitbucketDockerFilter(
   if (!isBitbucket) return opts;
   return {
     ...opts,
-    binds: opts.binds.filter((bind) => isBindMountSource(bind.split(":")[0] ?? "")),
+    binds: opts.binds.filter((bind) => legacyIsBindMountSource(legacyBindMountSpecSource(bind))),
     securityOpt: [],
   };
 }
diff --git a/apps/cli/src/legacy/shared/legacy-docker-run.layer.ts b/apps/cli/src/legacy/shared/legacy-docker-run.layer.ts
index f9b301821e..654038bb16 100644
--- a/apps/cli/src/legacy/shared/legacy-docker-run.layer.ts
+++ b/apps/cli/src/legacy/shared/legacy-docker-run.layer.ts
@@ -1,40 +1,17 @@
-import { Effect, Exit, Layer, Stream } from "effect";
+import { Effect, Layer, Stream } from "effect";
 import { ChildProcessSpawner } from "effect/unstable/process/ChildProcessSpawner";
 import { ProcessControl } from "../../shared/runtime/process-control.service.ts";
+import { legacyIsBitbucketPipeline } from "./legacy-bitbucket-pipeline.ts";
 import { containerCliExitCode, spawnContainerCli } from "./legacy-container-cli.ts";
+import { legacyMakeDockerImageResolver } from "./legacy-docker-image-resolve.ts";
 import {
   buildLegacyDockerArgs,
   legacyApplyBitbucketDockerFilter,
 } from "./legacy-docker-run.args.ts";
 import { LegacyDockerRunError } from "./legacy-docker-run.errors.ts";
-import { legacyGetRegistryImageUrlCandidates } from "./legacy-docker-registry.ts";
+import { LEGACY_SUGGEST_DOCKER_INSTALL } from "./legacy-docker-suggest.ts";
 import { LegacyDockerRun, type LegacyDockerRunOpts } from "./legacy-docker-run.service.ts";
 
-// Go's prerequisite hint (`apps/cli-go/internal/utils/docker.go:248`).
-const SUGGEST_DOCKER_INSTALL =
-  "Docker Desktop is a prerequisite for local development. Follow the official docs to install: https://docs.docker.com/desktop";
-
-// Go's `DockerStart` checks `os.Getenv("BITBUCKET_CLONE_DIR") != ""`
-// (`apps/cli-go/internal/utils/docker.go:289`) to drop named volumes / security-opts.
-const legacyIsBitbucketPipeline = (): boolean => {
-  const value = globalThis.process.env["BITBUCKET_CLONE_DIR"];
-  return value !== undefined && value.length > 0;
-};
-
-const DOCKER_PULL_RETRY_DELAYS_MS = [500] as const;
-
-const RETRYABLE_PULL_PATTERNS = [
-  /toomanyrequests/i,
-  /rate exceeded/i,
-  /429\b/i,
-  /timeout/i,
-  /temporarily unavailable/i,
-  /temporary failure/i,
-  /connection reset/i,
-  /tls handshake timeout/i,
-  /i\/o timeout/i,
-] as const;
-
 export const legacyDockerRunLayer: Layer.Layer<
   LegacyDockerRun,
   never,
@@ -49,7 +26,9 @@ export const legacyDockerRunLayer: Layer.Layer<
       // Never embed the spawn error verbatim: it can leak the full argv and
       // environment of the failed exec (CWE-214/209). Emit a fixed,
       // credential-free message that still points at the likely cause.
-      new LegacyDockerRunError({ message: `failed to run docker. ${SUGGEST_DOCKER_INSTALL}` });
+      new LegacyDockerRunError({
+        message: `failed to run docker. ${LEGACY_SUGGEST_DOCKER_INSTALL}`,
+      });
 
     const concat = (chunks: ReadonlyArray<Uint8Array>): Uint8Array => {
       const total = chunks.reduce((size, chunk) => size + chunk.length, 0);
@@ -62,122 +41,14 @@ export const legacyDockerRunLayer: Layer.Layer<
       return bytes;
     };
 
-    const hasLocalImage = (image: string): Effect.Effect<boolean> =>
-      containerCliExitCode(spawner, ["image", "inspect", image]).pipe(
-        Effect.map((exitCode) => exitCode === 0),
-        Effect.catch(() => Effect.succeed(false)),
-      );
-
-    const pullImage = (
-      image: string,
-    ): Effect.Effect<{ readonly exitCode: number; readonly stderr: string }, Error> =>
-      Effect.gen(function* () {
-        const handle = yield* spawnContainerCli(spawner, ["pull", image], {
-          stdin: "inherit",
-          stdout: "pipe",
-          stderr: "pipe",
-          detached: false,
-          extendEnv: true,
-        }).pipe(Effect.mapError(() => new Error("spawn")));
-        // Tee pull progress to the parent terminal in real time so a large,
-        // uncached pull does not look frozen — Go streams the same progress via
-        // `jsonmessage.DisplayJSONMessagesToStream`. Progress goes to stderr so
-        // it never corrupts the captured stdout of the `db dump` run path. The
-        // buffered copies are kept only to classify retryable failures and to
-        // report the error on a non-zero exit. Decode each stream separately so
-        // a multi-byte UTF-8 sequence is never split across interleaved chunks.
-        const stdoutChunks: Array<Uint8Array> = [];
-        const stderrChunks: Array<Uint8Array> = [];
-        yield* Effect.all(
-          [
-            Stream.runForEach(handle.stdout, (chunk) =>
-              Effect.sync(() => {
-                stdoutChunks.push(chunk);
-                globalThis.process.stderr.write(chunk);
-              }),
-            ),
-            Stream.runForEach(handle.stderr, (chunk) =>
-              Effect.sync(() => {
-                stderrChunks.push(chunk);
-                globalThis.process.stderr.write(chunk);
-              }),
-            ),
-          ],
-          { concurrency: "unbounded" },
-        );
-        const exitCode = yield* handle.exitCode.pipe(Effect.map(Number));
-        const stdout = new TextDecoder().decode(concat(stdoutChunks));
-        const stderr = new TextDecoder().decode(concat(stderrChunks));
-        return {
-          exitCode,
-          stderr: `${stdout}${stderr}`.trim(),
-        };
-      }).pipe(Effect.scoped);
-
-    const shouldRetryPull = (message: string): boolean =>
-      RETRYABLE_PULL_PATTERNS.some((pattern) => pattern.test(message));
-
-    const resolveImage = (image: string): Effect.Effect<string, LegacyDockerRunError> =>
-      Effect.gen(function* () {
-        const candidates = legacyGetRegistryImageUrlCandidates(image);
-        for (const candidate of candidates) {
-          if (yield* hasLocalImage(candidate)) {
-            return candidate;
-          }
-        }
-
-        const failures: Array<string> = [];
-        for (const candidate of candidates) {
-          for (
-            let attemptIndex = 0;
-            attemptIndex <= DOCKER_PULL_RETRY_DELAYS_MS.length;
-            attemptIndex += 1
-          ) {
-            const attempt = attemptIndex + 1;
-            const result = yield* Effect.exit(pullImage(candidate));
-            if (Exit.isSuccess(result)) {
-              if (result.value.exitCode === 0) {
-                return candidate;
-              }
-              const message =
-                result.value.stderr.length > 0
-                  ? result.value.stderr
-                  : `docker pull exited with code ${result.value.exitCode}`;
-              failures.push(`${candidate} attempt ${attempt}: ${message}`);
-              if (
-                !shouldRetryPull(message) ||
-                attemptIndex === DOCKER_PULL_RETRY_DELAYS_MS.length
-              ) {
-                break;
-              }
-            } else {
-              // A failed effect (rather than a non-zero exit, which returns a
-              // value) means the container runtime could not be spawned at all.
-              // No registry candidate can fix a missing Docker/Podman binary or
-              // a down daemon, so stop here and surface the install hint instead
-              // of an opaque, repeated spawn error across every candidate.
-              return yield* Effect.fail(spawnError());
-            }
-
-            const delay = DOCKER_PULL_RETRY_DELAYS_MS[attemptIndex];
-            if (delay === undefined) {
-              break;
-            }
-            yield* Effect.sleep(`${delay} millis`);
-          }
-        }
-
-        return yield* Effect.fail(
-          new LegacyDockerRunError({
-            message: `failed to pull docker image from all registries: ${failures.join("; ")}`,
-          }),
-        );
-      });
+    const resolveImage = legacyMakeDockerImageResolver(spawner);
 
     const withResolvedImage = (
       opts: LegacyDockerRunOpts,
     ): Effect.Effect<LegacyDockerRunOpts, LegacyDockerRunError> =>
-      resolveImage(opts.image).pipe(Effect.map((image) => ({ ...opts, image })));
+      opts.skipImageResolve === true
+        ? Effect.succeed(opts)
+        : resolveImage(opts.image).pipe(Effect.map((image) => ({ ...opts, image })));
 
     return LegacyDockerRun.of({
       runCapture: (opts, captureOpts) =>
@@ -309,7 +180,7 @@ export const legacyDockerRunLayer: Layer.Layer<
               Effect.mapError(
                 () =>
                   new LegacyDockerRunError({
-                    message: `failed to run docker. ${SUGGEST_DOCKER_INSTALL}`,
+                    message: `failed to run docker. ${LEGACY_SUGGEST_DOCKER_INSTALL}`,
                   }),
               ),
             );
diff --git a/apps/cli/src/legacy/shared/legacy-docker-run.service.ts b/apps/cli/src/legacy/shared/legacy-docker-run.service.ts
index f6fbe07518..12a25307a0 100644
--- a/apps/cli/src/legacy/shared/legacy-docker-run.service.ts
+++ b/apps/cli/src/legacy/shared/legacy-docker-run.service.ts
@@ -29,6 +29,19 @@ export interface LegacyDockerRunOpts {
    */
   readonly extraHosts: ReadonlyArray<string>;
   readonly network: LegacyDockerNetwork;
+  /**
+   * Skips this layer's own image resolution (`legacyMakeDockerImageResolver`) when the
+   * caller already resolved `image` itself through a `projectEnvValues`-aware path (e.g.
+   * `start`'s one-shot fresh-DB setup jobs, resolved via `legacyEnsureImagesCached` before
+   * `legacyStartSetupLocalDatabase` ever calls this service). This layer's own resolver is
+   * built once, statically, with no `projectEnvValues` in scope (see
+   * `legacy-docker-run.layer.ts`'s header) — re-resolving an ALREADY-resolved image (e.g.
+   * `registry.example.com/supabase/gotrue:v2.192.0`) would treat it as a fresh, unresolved
+   * image reference and rebuild registry candidates from it using the DEFAULT registry,
+   * silently discarding a project-dotenv-only `SUPABASE_INTERNAL_IMAGE_REGISTRY` override.
+   * Defaults to `false` (existing ambient-only resolution) for every other caller.
+   */
+  readonly skipImageResolve?: boolean;
 }
 
 /**
diff --git a/apps/cli/src/legacy/shared/legacy-docker-suggest.ts b/apps/cli/src/legacy/shared/legacy-docker-suggest.ts
new file mode 100644
index 0000000000..76397c3ab1
--- /dev/null
+++ b/apps/cli/src/legacy/shared/legacy-docker-suggest.ts
@@ -0,0 +1,21 @@
+/**
+ * Go's Docker prerequisite hint (`apps/cli-go/internal/utils/docker.go:350`,
+ * `suggestDockerInstall`). Go sets it as `CmdSuggestion` — rendered as a separate
+ * "Suggestion:" line — whenever a container-runtime call fails because the daemon
+ * is unreachable (`client.IsErrConnectionFailed`, `misc.go:148-154`).
+ */
+export const LEGACY_SUGGEST_DOCKER_INSTALL =
+  "Docker Desktop is a prerequisite for local development. Follow the official docs to install: https://docs.docker.com/desktop";
+
+/**
+ * Whether a container-CLI stderr indicates the daemon is unreachable — the
+ * subprocess-stderr equivalent of Go's `client.IsErrConnectionFailed` (which
+ * inspects the Docker API client error). The docker / podman CLIs print
+ * "Cannot connect to the Docker daemon …" / "Cannot connect to Podman …" (often
+ * followed by "Is the docker daemon running?") when the socket is down.
+ */
+export function legacyIsDockerDaemonUnreachable(stderr: string): boolean {
+  return /cannot connect to the docker daemon|cannot connect to podman|is the docker daemon running/iu.test(
+    stderr,
+  );
+}
diff --git a/apps/cli/src/legacy/shared/legacy-docker-suggest.unit.test.ts b/apps/cli/src/legacy/shared/legacy-docker-suggest.unit.test.ts
new file mode 100644
index 0000000000..0fcadd4f22
--- /dev/null
+++ b/apps/cli/src/legacy/shared/legacy-docker-suggest.unit.test.ts
@@ -0,0 +1,31 @@
+import { describe, expect, it } from "vitest";
+
+import {
+  LEGACY_SUGGEST_DOCKER_INSTALL,
+  legacyIsDockerDaemonUnreachable,
+} from "./legacy-docker-suggest.ts";
+
+describe("legacyIsDockerDaemonUnreachable", () => {
+  it("detects the docker/podman daemon-down CLI messages (Go's IsErrConnectionFailed)", () => {
+    expect(
+      legacyIsDockerDaemonUnreachable(
+        "Cannot connect to the Docker daemon at unix:///var/run/docker.sock. Is the docker daemon running?",
+      ),
+    ).toBe(true);
+    // Case-insensitive + the podman phrasing.
+    expect(legacyIsDockerDaemonUnreachable("cannot connect to podman")).toBe(true);
+    expect(legacyIsDockerDaemonUnreachable("Is the docker daemon running?")).toBe(true);
+  });
+
+  it("does not flag an unrelated inspect failure (e.g. a permission error)", () => {
+    expect(legacyIsDockerDaemonUnreachable("permission denied while trying to connect")).toBe(
+      false,
+    );
+    expect(legacyIsDockerDaemonUnreachable("Error: No such container: supabase_db_x")).toBe(false);
+    expect(legacyIsDockerDaemonUnreachable("")).toBe(false);
+  });
+
+  it("exposes Go's install hint verbatim", () => {
+    expect(LEGACY_SUGGEST_DOCKER_INSTALL).toContain("https://docs.docker.com/desktop");
+  });
+});
diff --git a/apps/cli/src/legacy/shared/legacy-edge-runtime-script.layer.integration.test.ts b/apps/cli/src/legacy/shared/legacy-edge-runtime-script.layer.integration.test.ts
new file mode 100644
index 0000000000..dc7a3fb052
--- /dev/null
+++ b/apps/cli/src/legacy/shared/legacy-edge-runtime-script.layer.integration.test.ts
@@ -0,0 +1,123 @@
+import { describe, expect, it } from "@effect/vitest";
+import { BunServices } from "@effect/platform-bun";
+import { Effect, Exit, Layer, Option } from "effect";
+
+import { LegacyDebugFlag, LegacyNetworkIdFlag } from "../../shared/legacy/global-flags.ts";
+import { RuntimeInfo } from "../../shared/runtime/runtime-info.service.ts";
+import { LegacyCliConfig } from "../config/legacy-cli-config.service.ts";
+import { LegacyDockerRun } from "./legacy-docker-run.service.ts";
+import { legacyEdgeRuntimeScriptLayer } from "./legacy-edge-runtime-script.layer.ts";
+import { LegacyEdgeRuntimeScript } from "./legacy-edge-runtime-script.service.ts";
+
+// Fakes a `docker run --rm` capture: the pg-delta scripts throw to force the
+// worker to exit, so a real diff always comes back with a non-zero exit and
+// "main worker has been destroyed" in stderr — the crash path only differs by
+// the sentinel line the templates' catch blocks add.
+function fakeDocker(result: { exitCode: number; stdout?: string; stderr?: string }) {
+  return Layer.succeed(LegacyDockerRun, {
+    runCapture: () =>
+      Effect.succeed({
+        exitCode: result.exitCode,
+        stdout: new TextEncoder().encode(result.stdout ?? ""),
+        stderr: result.stderr ?? "",
+      }),
+    run: () => Effect.die("unused"),
+    runStream: () => Effect.die("unused"),
+  });
+}
+
+// `workdir` points at a directory without `supabase/.temp/edge-runtime-version`,
+// so the image resolver falls back to the default tag (the read is orElseSucceed).
+const cliConfig = Layer.succeed(LegacyCliConfig, {
+  profile: "supabase",
+  apiUrl: "https://api.supabase.com",
+  projectHost: "supabase.co",
+  poolerHost: "supabase.co",
+  dashboardUrl: "https://supabase.com/dashboard",
+  accessToken: Option.none(),
+  projectId: Option.none(),
+  workdir: "/nonexistent-workdir",
+  userAgent: "test",
+});
+
+function setup(result: { exitCode: number; stdout?: string; stderr?: string }) {
+  return legacyEdgeRuntimeScriptLayer.pipe(
+    Layer.provideMerge(
+      Layer.mergeAll(
+        fakeDocker(result),
+        cliConfig,
+        Layer.succeed(RuntimeInfo, {
+          cwd: "/nonexistent-workdir",
+          platform: "darwin",
+          arch: "arm64",
+          homeDir: "/home/test",
+          execPath: "/usr/bin/bun",
+          pid: 1,
+        }),
+        Layer.succeed(LegacyDebugFlag, false),
+        Layer.succeed(LegacyNetworkIdFlag, Option.none<string>()),
+        BunServices.layer,
+      ),
+    ),
+  );
+}
+
+const runScript = Effect.fnUntraced(function* () {
+  const edge = yield* LegacyEdgeRuntimeScript;
+  return yield* edge.run({
+    script: "console.log('x')",
+    env: {},
+    binds: [],
+    errPrefix: "error diffing schema",
+    denoVersion: 2,
+  });
+});
+
+describe("legacyEdgeRuntimeScriptLayer sentinel handling", () => {
+  it.effect(
+    "fails with the real error when the script crashes behind the worker-destroyed message",
+    () => {
+      // The catch block emits the real error, the sentinel, and the worker is torn
+      // down — all with a non-zero exit. This must surface, not read as an empty diff.
+      const stderr =
+        "error: permission denied for table pg_user_mapping\n" +
+        "PGDELTA_SCRIPT_ERROR\n" +
+        "worker boot error\nmain worker has been destroyed\n";
+      return runScript().pipe(
+        Effect.exit,
+        Effect.tap((exit) =>
+          Effect.sync(() => {
+            expect(Exit.isFailure(exit)).toBe(true);
+            const error = Exit.isFailure(exit)
+              ? exit.cause.reasons.find((r) => r._tag === "Fail")?.error
+              : undefined;
+            const message = (error as { message: string } | undefined)?.message ?? "";
+            expect(message).toContain("error diffing schema: error running script:");
+            // The actionable permission error must reach the user.
+            expect(message).toContain("permission denied for table pg_user_mapping");
+          }),
+        ),
+        Effect.provide(setup({ exitCode: 1, stdout: "", stderr })),
+      );
+    },
+  );
+
+  it.effect("still succeeds on a worker-destroyed exit when no sentinel is present", () => {
+    // Success path: the template forces the worker to exit after writing output, so
+    // the exit is non-zero with "main worker has been destroyed" but no sentinel.
+    return runScript().pipe(
+      Effect.tap((res) =>
+        Effect.sync(() => {
+          expect(res.stdout).toBe("ALTER TABLE x;\n");
+        }),
+      ),
+      Effect.provide(
+        setup({
+          exitCode: 1,
+          stdout: "ALTER TABLE x;\n",
+          stderr: "main worker has been destroyed\n",
+        }),
+      ),
+    );
+  });
+});
diff --git a/apps/cli/src/legacy/shared/legacy-edge-runtime-script.layer.ts b/apps/cli/src/legacy/shared/legacy-edge-runtime-script.layer.ts
index 5b7d273c78..3fa93dad83 100644
--- a/apps/cli/src/legacy/shared/legacy-edge-runtime-script.layer.ts
+++ b/apps/cli/src/legacy/shared/legacy-edge-runtime-script.layer.ts
@@ -10,6 +10,7 @@ import { LegacyDockerRun } from "./legacy-docker-run.service.ts";
 import { legacyResolveEdgeRuntimeImage } from "./legacy-edge-runtime-image.ts";
 import { LegacyEdgeRuntimeScriptError } from "./legacy-edge-runtime-script.errors.ts";
 import {
+  LEGACY_EDGE_RUNTIME_SCRIPT_ERROR_SENTINEL,
   LegacyEdgeRuntimeScript,
   legacyBuildEdgeRuntimeEntrypoint,
   legacyBuildEdgeRuntimeStartCmd,
@@ -132,6 +133,21 @@ export const legacyEdgeRuntimeScriptLayer = Layer.effect(
             );
           }
 
+          // The pg-delta templates force the worker to exit by throwing, so a
+          // script crash is masked by the "main worker has been destroyed"
+          // suppression above. The sentinel — printed only by the templates'
+          // catch blocks — marks a real failure so the collected stderr (which
+          // holds the real error) reaches the user instead of looking like an
+          // empty diff. Byte-for-byte port of Go's check in
+          // apps/cli-go/internal/utils/edgeruntime.go.
+          if (result.stderr.includes(LEGACY_EDGE_RUNTIME_SCRIPT_ERROR_SENTINEL)) {
+            return yield* Effect.fail(
+              new LegacyEdgeRuntimeScriptError({
+                message: `${opts.errPrefix}: error running script:\n${result.stderr}`,
+              }),
+            );
+          }
+
           return {
             stdout: new TextDecoder().decode(result.stdout),
             stderr: result.stderr,
diff --git a/apps/cli/src/legacy/shared/legacy-edge-runtime-script.service.ts b/apps/cli/src/legacy/shared/legacy-edge-runtime-script.service.ts
index 8f6e970817..8d679b8be6 100644
--- a/apps/cli/src/legacy/shared/legacy-edge-runtime-script.service.ts
+++ b/apps/cli/src/legacy/shared/legacy-edge-runtime-script.service.ts
@@ -2,6 +2,19 @@ import { Context, type Effect, Option } from "effect";
 
 import type { LegacyEdgeRuntimeScriptError } from "./legacy-edge-runtime-script.errors.ts";
 
+/**
+ * Printed to stderr by the pg-delta Deno templates when their body throws (see
+ * the `catch` blocks in `apps/cli-go/internal/db/diff/templates/*.ts`). The
+ * templates force the edge-runtime worker to exit by throwing on both the
+ * success and failure paths, and that non-zero exit is otherwise suppressed when
+ * stderr contains `"main worker has been destroyed"`. Without a distinct marker
+ * a crashed script is indistinguishable from a successful empty diff, so
+ * `db pull` reports "No schema changes found" while the real error is swallowed.
+ * Byte-for-byte mirror of Go's `EdgeRuntimeScriptErrorSentinel`
+ * (`apps/cli-go/internal/utils/edgeruntime.go`). See supabase/cli#5826.
+ */
+export const LEGACY_EDGE_RUNTIME_SCRIPT_ERROR_SENTINEL = "PGDELTA_SCRIPT_ERROR";
+
 /** A file dropped alongside `index.ts` in the container's working directory. */
 export interface LegacyEdgeRuntimeFile {
   readonly name: string;
diff --git a/apps/cli/src/legacy/shared/legacy-experimental-gate.unit.test.ts b/apps/cli/src/legacy/shared/legacy-experimental-gate.unit.test.ts
index a359ec4af7..bc07234903 100644
--- a/apps/cli/src/legacy/shared/legacy-experimental-gate.unit.test.ts
+++ b/apps/cli/src/legacy/shared/legacy-experimental-gate.unit.test.ts
@@ -1,6 +1,7 @@
 import { describe, expect, it } from "@effect/vitest";
 import { Effect, Layer } from "effect";
 
+import { CliArgs } from "../../shared/cli/cli-args.service.ts";
 import { LegacyExperimentalFlag } from "../../shared/legacy/global-flags.ts";
 import {
   LegacyExperimentalRequiredError,
@@ -8,7 +9,8 @@ import {
 } from "./legacy-experimental-gate.ts";
 
 const ENV = "SUPABASE_EXPERIMENTAL";
-const withFlag = (value: boolean) => Layer.succeed(LegacyExperimentalFlag, value);
+const withFlag = (value: boolean, args: ReadonlyArray<string> = []) =>
+  Layer.mergeAll(Layer.succeed(LegacyExperimentalFlag, value), Layer.succeed(CliArgs, { args }));
 
 describe("legacyRequireExperimental", () => {
   it.effect("passes when --experimental is set", () =>
@@ -43,4 +45,23 @@ describe("legacyRequireExperimental", () => {
       expect(exit._tag).toBe("Success");
     }),
   );
+
+  it.effect(
+    "fails even with SUPABASE_EXPERIMENTAL=1 when --experimental=false is explicit (viper Changed wins)",
+    () =>
+      Effect.gen(function* () {
+        // viper's bound-pflag lookup returns the flag value whenever Changed is true —
+        // BEFORE falling back to AutomaticEnv (viper@v1.21.0/viper.go:1176-1178) — so an
+        // explicit --experimental=false must win over SUPABASE_EXPERIMENTAL=1.
+        const saved = process.env[ENV];
+        process.env[ENV] = "1";
+        const error = yield* legacyRequireExperimental.pipe(
+          Effect.provide(withFlag(false, ["--experimental=false"])),
+          Effect.flip,
+        );
+        if (saved === undefined) delete process.env[ENV];
+        else process.env[ENV] = saved;
+        expect(error).toBeInstanceOf(LegacyExperimentalRequiredError);
+      }),
+  );
 });
diff --git a/apps/cli/src/legacy/shared/legacy-go-duration.ts b/apps/cli/src/legacy/shared/legacy-go-duration.ts
new file mode 100644
index 0000000000..8fbee02b37
--- /dev/null
+++ b/apps/cli/src/legacy/shared/legacy-go-duration.ts
@@ -0,0 +1,211 @@
+/**
+ * Go `time.Duration` string parsing and formatting, ported from Go's
+ * `src/time/time.go` `time.ParseDuration()` and `Duration.String()`.
+ *
+ * Several `config.toml` fields decode in `@supabase/config` as the raw
+ * duration STRING (e.g. `auth.sessions.timebox = "1h"`,
+ * `auth.sms.max_frequency = "5s"`) rather than Go's parsed `time.Duration`
+ * (nanoseconds as `int64`). Go itself re-serializes the PARSED value with
+ * `fmt.Sprintf("%v", duration)` when building a container's env (e.g.
+ * `GOTRUE_SESSIONS_TIMEBOX`, `GOTRUE_SMS_MAX_FREQUENCY` in
+ * `apps/cli-go/internal/start/start.go`'s `buildGotrueEnv`), which normalizes
+ * the string to Go's canonical form — `"1h"` becomes `"1h0m0s"`,
+ * `"90s"` becomes `"1m30s"` — so callers needing byte-exact parity must
+ * round-trip through both functions below, not just pass the configured
+ * string through unchanged.
+ */
+
+const NS_PER_SECOND = 1_000_000_000;
+const NS_PER_MINUTE = 60 * NS_PER_SECOND;
+const NS_PER_HOUR = 60 * NS_PER_MINUTE;
+const NS_PER_MS = 1_000_000;
+const NS_PER_US = 1_000;
+
+// `legacyParseGoDuration`'s own accumulator needs exact integer arithmetic near Go's `int64`
+// nanosecond ceiling (~9.223e18) — that magnitude is already ~1000x past `Number.MAX_SAFE_INTEGER`
+// (2^53 ≈ 9.007e15), so a plain `number` accumulator (as used by `legacyFormatGoDuration` below,
+// which never approaches this magnitude for real durations) silently rounds to the nearest
+// representable float64, which can flip a legitimate boundary value into a false overflow or vice
+// versa. `BigInt` constants, distinct from the `NS_PER_*` `number`s above, exist only for this.
+const NS_PER_SECOND_BIG = 1_000_000_000n;
+const NS_PER_MINUTE_BIG = 60n * NS_PER_SECOND_BIG;
+const NS_PER_HOUR_BIG = 60n * NS_PER_MINUTE_BIG;
+const NS_PER_MS_BIG = 1_000_000n;
+const NS_PER_US_BIG = 1_000n;
+
+// Go's `time.Duration` ceiling (`math.MaxInt64` nanoseconds, ~292.47 years) — `time.ParseDuration`
+// rejects any value whose accumulated nanosecond count would exceed this. Go's real max parseable
+// duration is `2562047h47m16.854775807s`.
+const MAX_INT64_NS = 9223372036854775807n;
+
+/**
+ * Port of Go `time.ParseDuration`. Returns nanoseconds as a number. Accepts
+ * the same grammar Go does: a possibly-signed sequence of decimal numbers,
+ * each with a unit suffix (`"ns"`, `"us"`/`"µs"`, `"ms"`, `"s"`, `"m"`, `"h"`),
+ * e.g. `"5s"`, `"1h30m"`, `"300ms"`. Throws on invalid input, matching Go's
+ * own `errors.New("time: invalid duration ...")` failure mode — including
+ * overflowing `math.MaxInt64` nanoseconds and a fractional remainder that
+ * would truncate to a sub-nanosecond value.
+ *
+ * Accumulates internally in `BigInt`, not `number`: durations near Go's real
+ * max are already well past `Number.MAX_SAFE_INTEGER`, so a `number`
+ * accumulator can silently round a legitimate boundary value into a false
+ * overflow (or the reverse) well before the final overflow check ever runs.
+ * Only the RETURNED value converts to `number` (at the very end), which is
+ * lossy for a duration this close to the ceiling — an accepted, proportionate
+ * limit given every real config duration (seconds-hours) is nowhere near it,
+ * and the exactness that actually matters — whether an out-of-range override
+ * gets rejected like Go rejects it — no longer depends on `number` precision
+ * at all.
+ */
+export function legacyParseGoDuration(value: string): number {
+  const orig = value;
+  let s = value;
+  let neg = false;
+
+  if (s.startsWith("-") || s.startsWith("+")) {
+    neg = s.startsWith("-");
+    s = s.slice(1);
+  }
+  if (s === "0") return 0;
+  if (s.length === 0) throw new Error(`time: invalid duration "${orig}"`);
+
+  let total = 0n;
+  while (s.length > 0) {
+    // Go requires the next character to be `[0-9.]` before consuming a unit
+    // (`time.ParseDuration`'s `if !(s[0] == '.' || '0' <= s[0] && s[0] <= '9')`
+    // guard) — without this check, a bare unit like `"s"` or `"m"` would read
+    // zero digits, skip the "missing unit" guard below (since `s` is still
+    // non-empty), and silently match the unit anyway.
+    if (!(s.charAt(0) === "." || (s.charAt(0) >= "0" && s.charAt(0) <= "9"))) {
+      throw new Error(`time: invalid duration "${orig}"`);
+    }
+    let n = 0n;
+    let frac = 0n;
+    let post = 1n;
+    let i = 0;
+    while (i < s.length && s.charAt(i) >= "0" && s.charAt(i) <= "9") {
+      n = n * 10n + BigInt(s.charAt(i));
+      i++;
+    }
+    const hasIntDigits = i > 0;
+    let hasFracDigits = false;
+    if (i < s.length && s.charAt(i) === ".") {
+      i++;
+      const fracStart = i;
+      while (i < s.length && s.charAt(i) >= "0" && s.charAt(i) <= "9") {
+        frac = frac * 10n + BigInt(s.charAt(i));
+        post *= 10n;
+        i++;
+      }
+      hasFracDigits = i > fracStart;
+    }
+    // Go's `pre`/`post` guard: a lone `.` with no digits on either side
+    // (`".s"`, `"."`, `"-."`) is invalid — the leading `[0-9.]` check above lets
+    // `.` through (it's the first character of a valid fraction like `".5s"`),
+    // but a `.` that consumes zero digits before AND after it must still fail.
+    if (!hasIntDigits && !hasFracDigits) {
+      throw new Error(`time: invalid duration "${orig}"`);
+    }
+    s = s.slice(i);
+    if (s.length === 0) throw new Error(`time: missing unit in duration "${orig}"`);
+
+    let unitNs: bigint;
+    if (s.startsWith("ns")) {
+      unitNs = 1n;
+      s = s.slice(2);
+    } else if (s.startsWith("us") || s.startsWith("µs")) {
+      unitNs = NS_PER_US_BIG;
+      s = s.slice(2);
+    } else if (s.startsWith("ms")) {
+      unitNs = NS_PER_MS_BIG;
+      s = s.slice(2);
+    } else if (s.startsWith("s")) {
+      unitNs = NS_PER_SECOND_BIG;
+      s = s.slice(1);
+    } else if (s.startsWith("m")) {
+      unitNs = NS_PER_MINUTE_BIG;
+      s = s.slice(1);
+    } else if (s.startsWith("h")) {
+      unitNs = NS_PER_HOUR_BIG;
+      s = s.slice(1);
+    } else {
+      throw new Error(`time: unknown unit in duration "${orig}"`);
+    }
+
+    // Go converts the fractional remainder via `uint64(float64(f) * (float64(unit)/scale))` —
+    // a float64->uint64 conversion, which truncates toward zero, not rounds: `"0.5ns"` becomes
+    // `0`, not `1`. `BigInt` division truncates toward zero unconditionally, so
+    // `(frac * unitNs) / post` matches that exactly, without any intermediate float64 rounding.
+    total += n * unitNs + (frac * unitNs) / post;
+    if (total > MAX_INT64_NS) {
+      throw new Error(`time: invalid duration "${orig}"`);
+    }
+  }
+
+  return Number(neg ? -total : total);
+}
+
+/**
+ * Port of Go `Duration.String()`. `0` formats as `"0s"`; otherwise only the
+ * units needed to represent the value are shown, with minutes/seconds always
+ * trailing an hours component (`"1h0m0s"`), and a sub-second remainder
+ * formatted as a fraction of its largest applicable unit (`"1.5s"`,
+ * `"300ms"`).
+ */
+export function legacyFormatGoDuration(nanoseconds: number): string {
+  if (nanoseconds === 0) return "0s";
+
+  let ns = nanoseconds;
+  const neg = ns < 0;
+  if (neg) ns = -ns;
+
+  const hours = Math.floor(ns / NS_PER_HOUR);
+  ns -= hours * NS_PER_HOUR;
+  const minutes = Math.floor(ns / NS_PER_MINUTE);
+  ns -= minutes * NS_PER_MINUTE;
+  const secs = Math.floor(ns / NS_PER_SECOND);
+  ns -= secs * NS_PER_SECOND;
+  const ms = Math.floor(ns / NS_PER_MS);
+  ns -= ms * NS_PER_MS;
+  const us = Math.floor(ns / NS_PER_US);
+  ns -= us * NS_PER_US;
+
+  const sign = neg ? "-" : "";
+
+  if (hours > 0 || minutes > 0) {
+    const secsStr =
+      ms > 0 || us > 0 || ns > 0
+        ? formatFraction(secs * NS_PER_SECOND + ms * NS_PER_MS + us * NS_PER_US + ns, NS_PER_SECOND)
+        : `${secs}`;
+    if (hours > 0) return `${sign}${hours}h${minutes}m${secsStr}s`;
+    return `${sign}${minutes}m${secsStr}s`;
+  }
+  if (secs > 0) {
+    if (ms > 0 || us > 0 || ns > 0) {
+      const totalNs = secs * NS_PER_SECOND + ms * NS_PER_MS + us * NS_PER_US + ns;
+      return `${sign}${formatFraction(totalNs, NS_PER_SECOND)}s`;
+    }
+    return `${sign}${secs}s`;
+  }
+  if (ms > 0) {
+    if (us > 0 || ns > 0) {
+      const totalNs = ms * NS_PER_MS + us * NS_PER_US + ns;
+      return `${sign}${formatFraction(totalNs, NS_PER_MS)}ms`;
+    }
+    return `${sign}${ms}ms`;
+  }
+  if (us > 0) {
+    if (ns > 0) {
+      const totalNs = us * NS_PER_US + ns;
+      return `${sign}${formatFraction(totalNs, NS_PER_US)}µs`;
+    }
+    return `${sign}${us}µs`;
+  }
+  return `${sign}${ns}ns`;
+}
+
+/** Formats `totalNs / unitNs` with trailing zeros (and a trailing `.`) trimmed, matching Go's `fmtFrac`. */
+function formatFraction(totalNs: number, unitNs: number): string {
+  return (totalNs / unitNs).toFixed(9).replace(/0+$/, "").replace(/\.$/, "");
+}
diff --git a/apps/cli/src/legacy/shared/legacy-go-duration.unit.test.ts b/apps/cli/src/legacy/shared/legacy-go-duration.unit.test.ts
new file mode 100644
index 0000000000..551f5518ad
--- /dev/null
+++ b/apps/cli/src/legacy/shared/legacy-go-duration.unit.test.ts
@@ -0,0 +1,145 @@
+import { describe, expect, it } from "vitest";
+
+import { legacyFormatGoDuration, legacyParseGoDuration } from "./legacy-go-duration.ts";
+
+describe("legacyParseGoDuration", () => {
+  it("parses a single unit", () => {
+    expect(legacyParseGoDuration("5s")).toBe(5_000_000_000);
+    expect(legacyParseGoDuration("300ms")).toBe(300_000_000);
+    expect(legacyParseGoDuration("1h")).toBe(3_600_000_000_000);
+  });
+
+  it("parses multiple units concatenated", () => {
+    expect(legacyParseGoDuration("1h30m")).toBe(5_400_000_000_000);
+  });
+
+  it("parses a fractional value", () => {
+    expect(legacyParseGoDuration("1.5s")).toBe(1_500_000_000);
+  });
+
+  it("parses a signed value", () => {
+    expect(legacyParseGoDuration("-5s")).toBe(-5_000_000_000);
+    expect(legacyParseGoDuration("+5s")).toBe(5_000_000_000);
+  });
+
+  it('treats a bare "0" as zero regardless of sign', () => {
+    expect(legacyParseGoDuration("0")).toBe(0);
+  });
+
+  it("rejects an empty string", () => {
+    expect(() => legacyParseGoDuration("")).toThrow('time: invalid duration ""');
+  });
+
+  // Task 1: a unit with no preceding digit ("s", "m", ...) used to read zero
+  // digits, skip the "missing unit" guard (since `s` was still non-empty),
+  // and silently match the unit anyway — returning 0 instead of erroring like
+  // Go's real `time.ParseDuration`.
+  it.each(["s", "m", "h", "ms", "us", "µs", "ns"])(
+    'rejects a bare unit with no preceding digit ("%s")',
+    (input) => {
+      expect(() => legacyParseGoDuration(input)).toThrow(`time: invalid duration "${input}"`);
+    },
+  );
+
+  it('rejects a bare unit following a valid unit ("1hs")', () => {
+    expect(() => legacyParseGoDuration("1hs")).toThrow('time: invalid duration "1hs"');
+  });
+
+  it('rejects a negative bare unit ("-s")', () => {
+    expect(() => legacyParseGoDuration("-s")).toThrow('time: invalid duration "-s"');
+  });
+
+  // Go's `pre`/`post` guard: a lone "." with no digits on either side is
+  // still invalid, even though "." alone passes the leading `[0-9.]` check
+  // (it's the first character of a valid fraction like ".5s").
+  it.each([".s", ".", "-.", "+.", ".h"])('rejects a lone "." with no digits ("%s")', (input) => {
+    expect(() => legacyParseGoDuration(input)).toThrow(`time: invalid duration "${input}"`);
+  });
+
+  it('accepts a fraction-only value with no leading digit (".5s")', () => {
+    expect(legacyParseGoDuration(".5s")).toBe(500_000_000);
+  });
+
+  it("rejects a number with no unit", () => {
+    expect(() => legacyParseGoDuration("5")).toThrow('time: missing unit in duration "5"');
+  });
+
+  it("rejects an unknown unit", () => {
+    expect(() => legacyParseGoDuration("5x")).toThrow('time: unknown unit in duration "5x"');
+  });
+
+  // Go converts the fractional remainder via a float64->uint64 conversion,
+  // which truncates toward zero rather than rounding — `"0.5ns"` must become
+  // `0`, not `1`.
+  it('truncates a sub-nanosecond fraction instead of rounding ("0.5ns")', () => {
+    expect(legacyParseGoDuration("0.5ns")).toBe(0);
+  });
+
+  it('truncates a sub-nanosecond fraction instead of rounding ("1.9ns")', () => {
+    expect(legacyParseGoDuration("1.9ns")).toBe(1);
+  });
+
+  // Go's `time.Duration` is bounded by `math.MaxInt64` nanoseconds
+  // (~292.47 years); `time.ParseDuration` rejects any value whose
+  // accumulated nanosecond count would exceed it.
+  it('rejects a duration that overflows math.MaxInt64 nanoseconds ("2562048h")', () => {
+    expect(() => legacyParseGoDuration("2562048h")).toThrow('time: invalid duration "2562048h"');
+  });
+
+  it("accepts Go's actual maximum parseable duration without overflowing", () => {
+    expect(() => legacyParseGoDuration("2562047h47m16.854775807s")).not.toThrow();
+  });
+
+  // Regression test: an earlier fix's overflow bound was `Number(9223372036854775807n)`,
+  // which rounds UP to `9223372036854776000` — 193 past the true `math.MaxInt64`. That let
+  // this exact value (`2^63`, one nanosecond past Go's true ceiling) silently pass instead of
+  // being rejected like Go's real `time.ParseDuration` rejects it.
+  it('rejects a duration exactly 1ns past Go\'s true math.MaxInt64 ceiling ("9223372036854775808ns")', () => {
+    expect(() => legacyParseGoDuration("9223372036854775808ns")).toThrow(
+      'time: invalid duration "9223372036854775808ns"',
+    );
+  });
+
+  it("accepts a duration exactly at Go's true math.MaxInt64 ceiling in nanoseconds", () => {
+    expect(() => legacyParseGoDuration("9223372036854775807ns")).not.toThrow();
+  });
+});
+
+describe("legacyFormatGoDuration", () => {
+  it('formats zero as "0s"', () => {
+    expect(legacyFormatGoDuration(0)).toBe("0s");
+  });
+
+  it("formats whole hours/minutes/seconds", () => {
+    expect(legacyFormatGoDuration(3_600_000_000_000)).toBe("1h0m0s");
+  });
+
+  it("normalizes 90s to 1m30s", () => {
+    expect(legacyFormatGoDuration(90_000_000_000)).toBe("1m30s");
+  });
+
+  it("formats a sub-second fraction", () => {
+    expect(legacyFormatGoDuration(1_500_000_000)).toBe("1.5s");
+  });
+
+  it("round-trips through legacyParseGoDuration", () => {
+    expect(legacyFormatGoDuration(legacyParseGoDuration("1h"))).toBe("1h0m0s");
+    expect(legacyFormatGoDuration(legacyParseGoDuration("90s"))).toBe("1m30s");
+  });
+
+  // A sub-second remainder must still be included when minutes/hours are
+  // present, matching Go's `Duration.String()`, which computes the
+  // fractional-seconds string from the FULL nanosecond count before peeling
+  // off minutes/hours — not just when seconds is the only component.
+  it("includes a sub-second fraction alongside minutes", () => {
+    expect(legacyFormatGoDuration(legacyParseGoDuration("1m0.5s"))).toBe("1m0.5s");
+  });
+
+  it("includes a sub-second fraction alongside hours", () => {
+    expect(legacyFormatGoDuration(legacyParseGoDuration("1h0.5s"))).toBe("1h0m0.5s");
+  });
+
+  it("includes a sub-second fraction alongside hours and minutes", () => {
+    expect(legacyFormatGoDuration(legacyParseGoDuration("1h1m0.5s"))).toBe("1h1m0.5s");
+  });
+});
diff --git a/apps/cli/src/legacy/shared/legacy-go-jwt.ts b/apps/cli/src/legacy/shared/legacy-go-jwt.ts
new file mode 100644
index 0000000000..96d68e640a
--- /dev/null
+++ b/apps/cli/src/legacy/shared/legacy-go-jwt.ts
@@ -0,0 +1,232 @@
+import { createHmac, createPrivateKey, createSign } from "node:crypto";
+
+/**
+ * RFC 7517 JWK fields Go's `JWK` struct round-trips (`pkg/config/auth.go:88-108`,
+ * `toml`/`json` tags `kty`, `kid`, `use`, `key_ops`, `alg`, `ext`, `n`, `e`, `d`, `p`, `q`, `dp`,
+ * `dq`, `qi`, `crv`, `x`, `y`) — field names match exactly, so a signing-keys file can be parsed
+ * straight into this shape (Go decodes `auth.signing_keys_path` directly into `[]JWK`,
+ * `pkg/config/config.go:1113`, so `use`/`key_ops`/`ext` on a user's key file must round-trip into
+ * both `GOTRUE_JWT_KEYS` and the published JWKS just like every other field here). A superset of
+ * Node's own `crypto.webcrypto.JsonWebKey` (which omits `kid`), so it's still assignable wherever
+ * that type is expected (e.g. `createPrivateKey`'s `format: "jwk"` input) — `key_ops` is typed as
+ * a mutable `string[]` rather than `ReadonlyArray<string>` for exactly this reason: Node's own
+ * `JsonWebKey.key_ops` field is a plain `string[]`, and a `ReadonlyArray` isn't assignable to it.
+ */
+export interface LegacyJwk {
+  readonly kty: string;
+  readonly kid?: string;
+  readonly use?: string;
+  readonly key_ops?: string[];
+  readonly alg?: string;
+  readonly ext?: boolean;
+  readonly n?: string;
+  readonly e?: string;
+  readonly d?: string;
+  readonly p?: string;
+  readonly q?: string;
+  readonly dp?: string;
+  readonly dq?: string;
+  readonly qi?: string;
+  readonly crv?: string;
+  readonly x?: string;
+  readonly y?: string;
+}
+
+/**
+ * Go's `NewConfig()` default `Auth.SigningKeys` (`apps/cli-go/pkg/config/config.go:504-515`) —
+ * a single ES256 key, unconditionally present on every resolved config UNLESS overwritten by a
+ * real `auth.signing_keys_path` file (and only then when `auth.enabled` — see
+ * `config.go:1087,1110-1116`). Go's `ResolveJWKS` iterates `a.SigningKeys` regardless of
+ * `auth.enabled`, so this default key is always part of the published JWKS unless a configured
+ * file overrides it — callers must not skip it just because auth happens to be disabled or no
+ * `signing_keys_path` is set. Shared by GoTrue's own env building (`services/gotrue.service.ts`,
+ * which signs tokens with it) and JWKS resolution (`legacyResolveLocalJwks`, which must publish
+ * its public form) so the two can never disagree on the default key.
+ *
+ * Typed as `LegacyJwk` directly — see that type's own doc comment for why `key_ops` is a mutable
+ * `string[]` rather than `ReadonlyArray<string>`, which is also why this is still structurally
+ * assignable everywhere a `JwkLike` (`shared/auth/jwks.ts`) is expected.
+ */
+export const LEGACY_DEFAULT_SIGNING_KEY: LegacyJwk = {
+  kty: "EC",
+  kid: "b81269f1-21d8-4f2e-b719-c2240a840d90",
+  use: "sig",
+  key_ops: ["sign", "verify"],
+  alg: "ES256",
+  ext: true,
+  crv: "P-256",
+  x: "M5Sjqn5zwC9Kl1zVfUUGvv9boQjCGd45G8sdopBExB4",
+  y: "P6IXMvA2WYXSHSOMTBH2jsw_9rrzGy89FjPf6oOsIxQ",
+  d: "dIhR8wywJlqlua4y_yMq2SLhlFXDZJBCvFrY1DCHyVU",
+};
+
+/**
+ * Go-byte-exact HS256 signer for the default local-dev `anon`/`service_role`
+ * keys, ported from `CustomClaims`/`generateJWT` (`apps/cli-go/pkg/config/apikeys.go:23-40,75-86`).
+ * {@link legacyGenerateAsymmetricGoJwt} below covers the RS256/ES256 branch of
+ * the same Go function, taken when `auth.signing_keys_path` is configured.
+ *
+ * This intentionally does NOT reuse `@supabase/stack`'s `generateJwt`
+ * (`packages/stack/src/JwtGenerator.ts`) — that helper uses `iss:"supabase"`,
+ * a dynamic `iat`/10-year `exp`, and a different claim order, none of which
+ * byte-match what Go prints for `supabase status`. Go's claims, in
+ * declaration order (the outer `CustomClaims.Issuer` field shadows the
+ * embedded `jwt.RegisteredClaims.Issuer`, so only one `iss` key is emitted):
+ *
+ *   iss (fixed "supabase-demo"), ref (omitempty), role, is_anonymous (omitempty),
+ *   then the remaining `jwt.RegisteredClaims` fields (sub, aud, exp, nbf, iat, jti),
+ *   all `omitempty` except `exp`, which Go always sets to the fixed
+ *   `defaultJwtExpiry = 1983812996` unix timestamp (never computed from "now").
+ *
+ * `status` never sets `ref`/`is_anonymous`, so for this signer's two roles the
+ * payload always serializes to exactly `{"iss":...,"role":...,"exp":...}`.
+ */
+
+const GO_JWT_ISSUER = "supabase-demo";
+const GO_JWT_FIXED_EXP = 1983812996;
+
+function base64UrlEncode(input: string): string {
+  return Buffer.from(input).toString("base64url");
+}
+
+export function legacyGenerateGoJwt(secret: string, role: "anon" | "service_role"): string {
+  const header = base64UrlEncode(JSON.stringify({ alg: "HS256", typ: "JWT" }));
+  const payload = base64UrlEncode(
+    JSON.stringify({ iss: GO_JWT_ISSUER, role, exp: GO_JWT_FIXED_EXP }),
+  );
+  const data = `${header}.${payload}`;
+  const signature = createHmac("sha256", secret).update(data).digest("base64url");
+  return `${data}.${signature}`;
+}
+
+/** Go's asymmetric-JWT expiry: `time.Now().Add(time.Hour * 24 * 365 * 10)` (10 years). */
+const GO_JWT_ASYMMETRIC_EXPIRY_SECONDS = 60 * 60 * 24 * 365 * 10;
+
+function base64UrlToBigInt(value: string): bigint {
+  const hex = Buffer.from(value, "base64url").toString("hex");
+  return hex.length === 0 ? 0n : BigInt(`0x${hex}`);
+}
+
+function bigIntToBase64Url(value: bigint): string {
+  let hex = value.toString(16);
+  if (hex.length % 2 === 1) hex = `0${hex}`;
+  return Buffer.from(hex, "hex").toString("base64url");
+}
+
+/** Modular inverse of `a` mod `m` via the extended Euclidean algorithm (`a`/`m` coprime, as `q`/`p` always are for a valid RSA key). */
+function modInverse(a: bigint, m: bigint): bigint {
+  let [oldR, r] = [a, m];
+  let [oldS, s] = [1n, 0n];
+  while (r !== 0n) {
+    const quotient = oldR / r;
+    [oldR, r] = [r, oldR - quotient * r];
+    [oldS, s] = [s, oldS - quotient * s];
+  }
+  return ((oldS % m) + m) % m;
+}
+
+/**
+ * Backfills the RSA CRT parameters (`dp`, `dq`, `qi`) Go's `jwkToRSAPrivateKey`
+ * (`apps/cli-go/pkg/config/apikeys.go:132-168`) never reads — it constructs
+ * `rsa.PrivateKey{N, E, D, Primes: [p, q]}` from `n`/`e`/`d`/`p`/`q` alone, and
+ * Go's stdlib `crypto/rsa` (`SignPKCS1v15` -> `precompute()`) lazily derives
+ * `Dp`/`Dq`/`Qinv` from `p`/`q`/`d` itself when they're absent, so a JWK
+ * missing them still signs successfully in Go. Node's
+ * `createPrivateKey({ format: "jwk" })` has no such fallback — it hard-rejects
+ * an RSA JWK without `dp`/`dq`/`qi` (`The "key.dp" property must be of type
+ * string`) — so this reproduces Go's derivation before handing the key to
+ * Node: `dp = d mod (p-1)`, `dq = d mod (q-1)`, `qi = q^-1 mod p` (RFC 7517
+ * section 6.3.2 / RFC 3447 section 3.2). A key that already has all three (the common case
+ * for a Node/openssl-generated JWK) is returned unchanged; one missing
+ * `d`/`p`/`q` themselves is also returned unchanged — that's a genuinely
+ * invalid key in Go too, and `createPrivateKey` will raise its own error.
+ */
+function ensureRsaCrtParams(jwk: LegacyJwk): LegacyJwk {
+  if (jwk.dp !== undefined && jwk.dq !== undefined && jwk.qi !== undefined) {
+    return jwk;
+  }
+  if (jwk.d === undefined || jwk.p === undefined || jwk.q === undefined) {
+    return jwk;
+  }
+  const d = base64UrlToBigInt(jwk.d);
+  const p = base64UrlToBigInt(jwk.p);
+  const q = base64UrlToBigInt(jwk.q);
+  return {
+    ...jwk,
+    dp: bigIntToBase64Url(d % (p - 1n)),
+    dq: bigIntToBase64Url(d % (q - 1n)),
+    qi: bigIntToBase64Url(modInverse(q, p)),
+  };
+}
+
+/**
+ * Go's `GenerateAsymmetricJWT` (`pkg/config/apikeys.go:88-113`), reached from
+ * `generateJWT` only when `auth.signing_keys_path` resolves to a non-empty JWK
+ * array (`pkg/config/apikeys.go:76-80`) — the first key in the file signs both
+ * the anon and service_role tokens. Same claim shape as {@link legacyGenerateGoJwt}
+ * (`iss`/`role`/`exp`), except the expiry is 10 years from now rather than Go's
+ * fixed HMAC-path timestamp, since `generateJWT` sets `claims.ExpiresAt`
+ * explicitly before calling this function instead of falling through to
+ * `CustomClaims.NewToken()`'s fixed default.
+ *
+ * Only `RS256`/`ES256` are supported, matching Go's `jwkToPrivateKey`
+ * (RSA/EC key types) + this function's own switch on `jwk.alg`. `kty`/`alg`
+ * are cross-validated (RS256 requires `kty: "RSA"`, ES256 requires
+ * `kty: "EC"` and `crv: "P-256"`) — matching Go's `jwkToRSAPrivateKey` /
+ * `jwkToECDSAPrivateKey`, which reject any other combination rather than
+ * signing with a mismatched key or curve (Node's `createPrivateKey`/`createSign`
+ * do not themselves catch this: an EC key signed as RS256, or a non-P-256
+ * curve signed as ES256, both "succeed" and produce a spec-invalid token that
+ * silently fails verification instead of raising an error). The header key
+ * order (`alg`, `kid`, `typ`) matches Go's `encoding/json` alphabetically
+ * sorting `map[string]interface{}` keys — `kid` is only present when set on
+ * the JWK, matching Go's `if len(jwk.KeyID) > 0` guard.
+ *
+ * `dsaEncoding: "ieee-p1363"` is required for ES256: Node's default ECDSA
+ * signature output is DER-encoded, which is not the raw (r‖s) format JWS
+ * requires — verified by round-tripping through `jose`'s `jwtVerify`.
+ */
+export function legacyGenerateAsymmetricGoJwt(
+  jwk: LegacyJwk,
+  role: "anon" | "service_role",
+): string {
+  const algorithm = jwk.alg;
+  if (algorithm !== "RS256" && algorithm !== "ES256") {
+    throw new Error(`unsupported algorithm: ${algorithm ?? ""}`);
+  }
+  if (algorithm === "RS256" && jwk.kty !== "RSA") {
+    throw new Error(`unsupported key type: ${jwk.kty}`);
+  }
+  if (algorithm === "ES256") {
+    if (jwk.kty !== "EC") {
+      throw new Error(`unsupported key type: ${jwk.kty}`);
+    }
+    if (jwk.crv !== "P-256") {
+      throw new Error(`unsupported curve: ${jwk.crv ?? ""}`);
+    }
+  }
+  const header =
+    jwk.kid !== undefined && jwk.kid.length > 0
+      ? { alg: algorithm, kid: jwk.kid, typ: "JWT" }
+      : { alg: algorithm, typ: "JWT" };
+  const expiresAt = Math.floor(Date.now() / 1000) + GO_JWT_ASYMMETRIC_EXPIRY_SECONDS;
+  const headerEncoded = base64UrlEncode(JSON.stringify(header));
+  const payloadEncoded = base64UrlEncode(
+    JSON.stringify({ iss: GO_JWT_ISSUER, role, exp: expiresAt }),
+  );
+  const data = `${headerEncoded}.${payloadEncoded}`;
+
+  const privateKey = createPrivateKey({
+    key: algorithm === "RS256" ? ensureRsaCrtParams(jwk) : jwk,
+    format: "jwk",
+  });
+  const signature =
+    algorithm === "RS256"
+      ? createSign("RSA-SHA256").update(data).end().sign(privateKey)
+      : createSign("sha256")
+          .update(data)
+          .end()
+          .sign({ key: privateKey, dsaEncoding: "ieee-p1363" });
+
+  return `${data}.${signature.toString("base64url")}`;
+}
diff --git a/apps/cli/src/legacy/shared/legacy-go-jwt.unit.test.ts b/apps/cli/src/legacy/shared/legacy-go-jwt.unit.test.ts
new file mode 100644
index 0000000000..5bfeabfe70
--- /dev/null
+++ b/apps/cli/src/legacy/shared/legacy-go-jwt.unit.test.ts
@@ -0,0 +1,179 @@
+import { createHmac, generateKeyPairSync } from "node:crypto";
+import { importJWK, jwtVerify } from "jose";
+import { describe, expect, it } from "vitest";
+
+import {
+  legacyGenerateAsymmetricGoJwt,
+  legacyGenerateGoJwt,
+  type LegacyJwk,
+} from "./legacy-go-jwt.ts";
+
+const SECRET = "super-secret-jwt-token-with-at-least-32-characters-long";
+
+function generateRsaJwk(kid?: string): LegacyJwk {
+  const { privateKey } = generateKeyPairSync("rsa", { modulusLength: 2048 });
+  const jwk = privateKey.export({ format: "jwk" });
+  return { ...jwk, kty: "RSA", alg: "RS256", kid };
+}
+
+function generateEcJwk(kid?: string): LegacyJwk {
+  const { privateKey } = generateKeyPairSync("ec", { namedCurve: "P-256" });
+  const jwk = privateKey.export({ format: "jwk" });
+  return { ...jwk, kty: "EC", alg: "ES256", kid };
+}
+
+function publicJwkOf(jwk: LegacyJwk): LegacyJwk {
+  const { d: _d, p: _p, q: _q, dp: _dp, dq: _dq, qi: _qi, ...publicJwk } = jwk;
+  return publicJwk;
+}
+
+function decodeSegment(segment: string): string {
+  return Buffer.from(segment, "base64url").toString("utf8");
+}
+
+describe("legacyGenerateGoJwt", () => {
+  it("emits Go's exact JWT header (no extra fields, alg before typ)", () => {
+    const token = legacyGenerateGoJwt(SECRET, "anon");
+    const [header] = token.split(".");
+    expect(header).toBeDefined();
+    // Go's jwt.NewWithClaims builds Header as map[string]any{"typ":..,"alg":..};
+    // encoding/json marshals map keys in sorted order, so "alg" sorts before "typ".
+    expect(decodeSegment(header ?? "")).toBe('{"alg":"HS256","typ":"JWT"}');
+  });
+
+  it("emits the anon payload with Go's exact key order and fixed claims", () => {
+    const token = legacyGenerateGoJwt(SECRET, "anon");
+    const [, payload] = token.split(".");
+    expect(payload).toBeDefined();
+    const raw = decodeSegment(payload ?? "");
+    // Byte-exact key order: iss, role, exp — ref/is_anonymous/iat are omitted
+    // entirely (Go's `omitempty`), matching status's no-ref, non-anonymous use.
+    expect(raw).toBe('{"iss":"supabase-demo","role":"anon","exp":1983812996}');
+
+    const parsed = JSON.parse(raw) as Record<string, unknown>;
+    expect(parsed).toEqual({ iss: "supabase-demo", role: "anon", exp: 1983812996 });
+    expect(Object.keys(parsed)).not.toContain("iat");
+    expect(Object.keys(parsed)).not.toContain("ref");
+    expect(Object.keys(parsed)).not.toContain("is_anonymous");
+  });
+
+  it("emits the service_role payload with Go's exact key order and fixed claims", () => {
+    const token = legacyGenerateGoJwt(SECRET, "service_role");
+    const [, payload] = token.split(".");
+    const raw = decodeSegment(payload ?? "");
+    expect(raw).toBe('{"iss":"supabase-demo","role":"service_role","exp":1983812996}');
+  });
+
+  it("signs with plain HMAC-SHA256 over the base64url header.payload, base64url-encoded", () => {
+    const token = legacyGenerateGoJwt(SECRET, "anon");
+    const [header, payload, signature] = token.split(".");
+    const expectedSignature = createHmac("sha256", SECRET)
+      .update(`${header}.${payload}`)
+      .digest("base64url");
+    expect(signature).toBe(expectedSignature);
+  });
+
+  it("is deterministic across calls (no timestamp derived from Date.now())", () => {
+    const first = legacyGenerateGoJwt(SECRET, "anon");
+    const second = legacyGenerateGoJwt(SECRET, "anon");
+    expect(first).toBe(second);
+  });
+
+  it("produces different tokens for different secrets", () => {
+    const a = legacyGenerateGoJwt(SECRET, "anon");
+    const b = legacyGenerateGoJwt("a-different-secret-value-1234567", "anon");
+    expect(a).not.toBe(b);
+  });
+});
+
+describe("legacyGenerateAsymmetricGoJwt", () => {
+  it("signs and verifies an RS256 token from an RSA JWK", async () => {
+    const jwk = generateRsaJwk("rsa-kid");
+    const token = legacyGenerateAsymmetricGoJwt(jwk, "anon");
+    const publicKey = await importJWK(publicJwkOf(jwk), "RS256");
+    const { payload, protectedHeader } = await jwtVerify(token, publicKey);
+    expect(payload).toMatchObject({ iss: "supabase-demo", role: "anon" });
+    expect(protectedHeader).toEqual({ alg: "RS256", kid: "rsa-kid", typ: "JWT" });
+  });
+
+  it("signs an RS256 token from an RSA JWK missing CRT exponents (dp/dq/qi), matching Go", async () => {
+    // Go's `jwkToRSAPrivateKey` (`apps/cli-go/pkg/config/apikeys.go:132-168`)
+    // never reads `dp`/`dq`/`qi` — it builds the key from `n`/`e`/`d`/`p`/`q`
+    // alone, and Go's stdlib derives the CRT params itself when absent. A
+    // hand-authored signing-keys file that omits them (common — RFC 7517 marks
+    // them optional) must still sign successfully here.
+    const jwk = generateRsaJwk("rsa-kid");
+    const { dp: _dp, dq: _dq, qi: _qi, ...jwkWithoutCrtParams } = jwk;
+    const token = legacyGenerateAsymmetricGoJwt(jwkWithoutCrtParams, "anon");
+    const publicKey = await importJWK(publicJwkOf(jwk), "RS256");
+    const { payload, protectedHeader } = await jwtVerify(token, publicKey);
+    expect(payload).toMatchObject({ iss: "supabase-demo", role: "anon" });
+    expect(protectedHeader).toEqual({ alg: "RS256", kid: "rsa-kid", typ: "JWT" });
+  });
+
+  it("signs and verifies an ES256 token from an EC JWK", async () => {
+    const jwk = generateEcJwk("ec-kid");
+    const token = legacyGenerateAsymmetricGoJwt(jwk, "service_role");
+    const publicKey = await importJWK(publicJwkOf(jwk), "ES256");
+    const { payload, protectedHeader } = await jwtVerify(token, publicKey);
+    expect(payload).toMatchObject({ iss: "supabase-demo", role: "service_role" });
+    expect(protectedHeader).toEqual({ alg: "ES256", kid: "ec-kid", typ: "JWT" });
+  });
+
+  it("omits the kid header entirely when the JWK has no kid", () => {
+    const jwk = generateRsaJwk();
+    const token = legacyGenerateAsymmetricGoJwt(jwk, "anon");
+    const [header] = token.split(".");
+    const decoded = JSON.parse(Buffer.from(header ?? "", "base64url").toString());
+    expect(decoded).toEqual({ alg: "RS256", typ: "JWT" });
+  });
+
+  it("sets a ~10-year expiry computed from the current time, not a fixed timestamp", () => {
+    const jwk = generateRsaJwk();
+    const before = Math.floor(Date.now() / 1000);
+    const token = legacyGenerateAsymmetricGoJwt(jwk, "anon");
+    const [, payload] = token.split(".");
+    const decoded = JSON.parse(Buffer.from(payload ?? "", "base64url").toString());
+    const tenYearsSeconds = 60 * 60 * 24 * 365 * 10;
+    expect(decoded.exp).toBeGreaterThanOrEqual(before + tenYearsSeconds);
+    expect(decoded.exp).toBeLessThan(before + tenYearsSeconds + 10);
+  });
+
+  it("rejects an unsupported algorithm", () => {
+    const jwk = { ...generateRsaJwk(), alg: "RS512" };
+    expect(() => legacyGenerateAsymmetricGoJwt(jwk, "anon")).toThrow(
+      "unsupported algorithm: RS512",
+    );
+  });
+
+  it("rejects a JWK with no algorithm", () => {
+    const { alg: _alg, ...jwkWithoutAlg } = generateRsaJwk();
+    expect(() => legacyGenerateAsymmetricGoJwt(jwkWithoutAlg, "anon")).toThrow(
+      "unsupported algorithm: ",
+    );
+  });
+
+  it("rejects an EC key forged with alg: RS256 instead of signing garbage", () => {
+    const jwk = { ...generateEcJwk(), alg: "RS256" };
+    expect(() => legacyGenerateAsymmetricGoJwt(jwk, "anon")).toThrow("unsupported key type: EC");
+  });
+
+  it("rejects an RSA key forged with alg: ES256 instead of signing garbage", () => {
+    const jwk = { ...generateRsaJwk(), alg: "ES256" };
+    expect(() => legacyGenerateAsymmetricGoJwt(jwk, "anon")).toThrow("unsupported key type: RSA");
+  });
+
+  it("rejects an ES256 EC key whose curve is not P-256", () => {
+    const { privateKey } = generateKeyPairSync("ec", { namedCurve: "P-384" });
+    const jwk = { ...privateKey.export({ format: "jwk" }), kty: "EC", alg: "ES256" };
+    expect(() => legacyGenerateAsymmetricGoJwt(jwk, "anon")).toThrow("unsupported curve: P-384");
+  });
+
+  it("rejects an ES256 EC key with no curve at all", () => {
+    const jwk = generateEcJwk();
+    const { crv: _crv, ...jwkWithoutCurve } = jwk;
+    expect(() => legacyGenerateAsymmetricGoJwt(jwkWithoutCurve, "anon")).toThrow(
+      "unsupported curve: ",
+    );
+  });
+});
diff --git a/apps/cli/src/legacy/shared/legacy-hostname.ts b/apps/cli/src/legacy/shared/legacy-hostname.ts
index 087363c20b..d2c6d719cd 100644
--- a/apps/cli/src/legacy/shared/legacy-hostname.ts
+++ b/apps/cli/src/legacy/shared/legacy-hostname.ts
@@ -1,17 +1,128 @@
+import { createHash } from "node:crypto";
+import { readFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+
 const LOCAL_HOST = "127.0.0.1";
 
+/** Docker CLI's reserved "no context store entry" name (`docker/cli` `cli/command/cli.go`'s `DefaultContextName`). */
+const DEFAULT_CONTEXT_NAME = "default";
+
+/**
+ * Docker CLI's config directory: `$DOCKER_CONFIG` or `~/.docker`
+ * (`docker/cli` `cliconfig.Dir()`), read from here rather than
+ * `client.Client`'s own resolution since this module never spawns a real
+ * Docker client — it only needs the same two on-disk files that resolution
+ * reads.
+ */
+function dockerConfigDir(): string {
+  const override = process.env["DOCKER_CONFIG"];
+  return override !== undefined && override.length > 0 ? override : join(homedir(), ".docker");
+}
+
+/**
+ * Go's `cli.CurrentContext()` name resolution (`docker/cli`
+ * `cli/command/cli.go`'s `resolveContextName`): `DOCKER_CONTEXT` env, else the
+ * config file's `currentContext`, else `"default"`. Only reached when
+ * `DOCKER_HOST` is unset — `resolveContextName` itself forces `"default"`
+ * when `DOCKER_HOST`/`--host` is set, which {@link legacyGetHostname} below
+ * already handles as its own, earlier branch.
+ */
+function currentDockerContextName(): string {
+  const fromEnv = process.env["DOCKER_CONTEXT"];
+  if (fromEnv !== undefined && fromEnv.length > 0) {
+    return fromEnv;
+  }
+  try {
+    const config = JSON.parse(readFileSync(join(dockerConfigDir(), "config.json"), "utf8")) as {
+      currentContext?: unknown;
+    };
+    if (typeof config.currentContext === "string" && config.currentContext.length > 0) {
+      return config.currentContext;
+    }
+  } catch {
+    // Missing/malformed config.json → the default context, same as Go's own
+    // silent fallback when it can't load the config file here.
+  }
+  return DEFAULT_CONTEXT_NAME;
+}
+
+/**
+ * Reads a non-default context's daemon endpoint from Docker CLI's context
+ * store: `<configDir>/contexts/meta/<sha256hex(name)>/meta.json`'s
+ * `Endpoints.docker.Host` (`docker/cli` `cli/context/store/metadatastore.go`).
+ * The `"default"` context has no store entry (it's Go's synthetic
+ * always-available context, resolved without a client, see
+ * `cli.Initialize`), so it's never looked up here — matching the earlier
+ * `"default"` short-circuit in {@link currentDockerContextName}'s caller.
+ */
+function dockerContextEndpointHost(contextName: string): string | undefined {
+  if (contextName === DEFAULT_CONTEXT_NAME) {
+    return undefined;
+  }
+  try {
+    const contextId = createHash("sha256").update(contextName).digest("hex");
+    const metaPath = join(dockerConfigDir(), "contexts", "meta", contextId, "meta.json");
+    const meta = JSON.parse(readFileSync(metaPath, "utf8")) as {
+      readonly Endpoints?: { readonly docker?: { readonly Host?: unknown } };
+    };
+    const host = meta.Endpoints?.docker?.Host;
+    return typeof host === "string" && host.length > 0 ? host : undefined;
+  } catch {
+    // Missing/malformed context store entry → treat as unresolvable, same as
+    // Go silently falling back to the loopback default below.
+    return undefined;
+  }
+}
+
+/**
+ * Extracts the bare host from a `tcp://host:port` daemon endpoint, mirroring
+ * Go's `client.ParseHostURL` + `net.SplitHostPort` (`misc.go:307`). Returns
+ * `undefined` for a non-`tcp://` endpoint (e.g. `unix://`, `npipe://`) or an
+ * unparseable one, in which case the caller falls back to the loopback
+ * default, matching Go's `net.SplitHostPort` failure/non-TCP handling.
+ */
+function hostFromTcpEndpoint(endpoint: string): string | undefined {
+  try {
+    const url = new URL(endpoint);
+    if (url.protocol !== "tcp:" || url.hostname.length === 0) {
+      return undefined;
+    }
+    // WHATWG `URL.hostname` returns an IPv6 host bracketed (`[::1]`), but Go's
+    // `net.SplitHostPort` (`misc.go:307`) returns the bare host (`::1`). Strip a
+    // single surrounding bracket pair so local-stack probes dial/compare the
+    // same host Go does; IPv4 and named hosts are returned unchanged.
+    const host = url.hostname;
+    return host.startsWith("[") && host.endsWith("]") ? host.slice(1, -1) : host;
+  } catch {
+    return undefined;
+  }
+}
+
 /**
  * Resolves the hostname used for local Supabase service connections, mirroring
- * Go's `utils.GetHostname` (`apps/cli-go/internal/utils/misc.go:298`):
+ * Go's `utils.GetHostname` (`apps/cli-go/internal/utils/misc.go:298-311`):
  *
  * 1. `SUPABASE_SERVICES_HOSTNAME` env override — set in dev containers or when
  *    the Docker daemon is not reachable on the container's own loopback.
  * 2. The Docker daemon host when `DOCKER_HOST` is a `tcp://host:port` endpoint
  *    (Go's `Docker.DaemonHost()` + `client.ParseHostURL` + `net.SplitHostPort`).
- * 3. `127.0.0.1` otherwise (the default unix-socket daemon).
+ * 3. Otherwise, the ACTIVE DOCKER CONTEXT's daemon endpoint, when it's a
+ *    `tcp://` one — Go's `Docker.DaemonHost()` comes from a client built via
+ *    `command.NewDockerCli()` + `cli.Initialize()` (`apps/cli-go/internal/
+ *    utils/docker.go:41-54`), whose endpoint resolution walks `DOCKER_HOST` ->
+ *    `DOCKER_CONTEXT` -> the config file's `currentContext` -> the context
+ *    store (`docker/cli` `cli/command/cli.go`'s `getDockerEndPoint`/
+ *    `resolveContextName`) — not just `DOCKER_HOST`. The `docker`/`podman`
+ *    binary this module's callers shell out to for `ps`/`inspect` already
+ *    resolves the same active context itself, so without this step `status`
+ *    could correctly inspect a remote daemon while printing unusable
+ *    `127.0.0.1` API/DB/Studio URLs for it.
+ * 4. `127.0.0.1` otherwise (the default unix-socket daemon, or an
+ *    unresolvable/malformed context).
  *
  * Shared across legacy commands that connect to the local stack (`gen types`,
- * `test db`, and later `db reset` / `db dump`).
+ * `test db`, `status`, `stop`, and later `db reset` / `db dump`).
  */
 export function legacyGetHostname(): string {
   const override = process.env["SUPABASE_SERVICES_HOSTNAME"];
@@ -20,18 +131,13 @@ export function legacyGetHostname(): string {
   }
   const dockerHost = process.env["DOCKER_HOST"];
   if (dockerHost !== undefined && dockerHost.length > 0) {
-    try {
-      const url = new URL(dockerHost);
-      if (url.protocol === "tcp:" && url.hostname.length > 0) {
-        // WHATWG `URL.hostname` returns an IPv6 host bracketed (`[::1]`), but Go's
-        // `net.SplitHostPort` (`misc.go:307`) returns the bare host (`::1`). Strip a
-        // single surrounding bracket pair so local-stack probes dial/compare the
-        // same host Go does; IPv4 and named hosts are returned unchanged.
-        const host = url.hostname;
-        return host.startsWith("[") && host.endsWith("]") ? host.slice(1, -1) : host;
-      }
-    } catch {
-      // Unparseable DOCKER_HOST → fall through to the loopback default.
+    return hostFromTcpEndpoint(dockerHost) ?? LOCAL_HOST;
+  }
+  const contextEndpoint = dockerContextEndpointHost(currentDockerContextName());
+  if (contextEndpoint !== undefined) {
+    const host = hostFromTcpEndpoint(contextEndpoint);
+    if (host !== undefined) {
+      return host;
     }
   }
   return LOCAL_HOST;
diff --git a/apps/cli/src/legacy/shared/legacy-hostname.unit.test.ts b/apps/cli/src/legacy/shared/legacy-hostname.unit.test.ts
index 9706f5f002..0f1c351d0e 100644
--- a/apps/cli/src/legacy/shared/legacy-hostname.unit.test.ts
+++ b/apps/cli/src/legacy/shared/legacy-hostname.unit.test.ts
@@ -1,4 +1,8 @@
-import { describe, expect, it } from "vitest";
+import { createHash } from "node:crypto";
+import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { afterEach, describe, expect, it } from "vitest";
 
 import { legacyGetHostname } from "./legacy-hostname.ts";
 
@@ -19,6 +23,30 @@ function withEnv<T>(entries: Record<string, string | undefined>, run: () => T):
   }
 }
 
+/** Writes a Docker CLI-shaped `$DOCKER_CONFIG` directory (`config.json` + a context store entry). */
+function writeDockerConfigDir(options: {
+  readonly currentContext?: string;
+  readonly contexts?: Readonly<Record<string, string>>; // context name -> docker.Host endpoint
+}): string {
+  const dir = mkdtempSync(join(tmpdir(), "legacy-hostname-docker-config-"));
+  if (options.currentContext !== undefined) {
+    writeFileSync(
+      join(dir, "config.json"),
+      JSON.stringify({ currentContext: options.currentContext }),
+    );
+  }
+  for (const [name, host] of Object.entries(options.contexts ?? {})) {
+    const contextId = createHash("sha256").update(name).digest("hex");
+    const metaDir = join(dir, "contexts", "meta", contextId);
+    mkdirSync(metaDir, { recursive: true });
+    writeFileSync(
+      join(metaDir, "meta.json"),
+      JSON.stringify({ Endpoints: { docker: { Host: host } } }),
+    );
+  }
+  return dir;
+}
+
 describe("legacyGetHostname", () => {
   it("prefers SUPABASE_SERVICES_HOSTNAME over everything else", () => {
     expect(
@@ -63,4 +91,98 @@ describe("legacyGetHostname", () => {
       withEnv({ SUPABASE_SERVICES_HOSTNAME: undefined, DOCKER_HOST: undefined }, legacyGetHostname),
     ).toBe("127.0.0.1");
   });
+
+  describe("active Docker context resolution (Go's Docker.DaemonHost() parity)", () => {
+    let configDirs: Array<string> = [];
+
+    afterEach(() => {
+      for (const dir of configDirs) rmSync(dir, { recursive: true, force: true });
+      configDirs = [];
+    });
+
+    function withDockerConfig<T>(
+      options: Parameters<typeof writeDockerConfigDir>[0],
+      env: Record<string, string | undefined>,
+      run: () => T,
+    ): T {
+      const dir = writeDockerConfigDir(options);
+      configDirs.push(dir);
+      return withEnv(
+        {
+          SUPABASE_SERVICES_HOSTNAME: undefined,
+          DOCKER_HOST: undefined,
+          DOCKER_CONFIG: dir,
+          ...env,
+        },
+        run,
+      );
+    }
+
+    it("resolves the host from the active context's tcp:// endpoint via config.json's currentContext", () => {
+      const result = withDockerConfig(
+        { currentContext: "remote", contexts: { remote: "tcp://remote-host:2375" } },
+        {},
+        legacyGetHostname,
+      );
+      expect(result).toBe("remote-host");
+    });
+
+    it("prefers DOCKER_CONTEXT over config.json's currentContext", () => {
+      const result = withDockerConfig(
+        {
+          currentContext: "other",
+          contexts: { envctx: "tcp://envctx-host:2375", other: "tcp://other-host:2375" },
+        },
+        { DOCKER_CONTEXT: "envctx" },
+        legacyGetHostname,
+      );
+      expect(result).toBe("envctx-host");
+    });
+
+    it("strips brackets from an IPv6 context endpoint (net.SplitHostPort parity)", () => {
+      const result = withDockerConfig(
+        { currentContext: "remote", contexts: { remote: "tcp://[::1]:2375" } },
+        {},
+        legacyGetHostname,
+      );
+      expect(result).toBe("::1");
+    });
+
+    it("falls back to 127.0.0.1 when the active context's endpoint is not tcp://", () => {
+      const result = withDockerConfig(
+        { currentContext: "remote", contexts: { remote: "unix:///var/run/docker.sock" } },
+        {},
+        legacyGetHostname,
+      );
+      expect(result).toBe("127.0.0.1");
+    });
+
+    it("falls back to 127.0.0.1 when the context store entry is missing", () => {
+      const result = withDockerConfig({ currentContext: "ghost" }, {}, legacyGetHostname);
+      expect(result).toBe("127.0.0.1");
+    });
+
+    it("falls back to 127.0.0.1 when config.json is missing entirely (default context)", () => {
+      const result = withDockerConfig({}, {}, legacyGetHostname);
+      expect(result).toBe("127.0.0.1");
+    });
+
+    it("never consults the context store for the default context", () => {
+      const result = withDockerConfig(
+        { currentContext: "default", contexts: { default: "tcp://should-never-be-read:2375" } },
+        {},
+        legacyGetHostname,
+      );
+      expect(result).toBe("127.0.0.1");
+    });
+
+    it("DOCKER_HOST still takes precedence over an active non-default context", () => {
+      const result = withDockerConfig(
+        { currentContext: "remote", contexts: { remote: "tcp://context-host:2375" } },
+        { DOCKER_HOST: "tcp://direct-host:2375" },
+        legacyGetHostname,
+      );
+      expect(result).toBe("direct-host");
+    });
+  });
 });
diff --git a/apps/cli/src/legacy/shared/legacy-kong-auth.ts b/apps/cli/src/legacy/shared/legacy-kong-auth.ts
new file mode 100644
index 0000000000..6f41ef48a6
--- /dev/null
+++ b/apps/cli/src/legacy/shared/legacy-kong-auth.ts
@@ -0,0 +1,18 @@
+/**
+ * Auth headers for a request through the local Kong service gateway, mirroring
+ * Go's `fetcher.withAuthToken` (`apps/cli-go/pkg/fetcher/gateway.go:22-34`):
+ * `apikey` is always sent; `Authorization: Bearer <key>` is added only when the
+ * key is a JWT — an opaque `sb_...` secret key is not a bearer token, so Go's
+ * `sb_` prefix check omits the header for those.
+ *
+ * Hoisted here because it is needed by every local Kong-gateway caller across
+ * command families: `legacy-storage-gateway.ts` (Storage, `seed buckets` /
+ * `storage ls/cp/mv/rm`) and `start`'s PostgREST HTTP-HEAD readiness probe
+ * (`commands/start/lib/health-check.ts`).
+ */
+export function legacyKongAuthHeaders(apiKey: string): Readonly<Record<string, string>> {
+  const isOpaqueServiceKey = apiKey.startsWith("sb_");
+  return isOpaqueServiceKey
+    ? { apikey: apiKey }
+    : { apikey: apiKey, Authorization: `Bearer ${apiKey}` };
+}
diff --git a/apps/cli/src/legacy/shared/legacy-local-config-values.ts b/apps/cli/src/legacy/shared/legacy-local-config-values.ts
new file mode 100644
index 0000000000..6de36bd34f
--- /dev/null
+++ b/apps/cli/src/legacy/shared/legacy-local-config-values.ts
@@ -0,0 +1,3179 @@
+import { readFileSync } from "node:fs";
+import { basename, join } from "node:path";
+
+import { ENV_CAPTURE_REGEX, type ProjectConfig } from "@supabase/config";
+import { defaultJwtSecret, defaultPublishableKey, defaultSecretKey } from "@supabase/stack/effect";
+import { Schema } from "effect";
+
+import {
+  resolveRemoteJwks,
+  resolveThirdPartyIssuerUrl,
+  thirdPartyIssuerUrlUnchecked,
+  toPublicJwk,
+  type ThirdPartyProvidersLike,
+} from "../../shared/auth/jwks.ts";
+import { legacyResolveApiExternalUrl } from "./legacy-api-url.ts";
+import { legacySanitizeProjectId } from "./legacy-docker-ids.ts";
+import {
+  legacyApiTlsCertReadErrorMessage,
+  legacyApiTlsKeyReadErrorMessage,
+  type LegacyAnalyticsInput,
+  type LegacyApiInput,
+  type LegacyAuthInput,
+  type LegacyCaptchaInput,
+  LegacyConfigValidateError,
+  type LegacyConfigValidationInput,
+  type LegacyDbInput,
+  legacyEmailContentPathReadErrorMessage,
+  type LegacyExperimentalInput,
+  type LegacyHookInput,
+  type LegacyLocalSmtpInput,
+  type LegacyMfaFactorInput,
+  legacyParseGoBool,
+  type LegacyPasskeyInput,
+  legacyResolveApiTlsPath,
+  legacyResolveEmailTemplateContentPath,
+  legacyResolveSigningKeysPath,
+  legacySigningKeysDecodeErrorMessage,
+  legacySigningKeysReadErrorMessage,
+  type LegacySmtpInput,
+  type LegacyStudioInput,
+  type LegacyThirdPartyInput,
+  legacyValidateResolvedConfig,
+} from "./legacy-config-validate.ts";
+import {
+  LEGACY_DEFAULT_SIGNING_KEY,
+  legacyGenerateAsymmetricGoJwt,
+  legacyGenerateGoJwt,
+  type LegacyJwk,
+} from "./legacy-go-jwt.ts";
+import {
+  legacyCollectDotenvPrivateKeys,
+  legacyDecryptSecret,
+  legacyIsEncryptedSecret,
+} from "./legacy-vault-decrypt.ts";
+
+/**
+ * Go-parity derived local-dev config values, ported from `utils.Config`'s
+ * post-load defaulting (`pkg/config/config.go:406-441,748-758`) and
+ * `utils.GetApiUrl`/status's `toValues()` (`internal/utils/config.go:255-268`,
+ * `internal/status/status.go:52-95`). `@supabase/config`'s schema has no field for
+ * a handful of Go constants (`db.password`, the S3 credential triple) — those are
+ * Go-hardcoded literals, reproduced here rather than added to the shared schema
+ * (`pkg/config/config.go:408,437-441`).
+ *
+ * Kept generic (no `status`-specific shaping) so a future native `start`/`restart`
+ * port can reuse it instead of re-deriving these values — see the plan's
+ * "Files to create" note. Do not fold this into `legacy-storage-credentials.ts`;
+ * that module resolves credentials through a different (HTTP/tenant-aware) path
+ * for the remote-project branch, which this pure resolver does not need (the
+ * shared `<scheme>://<host>:<port>` derivation itself lives in
+ * `legacy-api-url.ts`, used by both).
+ */
+
+/** Go's `Db.Password` default (`pkg/config/config.go:408`) — never present in config.toml. */
+const DEFAULT_DB_PASSWORD = "postgres";
+
+/** Go's hardcoded local S3 credentials (`pkg/config/config.go:437-441`). */
+const DEFAULT_S3_ACCESS_KEY_ID = "625729a08b95bf1b7ff351a663f3a23c";
+const DEFAULT_S3_SECRET_ACCESS_KEY =
+  "850181e4652dd023b7a98c58ae0d2d34bd487ee0cc3254aed6eda37307425907";
+const DEFAULT_S3_REGION = "local";
+
+/**
+ * Go's `Db.RootKey` default (`apps/cli-go/pkg/config/config.go:460-462`).
+ * Exported (not just a local default) so `start`'s Postgres container-spec
+ * builder (`postgres.service.ts`) shares this one literal instead of a second
+ * copy — `db.root_key` isn't modeled in `@supabase/config`'s schema, so it's
+ * resolved below off the raw document the same way `jwtSecret` is resolved.
+ */
+export const LEGACY_POSTGRES_DEFAULT_ROOT_KEY =
+  "d4dc5b6d4a1d6a10b2c1e76112c994d65db7cec380572cc1839624d4be3fa275";
+
+export interface LegacyLocalConfigValues {
+  readonly apiUrl: string;
+  readonly apiPort: number;
+  readonly dbPort: number;
+  /** Already env-overridden `studio.port` (`SUPABASE_STUDIO_PORT`) — see `apiPort`/`dbPort` for the same pattern. */
+  readonly studioPort: number;
+  readonly rootKey: string;
+  /**
+   * Already-resolved (env-overridden, decrypted-if-`encrypted:`) `studio.
+   * openai_api_key`. Go types this as a `config.Secret` (`pkg/config/
+   * config.go:264`), decrypted by `DecryptSecretHookFunc` at decode time
+   * (`secret.go:30-46,77-108`) for both the TOML value and any
+   * `SUPABASE_STUDIO_OPENAI_API_KEY` override (Go's generic Viper
+   * `AutomaticEnv` binding, `config.go:582-586`) — same treatment as
+   * `jwtSecret`/the API keys below, via the same `legacyDecryptAuthSecret` helper.
+   */
+  readonly openaiApiKey: string | undefined;
+  readonly authSiteUrl: string;
+  readonly authJwtIssuer: string | undefined;
+  readonly authJwtExpiry: number;
+  readonly authAdditionalRedirectUrls: ReadonlyArray<string>;
+  readonly authEnableSignup: boolean;
+  readonly authEnableAnonymousSignIns: boolean;
+  readonly authEnableRefreshTokenRotation: boolean;
+  readonly authRefreshTokenReuseInterval: number;
+  readonly authEnableManualLinking: boolean;
+  readonly authMinimumPasswordLength: number;
+  readonly authPasswordRequirements: string;
+  readonly restUrl: string;
+  readonly graphqlUrl: string;
+  readonly functionsUrl: string;
+  readonly mcpUrl: string;
+  readonly studioUrl: string;
+  readonly mailpitUrl: string;
+  readonly dbUrl: string;
+  readonly publishableKey: string;
+  readonly secretKey: string;
+  readonly jwtSecret: string;
+  readonly anonKey: string;
+  readonly serviceRoleKey: string;
+  readonly storageS3Url: string;
+  readonly storageS3AccessKeyId: string;
+  readonly storageS3SecretAccessKey: string;
+  readonly storageS3Region: string;
+  /** Already env-overridden `analytics.enabled` (`SUPABASE_ANALYTICS_ENABLED`). */
+  readonly analyticsEnabled: boolean;
+  /** Already env-overridden `analytics.backend` (`SUPABASE_ANALYTICS_BACKEND`), hard-validated like Go's `LogflareBackend`. */
+  readonly analyticsBackend: "postgres" | "bigquery";
+  /** Already env-overridden `analytics.gcp_project_id` (`SUPABASE_ANALYTICS_GCP_PROJECT_ID`). */
+  readonly gcpProjectId: string;
+  /** Already env-overridden `analytics.gcp_project_number` (`SUPABASE_ANALYTICS_GCP_PROJECT_NUMBER`). */
+  readonly gcpProjectNumber: string;
+  /** Already env-overridden `analytics.gcp_jwt_path` (`SUPABASE_ANALYTICS_GCP_JWT_PATH`). */
+  readonly gcpJwtPath: string;
+}
+
+/**
+ * Go's `utils.GetApiUrl(path)` (`internal/utils/config.go:255-268`): appends
+ * `path` to the resolved external URL. Go's own fallback branch (building a bare
+ * `http://host:port` when `Config.Api.ExternalUrl` is empty) is unreachable in
+ * practice because `config.Load` already defaults `ExternalUrl` before `status`
+ * runs — `resolveApiExternalUrl` reproduces that same default, so `apiExternalUrl`
+ * passed in here is never empty.
+ */
+function apiUrlWithPath(apiExternalUrl: string, path: string): string {
+  return `${apiExternalUrl}${path}`;
+}
+
+/**
+ * Thrown by {@link legacyResolveLocalConfigValues} when `auth.jwt_secret` is
+ * configured but too short to sign with, mirroring Go's `Config.Validate`
+ * (`pkg/config/apikeys.go:45-47`) — that check runs at config-load time, before
+ * any command renders output, so no local dev stack can even start with a
+ * short secret.
+ */
+export class LegacyInvalidJwtSecretError extends Error {
+  constructor() {
+    super("Invalid config for auth.jwt_secret. Must be at least 16 characters");
+    this.name = "LegacyInvalidJwtSecretError";
+  }
+}
+
+/** Go's minimum `auth.jwt_secret` length (`pkg/config/apikeys.go:46`). */
+const MIN_JWT_SECRET_LENGTH = 16;
+
+/**
+ * Thrown by {@link legacyEnvOverridePort} when a `SUPABASE_*_PORT` env/dotenv
+ * override doesn't parse as a valid port, mirroring Go's `Config.Load`
+ * (`pkg/config/config.go:749-756`): `v.UnmarshalExact` decodes with
+ * `WeaklyTypedInput` on (viper's `defaultDecoderConfig`, never reset by our
+ * decoder options), so mapstructure's `decodeUint` runs `strconv.ParseUint`
+ * on the override string and hard-fails config loading on a bad value —
+ * there is no Go code path that reaches `status`/`stop` with a malformed
+ * port override. The message text isn't a byte-match for mapstructure's
+ * internal error (that's viper/mapstructure library text, not a Go-authored
+ * string), but the parity-relevant part — hard-fail, same field name — is.
+ */
+export class LegacyInvalidPortEnvOverrideError extends Error {
+  constructor(dottedFieldPath: string, value: string) {
+    super(`Invalid config for ${dottedFieldPath}: cannot parse "${value}" as a port`);
+    this.name = "LegacyInvalidPortEnvOverrideError";
+  }
+}
+
+/** Go's `uint16` port fields' valid range (`pkg/config/db.go:84`, `pkg/config/api.go:29`, etc). */
+const MAX_PORT = 65535;
+
+/**
+ * Port-flavored sibling of {@link legacyEnvOverride}/{@link legacyEnvOverrideBool}
+ * for `SUPABASE_*_PORT` fields Go decodes as `uint16` rather than a plain
+ * string. Unlike the boolean sibling — which intentionally falls back to
+ * `configured` on a malformed override — a bad port override is a genuine
+ * Go-parity hard failure (see {@link LegacyInvalidPortEnvOverrideError}), not
+ * a leniency case: Go never proceeds with the pre-override value on a decode
+ * error, it fails config loading outright. Parses with
+ * {@link parseGoBaseZeroUint} (Go's base-0 grammar, same as
+ * {@link legacyEnvOverrideUint}), then applies {@link MAX_PORT} as this
+ * field's own `uint16` bound afterward — the same "parse the literal, then
+ * check it fits the bit width" split `strconv.ParseUint` itself uses.
+ */
+export function legacyEnvOverridePort(
+  name: string,
+  configuredPort: number,
+  dottedFieldPath: string,
+  projectEnvValues: Readonly<Record<string, string>> | undefined,
+): number {
+  const value = legacyEnvOverride(name, undefined, projectEnvValues);
+  if (value === undefined) return configuredPort;
+  const parsed = parseGoBaseZeroUint(value);
+  if (parsed === undefined || parsed > BigInt(MAX_PORT)) {
+    throw new LegacyInvalidPortEnvOverrideError(dottedFieldPath, value);
+  }
+  return Number(parsed);
+}
+
+/**
+ * Go's `Config.Load` binds Viper with `SetEnvPrefix("SUPABASE")` +
+ * `AutomaticEnv()` + a `.`→`_` key replacer (`pkg/config/config.go:529-535`),
+ * so ANY config field can be overridden by a `SUPABASE_<DOTTED_KEY>` env var,
+ * generically across the whole struct — not just auth fields
+ * (`config_test.go:351,1061` exercise this against `auth.site_url`, and
+ * `internal/status/status.go:52-95`'s `toValues()` reads `utils.Config.*`
+ * directly, so every already-overridden field is automatically reflected in
+ * `status`'s output). This resolves it for every field this module derives a
+ * URL/port from, at the same higher-than-config.toml precedence Viper gives
+ * env vars. An empty env var is treated as unset, matching Viper's default
+ * (`AllowEmptyEnv` is never enabled in `config.go`).
+ *
+ * Viper's `AutomaticEnv` binding runs AFTER `Config.Load`'s `loadNestedEnv`
+ * (`config.go:735-738`), which loads `supabase/.env`(.local) and project-root
+ * dotenv files into the process env before any `SUPABASE_*` var is read
+ * (`config.go:1169-1207`) — so a value that lives only in one of those files,
+ * not the ambient shell, must still be visible here. `projectEnvValues` is
+ * that already-resolved map (see `legacyResolveProjectEnvironmentValues`);
+ * falling back to `process.env` covers the "no `supabase/` project found"
+ * case, where `projectEnvValues` is `undefined`.
+ *
+ * The resolved override string itself can be a further `env(VAR)` indirection
+ * (e.g. `SUPABASE_API_ENABLED=env(API_ENABLED)`) — Go's `LoadEnvHook`
+ * (`decode_hooks.go:15-23`) is the first mapstructure decode hook composed
+ * into `v.UnmarshalExact` (`config.go:749-753,769-772`), so it resolves
+ * `env(...)` on every string mapstructure decodes into the struct, regardless
+ * of whether Viper sourced that string from `config.toml` or a `SUPABASE_*`
+ * `AutomaticEnv` override (`config.go:582-586`) — Viper's `Get()` just returns
+ * a string; the hook chain doesn't know or care where it came from. Resolved
+ * with the same `projectEnvValues ?? process.env` precedence and non-empty
+ * gate as the outer lookup (mirroring `decode_hooks.go:19-24`'s `len(env) > 0`
+ * check); an unresolved/empty indirection leaves the `env(VAR)` literal
+ * untouched, same as Go.
+ */
+export function legacyEnvOverride(
+  name: string,
+  configured: string | undefined,
+  projectEnvValues: Readonly<Record<string, string>> | undefined,
+): string | undefined {
+  const value = projectEnvValues?.[name] ?? process.env[name];
+  if (value === undefined || value.length === 0) return configured;
+  const indirection = ENV_CAPTURE_REGEX.exec(value)?.[1];
+  if (indirection === undefined) return value;
+  const resolved = projectEnvValues?.[indirection] ?? process.env[indirection];
+  return resolved !== undefined && resolved.length > 0 ? resolved : value;
+}
+
+/**
+ * Thrown by {@link legacyEnvOverrideBool} when a `SUPABASE_*_ENABLED` (or other
+ * bool-typed) env/dotenv override doesn't parse as one of Go's accepted bool
+ * spellings, mirroring Go's `Config.Load` (`pkg/config/config.go:749-756`):
+ * `v.UnmarshalExact` decodes with `WeaklyTypedInput` on (viper's
+ * `defaultDecoderConfig`, never reset by our decoder options — same mechanism
+ * as {@link LegacyInvalidPortEnvOverrideError}), so mapstructure's `decodeBool`
+ * runs `strconv.ParseBool` on the override string and hard-fails config
+ * loading on a bad value — there is no Go code path that reaches `status`/
+ * `stop` with a malformed bool override.
+ */
+export class LegacyInvalidBoolEnvOverrideError extends Error {
+  constructor(dottedFieldPath: string, value: string) {
+    super(`Invalid config for ${dottedFieldPath}: cannot parse "${value}" as a bool`);
+    this.name = "LegacyInvalidBoolEnvOverrideError";
+  }
+}
+
+/**
+ * Boolean-flavored sibling of {@link legacyEnvOverride} for `SUPABASE_*` fields Go
+ * decodes as a native bool (`api.tls.enabled`, `auth.enabled`, and every other
+ * `<section>.enabled` gate `status`/`stop` read — see `legacy-status-values.ts`)
+ * rather than a string/number — those are bound by the same generic Viper
+ * mechanism (`ExperimentalBindStruct` + `SetEnvPrefix("SUPABASE")` +
+ * `AutomaticEnv()`, `pkg/config/config.go:582-586`), but the override string
+ * must be decoded with Go's own `strconv.ParseBool` acceptance set
+ * ({@link legacyParseGoBool}) instead of used verbatim. Unlike a plain string
+ * override — where an unparsed value has no Go-observable failure mode — a
+ * malformed bool override is a genuine Go-parity hard failure (see
+ * {@link LegacyInvalidBoolEnvOverrideError}), same as
+ * {@link LegacyInvalidPortEnvOverrideError} for ports: Go never proceeds with
+ * the pre-override value on a decode error, it fails config loading outright.
+ *
+ * Exported (not just used internally) because `legacy-status-values.ts`'s own
+ * `<section>.enabled` gates need this same override treatment — Go's
+ * `status.toValues()` reads `utils.Config.*.Enabled` post-Viper-override for
+ * every gated service, not only auth.
+ */
+export function legacyEnvOverrideBool(
+  name: string,
+  configured: boolean,
+  dottedFieldPath: string,
+  projectEnvValues: Readonly<Record<string, string>> | undefined,
+): boolean {
+  const value = legacyEnvOverride(name, undefined, projectEnvValues);
+  if (value === undefined) return configured;
+  const parsed = legacyParseGoBool(value);
+  if (parsed === undefined) {
+    throw new LegacyInvalidBoolEnvOverrideError(dottedFieldPath, value);
+  }
+  return parsed;
+}
+
+/**
+ * Thrown by {@link envOverrideAnalyticsBackend} when `SUPABASE_ANALYTICS_BACKEND`
+ * doesn't match one of Go's `LogflareBackend` values. `Analytics.Backend` is
+ * typed `LogflareBackend` (`pkg/config/config.go:303`), and
+ * `LogflareBackend.UnmarshalText` (`config.go:60-65`) hard-rejects anything
+ * outside `{postgres, bigquery}` — that runs inside the same
+ * `v.UnmarshalExact` decode call (`config.go:749-756`) every other
+ * `SUPABASE_*` override goes through, so a malformed override fails config
+ * loading outright, same mechanism as {@link LegacyInvalidPortEnvOverrideError}/
+ * {@link LegacyInvalidBoolEnvOverrideError}.
+ */
+export class LegacyInvalidAnalyticsBackendEnvOverrideError extends Error {
+  constructor(dottedFieldPath: string, value: string) {
+    super(
+      `Invalid config for ${dottedFieldPath}: cannot parse "${value}" as one of "postgres", "bigquery"`,
+    );
+    this.name = "LegacyInvalidAnalyticsBackendEnvOverrideError";
+  }
+}
+
+/**
+ * `analytics.backend`-flavored sibling of {@link legacyEnvOverridePort}/
+ * {@link legacyEnvOverrideBool} for the one `SUPABASE_*` override this file
+ * decodes as a Go text-unmarshalled enum rather than a string/number/bool —
+ * see {@link LegacyInvalidAnalyticsBackendEnvOverrideError}. Validates the
+ * override-or-configured value with a SINGLE check (rather than only
+ * validating the override, trusting the schema for the configured value),
+ * matching Go more closely: viper merges the config.toml value and any env
+ * override into one string BEFORE `UnmarshalExact` calls `UnmarshalText`
+ * exactly once on the resolved value (`config.go:749-756`), not once per
+ * source. `@supabase/config`'s `stringEnum` (`packages/config/src/
+ * analytics.ts:31-39`) already guards the `config.toml`-sourced value at
+ * decode time, so this is belt-and-suspenders for that source and the sole
+ * guard for the env-override one, which bypasses that schema entirely.
+ */
+function envOverrideAnalyticsBackend(
+  configured: string,
+  projectEnvValues: Readonly<Record<string, string>> | undefined,
+): "postgres" | "bigquery" {
+  const value =
+    legacyEnvOverride("SUPABASE_ANALYTICS_BACKEND", undefined, projectEnvValues) ?? configured;
+  if (value !== "postgres" && value !== "bigquery") {
+    throw new LegacyInvalidAnalyticsBackendEnvOverrideError("analytics.backend", value);
+  }
+  return value;
+}
+
+/**
+ * Thrown by {@link legacyEnvOverrideRealtimeIpVersion} when
+ * `SUPABASE_REALTIME_IP_VERSION` doesn't match Go's `AddressFamily`
+ * (`pkg/config/config.go:67-81`) — `UnmarshalText` hard-rejects anything
+ * outside `{IPv4, IPv6}`, same mechanism as
+ * {@link LegacyInvalidAnalyticsBackendEnvOverrideError}.
+ */
+export class LegacyInvalidRealtimeIpVersionEnvOverrideError extends Error {
+  constructor(dottedFieldPath: string, value: string) {
+    super(
+      `Invalid config for ${dottedFieldPath}: cannot parse "${value}" as one of "IPv4", "IPv6"`,
+    );
+    this.name = "LegacyInvalidRealtimeIpVersionEnvOverrideError";
+  }
+}
+
+/**
+ * `realtime.ip_version`-flavored sibling of {@link envOverrideAnalyticsBackend}
+ * — Go's `Realtime.IpVersion` is `AddressFamily`, text-unmarshalled the same
+ * way `Analytics.Backend` is, so the override-or-configured value is
+ * validated with a single check to match Go's one-shot `UnmarshalText` call.
+ */
+export function legacyEnvOverrideRealtimeIpVersion(
+  configured: string,
+  projectEnvValues: Readonly<Record<string, string>> | undefined,
+): "IPv4" | "IPv6" {
+  const value =
+    legacyEnvOverride("SUPABASE_REALTIME_IP_VERSION", undefined, projectEnvValues) ?? configured;
+  if (value !== "IPv4" && value !== "IPv6") {
+    throw new LegacyInvalidRealtimeIpVersionEnvOverrideError("realtime.ip_version", value);
+  }
+  return value;
+}
+
+/** `SUPABASE_REALTIME_MAX_HEADER_LENGTH` — see {@link legacyEnvOverrideUint}. */
+export function legacyEnvOverrideRealtimeMaxHeaderLength(
+  configured: number,
+  projectEnvValues: Readonly<Record<string, string>> | undefined,
+): number {
+  return legacyEnvOverrideUint(
+    "SUPABASE_REALTIME_MAX_HEADER_LENGTH",
+    "realtime.max_header_length",
+    configured,
+    projectEnvValues,
+  );
+}
+
+/** `SUPABASE_API_MAX_ROWS` — see {@link legacyEnvOverrideUint}. */
+export function legacyEnvOverrideApiMaxRows(
+  configured: number,
+  projectEnvValues: Readonly<Record<string, string>> | undefined,
+): number {
+  return legacyEnvOverrideUint(
+    "SUPABASE_API_MAX_ROWS",
+    "api.max_rows",
+    configured,
+    projectEnvValues,
+  );
+}
+
+/**
+ * Thrown by {@link legacyEnvOverridePoolMode} when `SUPABASE_DB_POOLER_POOL_MODE`
+ * doesn't match Go's `PoolMode` (`pkg/config/db.go:14-26`) — `UnmarshalText`
+ * hard-rejects anything outside `{transaction, session}`, same mechanism as
+ * {@link LegacyInvalidRealtimeIpVersionEnvOverrideError}.
+ */
+export class LegacyInvalidPoolModeEnvOverrideError extends Error {
+  constructor(dottedFieldPath: string, value: string) {
+    super(
+      `Invalid config for ${dottedFieldPath}: cannot parse "${value}" as one of "transaction", "session"`,
+    );
+    this.name = "LegacyInvalidPoolModeEnvOverrideError";
+  }
+}
+
+/**
+ * `db.pooler.pool_mode`-flavored sibling of {@link legacyEnvOverrideRealtimeIpVersion}
+ * — Go's `Pooler.PoolMode` is `PoolMode`, text-unmarshalled the same way
+ * `Realtime.IpVersion` is, so the override-or-configured value is validated
+ * with a single check to match Go's one-shot `UnmarshalText` call.
+ */
+export function legacyEnvOverridePoolMode(
+  configured: string,
+  projectEnvValues: Readonly<Record<string, string>> | undefined,
+): "transaction" | "session" {
+  const value =
+    legacyEnvOverride("SUPABASE_DB_POOLER_POOL_MODE", undefined, projectEnvValues) ?? configured;
+  if (value !== "transaction" && value !== "session") {
+    throw new LegacyInvalidPoolModeEnvOverrideError("db.pooler.pool_mode", value);
+  }
+  return value;
+}
+
+/**
+ * Thrown by {@link legacyEnvOverrideEdgeRuntimePolicy} when
+ * `SUPABASE_EDGE_RUNTIME_POLICY` doesn't match Go's `RequestPolicy`
+ * (`pkg/config/config.go:83-96`) — `UnmarshalText` hard-rejects anything
+ * outside `{per_worker, oneshot}`, same mechanism as
+ * {@link LegacyInvalidPoolModeEnvOverrideError}.
+ */
+export class LegacyInvalidEdgeRuntimePolicyEnvOverrideError extends Error {
+  constructor(dottedFieldPath: string, value: string) {
+    super(
+      `Invalid config for ${dottedFieldPath}: cannot parse "${value}" as one of "per_worker", "oneshot"`,
+    );
+    this.name = "LegacyInvalidEdgeRuntimePolicyEnvOverrideError";
+  }
+}
+
+/**
+ * `edge_runtime.policy`-flavored sibling of {@link legacyEnvOverridePoolMode}
+ * — Go's `EdgeRuntime.Policy` is `RequestPolicy`, text-unmarshalled the same
+ * way `Pooler.PoolMode` is, so the override-or-configured value is validated
+ * with a single check to match Go's one-shot `UnmarshalText` call.
+ */
+export function legacyEnvOverrideEdgeRuntimePolicy(
+  configured: string,
+  projectEnvValues: Readonly<Record<string, string>> | undefined,
+): "per_worker" | "oneshot" {
+  const value =
+    legacyEnvOverride("SUPABASE_EDGE_RUNTIME_POLICY", undefined, projectEnvValues) ?? configured;
+  if (value !== "per_worker" && value !== "oneshot") {
+    throw new LegacyInvalidEdgeRuntimePolicyEnvOverrideError("edge_runtime.policy", value);
+  }
+  return value;
+}
+
+/** `SUPABASE_DB_POOLER_DEFAULT_POOL_SIZE` — see {@link legacyEnvOverrideUint}. */
+export function legacyEnvOverrideDefaultPoolSize(
+  configured: number,
+  projectEnvValues: Readonly<Record<string, string>> | undefined,
+): number {
+  return legacyEnvOverrideUint(
+    "SUPABASE_DB_POOLER_DEFAULT_POOL_SIZE",
+    "db.pooler.default_pool_size",
+    configured,
+    projectEnvValues,
+  );
+}
+
+/** `SUPABASE_DB_POOLER_MAX_CLIENT_CONN` — see {@link legacyEnvOverrideUint}. */
+export function legacyEnvOverrideMaxClientConn(
+  configured: number,
+  projectEnvValues: Readonly<Record<string, string>> | undefined,
+): number {
+  return legacyEnvOverrideUint(
+    "SUPABASE_DB_POOLER_MAX_CLIENT_CONN",
+    "db.pooler.max_client_conn",
+    configured,
+    projectEnvValues,
+  );
+}
+
+/**
+ * Decrypts a resolved auth identity-key field (`jwt_secret`, `publishable_key`,
+ * `secret_key`, `anon_key`, `service_role_key`) when it's a dotenvx `encrypted:`
+ * value, mirroring Go's `DecryptSecretHookFunc` (`pkg/config/secret.go:30-73`),
+ * which Go runs unconditionally during `UnmarshalExact` for every
+ * `config.Secret`-typed field (`pkg/config/auth.go:181-185` types these five as
+ * `Secret`) — an undecryptable value aborts config loading with
+ * `failed to parse config: <error>` (`config.go:704`) before `status`/`stop`
+ * continue. `@supabase/config`'s schema only tags these fields for later
+ * `Redacted` wrapping (`packages/config/src/lib/env.ts`) and never decrypts, so
+ * without this step a valid `encrypted:` secret would be used as literal (wrong)
+ * key material and a malformed one would silently pass through instead of
+ * failing like Go does.
+ *
+ * Applied AFTER {@link legacyEnvOverride}, matching Go: an env-sourced override lands
+ * on the same `config.Secret` field and goes through the same decode hook as a
+ * TOML-sourced value, so `SUPABASE_AUTH_JWT_SECRET=encrypted:...` is decrypted
+ * too, not just the config.toml value.
+ */
+function legacyDecryptAuthSecret(
+  value: string | undefined,
+  projectEnvValues: Readonly<Record<string, string>> | undefined,
+): string | undefined {
+  if (value === undefined || !legacyIsEncryptedSecret(value)) return value;
+  const dotenvPrivateKeys = legacyCollectDotenvPrivateKeys({ ...projectEnvValues, ...process.env });
+  const decrypted = legacyDecryptSecret(value, dotenvPrivateKeys);
+  if (!decrypted.ok) {
+    throw new LegacyConfigValidateError(`failed to parse config: ${decrypted.error}`);
+  }
+  return decrypted.value;
+}
+
+/**
+ * `[auth.email.smtp]`'s full resolved field set, including Go's
+ * presence-based `enabled` default. Exported so any caller that needs GoTrue's
+ * actual SMTP-vs-Mailpit decision (not just validation) can reuse this instead
+ * of re-deriving it from the schema-decoded, always-`enabled: false`-when-
+ * absent `config.auth.email.smtp` — see `start.handler.ts`'s
+ * `resolveGotrueEnvInput`, which used to do exactly that.
+ *
+ * Go's `[auth.email.smtp]` presence-based `enabled` default
+ * (`pkg/config/config.go:743-748`): when the TOML table is present but omits
+ * `enabled`, Go treats it as `true` — a genuinely presence-based default
+ * `@supabase/config`'s schema can't see (it always decodes `smtp.enabled` to
+ * `false` when the key is absent), so this reads the raw `authDocument` too.
+ * `auth.email.smtp.*` is Viper-bound like every other nested field once
+ * `[auth.email.smtp]` is present in config.toml (`ExperimentalBindStruct`/
+ * `AutomaticEnv`, `config.go:581-586`), so `SUPABASE_AUTH_EMAIL_SMTP_ENABLED`/
+ * `_HOST`/`_PORT`/`_USER`/`_PASS`/`_ADMIN_EMAIL`/`_SENDER_NAME` overrides
+ * apply before `Auth.Email.validate` runs (`config.go:1325-1344`) — layered on
+ * top of the presence-aware raw-document read above, same
+ * `legacyEnvOverride`/`legacyEnvOverridePort` precedent as every other field in this file.
+ * `sender_name` (`pkg/config/auth.go:254-262`) is an equally Viper-bound
+ * regular field, just not needed by validation (hence absent from
+ * {@link LegacySmtpInput}).
+ */
+export function legacyResolveAuthEmailSmtp(
+  authDocument: Readonly<Record<string, unknown>> | undefined,
+  projectEnvValues: Readonly<Record<string, string>> | undefined,
+): (LegacySmtpInput & { readonly senderName: string | undefined }) | undefined {
+  const smtpDoc = asRecord(asRecord(authDocument?.["email"])?.["smtp"]);
+  if (smtpDoc === undefined) return undefined;
+  return {
+    enabled: legacyEnvOverrideBool(
+      "SUPABASE_AUTH_EMAIL_SMTP_ENABLED",
+      smtpDoc["enabled"] === undefined ? true : smtpDoc["enabled"] === true,
+      "auth.email.smtp.enabled",
+      projectEnvValues,
+    ),
+    host:
+      legacyEnvOverride(
+        "SUPABASE_AUTH_EMAIL_SMTP_HOST",
+        typeof smtpDoc["host"] === "string" ? smtpDoc["host"] : "",
+        projectEnvValues,
+      ) ?? "",
+    port: legacyEnvOverridePort(
+      "SUPABASE_AUTH_EMAIL_SMTP_PORT",
+      typeof smtpDoc["port"] === "number" ? smtpDoc["port"] : 0,
+      "auth.email.smtp.port",
+      projectEnvValues,
+    ),
+    user:
+      legacyEnvOverride(
+        "SUPABASE_AUTH_EMAIL_SMTP_USER",
+        typeof smtpDoc["user"] === "string" ? smtpDoc["user"] : "",
+        projectEnvValues,
+      ) ?? "",
+    // Go's `Auth.Email.Smtp.Pass` is a `config.Secret` (`pkg/config/auth.go:260`),
+    // decrypted by `DecryptSecretHookFunc` at decode time for both the TOML
+    // value and any env override — same treatment as `jwt_secret`/the API
+    // keys below, via the same `legacyDecryptAuthSecret` helper.
+    pass:
+      legacyDecryptAuthSecret(
+        legacyEnvOverride(
+          "SUPABASE_AUTH_EMAIL_SMTP_PASS",
+          typeof smtpDoc["pass"] === "string" ? smtpDoc["pass"] : "",
+          projectEnvValues,
+        ) ?? "",
+        projectEnvValues,
+      ) ?? "",
+    adminEmail:
+      legacyEnvOverride(
+        "SUPABASE_AUTH_EMAIL_SMTP_ADMIN_EMAIL",
+        typeof smtpDoc["admin_email"] === "string" ? smtpDoc["admin_email"] : "",
+        projectEnvValues,
+      ) ?? "",
+    senderName: legacyEnvOverride(
+      "SUPABASE_AUTH_EMAIL_SMTP_SENDER_NAME",
+      typeof smtpDoc["sender_name"] === "string" ? smtpDoc["sender_name"] : undefined,
+      projectEnvValues,
+    ),
+  };
+}
+
+/**
+ * Go's `Config.Validate` checks `auth.captcha` right after `auth.site_url`,
+ * still inside `if c.Auth.Enabled` (`pkg/config/config.go:1099-1109`): an
+ * enabled CAPTCHA section requires both `provider` and `secret`. `auth.captcha.*`
+ * is Viper-bound like every other nested field once `[auth.captcha]` is present
+ * in config.toml (`ExperimentalBindStruct`/`AutomaticEnv`, `config.go:581-586`),
+ * so `SUPABASE_AUTH_CAPTCHA_ENABLED`/`_PROVIDER`/`_SECRET` overrides apply before
+ * this validation runs. Unlike the flat `auth.site_url` field, `config.auth.captcha`
+ * does NOT decode to `undefined` when `[auth.captcha]` is absent from config.toml —
+ * `captcha.ts`'s own `withDecodingDefaultKey` fills in `{ enabled: false }` even
+ * through the outer `Schema.optionalKey` wrapper (`packages/config/src/auth/index.ts`),
+ * confirmed empirically; there is no schema-level presence signal here, unlike
+ * `auth.passkey`/`auth.webauthn`. So presence is read from the raw `authDocument`
+ * instead — matching Go's `AutomaticEnv` (which only intercepts keys already
+ * present in the merged config), an absent `[auth.captcha]` section never picks
+ * up an env override alone.
+ *
+ * Hoisted (like {@link legacyResolveAuthEmailSmtp}) so both
+ * `legacyResolveLocalConfigValues` (`Config.Validate` parity) and
+ * `start.handler.ts`'s `resolveGotrueEnvInput` (the actual GoTrue env) resolve
+ * the SAME effective value — `secret` is `Secret`-typed in Go
+ * (`pkg/config/auth.go`), decrypted the same way `jwt_secret`/API keys/`smtp.pass` are.
+ */
+export function legacyResolveAuthCaptcha(
+  authDocument: Readonly<Record<string, unknown>> | undefined,
+  captcha: ProjectConfig["auth"]["captcha"],
+  projectEnvValues: Readonly<Record<string, string>> | undefined,
+): LegacyCaptchaInput | undefined {
+  const captchaDoc = asRecord(authDocument?.["captcha"]);
+  return captcha
+    ? {
+        enabled:
+          captchaDoc !== undefined
+            ? legacyEnvOverrideBool(
+                "SUPABASE_AUTH_CAPTCHA_ENABLED",
+                captcha.enabled ?? false,
+                "auth.captcha.enabled",
+                projectEnvValues,
+              )
+            : (captcha.enabled ?? false),
+        provider:
+          captchaDoc !== undefined
+            ? legacyEnvOverride(
+                "SUPABASE_AUTH_CAPTCHA_PROVIDER",
+                captcha.provider,
+                projectEnvValues,
+              )
+            : captcha.provider,
+        secret: legacyDecryptAuthSecret(
+          captchaDoc !== undefined
+            ? legacyEnvOverride("SUPABASE_AUTH_CAPTCHA_SECRET", captcha.secret, projectEnvValues)
+            : captcha.secret,
+          projectEnvValues,
+        ),
+      }
+    : undefined;
+}
+
+/** Go's `(a *auth) generateAPIKeys` (`pkg/config/apikeys.go:43-73`). */
+function resolveJwtSecret(configured: string | undefined): string {
+  if (configured === undefined || configured.length === 0) return defaultJwtSecret;
+  if (configured.length < MIN_JWT_SECRET_LENGTH) {
+    throw new LegacyInvalidJwtSecretError();
+  }
+  return configured;
+}
+
+function resolveOpaqueKey(configured: string | undefined, fallback: string): string {
+  return configured !== undefined && configured.length > 0 ? configured : fallback;
+}
+
+function resolveSignedKey(
+  configured: string | undefined,
+  jwtSecret: string,
+  signingKey: LegacyJwk | undefined,
+  role: "anon" | "service_role",
+): string {
+  if (configured !== undefined && configured.length > 0) return configured;
+  return signingKey !== undefined
+    ? legacyGenerateAsymmetricGoJwt(signingKey, role)
+    : legacyGenerateGoJwt(jwtSecret, role);
+}
+
+/** Matches Go's `JWK` struct fields (`pkg/config/auth.go:88-108`) — see `LegacyJwk`. */
+const LegacyJwkSchema = Schema.Struct({
+  kty: Schema.String,
+  kid: Schema.optionalKey(Schema.String),
+  use: Schema.optionalKey(Schema.String),
+  key_ops: Schema.optionalKey(Schema.Array(Schema.String)),
+  alg: Schema.optionalKey(Schema.String),
+  ext: Schema.optionalKey(Schema.Boolean),
+  n: Schema.optionalKey(Schema.String),
+  e: Schema.optionalKey(Schema.String),
+  d: Schema.optionalKey(Schema.String),
+  p: Schema.optionalKey(Schema.String),
+  q: Schema.optionalKey(Schema.String),
+  dp: Schema.optionalKey(Schema.String),
+  dq: Schema.optionalKey(Schema.String),
+  qi: Schema.optionalKey(Schema.String),
+  crv: Schema.optionalKey(Schema.String),
+  x: Schema.optionalKey(Schema.String),
+  y: Schema.optionalKey(Schema.String),
+});
+const decodeLegacyJwks = Schema.decodeUnknownSync(Schema.Array(LegacyJwkSchema));
+
+/**
+ * Go's `Config.Validate` (`pkg/config/config.go:877-878,1059-1062`): a relative
+ * `signing_keys_path` resolves against `<workdir>/supabase`, then the file is
+ * read and JSON-decoded into `[]JWK`. Used via {@link legacyResolveConfiguredSigningKeys}'s
+ * {@link loadSigningKeys} call, both by `legacyResolveLocalConfigValues` (which only needs the
+ * first key to sign anon/service_role, matching `generateJWT`'s `a.SigningKeys[0]` — see
+ * {@link resolveSignedKey}) and {@link legacyResolveLocalJwks} (the full array, matching
+ * `ResolveJWKS`'s `a.SigningKeys` loop).
+ *
+ * Uses `node:fs` directly (not the `FileSystem` Effect service other Go-parity
+ * resolvers in `legacy/` use for file reads) so this function — and its large
+ * existing test surface — can stay a plain synchronous resolver; this is an
+ * optional, rarely-configured field, not worth threading Effect dependencies
+ * through `legacyStatusValues`/`status.handler.ts` for.
+ *
+ * Error wording matches Go's two `Validate` failure branches exactly
+ * (`"failed to read signing keys: %w"` for an open failure, `"failed to decode
+ * signing keys: %w"` for a parse failure) rather than letting `readFileSync`/
+ * `JSON.parse`'s raw Node error text through unwrapped.
+ *
+ * Callers must only invoke this when auth is enabled (the `SUPABASE_AUTH_ENABLED`-
+ * overridden value, not necessarily raw `config.auth.enabled` — see
+ * {@link legacyEnvOverrideBool}) — Go's `Validate` nests the entire signing-keys read
+ * inside `if c.Auth.Enabled` (`pkg/config/config.go:1036,1059-1065`), reading
+ * that same post-override value, so a disabled auth section never touches
+ * `signing_keys_path`, however stale or missing that file is.
+ */
+function readSigningKeysFile(workdir: string, signingKeysPath: string): ReadonlyArray<LegacyJwk> {
+  const absolutePath = legacyResolveSigningKeysPath(workdir, signingKeysPath);
+
+  let contents: string;
+  try {
+    contents = readFileSync(absolutePath, "utf8");
+  } catch (cause) {
+    throw new LegacyConfigValidateError(legacySigningKeysReadErrorMessage(cause));
+  }
+
+  try {
+    // `Schema.Array` decodes `key_ops` as `ReadonlyArray<string>`, but `LegacyJwk.key_ops` is a
+    // mutable `string[]` (required for assignability into Node's `createPrivateKey`/`JsonWebKey`
+    // input — see that type's own doc comment), so each key's `key_ops` is copied into a fresh
+    // mutable array here rather than widening the schema's own (correctly readonly) output type.
+    return decodeLegacyJwks(JSON.parse(contents)).map((jwk) => ({
+      ...jwk,
+      key_ops: jwk.key_ops === undefined ? undefined : [...jwk.key_ops],
+    }));
+  } catch (cause) {
+    throw new LegacyConfigValidateError(legacySigningKeysDecodeErrorMessage(cause));
+  }
+}
+
+/** See {@link readSigningKeysFile}. */
+function loadSigningKeys(workdir: string, signingKeysPath: string): ReadonlyArray<LegacyJwk> {
+  return readSigningKeysFile(workdir, signingKeysPath);
+}
+
+/**
+ * Go's `Auth.SigningKeys` config-load gating (`pkg/config/config.go:1087,1110-
+ * 1116`): `auth.signing_keys_path`'s file is read only when auth is enabled
+ * (the `SUPABASE_AUTH_ENABLED`-overridden value) AND a path is actually
+ * configured. Returns `undefined` in every other case — Go's `Auth.SigningKeys`
+ * then keeps its `NewConfig()`-seeded single default ES256 key
+ * ({@link LEGACY_DEFAULT_SIGNING_KEY}); callers fall back to their own default
+ * instead of this function choosing one, since `legacyResolveLocalJwks` and
+ * `gotrue.service.ts`'s `GOTRUE_JWT_KEYS` each spell their own default slightly
+ * differently (a bare JWKS-shaped key vs. a full `LegacyGotrueSigningKey`).
+ *
+ * Shared by {@link legacyResolveLocalJwks} (the full JWKS document) and
+ * `start.handler.ts`'s `GOTRUE_JWT_KEYS` env (Go's `GOTRUE_JWT_KEYS =
+ * utils.Config.Auth.SigningKeys`) so the two resolvers can never disagree on
+ * which signing key(s) apply — a prerequisite for GoTrue-issued tokens to
+ * verify against the published JWKS at all.
+ */
+export function legacyResolveConfiguredSigningKeys(
+  config: ProjectConfig,
+  workdir: string,
+  projectEnvValues: Readonly<Record<string, string>> | undefined,
+): ReadonlyArray<LegacyJwk> | undefined {
+  const authEnabled = legacyEnvOverrideBool(
+    "SUPABASE_AUTH_ENABLED",
+    config.auth.enabled,
+    "auth.enabled",
+    projectEnvValues,
+  );
+  const signingKeysPath = legacyEnvOverride(
+    "SUPABASE_AUTH_SIGNING_KEYS_PATH",
+    config.auth.signing_keys_path,
+    projectEnvValues,
+  );
+  return authEnabled && signingKeysPath !== undefined && signingKeysPath.length > 0
+    ? loadSigningKeys(workdir, signingKeysPath)
+    : undefined;
+}
+
+/**
+ * Go's `Config.Validate` TLS branch (`pkg/config/config.go:1006-1027`) file reads: gated on
+ * `api.enabled && api.tls.enabled` same as the caller, each configured path is read to confirm
+ * it's actually reachable, matching Go's `fs.ReadFile` calls (Go caches the bytes for `start` to
+ * serve as `CertContent`/`KeyContent` — `status`/`stop` have no use for the bytes, only the same
+ * validation outcome, so they're discarded here). The "exactly one of cert/key set" presence
+ * check now lives in `legacyValidateResolvedConfig`'s `api.tls` step
+ * (`legacy-config-validate.ts`) — this function only runs the reads, and only when BOTH paths
+ * are actually present: neither path set, or only one, never reaches a `fs.ReadFile` call here,
+ * since the presence check (run later, as part of the single consolidated validation call) owns
+ * rejecting the one-but-not-the-other case.
+ *
+ * Go joins both paths unconditionally with the `supabase/` dir — no `filepath.IsAbs` guard
+ * (`config.go:961-965` uses `path.Join`, which absorbs a leading `/`) — unlike
+ * {@link readSigningKeysFile}'s `signing_keys_path`, which Go does guard with `filepath.IsAbs`
+ * (`config.go:928-929`). See `legacyResolveApiTlsPath`. Matches the identical Kong-side
+ * validation already ported for `seed buckets`/`storage` in
+ * `legacy-storage-credentials.ts`'s `validateLocalKongTls`.
+ *
+ * Uses `node:fs` directly for the same reason as {@link readSigningKeysFile}: this stays a plain
+ * synchronous resolver rather than threading the Effect `FileSystem` service through
+ * `legacyStatusValues`/`status.handler.ts`.
+ */
+function readApiTlsFiles(
+  workdir: string,
+  certPath: string | undefined,
+  keyPath: string | undefined,
+): void {
+  if (certPath === undefined || certPath.length === 0) return;
+  if (keyPath === undefined || keyPath.length === 0) return;
+
+  try {
+    readFileSync(legacyResolveApiTlsPath(workdir, certPath), "utf8");
+  } catch (cause) {
+    throw new LegacyConfigValidateError(legacyApiTlsCertReadErrorMessage(cause));
+  }
+  try {
+    readFileSync(legacyResolveApiTlsPath(workdir, keyPath), "utf8");
+  } catch (cause) {
+    throw new LegacyConfigValidateError(legacyApiTlsKeyReadErrorMessage(cause));
+  }
+}
+
+/**
+ * One `[auth.email.template.<name>]` entry, already env-override-resolved. `subject` is
+ * `string | undefined` rather than a plain `string` — see {@link legacyResolveAuthEmail}'s doc
+ * comment for why.
+ */
+interface LegacyResolvedAuthEmailTemplate {
+  readonly subject: string | undefined;
+  readonly content_path: string;
+  readonly content_present: boolean;
+}
+
+/** One `[auth.email.notification.<name>]` entry — see {@link LegacyResolvedAuthEmailTemplate}. */
+interface LegacyResolvedAuthEmailNotification {
+  readonly enabled: boolean;
+  readonly subject: string | undefined;
+  readonly content_path: string;
+  readonly content_present: boolean;
+}
+
+/**
+ * {@link legacyResolveAuthEmail}'s return type — identical to `ProjectConfig["auth"]["email"]`
+ * except each `template`/`notification` entry's `subject` is `string | undefined` instead of a
+ * plain `string`.
+ */
+export type LegacyResolvedAuthEmail = Omit<
+  ProjectConfig["auth"]["email"],
+  "template" | "notification"
+> & {
+  readonly template: Readonly<Record<string, LegacyResolvedAuthEmailTemplate>>;
+  readonly notification: Readonly<Record<string, LegacyResolvedAuthEmailNotification>>;
+};
+
+/**
+ * Go's `Auth.Email` is a value-typed (non-pointer) struct (`pkg/config/auth.go:174,242-253`),
+ * always Viper/`AutomaticEnv`-bound regardless of `[auth.email]` presence in config.toml
+ * (`config.go:580-586`) — same reasoning as {@link resolveGotrueRateLimit}/`resolveGotrueSessions`
+ * in `start.handler.ts`, just hoisted here since `readAuthEmailTemplateContent`'s validation-only
+ * file-read ALSO needs the override-aware `template`/`notification` maps, not just
+ * `start.handler.ts`'s GoTrue env builder — same single-source/two-consumer shape as
+ * {@link legacyResolveAuthExternalProviders}.
+ *
+ * `template`/`notification` THEMSELVES need no raw-document presence gate: they're
+ * `Schema.Record`s (`packages/config/src/auth/email.ts`), which — unlike a fixed-shape struct
+ * with `withDecodingDefaultKey` — only ever contain a key when the TOML section was actually
+ * present, so `Object.entries(email.template)` already reflects presence, matching Go's own
+ * `map[string]emailTemplate`. Each entry's OWN `subject` field is a narrower case, though: Go's
+ * `emailTemplate.Subject` is `*string` (`pkg/config/auth.go:266`), so an explicit `subject = ""`
+ * is a real, non-nil state distinct from an absent key — but both decode to the SAME `""` in
+ * `@supabase/config`'s plain-string schema (`packages/config/src/auth/email.ts`), so `authDocument`
+ * (the raw TOML) is read per-entry to recover which case applies, same as the
+ * `auth.captcha`/`auth.passkey`/`auth.webauthn`/`auth.email.smtp` presence gaps elsewhere in this
+ * file. An env override always wins outright when set (Go's Viper `AutomaticEnv` precedence over
+ * config.toml), regardless of the raw document.
+ *
+ * `start.go:544-558` (Kong `mountEmailTemplates`) and `start.go:668-694,1376-1406` (GoTrue's
+ * mailer/OTP/signup env) both read `utils.Config.Auth.Email.*` post-override — this resolves the
+ * SAME effective value for both `buildKongEmailTemplateMounts` and `resolveGotrueEnvInput` in
+ * `start.handler.ts`.
+ */
+export function legacyResolveAuthEmail(
+  email: ProjectConfig["auth"]["email"],
+  authDocument: Record<string, unknown> | undefined,
+  projectEnvValues: Readonly<Record<string, string>> | undefined,
+): LegacyResolvedAuthEmail {
+  const emailDoc = asRecord(authDocument?.["email"]);
+  const templateDoc = asRecord(emailDoc?.["template"]);
+  const notificationDoc = asRecord(emailDoc?.["notification"]);
+
+  const template: Record<string, LegacyResolvedAuthEmailTemplate> = {};
+  for (const [name, tmpl] of Object.entries(email.template)) {
+    const envPrefix = `SUPABASE_AUTH_EMAIL_TEMPLATE_${name.toUpperCase()}`;
+    const envSubject = legacyEnvOverride(`${envPrefix}_SUBJECT`, undefined, projectEnvValues);
+    const rawSubjectPresent = asRecord(templateDoc?.[name])?.["subject"] !== undefined;
+    template[name] = {
+      subject: envSubject ?? (rawSubjectPresent ? tmpl.subject : undefined),
+      content_path:
+        legacyEnvOverride(`${envPrefix}_CONTENT_PATH`, tmpl.content_path, projectEnvValues) ??
+        tmpl.content_path,
+      // Go's `Content *string` is folded from `${envPrefix}_CONTENT` by the same generic
+      // Viper/`AutomaticEnv` bind as every other field (`config.go:749`, before `Config.Validate`
+      // at `config.go:882`) — so an env override makes `content` "present" here exactly like a raw
+      // TOML `content = "..."` would, and {@link readAuthEmailTemplateContent} rejects it below
+      // unless `content_path` is also set.
+      content_present:
+        asRecord(templateDoc?.[name])?.["content"] !== undefined ||
+        legacyEnvOverride(`${envPrefix}_CONTENT`, undefined, projectEnvValues) !== undefined,
+    };
+  }
+
+  const notification: Record<string, LegacyResolvedAuthEmailNotification> = {};
+  for (const [name, tmpl] of Object.entries(email.notification)) {
+    const envPrefix = `SUPABASE_AUTH_EMAIL_NOTIFICATION_${name.toUpperCase()}`;
+    const envSubject = legacyEnvOverride(`${envPrefix}_SUBJECT`, undefined, projectEnvValues);
+    const rawSubjectPresent = asRecord(notificationDoc?.[name])?.["subject"] !== undefined;
+    notification[name] = {
+      enabled: legacyEnvOverrideBool(
+        `${envPrefix}_ENABLED`,
+        tmpl.enabled,
+        `auth.email.notification.${name}.enabled`,
+        projectEnvValues,
+      ),
+      subject: envSubject ?? (rawSubjectPresent ? tmpl.subject : undefined),
+      content_path:
+        legacyEnvOverride(`${envPrefix}_CONTENT_PATH`, tmpl.content_path, projectEnvValues) ??
+        tmpl.content_path,
+      // Same `_CONTENT` env-presence fold as the template loop above.
+      content_present:
+        asRecord(notificationDoc?.[name])?.["content"] !== undefined ||
+        legacyEnvOverride(`${envPrefix}_CONTENT`, undefined, projectEnvValues) !== undefined,
+    };
+  }
+
+  return {
+    ...email,
+    enable_signup: legacyEnvOverrideBool(
+      "SUPABASE_AUTH_EMAIL_ENABLE_SIGNUP",
+      email.enable_signup,
+      "auth.email.enable_signup",
+      projectEnvValues,
+    ),
+    double_confirm_changes: legacyEnvOverrideBool(
+      "SUPABASE_AUTH_EMAIL_DOUBLE_CONFIRM_CHANGES",
+      email.double_confirm_changes,
+      "auth.email.double_confirm_changes",
+      projectEnvValues,
+    ),
+    enable_confirmations: legacyEnvOverrideBool(
+      "SUPABASE_AUTH_EMAIL_ENABLE_CONFIRMATIONS",
+      email.enable_confirmations,
+      "auth.email.enable_confirmations",
+      projectEnvValues,
+    ),
+    secure_password_change: legacyEnvOverrideBool(
+      "SUPABASE_AUTH_EMAIL_SECURE_PASSWORD_CHANGE",
+      email.secure_password_change,
+      "auth.email.secure_password_change",
+      projectEnvValues,
+    ),
+    max_frequency:
+      legacyEnvOverride(
+        "SUPABASE_AUTH_EMAIL_MAX_FREQUENCY",
+        email.max_frequency,
+        projectEnvValues,
+      ) ?? email.max_frequency,
+    otp_length: legacyEnvOverrideUint(
+      "SUPABASE_AUTH_EMAIL_OTP_LENGTH",
+      "auth.email.otp_length",
+      email.otp_length,
+      projectEnvValues,
+    ),
+    otp_expiry: legacyEnvOverrideUint(
+      "SUPABASE_AUTH_EMAIL_OTP_EXPIRY",
+      "auth.email.otp_expiry",
+      email.otp_expiry,
+      projectEnvValues,
+    ),
+    template,
+    notification,
+  };
+}
+
+/**
+ * Go's `(e *email) validate(fsys)` template/notification content read (`pkg/config/
+ * config.go:1293-1313`), called from `Config.Validate` right after `Auth.MFA.validate()`, still
+ * inside `if c.Auth.Enabled` (`config.go:1142`). Every template is checked unconditionally; a
+ * notification only when that notification is itself enabled (`config.go:1308`). Uses the same
+ * `readFileSync`-based pattern as {@link readSigningKeysFile}/`readApiTlsFiles` in this file,
+ * not an Effect `FileSystem` service.
+ *
+ * The `content`-vs-`content_path` exclusivity decision and path resolution (including the
+ * TEMPLATE-vs-`workdir`/NOTIFICATION-vs-`<workdir>/supabase` base asymmetry, per Go's `(c
+ * *baseConfig) resolve` (`config.go:900-916`) — this asymmetry is real, intentional Go behavior
+ * to match, not a bug to fix) now live in `legacyResolveEmailTemplateContentPath`
+ * (`legacy-config-validate.ts`); this function only feeds it each entry's already-resolved
+ * `content_present` (see {@link legacyResolveAuthEmail}, which folds both the raw TOML `content`
+ * key AND a `${envPrefix}_CONTENT` env override into that flag) and performs the read when a path
+ * comes back.
+ *
+ * Takes the ALREADY env-override-resolved `email` (from {@link legacyResolveAuthEmail}) so this
+ * only performs the file-existence read, matching the other validators' "resolve once, validate
+ * the resolved value" shape.
+ */
+function readAuthEmailTemplateContent(email: LegacyResolvedAuthEmail, workdir: string): void {
+  for (const [name, tmpl] of Object.entries(email.template)) {
+    const path = legacyResolveEmailTemplateContentPath({
+      section: "template",
+      name,
+      contentPath: tmpl.content_path,
+      contentPresent: tmpl.content_present,
+      base: workdir,
+    });
+    if (path === undefined) continue;
+    try {
+      readFileSync(path, "utf8");
+    } catch (cause) {
+      throw new LegacyConfigValidateError(
+        legacyEmailContentPathReadErrorMessage("template", name, cause),
+      );
+    }
+  }
+  for (const [name, tmpl] of Object.entries(email.notification)) {
+    if (!tmpl.enabled) continue;
+    const path = legacyResolveEmailTemplateContentPath({
+      section: "notification",
+      name,
+      contentPath: tmpl.content_path,
+      contentPresent: tmpl.content_present,
+      base: join(workdir, "supabase"),
+    });
+    if (path === undefined) continue;
+    try {
+      readFileSync(path, "utf8");
+    } catch (cause) {
+      throw new LegacyConfigValidateError(
+        legacyEmailContentPathReadErrorMessage("notification", name, cause),
+      );
+    }
+  }
+}
+
+// Go's decode-time overflow bound for every field routed through {@link legacyEnvOverrideUint}:
+// they are all plain Go `uint`, 64 bits wide on every platform this CLI ships for (amd64/arm64),
+// decoded via mapstructure's `decodeUint` under Viper's default `WeaklyTypedInput: true`
+// (`strconv.ParseUint(str, 0, 64)` — `viper.go:988` sets the flag, `config.go:749` never
+// overrides it). `BigInt`, not `Number`, comparison: a JS `Number` can't exactly represent values
+// this close to `2^64`, so a `Number.MAX_SAFE_INTEGER`-based check would incorrectly reject
+// legitimate large `uint64` values Go itself still accepts.
+const LEGACY_UINT_MAX = 18446744073709551615n; // 2^64 - 1
+
+/**
+ * Go-style base-0 unsigned integer literal parsing, matching `strconv.ParseUint(str, 0, bitSize)`
+ * — the same call {@link legacyEnvOverrideUint}'s callers all decode through (`mapstructure.go:791`,
+ * `decodeUint`). Base 0 auto-detects from a prefix: `0b`/`0B` → binary, `0o`/`0O` → octal, `0x`/`0X`
+ * → hex, and a BARE leading `0` followed by more digits is ALSO octal (so `"010"` parses as `8`, not
+ * `10` — a real footgun for a user zero-padding a value expecting decimal semantics). Underscores
+ * are permitted between digits (Go 1.13+, e.g. `"1_000"`), but ONLY in base-0 mode. `ParseUint`
+ * never accepts a leading `+`/`-` sign (unlike `ParseInt`) — verified against a real Go binary
+ * across prefix casing, underscore placement, invalid-octal-digit rejection (`"08"`/`"09"` do NOT
+ * fall back to decimal — Go rejects them outright), and sign rejection. Returns `undefined` (not a
+ * thrown error) for anything that isn't a valid literal, so the caller can produce its own
+ * consistently-shaped error message; deliberately does NOT bound-check the result against any
+ * particular bit width — that stays the caller's job (see {@link LEGACY_UINT_MAX}), matching
+ * `strconv.ParseUint`'s own separation of "parse the literal" from "does it fit in `bitSize` bits".
+ */
+function parseGoBaseZeroUint(value: string): bigint | undefined {
+  if (value.length === 0 || value.startsWith("+") || value.startsWith("-")) return undefined;
+
+  let literal: string | undefined;
+  if (/^0[bB](_?[01])+$/.test(value)) {
+    literal = `0b${value.slice(2).replaceAll("_", "")}`;
+  } else if (/^0[oO](_?[0-7])+$/.test(value)) {
+    literal = `0o${value.slice(2).replaceAll("_", "")}`;
+  } else if (/^0[xX](_?[0-9a-fA-F])+$/.test(value)) {
+    literal = `0x${value.slice(2).replaceAll("_", "")}`;
+  } else if (value.startsWith("0") && value.length > 1) {
+    // Go's default branch for a bare leading zero: always octal, with no fallback to decimal even
+    // when a later digit isn't valid octal (`"08"`/`"09"` are rejected, not read as decimal 8/9).
+    literal = /^[0-7](_?[0-7])*$/.test(value) ? `0o${value.replaceAll("_", "")}` : undefined;
+  } else {
+    literal = /^[0-9](_?[0-9])*$/.test(value) ? value.replaceAll("_", "") : undefined;
+  }
+  if (literal === undefined) return undefined;
+
+  try {
+    // `BigInt(...)` natively parses `0b`/`0o`/`0x`-prefixed string literals in the corresponding
+    // base — exactly the normalized, underscore-free literal built above.
+    return BigInt(literal);
+  } catch {
+    return undefined;
+  }
+}
+
+/**
+ * `SUPABASE_<NAME>` sibling of {@link legacyEnvOverridePort} for `uint`-typed config
+ * fields with no upper-bound cap (`db.major_version`, `edge_runtime.
+ * deno_version`, `auth.jwt_expiry`, `auth.refresh_token_reuse_interval`,
+ * `auth.minimum_password_length`, …) — same generic Viper `AutomaticEnv`
+ * binding (`config.go:576-586`), same mapstructure hard-fail-on-bad-value
+ * semantics as the capped `uint16` port fields, but without `MAX_PORT`. Parses
+ * with {@link parseGoBaseZeroUint} (Go's base-0 grammar — hex/octal/binary
+ * prefixes and a bare leading zero all parse differently than plain decimal),
+ * not plain decimal, since Go's own decode does the same. A non-parsing or
+ * out-of-{@link LEGACY_UINT_MAX} override folds into the same generic
+ * "Invalid <field>" message `legacyValidateResolvedConfig` produces for an
+ * out-of-set numeric value, since Go's own decode failure and `Validate`
+ * failure for these fields aren't independently distinguishable from the
+ * CLI's output the way ports/bools are.
+ */
+export function legacyEnvOverrideUint(
+  name: string,
+  dottedFieldPath: string,
+  configured: number,
+  projectEnvValues: Readonly<Record<string, string>> | undefined,
+): number {
+  const value = legacyEnvOverride(name, undefined, projectEnvValues);
+  if (value === undefined) return configured;
+  const parsed = parseGoBaseZeroUint(value);
+  if (parsed === undefined || parsed > LEGACY_UINT_MAX) {
+    throw new Error(`Failed reading config: Invalid ${dottedFieldPath}: ${value}.`);
+  }
+  return Number(parsed);
+}
+
+/** `SUPABASE_DB_MAJOR_VERSION` — see {@link legacyEnvOverrideUint}. */
+export function legacyEnvOverrideMajorVersion(
+  configured: number,
+  projectEnvValues: Readonly<Record<string, string>> | undefined,
+): number {
+  return legacyEnvOverrideUint(
+    "SUPABASE_DB_MAJOR_VERSION",
+    "db.major_version",
+    configured,
+    projectEnvValues,
+  );
+}
+
+/** `SUPABASE_EDGE_RUNTIME_DENO_VERSION` — see {@link legacyEnvOverrideUint}. */
+export function legacyEnvOverrideDenoVersion(
+  configured: number,
+  projectEnvValues: Readonly<Record<string, string>> | undefined,
+): number {
+  return legacyEnvOverrideUint(
+    "SUPABASE_EDGE_RUNTIME_DENO_VERSION",
+    "edge_runtime.deno_version",
+    configured,
+    projectEnvValues,
+  );
+}
+
+/**
+ * Optional-uint sibling of {@link legacyEnvOverrideUint} for `db.settings.*` number
+ * fields (`max_connections`, `max_wal_senders`, …) — each one is a genuine Go
+ * nil pointer (`*uint`) when unset in `config.toml`, unlike `db.major_version`/
+ * `edge_runtime.deno_version`, which always have a real default. `configured`
+ * (and the return value) stay `number | undefined` to preserve that
+ * "not configured" state through an override miss, matching Go's nil pointer
+ * staying nil when no `SUPABASE_DB_SETTINGS_*` override is set either.
+ */
+function envOverrideOptionalUint(
+  name: string,
+  dottedFieldPath: string,
+  configured: number | undefined,
+  projectEnvValues: Readonly<Record<string, string>> | undefined,
+): number | undefined {
+  const value = legacyEnvOverride(name, undefined, projectEnvValues);
+  if (value === undefined) return configured;
+  if (!/^\d+$/.test(value)) {
+    throw new Error(`Failed reading config: Invalid ${dottedFieldPath}: ${value}.`);
+  }
+  return Number(value);
+}
+
+/**
+ * Optional-bool sibling of {@link legacyEnvOverrideBool} for
+ * `db.settings.track_commit_timestamp` — a genuine Go nil pointer (`*bool`)
+ * when unset, unlike every other bool this file overrides (all of which have
+ * a real default and can never be "not configured").
+ */
+function legacyEnvOverrideOptionalBool(
+  name: string,
+  configured: boolean | undefined,
+  dottedFieldPath: string,
+  projectEnvValues: Readonly<Record<string, string>> | undefined,
+): boolean | undefined {
+  const value = legacyEnvOverride(name, undefined, projectEnvValues);
+  if (value === undefined) return configured;
+  const parsed = legacyParseGoBool(value);
+  if (parsed === undefined) {
+    throw new LegacyInvalidBoolEnvOverrideError(dottedFieldPath, value);
+  }
+  return parsed;
+}
+
+/**
+ * Thrown by {@link legacyResolveDbSettingsEnvOverrides} when
+ * `SUPABASE_DB_SETTINGS_SESSION_REPLICATION_ROLE` doesn't match Go's
+ * `SessionReplicationRole` (`pkg/config/db.go:29-43`) — `UnmarshalText`
+ * hard-rejects anything outside `{origin, replica, local}`, same mechanism as
+ * {@link LegacyInvalidAnalyticsBackendEnvOverrideError}/
+ * {@link LegacyInvalidRealtimeIpVersionEnvOverrideError}.
+ */
+export class LegacyInvalidSessionReplicationRoleEnvOverrideError extends Error {
+  constructor(dottedFieldPath: string, value: string) {
+    super(
+      `Invalid config for ${dottedFieldPath}: cannot parse "${value}" as one of "origin", "replica", "local"`,
+    );
+    this.name = "LegacyInvalidSessionReplicationRoleEnvOverrideError";
+  }
+}
+
+/**
+ * `db.settings.session_replication_role`-flavored sibling of
+ * {@link envOverrideAnalyticsBackend}/{@link legacyEnvOverrideRealtimeIpVersion}
+ * — the one `db.settings.*` field Go decodes as a text-unmarshalled enum
+ * rather than a string/number/bool. Unlike those two siblings, `configured`
+ * (and the return value) may genuinely be `undefined` (Go's nil pointer, "not
+ * configured" — never written to `postgresql.conf`), so validation only runs
+ * once the merged override-or-configured value is actually present.
+ */
+function legacyEnvOverrideSessionReplicationRole(
+  configured: string | undefined,
+  projectEnvValues: Readonly<Record<string, string>> | undefined,
+): "origin" | "replica" | "local" | undefined {
+  const value = legacyEnvOverride(
+    "SUPABASE_DB_SETTINGS_SESSION_REPLICATION_ROLE",
+    configured,
+    projectEnvValues,
+  );
+  if (value === undefined) return undefined;
+  if (value !== "origin" && value !== "replica" && value !== "local") {
+    throw new LegacyInvalidSessionReplicationRoleEnvOverrideError(
+      "db.settings.session_replication_role",
+      value,
+    );
+  }
+  return value;
+}
+
+/**
+ * Go's `Config.Load` applies every `SUPABASE_DB_SETTINGS_*` override
+ * generically (Viper's `AutomaticEnv`, `pkg/config/config.go:576-586`) before
+ * `(a *settings) ToPostgresConfig()` (`pkg/config/db.go:181-190`) ever
+ * serializes `db.settings` into `postgresql.conf` — so an override for, say,
+ * `shared_buffers` changes what Go actually configures Postgres with. This
+ * resolves all 23 `db.settings.*` sub-fields (`packages/config/src/db.ts`) to
+ * their env-overridden value, for `legacyPostgresSettingsToPostgresConfig` to
+ * serialize — mirroring the `db.port`/`db.major_version`-style fix already
+ * applied at this same `start` call site, just fanned out across every
+ * `[db.settings]` field instead of one.
+ */
+export function legacyResolveDbSettingsEnvOverrides(
+  settings: ProjectConfig["db"]["settings"],
+  projectEnvValues: Readonly<Record<string, string>> | undefined,
+): NonNullable<ProjectConfig["db"]["settings"]> {
+  return {
+    effective_cache_size: legacyEnvOverride(
+      "SUPABASE_DB_SETTINGS_EFFECTIVE_CACHE_SIZE",
+      settings?.effective_cache_size,
+      projectEnvValues,
+    ),
+    logical_decoding_work_mem: legacyEnvOverride(
+      "SUPABASE_DB_SETTINGS_LOGICAL_DECODING_WORK_MEM",
+      settings?.logical_decoding_work_mem,
+      projectEnvValues,
+    ),
+    maintenance_work_mem: legacyEnvOverride(
+      "SUPABASE_DB_SETTINGS_MAINTENANCE_WORK_MEM",
+      settings?.maintenance_work_mem,
+      projectEnvValues,
+    ),
+    max_connections: envOverrideOptionalUint(
+      "SUPABASE_DB_SETTINGS_MAX_CONNECTIONS",
+      "db.settings.max_connections",
+      settings?.max_connections,
+      projectEnvValues,
+    ),
+    max_locks_per_transaction: envOverrideOptionalUint(
+      "SUPABASE_DB_SETTINGS_MAX_LOCKS_PER_TRANSACTION",
+      "db.settings.max_locks_per_transaction",
+      settings?.max_locks_per_transaction,
+      projectEnvValues,
+    ),
+    max_parallel_maintenance_workers: envOverrideOptionalUint(
+      "SUPABASE_DB_SETTINGS_MAX_PARALLEL_MAINTENANCE_WORKERS",
+      "db.settings.max_parallel_maintenance_workers",
+      settings?.max_parallel_maintenance_workers,
+      projectEnvValues,
+    ),
+    max_parallel_workers: envOverrideOptionalUint(
+      "SUPABASE_DB_SETTINGS_MAX_PARALLEL_WORKERS",
+      "db.settings.max_parallel_workers",
+      settings?.max_parallel_workers,
+      projectEnvValues,
+    ),
+    max_parallel_workers_per_gather: envOverrideOptionalUint(
+      "SUPABASE_DB_SETTINGS_MAX_PARALLEL_WORKERS_PER_GATHER",
+      "db.settings.max_parallel_workers_per_gather",
+      settings?.max_parallel_workers_per_gather,
+      projectEnvValues,
+    ),
+    max_replication_slots: envOverrideOptionalUint(
+      "SUPABASE_DB_SETTINGS_MAX_REPLICATION_SLOTS",
+      "db.settings.max_replication_slots",
+      settings?.max_replication_slots,
+      projectEnvValues,
+    ),
+    max_slot_wal_keep_size: legacyEnvOverride(
+      "SUPABASE_DB_SETTINGS_MAX_SLOT_WAL_KEEP_SIZE",
+      settings?.max_slot_wal_keep_size,
+      projectEnvValues,
+    ),
+    max_standby_archive_delay: legacyEnvOverride(
+      "SUPABASE_DB_SETTINGS_MAX_STANDBY_ARCHIVE_DELAY",
+      settings?.max_standby_archive_delay,
+      projectEnvValues,
+    ),
+    max_standby_streaming_delay: legacyEnvOverride(
+      "SUPABASE_DB_SETTINGS_MAX_STANDBY_STREAMING_DELAY",
+      settings?.max_standby_streaming_delay,
+      projectEnvValues,
+    ),
+    max_wal_size: legacyEnvOverride(
+      "SUPABASE_DB_SETTINGS_MAX_WAL_SIZE",
+      settings?.max_wal_size,
+      projectEnvValues,
+    ),
+    max_wal_senders: envOverrideOptionalUint(
+      "SUPABASE_DB_SETTINGS_MAX_WAL_SENDERS",
+      "db.settings.max_wal_senders",
+      settings?.max_wal_senders,
+      projectEnvValues,
+    ),
+    max_worker_processes: envOverrideOptionalUint(
+      "SUPABASE_DB_SETTINGS_MAX_WORKER_PROCESSES",
+      "db.settings.max_worker_processes",
+      settings?.max_worker_processes,
+      projectEnvValues,
+    ),
+    session_replication_role: legacyEnvOverrideSessionReplicationRole(
+      settings?.session_replication_role,
+      projectEnvValues,
+    ),
+    shared_buffers: legacyEnvOverride(
+      "SUPABASE_DB_SETTINGS_SHARED_BUFFERS",
+      settings?.shared_buffers,
+      projectEnvValues,
+    ),
+    statement_timeout: legacyEnvOverride(
+      "SUPABASE_DB_SETTINGS_STATEMENT_TIMEOUT",
+      settings?.statement_timeout,
+      projectEnvValues,
+    ),
+    track_activity_query_size: legacyEnvOverride(
+      "SUPABASE_DB_SETTINGS_TRACK_ACTIVITY_QUERY_SIZE",
+      settings?.track_activity_query_size,
+      projectEnvValues,
+    ),
+    track_commit_timestamp: legacyEnvOverrideOptionalBool(
+      "SUPABASE_DB_SETTINGS_TRACK_COMMIT_TIMESTAMP",
+      settings?.track_commit_timestamp,
+      "db.settings.track_commit_timestamp",
+      projectEnvValues,
+    ),
+    wal_keep_size: legacyEnvOverride(
+      "SUPABASE_DB_SETTINGS_WAL_KEEP_SIZE",
+      settings?.wal_keep_size,
+      projectEnvValues,
+    ),
+    wal_sender_timeout: legacyEnvOverride(
+      "SUPABASE_DB_SETTINGS_WAL_SENDER_TIMEOUT",
+      settings?.wal_sender_timeout,
+      projectEnvValues,
+    ),
+    work_mem: legacyEnvOverride(
+      "SUPABASE_DB_SETTINGS_WORK_MEM",
+      settings?.work_mem,
+      projectEnvValues,
+    ),
+  };
+}
+
+/** Go's `password_requirements` fixed enum (`@supabase/config`'s `packages/config/src/auth/index.ts`). */
+const LEGACY_PASSWORD_REQUIREMENTS_VALUES = new Set([
+  "",
+  "letters_digits",
+  "lower_upper_letters_digits",
+  "lower_upper_letters_digits_symbols",
+]);
+
+/** Narrows an unknown value to a plain object, mirroring `legacy-db-config.toml-read.ts`'s `asRecord`. */
+function asRecord(value: unknown): Record<string, unknown> | undefined {
+  return typeof value === "object" && value !== null && !Array.isArray(value)
+    ? (value as Record<string, unknown>)
+    : undefined;
+}
+
+/** Go's `hook.validate()` hook-type iteration order (`pkg/config/config.go:1453-1485`), used
+ * only to build {@link legacyResolveLocalConfigValues}'s `hooks` input in the right order —
+ * the actual per-hook validation now lives in `legacyValidateResolvedConfig`. */
+const LEGACY_HOOK_TYPE_ORDER = [
+  "mfa_verification_attempt",
+  "password_verification_attempt",
+  "custom_access_token",
+  "send_sms",
+  "send_email",
+  "before_user_created",
+] as const;
+
+/** camelCase key {@link legacyResolveAuthHooks} exposes per {@link LEGACY_HOOK_TYPE_ORDER} entry — matches `LegacyBuildGotrueEnvInput.hooks`'s field names (`gotrue.service.ts`). */
+const LEGACY_HOOK_TYPE_TO_CAMEL = {
+  mfa_verification_attempt: "mfaVerificationAttempt",
+  password_verification_attempt: "passwordVerificationAttempt",
+  custom_access_token: "customAccessToken",
+  send_sms: "sendSms",
+  send_email: "sendEmail",
+  before_user_created: "beforeUserCreated",
+} as const satisfies Record<(typeof LEGACY_HOOK_TYPE_ORDER)[number], string>;
+
+interface LegacyResolvedAuthHook {
+  readonly enabled: boolean;
+  readonly uri: string;
+  readonly secrets: string;
+}
+
+export type LegacyResolvedAuthHooks = {
+  readonly [K in (typeof LEGACY_HOOK_TYPE_TO_CAMEL)[keyof typeof LEGACY_HOOK_TYPE_TO_CAMEL]]: LegacyResolvedAuthHook;
+};
+
+/**
+ * Go's `hook.validate()` fixed iteration order (`pkg/config/config.go:1453-1485`).
+ * `auth.hook.<type>.*` is Viper-bound like every other nested field
+ * (`ExperimentalBindStruct`/`AutomaticEnv`, `config.go:581-586`), so
+ * `SUPABASE_AUTH_HOOK_<TYPE>_ENABLED`/`_URI`/`_SECRETS` overrides apply before
+ * Go builds `GOTRUE_HOOK_*` (`internal/start/start.go:746-792`) — Go has no
+ * separate "raw" vs. "effective" hook value, so a hook enabled/retargeted
+ * purely through env vars must reach GoTrue too, not just validation.
+ * `@supabase/config`'s hook schema always decodes a `{ enabled: false }`
+ * default per type regardless of file presence (`packages/config/src/auth/
+ * hooks.ts`'s `withDecodingDefaultKey`), which erases the presence signal
+ * Go's `AutomaticEnv` needs (it only intercepts keys already present in the
+ * merged config) — so, like the passkey/webauthn/captcha overrides, this
+ * reads the raw `[auth.hook.<type>]` document to gate the override on the
+ * section actually being present.
+ *
+ * Hoisted (like {@link legacyResolveAuthEmailSmtp}/{@link legacyResolveAuthCaptcha})
+ * so both `legacyResolveLocalConfigValues` (which derives its filtered,
+ * enabled-only `LegacyHookInput[]` for `Config.Validate` parity from this same
+ * unfiltered result) and `start.handler.ts`'s `resolveGotrueEnvInput` (the
+ * actual GoTrue env) resolve the SAME effective values.
+ */
+export function legacyResolveAuthHooks(
+  authDocument: Readonly<Record<string, unknown>> | undefined,
+  hook: ProjectConfig["auth"]["hook"],
+  projectEnvValues: Readonly<Record<string, string>> | undefined,
+): LegacyResolvedAuthHooks {
+  const hookDocument = asRecord(authDocument?.["hook"]);
+  const result = {} as Record<string, LegacyResolvedAuthHook>;
+  for (const hookType of LEGACY_HOOK_TYPE_ORDER) {
+    const h = hook[hookType];
+    const hookSectionPresent = asRecord(hookDocument?.[hookType]) !== undefined;
+    const envPrefix = `SUPABASE_AUTH_HOOK_${hookType.toUpperCase()}`;
+    const enabled = hookSectionPresent
+      ? legacyEnvOverrideBool(
+          `${envPrefix}_ENABLED`,
+          h.enabled,
+          `auth.hook.${hookType}.enabled`,
+          projectEnvValues,
+        )
+      : h.enabled;
+    const uri =
+      (hookSectionPresent
+        ? legacyEnvOverride(`${envPrefix}_URI`, h.uri, projectEnvValues)
+        : h.uri) ?? "";
+    const secrets =
+      (hookSectionPresent
+        ? legacyEnvOverride(`${envPrefix}_SECRETS`, h.secrets, projectEnvValues)
+        : h.secrets) ?? "";
+    result[LEGACY_HOOK_TYPE_TO_CAMEL[hookType]] = { enabled, uri, secrets };
+  }
+  return result as LegacyResolvedAuthHooks;
+}
+
+/**
+ * Go's `Auth.MFA` factor fields (`TOTP`/`Phone`/`WebAuthn`) are value-typed
+ * structs (`pkg/config/auth.go:317-321`), never `nil` — unlike `Auth.Hook`'s
+ * pointer-typed fields above, Viper's `AutomaticEnv` always binds to them
+ * regardless of whether `[auth.mfa.<factor>]` is present in config.toml, so
+ * `SUPABASE_AUTH_MFA_*` overrides always apply before `Auth.MFA.validate()`
+ * runs (`config.go:1523-1534`) — no raw-document presence gate needed, unlike
+ * hooks/smtp above.
+ *
+ * Hoisted (like {@link legacyResolveAuthHooks}/{@link legacyResolveAuthCaptcha})
+ * so both `legacyResolveLocalConfigValues` (which derives its `enrollEnabled`/
+ * `verifyEnabled` pairs for `Config.Validate` parity from this same unfiltered
+ * result) and `start.handler.ts`'s `resolveGotrueEnvInput` (the actual GoTrue
+ * env) resolve the SAME effective values.
+ */
+export function legacyResolveAuthMfa(
+  mfa: ProjectConfig["auth"]["mfa"],
+  projectEnvValues: Readonly<Record<string, string>> | undefined,
+): ProjectConfig["auth"]["mfa"] {
+  return {
+    totp: {
+      enroll_enabled: legacyEnvOverrideBool(
+        "SUPABASE_AUTH_MFA_TOTP_ENROLL_ENABLED",
+        mfa.totp.enroll_enabled,
+        "auth.mfa.totp.enroll_enabled",
+        projectEnvValues,
+      ),
+      verify_enabled: legacyEnvOverrideBool(
+        "SUPABASE_AUTH_MFA_TOTP_VERIFY_ENABLED",
+        mfa.totp.verify_enabled,
+        "auth.mfa.totp.verify_enabled",
+        projectEnvValues,
+      ),
+    },
+    phone: {
+      enroll_enabled: legacyEnvOverrideBool(
+        "SUPABASE_AUTH_MFA_PHONE_ENROLL_ENABLED",
+        mfa.phone.enroll_enabled,
+        "auth.mfa.phone.enroll_enabled",
+        projectEnvValues,
+      ),
+      verify_enabled: legacyEnvOverrideBool(
+        "SUPABASE_AUTH_MFA_PHONE_VERIFY_ENABLED",
+        mfa.phone.verify_enabled,
+        "auth.mfa.phone.verify_enabled",
+        projectEnvValues,
+      ),
+      otp_length: legacyEnvOverrideUint(
+        "SUPABASE_AUTH_MFA_PHONE_OTP_LENGTH",
+        "auth.mfa.phone.otp_length",
+        mfa.phone.otp_length,
+        projectEnvValues,
+      ),
+      template:
+        legacyEnvOverride(
+          "SUPABASE_AUTH_MFA_PHONE_TEMPLATE",
+          mfa.phone.template,
+          projectEnvValues,
+        ) ?? mfa.phone.template,
+      max_frequency:
+        legacyEnvOverride(
+          "SUPABASE_AUTH_MFA_PHONE_MAX_FREQUENCY",
+          mfa.phone.max_frequency,
+          projectEnvValues,
+        ) ?? mfa.phone.max_frequency,
+    },
+    web_authn: {
+      enroll_enabled: legacyEnvOverrideBool(
+        "SUPABASE_AUTH_MFA_WEB_AUTHN_ENROLL_ENABLED",
+        mfa.web_authn.enroll_enabled,
+        "auth.mfa.web_authn.enroll_enabled",
+        projectEnvValues,
+      ),
+      verify_enabled: legacyEnvOverrideBool(
+        "SUPABASE_AUTH_MFA_WEB_AUTHN_VERIFY_ENABLED",
+        mfa.web_authn.verify_enabled,
+        "auth.mfa.web_authn.verify_enabled",
+        projectEnvValues,
+      ),
+    },
+    max_enrolled_factors: legacyEnvOverrideUint(
+      "SUPABASE_AUTH_MFA_MAX_ENROLLED_FACTORS",
+      "auth.mfa.max_enrolled_factors",
+      mfa.max_enrolled_factors,
+      projectEnvValues,
+    ),
+  };
+}
+
+/** Go's `(s *sms) validate()` fixed provider priority (`pkg/config/config.go:1348-1410`) — a
+ * `switch` that validates ONLY the first enabled provider in this order. */
+const LEGACY_SMS_PROVIDER_ORDER = [
+  "twilio",
+  "twilio_verify",
+  "messagebird",
+  "textlocal",
+  "vonage",
+] as const;
+
+/**
+ * Go's `Auth.Sms.<provider>.*` is Viper-bound like every other nested field once
+ * `[auth.sms.<provider>]` is present in config.toml (`ExperimentalBindStruct`/`AutomaticEnv`,
+ * `config.go:581-586`), so `SUPABASE_AUTH_SMS_<PROVIDER>_ENABLED`/`_<FIELD>` overrides must reach
+ * GoTrue's actual container env (`start.go:696-733`), not just `Config.Validate` — same
+ * "validates but doesn't use" gap already fixed for `auth.hook`/`auth.captcha`/`auth.external`/
+ * `auth.mfa`. Hoisted so both {@link validateAuthSmsProviders} and `start.handler.ts`'s
+ * `resolveGotrueEnvInput` resolve the SAME effective per-provider values — same precedent as
+ * {@link legacyResolveAuthExternalProviders}.
+ *
+ * Presence-gated per provider (the raw `[auth.sms.<provider>]` table must exist), matching
+ * `AutomaticEnv`'s "only intercepts keys already present in the merged config" behavior — same
+ * gate {@link validateAuthSmsProviders} used before this was hoisted out of it. `twilio` is the
+ * one exception: Go's ejected default `config.toml` (`pkg/config/templates/config.toml:288-293`)
+ * unconditionally emits an UNCOMMENTED `[auth.sms.twilio]` table, merged into Viper
+ * (`mergeDefaultValues`, `config.go:690-698`) before the user's own file — so `auth.sms.twilio.*`
+ * is always registered with Viper and `SUPABASE_AUTH_SMS_TWILIO_*` overrides apply with no
+ * user-declared table, confirmed empirically against the real Go binary. The other 4 providers get
+ * no default template entry at all (not even commented out), so they keep the presence gate. When
+ * a (non-twilio) provider's table is absent, its decoded (schema-default) values pass through
+ * unchanged, still decrypting
+ * the one `config.Secret`-typed field per provider (`pkg/config/auth.go:339,345,351,358`) for
+ * parity with this function's (now-superseded) `resolveGotrueSms` precursor, which decrypted all
+ * 5 providers unconditionally.
+ *
+ * The 4 top-level scalars (`enable_signup`/`enable_confirmations`/`template`/`max_frequency`,
+ * `pkg/config/auth.go:277-288`) get NO presence gate, unlike the providers above — they're
+ * unconditionally emitted (uncommented) in Go's ejected default config.toml
+ * (`pkg/config/templates/config.toml:257-265`), so `mergeDefaultValues` always registers them
+ * with Viper regardless of whether the user's own config.toml even has an `[auth.sms]` section,
+ * same reasoning already applied to `legacyResolveAuthEmail`'s scalars. `test_otp` (a
+ * `map[string]string`) is deliberately left unresolved: it's commented out of Go's default
+ * template, so Viper never knows the key by default, and Go has no `SUPABASE_AUTH_SMS_TEST_OTP*`
+ * env var at all — `ExperimentalBindStruct` binds static struct fields, not arbitrary map keys.
+ */
+export function legacyResolveAuthSms(
+  authDocument: Readonly<Record<string, unknown>> | undefined,
+  sms: ProjectConfig["auth"]["sms"],
+  projectEnvValues: Readonly<Record<string, string>> | undefined,
+): ProjectConfig["auth"]["sms"] {
+  const smsDoc = asRecord(authDocument?.["sms"]);
+
+  function providerPresent(providerName: (typeof LEGACY_SMS_PROVIDER_ORDER)[number]): boolean {
+    // `twilio` is always considered present — see this function's doc comment.
+    if (providerName === "twilio") return true;
+    return smsDoc !== undefined && asRecord(smsDoc[providerName]) !== undefined;
+  }
+
+  function resolveEnabled(
+    providerName: (typeof LEGACY_SMS_PROVIDER_ORDER)[number],
+    configured: boolean,
+  ): boolean {
+    if (!providerPresent(providerName)) return configured;
+    return legacyEnvOverrideBool(
+      `SUPABASE_AUTH_SMS_${providerName.toUpperCase()}_ENABLED`,
+      configured,
+      `auth.sms.${providerName}.enabled`,
+      projectEnvValues,
+    );
+  }
+
+  function resolveField(
+    providerName: (typeof LEGACY_SMS_PROVIDER_ORDER)[number],
+    field: string,
+    configured: string | undefined,
+  ): string | undefined {
+    if (!providerPresent(providerName)) return configured;
+    return legacyEnvOverride(
+      `SUPABASE_AUTH_SMS_${providerName.toUpperCase()}_${field.toUpperCase()}`,
+      configured,
+      projectEnvValues,
+    );
+  }
+
+  const twilioEnabled = resolveEnabled("twilio", sms.twilio.enabled);
+  const twilioVerifyEnabled = resolveEnabled("twilio_verify", sms.twilio_verify.enabled);
+  const messagebirdEnabled = resolveEnabled("messagebird", sms.messagebird.enabled);
+  const textlocalEnabled = resolveEnabled("textlocal", sms.textlocal.enabled);
+  const vonageEnabled = resolveEnabled("vonage", sms.vonage.enabled);
+  const anyProviderEnabled =
+    twilioEnabled || twilioVerifyEnabled || messagebirdEnabled || textlocalEnabled || vonageEnabled;
+  const enableSignupConfigured = legacyEnvOverrideBool(
+    "SUPABASE_AUTH_SMS_ENABLE_SIGNUP",
+    sms.enable_signup,
+    "auth.sms.enable_signup",
+    projectEnvValues,
+  );
+
+  return {
+    ...sms,
+    // Go's `(s *sms) validate()` (`config.go:1348-1416`) takes the `case s.EnableSignup:` switch
+    // branch — reached only when every named provider above is disabled — and mutates
+    // `EnableSignup = false` before `buildGotrueEnv` ever reads it, so phone signup is never
+    // enabled with no provider configured to actually deliver an OTP.
+    enable_signup: anyProviderEnabled ? enableSignupConfigured : false,
+    enable_confirmations: legacyEnvOverrideBool(
+      "SUPABASE_AUTH_SMS_ENABLE_CONFIRMATIONS",
+      sms.enable_confirmations,
+      "auth.sms.enable_confirmations",
+      projectEnvValues,
+    ),
+    template:
+      legacyEnvOverride("SUPABASE_AUTH_SMS_TEMPLATE", sms.template, projectEnvValues) ??
+      sms.template,
+    max_frequency:
+      legacyEnvOverride("SUPABASE_AUTH_SMS_MAX_FREQUENCY", sms.max_frequency, projectEnvValues) ??
+      sms.max_frequency,
+    twilio: {
+      enabled: twilioEnabled,
+      account_sid: resolveField("twilio", "account_sid", sms.twilio.account_sid) ?? "",
+      message_service_sid:
+        resolveField("twilio", "message_service_sid", sms.twilio.message_service_sid) ?? "",
+      auth_token: legacyDecryptAuthSecret(
+        resolveField("twilio", "auth_token", sms.twilio.auth_token),
+        projectEnvValues,
+      ),
+    },
+    twilio_verify: {
+      enabled: twilioVerifyEnabled,
+      account_sid: resolveField("twilio_verify", "account_sid", sms.twilio_verify.account_sid),
+      message_service_sid: resolveField(
+        "twilio_verify",
+        "message_service_sid",
+        sms.twilio_verify.message_service_sid,
+      ),
+      auth_token: legacyDecryptAuthSecret(
+        resolveField("twilio_verify", "auth_token", sms.twilio_verify.auth_token),
+        projectEnvValues,
+      ),
+    },
+    messagebird: {
+      enabled: messagebirdEnabled,
+      originator: resolveField("messagebird", "originator", sms.messagebird.originator),
+      access_key: legacyDecryptAuthSecret(
+        resolveField("messagebird", "access_key", sms.messagebird.access_key),
+        projectEnvValues,
+      ),
+    },
+    textlocal: {
+      enabled: textlocalEnabled,
+      sender: resolveField("textlocal", "sender", sms.textlocal.sender),
+      api_key: legacyDecryptAuthSecret(
+        resolveField("textlocal", "api_key", sms.textlocal.api_key),
+        projectEnvValues,
+      ),
+    },
+    vonage: {
+      enabled: vonageEnabled,
+      from: resolveField("vonage", "from", sms.vonage.from),
+      api_key: resolveField("vonage", "api_key", sms.vonage.api_key),
+      api_secret: legacyDecryptAuthSecret(
+        resolveField("vonage", "api_secret", sms.vonage.api_secret),
+        projectEnvValues,
+      ),
+    },
+  };
+}
+
+/**
+ * Go's `(s *sms) validate()` (`pkg/config/config.go:1348-1410`): a boolean `switch` that inspects
+ * providers in the FIXED priority order above and validates ONLY the first one whose `enabled` is
+ * true — a later enabled-but-incomplete provider is never even looked at. Runs against
+ * {@link legacyResolveAuthSms}'s env-override-aware result, same document-based, post-override
+ * pattern as {@link validateAuthExternalProviders} below.
+ */
+function validateAuthSmsProviders(
+  authDocument: Record<string, unknown> | undefined,
+  sms: ProjectConfig["auth"]["sms"],
+  projectEnvValues: Readonly<Record<string, string>> | undefined,
+): void {
+  const resolved = legacyResolveAuthSms(authDocument, sms, projectEnvValues);
+
+  function requireField(provider: string, field: string, value: string | undefined): void {
+    if (value === undefined || value.length === 0) {
+      throw new LegacyConfigValidateError(
+        `Missing required field in config: auth.sms.${provider}.${field}`,
+      );
+    }
+  }
+
+  if (resolved.twilio.enabled) {
+    requireField("twilio", "account_sid", resolved.twilio.account_sid);
+    requireField("twilio", "message_service_sid", resolved.twilio.message_service_sid);
+    requireField("twilio", "auth_token", resolved.twilio.auth_token);
+    return;
+  }
+  if (resolved.twilio_verify.enabled) {
+    requireField("twilio_verify", "account_sid", resolved.twilio_verify.account_sid);
+    requireField(
+      "twilio_verify",
+      "message_service_sid",
+      resolved.twilio_verify.message_service_sid,
+    );
+    requireField("twilio_verify", "auth_token", resolved.twilio_verify.auth_token);
+    return;
+  }
+  if (resolved.messagebird.enabled) {
+    requireField("messagebird", "originator", resolved.messagebird.originator);
+    requireField("messagebird", "access_key", resolved.messagebird.access_key);
+    return;
+  }
+  if (resolved.textlocal.enabled) {
+    requireField("textlocal", "sender", resolved.textlocal.sender);
+    requireField("textlocal", "api_key", resolved.textlocal.api_key);
+    return;
+  }
+  if (resolved.vonage.enabled) {
+    requireField("vonage", "from", resolved.vonage.from);
+    requireField("vonage", "api_key", resolved.vonage.api_key);
+    requireField("vonage", "api_secret", resolved.vonage.api_secret);
+    return;
+  }
+}
+
+/** Go's `external.validate()` deprecated-provider skip (`config.go:1419-1423`) — `linkedin`/
+ * `slack` are deleted (and warned on, if enabled) before the required-field loop runs, so they
+ * are never validated here. Mirrors `legacy-db-config.toml-read.ts`'s identical "B5: external
+ * providers" skip list. */
+const LEGACY_DEPRECATED_EXTERNAL_PROVIDERS = new Set(["linkedin", "slack"]);
+
+/** Matches `LegacyGotrueExternalProviderInput` (`start/services/gotrue.service.ts`) field-for-field — kept as its own type here rather than importing that command-specific one, same precedent as {@link LegacyResolvedAuthHooks}. */
+export interface LegacyResolvedAuthExternalProvider {
+  readonly enabled: boolean;
+  readonly clientId: string;
+  readonly secret?: string;
+  readonly url: string;
+  readonly redirectUri?: string;
+  readonly skipNonceCheck: boolean;
+  readonly emailOptional: boolean;
+}
+
+/**
+ * Go's `appendGotrueExternalProviderEnv` presence-filtering (`start.go:1442-
+ * 1462`): Go's `Auth.External` is a genuine `map[string]provider{}` containing
+ * only the providers a user's `config.toml` actually mentions, but
+ * `@supabase/config`'s schema always decodes a fixed set of ~19 known
+ * providers, each defaulting `enabled: false` regardless of TOML presence — so
+ * presence must be read from the raw document, same approach
+ * {@link validateAuthExternalProviders} below uses. `apple` is the one
+ * exception, unioned into the iterated provider set unconditionally — see the
+ * inline comment at the iteration below for why.
+ *
+ * `auth.external.<name>.*` is Viper-bound like every other nested field once
+ * `[auth.external.<name>]` is present in config.toml (`ExperimentalBindStruct`/
+ * `AutomaticEnv`, `config.go:581-586`), so `SUPABASE_AUTH_EXTERNAL_<NAME>_*`
+ * overrides apply before Go's `appendGotrueExternalProviderEnv` runs — Go has
+ * no separate "raw" vs. "effective" provider value, so this must be reflected
+ * in GoTrue's actual container env, not just validation.
+ *
+ * Hoisted (like {@link legacyResolveAuthHooks}/{@link legacyResolveAuthCaptcha})
+ * so both {@link validateAuthExternalProviders} (which derives its
+ * enabled/client_id/secret checks from this same unfiltered result) and
+ * `start.handler.ts`'s `resolveGotrueEnvInput` (the actual GoTrue env) resolve
+ * the SAME effective values.
+ */
+/**
+ * Go decodes ANY unmodeled/raw-document boolean field — a custom `map[string]provider` entry
+ * (`Enabled bool`, `pkg/config/auth.go:361-369`), `auth.passkey.enabled` (`auth.go:384-386`), etc.
+ * — through its own typed struct field regardless of TOML-vs-env origin: an `env(VAR)`-substituted
+ * string is weakly-coerced to `bool` by mapstructure's `WeaklyTypedInput`/`strconv.ParseBool`
+ * (`config.go:749-756`) before `Config` ever sees it, so Go never has an untyped raw string for
+ * these fields. `@supabase/config` has no schema at all for `auth.passkey`/`auth.webauthn`, and only
+ * recognizes the ~19 known provider ids for `auth.external` (`packages/config/src/auth/
+ * providers.ts`) — so for any of these unmodeled paths, the pre-decode `env(...)` walker
+ * substitutes the env value but skips type coercion (no schema AST at that path —
+ * `packages/config/src/lib/env.ts:308-314`), leaving e.g. `enabled = "env(CUSTOM_OAUTH_ENABLED)"`
+ * as the literal string `"true"`/`"false"` instead of a real boolean. A native TOML `true`/`false`
+ * literal still decodes to an actual `boolean` even for an unmodeled key (only `env(...)`
+ * substitution is schema-blind), so this must accept both. Used by
+ * {@link legacyResolveAuthExternalProviders} below AND by `start.handler.ts`'s
+ * `resolveGotruePasskeyWebauthn`/this file's own passkey-validation read, since both are
+ * unmodeled-document reads of the identical shape.
+ *
+ * An unparsable STRING (e.g. a typo, or a still-literal `"env(VAR)"` when the referenced var was
+ * never set) is a hard `Config.Load` failure in Go, not a silent `false` — `v.UnmarshalExact`'s
+ * `strconv.ParseBool` decode hook (`config.go:747-753`) errors on it, and that error propagates as
+ * `"failed to parse config: %w"`, same as {@link legacyEnvOverrideBool}'s identical treatment for
+ * schema-modeled bool fields. Silently defaulting to `false` here would both misreport a broken
+ * config as "section disabled" AND skip the required-field validation an enabled section should
+ * trigger. An absent value (`undefined` — key genuinely not present) is NOT an error: that's Go's
+ * own zero-value bool default, unchanged.
+ *
+ * Viper's decoder sets `WeaklyTypedInput: true` (its own hardcoded default —
+ * `defaultDecoderConfig`, `viper.go:976-994` — the `UnmarshalExact` call site only overrides
+ * `TagName`/`Squash`/`ZeroFields`/`DecodeHook`, never touching this flag), so a raw NUMBER for a
+ * `bool` field is NOT an error in Go either — mapstructure's `decodeBool` weakly coerces it via a
+ * truthiness check (`mapstructure.go:915-920`: int/uint/float `!= 0`), e.g. `enabled = 123` decodes
+ * as `true`, `enabled = 0` as `false`. Only a genuinely unconvertible type — an array or inline
+ * table (TOML's only other value kinds) — hits mapstructure's `default:` case
+ * (`mapstructure.go:933-936`), which errors unconditionally regardless of `WeaklyTypedInput`. So
+ * this function must weakly-coerce a JS `number` the same way, and only throw for anything else.
+ */
+export function legacyRawUnmodeledBool(value: unknown, dottedFieldPath: string): boolean {
+  if (value === undefined) return false;
+  if (typeof value === "boolean") return value;
+  if (typeof value === "number") return value !== 0;
+  if (typeof value === "string") {
+    const parsed = legacyParseGoBool(value);
+    if (parsed === undefined) {
+      throw new LegacyInvalidBoolEnvOverrideError(dottedFieldPath, value);
+    }
+    return parsed;
+  }
+  throw new LegacyInvalidBoolEnvOverrideError(dottedFieldPath, String(value));
+}
+
+/**
+ * Go's `strToArr` (`pkg/config/utils.go:86-92`): empty string → `[]`, else a plain comma-split, no
+ * trimming — the same semantic `mapstructure.StringToSliceHookFunc(",")` applies unconditionally to
+ * every `[]string`-typed config field during decode (`config.go:775-784`), so a raw or
+ * `env(VAR)`-resolved string destined for a slice field (e.g. `auth.webauthn.rp_origins`, which
+ * `@supabase/config` has no schema for at all) must be split the same way, not just accepted when
+ * it's already a JS array. Hoisted here (was duplicated in `config/push/config-sync/{api,auth}.
+ * sync.ts`) since it's now needed by a third, unrelated call site.
+ */
+export function legacyStrToArr(value: string): Array<string> {
+  return value.length === 0 ? [] : value.split(",");
+}
+
+export function legacyResolveAuthExternalProviders(
+  authDocument: Readonly<Record<string, unknown>> | undefined,
+  external: ProjectConfig["auth"]["external"],
+  projectEnvValues: Readonly<Record<string, string>> | undefined,
+): Record<string, LegacyResolvedAuthExternalProvider> {
+  const externalDoc = asRecord(authDocument?.["external"]);
+
+  const result: Record<string, LegacyResolvedAuthExternalProvider> = {};
+  const decodedProviders = new Map(Object.entries(external));
+  // Iterate the RAW document's keys, not `Object.entries(external)` — see this
+  // function's doc comment above for why (unmodeled/custom provider names).
+  // `apple` is unioned in unconditionally: Go's ejected default config.toml
+  // (`pkg/config/templates/config.toml:322-335`) unconditionally emits an
+  // UNCOMMENTED `[auth.external.apple]` table, merged into Viper
+  // (`mergeDefaultValues`, `config.go:690-699`) before the user's own file — so
+  // `auth.external.apple.*` is always registered with Viper and
+  // `SUPABASE_AUTH_EXTERNAL_APPLE_*` overrides apply with no user-declared table,
+  // confirmed against the actual Go source. Every other provider has no default
+  // template entry (just named in a comment), so they keep the raw-document
+  // presence gate below.
+  const providerNames = new Set([...Object.keys(externalDoc ?? {}), "apple"]);
+  for (const name of providerNames) {
+    if (LEGACY_DEPRECATED_EXTERNAL_PROVIDERS.has(name)) continue;
+    const envPrefix = `SUPABASE_AUTH_EXTERNAL_${name.toUpperCase()}`;
+    const provider = decodedProviders.get(name);
+    const rawProvider = provider === undefined ? asRecord(externalDoc?.[name]) : undefined;
+    if (provider === undefined && rawProvider === undefined) continue;
+    const configuredEnabled =
+      provider?.enabled ??
+      legacyRawUnmodeledBool(rawProvider?.["enabled"], `auth.external.${name}.enabled`);
+    const configuredClientId =
+      provider?.client_id ??
+      (typeof rawProvider?.["client_id"] === "string" ? rawProvider["client_id"] : undefined);
+    const configuredSecret =
+      provider?.secret ??
+      (typeof rawProvider?.["secret"] === "string" ? rawProvider["secret"] : undefined);
+    const configuredUrl =
+      provider?.url ?? (typeof rawProvider?.["url"] === "string" ? rawProvider["url"] : undefined);
+    const configuredRedirectUri =
+      provider?.redirect_uri ??
+      (typeof rawProvider?.["redirect_uri"] === "string" ? rawProvider["redirect_uri"] : undefined);
+    const configuredSkipNonceCheck =
+      provider?.skip_nonce_check ??
+      legacyRawUnmodeledBool(
+        rawProvider?.["skip_nonce_check"],
+        `auth.external.${name}.skip_nonce_check`,
+      );
+    const configuredEmailOptional =
+      provider?.email_optional ??
+      legacyRawUnmodeledBool(
+        rawProvider?.["email_optional"],
+        `auth.external.${name}.email_optional`,
+      );
+
+    result[name] = {
+      enabled: legacyEnvOverrideBool(
+        `${envPrefix}_ENABLED`,
+        configuredEnabled,
+        `auth.external.${name}.enabled`,
+        projectEnvValues,
+      ),
+      clientId:
+        legacyEnvOverride(`${envPrefix}_CLIENT_ID`, configuredClientId, projectEnvValues) ?? "",
+      secret: legacyDecryptAuthSecret(
+        legacyEnvOverride(`${envPrefix}_SECRET`, configuredSecret, projectEnvValues),
+        projectEnvValues,
+      ),
+      url: legacyEnvOverride(`${envPrefix}_URL`, configuredUrl, projectEnvValues) ?? "",
+      redirectUri: legacyEnvOverride(
+        `${envPrefix}_REDIRECT_URI`,
+        configuredRedirectUri,
+        projectEnvValues,
+      ),
+      skipNonceCheck: legacyEnvOverrideBool(
+        `${envPrefix}_SKIP_NONCE_CHECK`,
+        configuredSkipNonceCheck,
+        `auth.external.${name}.skip_nonce_check`,
+        projectEnvValues,
+      ),
+      emailOptional: legacyEnvOverrideBool(
+        `${envPrefix}_EMAIL_OPTIONAL`,
+        configuredEmailOptional,
+        `auth.external.${name}.email_optional`,
+        projectEnvValues,
+      ),
+    };
+  }
+  return result;
+}
+
+/**
+ * Go's `(e external) validate()` (`pkg/config/config.go:1419-1451`) — D-only per
+ * `legacy-config-validate.ts`'s module header ("`auth.external` ... stays 100% inline in D"), so
+ * this ports the identical inline block D already has (`legacy-db-config.toml-read.ts`'s "B5:
+ * external providers") to close the same gap for L. `auth.external` is a genuine Go
+ * `map[string]provider` (`apps/cli-go/pkg/config/auth.go:190`), so an arbitrary/unmodeled
+ * provider name (e.g. `[auth.external.custom]`) is a legitimate config shape — Go validates
+ * every enabled entry regardless of name. `@supabase/config`'s `external` schema only models the
+ * ~20 known provider ids and silently drops anything else at decode time
+ * (`packages/config/src/auth/providers.ts`), so an unmodeled provider's required-field check
+ * must run against the RAW `authDocument` instead of the decoded `ProjectConfig` — same
+ * document-based approach as {@link readAuthEmailTemplateContent}/the passkey/smtp checks above.
+ * Known providers are already covered by the schema's own `requiredWhenEnabled` check at decode
+ * time, so in practice this only ever fires for a name the schema doesn't model, but it runs
+ * over every raw key unconditionally, matching Go's own map iteration rather than special-casing
+ * "unknown" a different way. `authDocument`'s values are already post-`env()`-interpolation (see
+ * `LoadedProjectConfig.document`), so no `legacyExpandEnv`-style resolution is needed here,
+ * unlike D's raw pre-interpolation document.
+ *
+ * `auth.external.<name>.*` is Viper-bound like every other nested field once
+ * `[auth.external.<name>]` is present in config.toml (`ExperimentalBindStruct`/`AutomaticEnv`,
+ * `config.go:581-586`), so `SUPABASE_AUTH_EXTERNAL_<NAME>_ENABLED`/`_CLIENT_ID`/`_SECRET`
+ * overrides apply before this validation runs — same gap this schema's own `requiredWhenEnabled`
+ * check has for KNOWN providers too (that check only sees the decoded, pre-override TOML value),
+ * so this now covers both known and unmodeled provider names uniformly, matching Go not
+ * distinguishing between them either.
+ */
+function validateAuthExternalProviders(
+  authDocument: Record<string, unknown> | undefined,
+  external: ProjectConfig["auth"]["external"],
+  projectEnvValues: Readonly<Record<string, string>> | undefined,
+): void {
+  // Derived from `legacyResolveAuthExternalProviders`'s unfiltered result so this validation
+  // path and `start.handler.ts`'s GoTrue env builder can't drift — same precedent as
+  // `legacyResolveAuthHooks`'s validation caller above.
+  const resolved = legacyResolveAuthExternalProviders(authDocument, external, projectEnvValues);
+  for (const [name, provider] of Object.entries(resolved)) {
+    if (!provider.enabled) continue;
+    if (provider.clientId.length === 0) {
+      throw new LegacyConfigValidateError(
+        `Missing required field in config: auth.external.${name}.client_id`,
+      );
+    }
+    if (
+      name !== "apple" &&
+      name !== "google" &&
+      (provider.secret === undefined || provider.secret.length === 0)
+    ) {
+      throw new LegacyConfigValidateError(
+        `Missing required field in config: auth.external.${name}.secret`,
+      );
+    }
+  }
+}
+
+/**
+ * @throws when `project_id` (post-override, post-workdir-basename-fallback) is
+ * an explicit empty string. Go's `Config.Validate` checks this FIRST, before
+ * every other field (`pkg/config/config.go:990-991`): `mergeDefaultValues`
+ * merges `sanitizeProjectId(filepath.Base(cwd))` in as a viper DEFAULT value
+ * BEFORE `config.toml` is merged (`config.go:690-699`, via `Eject`,
+ * `config.go:561-570`) — so `c.ProjectId` is NEVER Go's zero value by the time
+ * `Validate` runs; it's always at least this sanitized basename. A workdir
+ * whose basename sanitizes to the empty string (e.g. `!!!`) therefore fails
+ * config loading in Go even with NO `project_id` key in the file at all. An
+ * explicit `project_id = ""` IN the file overwrites that default with the
+ * literal empty string the same way (rather than being treated as absent) —
+ * Go fails outright rather than falling back to the basename either way.
+ * `legacySanitizeProjectId` is only applied to the BASENAME fallback here,
+ * matching `Eject`'s pre-sanitized default — an explicit non-empty
+ * `config.project_id`/`SUPABASE_PROJECT_ID` value is intentionally NOT
+ * re-sanitized at this point, matching Go's `Validate` "auto-fix" branch
+ * (`config.go:992-996`) being a WARN-only rewrite with no throwing
+ * equivalent, same precedent as this module's other WARN-only omissions
+ * (`auth.captcha.secret`/`assertEnvLoaded`, SMS's `EnableSignup` case).
+ * @throws {LegacyInvalidJwtSecretError} when `auth.jwt_secret` is set but too short.
+ * @throws {LegacyInvalidPortEnvOverrideError} when a `SUPABASE_*_PORT` env/dotenv
+ * override doesn't parse as a valid port.
+ * @throws {LegacyInvalidBoolEnvOverrideError} when a `SUPABASE_*_ENABLED` env/dotenv
+ * override doesn't parse as a valid bool.
+ * @throws when a configured `api.tls` cert/key file can't be read — see
+ * {@link readApiTlsFiles}. The "exactly one of cert/key set" presence check
+ * runs later, as part of {@link legacyValidateResolvedConfig}.
+ * @throws when `auth.signing_keys_path` is set, auth is enabled, and the file is missing,
+ * malformed, or its first key uses an unsupported algorithm — see
+ * {@link legacyResolveConfiguredSigningKeys} and {@link legacyGenerateAsymmetricGoJwt}.
+ * @throws when an email template's `content` is present without `content_path`, or a
+ * configured `content_path` file can't be read — see {@link readAuthEmailTemplateContent}.
+ * @throws {LegacyInvalidAnalyticsBackendEnvOverrideError} when `SUPABASE_ANALYTICS_BACKEND`
+ * doesn't parse as one of Go's `LogflareBackend` values.
+ * @throws {LegacyConfigValidateError} for every other `Config.Validate` branch this module
+ * and `legacy-config-validate.ts` jointly own — project_id emptiness aside (checked above,
+ * inline, since the value is also needed for the throw's own message-free early-exit shape),
+ * every REMAINING pure check (api.port/tls presence, db.port/major_version, storage bucket
+ * names, studio, local_smtp, auth.site_url/captcha/passkey/hooks/mfa/smtp/third_party,
+ * function slugs, edge_runtime.deno_version, analytics.gcp_*, experimental.*) is deferred to a
+ * SINGLE call to {@link legacyValidateResolvedConfig} at the end of this function, in Go's exact
+ * relative order — see that module's header for the full table and the accepted ordering
+ * tradeoff this introduces against the I/O checks listed above (which keep running at their
+ * original position, per-caller, rather than being folded into that single call).
+ */
+export function legacyResolveLocalConfigValues(
+  config: ProjectConfig,
+  hostname: string,
+  workdir: string,
+  projectEnvValues: Readonly<Record<string, string>> | undefined = undefined,
+  /**
+   * `LoadedProjectConfig.document` (`packages/config/src/io.ts`) — the raw,
+   * pre-schema-default TOML document `config` was decoded from. Lets checks
+   * that hinge on TOML-section PRESENCE (not the decoded, always-defaulted
+   * value) inspect the file directly — see `legacyValidateResolvedConfig`'s
+   * `experimental.webhooks`/`auth.passkey`/`auth.email.smtp` steps.
+   * `undefined` for callers that haven't threaded it through yet (e.g. most
+   * existing unit tests); those checks are then simply skipped rather than
+   * guessed at.
+   */
+  document: Readonly<Record<string, unknown>> | undefined = undefined,
+): LegacyLocalConfigValues {
+  // Go's `Config.Validate` checks `ProjectId` FIRST, before every other field
+  // (`pkg/config/config.go:990-991`) — see this function's `@throws` doc above
+  // for why a workdir basename that sanitizes to `""` fails here even when
+  // `project_id` is absent from the file entirely. `config.project_id` is
+  // `undefined` only when the key is genuinely absent (`optionalKey`, see
+  // `packages/config/src/base.ts`) — that's the ONE case where Go's own
+  // sanitized-basename viper default shows through instead of a file value,
+  // so the fallback belongs here, not as a third branch after `legacyEnvOverride`.
+  // `SUPABASE_PROJECT_ID` is checked via the same `legacyEnvOverride` precedence
+  // every other field here uses, since Viper's `AutomaticEnv` binds it too
+  // (`config.go:529-535`) and it can turn an explicit-empty file value (or an
+  // unsanitizable basename fallback) back into a valid override.
+  const resolvedProjectId = legacyEnvOverride(
+    "SUPABASE_PROJECT_ID",
+    config.project_id ?? legacySanitizeProjectId(basename(workdir)),
+    projectEnvValues,
+  );
+
+  // Go's `status` reads `utils.Config.Api.Port`/`ExternalUrl`/`Tls.Enabled`
+  // after Viper's AutomaticEnv has already applied any `SUPABASE_API_PORT`/
+  // `SUPABASE_API_EXTERNAL_URL`/`SUPABASE_API_TLS_ENABLED` override
+  // (`config.go:529-535,799-809`), so the values fed into
+  // `legacyResolveApiExternalUrl`'s own `external_url`-wins-else-
+  // `scheme://host:port` derivation (which picks `https` vs `http` from
+  // `tls.enabled`) must be the overridden ones too.
+  const apiTlsEnabled = legacyEnvOverrideBool(
+    "SUPABASE_API_TLS_ENABLED",
+    config.api.tls.enabled,
+    "api.tls.enabled",
+    projectEnvValues,
+  );
+  // Go's TLS cert/key validation nests entirely inside `if c.Api.Enabled`
+  // (`config.go:1006,1010`) — mirroring `authEnabled` below, gate on the
+  // POST-`SUPABASE_API_ENABLED`-override value, not raw `config.api.enabled`.
+  const apiEnabled = legacyEnvOverrideBool(
+    "SUPABASE_API_ENABLED",
+    config.api.enabled,
+    "api.enabled",
+    projectEnvValues,
+  );
+  const apiTlsCertPath = legacyEnvOverride(
+    "SUPABASE_API_TLS_CERT_PATH",
+    config.api.tls.cert_path,
+    projectEnvValues,
+  );
+  const apiTlsKeyPath = legacyEnvOverride(
+    "SUPABASE_API_TLS_KEY_PATH",
+    config.api.tls.key_path,
+    projectEnvValues,
+  );
+  if (apiEnabled && apiTlsEnabled) {
+    readApiTlsFiles(workdir, apiTlsCertPath, apiTlsKeyPath);
+  }
+  // Go's `Config.Validate` rejects `api.port === 0`/`SUPABASE_API_PORT=0` ONLY
+  // when `api.enabled` (`pkg/config/config.go:1006-1008`) — unlike `db.port`
+  // below, which has no `enabled` gate. Resolved once into a named const so the
+  // check and the URL derivation below share the same overridden value instead
+  // of calling `legacyEnvOverridePort` twice.
+  const apiPort = legacyEnvOverridePort(
+    "SUPABASE_API_PORT",
+    config.api.port,
+    "api.port",
+    projectEnvValues,
+  );
+  const apiExternalUrl = legacyResolveApiExternalUrl(
+    {
+      external_url: legacyEnvOverride(
+        "SUPABASE_API_EXTERNAL_URL",
+        config.api.external_url,
+        projectEnvValues,
+      ),
+      port: apiPort,
+      tls: { enabled: apiTlsEnabled },
+    },
+    hostname,
+  );
+  // Unlike `api.port`/`studio.port`/`local_smtp.port` below, `db.port` has no
+  // `enabled` gate in Go's `Config.Validate` — it's unconditionally required,
+  // and a decoded `0` (e.g. `SUPABASE_DB_PORT=0`) fails validation with this
+  // exact message (`pkg/config/config.go:1031-1032`) before `status`/`stop`
+  // render anything, same wording already used for the `db query`/`test db`
+  // path (`legacy-db-config.toml-read.ts:1380`).
+  const dbPort = legacyEnvOverridePort(
+    "SUPABASE_DB_PORT",
+    config.db.port,
+    "db.port",
+    projectEnvValues,
+  );
+  // Go's `Config.Validate` checks `db.major_version` right after `db.port`
+  // (`pkg/config/config.go:1034-1061`), unconditionally (no `enabled` gate).
+  const majorVersion = legacyEnvOverrideMajorVersion(config.db.major_version, projectEnvValues);
+  // Go's `flags.LoadConfig` applies every `SUPABASE_DB_SETTINGS_*` override unconditionally
+  // during `Config.Load` (`config.go:576-586`), BEFORE `start`/`status`/`stop` do anything else
+  // (`internal/start/start.go:51` runs before `AssertSupabaseDbIsRunning` at line 54; `status.
+  // Run`/`stop.Run` load config first too) — so a malformed override must fail here, the same
+  // point `majorVersion`/`denoVersion`/`orioledbVersion` are already validated, not deep inside
+  // `start.handler.ts`'s `bringUp` after Postgres may already be created. Validate-only: the
+  // actual resolved settings `start` needs are recomputed at their own call site (same
+  // "validate early, recompute at point of use" split already used for those three fields).
+  legacyResolveDbSettingsEnvOverrides(config.db.settings, projectEnvValues);
+  // Same gap for `db.network_restrictions.enabled` — `[db.network_restrictions]` ships
+  // uncommented in Go's default template (unlike the commented-out `[db.ssl_enforcement]`) and
+  // `NetworkRestrictions` is a plain, non-pointer `db` struct field, so Viper always registers a
+  // default and decodes a malformed `SUPABASE_DB_NETWORK_RESTRICTIONS_ENABLED` override
+  // unconditionally during `Config.Load` — same bucket as `db.port`/`db.major_version` above, not
+  // the presence-gated `db.ssl_enforcement`/`auth.sms.twilio`/`auth.external.apple` cases.
+  // Validate-only: `start` doesn't otherwise consume this field (only `config push` does).
+  legacyEnvOverrideBool(
+    "SUPABASE_DB_NETWORK_RESTRICTIONS_ENABLED",
+    config.db.network_restrictions.enabled,
+    "db.network_restrictions.enabled",
+    projectEnvValues,
+  );
+  // `db.root_key` isn't modeled in `@supabase/config`'s schema (every other
+  // `db.*` field is), so it's read off the raw pre-schema document — same
+  // presence-based pattern as `authDocument` below. Go writes the
+  // default-or-configured, decrypted-if-`encrypted:` value verbatim into
+  // `/etc/postgresql-custom/pgsodium_root.key` on every start
+  // (`apps/cli-go/internal/db/start/start.go:100`), going through the same
+  // `Secret`/`DecryptSecretHookFunc` decode every other secret field gets
+  // (`pkg/config/secret.go:30-109`, wired at `pkg/config/config.go:781`).
+  const rawRootKeyValue = asRecord(document?.["db"])?.["root_key"];
+  // Go's `DecryptSecretHookFunc` only intercepts a STRING source value
+  // (`secret.go:86-89`); any other raw TOML kind (integer, bool, array, ...)
+  // falls through untouched and mapstructure then rejects decoding a scalar
+  // into the `Secret{Value, SHA256}` struct with exactly this message
+  // (`config.go:748-751` wraps it as `failed to parse config: %w`) — same
+  // "decoding failed due to the following error(s):" wrapper already used for
+  // `auth.captcha.provider`/`analytics.backend` above.
+  if (rawRootKeyValue !== undefined && typeof rawRootKeyValue !== "string") {
+    throw new LegacyConfigValidateError(
+      "failed to parse config: decoding failed due to the following error(s):\n\n'db.root_key' expected a map or struct",
+    );
+  }
+  const rawRootKey = legacyEnvOverride("SUPABASE_DB_ROOT_KEY", rawRootKeyValue, projectEnvValues);
+  const rootKey =
+    rawRootKey === undefined || rawRootKey.length === 0
+      ? LEGACY_POSTGRES_DEFAULT_ROOT_KEY
+      : (legacyDecryptAuthSecret(rawRootKey, projectEnvValues) ?? LEGACY_POSTGRES_DEFAULT_ROOT_KEY);
+  // Go's `Config.Validate` runs `ValidateBucketName` over every `[storage.buckets.*]`
+  // key right after `db.major_version`, unconditionally.
+  const storageBucketNames =
+    config.storage.buckets !== undefined ? Object.keys(config.storage.buckets) : [];
+  // Go's `Config.Validate` rejects `studio.port === 0`/`SUPABASE_STUDIO_PORT=0`
+  // ONLY when `studio.enabled` (`pkg/config/config.go:1070-1073`) — same
+  // enabled-gated pattern as `api.port` above.
+  const studioEnabled = legacyEnvOverrideBool(
+    "SUPABASE_STUDIO_ENABLED",
+    config.studio.enabled,
+    "studio.enabled",
+    projectEnvValues,
+  );
+  const studioPort = legacyEnvOverridePort(
+    "SUPABASE_STUDIO_PORT",
+    config.studio.port,
+    "studio.port",
+    projectEnvValues,
+  );
+  // Go's `Config.Validate` parses `studio.api_url` with `net/url.Parse` right
+  // after the port check, still inside `if c.Studio.Enabled`
+  // (`pkg/config/config.go:1074-1078`). `config.studio.api_url` is a required
+  // (defaulted) field, so `legacyEnvOverride` can only return `undefined` here if
+  // that default itself were somehow undefined — the `??` fallback just
+  // satisfies that generic signature.
+  const studioApiUrl =
+    legacyEnvOverride("SUPABASE_STUDIO_API_URL", config.studio.api_url, projectEnvValues) ??
+    config.studio.api_url;
+  // Go's `Config.Validate` rejects `local_smtp.port === 0`/
+  // `SUPABASE_LOCAL_SMTP_PORT=0` ONLY when `local_smtp.enabled` — Go's struct
+  // field is still named `Inbucket` for the `[local_smtp]` TOML section
+  // (`pkg/config/config.go:235,1081-1083`), so `local_smtp.enabled` and the
+  // deprecated `inbucket.enabled` alias are the same underlying flag, not two
+  // independent ones.
+  const mailpitEnabled = legacyEnvOverrideBool(
+    "SUPABASE_LOCAL_SMTP_ENABLED",
+    config.local_smtp.enabled,
+    "local_smtp.enabled",
+    projectEnvValues,
+  );
+  const mailpitPort = legacyEnvOverridePort(
+    "SUPABASE_LOCAL_SMTP_PORT",
+    config.local_smtp.port,
+    "local_smtp.port",
+    projectEnvValues,
+  );
+  const jwtSecret = resolveJwtSecret(
+    legacyDecryptAuthSecret(
+      legacyEnvOverride("SUPABASE_AUTH_JWT_SECRET", config.auth.jwt_secret, projectEnvValues),
+      projectEnvValues,
+    ),
+  );
+  const signingKeysPath = legacyEnvOverride(
+    "SUPABASE_AUTH_SIGNING_KEYS_PATH",
+    config.auth.signing_keys_path,
+    projectEnvValues,
+  );
+  // Gated on `auth.enabled` to match Go's `Validate` (`pkg/config/config.go:1036,1059-1065`):
+  // the signing-keys file read lives entirely inside `if c.Auth.Enabled`, so a
+  // disabled auth section never opens/parses `signing_keys_path`, even a stale
+  // or missing one. JWT-secret validation and anon/service_role key generation
+  // (`generateAPIKeys`, `apikeys.go:43-73`) run unconditionally either way, so
+  // only this file read is gated. `c.Auth.Enabled` is itself Viper-bound like
+  // any other field (`config.go:582-586`), so `Validate`'s gate reads the
+  // POST-`SUPABASE_AUTH_ENABLED`-override value, not the raw TOML one — hence
+  // `legacyEnvOverrideBool` here instead of `config.auth.enabled` directly.
+  const authEnabled = legacyEnvOverrideBool(
+    "SUPABASE_AUTH_ENABLED",
+    config.auth.enabled,
+    "auth.enabled",
+    projectEnvValues,
+  );
+  // Go's `Config.Validate` checks `auth.site_url` first inside `if c.Auth.Enabled`
+  // (`pkg/config/config.go:1086-1090`), before the signing-keys read below —
+  // `@supabase/config`'s schema only defaults `site_url` when the key is ABSENT
+  // (`Schema.withDecodingDefaultKey`), so an explicit `site_url = ""` decodes as
+  // `""` with no schema-level error, same gap as `db.port === 0` above.
+  const siteUrl =
+    legacyEnvOverride("SUPABASE_AUTH_SITE_URL", config.auth.site_url, projectEnvValues) ??
+    config.auth.site_url;
+  // Go's `start.go` builds GoTrue's env straight off `utils.Config.Auth.*`
+  // with no local override logic of its own (`start.go:1365-1405`) — the
+  // override happens earlier, generically, via Viper's `AutomaticEnv`
+  // (`config.go:585-586`), so every flat `auth.*` scalar Go feeds into
+  // GoTrue's env must go through the same override resolution `siteUrl`
+  // above already gets, not just the fields `Validate` happens to check.
+  const jwtIssuer = legacyEnvOverride(
+    "SUPABASE_AUTH_JWT_ISSUER",
+    config.auth.jwt_issuer,
+    projectEnvValues,
+  );
+  const jwtExpiry = legacyEnvOverrideUint(
+    "SUPABASE_AUTH_JWT_EXPIRY",
+    "auth.jwt_expiry",
+    config.auth.jwt_expiry,
+    projectEnvValues,
+  );
+  // Go decodes `additional_redirect_urls` (a `[]string`) through the same
+  // `StringToSliceHookFunc(",")` mapstructure hook as every other Go
+  // string-slice field (`config.go:775-784`) — same comma-split-override
+  // pattern as `auth.webauthn.rp_origins` below.
+  const additionalRedirectUrlsOverride = legacyEnvOverride(
+    "SUPABASE_AUTH_ADDITIONAL_REDIRECT_URLS",
+    undefined,
+    projectEnvValues,
+  );
+  const additionalRedirectUrls =
+    additionalRedirectUrlsOverride !== undefined
+      ? additionalRedirectUrlsOverride.split(",")
+      : config.auth.additional_redirect_urls;
+  const enableSignup = legacyEnvOverrideBool(
+    "SUPABASE_AUTH_ENABLE_SIGNUP",
+    config.auth.enable_signup,
+    "auth.enable_signup",
+    projectEnvValues,
+  );
+  const enableAnonymousSignIns = legacyEnvOverrideBool(
+    "SUPABASE_AUTH_ENABLE_ANONYMOUS_SIGN_INS",
+    config.auth.enable_anonymous_sign_ins,
+    "auth.enable_anonymous_sign_ins",
+    projectEnvValues,
+  );
+  const enableRefreshTokenRotation = legacyEnvOverrideBool(
+    "SUPABASE_AUTH_ENABLE_REFRESH_TOKEN_ROTATION",
+    config.auth.enable_refresh_token_rotation,
+    "auth.enable_refresh_token_rotation",
+    projectEnvValues,
+  );
+  const refreshTokenReuseInterval = legacyEnvOverrideUint(
+    "SUPABASE_AUTH_REFRESH_TOKEN_REUSE_INTERVAL",
+    "auth.refresh_token_reuse_interval",
+    config.auth.refresh_token_reuse_interval,
+    projectEnvValues,
+  );
+  const enableManualLinking = legacyEnvOverrideBool(
+    "SUPABASE_AUTH_ENABLE_MANUAL_LINKING",
+    config.auth.enable_manual_linking,
+    "auth.enable_manual_linking",
+    projectEnvValues,
+  );
+  const minimumPasswordLength = legacyEnvOverrideUint(
+    "SUPABASE_AUTH_MINIMUM_PASSWORD_LENGTH",
+    "auth.minimum_password_length",
+    config.auth.minimum_password_length,
+    projectEnvValues,
+  );
+  // Go's `PasswordRequirements.UnmarshalText` (`pkg/config/auth.go:26-31`)
+  // hard-fails config loading on a value outside this fixed set — same
+  // decode-time-failure semantics as the numeric overrides above, just
+  // string-typed.
+  const passwordRequirementsOverride = legacyEnvOverride(
+    "SUPABASE_AUTH_PASSWORD_REQUIREMENTS",
+    undefined,
+    projectEnvValues,
+  );
+  if (
+    passwordRequirementsOverride !== undefined &&
+    !LEGACY_PASSWORD_REQUIREMENTS_VALUES.has(passwordRequirementsOverride)
+  ) {
+    throw new Error(
+      `Failed reading config: Invalid auth.password_requirements: ${passwordRequirementsOverride}.`,
+    );
+  }
+  const passwordRequirements = passwordRequirementsOverride ?? config.auth.password_requirements;
+  // `LoadedProjectConfig.document` (the raw, pre-schema-default TOML `config` was decoded from) —
+  // hoisted here (rather than inside the `authEnabled` block below, where it used to live) because
+  // the captcha presence check right below needs it too. `undefined` for callers that haven't
+  // threaded `document` through yet, in which case presence-based checks are simply skipped.
+  const authDocument = asRecord(document?.["auth"]);
+  const captchaInput = legacyResolveAuthCaptcha(
+    authDocument,
+    config.auth.captcha,
+    projectEnvValues,
+  );
+  // Go's `generateJWT` (`apikeys.go:77`) signs asymmetrically whenever
+  // `len(a.SigningKeysPath) > 0 && len(a.SigningKeys) > 0` — NOT gated on `auth.enabled`. Since
+  // `a.SigningKeys` is unconditionally seeded with the default ES256 key at `NewConfig()` time
+  // and only ever replaced by the file's keys (when the read above actually runs), it's never
+  // empty either way — so this reduces to "does `signing_keys_path` resolve to a key at all,"
+  // matching {@link legacyResolveLocalJwks}'s identical `signingKeysPath`-only condition. Reuses
+  // {@link legacyResolveConfiguredSigningKeys} (which already gates the actual file read on
+  // `authEnabled` internally, matching the file-read gating above) rather than duplicating that
+  // gate here — a disabled-auth config with a configured path must still sign asymmetrically
+  // with the default key, not silently fall back to symmetric HS256.
+  const signingKey =
+    signingKeysPath !== undefined && signingKeysPath.length > 0
+      ? (legacyResolveConfiguredSigningKeys(config, workdir, projectEnvValues) ?? [
+          LEGACY_DEFAULT_SIGNING_KEY,
+        ])[0]
+      : undefined;
+  // Go's `Config.Validate` runs passkey/webauthn validation, then
+  // `Auth.Hook.validate()`, then `Auth.MFA.validate()`, then
+  // `Auth.Email.validate()`, then `Auth.Sms.validate()`/`Auth.ThirdParty.validate()` (skipping
+  // the D-only `external` step, ported separately below), all right after the signing-keys read
+  // and still inside `if c.Auth.Enabled` (`pkg/config/config.go:1117-1153`). Sms
+  // (`config.go:1145-1147`/`1348-1417`) is enforced at decode time by `@supabase/config`'s `sms`
+  // schema (`packages/config/src/auth/sms.ts`'s provider-switch check) for the TOML-only case,
+  // AND re-checked here post-env-override by {@link validateAuthSmsProviders} (called alongside
+  // {@link validateAuthExternalProviders}, after the single `legacyValidateResolvedConfig` call
+  // below) — see that function's doc comment for why both are needed. External
+  // (`config.go:1148-1150`/`1419-1451`) is D-only per `legacy-config-validate.ts`'s module
+  // header; {@link validateAuthExternalProviders} ports D's identical inline check. This block
+  // only ACCUMULATES the inputs those checks need — the checks themselves run once, later, as
+  // part of the single `legacyValidateResolvedConfig` call below.
+  let authInput: LegacyAuthInput | undefined;
+  if (authEnabled) {
+    // `@supabase/config`'s auth schema has no `passkey`/`webauthn` fields at all (see
+    // `config-sync/auth.sync.ts`'s "not in `@supabase/config` schema" note), so passkey/webauthn
+    // are read from the RAW, post-`env()`-interpolation TOML document (`authDocument`, hoisted
+    // above) instead of the decoded `ProjectConfig` — same document-based approach already used
+    // on the `db`/migration config-load path (`legacy-db-config.toml-read.ts`'s
+    // `legacyValidateAuthConfig`, section A6). `authDocument` is `undefined` when a caller hasn't
+    // threaded `document` through yet, in which case passkey/smtp presence-based checks are
+    // simply skipped rather than guessed at.
+    const passkeyDoc = asRecord(authDocument?.["passkey"]);
+    const webauthnDoc = asRecord(authDocument?.["webauthn"]);
+    // `auth.passkey.enabled`/`auth.webauthn.*` are Viper-bound like every other nested field once
+    // `[auth.passkey]`/`[auth.webauthn]` are present in config.toml (`ExperimentalBindStruct`/
+    // `AutomaticEnv`, `config.go:581-586`), so `SUPABASE_AUTH_PASSKEY_ENABLED` and
+    // `SUPABASE_AUTH_WEBAUTHN_RP_ID`/`_RP_ORIGINS` overrides apply before `Auth.Passkey`/
+    // `Auth.Webauthn` validation runs (`config.go:1117-1134`). Gated on the raw section already
+    // being present (`passkeyDoc`/`webauthnDoc !== undefined`), matching Go's `AutomaticEnv`
+    // (which only intercepts keys already present in the merged config) — an absent
+    // `[auth.passkey]`/`[auth.webauthn]` section is never synthesized from an env override alone.
+    const passkeyEnabled =
+      passkeyDoc !== undefined
+        ? legacyEnvOverrideBool(
+            "SUPABASE_AUTH_PASSKEY_ENABLED",
+            legacyRawUnmodeledBool(passkeyDoc["enabled"], "auth.passkey.enabled"),
+            "auth.passkey.enabled",
+            projectEnvValues,
+          )
+        : false;
+    const rpId =
+      webauthnDoc !== undefined
+        ? legacyEnvOverride(
+            "SUPABASE_AUTH_WEBAUTHN_RP_ID",
+            typeof webauthnDoc["rp_id"] === "string" ? webauthnDoc["rp_id"] : undefined,
+            projectEnvValues,
+          )
+        : undefined;
+    // Go decodes `rp_origins` (a `[]string`) through the same `StringToSliceHookFunc(",")`
+    // mapstructure hook as every other Go string-slice field (`config.go:775-784`), so a
+    // `SUPABASE_AUTH_WEBAUTHN_RP_ORIGINS` override is comma-split the same way.
+    const rpOriginsOverride =
+      webauthnDoc !== undefined
+        ? legacyEnvOverride("SUPABASE_AUTH_WEBAUTHN_RP_ORIGINS", undefined, projectEnvValues)
+        : undefined;
+    // Go's mapstructure decode chain applies `StringToSliceHookFunc(",")` unconditionally to
+    // every `[]string`-typed field (`config.go:775-784`) — a raw or `env(...)`-resolved
+    // `rp_origins` string (this section has no `@supabase/config` schema at all) must be
+    // comma-split, not silently dropped when it isn't already a JS array.
+    const rawRpOrigins = webauthnDoc?.["rp_origins"];
+    const rpOrigins =
+      rpOriginsOverride !== undefined
+        ? legacyStrToArr(rpOriginsOverride)
+        : Array.isArray(rawRpOrigins)
+          ? rawRpOrigins
+          : typeof rawRpOrigins === "string"
+            ? legacyStrToArr(rawRpOrigins)
+            : undefined;
+    const passkey: LegacyPasskeyInput | undefined = passkeyEnabled
+      ? { webauthnPresent: webauthnDoc !== undefined, rpId, rpOrigins }
+      : undefined;
+
+    // Only enabled hooks are forwarded to `Config.Validate` parity, in Go's
+    // fixed iteration order (`pkg/config/config.go:1453-1485`) — derived from
+    // `legacyResolveAuthHooks`'s unfiltered result so this validation path and
+    // `resolveGotrueEnvInput`'s actual GoTrue env resolve the exact same
+    // per-hook override values (see that function's doc comment).
+    const resolvedHooks = legacyResolveAuthHooks(authDocument, config.auth.hook, projectEnvValues);
+    const hooks: Array<LegacyHookInput> = LEGACY_HOOK_TYPE_ORDER.filter(
+      (hookType) => resolvedHooks[LEGACY_HOOK_TYPE_TO_CAMEL[hookType]].enabled,
+    ).map((hookType) => {
+      const resolved = resolvedHooks[LEGACY_HOOK_TYPE_TO_CAMEL[hookType]];
+      return { type: hookType, uri: resolved.uri, secrets: resolved.secrets };
+    });
+
+    // Derived from `legacyResolveAuthMfa`'s unfiltered result so this validation path and
+    // `resolveGotrueEnvInput`'s actual GoTrue env resolve the exact same per-factor override
+    // values (see that function's doc comment) — same precedent as `hooks` above.
+    const resolvedMfa = legacyResolveAuthMfa(config.auth.mfa, projectEnvValues);
+    const mfa: ReadonlyArray<LegacyMfaFactorInput> = [
+      {
+        label: "totp",
+        enrollEnabled: resolvedMfa.totp.enroll_enabled,
+        verifyEnabled: resolvedMfa.totp.verify_enabled,
+      },
+      {
+        label: "phone",
+        enrollEnabled: resolvedMfa.phone.enroll_enabled,
+        verifyEnabled: resolvedMfa.phone.verify_enabled,
+      },
+      {
+        label: "web_authn",
+        enrollEnabled: resolvedMfa.web_authn.enroll_enabled,
+        verifyEnabled: resolvedMfa.web_authn.verify_enabled,
+      },
+    ];
+
+    // Go's `Config.Validate` runs the email template/notification content read right after
+    // `Auth.MFA.validate()`, still inside `if c.Auth.Enabled` (`config.go:1142`) — this I/O read
+    // stays at this exact textual position (see this function's `@throws` doc for why).
+    readAuthEmailTemplateContent(
+      legacyResolveAuthEmail(config.auth.email, authDocument, projectEnvValues),
+      workdir,
+    );
+
+    // Go's `[auth.email.smtp]` presence-based `enabled` default — see
+    // {@link legacyResolveAuthEmailSmtp}'s doc comment.
+    const resolvedSmtp = legacyResolveAuthEmailSmtp(authDocument, projectEnvValues);
+    const smtp: LegacySmtpInput | undefined =
+      resolvedSmtp === undefined
+        ? undefined
+        : {
+            enabled: resolvedSmtp.enabled,
+            host: resolvedSmtp.host,
+            port: resolvedSmtp.port,
+            user: resolvedSmtp.user,
+            pass: resolvedSmtp.pass,
+            adminEmail: resolvedSmtp.adminEmail,
+          };
+
+    // Go's `(tpa *thirdParty) validate()` fixed provider order (`pkg/config/config.go:1635-1683`)
+    // — only enabled providers are forwarded, in that order. Like `Auth.MFA` above, each provider
+    // struct (`tpaFirebase`/`tpaAuth0`/`tpaCognito`/`tpaClerk`/`tpaWorkOs`, `auth.go:191-198`) is
+    // value-typed, so `SUPABASE_AUTH_THIRD_PARTY_<PROVIDER>_*` overrides always apply — including
+    // `workos`, whose default template omits `[auth.third_party.workos]` entirely — before
+    // `Auth.ThirdParty.validate()` runs; no raw-document presence gate needed.
+    const thirdParty: Array<LegacyThirdPartyInput> = [];
+    if (
+      legacyEnvOverrideBool(
+        "SUPABASE_AUTH_THIRD_PARTY_FIREBASE_ENABLED",
+        config.auth.third_party.firebase.enabled,
+        "auth.third_party.firebase.enabled",
+        projectEnvValues,
+      )
+    ) {
+      thirdParty.push({
+        provider: "firebase",
+        requiredField:
+          legacyEnvOverride(
+            "SUPABASE_AUTH_THIRD_PARTY_FIREBASE_PROJECT_ID",
+            config.auth.third_party.firebase.project_id,
+            projectEnvValues,
+          ) ?? "",
+      });
+    }
+    if (
+      legacyEnvOverrideBool(
+        "SUPABASE_AUTH_THIRD_PARTY_AUTH0_ENABLED",
+        config.auth.third_party.auth0.enabled,
+        "auth.third_party.auth0.enabled",
+        projectEnvValues,
+      )
+    ) {
+      thirdParty.push({
+        provider: "auth0",
+        requiredField:
+          legacyEnvOverride(
+            "SUPABASE_AUTH_THIRD_PARTY_AUTH0_TENANT",
+            config.auth.third_party.auth0.tenant,
+            projectEnvValues,
+          ) ?? "",
+      });
+    }
+    if (
+      legacyEnvOverrideBool(
+        "SUPABASE_AUTH_THIRD_PARTY_AWS_COGNITO_ENABLED",
+        config.auth.third_party.aws_cognito.enabled,
+        "auth.third_party.aws_cognito.enabled",
+        projectEnvValues,
+      )
+    ) {
+      thirdParty.push({
+        provider: "cognito",
+        requiredField:
+          legacyEnvOverride(
+            "SUPABASE_AUTH_THIRD_PARTY_AWS_COGNITO_USER_POOL_ID",
+            config.auth.third_party.aws_cognito.user_pool_id,
+            projectEnvValues,
+          ) ?? "",
+        cognitoUserPoolRegion: legacyEnvOverride(
+          "SUPABASE_AUTH_THIRD_PARTY_AWS_COGNITO_USER_POOL_REGION",
+          config.auth.third_party.aws_cognito.user_pool_region,
+          projectEnvValues,
+        ),
+      });
+    }
+    if (
+      legacyEnvOverrideBool(
+        "SUPABASE_AUTH_THIRD_PARTY_CLERK_ENABLED",
+        config.auth.third_party.clerk.enabled,
+        "auth.third_party.clerk.enabled",
+        projectEnvValues,
+      )
+    ) {
+      thirdParty.push({
+        provider: "clerk",
+        requiredField:
+          legacyEnvOverride(
+            "SUPABASE_AUTH_THIRD_PARTY_CLERK_DOMAIN",
+            config.auth.third_party.clerk.domain,
+            projectEnvValues,
+          ) ?? "",
+      });
+    }
+    if (
+      legacyEnvOverrideBool(
+        "SUPABASE_AUTH_THIRD_PARTY_WORKOS_ENABLED",
+        config.auth.third_party.workos.enabled,
+        "auth.third_party.workos.enabled",
+        projectEnvValues,
+      )
+    ) {
+      thirdParty.push({
+        provider: "workos",
+        requiredField:
+          legacyEnvOverride(
+            "SUPABASE_AUTH_THIRD_PARTY_WORKOS_ISSUER_URL",
+            config.auth.third_party.workos.issuer_url,
+            projectEnvValues,
+          ) ?? "",
+      });
+    }
+
+    authInput = {
+      siteUrl: siteUrl ?? "",
+      captcha: captchaInput,
+      passkey,
+      hooks,
+      mfa,
+      smtp,
+      thirdParty,
+    };
+  }
+  // Go's `Config.Validate` runs `ValidateFunctionSlug` over every `[functions.*]`
+  // key right after the auth block/`generateAPIKeys`, unconditionally.
+  const functionSlugs = Object.keys(config.functions);
+  // Go's `Config.Validate` checks `edge_runtime.deno_version` after the auth
+  // block and the functions loop (`pkg/config/config.go:1158-1173`), and —
+  // unlike `studio.port`/`local_smtp.port` above — unconditionally, with no
+  // `edge_runtime.enabled` gate.
+  const denoVersion = legacyEnvOverrideDenoVersion(
+    config.edge_runtime.deno_version,
+    projectEnvValues,
+  );
+
+  // Go's `Config.Validate` validates `[analytics]` right after
+  // `edge_runtime.deno_version` (`pkg/config/config.go:1174-1187`): when
+  // `analytics.enabled` and `analytics.backend == "bigquery"`, all three GCP
+  // fields are required, checked in that order, each with its own message.
+  // Backend-enum validation (rejecting a non-postgres/bigquery value) is
+  // covered at decode time for the `config.toml`-sourced value by
+  // `@supabase/config`'s `stringEnum` (`packages/config/src/analytics.ts:17-41`),
+  // but that schema doesn't see the `SUPABASE_ANALYTICS_BACKEND` env-override
+  // path — see {@link envOverrideAnalyticsBackend} for that case.
+  const analyticsEnabled = legacyEnvOverrideBool(
+    "SUPABASE_ANALYTICS_ENABLED",
+    config.analytics.enabled,
+    "analytics.enabled",
+    projectEnvValues,
+  );
+  const analyticsBackend = envOverrideAnalyticsBackend(config.analytics.backend, projectEnvValues);
+  const gcpProjectId = legacyEnvOverride(
+    "SUPABASE_ANALYTICS_GCP_PROJECT_ID",
+    config.analytics.gcp_project_id,
+    projectEnvValues,
+  );
+  const gcpProjectNumber = legacyEnvOverride(
+    "SUPABASE_ANALYTICS_GCP_PROJECT_NUMBER",
+    config.analytics.gcp_project_number,
+    projectEnvValues,
+  );
+  const gcpJwtPath = legacyEnvOverride(
+    "SUPABASE_ANALYTICS_GCP_JWT_PATH",
+    config.analytics.gcp_jwt_path,
+    projectEnvValues,
+  );
+
+  // Go's `Config.Validate` calls `c.Experimental.validate()` right after the
+  // analytics/bigquery block and right before returning. The webhooks check is NOT "the user
+  // disabled a feature" — Go's bool zero-value is `false`, so `e.Webhooks != nil &&
+  // !e.Webhooks.Enabled` rejects ANY present `[experimental.webhooks]` section whose `enabled`
+  // isn't explicitly `true`, including one where the key is simply omitted; the section exists
+  // only so it can be turned on, never explicitly off. This hinges on PRESENCE of the TOML
+  // section, not the decoded `enabled` value — `@supabase/config`'s decode-time default
+  // (`packages/config/src/experimental.ts`'s `withDecodingDefaultKey(Effect.succeed({}))`) fills
+  // in `experimental.webhooks = { enabled: false }` on the DECODED `ProjectConfig` even when the
+  // TOML section is entirely absent — verified empirically, this default-fill erases exactly the
+  // presence signal this check needs. So this reads `LoadedProjectConfig.document` (the raw,
+  // pre-default TOML) instead, same as the passkey/smtp checks above.
+  const experimentalDocument = asRecord(document?.["experimental"]);
+  const webhooksPresent = asRecord(experimentalDocument?.["webhooks"]) !== undefined;
+  // `SUPABASE_EXPERIMENTAL_WEBHOOKS_ENABLED`/`SUPABASE_EXPERIMENTAL_PGDELTA_FORMAT_OPTIONS` are
+  // Viper-bound like every other leaf field (`ExperimentalBindStruct`/`AutomaticEnv`,
+  // `config.go:581-586`) before `experimental.validate()` runs — same mechanism the db/migration
+  // loader (`legacy-db-config.toml-read.ts`) already applies for the `pgdelta` override; this
+  // resolver just never got the equivalent treatment. A malformed JSON override needs no separate
+  // error path here: it flows through unchanged and `legacyValidateResolvedConfig`'s existing
+  // `isValidJson` check reports it the same way it already reports a malformed TOML-sourced value.
+  const webhooksEnabled = legacyEnvOverrideBool(
+    "SUPABASE_EXPERIMENTAL_WEBHOOKS_ENABLED",
+    config.experimental.webhooks?.enabled === true,
+    "experimental.webhooks.enabled",
+    projectEnvValues,
+  );
+  const pgdeltaFormatOptions =
+    legacyEnvOverride(
+      "SUPABASE_EXPERIMENTAL_PGDELTA_FORMAT_OPTIONS",
+      config.experimental.pgdelta?.format_options,
+      projectEnvValues,
+    ) ?? "";
+
+  // Every PURE Config.Validate check this module/legacy-config-validate.ts jointly own is
+  // deferred to this single call, positioned here (where the last of those checks ran until
+  // this commit), in Go's exact relative order against every OTHER pure check. This means a
+  // config broken in TWO OR MORE independent pure-section ways reports whichever Go considers
+  // first among the ones broken — unchanged from before. The only real reordering risk is
+  // between a pure check and one of this function's 3 I/O reads (signing keys, api.tls
+  // cert/key, email template/notification content) that in THIS function's source sits between
+  // two pure sections (e.g. the signing-keys read sits between the captcha check above and the
+  // passkey/hooks/mfa/email/smtp/third_party checks folded into `authInput` above) — that I/O
+  // read now effectively runs BEFORE those later pure checks rather than interleaved at its
+  // original relative position. This is the same narrow, accepted, documented tradeoff recorded
+  // in `legacy-config-validate.ts`'s module header; every existing test constructs exactly one
+  // validation failure at a time, so it has zero effect on any real test.
+  const apiInput: LegacyApiInput = {
+    enabled: apiEnabled,
+    port: apiPort,
+    tls: { enabled: apiTlsEnabled, certPath: apiTlsCertPath, keyPath: apiTlsKeyPath },
+  };
+  const dbInput: LegacyDbInput = { port: dbPort, majorVersion };
+  const studioInput: LegacyStudioInput = {
+    enabled: studioEnabled,
+    port: studioPort,
+    apiUrl: studioApiUrl,
+  };
+  const localSmtpInput: LegacyLocalSmtpInput = { enabled: mailpitEnabled, port: mailpitPort };
+  const analyticsInput: LegacyAnalyticsInput = {
+    enabled: analyticsEnabled,
+    backend: analyticsBackend,
+    gcpProjectId: gcpProjectId ?? "",
+    gcpProjectNumber: gcpProjectNumber ?? "",
+    gcpJwtPath: gcpJwtPath ?? "",
+  };
+  const experimentalInput: LegacyExperimentalInput = {
+    webhooksPresent,
+    webhooksEnabled,
+    pgdeltaFormatOptions,
+  };
+
+  const input: LegacyConfigValidationInput = {
+    projectId: resolvedProjectId,
+    api: apiInput,
+    db: dbInput,
+    storageBucketNames,
+    studio: studioInput,
+    localSmtp: localSmtpInput,
+    auth: authInput,
+    functionSlugs,
+    edgeRuntimeDenoVersion: denoVersion,
+    analytics: analyticsInput,
+    experimental: experimentalInput,
+  };
+  legacyValidateResolvedConfig(input);
+  // Both run after the single shared `legacyValidateResolvedConfig` call per the module's
+  // documented sms/external-vs-third_party ordering tradeoff (third_party is checked inside that
+  // call; sms/external run after it here) — in Go's own relative sms-then-external order
+  // (`config.go:1145-1150`). `validateAuthSmsProviders` re-runs `@supabase/config`'s schema-level
+  // switch with env overrides applied (see its doc comment); `validateAuthExternalProviders` is
+  // D-only per `legacy-config-validate.ts`'s module header ("auth.external ... stays 100% inline
+  // in D") — this is L's port of D's identical inline block.
+  if (authEnabled) {
+    validateAuthSmsProviders(authDocument, config.auth.sms, projectEnvValues);
+    validateAuthExternalProviders(authDocument, config.auth.external, projectEnvValues);
+  }
+
+  const openaiApiKey = legacyDecryptAuthSecret(
+    legacyEnvOverride(
+      "SUPABASE_STUDIO_OPENAI_API_KEY",
+      config.studio.openai_api_key,
+      projectEnvValues,
+    ),
+    projectEnvValues,
+  );
+
+  return {
+    apiUrl: apiExternalUrl,
+    apiPort,
+    dbPort,
+    studioPort,
+    rootKey,
+    openaiApiKey,
+    authSiteUrl: siteUrl,
+    authJwtIssuer: jwtIssuer,
+    authJwtExpiry: jwtExpiry,
+    authAdditionalRedirectUrls: additionalRedirectUrls,
+    authEnableSignup: enableSignup,
+    authEnableAnonymousSignIns: enableAnonymousSignIns,
+    authEnableRefreshTokenRotation: enableRefreshTokenRotation,
+    authRefreshTokenReuseInterval: refreshTokenReuseInterval,
+    authEnableManualLinking: enableManualLinking,
+    authMinimumPasswordLength: minimumPasswordLength,
+    authPasswordRequirements: passwordRequirements,
+    restUrl: apiUrlWithPath(apiExternalUrl, "/rest/v1"),
+    graphqlUrl: apiUrlWithPath(apiExternalUrl, "/graphql/v1"),
+    functionsUrl: apiUrlWithPath(apiExternalUrl, "/functions/v1"),
+    mcpUrl: apiUrlWithPath(apiExternalUrl, "/mcp"),
+    studioUrl: `http://${hostname}:${studioPort}`,
+    mailpitUrl: `http://${hostname}:${mailpitPort}`,
+    dbUrl: `postgresql://postgres:${DEFAULT_DB_PASSWORD}@${hostname}:${dbPort}/postgres`,
+    publishableKey: resolveOpaqueKey(
+      legacyDecryptAuthSecret(
+        legacyEnvOverride(
+          "SUPABASE_AUTH_PUBLISHABLE_KEY",
+          config.auth.publishable_key,
+          projectEnvValues,
+        ),
+        projectEnvValues,
+      ),
+      defaultPublishableKey,
+    ),
+    secretKey: resolveOpaqueKey(
+      legacyDecryptAuthSecret(
+        legacyEnvOverride("SUPABASE_AUTH_SECRET_KEY", config.auth.secret_key, projectEnvValues),
+        projectEnvValues,
+      ),
+      defaultSecretKey,
+    ),
+    jwtSecret,
+    anonKey: resolveSignedKey(
+      legacyDecryptAuthSecret(
+        legacyEnvOverride("SUPABASE_AUTH_ANON_KEY", config.auth.anon_key, projectEnvValues),
+        projectEnvValues,
+      ),
+      jwtSecret,
+      signingKey,
+      "anon",
+    ),
+    serviceRoleKey: resolveSignedKey(
+      legacyDecryptAuthSecret(
+        legacyEnvOverride(
+          "SUPABASE_AUTH_SERVICE_ROLE_KEY",
+          config.auth.service_role_key,
+          projectEnvValues,
+        ),
+        projectEnvValues,
+      ),
+      jwtSecret,
+      signingKey,
+      "service_role",
+    ),
+    storageS3Url: apiUrlWithPath(apiExternalUrl, "/storage/v1/s3"),
+    storageS3AccessKeyId: DEFAULT_S3_ACCESS_KEY_ID,
+    storageS3SecretAccessKey: DEFAULT_S3_SECRET_ACCESS_KEY,
+    storageS3Region: DEFAULT_S3_REGION,
+    analyticsEnabled,
+    analyticsBackend,
+    gcpProjectId: gcpProjectId ?? "",
+    gcpProjectNumber: gcpProjectNumber ?? "",
+    gcpJwtPath: gcpJwtPath ?? "",
+  };
+}
+
+/**
+ * Go's `(a *auth) ResolveJWKS(ctx)` (`apps/cli-go/pkg/config/config.go:1727-1806`) — reached only
+ * from the future native `start` port (`internal/start/start.go:274-277`: a fetch failure there
+ * fails the whole `start` command outright). Deliberately NOT folded into
+ * {@link LegacyLocalConfigValues}/{@link legacyResolveLocalConfigValues}: that resolver is
+ * synchronous and runs on every `stop`/`status` invocation (see `legacy-status-values.ts`/
+ * `stop.handler.ts`), so adding this function's network round-trip (the OIDC discovery + remote
+ * JWKS fetch) there would tax two commands that never render a JWKS. This is a standalone sibling
+ * `start`-only callers invoke separately, alongside (not instead of) `legacyResolveLocalConfigValues`.
+ *
+ * Divergences from the structurally similar (but functionally unrelated) `resolveAuthArtifacts` in
+ * `shared/functions/serve.ts` (Go's equivalent call site for THAT function is
+ * `internal/functions/serve/`, out of scope for this port) — deliberately NOT copied here:
+ *  - a remote-JWKS fetch failure is a hard, propagating error here (matching `start.go:274-277`
+ *    returning the error outright); `serve.ts` instead swallows the failure and continues with
+ *    zero remote keys, a `functions serve`-only leniency with no equivalent in `ResolveJWKS`.
+ *  - this never injects `serve.ts`'s `defaultSigningKey` EC key — that key exists only for
+ *    `functions serve`'s own local-dev defaults and has no equivalent in `ResolveJWKS`.
+ *
+ * Reuses {@link toPublicJwk}/{@link resolveThirdPartyIssuerUrl}/{@link resolveRemoteJwks}
+ * (`shared/auth/jwks.ts`) rather than re-implementing them a second time — see that module's
+ * header. `jwtSecret` is accepted as a parameter (the same value already resolved onto
+ * {@link LegacyLocalConfigValues.jwtSecret} by {@link legacyResolveLocalConfigValues}/
+ * {@link resolveJwtSecret}) rather than recomputed, so the two functions never disagree on it.
+ *
+ * `authEnabled`/`signingKeysPath` ARE recomputed here (cheap, pure `legacyEnvOverride`/
+ * `legacyEnvOverrideBool` calls, no I/O) rather than threaded through from the caller's own
+ * computation of the same values, keeping this function self-contained. Both this function and
+ * `legacyResolveLocalConfigValues`'s own `signingKey` now share
+ * {@link legacyResolveConfiguredSigningKeys} — this function needs the FULL key array (see
+ * {@link loadSigningKeys}), the other only the first key to sign anon/service_role.
+ *
+ * `signingKeysPath`'s effect on the oct-JWT-secret fallback below matches Go's literal field
+ * checks exactly, NOT "is auth enabled": Go's `a.SigningKeysPath` (`pkg/config/config.go:928-929`)
+ * is resolved to an absolute path unconditionally, regardless of `auth.enabled` — only the file
+ * read INTO `a.SigningKeys` is gated on `c.Auth.Enabled` (`config.go:1087,1110-1116`). So a config
+ * with `auth.enabled = false` and a configured `signing_keys_path` resolves `signingKeys: []`
+ * (never read) with `signingKeysPath` still non-empty — Go's fallback check
+ * (`len(a.SigningKeysPath) == 0`) is then FALSE, so the oct fallback is skipped too, matching this
+ * function's `signingKeysPath` emptiness check below rather than `!authEnabled`.
+ *
+ * @throws {LegacyConfigValidateError} when more than one `auth.third_party.*` provider is
+ * enabled, an enabled provider is missing a required field, or the remote JWKS fetch (OIDC
+ * discovery or the JWKS document itself) fails — matching Go's `ResolveJWKS` returning that error
+ * outright, propagated here as this file's own error type rather than a bare `Error`.
+ */
+export async function legacyResolveLocalJwks(
+  config: ProjectConfig,
+  workdir: string,
+  jwtSecret: string,
+  projectEnvValues: Readonly<Record<string, string>> | undefined = undefined,
+): Promise<string> {
+  const signingKeysPath = legacyEnvOverride(
+    "SUPABASE_AUTH_SIGNING_KEYS_PATH",
+    config.auth.signing_keys_path,
+    projectEnvValues,
+  );
+  // Go's `a.SigningKeys` is UNCONDITIONALLY seeded with the single default ES256 key at
+  // `NewConfig()` time (`pkg/config/config.go:504-515`) — every resolved config carries it,
+  // regardless of `auth.enabled`. It is only ever REPLACED by a configured
+  // `signing_keys_path` file, and only when that file is actually read (gated on
+  // `auth.enabled && signing_keys_path set`, `config.go:1087,1110-1116` — see
+  // {@link legacyResolveConfiguredSigningKeys}). So `ResolveJWKS` (which iterates
+  // `a.SigningKeys` with no `auth.enabled` gate of its own) always publishes either the
+  // file's keys or this default — never neither. `GOTRUE_JWT_KEYS` signs with the same
+  // default (`services/gotrue.service.ts`'s `LEGACY_GOTRUE_DEFAULT_SIGNING_KEY`), so the
+  // two must never disagree on which key applies here.
+  const signingKeys: ReadonlyArray<LegacyJwk> = legacyResolveConfiguredSigningKeys(
+    config,
+    workdir,
+    projectEnvValues,
+  ) ?? [LEGACY_DEFAULT_SIGNING_KEY];
+
+  // Same fixed provider order + `SUPABASE_AUTH_THIRD_PARTY_<PROVIDER>_*` overrides as the
+  // `thirdParty: Array<LegacyThirdPartyInput>` block in `legacyResolveLocalConfigValues` above,
+  // but built as a `ThirdPartyProvidersLike` (every provider's full field set, including auth0's
+  // `tenant_region`) rather than `LegacyThirdPartyInput` (a validation-only shape with no
+  // `tenant_region` field) — {@link resolveThirdPartyIssuerUrl} needs the full set to build the
+  // issuer URL, not just validate presence.
+  const thirdParty: ThirdPartyProvidersLike = {
+    firebase: {
+      enabled: legacyEnvOverrideBool(
+        "SUPABASE_AUTH_THIRD_PARTY_FIREBASE_ENABLED",
+        config.auth.third_party.firebase.enabled,
+        "auth.third_party.firebase.enabled",
+        projectEnvValues,
+      ),
+      project_id: legacyEnvOverride(
+        "SUPABASE_AUTH_THIRD_PARTY_FIREBASE_PROJECT_ID",
+        config.auth.third_party.firebase.project_id,
+        projectEnvValues,
+      ),
+    },
+    auth0: {
+      enabled: legacyEnvOverrideBool(
+        "SUPABASE_AUTH_THIRD_PARTY_AUTH0_ENABLED",
+        config.auth.third_party.auth0.enabled,
+        "auth.third_party.auth0.enabled",
+        projectEnvValues,
+      ),
+      tenant: legacyEnvOverride(
+        "SUPABASE_AUTH_THIRD_PARTY_AUTH0_TENANT",
+        config.auth.third_party.auth0.tenant,
+        projectEnvValues,
+      ),
+      tenant_region: legacyEnvOverride(
+        "SUPABASE_AUTH_THIRD_PARTY_AUTH0_TENANT_REGION",
+        config.auth.third_party.auth0.tenant_region,
+        projectEnvValues,
+      ),
+    },
+    aws_cognito: {
+      enabled: legacyEnvOverrideBool(
+        "SUPABASE_AUTH_THIRD_PARTY_AWS_COGNITO_ENABLED",
+        config.auth.third_party.aws_cognito.enabled,
+        "auth.third_party.aws_cognito.enabled",
+        projectEnvValues,
+      ),
+      user_pool_id: legacyEnvOverride(
+        "SUPABASE_AUTH_THIRD_PARTY_AWS_COGNITO_USER_POOL_ID",
+        config.auth.third_party.aws_cognito.user_pool_id,
+        projectEnvValues,
+      ),
+      user_pool_region: legacyEnvOverride(
+        "SUPABASE_AUTH_THIRD_PARTY_AWS_COGNITO_USER_POOL_REGION",
+        config.auth.third_party.aws_cognito.user_pool_region,
+        projectEnvValues,
+      ),
+    },
+    clerk: {
+      enabled: legacyEnvOverrideBool(
+        "SUPABASE_AUTH_THIRD_PARTY_CLERK_ENABLED",
+        config.auth.third_party.clerk.enabled,
+        "auth.third_party.clerk.enabled",
+        projectEnvValues,
+      ),
+      domain: legacyEnvOverride(
+        "SUPABASE_AUTH_THIRD_PARTY_CLERK_DOMAIN",
+        config.auth.third_party.clerk.domain,
+        projectEnvValues,
+      ),
+    },
+    workos: {
+      enabled: legacyEnvOverrideBool(
+        "SUPABASE_AUTH_THIRD_PARTY_WORKOS_ENABLED",
+        config.auth.third_party.workos.enabled,
+        "auth.third_party.workos.enabled",
+        projectEnvValues,
+      ),
+      issuer_url: legacyEnvOverride(
+        "SUPABASE_AUTH_THIRD_PARTY_WORKOS_ISSUER_URL",
+        config.auth.third_party.workos.issuer_url,
+        projectEnvValues,
+      ),
+    },
+  };
+
+  // Go's `Auth.ThirdParty.validate()` (the "at most one enabled" + required-field checks
+  // `resolveThirdPartyIssuerUrl` performs) only runs inside `Config.Validate`'s `if
+  // c.Auth.Enabled` block (`config.go:1087-1153`) — but `ResolveJWKS`/`IssuerURL()` (this whole
+  // function) is called UNCONDITIONALLY (`internal/start/start.go:274`), regardless of
+  // `auth.enabled`. When auth is enabled, `legacyResolveLocalConfigValues`'s own gated
+  // `validateAuthThirdPartyProviders`-equivalent check already ran first, so the validating
+  // resolver here is safe/redundant-but-harmless. When auth is disabled, that earlier validation
+  // is (correctly) skipped, so this function must NOT re-introduce it — using the unchecked,
+  // no-throw `IssuerURL()`-only builder instead, matching Go exactly.
+  const authEnabled = legacyEnvOverrideBool(
+    "SUPABASE_AUTH_ENABLED",
+    config.auth.enabled,
+    "auth.enabled",
+    projectEnvValues,
+  );
+  let issuerUrl: string | undefined;
+  if (authEnabled) {
+    try {
+      issuerUrl = resolveThirdPartyIssuerUrl(thirdParty);
+    } catch (cause) {
+      throw new LegacyConfigValidateError(cause instanceof Error ? cause.message : String(cause));
+    }
+  } else {
+    issuerUrl = thirdPartyIssuerUrlUnchecked(thirdParty);
+  }
+
+  const keys: unknown[] = [];
+  // Go's `ResolveJWKS` only attempts the remote fetch when `issuerURL != ""`
+  // (`apps/cli-go/pkg/config/config.go:1732`) — a provider's own `issuerURL()` can return the
+  // empty string with no validation (e.g. workos's `issuerURL()` is a raw field read,
+  // `config.go:1631-1632`), so an enabled-but-unconfigured third-party provider with
+  // `auth.enabled = false` must be tolerated, not fetched.
+  if (issuerUrl !== undefined && issuerUrl.length > 0) {
+    try {
+      keys.push(...(await resolveRemoteJwks(issuerUrl)));
+    } catch (cause) {
+      throw new LegacyConfigValidateError(cause instanceof Error ? cause.message : String(cause));
+    }
+  }
+  keys.push(...signingKeys.map(toPublicJwk));
+  if (signingKeysPath === undefined || signingKeysPath.length === 0) {
+    keys.push({ kty: "oct", k: Buffer.from(jwtSecret).toString("base64url") });
+  }
+
+  return JSON.stringify({ keys });
+}
diff --git a/apps/cli/src/legacy/shared/legacy-local-config-values.unit.test.ts b/apps/cli/src/legacy/shared/legacy-local-config-values.unit.test.ts
new file mode 100644
index 0000000000..d6aef1658c
--- /dev/null
+++ b/apps/cli/src/legacy/shared/legacy-local-config-values.unit.test.ts
@@ -0,0 +1,3037 @@
+import { generateKeyPairSync } from "node:crypto";
+import { mkdirSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+
+import { ProjectConfigSchema, type ProjectConfig } from "@supabase/config";
+import { Schema } from "effect";
+import { importJWK, jwtVerify } from "jose";
+import { afterEach, describe, expect, it, vi } from "vitest";
+
+import { useLegacyTempWorkdir } from "../../../tests/helpers/legacy-mocks.ts";
+import { LEGACY_DEFAULT_SIGNING_KEY } from "./legacy-go-jwt.ts";
+import {
+  LEGACY_POSTGRES_DEFAULT_ROOT_KEY,
+  LegacyInvalidAnalyticsBackendEnvOverrideError,
+  LegacyInvalidBoolEnvOverrideError,
+  LegacyInvalidEdgeRuntimePolicyEnvOverrideError,
+  LegacyInvalidJwtSecretError,
+  LegacyInvalidPoolModeEnvOverrideError,
+  LegacyInvalidPortEnvOverrideError,
+  LegacyInvalidRealtimeIpVersionEnvOverrideError,
+  LegacyInvalidSessionReplicationRoleEnvOverrideError,
+  legacyEnvOverrideApiMaxRows,
+  legacyEnvOverrideDefaultPoolSize,
+  legacyEnvOverrideEdgeRuntimePolicy,
+  legacyEnvOverrideMajorVersion,
+  legacyEnvOverrideMaxClientConn,
+  legacyEnvOverridePoolMode,
+  legacyEnvOverrideRealtimeIpVersion,
+  legacyEnvOverrideRealtimeMaxHeaderLength,
+  legacyRawUnmodeledBool,
+  legacyResolveAuthCaptcha,
+  legacyResolveAuthEmail,
+  legacyResolveAuthEmailSmtp,
+  legacyResolveAuthExternalProviders,
+  legacyResolveAuthHooks,
+  legacyResolveAuthSms,
+  legacyResolveDbSettingsEnvOverrides,
+  legacyResolveLocalConfigValues,
+  legacyResolveLocalJwks,
+} from "./legacy-local-config-values.ts";
+
+const decodeConfig = Schema.decodeUnknownSync(ProjectConfigSchema);
+const WORKDIR = "/tmp/legacy-local-config-values-test";
+
+function baseConfig(overrides: Record<string, unknown> = {}): ProjectConfig {
+  return decodeConfig({ project_id: "test", ...overrides });
+}
+
+/** RSA JWK matching Go's `JWK` struct field names (kty/n/e/d/p/q/dp/dq/qi). */
+function generateRsaJwk(): Record<string, unknown> {
+  const { privateKey } = generateKeyPairSync("rsa", { modulusLength: 2048 });
+  const jwk = privateKey.export({ format: "jwk" });
+  return { ...jwk, alg: "RS256", kid: "test-rsa-kid" };
+}
+
+function writeSigningKeys(workdir: string, jwks: ReadonlyArray<Record<string, unknown>>) {
+  const supabaseDir = join(workdir, "supabase");
+  mkdirSync(supabaseDir, { recursive: true });
+  writeFileSync(join(supabaseDir, "signing_keys.json"), JSON.stringify(jwks));
+}
+
+describe("legacyResolveLocalConfigValues", () => {
+  it("derives every URL from api.external_url when unset", () => {
+    const config = baseConfig();
+    const values = legacyResolveLocalConfigValues(config, "127.0.0.1", WORKDIR);
+
+    expect(values.apiUrl).toBe("http://127.0.0.1:54321");
+    expect(values.restUrl).toBe("http://127.0.0.1:54321/rest/v1");
+    expect(values.graphqlUrl).toBe("http://127.0.0.1:54321/graphql/v1");
+    expect(values.functionsUrl).toBe("http://127.0.0.1:54321/functions/v1");
+    expect(values.mcpUrl).toBe("http://127.0.0.1:54321/mcp");
+    expect(values.storageS3Url).toBe("http://127.0.0.1:54321/storage/v1/s3");
+    expect(values.studioUrl).toBe("http://127.0.0.1:54323");
+    expect(values.mailpitUrl).toBe("http://127.0.0.1:54324");
+  });
+
+  it("uses https and the configured port when api.tls.enabled", () => {
+    const config = baseConfig({ api: { tls: { enabled: true }, port: 54321 } });
+    const values = legacyResolveLocalConfigValues(config, "127.0.0.1", WORKDIR);
+    expect(values.apiUrl).toBe("https://127.0.0.1:54321");
+  });
+
+  it("uses api.external_url verbatim when configured", () => {
+    const config = baseConfig({ api: { external_url: "https://example.test" } });
+    const values = legacyResolveLocalConfigValues(config, "127.0.0.1", WORKDIR);
+    expect(values.apiUrl).toBe("https://example.test");
+    expect(values.restUrl).toBe("https://example.test/rest/v1");
+  });
+
+  it("brackets an IPv6 hostname when building host:port", () => {
+    const config = baseConfig();
+    const values = legacyResolveLocalConfigValues(config, "::1", WORKDIR);
+    expect(values.apiUrl).toBe("http://[::1]:54321");
+  });
+
+  it("builds the db URL with the hardcoded postgres password", () => {
+    const config = baseConfig({ db: { port: 54322 } });
+    const values = legacyResolveLocalConfigValues(config, "127.0.0.1", WORKDIR);
+    expect(values.dbUrl).toBe("postgresql://postgres:postgres@127.0.0.1:54322/postgres");
+  });
+
+  it("falls back to the default JWT secret and opaque keys when unset", () => {
+    const config = baseConfig();
+    const values = legacyResolveLocalConfigValues(config, "127.0.0.1", WORKDIR);
+    expect(values.jwtSecret).toBe("super-secret-jwt-token-with-at-least-32-characters-long");
+    expect(values.publishableKey).toBe("sb_publishable_ACJWlzQHlZjBrEguHvfOxg_3BJgxAaH");
+    expect(values.secretKey).toBe("sb_secret_N7UND0UgjKTVK-Uodkm0Hg_xSvEMPvz");
+  });
+
+  it("uses configured opaque keys verbatim when set", () => {
+    const config = baseConfig({
+      auth: { publishable_key: "sb_publishable_custom", secret_key: "sb_secret_custom" },
+    });
+    const values = legacyResolveLocalConfigValues(config, "127.0.0.1", WORKDIR);
+    expect(values.publishableKey).toBe("sb_publishable_custom");
+    expect(values.secretKey).toBe("sb_secret_custom");
+  });
+
+  it("signs the default anon/service_role JWTs from the resolved secret", () => {
+    const config = baseConfig();
+    const values = legacyResolveLocalConfigValues(config, "127.0.0.1", WORKDIR);
+    // Byte-exact Go-parity shape is covered by legacy-go-jwt.unit.test.ts; here we
+    // only assert the resolver wires the default secret through to both roles.
+    const [, anonPayload] = values.anonKey.split(".");
+    const [, serviceRolePayload] = values.serviceRoleKey.split(".");
+    expect(JSON.parse(Buffer.from(anonPayload ?? "", "base64url").toString())).toMatchObject({
+      role: "anon",
+    });
+    expect(JSON.parse(Buffer.from(serviceRolePayload ?? "", "base64url").toString())).toMatchObject(
+      { role: "service_role" },
+    );
+  });
+
+  it("uses configured anon/service_role keys verbatim when set", () => {
+    const config = baseConfig({
+      auth: { anon_key: "configured-anon", service_role_key: "configured-service-role" },
+    });
+    const values = legacyResolveLocalConfigValues(config, "127.0.0.1", WORKDIR);
+    expect(values.anonKey).toBe("configured-anon");
+    expect(values.serviceRoleKey).toBe("configured-service-role");
+  });
+
+  it("signs anon/service_role JWTs from a configured jwt_secret", () => {
+    const config = baseConfig({ auth: { jwt_secret: "a".repeat(32) } });
+    const values = legacyResolveLocalConfigValues(config, "127.0.0.1", WORKDIR);
+    expect(values.jwtSecret).toBe("a".repeat(32));
+    expect(values.anonKey).not.toBe("");
+  });
+
+  it("rejects a configured jwt_secret shorter than 16 characters", () => {
+    // Go's Config.Validate fails this at config-load time, before any command
+    // can render output (pkg/config/apikeys.go:45-47) — reproduced as a thrown
+    // error here rather than silently signing with the too-short secret.
+    const config = baseConfig({ auth: { jwt_secret: "a".repeat(15) } });
+    expect(() => legacyResolveLocalConfigValues(config, "127.0.0.1", WORKDIR)).toThrow(
+      LegacyInvalidJwtSecretError,
+    );
+  });
+
+  describe("encrypted auth secrets", () => {
+    // Go's test vector (`apps/cli-go/pkg/config/secret_test.go`): this ciphertext
+    // decrypts to "value" under the keypair below.
+    const VAULT_PRIVATE_KEY = "7fd7210cef8f331ee8c55897996aaaafd853a2b20a4dc73d6d75759f65d2a7eb";
+    const VAULT_ENCRYPTED =
+      "encrypted:BKiXH15AyRzeohGyUrmB6cGjSklCrrBjdesQlX1VcXo/Xp20Bi2gGZ3AlIqxPQDmjVAALnhZamKnuY73l8Dz1P+BYiZUgxTSLzdCvdYUyVbNekj2UudbdUizBViERtZkuQwZHIv/";
+
+    afterEach(() => {
+      delete process.env["DOTENV_PRIVATE_KEY"];
+    });
+
+    it("decrypts an encrypted: jwt_secret when DOTENV_PRIVATE_KEY is set", () => {
+      // "value" is only 5 characters, shorter than Go's minimum JWT secret length,
+      // so pad it out the way a real deployment's decrypted secret would be sized.
+      process.env["DOTENV_PRIVATE_KEY"] = VAULT_PRIVATE_KEY;
+      const config = baseConfig({ auth: { jwt_secret: VAULT_ENCRYPTED } });
+      expect(() => legacyResolveLocalConfigValues(config, "127.0.0.1", WORKDIR)).toThrow(
+        LegacyInvalidJwtSecretError,
+      );
+    });
+
+    it("decrypts an encrypted: publishable_key when DOTENV_PRIVATE_KEY is set", () => {
+      process.env["DOTENV_PRIVATE_KEY"] = VAULT_PRIVATE_KEY;
+      const config = baseConfig({ auth: { publishable_key: VAULT_ENCRYPTED } });
+      const values = legacyResolveLocalConfigValues(config, "127.0.0.1", WORKDIR);
+      expect(values.publishableKey).toBe("value");
+    });
+
+    it("fails config loading for an encrypted: secret with no private key, matching Go", () => {
+      // Go aborts the whole command with `failed to parse config: <error>` rather
+      // than silently using the ciphertext as literal key material
+      // (`secret.go:30-73`, `config.go:704`).
+      const config = baseConfig({ auth: { publishable_key: VAULT_ENCRYPTED } });
+      expect(() => legacyResolveLocalConfigValues(config, "127.0.0.1", WORKDIR)).toThrow(
+        "failed to parse config: missing private key",
+      );
+    });
+
+    it("decrypts an encrypted: auth.email.smtp.pass, matching Go's Secret-typed Smtp.Pass field", () => {
+      process.env["DOTENV_PRIVATE_KEY"] = VAULT_PRIVATE_KEY;
+      const document = { auth: { email: { smtp: { enabled: true, pass: VAULT_ENCRYPTED } } } };
+      const resolved = legacyResolveAuthEmailSmtp(document.auth, undefined);
+      expect(resolved?.pass).toBe("value");
+    });
+
+    it("decrypts an encrypted: studio.openai_api_key, matching Go's Secret-typed OpenaiApiKey field", () => {
+      process.env["DOTENV_PRIVATE_KEY"] = VAULT_PRIVATE_KEY;
+      const config = baseConfig({ studio: { openai_api_key: VAULT_ENCRYPTED } });
+      const values = legacyResolveLocalConfigValues(config, "127.0.0.1", WORKDIR);
+      expect(values.openaiApiKey).toBe("value");
+    });
+
+    it("decrypts an encrypted: SUPABASE_AUTH_* env override, not just the config.toml value", () => {
+      // Go's decrypt hook runs on whatever value reaches the config.Secret field,
+      // whether it was sourced from config.toml or a Viper env override.
+      process.env["DOTENV_PRIVATE_KEY"] = VAULT_PRIVATE_KEY;
+      const config = baseConfig();
+      const values = legacyResolveLocalConfigValues(config, "127.0.0.1", WORKDIR, {
+        SUPABASE_AUTH_SECRET_KEY: VAULT_ENCRYPTED,
+      });
+      expect(values.secretKey).toBe("value");
+      delete process.env["DOTENV_PRIVATE_KEY"];
+    });
+  });
+
+  it("rejects an explicit empty project_id, matching Go's Config.Validate", () => {
+    // Go's Config.Validate checks ProjectId first, before any other field
+    // (pkg/config/config.go:990-991). The workdir-basename default is merged
+    // in as a viper default BEFORE config.toml is merged, so an explicit
+    // `project_id = ""` in the file overwrites that default with the literal
+    // empty string rather than being treated as absent — Go fails outright.
+    const config = baseConfig({ project_id: "" });
+    expect(() => legacyResolveLocalConfigValues(config, "127.0.0.1", WORKDIR)).toThrow(
+      "Missing required field in config: project_id",
+    );
+  });
+
+  it("does not reject an absent project_id when the workdir basename sanitizes to a non-empty value", () => {
+    const config = Schema.decodeUnknownSync(ProjectConfigSchema)({});
+    expect(() => legacyResolveLocalConfigValues(config, "127.0.0.1", WORKDIR)).not.toThrow();
+  });
+
+  it("rejects an absent project_id when the workdir basename sanitizes to empty, matching Go", () => {
+    // Go's `mergeDefaultValues` merges `sanitizeProjectId(filepath.Base(cwd))` in as a viper
+    // DEFAULT before config.toml is merged (config.go:690-699, via Eject at config.go:561-570) —
+    // so `c.ProjectId` is never Go's zero value by the time `Validate` runs. A workdir whose
+    // basename sanitizes to `""` (every character invalid, e.g. `!!!`) therefore still fails
+    // config loading in Go even with no `project_id` key in the file at all.
+    const config = Schema.decodeUnknownSync(ProjectConfigSchema)({});
+    expect(() => legacyResolveLocalConfigValues(config, "127.0.0.1", "/tmp/!!!")).toThrow(
+      "Missing required field in config: project_id",
+    );
+  });
+
+  it("lets SUPABASE_PROJECT_ID override an absent project_id whose basename sanitizes to empty", () => {
+    const config = Schema.decodeUnknownSync(ProjectConfigSchema)({});
+    expect(() =>
+      legacyResolveLocalConfigValues(config, "127.0.0.1", "/tmp/!!!", {
+        SUPABASE_PROJECT_ID: "env-project",
+      }),
+    ).not.toThrow();
+  });
+
+  it("lets SUPABASE_PROJECT_ID override an explicit empty project_id", () => {
+    // Viper's AutomaticEnv binds SUPABASE_PROJECT_ID with higher precedence
+    // than config.toml (config.go:529-535), so a non-empty env override must
+    // win even when the file's project_id is explicitly empty.
+    const config = baseConfig({ project_id: "" });
+    expect(() =>
+      legacyResolveLocalConfigValues(config, "127.0.0.1", WORKDIR, {
+        SUPABASE_PROJECT_ID: "env-project",
+      }),
+    ).not.toThrow();
+  });
+
+  it("hardcodes the Go-parity local S3 credentials", () => {
+    const config = baseConfig();
+    const values = legacyResolveLocalConfigValues(config, "127.0.0.1", WORKDIR);
+    expect(values.storageS3AccessKeyId).toBe("625729a08b95bf1b7ff351a663f3a23c");
+    expect(values.storageS3SecretAccessKey).toBe(
+      "850181e4652dd023b7a98c58ae0d2d34bd487ee0cc3254aed6eda37307425907",
+    );
+    expect(values.storageS3Region).toBe("local");
+  });
+
+  describe("SUPABASE_AUTH_* env overrides", () => {
+    const tempRoot = useLegacyTempWorkdir("supabase-signing-keys-env-override-test-");
+
+    // Go's Config.Load binds Viper with SetEnvPrefix("SUPABASE") + AutomaticEnv()
+    // (pkg/config/config.go:529-535) — env vars take precedence over config.toml.
+    const ENV_KEYS = [
+      "SUPABASE_AUTH_JWT_SECRET",
+      "SUPABASE_AUTH_PUBLISHABLE_KEY",
+      "SUPABASE_AUTH_SECRET_KEY",
+      "SUPABASE_AUTH_ANON_KEY",
+      "SUPABASE_AUTH_SERVICE_ROLE_KEY",
+      "SUPABASE_AUTH_SIGNING_KEYS_PATH",
+    ] as const;
+
+    afterEach(() => {
+      for (const key of ENV_KEYS) delete process.env[key];
+    });
+
+    it("overrides jwt_secret even when config.toml sets one", () => {
+      process.env["SUPABASE_AUTH_JWT_SECRET"] = "b".repeat(32);
+      const config = baseConfig({ auth: { jwt_secret: "a".repeat(32) } });
+      const values = legacyResolveLocalConfigValues(config, "127.0.0.1", WORKDIR);
+      expect(values.jwtSecret).toBe("b".repeat(32));
+    });
+
+    it("overrides publishable_key/secret_key", () => {
+      process.env["SUPABASE_AUTH_PUBLISHABLE_KEY"] = "env-publishable";
+      process.env["SUPABASE_AUTH_SECRET_KEY"] = "env-secret";
+      const config = baseConfig({
+        auth: { publishable_key: "config-publishable", secret_key: "config-secret" },
+      });
+      const values = legacyResolveLocalConfigValues(config, "127.0.0.1", WORKDIR);
+      expect(values.publishableKey).toBe("env-publishable");
+      expect(values.secretKey).toBe("env-secret");
+    });
+
+    it("overrides anon_key/service_role_key", () => {
+      process.env["SUPABASE_AUTH_ANON_KEY"] = "env-anon";
+      process.env["SUPABASE_AUTH_SERVICE_ROLE_KEY"] = "env-service-role";
+      const config = baseConfig({
+        auth: { anon_key: "config-anon", service_role_key: "config-service-role" },
+      });
+      const values = legacyResolveLocalConfigValues(config, "127.0.0.1", WORKDIR);
+      expect(values.anonKey).toBe("env-anon");
+      expect(values.serviceRoleKey).toBe("env-service-role");
+    });
+
+    it("treats an empty env var as unset, matching Viper's default", () => {
+      process.env["SUPABASE_AUTH_JWT_SECRET"] = "";
+      const config = baseConfig({ auth: { jwt_secret: "a".repeat(32) } });
+      const values = legacyResolveLocalConfigValues(config, "127.0.0.1", WORKDIR);
+      expect(values.jwtSecret).toBe("a".repeat(32));
+    });
+
+    it("still applies the short-secret validation to an env-provided jwt_secret", () => {
+      process.env["SUPABASE_AUTH_JWT_SECRET"] = "too-short";
+      const config = baseConfig();
+      expect(() => legacyResolveLocalConfigValues(config, "127.0.0.1", WORKDIR)).toThrow(
+        LegacyInvalidJwtSecretError,
+      );
+    });
+
+    it("overrides signing_keys_path even when config.toml doesn't set one", async () => {
+      const jwk = generateRsaJwk();
+      writeSigningKeys(tempRoot.current, [jwk]);
+      process.env["SUPABASE_AUTH_SIGNING_KEYS_PATH"] = "signing_keys.json";
+      const config = baseConfig();
+      const values = legacyResolveLocalConfigValues(config, "127.0.0.1", tempRoot.current);
+
+      const publicJwk = { ...jwk, d: undefined, p: undefined, q: undefined, dp: undefined };
+      const publicKey = await importJWK(publicJwk, "RS256");
+      const { protectedHeader } = await jwtVerify(values.anonKey, publicKey);
+      expect(protectedHeader).toMatchObject({ alg: "RS256", kid: "test-rsa-kid" });
+    });
+
+    it("prefers an env-provided signing_keys_path over config.toml's", () => {
+      const envJwk = { ...generateRsaJwk(), kid: "env-kid" };
+      const configJwk = { ...generateRsaJwk(), kid: "config-kid" };
+      writeSigningKeys(tempRoot.current, [envJwk]);
+      const supabaseDir = join(tempRoot.current, "supabase");
+      writeFileSync(join(supabaseDir, "other_keys.json"), JSON.stringify([configJwk]));
+      process.env["SUPABASE_AUTH_SIGNING_KEYS_PATH"] = "signing_keys.json";
+      const config = baseConfig({ auth: { signing_keys_path: "other_keys.json" } });
+      const values = legacyResolveLocalConfigValues(config, "127.0.0.1", tempRoot.current);
+      const [header] = values.anonKey.split(".");
+      expect(JSON.parse(Buffer.from(header ?? "", "base64url").toString())).toMatchObject({
+        kid: "env-kid",
+      });
+    });
+  });
+
+  describe("SUPABASE_* env(VAR) indirection (Go's LoadEnvHook)", () => {
+    // Go's `LoadEnvHook` (`apps/cli-go/pkg/config/decode_hooks.go:15-23`) is
+    // the first mapstructure decode hook composed into `v.UnmarshalExact`
+    // (`config.go:749-753,769-772`), so it resolves a nested `env(VAR)`
+    // reference on ANY string mapstructure decodes into the struct — including
+    // a `SUPABASE_*` env-override value itself, not just a `config.toml`
+    // literal. `envOverride`'s callers (string/port/bool fields) must all see
+    // that same resolution.
+    const ENV_KEYS = ["SUPABASE_AUTH_JWT_SECRET", "SUPABASE_DB_PORT", "SUPABASE_API_ENABLED"];
+
+    afterEach(() => {
+      for (const key of ENV_KEYS) delete process.env[key];
+      delete process.env["INDIRECT_JWT_SECRET"];
+      delete process.env["INDIRECT_DB_PORT"];
+      delete process.env["INDIRECT_API_ENABLED"];
+    });
+
+    it("resolves a string override's env(VAR) indirection", () => {
+      process.env["SUPABASE_AUTH_JWT_SECRET"] = "env(INDIRECT_JWT_SECRET)";
+      process.env["INDIRECT_JWT_SECRET"] = "c".repeat(32);
+      const config = baseConfig({ auth: { jwt_secret: "a".repeat(32) } });
+      const values = legacyResolveLocalConfigValues(config, "127.0.0.1", WORKDIR);
+      expect(values.jwtSecret).toBe("c".repeat(32));
+    });
+
+    it("resolves a port override's env(VAR) indirection", () => {
+      process.env["SUPABASE_DB_PORT"] = "env(INDIRECT_DB_PORT)";
+      process.env["INDIRECT_DB_PORT"] = "54329";
+      const config = baseConfig({ db: { port: 54322 } });
+      const values = legacyResolveLocalConfigValues(config, "127.0.0.1", WORKDIR);
+      expect(values.dbUrl).toBe("postgresql://postgres:postgres@127.0.0.1:54329/postgres");
+    });
+
+    it("resolves a bool override's env(VAR) indirection", () => {
+      process.env["SUPABASE_API_ENABLED"] = "env(INDIRECT_API_ENABLED)";
+      process.env["INDIRECT_API_ENABLED"] = "false";
+      const config = baseConfig({
+        api: { enabled: true, tls: { enabled: true, cert_path: "missing-cert.pem" } },
+      });
+      // If the bool override weren't resolved through the indirection, the
+      // literal "env(INDIRECT_API_ENABLED)" string would fail Go's
+      // strconv.ParseBool acceptance set and throw LegacyInvalidBoolEnvOverrideError;
+      // resolving it to "false" disables api.enabled and skips the TLS check
+      // that would otherwise throw on the missing cert file.
+      expect(() => legacyResolveLocalConfigValues(config, "127.0.0.1", WORKDIR)).not.toThrow();
+    });
+
+    it("preserves the env(VAR) literal when the indirected var is unset, matching Go", () => {
+      process.env["SUPABASE_AUTH_JWT_SECRET"] = "env(INDIRECT_JWT_SECRET)";
+      const config = baseConfig({ auth: { jwt_secret: "a".repeat(32) } });
+      const values = legacyResolveLocalConfigValues(config, "127.0.0.1", WORKDIR);
+      // Go's LoadEnvHook only substitutes when the target var is non-empty
+      // (`decode_hooks.go:19-24`) — an unset indirection leaves the literal
+      // `env(VAR)` string, same as an unresolved config.toml-level reference.
+      expect(values.jwtSecret).toBe("env(INDIRECT_JWT_SECRET)");
+    });
+  });
+
+  describe("non-auth SUPABASE_* env overrides", () => {
+    // Go's Config.Load binds Viper with SetEnvPrefix("SUPABASE") + AutomaticEnv()
+    // generically across the whole config struct (pkg/config/config.go:529-535),
+    // not just auth fields — config_test.go:351,1061 exercise this against
+    // auth.site_url, and status.go's toValues() reads the already-overridden
+    // utils.Config.* directly, so every port/URL status derives must honor the
+    // same override.
+    const ENV_KEYS = [
+      "SUPABASE_DB_PORT",
+      "SUPABASE_STUDIO_PORT",
+      "SUPABASE_LOCAL_SMTP_PORT",
+      "SUPABASE_API_PORT",
+      "SUPABASE_API_EXTERNAL_URL",
+      "SUPABASE_STUDIO_API_URL",
+    ] as const;
+
+    afterEach(() => {
+      for (const key of ENV_KEYS) delete process.env[key];
+    });
+
+    it("overrides db.port for the derived DB URL and the exposed dbPort", () => {
+      process.env["SUPABASE_DB_PORT"] = "54329";
+      const config = baseConfig({ db: { port: 54322 } });
+      const values = legacyResolveLocalConfigValues(config, "127.0.0.1", WORKDIR);
+      expect(values.dbUrl).toBe("postgresql://postgres:postgres@127.0.0.1:54329/postgres");
+      expect(values.dbPort).toBe(54329);
+    });
+
+    it("overrides studio.port for the derived Studio URL", () => {
+      process.env["SUPABASE_STUDIO_PORT"] = "54330";
+      const config = baseConfig({ studio: { port: 54323 } });
+      const values = legacyResolveLocalConfigValues(config, "127.0.0.1", WORKDIR);
+      expect(values.studioUrl).toBe("http://127.0.0.1:54330");
+    });
+
+    it("overrides local_smtp.port for the derived Mailpit URL", () => {
+      process.env["SUPABASE_LOCAL_SMTP_PORT"] = "54331";
+      const config = baseConfig({ local_smtp: { port: 54324 } });
+      const values = legacyResolveLocalConfigValues(config, "127.0.0.1", WORKDIR);
+      expect(values.mailpitUrl).toBe("http://127.0.0.1:54331");
+    });
+
+    it("overrides api.port for every API-derived URL", () => {
+      process.env["SUPABASE_API_PORT"] = "54332";
+      const config = baseConfig({ api: { port: 54321 } });
+      const values = legacyResolveLocalConfigValues(config, "127.0.0.1", WORKDIR);
+      expect(values.apiUrl).toBe("http://127.0.0.1:54332");
+      expect(values.restUrl).toBe("http://127.0.0.1:54332/rest/v1");
+    });
+
+    it("overrides api.external_url even when config.toml sets one", () => {
+      process.env["SUPABASE_API_EXTERNAL_URL"] = "https://env-override.example";
+      const config = baseConfig({ api: { external_url: "https://config.example" } });
+      const values = legacyResolveLocalConfigValues(config, "127.0.0.1", WORKDIR);
+      expect(values.apiUrl).toBe("https://env-override.example");
+    });
+
+    it("treats an empty non-auth env var as unset, matching Viper's default", () => {
+      process.env["SUPABASE_DB_PORT"] = "";
+      const config = baseConfig({ db: { port: 54322 } });
+      const values = legacyResolveLocalConfigValues(config, "127.0.0.1", WORKDIR);
+      expect(values.dbUrl).toBe("postgresql://postgres:postgres@127.0.0.1:54322/postgres");
+    });
+
+    // Go's Config.Load decodes `SUPABASE_*_PORT` overrides as `uint16` via
+    // Viper's UnmarshalExact (pkg/config/config.go:749-756, WeaklyTypedInput
+    // decodes the override string with strconv.ParseUint and hard-fails on a
+    // malformed value) rather than silently producing a `NaN`-laced URL.
+    it.each([
+      "SUPABASE_DB_PORT",
+      "SUPABASE_STUDIO_PORT",
+      "SUPABASE_LOCAL_SMTP_PORT",
+      "SUPABASE_API_PORT",
+    ] as const)("rejects a malformed %s override instead of producing NaN", (envKey) => {
+      process.env[envKey] = "abc";
+      const config = baseConfig();
+      expect(() => legacyResolveLocalConfigValues(config, "127.0.0.1", WORKDIR)).toThrow(
+        LegacyInvalidPortEnvOverrideError,
+      );
+    });
+
+    it("rejects a SUPABASE_DB_PORT override above the uint16 range", () => {
+      process.env["SUPABASE_DB_PORT"] = "99999";
+      const config = baseConfig();
+      expect(() => legacyResolveLocalConfigValues(config, "127.0.0.1", WORKDIR)).toThrow(
+        LegacyInvalidPortEnvOverrideError,
+      );
+    });
+
+    // Go's `strconv.ParseUint(str, 0, 16)` (base 0) auto-detects octal/hex/binary literals for
+    // `SUPABASE_*_PORT` overrides too — same base-0 grammar as `legacyEnvOverrideUint`
+    // (`parseGoBaseZeroUint`), just capped at `uint16` instead of `uint64`. The old
+    // `/^\d+$/`-plus-`Number()` parsing silently misread a bare-leading-zero override as decimal
+    // instead of octal, and rejected a `0x`-prefixed override outright even though Go accepts it.
+    it("resolves an octal leading-zero SUPABASE_DB_PORT override to its octal value, not decimal", () => {
+      process.env["SUPABASE_DB_PORT"] = "010";
+      const config = baseConfig({ db: { port: 54322 } });
+      const values = legacyResolveLocalConfigValues(config, "127.0.0.1", WORKDIR);
+      expect(values.dbPort).toBe(8);
+      expect(values.dbUrl).toBe("postgresql://postgres:postgres@127.0.0.1:8/postgres");
+    });
+
+    it("resolves a 0x-prefixed SUPABASE_DB_PORT override as hex", () => {
+      process.env["SUPABASE_DB_PORT"] = "0x1F90";
+      const config = baseConfig({ db: { port: 54322 } });
+      const values = legacyResolveLocalConfigValues(config, "127.0.0.1", WORKDIR);
+      expect(values.dbPort).toBe(8080);
+    });
+
+    it("still resolves a plain decimal SUPABASE_DB_PORT override with no leading zero", () => {
+      process.env["SUPABASE_DB_PORT"] = "5432";
+      const config = baseConfig({ db: { port: 54322 } });
+      const values = legacyResolveLocalConfigValues(config, "127.0.0.1", WORKDIR);
+      expect(values.dbPort).toBe(5432);
+    });
+
+    it("rejects a 0x-prefixed SUPABASE_DB_PORT override exceeding the uint16 range", () => {
+      process.env["SUPABASE_DB_PORT"] = "0x1FFFF";
+      const config = baseConfig();
+      expect(() => legacyResolveLocalConfigValues(config, "127.0.0.1", WORKDIR)).toThrow(
+        LegacyInvalidPortEnvOverrideError,
+      );
+    });
+
+    // Unlike the malformed/out-of-range cases above (a decode-time hard-fail,
+    // uniform across all four SUPABASE_*_PORT fields), db.port=0 is a
+    // Config.Validate-time hard-fail specific to db.port: it has no `enabled`
+    // gate in Go, unlike api.port/studio.port/local_smtp.port
+    // (pkg/config/config.go:1006-1009,1031-1032,1070-1073,1081-1084).
+    it("rejects a zero SUPABASE_DB_PORT override, matching Go's required-field check", () => {
+      process.env["SUPABASE_DB_PORT"] = "0";
+      const config = baseConfig();
+      expect(() => legacyResolveLocalConfigValues(config, "127.0.0.1", WORKDIR)).toThrow(
+        "Missing required field in config: db.port",
+      );
+    });
+
+    // Unlike db.port, Go gates the api.port===0 rejection on api.enabled
+    // (pkg/config/config.go:1006-1008) — api.enabled defaults to true, so a
+    // configured or env-overridden zero port is rejected by default.
+    it("rejects a configured api.port of 0 when api is enabled", () => {
+      const config = baseConfig({ api: { port: 0 } });
+      expect(() => legacyResolveLocalConfigValues(config, "127.0.0.1", WORKDIR)).toThrow(
+        "Missing required field in config: api.port",
+      );
+    });
+
+    it("rejects a zero SUPABASE_API_PORT override when api is enabled", () => {
+      process.env["SUPABASE_API_PORT"] = "0";
+      const config = baseConfig();
+      expect(() => legacyResolveLocalConfigValues(config, "127.0.0.1", WORKDIR)).toThrow(
+        "Missing required field in config: api.port",
+      );
+    });
+
+    it("does not reject a zero api.port when api is disabled", () => {
+      const config = baseConfig({ api: { enabled: false, port: 0 } });
+      expect(() => legacyResolveLocalConfigValues(config, "127.0.0.1", WORKDIR)).not.toThrow();
+    });
+
+    // Go gates the studio.port===0 rejection on studio.enabled
+    // (pkg/config/config.go:1070-1073), same pattern as api.port above.
+    // studio.enabled defaults to true, so a configured or env-overridden zero
+    // port is rejected by default.
+    it("rejects a configured studio.port of 0 when studio is enabled", () => {
+      const config = baseConfig({ studio: { port: 0 } });
+      expect(() => legacyResolveLocalConfigValues(config, "127.0.0.1", WORKDIR)).toThrow(
+        "Missing required field in config: studio.port",
+      );
+    });
+
+    it("rejects a zero SUPABASE_STUDIO_PORT override when studio is enabled", () => {
+      process.env["SUPABASE_STUDIO_PORT"] = "0";
+      const config = baseConfig();
+      expect(() => legacyResolveLocalConfigValues(config, "127.0.0.1", WORKDIR)).toThrow(
+        "Missing required field in config: studio.port",
+      );
+    });
+
+    it("does not reject a zero studio.port when studio is disabled", () => {
+      const config = baseConfig({ studio: { enabled: false, port: 0 } });
+      expect(() => legacyResolveLocalConfigValues(config, "127.0.0.1", WORKDIR)).not.toThrow();
+    });
+
+    // Go's Config.Validate parses studio.api_url with net/url.Parse right
+    // after the port check, still inside `if c.Studio.Enabled`
+    // (pkg/config/config.go:1074-1078).
+    it("rejects a malformed studio.api_url (unterminated IPv6 literal) when studio is enabled", () => {
+      const config = baseConfig({ studio: { api_url: "http://[::1" } });
+      expect(() => legacyResolveLocalConfigValues(config, "127.0.0.1", WORKDIR)).toThrow(
+        `Invalid config for studio.api_url: parse "http://[::1": missing ']' in host`,
+      );
+    });
+
+    it("does not reject a malformed studio.api_url when studio is disabled", () => {
+      const config = baseConfig({ studio: { enabled: false, api_url: "http://[::1" } });
+      expect(() => legacyResolveLocalConfigValues(config, "127.0.0.1", WORKDIR)).not.toThrow();
+    });
+
+    it("does not throw for the default studio.api_url", () => {
+      const config = baseConfig();
+      expect(() => legacyResolveLocalConfigValues(config, "127.0.0.1", WORKDIR)).not.toThrow();
+    });
+
+    it("rejects a malformed SUPABASE_STUDIO_API_URL override", () => {
+      process.env["SUPABASE_STUDIO_API_URL"] = "http://[::1";
+      const config = baseConfig();
+      expect(() => legacyResolveLocalConfigValues(config, "127.0.0.1", WORKDIR)).toThrow(
+        `Invalid config for studio.api_url: parse "http://[::1": missing ']' in host`,
+      );
+    });
+
+    // Go gates the local_smtp.port===0 rejection on local_smtp.enabled (Go's
+    // struct field is still named `Inbucket` for the `[local_smtp]` TOML
+    // section, pkg/config/config.go:235,1081-1083), same pattern as api.port/
+    // studio.port above. local_smtp.enabled defaults to true, so a configured
+    // or env-overridden zero port is rejected by default.
+    it("rejects a configured local_smtp.port of 0 when local_smtp is enabled", () => {
+      const config = baseConfig({ local_smtp: { port: 0 } });
+      expect(() => legacyResolveLocalConfigValues(config, "127.0.0.1", WORKDIR)).toThrow(
+        "Missing required field in config: local_smtp.port",
+      );
+    });
+
+    it("rejects a zero SUPABASE_LOCAL_SMTP_PORT override when local_smtp is enabled", () => {
+      process.env["SUPABASE_LOCAL_SMTP_PORT"] = "0";
+      const config = baseConfig();
+      expect(() => legacyResolveLocalConfigValues(config, "127.0.0.1", WORKDIR)).toThrow(
+        "Missing required field in config: local_smtp.port",
+      );
+    });
+
+    it("does not reject a zero local_smtp.port when local_smtp is disabled", () => {
+      const config = baseConfig({ local_smtp: { enabled: false, port: 0 } });
+      expect(() => legacyResolveLocalConfigValues(config, "127.0.0.1", WORKDIR)).not.toThrow();
+    });
+  });
+
+  describe("db.major_version (required field in config)", () => {
+    // The pure 0/12/13-17/generic-invalid assertions moved to
+    // `legacy-config-validate.unit.test.ts` (direct `legacyValidateResolvedConfig` calls) —
+    // only the SUPABASE_DB_MAJOR_VERSION env-override mechanics stay here.
+    afterEach(() => {
+      delete process.env["SUPABASE_DB_MAJOR_VERSION"];
+    });
+
+    it("overrides a valid configured major_version via SUPABASE_DB_MAJOR_VERSION", () => {
+      process.env["SUPABASE_DB_MAJOR_VERSION"] = "15";
+      const config = baseConfig({ db: { major_version: 17 } });
+      expect(() => legacyResolveLocalConfigValues(config, "127.0.0.1", WORKDIR)).not.toThrow();
+    });
+
+    it("rejects an unsupported SUPABASE_DB_MAJOR_VERSION override", () => {
+      process.env["SUPABASE_DB_MAJOR_VERSION"] = "16";
+      const config = baseConfig({ db: { major_version: 17 } });
+      expect(() => legacyResolveLocalConfigValues(config, "127.0.0.1", WORKDIR)).toThrow(
+        "Failed reading config: Invalid db.major_version: 16.",
+      );
+    });
+
+    it("rejects a non-numeric SUPABASE_DB_MAJOR_VERSION override", () => {
+      process.env["SUPABASE_DB_MAJOR_VERSION"] = "abc";
+      const config = baseConfig();
+      expect(() => legacyResolveLocalConfigValues(config, "127.0.0.1", WORKDIR)).toThrow(
+        "Failed reading config: Invalid db.major_version: abc.",
+      );
+    });
+
+    it("treats an empty SUPABASE_DB_MAJOR_VERSION override as unset, matching Viper's default", () => {
+      process.env["SUPABASE_DB_MAJOR_VERSION"] = "";
+      const config = baseConfig({ db: { major_version: 17 } });
+      expect(() => legacyResolveLocalConfigValues(config, "127.0.0.1", WORKDIR)).not.toThrow();
+    });
+  });
+
+  describe("SUPABASE_DB_NETWORK_RESTRICTIONS_ENABLED env override", () => {
+    // `[db.network_restrictions]` ships uncommented in Go's default template and
+    // `NetworkRestrictions` is a plain, non-pointer `db` struct field, so Viper always registers a
+    // default and decodes this override unconditionally during `Config.Load` — same bucket as
+    // `db.port`/`db.major_version` above, validated eagerly rather than skipped.
+    afterEach(() => {
+      delete process.env["SUPABASE_DB_NETWORK_RESTRICTIONS_ENABLED"];
+    });
+
+    it("does not throw for a valid SUPABASE_DB_NETWORK_RESTRICTIONS_ENABLED override", () => {
+      process.env["SUPABASE_DB_NETWORK_RESTRICTIONS_ENABLED"] = "true";
+      const config = baseConfig();
+      expect(() => legacyResolveLocalConfigValues(config, "127.0.0.1", WORKDIR)).not.toThrow();
+    });
+
+    it("rejects a malformed SUPABASE_DB_NETWORK_RESTRICTIONS_ENABLED override", () => {
+      process.env["SUPABASE_DB_NETWORK_RESTRICTIONS_ENABLED"] = "notabool";
+      const config = baseConfig();
+      expect(() => legacyResolveLocalConfigValues(config, "127.0.0.1", WORKDIR)).toThrow(
+        LegacyInvalidBoolEnvOverrideError,
+      );
+      expect(() => legacyResolveLocalConfigValues(config, "127.0.0.1", WORKDIR)).toThrow(
+        'Invalid config for db.network_restrictions.enabled: cannot parse "notabool" as a bool',
+      );
+    });
+  });
+
+  describe("db.root_key (unmodeled raw-document field)", () => {
+    it("falls back to the default root key when absent", () => {
+      const config = baseConfig();
+      const values = legacyResolveLocalConfigValues(config, "127.0.0.1", WORKDIR);
+      expect(values.rootKey).toBe(LEGACY_POSTGRES_DEFAULT_ROOT_KEY);
+    });
+
+    it("uses a configured string root_key verbatim", () => {
+      const config = baseConfig();
+      const document = { db: { root_key: "custom-root-key" } };
+      const values = legacyResolveLocalConfigValues(
+        config,
+        "127.0.0.1",
+        WORKDIR,
+        undefined,
+        document,
+      );
+      expect(values.rootKey).toBe("custom-root-key");
+    });
+
+    it("rejects a non-string root_key (e.g. a bare TOML integer), matching Go's Secret decode failure", () => {
+      // `db.root_key` isn't modeled in `@supabase/config`'s schema, so Go's own
+      // decode failure (mapstructure rejecting a scalar into the `Secret` struct,
+      // `config.go:748-751`) must be reproduced here rather than letting the raw
+      // number flow unguarded into `envOverride`/`legacyDecryptAuthSecret`.
+      const config = baseConfig();
+      const document = { db: { root_key: 12345 } };
+      expect(() =>
+        legacyResolveLocalConfigValues(config, "127.0.0.1", WORKDIR, undefined, document),
+      ).toThrow(
+        "failed to parse config: decoding failed due to the following error(s):\n\n'db.root_key' expected a map or struct",
+      );
+    });
+  });
+
+  // Go's Config.Validate runs ValidateBucketName over every [storage.buckets.*]
+  // key right after db.major_version, unconditionally — there is no
+  // storage.enabled-style gate (pkg/config/config.go:1063-1068).
+  //
+  // Moved to `legacy-config-validate.unit.test.ts` (direct `legacyValidateResolvedConfig`
+  // calls) — this section has no L-specific derivation or env-override mechanics of its own.
+
+  // Go's Config.Validate rejects an invalid edge_runtime.deno_version
+  // unconditionally — NOT gated on edge_runtime.enabled
+  // (pkg/config/config.go:1164-1173).
+  describe("edge_runtime.deno_version (required field in config)", () => {
+    // The pure 0/1/2/generic-invalid/disabled assertions moved to
+    // `legacy-config-validate.unit.test.ts` (direct `legacyValidateResolvedConfig` calls) —
+    // only the SUPABASE_EDGE_RUNTIME_DENO_VERSION env-override mechanics stay here.
+    afterEach(() => {
+      delete process.env["SUPABASE_EDGE_RUNTIME_DENO_VERSION"];
+    });
+
+    it("rejects a zero SUPABASE_EDGE_RUNTIME_DENO_VERSION override", () => {
+      process.env["SUPABASE_EDGE_RUNTIME_DENO_VERSION"] = "0";
+      const config = baseConfig({ edge_runtime: { deno_version: 2 } });
+      expect(() => legacyResolveLocalConfigValues(config, "127.0.0.1", WORKDIR)).toThrow(
+        "Missing required field in config: edge_runtime.deno_version",
+      );
+    });
+
+    it("rejects an unsupported SUPABASE_EDGE_RUNTIME_DENO_VERSION override", () => {
+      process.env["SUPABASE_EDGE_RUNTIME_DENO_VERSION"] = "3";
+      const config = baseConfig({ edge_runtime: { deno_version: 2 } });
+      expect(() => legacyResolveLocalConfigValues(config, "127.0.0.1", WORKDIR)).toThrow(
+        "Failed reading config: Invalid edge_runtime.deno_version: 3.",
+      );
+    });
+
+    it("rejects a non-numeric SUPABASE_EDGE_RUNTIME_DENO_VERSION override", () => {
+      process.env["SUPABASE_EDGE_RUNTIME_DENO_VERSION"] = "abc";
+      const config = baseConfig();
+      expect(() => legacyResolveLocalConfigValues(config, "127.0.0.1", WORKDIR)).toThrow(
+        "Failed reading config: Invalid edge_runtime.deno_version: abc.",
+      );
+    });
+
+    it("treats an empty SUPABASE_EDGE_RUNTIME_DENO_VERSION override as unset, matching Viper's default", () => {
+      process.env["SUPABASE_EDGE_RUNTIME_DENO_VERSION"] = "";
+      const config = baseConfig({ edge_runtime: { deno_version: 2 } });
+      expect(() => legacyResolveLocalConfigValues(config, "127.0.0.1", WORKDIR)).not.toThrow();
+    });
+  });
+
+  describe("analytics (BigQuery backend required fields)", () => {
+    // Go's `Config.Validate` validates `[analytics]` right after
+    // `edge_runtime.deno_version` (`pkg/config/config.go:1174-1187`): when
+    // `analytics.enabled` and `analytics.backend == "bigquery"`, all three GCP
+    // fields are required, checked in that order.
+    //
+    // The pure required-field/complete/disabled assertions moved to
+    // `legacy-config-validate.unit.test.ts` (direct `legacyValidateResolvedConfig` calls) —
+    // only the SUPABASE_ANALYTICS_* env-override mechanics stay here.
+    afterEach(() => {
+      delete process.env["SUPABASE_ANALYTICS_ENABLED"];
+      delete process.env["SUPABASE_ANALYTICS_BACKEND"];
+      delete process.env["SUPABASE_ANALYTICS_GCP_PROJECT_ID"];
+      delete process.env["SUPABASE_ANALYTICS_GCP_PROJECT_NUMBER"];
+      delete process.env["SUPABASE_ANALYTICS_GCP_JWT_PATH"];
+    });
+
+    it("rejects a bigquery backend enabled only via SUPABASE_ANALYTICS_ENABLED", () => {
+      process.env["SUPABASE_ANALYTICS_ENABLED"] = "true";
+      const config = baseConfig({ analytics: { enabled: false, backend: "bigquery" } });
+      expect(() => legacyResolveLocalConfigValues(config, "127.0.0.1", WORKDIR)).toThrow(
+        "Missing required field in config: analytics.gcp_project_id",
+      );
+    });
+
+    it("rejects a bigquery backend selected only via SUPABASE_ANALYTICS_BACKEND", () => {
+      process.env["SUPABASE_ANALYTICS_BACKEND"] = "bigquery";
+      const config = baseConfig({ analytics: { enabled: true, backend: "postgres" } });
+      expect(() => legacyResolveLocalConfigValues(config, "127.0.0.1", WORKDIR)).toThrow(
+        "Missing required field in config: analytics.gcp_project_id",
+      );
+    });
+
+    it("accepts env-provided GCP fields overriding empty config.toml values", () => {
+      process.env["SUPABASE_ANALYTICS_GCP_PROJECT_ID"] = "proj";
+      process.env["SUPABASE_ANALYTICS_GCP_PROJECT_NUMBER"] = "123";
+      process.env["SUPABASE_ANALYTICS_GCP_JWT_PATH"] = "gcp.json";
+      const config = baseConfig({ analytics: { enabled: true, backend: "bigquery" } });
+      expect(() => legacyResolveLocalConfigValues(config, "127.0.0.1", WORKDIR)).not.toThrow();
+    });
+
+    // Go's `LogflareBackend.UnmarshalText` (`config.go:60-65`) hard-rejects any
+    // `analytics.backend` value outside `postgres`/`bigquery` during the same
+    // `UnmarshalExact` decode every `SUPABASE_*` override goes through
+    // (`config.go:749-756`) — a malformed `SUPABASE_ANALYTICS_BACKEND` fails
+    // config loading outright, same mechanism as the port/bool overrides below.
+    it("rejects an invalid SUPABASE_ANALYTICS_BACKEND override", () => {
+      process.env["SUPABASE_ANALYTICS_BACKEND"] = "mysql";
+      const config = baseConfig({ analytics: { enabled: true, backend: "postgres" } });
+      expect(() => legacyResolveLocalConfigValues(config, "127.0.0.1", WORKDIR)).toThrow(
+        LegacyInvalidAnalyticsBackendEnvOverrideError,
+      );
+      expect(() => legacyResolveLocalConfigValues(config, "127.0.0.1", WORKDIR)).toThrow(
+        'Invalid config for analytics.backend: cannot parse "mysql" as one of "postgres", "bigquery"',
+      );
+    });
+  });
+
+  describe("experimental.* (experimental.validate())", () => {
+    // Go's `(e *experimental) validate()` (`pkg/config/config.go:1846-1854`),
+    // called right after the analytics/bigquery block and right before
+    // `Config.Validate` returns — unconditionally, no `enabled` gate of its own.
+    //
+    // Every webhooks-presence/enabled combination and the pgdelta format_options JSON checks
+    // moved to `legacy-config-validate.unit.test.ts` (direct `legacyValidateResolvedConfig`
+    // calls, setting `experimental.webhooksPresent`/`webhooksEnabled` directly instead of
+    // deriving them from a raw `document`) — only this document-THREADING-specific case stays
+    // here, since it exercises this function's own "no document provided" fallback rather than
+    // a check `legacyValidateResolvedConfig` itself owns.
+    it("does not throw a present [experimental.webhooks] section without enabled when no document is provided", () => {
+      // No `document` (5th param) at all — e.g. a caller that hasn't threaded
+      // `LoadedProjectConfig.document` through yet. The presence-only check
+      // can't run without it, so it's skipped rather than guessed at; this
+      // also covers every pre-existing call site/test in this file that
+      // doesn't pass a 5th argument.
+      const config = baseConfig({ experimental: { webhooks: {} } });
+      expect(() => legacyResolveLocalConfigValues(config, "127.0.0.1", WORKDIR)).not.toThrow();
+    });
+
+    // `experimental.webhooks.enabled`/`experimental.pgdelta.format_options` are Viper-bound like
+    // any other leaf field once `[experimental]` is present (`ExperimentalBindStruct`/
+    // `AutomaticEnv`, `config.go:581-586`) — same SUPABASE_*-env-override MECHANICS split as
+    // `auth.captcha`/`auth.passkey` above: the required-field/JSON-shape checks themselves live in
+    // `legacy-config-validate.unit.test.ts`, only the env-override wiring is exercised here.
+    afterEach(() => {
+      delete process.env["SUPABASE_EXPERIMENTAL_WEBHOOKS_ENABLED"];
+      delete process.env["SUPABASE_EXPERIMENTAL_PGDELTA_FORMAT_OPTIONS"];
+    });
+
+    it("enables webhooks purely via SUPABASE_EXPERIMENTAL_WEBHOOKS_ENABLED when the section omits enabled", () => {
+      process.env["SUPABASE_EXPERIMENTAL_WEBHOOKS_ENABLED"] = "true";
+      const config = baseConfig({ experimental: { webhooks: {} } });
+      const document = { experimental: { webhooks: {} } };
+      expect(() =>
+        legacyResolveLocalConfigValues(config, "127.0.0.1", WORKDIR, undefined, document),
+      ).not.toThrow();
+    });
+
+    it("rejects a malformed SUPABASE_EXPERIMENTAL_WEBHOOKS_ENABLED override on an already-enabled section", () => {
+      process.env["SUPABASE_EXPERIMENTAL_WEBHOOKS_ENABLED"] = "notabool";
+      const config = baseConfig({ experimental: { webhooks: { enabled: true } } });
+      const document = { experimental: { webhooks: { enabled: true } } };
+      expect(() =>
+        legacyResolveLocalConfigValues(config, "127.0.0.1", WORKDIR, undefined, document),
+      ).toThrow(LegacyInvalidBoolEnvOverrideError);
+      expect(() =>
+        legacyResolveLocalConfigValues(config, "127.0.0.1", WORKDIR, undefined, document),
+      ).toThrow(
+        'Invalid config for experimental.webhooks.enabled: cannot parse "notabool" as a bool',
+      );
+    });
+
+    it("rejects an invalid JSON SUPABASE_EXPERIMENTAL_PGDELTA_FORMAT_OPTIONS override", () => {
+      process.env["SUPABASE_EXPERIMENTAL_PGDELTA_FORMAT_OPTIONS"] = "{not valid json";
+      const config = baseConfig();
+      expect(() => legacyResolveLocalConfigValues(config, "127.0.0.1", WORKDIR)).toThrow(
+        "Invalid config for experimental.pgdelta.format_options: must be valid JSON",
+      );
+    });
+
+    it("accepts a valid JSON SUPABASE_EXPERIMENTAL_PGDELTA_FORMAT_OPTIONS override", () => {
+      process.env["SUPABASE_EXPERIMENTAL_PGDELTA_FORMAT_OPTIONS"] = '{"keywordCase":"upper"}';
+      const config = baseConfig();
+      expect(() => legacyResolveLocalConfigValues(config, "127.0.0.1", WORKDIR)).not.toThrow();
+    });
+  });
+
+  describe("SUPABASE_API_TLS_ENABLED env override", () => {
+    // Go applies the Viper-bound `api.tls.enabled` override (config.go:582-586)
+    // BEFORE deriving the default `api.external_url` scheme (config.go:799-809),
+    // so an ambient/dotenv override flips http/https even when config.toml says
+    // otherwise.
+    afterEach(() => {
+      delete process.env["SUPABASE_API_TLS_ENABLED"];
+    });
+
+    it("overrides api.tls.enabled from false to true", () => {
+      process.env["SUPABASE_API_TLS_ENABLED"] = "true";
+      const config = baseConfig({ api: { tls: { enabled: false }, port: 54321 } });
+      const values = legacyResolveLocalConfigValues(config, "127.0.0.1", WORKDIR);
+      expect(values.apiUrl).toBe("https://127.0.0.1:54321");
+    });
+
+    it("overrides api.tls.enabled from true to false", () => {
+      process.env["SUPABASE_API_TLS_ENABLED"] = "false";
+      const config = baseConfig({ api: { tls: { enabled: true }, port: 54321 } });
+      const values = legacyResolveLocalConfigValues(config, "127.0.0.1", WORKDIR);
+      expect(values.apiUrl).toBe("http://127.0.0.1:54321");
+    });
+
+    it("does not override api.tls.enabled once api.external_url is set", () => {
+      process.env["SUPABASE_API_TLS_ENABLED"] = "true";
+      const config = baseConfig({ api: { external_url: "http://config.example" } });
+      const values = legacyResolveLocalConfigValues(config, "127.0.0.1", WORKDIR);
+      expect(values.apiUrl).toBe("http://config.example");
+    });
+
+    it("rejects a malformed override instead of falling back to the configured value", () => {
+      process.env["SUPABASE_API_TLS_ENABLED"] = "not-a-bool";
+      const config = baseConfig({ api: { tls: { enabled: true }, port: 54321 } });
+      expect(() => legacyResolveLocalConfigValues(config, "127.0.0.1", WORKDIR)).toThrow(
+        LegacyInvalidBoolEnvOverrideError,
+      );
+    });
+
+    it("treats an empty override as unset, matching Viper's default", () => {
+      process.env["SUPABASE_API_TLS_ENABLED"] = "";
+      const config = baseConfig({ api: { tls: { enabled: true }, port: 54321 } });
+      const values = legacyResolveLocalConfigValues(config, "127.0.0.1", WORKDIR);
+      expect(values.apiUrl).toBe("https://127.0.0.1:54321");
+    });
+  });
+
+  describe("legacyEnvOverrideRealtimeIpVersion", () => {
+    afterEach(() => {
+      delete process.env["SUPABASE_REALTIME_IP_VERSION"];
+    });
+
+    it("falls back to the configured value when unset", () => {
+      expect(legacyEnvOverrideRealtimeIpVersion("IPv4", undefined)).toBe("IPv4");
+    });
+
+    it("overrides IPv4 to IPv6 via the env var", () => {
+      process.env["SUPABASE_REALTIME_IP_VERSION"] = "IPv6";
+      expect(legacyEnvOverrideRealtimeIpVersion("IPv4", undefined)).toBe("IPv6");
+    });
+
+    // Go's `AddressFamily.UnmarshalText` (`pkg/config/config.go:74-81`) hard-rejects
+    // any value outside `{IPv4, IPv6}` during the same `UnmarshalExact` decode every
+    // `SUPABASE_*` override goes through, same mechanism as the analytics backend override.
+    it("rejects an invalid override instead of falling back to the configured value", () => {
+      process.env["SUPABASE_REALTIME_IP_VERSION"] = "IPv5";
+      expect(() => legacyEnvOverrideRealtimeIpVersion("IPv4", undefined)).toThrow(
+        LegacyInvalidRealtimeIpVersionEnvOverrideError,
+      );
+      expect(() => legacyEnvOverrideRealtimeIpVersion("IPv4", undefined)).toThrow(
+        'Invalid config for realtime.ip_version: cannot parse "IPv5" as one of "IPv4", "IPv6"',
+      );
+    });
+  });
+
+  describe("legacyEnvOverrideRealtimeMaxHeaderLength", () => {
+    afterEach(() => {
+      delete process.env["SUPABASE_REALTIME_MAX_HEADER_LENGTH"];
+    });
+
+    it("falls back to the configured value when unset", () => {
+      expect(legacyEnvOverrideRealtimeMaxHeaderLength(4096, undefined)).toBe(4096);
+    });
+
+    it("overrides the configured value via the env var", () => {
+      process.env["SUPABASE_REALTIME_MAX_HEADER_LENGTH"] = "8192";
+      expect(legacyEnvOverrideRealtimeMaxHeaderLength(4096, undefined)).toBe(8192);
+    });
+
+    it("also honors a projectEnvValues (dotenv) value", () => {
+      expect(
+        legacyEnvOverrideRealtimeMaxHeaderLength(4096, {
+          SUPABASE_REALTIME_MAX_HEADER_LENGTH: "16384",
+        }),
+      ).toBe(16384);
+    });
+
+    // Go's `uint` is 64 bits wide on every platform this CLI ships for, decoded via
+    // mapstructure's `decodeUint` (`strconv.ParseUint(str, 0, 64)`) under Viper's
+    // `WeaklyTypedInput: true`. A value one past `2^64-1` genuinely fails that parse in Go, so
+    // it must be rejected here too instead of silently losing precision through `Number(value)`.
+    it("rejects an override exceeding the uint64 max (2^64), matching Go's ParseUint failure", () => {
+      process.env["SUPABASE_REALTIME_MAX_HEADER_LENGTH"] = "18446744073709551616";
+      expect(() => legacyEnvOverrideRealtimeMaxHeaderLength(4096, undefined)).toThrow(
+        "Failed reading config: Invalid realtime.max_header_length: 18446744073709551616.",
+      );
+    });
+
+    // Guards against an overcorrected fix that used an imprecise `Number`-based bound and
+    // rejected values Go itself still accepts.
+    it("accepts an override of exactly the uint64 max (2^64-1)", () => {
+      process.env["SUPABASE_REALTIME_MAX_HEADER_LENGTH"] = "18446744073709551615";
+      expect(() => legacyEnvOverrideRealtimeMaxHeaderLength(4096, undefined)).not.toThrow();
+    });
+
+    // Guards against the base-0 grammar rewrite (`parseGoBaseZeroUint`) silently
+    // reintroducing precision loss or an unbounded parse for a non-decimal literal —
+    // `0x10000000000000000` is exactly 2^64, one past `LEGACY_UINT_MAX`, same as the
+    // decimal literal above, just routed through the hex branch instead of the plain
+    // decimal branch.
+    it("rejects a hex override exceeding the uint64 max (2^64), matching Go's ParseUint failure", () => {
+      process.env["SUPABASE_REALTIME_MAX_HEADER_LENGTH"] = "0x10000000000000000";
+      expect(() => legacyEnvOverrideRealtimeMaxHeaderLength(4096, undefined)).toThrow(
+        "Failed reading config: Invalid realtime.max_header_length: 0x10000000000000000.",
+      );
+    });
+  });
+
+  describe("legacyEnvOverrideApiMaxRows", () => {
+    afterEach(() => {
+      delete process.env["SUPABASE_API_MAX_ROWS"];
+    });
+
+    it("falls back to the configured value when unset", () => {
+      expect(legacyEnvOverrideApiMaxRows(1000, undefined)).toBe(1000);
+    });
+
+    it("overrides the configured value via the env var", () => {
+      process.env["SUPABASE_API_MAX_ROWS"] = "500";
+      expect(legacyEnvOverrideApiMaxRows(1000, undefined)).toBe(500);
+    });
+  });
+
+  // `legacyEnvOverrideMajorVersion` is exercised directly (rather than through the
+  // full `legacyResolveLocalConfigValues` pipeline, as the "db.major_version (required
+  // field in config)" describe block above does) so these assertions cover only
+  // `legacyEnvOverrideUint`'s base-0 grammar parsing, not `legacyValidateResolvedConfig`'s
+  // separate "is this a supported Postgres major version" switch — most of the octal/hex/
+  // binary literals below don't correspond to a supported major version and would fail
+  // that unrelated downstream check even once correctly parsed.
+  describe("legacyEnvOverrideMajorVersion", () => {
+    afterEach(() => {
+      delete process.env["SUPABASE_DB_MAJOR_VERSION"];
+    });
+
+    it("falls back to the configured value when unset", () => {
+      expect(legacyEnvOverrideMajorVersion(17, undefined)).toBe(17);
+    });
+
+    // Go's `strconv.ParseUint(str, 0, 64)` treats a bare leading zero followed by more
+    // digits as octal, not decimal — `"010"` is `8`, not `10` — a silent value
+    // divergence the old `/^\d+$/`-plus-`Number()` parsing didn't reproduce.
+    it("resolves an octal leading-zero override to its octal value, not decimal", () => {
+      process.env["SUPABASE_DB_MAJOR_VERSION"] = "010";
+      expect(legacyEnvOverrideMajorVersion(17, undefined)).toBe(8);
+    });
+
+    it("resolves a 0x-prefixed override as hex", () => {
+      process.env["SUPABASE_DB_MAJOR_VERSION"] = "0x10";
+      expect(legacyEnvOverrideMajorVersion(17, undefined)).toBe(16);
+    });
+
+    it("resolves a 0b-prefixed override as binary", () => {
+      process.env["SUPABASE_DB_MAJOR_VERSION"] = "0b101";
+      expect(legacyEnvOverrideMajorVersion(17, undefined)).toBe(5);
+    });
+
+    it("still resolves a plain decimal override with no leading zero", () => {
+      process.env["SUPABASE_DB_MAJOR_VERSION"] = "15";
+      expect(legacyEnvOverrideMajorVersion(17, undefined)).toBe(15);
+    });
+
+    // Underscore digit separators are only legal in Go's base-0 mode (Go 1.13+).
+    it("permits an underscore digit separator between decimal digits", () => {
+      process.env["SUPABASE_DB_MAJOR_VERSION"] = "1_000";
+      expect(legacyEnvOverrideMajorVersion(17, undefined)).toBe(1000);
+    });
+
+    // Go does NOT fall back to decimal when a bare-leading-zero literal contains an
+    // invalid octal digit — `"08"`/`"09"` are rejected outright, never read as 8/9.
+    it("rejects an invalid octal digit instead of silently falling back to decimal", () => {
+      process.env["SUPABASE_DB_MAJOR_VERSION"] = "08";
+      expect(() => legacyEnvOverrideMajorVersion(17, undefined)).toThrow(
+        "Failed reading config: Invalid db.major_version: 08.",
+      );
+    });
+
+    // `strconv.ParseUint` never accepts a leading sign, unlike `ParseInt`.
+    it("rejects a signed override", () => {
+      process.env["SUPABASE_DB_MAJOR_VERSION"] = "+5";
+      expect(() => legacyEnvOverrideMajorVersion(17, undefined)).toThrow(
+        "Failed reading config: Invalid db.major_version: +5.",
+      );
+    });
+  });
+
+  describe("legacyEnvOverridePoolMode", () => {
+    afterEach(() => {
+      delete process.env["SUPABASE_DB_POOLER_POOL_MODE"];
+    });
+
+    it("falls back to the configured value when unset", () => {
+      expect(legacyEnvOverridePoolMode("transaction", undefined)).toBe("transaction");
+    });
+
+    it("overrides the configured value via the env var", () => {
+      process.env["SUPABASE_DB_POOLER_POOL_MODE"] = "session";
+      expect(legacyEnvOverridePoolMode("transaction", undefined)).toBe("session");
+    });
+
+    // Go's `PoolMode.UnmarshalText` (`pkg/config/db.go:14-26`) hard-rejects any
+    // value outside `{transaction, session}`.
+    it("rejects an invalid override instead of falling back to the configured value", () => {
+      process.env["SUPABASE_DB_POOLER_POOL_MODE"] = "invalid";
+      expect(() => legacyEnvOverridePoolMode("transaction", undefined)).toThrow(
+        LegacyInvalidPoolModeEnvOverrideError,
+      );
+      expect(() => legacyEnvOverridePoolMode("transaction", undefined)).toThrow(
+        'Invalid config for db.pooler.pool_mode: cannot parse "invalid" as one of "transaction", "session"',
+      );
+    });
+  });
+
+  describe("legacyEnvOverrideEdgeRuntimePolicy", () => {
+    afterEach(() => {
+      delete process.env["SUPABASE_EDGE_RUNTIME_POLICY"];
+    });
+
+    it("falls back to the configured value when unset", () => {
+      expect(legacyEnvOverrideEdgeRuntimePolicy("oneshot", undefined)).toBe("oneshot");
+    });
+
+    it("overrides the configured value via the env var", () => {
+      process.env["SUPABASE_EDGE_RUNTIME_POLICY"] = "per_worker";
+      expect(legacyEnvOverrideEdgeRuntimePolicy("oneshot", undefined)).toBe("per_worker");
+    });
+
+    // Go's `RequestPolicy.UnmarshalText` (`pkg/config/config.go:83-96`) hard-rejects
+    // any value outside `{per_worker, oneshot}`.
+    it("rejects an invalid override instead of falling back to the configured value", () => {
+      process.env["SUPABASE_EDGE_RUNTIME_POLICY"] = "invalid";
+      expect(() => legacyEnvOverrideEdgeRuntimePolicy("oneshot", undefined)).toThrow(
+        LegacyInvalidEdgeRuntimePolicyEnvOverrideError,
+      );
+      expect(() => legacyEnvOverrideEdgeRuntimePolicy("oneshot", undefined)).toThrow(
+        'Invalid config for edge_runtime.policy: cannot parse "invalid" as one of "per_worker", "oneshot"',
+      );
+    });
+  });
+
+  describe("legacyEnvOverrideDefaultPoolSize", () => {
+    afterEach(() => {
+      delete process.env["SUPABASE_DB_POOLER_DEFAULT_POOL_SIZE"];
+    });
+
+    it("falls back to the configured value when unset", () => {
+      expect(legacyEnvOverrideDefaultPoolSize(20, undefined)).toBe(20);
+    });
+
+    it("overrides the configured value via the env var", () => {
+      process.env["SUPABASE_DB_POOLER_DEFAULT_POOL_SIZE"] = "40";
+      expect(legacyEnvOverrideDefaultPoolSize(20, undefined)).toBe(40);
+    });
+  });
+
+  describe("legacyEnvOverrideMaxClientConn", () => {
+    afterEach(() => {
+      delete process.env["SUPABASE_DB_POOLER_MAX_CLIENT_CONN"];
+    });
+
+    it("falls back to the configured value when unset", () => {
+      expect(legacyEnvOverrideMaxClientConn(100, undefined)).toBe(100);
+    });
+
+    it("overrides the configured value via the env var", () => {
+      process.env["SUPABASE_DB_POOLER_MAX_CLIENT_CONN"] = "200";
+      expect(legacyEnvOverrideMaxClientConn(100, undefined)).toBe(200);
+    });
+  });
+
+  describe("legacyResolveAuthCaptcha", () => {
+    afterEach(() => {
+      delete process.env["SUPABASE_AUTH_CAPTCHA_ENABLED"];
+      delete process.env["SUPABASE_AUTH_CAPTCHA_PROVIDER"];
+      delete process.env["SUPABASE_AUTH_CAPTCHA_SECRET"];
+    });
+
+    it("returns undefined when captcha is not configured", () => {
+      expect(legacyResolveAuthCaptcha(undefined, undefined, undefined)).toBeUndefined();
+    });
+
+    it("overrides enabled/provider when the section is present in the document", () => {
+      process.env["SUPABASE_AUTH_CAPTCHA_ENABLED"] = "true";
+      process.env["SUPABASE_AUTH_CAPTCHA_PROVIDER"] = "turnstile";
+      const authDocument = { captcha: { enabled: false, provider: "hcaptcha" } };
+      const resolved = legacyResolveAuthCaptcha(
+        authDocument,
+        { enabled: false, provider: "hcaptcha", secret: "shh" },
+        undefined,
+      );
+      expect(resolved?.enabled).toBe(true);
+      expect(resolved?.provider).toBe("turnstile");
+    });
+
+    it("does not apply an env override when [auth.captcha] is absent from the document", () => {
+      process.env["SUPABASE_AUTH_CAPTCHA_ENABLED"] = "true";
+      const resolved = legacyResolveAuthCaptcha(
+        {},
+        { enabled: false, provider: "hcaptcha", secret: "shh" },
+        undefined,
+      );
+      expect(resolved?.enabled).toBe(false);
+    });
+
+    it("decrypts an encrypted: captcha secret", () => {
+      process.env["DOTENV_PRIVATE_KEY"] =
+        "7fd7210cef8f331ee8c55897996aaaafd853a2b20a4dc73d6d75759f65d2a7eb";
+      const authDocument = { captcha: { enabled: true } };
+      const resolved = legacyResolveAuthCaptcha(
+        authDocument,
+        {
+          enabled: true,
+          provider: "hcaptcha",
+          secret:
+            "encrypted:BKiXH15AyRzeohGyUrmB6cGjSklCrrBjdesQlX1VcXo/Xp20Bi2gGZ3AlIqxPQDmjVAALnhZamKnuY73l8Dz1P+BYiZUgxTSLzdCvdYUyVbNekj2UudbdUizBViERtZkuQwZHIv/",
+        },
+        undefined,
+      );
+      expect(resolved?.secret).toBe("value");
+      delete process.env["DOTENV_PRIVATE_KEY"];
+    });
+  });
+
+  describe("legacyResolveAuthEmail", () => {
+    afterEach(() => {
+      delete process.env["SUPABASE_AUTH_EMAIL_TEMPLATE_CONFIRMATION_SUBJECT"];
+    });
+
+    // Go's `emailTemplate.Subject` is `*string` (`pkg/config/auth.go:266`) — an explicit
+    // `subject = ""` in config.toml is a real, non-nil state, distinct from an absent key, that
+    // Go's mailer-env block honors by still emitting `GOTRUE_MAILER_SUBJECTS_*=` (empty).
+    it("keeps an explicit empty subject present in the raw document, not omitted", () => {
+      const config = baseConfig({
+        auth: { email: { template: { confirmation: { subject: "", content_path: "x" } } } },
+      });
+      const authDocument = { email: { template: { confirmation: { subject: "" } } } };
+      const resolved = legacyResolveAuthEmail(config.auth.email, authDocument, undefined);
+      expect(resolved.template["confirmation"]?.subject).toBe("");
+    });
+
+    it("omits the subject when the key is absent from the raw document", () => {
+      const config = baseConfig({
+        auth: { email: { template: { confirmation: { content_path: "x" } } } },
+      });
+      const authDocument = { email: { template: { confirmation: { content_path: "x" } } } };
+      const resolved = legacyResolveAuthEmail(config.auth.email, authDocument, undefined);
+      expect(resolved.template["confirmation"]?.subject).toBeUndefined();
+    });
+
+    it("prefers an env-overridden subject over the raw document's presence, even when absent", () => {
+      process.env["SUPABASE_AUTH_EMAIL_TEMPLATE_CONFIRMATION_SUBJECT"] = "Overridden subject";
+      const config = baseConfig({
+        auth: { email: { template: { confirmation: { content_path: "x" } } } },
+      });
+      const authDocument = { email: { template: { confirmation: { content_path: "x" } } } };
+      const resolved = legacyResolveAuthEmail(config.auth.email, authDocument, undefined);
+      expect(resolved.template["confirmation"]?.subject).toBe("Overridden subject");
+    });
+  });
+
+  describe("legacyResolveAuthHooks", () => {
+    const baseHook = { enabled: false, uri: "", secrets: "" };
+    const allHooks = {
+      mfa_verification_attempt: baseHook,
+      password_verification_attempt: baseHook,
+      custom_access_token: baseHook,
+      send_sms: baseHook,
+      send_email: baseHook,
+      before_user_created: baseHook,
+    };
+
+    afterEach(() => {
+      delete process.env["SUPABASE_AUTH_HOOK_CUSTOM_ACCESS_TOKEN_ENABLED"];
+      delete process.env["SUPABASE_AUTH_HOOK_CUSTOM_ACCESS_TOKEN_URI"];
+    });
+
+    it("leaves every hook disabled when nothing is configured or overridden", () => {
+      const resolved = legacyResolveAuthHooks(undefined, allHooks, undefined);
+      expect(resolved.customAccessToken.enabled).toBe(false);
+      expect(resolved.mfaVerificationAttempt.enabled).toBe(false);
+    });
+
+    it("overrides enabled/uri when the hook's section is present in the document", () => {
+      process.env["SUPABASE_AUTH_HOOK_CUSTOM_ACCESS_TOKEN_ENABLED"] = "true";
+      process.env["SUPABASE_AUTH_HOOK_CUSTOM_ACCESS_TOKEN_URI"] = "https://example.com/hook";
+      const authDocument = { hook: { custom_access_token: { enabled: false } } };
+      const resolved = legacyResolveAuthHooks(authDocument, allHooks, undefined);
+      expect(resolved.customAccessToken.enabled).toBe(true);
+      expect(resolved.customAccessToken.uri).toBe("https://example.com/hook");
+      // Unrelated hooks stay untouched.
+      expect(resolved.mfaVerificationAttempt.enabled).toBe(false);
+    });
+
+    it("does not apply an env override when the hook's section is absent from the document", () => {
+      process.env["SUPABASE_AUTH_HOOK_CUSTOM_ACCESS_TOKEN_ENABLED"] = "true";
+      const resolved = legacyResolveAuthHooks({}, allHooks, undefined);
+      expect(resolved.customAccessToken.enabled).toBe(false);
+    });
+  });
+
+  describe("legacyResolveAuthExternalProviders", () => {
+    it("coerces an env(...)-resolved boolean string for an unmodeled/custom provider", () => {
+      const authDocument = {
+        external: {
+          my_custom: {
+            enabled: "true",
+            client_id: "custom-client-id",
+            skip_nonce_check: "false",
+            email_optional: "TRUE",
+          },
+        },
+      };
+      const resolved = legacyResolveAuthExternalProviders(
+        authDocument,
+        baseConfig().auth.external,
+        undefined,
+      );
+      expect(resolved["my_custom"]?.enabled).toBe(true);
+      expect(resolved["my_custom"]?.skipNonceCheck).toBe(false);
+      expect(resolved["my_custom"]?.emailOptional).toBe(true);
+    });
+
+    it("throws on an unparsable custom-provider boolean string instead of silently disabling it", () => {
+      const authDocument = {
+        external: { my_custom: { enabled: "not-a-bool", client_id: "custom-client-id" } },
+      };
+      expect(() =>
+        legacyResolveAuthExternalProviders(authDocument, baseConfig().auth.external, undefined),
+      ).toThrow('cannot parse "not-a-bool" as a bool');
+    });
+
+    it("leaves an absent custom-provider boolean field at its schema default without throwing", () => {
+      const authDocument = {
+        external: { my_custom: { client_id: "custom-client-id" } },
+      };
+      const resolved = legacyResolveAuthExternalProviders(
+        authDocument,
+        baseConfig().auth.external,
+        undefined,
+      );
+      expect(resolved["my_custom"]?.enabled).toBe(false);
+    });
+
+    it("weakly coerces a raw numeric custom-provider boolean by truthiness, matching Go's WeaklyTypedInput decode", () => {
+      const authDocument = {
+        external: { my_custom: { enabled: 1, client_id: "custom-client-id" } },
+      };
+      const resolved = legacyResolveAuthExternalProviders(
+        authDocument,
+        baseConfig().auth.external,
+        undefined,
+      );
+      expect(resolved["my_custom"]?.enabled).toBe(true);
+    });
+
+    it("throws on a raw array/table custom-provider boolean instead of silently disabling it", () => {
+      const authDocument = {
+        external: { my_custom: { enabled: [1, 2], client_id: "custom-client-id" } },
+      };
+      expect(() =>
+        legacyResolveAuthExternalProviders(authDocument, baseConfig().auth.external, undefined),
+      ).toThrow('cannot parse "1,2" as a bool');
+    });
+
+    it("resolves apple purely from env overrides even with no config.toml [auth.external] section at all, matching Go's ejected default template", () => {
+      const projectEnvValues = {
+        SUPABASE_AUTH_EXTERNAL_APPLE_ENABLED: "true",
+        SUPABASE_AUTH_EXTERNAL_APPLE_CLIENT_ID: "apple-client-id",
+        SUPABASE_AUTH_EXTERNAL_APPLE_SECRET: "apple-secret",
+        SUPABASE_AUTH_EXTERNAL_APPLE_URL: "https://appleid.apple.com",
+      };
+      const resolved = legacyResolveAuthExternalProviders(
+        undefined,
+        baseConfig().auth.external,
+        projectEnvValues,
+      );
+      expect(resolved["apple"]).toEqual({
+        enabled: true,
+        clientId: "apple-client-id",
+        secret: "apple-secret",
+        url: "https://appleid.apple.com",
+        redirectUri: "",
+        skipNonceCheck: false,
+        emailOptional: false,
+      });
+    });
+
+    it("does not synthesize any other provider purely from an env override with no TOML table, only apple gets Go's default-template exception", () => {
+      const projectEnvValues = {
+        SUPABASE_AUTH_EXTERNAL_GOOGLE_ENABLED: "true",
+        SUPABASE_AUTH_EXTERNAL_GOOGLE_CLIENT_ID: "google-client-id",
+      };
+      const resolved = legacyResolveAuthExternalProviders(
+        undefined,
+        baseConfig().auth.external,
+        projectEnvValues,
+      );
+      expect(resolved["google"]).toBeUndefined();
+      // apple is still unconditionally present (Go's default template), but unaffected by
+      // the unrelated google env vars above.
+      expect(resolved["apple"]?.enabled).toBe(false);
+    });
+  });
+
+  describe("legacyRawUnmodeledBool", () => {
+    it("returns false for an absent value, matching Go's zero-value bool default", () => {
+      expect(legacyRawUnmodeledBool(undefined, "auth.passkey.enabled")).toBe(false);
+    });
+
+    it("passes a real boolean through unchanged", () => {
+      expect(legacyRawUnmodeledBool(true, "auth.passkey.enabled")).toBe(true);
+      expect(legacyRawUnmodeledBool(false, "auth.passkey.enabled")).toBe(false);
+    });
+
+    it("weakly coerces a raw number by truthiness, matching mapstructure's WeaklyTypedInput decodeBool", () => {
+      expect(legacyRawUnmodeledBool(123, "auth.passkey.enabled")).toBe(true);
+      expect(legacyRawUnmodeledBool(0, "auth.passkey.enabled")).toBe(false);
+      expect(legacyRawUnmodeledBool(1.5, "auth.passkey.enabled")).toBe(true);
+    });
+
+    it("parses a valid boolean-ish string the way Go's strconv.ParseBool does", () => {
+      expect(legacyRawUnmodeledBool("true", "auth.passkey.enabled")).toBe(true);
+      expect(legacyRawUnmodeledBool("False", "auth.passkey.enabled")).toBe(false);
+      expect(legacyRawUnmodeledBool("", "auth.passkey.enabled")).toBe(false);
+    });
+
+    it("throws on an unparsable string instead of silently disabling it", () => {
+      expect(() => legacyRawUnmodeledBool("not-a-bool", "auth.passkey.enabled")).toThrow(
+        'cannot parse "not-a-bool" as a bool',
+      );
+    });
+
+    it("throws on an array or table value — mapstructure's decodeBool errors on these unconditionally, never weakly coerced", () => {
+      expect(() => legacyRawUnmodeledBool([1, 2], "auth.passkey.enabled")).toThrow(
+        LegacyInvalidBoolEnvOverrideError,
+      );
+      expect(() => legacyRawUnmodeledBool({ nested: true }, "auth.passkey.enabled")).toThrow(
+        LegacyInvalidBoolEnvOverrideError,
+      );
+    });
+  });
+
+  describe("legacyResolveDbSettingsEnvOverrides", () => {
+    const ALL_OVERRIDE_NAMES = [
+      "SUPABASE_DB_SETTINGS_EFFECTIVE_CACHE_SIZE",
+      "SUPABASE_DB_SETTINGS_LOGICAL_DECODING_WORK_MEM",
+      "SUPABASE_DB_SETTINGS_MAINTENANCE_WORK_MEM",
+      "SUPABASE_DB_SETTINGS_MAX_CONNECTIONS",
+      "SUPABASE_DB_SETTINGS_MAX_LOCKS_PER_TRANSACTION",
+      "SUPABASE_DB_SETTINGS_MAX_PARALLEL_MAINTENANCE_WORKERS",
+      "SUPABASE_DB_SETTINGS_MAX_PARALLEL_WORKERS",
+      "SUPABASE_DB_SETTINGS_MAX_PARALLEL_WORKERS_PER_GATHER",
+      "SUPABASE_DB_SETTINGS_MAX_REPLICATION_SLOTS",
+      "SUPABASE_DB_SETTINGS_MAX_SLOT_WAL_KEEP_SIZE",
+      "SUPABASE_DB_SETTINGS_MAX_STANDBY_ARCHIVE_DELAY",
+      "SUPABASE_DB_SETTINGS_MAX_STANDBY_STREAMING_DELAY",
+      "SUPABASE_DB_SETTINGS_MAX_WAL_SIZE",
+      "SUPABASE_DB_SETTINGS_MAX_WAL_SENDERS",
+      "SUPABASE_DB_SETTINGS_MAX_WORKER_PROCESSES",
+      "SUPABASE_DB_SETTINGS_SESSION_REPLICATION_ROLE",
+      "SUPABASE_DB_SETTINGS_SHARED_BUFFERS",
+      "SUPABASE_DB_SETTINGS_STATEMENT_TIMEOUT",
+      "SUPABASE_DB_SETTINGS_TRACK_ACTIVITY_QUERY_SIZE",
+      "SUPABASE_DB_SETTINGS_TRACK_COMMIT_TIMESTAMP",
+      "SUPABASE_DB_SETTINGS_WAL_KEEP_SIZE",
+      "SUPABASE_DB_SETTINGS_WAL_SENDER_TIMEOUT",
+      "SUPABASE_DB_SETTINGS_WORK_MEM",
+    ];
+
+    afterEach(() => {
+      for (const name of ALL_OVERRIDE_NAMES) delete process.env[name];
+    });
+
+    it("returns the configured settings unchanged when nothing is overridden", () => {
+      const settings = { shared_buffers: "128MB", max_connections: 100 };
+      expect(legacyResolveDbSettingsEnvOverrides(settings, undefined)).toEqual(settings);
+    });
+
+    it("leaves an unconfigured field undefined when nothing is overridden", () => {
+      expect(
+        legacyResolveDbSettingsEnvOverrides({}, undefined).effective_cache_size,
+      ).toBeUndefined();
+    });
+
+    it("overrides a string field via the env var", () => {
+      process.env["SUPABASE_DB_SETTINGS_SHARED_BUFFERS"] = "256MB";
+      expect(
+        legacyResolveDbSettingsEnvOverrides({ shared_buffers: "128MB" }, undefined).shared_buffers,
+      ).toBe("256MB");
+    });
+
+    it("sets a string field via the env var even when not configured at all", () => {
+      process.env["SUPABASE_DB_SETTINGS_WORK_MEM"] = "8MB";
+      expect(legacyResolveDbSettingsEnvOverrides({}, undefined).work_mem).toBe("8MB");
+    });
+
+    it("overrides a uint field via the env var", () => {
+      process.env["SUPABASE_DB_SETTINGS_MAX_CONNECTIONS"] = "200";
+      expect(
+        legacyResolveDbSettingsEnvOverrides({ max_connections: 100 }, undefined).max_connections,
+      ).toBe(200);
+    });
+
+    it("rejects a non-numeric uint override", () => {
+      process.env["SUPABASE_DB_SETTINGS_MAX_CONNECTIONS"] = "not-a-number";
+      expect(() => legacyResolveDbSettingsEnvOverrides({}, undefined)).toThrow(
+        "Invalid db.settings.max_connections",
+      );
+    });
+
+    it("overrides the boolean field via the env var", () => {
+      process.env["SUPABASE_DB_SETTINGS_TRACK_COMMIT_TIMESTAMP"] = "true";
+      expect(
+        legacyResolveDbSettingsEnvOverrides({ track_commit_timestamp: false }, undefined)
+          .track_commit_timestamp,
+      ).toBe(true);
+    });
+
+    it("rejects a malformed boolean override", () => {
+      process.env["SUPABASE_DB_SETTINGS_TRACK_COMMIT_TIMESTAMP"] = "not-a-bool";
+      expect(() => legacyResolveDbSettingsEnvOverrides({}, undefined)).toThrow(
+        LegacyInvalidBoolEnvOverrideError,
+      );
+    });
+
+    it("overrides the session_replication_role enum field via the env var", () => {
+      process.env["SUPABASE_DB_SETTINGS_SESSION_REPLICATION_ROLE"] = "replica";
+      expect(
+        legacyResolveDbSettingsEnvOverrides({ session_replication_role: "origin" }, undefined)
+          .session_replication_role,
+      ).toBe("replica");
+    });
+
+    it("leaves session_replication_role undefined when neither configured nor overridden", () => {
+      expect(
+        legacyResolveDbSettingsEnvOverrides({}, undefined).session_replication_role,
+      ).toBeUndefined();
+    });
+
+    // Go's `SessionReplicationRole.UnmarshalText` (`pkg/config/db.go:37-43`)
+    // hard-rejects anything outside `{origin, replica, local}`.
+    it("rejects an invalid session_replication_role override", () => {
+      process.env["SUPABASE_DB_SETTINGS_SESSION_REPLICATION_ROLE"] = "invalid";
+      expect(() => legacyResolveDbSettingsEnvOverrides({}, undefined)).toThrow(
+        LegacyInvalidSessionReplicationRoleEnvOverrideError,
+      );
+      expect(() => legacyResolveDbSettingsEnvOverrides({}, undefined)).toThrow(
+        'Invalid config for db.settings.session_replication_role: cannot parse "invalid" as one of "origin", "replica", "local"',
+      );
+    });
+
+    it("also honors a projectEnvValues (dotenv) value", () => {
+      expect(
+        legacyResolveDbSettingsEnvOverrides({}, { SUPABASE_DB_SETTINGS_SHARED_BUFFERS: "512MB" })
+          .shared_buffers,
+      ).toBe("512MB");
+    });
+  });
+
+  describe("auth.signing_keys_path (asymmetric JWT signing)", () => {
+    const tempRoot = useLegacyTempWorkdir("supabase-signing-keys-test-");
+
+    it("signs anon/service_role with the first RS256 key in the file", async () => {
+      const jwk = generateRsaJwk();
+      writeSigningKeys(tempRoot.current, [jwk]);
+      const config = baseConfig({ auth: { signing_keys_path: "signing_keys.json" } });
+      const values = legacyResolveLocalConfigValues(config, "127.0.0.1", tempRoot.current);
+
+      const publicJwk = { ...jwk, d: undefined, p: undefined, q: undefined, dp: undefined };
+      const publicKey = await importJWK(publicJwk, "RS256");
+      const { payload, protectedHeader } = await jwtVerify(values.anonKey, publicKey);
+      expect(payload).toMatchObject({ iss: "supabase-demo", role: "anon" });
+      expect(protectedHeader).toMatchObject({ alg: "RS256", kid: "test-rsa-kid" });
+
+      const serviceRole = await jwtVerify(values.serviceRoleKey, publicKey);
+      expect(serviceRole.payload).toMatchObject({ role: "service_role" });
+    });
+
+    it("resolves a relative signing_keys_path against <workdir>/supabase", async () => {
+      const jwk = generateRsaJwk();
+      writeSigningKeys(tempRoot.current, [jwk]);
+      const config = baseConfig({ auth: { signing_keys_path: "./signing_keys.json" } });
+      const values = legacyResolveLocalConfigValues(config, "127.0.0.1", tempRoot.current);
+      expect(values.anonKey.split(".")).toHaveLength(3);
+    });
+
+    it("uses an absolute signing_keys_path as-is, without joining the workdir", async () => {
+      const jwk = generateRsaJwk();
+      writeSigningKeys(tempRoot.current, [jwk]);
+      const absolutePath = join(tempRoot.current, "supabase", "signing_keys.json");
+      const config = baseConfig({ auth: { signing_keys_path: absolutePath } });
+      const values = legacyResolveLocalConfigValues(config, "127.0.0.1", "/some/unrelated/workdir");
+      expect(values.anonKey.split(".")).toHaveLength(3);
+    });
+
+    it("still prefers an explicit anon_key/service_role_key over signing keys", () => {
+      writeSigningKeys(tempRoot.current, [generateRsaJwk()]);
+      const config = baseConfig({
+        auth: {
+          signing_keys_path: "signing_keys.json",
+          anon_key: "configured-anon",
+          service_role_key: "configured-service-role",
+        },
+      });
+      const values = legacyResolveLocalConfigValues(config, "127.0.0.1", tempRoot.current);
+      expect(values.anonKey).toBe("configured-anon");
+      expect(values.serviceRoleKey).toBe("configured-service-role");
+    });
+
+    it("falls back to HMAC signing when signing_keys_path resolves to an empty array", () => {
+      writeSigningKeys(tempRoot.current, []);
+      const config = baseConfig({ auth: { signing_keys_path: "signing_keys.json" } });
+      const values = legacyResolveLocalConfigValues(config, "127.0.0.1", tempRoot.current);
+      const [, payload] = values.anonKey.split(".");
+      expect(JSON.parse(Buffer.from(payload ?? "", "base64url").toString())).toMatchObject({
+        iss: "supabase-demo",
+      });
+    });
+
+    it("throws a Go-worded error when the signing keys file does not exist", () => {
+      const config = baseConfig({ auth: { signing_keys_path: "missing.json" } });
+      expect(() => legacyResolveLocalConfigValues(config, "127.0.0.1", tempRoot.current)).toThrow(
+        "failed to read signing keys: ",
+      );
+    });
+
+    it("throws a Go-worded error when the signing keys file is malformed JSON", () => {
+      const supabaseDir = join(tempRoot.current, "supabase");
+      mkdirSync(supabaseDir, { recursive: true });
+      writeFileSync(join(supabaseDir, "signing_keys.json"), "not valid json");
+      const config = baseConfig({ auth: { signing_keys_path: "signing_keys.json" } });
+      expect(() => legacyResolveLocalConfigValues(config, "127.0.0.1", tempRoot.current)).toThrow(
+        "failed to decode signing keys: ",
+      );
+    });
+
+    it("throws when the first key uses an unsupported algorithm", () => {
+      writeSigningKeys(tempRoot.current, [{ ...generateRsaJwk(), alg: "RS512" }]);
+      const config = baseConfig({ auth: { signing_keys_path: "signing_keys.json" } });
+      expect(() => legacyResolveLocalConfigValues(config, "127.0.0.1", tempRoot.current)).toThrow(
+        "unsupported algorithm: RS512",
+      );
+    });
+
+    // Go's `Validate` only opens/parses `signing_keys_path` inside
+    // `if c.Auth.Enabled` (`pkg/config/config.go:1036,1059-1065`) — a disabled
+    // auth section never touches the file, however stale or missing it is.
+    it("skips reading a missing signing_keys_path when auth is disabled", () => {
+      const config = baseConfig({
+        auth: { enabled: false, signing_keys_path: "missing.json" },
+      });
+      expect(() =>
+        legacyResolveLocalConfigValues(config, "127.0.0.1", tempRoot.current),
+      ).not.toThrow();
+    });
+
+    it("skips reading a malformed signing_keys_path when auth is disabled, but still signs asymmetrically with the default key", async () => {
+      const supabaseDir = join(tempRoot.current, "supabase");
+      mkdirSync(supabaseDir, { recursive: true });
+      writeFileSync(join(supabaseDir, "signing_keys.json"), "not valid json");
+      const config = baseConfig({
+        auth: { enabled: false, signing_keys_path: "signing_keys.json" },
+      });
+      const values = legacyResolveLocalConfigValues(config, "127.0.0.1", tempRoot.current);
+      // Go's `generateJWT` (`apikeys.go:77`) checks `len(a.SigningKeysPath) > 0 &&
+      // len(a.SigningKeys) > 0`, NOT `auth.enabled` — `a.SigningKeys` is never empty (it keeps
+      // its `NewConfig()`-seeded default when the file read is skipped), so a disabled-auth
+      // config with a configured path still signs with the default ES256 key, not HMAC.
+      const publicKey = await importJWK(
+        { ...LEGACY_DEFAULT_SIGNING_KEY, d: undefined, key_ops: undefined },
+        "ES256",
+      );
+      const { payload, protectedHeader } = await jwtVerify(values.anonKey, publicKey);
+      expect(payload).toMatchObject({ iss: "supabase-demo", role: "anon" });
+      expect(protectedHeader).toMatchObject({ alg: "ES256", kid: LEGACY_DEFAULT_SIGNING_KEY.kid });
+    });
+
+    describe("SUPABASE_AUTH_ENABLED env override", () => {
+      // `c.Auth.Enabled` is Viper-bound like any other field
+      // (config.go:582-586), so `Validate`'s `if c.Auth.Enabled` gate
+      // (config.go:1036,1059-1065) reads the POST-override value, not raw
+      // TOML — a stale/missing signing_keys_path must be skipped when auth is
+      // disabled only via env/dotenv, and read when auth is enabled only via
+      // env/dotenv despite TOML saying otherwise.
+      afterEach(() => {
+        delete process.env["SUPABASE_AUTH_ENABLED"];
+      });
+
+      it("skips reading a missing signing_keys_path when auth is disabled only via env", () => {
+        process.env["SUPABASE_AUTH_ENABLED"] = "false";
+        const config = baseConfig({
+          auth: { enabled: true, signing_keys_path: "missing.json" },
+        });
+        expect(() =>
+          legacyResolveLocalConfigValues(config, "127.0.0.1", tempRoot.current),
+        ).not.toThrow();
+      });
+
+      it("reads signing_keys_path when auth is enabled only via env despite TOML saying disabled", async () => {
+        process.env["SUPABASE_AUTH_ENABLED"] = "true";
+        const jwk = generateRsaJwk();
+        writeSigningKeys(tempRoot.current, [jwk]);
+        const config = baseConfig({
+          auth: { enabled: false, signing_keys_path: "signing_keys.json" },
+        });
+        const values = legacyResolveLocalConfigValues(config, "127.0.0.1", tempRoot.current);
+        expect(values.anonKey.split(".")).toHaveLength(3);
+      });
+
+      it("rejects a malformed override instead of falling back to the configured value", () => {
+        process.env["SUPABASE_AUTH_ENABLED"] = "not-a-bool";
+        const config = baseConfig({
+          auth: { enabled: false, signing_keys_path: "missing.json" },
+        });
+        expect(() => legacyResolveLocalConfigValues(config, "127.0.0.1", tempRoot.current)).toThrow(
+          LegacyInvalidBoolEnvOverrideError,
+        );
+      });
+    });
+  });
+
+  describe("auth.site_url (required field in config)", () => {
+    // The pure empty/set/disabled assertions moved to `legacy-config-validate.unit.test.ts`
+    // (direct `legacyValidateResolvedConfig` calls) — only the SUPABASE_AUTH_ENABLED /
+    // SUPABASE_AUTH_SITE_URL env-override mechanics stay here.
+    describe("SUPABASE_AUTH_ENABLED / SUPABASE_AUTH_SITE_URL env overrides", () => {
+      afterEach(() => {
+        delete process.env["SUPABASE_AUTH_ENABLED"];
+        delete process.env["SUPABASE_AUTH_SITE_URL"];
+      });
+
+      it("rejects an empty site_url when auth is enabled only via env", () => {
+        process.env["SUPABASE_AUTH_ENABLED"] = "true";
+        const config = baseConfig({ auth: { enabled: false, site_url: "" } });
+        expect(() => legacyResolveLocalConfigValues(config, "127.0.0.1", WORKDIR)).toThrow(
+          "Missing required field in config: auth.site_url",
+        );
+      });
+
+      it("does not throw when auth is disabled only via env, however empty site_url is", () => {
+        process.env["SUPABASE_AUTH_ENABLED"] = "false";
+        const config = baseConfig({ auth: { enabled: true, site_url: "" } });
+        expect(() => legacyResolveLocalConfigValues(config, "127.0.0.1", WORKDIR)).not.toThrow();
+      });
+
+      it("accepts an env-provided site_url overriding an empty config.toml value", () => {
+        process.env["SUPABASE_AUTH_SITE_URL"] = "http://localhost:4000";
+        const config = baseConfig({ auth: { enabled: true, site_url: "" } });
+        expect(() => legacyResolveLocalConfigValues(config, "127.0.0.1", WORKDIR)).not.toThrow();
+      });
+
+      it("exposes the overridden site_url on the returned values, not just for validation", () => {
+        process.env["SUPABASE_AUTH_SITE_URL"] = "http://localhost:4000";
+        const config = baseConfig({ auth: { enabled: true, site_url: "http://127.0.0.1:3000" } });
+        const values = legacyResolveLocalConfigValues(config, "127.0.0.1", WORKDIR);
+        expect(values.authSiteUrl).toBe("http://localhost:4000");
+      });
+    });
+  });
+
+  describe("auth.* flat scalar env overrides (GoTrue container env, not just validation)", () => {
+    const AUTH_SCALAR_ENV_KEYS = [
+      "SUPABASE_AUTH_JWT_ISSUER",
+      "SUPABASE_AUTH_JWT_EXPIRY",
+      "SUPABASE_AUTH_ADDITIONAL_REDIRECT_URLS",
+      "SUPABASE_AUTH_ENABLE_SIGNUP",
+      "SUPABASE_AUTH_ENABLE_ANONYMOUS_SIGN_INS",
+      "SUPABASE_AUTH_ENABLE_REFRESH_TOKEN_ROTATION",
+      "SUPABASE_AUTH_REFRESH_TOKEN_REUSE_INTERVAL",
+      "SUPABASE_AUTH_ENABLE_MANUAL_LINKING",
+      "SUPABASE_AUTH_MINIMUM_PASSWORD_LENGTH",
+      "SUPABASE_AUTH_PASSWORD_REQUIREMENTS",
+    ];
+    afterEach(() => {
+      for (const key of AUTH_SCALAR_ENV_KEYS) delete process.env[key];
+    });
+
+    it("overrides every flat auth.* scalar GoTrue needs, not just the ones Validate checks", () => {
+      process.env["SUPABASE_AUTH_JWT_ISSUER"] = "https://issuer.example.com";
+      process.env["SUPABASE_AUTH_JWT_EXPIRY"] = "7200";
+      process.env["SUPABASE_AUTH_ADDITIONAL_REDIRECT_URLS"] =
+        "https://a.example.com,https://b.example.com";
+      process.env["SUPABASE_AUTH_ENABLE_SIGNUP"] = "false";
+      process.env["SUPABASE_AUTH_ENABLE_ANONYMOUS_SIGN_INS"] = "true";
+      process.env["SUPABASE_AUTH_ENABLE_REFRESH_TOKEN_ROTATION"] = "false";
+      process.env["SUPABASE_AUTH_REFRESH_TOKEN_REUSE_INTERVAL"] = "20";
+      process.env["SUPABASE_AUTH_ENABLE_MANUAL_LINKING"] = "true";
+      process.env["SUPABASE_AUTH_MINIMUM_PASSWORD_LENGTH"] = "12";
+      process.env["SUPABASE_AUTH_PASSWORD_REQUIREMENTS"] = "lower_upper_letters_digits";
+
+      const config = baseConfig({
+        auth: {
+          jwt_expiry: 3600,
+          additional_redirect_urls: [],
+          enable_signup: true,
+          enable_anonymous_sign_ins: false,
+          enable_refresh_token_rotation: true,
+          refresh_token_reuse_interval: 10,
+          enable_manual_linking: false,
+          minimum_password_length: 6,
+          password_requirements: "",
+        },
+      });
+      const values = legacyResolveLocalConfigValues(config, "127.0.0.1", WORKDIR);
+
+      expect(values.authJwtIssuer).toBe("https://issuer.example.com");
+      expect(values.authJwtExpiry).toBe(7200);
+      expect(values.authAdditionalRedirectUrls).toEqual([
+        "https://a.example.com",
+        "https://b.example.com",
+      ]);
+      expect(values.authEnableSignup).toBe(false);
+      expect(values.authEnableAnonymousSignIns).toBe(true);
+      expect(values.authEnableRefreshTokenRotation).toBe(false);
+      expect(values.authRefreshTokenReuseInterval).toBe(20);
+      expect(values.authEnableManualLinking).toBe(true);
+      expect(values.authMinimumPasswordLength).toBe(12);
+      expect(values.authPasswordRequirements).toBe("lower_upper_letters_digits");
+    });
+
+    it("rejects an unrecognized SUPABASE_AUTH_PASSWORD_REQUIREMENTS override, matching Go's UnmarshalText", () => {
+      process.env["SUPABASE_AUTH_PASSWORD_REQUIREMENTS"] = "bogus";
+      const config = baseConfig();
+      expect(() => legacyResolveLocalConfigValues(config, "127.0.0.1", WORKDIR)).toThrow(
+        "Invalid auth.password_requirements: bogus",
+      );
+    });
+  });
+
+  // auth.captcha/passkey/webauthn/hook/smtp REQUIRED-FIELD checks (the actual `enabled` ⇒
+  // provider/secret/uri/host/etc. logic) live entirely in `legacy-config-validate.unit.test.ts`
+  // (direct `legacyValidateResolvedConfig` calls). Only the SUPABASE_*-env-override MECHANICS
+  // this resolver owns — layering an env/dotenv value on top of the TOML-decoded or
+  // raw-document-derived value before that validation ever runs — are tested here, same split as
+  // `auth.site_url` above.
+
+  describe("auth.captcha env overrides", () => {
+    // `auth.captcha.*` is Viper-bound like any other nested field once `[auth.captcha]` is
+    // present in config.toml (`ExperimentalBindStruct`/`AutomaticEnv`, `config.go:581-586`).
+    afterEach(() => {
+      delete process.env["SUPABASE_AUTH_CAPTCHA_ENABLED"];
+      delete process.env["SUPABASE_AUTH_CAPTCHA_PROVIDER"];
+      delete process.env["SUPABASE_AUTH_CAPTCHA_SECRET"];
+    });
+
+    it("rejects a captcha section enabled only via env with no provider", () => {
+      process.env["SUPABASE_AUTH_CAPTCHA_ENABLED"] = "true";
+      const config = baseConfig({ auth: { captcha: { enabled: false } } });
+      const document = { auth: { captcha: { enabled: false } } };
+      expect(() =>
+        legacyResolveLocalConfigValues(config, "127.0.0.1", WORKDIR, undefined, document),
+      ).toThrow("Missing required field in config: auth.captcha.provider");
+    });
+
+    it("does not throw when an incomplete enabled captcha section is disabled only via env", () => {
+      process.env["SUPABASE_AUTH_CAPTCHA_ENABLED"] = "false";
+      const config = baseConfig({ auth: { captcha: { enabled: true } } });
+      const document = { auth: { captcha: { enabled: true } } };
+      expect(() =>
+        legacyResolveLocalConfigValues(config, "127.0.0.1", WORKDIR, undefined, document),
+      ).not.toThrow();
+    });
+
+    it("accepts env-provided provider/secret overriding an enabled captcha section", () => {
+      process.env["SUPABASE_AUTH_CAPTCHA_PROVIDER"] = "hcaptcha";
+      process.env["SUPABASE_AUTH_CAPTCHA_SECRET"] = "shh";
+      const config = baseConfig({ auth: { captcha: { enabled: true } } });
+      const document = { auth: { captcha: { enabled: true } } };
+      expect(() =>
+        legacyResolveLocalConfigValues(config, "127.0.0.1", WORKDIR, undefined, document),
+      ).not.toThrow();
+    });
+
+    it("does not synthesize a captcha section purely from an env override when [auth.captcha] is absent", () => {
+      process.env["SUPABASE_AUTH_CAPTCHA_ENABLED"] = "true";
+      const config = baseConfig();
+      expect(() => legacyResolveLocalConfigValues(config, "127.0.0.1", WORKDIR)).not.toThrow();
+    });
+  });
+
+  describe("auth.passkey / auth.webauthn env overrides", () => {
+    // `auth.passkey.enabled`/`auth.webauthn.*` are Viper-bound like any other nested field once
+    // `[auth.passkey]`/`[auth.webauthn]` are present in config.toml. Both are read from the raw
+    // `document` (5th param), same as the presence-based defaulting above, so these tests thread
+    // a `document` object through explicitly instead of relying on `baseConfig`'s decoded schema
+    // (which has no `passkey`/`webauthn` fields at all).
+    afterEach(() => {
+      delete process.env["SUPABASE_AUTH_PASSKEY_ENABLED"];
+      delete process.env["SUPABASE_AUTH_WEBAUTHN_RP_ID"];
+      delete process.env["SUPABASE_AUTH_WEBAUTHN_RP_ORIGINS"];
+    });
+
+    it("rejects a passkey section enabled only via env with no [auth.webauthn] section", () => {
+      process.env["SUPABASE_AUTH_PASSKEY_ENABLED"] = "true";
+      const config = baseConfig();
+      const document = { auth: { passkey: { enabled: false } } };
+      expect(() =>
+        legacyResolveLocalConfigValues(config, "127.0.0.1", WORKDIR, undefined, document),
+      ).toThrow(
+        "Missing required config section: auth.webauthn (required when auth.passkey.enabled is true)",
+      );
+    });
+
+    it("accepts env-provided rp_id/rp_origins overriding an incomplete [auth.webauthn] section", () => {
+      process.env["SUPABASE_AUTH_PASSKEY_ENABLED"] = "true";
+      process.env["SUPABASE_AUTH_WEBAUTHN_RP_ID"] = "localhost";
+      process.env["SUPABASE_AUTH_WEBAUTHN_RP_ORIGINS"] =
+        "http://localhost:3000,http://localhost:3001";
+      const config = baseConfig();
+      const document = { auth: { passkey: { enabled: false }, webauthn: {} } };
+      expect(() =>
+        legacyResolveLocalConfigValues(config, "127.0.0.1", WORKDIR, undefined, document),
+      ).not.toThrow();
+    });
+
+    it("does not synthesize a passkey section purely from an env override when [auth.passkey] is absent from the document", () => {
+      process.env["SUPABASE_AUTH_PASSKEY_ENABLED"] = "true";
+      const config = baseConfig();
+      expect(() => legacyResolveLocalConfigValues(config, "127.0.0.1", WORKDIR)).not.toThrow();
+    });
+
+    it("throws on an unparsable raw auth.passkey.enabled string instead of silently disabling it", () => {
+      // e.g. a still-literal `env(VAR)` placeholder when the referenced var was never set, or a
+      // typo — Go's `strconv.ParseBool` hard-rejects this during `Config.Load`, it never silently
+      // treats it as `false`.
+      const config = baseConfig();
+      const document = { auth: { passkey: { enabled: "not-a-bool" } } };
+      expect(() =>
+        legacyResolveLocalConfigValues(config, "127.0.0.1", WORKDIR, undefined, document),
+      ).toThrow('cannot parse "not-a-bool" as a bool');
+    });
+  });
+
+  describe("auth.hook.* env overrides", () => {
+    // `auth.hook.<type>.*` is Viper-bound like any other nested field once `[auth.hook.<type>]`
+    // is present in config.toml. `@supabase/config`'s hook schema always decodes a default
+    // `{ enabled: false }` regardless of file presence, so — like passkey/webauthn above — the
+    // presence gate is read from the raw `document`, not the decoded `config`.
+    afterEach(() => {
+      delete process.env["SUPABASE_AUTH_HOOK_SEND_EMAIL_ENABLED"];
+      delete process.env["SUPABASE_AUTH_HOOK_SEND_EMAIL_URI"];
+      delete process.env["SUPABASE_AUTH_HOOK_SEND_EMAIL_SECRETS"];
+    });
+
+    it("rejects a hook section enabled only via env with no uri", () => {
+      process.env["SUPABASE_AUTH_HOOK_SEND_EMAIL_ENABLED"] = "true";
+      const config = baseConfig();
+      const document = { auth: { hook: { send_email: { enabled: false } } } };
+      expect(() =>
+        legacyResolveLocalConfigValues(config, "127.0.0.1", WORKDIR, undefined, document),
+      ).toThrow("Missing required field in config: auth.hook.send_email.uri");
+    });
+
+    it("accepts an env-provided uri overriding a TOML-enabled hook missing its uri", () => {
+      process.env["SUPABASE_AUTH_HOOK_SEND_EMAIL_URI"] = "pg-functions://postgres/auth/hook";
+      const config = baseConfig({ auth: { hook: { send_email: { enabled: true } } } });
+      const document = { auth: { hook: { send_email: { enabled: true } } } };
+      expect(() =>
+        legacyResolveLocalConfigValues(config, "127.0.0.1", WORKDIR, undefined, document),
+      ).not.toThrow();
+    });
+
+    it("does not synthesize a hook enablement purely from an env override when the section is absent from the document", () => {
+      process.env["SUPABASE_AUTH_HOOK_SEND_EMAIL_ENABLED"] = "true";
+      const config = baseConfig();
+      expect(() => legacyResolveLocalConfigValues(config, "127.0.0.1", WORKDIR)).not.toThrow();
+    });
+  });
+
+  describe("auth.email.smtp env overrides", () => {
+    // `auth.email.smtp.*` is Viper-bound like any other nested field once `[auth.email.smtp]`
+    // is present in config.toml — layered on top of the presence-aware raw-document read that
+    // already exists here for Go's presence-based `enabled` default.
+    afterEach(() => {
+      delete process.env["SUPABASE_AUTH_EMAIL_SMTP_ENABLED"];
+      delete process.env["SUPABASE_AUTH_EMAIL_SMTP_HOST"];
+      delete process.env["SUPABASE_AUTH_EMAIL_SMTP_PORT"];
+      delete process.env["SUPABASE_AUTH_EMAIL_SMTP_USER"];
+      delete process.env["SUPABASE_AUTH_EMAIL_SMTP_PASS"];
+      delete process.env["SUPABASE_AUTH_EMAIL_SMTP_ADMIN_EMAIL"];
+    });
+
+    it("rejects an smtp section enabled only via env with no host", () => {
+      process.env["SUPABASE_AUTH_EMAIL_SMTP_ENABLED"] = "true";
+      const config = baseConfig();
+      const document = { auth: { email: { smtp: { enabled: false } } } };
+      expect(() =>
+        legacyResolveLocalConfigValues(config, "127.0.0.1", WORKDIR, undefined, document),
+      ).toThrow("Missing required field in config: auth.email.smtp.host");
+    });
+
+    it("accepts env-provided host/port/user/pass/admin_email overriding an enabled-but-incomplete smtp section", () => {
+      process.env["SUPABASE_AUTH_EMAIL_SMTP_HOST"] = "smtp.example.com";
+      process.env["SUPABASE_AUTH_EMAIL_SMTP_PORT"] = "587";
+      process.env["SUPABASE_AUTH_EMAIL_SMTP_USER"] = "user";
+      process.env["SUPABASE_AUTH_EMAIL_SMTP_PASS"] = "pass";
+      process.env["SUPABASE_AUTH_EMAIL_SMTP_ADMIN_EMAIL"] = "admin@example.com";
+      const config = baseConfig();
+      const document = { auth: { email: { smtp: { enabled: true } } } };
+      expect(() =>
+        legacyResolveLocalConfigValues(config, "127.0.0.1", WORKDIR, undefined, document),
+      ).not.toThrow();
+    });
+
+    it("rejects an invalid SUPABASE_AUTH_EMAIL_SMTP_PORT override", () => {
+      process.env["SUPABASE_AUTH_EMAIL_SMTP_HOST"] = "smtp.example.com";
+      process.env["SUPABASE_AUTH_EMAIL_SMTP_PORT"] = "not-a-port";
+      process.env["SUPABASE_AUTH_EMAIL_SMTP_USER"] = "user";
+      process.env["SUPABASE_AUTH_EMAIL_SMTP_PASS"] = "pass";
+      process.env["SUPABASE_AUTH_EMAIL_SMTP_ADMIN_EMAIL"] = "admin@example.com";
+      const config = baseConfig();
+      const document = { auth: { email: { smtp: { enabled: true } } } };
+      expect(() =>
+        legacyResolveLocalConfigValues(config, "127.0.0.1", WORKDIR, undefined, document),
+      ).toThrow(LegacyInvalidPortEnvOverrideError);
+    });
+
+    it("does not synthesize an smtp section purely from an env override when [auth.email.smtp] is absent from the document", () => {
+      process.env["SUPABASE_AUTH_EMAIL_SMTP_ENABLED"] = "true";
+      const config = baseConfig();
+      expect(() => legacyResolveLocalConfigValues(config, "127.0.0.1", WORKDIR)).not.toThrow();
+    });
+  });
+
+  describe("auth.mfa env overrides", () => {
+    // `auth.mfa.<factor>.*` is Viper-bound unconditionally (value-typed struct fields, never
+    // `nil`) — unlike hooks/smtp above, no raw-document presence gate is needed; see the block
+    // comment above the `mfa` array in legacy-local-config-values.ts.
+    afterEach(() => {
+      delete process.env["SUPABASE_AUTH_MFA_TOTP_ENROLL_ENABLED"];
+      delete process.env["SUPABASE_AUTH_MFA_TOTP_VERIFY_ENABLED"];
+    });
+
+    it("rejects an env-enabled enroll factor left at its TOML-decoded verify default", () => {
+      process.env["SUPABASE_AUTH_MFA_TOTP_ENROLL_ENABLED"] = "true";
+      const config = baseConfig();
+      expect(() => legacyResolveLocalConfigValues(config, "127.0.0.1", WORKDIR)).toThrow(
+        "Invalid MFA config: auth.mfa.totp.enroll_enabled requires verify_enabled",
+      );
+    });
+
+    it("accepts an env-enabled enroll factor when verify is also env-enabled", () => {
+      process.env["SUPABASE_AUTH_MFA_TOTP_ENROLL_ENABLED"] = "true";
+      process.env["SUPABASE_AUTH_MFA_TOTP_VERIFY_ENABLED"] = "true";
+      const config = baseConfig();
+      expect(() => legacyResolveLocalConfigValues(config, "127.0.0.1", WORKDIR)).not.toThrow();
+    });
+
+    it("rejects a malformed SUPABASE_AUTH_MFA_TOTP_ENROLL_ENABLED override", () => {
+      process.env["SUPABASE_AUTH_MFA_TOTP_ENROLL_ENABLED"] = "not-a-bool";
+      const config = baseConfig();
+      expect(() => legacyResolveLocalConfigValues(config, "127.0.0.1", WORKDIR)).toThrow(
+        LegacyInvalidBoolEnvOverrideError,
+      );
+    });
+  });
+
+  describe("auth.third_party env overrides", () => {
+    // Same value-typed-struct reasoning as auth.mfa above — including `workos`, whose default
+    // template omits `[auth.third_party.workos]` entirely yet is still unconditionally overridable.
+    afterEach(() => {
+      delete process.env["SUPABASE_AUTH_THIRD_PARTY_FIREBASE_ENABLED"];
+      delete process.env["SUPABASE_AUTH_THIRD_PARTY_FIREBASE_PROJECT_ID"];
+    });
+
+    it("rejects a third-party provider enabled only via env with no required field configured", () => {
+      process.env["SUPABASE_AUTH_THIRD_PARTY_FIREBASE_ENABLED"] = "true";
+      const config = baseConfig();
+      expect(() => legacyResolveLocalConfigValues(config, "127.0.0.1", WORKDIR)).toThrow(
+        "Invalid config: auth.third_party.firebase is enabled but without a project_id.",
+      );
+    });
+
+    it("accepts an env-provided project_id overriding a TOML-enabled firebase provider", () => {
+      process.env["SUPABASE_AUTH_THIRD_PARTY_FIREBASE_PROJECT_ID"] = "my-project";
+      const config = baseConfig({ auth: { third_party: { firebase: { enabled: true } } } });
+      expect(() => legacyResolveLocalConfigValues(config, "127.0.0.1", WORKDIR)).not.toThrow();
+    });
+
+    it("does not enable a third-party provider purely from a required-field env override", () => {
+      process.env["SUPABASE_AUTH_THIRD_PARTY_FIREBASE_PROJECT_ID"] = "my-project";
+      const config = baseConfig();
+      expect(() => legacyResolveLocalConfigValues(config, "127.0.0.1", WORKDIR)).not.toThrow();
+    });
+  });
+
+  describe("auth.email.template/notification (content_path validation)", () => {
+    // Go's `(e *email) validate(fsys)` (`pkg/config/config.go:1293-1313`),
+    // called right after `Auth.MFA.validate()`, still inside `if c.Auth.Enabled`.
+    const tempRoot = useLegacyTempWorkdir("supabase-email-templates-test-");
+
+    it("rejects a template content_path pointing at a missing file", () => {
+      const config = baseConfig({
+        auth: {
+          enabled: true,
+          site_url: "http://localhost:3000",
+          email: { template: { invite: { content_path: "missing-invite.html" } } },
+        },
+      });
+      expect(() => legacyResolveLocalConfigValues(config, "127.0.0.1", tempRoot.current)).toThrow(
+        "Invalid config for auth.email.template.invite.content_path: ",
+      );
+    });
+
+    it("resolves a relative template content_path against the workdir itself, not <workdir>/supabase", () => {
+      writeFileSync(join(tempRoot.current, "invite.html"), "<html></html>");
+      const config = baseConfig({
+        auth: {
+          enabled: true,
+          site_url: "http://localhost:3000",
+          email: { template: { invite: { content_path: "invite.html" } } },
+        },
+      });
+      expect(() =>
+        legacyResolveLocalConfigValues(config, "127.0.0.1", tempRoot.current),
+      ).not.toThrow();
+    });
+
+    it("does not throw a template with no content_path configured", () => {
+      const config = baseConfig({
+        auth: {
+          enabled: true,
+          site_url: "http://localhost:3000",
+          email: { template: { invite: {} } },
+        },
+      });
+      expect(() =>
+        legacyResolveLocalConfigValues(config, "127.0.0.1", tempRoot.current),
+      ).not.toThrow();
+    });
+
+    it("rejects an enabled notification content_path pointing at a missing file", () => {
+      const config = baseConfig({
+        auth: {
+          enabled: true,
+          site_url: "http://localhost:3000",
+          email: {
+            notification: { password_changed: { enabled: true, content_path: "missing.html" } },
+          },
+        },
+      });
+      expect(() => legacyResolveLocalConfigValues(config, "127.0.0.1", tempRoot.current)).toThrow(
+        "Invalid config for auth.email.notification.password_changed.content_path: ",
+      );
+    });
+
+    it("resolves a relative notification content_path against <workdir>/supabase", () => {
+      const supabaseDir = join(tempRoot.current, "supabase");
+      mkdirSync(supabaseDir, { recursive: true });
+      writeFileSync(join(supabaseDir, "pw-changed.html"), "<html></html>");
+      const config = baseConfig({
+        auth: {
+          enabled: true,
+          site_url: "http://localhost:3000",
+          email: {
+            notification: {
+              password_changed: { enabled: true, content_path: "pw-changed.html" },
+            },
+          },
+        },
+      });
+      expect(() =>
+        legacyResolveLocalConfigValues(config, "127.0.0.1", tempRoot.current),
+      ).not.toThrow();
+    });
+
+    it("does not throw a disabled notification's missing content_path", () => {
+      const config = baseConfig({
+        auth: {
+          enabled: true,
+          site_url: "http://localhost:3000",
+          email: {
+            notification: {
+              password_changed: { enabled: false, content_path: "missing.html" },
+            },
+          },
+        },
+      });
+      expect(() =>
+        legacyResolveLocalConfigValues(config, "127.0.0.1", tempRoot.current),
+      ).not.toThrow();
+    });
+
+    it("does not throw a missing template content_path when auth is disabled", () => {
+      const config = baseConfig({
+        auth: { enabled: false, email: { template: { invite: { content_path: "missing.html" } } } },
+      });
+      expect(() =>
+        legacyResolveLocalConfigValues(config, "127.0.0.1", tempRoot.current),
+      ).not.toThrow();
+    });
+
+    // Divergence #2 (see `legacy-config-validate.ts`'s port-plan notes): Go's asymmetric
+    // content-vs-content_path exclusivity (`config.go:1293-1313`) — a raw `content` key present
+    // with no `content_path` is an error, not a silent no-op. `@supabase/config`'s schema has no
+    // `content` field to see, so this only fires when the raw `document` (5th param) carries it.
+    it("rejects a template content key present without content_path", () => {
+      const config = baseConfig({
+        auth: {
+          enabled: true,
+          site_url: "http://localhost:3000",
+          email: { template: { invite: {} } },
+        },
+      });
+      expect(() =>
+        legacyResolveLocalConfigValues(config, "127.0.0.1", tempRoot.current, undefined, {
+          auth: { email: { template: { invite: { content: "<html>Hi</html>" } } } },
+        }),
+      ).toThrow(
+        "Invalid config for auth.email.template.invite.content: please use content_path instead",
+      );
+    });
+  });
+
+  describe("auth.email.template/notification env overrides", () => {
+    // `auth.email.template.<name>.*`/`auth.email.notification.<name>.*` are Viper-bound like any
+    // other nested field once the section is present in config.toml. Unlike hook/passkey, no
+    // extra raw-document presence gate is needed: `email.template`/`email.notification` are
+    // `Schema.Record`s, so `Object.entries` on the decoded config already reflects presence.
+    const tempRoot = useLegacyTempWorkdir("supabase-email-template-env-test-");
+
+    afterEach(() => {
+      delete process.env["SUPABASE_AUTH_EMAIL_TEMPLATE_INVITE_CONTENT_PATH"];
+      delete process.env["SUPABASE_AUTH_EMAIL_TEMPLATE_INVITE_CONTENT"];
+      delete process.env["SUPABASE_AUTH_EMAIL_NOTIFICATION_PASSWORD_CHANGED_ENABLED"];
+      delete process.env["SUPABASE_AUTH_EMAIL_NOTIFICATION_PASSWORD_CHANGED_CONTENT_PATH"];
+      delete process.env["SUPABASE_AUTH_EMAIL_NOTIFICATION_PASSWORD_CHANGED_CONTENT"];
+    });
+
+    it("lets an env-provided template content_path override a missing TOML content_path", () => {
+      writeFileSync(join(tempRoot.current, "invite.html"), "<html></html>");
+      process.env["SUPABASE_AUTH_EMAIL_TEMPLATE_INVITE_CONTENT_PATH"] = "invite.html";
+      const config = baseConfig({
+        auth: {
+          enabled: true,
+          site_url: "http://localhost:3000",
+          email: { template: { invite: {} } },
+        },
+      });
+      expect(() =>
+        legacyResolveLocalConfigValues(config, "127.0.0.1", tempRoot.current),
+      ).not.toThrow();
+    });
+
+    it("rejects a notification enabled only via env with a missing content_path file", () => {
+      // Go applies SUPABASE_AUTH_EMAIL_NOTIFICATION_PASSWORD_CHANGED_ENABLED before
+      // Auth.Email.validate() decides whether to read content_path — a notification disabled
+      // in TOML but enabled by env must still be checked.
+      process.env["SUPABASE_AUTH_EMAIL_NOTIFICATION_PASSWORD_CHANGED_ENABLED"] = "true";
+      const config = baseConfig({
+        auth: {
+          enabled: true,
+          site_url: "http://localhost:3000",
+          email: {
+            notification: { password_changed: { enabled: false, content_path: "missing.html" } },
+          },
+        },
+      });
+      expect(() => legacyResolveLocalConfigValues(config, "127.0.0.1", tempRoot.current)).toThrow(
+        "Invalid config for auth.email.notification.password_changed.content_path: ",
+      );
+    });
+
+    it("does not validate a notification disabled only via env despite a TOML-enabled section", () => {
+      process.env["SUPABASE_AUTH_EMAIL_NOTIFICATION_PASSWORD_CHANGED_ENABLED"] = "false";
+      const config = baseConfig({
+        auth: {
+          enabled: true,
+          site_url: "http://localhost:3000",
+          email: {
+            notification: { password_changed: { enabled: true, content_path: "missing.html" } },
+          },
+        },
+      });
+      expect(() =>
+        legacyResolveLocalConfigValues(config, "127.0.0.1", tempRoot.current),
+      ).not.toThrow();
+    });
+
+    it("lets an env-provided notification content_path override a missing TOML content_path", () => {
+      const supabaseDir = join(tempRoot.current, "supabase");
+      mkdirSync(supabaseDir, { recursive: true });
+      writeFileSync(join(supabaseDir, "pw-changed.html"), "<html></html>");
+      process.env["SUPABASE_AUTH_EMAIL_NOTIFICATION_PASSWORD_CHANGED_CONTENT_PATH"] =
+        "pw-changed.html";
+      const config = baseConfig({
+        auth: {
+          enabled: true,
+          site_url: "http://localhost:3000",
+          email: { notification: { password_changed: { enabled: true } } },
+        },
+      });
+      expect(() =>
+        legacyResolveLocalConfigValues(config, "127.0.0.1", tempRoot.current),
+      ).not.toThrow();
+    });
+
+    // Go's Viper `AutomaticEnv` folds a `SUPABASE_AUTH_EMAIL_TEMPLATE_<NAME>_CONTENT`/
+    // `_NOTIFICATION_<NAME>_CONTENT` override into `Content *string` before `Config.Validate`
+    // runs (`config.go:749,882`), so it's "present" for the content-vs-content_path exclusivity
+    // check exactly like a raw TOML `content` key — a bare env override with no content_path
+    // configured anywhere must be rejected, not silently accepted.
+    it("rejects a template _CONTENT env override with no content_path configured", () => {
+      process.env["SUPABASE_AUTH_EMAIL_TEMPLATE_INVITE_CONTENT"] = "<html>Hi</html>";
+      const config = baseConfig({
+        auth: {
+          enabled: true,
+          site_url: "http://localhost:3000",
+          email: { template: { invite: {} } },
+        },
+      });
+      expect(() => legacyResolveLocalConfigValues(config, "127.0.0.1", tempRoot.current)).toThrow(
+        "Invalid config for auth.email.template.invite.content: please use content_path instead",
+      );
+    });
+
+    it("rejects an enabled notification's _CONTENT env override with no content_path configured", () => {
+      process.env["SUPABASE_AUTH_EMAIL_NOTIFICATION_PASSWORD_CHANGED_CONTENT"] = "<html>Hi</html>";
+      const config = baseConfig({
+        auth: {
+          enabled: true,
+          site_url: "http://localhost:3000",
+          email: { notification: { password_changed: { enabled: true } } },
+        },
+      });
+      expect(() => legacyResolveLocalConfigValues(config, "127.0.0.1", tempRoot.current)).toThrow(
+        "Invalid config for auth.email.notification.password_changed.content: please use content_path instead",
+      );
+    });
+
+    it("does not validate a disabled notification's _CONTENT env override", () => {
+      process.env["SUPABASE_AUTH_EMAIL_NOTIFICATION_PASSWORD_CHANGED_CONTENT"] = "<html>Hi</html>";
+      const config = baseConfig({
+        auth: {
+          enabled: true,
+          site_url: "http://localhost:3000",
+          email: { notification: { password_changed: { enabled: false } } },
+        },
+      });
+      expect(() =>
+        legacyResolveLocalConfigValues(config, "127.0.0.1", tempRoot.current),
+      ).not.toThrow();
+    });
+
+    it("lets a simultaneous template _CONTENT_PATH env override win over a _CONTENT env override", () => {
+      writeFileSync(join(tempRoot.current, "invite.html"), "<html></html>");
+      process.env["SUPABASE_AUTH_EMAIL_TEMPLATE_INVITE_CONTENT"] = "<html>Hi</html>";
+      process.env["SUPABASE_AUTH_EMAIL_TEMPLATE_INVITE_CONTENT_PATH"] = "invite.html";
+      const config = baseConfig({
+        auth: {
+          enabled: true,
+          site_url: "http://localhost:3000",
+          email: { template: { invite: {} } },
+        },
+      });
+      expect(() =>
+        legacyResolveLocalConfigValues(config, "127.0.0.1", tempRoot.current),
+      ).not.toThrow();
+    });
+  });
+
+  // auth.third_party.* (thirdParty.validate()) and functions.* (function-slug validation)
+  // moved entirely to `legacy-config-validate.unit.test.ts` (direct `legacyValidateResolvedConfig`
+  // calls) — L pre-filters to enabled-only third_party providers and derives function slugs
+  // directly off `config.functions` with no env-override mechanics of its own for these checks.
+
+  describe("auth.external (external.validate(), D-only, ported to L)", () => {
+    // `auth.external` is a genuine Go `map[string]provider`, so an unmodeled/arbitrary provider
+    // name is a legitimate config shape `@supabase/config`'s schema silently drops at decode —
+    // this check reads the raw `document` (5th param) instead, same as passkey/hook above.
+    it("rejects an enabled unmodeled external provider missing client_id", () => {
+      const config = baseConfig();
+      const document = { auth: { external: { custom: { enabled: true } } } };
+      expect(() =>
+        legacyResolveLocalConfigValues(config, "127.0.0.1", WORKDIR, undefined, document),
+      ).toThrow("Missing required field in config: auth.external.custom.client_id");
+    });
+
+    it("rejects an enabled unmodeled external provider missing secret", () => {
+      const config = baseConfig();
+      const document = {
+        auth: { external: { custom: { enabled: true, client_id: "abc" } } },
+      };
+      expect(() =>
+        legacyResolveLocalConfigValues(config, "127.0.0.1", WORKDIR, undefined, document),
+      ).toThrow("Missing required field in config: auth.external.custom.secret");
+    });
+
+    it("does not require a secret for apple/google providers", () => {
+      const config = baseConfig();
+      const document = {
+        auth: { external: { apple: { enabled: true, client_id: "abc" } } },
+      };
+      expect(() =>
+        legacyResolveLocalConfigValues(config, "127.0.0.1", WORKDIR, undefined, document),
+      ).not.toThrow();
+    });
+
+    it("skips deprecated linkedin/slack providers", () => {
+      const config = baseConfig();
+      const document = { auth: { external: { slack: { enabled: true } } } };
+      expect(() =>
+        legacyResolveLocalConfigValues(config, "127.0.0.1", WORKDIR, undefined, document),
+      ).not.toThrow();
+    });
+
+    it("does not validate a disabled unmodeled external provider", () => {
+      const config = baseConfig();
+      const document = { auth: { external: { custom: { enabled: false } } } };
+      expect(() =>
+        legacyResolveLocalConfigValues(config, "127.0.0.1", WORKDIR, undefined, document),
+      ).not.toThrow();
+    });
+
+    it("skips the check entirely when no document is threaded through", () => {
+      const config = baseConfig();
+      expect(() => legacyResolveLocalConfigValues(config, "127.0.0.1", WORKDIR)).not.toThrow();
+    });
+  });
+
+  describe("auth.external env overrides", () => {
+    // `auth.external.<name>.*` is Viper-bound like any other nested field once
+    // `[auth.external.<name>]` is present in config.toml — same gap the schema's own
+    // `requiredWhenEnabled` check has for KNOWN providers too.
+    afterEach(() => {
+      delete process.env["SUPABASE_AUTH_EXTERNAL_CUSTOM_ENABLED"];
+      delete process.env["SUPABASE_AUTH_EXTERNAL_CUSTOM_CLIENT_ID"];
+      delete process.env["SUPABASE_AUTH_EXTERNAL_CUSTOM_SECRET"];
+    });
+
+    it("rejects a provider enabled only via env with no client_id", () => {
+      process.env["SUPABASE_AUTH_EXTERNAL_CUSTOM_ENABLED"] = "true";
+      const config = baseConfig();
+      const document = { auth: { external: { custom: { enabled: false } } } };
+      expect(() =>
+        legacyResolveLocalConfigValues(config, "127.0.0.1", WORKDIR, undefined, document),
+      ).toThrow("Missing required field in config: auth.external.custom.client_id");
+    });
+
+    it("accepts env-provided client_id/secret overriding a TOML-enabled provider missing both", () => {
+      process.env["SUPABASE_AUTH_EXTERNAL_CUSTOM_CLIENT_ID"] = "abc";
+      process.env["SUPABASE_AUTH_EXTERNAL_CUSTOM_SECRET"] = "shh";
+      const config = baseConfig();
+      const document = { auth: { external: { custom: { enabled: true } } } };
+      expect(() =>
+        legacyResolveLocalConfigValues(config, "127.0.0.1", WORKDIR, undefined, document),
+      ).not.toThrow();
+    });
+
+    it("does not synthesize a provider purely from an env override when the section is absent from the document", () => {
+      process.env["SUPABASE_AUTH_EXTERNAL_CUSTOM_ENABLED"] = "true";
+      const config = baseConfig();
+      expect(() => legacyResolveLocalConfigValues(config, "127.0.0.1", WORKDIR)).not.toThrow();
+    });
+  });
+
+  describe("auth.sms env overrides (provider switch)", () => {
+    // Go's `(s *sms) validate()` (`pkg/config/config.go:1348-1410`) is a `switch` that validates
+    // ONLY the first enabled provider in a fixed priority order (twilio, twilio_verify,
+    // messagebird, textlocal, vonage). `@supabase/config`'s schema already implements this switch
+    // for the schema-decoded (pre-env-override) TOML value; this re-runs it against the raw
+    // document with `SUPABASE_AUTH_SMS_*` overrides applied, since the schema never sees them.
+    afterEach(() => {
+      delete process.env["SUPABASE_AUTH_SMS_TWILIO_ENABLED"];
+      delete process.env["SUPABASE_AUTH_SMS_TWILIO_ACCOUNT_SID"];
+      delete process.env["SUPABASE_AUTH_SMS_TWILIO_MESSAGE_SERVICE_SID"];
+      delete process.env["SUPABASE_AUTH_SMS_TWILIO_AUTH_TOKEN"];
+      delete process.env["SUPABASE_AUTH_SMS_MESSAGEBIRD_ENABLED"];
+    });
+
+    it("rejects a provider enabled only via env with missing required fields", () => {
+      process.env["SUPABASE_AUTH_SMS_TWILIO_ENABLED"] = "true";
+      const config = baseConfig();
+      const document = { auth: { sms: { twilio: { enabled: false } } } };
+      expect(() =>
+        legacyResolveLocalConfigValues(config, "127.0.0.1", WORKDIR, undefined, document),
+      ).toThrow("Missing required field in config: auth.sms.twilio.account_sid");
+    });
+
+    it("accepts env-provided credentials overriding a TOML-enabled provider missing them", () => {
+      process.env["SUPABASE_AUTH_SMS_TWILIO_ACCOUNT_SID"] = "AC123";
+      process.env["SUPABASE_AUTH_SMS_TWILIO_MESSAGE_SERVICE_SID"] = "MG123";
+      process.env["SUPABASE_AUTH_SMS_TWILIO_AUTH_TOKEN"] = "tok";
+      const config = baseConfig();
+      const document = { auth: { sms: { twilio: { enabled: true } } } };
+      expect(() =>
+        legacyResolveLocalConfigValues(config, "127.0.0.1", WORKDIR, undefined, document),
+      ).not.toThrow();
+    });
+
+    it("only validates the first enabled provider in Go's fixed priority order", () => {
+      // twilio is disabled via env; messagebird becomes the switch winner and is missing its
+      // required fields — twilio's own (still-missing) fields must never be inspected.
+      process.env["SUPABASE_AUTH_SMS_TWILIO_ENABLED"] = "false";
+      process.env["SUPABASE_AUTH_SMS_MESSAGEBIRD_ENABLED"] = "true";
+      const config = baseConfig();
+      const document = {
+        auth: { sms: { twilio: { enabled: true }, messagebird: { enabled: false } } },
+      };
+      expect(() =>
+        legacyResolveLocalConfigValues(config, "127.0.0.1", WORKDIR, undefined, document),
+      ).toThrow("Missing required field in config: auth.sms.messagebird.originator");
+    });
+
+    it("throws for a provider enabled only via env with missing required fields even when the document has no auth.sms section at all", () => {
+      // Unlike the other 4 providers, twilio's presence is NOT gated on the document: Go's
+      // ejected default config.toml (`pkg/config/templates/config.toml:288-293`) always emits an
+      // uncommented `[auth.sms.twilio]` table, so `mergeDefaultValues` registers
+      // `auth.sms.twilio.*` with Viper even when the user's own config.toml has no `[auth.sms]`
+      // section at all — `SUPABASE_AUTH_SMS_TWILIO_ENABLED` applies with nothing left to supply
+      // the required credentials, so this now fails validation instead of silently doing nothing.
+      process.env["SUPABASE_AUTH_SMS_TWILIO_ENABLED"] = "true";
+      const config = baseConfig();
+      expect(() => legacyResolveLocalConfigValues(config, "127.0.0.1", WORKDIR)).toThrow(
+        "Missing required field in config: auth.sms.twilio.account_sid",
+      );
+    });
+
+    it("resolves a fully env-only twilio configuration with no auth.sms.twilio document section", () => {
+      process.env["SUPABASE_AUTH_SMS_TWILIO_ENABLED"] = "true";
+      process.env["SUPABASE_AUTH_SMS_TWILIO_ACCOUNT_SID"] = "AC123";
+      process.env["SUPABASE_AUTH_SMS_TWILIO_MESSAGE_SERVICE_SID"] = "MG123";
+      process.env["SUPABASE_AUTH_SMS_TWILIO_AUTH_TOKEN"] = "tok";
+      const resolved = legacyResolveAuthSms(undefined, baseConfig().auth.sms, undefined);
+      expect(resolved.twilio.enabled).toBe(true);
+      expect(resolved.twilio.account_sid).toBe("AC123");
+      expect(resolved.twilio.message_service_sid).toBe("MG123");
+      expect(resolved.twilio.auth_token).toBe("tok");
+    });
+
+    it("still does not synthesize messagebird purely from an env override when the section is absent from the document", () => {
+      // messagebird (like twilio_verify/textlocal/vonage) has no entry at all in Go's default
+      // template, so an absent `[auth.sms.messagebird]` table genuinely means Viper never
+      // registers it — the presence gate is still correct parity for these 4 providers.
+      process.env["SUPABASE_AUTH_SMS_MESSAGEBIRD_ENABLED"] = "true";
+      const config = baseConfig();
+      const resolved = legacyResolveAuthSms(undefined, config.auth.sms, undefined);
+      expect(resolved.messagebird.enabled).toBe(false);
+      expect(() => legacyResolveLocalConfigValues(config, "127.0.0.1", WORKDIR)).not.toThrow();
+    });
+  });
+
+  describe("legacyResolveAuthSms (top-level scalars)", () => {
+    afterEach(() => {
+      delete process.env["SUPABASE_AUTH_SMS_ENABLE_SIGNUP"];
+      delete process.env["SUPABASE_AUTH_SMS_ENABLE_CONFIRMATIONS"];
+      delete process.env["SUPABASE_AUTH_SMS_MAX_FREQUENCY"];
+      delete process.env["SUPABASE_AUTH_SMS_TEMPLATE"];
+    });
+
+    it("overrides enable_signup/enable_confirmations/max_frequency/template with no presence gate", () => {
+      process.env["SUPABASE_AUTH_SMS_ENABLE_SIGNUP"] = "true";
+      process.env["SUPABASE_AUTH_SMS_ENABLE_CONFIRMATIONS"] = "true";
+      process.env["SUPABASE_AUTH_SMS_MAX_FREQUENCY"] = "10s";
+      process.env["SUPABASE_AUTH_SMS_TEMPLATE"] = "Your OTP is {{ .Code }}";
+      // A provider must be enabled, or `enable_signup` gets downgraded to `false` regardless of
+      // the override — see the "disables phone login" tests below for that behavior itself.
+      const configured = {
+        ...baseConfig().auth.sms,
+        twilio: { ...baseConfig().auth.sms.twilio, enabled: true },
+      };
+      const resolved = legacyResolveAuthSms(undefined, configured, undefined);
+      expect(resolved.enable_signup).toBe(true);
+      expect(resolved.enable_confirmations).toBe(true);
+      expect(resolved.max_frequency).toBe("10s");
+      expect(resolved.template).toBe("Your OTP is {{ .Code }}");
+    });
+
+    it("leaves the scalars at their configured values when nothing is overridden", () => {
+      const configured = {
+        ...baseConfig().auth.sms,
+        enable_signup: true,
+        max_frequency: "5s",
+        twilio: { ...baseConfig().auth.sms.twilio, enabled: true },
+      };
+      const resolved = legacyResolveAuthSms(undefined, configured, undefined);
+      expect(resolved.enable_signup).toBe(true);
+      expect(resolved.max_frequency).toBe("5s");
+    });
+  });
+
+  describe("legacyResolveAuthSms (disables phone login with no provider enabled)", () => {
+    afterEach(() => {
+      delete process.env["SUPABASE_AUTH_SMS_ENABLE_SIGNUP"];
+    });
+
+    it("downgrades enable_signup to false when configured true with no provider enabled", () => {
+      const configured = { ...baseConfig().auth.sms, enable_signup: true };
+      const resolved = legacyResolveAuthSms(undefined, configured, undefined);
+      expect(resolved.enable_signup).toBe(false);
+    });
+
+    it("downgrades an env-overridden enable_signup to false with no provider enabled", () => {
+      process.env["SUPABASE_AUTH_SMS_ENABLE_SIGNUP"] = "true";
+      const resolved = legacyResolveAuthSms(undefined, baseConfig().auth.sms, undefined);
+      expect(resolved.enable_signup).toBe(false);
+    });
+
+    it("leaves enable_signup alone when a provider is enabled", () => {
+      const configured = {
+        ...baseConfig().auth.sms,
+        enable_signup: true,
+        vonage: { ...baseConfig().auth.sms.vonage, enabled: true },
+      };
+      const resolved = legacyResolveAuthSms(undefined, configured, undefined);
+      expect(resolved.enable_signup).toBe(true);
+    });
+
+    it("leaves enable_signup at false when already false with no provider enabled", () => {
+      const resolved = legacyResolveAuthSms(undefined, baseConfig().auth.sms, undefined);
+      expect(resolved.enable_signup).toBe(false);
+    });
+  });
+
+  describe("api.tls (cert/key validation)", () => {
+    const tempRoot = useLegacyTempWorkdir("supabase-api-tls-test-");
+
+    function writeTlsFile(workdir: string, name: string, contents = "dummy") {
+      const supabaseDir = join(workdir, "supabase");
+      mkdirSync(supabaseDir, { recursive: true });
+      writeFileSync(join(supabaseDir, name), contents);
+    }
+
+    it("does not throw when tls.enabled with neither cert_path nor key_path set", () => {
+      // Go's Validate only rejects the "exactly one set" case (config.go:1010-1027);
+      // tls.enabled with nothing configured still loads.
+      const config = baseConfig({ api: { tls: { enabled: true } } });
+      expect(() =>
+        legacyResolveLocalConfigValues(config, "127.0.0.1", tempRoot.current),
+      ).not.toThrow();
+    });
+
+    // The "exactly one of cert/key set" presence-only assertions moved to
+    // `legacy-config-validate.unit.test.ts` (direct `legacyValidateResolvedConfig` calls) —
+    // the actual file reads below stay here, since I/O is per-caller.
+
+    it("throws a Go-worded error when the configured cert file does not exist", () => {
+      writeTlsFile(tempRoot.current, "key.pem");
+      const config = baseConfig({
+        api: { tls: { enabled: true, cert_path: "missing-cert.pem", key_path: "key.pem" } },
+      });
+      expect(() => legacyResolveLocalConfigValues(config, "127.0.0.1", tempRoot.current)).toThrow(
+        "failed to read TLS cert: ",
+      );
+    });
+
+    it("throws a Go-worded error when the configured key file does not exist", () => {
+      writeTlsFile(tempRoot.current, "cert.pem");
+      const config = baseConfig({
+        api: { tls: { enabled: true, cert_path: "cert.pem", key_path: "missing-key.pem" } },
+      });
+      expect(() => legacyResolveLocalConfigValues(config, "127.0.0.1", tempRoot.current)).toThrow(
+        "failed to read TLS key: ",
+      );
+    });
+
+    it("succeeds when both cert_path and key_path are readable", () => {
+      writeTlsFile(tempRoot.current, "cert.pem");
+      writeTlsFile(tempRoot.current, "key.pem");
+      const config = baseConfig({
+        api: { tls: { enabled: true, cert_path: "cert.pem", key_path: "key.pem" } },
+      });
+      expect(() =>
+        legacyResolveLocalConfigValues(config, "127.0.0.1", tempRoot.current),
+      ).not.toThrow();
+    });
+
+    it("resolves cert_path/key_path against <workdir>/supabase unconditionally, no isAbsolute guard", () => {
+      // Go's `path.Join` (config.go:961-965) absorbs a leading "/" — unlike
+      // signing_keys_path, which Go DOES guard with filepath.IsAbs.
+      writeTlsFile(tempRoot.current, "cert.pem");
+      writeTlsFile(tempRoot.current, "key.pem");
+      const config = baseConfig({
+        api: {
+          tls: {
+            enabled: true,
+            cert_path: "/cert.pem",
+            key_path: "/key.pem",
+          },
+        },
+      });
+      expect(() =>
+        legacyResolveLocalConfigValues(config, "127.0.0.1", tempRoot.current),
+      ).not.toThrow();
+    });
+
+    // Go's `Validate` nests the whole TLS branch inside `if c.Api.Enabled`
+    // (config.go:1006,1010) — a disabled api section never validates cert/key,
+    // however invalid the pairing.
+    it("skips TLS validation entirely when api is disabled", () => {
+      const config = baseConfig({
+        api: { enabled: false, tls: { enabled: true, cert_path: "missing-cert.pem" } },
+      });
+      expect(() =>
+        legacyResolveLocalConfigValues(config, "127.0.0.1", tempRoot.current),
+      ).not.toThrow();
+    });
+
+    describe("SUPABASE_API_ENABLED / SUPABASE_API_TLS_ENABLED env overrides", () => {
+      afterEach(() => {
+        delete process.env["SUPABASE_API_ENABLED"];
+        delete process.env["SUPABASE_API_TLS_ENABLED"];
+      });
+
+      it("skips TLS validation when api is disabled only via env", () => {
+        process.env["SUPABASE_API_ENABLED"] = "false";
+        const config = baseConfig({
+          api: { enabled: true, tls: { enabled: true, cert_path: "missing-cert.pem" } },
+        });
+        expect(() =>
+          legacyResolveLocalConfigValues(config, "127.0.0.1", tempRoot.current),
+        ).not.toThrow();
+      });
+
+      it("validates TLS when enabled only via env despite TOML saying tls.enabled = false", () => {
+        process.env["SUPABASE_API_TLS_ENABLED"] = "true";
+        const config = baseConfig({
+          api: { tls: { enabled: false, cert_path: "missing-cert.pem" } },
+        });
+        expect(() => legacyResolveLocalConfigValues(config, "127.0.0.1", tempRoot.current)).toThrow(
+          "Missing required field in config: api.tls.key_path",
+        );
+      });
+    });
+  });
+});
+
+describe("legacyResolveLocalJwks", () => {
+  const tempRoot = useLegacyTempWorkdir("supabase-local-jwks-test-");
+
+  it("includes the default ES256 signing key and the oct JWT-secret fallback when no signing_keys_path is configured", async () => {
+    // Go's `a.SigningKeys` defaults to this single ES256 key at `NewConfig()` time
+    // (`pkg/config/config.go:504-515`), unconditionally — `ResolveJWKS` always publishes it
+    // (in public form) unless a configured `signing_keys_path` file overrides it.
+    const config = baseConfig();
+    const jwks = await legacyResolveLocalJwks(config, tempRoot.current, "a".repeat(32));
+    expect(JSON.parse(jwks)).toEqual({
+      keys: [
+        {
+          kty: "EC",
+          kid: "b81269f1-21d8-4f2e-b719-c2240a840d90",
+          use: "sig",
+          key_ops: ["verify"],
+          alg: "ES256",
+          ext: true,
+          crv: "P-256",
+          x: "M5Sjqn5zwC9Kl1zVfUUGvv9boQjCGd45G8sdopBExB4",
+          y: "P6IXMvA2WYXSHSOMTBH2jsw_9rrzGy89FjPf6oOsIxQ",
+        },
+        { kty: "oct", k: Buffer.from("a".repeat(32)).toString("base64url") },
+      ],
+    });
+  });
+
+  it("publishes the public form of every signing key and omits the oct fallback", async () => {
+    const jwk = generateRsaJwk();
+    writeSigningKeys(tempRoot.current, [jwk]);
+    const config = baseConfig({ auth: { signing_keys_path: "signing_keys.json" } });
+    const jwks = await legacyResolveLocalJwks(config, tempRoot.current, "a".repeat(32));
+    const parsed = JSON.parse(jwks) as { keys: ReadonlyArray<Record<string, unknown>> };
+
+    expect(parsed.keys).toHaveLength(1);
+    expect(parsed.keys[0]).toMatchObject({
+      kty: "RSA",
+      kid: "test-rsa-kid",
+      n: jwk["n"],
+      e: jwk["e"],
+    });
+    expect(parsed.keys[0]).not.toHaveProperty("d");
+    expect(parsed.keys[0]).not.toHaveProperty("p");
+    expect(parsed.keys.some((key) => key["kty"] === "oct")).toBe(false);
+  });
+
+  // Go decodes `auth.signing_keys_path` directly into `[]JWK` (`pkg/config/config.go:1113`),
+  // so a configured key's `use`/`key_ops`/`ext` metadata must round-trip into the published JWKS
+  // via `ToPublicJWK` (`pkg/config/auth.go:111-145`), which keeps `use`/`ext` verbatim and
+  // filters `key_ops` down to `"verify"` entries only (never dropping the other two fields).
+  it("preserves a configured signing key's use/ext and filters key_ops to verify-only", async () => {
+    const jwk = { ...generateRsaJwk(), use: "sig", ext: true, key_ops: ["sign", "verify"] };
+    writeSigningKeys(tempRoot.current, [jwk]);
+    const config = baseConfig({ auth: { signing_keys_path: "signing_keys.json" } });
+    const jwks = await legacyResolveLocalJwks(config, tempRoot.current, "a".repeat(32));
+    const parsed = JSON.parse(jwks) as { keys: ReadonlyArray<Record<string, unknown>> };
+
+    expect(parsed.keys[0]).toMatchObject({ use: "sig", ext: true, key_ops: ["verify"] });
+  });
+
+  // Go quirk this reproduces: `a.SigningKeysPath` is resolved to an absolute path
+  // unconditionally (`pkg/config/config.go:928-929`), but the FILE is only read into
+  // `a.SigningKeys` when auth is enabled (`Config.Validate`'s file read is nested inside
+  // `if c.Auth.Enabled`, `config.go:1087,1110-1116`) — so a disabled-auth config with a
+  // configured `signing_keys_path` never reads the file, and `a.SigningKeys` stays at its
+  // unconditional `NewConfig()` default (the single ES256 key) rather than becoming empty.
+  // The oct fallback is still skipped (`len(a.SigningKeysPath) == 0` is false), so the
+  // default ES256 key is the ONLY entry — neither the file's keys nor the oct key appear.
+  it("falls back to the default ES256 signing key (not the configured file, not the oct fallback) when auth is disabled but signing_keys_path is set", async () => {
+    writeSigningKeys(tempRoot.current, [generateRsaJwk()]);
+    const config = baseConfig({
+      auth: { enabled: false, signing_keys_path: "signing_keys.json" },
+    });
+    const jwks = await legacyResolveLocalJwks(config, tempRoot.current, "a".repeat(32));
+    expect(JSON.parse(jwks)).toEqual({
+      keys: [
+        {
+          kty: "EC",
+          kid: "b81269f1-21d8-4f2e-b719-c2240a840d90",
+          use: "sig",
+          key_ops: ["verify"],
+          alg: "ES256",
+          ext: true,
+          crv: "P-256",
+          x: "M5Sjqn5zwC9Kl1zVfUUGvv9boQjCGd45G8sdopBExB4",
+          y: "P6IXMvA2WYXSHSOMTBH2jsw_9rrzGy89FjPf6oOsIxQ",
+        },
+      ],
+    });
+  });
+
+  it("throws a Go-worded error when the signing keys file does not exist", async () => {
+    const config = baseConfig({ auth: { signing_keys_path: "missing.json" } });
+    await expect(legacyResolveLocalJwks(config, tempRoot.current, "a".repeat(32))).rejects.toThrow(
+      "failed to read signing keys: ",
+    );
+  });
+
+  it("throws a Go-worded error when the signing keys file is malformed JSON", async () => {
+    const supabaseDir = join(tempRoot.current, "supabase");
+    mkdirSync(supabaseDir, { recursive: true });
+    writeFileSync(join(supabaseDir, "signing_keys.json"), "not valid json");
+    const config = baseConfig({ auth: { signing_keys_path: "signing_keys.json" } });
+    await expect(legacyResolveLocalJwks(config, tempRoot.current, "a".repeat(32))).rejects.toThrow(
+      "failed to decode signing keys: ",
+    );
+  });
+
+  describe("auth.third_party", () => {
+    afterEach(() => {
+      vi.restoreAllMocks();
+    });
+
+    it("rejects an enabled third-party provider missing its required field", async () => {
+      const config = baseConfig({ auth: { third_party: { firebase: { enabled: true } } } });
+      await expect(legacyResolveLocalJwks(config, WORKDIR, "a".repeat(32))).rejects.toThrow(
+        "Invalid config: auth.third_party.firebase is enabled but without a project_id.",
+      );
+    });
+
+    it("rejects more than one enabled third-party provider", async () => {
+      const config = baseConfig({
+        auth: {
+          third_party: {
+            firebase: { enabled: true, project_id: "my-project" },
+            workos: { enabled: true, issuer_url: "https://issuer.example" },
+          },
+        },
+      });
+      await expect(legacyResolveLocalJwks(config, WORKDIR, "a".repeat(32))).rejects.toThrow(
+        "Invalid config: Only one third_party provider allowed to be enabled at a time.",
+      );
+    });
+
+    it("does not validate third-party providers when auth is disabled, matching Go's ResolveJWKS/IssuerURL", async () => {
+      // Go's `Auth.ThirdParty.validate()` (the "at most one enabled" check above) only runs
+      // inside `Config.Validate`'s `if Auth.Enabled` block — `ResolveJWKS`/`IssuerURL()` is called
+      // unconditionally and never validates, it just picks the first enabled provider by fixed
+      // priority (firebase, auth0, aws_cognito, clerk, workos) and resolves its remote JWKS.
+      const remoteKeys = [{ kty: "RSA", kid: "firebase-key", n: "abc", e: "AQAB" }];
+      const issuerUrl = "https://securetoken.google.com/my-project";
+      const fetchMock = vi.spyOn(globalThis, "fetch").mockImplementation(async (input) => {
+        const url =
+          typeof input === "string" ? input : input instanceof URL ? input.toString() : input.url;
+        if (url === `${issuerUrl}/.well-known/openid-configuration`) {
+          return new Response(JSON.stringify({ jwks_uri: `${issuerUrl}/jwks.json` }), {
+            status: 200,
+            headers: { "content-type": "application/json" },
+          });
+        }
+        if (url === `${issuerUrl}/jwks.json`) {
+          return new Response(JSON.stringify({ keys: remoteKeys }), {
+            status: 200,
+            headers: { "content-type": "application/json" },
+          });
+        }
+        throw new Error(`unexpected fetch: ${url}`);
+      });
+      const config = baseConfig({
+        auth: {
+          enabled: false,
+          third_party: {
+            firebase: { enabled: true, project_id: "my-project" },
+            workos: { enabled: true, issuer_url: "https://issuer.example" },
+          },
+        },
+      });
+      const jwksJson = await legacyResolveLocalJwks(config, WORKDIR, "a".repeat(32));
+      const jwks = JSON.parse(jwksJson) as { keys: ReadonlyArray<{ kid?: string }> };
+      expect(jwks.keys.some((key) => key.kid === "firebase-key")).toBe(true);
+      fetchMock.mockRestore();
+    });
+
+    // Go's `ResolveJWKS` only attempts the remote fetch when `issuerURL != ""`
+    // (`apps/cli-go/pkg/config/config.go:1732`); workos's own `issuerURL()` is a raw field read
+    // with no validation (`config.go:1631-1632`), so an enabled-but-unconfigured workos provider
+    // with `auth.enabled = false` resolves an empty issuer URL that Go tolerates by skipping the
+    // fetch entirely, rather than attempting (and failing) a fetch against an empty URL.
+    it('does not attempt a remote JWKS fetch for an enabled third-party provider with an empty issuer_url, matching Go\'s issuerURL != "" check', async () => {
+      const fetchMock = vi.spyOn(globalThis, "fetch");
+      const config = baseConfig({
+        auth: {
+          enabled: false,
+          third_party: { workos: { enabled: true, issuer_url: "" } },
+        },
+      });
+
+      const jwksJson = await legacyResolveLocalJwks(config, WORKDIR, "a".repeat(32));
+      const jwks = JSON.parse(jwksJson) as { keys: ReadonlyArray<unknown> };
+
+      expect(fetchMock).not.toHaveBeenCalled();
+      expect(jwks.keys.length).toBeGreaterThan(0);
+      fetchMock.mockRestore();
+    });
+
+    it("fetches and includes the remote JWKS for an enabled third-party provider", async () => {
+      const remoteKeys = [{ kty: "RSA", kid: "remote-key", n: "abc", e: "AQAB" }];
+      const fetchMock = vi.spyOn(globalThis, "fetch").mockImplementation(async (input) => {
+        const url =
+          typeof input === "string" ? input : input instanceof URL ? input.toString() : input.url;
+        if (url === "https://issuer.example/.well-known/openid-configuration") {
+          return new Response(JSON.stringify({ jwks_uri: "https://issuer.example/jwks.json" }), {
+            status: 200,
+            headers: { "content-type": "application/json" },
+          });
+        }
+        if (url === "https://issuer.example/jwks.json") {
+          return new Response(JSON.stringify({ keys: remoteKeys }), {
+            status: 200,
+            headers: { "content-type": "application/json" },
+          });
+        }
+        throw new Error(`unexpected fetch url: ${url}`);
+      });
+
+      const config = baseConfig({
+        auth: { third_party: { workos: { enabled: true, issuer_url: "https://issuer.example" } } },
+      });
+      const jwks = await legacyResolveLocalJwks(config, WORKDIR, "a".repeat(32));
+      const parsed = JSON.parse(jwks) as { keys: ReadonlyArray<Record<string, unknown>> };
+
+      expect(parsed.keys).toEqual(
+        expect.arrayContaining([expect.objectContaining({ kid: "remote-key" })]),
+      );
+      expect(fetchMock).toHaveBeenCalledTimes(2);
+    });
+
+    // The key divergence from `shared/functions/serve.ts`'s own (unrelated)
+    // `resolveAuthArtifacts`: Go's `start` treats a remote-JWKS fetch failure as a hard,
+    // command-failing error (`internal/start/start.go:274-277`) — `legacyResolveLocalJwks`
+    // must propagate it too, not swallow it and continue with zero remote keys.
+    it("fails the whole resolution when the remote JWKS fetch fails, unlike functions serve's leniency", async () => {
+      vi.spyOn(globalThis, "fetch").mockImplementation(async () => {
+        throw new Error("oidc discovery failed");
+      });
+
+      const config = baseConfig({
+        auth: { third_party: { workos: { enabled: true, issuer_url: "https://issuer.example" } } },
+      });
+      await expect(legacyResolveLocalJwks(config, WORKDIR, "a".repeat(32))).rejects.toThrow(
+        "oidc discovery failed",
+      );
+    });
+  });
+});
diff --git a/apps/cli/src/legacy/shared/legacy-local-project-context.ts b/apps/cli/src/legacy/shared/legacy-local-project-context.ts
new file mode 100644
index 0000000000..62341fc56a
--- /dev/null
+++ b/apps/cli/src/legacy/shared/legacy-local-project-context.ts
@@ -0,0 +1,121 @@
+import {
+  loadProjectConfig,
+  loadProjectEnvironment,
+  ProjectConfigSchema,
+  type LoadedProjectConfig,
+  type ProjectConfig,
+} from "@supabase/config";
+import { Effect, FileSystem, Path, Schema } from "effect";
+
+import { legacyResolveLocalProjectId, legacySanitizeProjectId } from "./legacy-docker-ids.ts";
+import { legacyGetHostname } from "./legacy-hostname.ts";
+import { legacyResolveProjectEnvironmentValues } from "./legacy-project-environment.ts";
+
+/**
+ * The config-load/env/project-id resolution `stop` (its non-`--all`/non-`--project-id` branch)
+ * and `status` (unconditionally) both duplicated verbatim before this hoist. Ported from Go's
+ * `flags.LoadConfig` (config load, `internal/utils/flags/config_path.go:10-14` ->
+ * `pkg/config/config.go:882`) plus `utils.GetHostname`/`GetId`'s project-id resolution
+ * (`internal/utils/misc.go:231-311`, `internal/utils/config.go`).
+ *
+ * Deliberately excludes workdir validation (`legacyValidateWorkdirIsDirectory`,
+ * `legacy-workdir-validation.ts`): both callers already invoke that themselves, at a point in
+ * their own control flow that differs (`stop` validates unconditionally before its `--all`/
+ * `--project-id` mutual-exclusivity check and bypass branching; `status` validates before its own
+ * `--override-name` parsing, which itself must win over a config-load error). Folding workdir
+ * validation into this function would force one of those two orderings to move, which would
+ * silently change which error wins when multiple things are wrong at once — see `status.handler.ts`'s
+ * own numbered comments for exactly why that ordering is load-bearing. Callers keep calling
+ * {@link legacyValidateWorkdirIsDirectory} themselves, unchanged, before this.
+ *
+ * The sanitized project id (Go's `Config.ProjectId` singleton, rewritten once by `Config.Validate`
+ * at config-load time, `pkg/config/config.go:938-944`) IS included here, even though `status`
+ * previously computed it AFTER its own `legacyResolveStatusLocalState` call, and `stop` computed it
+ * after its own `legacyResolveLocalConfigValues` call — both of those are pure, non-throwing string
+ * derivations (`legacyResolveLocalProjectId`/`legacySanitizeProjectId`, see their own doc comments)
+ * with no observable failure mode, so resolving it earlier here, ahead of each caller's own
+ * subsequent (throwing) config-value resolution, cannot change which error a caller surfaces first.
+ *
+ * `mapConfigLoadError` lets each caller tag a config-load failure with its own command-specific
+ * error type (`LegacyStopConfigLoadError`/`LegacyStatusConfigLoadError` today), matching the
+ * `mapError: (message: string) => E` idiom already used by `legacy-migration-apply.ts`'s exports.
+ */
+export interface LegacyLocalProjectContext {
+  readonly config: ProjectConfig;
+  readonly projectEnvValues: Record<string, string>;
+  /** `null` when no `supabase/config.toml` was found — see `loadProjectConfig`'s own contract. */
+  readonly loaded: LoadedProjectConfig | null;
+  readonly hostname: string;
+  /** Config/env-derived, sanitized project id — see {@link legacySanitizeProjectId}'s doc comment. */
+  readonly projectId: string;
+}
+
+export const legacyLoadLocalProjectContext = <E>(
+  workdir: string,
+  mapConfigLoadError: (message: string) => E,
+): Effect.Effect<LegacyLocalProjectContext, E, FileSystem.FileSystem | Path.Path> =>
+  Effect.gen(function* () {
+    // `search: false`: `workdir` already IS Go's fully-resolved chdir target (`legacy-cli-config.
+    // layer.ts`'s `resolveWorkdir` mirrors `ChangeWorkDir`'s explicit-exact-vs-default-searched
+    // resolution, `apps/cli-go/internal/utils/misc.go:231-247`), so letting `@supabase/config`'s
+    // `findProjectPaths` climb ancestors again on top of that would let an unrelated ancestor
+    // project's config.toml win when `--workdir`/`SUPABASE_WORKDIR` points at a subdirectory with
+    // no `supabase/config.toml` of its own — Go never searches past the exact (explicit or
+    // defaulted) workdir (`NewPathBuilder`, `pkg/config/utils.go:43-48`).
+    const projectEnv = yield* loadProjectEnvironment({
+      cwd: workdir,
+      baseEnv: process.env,
+      search: false,
+      // Go's `loadDefaultEnv` (`apps/cli-go/pkg/config/config.go:1243-1250`) omits `.env.local`
+      // from its candidate list whenever `SUPABASE_ENV=test` — a malformed or intentionally
+      // non-test `supabase/.env.local` is then invisible to Go and must not fail config loading
+      // here either. `legacyResolveProjectEnvironmentValues` below already applies this same gate
+      // for the project-root pass; this mirrors it for the `supabase/`-dir pass
+      // `loadProjectEnvironment` itself performs.
+      skipEnvLocal: (process.env["SUPABASE_ENV"] || "development") === "test",
+    }).pipe(
+      Effect.mapError((cause) => mapConfigLoadError(`failed to read config: ${String(cause)}`)),
+    );
+
+    // Resolved BEFORE `loadProjectConfig` decodes config.toml (not after): Go's `Config.Load` runs
+    // `loadNestedEnv` before `LoadEnvHook` decodes `env(...)` references (`config.go:735-738`), so
+    // an `env(...)`-valued `project_id` sourced only from a project-root/`SUPABASE_ENV`-selected
+    // file must already be visible to the decoder, not just to the `SUPABASE_PROJECT_ID` override
+    // read below. A malformed extra dotenv file throws here (see `readDotEnvFile`), matching Go's
+    // `loadNestedEnv` propagating `godotenv`'s parse error instead of silently skipping the bad
+    // line. `workdir` is passed through so dotenv files under `<workdir>/supabase`/`workdir` are
+    // still discovered even when `projectEnv` is `null` (no config.toml there) — Go's own
+    // `loadNestedEnv` runs unconditionally, before `config.toml` is ever opened
+    // (`pkg/config/config.go:786-793`).
+    const projectEnvValues = yield* Effect.try({
+      try: () => legacyResolveProjectEnvironmentValues(projectEnv, workdir),
+      catch: (cause) => mapConfigLoadError(`failed to read config: ${String(cause)}`),
+    });
+
+    // An absent config.toml is not a failure — Go's `flags.LoadConfig` still resolves a project id
+    // via the workdir basename default. Only a malformed file (`loadProjectConfig` failing rather
+    // than returning `null`) is a hard error.
+    const loaded = yield* loadProjectConfig(workdir, {
+      projectEnv: projectEnv !== null ? { ...projectEnv, values: projectEnvValues } : undefined,
+      search: false,
+      // Go's `NewPathBuilder`/`Config.Load` (`pkg/config/utils.go:43-48`) only ever resolves
+      // `supabase/config.toml` — it has no concept of a JSON project config file. Without this, a
+      // workdir with a stray `config.json` would make `loadProjectConfig` prefer it over
+      // `config.toml`.
+      tomlOnly: true,
+      goViperCompat: true,
+    }).pipe(
+      Effect.mapError((cause) => mapConfigLoadError(`failed to read config: ${String(cause)}`)),
+    );
+    const config = loaded?.config ?? Schema.decodeUnknownSync(ProjectConfigSchema)({});
+    const hostname = legacyGetHostname();
+    const projectId = legacySanitizeProjectId(
+      legacyResolveLocalProjectId(
+        projectEnvValues["SUPABASE_PROJECT_ID"] ?? process.env["SUPABASE_PROJECT_ID"],
+        config.project_id,
+        workdir,
+      ),
+    );
+
+    return { config, projectEnvValues, loaded, hostname, projectId };
+  });
diff --git a/apps/cli/src/legacy/shared/legacy-management-api-runtime.layer.ts b/apps/cli/src/legacy/shared/legacy-management-api-runtime.layer.ts
index 9b0ab6b18d..2b75bcd08a 100644
--- a/apps/cli/src/legacy/shared/legacy-management-api-runtime.layer.ts
+++ b/apps/cli/src/legacy/shared/legacy-management-api-runtime.layer.ts
@@ -15,6 +15,7 @@ import { LegacyCliConfig } from "../config/legacy-cli-config.service.ts";
 import { legacyCliConfigLayer } from "../config/legacy-cli-config.layer.ts";
 import { LegacyProjectRefResolver } from "../config/legacy-project-ref.service.ts";
 import { legacyProjectRefLayer } from "../config/legacy-project-ref.layer.ts";
+import { LegacyDebugLogger } from "./legacy-debug-logger.service.ts";
 import { legacyDebugLoggerLayer } from "./legacy-debug-logger.layer.ts";
 import { legacyDohFetchLayer } from "./legacy-http-dns.ts";
 import { LegacyIdentityStitch, legacyIdentityStitchLayer } from "./legacy-identity-stitch.ts";
@@ -104,6 +105,10 @@ export function legacyManagementApiRuntimeLayer(subcommand: ReadonlyArray<string
     // layer memoisation all three share one stitchAttempted guard — Go's one
     // root-context sync.Once.
     legacyIdentityStitchLayer,
+    // Expose the same memoised instance already provided into cliConfig/httpClient/etc.
+    // at the top level so handlers can log a swallowed, non-fatal error directly
+    // (Go's `fmt.Fprintln(utils.GetDebugLogger(), err)` pattern, e.g. `secrets set`).
+    legacyDebugLoggerLayer,
   );
 
   // Compile-time guarantee that the merged layer exposes every service a
@@ -148,7 +153,8 @@ type LegacyManagementApiServices =
   | LegacyLinkedProjectCache
   | LegacyTelemetryState
   | CommandRuntime
-  | LegacyIdentityStitch;
+  | LegacyIdentityStitch
+  | LegacyDebugLogger;
 
 /**
  * Runtime layer for the `--linked` db-config resolver path (`db dump`, `db query`,
diff --git a/apps/cli/src/legacy/shared/legacy-migration-apply.ts b/apps/cli/src/legacy/shared/legacy-migration-apply.ts
index b9b376bea5..9f98eb8788 100644
--- a/apps/cli/src/legacy/shared/legacy-migration-apply.ts
+++ b/apps/cli/src/legacy/shared/legacy-migration-apply.ts
@@ -1,5 +1,6 @@
 import { Data, Effect, type FileSystem, type Path } from "effect";
 
+import { Output } from "../../shared/output/output.service.ts";
 import type { LegacyDbSession } from "./legacy-db-connection.service.ts";
 import {
   INSERT_MIGRATION_VERSION,
@@ -60,7 +61,7 @@ const legacyTrimLeadingSqlComments = (sql: string): string => {
  * Whether a migration statement cannot run inside a transaction block — `CREATE
  * [UNIQUE] INDEX CONCURRENTLY`, `REINDEX … CONCURRENTLY`, `VACUUM`, `ALTER SYSTEM`,
  * `CLUSTER`. Such statements fail with SQLSTATE 25001 inside the `BEGIN`/`COMMIT`
- * that wraps a migration, so `legacyApplyMigrationFile` runs them standalone.
+ * that wraps a migration, so `execMigrationBatch` runs them standalone.
  * Port of Go's `isPipelineIncompatible` (`pkg/migration/file.go`, supabase/cli#5156).
  */
 export const legacyIsPipelineIncompatible = (sql: string): boolean => {
@@ -79,55 +80,45 @@ type LegacyBatchItem =
   | { readonly kind: "exec"; readonly sql: string }
   | { readonly kind: "version" };
 
+const errMessage = (e: unknown): string =>
+  typeof e === "object" && e !== null && "message" in e && typeof e.message === "string"
+    ? e.message
+    : String(e);
+
 /**
- * Applies a single migration file to the connected database and records it in
- * `supabase_migrations.schema_migrations`. Mirrors Go's `migration.ApplyMigrations`
- * for one file (`pkg/migration/apply.go` + `(*MigrationFile).ExecBatch`): `RESET ALL`
- * first to clear any session state leaked by a prior file, then create the history
- * table, then run the file's statements + the history insert.
- *
- * Statements run inside a `BEGIN`/`COMMIT` batch, except pipeline-incompatible ones
+ * Runs a single migration/seed file's statements (plus the optional history insert).
+ * Mirrors Go's `(*MigrationFile).ExecBatch` (`pkg/migration/file.go`): statements run
+ * inside a `BEGIN`/`COMMIT` batch, except pipeline-incompatible ones
  * (`legacyIsPipelineIncompatible` — `CREATE INDEX CONCURRENTLY`, `VACUUM`, …) which
- * cannot run in a transaction block: the batch is flushed (committed), the statement
- * runs standalone, then batching resumes — mirroring Go's `ExecBatch` flush logic
- * (supabase/cli#5156). The history insert goes in the final batch, so the migration
- * is recorded only after every statement succeeds. A file with no such statements is
- * a single `BEGIN`/`COMMIT` around everything, identical to the pre-fix behaviour.
+ * cannot run in a transaction block: the open batch is flushed (committed), the
+ * statement runs standalone, then batching resumes (supabase/cli#5156). The history
+ * insert goes in the final batch, so the migration is recorded only after every
+ * statement succeeds. A file with no such statements is a single `BEGIN`/`COMMIT`.
  *
- * `mapError` lets the caller tag the failure (e.g. `LegacyDeclarativeApplyError`).
+ * Does NOT create the history table and does NOT `RESET ALL` — Go's `ExecBatch` does
+ * neither; those are the migration-apply path's responsibility (`ApplyMigrations`,
+ * apply.go:65-69), so role/globals files (`legacySeedGlobals`) stay reset-free like Go.
+ * When `forceNoVersion` is set the history insert is skipped regardless of filename
+ * (Go's `SeedGlobals` clears `Version`).
  */
-export const legacyApplyMigrationFile = <E>(
+const execMigrationBatch = <E>(
   session: LegacyDbSession,
   fs: FileSystem.FileSystem,
   path: Path.Path,
   migrationPath: string,
   mapError: (message: string) => E,
+  forceNoVersion: boolean,
 ): Effect.Effect<void, E> =>
   Effect.gen(function* () {
     const content = yield* fs.readFileString(migrationPath);
     const statements = legacySplitAndTrim(content);
     const filename = path.basename(migrationPath);
     const matches = MIGRATE_FILE_PATTERN.exec(filename);
-    const version = matches?.[1] ?? "";
+    const version = forceNoVersion ? "" : (matches?.[1] ?? "");
     const name = matches?.[2] ?? "";
 
-    // `RESET ALL` runs FIRST, before the history-table DDL: an earlier migration applied
-    // on this same connection may have left a session default (e.g.
-    // `SET default_transaction_read_only = on`) that would otherwise make this DDL fail
-    // before it is cleared. Go resets connection state at the top of each file's apply,
-    // ahead of any work (`apps/cli-go/pkg/migration/apply.go:65-69`).
-    yield* session.exec("RESET ALL");
-    yield* legacyCreateMigrationTable(session);
-
     // Mirror Go's `MigrationFile.ExecBatch` error context (`pkg/migration/file.go`):
-    // on a failed statement, append `At statement: <index>` and the statement text so the
-    // error (and the debug bundle) point at the exact failing SQL. (Go also adds a caret /
-    // pgErr.Detail / extension-type hint, which need the driver SQLSTATE the session does
-    // not currently surface — the statement number + text is the always-present context.)
-    const errMessage = (e: unknown): string =>
-      typeof e === "object" && e !== null && "message" in e && typeof e.message === "string"
-        ? e.message
-        : String(e);
+    // on a failed statement, append `At statement: <index>` and the statement text.
     const atStatement = (e: unknown, index: number, stat: string) =>
       new Error(`${errMessage(e)}\nAt statement: ${index}\n${stat}`);
 
@@ -183,10 +174,112 @@ export const legacyApplyMigrationFile = <E>(
       pending = [...pending, { kind: "version" }];
     }
     yield* flushBatch;
-  }).pipe(
-    Effect.mapError((error) =>
-      mapError(
-        "message" in error && typeof error.message === "string" ? error.message : String(error),
-      ),
-    ),
-  );
+  }).pipe(Effect.mapError((error) => mapError(errMessage(error))));
+
+/**
+ * Go's per-migration connection reset (`apply.go:65-69`): `RESET ALL` clears any
+ * connection settings a prior statement on the same session may have changed
+ * (e.g. `set_config('search_path', …)`), run before each migration's `ExecBatch`.
+ * Only the migration-apply path does this — `SeedGlobals` (role/globals files)
+ * must NOT, so this is a caller responsibility, never inside `execMigrationBatch`.
+ */
+const resetConnectionState = <E>(
+  session: LegacyDbSession,
+  mapError: (message: string) => E,
+): Effect.Effect<void, E> =>
+  session.exec("RESET ALL").pipe(Effect.mapError((e) => mapError(errMessage(e))));
+
+/**
+ * Applies a single migration file to the connected database and records it in
+ * `supabase_migrations.schema_migrations`. Mirrors Go's `migration.ApplyMigrations`
+ * for one file (`pkg/migration/apply.go` + `(*MigrationFile).ExecBatch`): `RESET ALL`
+ * first to clear any session state leaked by a prior file (e.g.
+ * `SET default_transaction_read_only = on`) before the history-table DDL, then create
+ * the history table, then run the file's statements + the history insert.
+ *
+ * `mapError` lets the caller tag the failure (e.g. `LegacyDeclarativeApplyError`).
+ */
+export const legacyApplyMigrationFile = <E>(
+  session: LegacyDbSession,
+  fs: FileSystem.FileSystem,
+  path: Path.Path,
+  migrationPath: string,
+  mapError: (message: string) => E,
+): Effect.Effect<void, E> =>
+  Effect.gen(function* () {
+    yield* resetConnectionState(session, mapError);
+    yield* legacyCreateMigrationTable(session).pipe(
+      Effect.mapError((e) => mapError(errMessage(e))),
+    );
+    yield* execMigrationBatch(session, fs, path, migrationPath, mapError, false);
+  });
+
+/**
+ * Applies a list of pending migration files, mirroring Go's
+ * `migration.ApplyMigrations` (`pkg/migration/apply.go:56-77`): create the
+ * history table once when there is anything to apply, then for each file emit
+ * `Applying migration <name>...` to stderr, `RESET ALL`, and run it transactionally.
+ */
+export const legacyApplyMigrations = <E>(
+  session: LegacyDbSession,
+  fs: FileSystem.FileSystem,
+  path: Path.Path,
+  pending: ReadonlyArray<string>,
+  mapError: (message: string) => E,
+): Effect.Effect<void, E, Output> =>
+  Effect.gen(function* () {
+    const output = yield* Output;
+    if (pending.length === 0) return;
+    yield* legacyCreateMigrationTable(session).pipe(
+      Effect.mapError((e) => mapError(errMessage(e))),
+    );
+    for (const migrationPath of pending) {
+      yield* output.raw(`Applying migration ${path.basename(migrationPath)}...\n`, "stderr");
+      // Go resets connection state per migration (apply.go:65-69) before ExecBatch.
+      yield* resetConnectionState(session, mapError);
+      yield* execMigrationBatch(session, fs, path, migrationPath, mapError, false);
+    }
+  });
+
+/**
+ * Applies custom-role / globals files, mirroring Go's `migration.SeedGlobals`
+ * (`pkg/migration/seed.go:85-100`): for each file emit `Seeding globals from
+ * <name>...` to stderr and run it transactionally WITHOUT inserting a migration
+ * history row (Go clears `Version`), WITHOUT creating the history table, and WITHOUT
+ * `RESET ALL` (Go's `SeedGlobals` → `ExecBatch` never resets).
+ */
+export const legacySeedGlobals = <E>(
+  session: LegacyDbSession,
+  fs: FileSystem.FileSystem,
+  path: Path.Path,
+  globals: ReadonlyArray<string>,
+  mapError: (message: string) => E,
+): Effect.Effect<void, E, Output> =>
+  Effect.gen(function* () {
+    const output = yield* Output;
+    for (const globalPath of globals) {
+      yield* output.raw(`Seeding globals from ${path.basename(globalPath)}...\n`, "stderr");
+      yield* execMigrationBatch(session, fs, path, globalPath, mapError, true);
+    }
+  });
+
+/**
+ * Runs one SQL file's statements transactionally, WITHOUT `legacySeedGlobals`'s
+ * per-file `Seeding globals from <name>...` stderr message, WITHOUT inserting a
+ * migration history row, WITHOUT creating the history table, and WITHOUT `RESET
+ * ALL` (same batching semantics as `legacySeedGlobals`, `forceNoVersion: true`,
+ * just silent). Go's `initSchema`/`InitSchema14`/`ApplyApiPrivileges`
+ * (`apps/cli-go/internal/db/start/start.go`) each call
+ * `(*MigrationFile).ExecBatch` DIRECTLY on an in-memory SQL constant — bypassing
+ * `migration.SeedGlobals`'s message — so reusing `legacySeedGlobals` for those
+ * would print an extra line Go never prints. Callers write the in-memory SQL
+ * constant to a temp file first (this module only reads files, like
+ * `execMigrationBatch`'s other callers).
+ */
+export const legacyExecSqlFile = <E>(
+  session: LegacyDbSession,
+  fs: FileSystem.FileSystem,
+  path: Path.Path,
+  filePath: string,
+  mapError: (message: string) => E,
+): Effect.Effect<void, E> => execMigrationBatch(session, fs, path, filePath, mapError, true);
diff --git a/apps/cli/src/legacy/shared/legacy-migration-apply.unit.test.ts b/apps/cli/src/legacy/shared/legacy-migration-apply.unit.test.ts
index 567be21e75..a5039843de 100644
--- a/apps/cli/src/legacy/shared/legacy-migration-apply.unit.test.ts
+++ b/apps/cli/src/legacy/shared/legacy-migration-apply.unit.test.ts
@@ -5,10 +5,12 @@ import { BunServices } from "@effect/platform-bun";
 import { describe, expect, it } from "@effect/vitest";
 import { Data, Effect, Exit, FileSystem, Path } from "effect";
 
+import { mockOutput } from "../../../tests/helpers/mocks.ts";
 import type { LegacyDbSession } from "./legacy-db-connection.service.ts";
 import {
   legacyApplyMigrationFile,
   legacyIsPipelineIncompatible,
+  legacySeedGlobals,
 } from "./legacy-migration-apply.ts";
 
 class TestError extends Data.TaggedError("TestError")<{ readonly message: string }> {}
@@ -230,3 +232,27 @@ describe("legacyIsPipelineIncompatible", () => {
     expect(legacyIsPipelineIncompatible(sql)).toBe(want);
   });
 });
+
+describe("legacySeedGlobals", () => {
+  it.effect("runs the globals file WITHOUT RESET ALL and without a history insert", () => {
+    const dir = mkdtempSync(join(tmpdir(), "legacy-globals-"));
+    const file = join(dir, "roles.sql");
+    writeFileSync(file, "CREATE ROLE my_role;");
+    const { session, calls } = fakeSession();
+    return Effect.gen(function* () {
+      const fs = yield* FileSystem.FileSystem;
+      const path = yield* Path.Path;
+      yield* legacySeedGlobals(session, fs, path, [file], (message) => new TestError({ message }));
+      const execs = calls.filter((c) => c.kind === "exec").map((c) => c.sql);
+      // Go's SeedGlobals calls ExecBatch directly — no RESET ALL (that's only the
+      // migration-apply path) and no schema-migrations history insert.
+      expect(execs).not.toContain("RESET ALL");
+      expect(execs).toContain("CREATE ROLE my_role");
+      expect(calls.some((c) => c.kind === "query")).toBe(false);
+      rmSync(dir, { recursive: true, force: true });
+    }).pipe(
+      Effect.provide(mockOutput({ format: "text" }).layer),
+      Effect.provide(BunServices.layer),
+    );
+  });
+});
diff --git a/apps/cli/src/legacy/shared/legacy-project-environment.ts b/apps/cli/src/legacy/shared/legacy-project-environment.ts
new file mode 100644
index 0000000000..fe1ad08291
--- /dev/null
+++ b/apps/cli/src/legacy/shared/legacy-project-environment.ts
@@ -0,0 +1,141 @@
+import { existsSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+
+import type { ProjectEnvironment } from "@supabase/config";
+
+import { parseDotEnv } from "./legacy-dotenv.ts";
+
+/**
+ * Fills the gap between `@supabase/config`'s `loadProjectEnvironment` and Go's
+ * `loadNestedEnv` (`apps/cli-go/pkg/config/config.go:1169-1190`). Go's version
+ * walks not just `supabase/` but one directory further, up to the project
+ * root/workdir (the loop stops once `cwd == filepath.Dir(repoDir)`, i.e. after
+ * exactly two directories: `supabase/`, then its parent), and at each
+ * directory calls `loadDefaultEnv` (`config.go:1192-1207`), which loads dotenv
+ * files chosen by `SUPABASE_ENV` (empty/unset defaults to `"development"`,
+ * `config.go:1193-1195`): `.env.<env>.local`, `.env.local` (skipped when
+ * `env === "test"`), `.env.<env>`, `.env` — via `godotenv.Load`, which only
+ * sets a key if it isn't already present in the process environment
+ * (`godotenv@v1.5.1/godotenv.go:184-204`, `overload: false`). Because
+ * `godotenv.Load` writes straight into the process env as it goes, the net
+ * precedence (highest first) is: ambient shell env > `supabase/`-dir dotenv
+ * files (`.local` variant before non-local, env-specific before bare `.env`)
+ * > project-root dotenv files (same internal order).
+ *
+ * `loadProjectEnvironment` only implements the `supabase/`-dir, plain
+ * `.env`/`.env.local` half of this (no project-root pass, no `SUPABASE_ENV`
+ * filename selection) — and it's shared infrastructure used well beyond
+ * `legacy/` (the `next/` command tree, `secrets set`), so extending its
+ * file-resolution semantics is out of scope for a `stop`/`status` port.
+ * Instead, this fills in the missing project-root + `SUPABASE_ENV`-selected
+ * files locally: `loadProjectEnvironment`'s already-resolved `values` (its
+ * ambient-wins-over-`supabase/.env`(.local) result) always takes precedence
+ * over anything discovered here, since it's already correct for the keys it
+ * knows about.
+ */
+function candidateDotenvFilenames(env: string): ReadonlyArray<string> {
+  return [`.env.${env}.local`, ...(env === "test" ? [] : [".env.local"]), `.env.${env}`, ".env"];
+}
+
+/**
+ * Minimal dotenv reader for the project-root and `SUPABASE_ENV`-selected extra
+ * files this module resolves, intentionally not reusing `@supabase/config`'s
+ * Effect-based `FileSystem` parser: this module stays a plain synchronous
+ * helper (like `legacy-local-config-values.ts`'s `loadFirstSigningKey`) since
+ * it only needs a handful of extra files read once per `stop`/`status`
+ * invocation. Delegates to {@link parseDotEnv} — the same `godotenv`-faithful,
+ * cursor-based parser `bootstrap`/`legacyReadDbToml` already use — rather than
+ * a hand-rolled line-by-line scan, so a quoted value spanning physical lines
+ * (a PEM/private key) parses correctly instead of aborting on what looks like
+ * a malformed continuation line.
+ *
+ * @throws on a line that isn't blank, a comment, or a `KEY=VALUE`/`KEY: VALUE`
+ * assignment — matching Go's `loadEnvIfExists` (`pkg/config/config.go:1209-1234`),
+ * which propagates `godotenv.Load`'s parse error up through `loadNestedEnv` and
+ * fails `Config.Load` before `stop`/`status` touch Docker, rather than silently
+ * skipping the bad line.
+ */
+function readDotEnvFile(path: string): Record<string, string> | undefined {
+  if (!existsSync(path)) return undefined;
+
+  const contents = readFileSync(path, "utf8");
+  try {
+    return parseDotEnv(contents);
+  } catch (cause) {
+    throw new Error(
+      `failed to parse environment file: ${path} (${cause instanceof Error ? cause.message : String(cause)})`,
+    );
+  }
+}
+
+/**
+ * Returns the merged env-var map `stop`/`status` should read `SUPABASE_*`
+ * overrides (project id, auth fields) from — the project-root and
+ * `SUPABASE_ENV`-selected files `loadProjectEnvironment` doesn't cover, layered
+ * under only the truly ambient-sourced entries of `projectEnv.values`.
+ *
+ * Only `projectEnv`'s AMBIENT entries outrank `merged`: `projectEnv.values`
+ * also carries plain `supabase/.env`/`.env.local` values it read itself, and
+ * those are not necessarily higher Go precedence than an env-specific file
+ * (`.env.<env>.local`/`.env.<env>`) `merged` resolved — `loadProjectEnvironment`
+ * has no notion of `SUPABASE_ENV`-selected filenames, so it can't tell the two
+ * apart itself. `merged`'s own walk below already re-derives the full file
+ * precedence, including `supabase/.env`(.local), so only ambient needs to be
+ * layered back on top (`projectEnv.sources[key] === "ambient"` marks exactly
+ * those entries — see `loadProjectEnvironment`'s `ProjectEnvironment` shape).
+ *
+ * `projectEnv` is `null` whenever `@supabase/config` found no
+ * `supabase/config.toml`/`config.json` (searching ancestors, or at exactly
+ * `workdir` when the caller passed `search: false`) — but Go's dotenv loading
+ * doesn't share that precondition: `Config.Load` calls
+ * `loadNestedEnv(builder.SupabaseDirPath)` BEFORE it ever opens `config.toml`
+ * (`pkg/config/config.go:786-793`), and `SupabaseDirPath` is a pure string
+ * join with no existence check (`NewPathBuilder`, `pkg/config/utils.go:43-48`).
+ * So a missing/absent config file must not skip dotenv loading — fall back to
+ * deriving the same two directories directly from `workdir`
+ * (`<workdir>/supabase` and `workdir` itself) and read `process.env` itself as
+ * the ambient layer, since there's no `loadProjectEnvironment` result to
+ * consult for it in this branch.
+ */
+export function legacyResolveProjectEnvironmentValues(
+  projectEnv: ProjectEnvironment | null,
+  workdir: string,
+): Record<string, string> {
+  const env = process.env["SUPABASE_ENV"] || "development";
+  const filenames = candidateDotenvFilenames(env);
+  const merged: Record<string, string> = {};
+
+  const supabaseDir = projectEnv?.paths.supabaseDir ?? join(workdir, "supabase");
+  const projectRoot = projectEnv?.paths.projectRoot ?? workdir;
+
+  // supabase/ dir first, then its parent (the project root) — matching Go's
+  // directory walk order. Within a directory, `godotenv.Load`'s "never
+  // override an already-set var" means first-processed-wins, so the plain
+  // merge below (skip keys already present) reproduces both orderings at once.
+  for (const dir of [supabaseDir, projectRoot]) {
+    for (const filename of filenames) {
+      const parsed = readDotEnvFile(join(dir, filename));
+      if (parsed === undefined) continue;
+      for (const [key, value] of Object.entries(parsed)) {
+        if (!(key in merged)) merged[key] = value;
+      }
+    }
+  }
+
+  const ambientOverrides: Record<string, string> = {};
+  if (projectEnv !== null) {
+    for (const [key, value] of Object.entries(projectEnv.values)) {
+      if (projectEnv.sources[key] === "ambient") {
+        ambientOverrides[key] = value;
+      }
+    }
+  } else {
+    for (const [key, value] of Object.entries(process.env)) {
+      if (value !== undefined) {
+        ambientOverrides[key] = value;
+      }
+    }
+  }
+
+  return { ...merged, ...ambientOverrides };
+}
diff --git a/apps/cli/src/legacy/shared/legacy-project-environment.unit.test.ts b/apps/cli/src/legacy/shared/legacy-project-environment.unit.test.ts
new file mode 100644
index 0000000000..8e7e71b826
--- /dev/null
+++ b/apps/cli/src/legacy/shared/legacy-project-environment.unit.test.ts
@@ -0,0 +1,300 @@
+import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+
+import type { ProjectEnvironment } from "@supabase/config";
+import { afterEach, beforeEach, describe, expect, it } from "vitest";
+
+import { legacyResolveProjectEnvironmentValues } from "./legacy-project-environment.ts";
+
+let root: string;
+let supabaseDir: string;
+
+beforeEach(() => {
+  root = mkdtempSync(join(tmpdir(), "supabase-legacy-project-env-"));
+  supabaseDir = join(root, "supabase");
+  mkdirSync(supabaseDir, { recursive: true });
+});
+
+afterEach(() => {
+  rmSync(root, { recursive: true, force: true });
+  delete process.env["SUPABASE_ENV"];
+  delete process.env["SUPABASE_PROJECT_ID"];
+});
+
+function fakeProjectEnv(
+  values: Record<string, string> = {},
+  sources: Record<string, "ambient" | ".env" | ".env.local"> = {},
+): ProjectEnvironment {
+  return {
+    paths: {
+      projectRoot: root,
+      supabaseDir,
+      configPath: join(supabaseDir, "config.toml"),
+      envPath: join(supabaseDir, ".env"),
+      envLocalPath: join(supabaseDir, ".env.local"),
+    },
+    values,
+    loadedPaths: [],
+    // Default every given value to "ambient" unless the caller says otherwise —
+    // matches how most tests use this helper (representing an already-resolved,
+    // highest-precedence value) without forcing every call site to spell it out.
+    sources: Object.fromEntries(Object.keys(values).map((key) => [key, sources[key] ?? "ambient"])),
+  };
+}
+
+describe("legacyResolveProjectEnvironmentValues", () => {
+  it("returns just the already-loaded values when no extra dotenv files exist", () => {
+    const projectEnv = fakeProjectEnv({ SUPABASE_PROJECT_ID: "from-loader" });
+    expect(legacyResolveProjectEnvironmentValues(projectEnv, root)).toEqual({
+      SUPABASE_PROJECT_ID: "from-loader",
+    });
+  });
+
+  it("fills in a value from a project-root .env file Go's loadNestedEnv would load", () => {
+    writeFileSync(join(root, ".env"), "SUPABASE_PROJECT_ID=root-env-project\n");
+    const merged = legacyResolveProjectEnvironmentValues(fakeProjectEnv(), root);
+    expect(merged["SUPABASE_PROJECT_ID"]).toBe("root-env-project");
+  });
+
+  it("prefers a supabase/-dir dotenv file over the same key in a project-root file", () => {
+    writeFileSync(join(supabaseDir, ".env"), "SUPABASE_PROJECT_ID=supabase-dir-project\n");
+    writeFileSync(join(root, ".env"), "SUPABASE_PROJECT_ID=root-dir-project\n");
+    const merged = legacyResolveProjectEnvironmentValues(fakeProjectEnv(), root);
+    expect(merged["SUPABASE_PROJECT_ID"]).toBe("supabase-dir-project");
+  });
+
+  it("lets already-resolved projectEnv.values win over anything discovered locally", () => {
+    // `projectEnv.values` already reflects loadProjectEnvironment's correct
+    // ambient-wins-over-supabase/.env(.local) result; a redundant root .env
+    // entry for the same key must never override it.
+    writeFileSync(join(root, ".env"), "SUPABASE_PROJECT_ID=root-env-project\n");
+    const projectEnv = fakeProjectEnv({ SUPABASE_PROJECT_ID: "ambient-project" });
+    const merged = legacyResolveProjectEnvironmentValues(projectEnv, root);
+    expect(merged["SUPABASE_PROJECT_ID"]).toBe("ambient-project");
+  });
+
+  it("defaults SUPABASE_ENV to development when unset", () => {
+    writeFileSync(join(root, ".env.development"), "SUPABASE_PROJECT_ID=dev-project\n");
+    const merged = legacyResolveProjectEnvironmentValues(fakeProjectEnv(), root);
+    expect(merged["SUPABASE_PROJECT_ID"]).toBe("dev-project");
+  });
+
+  it("selects the SUPABASE_ENV-named file over the bare .env file", () => {
+    process.env["SUPABASE_ENV"] = "production";
+    writeFileSync(join(root, ".env"), "SUPABASE_PROJECT_ID=bare-env-project\n");
+    writeFileSync(join(root, ".env.production"), "SUPABASE_PROJECT_ID=prod-project\n");
+    const merged = legacyResolveProjectEnvironmentValues(fakeProjectEnv(), root);
+    expect(merged["SUPABASE_PROJECT_ID"]).toBe("prod-project");
+  });
+
+  it("prefers the .local variant of the SUPABASE_ENV file over the non-local one", () => {
+    process.env["SUPABASE_ENV"] = "production";
+    writeFileSync(join(root, ".env.production"), "SUPABASE_PROJECT_ID=prod-project\n");
+    writeFileSync(join(root, ".env.production.local"), "SUPABASE_PROJECT_ID=prod-local-project\n");
+    const merged = legacyResolveProjectEnvironmentValues(fakeProjectEnv(), root);
+    expect(merged["SUPABASE_PROJECT_ID"]).toBe("prod-local-project");
+  });
+
+  it("skips .env.local when SUPABASE_ENV=test, matching Go's loadDefaultEnv", () => {
+    process.env["SUPABASE_ENV"] = "test";
+    writeFileSync(join(root, ".env.local"), "SUPABASE_PROJECT_ID=local-project\n");
+    writeFileSync(join(root, ".env.test"), "SUPABASE_PROJECT_ID=test-project\n");
+    const merged = legacyResolveProjectEnvironmentValues(fakeProjectEnv(), root);
+    expect(merged["SUPABASE_PROJECT_ID"]).toBe("test-project");
+  });
+
+  it("strips quotes the same way the shared dotenv parser does", () => {
+    writeFileSync(join(root, ".env"), 'SUPABASE_AUTH_JWT_SECRET="a quoted value"\n');
+    const merged = legacyResolveProjectEnvironmentValues(fakeProjectEnv(), root);
+    expect(merged["SUPABASE_AUTH_JWT_SECRET"]).toBe("a quoted value");
+  });
+
+  it("ignores blank lines and comments", () => {
+    writeFileSync(root + "/.env", "\n# a comment\nSUPABASE_PROJECT_ID=commented-project\n");
+    const merged = legacyResolveProjectEnvironmentValues(fakeProjectEnv(), root);
+    expect(merged["SUPABASE_PROJECT_ID"]).toBe("commented-project");
+  });
+
+  it("preserves a literal # in an unquoted value with no leading whitespace, matching godotenv", () => {
+    // godotenv only starts an inline comment at a `#` preceded by whitespace
+    // (`godotenv@v1.5.1/parser.go:144-153`); `foo#bar` keeps the `#` verbatim.
+    writeFileSync(root + "/.env", "SUPABASE_AUTH_JWT_SECRET=long#secret\n");
+    const merged = legacyResolveProjectEnvironmentValues(fakeProjectEnv(), root);
+    expect(merged["SUPABASE_AUTH_JWT_SECRET"]).toBe("long#secret");
+  });
+
+  it("still truncates an unquoted value at a whitespace-preceded inline comment", () => {
+    writeFileSync(root + "/.env", "SUPABASE_PROJECT_ID=54323 # local\n");
+    const merged = legacyResolveProjectEnvironmentValues(fakeProjectEnv(), root);
+    expect(merged["SUPABASE_PROJECT_ID"]).toBe("54323");
+  });
+
+  it("strips a trailing comment after a quoted value, matching godotenv", () => {
+    // godotenv's `extractVarValue` locates the quoted span by scanning forward for the
+    // closing quote (`godotenv@v1.5.1/parser.go:160-180`) and discards anything after
+    // it as a comment — the value is `demo`, not the literal `"demo"` a check that
+    // requires the whole trimmed remainder to end with a quote would produce.
+    writeFileSync(root + "/.env", 'SUPABASE_PROJECT_ID="demo" # local\n');
+    const merged = legacyResolveProjectEnvironmentValues(fakeProjectEnv(), root);
+    expect(merged["SUPABASE_PROJECT_ID"]).toBe("demo");
+  });
+
+  it("accepts a colon-separated assignment, matching godotenv's YAML-style key/value form", () => {
+    // godotenv's `locateKeyName` treats `=` and `:` as interchangeable separators
+    // (`godotenv@v1.5.1/parser.go:90-95`), and the repo's other dotenv parser
+    // (`packages/config/src/project.ts`'s `parseDotEnv`) already accepts both.
+    writeFileSync(root + "/.env", "SUPABASE_PROJECT_ID: colon-project\n");
+    const merged = legacyResolveProjectEnvironmentValues(fakeProjectEnv(), root);
+    expect(merged["SUPABASE_PROJECT_ID"]).toBe("colon-project");
+  });
+
+  it("prefers an env-specific file over a same-key value projectEnv.values sourced from a bare .env file", () => {
+    // `projectEnv.values` has no notion of SUPABASE_ENV-selected filenames, so
+    // a key it resolved from a plain supabase/.env file is NOT necessarily
+    // higher Go precedence than a same-named key from `.env.<env>.local` —
+    // only an "ambient" source outranks the file precedence computed locally.
+    process.env["SUPABASE_ENV"] = "development";
+    writeFileSync(
+      join(supabaseDir, ".env.development.local"),
+      "SUPABASE_PROJECT_ID=env-specific-project\n",
+    );
+    const projectEnv = fakeProjectEnv(
+      { SUPABASE_PROJECT_ID: "bare-dotenv-project" },
+      { SUPABASE_PROJECT_ID: ".env" },
+    );
+    const merged = legacyResolveProjectEnvironmentValues(projectEnv, root);
+    expect(merged["SUPABASE_PROJECT_ID"]).toBe("env-specific-project");
+  });
+
+  it("still lets a truly ambient-sourced value win over any file", () => {
+    process.env["SUPABASE_ENV"] = "development";
+    writeFileSync(
+      join(supabaseDir, ".env.development.local"),
+      "SUPABASE_PROJECT_ID=env-specific-project\n",
+    );
+    const projectEnv = fakeProjectEnv(
+      { SUPABASE_PROJECT_ID: "ambient-project" },
+      { SUPABASE_PROJECT_ID: "ambient" },
+    );
+    const merged = legacyResolveProjectEnvironmentValues(projectEnv, root);
+    expect(merged["SUPABASE_PROJECT_ID"]).toBe("ambient-project");
+  });
+
+  it("throws on a malformed line, matching Go's loadEnvIfExists propagating godotenv's parse error", () => {
+    writeFileSync(join(root, ".env"), "not a valid line\n");
+    expect(() => legacyResolveProjectEnvironmentValues(fakeProjectEnv(), root)).toThrow(
+      /failed to parse environment file/,
+    );
+  });
+
+  it("expands an unquoted $VAR reference to an earlier value in the same file", () => {
+    // godotenv expands unquoted/double-quoted references while loading
+    // (`godotenv@v1.5.1/parser.go:157`), so a later key can reuse an earlier one.
+    writeFileSync(join(root, ".env"), "BASE=demo\nSUPABASE_PROJECT_ID=$BASE\n");
+    const merged = legacyResolveProjectEnvironmentValues(fakeProjectEnv(), root);
+    expect(merged["SUPABASE_PROJECT_ID"]).toBe("demo");
+  });
+
+  it("expands a braced ${VAR} reference in a double-quoted value", () => {
+    writeFileSync(join(root, ".env"), 'SECRET=shh\nSUPABASE_AUTH_JWT_SECRET="${SECRET}"\n');
+    const merged = legacyResolveProjectEnvironmentValues(fakeProjectEnv(), root);
+    expect(merged["SUPABASE_AUTH_JWT_SECRET"]).toBe("shh");
+  });
+
+  it("does not expand variable references inside single-quoted values", () => {
+    // godotenv never calls expandVariables for single-quoted values
+    // (`parser.go:172-173`) — they stay byte-literal.
+    writeFileSync(join(root, ".env"), "BASE=demo\nSUPABASE_PROJECT_ID='$BASE'\n");
+    const merged = legacyResolveProjectEnvironmentValues(fakeProjectEnv(), root);
+    expect(merged["SUPABASE_PROJECT_ID"]).toBe("$BASE");
+  });
+
+  it("expands an unresolved bare reference to an empty string, matching Go's map zero-value", () => {
+    writeFileSync(join(root, ".env"), "SUPABASE_PROJECT_ID=$NOPE\n");
+    const merged = legacyResolveProjectEnvironmentValues(fakeProjectEnv(), root);
+    expect(merged["SUPABASE_PROJECT_ID"]).toBe("");
+  });
+
+  it("expands an unresolved braced reference to an empty string, matching Go's map zero-value", () => {
+    writeFileSync(join(root, ".env"), 'SUPABASE_AUTH_JWT_SECRET="${NOPE}"\n');
+    const merged = legacyResolveProjectEnvironmentValues(fakeProjectEnv(), root);
+    expect(merged["SUPABASE_AUTH_JWT_SECRET"]).toBe("");
+  });
+
+  it("preserves a backslash-escaped $VAR reference as a literal, matching godotenv's escape rule", () => {
+    // godotenv's expandVarRegex captures a leading backslash and strips ONLY
+    // that backslash, returning the rest of the match verbatim instead of
+    // doing a lookup (`godotenv@v1.5.1/parser.go:253,264-265`) — even when
+    // BASE is defined, `demo\$BASE` must stay `demo$BASE`, not become
+    // `demodemo`.
+    writeFileSync(join(root, ".env"), "BASE=demo\nSUPABASE_PROJECT_ID=demo\\$BASE\n");
+    const merged = legacyResolveProjectEnvironmentValues(fakeProjectEnv(), root);
+    expect(merged["SUPABASE_PROJECT_ID"]).toBe("demo$BASE");
+  });
+
+  it("preserves a backslash-escaped ${VAR} reference in a double-quoted value", () => {
+    writeFileSync(join(root, ".env"), 'BASE=demo\nSUPABASE_PROJECT_ID="demo\\${BASE}"\n');
+    const merged = legacyResolveProjectEnvironmentValues(fakeProjectEnv(), root);
+    expect(merged["SUPABASE_PROJECT_ID"]).toBe("demo${BASE}");
+  });
+
+  it("treats a bare trailing $ with no variable name as a literal", () => {
+    writeFileSync(join(root, ".env"), "SUPABASE_PROJECT_ID=demo$\n");
+    const merged = legacyResolveProjectEnvironmentValues(fakeProjectEnv(), root);
+    expect(merged["SUPABASE_PROJECT_ID"]).toBe("demo$");
+  });
+
+  it("preserves a multiline quoted value alongside an unrelated SUPABASE_* key (godotenv parity)", () => {
+    // godotenv's parser scans the whole buffer with a cursor, not line-by-line
+    // (`godotenv@v1.5.1/parser.go:20-45`), so a quoted value spanning physical
+    // lines — e.g. a pasted PEM private key — doesn't break parsing of the rest
+    // of the file. A naive line-by-line reader would see the continuation line
+    // as malformed and abort before SUPABASE_PROJECT_ID is ever read.
+    const pem = "-----BEGIN PRIVATE KEY-----\nMIIBogIBAAJ\n-----END PRIVATE KEY-----";
+    writeFileSync(
+      join(root, ".env"),
+      `PRIVATE_KEY="${pem}"\nSUPABASE_PROJECT_ID=multiline-safe-project\n`,
+    );
+    const merged = legacyResolveProjectEnvironmentValues(fakeProjectEnv(), root);
+    expect(merged["SUPABASE_PROJECT_ID"]).toBe("multiline-safe-project");
+  });
+
+  describe("when no project was found (projectEnv is null)", () => {
+    // Go's `loadNestedEnv` runs unconditionally before `config.toml` is ever
+    // opened (`pkg/config/config.go:786-793`), so a missing config file must
+    // not skip dotenv loading — these cover the local fallback that derives
+    // `<workdir>/supabase`/`workdir` directly instead of giving up.
+
+    it("still reads a supabase/-dir dotenv file directly under workdir", () => {
+      writeFileSync(join(supabaseDir, ".env"), "SUPABASE_PROJECT_ID=fallback-project\n");
+      const merged = legacyResolveProjectEnvironmentValues(null, root);
+      expect(merged["SUPABASE_PROJECT_ID"]).toBe("fallback-project");
+    });
+
+    it("still reads a project-root dotenv file directly under workdir", () => {
+      writeFileSync(join(root, ".env"), "SUPABASE_PROJECT_ID=root-fallback-project\n");
+      const merged = legacyResolveProjectEnvironmentValues(null, root);
+      expect(merged["SUPABASE_PROJECT_ID"]).toBe("root-fallback-project");
+    });
+
+    it("prefers the supabase/-dir file over the project-root file, same as the non-null case", () => {
+      writeFileSync(join(supabaseDir, ".env"), "SUPABASE_PROJECT_ID=supabase-dir-project\n");
+      writeFileSync(join(root, ".env"), "SUPABASE_PROJECT_ID=root-dir-project\n");
+      const merged = legacyResolveProjectEnvironmentValues(null, root);
+      expect(merged["SUPABASE_PROJECT_ID"]).toBe("supabase-dir-project");
+    });
+
+    it("lets an ambient shell var win over a dotenv value, using process.env directly", () => {
+      process.env["SUPABASE_PROJECT_ID"] = "ambient-fallback-project";
+      writeFileSync(join(supabaseDir, ".env"), "SUPABASE_PROJECT_ID=dotenv-fallback-project\n");
+      const merged = legacyResolveProjectEnvironmentValues(null, root);
+      expect(merged["SUPABASE_PROJECT_ID"]).toBe("ambient-fallback-project");
+    });
+
+    it("returns an empty object when workdir has no dotenv files and no ambient value", () => {
+      const merged = legacyResolveProjectEnvironmentValues(null, root);
+      expect(merged["SUPABASE_PROJECT_ID"]).toBeUndefined();
+    });
+  });
+});
diff --git a/apps/cli/src/legacy/shared/legacy-prompt-yes-no.ts b/apps/cli/src/legacy/shared/legacy-prompt-yes-no.ts
index 64ba6368a6..81499e2b72 100644
--- a/apps/cli/src/legacy/shared/legacy-prompt-yes-no.ts
+++ b/apps/cli/src/legacy/shared/legacy-prompt-yes-no.ts
@@ -29,6 +29,9 @@ export const legacyParseYesNo = (input: string): boolean | undefined => {
  * `db pull`, `seed buckets`, and `storage rm`:
  *  - when `yes` is set, echoes `<label> [Y/n|y/N] y` and returns true even on a
  *    TTY (Go auto-confirms with the affirmative echo, `console.go:70-72`);
+ *  - when `interactive` is false (Go callers that force `console.IsTTY = false`,
+ *    e.g. `buckets.Run(ctx, "", false, fsys)` during `db reset`), behaves like a
+ *    non-TTY stdin: label + one bounded line scan, honoring a parsed answer;
  *  - `json`/`stream-json` output never prompts and uses the default silently;
  *  - a real TTY otherwise prompts with the given default via clack;
  *  - on a non-TTY stdin, Go does **not** short-circuit to the default: it prints
@@ -44,6 +47,7 @@ export const legacyPromptYesNo = Effect.fnUntraced(function* (
   yes: boolean,
   label: string,
   defaultValue: boolean,
+  interactive = true,
 ) {
   const choices = defaultValue ? "Y/n" : "y/N";
   if (yes) {
@@ -54,7 +58,12 @@ export const legacyPromptYesNo = Effect.fnUntraced(function* (
     return defaultValue;
   }
   const tty = yield* Tty;
-  if (!tty.stdinIsTty) {
+  // `interactive === false` mirrors Go callers that force `console.IsTTY = false`
+  // (e.g. `buckets.Run(ctx, "", false, fsys)` during `db reset`): Go does NOT
+  // silently take the default — `PromptYesNo` still prints the label, scans one
+  // line with the 100ms timeout, echoes it, and honors a parsed answer
+  // (`console.go:64-102`). So route it through the same non-TTY read path.
+  if (!interactive || !tty.stdinIsTty) {
     // Go's `PromptText` prints the label, then `ReadLine` scans one line and (on a
     // non-TTY) echoes it to stderr (`console.go:96-102`). A parsed piped answer
     // wins; an empty/exhausted scan or an unparseable line uses the default.
diff --git a/apps/cli/src/legacy/shared/legacy-seed-buckets.ts b/apps/cli/src/legacy/shared/legacy-seed-buckets.ts
new file mode 100644
index 0000000000..e4c06c8227
--- /dev/null
+++ b/apps/cli/src/legacy/shared/legacy-seed-buckets.ts
@@ -0,0 +1,638 @@
+import {
+  loadProjectConfig,
+  type LoadProjectConfigOptions,
+  type ProjectConfig,
+  ProjectConfigSchema,
+} from "@supabase/config";
+import { Effect, FileSystem, Path, Schema } from "effect";
+import { FetchHttpClient } from "effect/unstable/http";
+import type { PlatformError } from "effect/PlatformError";
+
+import { Output } from "../../shared/output/output.service.ts";
+import { legacyResolveYesWithProjectEnv } from "../../shared/legacy/global-flags.ts";
+import { LegacyCliConfig } from "../config/legacy-cli-config.service.ts";
+import { legacyBold, legacyYellow } from "./legacy-colors.ts";
+import { legacyLoadProjectEnv } from "./legacy-db-config.toml-read.ts";
+import { legacyPromptYesNo } from "./legacy-prompt-yes-no.ts";
+import {
+  legacyResolveStorageCredentials,
+  legacyStorageGatewayFetch,
+} from "./legacy-storage-credentials.ts";
+import {
+  legacyParseFileSizeLimit,
+  legacyResolveBucketProps,
+} from "./legacy-storage-bucket-config.ts";
+import {
+  type LegacyStorageGateway,
+  type LegacyUpsertBucketProps,
+  legacyMakeStorageGateway,
+} from "./legacy-storage-gateway.ts";
+import type { LegacyStorageGatewayError } from "./legacy-storage-gateway.errors.ts";
+import { legacyContentTypeForUpload, legacyReadSniffBytes } from "./legacy-storage-content-type.ts";
+import {
+  legacyIsLocalVectorBucketsUnavailable,
+  legacyIsVectorBucketsFeatureNotEnabled,
+} from "../commands/seed/buckets/buckets.classify.ts";
+import { LegacySeedConfigLoadError } from "../commands/seed/buckets/buckets.errors.ts";
+import { legacyBucketObjectKey } from "../commands/seed/buckets/buckets.upload.ts";
+
+const CONFIG_PATH = "supabase/config.toml";
+const UPLOAD_CONCURRENCY = 5;
+
+/**
+ * Well-known OS metadata files (macOS Finder, Windows Explorer) that must
+ * never be uploaded as seeded objects — see CLI-1950. Go has no equivalent
+ * skip; this is an intentional TS-only improvement over Go's current (also
+ * buggy) behavior.
+ */
+const osJunkFileNames = new Set([".DS_Store", "Thumbs.db", "desktop.ini"]);
+
+/**
+ * Mirrors Go's `ValidateBucketName` regex (`apps/cli-go/pkg/config/config.go:1382`).
+ * Used to validate `[storage.buckets]` names before any Storage API call, matching
+ * Go's config-load-time check (`config.go:899-903`). Vector and analytics names are
+ * NOT validated here — Go only validates `[storage.buckets]`.
+ */
+const LEGACY_BUCKET_NAME_PATTERN = /^(?:[0-9A-Za-z_]|!|-|\.|\*|'|\(|\)| |&|\$|@|=|;|:|\+|,|\?)*$/;
+
+/**
+ * Verbatim Go regex literal (`config.go:1382`) — used in the error message so it
+ * is byte-identical to Go's output. Do NOT derive from `LEGACY_BUCKET_NAME_PATTERN.source`.
+ */
+const LEGACY_BUCKET_NAME_PATTERN_SOURCE =
+  "^(\\w|!|-|\\.|\\*|'|\\(|\\)| |&|\\$|@|=|;|:|\\+|,|\\?)*$";
+
+const legacyValidateBucketName = Effect.fnUntraced(function* (name: string) {
+  if (!LEGACY_BUCKET_NAME_PATTERN.test(name)) {
+    return yield* new LegacySeedConfigLoadError({
+      message: `Invalid Bucket name: ${name}. Only lowercase letters, numbers, dots, hyphens, and spaces are allowed. (${LEGACY_BUCKET_NAME_PATTERN_SOURCE})`,
+    });
+  }
+});
+
+interface CollectedFile {
+  readonly absPath: string;
+  readonly displayPath: string;
+}
+
+/** Mutable run summary, emitted as the structured result in json/stream-json mode. */
+interface SeedSummary {
+  readonly buckets_created: Array<string>;
+  readonly buckets_updated: Array<string>;
+  readonly buckets_skipped: Array<string>;
+  readonly vector_created: Array<string>;
+  readonly vector_pruned: Array<string>;
+  vector_skipped: boolean;
+  readonly objects_uploaded: Array<string>;
+  readonly analytics_created: Array<string>;
+  readonly analytics_pruned: Array<string>;
+}
+
+function emptySummary(): SeedSummary {
+  return {
+    buckets_created: [],
+    buckets_updated: [],
+    buckets_skipped: [],
+    vector_created: [],
+    vector_pruned: [],
+    vector_skipped: false,
+    objects_uploaded: [],
+    analytics_created: [],
+    analytics_pruned: [],
+  };
+}
+
+/**
+ * Embedded-default project config, decoded from an empty object — the same
+ * `decodeUnknownSync(ProjectConfigSchema)({})` the loader uses internally
+ * (`packages/config/src/io.ts:54-56`). Go's `seed buckets` never aborts on a
+ * missing `config.toml`: it reads the package-global `utils.Config`, initialized
+ * to embedded defaults, and `config.Load` no-ops on a missing file. So "no
+ * config file" behaves like the embedded-default config.
+ */
+const legacyDecodeDefaultProjectConfig = Schema.decodeUnknownSync(ProjectConfigSchema);
+
+/**
+ * Core of `seed buckets`: load config (merging `[remotes.<ref>]` for a non-empty
+ * `projectRef`), validate bucket config, then upsert/seed buckets + objects against
+ * the Storage service gateway. Hoisted to `legacy/shared/` so both the `seed
+ * buckets` command and `db reset --local` can reuse the exact local-seed path Go
+ * invokes via `buckets.Run(ctx, "", false, fsys)` (`internal/db/reset/reset.go:71`).
+ *
+ * `emitSummary` controls whether the machine-readable summary is written to stdout:
+ * the `seed buckets` command emits it; `db reset` does NOT (it emits its own
+ * result), matching Go where reset's `buckets.Run` prints nothing to stdout.
+ *
+ * `interactive` controls whether overwrite/prune confirmations may prompt. `db
+ * reset` reuses this core with `interactive: false` so it never blocks on input —
+ * Go forces it via `buckets.Run(ctx, "", false, fsys)`. Defaults to `true`.
+ *
+ * The caller owns project-ref resolution, the linked-project cache write, and the
+ * telemetry flush (Go's PersistentPostRun) — this core does none of those.
+ */
+export const legacySeedBucketsRun = Effect.fnUntraced(function* (opts: {
+  readonly projectRef: string;
+  readonly emitSummary: boolean;
+  readonly interactive?: boolean;
+  /**
+   * Pre-resolved auto-confirm value. `db reset` resolves `yes` with the nested project
+   * `.env` loaded (Go's `loadNestedEnv` runs before `buckets.Run`), so pass it through here
+   * — the internal fallback below only loads whatever THIS command's own project would
+   * supply. When omitted (the standalone `seed buckets` command), fall back to
+   * `legacyResolveYesWithProjectEnv`, loading the project env ourselves — `seed buckets`
+   * defaults to `--local` (Go's `seedFlags.Bool("local", true, ...)`, `cmd/seed.go:31`),
+   * and root's `ParseDatabaseConfig` calls `LoadConfig` — loading the project `.env` files
+   * — before `buckets.Run`'s overwrite/prune prompts (`root.go:118`), so a `SUPABASE_YES`
+   * set only in `supabase/.env` must auto-confirm here too.
+   */
+  readonly yes?: boolean;
+  /**
+   * Skips this function's own `loadProjectConfig` reload in favor of a config
+   * the caller already resolved (and may have folded env overrides into —
+   * see `start.handler.ts`'s `effectiveLocalStorageConfig`). Go's `buckets.Run`
+   * never reloads config itself: it reads the single process-wide `utils.Config`
+   * populated once by `Config.Load()` at CLI startup, so any `SUPABASE_*`
+   * override already in effect for the rest of that process (e.g. an
+   * env-overridden `api.port`/`api.tls.enabled` that actually brought Kong up
+   * differently) is automatically visible here too. `start` is a long-running
+   * process that resolves its own config/env once up front and must reuse
+   * that SAME resolution for bucket seeding to match — an independent reload
+   * from disk would silently drop any override that exists only in the
+   * shell/dotenv, not literally in config.toml. Only `start` passes this;
+   * the standalone `seed buckets` command's own single load already IS Go's
+   * one-shot `Config.Load()` for that process, so it keeps reloading below.
+   */
+  readonly resolvedConfig?: {
+    readonly config: ProjectConfig;
+    readonly document: Record<string, unknown> | undefined;
+  };
+}) {
+  const output = yield* Output;
+  const cliConfig = yield* LegacyCliConfig;
+  const fs = yield* FileSystem.FileSystem;
+  const path = yield* Path.Path;
+  // `--yes` OR `SUPABASE_YES` (Go's viper AutomaticEnv, root.go:318-320).
+  const yes =
+    opts.yes ??
+    (yield* legacyResolveYesWithProjectEnv(
+      yield* legacyLoadProjectEnv(fs, path, cliConfig.workdir),
+    ));
+  const { projectRef, emitSummary } = opts;
+  const interactive = opts.interactive ?? true;
+
+  // Load config.toml, passing projectRef so `[remotes.*]` overrides are merged for
+  // --linked. A parse failure aborts before any network call. Skipped entirely
+  // when the caller already supplied `resolvedConfig` — see that option's doc
+  // comment above.
+  const loadOptions: LoadProjectConfigOptions =
+    projectRef !== "" ? { projectRef, goViperCompat: true } : { goViperCompat: true };
+  const loaded =
+    opts.resolvedConfig !== undefined
+      ? null
+      : yield* loadProjectConfig(cliConfig.workdir, loadOptions).pipe(
+          Effect.catchTag(
+            "ProjectConfigParseError",
+            (cause) =>
+              new LegacySeedConfigLoadError({
+                message: `failed to parse supabase/config.toml: ${String(cause.cause)}`,
+              }),
+          ),
+        );
+  // A missing config file is NOT an early exit: Go uses embedded defaults and
+  // still gates the no-op on `len(projectRef) == 0`. So local + no-config falls
+  // into the no-op short-circuit; `--linked` + no-config falls through to the
+  // remote path so auth/project/API failures surface. `resolvedConfig` (when
+  // given) always wins over a `null` `loaded` — see that option's doc comment.
+  const config =
+    opts.resolvedConfig?.config ??
+    (loaded === null ? legacyDecodeDefaultProjectConfig({}) : loaded.config);
+  const document = opts.resolvedConfig?.document ?? (loaded === null ? undefined : loaded.document);
+
+  // Go prints this from inside config load (`config.go:513`) whenever a
+  // `[remotes.*]` block matched the linked ref. stderr in all output modes.
+  if (loaded !== null && loaded.appliedRemote !== undefined) {
+    yield* output.raw(`Loading config override: [remotes.${loaded.appliedRemote}]\n`, "stderr");
+  }
+  const bucketsConfig = config.storage.buckets ?? {};
+  const bucketNames = Object.keys(bucketsConfig);
+  const vectorEnabled = config.storage.vector.enabled;
+  const vectorBucketNames = Object.keys(config.storage.vector.buckets);
+  const hasVectorBuckets = vectorBucketNames.length > 0;
+
+  // Config-load-time validations run BEFORE the no-op short-circuit: Go decodes the
+  // whole config (storage.FileSizeLimit, bucket sizes) and runs ValidateBucketName
+  // during config.Load — before `buckets.Run` can take its no-op path — so an
+  // invalid value fails even when there's nothing to seed.
+  //
+  // Bucket names (Go ValidateBucketName, config.go:899-903).
+  for (const name of bucketNames) {
+    yield* legacyValidateBucketName(name);
+  }
+
+  // Storage-level file_size_limit, parsed unconditionally.
+  const storageFileSizeLimitBytes = yield* parseFileSizeLimitOrFail(config.storage.file_size_limit);
+
+  // Per-bucket props (sizes parsed before any Storage call).
+  const bucketPropsByName = new Map<string, LegacyUpsertBucketProps>();
+  for (const [name, bucket] of Object.entries(bucketsConfig)) {
+    bucketPropsByName.set(
+      name,
+      yield* computeBucketProps(document, name, bucket, storageFileSizeLimitBytes),
+    );
+  }
+
+  // Short-circuit: nothing to seed (ref present → never short-circuits).
+  if (projectRef === "" && bucketNames.length === 0 && !hasVectorBuckets) {
+    if (emitSummary && output.format !== "text") {
+      yield* output.success("", { ...emptySummary() });
+    }
+    return;
+  }
+
+  // Build the Storage service-gateway client (local or remote).
+  const credentials = yield* legacyResolveStorageCredentials({ projectRef, config });
+
+  // All gateway operations run with an explicit non-DoH fetch (CA-trusting for
+  // local + https, plain `globalThis.fetch` otherwise). The api-keys lookup inside
+  // `legacyResolveStorageCredentials` runs BEFORE this scope, so it still honors
+  // `--dns-resolver https`, matching Go's `tenant.GetApiKeys`.
+  const gatewayOps = Effect.gen(function* () {
+    const gateway = yield* legacyMakeStorageGateway({
+      baseUrl: credentials.baseUrl,
+      apiKey: credentials.apiKey,
+      userAgent: cliConfig.userAgent,
+    });
+
+    const summary = emptySummary();
+
+    // Upsert configured buckets.
+    yield* upsertBuckets(output, yes, interactive, gateway, bucketPropsByName, summary);
+
+    // Upsert analytics buckets (remote --linked only).
+    if (config.storage.analytics.enabled && projectRef !== "") {
+      yield* output.raw("Updating analytics buckets...\n", "stderr");
+      yield* upsertAnalyticsBuckets(
+        output,
+        yes,
+        interactive,
+        gateway,
+        Object.keys(config.storage.analytics.buckets),
+        summary,
+      );
+    }
+
+    // Upsert vector buckets (local), with graceful skip on unavailability.
+    if (vectorEnabled && hasVectorBuckets) {
+      yield* output.raw("Updating vector buckets...\n", "stderr");
+      yield* upsertVectorBuckets(
+        output,
+        yes,
+        interactive,
+        gateway,
+        vectorBucketNames,
+        summary,
+      ).pipe(Effect.catch((error) => handleVectorError(output, error, summary)));
+    }
+
+    // Upload objects for each bucket with a configured objects_path.
+    yield* uploadObjects(fs, path, output, gateway, cliConfig.workdir, bucketsConfig, summary);
+
+    // Machine-readable summary (Go has none; text mode emits nothing extra).
+    if (emitSummary && output.format !== "text") {
+      yield* output.success("", { ...summary });
+    }
+  });
+
+  yield* gatewayOps.pipe(
+    Effect.provideService(
+      FetchHttpClient.Fetch,
+      legacyStorageGatewayFetch(credentials.localKongCa),
+    ),
+  );
+});
+
+type BucketsConfig = Readonly<
+  Record<
+    string,
+    {
+      readonly public: boolean;
+      readonly file_size_limit: string;
+      readonly allowed_mime_types: ReadonlyArray<string>;
+      readonly objects_path: string;
+    }
+  >
+>;
+
+// Parse a `file_size_limit` string to bytes, mapping a parse failure to a
+// config-load error (Go rejects an invalid `sizeInBytes` during `config.Load`,
+// before NewStorageAPI).
+const parseFileSizeLimitOrFail = (value: string) =>
+  Effect.try({
+    try: () => legacyParseFileSizeLimit(value),
+    catch: (cause) =>
+      new LegacySeedConfigLoadError({
+        message: cause instanceof Error ? cause.message : String(cause),
+      }),
+  });
+
+const computeBucketProps = (
+  document: Record<string, unknown> | undefined,
+  name: string,
+  bucket: BucketsConfig[string],
+  storageFileSizeLimitBytes: number,
+) =>
+  Effect.try({
+    try: () => legacyResolveBucketProps({ document, name, bucket, storageFileSizeLimitBytes }),
+    catch: (cause) =>
+      new LegacySeedConfigLoadError({
+        message: cause instanceof Error ? cause.message : String(cause),
+      }),
+  });
+
+// Port of `pkg/storage/batch.go:UpsertBuckets`. `propsByName` is precomputed and
+// size-validated before this runs (Go parses sizes at config-load, before any
+// Storage call).
+const upsertBuckets = Effect.fnUntraced(function* (
+  output: typeof Output.Service,
+  yes: boolean,
+  interactive: boolean,
+  gateway: LegacyStorageGateway,
+  propsByName: ReadonlyMap<string, LegacyUpsertBucketProps>,
+  summary: SeedSummary,
+) {
+  const existing = yield* gateway.listBuckets();
+  const byName = new Map(existing.map((b) => [b.name, b.id]));
+
+  for (const [name, props] of propsByName) {
+    const bucketId = byName.get(name);
+    if (bucketId !== undefined) {
+      const overwrite = yield* legacyPromptYesNo(
+        output,
+        yes,
+        `Bucket ${legacyBold(bucketId)} already exists. Do you want to overwrite its properties?`,
+        true,
+        interactive,
+      );
+      if (!overwrite) {
+        summary.buckets_skipped.push(bucketId);
+        continue;
+      }
+      yield* output.raw(`Updating Storage bucket: ${bucketId}\n`, "stderr");
+      yield* gateway.updateBucket(bucketId, props);
+      summary.buckets_updated.push(bucketId);
+    } else {
+      yield* output.raw(`Creating Storage bucket: ${name}\n`, "stderr");
+      yield* gateway.createBucket(name, props);
+      summary.buckets_created.push(name);
+    }
+  }
+});
+
+// Port of `pkg/storage/vector.go:UpsertVectorBuckets`.
+const upsertVectorBuckets = Effect.fnUntraced(function* (
+  output: typeof Output.Service,
+  yes: boolean,
+  interactive: boolean,
+  gateway: LegacyStorageGateway,
+  configuredNames: ReadonlyArray<string>,
+  summary: SeedSummary,
+) {
+  const existing = yield* gateway.listVectorBuckets();
+  const existingSet = new Set(existing);
+  const configuredSet = new Set(configuredNames);
+  const toDelete = existing.filter((name) => !configuredSet.has(name));
+
+  for (const name of configuredNames) {
+    if (existingSet.has(name)) {
+      yield* output.raw(`Bucket already exists: ${name}\n`, "stderr");
+      continue;
+    }
+    yield* output.raw(`Creating vector bucket: ${name}\n`, "stderr");
+    yield* gateway.createVectorBucket(name);
+    summary.vector_created.push(name);
+  }
+
+  for (const name of toDelete) {
+    const prune = yield* legacyPromptYesNo(
+      output,
+      yes,
+      `Bucket ${legacyBold(name)} not found in ${legacyBold(CONFIG_PATH)}. Do you want to prune it?`,
+      false,
+      interactive,
+    );
+    if (!prune) {
+      continue;
+    }
+    yield* output.raw(`Pruning vector bucket: ${name}\n`, "stderr");
+    yield* gateway.deleteVectorBucket(name);
+    summary.vector_pruned.push(name);
+  }
+});
+
+// Port of `pkg/storage/analytics.go:UpsertAnalyticsBuckets`.
+const upsertAnalyticsBuckets = Effect.fnUntraced(function* (
+  output: typeof Output.Service,
+  yes: boolean,
+  interactive: boolean,
+  gateway: LegacyStorageGateway,
+  configuredNames: ReadonlyArray<string>,
+  summary: SeedSummary,
+) {
+  const existing = yield* gateway.listAnalyticsBuckets();
+  const existingSet = new Set(existing);
+  const configuredSet = new Set(configuredNames);
+  const toDelete = existing.filter((name) => !configuredSet.has(name));
+
+  for (const name of configuredNames) {
+    if (existingSet.has(name)) {
+      yield* output.raw(`Bucket already exists: ${name}\n`, "stderr");
+      continue;
+    }
+    yield* output.raw(`Creating analytics bucket: ${name}\n`, "stderr");
+    yield* gateway.createAnalyticsBucket(name);
+    summary.analytics_created.push(name);
+  }
+
+  for (const name of toDelete) {
+    const prune = yield* legacyPromptYesNo(
+      output,
+      yes,
+      `Bucket ${legacyBold(name)} not found in ${legacyBold(CONFIG_PATH)}. Do you want to prune it?`,
+      false,
+      interactive,
+    );
+    if (!prune) {
+      continue;
+    }
+    yield* output.raw(`Pruning analytics bucket: ${name}\n`, "stderr");
+    yield* gateway.deleteAnalyticsBucket(name);
+    summary.analytics_pruned.push(name);
+  }
+});
+
+/**
+ * Vector graceful-skip (`buckets.go:57-66`): on `FeatureNotEnabled` /
+ * local-unavailable errors, print the matching WARNING and continue (object
+ * upload still runs). Any other error propagates.
+ */
+const handleVectorError = Effect.fnUntraced(function* (
+  output: typeof Output.Service,
+  error: LegacyStorageGatewayError,
+  summary: SeedSummary,
+) {
+  if (legacyIsVectorBucketsFeatureNotEnabled(error.message)) {
+    yield* output.raw(
+      `${legacyYellow("WARNING:")} Vector buckets are not available in this project's region yet. Skipping vector bucket seeding.\n`,
+      "stderr",
+    );
+    summary.vector_skipped = true;
+    return;
+  }
+  if (legacyIsLocalVectorBucketsUnavailable(error.message)) {
+    yield* output.raw(
+      `${legacyYellow("WARNING:")} Vector buckets are not available in the local storage service. If this project is linked, run \`supabase link\` to update service versions, then restart the local stack. Skipping vector bucket seeding.\n`,
+      "stderr",
+    );
+    summary.vector_skipped = true;
+    return;
+  }
+  return yield* Effect.fail(error);
+});
+
+// Port of `pkg/storage/batch.go:UpsertObjects` (+ object walk in objects.go).
+const uploadObjects = Effect.fnUntraced(function* (
+  fs: FileSystem.FileSystem,
+  path: Path.Path,
+  output: typeof Output.Service,
+  gateway: LegacyStorageGateway,
+  workdir: string,
+  bucketsConfig: BucketsConfig,
+  summary: SeedSummary,
+) {
+  for (const [name, bucket] of Object.entries(bucketsConfig)) {
+    const objectsPath = bucket.objects_path;
+    if (objectsPath.length === 0) {
+      continue;
+    }
+    // Go resolves a relative bucket objects_path against SupabaseDirPath at
+    // config-resolve time (`pkg/config/config.go:757-759`); absolute paths are
+    // left untouched. `displayRoot` (workdir-relative) drives the `Uploading:`
+    // stderr and the destination key so both stay byte-identical to Go.
+    const displayRoot = path.isAbsolute(objectsPath)
+      ? objectsPath
+      : path.join("supabase", objectsPath);
+    const absRoot = path.isAbsolute(objectsPath)
+      ? objectsPath
+      : path.join(workdir, "supabase", objectsPath);
+    const files = yield* collectFiles(fs, path, output, absRoot, displayRoot);
+    yield* Effect.forEach(
+      files,
+      (file) =>
+        Effect.gen(function* () {
+          const dstPath = legacyBucketObjectKey(name, displayRoot, file.displayPath);
+          yield* output.raw(`Uploading: ${file.displayPath} => ${dstPath}\n`, "stderr");
+          // Content-type is byte-driven: Go sniffs the first 512 bytes with
+          // http.DetectContentType, refining only a generic text/plain by
+          // extension (`pkg/storage/objects.go:77-108`).
+          const sniff = yield* legacyReadSniffBytes(fs, file.absPath);
+          // Go's seed upload always sets Cache-Control max-age=3600 and x-upsert
+          // (Overwrite) true (`pkg/storage/batch.go`).
+          yield* gateway.uploadObject(dstPath, file.absPath, {
+            contentType: legacyContentTypeForUpload(sniff, file.absPath),
+            cacheControl: "max-age=3600",
+            overwrite: true,
+          });
+          summary.objects_uploaded.push(dstPath);
+        }),
+      { concurrency: UPLOAD_CONCURRENCY },
+    );
+  }
+});
+
+/**
+ * Collect uploadable files under `absRoot`, lexically ordered, mirroring Go's
+ * `fs.WalkDir` + `isUploadableEntry` (`pkg/storage/batch.go:65-131`).
+ *
+ * Parity details:
+ *  - The **root** is resolved with a following stat (Go's `fs.Stat`), so a
+ *    symlinked `objects_path` is followed; a missing/dangling root fails.
+ *  - **Nested** entries use no-follow detection: real directories are descended;
+ *    symlinks are NOT descended — Go's `isUploadableEntry` OPENS the symlink
+ *    target then stats the handle, uploading only a regular file and skipping
+ *    dangling symlinks / symlinks-to-directories / unreadable targets.
+ */
+const collectFiles = (
+  fs: FileSystem.FileSystem,
+  path: Path.Path,
+  output: typeof Output.Service,
+  absRoot: string,
+  displayRoot: string,
+): Effect.Effect<ReadonlyArray<CollectedFile>, PlatformError> =>
+  Effect.gen(function* () {
+    const info = yield* fs.stat(absRoot);
+    if (info.type === "Directory") {
+      return yield* collectDir(fs, path, output, absRoot, displayRoot);
+    }
+    if (info.type === "File") {
+      if (osJunkFileNames.has(path.basename(displayRoot))) {
+        yield* output.raw(`Skipping OS metadata file: ${displayRoot}\n`, "stderr");
+        return [];
+      }
+      return [{ absPath: absRoot, displayPath: displayRoot }];
+    }
+    yield* output.raw(`Skipping non-regular file: ${displayRoot}\n`, "stderr");
+    return [];
+  });
+
+const collectDir = (
+  fs: FileSystem.FileSystem,
+  path: Path.Path,
+  output: typeof Output.Service,
+  absDir: string,
+  displayDir: string,
+): Effect.Effect<ReadonlyArray<CollectedFile>, PlatformError> =>
+  Effect.gen(function* () {
+    const names = [...(yield* fs.readDirectory(absDir))].sort();
+    const collected: Array<CollectedFile> = [];
+    for (const name of names) {
+      const absChild = path.join(absDir, name);
+      const displayChild = path.join(displayDir, name);
+      if (osJunkFileNames.has(name)) {
+        yield* output.raw(`Skipping OS metadata file: ${displayChild}\n`, "stderr");
+        continue;
+      }
+      // `readLink` succeeds only on a symlink — our no-follow detector (Effect's
+      // `stat` follows symlinks and has no `lstat`).
+      const isSymlink = yield* fs.readLink(absChild).pipe(
+        Effect.as(true),
+        Effect.catch(() => Effect.succeed(false)),
+      );
+      if (isSymlink) {
+        // Go `isUploadableEntry` (batch.go:73-84) OPENS the target then stats the
+        // handle; it uploads only a regular file. `stat` alone would queue an
+        // unreadable target and abort later at upload, so mirror Go: open + stat.
+        const targetType = yield* Effect.scoped(
+          Effect.gen(function* () {
+            const handle = yield* fs.open(absChild, { flag: "r" });
+            const targetInfo = yield* handle.stat;
+            return targetInfo.type;
+          }),
+        ).pipe(Effect.catch(() => Effect.succeed("Unknown" as const)));
+        if (targetType === "File") {
+          collected.push({ absPath: absChild, displayPath: displayChild });
+        } else {
+          yield* output.raw(`Skipping non-regular file: ${displayChild}\n`, "stderr");
+        }
+        continue;
+      }
+      const childInfo = yield* fs.stat(absChild);
+      if (childInfo.type === "Directory") {
+        collected.push(...(yield* collectDir(fs, path, output, absChild, displayChild)));
+      } else if (childInfo.type === "File") {
+        collected.push({ absPath: absChild, displayPath: displayChild });
+      } else {
+        yield* output.raw(`Skipping non-regular file: ${displayChild}\n`, "stderr");
+      }
+    }
+    return collected;
+  });
diff --git a/apps/cli/src/legacy/shared/legacy-service-catalog.ts b/apps/cli/src/legacy/shared/legacy-service-catalog.ts
new file mode 100644
index 0000000000..60a675725e
--- /dev/null
+++ b/apps/cli/src/legacy/shared/legacy-service-catalog.ts
@@ -0,0 +1,54 @@
+/**
+ * Per-service identity catalog for the local dev stack — the single source of
+ * truth `start` and `status` both read so they can never drift on container
+ * name suffixes or `--exclude` keys.
+ *
+ * `containerSuffix` matches the suffix strings `legacyServiceContainerIds`/
+ * `localDbContainerId` feed into `legacyServiceContainerName` (`legacy-docker-ids.ts`)
+ * — cross-check by exact string, not by array position, since that function's
+ * array order (Go's `utils.GetDockerIds()`, `apps/cli-go/internal/utils/config.go:82-98`)
+ * differs from this catalog's order.
+ *
+ * `excludeKey` matches `utils.ShortContainerImageName(image)` for each of
+ * `config.Images.Services()` (`apps/cli-go/pkg/config/constants.go:60-76`) — the
+ * value Go's `--exclude` flag and `ExcludableContainers()`
+ * (`apps/cli-go/internal/start/start.go:1297-1303`) match against. Postgres has
+ * no `excludeKey` — it is never excludable in Go.
+ *
+ * Array order matches Go's actual container start sequence
+ * (`apps/cli-go/internal/start/start.go`'s "Start <service>" comments,
+ * lines 293-1267): Postgres, then each service's `if` block in file order.
+ * `startOrder` (1-14) mirrors that same order as an explicit field.
+ */
+export interface LegacyServiceCatalogEntry {
+  /** Stable service key, independent of both the container suffix and the exclude key. */
+  readonly service: string;
+  /** Matches a `legacyServiceContainerIds`/`localDbContainerId` suffix string exactly. */
+  readonly containerSuffix: string;
+  /** `--exclude` key (`utils.ShortContainerImageName`). Absent for Postgres — never excludable. */
+  readonly excludeKey?: string;
+  /** 1-14, matching Go's real container start sequence in `internal/start/start.go`. */
+  readonly startOrder: number;
+}
+
+export const LEGACY_SERVICE_CATALOG: ReadonlyArray<LegacyServiceCatalogEntry> = [
+  { service: "postgres", containerSuffix: "db", startOrder: 1 },
+  { service: "logflare", containerSuffix: "analytics", excludeKey: "logflare", startOrder: 2 },
+  { service: "vector", containerSuffix: "vector", excludeKey: "vector", startOrder: 3 },
+  { service: "kong", containerSuffix: "kong", excludeKey: "kong", startOrder: 4 },
+  { service: "gotrue", containerSuffix: "auth", excludeKey: "gotrue", startOrder: 5 },
+  { service: "mailpit", containerSuffix: "inbucket", excludeKey: "mailpit", startOrder: 6 },
+  { service: "realtime", containerSuffix: "realtime", excludeKey: "realtime", startOrder: 7 },
+  { service: "postgrest", containerSuffix: "rest", excludeKey: "postgrest", startOrder: 8 },
+  { service: "storage", containerSuffix: "storage", excludeKey: "storage-api", startOrder: 9 },
+  { service: "imgproxy", containerSuffix: "imgproxy", excludeKey: "imgproxy", startOrder: 10 },
+  {
+    service: "edgeRuntime",
+    containerSuffix: "edge_runtime",
+    excludeKey: "edge-runtime",
+    startOrder: 11,
+  },
+  { service: "pgMeta", containerSuffix: "pg_meta", excludeKey: "postgres-meta", startOrder: 12 },
+  { service: "studio", containerSuffix: "studio", excludeKey: "studio", startOrder: 13 },
+  { service: "supavisor", containerSuffix: "pooler", excludeKey: "supavisor", startOrder: 14 },
+];
diff --git a/apps/cli/src/legacy/shared/legacy-service-catalog.unit.test.ts b/apps/cli/src/legacy/shared/legacy-service-catalog.unit.test.ts
new file mode 100644
index 0000000000..d945de9d98
--- /dev/null
+++ b/apps/cli/src/legacy/shared/legacy-service-catalog.unit.test.ts
@@ -0,0 +1,70 @@
+import { describe, expect, it } from "vitest";
+
+import { legacyServiceContainerIds, localDbContainerId } from "./legacy-docker-ids.ts";
+import { LEGACY_SERVICE_CATALOG } from "./legacy-service-catalog.ts";
+
+describe("LEGACY_SERVICE_CATALOG", () => {
+  it("has exactly 13 excludable entries and 1 non-excludable entry (Postgres)", () => {
+    const withExcludeKey = LEGACY_SERVICE_CATALOG.filter((entry) => entry.excludeKey !== undefined);
+    const withoutExcludeKey = LEGACY_SERVICE_CATALOG.filter(
+      (entry) => entry.excludeKey === undefined,
+    );
+    expect(withExcludeKey).toHaveLength(13);
+    expect(withoutExcludeKey).toHaveLength(1);
+    expect(withoutExcludeKey[0]?.service).toBe("postgres");
+  });
+
+  it("has no duplicate containerSuffix, excludeKey, or startOrder values", () => {
+    const suffixes = LEGACY_SERVICE_CATALOG.map((entry) => entry.containerSuffix);
+    const excludeKeys = LEGACY_SERVICE_CATALOG.filter(
+      (entry) => entry.excludeKey !== undefined,
+    ).map((entry) => entry.excludeKey);
+    const startOrders = LEGACY_SERVICE_CATALOG.map((entry) => entry.startOrder);
+
+    expect(new Set(suffixes).size).toBe(suffixes.length);
+    expect(new Set(excludeKeys).size).toBe(excludeKeys.length);
+    expect(new Set(startOrders).size).toBe(startOrders.length);
+  });
+
+  it("uses startOrder values 1-14 with no gaps", () => {
+    const startOrders = LEGACY_SERVICE_CATALOG.map((entry) => entry.startOrder).sort(
+      (a, b) => a - b,
+    );
+    expect(startOrders).toEqual(Array.from({ length: 14 }, (_, index) => index + 1));
+  });
+
+  it("is ordered by ascending startOrder", () => {
+    const startOrders = LEGACY_SERVICE_CATALOG.map((entry) => entry.startOrder);
+    expect(startOrders).toEqual([...startOrders].sort((a, b) => a - b));
+  });
+
+  it("has no duplicate service keys", () => {
+    const services = LEGACY_SERVICE_CATALOG.map((entry) => entry.service);
+    expect(new Set(services).size).toBe(services.length);
+  });
+
+  it("every non-Postgres containerSuffix matches a legacyServiceContainerIds suffix", () => {
+    // legacyServiceContainerIds bakes its suffixes into the returned container
+    // ids, so recover them by stripping the shared "supabase_" prefix and
+    // "_<projectId>" suffix for a fixed project id.
+    const projectId = "catalog-cross-check";
+    const containerIds = legacyServiceContainerIds(projectId);
+    const suffixesFromContainerIds = containerIds.map((id) =>
+      id.replace(/^supabase_/, "").replace(new RegExp(`_${projectId}$`), ""),
+    );
+
+    for (const entry of LEGACY_SERVICE_CATALOG) {
+      if (entry.service === "postgres") continue;
+      expect(suffixesFromContainerIds).toContain(entry.containerSuffix);
+    }
+  });
+
+  it("Postgres's containerSuffix matches localDbContainerId's suffix", () => {
+    const projectId = "catalog-cross-check";
+    const postgresEntry = LEGACY_SERVICE_CATALOG.find((entry) => entry.service === "postgres");
+    expect(postgresEntry?.containerSuffix).toBe("db");
+    expect(localDbContainerId(projectId)).toBe(
+      `supabase_${postgresEntry?.containerSuffix}_${projectId}`,
+    );
+  });
+});
diff --git a/apps/cli/src/legacy/shared/legacy-service-version-overrides.ts b/apps/cli/src/legacy/shared/legacy-service-version-overrides.ts
new file mode 100644
index 0000000000..2f27c40b52
--- /dev/null
+++ b/apps/cli/src/legacy/shared/legacy-service-version-overrides.ts
@@ -0,0 +1,60 @@
+import { Effect, FileSystem, Path } from "effect";
+import type { LocalServiceVersionOverrides } from "../../shared/services/services.shared.ts";
+import { legacyTempPaths } from "./legacy-temp-paths.ts";
+
+/**
+ * `supabase/.temp/{gotrue,rest,storage,realtime,studio,pgmeta,logflare,pooler}-version`
+ * pin files — written by `supabase link` for a linked/bootstrap project, read
+ * by Go's `Config.Load` to rewrite `c.Auth.Image`/`c.Api.Image`/etc. before any
+ * command that pulls or starts these services (`apps/cli-go/pkg/config/
+ * config.go:827-863`). `gotrue`/`postgrest` are additionally gated on
+ * `majorVersion > 14`, mirroring Go's same condition there.
+ */
+const LEGACY_VERSION_FILES = [
+  ["auth", "gotrue-version", (majorVersion: number | undefined) => (majorVersion ?? 17) > 14],
+  ["postgrest", "rest-version", (majorVersion: number | undefined) => (majorVersion ?? 17) > 14],
+  ["storage", "storage-version"],
+  ["realtime", "realtime-version"],
+  ["studio", "studio-version"],
+  ["pgmeta", "pgmeta-version"],
+  ["analytics", "logflare-version"],
+  ["pooler", "pooler-version"],
+] as const satisfies ReadonlyArray<
+  readonly [
+    "auth" | "postgrest" | "storage" | "realtime" | "studio" | "pgmeta" | "analytics" | "pooler",
+    string,
+    ((majorVersion: number | undefined) => boolean)?,
+  ]
+>;
+
+/**
+ * Reads every linked-service version pin present under `<workdir>/supabase/
+ * .temp/`, returning only the services whose pin file exists and is
+ * non-blank. Any read error (including not-exist) resolves to "" for that
+ * file, matching Go's `err == nil && len(version) > 0` gate.
+ */
+export const legacyReadServiceVersionOverrides = Effect.fnUntraced(function* (
+  fs: FileSystem.FileSystem,
+  path: Path.Path,
+  workdir: string,
+  majorVersion: number | undefined,
+) {
+  const paths = legacyTempPaths(path, workdir);
+  const versions: LocalServiceVersionOverrides = {};
+
+  for (const [service, fileName, shouldRead] of LEGACY_VERSION_FILES) {
+    if (shouldRead !== undefined && !shouldRead(majorVersion)) {
+      continue;
+    }
+
+    const version = yield* fs.readFileString(path.join(paths.tempDir, fileName)).pipe(
+      Effect.map((content) => content.trim()),
+      Effect.orElseSucceed(() => ""),
+    );
+    if (version.length > 0) {
+      versions[service] = version;
+    }
+  }
+
+  return versions;
+});
diff --git a/apps/cli/src/legacy/shared/legacy-start-secrets-cleanup.ts b/apps/cli/src/legacy/shared/legacy-start-secrets-cleanup.ts
new file mode 100644
index 0000000000..bff5bee23f
--- /dev/null
+++ b/apps/cli/src/legacy/shared/legacy-start-secrets-cleanup.ts
@@ -0,0 +1,71 @@
+import { rm } from "node:fs/promises";
+import { join } from "node:path";
+
+import { Effect } from "effect";
+
+import type { LegacyContainerIdName } from "./legacy-docker-lifecycle.ts";
+
+/**
+ * Best-effort removal of `legacyStageStartSecretFiles`'s
+ * (`legacy/commands/start/lib/container-lifecycle.ts`) per-container
+ * staged-secret directories for every container in `containers` — plaintext
+ * JWT/TLS/pgsodium/pooler secret material `start` stages on host disk (Kong,
+ * Postgres, Supavisor) that otherwise survives indefinitely, since neither
+ * `stop` nor a failed-start rollback previously touched
+ * `<workdir>/supabase/.temp/start-secrets/`. There is no Go behavior to
+ * match here — Go never stages secrets on host disk in the first place (it
+ * injects them into `container.Config.Cmd`/`Entrypoint` directly via the
+ * Docker Engine API) — this is a TS-port-only hygiene fix.
+ *
+ * Hoisted here (`legacy/shared/`) per `apps/cli/CLAUDE.md`'s "Hoist Before
+ * You Duplicate" rule: both `start`'s own rollback (`start.rollback.ts`) and
+ * `stop` (`stop.handler.ts`) need this same cleanup.
+ *
+ * Each container's own directory is resolved as `<workdir>/supabase/.temp/
+ * start-secrets/<name>`, where `workdir` is that container's own
+ * `LEGACY_CLI_WORKDIR_LABEL` value (see that constant's doc comment) — NOT
+ * necessarily `fallbackWorkdir` (the caller's own `LegacyCliConfig.workdir`).
+ * A caller tearing down containers by an explicit `--project-id`/`--all`
+ * filter may be tearing down a DIFFERENT project's containers than the one
+ * its own cwd/`--workdir` points at, so using the caller's workdir
+ * unconditionally would look in the wrong directory and silently orphan that
+ * project's staged secret files. `fallbackWorkdir` is used only for a
+ * container whose own label is empty — created before this label existed
+ * (or by a Go binary, which never sets it).
+ *
+ * `containers` MUST be exactly the containers Docker itself reported as
+ * matching the same label filter the caller just tore down, and only once
+ * that teardown is CONFIRMED complete (`legacyDockerRemoveAll`'s
+ * `onContainersRemoved` hook) — never independently reconstructed/guessed,
+ * and never a pre-teardown snapshot, since a container that a later stage
+ * failed to actually remove must keep its secrets. This also avoids a
+ * blanket delete of the whole `start-secrets/` parent directory, which would
+ * be unsafe if a workdir's project id ever changed across `start` runs
+ * without an intervening `stop`: that parent could then hold subdirectories
+ * for more than one project id, some possibly still backing a live
+ * `restartPolicy: "unless-stopped"` container a narrower `stop
+ * --project-id`/rollback isn't tearing down.
+ *
+ * Never fails: a directory that was never staged (every service besides
+ * Kong/Postgres/Supavisor) is a harmless no-op, and a real deletion error is
+ * not worth failing `stop`/rollback over.
+ */
+export function legacyCleanupStartSecrets(
+  containers: ReadonlyArray<LegacyContainerIdName>,
+  fallbackWorkdir: string,
+): Effect.Effect<void> {
+  return Effect.tryPromise(() =>
+    Promise.all(
+      containers.map((container) => {
+        const workdir = container.workdir.length > 0 ? container.workdir : fallbackWorkdir;
+        return rm(join(workdir, "supabase", ".temp", "start-secrets", container.name), {
+          recursive: true,
+          force: true,
+        });
+      }),
+    ),
+  ).pipe(
+    Effect.asVoid,
+    Effect.orElseSucceed(() => undefined),
+  );
+}
diff --git a/apps/cli/src/legacy/shared/legacy-status-errors.ts b/apps/cli/src/legacy/shared/legacy-status-errors.ts
new file mode 100644
index 0000000000..9e72e14fbb
--- /dev/null
+++ b/apps/cli/src/legacy/shared/legacy-status-errors.ts
@@ -0,0 +1,58 @@
+import { Data } from "effect";
+
+/**
+ * An explicit `--workdir`/`SUPABASE_WORKDIR` path doesn't exist or isn't a
+ * directory. Mirrors Go's `ChangeWorkDir` (`apps/cli-go/internal/utils/misc.go:
+ * 231-250`), which unconditionally `os.Chdir(workdir)`s in `PersistentPreRunE`
+ * (`apps/cli-go/cmd/root.go:93-105`) — before `status`'s own `PreRunE`
+ * (override-name parsing) or `RunE`, so a bad explicit workdir must fail here
+ * first, before config load or any Docker access.
+ */
+export class LegacyStatusWorkdirError extends Data.TaggedError("LegacyStatusWorkdirError")<{
+  readonly message: string;
+}> {}
+
+/** `loadProjectConfig` rejected `supabase/config.toml` (malformed TOML/JSON). */
+export class LegacyStatusConfigLoadError extends Data.TaggedError("LegacyStatusConfigLoadError")<{
+  readonly message: string;
+}> {}
+
+/** A `--override-name KEY=VALUE` entry did not parse, mirroring `env.EnvironToEnvSet`. */
+export class LegacyStatusOverrideParseError extends Data.TaggedError(
+  "LegacyStatusOverrideParseError",
+)<{
+  readonly message: string;
+}> {}
+
+/** Inspecting the db container failed for a reason other than "not found". */
+export class LegacyStatusDbInspectError extends Data.TaggedError("LegacyStatusDbInspectError")<{
+  readonly message: string;
+}> {}
+
+/** The db container is absent or present but not in the `running` state. */
+export class LegacyStatusDbNotRunningError extends Data.TaggedError(
+  "LegacyStatusDbNotRunningError",
+)<{
+  readonly message: string;
+}> {}
+
+/** The db container is running but its Docker health check is not `healthy`. */
+export class LegacyStatusDbNotReadyError extends Data.TaggedError("LegacyStatusDbNotReadyError")<{
+  readonly message: string;
+}> {}
+
+/** Listing running containers by label failed. */
+export class LegacyStatusListError extends Data.TaggedError("LegacyStatusListError")<{
+  readonly message: string;
+}> {}
+
+/**
+ * `config.toml` resolved to a value `Config.Validate` would reject before status
+ * ever renders — e.g. an `auth.jwt_secret` shorter than 16 characters
+ * (`pkg/config/apikeys.go:45-47`).
+ */
+export class LegacyStatusInvalidConfigError extends Data.TaggedError(
+  "LegacyStatusInvalidConfigError",
+)<{
+  readonly message: string;
+}> {}
diff --git a/apps/cli/src/legacy/shared/legacy-status-pretty.ts b/apps/cli/src/legacy/shared/legacy-status-pretty.ts
new file mode 100644
index 0000000000..366049526e
--- /dev/null
+++ b/apps/cli/src/legacy/shared/legacy-status-pretty.ts
@@ -0,0 +1,276 @@
+import { legacyAqua, legacyBold, legacyGreen, legacyYellow } from "./legacy-colors.ts";
+import type { LegacyStatusOutputNames } from "./legacy-status-values.ts";
+
+/**
+ * Port of Go's `PrettyPrint` / `OutputGroup.printTable`
+ * (`apps/cli-go/internal/status/status.go:236-392`), reproducing
+ * `tablewriter.NewTable` with `tw.StyleRounded` byte-for-byte for the fixed
+ * 5-group, 2-column layout `status` needs. This is not a general tablewriter
+ * port — column sizing, wrapping, and merge behavior are only implemented to the
+ * extent this command's rounded box needs them.
+ *
+ * Column 0 (the label column) is capped at 16 display columns
+ * (`ColMaxWidths.PerColumn[0] = 16`, `status.go:344`); a label wider than that
+ * word-wraps across multiple lines, leaving column 1 blank on the continuation
+ * lines (verified against a real `tablewriter@v1.1.4` render — see the port
+ * plan). None of the fixed labels below reach 17 characters today, so this is
+ * defensive parity rather than an observed case.
+ *
+ * This does not reuse `legacy/output/legacy-glamour-table.ts` — that helper
+ * byte-matches Go's `glamour.RenderTable(..., AsciiStyle)`, a single ASCII table
+ * with a different border style used by other commands. `status`'s Go source
+ * renders with `tablewriter`/`tw.StyleRounded` into 5 separate grouped, colored,
+ * Unicode-rounded-box tables, which is a different rendering contract entirely.
+ *
+ * Every color call below styles text written to **stdout** (via `output.raw`
+ * with no stream argument in `status.handler.ts`), so each one explicitly passes
+ * `process.stdout` to `legacy-colors.ts`'s helpers — they default to
+ * `process.stderr`, which would check the wrong stream's TTY status here.
+ */
+
+type OutputKind = "text" | "link" | "key";
+
+interface OutputItem {
+  readonly label: string;
+  readonly value: string;
+  readonly kind: OutputKind;
+}
+
+interface OutputGroup {
+  readonly name: string;
+  readonly items: ReadonlyArray<OutputItem>;
+}
+
+const COLUMN_0_MAX_WIDTH = 16;
+
+/**
+ * Builds the 5 fixed groups Go's `PrettyPrint` declares (`status.go:245-285`),
+ * looking up each label's value by output KEY from the resolved value map —
+ * `--override-name` remaps the KEY but never the group layout, matching Go
+ * (`values[names.StudioURL]`, not a hardcoded default name).
+ */
+function buildGroups(
+  values: Readonly<Record<string, string>>,
+  names: LegacyStatusOutputNames,
+): ReadonlyArray<OutputGroup> {
+  const at = (key: string) => values[key] ?? "";
+  return [
+    {
+      name: "🔧 Development Tools",
+      items: [
+        { label: "Studio", value: at(names.studioUrl), kind: "link" },
+        { label: "Mailpit", value: at(names.mailpitUrl), kind: "link" },
+        { label: "MCP", value: at(names.mcpUrl), kind: "link" },
+      ],
+    },
+    {
+      name: "🌐 APIs",
+      items: [
+        { label: "Project URL", value: at(names.apiUrl), kind: "link" },
+        { label: "REST", value: at(names.restUrl), kind: "link" },
+        { label: "GraphQL", value: at(names.graphqlUrl), kind: "link" },
+        { label: "Edge Functions", value: at(names.functionsUrl), kind: "link" },
+      ],
+    },
+    {
+      name: "⛁ Database",
+      items: [{ label: "URL", value: at(names.dbUrl), kind: "link" }],
+    },
+    {
+      name: "🔑 Authentication Keys",
+      items: [
+        { label: "Publishable", value: at(names.publishableKey), kind: "key" },
+        { label: "Secret", value: at(names.secretKey), kind: "key" },
+      ],
+    },
+    {
+      name: "📦 Storage (S3)",
+      items: [
+        { label: "URL", value: at(names.storageS3Url), kind: "link" },
+        { label: "Access Key", value: at(names.storageS3AccessKeyId), kind: "key" },
+        { label: "Secret Key", value: at(names.storageS3SecretAccessKey), kind: "key" },
+        { label: "Region", value: at(names.storageS3Region), kind: "text" },
+      ],
+    },
+  ];
+}
+
+/**
+ * Display width, matching `go-runewidth`'s treatment closely enough for this
+ * command's inputs: URLs/keys/labels are always plain ASCII, so every rune is
+ * width 1. The only non-ASCII runes ever rendered are the 5 fixed group-title
+ * emoji, whose exact rendered widths are hardcoded in {@link HEADER_DISPLAY_WIDTH}
+ * below rather than computed generically (avoids taking a full Unicode
+ * East-Asian-Width dependency for a 5-value constant table).
+ */
+function displayWidth(text: string): number {
+  return [...text].length;
+}
+
+/** Go-rendered display width of each fixed group title (see `status.pretty.unit.test.ts`). */
+const HEADER_DISPLAY_WIDTH: Readonly<Record<string, number>> = {
+  "🔧 Development Tools": 20,
+  "🌐 APIs": 7,
+  "⛁ Database": 10,
+  "🔑 Authentication Keys": 22,
+  "📦 Storage (S3)": 15,
+};
+
+/**
+ * Exported only for direct unit coverage of the fallback branch (a group title
+ * outside the 5-entry {@link HEADER_DISPLAY_WIDTH} table) — every call site in
+ * this file only ever passes one of those 5 fixed titles.
+ */
+export function legacyStatusHeaderWidth(name: string): number {
+  return HEADER_DISPLAY_WIDTH[name] ?? displayWidth(name);
+}
+
+/**
+ * Greedy word-wrap to `width` columns, mirroring tablewriter's column wrapping.
+ * Exported only for direct unit coverage of the >16-char defensive-wrap branch
+ * (see the file-level doc comment) — none of this command's real labels reach
+ * that width today, so `legacyRenderStatusPretty` never exercises it end to end.
+ */
+export function legacyWrapStatusLabel(text: string, width: number): ReadonlyArray<string> {
+  if (displayWidth(text) <= width) return [text];
+  const words = text.split(" ");
+  const lines: string[] = [];
+  let current = "";
+  for (const word of words) {
+    const candidate = current.length === 0 ? word : `${current} ${word}`;
+    if (displayWidth(candidate) <= width) {
+      current = candidate;
+    } else {
+      if (current.length > 0) lines.push(current);
+      current = word;
+    }
+  }
+  if (current.length > 0) lines.push(current);
+  return lines.length > 0 ? lines : [text];
+}
+
+/**
+ * Value coloring, mirroring the `switch row.Type` in `printTable`
+ * (`status.go:372-377`): `Link` → Aqua, `Key` → Yellow, `Text` → unstyled (the
+ * switch has no `Text` case, so `value` keeps its raw pre-switch assignment).
+ */
+function colorValue(kind: OutputKind, value: string): string {
+  switch (kind) {
+    case "link":
+      return legacyAqua(value, process.stdout);
+    case "key":
+      return legacyYellow(value, process.stdout);
+    case "text":
+      return value;
+  }
+}
+
+interface ColumnLayout {
+  readonly col0Padded: number;
+  readonly col1Padded: number;
+  readonly targetInner: number;
+}
+
+/**
+ * Computes the padded column widths and total inner (header) width for a group,
+ * mirroring tablewriter's column-sizing pass: each column is sized from its
+ * widest content cell (col 0 capped at 16), then both columns widen evenly
+ * (col 0 taking the larger half of an odd remainder) if the header text is
+ * wider than the data-driven layout. Exported only for direct unit coverage of
+ * the header-widens-the-table branch — none of this command's 5 fixed group
+ * titles are wider than their data today, so `legacyRenderStatusPretty` never
+ * exercises it end to end (see the file-level doc comment).
+ */
+export function legacyStatusColumnLayout(
+  headerWidthValue: number,
+  col0Contents: ReadonlyArray<string>,
+  col1Contents: ReadonlyArray<string>,
+): ColumnLayout {
+  const col0Content = Math.min(
+    COLUMN_0_MAX_WIDTH,
+    Math.max(...col0Contents.map((text) => displayWidth(text))),
+  );
+  const col1Content = Math.max(...col1Contents.map((text) => displayWidth(text)));
+
+  let col0Padded = col0Content + 2;
+  let col1Padded = col1Content + 2;
+  const dataInner = col0Padded + 1 + col1Padded;
+  const targetInner = Math.max(dataInner, headerWidthValue + 2);
+  const extra = targetInner - dataInner;
+  if (extra > 0) {
+    col0Padded += Math.ceil(extra / 2);
+    col1Padded += Math.floor(extra / 2);
+  }
+  return { col0Padded, col1Padded, targetInner };
+}
+
+function renderGroupTable(group: OutputGroup): string | undefined {
+  const rows = group.items.filter((item) => item.value.length > 0);
+  if (rows.length === 0) return undefined;
+
+  // Column 0 wraps at 16; column 1 is never capped (Go only sets PerColumn[0]).
+  // Kept as plain text here — color is applied only after padding, below, so an
+  // ANSI escape is never counted toward the padded display width.
+  const wrappedRows = rows.map((row) => ({
+    lines: legacyWrapStatusLabel(row.label, COLUMN_0_MAX_WIDTH),
+    kind: row.kind,
+    value: row.value,
+  }));
+
+  const { col0Padded, col1Padded, targetInner } = legacyStatusColumnLayout(
+    legacyStatusHeaderWidth(group.name),
+    rows.map((row) => row.label),
+    rows.map((row) => row.value),
+  );
+  const col0Width = col0Padded - 2;
+  const col1Width = col1Padded - 2;
+
+  // Pad on the plain text first, then apply color/bold — an active ANSI escape
+  // must never be counted toward the padded display width.
+  const pad = (text: string, width: number) =>
+    text + " ".repeat(Math.max(0, width - displayWidth(text)));
+  // The header uses `headerWidth` (the hardcoded emoji-aware width table) rather
+  // than `displayWidth`, so its padding lines up with the border math above,
+  // which sized `targetInner` off the same `headerWidth` call.
+  const padHeader = (text: string, width: number) =>
+    text + " ".repeat(Math.max(0, width - legacyStatusHeaderWidth(text)));
+
+  const lines: string[] = [];
+  lines.push(`╭${"─".repeat(col0Padded + 1 + col1Padded)}╮`);
+  lines.push(`│ ${legacyBold(padHeader(group.name, targetInner - 2), process.stdout)} │`);
+  lines.push(`├${"─".repeat(col0Padded)}┬${"─".repeat(col1Padded)}┤`);
+  for (const row of wrappedRows) {
+    row.lines.forEach((line, index) => {
+      // Only the first wrapped line carries the value; Go's continuation lines
+      // (from a >16-char label wrapping) leave column 1 blank.
+      const labelCell = legacyGreen(pad(line, col0Width), process.stdout);
+      const paddedValue = pad(index === 0 ? row.value : "", col1Width);
+      const valueCell = index === 0 ? colorValue(row.kind, paddedValue) : paddedValue;
+      lines.push(`│ ${labelCell} │ ${valueCell} │`);
+    });
+  }
+  lines.push(`╰${"─".repeat(col0Padded)}┴${"─".repeat(col1Padded)}╯`);
+  return lines.join("\n");
+}
+
+/**
+ * Port of Go's `PrettyPrint` (`status.go:236-294`): renders the 5 fixed groups
+ * as rounded-border tables, skipping empty rows and empty groups, with a blank
+ * line after every group (rendered or not — Go's loop always
+ * `fmt.Fprintln(w)`s after a nil-error `printTable`, even when nothing rendered).
+ */
+export function legacyRenderStatusPretty(
+  values: Readonly<Record<string, string>>,
+  names: LegacyStatusOutputNames,
+): string {
+  const groups = buildGroups(values, names);
+  const lines: string[] = [];
+  for (const group of groups) {
+    const table = renderGroupTable(group);
+    if (table !== undefined) {
+      lines.push(table);
+    }
+    lines.push("");
+  }
+  return lines.join("\n");
+}
diff --git a/apps/cli/src/legacy/shared/legacy-status-pretty.unit.test.ts b/apps/cli/src/legacy/shared/legacy-status-pretty.unit.test.ts
new file mode 100644
index 0000000000..51337df7e5
--- /dev/null
+++ b/apps/cli/src/legacy/shared/legacy-status-pretty.unit.test.ts
@@ -0,0 +1,267 @@
+import { describe, expect, it } from "vitest";
+
+import {
+  legacyRenderStatusPretty,
+  legacyStatusColumnLayout,
+  legacyStatusHeaderWidth,
+  legacyWrapStatusLabel,
+} from "./legacy-status-pretty.ts";
+import type { LegacyStatusOutputNames } from "./legacy-status-values.ts";
+
+// The renderer applies Go-parity ANSI styling via `legacy-colors.ts`, which
+// no-ops on a real non-TTY stream but the vitest process presents its stderr
+// as color-capable. Strip escapes so these assertions target the plain
+// structural output — the golden contract per the port plan — not whichever
+// TTY heuristic the test runner happens to report.
+// eslint-disable-next-line no-control-regex
+const stripAnsi = (text: string) => text.replace(/\x1b\[[0-9;]*m/gu, "");
+
+// Default (un-overridden) output names, matching `legacy-status-values.ts`'s
+// `resolveOutputNames` with an empty override map — the KEYs the pretty
+// renderer looks values up by.
+const NAMES: LegacyStatusOutputNames = {
+  apiUrl: "API_URL",
+  restUrl: "REST_URL",
+  graphqlUrl: "GRAPHQL_URL",
+  storageS3Url: "STORAGE_S3_URL",
+  mcpUrl: "MCP_URL",
+  functionsUrl: "FUNCTIONS_URL",
+  dbUrl: "DB_URL",
+  studioUrl: "STUDIO_URL",
+  mailpitUrl: "MAILPIT_URL",
+  publishableKey: "PUBLISHABLE_KEY",
+  secretKey: "SECRET_KEY",
+  storageS3AccessKeyId: "S3_PROTOCOL_ACCESS_KEY_ID",
+  storageS3SecretAccessKey: "S3_PROTOCOL_ACCESS_KEY_SECRET",
+  storageS3Region: "S3_PROTOCOL_REGION",
+};
+
+const FULL_VALUES: Record<string, string> = {
+  API_URL: "http://127.0.0.1:54321",
+  REST_URL: "http://127.0.0.1:54321/rest/v1",
+  GRAPHQL_URL: "http://127.0.0.1:54321/graphql/v1",
+  STORAGE_S3_URL: "http://127.0.0.1:54321/storage/v1/s3",
+  MCP_URL: "http://127.0.0.1:54321/mcp",
+  FUNCTIONS_URL: "http://127.0.0.1:54321/functions/v1",
+  DB_URL: "postgresql://postgres:postgres@127.0.0.1:54322/postgres",
+  STUDIO_URL: "http://127.0.0.1:54323",
+  MAILPIT_URL: "http://127.0.0.1:54324",
+  PUBLISHABLE_KEY: "sb_publishable_ACJWlzQHlZjBrEguHvfOxg_3BJgxAaH",
+  SECRET_KEY: "sb_secret_N7UND0UgjKTVK-Uodkm0Hg_xSvEMPvz",
+  S3_PROTOCOL_ACCESS_KEY_ID: "625729a08b95bf1b7ff351a663f3a23c",
+  S3_PROTOCOL_ACCESS_KEY_SECRET: "850181e4652dd023b7a98c58ae0d2d34bd487ee0cc3254aed6eda37307425907",
+  S3_PROTOCOL_REGION: "local",
+};
+
+describe("legacyRenderStatusPretty", () => {
+  // Byte-for-byte parity with a real `tablewriter@v1.1.4` + `tw.StyleRounded`
+  // render of Go's `PrettyPrint` group layout (verified by running the actual
+  // vendored Go module against this exact value set — see the port plan).
+  it("matches the Go rounded-table fixture for a fully running stack", () => {
+    const out = stripAnsi(legacyRenderStatusPretty(FULL_VALUES, NAMES));
+
+    const expected = [
+      "╭──────────────────────────────────────╮",
+      "│ 🔧 Development Tools                 │",
+      "├─────────┬────────────────────────────┤",
+      "│ Studio  │ http://127.0.0.1:54323     │",
+      "│ Mailpit │ http://127.0.0.1:54324     │",
+      "│ MCP     │ http://127.0.0.1:54321/mcp │",
+      "╰─────────┴────────────────────────────╯",
+      "",
+      "╭──────────────────────────────────────────────────────╮",
+      "│ 🌐 APIs                                              │",
+      "├────────────────┬─────────────────────────────────────┤",
+      "│ Project URL    │ http://127.0.0.1:54321              │",
+      "│ REST           │ http://127.0.0.1:54321/rest/v1      │",
+      "│ GraphQL        │ http://127.0.0.1:54321/graphql/v1   │",
+      "│ Edge Functions │ http://127.0.0.1:54321/functions/v1 │",
+      "╰────────────────┴─────────────────────────────────────╯",
+      "",
+      "╭───────────────────────────────────────────────────────────────╮",
+      "│ ⛁ Database                                                    │",
+      "├─────┬─────────────────────────────────────────────────────────┤",
+      "│ URL │ postgresql://postgres:postgres@127.0.0.1:54322/postgres │",
+      "╰─────┴─────────────────────────────────────────────────────────╯",
+      "",
+      "╭──────────────────────────────────────────────────────────────╮",
+      "│ 🔑 Authentication Keys                                       │",
+      "├─────────────┬────────────────────────────────────────────────┤",
+      "│ Publishable │ sb_publishable_ACJWlzQHlZjBrEguHvfOxg_3BJgxAaH │",
+      "│ Secret      │ sb_secret_N7UND0UgjKTVK-Uodkm0Hg_xSvEMPvz      │",
+      "╰─────────────┴────────────────────────────────────────────────╯",
+      "",
+      "╭───────────────────────────────────────────────────────────────────────────────╮",
+      "│ 📦 Storage (S3)                                                               │",
+      "├────────────┬──────────────────────────────────────────────────────────────────┤",
+      "│ URL        │ http://127.0.0.1:54321/storage/v1/s3                             │",
+      "│ Access Key │ 625729a08b95bf1b7ff351a663f3a23c                                 │",
+      "│ Secret Key │ 850181e4652dd023b7a98c58ae0d2d34bd487ee0cc3254aed6eda37307425907 │",
+      "│ Region     │ local                                                            │",
+      "╰────────────┴──────────────────────────────────────────────────────────────────╯",
+      "",
+    ].join("\n");
+
+    expect(out).toBe(expected);
+  });
+
+  // Byte-for-byte parity with a real render of a single-row group (Database),
+  // confirming the header-vs-single-short-row column sizing. All other groups
+  // are empty in this fixture, so only the Database box should appear.
+  it("matches the Go rounded-table fixture for a single-row group", () => {
+    const out = stripAnsi(
+      legacyRenderStatusPretty({ DB_URL: FULL_VALUES.DB_URL ?? "" }, { ...NAMES, dbUrl: "DB_URL" }),
+    );
+
+    const expectedTable = [
+      "╭───────────────────────────────────────────────────────────────╮",
+      "│ ⛁ Database                                                    │",
+      "├─────┬─────────────────────────────────────────────────────────┤",
+      "│ URL │ postgresql://postgres:postgres@127.0.0.1:54322/postgres │",
+      "╰─────┴─────────────────────────────────────────────────────────╯",
+    ].join("\n");
+
+    expect(out).toContain(expectedTable);
+    expect(out).toBe(["", "", expectedTable, "", "", ""].join("\n"));
+  });
+
+  // All other groups are empty in this fixture, so only the APIs box appears
+  // (only Project URL, the rest of the group's rows are excluded/disabled).
+  it("matches the Go rounded-table fixture for a partial APIs group", () => {
+    const out = stripAnsi(legacyRenderStatusPretty({ API_URL: "http://127.0.0.1:54321" }, NAMES));
+
+    const expectedTable = [
+      "╭──────────────────────────────────────╮",
+      "│ 🌐 APIs                              │",
+      "├─────────────┬────────────────────────┤",
+      "│ Project URL │ http://127.0.0.1:54321 │",
+      "╰─────────────┴────────────────────────╯",
+    ].join("\n");
+
+    expect(out).toBe(["", expectedTable, "", "", "", ""].join("\n"));
+  });
+
+  it("skips a row whose value is missing from the value map", () => {
+    // Only Studio present; Mailpit/MCP absent from the map entirely (excluded
+    // or disabled upstream in `legacy-status-values.ts`) — same as an empty string.
+    const out = stripAnsi(
+      legacyRenderStatusPretty({ STUDIO_URL: "http://127.0.0.1:54323" }, NAMES),
+    );
+
+    expect(out).toContain("Studio");
+    expect(out).not.toContain("Mailpit");
+    expect(out).not.toContain("MCP");
+  });
+
+  it("skips an entirely empty group but still emits its trailing blank line", () => {
+    // Nothing present for Development Tools; only the Database URL is set.
+    const out = stripAnsi(legacyRenderStatusPretty({ DB_URL: FULL_VALUES.DB_URL ?? "" }, NAMES));
+    const lines = out.split("\n");
+
+    // No rounded-box characters before the Database group's own box.
+    expect(lines[0]).not.toMatch(/[╭│╰]/);
+    expect(lines[0]).toBe("");
+    expect(out).not.toContain("Development Tools");
+    expect(out).toContain("⛁ Database");
+  });
+
+  it("returns only blank lines when every group is empty", () => {
+    const out = stripAnsi(legacyRenderStatusPretty({}, NAMES));
+    // One blank line per group (5 groups), none of them rendering a table.
+    expect(out).toBe(["", "", "", "", ""].join("\n"));
+  });
+
+  // `legacyRenderStatusPretty` is a pure lookup: it renders whatever `values`
+  // are reachable through `names`' keys, with no opinion on how the caller
+  // derived either. This is NOT asserting that `--override-name` reaches
+  // pretty-mode output in production — `status.handler.ts` deliberately always
+  // calls this function with un-overridden names (matching Go's `PrettyPrint`,
+  // which unmarshals a fresh empty `EnvSet{}` rather than the CLI's overridden
+  // `CustomName`). This test only proves the renderer's KEY-based lookup itself
+  // works correctly for an arbitrary names/values pairing.
+  it("resolves values through whatever KEY the names parameter specifies", () => {
+    const overriddenNames: LegacyStatusOutputNames = {
+      ...NAMES,
+      apiUrl: "NEXT_PUBLIC_SUPABASE_URL",
+    };
+    const out = stripAnsi(
+      legacyRenderStatusPretty(
+        { NEXT_PUBLIC_SUPABASE_URL: "http://127.0.0.1:54321" },
+        overriddenNames,
+      ),
+    );
+    expect(out).toContain("http://127.0.0.1:54321");
+  });
+});
+
+// None of `status`'s 18 fixed field labels or 5 fixed group titles are wide
+// enough to exercise these two branches through the public
+// `legacyRenderStatusPretty` API today (see the file-level doc comment on
+// `legacy-status-pretty.ts`) — covered directly here as defensive Go-parity logic.
+describe("legacyWrapStatusLabel", () => {
+  it("returns the text unwrapped when it fits within the width", () => {
+    expect(legacyWrapStatusLabel("Edge Functions", 16)).toEqual(["Edge Functions"]);
+  });
+
+  it("word-wraps a label wider than the column width", () => {
+    expect(legacyWrapStatusLabel("This Is A Very Long Label Name", 16)).toEqual([
+      "This Is A Very",
+      "Long Label Name",
+    ]);
+  });
+
+  it("hard-breaks a single word wider than the column width", () => {
+    expect(legacyWrapStatusLabel("ThisIsAVeryLongSingleWordLabel", 16)).toEqual([
+      "ThisIsAVeryLongSingleWordLabel",
+    ]);
+  });
+
+  it("does not emit a leading empty line when the very first word already overflows", () => {
+    expect(legacyWrapStatusLabel("SuperLongFirstWord Short", 10)).toEqual([
+      "SuperLongFirstWord",
+      "Short",
+    ]);
+  });
+
+  it("returns the input unchanged for an empty label", () => {
+    expect(legacyWrapStatusLabel("", 10)).toEqual([""]);
+  });
+
+  it("returns the input unchanged for a whitespace-only label wider than the column", () => {
+    // Every "word" from splitting on spaces is itself empty, so `current` never
+    // accumulates anything to flush after the loop — the `lines` array stays
+    // empty and the function falls back to the original text.
+    expect(legacyWrapStatusLabel("     ", 2)).toEqual(["     "]);
+  });
+});
+
+describe("legacyStatusColumnLayout", () => {
+  it("sizes columns from content alone when the header already fits", () => {
+    const layout = legacyStatusColumnLayout(10, ["URL"], ["postgresql://short"]);
+    expect(layout.targetInner).toBe(3 + 2 + 1 + "postgresql://short".length + 2);
+  });
+
+  it("widens both columns evenly when the header is wider than the data", () => {
+    // Base data-driven layout: col0="a"(1+2=3), col1="b"(1+2=3), dataInner=3+1+3=7.
+    // A 10-char header needs innerWidth=12, so 5 extra columns split 3/2.
+    const layout = legacyStatusColumnLayout(10, ["a"], ["b"]);
+    expect(layout.targetInner).toBe(12);
+    expect(layout.col0Padded).toBe(6);
+    expect(layout.col1Padded).toBe(5);
+  });
+
+  it("caps column 0's content width at 16 even when a label is longer", () => {
+    const layout = legacyStatusColumnLayout(0, ["a".repeat(30)], ["b"]);
+    expect(layout.col0Padded).toBe(18);
+  });
+});
+
+describe("legacyStatusHeaderWidth", () => {
+  it("uses the hardcoded emoji-aware width for a known fixed group title", () => {
+    expect(legacyStatusHeaderWidth("⛁ Database")).toBe(10);
+  });
+
+  it("falls back to code-point length for a title outside the fixed table", () => {
+    expect(legacyStatusHeaderWidth("Plain Title")).toBe("Plain Title".length);
+  });
+});
diff --git a/apps/cli/src/legacy/shared/legacy-status-values.ts b/apps/cli/src/legacy/shared/legacy-status-values.ts
new file mode 100644
index 0000000000..1f2f9005a7
--- /dev/null
+++ b/apps/cli/src/legacy/shared/legacy-status-values.ts
@@ -0,0 +1,507 @@
+import type { ProjectConfig } from "@supabase/config";
+
+import { dockerfileServiceImage } from "../../shared/services/dockerfile-images.ts";
+import { legacyServiceContainerIds } from "./legacy-docker-ids.ts";
+import {
+  legacyEnvOverrideBool,
+  legacyResolveLocalConfigValues,
+  type LegacyLocalConfigValues,
+} from "./legacy-local-config-values.ts";
+
+/**
+ * Port of Go's `status.CustomName` + `toValues()` (`internal/status/status.go:29-97`).
+ * Each field's Go `env:"..."` tag carries two things: the dotted key
+ * `--override-name <key>=<name>` matches against (`fieldKey` below), and the
+ * default output env-var name (`defaultName`). `deprecated` fields (`inbucket`,
+ * `jwt_secret`, `anon_key`, `service_role_key`) are still emitted — Go's
+ * `deprecated` tag only affects a startup warning it never wires up for `status`
+ * (only `env.Unmarshal` reads the tag, and it does not warn), so no divergence here.
+ */
+export interface LegacyStatusField {
+  readonly fieldKey: string;
+  readonly defaultName: string;
+}
+
+const API_URL: LegacyStatusField = { fieldKey: "api.url", defaultName: "API_URL" };
+const REST_URL: LegacyStatusField = { fieldKey: "api.rest_url", defaultName: "REST_URL" };
+const GRAPHQL_URL: LegacyStatusField = { fieldKey: "api.graphql_url", defaultName: "GRAPHQL_URL" };
+const STORAGE_S3_URL: LegacyStatusField = {
+  fieldKey: "api.storage_s3_url",
+  defaultName: "STORAGE_S3_URL",
+};
+const MCP_URL: LegacyStatusField = { fieldKey: "api.mcp_url", defaultName: "MCP_URL" };
+const FUNCTIONS_URL: LegacyStatusField = {
+  fieldKey: "api.functions_url",
+  defaultName: "FUNCTIONS_URL",
+};
+const DB_URL: LegacyStatusField = { fieldKey: "db.url", defaultName: "DB_URL" };
+const STUDIO_URL: LegacyStatusField = { fieldKey: "studio.url", defaultName: "STUDIO_URL" };
+const INBUCKET_URL: LegacyStatusField = { fieldKey: "inbucket.url", defaultName: "INBUCKET_URL" };
+const MAILPIT_URL: LegacyStatusField = { fieldKey: "mailpit.url", defaultName: "MAILPIT_URL" };
+const PUBLISHABLE_KEY: LegacyStatusField = {
+  fieldKey: "auth.publishable_key",
+  defaultName: "PUBLISHABLE_KEY",
+};
+const SECRET_KEY: LegacyStatusField = { fieldKey: "auth.secret_key", defaultName: "SECRET_KEY" };
+const JWT_SECRET: LegacyStatusField = { fieldKey: "auth.jwt_secret", defaultName: "JWT_SECRET" };
+const ANON_KEY: LegacyStatusField = { fieldKey: "auth.anon_key", defaultName: "ANON_KEY" };
+const SERVICE_ROLE_KEY: LegacyStatusField = {
+  fieldKey: "auth.service_role_key",
+  defaultName: "SERVICE_ROLE_KEY",
+};
+const STORAGE_S3_ACCESS_KEY_ID: LegacyStatusField = {
+  fieldKey: "storage.s3_access_key_id",
+  defaultName: "S3_PROTOCOL_ACCESS_KEY_ID",
+};
+const STORAGE_S3_SECRET_ACCESS_KEY: LegacyStatusField = {
+  fieldKey: "storage.s3_secret_access_key",
+  defaultName: "S3_PROTOCOL_ACCESS_KEY_SECRET",
+};
+const STORAGE_S3_REGION: LegacyStatusField = {
+  fieldKey: "storage.s3_region",
+  defaultName: "S3_PROTOCOL_REGION",
+};
+
+/** All 18 fields, in `CustomName` struct declaration order. */
+export const LEGACY_STATUS_FIELDS: ReadonlyArray<LegacyStatusField> = [
+  API_URL,
+  REST_URL,
+  GRAPHQL_URL,
+  STORAGE_S3_URL,
+  MCP_URL,
+  FUNCTIONS_URL,
+  DB_URL,
+  STUDIO_URL,
+  INBUCKET_URL,
+  MAILPIT_URL,
+  PUBLISHABLE_KEY,
+  SECRET_KEY,
+  JWT_SECRET,
+  ANON_KEY,
+  SERVICE_ROLE_KEY,
+  STORAGE_S3_ACCESS_KEY_ID,
+  STORAGE_S3_SECRET_ACCESS_KEY,
+  STORAGE_S3_REGION,
+];
+
+/** The subset of {@link LEGACY_STATUS_FIELDS} the pretty renderer looks up by field. */
+export interface LegacyStatusOutputNames {
+  readonly apiUrl: string;
+  readonly restUrl: string;
+  readonly graphqlUrl: string;
+  readonly storageS3Url: string;
+  readonly mcpUrl: string;
+  readonly functionsUrl: string;
+  readonly dbUrl: string;
+  readonly studioUrl: string;
+  readonly mailpitUrl: string;
+  readonly publishableKey: string;
+  readonly secretKey: string;
+  readonly storageS3AccessKeyId: string;
+  readonly storageS3SecretAccessKey: string;
+  readonly storageS3Region: string;
+}
+
+/**
+ * Resolves each field's output KEY, applying `--override-name <fieldKey>=<name>`
+ * remaps over the Go default names. `overrides` maps `fieldKey` (e.g. `"api.url"`)
+ * to the replacement output name, mirroring `env.Unmarshal`'s `default=` override.
+ */
+function resolveOutputNames(overrides: ReadonlyMap<string, string>): LegacyStatusOutputNames {
+  const nameFor = (field: LegacyStatusField) => overrides.get(field.fieldKey) ?? field.defaultName;
+  return {
+    apiUrl: nameFor(API_URL),
+    restUrl: nameFor(REST_URL),
+    graphqlUrl: nameFor(GRAPHQL_URL),
+    storageS3Url: nameFor(STORAGE_S3_URL),
+    mcpUrl: nameFor(MCP_URL),
+    functionsUrl: nameFor(FUNCTIONS_URL),
+    dbUrl: nameFor(DB_URL),
+    studioUrl: nameFor(STUDIO_URL),
+    mailpitUrl: nameFor(MAILPIT_URL),
+    publishableKey: nameFor(PUBLISHABLE_KEY),
+    secretKey: nameFor(SECRET_KEY),
+    storageS3AccessKeyId: nameFor(STORAGE_S3_ACCESS_KEY_ID),
+    storageS3SecretAccessKey: nameFor(STORAGE_S3_SECRET_ACCESS_KEY),
+    storageS3Region: nameFor(STORAGE_S3_REGION),
+  };
+}
+
+/**
+ * Container ids `toValues()` gates each group on, taken from
+ * `legacyServiceContainerIds`'s alias order (`kong`, `auth`, `inbucket`, ...,
+ * `edge_runtime`, ...) — see `legacy-docker-ids.ts`.
+ */
+export interface LegacyStatusContainerIds {
+  readonly kong: string;
+  readonly auth: string;
+  readonly inbucket: string;
+  readonly rest: string;
+  readonly storage: string;
+  readonly studio: string;
+  readonly edgeRuntime: string;
+}
+
+// Positional indices into `legacyServiceContainerIds`'s fixed 13-element
+// array (`legacy-docker-ids.ts`'s `GetDockerIds()` order), named so a caller
+// never has to destructure the array positionally.
+const CONTAINER_INDEX = {
+  kong: 0,
+  auth: 1,
+  inbucket: 2,
+  rest: 4,
+  storage: 5,
+  studio: 8,
+  edgeRuntime: 9,
+} as const;
+
+/**
+ * Derives {@link LegacyStatusContainerIds} from `legacyServiceContainerIds`'s
+ * flat array for a given project id. The array's length and order are a fixed
+ * Go-parity contract (13 elements, `GetDockerIds()` order), so every named
+ * index here is guaranteed present — this only exists to give the handler a
+ * named-field view instead of positional array destructuring.
+ */
+export function legacyStatusContainerIds(projectId: string): LegacyStatusContainerIds {
+  const ids = legacyServiceContainerIds(projectId);
+  const at = (index: number) => ids[index] ?? "";
+  return {
+    kong: at(CONTAINER_INDEX.kong),
+    auth: at(CONTAINER_INDEX.auth),
+    inbucket: at(CONTAINER_INDEX.inbucket),
+    rest: at(CONTAINER_INDEX.rest),
+    storage: at(CONTAINER_INDEX.storage),
+    studio: at(CONTAINER_INDEX.studio),
+    edgeRuntime: at(CONTAINER_INDEX.edgeRuntime),
+  };
+}
+
+/**
+ * Port of Go's `utils.ShortContainerImageName` (`internal/utils/misc.go:33-39,75`):
+ * extracts the repo name between the (first) `/` and the (last) `:`, falling back to
+ * the full string when the image ref doesn't match (no slash, or no tag).
+ */
+export function legacyShortContainerImageName(imageName: string): string {
+  const match = /\/(.*):/.exec(imageName);
+  return match?.[1] ?? imageName;
+}
+
+// Default image short names Go's `--exclude` also matches against
+// (`internal/status/status.go:55-61`), one per gated service. Sourced from the same
+// embedded Dockerfile manifest Go parses (`dockerfileServiceImage`), so a version bump
+// there is picked up automatically. Pinned-version substitution
+// (`legacy-db-image.ts`'s `replaceImageTag`) only ever rewrites the portion after the
+// first `:`, which `legacyShortContainerImageName` discards — so these are invariant to
+// version pinning and no `.temp/<service>-version` file needs to be read here.
+const KONG_IMAGE_NAME = legacyShortContainerImageName(dockerfileServiceImage("kong"));
+const POSTGREST_IMAGE_NAME = legacyShortContainerImageName(dockerfileServiceImage("postgrest"));
+const STUDIO_IMAGE_NAME = legacyShortContainerImageName(dockerfileServiceImage("studio"));
+const GOTRUE_IMAGE_NAME = legacyShortContainerImageName(dockerfileServiceImage("gotrue"));
+const MAILPIT_IMAGE_NAME = legacyShortContainerImageName(dockerfileServiceImage("mailpit"));
+const STORAGE_IMAGE_NAME = legacyShortContainerImageName(dockerfileServiceImage("storage"));
+const EDGE_RUNTIME_IMAGE_NAME = legacyShortContainerImageName(
+  dockerfileServiceImage("edgeruntime"),
+);
+
+export interface LegacyStatusValuesResult {
+  readonly values: Record<string, string>;
+  readonly names: LegacyStatusOutputNames;
+  readonly local: LegacyLocalConfigValues;
+}
+
+/**
+ * Everything `toValues()` needs that does NOT depend on `--override-name` —
+ * i.e. every field except the output KEY remapping. Resolving this once and
+ * reusing it for both the env/json/toml/yaml values (real overrides) and the
+ * pretty-table values (Go always recomputes with an empty override map,
+ * `status.go:236-243`) avoids re-reading `auth.signing_keys_path` and
+ * re-signing the anon/service_role JWTs a second time per invocation.
+ */
+export interface LegacyStatusState {
+  readonly config: ProjectConfig;
+  readonly local: LegacyLocalConfigValues;
+  readonly kongEnabled: boolean;
+  readonly postgrestEnabled: boolean;
+  readonly studioEnabled: boolean;
+  readonly authEnabled: boolean;
+  readonly inbucketEnabled: boolean;
+  readonly storageEnabled: boolean;
+  readonly functionsEnabled: boolean;
+  readonly storageS3ProtocolEnabled: boolean;
+}
+
+/**
+ * The config-load/`Validate`-equivalent half of {@link LegacyStatusState} —
+ * everything that can THROW, and none of it depends on `excluded`/
+ * `containerIds`. Split out so `status.handler.ts` can resolve and validate
+ * this before any Docker call, matching Go's `flags.LoadConfig` (config load
+ * + `Validate`, `internal/utils/flags/config_path.go:12` ->
+ * `pkg/config/config.go:882`) running entirely before `assertContainerHealthy`/
+ * container listing (`internal/status/status.go:101-116`) — a bad
+ * `auth.jwt_secret` or malformed `SUPABASE_*_PORT`/`SUPABASE_*_ENABLED`
+ * override must fail here, not be masked by a Docker/DB error when the local
+ * stack happens to be unavailable.
+ */
+export interface LegacyStatusLocalState {
+  readonly config: ProjectConfig;
+  readonly local: LegacyLocalConfigValues;
+  readonly apiEnabled: boolean;
+  readonly studioSectionEnabled: boolean;
+  readonly authSectionEnabled: boolean;
+  readonly inbucketSectionEnabled: boolean;
+  readonly storageSectionEnabled: boolean;
+  readonly edgeRuntimeEnabled: boolean;
+  readonly storageS3ProtocolEnabled: boolean;
+}
+
+/**
+ * Port of the throwing, non-Docker-dependent half of Go's
+ * `(*CustomName).toValues(exclude...)` (`internal/status/status.go:50-97`):
+ * resolves local config values (URLs, keys — can throw, see
+ * {@link legacyResolveLocalConfigValues}) and the per-service `.enabled` gates,
+ * with NO reference to `excluded`/`containerIds` — see {@link legacyGateStatusState}
+ * for the Docker-dependent, non-throwing half this composes with (in
+ * `status.handler.ts`, or via {@link legacyStatusValues} for callers that
+ * don't need to run validation before Docker calls).
+ *
+ * Each `.enabled` gate is read through {@link legacyEnvOverrideBool}, not the
+ * raw decoded `config.<section>.enabled`, because Go's `status.toValues()`
+ * (`status.go:55-61`) reads `utils.Config.*.Enabled` — a package-level struct
+ * Viper has already applied any `SUPABASE_<SECTION>_ENABLED` env/dotenv
+ * override to (`SetEnvPrefix("SUPABASE")` + `AutomaticEnv()` +
+ * `ExperimentalBindStruct()`, `pkg/config/config.go:580-586`) — generically,
+ * not just for `auth.enabled`. Skipping this would mean a stack Go started
+ * with e.g. `SUPABASE_API_ENABLED=true` over a `false` TOML value has Kong/
+ * PostgREST running while native `status` omits them entirely.
+ *
+ * @throws {LegacyInvalidJwtSecretError} when `auth.jwt_secret` is set but too short.
+ * @throws {LegacyInvalidPortEnvOverrideError} when a `SUPABASE_*_PORT` env/dotenv
+ * override doesn't parse as a valid port.
+ * @throws {LegacyInvalidBoolEnvOverrideError} when a `SUPABASE_*_ENABLED` env/dotenv
+ * override doesn't parse as a valid bool.
+ * @throws when `auth.signing_keys_path` is set but the file is missing, malformed,
+ * or its first key is unsupported — see {@link legacyGenerateAsymmetricGoJwt}.
+ */
+export function legacyResolveStatusLocalState(
+  config: ProjectConfig,
+  hostname: string,
+  workdir: string,
+  projectEnvValues: Readonly<Record<string, string>> | undefined = undefined,
+  /** `LoadedProjectConfig.document` — see {@link legacyResolveLocalConfigValues}'s doc comment. */
+  document: Readonly<Record<string, unknown>> | undefined = undefined,
+  /**
+   * An already-resolved {@link legacyResolveLocalConfigValues} result to reuse
+   * instead of re-deriving one. Callers that resolved `local` earlier in the
+   * SAME process (e.g. `start`'s success-path status print, after the values
+   * it already resolved were used to build every container spec) must pass it
+   * here rather than let this function call
+   * {@link legacyResolveLocalConfigValues} again — a second call re-mints a
+   * time-dependent asymmetric JWT (`auth.signing_keys_path` +
+   * {@link legacyGenerateAsymmetricGoJwt}'s `exp` claim) with a DIFFERENT
+   * signature than the one baked into the already-running containers. Go
+   * never has this problem: `c.Auth.generateAPIKeys()` runs exactly once per
+   * process (`Config.Validate()`, `pkg/config/config.go:1155`), mutating the
+   * config in place, so every later read — including its own status print —
+   * sees the same value.
+   */
+  precomputedLocal?: LegacyLocalConfigValues,
+): LegacyStatusLocalState {
+  const local =
+    precomputedLocal ??
+    legacyResolveLocalConfigValues(config, hostname, workdir, projectEnvValues, document);
+
+  const apiEnabled = legacyEnvOverrideBool(
+    "SUPABASE_API_ENABLED",
+    config.api.enabled,
+    "api.enabled",
+    projectEnvValues,
+  );
+  const studioSectionEnabled = legacyEnvOverrideBool(
+    "SUPABASE_STUDIO_ENABLED",
+    config.studio.enabled,
+    "studio.enabled",
+    projectEnvValues,
+  );
+  const authSectionEnabled = legacyEnvOverrideBool(
+    "SUPABASE_AUTH_ENABLED",
+    config.auth.enabled,
+    "auth.enabled",
+    projectEnvValues,
+  );
+  const inbucketSectionEnabled = legacyEnvOverrideBool(
+    "SUPABASE_LOCAL_SMTP_ENABLED",
+    config.local_smtp.enabled,
+    "local_smtp.enabled",
+    projectEnvValues,
+  );
+  const storageSectionEnabled = legacyEnvOverrideBool(
+    "SUPABASE_STORAGE_ENABLED",
+    config.storage.enabled,
+    "storage.enabled",
+    projectEnvValues,
+  );
+  const edgeRuntimeEnabled = legacyEnvOverrideBool(
+    "SUPABASE_EDGE_RUNTIME_ENABLED",
+    config.edge_runtime.enabled,
+    "edge_runtime.enabled",
+    projectEnvValues,
+  );
+  const storageS3ProtocolEnabled = legacyEnvOverrideBool(
+    "SUPABASE_STORAGE_S3_PROTOCOL_ENABLED",
+    config.storage.s3_protocol.enabled,
+    "storage.s3_protocol.enabled",
+    projectEnvValues,
+  );
+
+  return {
+    config,
+    local,
+    apiEnabled,
+    studioSectionEnabled,
+    authSectionEnabled,
+    inbucketSectionEnabled,
+    storageSectionEnabled,
+    edgeRuntimeEnabled,
+    storageS3ProtocolEnabled,
+  };
+}
+
+/**
+ * The Docker-dependent, non-throwing half of Go's `toValues()`: applies
+ * `excluded` (matching each gated service by its container id
+ * (`legacyStatusContainerIds`) OR its default Docker image short name
+ * (`legacyShortContainerImageName` above) — the 6 relevant Go config fields
+ * (`Api.KongImage`, `Api.Image`, `Studio.Image`, `Auth.Image`, `Inbucket.Image`,
+ * `Storage.Image`, `EdgeRuntime.Image`) all carry `toml:"-"`, so they're never
+ * user-overridable and the default image is always the one to check) on top of
+ * an already-resolved {@link LegacyStatusLocalState}. Pure: every throwing
+ * concern already ran in {@link legacyResolveStatusLocalState}.
+ */
+export function legacyGateStatusState(
+  localState: LegacyStatusLocalState,
+  containerIds: LegacyStatusContainerIds,
+  excluded: ReadonlyArray<string>,
+): LegacyStatusState {
+  const { config, local } = localState;
+  const { apiEnabled, studioSectionEnabled, authSectionEnabled } = localState;
+  const { inbucketSectionEnabled, storageSectionEnabled } = localState;
+  const { edgeRuntimeEnabled, storageS3ProtocolEnabled } = localState;
+  const isExcluded = (id: string) => excluded.includes(id);
+
+  const kongEnabled = apiEnabled && !isExcluded(containerIds.kong) && !isExcluded(KONG_IMAGE_NAME);
+  const postgrestEnabled =
+    kongEnabled && !isExcluded(containerIds.rest) && !isExcluded(POSTGREST_IMAGE_NAME);
+  const studioEnabled =
+    studioSectionEnabled && !isExcluded(containerIds.studio) && !isExcluded(STUDIO_IMAGE_NAME);
+  const authEnabled =
+    authSectionEnabled && !isExcluded(containerIds.auth) && !isExcluded(GOTRUE_IMAGE_NAME);
+  const inbucketEnabled =
+    inbucketSectionEnabled && !isExcluded(containerIds.inbucket) && !isExcluded(MAILPIT_IMAGE_NAME);
+  const storageEnabled =
+    storageSectionEnabled && !isExcluded(containerIds.storage) && !isExcluded(STORAGE_IMAGE_NAME);
+  const functionsEnabled =
+    edgeRuntimeEnabled &&
+    !isExcluded(containerIds.edgeRuntime) &&
+    !isExcluded(EDGE_RUNTIME_IMAGE_NAME);
+
+  return {
+    config,
+    local,
+    kongEnabled,
+    postgrestEnabled,
+    studioEnabled,
+    authEnabled,
+    inbucketEnabled,
+    storageEnabled,
+    functionsEnabled,
+    storageS3ProtocolEnabled,
+  };
+}
+
+/**
+ * Applies `--override-name` remapping to an already-resolved {@link LegacyStatusState}.
+ * Pure and non-throwing — every failure mode of `toValues()` lives in
+ * {@link legacyResolveStatusLocalState}, which runs once per `status` invocation.
+ */
+export function legacyStatusValuesFromState(
+  state: LegacyStatusState,
+  overrides: ReadonlyMap<string, string>,
+): LegacyStatusValuesResult {
+  const { local, kongEnabled, postgrestEnabled, studioEnabled, authEnabled } = state;
+  const { inbucketEnabled, storageEnabled, functionsEnabled, storageS3ProtocolEnabled } = state;
+  const names = resolveOutputNames(overrides);
+
+  // Go always sets db.url unconditionally, before any gating (status.go:52).
+  const values: Record<string, string> = {
+    [names.dbUrl]: local.dbUrl,
+  };
+
+  if (kongEnabled) {
+    values[names.apiUrl] = local.apiUrl;
+    if (postgrestEnabled) {
+      values[names.restUrl] = local.restUrl;
+      values[names.graphqlUrl] = local.graphqlUrl;
+    }
+    if (functionsEnabled) {
+      values[names.functionsUrl] = local.functionsUrl;
+    }
+    if (studioEnabled) {
+      values[names.mcpUrl] = local.mcpUrl;
+    }
+  }
+  if (studioEnabled) {
+    values[names.studioUrl] = local.studioUrl;
+  }
+  if (authEnabled) {
+    values[names.publishableKey] = local.publishableKey;
+    values[names.secretKey] = local.secretKey;
+    values[overrides.get(JWT_SECRET.fieldKey) ?? JWT_SECRET.defaultName] = local.jwtSecret;
+    values[overrides.get(ANON_KEY.fieldKey) ?? ANON_KEY.defaultName] = local.anonKey;
+    values[overrides.get(SERVICE_ROLE_KEY.fieldKey) ?? SERVICE_ROLE_KEY.defaultName] =
+      local.serviceRoleKey;
+  }
+  if (inbucketEnabled) {
+    values[names.mailpitUrl] = local.mailpitUrl;
+    values[overrides.get(INBUCKET_URL.fieldKey) ?? INBUCKET_URL.defaultName] = local.mailpitUrl;
+  }
+  if (storageEnabled && storageS3ProtocolEnabled) {
+    values[names.storageS3Url] = local.storageS3Url;
+    values[names.storageS3AccessKeyId] = local.storageS3AccessKeyId;
+    values[names.storageS3SecretAccessKey] = local.storageS3SecretAccessKey;
+    values[names.storageS3Region] = local.storageS3Region;
+  }
+
+  return { values, names, local };
+}
+
+/**
+ * Convenience wrapper combining {@link legacyResolveStatusLocalState} +
+ * {@link legacyGateStatusState} + {@link legacyStatusValuesFromState} in one
+ * call — used directly by tests that only need a single override map.
+ * `status.handler.ts` calls the three separately instead, so it can resolve +
+ * validate `localState` before any Docker call (see
+ * {@link legacyResolveStatusLocalState}'s doc comment), and reuse the gated
+ * `state` for both the real and pretty-mode (empty-override) value maps
+ * without recomputing `local`.
+ */
+export function legacyStatusValues(
+  config: ProjectConfig,
+  containerIds: LegacyStatusContainerIds,
+  hostname: string,
+  excluded: ReadonlyArray<string>,
+  overrides: ReadonlyMap<string, string>,
+  workdir: string,
+  projectEnvValues: Readonly<Record<string, string>> | undefined = undefined,
+  /** `LoadedProjectConfig.document` — see {@link legacyResolveLocalConfigValues}'s doc comment. */
+  document: Readonly<Record<string, unknown>> | undefined = undefined,
+): LegacyStatusValuesResult {
+  const localState = legacyResolveStatusLocalState(
+    config,
+    hostname,
+    workdir,
+    projectEnvValues,
+    document,
+  );
+  const state = legacyGateStatusState(localState, containerIds, excluded);
+  return legacyStatusValuesFromState(state, overrides);
+}
diff --git a/apps/cli/src/legacy/shared/legacy-status-values.unit.test.ts b/apps/cli/src/legacy/shared/legacy-status-values.unit.test.ts
new file mode 100644
index 0000000000..2dd93e6bcc
--- /dev/null
+++ b/apps/cli/src/legacy/shared/legacy-status-values.unit.test.ts
@@ -0,0 +1,793 @@
+import { ProjectConfigSchema, type ProjectConfig } from "@supabase/config";
+import { Schema } from "effect";
+import { describe, expect, it } from "vitest";
+
+import {
+  legacyShortContainerImageName,
+  legacyStatusContainerIds,
+  legacyStatusValues,
+  type LegacyStatusContainerIds,
+} from "./legacy-status-values.ts";
+
+const decodeConfig = Schema.decodeUnknownSync(ProjectConfigSchema);
+
+function baseConfig(overrides: Record<string, unknown> = {}): ProjectConfig {
+  return decodeConfig({ project_id: "test", ...overrides });
+}
+
+const CONTAINER_IDS: LegacyStatusContainerIds = {
+  kong: "supabase_kong_test",
+  auth: "supabase_auth_test",
+  inbucket: "supabase_inbucket_test",
+  rest: "supabase_rest_test",
+  storage: "supabase_storage_test",
+  studio: "supabase_studio_test",
+  edgeRuntime: "supabase_edge_runtime_test",
+};
+
+const HOSTNAME = "127.0.0.1";
+const NONE: ReadonlyArray<string> = [];
+const NO_OVERRIDES = new Map<string, string>();
+const WORKDIR = "/tmp/status-values-test";
+
+describe("legacyStatusValues", () => {
+  it("emits DB_URL unconditionally, even when every other service is disabled/excluded", () => {
+    const config = baseConfig({
+      api: { enabled: false },
+      studio: { enabled: false },
+      auth: { enabled: false },
+      local_smtp: { enabled: false },
+      storage: { enabled: false },
+      edge_runtime: { enabled: false },
+    });
+    const { values } = legacyStatusValues(
+      config,
+      CONTAINER_IDS,
+      HOSTNAME,
+      NONE,
+      NO_OVERRIDES,
+      WORKDIR,
+    );
+    expect(Object.keys(values)).toEqual(["DB_URL"]);
+    expect(values.DB_URL).toContain("postgresql://postgres:postgres@127.0.0.1");
+  });
+
+  describe("api / kong gating", () => {
+    it("includes API_URL when api.enabled", () => {
+      const { values } = legacyStatusValues(
+        baseConfig(),
+        CONTAINER_IDS,
+        HOSTNAME,
+        NONE,
+        NO_OVERRIDES,
+        WORKDIR,
+      );
+      expect(values.API_URL).toBeDefined();
+    });
+
+    it("omits API_URL when api.enabled is false", () => {
+      const config = baseConfig({ api: { enabled: false } });
+      const { values } = legacyStatusValues(
+        config,
+        CONTAINER_IDS,
+        HOSTNAME,
+        NONE,
+        NO_OVERRIDES,
+        WORKDIR,
+      );
+      expect(values.API_URL).toBeUndefined();
+    });
+
+    it("omits API_URL when the kong container id is excluded", () => {
+      const { values } = legacyStatusValues(
+        baseConfig(),
+        CONTAINER_IDS,
+        HOSTNAME,
+        [CONTAINER_IDS.kong],
+        NO_OVERRIDES,
+        WORKDIR,
+      );
+      expect(values.API_URL).toBeUndefined();
+    });
+
+    it("omits API_URL when the kong image short name is excluded", () => {
+      const { values } = legacyStatusValues(
+        baseConfig(),
+        CONTAINER_IDS,
+        HOSTNAME,
+        ["kong"],
+        NO_OVERRIDES,
+        WORKDIR,
+      );
+      expect(values.API_URL).toBeUndefined();
+    });
+
+    it("omits REST/GraphQL when kong is disabled even though postgrest is enabled", () => {
+      const config = baseConfig({ api: { enabled: false } });
+      const { values } = legacyStatusValues(
+        config,
+        CONTAINER_IDS,
+        HOSTNAME,
+        NONE,
+        NO_OVERRIDES,
+        WORKDIR,
+      );
+      expect(values.REST_URL).toBeUndefined();
+      expect(values.GRAPHQL_URL).toBeUndefined();
+    });
+
+    it("omits REST/GraphQL when only the rest container id is excluded", () => {
+      const { values } = legacyStatusValues(
+        baseConfig(),
+        CONTAINER_IDS,
+        HOSTNAME,
+        [CONTAINER_IDS.rest],
+        NO_OVERRIDES,
+        WORKDIR,
+      );
+      expect(values.API_URL).toBeDefined();
+      expect(values.REST_URL).toBeUndefined();
+      expect(values.GRAPHQL_URL).toBeUndefined();
+    });
+
+    it("includes REST/GraphQL when kong and postgrest are both enabled", () => {
+      const { values } = legacyStatusValues(
+        baseConfig(),
+        CONTAINER_IDS,
+        HOSTNAME,
+        NONE,
+        NO_OVERRIDES,
+        WORKDIR,
+      );
+      expect(values.REST_URL).toBeDefined();
+      expect(values.GRAPHQL_URL).toBeDefined();
+    });
+
+    it("omits REST/GraphQL when the postgrest image short name is excluded", () => {
+      const { values } = legacyStatusValues(
+        baseConfig(),
+        CONTAINER_IDS,
+        HOSTNAME,
+        ["postgrest"],
+        NO_OVERRIDES,
+        WORKDIR,
+      );
+      expect(values.API_URL).toBeDefined();
+      expect(values.REST_URL).toBeUndefined();
+      expect(values.GRAPHQL_URL).toBeUndefined();
+    });
+  });
+
+  describe("functions gating", () => {
+    it("includes FUNCTIONS_URL when kong and edge_runtime are both enabled", () => {
+      const { values } = legacyStatusValues(
+        baseConfig(),
+        CONTAINER_IDS,
+        HOSTNAME,
+        NONE,
+        NO_OVERRIDES,
+        WORKDIR,
+      );
+      expect(values.FUNCTIONS_URL).toBeDefined();
+    });
+
+    it("omits FUNCTIONS_URL when edge_runtime.enabled is false", () => {
+      const config = baseConfig({ edge_runtime: { enabled: false } });
+      const { values } = legacyStatusValues(
+        config,
+        CONTAINER_IDS,
+        HOSTNAME,
+        NONE,
+        NO_OVERRIDES,
+        WORKDIR,
+      );
+      expect(values.FUNCTIONS_URL).toBeUndefined();
+    });
+
+    it("omits FUNCTIONS_URL when kong is disabled even though edge_runtime is enabled", () => {
+      const config = baseConfig({ api: { enabled: false } });
+      const { values } = legacyStatusValues(
+        config,
+        CONTAINER_IDS,
+        HOSTNAME,
+        NONE,
+        NO_OVERRIDES,
+        WORKDIR,
+      );
+      expect(values.FUNCTIONS_URL).toBeUndefined();
+    });
+
+    it("omits FUNCTIONS_URL when the edge_runtime container id is excluded", () => {
+      const { values } = legacyStatusValues(
+        baseConfig(),
+        CONTAINER_IDS,
+        HOSTNAME,
+        [CONTAINER_IDS.edgeRuntime],
+        NO_OVERRIDES,
+        WORKDIR,
+      );
+      expect(values.FUNCTIONS_URL).toBeUndefined();
+    });
+
+    it("omits FUNCTIONS_URL when the edge-runtime image short name is excluded", () => {
+      // The image repo name (`supabase/edge-runtime`) differs from the Dockerfile's
+      // build alias (`edgeruntime`) — the short name Go matches against is the former.
+      const { values } = legacyStatusValues(
+        baseConfig(),
+        CONTAINER_IDS,
+        HOSTNAME,
+        ["edge-runtime"],
+        NO_OVERRIDES,
+        WORKDIR,
+      );
+      expect(values.FUNCTIONS_URL).toBeUndefined();
+    });
+  });
+
+  describe("studio / mcp gating", () => {
+    it("includes STUDIO_URL when studio.enabled", () => {
+      const { values } = legacyStatusValues(
+        baseConfig(),
+        CONTAINER_IDS,
+        HOSTNAME,
+        NONE,
+        NO_OVERRIDES,
+        WORKDIR,
+      );
+      expect(values.STUDIO_URL).toBeDefined();
+    });
+
+    it("omits STUDIO_URL when studio.enabled is false", () => {
+      const config = baseConfig({ studio: { enabled: false } });
+      const { values } = legacyStatusValues(
+        config,
+        CONTAINER_IDS,
+        HOSTNAME,
+        NONE,
+        NO_OVERRIDES,
+        WORKDIR,
+      );
+      expect(values.STUDIO_URL).toBeUndefined();
+    });
+
+    it("omits STUDIO_URL when the studio container id is excluded", () => {
+      const { values } = legacyStatusValues(
+        baseConfig(),
+        CONTAINER_IDS,
+        HOSTNAME,
+        [CONTAINER_IDS.studio],
+        NO_OVERRIDES,
+        WORKDIR,
+      );
+      expect(values.STUDIO_URL).toBeUndefined();
+    });
+
+    it("omits STUDIO_URL when the studio image short name is excluded", () => {
+      const { values } = legacyStatusValues(
+        baseConfig(),
+        CONTAINER_IDS,
+        HOSTNAME,
+        ["studio"],
+        NO_OVERRIDES,
+        WORKDIR,
+      );
+      expect(values.STUDIO_URL).toBeUndefined();
+    });
+
+    it("includes MCP_URL only when both kong and studio are enabled", () => {
+      const { values } = legacyStatusValues(
+        baseConfig(),
+        CONTAINER_IDS,
+        HOSTNAME,
+        NONE,
+        NO_OVERRIDES,
+        WORKDIR,
+      );
+      expect(values.MCP_URL).toBeDefined();
+    });
+
+    it("omits MCP_URL when kong is disabled", () => {
+      const config = baseConfig({ api: { enabled: false } });
+      const { values } = legacyStatusValues(
+        config,
+        CONTAINER_IDS,
+        HOSTNAME,
+        NONE,
+        NO_OVERRIDES,
+        WORKDIR,
+      );
+      expect(values.MCP_URL).toBeUndefined();
+    });
+
+    it("omits MCP_URL when studio is disabled", () => {
+      const config = baseConfig({ studio: { enabled: false } });
+      const { values } = legacyStatusValues(
+        config,
+        CONTAINER_IDS,
+        HOSTNAME,
+        NONE,
+        NO_OVERRIDES,
+        WORKDIR,
+      );
+      expect(values.MCP_URL).toBeUndefined();
+    });
+  });
+
+  describe("auth gating", () => {
+    it("includes all 5 auth fields when auth.enabled", () => {
+      const { values } = legacyStatusValues(
+        baseConfig(),
+        CONTAINER_IDS,
+        HOSTNAME,
+        NONE,
+        NO_OVERRIDES,
+        WORKDIR,
+      );
+      expect(values.PUBLISHABLE_KEY).toBeDefined();
+      expect(values.SECRET_KEY).toBeDefined();
+      expect(values.JWT_SECRET).toBeDefined();
+      expect(values.ANON_KEY).toBeDefined();
+      expect(values.SERVICE_ROLE_KEY).toBeDefined();
+    });
+
+    it("omits all 5 auth fields when auth.enabled is false", () => {
+      const config = baseConfig({ auth: { enabled: false } });
+      const { values } = legacyStatusValues(
+        config,
+        CONTAINER_IDS,
+        HOSTNAME,
+        NONE,
+        NO_OVERRIDES,
+        WORKDIR,
+      );
+      expect(values.PUBLISHABLE_KEY).toBeUndefined();
+      expect(values.SECRET_KEY).toBeUndefined();
+      expect(values.JWT_SECRET).toBeUndefined();
+      expect(values.ANON_KEY).toBeUndefined();
+      expect(values.SERVICE_ROLE_KEY).toBeUndefined();
+    });
+
+    it("omits all 5 auth fields when the auth container id is excluded", () => {
+      const { values } = legacyStatusValues(
+        baseConfig(),
+        CONTAINER_IDS,
+        HOSTNAME,
+        [CONTAINER_IDS.auth],
+        NO_OVERRIDES,
+        WORKDIR,
+      );
+      expect(values.PUBLISHABLE_KEY).toBeUndefined();
+    });
+
+    it("omits all 5 auth fields when the gotrue image short name is excluded", () => {
+      const { values } = legacyStatusValues(
+        baseConfig(),
+        CONTAINER_IDS,
+        HOSTNAME,
+        ["gotrue"],
+        NO_OVERRIDES,
+        WORKDIR,
+      );
+      expect(values.PUBLISHABLE_KEY).toBeUndefined();
+    });
+  });
+
+  describe("inbucket/mailpit gating", () => {
+    it("includes MAILPIT_URL and the deprecated INBUCKET_URL alias when local_smtp.enabled", () => {
+      const { values } = legacyStatusValues(
+        baseConfig(),
+        CONTAINER_IDS,
+        HOSTNAME,
+        NONE,
+        NO_OVERRIDES,
+        WORKDIR,
+      );
+      expect(values.MAILPIT_URL).toBeDefined();
+      expect(values.INBUCKET_URL).toBe(values.MAILPIT_URL);
+    });
+
+    it("omits MAILPIT_URL/INBUCKET_URL when local_smtp.enabled is false", () => {
+      const config = baseConfig({ local_smtp: { enabled: false } });
+      const { values } = legacyStatusValues(
+        config,
+        CONTAINER_IDS,
+        HOSTNAME,
+        NONE,
+        NO_OVERRIDES,
+        WORKDIR,
+      );
+      expect(values.MAILPIT_URL).toBeUndefined();
+      expect(values.INBUCKET_URL).toBeUndefined();
+    });
+
+    it("omits MAILPIT_URL/INBUCKET_URL when the inbucket container id is excluded", () => {
+      const { values } = legacyStatusValues(
+        baseConfig(),
+        CONTAINER_IDS,
+        HOSTNAME,
+        [CONTAINER_IDS.inbucket],
+        NO_OVERRIDES,
+        WORKDIR,
+      );
+      expect(values.MAILPIT_URL).toBeUndefined();
+    });
+
+    it("omits MAILPIT_URL/INBUCKET_URL when the mailpit image short name is excluded", () => {
+      const { values } = legacyStatusValues(
+        baseConfig(),
+        CONTAINER_IDS,
+        HOSTNAME,
+        ["mailpit"],
+        NO_OVERRIDES,
+        WORKDIR,
+      );
+      expect(values.MAILPIT_URL).toBeUndefined();
+    });
+  });
+
+  describe("storage / s3 gating", () => {
+    it("includes all 4 storage S3 fields when storage.enabled and s3_protocol.enabled", () => {
+      const { values } = legacyStatusValues(
+        baseConfig(),
+        CONTAINER_IDS,
+        HOSTNAME,
+        NONE,
+        NO_OVERRIDES,
+        WORKDIR,
+      );
+      expect(values.STORAGE_S3_URL).toBeDefined();
+      expect(values.S3_PROTOCOL_ACCESS_KEY_ID).toBeDefined();
+      expect(values.S3_PROTOCOL_ACCESS_KEY_SECRET).toBeDefined();
+      expect(values.S3_PROTOCOL_REGION).toBeDefined();
+    });
+
+    it("omits storage S3 fields when storage.enabled is false", () => {
+      const config = baseConfig({ storage: { enabled: false } });
+      const { values } = legacyStatusValues(
+        config,
+        CONTAINER_IDS,
+        HOSTNAME,
+        NONE,
+        NO_OVERRIDES,
+        WORKDIR,
+      );
+      expect(values.STORAGE_S3_URL).toBeUndefined();
+    });
+
+    it("omits storage S3 fields when the storage container id is excluded", () => {
+      const { values } = legacyStatusValues(
+        baseConfig(),
+        CONTAINER_IDS,
+        HOSTNAME,
+        [CONTAINER_IDS.storage],
+        NO_OVERRIDES,
+        WORKDIR,
+      );
+      expect(values.STORAGE_S3_URL).toBeUndefined();
+    });
+
+    it("omits storage S3 fields when the storage-api image short name is excluded", () => {
+      // The image repo name (`supabase/storage-api`) differs from the Dockerfile's
+      // build alias (`storage`) — the short name Go matches against is the former.
+      const { values } = legacyStatusValues(
+        baseConfig(),
+        CONTAINER_IDS,
+        HOSTNAME,
+        ["storage-api"],
+        NO_OVERRIDES,
+        WORKDIR,
+      );
+      expect(values.STORAGE_S3_URL).toBeUndefined();
+    });
+
+    it("omits storage S3 fields when storage.s3_protocol.enabled is false", () => {
+      const config = baseConfig({ storage: { s3_protocol: { enabled: false } } });
+      const { values } = legacyStatusValues(
+        config,
+        CONTAINER_IDS,
+        HOSTNAME,
+        NONE,
+        NO_OVERRIDES,
+        WORKDIR,
+      );
+      expect(values.STORAGE_S3_URL).toBeUndefined();
+      expect(values.S3_PROTOCOL_ACCESS_KEY_ID).toBeUndefined();
+    });
+  });
+
+  describe("SUPABASE_*_ENABLED env overrides", () => {
+    // Go's `status.toValues()` (`status.go:55-61`) reads `utils.Config.*.Enabled`
+    // AFTER Viper's `SetEnvPrefix("SUPABASE")` + `AutomaticEnv()` binding
+    // (`pkg/config/config.go:580-586`) has already applied any
+    // `SUPABASE_<SECTION>_ENABLED` override — generically, not just for auth.
+    // `legacyResolveStatusLocalState` must read the same post-override value
+    // for every gate, not the raw decoded `config.<section>.enabled`.
+
+    it("includes API_URL/REST_URL when SUPABASE_API_ENABLED overrides a disabled api.enabled", () => {
+      const config = baseConfig({ api: { enabled: false } });
+      const { values } = legacyStatusValues(
+        config,
+        CONTAINER_IDS,
+        HOSTNAME,
+        NONE,
+        NO_OVERRIDES,
+        WORKDIR,
+        {
+          SUPABASE_API_ENABLED: "true",
+        },
+      );
+      expect(values.API_URL).toBeDefined();
+      expect(values.REST_URL).toBeDefined();
+    });
+
+    it("omits API_URL when SUPABASE_API_ENABLED=false overrides an enabled api.enabled", () => {
+      const { values } = legacyStatusValues(
+        baseConfig(),
+        CONTAINER_IDS,
+        HOSTNAME,
+        NONE,
+        NO_OVERRIDES,
+        WORKDIR,
+        { SUPABASE_API_ENABLED: "false" },
+      );
+      expect(values.API_URL).toBeUndefined();
+    });
+
+    it("includes STUDIO_URL when SUPABASE_STUDIO_ENABLED overrides a disabled studio.enabled", () => {
+      const config = baseConfig({ studio: { enabled: false } });
+      const { values } = legacyStatusValues(
+        config,
+        CONTAINER_IDS,
+        HOSTNAME,
+        NONE,
+        NO_OVERRIDES,
+        WORKDIR,
+        {
+          SUPABASE_STUDIO_ENABLED: "true",
+        },
+      );
+      expect(values.STUDIO_URL).toBeDefined();
+    });
+
+    it("includes the 5 auth fields when SUPABASE_AUTH_ENABLED overrides a disabled auth.enabled", () => {
+      // Reproduces the exact scenario a Go-started stack can hit: TOML says
+      // auth is disabled, but the running stack was actually started with
+      // SUPABASE_AUTH_ENABLED=true from the shell/dotenv, so Auth is up and
+      // status must still print its credentials.
+      const config = baseConfig({ auth: { enabled: false } });
+      const { values } = legacyStatusValues(
+        config,
+        CONTAINER_IDS,
+        HOSTNAME,
+        NONE,
+        NO_OVERRIDES,
+        WORKDIR,
+        {
+          SUPABASE_AUTH_ENABLED: "true",
+        },
+      );
+      expect(values.PUBLISHABLE_KEY).toBeDefined();
+      expect(values.ANON_KEY).toBeDefined();
+      expect(values.SERVICE_ROLE_KEY).toBeDefined();
+    });
+
+    it("omits the 5 auth fields when SUPABASE_AUTH_ENABLED=false overrides an enabled auth.enabled", () => {
+      const { values } = legacyStatusValues(
+        baseConfig(),
+        CONTAINER_IDS,
+        HOSTNAME,
+        NONE,
+        NO_OVERRIDES,
+        WORKDIR,
+        { SUPABASE_AUTH_ENABLED: "false" },
+      );
+      expect(values.PUBLISHABLE_KEY).toBeUndefined();
+    });
+
+    it("includes MAILPIT_URL when SUPABASE_LOCAL_SMTP_ENABLED overrides a disabled local_smtp.enabled", () => {
+      const config = baseConfig({ local_smtp: { enabled: false } });
+      const { values } = legacyStatusValues(
+        config,
+        CONTAINER_IDS,
+        HOSTNAME,
+        NONE,
+        NO_OVERRIDES,
+        WORKDIR,
+        {
+          SUPABASE_LOCAL_SMTP_ENABLED: "true",
+        },
+      );
+      expect(values.MAILPIT_URL).toBeDefined();
+    });
+
+    it("includes storage S3 fields when SUPABASE_STORAGE_ENABLED overrides a disabled storage.enabled", () => {
+      const config = baseConfig({ storage: { enabled: false } });
+      const { values } = legacyStatusValues(
+        config,
+        CONTAINER_IDS,
+        HOSTNAME,
+        NONE,
+        NO_OVERRIDES,
+        WORKDIR,
+        {
+          SUPABASE_STORAGE_ENABLED: "true",
+        },
+      );
+      expect(values.STORAGE_S3_URL).toBeDefined();
+    });
+
+    it("includes FUNCTIONS_URL when SUPABASE_EDGE_RUNTIME_ENABLED overrides a disabled edge_runtime.enabled", () => {
+      const config = baseConfig({ edge_runtime: { enabled: false } });
+      const { values } = legacyStatusValues(
+        config,
+        CONTAINER_IDS,
+        HOSTNAME,
+        NONE,
+        NO_OVERRIDES,
+        WORKDIR,
+        {
+          SUPABASE_EDGE_RUNTIME_ENABLED: "true",
+        },
+      );
+      expect(values.FUNCTIONS_URL).toBeDefined();
+    });
+
+    it("includes storage S3 fields when SUPABASE_STORAGE_S3_PROTOCOL_ENABLED overrides a disabled s3_protocol.enabled", () => {
+      const config = baseConfig({ storage: { s3_protocol: { enabled: false } } });
+      const { values } = legacyStatusValues(
+        config,
+        CONTAINER_IDS,
+        HOSTNAME,
+        NONE,
+        NO_OVERRIDES,
+        WORKDIR,
+        {
+          SUPABASE_STORAGE_S3_PROTOCOL_ENABLED: "true",
+        },
+      );
+      expect(values.STORAGE_S3_URL).toBeDefined();
+    });
+
+    it("omits storage S3 fields when SUPABASE_STORAGE_S3_PROTOCOL_ENABLED=false overrides an enabled s3_protocol.enabled", () => {
+      const { values } = legacyStatusValues(
+        baseConfig(),
+        CONTAINER_IDS,
+        HOSTNAME,
+        NONE,
+        NO_OVERRIDES,
+        WORKDIR,
+        { SUPABASE_STORAGE_S3_PROTOCOL_ENABLED: "false" },
+      );
+      expect(values.STORAGE_S3_URL).toBeUndefined();
+    });
+  });
+
+  describe("--override-name remapping", () => {
+    it("remaps a field's output KEY while leaving the value unchanged", () => {
+      const overrides = new Map([["api.url", "NEXT_PUBLIC_SUPABASE_URL"]]);
+      const { values } = legacyStatusValues(
+        baseConfig(),
+        CONTAINER_IDS,
+        HOSTNAME,
+        NONE,
+        overrides,
+        WORKDIR,
+      );
+      expect(values.API_URL).toBeUndefined();
+      expect(values.NEXT_PUBLIC_SUPABASE_URL).toBe("http://127.0.0.1:54321");
+    });
+
+    it("remaps every field independently when multiple overrides are given", () => {
+      const overrides = new Map([
+        ["api.url", "CUSTOM_API_URL"],
+        ["db.url", "CUSTOM_DB_URL"],
+      ]);
+      const { values } = legacyStatusValues(
+        baseConfig(),
+        CONTAINER_IDS,
+        HOSTNAME,
+        NONE,
+        overrides,
+        WORKDIR,
+      );
+      expect(values.CUSTOM_API_URL).toBeDefined();
+      expect(values.CUSTOM_DB_URL).toBeDefined();
+      expect(values.API_URL).toBeUndefined();
+      expect(values.DB_URL).toBeUndefined();
+    });
+
+    it("leaves unrelated fields at their default name when only one is overridden", () => {
+      const overrides = new Map([["api.url", "CUSTOM_API_URL"]]);
+      const { values } = legacyStatusValues(
+        baseConfig(),
+        CONTAINER_IDS,
+        HOSTNAME,
+        NONE,
+        overrides,
+        WORKDIR,
+      );
+      expect(values.REST_URL).toBeDefined();
+    });
+
+    it("remaps the deprecated auth.jwt_secret/anon_key/service_role_key keys", () => {
+      const overrides = new Map([
+        ["auth.jwt_secret", "CUSTOM_JWT_SECRET"],
+        ["auth.anon_key", "CUSTOM_ANON_KEY"],
+        ["auth.service_role_key", "CUSTOM_SERVICE_ROLE_KEY"],
+      ]);
+      const { values } = legacyStatusValues(
+        baseConfig(),
+        CONTAINER_IDS,
+        HOSTNAME,
+        NONE,
+        overrides,
+        WORKDIR,
+      );
+      expect(values.CUSTOM_JWT_SECRET).toBeDefined();
+      expect(values.CUSTOM_ANON_KEY).toBeDefined();
+      expect(values.CUSTOM_SERVICE_ROLE_KEY).toBeDefined();
+      expect(values.JWT_SECRET).toBeUndefined();
+      expect(values.ANON_KEY).toBeUndefined();
+      expect(values.SERVICE_ROLE_KEY).toBeUndefined();
+    });
+
+    it("remaps the deprecated inbucket.url key independently of mailpit.url", () => {
+      const overrides = new Map([["inbucket.url", "CUSTOM_INBUCKET_URL"]]);
+      const { values } = legacyStatusValues(
+        baseConfig(),
+        CONTAINER_IDS,
+        HOSTNAME,
+        NONE,
+        overrides,
+        WORKDIR,
+      );
+      expect(values.CUSTOM_INBUCKET_URL).toBeDefined();
+      expect(values.MAILPIT_URL).toBeDefined();
+      expect(values.INBUCKET_URL).toBeUndefined();
+    });
+  });
+
+  it("combines stopped-service exclusions with --exclude flag exclusions", () => {
+    // Both `stopped` (from the health-check diff) and `--exclude` (user flag)
+    // funnel into the same `excluded` array in the handler; the pure function
+    // only sees the merged list.
+    const excluded = [CONTAINER_IDS.storage, CONTAINER_IDS.studio];
+    const { values } = legacyStatusValues(
+      baseConfig(),
+      CONTAINER_IDS,
+      HOSTNAME,
+      excluded,
+      NO_OVERRIDES,
+      WORKDIR,
+    );
+    expect(values.STORAGE_S3_URL).toBeUndefined();
+    expect(values.STUDIO_URL).toBeUndefined();
+    expect(values.API_URL).toBeDefined();
+  });
+});
+
+describe("legacyShortContainerImageName", () => {
+  it("extracts the repo name between the first slash and the last colon", () => {
+    expect(legacyShortContainerImageName("supabase/storage-api:v1.61.9")).toBe("storage-api");
+    expect(legacyShortContainerImageName("library/kong:2.8.1")).toBe("kong");
+  });
+
+  it("falls back to the full string when there is no slash/tag to extract", () => {
+    expect(legacyShortContainerImageName("kong")).toBe("kong");
+  });
+});
+
+describe("legacyStatusContainerIds", () => {
+  it("derives every named field from legacyServiceContainerIds's fixed array order", () => {
+    const ids = legacyStatusContainerIds("demo");
+    expect(ids).toEqual({
+      kong: "supabase_kong_demo",
+      auth: "supabase_auth_demo",
+      inbucket: "supabase_inbucket_demo",
+      rest: "supabase_rest_demo",
+      storage: "supabase_storage_demo",
+      studio: "supabase_studio_demo",
+      edgeRuntime: "supabase_edge_runtime_demo",
+    });
+  });
+});
diff --git a/apps/cli/src/legacy/shared/legacy-storage-credentials.ts b/apps/cli/src/legacy/shared/legacy-storage-credentials.ts
index 0826a7de8f..21983e8d15 100644
--- a/apps/cli/src/legacy/shared/legacy-storage-credentials.ts
+++ b/apps/cli/src/legacy/shared/legacy-storage-credentials.ts
@@ -4,6 +4,7 @@ import { Effect, FileSystem, Path } from "effect";
 
 import { LegacyPlatformApiFactory } from "../auth/legacy-platform-api-factory.service.ts";
 import { LegacyCliConfig } from "../config/legacy-cli-config.service.ts";
+import { legacyResolveApiExternalUrl } from "./legacy-api-url.ts";
 import { legacyMapTenantApiKeysError } from "./legacy-get-tenant-api-keys.ts";
 import { legacyGetHostname } from "./legacy-hostname.ts";
 import { legacyExtractServiceKeys } from "./legacy-tenant-keys.ts";
@@ -122,23 +123,11 @@ export const legacyResolveStorageCredentials = Effect.fnUntraced(function* (opts
 });
 
 /**
- * Local API URL, mirroring Go's `config.go:634-644` + `misc.go:298`: an explicit
- * `api.external_url` wins, otherwise `<scheme>://<host>:<port>` where the scheme
- * follows `api.tls.enabled`, the host is `legacyGetHostname` (Go's
- * `utils.GetHostname`), and the port is `api.port`.
+ * Local API URL: `legacyResolveApiExternalUrl` with `legacyGetHostname` (Go's
+ * `utils.GetHostname`) supplying the host when `api.external_url` is unset.
  */
 function resolveLocalBaseUrl(config: LegacyStorageConfigView): string {
-  if (config.api.external_url !== undefined && config.api.external_url.length > 0) {
-    return config.api.external_url;
-  }
-  const host = legacyGetHostname();
-  const scheme = config.api.tls.enabled ? "https" : "http";
-  // Go builds host:port with net.JoinHostPort (config.go:636-638), bracketing an
-  // IPv6 host. legacyGetHostname returns the unbracketed host, so bracket here.
-  const hostPort = host.includes(":")
-    ? `[${host}]:${config.api.port}`
-    : `${host}:${config.api.port}`;
-  return `${scheme}://${hostPort}`;
+  return legacyResolveApiExternalUrl(config.api, legacyGetHostname());
 }
 
 /**
diff --git a/apps/cli/src/legacy/shared/legacy-storage-gateway.ts b/apps/cli/src/legacy/shared/legacy-storage-gateway.ts
index 96bf8eabfb..6b57ec8a3f 100644
--- a/apps/cli/src/legacy/shared/legacy-storage-gateway.ts
+++ b/apps/cli/src/legacy/shared/legacy-storage-gateway.ts
@@ -4,6 +4,7 @@ import * as HttpClientError from "effect/unstable/http/HttpClientError";
 import * as HttpClientRequest from "effect/unstable/http/HttpClientRequest";
 import * as HttpClientResponse from "effect/unstable/http/HttpClientResponse";
 
+import { legacyKongAuthHeaders } from "./legacy-kong-auth.ts";
 import {
   LegacyStorageGatewayNetworkError,
   LegacyStorageGatewayStatusError,
@@ -13,10 +14,8 @@ import { legacyGoPathSplit } from "./legacy-storage-url.ts";
 /**
  * Native TypeScript client for the Supabase Storage **service gateway** (Kong),
  * mirroring `apps/cli-go/pkg/storage/{buckets,objects,vector,api}.go` and the
- * `fetcher.NewServiceGateway` auth headers: the `apikey` header is always sent,
- * and `Authorization: Bearer <key>` is added only when the key is a JWT — Go's
- * `withAuthToken` (`pkg/fetcher/gateway.go:22`) omits it for opaque `sb_...`
- * keys, which are not bearer tokens.
+ * `fetcher.NewServiceGateway` auth headers — see {@link legacyKongAuthHeaders}
+ * for the exact `apikey`/`Authorization` header shape.
  *
  * Shared by `seed buckets` (bucket/object/vector upsert against the local stack)
  * and `storage ls/cp/mv/rm` (object list/download/move/delete + bucket delete).
@@ -389,20 +388,13 @@ export const legacyMakeStorageGateway = Effect.fnUntraced(function* (opts: {
     return new LegacyStorageGatewayNetworkError({ message: base });
   };
 
-  // Go's `withAuthToken` (`pkg/fetcher/gateway.go:22`) gates the bearer header on
-  // a plain `sb_` prefix check: opaque `sb_...` keys are not JWTs.
-  const isOpaqueServiceKey = opts.apiKey.startsWith("sb_");
   const withAuth = (
     req: HttpClientRequest.HttpClientRequest,
-  ): HttpClientRequest.HttpClientRequest => {
-    const withApiKey = req.pipe(
-      HttpClientRequest.setHeader("apikey", opts.apiKey),
+  ): HttpClientRequest.HttpClientRequest =>
+    req.pipe(
       HttpClientRequest.setHeader("User-Agent", opts.userAgent),
+      HttpClientRequest.setHeaders(legacyKongAuthHeaders(opts.apiKey)),
     );
-    return isOpaqueServiceKey
-      ? withApiKey
-      : withApiKey.pipe(HttpClientRequest.setHeader("Authorization", `Bearer ${opts.apiKey}`));
-  };
 
   // Sends a request and returns the response body text, reproducing Go's
   // fetcher error shapes (`pkg/fetcher/http.go`). Go's service gateway installs
diff --git a/apps/cli/src/legacy/shared/legacy-storage-url.ts b/apps/cli/src/legacy/shared/legacy-storage-url.ts
index 4401c56387..9a4cce090f 100644
--- a/apps/cli/src/legacy/shared/legacy-storage-url.ts
+++ b/apps/cli/src/legacy/shared/legacy-storage-url.ts
@@ -129,7 +129,7 @@ function unescapePath(s: string): string {
       pending = [];
     }
   };
-  for (let i = 0; i < s.length; ) {
+  for (let i = 0; i < s.length;) {
     if (s.charCodeAt(i) === 0x25 /* % */) {
       const h1 = i + 1 < s.length ? s.charCodeAt(i + 1) : -1;
       const h2 = i + 2 < s.length ? s.charCodeAt(i + 2) : -1;
@@ -155,6 +155,62 @@ function hostFromAuthority(authority: string): string {
   return at === -1 ? authority : authority.slice(at + 1);
 }
 
+/** Go `net/url.validOptionalPort` (`url.go:761-774`): `""`, or `:` followed by only digits. */
+function isValidOptionalPort(port: string): boolean {
+  if (port.length === 0) return true;
+  if (port.charCodeAt(0) !== 0x3a /* : */) return false;
+  for (let i = 1; i < port.length; i++) {
+    if (!isDigit(port.charCodeAt(i))) return false;
+  }
+  return true;
+}
+
+/**
+ * Go `net/url.parseHost`, restricted to the branches this module's callers
+ * can actually hit (`net/url/url.go:544-608` in the Go stdlib `apps/cli-go`
+ * builds against): IP-literal (`[...]`) bracket/port validation, and the bare
+ * `host[:port]` port-digit check. Deliberately does NOT implement IPv6
+ * zone-identifier percent-decoding or `netip.ParseAddr` address validation
+ * (Go additionally requires a bracketed literal to parse as a valid,
+ * non-IPv4 IP address) — callers only need to know whether validation
+ * THROWS, and a config author writing a bogus-but-bracket-balanced IPv6
+ * literal is exotic enough that the narrower `netip.ParseAddr` check isn't
+ * worth the added surface; the common bracket-mismatch/invalid-port mistakes
+ * Go actually raises for realistic input (e.g. `http://[::1`, a truncated
+ * IPv6 literal) are still reproduced byte-for-byte. Also skips Go's
+ * `GODEBUG=urlstrictcolons=0` legacy multi-colon opt-out (`url.go:596-604`) —
+ * an explicit, non-default env var this codebase's bundled Go binary doesn't
+ * set, so the http/https "first colon is the port separator" behavior always
+ * applies for those schemes; other schemes use the last colon, matching Go's
+ * unconditional `else` branch for non-http(s) schemes.
+ */
+function validateGoUrlHost(scheme: string, host: string): void {
+  if (host.length === 0) return;
+  const openBracketIdx = host.indexOf("[");
+  if (openBracketIdx > 0) {
+    throw new Error("invalid IP-literal");
+  }
+  if (openBracketIdx === 0) {
+    const closeBracketIdx = host.lastIndexOf("]");
+    if (closeBracketIdx < 0) {
+      throw new Error("missing ']' in host");
+    }
+    const colonPort = host.slice(closeBracketIdx + 1);
+    if (!isValidOptionalPort(colonPort)) {
+      throw new Error(`invalid port ${JSON.stringify(colonPort)} after host`);
+    }
+    return;
+  }
+  const colonIdx =
+    scheme === "http" || scheme === "https" ? host.indexOf(":") : host.lastIndexOf(":");
+  if (colonIdx !== -1) {
+    const colonPort = host.slice(colonIdx);
+    if (!isValidOptionalPort(colonPort)) {
+      throw new Error(`invalid port ${JSON.stringify(colonPort)} after host`);
+    }
+  }
+}
+
 /**
  * Port of Go's `url.Parse` restricted to `Scheme`/`Host`/`Path`. Throws
  * `LegacyGoUrlParseError` (Go's `*url.Error`) on the failures the storage
@@ -208,6 +264,11 @@ export function legacyGoUrlParse(rawURL: string): LegacyGoUrl {
     const authority = slash === -1 ? afterSlashes : afterSlashes.slice(0, slash);
     rest = slash === -1 ? "" : afterSlashes.slice(slash);
     host = hostFromAuthority(authority);
+    try {
+      validateGoUrlHost(scheme, host);
+    } catch (cause) {
+      throw new LegacyGoUrlParseError(u, cause instanceof Error ? cause.message : String(cause));
+    }
   }
 
   let path: string;
diff --git a/apps/cli/src/legacy/shared/legacy-storage-url.unit.test.ts b/apps/cli/src/legacy/shared/legacy-storage-url.unit.test.ts
index 5e9643f48e..6100802123 100644
--- a/apps/cli/src/legacy/shared/legacy-storage-url.unit.test.ts
+++ b/apps/cli/src/legacy/shared/legacy-storage-url.unit.test.ts
@@ -4,6 +4,7 @@ import {
   LegacyGoUrlParseError,
   LegacyStorageUrlPatternError,
   legacyDetectScheme,
+  legacyGoUrlParse,
   legacyParseStorageUrl,
   legacySplitBucketPrefix,
   legacyStorageIsDir,
@@ -85,6 +86,52 @@ describe("legacyDetectScheme", () => {
   });
 });
 
+// Oracle: `go run` against Go 1.25's `net/url.Parse` directly (net/url/url.go's
+// `parseHost`) — used by `studio.api_url` validation, which needs the Host, not
+// just Scheme/Path, so the failures below matter beyond the storage commands.
+describe("legacyGoUrlParse (host validation)", () => {
+  it("rejects an unterminated IPv6 literal", () => {
+    expect(() => legacyGoUrlParse("http://[::1")).toThrow(LegacyGoUrlParseError);
+    expect(() => legacyGoUrlParse("http://[::1")).toThrow(
+      `parse "http://[::1": missing ']' in host`,
+    );
+  });
+
+  it("accepts a bracketed IPv6 literal with no port", () => {
+    expect(legacyGoUrlParse("http://[::1]").host).toBe("[::1]");
+  });
+
+  it("accepts a bracketed IPv6 literal with a valid port", () => {
+    expect(legacyGoUrlParse("http://[::1]:8080").host).toBe("[::1]:8080");
+  });
+
+  it("rejects a bracketed IPv6 literal with a non-numeric port", () => {
+    expect(() => legacyGoUrlParse("http://[::1]:abc")).toThrow(
+      `parse "http://[::1]:abc": invalid port ":abc" after host`,
+    );
+  });
+
+  it("rejects a bracket that isn't the first character of the host", () => {
+    expect(() => legacyGoUrlParse("http://host[::1]")).toThrow(
+      `parse "http://host[::1]": invalid IP-literal`,
+    );
+  });
+
+  it("accepts a plain hostname with a numeric port", () => {
+    expect(legacyGoUrlParse("http://example.com:99999").host).toBe("example.com:99999");
+  });
+
+  it("rejects more than one colon in an http(s) host (strict-colon default)", () => {
+    expect(() => legacyGoUrlParse("http://host:1:2")).toThrow(
+      `parse "http://host:1:2": invalid port ":1:2" after host`,
+    );
+  });
+
+  it("does not validate a host for a scheme with no authority (ss:///bucket)", () => {
+    expect(() => legacyGoUrlParse("ss:///bucket/x")).not.toThrow();
+  });
+});
+
 describe("legacyStorageIsDir", () => {
   it.each([
     ["", true],
diff --git a/apps/cli/src/legacy/shared/legacy-vault-decrypt.ts b/apps/cli/src/legacy/shared/legacy-vault-decrypt.ts
index 5c1c0d53d2..f5826a5218 100644
--- a/apps/cli/src/legacy/shared/legacy-vault-decrypt.ts
+++ b/apps/cli/src/legacy/shared/legacy-vault-decrypt.ts
@@ -63,8 +63,12 @@ function decryptWithKey(keyHex: string, encryptedValue: string): LegacyDecrypted
   let privateKeyHex: string;
   try {
     privateKeyHex = PrivateKey.fromHex(keyHex).toHex();
-  } catch (cause) {
-    return { ok: false, error: `failed to hex decode private key: ${errorMessage(cause)}` };
+  } catch {
+    // Fixed message rather than the underlying error (Go's `ecies.NewPrivateKeyFromHex`
+    // returns the generic "cannot decode hex string" too): the fallback hex decoder some
+    // runtimes take for a malformed key can otherwise echo a fragment of the bad input
+    // (offending character + index) into this error, which reaches the user's stderr.
+    return { ok: false, error: "failed to hex decode private key: cannot decode hex string" };
   }
   const encoded = encryptedValue.slice(ENCRYPTED_PREFIX.length);
   // Node's `Buffer.from(s, "base64")` silently drops invalid characters, unlike
diff --git a/apps/cli/src/legacy/shared/legacy-workdir-validation.ts b/apps/cli/src/legacy/shared/legacy-workdir-validation.ts
new file mode 100644
index 0000000000..40e8a5976f
--- /dev/null
+++ b/apps/cli/src/legacy/shared/legacy-workdir-validation.ts
@@ -0,0 +1,52 @@
+import { Data, Effect, FileSystem } from "effect";
+
+/**
+ * Raised by {@link legacyValidateWorkdirIsDirectory} when the target path
+ * doesn't exist or isn't a directory. Callers map this into their own
+ * command-specific error type.
+ */
+export class LegacyWorkdirValidationError extends Data.TaggedError("LegacyWorkdirValidationError")<{
+  readonly message: string;
+}> {}
+
+/**
+ * Validates that `workdir` exists and is a directory, the way Go's
+ * `ChangeWorkDir` implicitly does via `os.Chdir` (`apps/cli-go/internal/utils/
+ * misc.go:231-250`, called from `PersistentPreRunE`, `apps/cli-go/cmd/root.go:
+ * 93-105`, before any command runs): a missing path or a path that isn't a
+ * directory fails immediately, before config load or any Docker/API access.
+ *
+ * Callers that resolve `workdir` via `LegacyCliConfig` only need this check
+ * when `--workdir`/`SUPABASE_WORKDIR` was set explicitly — `legacy-cli-config.
+ * layer.ts`'s default walk-up-for-`supabase/config.toml` resolution always
+ * returns a real, already-existing directory (either one containing
+ * `supabase/config.toml`, or the process's own `cwd`), so it can never fail
+ * this check; calling it unconditionally is therefore safe and simpler than
+ * threading "was this explicit?" through every caller.
+ */
+export function legacyValidateWorkdirIsDirectory(
+  workdir: string,
+  fs: FileSystem.FileSystem,
+): Effect.Effect<void, LegacyWorkdirValidationError> {
+  return fs.stat(workdir).pipe(
+    Effect.matchEffect({
+      onFailure: (error) => {
+        const reason =
+          error.reason._tag === "NotFound" ? "no such file or directory" : error.message;
+        return Effect.fail(
+          new LegacyWorkdirValidationError({
+            message: `failed to change workdir: chdir ${workdir}: ${reason}`,
+          }),
+        );
+      },
+      onSuccess: (info) =>
+        info.type === "Directory"
+          ? Effect.void
+          : Effect.fail(
+              new LegacyWorkdirValidationError({
+                message: `failed to change workdir: chdir ${workdir}: not a directory`,
+              }),
+            ),
+    }),
+  );
+}
diff --git a/apps/cli/src/legacy/telemetry/legacy-analytics.layer.ts b/apps/cli/src/legacy/telemetry/legacy-analytics.layer.ts
index c09fc962b1..1a9ccabeaf 100644
--- a/apps/cli/src/legacy/telemetry/legacy-analytics.layer.ts
+++ b/apps/cli/src/legacy/telemetry/legacy-analytics.layer.ts
@@ -1,5 +1,4 @@
 import { Effect, FileSystem, Layer, Option, Path } from "effect";
-import { PostHog } from "posthog-node";
 import { aiToolLayer } from "../../shared/telemetry/ai-tool.layer.ts";
 import { AiTool } from "../../shared/telemetry/ai-tool.service.ts";
 import {
@@ -26,6 +25,7 @@ import {
   PropSchemaVersion,
   PropSessionId,
 } from "../../shared/telemetry/event-catalog.ts";
+import { scopedPosthogClient } from "../../shared/telemetry/posthog-client.ts";
 import { resolvePosthogConfig } from "../../shared/telemetry/posthog-config.ts";
 import { telemetryRuntimeLayer } from "../../shared/telemetry/runtime.layer.ts";
 import { TelemetryRuntime } from "../../shared/telemetry/runtime.service.ts";
@@ -158,14 +158,7 @@ export const legacyAnalyticsLayer = Layer.effect(
       });
     }
 
-    const client = new PostHog(posthogConfig.key.value, {
-      host: posthogConfig.host,
-      flushAt: 1,
-      flushInterval: 0,
-    });
-    yield* Effect.addFinalizer(() =>
-      Effect.promise(() => client._shutdown(5_000)).pipe(Effect.ignore),
-    );
+    const client = yield* scopedPosthogClient(posthogConfig.key.value, posthogConfig.host);
 
     const loadLinkedProject = makeLoadLinkedProject(fs, path);
 
diff --git a/apps/cli/src/legacy/telemetry/legacy-command-instrumentation.ts b/apps/cli/src/legacy/telemetry/legacy-command-instrumentation.ts
index 04deca03cd..ceae9c91be 100644
--- a/apps/cli/src/legacy/telemetry/legacy-command-instrumentation.ts
+++ b/apps/cli/src/legacy/telemetry/legacy-command-instrumentation.ts
@@ -1,11 +1,16 @@
 import { Clock, Effect, Exit, Option, Stdio } from "effect";
+import { Param } from "effect/unstable/cli";
 import {
   CommandRuntime,
   getCommandRuntimeCommand,
   getCommandRuntimeSpanName,
 } from "../../shared/runtime/command-runtime.service.ts";
 import { Output } from "../../shared/output/output.service.ts";
-import { LegacyOutputFlag } from "../../shared/legacy/global-flags.ts";
+import {
+  LEGACY_GLOBAL_FLAGS,
+  LegacyOutputFlag,
+  legacyGlobalFlagValues,
+} from "../../shared/legacy/global-flags.ts";
 import { ProcessControl } from "../../shared/runtime/process-control.service.ts";
 import { withAnalyticsContext } from "../../shared/telemetry/analytics-context.ts";
 import { Analytics } from "../../shared/telemetry/analytics.service.ts";
@@ -34,6 +39,17 @@ interface LegacyCommandInstrumentationOptions<Flags extends Record<string, unkno
   // Go's `markFlagTelemetrySafe` annotation in cmd/root_analytics.go. Boolean
   // flag values are always passed through, matching Go's isBooleanFlag branch.
   readonly safeFlags?: ReadonlyArray<string>;
+  // A command's flag config record (the object passed to `Command.make`).
+  // Any flag built with `Flag.choice`/`Flag.choiceWithValue` is treated as
+  // telemetry-safe automatically, mirroring Go's `isEnumFlag` branch
+  // (`cmd/root_analytics.go:110-116`, which checks `flag.Value.(*utils.EnumFlag)`
+  // unconditionally — no per-flag annotation required). Passing `config` here
+  // covers every current and future enum flag on the command without having to
+  // hand-list each one in `safeFlags`. The three global choice flags
+  // (`--output`, `--dns-resolver`, `--agent`) are covered separately and
+  // automatically via `GLOBAL_CHOICE_FLAG_NAMES` below — no need to redeclare
+  // them here.
+  readonly config?: Record<string, Param.Any>;
   // The `-o`/`--output` values this command accepts, mirroring Go's per-command
   // `--output` enum (`internal/utils/enum.go`). Defaults to the resource-command
   // set; `db query` overrides with `json|table|csv`. The shared global
@@ -41,11 +57,15 @@ interface LegacyCommandInstrumentationOptions<Flags extends Record<string, unkno
   // re-validates against the command's own set and rejects out-of-enum values
   // exactly as Go's flag parser does. See `legacy-go-output-flag.ts`.
   readonly outputFormats?: ReadonlyArray<string>;
-  // Short-flag → canonical-flag-name map (e.g. `{ s: "schema" }`). Go's
-  // `changedFlags()` uses pflag's `Visit`, which reports the CANONICAL flag name
-  // whether the user typed the long form (`--schema`) or the registered shorthand
-  // (`-s`). Pass a command's shorthands here so a `-s public` invocation records
-  // the `schema` flag in telemetry, matching Go (cmd/root_analytics.go:53-76).
+  // Short-flag → canonical-flag-name map (e.g. `{ s: "schema" }`) for this
+  // command's OWN flags. Go's `changedFlags()` uses pflag's `Visit`, which
+  // reports the CANONICAL flag name whether the user typed the long form
+  // (`--schema`) or the registered shorthand (`-s`). Pass a command's
+  // shorthands here so a `-s public` invocation records the `schema` flag in
+  // telemetry, matching Go (cmd/root_analytics.go:53-76). Global shorthands
+  // (currently just `-o` for `--output`, cmd/root.go:330) are merged in
+  // automatically via `GLOBAL_SHORT_ALIASES` below — no per-command wiring
+  // needed for those (CLI-1896 review follow-up).
   readonly aliases?: Readonly<Record<string, string>>;
 }
 
@@ -196,11 +216,127 @@ function normalizeFlagValue(value: unknown): unknown | undefined {
   return normalizeFlagValue(value.value);
 }
 
-function buildFlagsMap<Flags extends Record<string, unknown>>(
-  flags: Flags | undefined,
-  safeFlagSet: ReadonlySet<string>,
-  changedFlagNames: ReadonlyArray<string>,
-): Record<string, unknown> | undefined {
+// A `Map`/`Transform`/`Optional`/`Variadic` param wraps an inner `param` of the
+// same shape (e.g. `.pipe(Flag.optional)`, `.pipe(Flag.withDefault(...))`, which
+// composes as `Map(Optional(Single))`). `effect/unstable/cli` already ships the
+// exact unwrap this needs — `Param.extractSingleParams`, the same function
+// `--help` rendering uses — but it (and `Primitive.getChoiceKeys`) are
+// `@internal`-tagged and confirmed absent from this package's published `.d.ts`
+// (present in the compiled `.js`, so calling them would only type-check via an
+// `as` cast, which this repo forbids). This predicate reimplements the
+// `isSingle`-or-has-a-`.param`-field check using only type-visible public
+// fields; every non-`Single` variant publicly declares `.param` per its own
+// interface, and the variant union is closed as of this effect version, so an
+// unrecognized future variant fails *closed* (silently not detected as a
+// choice flag, i.e. stays redacted) rather than open. Delete this in favor of
+// `Param.extractSingleParams` if effect ever publishes it.
+interface WrappedParam {
+  readonly param: Param.Any;
+}
+function isWrappedParam(param: Param.Any): param is Param.Any & WrappedParam {
+  return "param" in param;
+}
+
+// Unwraps down to the underlying `Single` param the same way `--help`
+// rendering does. Shared by `getChoiceFlagNames` and `GLOBAL_SHORT_ALIASES`
+// below — both need the leaf `Single` to read its type-visible `name`/
+// `aliases`/`primitiveType` fields. Returns `undefined` only if the variant
+// union gains an unrecognized future case (fails closed, see the
+// `isWrappedParam` doc above for why this hand-rolled unwrap exists instead of
+// the `@internal` `Param.extractSingleParams`).
+function unwrapToSingleParam(param: Param.Any): Param.Single<Param.ParamKind, unknown> | undefined {
+  if (Param.isSingle(param)) return param;
+  if (isWrappedParam(param)) return unwrapToSingleParam(param.param);
+  return undefined;
+}
+
+// Mirrors Go's `isEnumFlag` (`cmd/root_analytics.go:110-116`), which checks
+// `flag.Value.(*utils.EnumFlag)` unconditionally — every enum flag is
+// telemetry-safe, no per-flag annotation needed. Checks the unwrapped
+// `Single`'s primitive `_tag` for `Flag.choice`/`Flag.choiceWithValue`.
+// Restricted to `kind === Param.flagKind` so a same-named `Argument.choice`
+// positional (none exist today) can never be mistaken for a `--flag`.
+function getChoiceFlagNames(config: Record<string, Param.Any> | undefined): ReadonlySet<string> {
+  const names = new Set<string>();
+  if (config === undefined) return names;
+
+  for (const param of Object.values(config)) {
+    const single = unwrapToSingleParam(param);
+    if (
+      single !== undefined &&
+      single.kind === Param.flagKind &&
+      single.primitiveType._tag === "Choice"
+    ) {
+      names.add(single.name);
+    }
+  }
+  return names;
+}
+
+// Short-flag → canonical-name entries for every global/persistent flag that
+// declares a shorthand alias, derived from `LEGACY_GLOBAL_FLAGS` itself so
+// this never drifts from the single source of truth — today that resolves to
+// just `{ o: "output" }`, from `LegacyOutputFlag`'s own `Flag.withAlias("o")`.
+// Mirrors Go's persistent-flag shorthand registration: `-o` is the only
+// global with a real shorthand (`cmd/root.go:330` registers it on
+// `--output`; every other persistent flag has none). `pflag.Visit` reports
+// the canonical `flag.Name` for either form (`cmd/root_analytics.go:53-76`),
+// so `-o json` must resolve to `output` here the same way `--output json`
+// already does. Merged ahead of each command's own `aliases` in
+// `extractChangedFlagNames` so a command's own alias still wins on conflict,
+// consistent with `buildFlagsMap`'s local-flag-shadows-global rule
+// (CLI-1896 review follow-up).
+const GLOBAL_SHORT_ALIASES: Readonly<Record<string, string>> = (() => {
+  const aliases: Record<string, string> = {};
+  for (const globalFlag of LEGACY_GLOBAL_FLAGS) {
+    const single = unwrapToSingleParam(globalFlag.flag);
+    if (single === undefined) continue;
+    for (const alias of single.aliases) {
+      aliases[alias] = single.name;
+    }
+  }
+  return aliases;
+})();
+
+// CLI-name set for every global/persistent flag that is itself a
+// `Flag.choice`/`Flag.choiceWithValue` — today `output`, `dns-resolver`, and
+// `agent` (`shared/legacy/global-flags.ts`). Reuses `getChoiceFlagNames`
+// itself (keyed by `.id` rather than CLI name — `getChoiceFlagNames` only
+// ever reads `single.name` off the unwrapped param, so the record key is
+// irrelevant) rather than re-implementing the choice-detection predicate, so
+// the two can never silently drift apart. Derived from `LEGACY_GLOBAL_FLAGS`
+// the same way `GLOBAL_SHORT_ALIASES` is, so this never drifts from that
+// single source of truth either. Mirrors Go's `isEnumFlag`
+// (`cmd/root_analytics.go:110-116`) checked against the actual
+// `*utils.EnumFlag`-backed persistent flag object registered on root
+// (`cmd/root.go:330,331,333`). Applied ONLY to the global-fallback path in
+// `buildFlagsMap` below (`!isFromHandler`): when a command registers its OWN
+// differently-typed local flag under the same CLI name (e.g. `db diff`'s
+// local string `--output`, `cmd/db.go:622`), Go's own `isEnumFlag` check runs
+// against THAT command's local flag object instead — which fails the type
+// assertion, so it stays redacted — exactly mirrored by
+// `choiceFlagNames`/`isFromHandler` continuing to govern the handler-owned
+// path. Invariant this depends on: any command whose Go counterpart locally
+// shadows one of these three with a NON-enum flag (only `db diff`'s `output`
+// today) must pass that flag in its own `flags` record, so `isFromHandler`
+// is true and this global set is never consulted for it — otherwise the
+// fallback would report verbatim here even though Go redacts it.
+const GLOBAL_CHOICE_FLAG_NAMES: ReadonlySet<string> = getChoiceFlagNames(
+  Object.fromEntries(LEGACY_GLOBAL_FLAGS.map((globalFlag) => [globalFlag.id, globalFlag.flag])),
+);
+
+function buildFlagsMap<Flags extends Record<string, unknown>>(options: {
+  readonly flags: Flags | undefined;
+  // Live global/persistent flag values (`legacyGlobalFlagValues`), keyed by
+  // CLI flag name — the fallback source for a changed flag the handler never
+  // declared locally (e.g. `debug`), matching Go's `changedFlags()` walking
+  // `cmd.Parent()`'s `PersistentFlags()` (`cmd/root_analytics.go:53-76`).
+  readonly globalFlagValues: Record<string, unknown>;
+  readonly safeFlagSet: ReadonlySet<string>;
+  readonly changedFlagNames: ReadonlyArray<string>;
+  readonly choiceFlagNames: ReadonlySet<string>;
+}): Record<string, unknown> | undefined {
+  const { flags, globalFlagValues, safeFlagSet, changedFlagNames, choiceFlagNames } = options;
   if (changedFlagNames.length === 0) return undefined;
 
   const result: Record<string, unknown> = {};
@@ -212,15 +348,33 @@ function buildFlagsMap<Flags extends Record<string, unknown>>(
   }
 
   for (const cliName of changedFlagNames) {
-    const rawValue = handlerFlagsByCliName.get(cliName);
+    // A command's own flag always wins over a global/persistent flag sharing
+    // the same CLI name — mirrored from Go's cobra flag-shadowing, e.g. `db
+    // diff`'s local `--output` file-path flag (`cmd/db.go:622`) shadows the
+    // root's global `--output` enum (`cmd/root.go:330`). Only fall back to
+    // the live global-flag value when the handler never declared this name.
+    const isFromHandler = handlerFlagsByCliName.has(cliName);
+    const rawValue = isFromHandler ? handlerFlagsByCliName.get(cliName) : globalFlagValues[cliName];
     const value = normalizeFlagValue(rawValue);
 
-    if (safeFlagSet.has(cliName) || typeof value === "boolean") {
-      result[cliName] = value ?? REDACTED_VALUE;
-      continue;
-    }
-
-    result[cliName] = REDACTED_VALUE;
+    // `safeFlagSet`/`choiceFlagNames` classify a flag as safe by CLI NAME,
+    // sourced from this command's own `safeFlags`/`config` options — they may
+    // only vouch for a value that actually came from this command's own
+    // `flags` record; a value resolved from the global-flag fallback must
+    // never inherit a *different* command's per-flag safe/choice annotation
+    // just because the CLI name matches. The global-fallback path instead
+    // consults `GLOBAL_CHOICE_FLAG_NAMES` (CLI-1904) — the global flag's OWN
+    // choice-ness, exactly mirroring Go's `isEnumFlag` type-asserting the
+    // actual persistent flag object rather than any per-command annotation.
+    // Boolean values are safe unconditionally regardless of source (Go's
+    // `isBooleanFlag` branch applies unconditionally too).
+    const isSafe =
+      typeof value === "boolean" ||
+      (isFromHandler
+        ? safeFlagSet.has(cliName) || choiceFlagNames.has(cliName)
+        : GLOBAL_CHOICE_FLAG_NAMES.has(cliName));
+
+    result[cliName] = isSafe ? (value ?? REDACTED_VALUE) : REDACTED_VALUE;
   }
 
   return result;
@@ -246,6 +400,7 @@ function withLegacyCommandAnalyticsImplementation<Flags extends Record<string, u
   options?: LegacyCommandInstrumentationOptions<Flags>,
 ) {
   const safeFlagSet = new Set(options?.safeFlags ?? []);
+  const choiceFlagNames = getChoiceFlagNames(options?.config);
   return <A, E, R>(self: Effect.Effect<A, E, R>) =>
     Effect.gen(function* () {
       const commandRuntime = yield* CommandRuntime;
@@ -263,8 +418,18 @@ function withLegacyCommandAnalyticsImplementation<Flags extends Record<string, u
         const stdio = yield* Stdio.Stdio;
         const args = yield* stdio.args;
         const startedAt = yield* Clock.currentTimeMillis;
-        const changedFlagNames = extractChangedFlagNames(args, options?.aliases);
-        const flags = buildFlagsMap(options?.flags, safeFlagSet, changedFlagNames);
+        const changedFlagNames = extractChangedFlagNames(args, {
+          ...GLOBAL_SHORT_ALIASES,
+          ...options?.aliases,
+        });
+        const globalFlagValues = yield* legacyGlobalFlagValues;
+        const flags = buildFlagsMap({
+          flags: options?.flags,
+          globalFlagValues,
+          safeFlagSet,
+          changedFlagNames,
+          choiceFlagNames,
+        });
         const analyticsContext = {
           command_run_id: commandRuntime.commandRunId,
           command,
diff --git a/apps/cli/src/legacy/telemetry/legacy-command-instrumentation.unit.test.ts b/apps/cli/src/legacy/telemetry/legacy-command-instrumentation.unit.test.ts
index a2b41c6fc0..eb5be95e3d 100644
--- a/apps/cli/src/legacy/telemetry/legacy-command-instrumentation.unit.test.ts
+++ b/apps/cli/src/legacy/telemetry/legacy-command-instrumentation.unit.test.ts
@@ -1,7 +1,14 @@
 import { describe, expect, it } from "@effect/vitest";
 import { Effect, Layer, Option, Stdio } from "effect";
+import { Flag } from "effect/unstable/cli";
 import { commandRuntimeLayer } from "../../shared/runtime/command-runtime.layer.ts";
-import { LegacyOutputFlag } from "../../shared/legacy/global-flags.ts";
+import {
+  LegacyAgentFlag,
+  LegacyDebugFlag,
+  LegacyDnsResolverFlag,
+  LegacyOutputFlag,
+  LegacyWorkdirFlag,
+} from "../../shared/legacy/global-flags.ts";
 import { CurrentAnalyticsContext } from "../../shared/telemetry/analytics-context.ts";
 import { Analytics } from "../../shared/telemetry/analytics.service.ts";
 import { ProcessControl } from "../../shared/runtime/process-control.service.ts";
@@ -439,6 +446,156 @@ describe("withLegacyCommandInstrumentation", () => {
     );
   });
 
+  it.live("passes Flag.choice values through verbatim (Go parity: isEnumFlag)", () => {
+    const analytics = mockContextualAnalytics();
+    const config = {
+      lang: Flag.choice("lang", ["typescript", "go", "python"] as const),
+    };
+
+    return Effect.void.pipe(
+      withLegacyCommandInstrumentation({
+        flags: { lang: "python" },
+        config,
+      }),
+      Effect.provide(analytics.layer),
+      Effect.provide(mockProcessControl().layer),
+      Effect.provide(mockOutput({ format: "text" }).layer),
+      Effect.provide(
+        Stdio.layerTest({ args: Effect.succeed(["gen", "types", "--lang", "python"]) }),
+      ),
+      Effect.provide(commandRuntimeLayer(["gen", "types"])),
+      Effect.tap(() =>
+        Effect.sync(() => {
+          const event = analytics.captured[0];
+          expect(event?.properties.flags).toEqual({ lang: "python" });
+        }),
+      ),
+    );
+  });
+
+  it.live(
+    "passes a Flag.withDefault-wrapped Flag.choice value through verbatim (Map(Optional(Single)))",
+    () => {
+      const analytics = mockContextualAnalytics();
+      // Mirrors gen signing-key's real `algorithm` flag construction exactly —
+      // `.pipe(Flag.withDefault(...))` composes as `Map(Optional(Single))`.
+      const config = {
+        algorithm: Flag.choice("algorithm", ["RS256", "ES256"] as const).pipe(
+          Flag.withDefault("ES256" as const),
+        ),
+      };
+
+      return Effect.void.pipe(
+        withLegacyCommandInstrumentation({
+          flags: { algorithm: "RS256" },
+          config,
+        }),
+        Effect.provide(analytics.layer),
+        Effect.provide(mockProcessControl().layer),
+        Effect.provide(mockOutput({ format: "text" }).layer),
+        Effect.provide(
+          Stdio.layerTest({ args: Effect.succeed(["gen", "signing-key", "--algorithm", "RS256"]) }),
+        ),
+        Effect.provide(commandRuntimeLayer(["gen", "signing-key"])),
+        Effect.tap(() =>
+          Effect.sync(() => {
+            const event = analytics.captured[0];
+            expect(event?.properties.flags).toEqual({ algorithm: "RS256" });
+          }),
+        ),
+      );
+    },
+  );
+
+  it.live(
+    "resolves a Flag.choice's shorthand alias to its canonical name (Go parity: pflag.Visit)",
+    () => {
+      const analytics = mockContextualAnalytics();
+      // Mirrors sso add's real `type` flag construction exactly — `-t` is a
+      // registered alias (Flag.withAlias("t")) that must be mapped to the
+      // canonical "type" name for extractChangedFlagNames to record it at all.
+      const config = {
+        type: Flag.choice("type", ["saml"] as const).pipe(Flag.withAlias("t")),
+      };
+
+      return Effect.void.pipe(
+        withLegacyCommandInstrumentation({
+          flags: { type: "saml" },
+          config,
+          aliases: { t: "type" },
+        }),
+        Effect.provide(analytics.layer),
+        Effect.provide(mockProcessControl().layer),
+        Effect.provide(mockOutput({ format: "text" }).layer),
+        Effect.provide(Stdio.layerTest({ args: Effect.succeed(["sso", "add", "-t", "saml"]) })),
+        Effect.provide(commandRuntimeLayer(["sso", "add"])),
+        Effect.tap(() =>
+          Effect.sync(() => {
+            const event = analytics.captured[0];
+            expect(event?.properties.flags).toEqual({ type: "saml" });
+          }),
+        ),
+      );
+    },
+  );
+
+  it.live("passes an Optional-wrapped Flag.choice value through verbatim", () => {
+    const analytics = mockContextualAnalytics();
+    const config = {
+      algorithm: Flag.choice("algorithm", ["RS256", "ES256"] as const).pipe(Flag.optional),
+    };
+
+    return Effect.void.pipe(
+      withLegacyCommandInstrumentation({
+        flags: { algorithm: Option.some("ES256") },
+        config,
+      }),
+      Effect.provide(analytics.layer),
+      Effect.provide(mockProcessControl().layer),
+      Effect.provide(mockOutput({ format: "text" }).layer),
+      Effect.provide(
+        Stdio.layerTest({ args: Effect.succeed(["gen", "signing-key", "--algorithm", "ES256"]) }),
+      ),
+      Effect.provide(commandRuntimeLayer(["gen", "signing-key"])),
+      Effect.tap(() =>
+        Effect.sync(() => {
+          const event = analytics.captured[0];
+          expect(event?.properties.flags).toEqual({ algorithm: "ES256" });
+        }),
+      ),
+    );
+  });
+
+  it.live("still redacts non-choice string flags even when config is provided", () => {
+    const analytics = mockContextualAnalytics();
+    const config = {
+      lang: Flag.choice("lang", ["typescript", "go"] as const),
+      schema: Flag.string("schema"),
+    };
+
+    return Effect.void.pipe(
+      withLegacyCommandInstrumentation({
+        flags: { lang: "go", schema: "public" },
+        config,
+      }),
+      Effect.provide(analytics.layer),
+      Effect.provide(mockProcessControl().layer),
+      Effect.provide(mockOutput({ format: "text" }).layer),
+      Effect.provide(
+        Stdio.layerTest({
+          args: Effect.succeed(["gen", "types", "--lang", "go", "--schema", "public"]),
+        }),
+      ),
+      Effect.provide(commandRuntimeLayer(["gen", "types"])),
+      Effect.tap(() =>
+        Effect.sync(() => {
+          const event = analytics.captured[0];
+          expect(event?.properties.flags).toEqual({ lang: "go", schema: "<redacted>" });
+        }),
+      ),
+    );
+  });
+
   it.live("omits the `flags` property when no flags changed", () => {
     const analytics = mockContextualAnalytics();
 
@@ -822,6 +979,211 @@ describe("withLegacyCommandInstrumentation", () => {
     );
   });
 
+  // Global/persistent flag parity (CLI-1896): Go's changedFlags() walks
+  // cmd.Parent()'s PersistentFlags() in addition to the leaf's own flags
+  // (cmd/root_analytics.go:53-76), so a global flag like --debug resolves to
+  // its real value even though no command declares it locally. The wrapper
+  // reads shared/legacy/global-flags.ts itself rather than relying on the
+  // per-command `flags` option to carry global flag values.
+
+  it.live("records a changed global boolean flag's real value (e.g. --debug)", () => {
+    // Go reports `flags: {debug: true}` for `supabase --debug telemetry disable`
+    // (isBooleanFlag is always safe, regardless of markFlagTelemetrySafe) — the
+    // TS port previously had no way to resolve `debug` at all and fell back to
+    // "<redacted>" for every global flag, even booleans.
+    const analytics = mockContextualAnalytics();
+
+    return Effect.void.pipe(
+      withLegacyCommandInstrumentation({ flags: {} }),
+      Effect.provide(analytics.layer),
+      Effect.provide(mockProcessControl().layer),
+      Effect.provide(mockOutput({ format: "text" }).layer),
+      Effect.provide(Stdio.layerTest({ args: Effect.succeed(["backups", "list", "--debug"]) })),
+      Effect.provide(commandRuntimeLayer(["backups", "list"])),
+      Effect.provide(Layer.succeed(LegacyDebugFlag, true)),
+      Effect.tap(() =>
+        Effect.sync(() => {
+          const event = analytics.captured[0];
+          expect(event?.properties.flags).toEqual({ debug: true });
+        }),
+      ),
+    );
+  });
+
+  it.live("merges a changed global flag alongside the command's own local flags", () => {
+    const analytics = mockContextualAnalytics();
+
+    return Effect.void.pipe(
+      withLegacyCommandInstrumentation({
+        flags: { projectRef: Option.some("abcdefghijklmnopqrst") },
+      }),
+      Effect.provide(analytics.layer),
+      Effect.provide(mockProcessControl().layer),
+      Effect.provide(mockOutput({ format: "text" }).layer),
+      Effect.provide(
+        Stdio.layerTest({
+          args: Effect.succeed([
+            "secrets",
+            "list",
+            "--project-ref",
+            "abcdefghijklmnopqrst",
+            "--debug",
+          ]),
+        }),
+      ),
+      Effect.provide(commandRuntimeLayer(["secrets", "list"])),
+      Effect.provide(Layer.succeed(LegacyDebugFlag, true)),
+      Effect.tap(() =>
+        Effect.sync(() => {
+          const event = analytics.captured[0];
+          expect(event?.properties.flags).toEqual({
+            "project-ref": "<redacted>",
+            debug: true,
+          });
+        }),
+      ),
+    );
+  });
+
+  it.live(
+    "still redacts a changed global string flag like --workdir (Go never marks it telemetry-safe)",
+    () => {
+      const analytics = mockContextualAnalytics();
+
+      return Effect.void.pipe(
+        withLegacyCommandInstrumentation({ flags: {} }),
+        Effect.provide(analytics.layer),
+        Effect.provide(mockProcessControl().layer),
+        Effect.provide(mockOutput({ format: "text" }).layer),
+        Effect.provide(
+          Stdio.layerTest({
+            args: Effect.succeed(["backups", "list", "--workdir", "/tmp/project"]),
+          }),
+        ),
+        Effect.provide(commandRuntimeLayer(["backups", "list"])),
+        Effect.provide(Layer.succeed(LegacyWorkdirFlag, Option.some("/tmp/project"))),
+        Effect.tap(() =>
+          Effect.sync(() => {
+            const event = analytics.captured[0];
+            expect(event?.properties.flags).toEqual({ workdir: "<redacted>" });
+          }),
+        ),
+      );
+    },
+  );
+
+  it.live(
+    "passes a changed global choice flag like --dns-resolver through verbatim (Go parity: isEnumFlag, CLI-1904)",
+    () => {
+      const analytics = mockContextualAnalytics();
+
+      return Effect.void.pipe(
+        withLegacyCommandInstrumentation({ flags: {} }),
+        Effect.provide(analytics.layer),
+        Effect.provide(mockProcessControl().layer),
+        Effect.provide(mockOutput({ format: "text" }).layer),
+        Effect.provide(
+          Stdio.layerTest({
+            args: Effect.succeed(["backups", "list", "--dns-resolver", "https"]),
+          }),
+        ),
+        Effect.provide(commandRuntimeLayer(["backups", "list"])),
+        Effect.provide(Layer.succeed(LegacyDnsResolverFlag, "https" as const)),
+        Effect.tap(() =>
+          Effect.sync(() => {
+            const event = analytics.captured[0];
+            expect(event?.properties.flags).toEqual({ "dns-resolver": "https" });
+          }),
+        ),
+      );
+    },
+  );
+
+  it.live(
+    "passes a changed global choice flag like --agent through verbatim (Go parity: isEnumFlag, CLI-1904)",
+    () => {
+      const analytics = mockContextualAnalytics();
+
+      return Effect.void.pipe(
+        withLegacyCommandInstrumentation({ flags: {} }),
+        Effect.provide(analytics.layer),
+        Effect.provide(mockProcessControl().layer),
+        Effect.provide(mockOutput({ format: "text" }).layer),
+        Effect.provide(
+          Stdio.layerTest({
+            args: Effect.succeed(["backups", "list", "--agent", "yes"]),
+          }),
+        ),
+        Effect.provide(commandRuntimeLayer(["backups", "list"])),
+        Effect.provide(Layer.succeed(LegacyAgentFlag, "yes" as const)),
+        Effect.tap(() =>
+          Effect.sync(() => {
+            const event = analytics.captured[0];
+            expect(event?.properties.flags).toEqual({ agent: "yes" });
+          }),
+        ),
+      );
+    },
+  );
+
+  it.live(
+    "still redacts a global choice flag shadowed by a command's own differently-typed local flag (db diff's local string --output, Go parity)",
+    () => {
+      // `db diff` declares its own local `output: Flag.string("output")` (a
+      // file path, `cmd/db.go:622`) rather than a `Flag.choice` — mirroring
+      // Go, where that command's own non-enum flag object governs
+      // `isEnumFlag`, not root's persistent `*utils.EnumFlag`. Simulate that
+      // shape here: `output` is declared in the handler's own `flags` record
+      // (so `isFromHandler` is true) but absent from `config`, so it must NOT
+      // inherit safety from `GLOBAL_CHOICE_FLAG_NAMES` just because the CLI
+      // name collides with the global `--output` choice flag.
+      const analytics = mockContextualAnalytics();
+
+      return Effect.void.pipe(
+        withLegacyCommandInstrumentation({ flags: { output: "diff.sql" } }),
+        Effect.provide(analytics.layer),
+        Effect.provide(mockProcessControl().layer),
+        Effect.provide(mockOutput({ format: "text" }).layer),
+        Effect.provide(
+          Stdio.layerTest({
+            args: Effect.succeed(["db", "diff", "--output", "diff.sql"]),
+          }),
+        ),
+        Effect.provide(commandRuntimeLayer(["db", "diff"])),
+        Effect.tap(() =>
+          Effect.sync(() => {
+            const event = analytics.captured[0];
+            expect(event?.properties.flags).toEqual({ output: "<redacted>" });
+          }),
+        ),
+      );
+    },
+  );
+
+  it.live("falls back to redacted when a changed global flag's service isn't wired", () => {
+    // Defensive case: `Effect.serviceOption` must never throw/defect when a
+    // narrow harness (or, hypothetically, an incompletely-wired real command)
+    // doesn't provide a global flag's context — it degrades to the prior
+    // REDACTED_VALUE behavior instead of crashing.
+    const analytics = mockContextualAnalytics();
+
+    return Effect.void.pipe(
+      withLegacyCommandInstrumentation({ flags: {} }),
+      Effect.provide(analytics.layer),
+      Effect.provide(mockProcessControl().layer),
+      Effect.provide(mockOutput({ format: "text" }).layer),
+      Effect.provide(Stdio.layerTest({ args: Effect.succeed(["backups", "list", "--debug"]) })),
+      Effect.provide(commandRuntimeLayer(["backups", "list"])),
+      // Note: no LegacyDebugFlag layer provided.
+      Effect.tap(() =>
+        Effect.sync(() => {
+          const event = analytics.captured[0];
+          expect(event?.properties.flags).toEqual({ debug: "<redacted>" });
+        }),
+      ),
+    );
+  });
+
   it.live("stops recording flags at the -- end-of-options sentinel", () => {
     // `test db -- --linked`: pflag stops parsing flags at `--`, so `--linked`
     // is a positional arg, not a changed flag. changedFlags() never sees it.
@@ -848,4 +1210,71 @@ describe("withLegacyCommandInstrumentation", () => {
       ),
     );
   });
+
+  // CLI-1896 review follow-up (Codex): a global flag's SHORTHAND must resolve
+  // through the same fallback its long form already does.
+
+  it.live("resolves a global flag's shorthand (-o) through the global fallback", () => {
+    // `-o json` must resolve to the canonical `output` flag the same way
+    // `--output json` already does: Go's `pflag.Visit` reports the canonical
+    // `flag.Name` for either form (`cmd/root_analytics.go:53-76`), and `-o` is
+    // `--output`'s only registered persistent shorthand (`cmd/root.go:330`).
+    const analytics = mockContextualAnalytics();
+
+    return Effect.void.pipe(
+      withLegacyCommandInstrumentation({ flags: {} }),
+      Effect.provide(analytics.layer),
+      Effect.provide(mockProcessControl().layer),
+      Effect.provide(mockOutput({ format: "text" }).layer),
+      Effect.provide(Stdio.layerTest({ args: Effect.succeed(["backups", "list", "-o", "json"]) })),
+      Effect.provide(commandRuntimeLayer(["backups", "list"])),
+      Effect.provide(Layer.succeed(LegacyOutputFlag, Option.some("json" as const))),
+      Effect.tap(() =>
+        Effect.sync(() => {
+          const event = analytics.captured[0];
+          // `output` is a global choice flag — passed through verbatim
+          // (Go parity: isEnumFlag, CLI-1904), and it must be PRESENT, not
+          // silently dropped.
+          expect(event?.properties.flags).toEqual({ output: "json" });
+        }),
+      ),
+    );
+  });
+
+  it.live(
+    "does not fabricate a global flag from a local flag's value token (secrets set --env-file --debug)",
+    () => {
+      // `--env-file` is a value-consuming local string flag. In bare
+      // space-separated form, pflag consumes the very next token as its
+      // VALUE regardless of its shape, so Go's changedFlags() never marks
+      // `debug` as changed for this invocation — the whole token is
+      // `env-file`'s value. Without `env-file` registered in
+      // VALUE_CONSUMING_LONG_FLAGS, extractChangedFlagNames would wrongly
+      // treat the trailing `--debug` as a separate flag, and CLI-1896's
+      // global-flag fallback would then fabricate a `flags.debug` value Go
+      // never records.
+      const analytics = mockContextualAnalytics();
+
+      return Effect.void.pipe(
+        withLegacyCommandInstrumentation({
+          flags: { envFile: Option.some("--debug") },
+        }),
+        Effect.provide(analytics.layer),
+        Effect.provide(mockProcessControl().layer),
+        Effect.provide(mockOutput({ format: "text" }).layer),
+        Effect.provide(
+          Stdio.layerTest({
+            args: Effect.succeed(["secrets", "set", "--env-file", "--debug"]),
+          }),
+        ),
+        Effect.provide(commandRuntimeLayer(["secrets", "set"])),
+        Effect.tap(() =>
+          Effect.sync(() => {
+            const event = analytics.captured[0];
+            expect(event?.properties.flags).toEqual({ "env-file": "<redacted>" });
+          }),
+        ),
+      );
+    },
+  );
 });
diff --git a/apps/cli/src/next/cli/main.ts b/apps/cli/src/next/cli/main.ts
index 5f30a56071..e43142859b 100644
--- a/apps/cli/src/next/cli/main.ts
+++ b/apps/cli/src/next/cli/main.ts
@@ -3,4 +3,16 @@ import { runCli } from "../../shared/cli/run.ts";
 import { analyticsLayer } from "../../shared/telemetry/analytics.layer.ts";
 import { nextRoot } from "./root.ts";
 
-await runCli(nextRoot, { analyticsLayer });
+await runCli(nextRoot, {
+  analyticsLayer,
+  // `next start`'s own flows (`commands/start/flows/{foreground,non-interactive}.flow.ts`)
+  // already race their stack lifecycle against `interruptOnSignal` and drive their own
+  // controlled shutdown (`markStopping`, a clean stop result). `run.ts`'s shared
+  // `selfManagedSignalCommands` list is matched purely against argv, with no notion of which
+  // shell registered the command, so it can't tell this `["start"]` apart from legacy's own
+  // native `start` (which DOES need the global wrapper, for Go-parity rollback-on-interrupt).
+  // Exempting it here, per shell, avoids the global wrapper racing this flow's own signal
+  // handling and forcing a raw interrupt (generic exit 130) instead of the flow's own graceful
+  // stop.
+  additionalSelfManagedSignalCommands: [["start"]],
+});
diff --git a/apps/cli/src/next/commands/functions/deploy/deploy.handler.ts b/apps/cli/src/next/commands/functions/deploy/deploy.handler.ts
index 1b61948324..acd17b7a1b 100644
--- a/apps/cli/src/next/commands/functions/deploy/deploy.handler.ts
+++ b/apps/cli/src/next/commands/functions/deploy/deploy.handler.ts
@@ -34,6 +34,7 @@ export const functionsDeploy = Effect.fn("functions.deploy")(function* (
     projectRoot: projectHome.projectRoot,
     supabaseDir: projectHome.supabaseDir,
     dashboardUrl: cliConfig.dashboardUrl,
+    goViperCompat: false,
     yes: flags.yes,
     rawArgs,
     edgeRuntimeVersion,
diff --git a/apps/cli/src/next/commands/functions/deploy/deploy.integration.test.ts b/apps/cli/src/next/commands/functions/deploy/deploy.integration.test.ts
index 3710bdeacb..60f5bfe80d 100644
--- a/apps/cli/src/next/commands/functions/deploy/deploy.integration.test.ts
+++ b/apps/cli/src/next/commands/functions/deploy/deploy.integration.test.ts
@@ -1549,6 +1549,44 @@ describe("functions deploy", () => {
     }).pipe(Effect.ensuring(cleanupTempDir(tempDir)));
   });
 
+  it.live("bundles when Docker only shares the project directory", () => {
+    const tempDir = makeTempDir();
+    const sharedOutputRoot = join(tempDir, "supabase", ".temp");
+    let outputPath = "";
+    const child = mockChildProcessSpawner({
+      exitCode: 0,
+      onSpawn: (record) => {
+        if (record.command !== "docker" || record.args[0] !== "run") {
+          return;
+        }
+        outputPath = resolveDockerOutputPath(record.args);
+        if (!outputPath.startsWith(`${sharedOutputRoot}${sep}`)) {
+          return;
+        }
+        mkdirSync(dirname(outputPath), { recursive: true });
+        writeFileSync(outputPath, "eszip-test-output");
+      },
+    });
+
+    return Effect.gen(function* () {
+      yield* Effect.promise(() => writeProjectConfig(tempDir));
+      yield* Effect.promise(() => writeLocalFunction(tempDir, "hello-world"));
+
+      const { layer } = setup(tempDir, {
+        rawArgs: ["functions", "deploy", "hello-world", "--use-docker"],
+        childLayer: child.layer,
+      });
+
+      yield* functionsDeploy({
+        ...BASE_FLAGS,
+        functionNames: ["hello-world"],
+        useDocker: true,
+      }).pipe(Effect.provide(layer));
+
+      expect(outputPath.startsWith(`${sharedOutputRoot}${sep}`)).toBe(true);
+    }).pipe(Effect.ensuring(cleanupTempDir(tempDir)));
+  });
+
   it.live("forwards npm auth environment to the Docker bundler", () => {
     const tempDir = makeTempDir();
     const previousRegistry = process.env["NPM_CONFIG_REGISTRY"];
@@ -2171,8 +2209,82 @@ describe("functions deploy", () => {
       if (!(error instanceof ConflictingFunctionDeployFlagsError)) {
         throw new Error(`unexpected error: ${String(error)}`);
       }
-      expect(error.message).toContain("--use-api");
-      expect(error.message).toContain("--use-docker");
+      // Byte-matches cobra's validateExclusiveFlagGroups (flag_groups.go:204):
+      // full group in registration order, changed subset sorted alphabetically.
+      expect(error.message).toBe(
+        "if any flags in the group [use-api use-docker legacy-bundle] are set none of the others can be; [use-api use-docker] were all set",
+      );
     }).pipe(Effect.ensuring(cleanupTempDir(tempDir)));
   });
+
+  it.live("still rejects the bundler mutex when --use-docker=false is explicit", () => {
+    const tempDir = makeTempDir();
+
+    return Effect.gen(function* () {
+      yield* Effect.promise(() => writeProjectConfig(tempDir));
+      const { layer } = setup(tempDir, {
+        rawArgs: ["functions", "deploy", "--use-api", "--use-docker=false"],
+      });
+
+      const error = yield* functionsDeploy({
+        ...BASE_FLAGS,
+        useApi: true,
+        useDocker: false,
+      }).pipe(Effect.provide(layer), Effect.flip);
+
+      expect(error).toBeInstanceOf(ConflictingFunctionDeployFlagsError);
+      if (!(error instanceof ConflictingFunctionDeployFlagsError)) {
+        throw new Error(`unexpected error: ${String(error)}`);
+      }
+      // cobra tracks pflag.Changed, not the resolved boolean value — an
+      // explicit --use-docker=false still counts as "set" for the mutex.
+      expect(error.message).toBe(
+        "if any flags in the group [use-api use-docker legacy-bundle] are set none of the others can be; [use-api use-docker] were all set",
+      );
+    }).pipe(Effect.ensuring(cleanupTempDir(tempDir)));
+  });
+
+  describe("--jobs validation (Go parity: cmd/functions.go:79-82)", () => {
+    it.live("rejects --jobs > 1 without --use-api", () => {
+      const tempDir = makeTempDir();
+
+      return Effect.gen(function* () {
+        yield* Effect.promise(() => writeProjectConfig(tempDir));
+        const { layer } = setup(tempDir, {
+          rawArgs: ["functions", "deploy", "--jobs", "2"],
+        });
+
+        const error = yield* functionsDeploy({
+          ...BASE_FLAGS,
+          useApi: false,
+          jobs: Option.some(2),
+        }).pipe(Effect.provide(layer), Effect.flip);
+
+        expect(error).toBeInstanceOf(Error);
+        expect((error as Error).message).toBe("--jobs must be used together with --use-api");
+      }).pipe(Effect.ensuring(cleanupTempDir(tempDir)));
+    });
+
+    it.live("allows --jobs > 1 together with --use-api", () => {
+      const tempDir = makeTempDir();
+
+      return Effect.gen(function* () {
+        yield* Effect.promise(() => writeProjectConfig(tempDir));
+        yield* Effect.promise(() => writeLocalFunction(tempDir, "hello-world"));
+
+        const { out, layer } = setup(tempDir, {
+          rawArgs: ["functions", "deploy", "hello-world", "--use-api", "--jobs", "2"],
+        });
+
+        yield* functionsDeploy({
+          ...BASE_FLAGS,
+          functionNames: ["hello-world"],
+          useApi: true,
+          jobs: Option.some(2),
+        }).pipe(Effect.provide(layer));
+
+        expect(out.stdoutText).toContain(`Deployed Functions on project ${PROJECT_REF}`);
+      }).pipe(Effect.ensuring(cleanupTempDir(tempDir)));
+    });
+  });
 });
diff --git a/apps/cli/src/next/commands/functions/dev/functions-dev-config.unit.test.ts b/apps/cli/src/next/commands/functions/dev/functions-dev-config.unit.test.ts
index b31bdd35b9..983a7a6a5e 100644
--- a/apps/cli/src/next/commands/functions/dev/functions-dev-config.unit.test.ts
+++ b/apps/cli/src/next/commands/functions/dev/functions-dev-config.unit.test.ts
@@ -4,7 +4,7 @@ import { mkdtempSync } from "node:fs";
 import { mkdir, rm, writeFile } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
-import { Effect, Layer, Option } from "effect";
+import { Effect, Exit, Layer, Option } from "effect";
 import { ProjectHome } from "../../../config/project-home.service.ts";
 import { RuntimeInfo } from "../../../../shared/runtime/runtime-info.service.ts";
 import {
@@ -147,4 +147,79 @@ literal = "literal-secret"
       Effect.provide(projectLayer(cwd)),
     );
   });
+
+  it.live("does not resolve a lowercase-named env() reference in edge runtime secrets", () => {
+    const cwd = makeTempProject();
+
+    return Effect.gen(function* () {
+      yield* Effect.tryPromise(() => mkdir(join(cwd, "supabase"), { recursive: true }));
+      yield* Effect.tryPromise(() =>
+        writeFile(join(cwd, "supabase", ".env"), "lowercase_env_var=should-not-resolve\n"),
+      );
+      yield* Effect.tryPromise(() =>
+        writeFile(
+          join(cwd, "supabase", "config.toml"),
+          `project_id = "test"
+
+[edge_runtime]
+policy = "oneshot"
+inspector_port = 8123
+
+[edge_runtime.secrets]
+lowercase_secret = "env(lowercase_env_var)"
+`,
+        ),
+      );
+
+      const result = yield* resolveFunctionsDevEdgeRuntimeConfig();
+
+      expect(result.config).toEqual({
+        enabled: true,
+        inspectorPort: 8123,
+        policy: "oneshot",
+        env: {
+          LOWERCASE_SECRET: "env(lowercase_env_var)",
+        },
+      });
+    }).pipe(
+      Effect.ensuring(Effect.tryPromise(() => rm(cwd, { recursive: true, force: true }))),
+      Effect.provide(projectLayer(cwd)),
+    );
+  });
+
+  it.live("does not split a comma-separated string literal for an array field", () => {
+    const cwd = makeTempProject();
+
+    return Effect.gen(function* () {
+      yield* Effect.tryPromise(() => mkdir(join(cwd, "supabase"), { recursive: true }));
+      yield* Effect.tryPromise(() =>
+        writeFile(join(cwd, "supabase", ".env"), "EDGE_API_KEY=edge-secret\n"),
+      );
+      yield* Effect.tryPromise(() =>
+        writeFile(
+          join(cwd, "supabase", "config.toml"),
+          `project_id = "test"
+
+[auth]
+additional_redirect_urls = "http://a,http://b"
+
+[edge_runtime]
+policy = "oneshot"
+inspector_port = 8123
+
+[edge_runtime.secrets]
+api_key = "env(EDGE_API_KEY)"
+literal = "literal-secret"
+`,
+        ),
+      );
+
+      const exit = yield* resolveFunctionsDevEdgeRuntimeConfig().pipe(Effect.exit);
+
+      expect(Exit.isFailure(exit)).toBe(true);
+    }).pipe(
+      Effect.ensuring(Effect.tryPromise(() => rm(cwd, { recursive: true, force: true }))),
+      Effect.provide(projectLayer(cwd)),
+    );
+  });
 });
diff --git a/apps/cli/src/next/commands/functions/download/download.handler.ts b/apps/cli/src/next/commands/functions/download/download.handler.ts
index 02b9aed1b2..15c6238e84 100644
--- a/apps/cli/src/next/commands/functions/download/download.handler.ts
+++ b/apps/cli/src/next/commands/functions/download/download.handler.ts
@@ -1,4 +1,4 @@
-import { Effect } from "effect";
+import { Effect, Stdio } from "effect";
 import { PlatformApi } from "../../../auth/platform-api.service.ts";
 import { ProjectHome } from "../../../config/project-home.service.ts";
 import {
@@ -13,12 +13,23 @@ export const functionsDownload = Effect.fnUntraced(function* (flags: FunctionsDo
   const api = yield* PlatformApi;
   const projectHome = yield* ProjectHome;
   const proxy = yield* LegacyGoProxy;
+  const stdio = yield* Stdio.Stdio;
+  const rawArgs = yield* stdio.args;
 
   yield* downloadFunctions(flags, {
     api,
     projectRoot: projectHome.projectRoot,
+    rawArgs,
     resolveProjectRef,
-    proxyDownload: (proxyFlags, projectRef) =>
-      proxy.exec(makeGoProxyDownloadArgs(proxyFlags, projectRef), { cwd: projectHome.projectRoot }),
+    // In machine-output mode the child's stdout is captured and discarded
+    // instead of inherited (CLI-1546: stdout is payload-only in machine
+    // mode) — `downloadFunctions` emits the `Output` envelope itself.
+    proxyDownload: (proxyFlags, projectRef, captureOutput) => {
+      const args = makeGoProxyDownloadArgs(proxyFlags, projectRef);
+      const cwd = projectHome.projectRoot;
+      return captureOutput
+        ? Effect.asVoid(proxy.execCapture(args, { cwd, stdin: "ignore" }))
+        : proxy.exec(args, { cwd });
+    },
   });
 });
diff --git a/apps/cli/src/next/commands/functions/download/download.integration.test.ts b/apps/cli/src/next/commands/functions/download/download.integration.test.ts
index b8095be511..9c1fa1a75d 100644
--- a/apps/cli/src/next/commands/functions/download/download.integration.test.ts
+++ b/apps/cli/src/next/commands/functions/download/download.integration.test.ts
@@ -4,7 +4,7 @@ import { existsSync, mkdtempSync } from "node:fs";
 import { mkdir, readFile, rm, symlink, writeFile } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
-import { Effect, Layer, Option } from "effect";
+import { Effect, Layer, Option, Stdio } from "effect";
 import * as HttpClient from "effect/unstable/http/HttpClient";
 import * as HttpClientError from "effect/unstable/http/HttpClientError";
 import * as HttpClientResponse from "effect/unstable/http/HttpClientResponse";
@@ -276,6 +276,7 @@ function setup(
     format?: "text" | "json" | "stream-json";
     linked?: boolean;
     projectRoot?: string;
+    rawArgs?: ReadonlyArray<string>;
   } = {},
 ) {
   const out = mockOutput({ format: opts.format ?? "text", interactive: false });
@@ -289,6 +290,9 @@ function setup(
     mockRuntimeInfo({ cwd }),
     mockProjectLinkState(opts.linked === false ? undefined : LINK_STATE),
     mockProjectHome(opts.projectRoot ?? cwd),
+    Stdio.layerTest({
+      args: Effect.succeed(opts.rawArgs ?? ["functions", "download"]),
+    }),
   );
 
   return { out, api, layer, proxy };
@@ -296,17 +300,25 @@ function setup(
 
 function mockLegacyGoProxy() {
   const calls: string[][] = [];
+  const captureCalls: string[][] = [];
   return {
     layer: Layer.succeed(LegacyGoProxy, {
       exec: (args: ReadonlyArray<string>) =>
         Effect.sync(() => {
           calls.push([...args]);
         }),
-      execCapture: () => Effect.succeed(""),
+      execCapture: (args: ReadonlyArray<string>) =>
+        Effect.sync(() => {
+          captureCalls.push([...args]);
+          return "";
+        }),
     }),
     get calls() {
       return calls;
     },
+    get captureCalls() {
+      return captureCalls;
+    },
   };
 }
 
@@ -803,6 +815,7 @@ describe("functions download", () => {
         bodyBySlug: {
           "hello-world": multipart,
         },
+        rawArgs: ["functions", "download", "hello-world", "--use-api"],
       });
 
       yield* functionsDownload({
@@ -821,7 +834,9 @@ describe("functions download", () => {
 
     return Effect.gen(function* () {
       yield* Effect.tryPromise(() => writeProjectConfig(tempDir));
-      const { layer, proxy } = setup(tempDir);
+      const { layer, proxy } = setup(tempDir, {
+        rawArgs: ["functions", "download", "hello-world", "--legacy-bundle"],
+      });
 
       yield* functionsDownload({
         ...BASE_FLAGS,
@@ -841,7 +856,9 @@ describe("functions download", () => {
 
     return Effect.gen(function* () {
       yield* Effect.tryPromise(() => writeProjectConfig(tempDir));
-      const { layer, proxy } = setup(tempDir);
+      const { layer, proxy } = setup(tempDir, {
+        rawArgs: ["functions", "download", "hello-world", "--use-docker"],
+      });
 
       yield* functionsDownload({
         ...BASE_FLAGS,
@@ -856,11 +873,157 @@ describe("functions download", () => {
     );
   });
 
+  it.live("captures the Go proxy's output and emits a JSON envelope in machine mode", () => {
+    const tempDir = makeTempDir();
+
+    return Effect.gen(function* () {
+      yield* Effect.tryPromise(() => writeProjectConfig(tempDir));
+      const { out, layer, proxy } = setup(tempDir, {
+        format: "json",
+        rawArgs: ["functions", "download", "hello-world", "--use-docker"],
+      });
+
+      // CLI-1546: stdout is payload-only in machine mode, so the delegated
+      // Go child's raw output must be captured/discarded (not inherited),
+      // and this command must emit the `Output` envelope itself.
+      yield* functionsDownload({
+        ...BASE_FLAGS,
+        useDocker: true,
+      }).pipe(Effect.provide(layer));
+
+      expect(proxy.calls).toEqual([]);
+      expect(proxy.captureCalls).toEqual([
+        ["functions", "download", "hello-world", "--project-ref", PROJECT_REF, "--use-docker"],
+      ]);
+      expect(out.messages).toContainEqual(
+        expect.objectContaining({
+          type: "success",
+          message: "Downloaded Edge Function source.",
+          data: {
+            function_slugs: ["hello-world"],
+            project_ref: PROJECT_REF,
+          },
+        }),
+      );
+    }).pipe(
+      Effect.ensuring(Effect.tryPromise(() => rm(tempDir, { recursive: true, force: true }))),
+    );
+  });
+
+  it.live(
+    "lists remote functions before delegating when no function name is given in machine mode",
+    () => {
+      const tempDir = makeTempDir();
+
+      return Effect.gen(function* () {
+        yield* Effect.tryPromise(() => writeProjectConfig(tempDir));
+        const { out, layer, proxy } = setup(tempDir, {
+          format: "json",
+          list: [makeFunction({ slug: "hello-world" }), makeFunction({ slug: "goodbye-world" })],
+          rawArgs: ["functions", "download", "--use-docker"],
+        });
+
+        yield* functionsDownload({
+          ...BASE_FLAGS,
+          functionName: Option.none(),
+          useDocker: true,
+        }).pipe(Effect.provide(layer));
+
+        expect(proxy.calls).toEqual([]);
+        expect(proxy.captureCalls).toEqual([
+          ["functions", "download", "--project-ref", PROJECT_REF, "--use-docker"],
+        ]);
+        expect(out.messages).toContainEqual(
+          expect.objectContaining({
+            type: "success",
+            message: "Downloaded Edge Function source.",
+            data: {
+              function_slugs: ["hello-world", "goodbye-world"],
+              project_ref: PROJECT_REF,
+            },
+          }),
+        );
+      }).pipe(
+        Effect.ensuring(Effect.tryPromise(() => rm(tempDir, { recursive: true, force: true }))),
+      );
+    },
+  );
+
+  it.live(
+    "reports no functions found without delegating when the project is empty in machine mode",
+    () => {
+      const tempDir = makeTempDir();
+
+      return Effect.gen(function* () {
+        yield* Effect.tryPromise(() => writeProjectConfig(tempDir));
+        const { out, layer, proxy } = setup(tempDir, {
+          format: "json",
+          list: [],
+          rawArgs: ["functions", "download", "--use-docker"],
+        });
+
+        // An empty project has nothing to delegate — this must match the
+        // native path's "No functions found." short-circuit instead of
+        // still invoking the Go/Docker child and reporting a misleading
+        // "Downloaded Edge Function source." success with an empty list.
+        yield* functionsDownload({
+          ...BASE_FLAGS,
+          functionName: Option.none(),
+          useDocker: true,
+        }).pipe(Effect.provide(layer));
+
+        expect(proxy.calls).toEqual([]);
+        expect(proxy.captureCalls).toEqual([]);
+        expect(out.messages).toContainEqual(
+          expect.objectContaining({
+            type: "success",
+            message: "No functions found.",
+            data: { function_slugs: [], project_ref: PROJECT_REF },
+          }),
+        );
+      }).pipe(
+        Effect.ensuring(Effect.tryPromise(() => rm(tempDir, { recursive: true, force: true }))),
+      );
+    },
+  );
+
+  it.live("fails before delegating when the pre-flight function list fails in machine mode", () => {
+    const tempDir = makeTempDir();
+
+    return Effect.gen(function* () {
+      yield* Effect.tryPromise(() => writeProjectConfig(tempDir));
+      const { layer, proxy } = setup(tempDir, {
+        format: "json",
+        listStatus: 503,
+        listBody: { message: "unavailable" },
+        rawArgs: ["functions", "download", "--use-docker"],
+      });
+
+      // The pre-flight list failure must be reported before any download
+      // side effect — the delegated proxy must never be invoked (CLI-1862
+      // review: a listing failure after a successful delegated download
+      // must not mask that success).
+      const error = yield* functionsDownload({
+        ...BASE_FLAGS,
+        functionName: Option.none(),
+        useDocker: true,
+      }).pipe(Effect.provide(layer), Effect.flip);
+
+      expect(error).toBeInstanceOf(Error);
+      expect(proxy.calls).toEqual([]);
+      expect(proxy.captureCalls).toEqual([]);
+    }).pipe(
+      Effect.ensuring(Effect.tryPromise(() => rm(tempDir, { recursive: true, force: true }))),
+    );
+  });
+
   it.live("rejects mutually exclusive compatibility flags", () => {
     const tempDir = makeTempDir();
 
     return Effect.gen(function* () {
-      const { api, layer, proxy } = setup(tempDir);
+      const { api, layer, proxy } = setup(tempDir, {
+        rawArgs: ["functions", "download", "hello-world", "--use-api", "--legacy-bundle"],
+      });
 
       const error = yield* functionsDownload({
         ...BASE_FLAGS,
@@ -869,6 +1032,46 @@ describe("functions download", () => {
       }).pipe(Effect.provide(layer), Effect.flip);
 
       expect(error).toBeInstanceOf(ConflictingFunctionDownloadFlagsError);
+      if (!(error instanceof ConflictingFunctionDownloadFlagsError)) {
+        throw new Error(`unexpected error: ${String(error)}`);
+      }
+      // Byte-matches cobra's validateExclusiveFlagGroups (flag_groups.go:204):
+      // full group in registration order, changed subset sorted alphabetically.
+      expect(error.message).toBe(
+        "if any flags in the group [use-api use-docker legacy-bundle] are set none of the others can be; [legacy-bundle use-api] were all set",
+      );
+      expect(api.requests).toHaveLength(0);
+      expect(proxy.calls).toHaveLength(0);
+    }).pipe(
+      Effect.ensuring(Effect.tryPromise(() => rm(tempDir, { recursive: true, force: true }))),
+    );
+  });
+
+  it.live("still rejects the bundler mutex when --use-docker=false is explicit", () => {
+    const tempDir = makeTempDir();
+
+    return Effect.gen(function* () {
+      const { api, layer, proxy } = setup(tempDir, {
+        rawArgs: ["functions", "download", "--use-api", "--use-docker=false"],
+      });
+
+      const error = yield* functionsDownload({
+        ...BASE_FLAGS,
+        useApi: true,
+        useDocker: false,
+      }).pipe(Effect.provide(layer), Effect.flip);
+
+      expect(error).toBeInstanceOf(ConflictingFunctionDownloadFlagsError);
+      if (!(error instanceof ConflictingFunctionDownloadFlagsError)) {
+        throw new Error(`unexpected error: ${String(error)}`);
+      }
+      // cobra tracks pflag.Changed, not the resolved boolean value — an
+      // explicit --use-docker=false still counts as "set" for the mutex.
+      // Regression case: download previously branched on flag truthiness,
+      // so --use-docker=false (falsy) was silently excluded from the check.
+      expect(error.message).toBe(
+        "if any flags in the group [use-api use-docker legacy-bundle] are set none of the others can be; [use-api use-docker] were all set",
+      );
       expect(api.requests).toHaveLength(0);
       expect(proxy.calls).toHaveLength(0);
     }).pipe(
diff --git a/apps/cli/src/next/commands/start/start.integration.test.ts b/apps/cli/src/next/commands/start/start.integration.test.ts
index 7179a25000..be7b06c555 100644
--- a/apps/cli/src/next/commands/start/start.integration.test.ts
+++ b/apps/cli/src/next/commands/start/start.integration.test.ts
@@ -1,7 +1,12 @@
+import { mkdtemp, mkdir, rm, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
 import { describe, expect, it } from "@effect/vitest";
+import { BunServices } from "@effect/platform-bun";
 import { Deferred, Effect, Exit, Fiber, Layer } from "effect";
 import type { StackServiceStatus } from "@supabase/stack";
 import { DEFAULT_VERSIONS, stackMetadata, type StackInfo } from "@supabase/stack/effect";
+import { loadProjectConfig } from "@supabase/config";
 import { start } from "./start.handler.ts";
 import { StartVersionState } from "./start.command.ts";
 import { startForegroundWithStopSignal } from "./flows/foreground.flow.ts";
@@ -532,3 +537,68 @@ describe("start", () => {
     }).pipe(Effect.provide(layer));
   });
 });
+
+describe("next start config-load path (goViperCompat default-off regression)", () => {
+  // start.command.ts's `Command.provide` factory calls
+  // `loadProjectConfig(projectHome.projectRoot)` with no options (line ~183) —
+  // deeply inside `Layer.unwrap`/`StateManager`/daemon-layer construction that
+  // this file's `start()`-from-handler harness (StartVersionState provided
+  // directly) never reaches and can't be extended to reach without
+  // reproducing that machinery. This test instead exercises the exact
+  // zero-options `loadProjectConfig` call directly against a real temp
+  // project, pinning that `next start` still loads successfully when a
+  // config.toml has a duplicate or malformed `[remotes.*]` block — the
+  // regression that motivated gating these Go-viper checks behind
+  // `goViperCompat` (packages/config/src/io.unit.test.ts has the
+  // authoritative, broader coverage of this default-off behavior).
+  it("loads successfully despite a duplicate [remotes.*] project_id", async () => {
+    const tempDir = await mkdtemp(join(tmpdir(), "supabase-next-start-config-"));
+    try {
+      await mkdir(join(tempDir, "supabase"), { recursive: true });
+      await writeFile(
+        join(tempDir, "supabase", "config.toml"),
+        `project_id = "baseref"
+
+[remotes.a]
+project_id = "dupref"
+
+[remotes.b]
+project_id = "dupref"
+`,
+      );
+
+      const result = await Effect.runPromise(
+        loadProjectConfig(tempDir).pipe(Effect.provide(BunServices.layer)),
+      );
+
+      expect(result).not.toBeNull();
+      expect(result?.config.project_id).toBe("baseref");
+    } finally {
+      await rm(tempDir, { recursive: true, force: true });
+    }
+  });
+
+  it("loads successfully despite a malformed [remotes.*] project_id", async () => {
+    const tempDir = await mkdtemp(join(tmpdir(), "supabase-next-start-config-"));
+    try {
+      await mkdir(join(tempDir, "supabase"), { recursive: true });
+      await writeFile(
+        join(tempDir, "supabase", "config.toml"),
+        `project_id = "baseref"
+
+[remotes.bad]
+project_id = "not-a-ref"
+`,
+      );
+
+      const result = await Effect.runPromise(
+        loadProjectConfig(tempDir).pipe(Effect.provide(BunServices.layer)),
+      );
+
+      expect(result).not.toBeNull();
+      expect(result?.config.project_id).toBe("baseref");
+    } finally {
+      await rm(tempDir, { recursive: true, force: true });
+    }
+  });
+});
diff --git a/apps/cli/src/next/docs/markdown-formatter.ts b/apps/cli/src/next/docs/markdown-formatter.ts
index 0897915e77..62e6eac47d 100644
--- a/apps/cli/src/next/docs/markdown-formatter.ts
+++ b/apps/cli/src/next/docs/markdown-formatter.ts
@@ -2,7 +2,11 @@ import { Option } from "effect";
 import type { HelpDoc } from "effect/unstable/cli";
 
 function escapeMdxText(value: string): string {
-  return value.replace(/</g, "&lt;").replace(/>/g, "&gt;");
+  return value
+    .replace(/</g, "&lt;")
+    .replace(/>/g, "&gt;")
+    .replace(/\{/g, "&#123;")
+    .replace(/\}/g, "&#125;");
 }
 
 function formatTable(headers: string[], rows: string[][]): string {
diff --git a/apps/cli/src/next/docs/markdown-formatter.unit.test.ts b/apps/cli/src/next/docs/markdown-formatter.unit.test.ts
index 7f1a166d93..f6e50610d5 100644
--- a/apps/cli/src/next/docs/markdown-formatter.unit.test.ts
+++ b/apps/cli/src/next/docs/markdown-formatter.unit.test.ts
@@ -69,6 +69,12 @@ describe("formatHelpDocAsMarkdown", () => {
       const usageIndex = result.indexOf("## Usage");
       expect(descIndex).toBeLessThan(usageIndex);
     });
+
+    it("escapes MDX expression braces in prose", () => {
+      const doc = makeDoc({ description: "Request /v1/projects/{ref}." });
+      const result = formatHelpDocAsMarkdown(doc);
+      expect(result).toContain("Request /v1/projects/&#123;ref&#125;.");
+    });
   });
 
   describe("flags section", () => {
diff --git a/apps/cli/src/shared/auth/jwks.ts b/apps/cli/src/shared/auth/jwks.ts
new file mode 100644
index 0000000000..56d0878c09
--- /dev/null
+++ b/apps/cli/src/shared/auth/jwks.ts
@@ -0,0 +1,259 @@
+const remoteJwksTimeoutMs = 10_000;
+
+/**
+ * Structural JWK shape shared by both shells' own JWK types
+ * (`legacy/shared/legacy-go-jwt.ts`'s `LegacyJwk` and `shared/functions/serve.ts`'s
+ * `SigningKeyJwk`) so either can be passed to {@link toPublicJwk} without conversion. Defined
+ * locally rather than importing `LegacyJwk` because `shared/` cannot import from `legacy/` (see
+ * `apps/cli/CLAUDE.md`'s isolation rules) — both existing types already satisfy this shape
+ * structurally, so no explicit relationship is needed.
+ */
+export interface JwkLike {
+  readonly kty: string;
+  readonly kid?: string;
+  readonly use?: string;
+  readonly key_ops?: ReadonlyArray<string>;
+  readonly alg?: string;
+  readonly ext?: boolean;
+  readonly n?: string;
+  readonly e?: string;
+  readonly crv?: string;
+  readonly x?: string;
+  readonly y?: string;
+}
+
+/**
+ * Filters `key_ops` down to `"verify"` entries, returning `undefined` (never an empty array) when
+ * none remain — matches Go's `encoding/json` `omitempty` on a slice field, which drops the field
+ * entirely for a zero-length slice (`apps/cli-go/pkg/config/auth.go:92,126-130`): `ToPublicJWK`
+ * only ever appends to a nil slice, so Go can emit an absent field or a non-empty array, never
+ * `"key_ops":[]`. `key.key_ops?.filter(...)` alone doesn't reproduce this: it only returns
+ * `undefined` when `key.key_ops` itself is `undefined`, not when filtering empties it out.
+ */
+function publicKeyOps(
+  keyOps: ReadonlyArray<string> | undefined,
+): ReadonlyArray<string> | undefined {
+  const verifyOps = keyOps?.filter((operation) => operation === "verify");
+  return verifyOps !== undefined && verifyOps.length > 0 ? verifyOps : undefined;
+}
+
+/**
+ * Go's `(j JWK) ToPublicJWK()` (`apps/cli-go/pkg/config/auth.go:111-145`): strips private key
+ * material (`d`/`p`/`q`/`dp`/`dq`/`qi`) from a signing key before it's published in a JWKS, and
+ * filters `key_ops` down to `"verify"` entries only (Go never republishes `"sign"`). Field order
+ * in the returned object matches Go's `JWK` struct declaration order (`kty, kid, use, key_ops,
+ * alg, ext, n, e` for RSA / `..., crv, x, y` for EC), since both Go's `encoding/json` and JS
+ * `JSON.stringify` serialize object keys in insertion/declaration order.
+ */
+export function toPublicJwk(key: JwkLike): JwkLike {
+  if (key.kty === "RSA") {
+    return {
+      kty: "RSA",
+      kid: key.kid,
+      use: key.use,
+      key_ops: publicKeyOps(key.key_ops),
+      alg: key.alg,
+      ext: key.ext,
+      n: key.n,
+      e: key.e,
+    };
+  }
+
+  return {
+    kty: "EC",
+    kid: key.kid,
+    use: key.use,
+    key_ops: publicKeyOps(key.key_ops),
+    alg: key.alg,
+    ext: key.ext,
+    crv: key.crv,
+    x: key.x,
+    y: key.y,
+  };
+}
+
+/**
+ * One `[auth.third_party.<provider>]` section, structurally matching `@supabase/config`'s
+ * `ProjectConfig["auth"]["third_party"]` — both `shared/functions/serve.ts`'s
+ * `PlainServeAuthConfig["third_party"]` (itself typed as `ProjectConfig["auth"]["third_party"]`)
+ * and `legacy/shared/legacy-local-config-values.ts`'s env-override-resolved third-party object
+ * satisfy this shape without conversion.
+ */
+export interface ThirdPartyProvidersLike {
+  readonly firebase: { readonly enabled: boolean; readonly project_id?: string };
+  readonly auth0: {
+    readonly enabled: boolean;
+    readonly tenant?: string;
+    readonly tenant_region?: string;
+  };
+  readonly aws_cognito: {
+    readonly enabled: boolean;
+    readonly user_pool_id?: string;
+    readonly user_pool_region?: string;
+  };
+  readonly clerk: { readonly enabled: boolean; readonly domain?: string };
+  readonly workos: { readonly enabled: boolean; readonly issuer_url?: string };
+}
+
+const clerkDomainPattern = /^(clerk([.][a-z0-9-]+){2,}|([a-z0-9-]+[.])+clerk[.]accounts[.]dev)$/;
+
+/**
+ * Go's `(tpa *thirdParty) validate()` + `(tpa *thirdParty) IssuerURL()`
+ * (`apps/cli-go/pkg/config/config.go:1635-1707`): rejects more than one enabled provider,
+ * validates the enabled provider's required field(s), then builds its OIDC issuer URL. Throws a
+ * plain `Error` with Go's exact message text on a validation failure; returns `undefined` when no
+ * provider is enabled.
+ */
+export function resolveThirdPartyIssuerUrl(
+  thirdParty: ThirdPartyProvidersLike,
+): string | undefined {
+  const enabledProviders = [
+    thirdParty.firebase.enabled ? "firebase" : undefined,
+    thirdParty.auth0.enabled ? "auth0" : undefined,
+    thirdParty.aws_cognito.enabled ? "aws_cognito" : undefined,
+    thirdParty.clerk.enabled ? "clerk" : undefined,
+    thirdParty.workos.enabled ? "workos" : undefined,
+  ].filter((value): value is NonNullable<typeof value> => value !== undefined);
+
+  if (enabledProviders.length > 1) {
+    throw new Error(
+      "Invalid config: Only one third_party provider allowed to be enabled at a time.",
+    );
+  }
+
+  if (thirdParty.firebase.enabled) {
+    if ((thirdParty.firebase.project_id ?? "").length === 0) {
+      throw new Error(
+        "Invalid config: auth.third_party.firebase is enabled but without a project_id.",
+      );
+    }
+    return `https://securetoken.google.com/${thirdParty.firebase.project_id}`;
+  }
+
+  if (thirdParty.auth0.enabled) {
+    if ((thirdParty.auth0.tenant ?? "").length === 0) {
+      throw new Error("Invalid config: auth.third_party.auth0 is enabled but without a tenant.");
+    }
+    return thirdParty.auth0.tenant_region
+      ? `https://${thirdParty.auth0.tenant}.${thirdParty.auth0.tenant_region}.auth0.com`
+      : `https://${thirdParty.auth0.tenant}.auth0.com`;
+  }
+
+  if (thirdParty.aws_cognito.enabled) {
+    if ((thirdParty.aws_cognito.user_pool_id ?? "").length === 0) {
+      throw new Error(
+        "Invalid config: auth.third_party.cognito is enabled but without a user_pool_id.",
+      );
+    }
+    if (
+      thirdParty.aws_cognito.user_pool_region === undefined ||
+      thirdParty.aws_cognito.user_pool_region.length === 0
+    ) {
+      throw new Error(
+        "Invalid config: auth.third_party.cognito is enabled but without a user_pool_region.",
+      );
+    }
+    return `https://cognito-idp.${thirdParty.aws_cognito.user_pool_region}.amazonaws.com/${thirdParty.aws_cognito.user_pool_id}`;
+  }
+
+  if (thirdParty.clerk.enabled) {
+    const domain = thirdParty.clerk.domain;
+    if (domain === undefined || domain.length === 0) {
+      throw new Error("Invalid config: auth.third_party.clerk is enabled but without a domain.");
+    }
+    if (!clerkDomainPattern.test(domain)) {
+      throw new Error(
+        "Invalid config: auth.third_party.clerk has invalid domain, it usually is like clerk.example.com or example.clerk.accounts.dev. Check https://clerk.com/setup/supabase on how to find the correct value.",
+      );
+    }
+    return `https://${domain}`;
+  }
+
+  if (thirdParty.workos.enabled) {
+    if ((thirdParty.workos.issuer_url ?? "").length === 0) {
+      throw new Error(
+        "Invalid config: auth.third_party.workos is enabled but without a issuer_url.",
+      );
+    }
+    return thirdParty.workos.issuer_url;
+  }
+
+  return undefined;
+}
+
+/**
+ * Go's `(tpa *thirdParty) IssuerURL()` ALONE (`apps/cli-go/pkg/config/config.go:1685-1707`, each
+ * provider's own unconditional `issuerURL()` at `config.go:1556-1636`) — no validation at all. Go's
+ * `Auth.ThirdParty.validate()` (the "at most one enabled" + required-field checks
+ * {@link resolveThirdPartyIssuerUrl} above performs) only runs inside `Config.Validate`'s `if
+ * c.Auth.Enabled` block (`config.go:1087-1153`), but `ResolveJWKS`/`IssuerURL()` is called
+ * unconditionally (`internal/start/start.go:274`) regardless of `auth.enabled`. So when auth is
+ * disabled, only this unchecked, fixed-priority string builder applies: the first enabled
+ * provider (firebase, auth0, aws_cognito, clerk, workos, in that order) wins, with no "more than
+ * one enabled" rejection and no required-field check — a missing required field for the winning
+ * provider just produces a URL with an empty segment, matching Go's own unchecked string
+ * interpolation (`fmt.Sprintf` never errors on an empty string argument).
+ */
+export function thirdPartyIssuerUrlUnchecked(
+  thirdParty: ThirdPartyProvidersLike,
+): string | undefined {
+  if (thirdParty.firebase.enabled) {
+    return `https://securetoken.google.com/${thirdParty.firebase.project_id ?? ""}`;
+  }
+  if (thirdParty.auth0.enabled) {
+    return thirdParty.auth0.tenant_region
+      ? `https://${thirdParty.auth0.tenant ?? ""}.${thirdParty.auth0.tenant_region}.auth0.com`
+      : `https://${thirdParty.auth0.tenant ?? ""}.auth0.com`;
+  }
+  if (thirdParty.aws_cognito.enabled) {
+    return `https://cognito-idp.${thirdParty.aws_cognito.user_pool_region ?? ""}.amazonaws.com/${thirdParty.aws_cognito.user_pool_id ?? ""}`;
+  }
+  if (thirdParty.clerk.enabled) {
+    return `https://${thirdParty.clerk.domain ?? ""}`;
+  }
+  if (thirdParty.workos.enabled) {
+    return thirdParty.workos.issuer_url;
+  }
+  return undefined;
+}
+
+/**
+ * Go's OIDC-discovery + remote-JWKS fetch inside `(a *auth) ResolveJWKS`
+ * (`apps/cli-go/pkg/config/config.go:1730-1774`): resolves `<issuerUrl>/.well-known/
+ * openid-configuration`'s `jwks_uri`, then fetches that URI's `keys` array. Throws/rejects on any
+ * failure rather than swallowing it — Go's `start` treats a failure here as a hard,
+ * command-failing error (`internal/start/start.go:274-277`); `shared/functions/serve.ts`'s own
+ * caller-side leniency (continuing with zero remote keys) is a `functions serve`-only choice made
+ * at the call site, not part of this function's contract.
+ */
+export async function resolveRemoteJwks(issuerUrl: string): Promise<ReadonlyArray<unknown>> {
+  const discoveryResponse = await fetch(`${issuerUrl}/.well-known/openid-configuration`, {
+    signal: AbortSignal.timeout(remoteJwksTimeoutMs),
+  });
+  if (!discoveryResponse.ok) {
+    throw new Error(`Failed to fetch ${issuerUrl}/.well-known/openid-configuration`);
+  }
+
+  const discovery = (await discoveryResponse.json()) as { jwks_uri?: string };
+  if (typeof discovery.jwks_uri !== "string" || discovery.jwks_uri.length === 0) {
+    throw new Error(
+      `auth.third_party: OIDC configuration at URL "${issuerUrl}/.well-known/openid-configuration" does not expose a jwks_uri property`,
+    );
+  }
+
+  const jwksResponse = await fetch(discovery.jwks_uri, {
+    signal: AbortSignal.timeout(remoteJwksTimeoutMs),
+  });
+  if (!jwksResponse.ok) {
+    throw new Error(`Failed to fetch ${discovery.jwks_uri}`);
+  }
+
+  const jwks = (await jwksResponse.json()) as { keys?: ReadonlyArray<unknown> };
+  if (!Array.isArray(jwks.keys) || jwks.keys.length === 0) {
+    throw new Error(
+      `auth.third_party: JWKS at URL "${discovery.jwks_uri}" as discovered from "${issuerUrl}/.well-known/openid-configuration" does not contain any JWK keys`,
+    );
+  }
+
+  return jwks.keys;
+}
diff --git a/apps/cli/src/shared/auth/jwks.unit.test.ts b/apps/cli/src/shared/auth/jwks.unit.test.ts
new file mode 100644
index 0000000000..7c32d1fc9b
--- /dev/null
+++ b/apps/cli/src/shared/auth/jwks.unit.test.ts
@@ -0,0 +1,27 @@
+import { describe, expect, it } from "vitest";
+
+import { toPublicJwk } from "./jwks.ts";
+
+describe("toPublicJwk", () => {
+  it("omits key_ops entirely for an RSA key whose ops filter down to none, matching Go's omitempty", () => {
+    const result = toPublicJwk({ kty: "RSA", key_ops: ["sign"], n: "abc", e: "AQAB" });
+    expect(result.key_ops).toBeUndefined();
+    expect(JSON.stringify(result)).not.toContain("key_ops");
+  });
+
+  it("omits key_ops entirely for an EC key whose ops filter down to none, matching Go's omitempty", () => {
+    const result = toPublicJwk({ kty: "EC", key_ops: ["sign"], crv: "P-256", x: "abc", y: "def" });
+    expect(result.key_ops).toBeUndefined();
+    expect(JSON.stringify(result)).not.toContain("key_ops");
+  });
+
+  it("keeps only the verify entry when key_ops mixes sign and verify", () => {
+    const result = toPublicJwk({ kty: "RSA", key_ops: ["sign", "verify"], n: "abc", e: "AQAB" });
+    expect(result.key_ops).toEqual(["verify"]);
+  });
+
+  it("leaves key_ops undefined when the input never set it", () => {
+    const result = toPublicJwk({ kty: "RSA", n: "abc", e: "AQAB" });
+    expect(result.key_ops).toBeUndefined();
+  });
+});
diff --git a/apps/cli/src/shared/cli/cobra-flag-groups.ts b/apps/cli/src/shared/cli/cobra-flag-groups.ts
new file mode 100644
index 0000000000..bb3e20716a
--- /dev/null
+++ b/apps/cli/src/shared/cli/cobra-flag-groups.ts
@@ -0,0 +1,97 @@
+/**
+ * Whether `--<flagName>` (or `--<flagName>=`) appears in the raw argv after
+ * the command path, matching cobra's `pflag.Changed` semantics — a flag
+ * counts as "set" once passed explicitly, regardless of its resulting value
+ * (e.g. `--use-docker=false` still counts as changed).
+ */
+export function hasExplicitLongFlag(
+  rawArgs: ReadonlyArray<string>,
+  commandPath: ReadonlyArray<string>,
+  flagName: string,
+): boolean {
+  const commandIndex = rawArgs.findIndex((_, index) =>
+    commandPath.every((segment, offset) => rawArgs[index + offset] === segment),
+  );
+  if (commandIndex === -1) {
+    return rawArgs.some((token) => token === `--${flagName}` || token.startsWith(`--${flagName}=`));
+  }
+
+  for (let index = commandIndex + commandPath.length; index < rawArgs.length; index += 1) {
+    const token = rawArgs[index];
+    if (token === undefined || token === "--") {
+      return false;
+    }
+    if (token === `--${flagName}` || token.startsWith(`--${flagName}=`)) {
+      return true;
+    }
+  }
+  return false;
+}
+
+/**
+ * Like `hasExplicitLongFlag`, but aware that a bare (`=`-less) occurrence of a
+ * *value-taking* flag consumes the very next argv token as its value —
+ * matching pflag's `parseLongArg` (`flag.go:1013-1031`), which takes the next
+ * raw arg unconditionally once a long flag needs a value, with no check that
+ * the token looks like another flag.
+ *
+ * Without this, scanning independently per flag name (as `hasExplicitLongFlag`
+ * does) can mistake a consumed value for a literal occurrence of a sibling
+ * mutex flag: `--metadata-file --metadata-url` is pflag's `metadata-file`
+ * flag being handed the (oddly named, but valid) string value
+ * `"--metadata-url"` — cobra never parses `--metadata-url` as its own flag,
+ * so `metadata-url.Changed` stays `false`. A naive scan sees both tokens and
+ * wrongly reports both as set.
+ *
+ * `valueFlagNames` must list every value-taking (non-boolean) flag declared
+ * on the command being scanned, so the scan knows which bare tokens consume a
+ * following value; boolean flags never consume one and must be omitted. This
+ * only covers flags local to the command — a global/inherited value-taking
+ * flag immediately preceding a mutex flag without `=` can still be misread
+ * the same way; closing that fully would mean teaching this scan about every
+ * flag reachable at parse time, not just the command's own, which is a
+ * bigger, cross-cutting change.
+ */
+export function hasExplicitValueFlag(
+  rawArgs: ReadonlyArray<string>,
+  commandPath: ReadonlyArray<string>,
+  valueFlagNames: ReadonlySet<string>,
+  flagName: string,
+): boolean {
+  const commandIndex = rawArgs.findIndex((_, index) =>
+    commandPath.every((segment, offset) => rawArgs[index + offset] === segment),
+  );
+  const scoped = commandIndex !== -1;
+  const tokens = scoped ? rawArgs.slice(commandIndex + commandPath.length) : rawArgs;
+
+  for (let index = 0; index < tokens.length; index += 1) {
+    const token = tokens[index];
+    if (token === undefined || (scoped && token === "--")) {
+      return false;
+    }
+    if (token === `--${flagName}` || token.startsWith(`--${flagName}=`)) {
+      return true;
+    }
+    if (token.startsWith("--") && !token.includes("=") && valueFlagNames.has(token.slice(2))) {
+      // Bare occurrence of a value-taking flag — skip the token it consumes
+      // so it can't be mistaken for a literal occurrence of `flagName`.
+      index += 1;
+    }
+  }
+  return false;
+}
+
+/**
+ * Byte-matches cobra's `validateExclusiveFlagGroups` error
+ * (`flag_groups.go:204`): `group` is the full mutually-exclusive set in
+ * registration order (unsorted, no dashes); `changed` is the subset that
+ * were actually set, sorted alphabetically per cobra's own `sort.Strings`.
+ */
+export function cobraMutuallyExclusiveErrorMessage(
+  group: ReadonlyArray<string>,
+  changed: ReadonlyArray<string>,
+): string {
+  const flagList = group.join(" ");
+  const set = [...changed].sort().join(" ");
+  return `if any flags in the group [${flagList}] are set none of the others can be; [${set}] were all set`;
+}
diff --git a/apps/cli/src/shared/cli/cobra-flag-groups.unit.test.ts b/apps/cli/src/shared/cli/cobra-flag-groups.unit.test.ts
new file mode 100644
index 0000000000..2a410121da
--- /dev/null
+++ b/apps/cli/src/shared/cli/cobra-flag-groups.unit.test.ts
@@ -0,0 +1,155 @@
+import { describe, expect, test } from "vitest";
+import {
+  cobraMutuallyExclusiveErrorMessage,
+  hasExplicitLongFlag,
+  hasExplicitValueFlag,
+} from "./cobra-flag-groups.ts";
+
+const COMMAND_PATH = ["functions", "deploy"] as const;
+
+describe("hasExplicitLongFlag", () => {
+  test("finds a bare flag after the command path", () => {
+    expect(hasExplicitLongFlag(["functions", "deploy", "--use-api"], COMMAND_PATH, "use-api")).toBe(
+      true,
+    );
+  });
+
+  test("finds a flag with an inline value", () => {
+    expect(
+      hasExplicitLongFlag(
+        ["functions", "deploy", "--use-docker=false"],
+        COMMAND_PATH,
+        "use-docker",
+      ),
+    ).toBe(true);
+  });
+
+  test("returns false when the flag is absent", () => {
+    expect(hasExplicitLongFlag(["functions", "deploy", "hello"], COMMAND_PATH, "use-api")).toBe(
+      false,
+    );
+  });
+
+  test("stops scanning at a -- terminator", () => {
+    expect(
+      hasExplicitLongFlag(["functions", "deploy", "--", "--use-api"], COMMAND_PATH, "use-api"),
+    ).toBe(false);
+  });
+
+  test("ignores a flag that appears before the command path", () => {
+    expect(hasExplicitLongFlag(["--use-api", "functions", "deploy"], COMMAND_PATH, "use-api")).toBe(
+      false,
+    );
+  });
+
+  test("falls back to a bare scan when the command path is not found", () => {
+    expect(hasExplicitLongFlag(["--use-api"], COMMAND_PATH, "use-api")).toBe(true);
+    expect(hasExplicitLongFlag(["--use-docker"], COMMAND_PATH, "use-api")).toBe(false);
+  });
+});
+
+describe("hasExplicitValueFlag", () => {
+  const SSO_UPDATE_PATH = ["sso", "update"] as const;
+  const VALUE_FLAGS = new Set(["metadata-file", "metadata-url", "domains", "add-domains"]);
+
+  test("finds a bare flag after the command path", () => {
+    expect(
+      hasExplicitValueFlag(
+        ["sso", "update", "id", "--metadata-file", "foo.xml"],
+        SSO_UPDATE_PATH,
+        VALUE_FLAGS,
+        "metadata-file",
+      ),
+    ).toBe(true);
+  });
+
+  test("finds a flag with an inline value", () => {
+    expect(
+      hasExplicitValueFlag(
+        ["sso", "update", "id", "--domains=a.com"],
+        SSO_UPDATE_PATH,
+        VALUE_FLAGS,
+        "domains",
+      ),
+    ).toBe(true);
+  });
+
+  test("does not mistake a value-taking flag's consumed value for a sibling flag", () => {
+    // pflag's `--flag arg` branch consumes the next token unconditionally
+    // (`flag.go:1013-1031`), so `--metadata-file --metadata-url` gives
+    // `metadata-file` the literal value `"--metadata-url"` and never parses
+    // `--metadata-url` as its own flag.
+    const args = ["sso", "update", "id", "--metadata-file", "--metadata-url"];
+    expect(hasExplicitValueFlag(args, SSO_UPDATE_PATH, VALUE_FLAGS, "metadata-file")).toBe(true);
+    expect(hasExplicitValueFlag(args, SSO_UPDATE_PATH, VALUE_FLAGS, "metadata-url")).toBe(false);
+  });
+
+  test("does not mistake a value-taking flag's consumed value for a sibling flag, reversed", () => {
+    const args = ["sso", "update", "id", "--metadata-url", "--metadata-file"];
+    expect(hasExplicitValueFlag(args, SSO_UPDATE_PATH, VALUE_FLAGS, "metadata-url")).toBe(true);
+    expect(hasExplicitValueFlag(args, SSO_UPDATE_PATH, VALUE_FLAGS, "metadata-file")).toBe(false);
+  });
+
+  test("an inline (`=`) value is never treated as consuming the next token", () => {
+    // `--metadata-file=--metadata-url` is one token: metadata-file's value is
+    // the literal string "--metadata-url", and no token is consumed after it.
+    const args = ["sso", "update", "id", "--metadata-file=--metadata-url", "--domains", "a.com"];
+    expect(hasExplicitValueFlag(args, SSO_UPDATE_PATH, VALUE_FLAGS, "metadata-file")).toBe(true);
+    expect(hasExplicitValueFlag(args, SSO_UPDATE_PATH, VALUE_FLAGS, "metadata-url")).toBe(false);
+    expect(hasExplicitValueFlag(args, SSO_UPDATE_PATH, VALUE_FLAGS, "domains")).toBe(true);
+  });
+
+  test("a real, non-adjacent occurrence of both flags is still detected", () => {
+    const args = ["sso", "update", "id", "--metadata-file", "foo.xml", "--metadata-url", "url"];
+    expect(hasExplicitValueFlag(args, SSO_UPDATE_PATH, VALUE_FLAGS, "metadata-file")).toBe(true);
+    expect(hasExplicitValueFlag(args, SSO_UPDATE_PATH, VALUE_FLAGS, "metadata-url")).toBe(true);
+  });
+
+  test("returns false when the flag is absent", () => {
+    expect(
+      hasExplicitValueFlag(["sso", "update", "id"], SSO_UPDATE_PATH, VALUE_FLAGS, "domains"),
+    ).toBe(false);
+  });
+
+  test("stops scanning at a -- terminator", () => {
+    expect(
+      hasExplicitValueFlag(
+        ["sso", "update", "id", "--", "--domains"],
+        SSO_UPDATE_PATH,
+        VALUE_FLAGS,
+        "domains",
+      ),
+    ).toBe(false);
+  });
+
+  test("falls back to a bare scan when the command path is not found", () => {
+    expect(hasExplicitValueFlag(["--domains"], SSO_UPDATE_PATH, VALUE_FLAGS, "domains")).toBe(true);
+    expect(hasExplicitValueFlag(["--metadata-file"], SSO_UPDATE_PATH, VALUE_FLAGS, "domains")).toBe(
+      false,
+    );
+  });
+});
+
+describe("cobraMutuallyExclusiveErrorMessage", () => {
+  test("byte-matches cobra's validateExclusiveFlagGroups template", () => {
+    expect(
+      cobraMutuallyExclusiveErrorMessage(
+        ["use-api", "use-docker", "legacy-bundle"],
+        ["use-docker", "use-api"],
+      ),
+    ).toBe(
+      "if any flags in the group [use-api use-docker legacy-bundle] are set none of the others can be; [use-api use-docker] were all set",
+    );
+  });
+
+  test("sorts the changed subset alphabetically regardless of input order", () => {
+    expect(
+      cobraMutuallyExclusiveErrorMessage(
+        ["use-api", "use-docker", "legacy-bundle"],
+        ["use-api", "legacy-bundle"],
+      ),
+    ).toBe(
+      "if any flags in the group [use-api use-docker legacy-bundle] are set none of the others can be; [legacy-bundle use-api] were all set",
+    );
+  });
+});
diff --git a/apps/cli/src/shared/cli/hidden-flag.unit.test.ts b/apps/cli/src/shared/cli/hidden-flag.unit.test.ts
index 8dc2efe194..7c9a9bbe07 100644
--- a/apps/cli/src/shared/cli/hidden-flag.unit.test.ts
+++ b/apps/cli/src/shared/cli/hidden-flag.unit.test.ts
@@ -122,11 +122,21 @@ describe("native hidden flags", () => {
     await Effect.runPromise(
       Effect.scoped(
         Effect.gen(function* () {
-          yield* Command.runWith(legacyTestRoot, { version: "0.0.0-test" })(["start", "--preview"]);
-          yield* Command.runWith(legacyTestRoot, { version: "0.0.0-test" })([
+          // `start` and `stop` are both natively ported (no longer `LegacyGoProxy` forwards),
+          // so they can fail for workdir/Docker-related reasons in this proxy-only test layer —
+          // the point here is only to prove the hidden `--preview`/`--backup` flags still parse
+          // by exact name, not that the commands succeed, matching the `functions deploy`/`serve`
+          // assertions below.
+          const startExit = yield* Command.runWith(legacyTestRoot, { version: "0.0.0-test" })([
+            "start",
+            "--preview",
+          ]).pipe(Effect.exit);
+          expect(JSON.stringify(startExit)).not.toContain("UnrecognizedFlag");
+          const stopExit = yield* Command.runWith(legacyTestRoot, { version: "0.0.0-test" })([
             "stop",
             "--backup=false",
-          ]);
+          ]).pipe(Effect.exit);
+          expect(JSON.stringify(stopExit)).not.toContain("UnrecognizedFlag");
           yield* Command.runWith(legacyTestRoot, { version: "0.0.0-test" })([
             "functions",
             "download",
@@ -161,8 +171,6 @@ describe("native hidden flags", () => {
     );
 
     expect(proxy.calls).toEqual([
-      ["start", "--preview"],
-      ["stop", "--backup=false"],
       ["functions", "download", "hello", "--project-ref", "abcdefghijklmnopqrst", "--use-docker"],
     ]);
   });
diff --git a/apps/cli/src/shared/cli/invalid-value-message.ts b/apps/cli/src/shared/cli/invalid-value-message.ts
new file mode 100644
index 0000000000..ff895e2a94
--- /dev/null
+++ b/apps/cli/src/shared/cli/invalid-value-message.ts
@@ -0,0 +1,57 @@
+// Workaround for a doubled "Expected: Expected ..." prefix in
+// effect@4.0.0-beta.93's own primitive parsers. Several `Primitive`s under
+// `effect/unstable/cli` (`choice` — used by `Flag.choice`/
+// `Flag.choiceWithValue` — plus the schema-backed `integer`, `float`,
+// `boolean`, and `date`) fail with a raw message that already starts with
+// the word "Expected" (e.g. `Expected "micro" | "small", got "nano"` or
+// `Expected a valid date, got Invalid Date`), and `CliError.InvalidValue`'s
+// own `message` getter independently prepends its own `"Expected: "` label
+// on top of that — so any flag or argument backed by one of these
+// primitives renders "Expected: Expected ...". Detect this from
+// `error.expected` (the field the buggy primitives actually populate)
+// rather than searching the fully composed `error.message`: `error.value`
+// is user-controlled and interpolated into that same message (including a
+// second time inside `expected` itself, via `choice`'s "got <value>"
+// suffix), so a message-wide, first-occurrence string replace can target
+// the wrong spot if the value itself happens to contain the literal text
+// "Expected: Expected ". Anchoring on `error.expected` and rebuilding the
+// message from the same template `CliError.InvalidValue` uses avoids ever
+// scanning `error.value`. Remove once upstream `effect` fixes this (see
+// CLI-1898).
+//
+// TODO: remove once Effect-TS/effect#6312 is fixed upstream.
+// https://github.com/Effect-TS/effect/issues/6312
+//
+// Shared by two call sites that each see `InvalidValue` failures at a
+// different point in `effect`'s CLI runtime:
+// - `subcommand-flag-suggestions.ts` formats errors that reach the
+//   `CliOutput.Formatter` via the `ShowHelp` envelope — i.e. ordinary
+//   subcommand/argument flags, validated while `Command.runWith` parses the
+//   command tree.
+// - `normalize-error.ts` formats errors from `GlobalFlag.setting` flags
+//   (`--output-format`, and the legacy `--output`/`-o`, `--dns-resolver`,
+//   `--agent`), which `Command.runWith` validates in a later step that runs
+//   *outside* the `ShowHelp` path and therefore never reaches the
+//   formatter — it surfaces as a raw failure through `runCli`'s catch-all
+//   instead.
+const EXPECTED_PREFIX = "Expected ";
+
+export interface InvalidValueMessageFields {
+  readonly option: string;
+  readonly value: string;
+  readonly expected: string;
+  readonly kind: "flag" | "argument";
+}
+
+/**
+ * Rebuilds a `CliError.InvalidValue` message from its own template when
+ * `expected` carries the doubled "Expected" prefix. Returns `undefined` when
+ * `expected` is unaffected, so callers can fall back to the error's own
+ * untouched `message`.
+ */
+export function formatInvalidValueMessage(error: InvalidValueMessageFields): string | undefined {
+  if (!error.expected.startsWith(EXPECTED_PREFIX)) return undefined;
+  return error.kind === "argument"
+    ? `Invalid value for argument <${error.option}>: "${error.value}". ${error.expected}`
+    : `Invalid value for flag --${error.option}: "${error.value}". ${error.expected}`;
+}
diff --git a/apps/cli/src/shared/cli/run.e2e.test.ts b/apps/cli/src/shared/cli/run.e2e.test.ts
new file mode 100644
index 0000000000..3c90257fe2
--- /dev/null
+++ b/apps/cli/src/shared/cli/run.e2e.test.ts
@@ -0,0 +1,62 @@
+import { describe, expect, test } from "vitest";
+import { runSupabase } from "../../../tests/helpers/cli.ts";
+
+/**
+ * CLI-1906: the real bug here is the actual OS process exit code —
+ * `ProcessControl.exit` calls real `process.exit(code)`, so only a genuine
+ * subprocess run proves the shipped binary's exit code changed. Everything
+ * else about this fix (`exitCodeForFailure`'s classification) is covered by
+ * `run.unit.test.ts` and `run.integration.test.ts`; this is the one minimal
+ * case that observes the real subprocess boundary.
+ */
+describe("legacy CLI process exit codes (CLI-1906)", () => {
+  test("bare `branches` (no subcommand, no --help) exits 0", async () => {
+    const { exitCode } = await runSupabase(["branches"], { entrypoint: "legacy" });
+    expect(exitCode).toBe(0);
+  });
+
+  test("a genuine parse error still exits 1", async () => {
+    const { exitCode } = await runSupabase(["branches", "--this-flag-does-not-exist"], {
+      entrypoint: "legacy",
+    });
+    expect(exitCode).toBe(1);
+  });
+});
+
+/**
+ * CLI-1901: a required-flag/choice parse failure used to dump the full help
+ * doc to **stdout** and print the error **twice** on stderr. The buffering
+ * mechanism that fixes this (`withoutParseErrorHelpDump` in `run.ts`) is
+ * already covered against a real command definition, in-process, by
+ * `run.integration.test.ts` — this is the one minimal case that observes the
+ * real subprocess boundary: whether the actual `stdout`/`stderr` streams of
+ * the shipped binary stay separated, and whether the error text is
+ * de-duplicated, matching the real `apps/cli-go/supabase-go` binary (Go
+ * still shows a usage block for an unrecognized flag — raised during
+ * `ParseFlags`, before `PersistentPreRunE` sets `SilenceUsage`
+ * (`apps/cli-go/cmd/root.go:97`) — always on stderr, never stdout;
+ * verified directly against the built Go binary).
+ */
+describe("legacy CLI required-flag/choice parse errors (CLI-1901)", () => {
+  test("an unrecognized flag: stdout stays clean, the help/usage content and the single error line land on stderr with no duplicate", async () => {
+    const { exitCode, stdout, stderr } = await runSupabase(
+      ["branches", "--this-flag-does-not-exist"],
+      { entrypoint: "legacy" },
+    );
+    expect(exitCode).toBe(1);
+    expect(stdout).toBe("");
+    // Matches Go's still-shown usage block for this error class (see the
+    // describe-level comment) — this library's help doc isn't byte-identical
+    // to cobra's shorter usage template, but it's on the right stream now.
+    expect(stderr).toContain("USAGE");
+    // The error text appears exactly once — before the fix, the library's own
+    // duplicate render put it on stderr a second time (on top of the stdout
+    // help dump this test doesn't even need to check for, since stdout is
+    // asserted empty above).
+    const occurrences = stderr.split("Unrecognized flag: --this-flag-does-not-exist").length - 1;
+    expect(occurrences).toBe(1);
+    expect(
+      stderr.trim().endsWith("Try rerunning the command with --debug to troubleshoot the error."),
+    ).toBe(true);
+  });
+});
diff --git a/apps/cli/src/shared/cli/run.integration.test.ts b/apps/cli/src/shared/cli/run.integration.test.ts
new file mode 100644
index 0000000000..1b91a5567d
--- /dev/null
+++ b/apps/cli/src/shared/cli/run.integration.test.ts
@@ -0,0 +1,307 @@
+import { describe, expect, test } from "@effect/vitest";
+import { BunServices } from "@effect/platform-bun";
+import { Console, Effect, Exit, Layer } from "effect";
+import { CliOutput, Command, Flag } from "effect/unstable/cli";
+import { legacyBranchesCommand } from "../../legacy/commands/branches/branches.command.ts";
+import { textCliOutputFormatter } from "../output/text-formatter.ts";
+import { CliArgs } from "./cli-args.service.ts";
+import { exitCodeForFailure, withoutParseErrorHelpDump } from "./run.ts";
+
+/**
+ * A `Console.Console` test double that records `log`/`error` calls into
+ * `calls` instead of writing anywhere, for asserting on writes through the
+ * `Console.Console` Effect service directly. Deliberately NOT `vi.spyOn`ing
+ * the global `console` object: under this repo's Bun + Vitest combination,
+ * spying on `console.log` and `console.error` in the SAME test reliably
+ * breaks call detection on both (reproduced in isolation, unrelated to this
+ * fix) — observing the `Console.Console` service `withoutParseErrorHelpDump`
+ * itself reads and overrides is both more precise and immune to that quirk.
+ */
+function fakeConsole(): { readonly console: Console.Console; readonly calls: Array<string> } {
+  const calls: Array<string> = [];
+  const unused = () => {};
+  return {
+    calls,
+    console: {
+      assert: unused,
+      clear: unused,
+      count: unused,
+      countReset: unused,
+      debug: unused,
+      dir: unused,
+      dirxml: unused,
+      error: (...args: ReadonlyArray<unknown>) => {
+        calls.push(`error:${args.join(" ")}`);
+      },
+      group: unused,
+      groupCollapsed: unused,
+      groupEnd: unused,
+      info: unused,
+      log: (...args: ReadonlyArray<unknown>) => {
+        calls.push(`log:${args.join(" ")}`);
+      },
+      table: unused,
+      time: unused,
+      timeEnd: unused,
+      timeLog: unused,
+      trace: unused,
+      warn: unused,
+    },
+  };
+}
+
+/**
+ * CLI-1906: `supabase branches` (a legacy "group" command — subcommands, no
+ * runnable handler of its own) used to exit 1 when invoked bare, even though
+ * the printed help was identical to `supabase branches --help`, which already
+ * exited 0. These tests run the real `legacyBranchesCommand` definition
+ * through `Command.runWith` (same technique as `version.integration.test.ts`)
+ * so the `ShowHelp` cause shape is the one the real CLI actually produces, not
+ * a hand-rolled stand-in. `legacyBranchesCommand` is exercised directly
+ * (rather than nested under `legacyRoot`) because `legacyRoot`'s
+ * `Command.provide` (see `Command.ts`'s `provide`/`withSubcommands`) wraps its
+ * *entire* handle — including the bare/`--help`/parse-error paths exercised
+ * here — in the production output/proxy layer graph (`Layer.unwrap` reading
+ * every global flag, resolving the Go proxy binary, etc). `Effect.provide`
+ * still *builds* that layer graph before running the wrapped handle even on
+ * these runs; it just never gets *consumed*, because the `ShowHelp` failure
+ * fires before any leaf subcommand handler body executes. Exercising
+ * `legacyBranchesCommand` directly avoids needing to provide or mock that
+ * unused graph for a test that only cares about the `ShowHelp` cause shape.
+ */
+describe("legacy group command exit codes (CLI-1906)", () => {
+  const layerFor = (args: ReadonlyArray<string>) =>
+    Layer.mergeAll(
+      CliOutput.layer(textCliOutputFormatter()),
+      Layer.succeed(CliArgs, { args }),
+      BunServices.layer,
+    );
+
+  const runBranches = (args: ReadonlyArray<string>) =>
+    Effect.runPromiseExit(
+      Command.runWith(legacyBranchesCommand, { version: "0.0.0-test" })(args).pipe(
+        Effect.provide(layerFor(args)),
+      ),
+    );
+
+  test("bare `branches` (no subcommand, no --help) fails with a clean ShowHelp that maps to exit 0", async () => {
+    const exit = await runBranches([]);
+    expect(Exit.isFailure(exit)).toBe(true);
+    if (!Exit.isFailure(exit)) return;
+
+    expect(exitCodeForFailure(exit.cause)).toBe(0);
+  });
+
+  test("`branches --help` succeeds outright and exits 0", async () => {
+    const exit = await runBranches(["--help"]);
+    // The `--help` global flag is handled as a successful `GlobalFlag.Action`, so this
+    // never even reaches the ShowHelp-as-failure path bare `branches` goes through above.
+    expect(Exit.isSuccess(exit)).toBe(true);
+  });
+
+  test("`branches` with an unrecognized flag is a genuine parse error that still exits 1", async () => {
+    const exit = await runBranches(["--this-flag-does-not-exist"]);
+    expect(Exit.isFailure(exit)).toBe(true);
+    if (!Exit.isFailure(exit)) return;
+
+    expect(exitCodeForFailure(exit.cause)).toBe(1);
+  });
+});
+
+/**
+ * CLI-1901: a required-flag/choice parse failure used to dump the full help
+ * doc to stdout (`console.log`) AND print the error twice — once from the
+ * vendored `effect` CLI library's own `showHelp()` (`console.error`), once
+ * from this repo's own Go-parity renderer (`handledProgram` +
+ * `normalizeCause` in `run.ts`, exercised downstream of this test, not
+ * here). These tests run real commands through `Command.runWith`, wrapped in
+ * `withoutParseErrorHelpDump`, and assert on the calls recorded by a fake
+ * `Console.Console` (see `fakeConsole` above) provided in place of the real
+ * one — that's the exact service `withoutParseErrorHelpDump` overrides and
+ * later replays through, so it's what actually matters here.
+ *
+ * Go only suppresses its own usage block for a MISSING REQUIRED FLAG
+ * (`ValidateRequiredFlags`, post-`PersistentPreRunE`) — verified against the
+ * real `apps/cli-go/supabase-go` binary. Every other parse-error tag
+ * (`UnrecognizedOption`, `InvalidValue`, `MissingArgument`,
+ * `UnknownSubcommand`) is raised during `ParseFlags`/`ValidateArgs`, BEFORE
+ * `PersistentPreRunE` sets `SilenceUsage` — Go still shows a usage block for
+ * those, always on stderr, never stdout. `classifyParseErrorConsoleOutput`
+ * (see `run.ts`) mirrors that split; these tests cover both branches.
+ *
+ * `legacyBranchesCommand` (no `Command.provide` of its own — see the
+ * sibling CLI-1906 suite above for why that matters) covers the
+ * `UnrecognizedOption` shape and proves the buffering/conditional-flush
+ * wiring end to end. `MissingOption`/`InvalidValue` specifically need a
+ * genuinely required flag / `Flag.choice`, which every shipped native
+ * command with one (e.g. `sso add`'s `--type`, see `add.command.ts`) also
+ * wraps in its own `Command.provide`d management-API runtime layer —
+ * exercising those tags against a real shipped command would mean
+ * providing or mocking that whole layer graph for services this parse-error
+ * path never consumes (same friction the CLI-1906 suite's own comment
+ * describes and avoids). A minimal `Command.make` with a required
+ * `Flag.string`/`Flag.choice` still runs through the exact same vendored
+ * `Command.runWith`/`showHelp()` machinery that produces the bug — the
+ * command is synthetic, but the `ShowHelp` cause shape it produces is not; a
+ * real subprocess run against `sso add` itself (the issue's own named
+ * repro target) is covered end to end by `sso.e2e.test.ts`.
+ */
+describe("withoutParseErrorHelpDump (CLI-1901)", () => {
+  const layerFor = (args: ReadonlyArray<string>, console: Console.Console) =>
+    Layer.mergeAll(
+      CliOutput.layer(textCliOutputFormatter()),
+      Layer.succeed(CliArgs, { args }),
+      Layer.succeed(Console.Console, console),
+      BunServices.layer,
+    );
+
+  const runBranches = (args: ReadonlyArray<string>, console: Console.Console) =>
+    withoutParseErrorHelpDump(
+      Command.runWith(legacyBranchesCommand, { version: "0.0.0-test" })(args),
+      { rootCommand: legacyBranchesCommand, args },
+    ).pipe(Effect.provide(layerFor(args, console)));
+
+  // `type`'s `-t` alias mirrors the real `sso add --type`/`-t` flag
+  // (`add.command.ts`) so the short-alias "present but missing its value"
+  // case below (Codex review finding, CLI-1901 follow-up) exercises the same
+  // shape end to end, without pulling in `sso add`'s own management-API
+  // runtime layer graph (see the suite-level comment above for why that's
+  // avoided here).
+  const requiredFlagCommand = Command.make("test-required-flag", {
+    type: Flag.choice("type", ["saml"] as const).pipe(Flag.withAlias("t")),
+  });
+
+  const runRequiredFlagCommand = (args: ReadonlyArray<string>, console: Console.Console) =>
+    withoutParseErrorHelpDump(
+      Command.runWith(requiredFlagCommand, { version: "0.0.0-test" })(args),
+      { rootCommand: requiredFlagCommand, args },
+    ).pipe(Effect.provide(layerFor(args, console)));
+
+  test("an unrecognized flag: replays the help dump to stderr (never stdout) and drops the duplicate error, but still fails with the original cause", async () => {
+    const { console, calls } = fakeConsole();
+    const exit = await Effect.runPromiseExit(runBranches(["--this-flag-does-not-exist"], console));
+
+    // The library's own duplicate `Console.error` write is gone. Its help
+    // doc survives, but redirected to stderr (`error:`), never stdout
+    // (`log:`) — matching Go, which still shows usage for an unrecognized
+    // flag (raised during `ParseFlags`, before `SilenceUsage` is set), just
+    // on stderr.
+    expect(calls.length).toBeGreaterThan(0);
+    expect(calls.every((call) => call.startsWith("error:"))).toBe(true);
+
+    // The original ShowHelp/UnrecognizedOption failure still propagates —
+    // the fix only suppresses the library's own console writes, it must not
+    // swallow or reshape the failure this repo's own `handledProgram` +
+    // `normalizeCause` still needs to render the single Go-parity line.
+    expect(Exit.isFailure(exit)).toBe(true);
+    if (!Exit.isFailure(exit)) return;
+    expect(exitCodeForFailure(exit.cause)).toBe(1);
+  });
+
+  test("`branches` bare (clean ShowHelp) still flushes its help dump to stdout and exits 0 (untouched)", async () => {
+    const { console, calls } = fakeConsole();
+    const exit = await Effect.runPromiseExit(runBranches([], console));
+
+    expect(calls.length).toBeGreaterThan(0);
+    expect(calls.every((call) => call.startsWith("log:"))).toBe(true);
+    expect(Exit.isFailure(exit)).toBe(true);
+    if (!Exit.isFailure(exit)) return;
+    expect(exitCodeForFailure(exit.cause)).toBe(0);
+  });
+
+  test("missing a required flag: drops the help dump entirely and the duplicate error, but still fails with the original cause", async () => {
+    const { console, calls } = fakeConsole();
+    const exit = await Effect.runPromiseExit(runRequiredFlagCommand([], console));
+
+    // Go's `SilenceUsage` is already active for a missing required flag
+    // (post-`PersistentPreRunE`) — nothing survives, not even on stderr.
+    expect(calls).toEqual([]);
+    expect(Exit.isFailure(exit)).toBe(true);
+    if (!Exit.isFailure(exit)) return;
+    expect(exitCodeForFailure(exit.cause)).toBe(1);
+  });
+
+  // CLI-1901 (Codex review finding): the vendored library can't tell "flag
+  // never given" apart from "flag given with no value following it" — both
+  // raise `MissingOption`. Go's pflag DOES distinguish these (a present-but-
+  // valueless flag is a `ParseFlags`-time error, before `SilenceUsage` is
+  // set) — verified against the real `apps/cli-go/supabase-go` binary, which
+  // still prints its usage block for this input. `--type` as the LAST token
+  // (no value token follows it) reproduces that "present but valueless" case.
+  test("a required flag present on argv but missing its value: replays the help dump to stderr instead of dropping it", async () => {
+    const { console, calls } = fakeConsole();
+    const exit = await Effect.runPromiseExit(runRequiredFlagCommand(["--type"], console));
+
+    expect(calls.length).toBeGreaterThan(0);
+    expect(calls.every((call) => call.startsWith("error:"))).toBe(true);
+    expect(Exit.isFailure(exit)).toBe(true);
+    if (!Exit.isFailure(exit)) return;
+    expect(exitCodeForFailure(exit.cause)).toBe(1);
+  });
+
+  // Codex review finding (CLI-1901 follow-up): the same "present but missing
+  // its value" case, but supplied via the flag's SHORT ALIAS (`-t`) instead of
+  // its canonical long form. Go's pflag treats a present-but-valueless
+  // shorthand exactly like the long form (`parseSingleShortArg` raises the
+  // same `ValueRequiredError` as `parseLongArg`, same pre-`SilenceUsage`
+  // timing) — verified against the real `apps/cli-go/supabase-go` binary
+  // (`sso add -t`: full usage block on stderr, byte-parallel to `sso add
+  // --type`). Before this fix, `isMissingFlagTokenPresent` only recognized
+  // the canonical `--type` token and misclassified `-t` as absent, silently
+  // dropping the help dump instead.
+  test("a required flag present on argv by its short alias but missing its value: replays the help dump to stderr instead of dropping it", async () => {
+    const { console, calls } = fakeConsole();
+    const exit = await Effect.runPromiseExit(runRequiredFlagCommand(["-t"], console));
+
+    expect(calls.length).toBeGreaterThan(0);
+    expect(calls.every((call) => call.startsWith("error:"))).toBe(true);
+    expect(Exit.isFailure(exit)).toBe(true);
+    if (!Exit.isFailure(exit)) return;
+    expect(exitCodeForFailure(exit.cause)).toBe(1);
+  });
+
+  test("an invalid Flag.choice value: replays the help dump to stderr (never stdout) and drops the duplicate error, but still fails with the original cause", async () => {
+    const { console, calls } = fakeConsole();
+    const exit = await Effect.runPromiseExit(runRequiredFlagCommand(["--type", "bogus"], console));
+
+    expect(calls.length).toBeGreaterThan(0);
+    expect(calls.every((call) => call.startsWith("error:"))).toBe(true);
+    expect(Exit.isFailure(exit)).toBe(true);
+    if (!Exit.isFailure(exit)) return;
+    expect(exitCodeForFailure(exit.cause)).toBe(1);
+  });
+
+  test("`--help` on a command with a required flag still prints the full help doc to stdout and exits 0 (untouched)", async () => {
+    const { console, calls } = fakeConsole();
+    const exit = await Effect.runPromiseExit(runRequiredFlagCommand(["--help"], console));
+
+    expect(calls.length).toBeGreaterThan(0);
+    expect(calls.every((call) => call.startsWith("log:"))).toBe(true);
+    expect(Exit.isSuccess(exit)).toBe(true);
+  });
+
+  // Effect's default logger (`Effect.log*`) resolves through this same
+  // `Console.Console` reference (`Logger.withConsoleLog`/`withConsoleError`
+  // in the vendored library) — see the "buffering scope" note on
+  // `withoutParseErrorHelpDump` in `run.ts`. No command handler in this
+  // codebase uses `Effect.log*` today, but this pins the invariant the doc
+  // comment describes: on a successful run, buffered logger output still
+  // reaches the user (deferred to end-of-run, not dropped).
+  test("Effect.log* output during a successful run is still flushed, not lost", async () => {
+    const { console, calls } = fakeConsole();
+    const program = Effect.gen(function* () {
+      yield* Effect.logInfo("hello from a handler");
+      return "done" as const;
+    });
+
+    const result = await Effect.runPromise(
+      withoutParseErrorHelpDump(program, { rootCommand: requiredFlagCommand, args: [] }).pipe(
+        Effect.provide(Layer.succeed(Console.Console, console)),
+      ),
+    );
+
+    expect(result).toBe("done");
+    expect(calls.length).toBeGreaterThan(0);
+    expect(calls.some((call) => call.includes("hello from a handler"))).toBe(true);
+  });
+});
diff --git a/apps/cli/src/shared/cli/run.ts b/apps/cli/src/shared/cli/run.ts
index 1b29aba459..0ee530f2d3 100644
--- a/apps/cli/src/shared/cli/run.ts
+++ b/apps/cli/src/shared/cli/run.ts
@@ -1,8 +1,8 @@
 import { BunServices } from "@effect/platform-bun";
 import { ProjectConfigStore } from "@supabase/config";
 import { unixHttpClientLayer } from "@supabase/stack";
-import { Cause, Effect, Exit, Fiber, Layer, Stdio } from "effect";
-import { CliOutput, Command } from "effect/unstable/cli";
+import { Cause, Console, Effect, Exit, Fiber, Layer, Runtime, Stdio } from "effect";
+import { CliError, CliOutput, Command } from "effect/unstable/cli";
 import { CLI_VERSION } from "./version.ts";
 import { Credentials } from "../../next/auth/credentials.service.ts";
 import { jsonCliOutputFormatter } from "../output/json-formatter.ts";
@@ -11,6 +11,7 @@ import { outputLayerFor } from "../output/output.layer.ts";
 import { normalizeCause } from "../output/normalize-error.ts";
 import type { OutputFormat } from "../output/types.ts";
 import { Output } from "../output/output.service.ts";
+import { LegacyGoChildExitError } from "../legacy/legacy-go-child-exit.error.ts";
 import { cliConfigLayer } from "../../next/config/cli-config.layer.ts";
 import { projectHomeLayer } from "../../next/config/project-home.layer.ts";
 import { ProjectLocalServiceVersions } from "../../next/config/project-local-service-versions.service.ts";
@@ -28,6 +29,8 @@ import { telemetryRuntimeLayer } from "../telemetry/runtime.layer.ts";
 import { tracingLayer } from "../telemetry/tracing.layer.ts";
 import { CliArgs } from "./cli-args.service.ts";
 import { resolveAgentOutputFormatFromArgs } from "./agent-output.ts";
+import type { CliErrorSuggestionContext } from "./subcommand-flag-suggestions.ts";
+import { flagAliasesFor, isValueTakingFlagTokenFor } from "./subcommand-flag-suggestions.ts";
 
 // Global flags that consume the following argv token as their value. Keep this in
 // sync with the value-taking global flags defined in `shared/cli/global-flags.ts`
@@ -47,9 +50,26 @@ const globalFlagsWithValues = new Set([
 // Commands that run their own foreground signal loop (serve/start daemons) and must
 // NOT be wrapped in the global signal-interrupt handler, which would otherwise race
 // their graceful shutdown. Matched by leading command-path segments.
+//
+// Top-level `start` (["start"]) is deliberately NOT listed here: it used to proxy to the
+// Go binary, which managed SIGINT/SIGTERM itself, but the native TypeScript `legacyStart`
+// installs no signal handling of its own — excluding it left Ctrl-C mid-bring-up as a raw,
+// unhandled OS signal that hard-kills the process, skipping every Effect finalizer
+// including `legacyRollbackStart`. Go's own `start` DOES roll back on SIGINT
+// (`cmd/root.go:99,155` wraps every command's context with `signal.NotifyContext`;
+// `internal/start/start.go:73-82` rolls back on any non-nil `run()` error, including the
+// `context.Canceled` a SIGINT produces), so native `start` must participate in the global
+// wrapper to match. This list is matched purely against argv command-path segments — it has
+// no notion of which shell (legacy vs next) registered the matching command, so `next start`
+// (a completely different command tree that happens to share the literal path `["start"]`)
+// needs its OWN exemption, passed via `RunCliOptions.additionalSelfManagedSignalCommands` from
+// `next/cli/main.ts` — see that call site's comment for why.
 const selfManagedSignalCommands: ReadonlyArray<ReadonlyArray<string>> = [
-  ["start"],
   ["db", "start"],
+  // `db reset` (local path) drives the bootstrap seam, which holds SIGINT/SIGTERM/SIGHUP with
+  // no-op listeners while the Go child recreates the container; the global handler would
+  // otherwise race that and cut off the child's Docker cleanup / status propagation.
+  ["db", "reset"],
   ["functions", "serve"],
 ];
 
@@ -71,9 +91,12 @@ export function extractCommandPath(args: ReadonlyArray<string>): ReadonlyArray<s
 }
 
 /** Whether the global signal-interrupt handler should wrap this invocation. */
-export function shouldUseGlobalSignalInterrupt(args: ReadonlyArray<string>): boolean {
+export function shouldUseGlobalSignalInterrupt(
+  args: ReadonlyArray<string>,
+  additionalSelfManagedCommands: ReadonlyArray<ReadonlyArray<string>> = [],
+): boolean {
   const commandPath = extractCommandPath(args);
-  return !selfManagedSignalCommands.some((command) =>
+  return ![...selfManagedSignalCommands, ...additionalSelfManagedCommands].some((command) =>
     command.every((segment, index) => commandPath[index] === segment),
   );
 }
@@ -89,17 +112,331 @@ function formatterLayerFor(
     : CliOutput.layer(textCliOutputFormatter(context));
 }
 
-function isErrorRecord(error: unknown): error is Record<string, unknown> {
-  return typeof error === "object" && error !== null;
+/**
+ * Process exit code for a failed CLI run, matching Go cobra's exit-code
+ * mapping. Delegates to Effect's own `Runtime` exit-code protocol (the same
+ * one `Runtime.defaultTeardown` uses) rather than hand-rolling `ShowHelp`
+ * classification: `CliError.ShowHelp` declares
+ * `[Runtime.errorExitCode] = this.errors.length ? 1 : 0`, so a bare group
+ * command's default handler failing with `ShowHelp({ errors: [] })` (no
+ * subcommand given, e.g. `supabase branches`) reads as exit `0` here — matching
+ * Go cobra's non-`Runnable()` handling, which internally returns
+ * `flag.ErrHelp` and `ExecuteC()` maps that to "print help, return nil error".
+ * A `ShowHelp` with a non-empty `errors` array (a genuine parse/validation
+ * failure) reads as exit `1`, and any other failure (including a `Cause.die`
+ * defect with no typed `ShowHelp` marker at all) falls back to
+ * `Runtime.getErrorExitCode`'s default of `1`. An explicit `--help` invocation
+ * never reaches this function — it's handled earlier as a successful
+ * `GlobalFlag.Action` and exits 0 via the success path.
+ */
+export function exitCodeForFailure(cause: Cause.Cause<unknown>): number {
+  if (Cause.hasInterruptsOnly(cause)) return 130;
+  return Runtime.getErrorExitCode(Cause.squash(cause));
+}
+
+/**
+ * Whether `handledProgram` should render its generic `output.fail` stderr line
+ * for a failed run, given the run's cause and the exit code `exitCodeForFailure`
+ * already computed for it. False for a clean exit (`0`), an interrupt (`130`),
+ * and a `LegacyGoChildExitError` (CLI-1879) — a delegated Go child already wrote
+ * its own detailed failure to the inherited stderr, so a second generic line
+ * here would be a line Go itself never prints.
+ *
+ * Checked by concrete type, NOT Effect's shared `[Runtime.errorReported]`
+ * marker: `CliError.ShowHelp` also sets that marker to `false`, for an
+ * unrelated reason (the CLI framework already rendered help/usage text) —
+ * gating on the marker would ALSO suppress `normalizeCause`'s Go-parity
+ * rendering for a `MissingOption` wrapped in `ShowHelp` (e.g. `Error: required
+ * flag(s) "type" not set`), a real parity regression. See the test suite for
+ * the regression this guards.
+ */
+export function shouldReportFailure(cause: Cause.Cause<unknown>, exitCode: number): boolean {
+  if (exitCode === 0 || exitCode === 130) return false;
+  return !(Cause.squash(cause) instanceof LegacyGoChildExitError);
 }
 
-function isExplicitHelpCause(cause: Cause.Cause<unknown>): boolean {
-  const error = Cause.findErrorOption(cause);
-  if (error._tag !== "Some" || !isErrorRecord(error.value)) return false;
-  if (error.value["_tag"] !== "ShowHelp") return false;
+/**
+ * A single `Console.log`/`Console.error` call captured while
+ * `withoutParseErrorHelpDump` runs, so it can be replayed once the run's
+ * outcome is known instead of being written immediately.
+ */
+interface BufferedConsoleWrite {
+  readonly method: "log" | "error";
+  readonly args: ReadonlyArray<unknown>;
+}
 
-  const errors = error.value["errors"];
-  return !Array.isArray(errors) || errors.length === 0;
+/**
+ * A `Console.Console` that captures `log`/`error` calls into `sink` instead
+ * of writing them, and forwards every other method straight through to the
+ * real console. The vendored `effect` CLI library's parser only ever calls
+ * `log`/`error` (`showHelp()` and the `Help`/`Version`/`Completions`
+ * `GlobalFlag.Action`s in `Command.ts`) — the rest are implemented so this
+ * stays a faithful `Console.Console` rather than a partial stand-in.
+ */
+function bufferingConsole(sink: Array<BufferedConsoleWrite>): Console.Console {
+  const real = globalThis.console;
+  return {
+    assert: real.assert.bind(real),
+    clear: real.clear.bind(real),
+    count: real.count.bind(real),
+    countReset: real.countReset.bind(real),
+    debug: real.debug.bind(real),
+    dir: real.dir.bind(real),
+    dirxml: real.dirxml.bind(real),
+    error: (...args: ReadonlyArray<unknown>) => {
+      sink.push({ method: "error", args });
+    },
+    group: real.group.bind(real),
+    groupCollapsed: real.groupCollapsed.bind(real),
+    groupEnd: real.groupEnd.bind(real),
+    info: real.info.bind(real),
+    log: (...args: ReadonlyArray<unknown>) => {
+      sink.push({ method: "log", args });
+    },
+    table: real.table.bind(real),
+    time: real.time.bind(real),
+    timeEnd: real.timeEnd.bind(real),
+    timeLog: real.timeLog.bind(real),
+    trace: real.trace.bind(real),
+    warn: real.warn.bind(real),
+  };
+}
+
+/**
+ * How `withoutParseErrorHelpDump` should dispose of its buffered
+ * `Console.log`/`Console.error` writes, given how the wrapped effect failed:
+ *
+ * - `"flush-unchanged"` — success, or a "clean" `ShowHelp` (`errors: []` —
+ *   an explicit `--help` or a bare group command with no subcommand, both
+ *   of which map to exit `0` per `exitCodeForFailure` above), or any other
+ *   failure. Those buffered writes (if any, there normally are none outside
+ *   the two `ShowHelp` cases) are the actual intended output.
+ * - `"drop"` — a genuine parse/validation failure Go cobra's
+ *   `PersistentPreRunE` already suppresses usage for: `ValidateRequiredFlags`
+ *   (cobra `command.go:1007`), which sets `cmd.SilenceUsage = true`
+ *   (`apps/cli-go/cmd/root.go:97`) BEFORE it runs. This library's
+ *   `MissingOption` is the one tag that maps to that stage — see CLI-1901 —
+ *   but ONLY when the flag was never given at all. A required flag that IS
+ *   present on argv but missing its value (e.g. `sso add --type` with
+ *   nothing after it) also raises `MissingOption` in this library (it has no
+ *   distinct "value required" tag), yet Go's own pflag raises a DIFFERENT,
+ *   earlier `ParseFlags`-time error for that input (`flag needs an
+ *   argument: --type`) which does NOT get `SilenceUsage` treatment — verified
+ *   against the real binary (`apps/cli-go/supabase-go sso add --type`: full
+ *   usage block on stderr, vs `sso add --project-ref x` with `--type` never
+ *   mentioned at all: bare `required flag(s) "type" not set`, no usage). See
+ *   `isMissingFlagTokenPresent` below for how this case is distinguished from
+ *   a genuinely-absent flag.
+ * - `"flush-help-doc-to-stderr"` — every other genuine parse/validation
+ *   failure (`UnrecognizedOption`, `InvalidValue`, `MissingArgument`,
+ *   `UnknownSubcommand`; multiple simultaneous errors also lands here).
+ *   These map to cobra's `ParseFlags`/`ValidateArgs` (`command.go:919,968`),
+ *   which run BEFORE `PersistentPreRunE` — Go still shows a usage block for
+ *   these, just on stderr, never stdout (verified against the real
+ *   `apps/cli-go/supabase-go` binary, e.g. `branches --bogus-flag` and
+ *   `sso add --type bogus`). The help doc this library renders isn't
+ *   byte-identical to cobra's shorter usage template (that would need a
+ *   second formatter, out of scope for CLI-1901), but showing SOME usage
+ *   content on the RIGHT stream is closer to Go than showing none at all.
+ *
+ * In every "genuine failure" case, the buffered `Console.error` write (the
+ * library's own duplicate render of the errors) is always dropped — this
+ * repo's own `handledProgram` + `normalizeCause` already render the single
+ * Go-parity line for it (see `withoutParseErrorHelpDump` below).
+ */
+export type ParseErrorConsoleDisposition = "flush-unchanged" | "drop" | "flush-help-doc-to-stderr";
+
+/**
+ * Whether `option`'s canonical long-form flag token (`--option` or
+ * `--option=...`), or one of its short/long `aliases` (e.g. `-t`), appears
+ * anywhere in the raw argv this run was invoked with BEFORE the `--`
+ * operand terminator (if any) — used to tell a genuinely-absent required
+ * flag (Go: `SilenceUsage`-suppressed) apart from one that's present but
+ * missing its value (Go: a `ParseFlags`-time error, usage still shown). See
+ * the `"drop"` case on `ParseErrorConsoleDisposition` above for the full
+ * rationale. `aliases` come from `flagAliasesFor` (see
+ * `classifyParseErrorConsoleOutput` below), already formatted with their
+ * leading dash(es).
+ *
+ * Tokens after a literal `--` are always positional operands, never a flag
+ * occurrence for ANY option — this mirrors the vendored `effect` CLI
+ * library's own lexer, which treats `--` the same way (`internal/lexer.ts`,
+ * `argv.indexOf("--")`). Without this cutoff, a command like
+ * `migration repair -- 20230101000000 --status` (a required `Flag.choice`,
+ * `legacy/commands/migration/repair/repair.command.ts`) would have its
+ * trailing `--status` positional argument misread as evidence the `--status`
+ * flag was given, flipping a genuinely-absent-flag failure (Go: no usage
+ * shown) into a "present but missing its value" one (Go: usage shown) — see
+ * CLI-1901.
+ *
+ * That `--` cutoff is only genuine when the scan reaches `--` as a LIVE
+ * token, not when it was itself consumed as the VALUE of an immediately
+ * preceding value-taking flag. Go/pflag's `parseArgs` (`flag.go`) only
+ * recognizes `--` as the terminator when it's at the FRONT of the remaining
+ * args on a fresh iteration; `parseLongArg`'s value branch pops the very
+ * next raw token with no shape check at all, so a literal `--` right after a
+ * value-taking flag gets swallowed as that flag's value and never reaches
+ * the terminator check — e.g. `sso add --project-ref -- --type` hands the
+ * literal string `--` to `--project-ref`, and parsing resumes normally on
+ * `--type` (which then fails with pflag's OWN `ValueRequiredError` — a
+ * `ParseFlags`-time error, usage still shown — since nothing follows it).
+ * The scan below therefore folds the terminator check into the very same
+ * loop that already skips consumed-value tokens, rather than precomputing
+ * `args.indexOf("--")` up front — a Codex review finding on CLI-1901.
+ *
+ * `isValueTakingToken` (from `isValueTakingFlagTokenFor`, OR'd with
+ * `globalFlagsWithValues` at the `classifyParseErrorConsoleOutput` call site
+ * below) lets the scan skip a token immediately consumed as the VALUE of a
+ * preceding value-taking flag — local OR global — instead of mistaking that
+ * consumed token (or a consumed literal `--`, per above) for `option`'s own
+ * occurrence. Go/pflag's `parseLongArg` (`flag.go`) unconditionally consumes
+ * the very next argv entry as a value-taking flag's value, even when that
+ * entry itself looks like another flag — e.g. `sso add --project-ref --type`
+ * hands the literal string `--type` to `--project-ref`, so `--type` is never
+ * seen as its own occurrence in Go, and its `MissingOption` failure keeps
+ * Go's `SilenceUsage` treatment (no usage shown). The vendored `effect`
+ * parser does NOT replicate that eager consumption (it only treats a
+ * following token as a value when the lexer tags it `Value`, never a
+ * flag-shaped token — `internal/parser.ts`'s `consumeFlagValueWithTokens`),
+ * so without this skip the raw scan would find the literal `--type` token
+ * and wrongly flush the help doc for an input Go shows no usage for — a
+ * Codex review finding on CLI-1901.
+ */
+function isMissingFlagTokenPresent(
+  option: string,
+  args: ReadonlyArray<string>,
+  aliases: ReadonlyArray<string> = [],
+  isValueTakingToken: (token: string) => boolean = () => false,
+): boolean {
+  const tokens = [`--${option}`, ...aliases];
+  for (let index = 0; index < args.length; index++) {
+    const arg = args[index];
+    if (arg === undefined) continue;
+    // A literal "--" only terminates flag parsing when reached as a LIVE
+    // token here — if the previous iteration already skipped it as a
+    // value-taking flag's consumed value (below), this line never runs for
+    // it, matching pflag's own ordering (see the doc comment above).
+    if (arg === "--") break;
+    if (tokens.some((token) => arg === token || arg.startsWith(`${token}=`))) return true;
+    const equalIndex = arg.indexOf("=");
+    const bareToken = equalIndex === -1 ? arg : arg.slice(0, equalIndex);
+    if (equalIndex === -1 && isValueTakingToken(bareToken)) {
+      // Go/pflag consumes the following argv entry as `bareToken`'s value
+      // unconditionally — even a literal "--" — so skip it here too, before
+      // the next iteration's terminator check ever sees it.
+      index++;
+    }
+  }
+  return false;
+}
+
+export function classifyParseErrorConsoleOutput(
+  cause: Cause.Cause<unknown>,
+  context: CliErrorSuggestionContext,
+): ParseErrorConsoleDisposition {
+  const error = Cause.squash(cause);
+  if (!CliError.isCliError(error) || error._tag !== "ShowHelp" || error.errors.length === 0) {
+    return "flush-unchanged";
+  }
+  // `isValueTakingFlagTokenFor` only inspects the resolved LEAF command's own
+  // flags, so it has no visibility into value-taking GLOBAL flags (`--network-id`,
+  // `--profile`, etc. — see `globalFlagsWithValues` above). Without OR-ing those
+  // in, a global value flag consuming the very next token (e.g.
+  // `migration repair --network-id --status --local <version>` handing the
+  // literal `--status` to `--network-id`, per pflag's `parseLongArg`) would
+  // leave the required `status` flag looking "present" to the scan below, even
+  // though Go/pflag never sees it as its own occurrence and suppresses usage
+  // for it (`SilenceUsage`) — a Codex review finding on CLI-1901.
+  const isLeafValueTakingToken = isValueTakingFlagTokenFor(context.rootCommand, error.commandPath);
+  const isValueTakingToken = (token: string) =>
+    globalFlagsWithValues.has(token) || isLeafValueTakingToken(token);
+  const isSuppressedMissingFlag = (inner: (typeof error.errors)[number]) =>
+    inner._tag === "MissingOption" &&
+    !isMissingFlagTokenPresent(
+      inner.option,
+      context.args,
+      flagAliasesFor(context.rootCommand, error.commandPath, inner.option),
+      isValueTakingToken,
+    );
+  return error.errors.every(isSuppressedMissingFlag) ? "drop" : "flush-help-doc-to-stderr";
+}
+
+/**
+ * Wraps `Command.runWith(rootCommand, ...)(args)` so the vendored `effect`
+ * CLI library's OWN `Console.log`/`Console.error` writes are captured
+ * instead of reaching the real console, then disposed of per
+ * `classifyParseErrorConsoleOutput` once the run's outcome is known:
+ * dropped entirely for a missing-required-flag failure, replayed to stderr
+ * (never stdout) for every other genuine parse/validation failure, and
+ * replayed unchanged for everything else. Either way, the library's own
+ * duplicate error render never survives — this repo's own `handledProgram`
+ * + `normalizeCause` already render the single Go-parity line for it. That
+ * fixes both halves of CLI-1901 (the stdout help dump and the duplicate
+ * error line) from this one call site, without patching the vendored
+ * library itself.
+ *
+ * TODO: remove this whole buffering/classification dance once upstream
+ * Effect-TS/effect#6313 is fixed — https://github.com/Effect-TS/effect/issues/6313.
+ * `runWith` has no supported way to opt out of, or redirect, its own
+ * `showHelp` console writes; everything below exists only to work around
+ * that gap from the outside.
+ *
+ * The "flush unchanged" outcome covers success, `--help`, `--version`,
+ * `--completions`, and the bare-group-command help dump, all of which stay
+ * untouched.
+ *
+ * Safe to wrap the entire `runWith` call — parsing AND the eventual command
+ * handler, not just the parse phase that can actually raise `ShowHelp`: no
+ * command handler in this codebase writes through `effect`'s `Console`
+ * service directly (they go through the `Output` service instead). One
+ * indirect exception is known — `@supabase/config`'s `loadProjectConfigFile`
+ * emits its deprecated-config-section warnings via `Console.error`, and is
+ * reachable from handlers through `ProjectConfigStore`/`loadProjectConfig` —
+ * so it pins itself to the real console (`Effect.provideService(Console.Console,
+ * globalThis.console)`) rather than relying on whatever `Console.Console` is
+ * ambient here; see CLI-1901 and that package's `io.ts` for why (a
+ * long-running command like `functions serve` would otherwise have the
+ * warning buffered for its entire session instead of shown at startup).
+ * Any other handler writing through `Console` directly would need the same
+ * treatment — buffering here never delays or drops real command output
+ * ONLY as long as that invariant holds. Note that Effect's OWN default
+ * logger (`Effect.log*`) DOES resolve through this same `Console` reference
+ * (`Logger.withConsoleLog`/`withConsoleError`) — this codebase has no
+ * `Effect.log*` call sites today, but if one is ever added to a handler, its
+ * output would be buffered too (deferred to end-of-run on the "flush
+ * unchanged" path, or dropped on a genuine parse failure — which never runs
+ * a handler in the first place, so that half is moot).
+ */
+export function withoutParseErrorHelpDump<A, E, R>(
+  effect: Effect.Effect<A, E, R>,
+  context: CliErrorSuggestionContext,
+): Effect.Effect<A, E, R> {
+  return Effect.gen(function* () {
+    const sink: Array<BufferedConsoleWrite> = [];
+    const exit = yield* effect.pipe(
+      Effect.provideService(Console.Console, bufferingConsole(sink)),
+      Effect.exit,
+    );
+    const disposition = Exit.isFailure(exit)
+      ? classifyParseErrorConsoleOutput(exit.cause, context)
+      : "flush-unchanged";
+    if (disposition === "drop") {
+      return yield* exit;
+    }
+    for (const write of sink) {
+      // The library's own duplicate error render never survives a genuine
+      // parse failure — only its help-doc `log` write gets a second look,
+      // redirected to stderr instead of its original stdout-bound method.
+      if (disposition === "flush-help-doc-to-stderr" && write.method === "error") continue;
+      const method = disposition === "flush-help-doc-to-stderr" ? "error" : write.method;
+      yield* Console.consoleWith((console) =>
+        Effect.sync(() => {
+          console[method](...write.args);
+        }),
+      );
+    }
+    return yield* exit;
+  });
 }
 
 function projectContextLayerFor(runtimeLayer: Layer.Layer<never>) {
@@ -126,6 +463,13 @@ type AnyAnalyticsLayer = Layer.Layer<Analytics, never, any>;
 
 export interface RunCliOptions {
   readonly analyticsLayer: AnyAnalyticsLayer;
+  /**
+   * Extra command paths (on top of the shared `selfManagedSignalCommands` list) that must NOT
+   * be wrapped in the global signal-interrupt handler for this shell specifically — see
+   * `next/cli/main.ts`'s own `start` exemption for why a shell needs this instead of just
+   * adding to the shared list.
+   */
+  readonly additionalSelfManagedSignalCommands?: ReadonlyArray<ReadonlyArray<string>>;
 }
 
 function cliProgramFor(
@@ -158,7 +502,10 @@ function cliProgramFor(
       }),
     ),
   );
-  return Command.runWith(rootCommand, { version: CLI_VERSION })(args).pipe(
+  return withoutParseErrorHelpDump(Command.runWith(rootCommand, { version: CLI_VERSION })(args), {
+    rootCommand,
+    args,
+  }).pipe(
     Effect.provide(formatterLayerFor(rootCommand, args, outputFormat)),
     Effect.provide(options.analyticsLayer),
     Effect.provide(tracingLayer),
@@ -183,7 +530,16 @@ export async function runCli(rootCommand: Command.Command.Any, options: RunCliOp
     }).pipe(Effect.provide(BunServices.layer)),
   );
 
-  const useGlobalSignalInterrupt = shouldUseGlobalSignalInterrupt(args);
+  // Same `{ rootCommand, args }` shape `formatterLayerFor` builds below, so
+  // `normalizeCause`'s single-render fallback path (CLI-1901) can reuse
+  // `formatCliErrorsForDisplay` and surface the same subcommand-flag hint the
+  // text/json formatters would have shown before the vendored library's own
+  // duplicate render was suppressed.
+  const suggestionContext = { rootCommand, args };
+  const useGlobalSignalInterrupt = shouldUseGlobalSignalInterrupt(
+    args,
+    options.additionalSelfManagedSignalCommands,
+  );
   const outputFormat = await Effect.runPromise(
     Effect.gen(function* () {
       const aiTool = yield* AiTool;
@@ -228,11 +584,17 @@ export async function runCli(rootCommand: Command.Command.Any, options: RunCliOp
       const output = yield* Output;
       const exit = yield* program.pipe(Effect.exit);
       if (Exit.isFailure(exit)) {
-        const interrupted = Cause.hasInterruptsOnly(exit.cause);
-        if (!interrupted && !isExplicitHelpCause(exit.cause)) {
-          yield* output.fail(normalizeCause(exit.cause));
+        const exitCode = exitCodeForFailure(exit.cause);
+        // See `shouldReportFailure` for the reporting rules (and why they're
+        // NOT keyed on Effect's shared `[Runtime.errorReported]` marker).
+        // Literal `--help` never reaches this branch — it's handled as a
+        // successful `GlobalFlag.Action` and exits 0 via the success path
+        // below. See `exitCodeForFailure` for why a "clean" ShowHelp failure
+        // (e.g. a bare group command with no subcommand) also maps to exit 0.
+        if (shouldReportFailure(exit.cause, exitCode)) {
+          yield* output.fail(normalizeCause(exit.cause, suggestionContext));
         }
-        return yield* processControl.exit(interrupted ? 130 : 1);
+        return yield* processControl.exit(exitCode);
       }
       const exitCode = yield* processControl.getExitCode;
       return yield* processControl.exit(exitCode ?? 0);
diff --git a/apps/cli/src/shared/cli/run.unit.test.ts b/apps/cli/src/shared/cli/run.unit.test.ts
index fdb66377a3..e337427026 100644
--- a/apps/cli/src/shared/cli/run.unit.test.ts
+++ b/apps/cli/src/shared/cli/run.unit.test.ts
@@ -1,6 +1,25 @@
+import { Cause } from "effect";
+import { CliError, Command } from "effect/unstable/cli";
 import { describe, expect, it } from "vitest";
 
-import { extractCommandPath, shouldUseGlobalSignalInterrupt } from "./run.ts";
+import { legacyBranchesCommand } from "../../legacy/commands/branches/branches.command.ts";
+import { legacyMigrationCommand } from "../../legacy/commands/migration/migration.command.ts";
+import { legacySsoCommand } from "../../legacy/commands/sso/sso.command.ts";
+import { LegacyGoChildExitError } from "../legacy/legacy-go-child-exit.error.ts";
+import {
+  classifyParseErrorConsoleOutput,
+  exitCodeForFailure,
+  extractCommandPath,
+  shouldReportFailure,
+  shouldUseGlobalSignalInterrupt,
+} from "./run.ts";
+
+// Real command tree (not a hand-rolled stand-in) so `classifyParseErrorConsoleOutput`'s
+// alias resolution (`flagAliasesFor`, via `context.rootCommand`) has real `Flag.withAlias`
+// declarations to walk — e.g. `sso add`'s `type` flag aliases to `-t` (`add.command.ts`).
+const testRoot = Command.make("supabase").pipe(
+  Command.withSubcommands([legacyBranchesCommand, legacyMigrationCommand, legacySsoCommand]),
+);
 
 describe("extractCommandPath", () => {
   it("returns positional command-path tokens", () => {
@@ -28,17 +47,454 @@ describe("extractCommandPath", () => {
 describe("shouldUseGlobalSignalInterrupt", () => {
   it("opts out for self-managed signal commands, even behind global flags", () => {
     expect(shouldUseGlobalSignalInterrupt(["functions", "serve"])).toBe(false);
-    expect(shouldUseGlobalSignalInterrupt(["start"])).toBe(false);
     expect(shouldUseGlobalSignalInterrupt(["db", "start"])).toBe(false);
+    // `db reset` drives the bootstrap seam (holds signals for the Go child), so it must not
+    // be wrapped in the global handler either.
+    expect(shouldUseGlobalSignalInterrupt(["db", "reset"])).toBe(false);
     expect(
       shouldUseGlobalSignalInterrupt(["--workdir", "/tmp/app", "functions", "serve", "--debug"]),
     ).toBe(false);
   });
 
-  it("opts in for ordinary commands", () => {
+  it("opts in for ordinary commands, including native start (it installs no signal handling of its own, so the global wrapper's rollback-on-interrupt is the only thing that runs legacyRollbackStart on Ctrl-C)", () => {
     expect(shouldUseGlobalSignalInterrupt(["functions", "list"])).toBe(true);
     expect(shouldUseGlobalSignalInterrupt(["db", "push"])).toBe(true);
     expect(shouldUseGlobalSignalInterrupt(["projects", "list"])).toBe(true);
+    expect(shouldUseGlobalSignalInterrupt(["start"])).toBe(true);
     expect(shouldUseGlobalSignalInterrupt([])).toBe(true);
   });
+
+  it("opts out for a shell's own additional self-managed commands, without affecting other shells sharing the same argv path", () => {
+    // `next start` already races its own flows against `interruptOnSignal` (see
+    // `next/cli/main.ts`'s call site) — matched purely against argv, `run.ts` itself can't tell
+    // this apart from legacy's native `start`, so the exemption is additive per shell instead of
+    // baked into the shared `selfManagedSignalCommands` list.
+    expect(shouldUseGlobalSignalInterrupt(["start"], [["start"]])).toBe(false);
+    // Without the override, the same argv still opts in (this is what legacy's own call site
+    // relies on for native start's rollback-on-interrupt).
+    expect(shouldUseGlobalSignalInterrupt(["start"])).toBe(true);
+    expect(shouldUseGlobalSignalInterrupt(["start"], [])).toBe(true);
+  });
+});
+
+describe("exitCodeForFailure", () => {
+  // CLI-1906: a group command's default handler (e.g. bare `supabase branches`, which
+  // has subcommands but no runnable handler of its own) fails with exactly this shape:
+  // ShowHelp with an empty `errors` array. `CliError.ShowHelp` declares
+  // `[Runtime.errorExitCode] = this.errors.length ? 1 : 0`, so this reads as exit 0 —
+  // matching Go cobra's `flag.ErrHelp` handling for non-Runnable commands. Before
+  // CLI-1906, this case always returned 1.
+  it("exits 0 for a clean ShowHelp failure (bare group command)", () => {
+    const cause = Cause.fail(new CliError.ShowHelp({ commandPath: ["branches"], errors: [] }));
+    expect(exitCodeForFailure(cause)).toBe(0);
+  });
+
+  it("exits 1 for a ShowHelp cause carrying a genuine validation error", () => {
+    const cause = Cause.fail(
+      new CliError.ShowHelp({
+        commandPath: ["branches"],
+        errors: [new CliError.UnrecognizedOption({ option: "--bogus", suggestions: [] })],
+      }),
+    );
+    expect(exitCodeForFailure(cause)).toBe(1);
+  });
+
+  it("exits 1 for a non-ShowHelp failure", () => {
+    const cause = Cause.fail(new Error("boom"));
+    expect(exitCodeForFailure(cause)).toBe(1);
+  });
+
+  // `Cause.squash` on a `Die` cause returns the raw defect (a plain `Error`, with no
+  // `Runtime.errorExitCode` marker at all). This must still fall back to the default
+  // failure exit code (1), not silently pass through as a "clean" exit — this is the real
+  // unexpected-crash path through `runCli` that must keep exiting 1.
+  it("exits 1 for a defect with no typed failure", () => {
+    const cause = Cause.die(new Error("unexpected crash"));
+    expect(exitCodeForFailure(cause)).toBe(1);
+  });
+
+  it("exits 130 when interrupted, regardless of any other failure reason", () => {
+    expect(exitCodeForFailure(Cause.interrupt())).toBe(130);
+  });
+
+  // CLI-1879: a delegated Go child's exact exit code (not just a generic 1)
+  // must reach the user, via the `LegacyGoChildExitError`'s
+  // `[Runtime.errorExitCode]` marker.
+  it("exits with a LegacyGoChildExitError's exact exit code", () => {
+    const cause = Cause.fail(
+      new LegacyGoChildExitError({ exitCode: 130, message: "supabase-go exited with code 130" }),
+    );
+    expect(exitCodeForFailure(cause)).toBe(130);
+  });
+});
+
+describe("shouldReportFailure", () => {
+  it("does not report a clean exit (0)", () => {
+    expect(shouldReportFailure(Cause.fail(new Error("unused")), 0)).toBe(false);
+  });
+
+  it("does not report an interrupt (130)", () => {
+    expect(shouldReportFailure(Cause.interrupt(), 130)).toBe(false);
+  });
+
+  // CLI-1879: the child already wrote its own detailed failure to the
+  // inherited stderr, so `runCli`'s generic line would be a duplicate Go
+  // itself never prints.
+  it("does not report a LegacyGoChildExitError", () => {
+    const cause = Cause.fail(
+      new LegacyGoChildExitError({ exitCode: 1, message: "supabase-go exited with code 1" }),
+    );
+    expect(shouldReportFailure(cause, 1)).toBe(false);
+  });
+
+  it("reports a non-ShowHelp failure", () => {
+    expect(shouldReportFailure(Cause.fail(new Error("boom")), 1)).toBe(true);
+  });
+
+  // Regression guard: `CliError.ShowHelp` ALSO sets Effect's shared
+  // `[Runtime.errorReported]` marker to `false` (for an unrelated reason — the
+  // CLI framework already rendered help/usage text). `shouldReportFailure`
+  // must NOT key on that shared marker, or it would also suppress
+  // `normalizeCause`'s Go-parity rendering for a `MissingOption` wrapped in
+  // `ShowHelp` (e.g. `Error: required flag(s) "type" not set`) — silently
+  // dropping that message for every command with a required flag.
+  it("still reports a ShowHelp failure carrying a genuine validation error (e.g. a missing required flag)", () => {
+    const cause = Cause.fail(
+      new CliError.ShowHelp({
+        commandPath: ["sso", "add"],
+        errors: [new CliError.MissingOption({ option: "--type" })],
+      }),
+    );
+    expect(shouldReportFailure(cause, 1)).toBe(true);
+  });
+});
+
+// CLI-1901: a required-flag/choice parse failure used to dump the full help
+// doc to stdout AND print the error twice (once from the vendored `effect`
+// CLI library's own `showHelp()`, once from this repo's own Go-parity
+// renderer). `withoutParseErrorHelpDump` fixes this by buffering the
+// library's own `Console.log`/`Console.error` writes and disposing of them
+// per this classifier's verdict — this suite covers the classifier;
+// `run.integration.test.ts` covers the end-to-end buffering/flush behavior
+// against real command definitions, and `run.e2e.test.ts` /
+// `sso.e2e.test.ts` cover the real subprocess stdout/stderr streams.
+describe("classifyParseErrorConsoleOutput", () => {
+  // Go cobra's `PersistentPreRunE` sets `SilenceUsage = true`
+  // (`apps/cli-go/cmd/root.go:97`) BEFORE `ValidateRequiredFlags`
+  // (`command.go:1007`) runs — verified against the real `supabase-go`
+  // binary (`sso add` without `--type`): a single clean stderr line, no
+  // usage block. `MissingOption` is the one tag that maps to that stage.
+  it("drops the help dump for a missing required flag", () => {
+    const cause = Cause.fail(
+      new CliError.ShowHelp({
+        commandPath: ["supabase", "sso", "add"],
+        errors: [new CliError.MissingOption({ option: "type" })],
+      }),
+    );
+    // `--type` (nor its `-t` alias) never appears on argv at all — genuinely absent.
+    expect(
+      classifyParseErrorConsoleOutput(cause, {
+        rootCommand: testRoot,
+        args: ["sso", "add", "--project-ref", "x"],
+      }),
+    ).toBe("drop");
+  });
+
+  // Multiple simultaneously-missing required flags: still `ValidateRequiredFlags`,
+  // still post-`PersistentPreRunE` in Go — must still drop, not just for a lone error.
+  it("drops the help dump when every error is a missing required flag", () => {
+    const cause = Cause.fail(
+      new CliError.ShowHelp({
+        commandPath: ["supabase", "sso", "add"],
+        errors: [
+          new CliError.MissingOption({ option: "type" }),
+          new CliError.MissingOption({ option: "project-ref" }),
+        ],
+      }),
+    );
+    expect(
+      classifyParseErrorConsoleOutput(cause, { rootCommand: testRoot, args: ["sso", "add"] }),
+    ).toBe("drop");
+  });
+
+  // CLI-1901 (Codex review finding): the vendored library raises the SAME
+  // `MissingOption` tag whether a required flag was never given at all, or
+  // given with no value following it (e.g. `sso add --type` as the last
+  // token) — it has no distinct "value required" error. Go's own pflag does
+  // distinguish these: a present-but-valueless flag is a `ParseFlags`-time
+  // error (`flag needs an argument: --type`), raised BEFORE
+  // `PersistentPreRunE` sets `SilenceUsage` — verified against the real
+  // `apps/cli-go/supabase-go` binary, which still prints its full usage block
+  // to stderr for this input. `isMissingFlagTokenPresent` recovers this
+  // distinction from raw argv so this case flushes the help doc instead of
+  // silently dropping it like a genuinely-absent flag.
+  it("flushes the help dump to stderr for a required flag present on argv but missing its value", () => {
+    const cause = Cause.fail(
+      new CliError.ShowHelp({
+        commandPath: ["supabase", "migration", "repair"],
+        errors: [new CliError.MissingOption({ option: "status" })],
+      }),
+    );
+    expect(
+      classifyParseErrorConsoleOutput(cause, {
+        rootCommand: testRoot,
+        args: ["migration", "repair", "20230101000000", "--status"],
+      }),
+    ).toBe("flush-help-doc-to-stderr");
+  });
+
+  // Codex review finding (CLI-1901 follow-up): `--` is the standard operand
+  // terminator — everything after it is positional, never a flag occurrence,
+  // for ANY option (mirrors the vendored `effect` lexer's own
+  // `argv.indexOf("--")` cutoff, `internal/lexer.ts`). Verified against the
+  // real `apps/cli-go/supabase-go` binary:
+  // `migration repair --local -- 20230101000000 --status` prints a bare
+  // `required flag(s) "status" not set`, no usage block — Go correctly parses
+  // the literal `--status` string as a second positional `version`, leaving
+  // the real `--status` flag genuinely unset. Without the `--` cutoff,
+  // `isMissingFlagTokenPresent` would find that trailing `--status` string
+  // anywhere in argv and wrongly conclude the flag was given but missing its
+  // value.
+  it("drops the help dump for a missing required flag whose token only appears after the -- terminator", () => {
+    const cause = Cause.fail(
+      new CliError.ShowHelp({
+        commandPath: ["supabase", "migration", "repair"],
+        errors: [new CliError.MissingOption({ option: "status" })],
+      }),
+    );
+    expect(
+      classifyParseErrorConsoleOutput(cause, {
+        rootCommand: testRoot,
+        args: ["migration", "repair", "--", "20230101000000", "--status"],
+      }),
+    ).toBe("drop");
+  });
+
+  // Codex review finding (CLI-1901 follow-up): `sso add`'s `type` flag also has
+  // a short alias, `-t` (`add.command.ts`). Go's pflag treats a present-but-
+  // valueless SHORT flag exactly like the long form — `parseSingleShortArg`
+  // raises the same `ValueRequiredError` as `parseLongArg`, same timing, same
+  // "usage still shown" outcome — verified against the real
+  // `apps/cli-go/supabase-go` binary (`sso add -t`: full usage block on
+  // stderr, byte-parallel to `sso add --type`). `flagAliasesFor` resolves
+  // `type`'s aliases from the real command tree (via `context.rootCommand`)
+  // so `isMissingFlagTokenPresent` recognizes `-t` here too, instead of
+  // misclassifying it as a genuinely-absent flag.
+  it("flushes the help dump to stderr for a required flag present on argv by its short alias but missing its value", () => {
+    const cause = Cause.fail(
+      new CliError.ShowHelp({
+        commandPath: ["supabase", "sso", "add"],
+        errors: [new CliError.MissingOption({ option: "type" })],
+      }),
+    );
+    expect(
+      classifyParseErrorConsoleOutput(cause, { rootCommand: testRoot, args: ["sso", "add", "-t"] }),
+    ).toBe("flush-help-doc-to-stderr");
+  });
+
+  // Codex review finding (CLI-1901 follow-up): `sso add --project-ref --type`
+  // omits `--type`'s value, but `--type` immediately follows `--project-ref`
+  // (a value-taking `Flag.string`, `add.command.ts`). Verified against the
+  // real `apps/cli-go/supabase-go` binary: pflag's `parseLongArg`
+  // (`flag.go`) unconditionally consumes the very next argv entry as
+  // `--project-ref`'s value, even though it looks like another flag — so
+  // `--type` is never seen as its own occurrence, and Go shows no usage at
+  // all (only its own "type" required-flag error, `SilenceUsage`-suppressed).
+  // The vendored `effect` parser does NOT eagerly consume a flag-shaped
+  // token as a value (`internal/parser.ts`'s `consumeFlagValueWithTokens`
+  // only consumes a following `Value`-tagged token), so `--type` remains its
+  // own token and raises its own `MissingOption` here too — but the raw scan
+  // must still recognize that `--type` was effectively consumed as
+  // `--project-ref`'s value, matching Go, instead of concluding `--type` is
+  // present but missing its value (which would wrongly flush the help doc).
+  it("drops the help dump when a required flag's own token is consumed as a preceding value-taking flag's value", () => {
+    const cause = Cause.fail(
+      new CliError.ShowHelp({
+        commandPath: ["supabase", "sso", "add"],
+        errors: [new CliError.MissingOption({ option: "type" })],
+      }),
+    );
+    expect(
+      classifyParseErrorConsoleOutput(cause, {
+        rootCommand: testRoot,
+        args: ["sso", "add", "--project-ref", "--type"],
+      }),
+    ).toBe("drop");
+  });
+
+  // Codex review finding (CLI-1901 follow-up): `isValueTakingFlagTokenFor`
+  // only inspects the resolved LEAF command's own flags, so it doesn't know
+  // `--network-id` (a value-taking GLOBAL flag, `globalFlagsWithValues` in
+  // `run.ts`) consumes the very next argv entry. Verified against pflag's
+  // `parseLongArg` (`flag.go`): `--network-id --status` hands the literal
+  // string `--status` to `--network-id` as its value, so the required
+  // `status` flag (`migration repair`, `Flag.choice`) is never seen as its
+  // own occurrence and keeps Go's `SilenceUsage` treatment (no usage shown).
+  // Without OR-ing `globalFlagsWithValues` into the scan's value-taking
+  // predicate, the raw `--status` token would be found anyway and wrongly
+  // flush the help doc.
+  it("drops the help dump when a required flag's own token is consumed as a global value-taking flag's value", () => {
+    const cause = Cause.fail(
+      new CliError.ShowHelp({
+        commandPath: ["supabase", "migration", "repair"],
+        errors: [new CliError.MissingOption({ option: "status" })],
+      }),
+    );
+    expect(
+      classifyParseErrorConsoleOutput(cause, {
+        rootCommand: testRoot,
+        args: ["migration", "repair", "--network-id", "--status", "--local", "20230101000000"],
+      }),
+    ).toBe("drop");
+  });
+
+  // Codex review finding (CLI-1901 follow-up): a literal `--` immediately
+  // after a value-taking flag is NOT a genuine operand terminator in Go —
+  // pflag's `parseLongArg` (`flag.go`) pops the very next raw token as the
+  // flag's value with no shape check at all, so `--project-ref --` hands the
+  // literal string `--` to `--project-ref`. Parsing then resumes normally on
+  // `--type`, which (nothing follows it) raises pflag's own
+  // `ValueRequiredError` — a `ParseFlags`-time error, usage still shown, NOT
+  // `SilenceUsage`-suppressed. Precomputing `args.indexOf("--")` before the
+  // value-consumption scan would wrongly treat that consumed `--` as the
+  // terminator and drop `--type` from the scan entirely, misclassifying
+  // `type` as genuinely absent.
+  it("flushes the help dump to stderr for a required flag whose own token follows a -- consumed as a preceding value-taking flag's value", () => {
+    const cause = Cause.fail(
+      new CliError.ShowHelp({
+        commandPath: ["supabase", "sso", "add"],
+        errors: [new CliError.MissingOption({ option: "type" })],
+      }),
+    );
+    expect(
+      classifyParseErrorConsoleOutput(cause, {
+        rootCommand: testRoot,
+        args: ["sso", "add", "--project-ref", "--", "--type"],
+      }),
+    ).toBe("flush-help-doc-to-stderr");
+  });
+
+  it("still drops the help dump for a missing required flag even when an unrelated flag shares a substring of its name", () => {
+    const cause = Cause.fail(
+      new CliError.ShowHelp({
+        commandPath: ["supabase", "sso", "add"],
+        errors: [new CliError.MissingOption({ option: "type" })],
+      }),
+    );
+    // `--type-hint` is a different flag token — must not false-positive-match `--type`.
+    expect(
+      classifyParseErrorConsoleOutput(cause, {
+        rootCommand: testRoot,
+        args: ["sso", "add", "--type-hint", "x"],
+      }),
+    ).toBe("drop");
+  });
+
+  // Go's `ParseFlags` (`command.go:919`) validates `Flag.choice` values BEFORE
+  // `PersistentPreRunE` runs — verified against the real binary (`sso add --type
+  // bogus`): Go still shows its usage block, on stderr. Same for an unrecognized
+  // flag and a missing positional argument (both also pre-`PersistentPreRunE`).
+  it("flushes the help dump to stderr for an invalid Flag.choice value", () => {
+    const cause = Cause.fail(
+      new CliError.ShowHelp({
+        commandPath: ["supabase", "sso", "add"],
+        errors: [
+          new CliError.InvalidValue({
+            option: "type",
+            value: "bogus",
+            expected: 'Expected "saml", got "bogus"',
+            kind: "flag",
+          }),
+        ],
+      }),
+    );
+    expect(
+      classifyParseErrorConsoleOutput(cause, {
+        rootCommand: testRoot,
+        args: ["sso", "add", "--type", "bogus"],
+      }),
+    ).toBe("flush-help-doc-to-stderr");
+  });
+
+  it("flushes the help dump to stderr for an unrecognized flag", () => {
+    const cause = Cause.fail(
+      new CliError.ShowHelp({
+        commandPath: ["supabase", "branches"],
+        errors: [new CliError.UnrecognizedOption({ option: "--bogus", suggestions: [] })],
+      }),
+    );
+    expect(
+      classifyParseErrorConsoleOutput(cause, {
+        rootCommand: testRoot,
+        args: ["branches", "--bogus"],
+      }),
+    ).toBe("flush-help-doc-to-stderr");
+  });
+
+  it("flushes the help dump to stderr for a missing positional argument", () => {
+    const cause = Cause.fail(
+      new CliError.ShowHelp({
+        commandPath: ["supabase", "sso", "show"],
+        errors: [new CliError.MissingArgument({ argument: "id" })],
+      }),
+    );
+    expect(
+      classifyParseErrorConsoleOutput(cause, { rootCommand: testRoot, args: ["sso", "show"] }),
+    ).toBe("flush-help-doc-to-stderr");
+  });
+
+  // A mix (e.g. a missing required flag alongside an unrecognized flag) can't
+  // actually occur in practice — the library fails fast on the earlier
+  // `ParseFlags`-class error before `MissingOption` is ever checked — but the
+  // classifier must still not mistake a mix for the all-`MissingOption` case.
+  it("flushes the help dump to stderr for a mix of error tags", () => {
+    const cause = Cause.fail(
+      new CliError.ShowHelp({
+        commandPath: ["supabase", "sso", "add"],
+        errors: [
+          new CliError.MissingOption({ option: "type" }),
+          new CliError.UnrecognizedOption({ option: "--bogus", suggestions: [] }),
+        ],
+      }),
+    );
+    expect(
+      classifyParseErrorConsoleOutput(cause, {
+        rootCommand: testRoot,
+        args: ["sso", "add", "--bogus"],
+      }),
+    ).toBe("flush-help-doc-to-stderr");
+  });
+
+  it("flushes unchanged for a clean ShowHelp failure (bare group command / explicit --help)", () => {
+    const cause = Cause.fail(
+      new CliError.ShowHelp({ commandPath: ["supabase", "branches"], errors: [] }),
+    );
+    expect(
+      classifyParseErrorConsoleOutput(cause, { rootCommand: testRoot, args: ["branches"] }),
+    ).toBe("flush-unchanged");
+  });
+
+  it("flushes unchanged for a non-ShowHelp failure", () => {
+    expect(
+      classifyParseErrorConsoleOutput(Cause.fail(new Error("boom")), {
+        rootCommand: testRoot,
+        args: [],
+      }),
+    ).toBe("flush-unchanged");
+  });
+
+  it("flushes unchanged for an interrupt", () => {
+    expect(
+      classifyParseErrorConsoleOutput(Cause.interrupt(), { rootCommand: testRoot, args: [] }),
+    ).toBe("flush-unchanged");
+  });
+
+  it("flushes unchanged for a defect with no typed failure", () => {
+    expect(
+      classifyParseErrorConsoleOutput(Cause.die(new Error("unexpected crash")), {
+        rootCommand: testRoot,
+        args: [],
+      }),
+    ).toBe("flush-unchanged");
+  });
 });
diff --git a/apps/cli/src/shared/cli/subcommand-flag-suggestions.ts b/apps/cli/src/shared/cli/subcommand-flag-suggestions.ts
index 1cc5124f98..e1865a5273 100644
--- a/apps/cli/src/shared/cli/subcommand-flag-suggestions.ts
+++ b/apps/cli/src/shared/cli/subcommand-flag-suggestions.ts
@@ -1,4 +1,5 @@
 import type { CliError, Command, HelpDoc } from "effect/unstable/cli";
+import { formatInvalidValueMessage } from "./invalid-value-message.ts";
 
 export interface CliErrorSuggestionContext {
   readonly rootCommand: Command.Command.Any;
@@ -101,6 +102,71 @@ function flagMatchesOption(flag: HelpDoc.FlagDoc, option: string): boolean {
   return flag.aliases.includes(option);
 }
 
+/**
+ * Every argv token (e.g. `-t`, alongside the canonical `--type`) that also
+ * resolves to `option` for the command at `commandPath`, by walking the
+ * command tree the same way `buildSubcommandFlagHint` does. Returns `[]` if
+ * `commandPath` doesn't resolve to a real command or that command has no
+ * flag named `option` — callers should treat that as "no aliases", not an
+ * error, since a synthetic/test command path is a legitimate input.
+ *
+ * Used by `run.ts`'s `isMissingFlagTokenPresent` to recognize a required
+ * flag supplied by its short alias but missing its value (Go/pflag still
+ * shows usage for that case — see CLI-1901) instead of misclassifying it as
+ * genuinely absent (Go: `SilenceUsage`-suppressed, no usage shown).
+ */
+export function flagAliasesFor(
+  rootCommand: Command.Command.Any,
+  commandPath: ReadonlyArray<string>,
+  option: string,
+): ReadonlyArray<string> {
+  const command = findCommand(rootCommand, commandPath.slice(1));
+  if (!command) return [];
+  const flag = helpDocFor(command, commandPath)?.flags.find(
+    (candidate) => candidate.name === option,
+  );
+  return flag?.aliases ?? [];
+}
+
+/**
+ * Builds a lookup for whether an argv token (a canonical `--name` or one of
+ * its aliases, e.g. `-t`) at `commandPath` belongs to a *value-taking* flag
+ * (any flag whose `HelpDoc.FlagDoc.type !== "boolean"`) on the command
+ * resolved the same way `flagAliasesFor` does. Returns a function that
+ * answers `false` for every token when `commandPath` doesn't resolve to a
+ * real command, mirroring `flagAliasesFor`'s "no aliases" fallback.
+ *
+ * Used by `run.ts`'s `isMissingFlagTokenPresent` to recognize when a
+ * DIFFERENT flag's value-consumption ate the very token being scanned for.
+ * Go/pflag's `parseLongArg` (`flag.go`) unconditionally consumes the next
+ * argv entry as a value-taking flag's value, even when that entry itself
+ * looks like another flag — e.g. `sso add --project-ref --type` hands the
+ * literal string `--type` to `--project-ref`, so `--type` is never seen as
+ * its own occurrence and its `MissingOption` failure gets Go's
+ * `SilenceUsage` treatment (no usage shown). The vendored `effect` CLI
+ * library's own parser does NOT replicate that (`internal/parser.ts`'s
+ * `consumeFlagValueWithTokens` only consumes a following token when it's
+ * lexed as a plain `Value`, never a flag-shaped token), so without this
+ * lookup the raw argv scan in `isMissingFlagTokenPresent` would find the
+ * literal `--type` token and wrongly conclude the flag is present but
+ * missing its value — reintroducing the usage dump CLI-1901 suppresses.
+ */
+export function isValueTakingFlagTokenFor(
+  rootCommand: Command.Command.Any,
+  commandPath: ReadonlyArray<string>,
+): (token: string) => boolean {
+  const command = findCommand(rootCommand, commandPath.slice(1));
+  const flags = command && helpDocFor(command, commandPath)?.flags;
+  if (!flags) return () => false;
+  const valueTakingTokens = new Set<string>();
+  for (const flag of flags) {
+    if (flag.type === "boolean") continue;
+    valueTakingTokens.add(`--${flag.name}`);
+    for (const alias of flag.aliases) valueTakingTokens.add(alias);
+  }
+  return (token: string) => valueTakingTokens.has(token);
+}
+
 function findPathEndIndex(
   args: ReadonlyArray<string>,
   pathWithoutRoot: ReadonlyArray<string>,
@@ -228,6 +294,20 @@ export function formatCliErrorsForDisplay(
       continue;
     }
 
+    if (error._tag === "InvalidValue") {
+      const message = formatInvalidValueMessage(error);
+      if (message !== undefined) {
+        changed = true;
+        formatted.push({
+          _tag: error._tag,
+          message,
+          source: error,
+          changed: true,
+        });
+        continue;
+      }
+    }
+
     formatted.push({ _tag: error._tag, message: error.message, source: error, changed: false });
   }
 
diff --git a/apps/cli/src/shared/cli/subcommand-flag-suggestions.unit.test.ts b/apps/cli/src/shared/cli/subcommand-flag-suggestions.unit.test.ts
index 079256d354..595b0969c6 100644
--- a/apps/cli/src/shared/cli/subcommand-flag-suggestions.unit.test.ts
+++ b/apps/cli/src/shared/cli/subcommand-flag-suggestions.unit.test.ts
@@ -122,4 +122,101 @@ describe("subcommand flag placement suggestions", () => {
     );
     expect(errors.errors[0]?.message).not.toContain("--project-ref=jacraenyzrorgjhsdvvf <value>");
   });
+
+  it("collapses the doubled 'Expected: Expected' prefix for an invalid choice flag value", () => {
+    const errors = formatCliErrorsForDisplay([
+      new CliError.InvalidValue({
+        option: "size",
+        value: "nano",
+        expected: 'Expected "micro" | "small" | "medium", got "nano"',
+        kind: "flag",
+      }),
+    ]);
+
+    expect(errors.changed).toBe(true);
+    expect(errors.errors).toHaveLength(1);
+    expect(errors.errors[0]?.message).toBe(
+      'Invalid value for flag --size: "nano". Expected "micro" | "small" | "medium", got "nano"',
+    );
+    expect(errors.errors[0]?.message).not.toMatch(/Expected:\s*Expected/);
+  });
+
+  it("collapses the doubled 'Expected: Expected' prefix for an invalid choice argument value", () => {
+    const errors = formatCliErrorsForDisplay([
+      new CliError.InvalidValue({
+        option: "level",
+        value: "bogus",
+        expected: 'Expected "debug" | "info", got "bogus"',
+        kind: "argument",
+      }),
+    ]);
+
+    expect(errors.changed).toBe(true);
+    expect(errors.errors[0]?.message).toBe(
+      'Invalid value for argument <level>: "bogus". Expected "debug" | "info", got "bogus"',
+    );
+    expect(errors.errors[0]?.message).not.toMatch(/Expected:\s*Expected/);
+  });
+
+  it("also collapses the doubled prefix for a non-choice primitive whose failure text starts with 'Expected' (e.g. an invalid integer flag value)", () => {
+    // Real failure text from effect@4.0.0-beta.93's schema-backed `Primitive.integer`
+    // (also affects `float`, `boolean`, and `date` — every primitive whose parse
+    // failure happens to start with the word "Expected" hits the same doubling).
+    const errors = formatCliErrorsForDisplay([
+      new CliError.InvalidValue({
+        option: "port",
+        value: "abc",
+        expected: 'Expected a string representing a finite number, got "abc"',
+        kind: "flag",
+      }),
+    ]);
+
+    expect(errors.changed).toBe(true);
+    expect(errors.errors[0]?.message).toBe(
+      'Invalid value for flag --port: "abc". Expected a string representing a finite number, got "abc"',
+    );
+    expect(errors.errors[0]?.message).not.toMatch(/Expected:\s*Expected/);
+  });
+
+  it("leaves invalid-value errors whose expected text does not start with 'Expected' unchanged", () => {
+    // Real failure text from effect@4.0.0-beta.93's `Primitive.keyValuePair` —
+    // it never starts with the word "Expected", so it isn't doubled by
+    // `CliError.InvalidValue`'s own "Expected: " prefix and needs no rewriting.
+    const errors = formatCliErrorsForDisplay([
+      new CliError.InvalidValue({
+        option: "define",
+        value: "bogus",
+        expected: "Invalid key=value format. Expected format: key=value, got: bogus",
+        kind: "flag",
+      }),
+    ]);
+
+    expect(errors.changed).toBe(false);
+    expect(errors.errors[0]?.changed).toBe(false);
+    expect(errors.errors[0]?.message).toBe(
+      'Invalid value for flag --define: "bogus". Expected: Invalid key=value format. Expected format: key=value, got: bogus',
+    );
+  });
+
+  it("does not corrupt a value that itself contains the literal 'Expected: Expected' text", () => {
+    // Regression test: the fix must anchor on `error.expected` (the field the
+    // buggy primitive actually populates) rather than searching the fully
+    // composed `error.message`, since `error.value` is user-controlled and is
+    // interpolated into that same message twice (once directly, once again
+    // inside `expected`'s "got <value>" suffix). A value that happens to
+    // contain the literal doubled-prefix text must be left untouched.
+    const errors = formatCliErrorsForDisplay([
+      new CliError.InvalidValue({
+        option: "env",
+        value: "Expected: Expected nano",
+        expected: 'Expected "dev" | "staging" | "prod", got "Expected: Expected nano"',
+        kind: "flag",
+      }),
+    ]);
+
+    expect(errors.changed).toBe(true);
+    expect(errors.errors[0]?.message).toBe(
+      'Invalid value for flag --env: "Expected: Expected nano". Expected "dev" | "staging" | "prod", got "Expected: Expected nano"',
+    );
+  });
 });
diff --git a/apps/cli/src/shared/functions/deploy.ts b/apps/cli/src/shared/functions/deploy.ts
index 46bab06023..e707cb76f2 100644
--- a/apps/cli/src/shared/functions/deploy.ts
+++ b/apps/cli/src/shared/functions/deploy.ts
@@ -1,7 +1,6 @@
 import { brotliCompressSync, constants as zlibConstants } from "node:zlib";
-import { chmod, mkdtemp, readFile, readdir, realpath, rm, stat } from "node:fs/promises";
+import { chmod, mkdir, mkdtemp, readFile, readdir, realpath, rm, stat } from "node:fs/promises";
 import { basename, dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
-import { tmpdir } from "node:os";
 import { URL } from "node:url";
 import { FunctionResponse, operationDefinitions, type ApiClient } from "@supabase/api/effect";
 import {
@@ -16,7 +15,15 @@ import { Output } from "../output/output.service.ts";
 import { spawnContainerCli } from "../../legacy/shared/legacy-container-cli.ts";
 import { legacyGetRegistryImageUrl } from "../../legacy/shared/legacy-docker-registry.ts";
 import { findGitRootPath } from "../git/git-root.ts";
-import { invalidFunctionSlugDetail, validateFunctionSlugMessage } from "./functions.shared.ts";
+import {
+  cobraMutuallyExclusiveErrorMessage,
+  hasExplicitLongFlag,
+} from "../cli/cobra-flag-groups.ts";
+import {
+  FUNCTIONS_BUNDLER_MUTEX_GROUP,
+  invalidFunctionSlugDetail,
+  validateFunctionSlugMessage,
+} from "./functions.shared.ts";
 import {
   ConflictingFunctionDeployFlagsError,
   FunctionDeployCancelledError,
@@ -54,6 +61,7 @@ interface DeployFunctionsDependencies<ResolveError, ResolveRequirements> {
   readonly projectRoot: string;
   readonly supabaseDir: string;
   readonly dashboardUrl: string;
+  readonly goViperCompat: boolean;
   readonly yes?: boolean;
   readonly rawArgs: ReadonlyArray<string>;
   readonly edgeRuntimeVersion: string;
@@ -192,30 +200,6 @@ function validateDeploySlug(slug: string): Effect.Effect<void, InvalidFunctionDe
   return Effect.fail(new InvalidFunctionDeploySlugError({ message: invalidFunctionSlugDetail }));
 }
 
-function hasExplicitLongFlag(
-  rawArgs: ReadonlyArray<string>,
-  commandPath: ReadonlyArray<string>,
-  flagName: string,
-): boolean {
-  const commandIndex = rawArgs.findIndex((_, index) =>
-    commandPath.every((segment, offset) => rawArgs[index + offset] === segment),
-  );
-  if (commandIndex === -1) {
-    return rawArgs.some((token) => token === `--${flagName}` || token.startsWith(`--${flagName}=`));
-  }
-
-  for (let index = commandIndex + commandPath.length; index < rawArgs.length; index += 1) {
-    const token = rawArgs[index];
-    if (token === undefined || token === "--") {
-      return false;
-    }
-    if (token === `--${flagName}` || token.startsWith(`--${flagName}=`)) {
-      return true;
-    }
-  }
-  return false;
-}
-
 function explicitBooleanFlag(
   rawArgs: ReadonlyArray<string>,
   commandPath: ReadonlyArray<string>,
@@ -264,6 +248,16 @@ export function localDockerId(name: string, projectId: string) {
 
 const dockerCliProjectLabel = "com.supabase.cli.project";
 const dockerComposeProjectLabel = "com.docker.compose.project";
+/**
+ * Must stay in sync with `LEGACY_CLI_WORKDIR_LABEL`
+ * (`legacy/shared/legacy-docker-ids.ts:95`) — same string literal, kept as a
+ * separate copy here rather than imported to respect the `next`/`legacy`
+ * isolation boundary (this file has no Go equivalent for the other two
+ * labels either). Read back by `legacyCleanupStartSecrets` so a later
+ * `stop`/`legacyRollbackStart` can reclaim this container's staged-secret
+ * directory using its OWN workdir rather than the caller's cwd.
+ */
+export const dockerWorkdirLabel = "com.supabase.cli.workdir";
 const dockerNpmEnvNames = ["NPM_CONFIG_REGISTRY", "NPM_AUTH_TOKEN"] as const;
 
 export function dockerProjectLabels(projectId: string) {
@@ -1206,7 +1200,7 @@ function shouldUseDenoJsonDiscovery(entrypoint: string, importMap: string) {
   return isDenoConfigFile(importMap) && dirname(importMap) === dirname(entrypoint);
 }
 
-function isUserDefinedDockerNetwork(networkMode: string) {
+export function isUserDefinedDockerNetwork(networkMode: string) {
   return (
     networkMode.length > 0 &&
     networkMode !== "default" &&
@@ -1349,8 +1343,10 @@ const bundleFunctionWithDocker = Effect.fnUntraced(function* (
   const output = yield* Output;
   yield* output.raw(`Bundling Function: ${config.slug}\n`, "stderr");
 
+  const outputRoot = resolve(functionsDir, "..", ".temp");
+  yield* Effect.tryPromise(() => mkdir(outputRoot, { recursive: true }));
   const outputDir = yield* Effect.tryPromise(() =>
-    mkdtemp(join(tmpdir(), `.supabase-output-${config.slug}-`)),
+    mkdtemp(join(outputRoot, `.supabase-output-${config.slug}-`)),
   );
   try {
     yield* Effect.tryPromise(() => chmod(outputDir, 0o777));
@@ -1770,8 +1766,9 @@ export const discoverFunctionSlugs = Effect.fnUntraced(function* (
     readdir(functionsDir, { withFileTypes: true }),
   ).pipe(
     Effect.catch((error) => {
-      const cause =
-        typeof error === "object" && error !== null && "error" in error ? error.error : error;
+      // `Effect.tryPromise`'s default failure is a `Cause.UnknownError`, which stores the
+      // original rejection on `.cause` (inherited from `Error`) — NOT `.error`.
+      const cause = error.cause;
       return cause instanceof Error && "code" in cause && cause.code === "ENOENT"
         ? Effect.succeed(undefined)
         : Effect.fail(error);
@@ -2103,6 +2100,10 @@ export function deployFunctions<ResolveError, ResolveRequirements>(
   return Effect.gen(function* () {
     const output = yield* Output;
     const commandPath = ["functions", "deploy"] as const;
+    // Presence-based (true for `--use-api=false`, not just bare `--use-api`) — mirrors
+    // cobra's `Changed()`-driven `MarkFlagsMutuallyExclusive`, so it's only used for the
+    // mutual-exclusivity check below. Behavior branches (bundler routing, --jobs guard)
+    // key off the resolved `flags.useApi` value instead, matching Go's own `if useApi`.
     const explicitUseApi = hasExplicitLongFlag(dependencies.rawArgs, commandPath, "use-api");
     const explicitUseDocker = hasExplicitLongFlag(dependencies.rawArgs, commandPath, "use-docker");
     const explicitLegacyBundle = hasExplicitLongFlag(
@@ -2111,25 +2112,32 @@ export function deployFunctions<ResolveError, ResolveRequirements>(
       "legacy-bundle",
     );
 
-    const selectedModes = [
-      explicitUseApi ? "--use-api" : undefined,
-      explicitUseDocker ? "--use-docker" : undefined,
-      explicitLegacyBundle ? "--legacy-bundle" : undefined,
-    ].filter((flag) => flag !== undefined);
+    const changedModes = [
+      explicitUseApi ? "use-api" : undefined,
+      explicitUseDocker ? "use-docker" : undefined,
+      explicitLegacyBundle ? "legacy-bundle" : undefined,
+    ].filter((flag): flag is string => flag !== undefined);
 
-    if (selectedModes.length > 1) {
+    if (changedModes.length > 1) {
       return yield* Effect.fail(
         new ConflictingFunctionDeployFlagsError({
-          message: `flags ${selectedModes.join(", ")} are mutually exclusive`,
+          message: cobraMutuallyExclusiveErrorMessage(FUNCTIONS_BUNDLER_MUTEX_GROUP, changedModes),
         }),
       );
     }
 
-    const useLocalBundler = !explicitUseApi && (flags.useDocker || flags.legacyBundle);
+    // Go parity (`cmd/functions.go:79-80`): `if useApi { useDocker = false }` mutates the
+    // resolved boolean, not a presence flag — `--use-api=false` alone must NOT force the
+    // API path, it should fall through to whatever `--use-docker`/`--legacy-bundle`
+    // already resolved to.
+    const useLocalBundler = !flags.useApi && (flags.useDocker || flags.legacyBundle);
     const configuredJobs = Option.getOrElse(flags.jobs, () => 1);
     const jobs = configuredJobs === 0 ? 1 : configuredJobs;
-    if (useLocalBundler && jobs > 1) {
-      return yield* Effect.fail(new Error("--jobs cannot be used with local bundling"));
+    // Go parity (`cmd/functions.go:79-82`): the guard is `if useApi { ... } else if
+    // maxJobs > 1 { error }` — keyed on the resolved `--use-api` value alone, not on
+    // whether local bundling (Docker/legacy-bundle) is in play.
+    if (!flags.useApi && jobs > 1) {
+      return yield* Effect.fail(new Error("--jobs must be used together with --use-api"));
     }
 
     const preResolvedProjectRef =
@@ -2155,7 +2163,10 @@ export function deployFunctions<ResolveError, ResolveRequirements>(
     // `@supabase/config` merges the matching `[remotes.*]` block over the base
     // config (Go's `loadFromFile` with `Config.ProjectId` set), so the resolved
     // config already reflects any remote function/edge_runtime overrides.
-    const loadedConfig = yield* loadProjectConfig(dependencies.projectRoot, { projectRef });
+    const loadedConfig = yield* loadProjectConfig(dependencies.projectRoot, {
+      projectRef,
+      goViperCompat: dependencies.goViperCompat,
+    });
     const deployConfig = loadedConfig?.config;
     const edgeRuntimeVersion = yield* resolveEdgeRuntimeVersion(
       deployConfig?.edge_runtime.deno_version,
diff --git a/apps/cli/src/shared/functions/download.ts b/apps/cli/src/shared/functions/download.ts
index 562066ee4b..7b9882f6dd 100644
--- a/apps/cli/src/shared/functions/download.ts
+++ b/apps/cli/src/shared/functions/download.ts
@@ -7,7 +7,15 @@ import { Effect, FileSystem, Option } from "effect";
 import * as HttpClientError from "effect/unstable/http/HttpClientError";
 import type * as HttpClientResponse from "effect/unstable/http/HttpClientResponse";
 import { Output } from "../output/output.service.ts";
-import { invalidFunctionSlugDetail, validateFunctionSlugMessage } from "./functions.shared.ts";
+import {
+  cobraMutuallyExclusiveErrorMessage,
+  hasExplicitLongFlag,
+} from "../cli/cobra-flag-groups.ts";
+import {
+  FUNCTIONS_BUNDLER_MUTEX_GROUP,
+  invalidFunctionSlugDetail,
+  validateFunctionSlugMessage,
+} from "./functions.shared.ts";
 import {
   ConflictingFunctionDownloadFlagsError,
   FunctionDownloadNotFoundError,
@@ -34,12 +42,21 @@ export interface DownloadFunctionsDependencies<
 > {
   readonly api: ApiClient;
   readonly projectRoot: string;
+  readonly rawArgs: ReadonlyArray<string>;
   readonly resolveProjectRef: (
     projectRef: Option.Option<string>,
   ) => Effect.Effect<string, ResolveError, ResolveRequirements>;
+  /**
+   * `captureOutput` is `true` whenever `output.format !== "text"`: the Go
+   * child's raw stdout must not reach the terminal (it would corrupt the
+   * JSON/NDJSON envelope, CLI-1546's "stdout is payload-only in machine
+   * mode" invariant), so the dependency must capture/discard it (e.g. via
+   * `LegacyGoProxy.execCapture`) instead of inheriting stdio.
+   */
   readonly proxyDownload: (
     flags: DownloadFunctionsOptions,
     projectRef: string,
+    captureOutput: boolean,
   ) => Effect.Effect<void, ProxyError, ProxyRequirements>;
 }
 
@@ -57,11 +74,14 @@ export function makeGoProxyDownloadArgs(
     args.push(flags.functionName.value);
   }
   args.push("--project-ref", projectRef);
-  if (flags.useDocker) {
-    args.push("--use-docker");
-  }
+  // At most one of these may reach the Go binary — it re-parses this argv
+  // fresh and enforces the same mutual exclusivity itself. `legacyBundle`
+  // takes priority since `useDocker` now defaults to `true` (CLI-1862) and
+  // would otherwise ride along on every `--legacy-bundle` invocation.
   if (flags.legacyBundle) {
     args.push("--legacy-bundle");
+  } else if (flags.useDocker) {
+    args.push("--use-docker");
   }
   return args;
 }
@@ -107,20 +127,24 @@ function validateSlug(slug: string): Effect.Effect<void, InvalidFunctionSlugErro
   return Effect.fail(new InvalidFunctionSlugError({ message: invalidFunctionSlugDetail }));
 }
 
+const downloadCommandPath = ["functions", "download"] as const;
+
 function validateDownloadFlags(
-  flags: DownloadFunctionsOptions,
+  rawArgs: ReadonlyArray<string>,
 ): Effect.Effect<void, ConflictingFunctionDownloadFlagsError> {
-  const selected = [
-    flags.useApi ? "--use-api" : undefined,
-    flags.useDocker ? "--use-docker" : undefined,
-    flags.legacyBundle ? "--legacy-bundle" : undefined,
-  ].filter((flag) => flag !== undefined);
-
-  return selected.length <= 1
+  const changed = [
+    hasExplicitLongFlag(rawArgs, downloadCommandPath, "use-api") ? "use-api" : undefined,
+    hasExplicitLongFlag(rawArgs, downloadCommandPath, "use-docker") ? "use-docker" : undefined,
+    hasExplicitLongFlag(rawArgs, downloadCommandPath, "legacy-bundle")
+      ? "legacy-bundle"
+      : undefined,
+  ].filter((flag): flag is string => flag !== undefined);
+
+  return changed.length <= 1
     ? Effect.void
     : Effect.fail(
         new ConflictingFunctionDownloadFlagsError({
-          message: `flags ${selected.join(", ")} are mutually exclusive`,
+          message: cobraMutuallyExclusiveErrorMessage(FUNCTIONS_BUNDLER_MUTEX_GROUP, changed),
         }),
       );
 }
@@ -734,17 +758,61 @@ export function downloadFunctions<ResolveError, ResolveRequirements, ProxyError,
   return Effect.gen(function* () {
     const output = yield* Output;
 
-    yield* validateDownloadFlags(flags);
-
-    if (flags.useDocker || flags.legacyBundle) {
-      const projectRef = yield* dependencies.resolveProjectRef(flags.projectRef);
-      return yield* dependencies.proxyDownload(flags, projectRef);
-    }
+    yield* validateDownloadFlags(dependencies.rawArgs);
 
     if (Option.isSome(flags.functionName)) {
       yield* validateSlug(flags.functionName.value);
     }
 
+    // Mirrors Go's `if useApi { useDocker = false }` (apps/cli-go/cmd/functions.go:51-53),
+    // which reads the resolved flag value, not `pflag.Changed`. Gate on
+    // `flags.useApi` directly so `--use-api=false` still routes through the
+    // Docker/legacy-bundle proxy, matching Go.
+    if (!flags.useApi && (flags.useDocker || flags.legacyBundle)) {
+      const projectRef = yield* dependencies.resolveProjectRef(flags.projectRef);
+
+      if (output.format === "text") {
+        yield* dependencies.proxyDownload(flags, projectRef, false);
+        return;
+      }
+
+      // Resolve the slug list *before* delegating, mirroring Go's own
+      // `downloadAll` (which also lists before looping through downloads,
+      // `apps/cli-go/internal/functions/download/download.go`). The
+      // delegated Go child never emits the TS `Output` envelope itself
+      // (CLI-1546: stdout is payload-only in machine mode, so its raw text
+      // is captured/discarded below, not inherited) — this list is purely
+      // for the JSON payload. Resolving it first means a transient listing
+      // failure is reported before any download side effect, instead of
+      // masking an already-successful delegated download with a later,
+      // unrelated listing failure.
+      const slugs = Option.isSome(flags.functionName)
+        ? [flags.functionName.value]
+        : yield* listRemoteFunctionSlugs(dependencies.api, projectRef);
+
+      // Mirrors the native path's empty-project short-circuit just below:
+      // an empty project has nothing to delegate, so report it the same way
+      // ("No functions found.") instead of still invoking the Go child (an
+      // unnecessary Docker/subprocess round-trip) and reporting a
+      // misleading "Downloaded Edge Function source." success with an
+      // empty slug list.
+      if (slugs.length === 0) {
+        yield* output.success("No functions found.", {
+          function_slugs: [],
+          project_ref: projectRef,
+        });
+        return;
+      }
+
+      yield* dependencies.proxyDownload(flags, projectRef, true);
+
+      yield* output.success("Downloaded Edge Function source.", {
+        function_slugs: slugs,
+        project_ref: projectRef,
+      });
+      return;
+    }
+
     const projectRef = yield* dependencies.resolveProjectRef(flags.projectRef);
     const slugs = Option.isSome(flags.functionName)
       ? [flags.functionName.value]
diff --git a/apps/cli/src/shared/functions/functions.shared.ts b/apps/cli/src/shared/functions/functions.shared.ts
index 3732e573c1..8c961e867d 100644
--- a/apps/cli/src/shared/functions/functions.shared.ts
+++ b/apps/cli/src/shared/functions/functions.shared.ts
@@ -6,3 +6,13 @@ export const invalidFunctionSlugDetail =
 export function validateFunctionSlugMessage(slug: string): string | undefined {
   return functionSlugPattern.test(slug) ? undefined : invalidFunctionSlugDetail;
 }
+
+// Go marks `--project-ref` telemetry-safe on `functionsListCmd`, `functionsDeleteCmd`,
+// `functionsDeployCmd`, and `functionsDownloadCmd`
+// (`cmd/functions.go:151,153,165,178`).
+export const FUNCTIONS_PROJECT_REF_SAFE_FLAGS = ["project-ref"] as const;
+
+// Registration order matches Go's `functionsDeployCmd`/`functionsDownloadCmd`
+// `MarkFlagsMutuallyExclusive("use-api", "use-docker", "legacy-bundle")`
+// (`cmd/functions.go:158,182`).
+export const FUNCTIONS_BUNDLER_MUTEX_GROUP = ["use-api", "use-docker", "legacy-bundle"] as const;
diff --git a/apps/cli/src/shared/functions/serve.ts b/apps/cli/src/shared/functions/serve.ts
index e11a1c4736..ab0f154d7d 100644
--- a/apps/cli/src/shared/functions/serve.ts
+++ b/apps/cli/src/shared/functions/serve.ts
@@ -18,8 +18,7 @@ import {
   type JsonWebKeyInput,
 } from "node:crypto";
 import { watch } from "node:fs";
-import { mkdir, mkdtemp, readFile, rm, stat, writeFile } from "node:fs/promises";
-import { tmpdir } from "node:os";
+import { mkdir, readFile, rm, stat, writeFile } from "node:fs/promises";
 import { basename, dirname, isAbsolute, join, relative, resolve } from "node:path";
 import { styleText } from "node:util";
 import { Cause, Duration, Effect, Layer, Option, Queue, Redacted, Schema, Stream } from "effect";
@@ -27,6 +26,12 @@ import { ChildProcessSpawner } from "effect/unstable/process";
 import { spawnContainerCli } from "../../legacy/shared/legacy-container-cli.ts";
 import { legacyGetRegistryImageUrl } from "../../legacy/shared/legacy-docker-registry.ts";
 import { parseDotEnv } from "../../legacy/shared/legacy-dotenv.ts";
+import {
+  resolveRemoteJwks,
+  resolveThirdPartyIssuerUrl,
+  thirdPartyIssuerUrlUnchecked,
+  toPublicJwk,
+} from "../auth/jwks.ts";
 import { Output } from "../output/output.service.ts";
 import {
   FileWatcher,
@@ -39,6 +44,7 @@ import {
   discoverFunctionSlugs,
   dockerBindHostPath,
   dockerProjectLabels,
+  dockerWorkdirLabel,
   ensureDockerNamedVolume,
   ensureDockerNetwork,
   isDockerRunning,
@@ -82,11 +88,9 @@ const ignoredDirNames = new Set([
 ]);
 const dockerLogRetryDelay = Duration.millis(400);
 const dockerLogDiagnosticTailLength = 4_096;
-const remoteJwksTimeoutMs = 10_000;
 const legacyDefaultEdgeRuntimeVersion = "v1.74.2";
 const defaultSupabaseEnv = "development";
 const serveMainContainerPath = "/root/index.ts";
-const clerkDomainPattern = /^(clerk([.][a-z0-9-]+){2,}|([a-z0-9-]+[.])+clerk[.]accounts[.]dev)$/;
 const shellVariableNamePattern = /^[A-Za-z_][A-Za-z0-9_]*$/;
 let cachedLegacyFunctionsServeMainTemplate: string | undefined;
 const watchIgnoreGlobs = [
@@ -127,9 +131,11 @@ export interface FunctionsServeDependencies {
   readonly debug: boolean;
   readonly networkId: Option.Option<string>;
   readonly projectIdOverride: Option.Option<string>;
+  readonly goViperCompat: boolean;
 }
 
 interface PlainServeAuthConfig {
+  readonly enabled: boolean;
   readonly signing_keys_path?: string;
   readonly publishable_key?: string;
   readonly secret_key?: string;
@@ -139,7 +145,7 @@ interface PlainServeAuthConfig {
   readonly third_party: ProjectConfig["auth"]["third_party"];
 }
 
-interface PlainServeEdgeRuntimeConfig {
+export interface PlainServeEdgeRuntimeConfig {
   readonly policy: ProjectConfig["edge_runtime"]["policy"];
   readonly inspector_port: number;
   readonly deno_version?: number;
@@ -170,12 +176,92 @@ interface WatchSpec {
   readonly matchPaths?: ReadonlySet<string>;
 }
 
-interface StartedRuntime {
+export interface StartedRuntime {
   readonly containerId: string;
   readonly cleanup: Effect.Effect<void>;
   readonly watchSpecs: ReadonlyArray<WatchSpec>;
 }
 
+/**
+ * Every already-resolved secret/key {@link startEdgeRuntimeContainer} needs,
+ * matching {@link resolveAuthArtifacts}'s return shape. Named and exported so
+ * a caller outside this module (`start`'s own edge-runtime bring-up,
+ * `legacy/commands/start/services/edge-runtime.service.ts`) can build the
+ * exact same shape from values it has already resolved itself, instead of
+ * calling {@link resolveAuthArtifacts} (which re-reads `config.toml`/signing
+ * keys independently — correct for the standalone `functions serve` command,
+ * but would risk resolving different secrets than the rest of a `start`
+ * stack for a caller that already has these values).
+ */
+export interface ServeAuthArtifacts {
+  readonly publishableKey: string;
+  readonly secretKey: string;
+  readonly jwtSecret: string;
+  readonly anonKey: string;
+  readonly serviceRoleKey: string;
+  readonly jwks: string;
+}
+
+/**
+ * Everything {@link startEdgeRuntimeContainer} needs from `config.toml`
+ * beyond auth (see {@link ServeAuthArtifacts}) — a narrowed, exported view of
+ * {@link ServeResolvedConfig} (which also carries `auth`/`configPath`, used
+ * only to resolve {@link ServeAuthArtifacts} and therefore irrelevant once
+ * those are already resolved). `start`'s own bring-up builds this directly
+ * from its own already-loaded `ProjectConfig` via {@link toPlainEdgeRuntimeConfig}/
+ * {@link toPlainFunctionRecord}/`inferFunctionsManifest` (`@supabase/config`)
+ * rather than going through {@link resolveServeConfig}'s independent
+ * config-loading pipeline.
+ */
+export interface ServeEdgeRuntimeContainerConfig {
+  readonly projectId: string;
+  readonly apiPort: number;
+  readonly edgeRuntimePolicy: string;
+  readonly edgeRuntimeInspectorPort: number;
+  readonly edgeRuntimeSecrets: Readonly<Record<string, string>>;
+  readonly configDeclaredFunctions: Readonly<Record<string, ManifestFunctionConfig>>;
+  readonly configFunctions: Readonly<Record<string, ManifestFunctionConfig>>;
+  readonly rawConfigFunctions: Readonly<Record<string, Readonly<Record<string, unknown>>>>;
+}
+
+/**
+ * Input to {@link startEdgeRuntimeContainer} — the reusable "bring up one
+ * Edge Runtime container" core extracted from `serveFunctions`'s interactive
+ * loop, kept independent of BOTH `functions serve`'s own config-loading
+ * (`resolveServeConfig`/`resolveAuthArtifacts`) and its file-watch/log-stream
+ * loop, so `start`'s bring-up can call it directly with values it has already
+ * resolved through its own pipeline (see `internal-db-connection.ts` for why
+ * {@link dbUrl} specifically must be caller-supplied rather than hardcoded).
+ */
+export interface StartEdgeRuntimeContainerInput {
+  readonly config: ServeEdgeRuntimeContainerConfig;
+  readonly authArtifacts: ServeAuthArtifacts;
+  /**
+   * `SUPABASE_DB_URL`. Deliberately NOT hardcoded in the shared core: Go's own
+   * two callers resolve this differently — standalone `functions serve`
+   * (`restartEdgeRuntime`, `serve.go:122`) always uses the `db` network alias
+   * (`postgresql://postgres:postgres@db:5432/postgres`, matching
+   * {@link legacyDefaultServeDbUrl} below), while `start`'s direct call
+   * (`start.go:66-72,1103`) uses the real `dbConfig` — the `db` container's
+   * own sanitized name and `config.db.password` — NOT the alias. Every caller
+   * must supply its own Go-accurate value; this module does not choose one.
+   */
+  readonly dbUrl: string;
+  /** Already-resolved edge-runtime image reference (registry-mapped, tag/deno-version already applied). */
+  readonly image: string;
+  readonly projectRoot: string;
+  readonly supabaseDir: string;
+  readonly flagCwd: string;
+  readonly platform: NodeJS.Platform;
+  readonly debug: boolean;
+  readonly networkId: string;
+  readonly envFile: Option.Option<string>;
+  readonly importMap: Option.Option<string>;
+  readonly noVerifyJwt: Option.Option<boolean>;
+  readonly inspectMode: FunctionsServeInspectMode | undefined;
+  readonly inspectMain: boolean;
+}
+
 type SigningKeyJwk = JsonWebKeyInput["key"] & {
   readonly kty: "EC" | "RSA";
   readonly kid?: string;
@@ -260,6 +346,7 @@ function toPlainAuthConfig(
   auth: ProjectConfig["auth"] | ResolvedProjectValue<ProjectConfig["auth"]>,
 ): PlainServeAuthConfig {
   return {
+    enabled: auth.enabled,
     signing_keys_path: reveal(auth.signing_keys_path),
     publishable_key: reveal(auth.publishable_key),
     secret_key: reveal(auth.secret_key),
@@ -293,7 +380,14 @@ function toPlainAuthConfig(
   };
 }
 
-function toPlainEdgeRuntimeConfig(
+/**
+ * Exported so `start`'s own edge-runtime bring-up
+ * (`legacy/commands/start/services/edge-runtime.service.ts`) can reuse this
+ * exact `Redacted`-unwrapping/key-uppercasing logic against its own,
+ * already-loaded `ProjectConfig` instead of duplicating it — see
+ * {@link ServeEdgeRuntimeContainerConfig}'s doc comment.
+ */
+export function toPlainEdgeRuntimeConfig(
   edgeRuntime: ProjectConfig["edge_runtime"] | ResolvedProjectValue<ProjectConfig["edge_runtime"]>,
 ): PlainServeEdgeRuntimeConfig {
   return {
@@ -308,7 +402,8 @@ function toPlainEdgeRuntimeConfig(
   };
 }
 
-function toPlainFunctionRecord(
+/** Exported for the same reason as {@link toPlainEdgeRuntimeConfig}. */
+export function toPlainFunctionRecord(
   functions: ProjectConfig["functions"] | ResolvedProjectValue<ProjectConfig["functions"]>,
 ): Readonly<Record<string, ManifestFunctionConfig>> {
   return Object.fromEntries(
@@ -393,137 +488,6 @@ async function readSigningKeys(pathname: string): Promise<ReadonlyArray<SigningK
   return decoded as ReadonlyArray<SigningKeyJwk>;
 }
 
-function toPublicSigningKey(signingKey: SigningKeyJwk): SigningKeyJwk {
-  if (signingKey.kty === "RSA") {
-    return {
-      kty: "RSA",
-      kid: signingKey.kid,
-      use: signingKey.use,
-      key_ops: signingKey.key_ops?.filter((operation: string) => operation === "verify"),
-      alg: signingKey.alg,
-      ext: signingKey.ext,
-      n: signingKey.n,
-      e: signingKey.e,
-    };
-  }
-
-  return {
-    kty: "EC",
-    kid: signingKey.kid,
-    use: signingKey.use,
-    key_ops: signingKey.key_ops?.filter((operation: string) => operation === "verify"),
-    alg: signingKey.alg,
-    ext: signingKey.ext,
-    crv: signingKey.crv,
-    x: signingKey.x,
-    y: signingKey.y,
-  };
-}
-
-function enabledThirdPartyIssuer(thirdParty: PlainServeAuthConfig["third_party"]) {
-  const enabledProviders = [
-    thirdParty.firebase.enabled ? "firebase" : undefined,
-    thirdParty.auth0.enabled ? "auth0" : undefined,
-    thirdParty.aws_cognito.enabled ? "aws_cognito" : undefined,
-    thirdParty.clerk.enabled ? "clerk" : undefined,
-    thirdParty.workos.enabled ? "workos" : undefined,
-  ].filter((value): value is NonNullable<typeof value> => value !== undefined);
-
-  if (enabledProviders.length > 1) {
-    throw new Error(
-      "Invalid config: Only one third_party provider allowed to be enabled at a time.",
-    );
-  }
-
-  if (thirdParty.firebase.enabled) {
-    if ((thirdParty.firebase.project_id ?? "").length === 0) {
-      throw new Error(
-        "Invalid config: auth.third_party.firebase is enabled but without a project_id.",
-      );
-    }
-    return `https://securetoken.google.com/${thirdParty.firebase.project_id}`;
-  }
-
-  if (thirdParty.auth0.enabled) {
-    if ((thirdParty.auth0.tenant ?? "").length === 0) {
-      throw new Error("Invalid config: auth.third_party.auth0 is enabled but without a tenant.");
-    }
-    return thirdParty.auth0.tenant_region
-      ? `https://${thirdParty.auth0.tenant}.${thirdParty.auth0.tenant_region}.auth0.com`
-      : `https://${thirdParty.auth0.tenant}.auth0.com`;
-  }
-
-  if (thirdParty.aws_cognito.enabled) {
-    if ((thirdParty.aws_cognito.user_pool_id ?? "").length === 0) {
-      throw new Error(
-        "Invalid config: auth.third_party.cognito is enabled but without a user_pool_id.",
-      );
-    }
-    if ((thirdParty.aws_cognito.user_pool_region ?? "").length === 0) {
-      throw new Error(
-        "Invalid config: auth.third_party.cognito is enabled but without a user_pool_region.",
-      );
-    }
-    return `https://cognito-idp.${thirdParty.aws_cognito.user_pool_region}.amazonaws.com/${thirdParty.aws_cognito.user_pool_id}`;
-  }
-
-  if (thirdParty.clerk.enabled) {
-    const domain = thirdParty.clerk.domain;
-    if (domain === undefined || domain.length === 0) {
-      throw new Error("Invalid config: auth.third_party.clerk is enabled but without a domain.");
-    }
-    if (!clerkDomainPattern.test(domain)) {
-      throw new Error(
-        "Invalid config: auth.third_party.clerk has invalid domain, it usually is like clerk.example.com or example.clerk.accounts.dev. Check https://clerk.com/setup/supabase on how to find the correct value.",
-      );
-    }
-    return `https://${domain}`;
-  }
-
-  if (thirdParty.workos.enabled) {
-    if ((thirdParty.workos.issuer_url ?? "").length === 0) {
-      throw new Error(
-        "Invalid config: auth.third_party.workos is enabled but without a issuer_url.",
-      );
-    }
-    return thirdParty.workos.issuer_url;
-  }
-
-  return undefined;
-}
-
-async function resolveRemoteJwks(issuerUrl: string): Promise<ReadonlyArray<unknown>> {
-  const discoveryResponse = await fetch(`${issuerUrl}/.well-known/openid-configuration`, {
-    signal: AbortSignal.timeout(remoteJwksTimeoutMs),
-  });
-  if (!discoveryResponse.ok) {
-    throw new Error(`Failed to fetch ${issuerUrl}/.well-known/openid-configuration`);
-  }
-
-  const discovery = (await discoveryResponse.json()) as { jwks_uri?: string };
-  if (typeof discovery.jwks_uri !== "string" || discovery.jwks_uri.length === 0) {
-    throw new Error(
-      `auth.third_party: OIDC configuration at URL "${issuerUrl}/.well-known/openid-configuration" does not expose a jwks_uri property`,
-    );
-  }
-
-  const jwksResponse = await fetch(discovery.jwks_uri, {
-    signal: AbortSignal.timeout(remoteJwksTimeoutMs),
-  });
-  if (!jwksResponse.ok) {
-    throw new Error(`Failed to fetch ${discovery.jwks_uri}`);
-  }
-
-  const jwks = (await jwksResponse.json()) as { keys?: ReadonlyArray<unknown> };
-  if (!Array.isArray(jwks.keys) || jwks.keys.length === 0) {
-    throw new Error(
-      `auth.third_party: JWKS at URL "${discovery.jwks_uri}" as discovered from "${issuerUrl}/.well-known/openid-configuration" does not contain any JWK keys`,
-    );
-  }
-
-  return jwks.keys;
-}
-
 const resolveAuthArtifacts = Effect.fnUntraced(function* (
   auth: PlainServeAuthConfig,
   configPath: string | undefined,
@@ -575,7 +539,15 @@ const resolveAuthArtifacts = Effect.fnUntraced(function* (
   const shouldUseJwtSecretFallback = signingKeysPath.length === 0;
 
   const keys: unknown[] = [];
-  const issuerUrl = enabledThirdPartyIssuer(auth.third_party);
+  // Go's `Auth.ThirdParty.validate()` (the "at most one enabled" + required-field checks
+  // `resolveThirdPartyIssuerUrl` performs) only runs inside `Config.Validate`'s `if
+  // c.Auth.Enabled` block (`config.go:1087-1153`), but `functions serve`'s own JWKS resolution
+  // (`serve.go:141`) discards `ResolveJWKS`'s error unconditionally, regardless of `auth.enabled`.
+  // So a malformed/multi-enabled third-party config must not throw here when auth is disabled —
+  // use the unchecked, no-throw `IssuerURL()`-only builder instead, matching Go exactly.
+  const issuerUrl = auth.enabled
+    ? resolveThirdPartyIssuerUrl(auth.third_party)
+    : thirdPartyIssuerUrlUnchecked(auth.third_party);
   if (issuerUrl !== undefined) {
     const remoteJwks = yield* Effect.tryPromise({
       try: () => resolveRemoteJwks(issuerUrl),
@@ -585,7 +557,7 @@ const resolveAuthArtifacts = Effect.fnUntraced(function* (
   }
   keys.push(
     ...(signingKeys.length > 0
-      ? signingKeys.map(toPublicSigningKey)
+      ? signingKeys.map(toPublicJwk)
       : shouldUseJwtSecretFallback
         ? [defaultSigningKey]
         : []),
@@ -616,6 +588,7 @@ const resolveAuthArtifacts = Effect.fnUntraced(function* (
 const resolveServeConfig = Effect.fnUntraced(function* (
   projectRoot: string,
   projectIdOverride: Option.Option<string>,
+  goViperCompat: boolean,
 ) {
   const projectEnv = yield* loadServeProjectEnvironment(projectRoot);
   const projectRef = Option.match(projectIdOverride, {
@@ -632,28 +605,35 @@ const resolveServeConfig = Effect.fnUntraced(function* (
   const loadedConfig = yield* loadProjectConfig(projectRoot, {
     ...(projectRef === undefined ? {} : { projectRef }),
     ...(projectEnv === null ? {} : { projectEnv }),
+    goViperCompat,
   });
   const baseConfig = loadedConfig?.config ?? defaultProjectConfig;
 
   const auth =
     projectEnv === null
       ? toPlainAuthConfig(baseConfig.auth)
-      : toPlainAuthConfig(yield* resolveProjectSubtree(baseConfig.auth, projectEnv, "auth"));
+      : toPlainAuthConfig(
+          yield* resolveProjectSubtree(baseConfig.auth, projectEnv, "auth", { goViperCompat }),
+        );
   const edgeRuntime =
     projectEnv === null
       ? toPlainEdgeRuntimeConfig(baseConfig.edge_runtime)
       : toPlainEdgeRuntimeConfig(
-          yield* resolveProjectSubtree(baseConfig.edge_runtime, projectEnv, "edge_runtime"),
+          yield* resolveProjectSubtree(baseConfig.edge_runtime, projectEnv, "edge_runtime", {
+            goViperCompat,
+          }),
         );
   const apiPort =
     projectEnv === null
       ? baseConfig.api.port
-      : (yield* resolveProjectSubtree(baseConfig.api, projectEnv, "api")).port;
+      : (yield* resolveProjectSubtree(baseConfig.api, projectEnv, "api", { goViperCompat })).port;
   const configDeclaredFunctions =
     projectEnv === null
       ? toPlainFunctionRecord(baseConfig.functions)
       : toPlainFunctionRecord(
-          yield* resolveProjectSubtree(baseConfig.functions, projectEnv, "functions"),
+          yield* resolveProjectSubtree(baseConfig.functions, projectEnv, "functions", {
+            goViperCompat,
+          }),
         );
   const configForManifest: ProjectConfig = {
     ...baseConfig,
@@ -667,7 +647,9 @@ const resolveServeConfig = Effect.fnUntraced(function* (
     projectEnv === null
       ? (baseConfig.project_id ?? "")
       : (reveal(
-          yield* resolveProjectValue(baseConfig.project_id ?? "", projectEnv, "project_id"),
+          yield* resolveProjectValue(baseConfig.project_id ?? "", projectEnv, "project_id", {
+            goViperCompat,
+          }),
         ) ?? "");
   const rawProjectId = Option.getOrElse(projectIdOverride, () => configProjectId).trim();
   const fallbackProjectId = basename(resolve(projectRoot));
@@ -681,7 +663,7 @@ const resolveServeConfig = Effect.fnUntraced(function* (
     configFunctions,
     rawConfigFunctions: rawFunctionConfigRecord(loadedConfig?.document),
     configPath: loadedConfig?.path,
-  };
+  } satisfies ServeResolvedConfig;
 });
 
 export function resolveFunctionsServeInspectMode(
@@ -807,13 +789,19 @@ function splitEnvEntry(entry: string) {
     : ([entry.slice(0, separatorIndex), entry.slice(separatorIndex + 1)] as const);
 }
 
-async function writeDockerEnvFile(env: Readonly<Record<string, string>>) {
+async function writeDockerEnvFile(env: Readonly<Record<string, string>>, dir: string) {
   const entries = Object.entries(env);
   if (entries.length === 0) {
     return undefined;
   }
 
-  const dir = await mkdtemp(join(tmpdir(), "supabase-functions-serve-env-"));
+  // Self-healing: `dir` is a deterministic, reused path (not a fresh mkdtemp
+  // each call), so a stale directory from an earlier invocation in the same
+  // process (e.g. `functions serve`'s watch-mode restart loop) is removed
+  // first — otherwise leftover files from a shrinking env set would survive
+  // alongside the fresh write.
+  await rm(dir, { recursive: true, force: true });
+  await mkdir(dir, { recursive: true, mode: 0o700 });
   const path = join(dir, "docker.env");
   // The file holds the JWT secret, anon/service-role keys, and JWKS, so keep it
   // owner-only rather than relying on the process umask.
@@ -825,21 +813,25 @@ async function writeDockerEnvFile(env: Readonly<Record<string, string>>) {
     { mode: 0o600 },
   );
 
-  return {
-    path,
-    cleanup: () => rm(dir, { recursive: true, force: true }),
-  };
+  return { path };
 }
 
 async function writeDockerMultilineEnvScript(
   env: ReadonlyArray<readonly [string, string]>,
   containerDir: string,
+  dir: string,
 ) {
+  // Self-healing — see the matching comment in `writeDockerEnvFile` above.
+  // Runs unconditionally, before the `env.length === 0` check, so a stale
+  // directory left by an earlier invocation that DID need multiline secrets
+  // is still reclaimed even when the current invocation doesn't.
+  await rm(dir, { recursive: true, force: true });
+
   if (env.length === 0) {
     return undefined;
   }
 
-  const dir = await mkdtemp(join(tmpdir(), "supabase-functions-serve-multiline-env-"));
+  await mkdir(dir, { recursive: true, mode: 0o700 });
   const scriptName = "multiline-env.sh";
   const path = join(dir, scriptName);
   const envDir = join(containerDir, "values");
@@ -853,7 +845,7 @@ async function writeDockerMultilineEnvScript(
 export ${name}="\${${name}%x}"`;
     })
     .join("\n");
-  await mkdir(hostEnvDir, { recursive: true });
+  await mkdir(hostEnvDir, { recursive: true, mode: 0o700 });
   // The value files hold secret env values, so keep them owner-only.
   await Promise.all(
     env.map(([_, value], index) =>
@@ -865,7 +857,6 @@ export ${name}="\${${name}%x}"`;
   return {
     bind: `${dir}:${containerDir}:ro`,
     scriptPath: join(containerDir, scriptName).replaceAll("\\", "/"),
-    cleanup: () => rm(dir, { recursive: true, force: true }),
   };
 }
 
@@ -1214,10 +1205,11 @@ const bestEffortRemoveContainer = Effect.fnUntraced(function* (containerId: stri
 const reloadKong = Effect.fnUntraced(function* (projectId: string) {
   const output = yield* Output;
   const kongId = localDockerId("kong", projectId);
-  const result = yield* runChildProcess("docker", ["exec", kongId, "kong", "reload"], {
-    stdout: "ignore",
-    stderr: "pipe",
-  }).pipe(Effect.catch(() => Effect.succeed({ exitCode: 1, stdout: "", stderr: "" })));
+  const result = yield* runChildProcess(
+    "docker",
+    ["exec", kongId, "kong", "reload", "--nginx-conf", "/home/kong/custom_nginx.template"],
+    { stdout: "ignore", stderr: "pipe" },
+  ).pipe(Effect.catch(() => Effect.succeed({ exitCode: 1, stdout: "", stderr: "" })));
 
   if (result.exitCode !== 0) {
     const suffix = result.stderr.trim().length > 0 ? ` ${result.stderr.trim()}` : "";
@@ -1238,16 +1230,15 @@ export function buildServeEntrypointCommand(
 `;
 }
 
-async function writeServeMainTemplateFile(template: string) {
+async function writeServeMainTemplateFile(template: string, dir: string) {
   // Mount the bundled runtime template instead of embedding it in `sh -c` so
   // Windows does not hit `uv_spawn` ENAMETOOLONG on path-heavy projects.
-  const dir = await mkdtemp(join(tmpdir(), "supabase-functions-serve-main-"));
+  // Self-healing — see the matching comment in `writeDockerEnvFile` above.
+  await rm(dir, { recursive: true, force: true });
+  await mkdir(dir, { recursive: true, mode: 0o700 });
   const pathname = join(dir, "index.ts");
   await writeFile(pathname, template);
-  return {
-    bind: `${pathname}:${serveMainContainerPath}:ro`,
-    cleanup: () => rm(dir, { recursive: true, force: true }),
-  } as const;
+  return { bind: `${pathname}:${serveMainContainerPath}:ro` } as const;
 }
 
 function edgeRuntimeImageTag(version: string) {
@@ -1257,7 +1248,10 @@ function edgeRuntimeImageTag(version: string) {
 const resolveServeFunctionConfigs = Effect.fnUntraced(function* (
   projectRoot: string,
   supabaseDir: string,
-  config: ServeResolvedConfig,
+  config: Pick<
+    ServeEdgeRuntimeContainerConfig,
+    "configDeclaredFunctions" | "configFunctions" | "rawConfigFunctions"
+  >,
   importMapOverride: Option.Option<string>,
   noVerifyJwtOverride: Option.Option<boolean>,
   flagCwd: string,
@@ -1276,61 +1270,131 @@ const resolveServeFunctionConfigs = Effect.fnUntraced(function* (
   });
 });
 
-const startEdgeRuntime = Effect.fnUntraced(function* (input: {
-  readonly flags: FunctionsServeFlags;
-  readonly dependencies: FunctionsServeDependencies;
-  readonly debug: boolean;
-  readonly networkId: Option.Option<string>;
-  readonly inspectMode: FunctionsServeInspectMode | undefined;
-}) {
-  const output = yield* Output;
-
-  if (!(yield* isDockerRunning())) {
-    return yield* Effect.fail(
-      new Error(
-        "failed to run docker. Docker Desktop is a prerequisite for local development. Follow the official docs to install: https://docs.docker.com/desktop",
-      ),
+/**
+ * Docker bind mounts (function source, import map, static assets) for every
+ * enabled function under `supabase/functions/**` — Go's
+ * `serve.PopulatePerFunctionConfigs` (`internal/functions/serve/serve.go:
+ * 277-318`), called both from Edge Runtime bring-up below (as part of its
+ * own loop) and, standalone, from `start`'s Studio container spec
+ * (`internal/start/start.go:1149-1159`), which needs only the bind mounts,
+ * unconditionally of whether Edge Runtime itself is enabled or excluded.
+ * `PopulatePerFunctionConfigs` logs `Skipped serving Function: <slug>`
+ * unconditionally for every disabled function, regardless of which of its
+ * two callers invoked it — so this shared helper reproduces that logging
+ * too. Note this means Go (and this port) genuinely double-prints the
+ * message when both Edge Runtime and Studio are enabled, since both call
+ * sites fire; don't dedupe it, that would itself diverge from Go.
+ */
+export const resolveFunctionBindMounts = Effect.fn("functions.resolveFunctionBindMounts")(
+  function* (
+    projectId: string,
+    projectRoot: string,
+    supabaseDir: string,
+    config: Pick<
+      ServeEdgeRuntimeContainerConfig,
+      "configDeclaredFunctions" | "configFunctions" | "rawConfigFunctions"
+    >,
+    importMapOverride: Option.Option<string>,
+    noVerifyJwtOverride: Option.Option<boolean>,
+    flagCwd: string,
+  ) {
+    const output = yield* Output;
+    const functionConfigs = yield* resolveServeFunctionConfigs(
+      projectRoot,
+      supabaseDir,
+      config,
+      importMapOverride,
+      noVerifyJwtOverride,
+      flagCwd,
     );
-  }
 
-  const resolved = yield* resolveServeConfig(
-    input.dependencies.projectRoot,
-    input.dependencies.projectIdOverride,
-  );
-  const projectId = resolved.projectId;
-  const containerId = localDockerId("edge_runtime", projectId);
-  let ownsRuntime = false;
-  return yield* Effect.gen(function* () {
-    const networkMode = Option.getOrElse(input.networkId, () =>
-      localDockerId("network", projectId),
-    );
-    const authArtifacts = yield* resolveAuthArtifacts(resolved.auth, resolved.configPath);
-    const edgeRuntimeVersionOverride = yield* Effect.tryPromise(() =>
-      readFile(join(input.dependencies.supabaseDir, ".temp", "edge-runtime-version"), "utf8"),
-    ).pipe(
-      Effect.map((value) => value.trim()),
-      Effect.catch(() => Effect.succeed("")),
-      Effect.map((value) => value || legacyDefaultEdgeRuntimeVersion),
-    );
-    const edgeRuntimeVersion = yield* resolveEdgeRuntimeVersion(
-      resolved.edgeRuntime.deno_version,
-      edgeRuntimeVersionOverride,
-    );
+    const functionsDir = join(projectRoot, functionsDirName);
+    const binds = new Set<string>();
 
-    yield* assertLocalDbRunning(projectId);
-    yield* bestEffortRemoveContainer(containerId);
-    ownsRuntime = true;
+    for (const fnConfig of functionConfigs) {
+      if (!fnConfig.enabled) {
+        yield* output.raw(`Skipped serving Function: ${fnConfig.slug}\n`, "stderr");
+        continue;
+      }
+
+      const bindWarnings: string[] = [];
+      for (const bind of yield* Effect.promise(() =>
+        buildDockerBinds(projectId, functionsDir, functionsDir, fnConfig, {
+          additionalModuleRoots: [flagCwd],
+          skipMissingImportMapTargets: true,
+          onWarning: async (message) => {
+            bindWarnings.push(message);
+          },
+        }),
+      )) {
+        binds.add(bind);
+      }
+      const missingSourceWarning = bindWarnings.find((warning) =>
+        warning.includes("failed to read file:"),
+      );
+      if (missingSourceWarning !== undefined) {
+        return yield* Effect.fail(
+          new Error(missingSourceWarning.trimStart().replace(/^WARN:\s*/, "")),
+        );
+      }
+    }
+
+    return binds;
+  },
+);
+
+/**
+ * The reusable "bring up one Edge Runtime container" core — Go's
+ * `ServeFunctions` (`internal/functions/serve/serve.go:135-252`), called both
+ * by standalone `functions serve` (indirectly, via `startEdgeRuntime` below,
+ * mirroring Go's `restartEdgeRuntime` wrapper) and directly by `start`'s own
+ * bring-up (`internal/start/start.go:1101-1108`, no wrapper step in between).
+ * Deliberately excludes everything `ServeFunctions` itself excludes too: no
+ * config-loading (caller resolves {@link StartEdgeRuntimeContainerInput.config}/
+ * {@link StartEdgeRuntimeContainerInput.authArtifacts} itself, matching how
+ * Go's two callers each resolve `config.toml`/secrets once, independently, and
+ * pass already-resolved values/strings into this shared core — see
+ * `serve.go:141-151` vs. `start.go:66-72`), no file-watching, and no log
+ * streaming (`serveFunctions`'s own loop, below, still owns both of those for
+ * the standalone command). Also excludes the Kong reload: `ServeFunctions`
+ * itself never reloads Kong — that only happens in `restartEdgeRuntime`
+ * (`startEdgeRuntime` below), after this core succeeds, so `start`'s own
+ * bring-up (which calls this core directly) correctly never reloads Kong
+ * either.
+ */
+export const startEdgeRuntimeContainer = Effect.fn("functions.startEdgeRuntimeContainer")(
+  function* (input: StartEdgeRuntimeContainerInput) {
+    const output = yield* Output;
+    const projectId = input.config.projectId;
+    const containerId = localDockerId("edge_runtime", projectId);
+    const networkMode = input.networkId;
+    // Deterministic, persistent host path (matching `start`'s own
+    // `legacyStageStartSecretFiles` convention for Kong/Postgres/Supavisor)
+    // rather than `os.tmpdir()`: `legacyCleanupStartSecrets` (wired into both
+    // `stop` and a failed-`start` rollback) reclaims this same
+    // `<workdir>/supabase/.temp/start-secrets/<containerId>` tree keyed by
+    // container name, so these JWT/service-role-key/secret env artifacts no
+    // longer leak on host disk indefinitely after the container is torn down.
+    const stagingDir = join(input.projectRoot, "supabase", ".temp", "start-secrets", containerId);
+    // A single directory-wide `rm` rather than three per-file `.cleanup()` closures (the JWT
+    // secrets/env file, the multiline-env script, the serve-main template all live under
+    // `stagingDir`): this is what lets the cleanup cover the whole staging-write window below,
+    // including a mid-write failure between the first and second `writeDocker*` call, not just
+    // the final `docker run` step.
+    const cleanupRuntimeArtifacts = Effect.tryPromise(() =>
+      rm(stagingDir, { recursive: true, force: true }),
+    ).pipe(Effect.orDie);
 
     const functionConfigs = yield* resolveServeFunctionConfigs(
-      input.dependencies.projectRoot,
-      input.dependencies.supabaseDir,
-      resolved,
-      input.flags.importMap,
-      input.flags.noVerifyJwt,
-      input.dependencies.flagCwd,
+      input.projectRoot,
+      input.supabaseDir,
+      input.config,
+      input.importMap,
+      input.noVerifyJwt,
+      input.flagCwd,
     );
 
-    const functionsDir = join(input.dependencies.projectRoot, functionsDirName);
+    const functionsDir = join(input.projectRoot, functionsDirName);
     const functionBinds = new Set<string>();
     const functionsConfig: Record<string, ServeFunctionContainerConfig> = {};
 
@@ -1343,7 +1407,7 @@ const startEdgeRuntime = Effect.fnUntraced(function* (input: {
       const bindWarnings: string[] = [];
       for (const bind of yield* Effect.promise(() =>
         buildDockerBinds(projectId, functionsDir, functionsDir, config, {
-          additionalModuleRoots: [input.dependencies.flagCwd],
+          additionalModuleRoots: [input.flagCwd],
           skipMissingImportMapTargets: true,
           onWarning: async (message) => {
             bindWarnings.push(message);
@@ -1360,10 +1424,7 @@ const startEdgeRuntime = Effect.fnUntraced(function* (input: {
           new Error(missingSourceWarning.trimStart().replace(/^WARN:\s*/, "")),
         );
       }
-      functionsConfig[config.slug] = toFunctionContainerConfig(
-        input.dependencies.projectRoot,
-        config,
-      );
+      functionsConfig[config.slug] = toFunctionContainerConfig(input.projectRoot, config);
     }
 
     const binds = new Set(functionBinds);
@@ -1373,20 +1434,20 @@ const startEdgeRuntime = Effect.fnUntraced(function* (input: {
 
     const env = [
       ...(yield* parseCustomEnvFile(
-        input.flags.envFile,
-        input.dependencies.projectRoot,
-        input.dependencies.flagCwd,
-        resolved.edgeRuntime.secrets,
+        input.envFile,
+        input.projectRoot,
+        input.flagCwd,
+        input.config.edgeRuntimeSecrets,
       )),
       "SUPABASE_URL=http://kong:8000",
-      `SUPABASE_ANON_KEY=${authArtifacts.anonKey}`,
-      `SUPABASE_SERVICE_ROLE_KEY=${authArtifacts.serviceRoleKey}`,
-      "SUPABASE_DB_URL=postgresql://postgres:postgres@db:5432/postgres",
-      `SUPABASE_INTERNAL_PUBLISHABLE_KEY=${authArtifacts.publishableKey}`,
-      `SUPABASE_INTERNAL_SECRET_KEY=${authArtifacts.secretKey}`,
-      `SUPABASE_INTERNAL_JWT_SECRET=${authArtifacts.jwtSecret}`,
-      `SUPABASE_JWKS=${authArtifacts.jwks}`,
-      `SUPABASE_INTERNAL_HOST_PORT=${resolved.apiPort}`,
+      `SUPABASE_ANON_KEY=${input.authArtifacts.anonKey}`,
+      `SUPABASE_SERVICE_ROLE_KEY=${input.authArtifacts.serviceRoleKey}`,
+      `SUPABASE_DB_URL=${input.dbUrl}`,
+      `SUPABASE_INTERNAL_PUBLISHABLE_KEY=${input.authArtifacts.publishableKey}`,
+      `SUPABASE_INTERNAL_SECRET_KEY=${input.authArtifacts.secretKey}`,
+      `SUPABASE_INTERNAL_JWT_SECRET=${input.authArtifacts.jwtSecret}`,
+      `SUPABASE_JWKS=${input.authArtifacts.jwks}`,
+      `SUPABASE_INTERNAL_HOST_PORT=${input.config.apiPort}`,
       `SUPABASE_INTERNAL_FUNCTIONS_CONFIG=${JSON.stringify(functionsConfig)}`,
       ...(input.debug ? ["SUPABASE_INTERNAL_DEBUG=true"] : []),
     ];
@@ -1396,98 +1457,217 @@ const startEdgeRuntime = Effect.fnUntraced(function* (input: {
     const dockerEnv = Object.fromEntries(env.map(splitEnvEntry));
     const { singleLine: singleLineDockerEnv, multiline: multilineDockerEnv } =
       partitionDockerEnvEntries(dockerEnv);
-    yield* Effect.try({
-      try: () => validateDockerMultilineEnvNames(multilineDockerEnv),
-      catch: (cause) => (cause instanceof Error ? cause : new Error(String(cause))),
-    });
-    const dockerEnvFile = yield* Effect.tryPromise(() => writeDockerEnvFile(singleLineDockerEnv));
-    const multilineEnvDir = "/root/.supabase/multiline-env";
-    const dockerMultilineEnvScript = yield* Effect.tryPromise(() =>
-      writeDockerMultilineEnvScript(multilineDockerEnv, multilineEnvDir),
-    ).pipe(Effect.mapError((cause) => (cause instanceof Error ? cause : new Error(String(cause)))));
-
-    const labels = dockerProjectLabels(projectId);
-    const runtimeCommand = [
-      "edge-runtime",
-      "start",
-      "--main-service=/root",
-      `--port=${dockerRuntimeServerPort}`,
-      `--policy=${resolved.edgeRuntime.policy}`,
-      ...buildFunctionsServeInspectArgs(input.inspectMode, input.flags.inspectMain),
-      ...(input.debug ? ["--verbose"] : []),
-    ];
-    const serveMainTemplate = yield* Effect.promise(() => getLegacyFunctionsServeMainTemplate());
-    const serveMainTemplateFile = yield* Effect.tryPromise(() =>
-      writeServeMainTemplateFile(serveMainTemplate),
-    ).pipe(Effect.mapError((cause) => (cause instanceof Error ? cause : new Error(String(cause)))));
-    const command = [
-      "run",
-      "-d",
-      "--name",
-      containerId,
-      "--network",
-      networkMode,
-      "--network-alias",
-      "edge_runtime",
-      "--workdir",
-      toDockerPath(input.dependencies.projectRoot),
-      "--ulimit",
-      "nofile=65536:65536",
-      "--label",
-      `com.supabase.cli.project=${labels["com.supabase.cli.project"]}`,
-      "--label",
-      `com.docker.compose.project=${labels["com.docker.compose.project"]}`,
-      "-v",
-      serveMainTemplateFile.bind,
-      ...([...binds] as ReadonlyArray<string>).flatMap((bind) => ["-v", bind]),
-      ...(dockerMultilineEnvScript === undefined ? [] : ["-v", dockerMultilineEnvScript.bind]),
-      ...(dockerEnvFile === undefined ? [] : ["--env-file", dockerEnvFile.path]),
-      ...(input.dependencies.platform === "linux"
-        ? ["--add-host", "host.docker.internal:host-gateway"]
-        : []),
-      ...(input.inspectMode === undefined
-        ? []
-        : ["-p", `${resolved.edgeRuntime.inspector_port}:${dockerRuntimeInspectorPort}`]),
-      "--entrypoint",
-      "sh",
-      legacyGetRegistryImageUrl(`supabase/edge-runtime:${edgeRuntimeImageTag(edgeRuntimeVersion)}`),
-      "-c",
-      buildServeEntrypointCommand(runtimeCommand, dockerMultilineEnvScript?.scriptPath),
-    ];
+    // Everything from here on writes into `stagingDir` (or starts the container that reads from
+    // it), so the whole window — including a mid-write failure between two `writeDocker*` calls,
+    // not just the final `docker run` step — is wrapped in `Effect.onError` below.
+    return yield* Effect.gen(function* () {
+      yield* Effect.try({
+        try: () => validateDockerMultilineEnvNames(multilineDockerEnv),
+        catch: (cause) => (cause instanceof Error ? cause : new Error(String(cause))),
+      });
+      const dockerEnvFile = yield* Effect.tryPromise(() =>
+        writeDockerEnvFile(singleLineDockerEnv, join(stagingDir, "env")),
+      );
+      const multilineEnvDir = "/root/.supabase/multiline-env";
+      const dockerMultilineEnvScript = yield* Effect.tryPromise(() =>
+        writeDockerMultilineEnvScript(
+          multilineDockerEnv,
+          multilineEnvDir,
+          join(stagingDir, "multiline-env"),
+        ),
+      ).pipe(
+        Effect.mapError((cause) => (cause instanceof Error ? cause : new Error(String(cause)))),
+      );
 
-    const cleanupRuntimeArtifacts = Effect.all([
-      Effect.tryPromise(() => serveMainTemplateFile.cleanup()).pipe(Effect.orDie),
-      dockerEnvFile === undefined
-        ? Effect.void
-        : Effect.tryPromise(() => dockerEnvFile.cleanup()).pipe(Effect.orDie),
-      dockerMultilineEnvScript === undefined
-        ? Effect.void
-        : Effect.tryPromise(() => dockerMultilineEnvScript.cleanup()).pipe(Effect.orDie),
-    ]).pipe(Effect.asVoid);
+      const labels = dockerProjectLabels(projectId);
+      const runtimeCommand = [
+        "edge-runtime",
+        "start",
+        "--main-service=/root",
+        `--port=${dockerRuntimeServerPort}`,
+        `--policy=${input.config.edgeRuntimePolicy}`,
+        ...buildFunctionsServeInspectArgs(input.inspectMode, input.inspectMain),
+        ...(input.debug ? ["--verbose"] : []),
+      ];
+      const serveMainTemplate = yield* Effect.promise(() => getLegacyFunctionsServeMainTemplate());
+      const serveMainTemplateFile = yield* Effect.tryPromise(() =>
+        writeServeMainTemplateFile(serveMainTemplate, join(stagingDir, "main")),
+      ).pipe(
+        Effect.mapError((cause) => (cause instanceof Error ? cause : new Error(String(cause)))),
+      );
+      const command = [
+        "run",
+        "-d",
+        "--name",
+        containerId,
+        "--network",
+        networkMode,
+        "--network-alias",
+        "edge_runtime",
+        "--workdir",
+        toDockerPath(input.projectRoot),
+        "--ulimit",
+        "nofile=65536:65536",
+        "--label",
+        `com.supabase.cli.project=${labels["com.supabase.cli.project"]}`,
+        "--label",
+        `com.docker.compose.project=${labels["com.docker.compose.project"]}`,
+        "--label",
+        `${dockerWorkdirLabel}=${input.projectRoot}`,
+        "-v",
+        serveMainTemplateFile.bind,
+        ...([...binds] as ReadonlyArray<string>).flatMap((bind) => ["-v", bind]),
+        ...(dockerMultilineEnvScript === undefined ? [] : ["-v", dockerMultilineEnvScript.bind]),
+        ...(dockerEnvFile === undefined ? [] : ["--env-file", dockerEnvFile.path]),
+        ...(input.platform === "linux" ? ["--add-host", "host.docker.internal:host-gateway"] : []),
+        ...(input.inspectMode === undefined
+          ? []
+          : ["-p", `${input.config.edgeRuntimeInspectorPort}:${dockerRuntimeInspectorPort}`]),
+        "--entrypoint",
+        "sh",
+        input.image,
+        "-c",
+        buildServeEntrypointCommand(runtimeCommand, dockerMultilineEnvScript?.scriptPath),
+      ];
 
-    return yield* Effect.gen(function* () {
-      yield* output.raw("Setting up Edge Functions runtime...\n", "stderr");
       const result = yield* runChildProcess("docker", command, {
         stdout: "pipe",
         stderr: "pipe",
       });
       if (result.exitCode !== 0) {
-        yield* cleanupRuntimeArtifacts;
         const message =
           result.stderr.trim() || result.stdout.trim() || "failed to start edge runtime";
         return yield* Effect.fail(new Error(message));
       }
 
-      yield* reloadKong(projectId);
-
       return {
         containerId,
         cleanup: cleanupRuntimeArtifacts,
         watchSpecs: yield* Effect.promise(() => buildWatchSpecs([...functionBinds])),
       } satisfies StartedRuntime;
-    }).pipe(Effect.onInterrupt(() => cleanupRuntimeArtifacts));
+    }).pipe(Effect.onError(() => cleanupRuntimeArtifacts));
+  },
+);
+
+/**
+ * `SUPABASE_DB_URL`'s value for standalone `functions serve` — Go's
+ * `restartEdgeRuntime` (`internal/functions/serve/serve.go:121-122`): "Use
+ * network alias because Deno cannot resolve `_` in hostname", always
+ * `postgresql://postgres:postgres@db:5432/postgres` regardless of
+ * project/config (`db`, `utils.DbAliases[0]`, is a fixed network alias, and
+ * `db.Password` is `toml:"-"` — never configurable, always the `"postgres"`
+ * literal default, `pkg/config/config.go:459`). This is genuinely NOT the
+ * same value `start`'s own bring-up uses — see
+ * {@link StartEdgeRuntimeContainerInput.dbUrl}'s doc comment.
+ */
+const legacyDefaultServeDbUrl = "postgresql://postgres:postgres@db:5432/postgres";
+
+/**
+ * Go's `restartEdgeRuntime` (`internal/functions/serve/serve.go:108-133`):
+ * resolves `functions serve`'s own config/secrets/image independently on
+ * every (re)start, then delegates the actual bring-up to
+ * {@link startEdgeRuntimeContainer} (Go's `ServeFunctions`) exactly like
+ * `start`'s own bring-up will. Once that bring-up succeeds, this wrapper — and
+ * only this wrapper, matching Go's `restartEdgeRuntime` — reloads Kong
+ * (`serve.go:126-131`) so Kong's routing table picks up the freshly
+ * (re)started container.
+ */
+const startEdgeRuntime = Effect.fnUntraced(function* (input: {
+  readonly flags: FunctionsServeFlags;
+  readonly dependencies: FunctionsServeDependencies;
+  readonly debug: boolean;
+  readonly networkId: Option.Option<string>;
+  readonly inspectMode: FunctionsServeInspectMode | undefined;
+}) {
+  const output = yield* Output;
+  if (!(yield* isDockerRunning())) {
+    return yield* Effect.fail(
+      new Error(
+        "failed to run docker. Docker Desktop is a prerequisite for local development. Follow the official docs to install: https://docs.docker.com/desktop",
+      ),
+    );
+  }
+
+  const resolved = yield* resolveServeConfig(
+    input.dependencies.projectRoot,
+    input.dependencies.projectIdOverride,
+    input.dependencies.goViperCompat,
+  );
+  const projectId = resolved.projectId;
+  const containerId = localDockerId("edge_runtime", projectId);
+  let ownsRuntime = false;
+  let startedRuntime: StartedRuntime | undefined;
+  return yield* Effect.gen(function* () {
+    const networkMode = Option.getOrElse(input.networkId, () =>
+      localDockerId("network", projectId),
+    );
+    const authArtifacts = yield* resolveAuthArtifacts(resolved.auth, resolved.configPath);
+    const edgeRuntimeVersionOverride = yield* Effect.tryPromise(() =>
+      readFile(join(input.dependencies.supabaseDir, ".temp", "edge-runtime-version"), "utf8"),
+    ).pipe(
+      Effect.map((value) => value.trim()),
+      Effect.catch(() => Effect.succeed("")),
+      Effect.map((value) => value || legacyDefaultEdgeRuntimeVersion),
+    );
+    const edgeRuntimeVersion = yield* resolveEdgeRuntimeVersion(
+      resolved.edgeRuntime.deno_version,
+      edgeRuntimeVersionOverride,
+    );
+    const image = legacyGetRegistryImageUrl(
+      `supabase/edge-runtime:${edgeRuntimeImageTag(edgeRuntimeVersion)}`,
+    );
+
+    yield* assertLocalDbRunning(projectId);
+    yield* bestEffortRemoveContainer(containerId);
+    ownsRuntime = true;
+
+    // Go's `restartEdgeRuntime` prints this right before calling `ServeFunctions`
+    // (`serve.go:124-125`) — `ServeFunctions` itself (this file's `startEdgeRuntimeContainer`,
+    // also called directly by `start.go:1104`) never prints it, so it belongs in this
+    // `functions serve`-only wrapper, not the shared core.
+    yield* output.raw("Setting up Edge Functions runtime...\n", "stderr");
+
+    startedRuntime = yield* startEdgeRuntimeContainer({
+      config: {
+        projectId,
+        apiPort: resolved.apiPort,
+        edgeRuntimePolicy: resolved.edgeRuntime.policy,
+        edgeRuntimeInspectorPort: resolved.edgeRuntime.inspector_port,
+        edgeRuntimeSecrets: resolved.edgeRuntime.secrets,
+        configDeclaredFunctions: resolved.configDeclaredFunctions,
+        configFunctions: resolved.configFunctions,
+        rawConfigFunctions: resolved.rawConfigFunctions,
+      },
+      authArtifacts,
+      dbUrl: legacyDefaultServeDbUrl,
+      image,
+      projectRoot: input.dependencies.projectRoot,
+      supabaseDir: input.dependencies.supabaseDir,
+      flagCwd: input.dependencies.flagCwd,
+      platform: input.dependencies.platform,
+      debug: input.debug,
+      networkId: networkMode,
+      envFile: input.flags.envFile,
+      importMap: input.flags.importMap,
+      noVerifyJwt: input.flags.noVerifyJwt,
+      inspectMode: input.inspectMode,
+      inspectMain: input.flags.inspectMain,
+    });
+
+    yield* reloadKong(projectId);
+
+    return startedRuntime;
   }).pipe(
-    Effect.onInterrupt(() => (ownsRuntime ? bestEffortRemoveContainer(containerId) : Effect.void)),
+    // `startEdgeRuntimeContainer`'s own `Effect.onError` only reaches while it's still running —
+    // once it returns successfully, an interrupt here (e.g. mid-`reloadKong`) escapes that scope
+    // entirely, so this wrapper must also run the returned runtime's own staging-file cleanup,
+    // not just remove the container.
+    Effect.onInterrupt(() =>
+      Effect.all([
+        ownsRuntime ? bestEffortRemoveContainer(containerId) : Effect.void,
+        startedRuntime === undefined ? Effect.void : startedRuntime.cleanup,
+      ]).pipe(Effect.asVoid),
+    ),
   );
 });
 
diff --git a/apps/cli/src/shared/legacy/global-flags.ts b/apps/cli/src/shared/legacy/global-flags.ts
index 8f7e8ff15f..59796bb6aa 100644
--- a/apps/cli/src/shared/legacy/global-flags.ts
+++ b/apps/cli/src/shared/legacy/global-flags.ts
@@ -1,4 +1,4 @@
-import { Effect } from "effect";
+import { Effect, Option } from "effect";
 import { Flag, GlobalFlag } from "effect/unstable/cli";
 
 import { CliArgs } from "../cli/cli-args.service.ts";
@@ -95,6 +95,48 @@ export const LEGACY_GLOBAL_FLAGS = [
   LegacyAgentFlag,
 ] as const;
 
+/**
+ * Resolves the current value of every global/persistent flag above, keyed by
+ * its own CLI flag name (each flag's `.id`, e.g. `debug`, `workdir`). Used by
+ * `legacy/telemetry/legacy-command-instrumentation.ts` to mirror Go's
+ * `changedFlags()` walking `cmd.Parent()`'s `PersistentFlags()` in addition to
+ * a command's own flags (`cmd/root_analytics.go:53-76`) — global flags here
+ * live in a single Effect-context-wide registry rather than per-ancestor
+ * `pflag.FlagSet`s, so this reads all of them unconditionally instead of
+ * walking a parent chain (CLI-1896).
+ *
+ * Read via `Effect.serviceOption` (adds no `R` requirement) so a caller that
+ * hasn't wired the global-flag context — e.g. a focused unit test — simply
+ * gets an empty record instead of a missing-service defect; production always
+ * provides every global flag through `Command.withGlobalFlags` at the CLI
+ * root (`legacy/cli/root.ts`).
+ *
+ * Reads each flag individually (rather than looping `LEGACY_GLOBAL_FLAGS`)
+ * because each `Setting<Id, A>` has a distinct value type `A` — a homogeneous
+ * loop widens the union in a way `Effect.serviceOption` can't resolve back to
+ * a single service lookup without an `as` cast, which this codebase forbids.
+ * `global-flags.unit.test.ts` asserts the resolved id set stays exactly in
+ * sync with `LEGACY_GLOBAL_FLAGS` — extend both together when adding a new
+ * global flag.
+ */
+export const legacyGlobalFlagValues = Effect.gen(function* () {
+  const values: Record<string, unknown> = {};
+  const setIfPresent = (id: string, option: Option.Option<unknown>) => {
+    if (Option.isSome(option)) values[id] = option.value;
+  };
+  setIfPresent(LegacyAgentFlag.id, yield* Effect.serviceOption(LegacyAgentFlag));
+  setIfPresent(LegacyCreateTicketFlag.id, yield* Effect.serviceOption(LegacyCreateTicketFlag));
+  setIfPresent(LegacyDebugFlag.id, yield* Effect.serviceOption(LegacyDebugFlag));
+  setIfPresent(LegacyDnsResolverFlag.id, yield* Effect.serviceOption(LegacyDnsResolverFlag));
+  setIfPresent(LegacyExperimentalFlag.id, yield* Effect.serviceOption(LegacyExperimentalFlag));
+  setIfPresent(LegacyNetworkIdFlag.id, yield* Effect.serviceOption(LegacyNetworkIdFlag));
+  setIfPresent(LegacyOutputFlag.id, yield* Effect.serviceOption(LegacyOutputFlag));
+  setIfPresent(LegacyProfileFlag.id, yield* Effect.serviceOption(LegacyProfileFlag));
+  setIfPresent(LegacyWorkdirFlag.id, yield* Effect.serviceOption(LegacyWorkdirFlag));
+  setIfPresent(LegacyYesFlag.id, yield* Effect.serviceOption(LegacyYesFlag));
+  return values;
+});
+
 const PFLAG_FALSE_VALUES = new Set(["0", "f", "F", "false", "FALSE", "False"]);
 
 /**
@@ -151,13 +193,61 @@ export const legacyResolveYesWithProjectEnv = (projectEnv: Record<string, string
     );
   });
 
+/**
+ * True when the raw argv contains an explicit `--experimental=<false>` (pflag's `ParseBool`
+ * false set). Mirrors {@link legacyYesFlagExplicitlyFalse}: `--experimental` is bound to
+ * viper the same way `--yes` is (`apps/cli-go/cmd/root.go:318-334`), and viper's bound-pflag
+ * lookup returns the flag value whenever `Changed` is true — BEFORE falling back to
+ * `AutomaticEnv` — regardless of whether that value is `true` or `false`
+ * (`viper@v1.21.0/viper.go:1176-1178`). A plain boolean can't distinguish an explicit
+ * `--experimental=false` from the omitted default, so scan the raw argv. Only the `=false`
+ * form needs special handling: `--experimental` / `--experimental=true` are already `true`,
+ * so `flag || env` matches Go, and an omitted flag correctly falls through to the env value.
+ */
+const legacyExperimentalFlagExplicitlyFalse = (args: ReadonlyArray<string>): boolean =>
+  args.some(
+    (arg) =>
+      arg.startsWith("--experimental=") &&
+      PFLAG_FALSE_VALUES.has(arg.slice("--experimental=".length)),
+  );
+
 /**
  * `--experimental` resolved with Go's viper `AutomaticEnv` fallback: the gate in
  * `rootCmd.PersistentPreRunE` reads `viper.GetBool("EXPERIMENTAL")`
  * (`apps/cli-go/cmd/root.go:94`), so `SUPABASE_EXPERIMENTAL` enables experimental
- * commands just like the flag. A passed `--experimental` wins over the env.
+ * commands just like the flag. An explicit `--experimental` — including
+ * `--experimental=false` — wins over the env, matching viper's bound-pflag precedence.
  */
 export const legacyResolveExperimental = Effect.gen(function* () {
   const flag = yield* LegacyExperimentalFlag;
+  const cliArgs = yield* CliArgs;
+  if (legacyExperimentalFlagExplicitlyFalse(cliArgs.args)) {
+    return false;
+  }
   return flag || legacyViperEnvBool("SUPABASE_EXPERIMENTAL");
 });
+
+/**
+ * `--experimental` resolved with the project `.env` consulted too, for commands that load the
+ * nested project env before branching on the experimental gate (`db reset`,
+ * `db schema declarative generate`/`sync`). Go's `ParseDatabaseConfig` /
+ * `dbDeclarativeCmd.PersistentPreRunE` run `loadNestedEnv` — which `os.Setenv`s each
+ * project-.env key — before reading `viper.GetBool("EXPERIMENTAL")`, so a
+ * `SUPABASE_EXPERIMENTAL` set only in `supabase/.env` enables the experimental path. The
+ * shell env still wins over the file value; an explicit `--experimental` — including
+ * `--experimental=false` — wins over both, matching viper's bound-pflag precedence.
+ * `projectEnv` is the loaded map from `legacyLoadProjectEnv`.
+ */
+export const legacyResolveExperimentalWithProjectEnv = (projectEnv: Record<string, string>) =>
+  Effect.gen(function* () {
+    const flag = yield* LegacyExperimentalFlag;
+    const cliArgs = yield* CliArgs;
+    if (legacyExperimentalFlagExplicitlyFalse(cliArgs.args)) {
+      return false;
+    }
+    return (
+      flag ||
+      legacyViperEnvBool("SUPABASE_EXPERIMENTAL") ||
+      legacyViperBool(projectEnv["SUPABASE_EXPERIMENTAL"])
+    );
+  });
diff --git a/apps/cli/src/shared/legacy/global-flags.unit.test.ts b/apps/cli/src/shared/legacy/global-flags.unit.test.ts
new file mode 100644
index 0000000000..ec54f34982
--- /dev/null
+++ b/apps/cli/src/shared/legacy/global-flags.unit.test.ts
@@ -0,0 +1,83 @@
+import { describe, expect, it } from "@effect/vitest";
+import { Effect, Layer, Option } from "effect";
+import {
+  LEGACY_GLOBAL_FLAGS,
+  LegacyAgentFlag,
+  LegacyCreateTicketFlag,
+  LegacyDebugFlag,
+  LegacyDnsResolverFlag,
+  LegacyExperimentalFlag,
+  LegacyNetworkIdFlag,
+  LegacyOutputFlag,
+  LegacyProfileFlag,
+  LegacyWorkdirFlag,
+  LegacyYesFlag,
+  legacyGlobalFlagValues,
+} from "./global-flags.ts";
+
+describe("legacyGlobalFlagValues", () => {
+  it.live(
+    "resolves every flag declared in LEGACY_GLOBAL_FLAGS by id (CLI-1896 drift guard: an 11th global flag added here without a matching read in legacyGlobalFlagValues fails this test instead of silently redacting forever)",
+    () => {
+      const layer = Layer.mergeAll(
+        Layer.succeed(LegacyAgentFlag, "yes" as const),
+        Layer.succeed(LegacyCreateTicketFlag, true),
+        Layer.succeed(LegacyDebugFlag, true),
+        Layer.succeed(LegacyDnsResolverFlag, "https" as const),
+        Layer.succeed(LegacyExperimentalFlag, true),
+        Layer.succeed(LegacyNetworkIdFlag, Option.some("my-network")),
+        Layer.succeed(LegacyOutputFlag, Option.some("json" as const)),
+        Layer.succeed(LegacyProfileFlag, "custom-profile"),
+        Layer.succeed(LegacyWorkdirFlag, Option.some("/tmp/project")),
+        Layer.succeed(LegacyYesFlag, true),
+      );
+
+      return legacyGlobalFlagValues.pipe(
+        Effect.provide(layer),
+        Effect.tap((values) =>
+          Effect.sync(() => {
+            // The key set must exactly match LEGACY_GLOBAL_FLAGS's own ids —
+            // this is what fails loudly if the array grows without a matching
+            // read here.
+            expect(Object.keys(values).sort()).toEqual(
+              LEGACY_GLOBAL_FLAGS.map((flag) => flag.id).sort(),
+            );
+            expect(values).toEqual({
+              agent: "yes",
+              "create-ticket": true,
+              debug: true,
+              "dns-resolver": "https",
+              experimental: true,
+              "network-id": Option.some("my-network"),
+              output: Option.some("json"),
+              profile: "custom-profile",
+              workdir: Option.some("/tmp/project"),
+              yes: true,
+            });
+          }),
+        ),
+      );
+    },
+  );
+
+  it.live("omits every flag when no global-flag context is provided", () => {
+    return legacyGlobalFlagValues.pipe(
+      Effect.tap((values) =>
+        Effect.sync(() => {
+          expect(values).toEqual({});
+        }),
+      ),
+    );
+  });
+
+  it.live("only includes flags whose service was actually provided", () => {
+    return legacyGlobalFlagValues.pipe(
+      Effect.provide(Layer.succeed(LegacyDebugFlag, true)),
+      Effect.tap((values) =>
+        Effect.sync(() => {
+          expect(values).toEqual({ debug: true });
+        }),
+      ),
+    );
+  });
+});
diff --git a/apps/cli/src/shared/legacy/go-proxy.layer.ts b/apps/cli/src/shared/legacy/go-proxy.layer.ts
index b190d9f109..d359113450 100644
--- a/apps/cli/src/shared/legacy/go-proxy.layer.ts
+++ b/apps/cli/src/shared/legacy/go-proxy.layer.ts
@@ -8,6 +8,7 @@ import * as ChildProcess from "effect/unstable/process/ChildProcess";
 import { ChildProcessSpawner } from "effect/unstable/process/ChildProcessSpawner";
 import { CLI_VERSION } from "../cli/version.ts";
 import { ProcessControl } from "../runtime/process-control.service.ts";
+import { LegacyGoChildExitError } from "./legacy-go-child-exit.error.ts";
 import { LegacyGoProxy } from "./go-proxy.service.ts";
 
 // ---------------------------------------------------------------------------
@@ -139,8 +140,8 @@ export function makeGoProxyLayer(opts?: {
    * Override binary resolution. Primarily a test seam so specs don't have to
    * mutate `process.env.SUPABASE_GO_BINARY` or stub the filesystem:
    *  - `string`              — treat as the resolved Go binary path.
-   *  - `{ notFound: [...] }` — simulate the not-found path; `.exec` will
-   *                            print the diagnostic and exit non-zero.
+   *  - `{ notFound: [...] }` — simulate the not-found path; `.exec` will print
+   *                            the diagnostic and fail with a non-zero exit code.
    *
    * In production, leave unset and let `resolveBinary()` pick the right
    * artifact for the host platform.
@@ -166,12 +167,16 @@ export function makeGoProxyLayer(opts?: {
                 // CLI-1488: never silently fall back to `supabase` on PATH —
                 // when the shim is on PATH and `supabase-go` is not co-located,
                 // that fallback resolves to the shim itself and fork-bombs.
-                // Print a specific diagnostic and exit non-zero instead.
+                // Print a specific diagnostic and fail non-zero instead.
                 yield* Effect.sync(() => {
                   process.stderr.write(`${formatGoBinaryNotFoundError(resolved.notFound)}\n`);
                 });
-                yield* processControl.exit(1);
-                return;
+                return yield* Effect.fail(
+                  new LegacyGoChildExitError({
+                    exitCode: 1,
+                    message: "supabase-go binary not found",
+                  }),
+                );
               }
               const binary = resolved.found;
 
@@ -212,7 +217,12 @@ export function makeGoProxyLayer(opts?: {
               });
               const exitCode = yield* spawner.exitCode(command).pipe(Effect.orDie);
               if (exitCode !== 0) {
-                yield* processControl.exit(exitCode);
+                return yield* Effect.fail(
+                  new LegacyGoChildExitError({
+                    exitCode,
+                    message: `supabase-go exited with code ${exitCode} (see stderr for details)`,
+                  }),
+                );
               }
             }),
           ),
@@ -223,7 +233,12 @@ export function makeGoProxyLayer(opts?: {
                 yield* Effect.sync(() => {
                   process.stderr.write(`${formatGoBinaryNotFoundError(resolved.notFound)}\n`);
                 });
-                return yield* processControl.exit(1);
+                return yield* Effect.fail(
+                  new LegacyGoChildExitError({
+                    exitCode: 1,
+                    message: "supabase-go binary not found",
+                  }),
+                );
               }
               const binary = resolved.found;
               yield* processControl.holdSignals(["SIGINT", "SIGTERM", "SIGHUP"]);
@@ -252,7 +267,12 @@ export function makeGoProxyLayer(opts?: {
               );
               const exitCode = yield* handle.exitCode.pipe(Effect.orDie);
               if (exitCode !== 0) {
-                return yield* processControl.exit(exitCode);
+                return yield* Effect.fail(
+                  new LegacyGoChildExitError({
+                    exitCode,
+                    message: `supabase-go exited with code ${exitCode} (see stderr for details)`,
+                  }),
+                );
               }
               return captured;
             }),
diff --git a/apps/cli/src/shared/legacy/go-proxy.layer.unit.test.ts b/apps/cli/src/shared/legacy/go-proxy.layer.unit.test.ts
index 8fc4713d7b..7a305197a8 100644
--- a/apps/cli/src/shared/legacy/go-proxy.layer.unit.test.ts
+++ b/apps/cli/src/shared/legacy/go-proxy.layer.unit.test.ts
@@ -1,7 +1,8 @@
 import { describe, expect, it, vi } from "@effect/vitest";
-import { Deferred, Effect, Fiber, Layer, Sink, Stream } from "effect";
+import { Cause, Deferred, Effect, Exit, Fiber, Layer, Sink, Stream } from "effect";
 import { ChildProcessSpawner } from "effect/unstable/process";
 import { type CliProcessSignal, ProcessControl } from "../runtime/process-control.service.ts";
+import { LegacyGoChildExitError } from "./legacy-go-child-exit.error.ts";
 import { LegacyGoProxy } from "./go-proxy.service.ts";
 import { formatGoBinaryNotFoundError, makeGoProxyLayer } from "./go-proxy.layer.ts";
 
@@ -54,12 +55,14 @@ type HoldEvent =
  * event log. Each acquire gets a monotonically increasing id so tests can
  * pair an acquire with its release and distinguish concurrent scopes.
  *
- * `exitBehavior`:
- *   - "never"          → exit() blocks on Effect.never (test manages the fiber)
- *   - "terminateDie"   → exit() dies with a tagged defect so callers can
- *                        observe via Effect.exit without juggling fibers
+ * The layer under test no longer calls `ProcessControl.exit()` itself on a
+ * non-zero exit or an unresolved binary (CLI-1879 routes both through
+ * `LegacyGoChildExitError` instead, so `runCli` can run finalizers before
+ * exiting) — `exit()` here only guards against a future regression that
+ * reintroduces a direct call; it blocks on `Effect.never` since nothing in
+ * this file exercises it.
  */
-function mockProcessControl(opts: { exitBehavior?: "never" | "terminateDie" } = {}) {
+function mockProcessControl() {
   const holdEvents: HoldEvent[] = [];
   const exitCalls: number[] = [];
   let nextHoldId = 0;
@@ -67,11 +70,7 @@ function mockProcessControl(opts: { exitBehavior?: "never" | "terminateDie" } =
   const exit = (code: number) =>
     Effect.sync(() => {
       exitCalls.push(code);
-    }).pipe(
-      Effect.flatMap(() =>
-        opts.exitBehavior === "terminateDie" ? Effect.die("EXIT_CALLED" as const) : Effect.never,
-      ),
-    );
+    }).pipe(Effect.flatMap(() => Effect.never));
 
   return {
     get holdEvents() {
@@ -284,18 +283,52 @@ describe("makeGoProxyLayer", () => {
     }).pipe(Effect.provide(layer));
   });
 
-  it.effect("propagates non-zero exit codes via ProcessControl.exit", () => {
+  it.effect("propagates non-zero exit codes via LegacyGoChildExitError", () => {
     const spawner = mockSpawner({ kind: "success", code: 7 });
-    // Use the terminating exit variant so we can observe via Effect.exit
-    // without juggling forked fibers around Effect.never.
-    const pc = mockProcessControl({ exitBehavior: "terminateDie" });
+    const pc = mockProcessControl();
     const layer = makeGoProxyLayer({ binary: TEST_BINARY }).pipe(
       Layer.provide(Layer.mergeAll(spawner.layer, pc.layer)),
     );
     return Effect.gen(function* () {
       const proxy = yield* LegacyGoProxy;
-      yield* proxy.exec(["some", "command"]).pipe(Effect.exit);
-      expect(pc.exitCalls).toEqual([7]);
+      const exit = yield* proxy.exec(["some", "command"]).pipe(Effect.exit);
+      expect(Exit.isFailure(exit)).toBe(true);
+      if (Exit.isFailure(exit)) {
+        const error = Cause.squash(exit.cause);
+        expect(error).toBeInstanceOf(LegacyGoChildExitError);
+        expect((error as LegacyGoChildExitError).exitCode).toBe(7);
+      }
+      // The layer itself never calls `ProcessControl.exit` — that's now
+      // `runCli`'s job, after finalizers have run.
+      expect(pc.exitCalls).toEqual([]);
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.effect("lets an Effect.ensuring finalizer run after a non-zero exit (CLI-1879)", () => {
+    // The whole point of routing a non-zero exit through `LegacyGoChildExitError`
+    // instead of `ProcessControl.exit()` (a real `process.exit()` in production):
+    // a caller's own `Effect.ensuring` finalizer — e.g. a handler's
+    // `Effect.ensuring(telemetryState.flush)` — must still run. Under the old
+    // `processControl.exit()`-based implementation this finalizer would never fire
+    // (production: the process would already be dead; this mock's `exit()` blocks
+    // forever on `Effect.never`, so the fiber never reaches `Effect.exit` either).
+    const spawner = mockSpawner({ kind: "success", code: 5 });
+    const pc = mockProcessControl();
+    const layer = makeGoProxyLayer({ binary: TEST_BINARY }).pipe(
+      Layer.provide(Layer.mergeAll(spawner.layer, pc.layer)),
+    );
+    let finalizerRan = false;
+    return Effect.gen(function* () {
+      const proxy = yield* LegacyGoProxy;
+      yield* proxy.exec(["some", "command"]).pipe(
+        Effect.ensuring(
+          Effect.sync(() => {
+            finalizerRan = true;
+          }),
+        ),
+        Effect.exit,
+      );
+      expect(finalizerRan).toBe(true);
     }).pipe(Effect.provide(layer));
   });
 
@@ -401,36 +434,75 @@ describe("makeGoProxyLayer", () => {
   // literal string "supabase" when no Go binary was found, which when run from
   // a PATH that contained the shim would fork-bomb the shim against itself
   // (silent multi-minute hang in CI followed by SIGTERM). The layer must now
-  // refuse to spawn anything and surface a specific diagnostic + non-zero exit.
-  it.effect("prints a diagnostic and exits 1 when supabase-go cannot be resolved", () => {
-    const spawner = mockSpawner({ kind: "success", code: 0 });
-    const pc = mockProcessControl({ exitBehavior: "terminateDie" });
-    const stderr = vi.spyOn(process.stderr, "write").mockImplementation(() => true);
-    const tried = [
-      "$SUPABASE_GO_BINARY (unset)",
-      "/usr/local/bin/supabase-go (not found alongside the shim)",
-    ];
-    const layer = makeGoProxyLayer({ binary: { notFound: tried } }).pipe(
-      Layer.provide(Layer.mergeAll(spawner.layer, pc.layer)),
-    );
-    return Effect.gen(function* () {
-      const proxy = yield* LegacyGoProxy;
-      yield* proxy.exec(["db", "start"]).pipe(Effect.exit);
-
-      // Did NOT spawn anything — the whole point is to refuse the fork-bomb.
-      expect(spawner.spawned).toHaveLength(0);
-      // Exited with code 1 via ProcessControl.exit.
-      expect(pc.exitCalls).toEqual([1]);
-      // Wrote the diagnostic to stderr, including each tried location.
-      expect(stderr).toHaveBeenCalledTimes(1);
-      const written = String(stderr.mock.calls[0]![0]);
-      expect(written).toContain("Could not find the `supabase-go` binary");
-      expect(written).toContain("$SUPABASE_GO_BINARY (unset)");
-      expect(written).toContain("/usr/local/bin/supabase-go");
-      expect(written).toContain("SUPABASE_GO_BINARY");
-      stderr.mockRestore();
-    }).pipe(Effect.provide(layer));
-  });
+  // refuse to spawn anything and surface a specific diagnostic + a
+  // `LegacyGoChildExitError` carrying exit code 1.
+  it.effect(
+    "prints a diagnostic and fails with exit code 1 when supabase-go cannot be resolved",
+    () => {
+      const spawner = mockSpawner({ kind: "success", code: 0 });
+      const pc = mockProcessControl();
+      const stderr = vi.spyOn(process.stderr, "write").mockImplementation(() => true);
+      const tried = [
+        "$SUPABASE_GO_BINARY (unset)",
+        "/usr/local/bin/supabase-go (not found alongside the shim)",
+      ];
+      const layer = makeGoProxyLayer({ binary: { notFound: tried } }).pipe(
+        Layer.provide(Layer.mergeAll(spawner.layer, pc.layer)),
+      );
+      return Effect.gen(function* () {
+        const proxy = yield* LegacyGoProxy;
+        const exit = yield* proxy.exec(["db", "start"]).pipe(Effect.exit);
+
+        // Did NOT spawn anything — the whole point is to refuse the fork-bomb.
+        expect(spawner.spawned).toHaveLength(0);
+        // Failed with a LegacyGoChildExitError carrying exit code 1, rather than
+        // calling `ProcessControl.exit` directly — that's now `runCli`'s job.
+        expect(Exit.isFailure(exit)).toBe(true);
+        if (Exit.isFailure(exit)) {
+          const error = Cause.squash(exit.cause);
+          expect(error).toBeInstanceOf(LegacyGoChildExitError);
+          expect((error as LegacyGoChildExitError).exitCode).toBe(1);
+        }
+        expect(pc.exitCalls).toEqual([]);
+        // Wrote the diagnostic to stderr, including each tried location.
+        expect(stderr).toHaveBeenCalledTimes(1);
+        const written = String(stderr.mock.calls[0]![0]);
+        expect(written).toContain("Could not find the `supabase-go` binary");
+        expect(written).toContain("$SUPABASE_GO_BINARY (unset)");
+        expect(written).toContain("/usr/local/bin/supabase-go");
+        expect(written).toContain("SUPABASE_GO_BINARY");
+        stderr.mockRestore();
+      }).pipe(Effect.provide(layer));
+    },
+  );
+
+  it.effect(
+    "execCapture also prints a diagnostic and fails with exit code 1 when supabase-go cannot be resolved",
+    () => {
+      const spawner = mockSpawner({ kind: "success", code: 0 });
+      const pc = mockProcessControl();
+      const stderr = vi.spyOn(process.stderr, "write").mockImplementation(() => true);
+      const tried = ["$SUPABASE_GO_BINARY (unset)"];
+      const layer = makeGoProxyLayer({ binary: { notFound: tried } }).pipe(
+        Layer.provide(Layer.mergeAll(spawner.layer, pc.layer)),
+      );
+      return Effect.gen(function* () {
+        const proxy = yield* LegacyGoProxy;
+        const exit = yield* proxy.execCapture(["db", "dump"]).pipe(Effect.exit);
+
+        expect(spawner.spawned).toHaveLength(0);
+        expect(Exit.isFailure(exit)).toBe(true);
+        if (Exit.isFailure(exit)) {
+          const error = Cause.squash(exit.cause);
+          expect(error).toBeInstanceOf(LegacyGoChildExitError);
+          expect((error as LegacyGoChildExitError).exitCode).toBe(1);
+        }
+        expect(pc.exitCalls).toEqual([]);
+        expect(stderr).toHaveBeenCalledTimes(1);
+        stderr.mockRestore();
+      }).pipe(Effect.provide(layer));
+    },
+  );
 
   it.effect("opens and closes a fresh hold scope per sequential exec call", () => {
     const spawner = mockSpawner({ kind: "success", code: 0 });
diff --git a/apps/cli/src/shared/legacy/go-proxy.service.ts b/apps/cli/src/shared/legacy/go-proxy.service.ts
index e9539e75a4..6ea6a50eb4 100644
--- a/apps/cli/src/shared/legacy/go-proxy.service.ts
+++ b/apps/cli/src/shared/legacy/go-proxy.service.ts
@@ -1,11 +1,15 @@
 import type { Effect } from "effect";
 import { Context } from "effect";
+import type { LegacyGoChildExitError } from "./legacy-go-child-exit.error.ts";
 
 interface LegacyGoProxyShape {
   /**
    * Forward the given args to the Go binary, inheriting stdin/stdout/stderr
-   * and propagating the exit code. On a non-zero exit the process exits with
-   * the same code — callers do not need to handle the failure case.
+   * and propagating the exit code. On a non-zero exit (or when the binary
+   * cannot be resolved at all), fails with `LegacyGoChildExitError` carrying
+   * the child's exact exit code; callers don't need to special-case it — it
+   * flows through the normal Effect failure channel up to `runCli`, which
+   * maps it to the real process exit code after running any finalizers.
    *
    * `opts.cwd` overrides the working directory for this call (falls back to the
    * layer's construction-time cwd). `opts.env` overlays extra environment
@@ -17,13 +21,16 @@ interface LegacyGoProxyShape {
   readonly exec: (
     args: ReadonlyArray<string>,
     opts?: { readonly cwd?: string; readonly env?: Record<string, string> },
-  ) => Effect.Effect<void>;
+  ) => Effect.Effect<void, LegacyGoChildExitError>;
 
   /**
    * Like `exec`, but captures the child's stdout and returns it as a string
    * instead of inheriting stdout. stderr is still inherited (so progress /
-   * diagnostics pass straight through), and a non-zero exit still terminates the
-   * process with the same code.
+   * diagnostics pass straight through). On a non-zero exit (or when the binary
+   * cannot be resolved at all), fails with `LegacyGoChildExitError` carrying
+   * the child's exact exit code; callers don't need to special-case it — it
+   * flows through the normal Effect failure channel up to `runCli`, which
+   * maps it to the real process exit code after running any finalizers.
    *
    * `opts.stdin` controls the child's stdin: `"inherit"` (default) keeps the
    * child interactive (its prompts reach the terminal); `"ignore"` gives it a
@@ -43,7 +50,7 @@ interface LegacyGoProxyShape {
       readonly env?: Record<string, string>;
       readonly stdin?: "inherit" | "ignore";
     },
-  ) => Effect.Effect<string>;
+  ) => Effect.Effect<string, LegacyGoChildExitError>;
 }
 
 export class LegacyGoProxy extends Context.Service<LegacyGoProxy, LegacyGoProxyShape>()(
diff --git a/apps/cli/src/shared/legacy/legacy-go-child-exit.error.ts b/apps/cli/src/shared/legacy/legacy-go-child-exit.error.ts
new file mode 100644
index 0000000000..d2b7f22ef3
--- /dev/null
+++ b/apps/cli/src/shared/legacy/legacy-go-child-exit.error.ts
@@ -0,0 +1,55 @@
+import { Data, Runtime } from "effect";
+
+/**
+ * A spawned `supabase-go` child process — via `LegacyGoProxy.exec`/`execCapture`,
+ * or the hidden `db __db-bootstrap` seam (`legacy-db-bootstrap.seam.layer.ts`) —
+ * exited non-zero, or could not be spawned at all (binary not found).
+ *
+ * Carries the child's exact exit code through Effect's `Runtime.errorExitCode`
+ * marker, so both `runCli` (`shared/cli/run.ts`, text mode) and
+ * `withJsonErrorHandling` (`shared/output/json-error-handling.ts`, `json`/
+ * `stream-json` mode) map the process's own exit code to this EXACT number —
+ * not a generic `1` — and only AFTER every `Effect.ensuring` finalizer between
+ * the call site and there has already run (telemetry flush, command
+ * instrumentation). Calling `ProcessControl.exit()` directly from deep inside a
+ * handler skips those finalizers entirely (`process.exit()` halts the process
+ * before the Effect runtime can unwind the remaining scopes) — this error type
+ * lets the child's status flow through the normal Effect failure channel
+ * instead, all the way up to the single `ProcessControl.exit()` call `runCli`
+ * itself makes once finalizers are done. See CLI-1879.
+ *
+ * `runCli`'s `handledProgram` special-cases this exact class (an `instanceof`
+ * check, not a shared Effect marker) to skip its generic `output.fail` stderr
+ * line in text mode — the child already wrote its own detailed failure (or,
+ * for the not-found case, `LegacyGoProxy`'s own specific diagnostic) to the
+ * parent's inherited stderr, and Go itself never prints a second, generic line
+ * on top of that. This is deliberately NOT keyed on Effect's shared
+ * `[Runtime.errorReported]` marker: `CliError.ShowHelp` also sets that marker
+ * to `false` for an unrelated reason (the CLI framework already rendered
+ * help/usage text), and gating on the marker there would ALSO suppress
+ * `normalizeCause`'s Go-parity rendering for a `MissingOption` wrapped in
+ * `ShowHelp` (e.g. `Error: required flag(s) "type" not set`) — a real parity
+ * regression. `withJsonErrorHandling` has no such collision (it runs upstream
+ * of `runCli`, catching every error uniformly) and still emits the structured
+ * JSON error envelope for this error like any other.
+ *
+ * The envelope's `message` is deliberately generic (`"supabase-go exited with
+ * code N (see stderr for details)"`) rather than the child's specific failure
+ * reason: the child's real detail is on stderr (see above), which a
+ * machine-output consumer reading only stdout won't see — this is an accepted,
+ * TS-only tradeoff (Go itself has no JSON error-envelope concept to match
+ * against here), not a parity gap.
+ *
+ * Invariant: `exitCode` must be a real non-zero child exit status (1-255,
+ * matching `ChildProcessSpawner.ExitCode`'s POSIX range), never `0` — every
+ * construction site guards on `exitCode !== 0` (or hardcodes `1` for the
+ * binary-not-found case) before constructing this error, since a `0` here
+ * would be a failure that both `runCli` and `withJsonErrorHandling` read back
+ * as a *successful* exit.
+ */
+export class LegacyGoChildExitError extends Data.TaggedError("LegacyGoChildExitError")<{
+  readonly exitCode: number;
+  readonly message: string;
+}> {
+  override readonly [Runtime.errorExitCode] = this.exitCode;
+}
diff --git a/apps/cli/src/shared/output/json-error-handling.ts b/apps/cli/src/shared/output/json-error-handling.ts
index 756077692f..2a886e8cf8 100644
--- a/apps/cli/src/shared/output/json-error-handling.ts
+++ b/apps/cli/src/shared/output/json-error-handling.ts
@@ -1,4 +1,4 @@
-import { Effect } from "effect";
+import { Effect, Runtime } from "effect";
 import { Output } from "./output.service.ts";
 import { ProcessControl } from "../runtime/process-control.service.ts";
 import { normalizeCliError } from "./normalize-error.ts";
@@ -13,7 +13,13 @@ export const withJsonErrorHandling = <A, E, R>(
         const processControl = yield* ProcessControl;
         if (output.format === "text") return yield* Effect.fail(error);
         yield* output.fail(normalizeCliError(error));
-        yield* processControl.setExitCode(1);
+        // `Runtime.getErrorExitCode` defaults to 1 for any error without a
+        // `[Runtime.errorExitCode]` marker, so this is a no-op for every existing
+        // error type. It only changes behavior for an error that opts in — e.g.
+        // `LegacyGoChildExitError` (CLI-1879), so a delegated Go child's exact exit
+        // code (not just a generic 1) still reaches the user under json/stream-json,
+        // matching the exit code `runCli`'s text-mode path already propagates.
+        yield* processControl.setExitCode(Runtime.getErrorExitCode(error));
       }),
     ),
   );
diff --git a/apps/cli/src/shared/output/json-error-handling.unit.test.ts b/apps/cli/src/shared/output/json-error-handling.unit.test.ts
index e763b8df19..29e7ec90c8 100644
--- a/apps/cli/src/shared/output/json-error-handling.unit.test.ts
+++ b/apps/cli/src/shared/output/json-error-handling.unit.test.ts
@@ -1,6 +1,7 @@
 import { describe, expect, it } from "@effect/vitest";
 import { Data, Effect, Exit, Layer, Option } from "effect";
 import { mockProcessControl } from "../../../tests/helpers/mocks.ts";
+import { LegacyGoChildExitError } from "../legacy/legacy-go-child-exit.error.ts";
 import { Output } from "./output.service.ts";
 import { withJsonErrorHandling } from "./json-error-handling.ts";
 
@@ -181,5 +182,24 @@ describe("withJsonErrorHandling", () => {
         expect(out.failCalls[0]?.message).toBe("plain error message");
       }).pipe(Effect.provide(out.layer), Effect.provide(processControl.layer));
     });
+
+    // CLI-1879: a delegated Go child's exact exit code must reach the user under
+    // json/stream-json too, not just a generic 1 — matching the exit code
+    // `runCli`'s text-mode path already propagates via the same
+    // `[Runtime.errorExitCode]` marker.
+    it.live("sets the exact exit code for a LegacyGoChildExitError, not a generic 1", () => {
+      const out = mockOutput("json");
+      const processControl = mockProcessControl();
+      return Effect.gen(function* () {
+        const error = new LegacyGoChildExitError({
+          exitCode: 130,
+          message: "supabase-go exited with code 130 (see stderr for details)",
+        });
+        yield* withJsonErrorHandling(Effect.fail(error)).pipe(Effect.provide(out.layer));
+        expect(out.failCalls).toHaveLength(1);
+        expect(out.failCalls[0]?.code).toBe("LegacyGoChildExitError");
+        expect(processControl.exitCode).toBe(130);
+      }).pipe(Effect.provide(out.layer), Effect.provide(processControl.layer));
+    });
   });
 });
diff --git a/apps/cli/src/shared/output/normalize-error.ts b/apps/cli/src/shared/output/normalize-error.ts
index a143b414b3..7d0976dd05 100644
--- a/apps/cli/src/shared/output/normalize-error.ts
+++ b/apps/cli/src/shared/output/normalize-error.ts
@@ -1,4 +1,8 @@
 import { Cause, Option } from "effect";
+import { CliError } from "effect/unstable/cli";
+import { formatInvalidValueMessage } from "../cli/invalid-value-message.ts";
+import type { CliErrorSuggestionContext } from "../cli/subcommand-flag-suggestions.ts";
+import { formatCliErrorsForDisplay } from "../cli/subcommand-flag-suggestions.ts";
 
 type NormalizedCliError = {
   readonly code: string;
@@ -17,7 +21,20 @@ const readString = (value: ErrorRecord, key: string): string | undefined => {
   return typeof field === "string" && field.trim().length > 0 ? field.trim() : undefined;
 };
 
-const mappedError = (error: ErrorRecord): NormalizedCliError | undefined => {
+// Unlike `readString`, does not trim or reject empty strings. Use this for
+// fields that carry raw user input (e.g. `CliError.InvalidValue#value`),
+// where an empty string or meaningful surrounding whitespace is a legitimate
+// value the user typed (`supabase --output-format ''`) and must be preserved
+// and reported verbatim rather than normalized away.
+const readRawString = (value: ErrorRecord, key: string): string | undefined => {
+  const field = value[key];
+  return typeof field === "string" ? field : undefined;
+};
+
+const mappedError = (
+  error: ErrorRecord,
+  context?: CliErrorSuggestionContext,
+): NormalizedCliError | undefined => {
   const tag = readString(error, "_tag");
   switch (tag) {
     case "NoRunningStackError":
@@ -75,6 +92,35 @@ const mappedError = (error: ErrorRecord): NormalizedCliError | undefined => {
           : "Error: required flag(s) not set",
       };
     }
+    case "InvalidValue": {
+      // `CliError.InvalidValue` for a `GlobalFlag.setting` flag (e.g.
+      // `--output-format`, or the legacy `--output`/`-o`, `--dns-resolver`,
+      // `--agent`) never reaches `CliOutput.Formatter` — `Command.runWith`
+      // validates those flags in a step that runs outside the `ShowHelp`
+      // path, so the failure lands here instead. Apply the same
+      // doubled-"Expected"-prefix workaround `subcommand-flag-suggestions.ts`
+      // applies for the `ShowHelp`-formatted case (see CLI-1898), so every
+      // `InvalidValue` failure — whichever path it takes — renders the same
+      // way.
+      const option = readString(error, "option");
+      // Raw read: `value` is the exact argv token the user typed and can
+      // legitimately be `""` or carry surrounding whitespace — `readString`
+      // would trim it or drop it entirely, either masking the bug this case
+      // exists to fix or misreporting what the user actually typed.
+      const value = readRawString(error, "value");
+      const expected = readString(error, "expected");
+      const kind = readString(error, "kind");
+      if (
+        option !== undefined &&
+        value !== undefined &&
+        expected !== undefined &&
+        (kind === "flag" || kind === "argument")
+      ) {
+        const message = formatInvalidValueMessage({ option, value, expected, kind });
+        if (message !== undefined) return { code: tag, message };
+      }
+      return undefined;
+    }
     case "ShowHelp": {
       // Effect CLI wraps parse errors in a ShowHelp envelope (`CliError.ts`)
       // whose `errors` array holds the underlying causes. If exactly one of
@@ -83,21 +129,64 @@ const mappedError = (error: ErrorRecord): NormalizedCliError | undefined => {
       // message — otherwise the user sees a useless top-line above the real
       // problem.
       const errors = error["errors"];
-      if (Array.isArray(errors) && errors.length === 1) {
+      if (!Array.isArray(errors) || errors.length === 0) return undefined;
+
+      if (errors.length === 1) {
         const inner = errors[0];
         if (isErrorRecord(inner)) {
-          const innerMapped = mappedError(inner);
+          const innerMapped = mappedError(inner, context);
           if (innerMapped) return innerMapped;
         }
       }
+
+      // No Go-parity-specific single-error mapping applies (either more than
+      // one simultaneous error, e.g. a child flag placed before its
+      // subcommand — `UnrecognizedOption` plus the `UnknownSubcommand` its
+      // misplaced value gets parsed as — or a lone error with no known
+      // mapping: UnrecognizedOption, DuplicateOption, MissingArgument,
+      // UnknownSubcommand, UserError, or an InvalidValue that doesn't hit
+      // CLI-1898's doubled-"Expected"-prefix bug). Surface every inner
+      // error's own message — reusing the same `formatCliErrorsForDisplay`
+      // the text/json formatters use, so a subcommand-flag hint (e.g. "Hint:
+      // --foo is available on `branches create`. Pass it after the
+      // subcommand") survives — rather than falling through to ShowHelp's
+      // useless "Help requested" envelope message: since CLI-1901 (`run.ts`'s
+      // `withoutParseErrorHelpDump`) stopped the vendored library from also
+      // `Console.error`-ing this same text, this is now the ONLY place any
+      // of it reaches the user, for one error or many.
+      if (errors.every(CliError.isCliError)) {
+        const formatted = formatCliErrorsForDisplay(errors, context);
+        if (formatted.errors.length > 0) {
+          const [only] = formatted.errors;
+          return {
+            code: formatted.errors.length === 1 && only ? only._tag : "ShowHelp",
+            message: formatted.errors.map((formattedError) => formattedError.message).join("\n\n"),
+          };
+        }
+      }
+
+      // Defensive fallback for a single inner value that carries a usable
+      // `_tag`/`message` pair but isn't a real `CliError` instance (e.g. a
+      // hand-rolled test double) — real `ShowHelp.errors` entries always are.
+      if (errors.length === 1) {
+        const inner = errors[0];
+        if (isErrorRecord(inner)) {
+          const code = readString(inner, "_tag");
+          const message = readString(inner, "message");
+          if (code && message) return { code, message };
+        }
+      }
       return undefined;
     }
   }
 };
 
-export function normalizeCliError(error: unknown): NormalizedCliError {
+export function normalizeCliError(
+  error: unknown,
+  context?: CliErrorSuggestionContext,
+): NormalizedCliError {
   if (isErrorRecord(error)) {
-    const mapped = mappedError(error);
+    const mapped = mappedError(error, context);
     if (mapped) {
       return mapped;
     }
@@ -134,9 +223,15 @@ export function normalizeCliError(error: unknown): NormalizedCliError {
   };
 }
 
-export function normalizeCause(cause: Cause.Cause<unknown>): NormalizedCliError {
+export function normalizeCause(
+  cause: Cause.Cause<unknown>,
+  context?: CliErrorSuggestionContext,
+): NormalizedCliError {
   const errorOption = Cause.findErrorOption(cause);
-  return normalizeCliError(Option.getOrElse(errorOption, () => Cause.squash(cause)));
+  return normalizeCliError(
+    Option.getOrElse(errorOption, () => Cause.squash(cause)),
+    context,
+  );
 }
 
 export function formatCliError(error: NormalizedCliError): string {
diff --git a/apps/cli/src/shared/output/normalize-error.unit.test.ts b/apps/cli/src/shared/output/normalize-error.unit.test.ts
index 1eba0f07f6..5f7c122ae3 100644
--- a/apps/cli/src/shared/output/normalize-error.unit.test.ts
+++ b/apps/cli/src/shared/output/normalize-error.unit.test.ts
@@ -1,7 +1,14 @@
 import { describe, expect, test } from "vitest";
 import { Cause } from "effect";
+import { CliError, Command } from "effect/unstable/cli";
+import { legacyBranchesCommand } from "../../legacy/commands/branches/branches.command.ts";
+import { legacyNetworkRestrictionsCommand } from "../../legacy/commands/network-restrictions/network-restrictions.command.ts";
 import { formatCliError, normalizeCause, normalizeCliError } from "./normalize-error.ts";
 
+const testRoot = Command.make("supabase").pipe(
+  Command.withSubcommands([legacyBranchesCommand, legacyNetworkRestrictionsCommand]),
+);
+
 describe("normalizeCliError", () => {
   test("maps NoRunningStackError to a user-facing message", () => {
     const error = {
@@ -50,6 +57,98 @@ describe("normalizeCliError", () => {
     });
   });
 
+  test("InvalidValue collapses the doubled 'Expected: Expected' prefix (e.g. a bad GlobalFlag.setting value)", () => {
+    // Regression test for CLI-1898: `--output-format`/`--dns-resolver`/`--agent`/
+    // legacy `--output` are `GlobalFlag.setting` flags backed by `Flag.choice`.
+    // `Command.runWith` validates their values in a step that runs outside the
+    // `ShowHelp` path, so a bad value never reaches `CliOutput.Formatter` (and
+    // `subcommand-flag-suggestions.ts`'s fix) — it surfaces here instead.
+    const error = new CliError.InvalidValue({
+      option: "output-format",
+      value: "bogus",
+      expected: 'Expected "text" | "json" | "stream-json", got "bogus"',
+      kind: "flag",
+    });
+
+    expect(normalizeCliError(error)).toEqual({
+      code: "InvalidValue",
+      message:
+        'Invalid value for flag --output-format: "bogus". Expected "text" | "json" | "stream-json", got "bogus"',
+    });
+  });
+
+  test("InvalidValue preserves an empty invalid value (e.g. `--output-format ''`)", () => {
+    // Regression test for a Codex review finding on CLI-1898: `value` is raw
+    // user input read straight off argv, so `''` is a legitimate way to
+    // trigger this failure. Reading it through the trim-and-reject-empty
+    // `readString` helper would fail the guard and leak the original
+    // doubled "Expected: Expected" message instead of fixing it.
+    const error = new CliError.InvalidValue({
+      option: "output-format",
+      value: "",
+      expected: 'Expected "text" | "json" | "stream-json", got ""',
+      kind: "flag",
+    });
+
+    expect(normalizeCliError(error)).toEqual({
+      code: "InvalidValue",
+      message:
+        'Invalid value for flag --output-format: "". Expected "text" | "json" | "stream-json", got ""',
+    });
+  });
+
+  test("InvalidValue preserves surrounding whitespace in the invalid value (e.g. `--output-format ' json'`)", () => {
+    // Regression test for the same Codex finding: trimming `value` would
+    // report a different string than what the user actually typed.
+    const error = new CliError.InvalidValue({
+      option: "output-format",
+      value: " json",
+      expected: 'Expected "text" | "json" | "stream-json", got " json"',
+      kind: "flag",
+    });
+
+    expect(normalizeCliError(error)).toEqual({
+      code: "InvalidValue",
+      message:
+        'Invalid value for flag --output-format: " json". Expected "text" | "json" | "stream-json", got " json"',
+    });
+  });
+
+  test("InvalidValue leaves an already-clean 'expected' message untouched", () => {
+    const error = new CliError.InvalidValue({
+      option: "define",
+      value: "bogus",
+      expected: "Invalid key=value format. Expected format: key=value, got: bogus",
+      kind: "flag",
+    });
+
+    expect(normalizeCliError(error)).toEqual({
+      code: "InvalidValue",
+      message:
+        'Invalid value for flag --define: "bogus". Expected: Invalid key=value format. Expected format: key=value, got: bogus',
+    });
+  });
+
+  test("ShowHelp envelope unwraps a single InvalidValue with the same doubled-prefix fix", () => {
+    const error = {
+      _tag: "ShowHelp",
+      commandPath: ["db", "lint"],
+      errors: [
+        new CliError.InvalidValue({
+          option: "level",
+          value: "bogus",
+          expected: 'Expected "warning" | "error", got "bogus"',
+          kind: "flag",
+        }),
+      ],
+    };
+
+    expect(normalizeCliError(error)).toEqual({
+      code: "InvalidValue",
+      message: 'Invalid value for flag --level: "bogus". Expected "warning" | "error", got "bogus"',
+    });
+  });
+
   test("ShowHelp envelope unwraps a single MissingOption to Cobra wording", () => {
     // Effect CLI raises `ShowHelp` containing the parse error in its `errors`
     // array. We unwrap to surface the actionable message instead of "Help requested".
@@ -64,6 +163,178 @@ describe("normalizeCliError", () => {
     });
   });
 
+  // CLI-1901: before this fix, the vendored `effect` CLI library's own
+  // `showHelp()` also printed this same message (via `Console.error`) as a
+  // duplicate of whatever `normalizeCause` rendered here — so a tag with no
+  // Go-parity-specific mapping (e.g. UnrecognizedOption) still had SOME
+  // informative text visible, just twice. Now that CLI-1901's `run.ts` fix
+  // suppresses the library's own duplicate print entirely, this generic
+  // fallback is the ONLY place the message reaches the user — it must not
+  // regress to the useless "Help requested" envelope message.
+  test("ShowHelp envelope unwraps a single UnrecognizedOption to its own message (no Go-parity mapping exists yet)", () => {
+    const error = {
+      _tag: "ShowHelp",
+      commandPath: ["branches"],
+      errors: [
+        new CliError.UnrecognizedOption({
+          option: "--bogus",
+          command: ["branches"],
+          suggestions: [],
+        }),
+      ],
+    };
+    expect(normalizeCliError(error)).toEqual({
+      code: "UnrecognizedOption",
+      message: "Unrecognized flag: --bogus in command branches",
+    });
+  });
+
+  // Regression test for a Codex review finding on CLI-1901: `run.ts`'s
+  // `withoutParseErrorHelpDump` suppresses the vendored library's own
+  // `Console.error` render, which used to be the only place a subcommand-flag
+  // placement hint (`buildSubcommandFlagHint` /
+  // `subcommand-flag-suggestions.ts`) reached the user. When a
+  // `CliErrorSuggestionContext` is supplied, this fallback must reuse
+  // `formatCliErrorsForDisplay` — the same helper the text/json formatters
+  // use — so that hint still survives through the single-render path.
+  test("ShowHelp envelope unwraps a single UnrecognizedOption and preserves its subcommand-flag hint when a suggestion context is supplied", () => {
+    const error = {
+      _tag: "ShowHelp",
+      commandPath: ["branches"],
+      errors: [
+        new CliError.UnrecognizedOption({
+          option: "--persistent",
+          command: ["supabase", "branches"],
+          suggestions: [],
+        }),
+      ],
+    };
+
+    const result = normalizeCliError(error, {
+      rootCommand: testRoot,
+      args: ["branches", "--persistent", "create"],
+    });
+
+    expect(result.code).toBe("UnrecognizedOption");
+    expect(result.message).toContain(
+      "Unrecognized flag: --persistent in command supabase branches",
+    );
+    expect(result.message).toContain(
+      "Hint: --persistent is available on `supabase branches create` and `supabase branches update`. Pass it after the subcommand",
+    );
+  });
+
+  // Regression test for a second Codex review finding on CLI-1901: a child
+  // flag placed before its subcommand, WITH a value (e.g. `network-restrictions
+  // --project-ref <ref> get`), makes Effect raise TWO simultaneous errors —
+  // `UnrecognizedOption` for the flag, plus `UnknownSubcommand` for the
+  // flag's own value being misread as the subcommand name. Before this fix,
+  // `mappedError`'s ShowHelp unwrap only ever looked at `errors.length === 1`,
+  // so a real two-error ShowHelp fell straight through to the generic
+  // "Help requested" envelope message — losing the hint (and the specific
+  // error) entirely now that CLI-1901 also suppresses the vendored library's
+  // own duplicate render for this case.
+  test("ShowHelp envelope unwraps multiple simultaneous errors and preserves the subcommand-flag hint (child flag with a value, before its subcommand)", () => {
+    const error = {
+      _tag: "ShowHelp",
+      commandPath: ["network-restrictions"],
+      errors: [
+        new CliError.UnrecognizedOption({
+          option: "--project-ref",
+          command: ["supabase", "network-restrictions"],
+          suggestions: [],
+        }),
+        new CliError.UnknownSubcommand({
+          subcommand: "jacraenyzrorgjhsdvvf",
+          parent: ["supabase", "network-restrictions"],
+          suggestions: [],
+        }),
+      ],
+    };
+
+    const result = normalizeCliError(error, {
+      rootCommand: testRoot,
+      args: ["network-restrictions", "--project-ref", "jacraenyzrorgjhsdvvf", "get"],
+    });
+
+    expect(result.code).toBe("UnrecognizedOption");
+    expect(result.message).toContain(
+      "Unrecognized flag: --project-ref in command supabase network-restrictions",
+    );
+    expect(result.message).toContain(
+      "Hint: --project-ref is available on `supabase network-restrictions get` and `supabase network-restrictions update`.",
+    );
+    expect(result.message).not.toContain("Help requested");
+  });
+
+  // A genuine, unrelated multi-error case (no shared hint to collapse them
+  // into one) must still surface every error's own message, not just the
+  // first — and must not crash trying to pick a single `code`.
+  test("ShowHelp envelope unwraps multiple unrelated simultaneous errors into a joined message", () => {
+    const error = {
+      _tag: "ShowHelp",
+      commandPath: ["branches"],
+      errors: [
+        new CliError.UnrecognizedOption({
+          option: "--bogus-one",
+          command: ["supabase", "branches"],
+          suggestions: [],
+        }),
+        new CliError.UnrecognizedOption({
+          option: "--bogus-two",
+          command: ["supabase", "branches"],
+          suggestions: [],
+        }),
+      ],
+    };
+
+    const result = normalizeCliError(error, { rootCommand: testRoot, args: ["branches"] });
+
+    expect(result.code).toBe("ShowHelp");
+    expect(result.message).toContain("Unrecognized flag: --bogus-one in command supabase branches");
+    expect(result.message).toContain("Unrecognized flag: --bogus-two in command supabase branches");
+  });
+
+  // The same fallback also covers an InvalidValue that does NOT have the
+  // CLI-1898 doubled-"Expected"-prefix bug (e.g. a custom `Flag.mapTryCatch`
+  // validator like `sso add --domains`, whose `expected` text is already
+  // clean) — `mappedError`'s own InvalidValue case returns `undefined` for
+  // those (nothing to fix), so this generic fallback is what surfaces the
+  // message, not CLI-1898's specific rebuild.
+  test("ShowHelp envelope unwraps a single InvalidValue with an already-clean expected message (not the CLI-1898 doubled-prefix bug)", () => {
+    const error = {
+      _tag: "ShowHelp",
+      commandPath: ["sso", "add"],
+      errors: [
+        new CliError.InvalidValue({
+          option: "domains",
+          value: "unterminated-quote.com",
+          expected: "a comma-separated list (unterminated quote)",
+          kind: "flag",
+        }),
+      ],
+    };
+    expect(normalizeCliError(error)).toEqual({
+      code: "InvalidValue",
+      message:
+        'Invalid value for flag --domains: "unterminated-quote.com". Expected: a comma-separated list (unterminated quote)',
+    });
+  });
+
+  // If the single inner error has a `_tag` but no usable `message` (neither a
+  // string via its own getter nor otherwise), the fallback must not surface a
+  // blank/garbage message — it should fall through to ShowHelp's own generic
+  // handling, same as the pre-existing multiple-errors case below.
+  test("ShowHelp envelope with a single inner error carrying no message falls back to generic", () => {
+    const error = {
+      _tag: "ShowHelp",
+      commandPath: ["branches"],
+      errors: [{ _tag: "SomeUnmappedTag" }],
+    };
+    const result = normalizeCliError(error);
+    expect(result.code).toBe("ShowHelp");
+  });
+
   test("ShowHelp with multiple errors does not unwrap (falls back to generic)", () => {
     const error = {
       _tag: "ShowHelp",
diff --git a/apps/cli/src/shared/output/text-formatter.unit.test.ts b/apps/cli/src/shared/output/text-formatter.unit.test.ts
index f49cf597ea..fff1a4a17b 100644
--- a/apps/cli/src/shared/output/text-formatter.unit.test.ts
+++ b/apps/cli/src/shared/output/text-formatter.unit.test.ts
@@ -53,4 +53,22 @@ describe("textCliOutputFormatter", () => {
     expect(text).toContain("Did you mean this?");
     expect(text).toContain("--plan");
   });
+
+  it("does not double the 'Expected' prefix for an invalid choice flag value", () => {
+    const formatter = textCliOutputFormatter();
+
+    const text = formatter.formatErrors([
+      new CliError.InvalidValue({
+        option: "size",
+        value: "nano",
+        expected: 'Expected "micro" | "small" | "medium", got "nano"',
+        kind: "flag",
+      }),
+    ]);
+
+    expect(text).toContain(
+      'Invalid value for flag --size: "nano". Expected "micro" | "small" | "medium", got "nano"',
+    );
+    expect(text).not.toMatch(/Expected:\s*Expected/);
+  });
 });
diff --git a/apps/cli/src/shared/services/services.shared.ts b/apps/cli/src/shared/services/services.shared.ts
index 05840cb893..4eee5e5ef2 100644
--- a/apps/cli/src/shared/services/services.shared.ts
+++ b/apps/cli/src/shared/services/services.shared.ts
@@ -115,7 +115,7 @@ export function postgresImageForDbMajorVersion(majorVersion: number): string | u
   }
 }
 
-function replaceImageTag(image: string, tag: string): string {
+export function replaceImageTag(image: string, tag: string): string {
   const index = image.lastIndexOf(":");
   if (index === -1) {
     return image;
diff --git a/apps/cli/src/shared/telemetry/analytics.layer.ts b/apps/cli/src/shared/telemetry/analytics.layer.ts
index 66a3a8e685..e25f983d7f 100644
--- a/apps/cli/src/shared/telemetry/analytics.layer.ts
+++ b/apps/cli/src/shared/telemetry/analytics.layer.ts
@@ -1,4 +1,3 @@
-import { PostHog } from "posthog-node";
 import { Effect, Layer, Option } from "effect";
 import type { ProjectLinkStateValue } from "../../next/config/project-link-state.service.ts";
 import { ProjectLinkState } from "../../next/config/project-link-state.service.ts";
@@ -7,6 +6,7 @@ import { aiToolLayer } from "./ai-tool.layer.ts";
 import { CurrentAnalyticsContext, type AnalyticsContext } from "./analytics-context.ts";
 import { Analytics } from "./analytics.service.ts";
 import { AiTool } from "./ai-tool.service.ts";
+import { scopedPosthogClient } from "./posthog-client.ts";
 import { telemetryRuntimeLayer } from "./runtime.layer.ts";
 import { TelemetryRuntime } from "./runtime.service.ts";
 
@@ -59,13 +59,9 @@ export const analyticsLayer = Layer.effect(
       });
     }
 
-    const client = new PostHog(cliConfig.telemetryPosthogKey.value, {
-      host: cliConfig.telemetryPosthogHost,
-      flushAt: 1,
-      flushInterval: 0,
-    });
-    yield* Effect.addFinalizer(() =>
-      Effect.promise(() => client._shutdown(5_000)).pipe(Effect.ignore),
+    const client = yield* scopedPosthogClient(
+      cliConfig.telemetryPosthogKey.value,
+      cliConfig.telemetryPosthogHost,
     );
 
     const baseProperties = stripUndefined({
diff --git a/apps/cli/src/shared/telemetry/posthog-client.e2e.test.ts b/apps/cli/src/shared/telemetry/posthog-client.e2e.test.ts
new file mode 100644
index 0000000000..a8a80cea61
--- /dev/null
+++ b/apps/cli/src/shared/telemetry/posthog-client.e2e.test.ts
@@ -0,0 +1,63 @@
+import { createServer, type Server, type Socket } from "node:net";
+import { afterAll, beforeAll, describe, expect, test } from "vitest";
+import { runSupabase } from "../../../tests/helpers/cli.ts";
+
+// A TCP blackhole: accepts connections and never responds, so telemetry
+// requests connect and then hang until aborted. Asserting on the spawned
+// process's wall-clock exit (not scope or shutdown internals) is deliberate:
+// pending sockets keep the runtime alive, so only actual process exit proves
+// the telemetry exit cap holds end to end.
+describe("telemetry against a blackholed PostHog endpoint", () => {
+  let server: Server;
+  let host: string;
+  let connections = 0;
+  const sockets = new Set<Socket>();
+
+  beforeAll(async () => {
+    server = createServer((socket) => {
+      connections += 1;
+      sockets.add(socket);
+      // Aborted requests reset the connection; without a listener the
+      // server-side ECONNRESET becomes an uncaught exception.
+      socket.on("error", () => {});
+      socket.on("close", () => sockets.delete(socket));
+    });
+    await new Promise<void>((resolve) => server.listen(0, "127.0.0.1", resolve));
+    const address = server.address();
+    if (address === null || typeof address === "string") {
+      throw new Error("Failed to allocate a blackhole port");
+    }
+    host = `http://127.0.0.1:${address.port}`;
+  });
+
+  afterAll(async () => {
+    for (const socket of sockets) socket.destroy();
+    await new Promise<void>((resolve) => server.close(() => resolve()));
+  });
+
+  test("commands exit promptly, cleanly, and quietly", async () => {
+    const startedAt = performance.now();
+    const { stdout, stderr, exitCode } = await runSupabase(["telemetry", "status"], {
+      entrypoint: "legacy",
+      env: {
+        // spawnSupabase disables telemetry for every test by default; this
+        // test exists to exercise it, so turn it back on explicitly.
+        SUPABASE_TELEMETRY_DISABLED: "0",
+        DO_NOT_TRACK: "0",
+        SUPABASE_TELEMETRY_POSTHOG_KEY: "phc_e2e_blackhole_test",
+        SUPABASE_TELEMETRY_POSTHOG_HOST: host,
+      },
+    });
+    const elapsedMs = performance.now() - startedAt;
+
+    expect(exitCode).toBe(0);
+    expect(stdout).toContain("Telemetry is enabled.");
+    expect(stderr).toBe("");
+    // Telemetry must have actually reached the blackhole, otherwise the
+    // timing assertion below passes vacuously with telemetry off.
+    expect(connections).toBeGreaterThanOrEqual(1);
+    // Healthy runs measure ~2.5s (2s drain cap + spawn overhead); the nearest
+    // real failure signature is the SDK's 5s default deadline plus startup.
+    expect(elapsedMs).toBeLessThan(4_500);
+  });
+});
diff --git a/apps/cli/src/shared/telemetry/posthog-client.ts b/apps/cli/src/shared/telemetry/posthog-client.ts
new file mode 100644
index 0000000000..e44f5d2c63
--- /dev/null
+++ b/apps/cli/src/shared/telemetry/posthog-client.ts
@@ -0,0 +1,56 @@
+import { Effect } from "effect";
+import { PostHog, type PostHogOptions } from "posthog-node";
+
+const EXIT_DELAY_CAP_MS = 2_000;
+
+const delivered = {
+  status: 200,
+  text: () => Promise.resolve(""),
+  json: () => Promise.resolve({}),
+};
+
+// posthog-node has no logger hook: delivery failures hit hardcoded
+// console.error calls and multi-second retries, so report them as delivered.
+export const fireAndForgetFetch: NonNullable<PostHogOptions["fetch"]> = async (url, options) => {
+  try {
+    const response = await globalThis.fetch(url, options);
+    return response.status >= 400 ? delivered : response;
+  } catch {
+    return delivered;
+  }
+};
+
+export const scopedPosthogClient = (apiKey: string, host: string) =>
+  Effect.acquireRelease(
+    Effect.sync(() => {
+      const shutdown = new AbortController();
+      const client = new PostHog(apiKey, {
+        host,
+        flushAt: 1,
+        flushInterval: 0,
+        requestTimeout: EXIT_DELAY_CAP_MS,
+        fetch: (url, options) =>
+          fireAndForgetFetch(url, {
+            ...options,
+            signal: options.signal
+              ? AbortSignal.any([options.signal, shutdown.signal])
+              : shutdown.signal,
+          }),
+      });
+      return { client, shutdown };
+    }),
+    ({ client, shutdown }) =>
+      Effect.promise(async () => {
+        try {
+          await client._shutdown(EXIT_DELAY_CAP_MS);
+        } catch {
+          // The deadline rejection must be swallowed: Effect.promise turns
+          // rejections into defects, which would fail the command.
+        } finally {
+          // The shutdown deadline only stops the wait; the SDK's drain keeps
+          // in-flight requests running and starts queued ones after release.
+          // Aborting cancels them so nothing outlives the scope.
+          shutdown.abort();
+        }
+      }),
+  ).pipe(Effect.map(({ client }) => client));
diff --git a/apps/cli/src/shared/telemetry/posthog-client.unit.test.ts b/apps/cli/src/shared/telemetry/posthog-client.unit.test.ts
new file mode 100644
index 0000000000..0f43315014
--- /dev/null
+++ b/apps/cli/src/shared/telemetry/posthog-client.unit.test.ts
@@ -0,0 +1,107 @@
+import { describe, expect, it } from "@effect/vitest";
+import { afterEach, vi } from "vitest";
+import { Effect } from "effect";
+import { PostHog } from "posthog-node";
+import { fireAndForgetFetch, scopedPosthogClient } from "./posthog-client.ts";
+
+const BATCH_URL = "https://eu.i.posthog.com/batch/";
+const BATCH_OPTIONS = { method: "POST" as const, headers: {}, body: "{}" };
+
+describe("fireAndForgetFetch", () => {
+  afterEach(() => {
+    vi.unstubAllGlobals();
+  });
+
+  it("passes successful responses through untouched", async () => {
+    vi.stubGlobal("fetch", async () => new Response(`{"status":1}`, { status: 200 }));
+
+    const response = await fireAndForgetFetch(BATCH_URL, BATCH_OPTIONS);
+
+    expect(response.status).toBe(200);
+    expect(await response.text()).toBe(`{"status":1}`);
+  });
+
+  it("reports success when the network is unreachable", async () => {
+    vi.stubGlobal("fetch", async () => {
+      throw new Error("connect ECONNREFUSED");
+    });
+
+    const response = await fireAndForgetFetch(BATCH_URL, BATCH_OPTIONS);
+
+    expect(response.status).toBe(200);
+    expect(await response.text()).toBe("");
+    expect(await response.json()).toEqual({});
+  });
+
+  it("reports success on error responses so the SDK never retries or logs", async () => {
+    vi.stubGlobal(
+      "fetch",
+      async () => new Response("Proxy Authentication Required", { status: 407 }),
+    );
+
+    const response = await fireAndForgetFetch(BATCH_URL, BATCH_OPTIONS);
+
+    expect(response.status).toBe(200);
+    expect(await response.text()).toBe("");
+  });
+});
+
+describe("scopedPosthogClient", () => {
+  afterEach(() => {
+    vi.unstubAllGlobals();
+  });
+
+  it.live("captures and shuts down cleanly against an unreachable host", () =>
+    Effect.gen(function* () {
+      const client = yield* scopedPosthogClient("phc_test", "http://127.0.0.1:9");
+      expect(client).toBeInstanceOf(PostHog);
+      client.capture({ event: "verify_event", distinctId: "device-1" });
+    }).pipe(Effect.scoped),
+  );
+
+  it.live(
+    "bounds the whole shutdown when a request is in flight and another event is queued",
+    () =>
+      Effect.gen(function* () {
+        let requestStarted = () => {};
+        const firstRequestInFlight = new Promise<void>((resolve) => {
+          requestStarted = resolve;
+        });
+        let activeRequests = 0;
+        vi.stubGlobal(
+          "fetch",
+          (_url: string, options: { signal?: AbortSignal }) =>
+            new Promise<Response>((_resolve, reject) => {
+              activeRequests += 1;
+              requestStarted();
+              const abort = () => {
+                activeRequests -= 1;
+                reject(new DOMException("The operation was aborted.", "AbortError"));
+              };
+              if (options.signal?.aborted) {
+                abort();
+                return;
+              }
+              options.signal?.addEventListener("abort", abort);
+            }),
+        );
+
+        const startedAt = performance.now();
+        yield* Effect.gen(function* () {
+          const client = yield* scopedPosthogClient("phc_test", "https://blackhole.invalid");
+          client.capture({ event: "first_event", distinctId: "device-1" });
+          yield* Effect.promise(() => firstRequestInFlight);
+          client.capture({ event: "second_event", distinctId: "device-1" });
+        }).pipe(Effect.scoped);
+
+        expect(performance.now() - startedAt).toBeLessThan(3_000);
+
+        // The SDK's drain keeps running past the shutdown deadline; without
+        // cancellation it starts the queued request AFTER scope release and
+        // keeps the process alive for that request's own timeout.
+        yield* Effect.promise(() => new Promise((resolve) => setTimeout(resolve, 50)));
+        expect(activeRequests).toBe(0);
+      }),
+    10_000,
+  );
+});
diff --git a/apps/cli/src/shared/telemetry/runtime.layer.unit.test.ts b/apps/cli/src/shared/telemetry/runtime.layer.unit.test.ts
index fbb165b4fa..a81bc3c044 100644
--- a/apps/cli/src/shared/telemetry/runtime.layer.unit.test.ts
+++ b/apps/cli/src/shared/telemetry/runtime.layer.unit.test.ts
@@ -138,4 +138,50 @@ describe("telemetryRuntimeLayer", () => {
       Effect.ensuring(Effect.sync(() => rmSync(homeDir, { recursive: true, force: true }))),
     );
   });
+
+  // CLI-1868 (telemetry enable/disable firing cli_command_executed on pre-toggle
+  // consent) depends on this exact property: `consent` is read from disk once
+  // at layer-construction time and does not reflect a later on-disk write —
+  // mirroring Go's PersistentPreRunE snapshot, which a command's own RunE
+  // (e.g. `telemetry disable`'s SetEnabled) cannot retroactively change.
+  it.live("captures consent once; a later on-disk write does not change it", () => {
+    const homeDir = makeTempDir();
+    const configPath = path.join(homeDir, "telemetry.json");
+    writeFileSync(
+      configPath,
+      JSON.stringify({
+        enabled: true,
+        device_id: "device-123",
+        session_id: "session-123",
+        session_last_active: "2026-04-01T12:00:00Z",
+        schema_version: 1,
+      }),
+    );
+
+    return Effect.gen(function* () {
+      const runtime = yield* TelemetryRuntime;
+      expect(runtime.consent).toBe("granted");
+
+      // Simulates `disable`'s handler rewriting the file mid-command, after
+      // this layer already resolved `consent` — the already-built runtime
+      // must keep reporting the pre-toggle value.
+      yield* Effect.sync(() =>
+        writeFileSync(
+          configPath,
+          JSON.stringify({
+            enabled: false,
+            device_id: "device-123",
+            session_id: "session-123",
+            session_last_active: "2026-04-01T12:00:00Z",
+            schema_version: 1,
+          }),
+        ),
+      );
+
+      expect(runtime.consent).toBe("granted");
+    }).pipe(
+      Effect.provide(buildLayer({ homeDir })),
+      Effect.ensuring(Effect.sync(() => rmSync(homeDir, { recursive: true, force: true }))),
+    );
+  });
 });
diff --git a/apps/cli/src/shared/telemetry/tracing.layer.ts b/apps/cli/src/shared/telemetry/tracing.layer.ts
index f9638cad11..770a2218ee 100644
--- a/apps/cli/src/shared/telemetry/tracing.layer.ts
+++ b/apps/cli/src/shared/telemetry/tracing.layer.ts
@@ -76,6 +76,7 @@ class ExportableSpan implements Tracer.Span {
   }
 
   attribute(key: string, value: unknown): void {
+    if (key.endsWith(".header.apikey")) return;
     this.attributes.set(key, value);
   }
 
diff --git a/apps/cli/src/shared/telemetry/tracing.layer.unit.test.ts b/apps/cli/src/shared/telemetry/tracing.layer.unit.test.ts
index 25b306e041..d6642f8492 100644
--- a/apps/cli/src/shared/telemetry/tracing.layer.unit.test.ts
+++ b/apps/cli/src/shared/telemetry/tracing.layer.unit.test.ts
@@ -242,6 +242,33 @@ describe("tracingLayer – span behaviour", () => {
     );
   });
 
+  it.live("does not write API keys to trace files", () => {
+    const home = makeTempDir();
+    const tracesDir = path.join(home, ".supabase", "traces");
+    const secretKey = `sb_secret_${"a".repeat(40)}`;
+    return Effect.gen(function* () {
+      const tracer = yield* Tracer.Tracer;
+      const span = tracer.span(makeSpanOptions());
+      span.attribute("http.request.header.apikey", secretKey);
+      span.end(BigInt(Date.now() + 100) * 1_000_000n, Exit.void);
+    }).pipe(
+      Effect.provide(buildTracingLayer({ home })),
+      Effect.ensuring(
+        Effect.sync(() => {
+          try {
+            const traceFile = readdirSync(tracesDir).find((file) => file.endsWith(".ndjson"));
+            expect(traceFile).toBeDefined();
+            const trace = readFileSync(path.join(tracesDir, traceFile!), "utf8");
+            expect(trace).not.toContain(secretKey);
+            expect(trace).not.toContain("http.request.header.apikey");
+          } finally {
+            rmSync(home, { recursive: true, force: true });
+          }
+        }),
+      ),
+    );
+  });
+
   it.live("span end does NOT export to NDJSON when SUPABASE_TELEMETRY_DISABLED=1", () => {
     const home = makeTempDir();
     const configDir = path.join(home, ".supabase");
diff --git a/apps/cli/tests/helpers/legacy-mocks.ts b/apps/cli/tests/helpers/legacy-mocks.ts
index 67e864cfaa..e02e241fbb 100644
--- a/apps/cli/tests/helpers/legacy-mocks.ts
+++ b/apps/cli/tests/helpers/legacy-mocks.ts
@@ -4,7 +4,8 @@ import { join } from "node:path";
 
 import { BunServices } from "@effect/platform-bun";
 import { type ApiClient, makeApiClient, type SupabaseApiConfigError } from "@supabase/api/effect";
-import { Effect, Layer, Option, Redacted } from "effect";
+import { Effect, FileSystem, Layer, Option, Redacted } from "effect";
+import { PlatformError, SystemError } from "effect/PlatformError";
 import * as HttpClient from "effect/unstable/http/HttpClient";
 import * as HttpClientError from "effect/unstable/http/HttpClientError";
 import * as HttpClientResponse from "effect/unstable/http/HttpClientResponse";
@@ -348,6 +349,7 @@ export function mockLegacyCliConfig(opts: {
   readonly apiUrl?: string;
   readonly projectHost?: string;
   readonly poolerHost?: string;
+  readonly dashboardUrl?: string;
   readonly accessToken?: Option.Option<Redacted.Redacted<string>>;
   readonly projectId?: Option.Option<string>;
   readonly userAgent?: string;
@@ -357,6 +359,7 @@ export function mockLegacyCliConfig(opts: {
     apiUrl: opts.apiUrl ?? LEGACY_DEFAULT_API_URL,
     projectHost: opts.projectHost ?? "supabase.co",
     poolerHost: opts.poolerHost ?? "supabase.com",
+    dashboardUrl: opts.dashboardUrl ?? "https://supabase.com/dashboard",
     accessToken: opts.accessToken ?? Option.some(Redacted.make(LEGACY_VALID_TOKEN)),
     projectId: opts.projectId ?? Option.some(LEGACY_VALID_REF),
     workdir: opts.workdir,
@@ -640,6 +643,47 @@ export function useLegacyTempWorkdir(prefix = "supabase-legacy-test-"): {
   };
 }
 
+// ---------------------------------------------------------------------------
+// Failing filesystem — wraps the real Bun `FileSystem` and fails the Nth
+// `writeFileString` call with a `PlatformError`, so cleanup-on-failure paths
+// (e.g. the pg-delta multi-file migration writer) can be exercised
+// deterministically. Every other call delegates to the real filesystem, so
+// config reads / earlier writes behave normally. Merge this AFTER
+// `BunServices.layer` (last-wins) so it overrides only `FileSystem`; `Path`
+// still comes from `BunServices`.
+// ---------------------------------------------------------------------------
+
+export function legacyFailWriteStringOnNthCallFsLayer(
+  failOnCall: number,
+): Layer.Layer<FileSystem.FileSystem> {
+  return Layer.effect(
+    FileSystem.FileSystem,
+    Effect.map(FileSystem.FileSystem, (real) => {
+      let calls = 0;
+      return FileSystem.FileSystem.of({
+        ...real,
+        writeFileString: (path, data, options) => {
+          calls += 1;
+          if (calls === failOnCall) {
+            return Effect.fail(
+              new PlatformError(
+                new SystemError({
+                  _tag: "Unknown",
+                  module: "FileSystem",
+                  method: "writeFileString",
+                  pathOrDescriptor: path,
+                  description: "simulated write failure",
+                }),
+              ),
+            );
+          }
+          return real.writeFileString(path, data, options);
+        },
+      });
+    }),
+  ).pipe(Layer.provide(BunServices.layer));
+}
+
 // ---------------------------------------------------------------------------
 // Runtime composition — bundles the entire Layer.mergeAll(...) graph that
 // every native-port integration test re-builds, including the easy-to-mis-wire
diff --git a/apps/docs/next-env.d.ts b/apps/docs/next-env.d.ts
index 9edff1c7ca..ce4e94a6b1 100644
--- a/apps/docs/next-env.d.ts
+++ b/apps/docs/next-env.d.ts
@@ -1,6 +1,7 @@
 /// <reference types="next" />
 /// <reference types="next/image-types/global" />
 import "./.next/types/routes.d.ts";
+import "./.next/types/root-params.d.ts";
 
 // NOTE: This file should not be edited
 // see https://nextjs.org/docs/app/api-reference/config/typescript for more information.
diff --git a/apps/docs/next.config.ts b/apps/docs/next.config.ts
index 8b4e5917ac..f4068ca072 100644
--- a/apps/docs/next.config.ts
+++ b/apps/docs/next.config.ts
@@ -2,6 +2,9 @@ import { createMDX } from "fumadocs-mdx/next";
 import type { NextConfig } from "next";
 
 const config: NextConfig = {
+  experimental: {
+    useTypeScriptCli: true,
+  },
   reactStrictMode: true,
 };
 
diff --git a/apps/docs/package.json b/apps/docs/package.json
index 492c9218e3..6783494b58 100644
--- a/apps/docs/package.json
+++ b/apps/docs/package.json
@@ -8,19 +8,19 @@
     "build": "bun run generate && next build"
   },
   "dependencies": {
-    "fumadocs-core": "^16.10.7",
-    "fumadocs-mdx": "^15.0.13",
-    "fumadocs-ui": "^16.10.7",
-    "next": "^16.2.9",
+    "fumadocs-core": "^16.11.3",
+    "fumadocs-mdx": "^15.1.0",
+    "fumadocs-ui": "^16.11.3",
+    "next": "16.3.0-preview.6",
     "react": "^19.2.7",
     "react-dom": "^19.2.7"
   },
   "devDependencies": {
     "@types/mdx": "^2.0.14",
-    "@types/node": "^26.0.0",
+    "@types/node": "^26.1.0",
     "@types/react": "^19.2.17",
     "@types/react-dom": "^19.1.6",
-    "typescript": "^6.0.3"
+    "typescript": "^7.0.2"
   },
   "nx": {
     "implicitDependencies": [
diff --git a/apps/docs/public/cli/config.schema.json b/apps/docs/public/cli/config.schema.json
index 0503269e77..c3f73abf09 100644
--- a/apps/docs/public/cli/config.schema.json
+++ b/apps/docs/public/cli/config.schema.json
@@ -41,19 +41,10 @@
           "default": 54327
         },
         "backend": {
-          "anyOf": [
-            {
-              "type": "string",
-              "enum": [
-                "postgres"
-              ]
-            },
-            {
-              "type": "string",
-              "enum": [
-                "bigquery"
-              ]
-            }
+          "type": "string",
+          "enum": [
+            "postgres",
+            "bigquery"
           ],
           "description": "Configure one of the supported backends:\n\n- `postgres`\n- `bigquery`",
           "default": "postgres"
@@ -347,31 +338,12 @@
           "default": 6
         },
         "password_requirements": {
-          "anyOf": [
-            {
-              "type": "string",
-              "enum": [
-                ""
-              ]
-            },
-            {
-              "type": "string",
-              "enum": [
-                "letters_digits"
-              ]
-            },
-            {
-              "type": "string",
-              "enum": [
-                "lower_upper_letters_digits"
-              ]
-            },
-            {
-              "type": "string",
-              "enum": [
-                "lower_upper_letters_digits_symbols"
-              ]
-            }
+          "type": "string",
+          "enum": [
+            "",
+            "letters_digits",
+            "lower_upper_letters_digits",
+            "lower_upper_letters_digits_symbols"
           ],
           "description": "Password character requirements.",
           "default": ""
@@ -600,19 +572,10 @@
               "default": false
             },
             "provider": {
-              "anyOf": [
-                {
-                  "type": "string",
-                  "enum": [
-                    "hcaptcha"
-                  ]
-                },
-                {
-                  "type": "string",
-                  "enum": [
-                    "turnstile"
-                  ]
-                }
+              "type": "string",
+              "enum": [
+                "hcaptcha",
+                "turnstile"
               ],
               "description": "CAPTCHA provider to use."
             },
@@ -1019,30 +982,28 @@
               "anyOf": [
                 {
                   "type": "object",
-                  "patternProperties": {
-                    "^(invite|confirmation|recovery|magic_link|email_change|reauthentication)$": {
-                      "anyOf": [
-                        {
-                          "type": "object",
-                          "properties": {
-                            "subject": {
-                              "type": "string",
-                              "description": "Subject line for the email template.",
-                              "default": ""
-                            },
-                            "content_path": {
-                              "type": "string",
-                              "description": "Path to the HTML template.",
-                              "default": ""
-                            }
+                  "additionalProperties": {
+                    "anyOf": [
+                      {
+                        "type": "object",
+                        "properties": {
+                          "subject": {
+                            "type": "string",
+                            "description": "Subject line for the email template.",
+                            "default": ""
                           },
-                          "additionalProperties": false
+                          "content_path": {
+                            "type": "string",
+                            "description": "Path to the HTML template.",
+                            "default": ""
+                          }
                         },
-                        {
-                          "type": "null"
-                        }
-                      ]
-                    }
+                        "additionalProperties": false
+                      },
+                      {
+                        "type": "null"
+                      }
+                    ]
                   },
                   "description": "Custom email template configuration.",
                   "default": {}
@@ -1056,35 +1017,33 @@
               "anyOf": [
                 {
                   "type": "object",
-                  "patternProperties": {
-                    "^(password_changed|email_changed|phone_changed|identity_linked|identity_unlinked|mfa_factor_enrolled|mfa_factor_unenrolled)$": {
-                      "anyOf": [
-                        {
-                          "type": "object",
-                          "properties": {
-                            "enabled": {
-                              "type": "boolean",
-                              "description": "Enable the notification email.",
-                              "default": false
-                            },
-                            "subject": {
-                              "type": "string",
-                              "description": "Subject line for the notification email.",
-                              "default": ""
-                            },
-                            "content_path": {
-                              "type": "string",
-                              "description": "Path to the HTML notification template.",
-                              "default": ""
-                            }
+                  "additionalProperties": {
+                    "anyOf": [
+                      {
+                        "type": "object",
+                        "properties": {
+                          "enabled": {
+                            "type": "boolean",
+                            "description": "Enable the notification email.",
+                            "default": false
                           },
-                          "additionalProperties": false
+                          "subject": {
+                            "type": "string",
+                            "description": "Subject line for the notification email.",
+                            "default": ""
+                          },
+                          "content_path": {
+                            "type": "string",
+                            "description": "Path to the HTML notification template.",
+                            "default": ""
+                          }
                         },
-                        {
-                          "type": "null"
-                        }
-                      ]
-                    }
+                        "additionalProperties": false
+                      },
+                      {
+                        "type": "null"
+                      }
+                    ]
                   },
                   "description": "Notification email configuration.",
                   "default": {}
@@ -1893,7 +1852,7 @@
               },
               "additionalProperties": false
             },
-            "slack": {
+            "slack_oidc": {
               "type": "object",
               "properties": {
                 "enabled": {
@@ -1910,7 +1869,7 @@
                   "type": "string",
                   "description": "Client secret for the Slack OAuth provider.\n\nDO NOT commit your OAuth provider secret to git. Use environment variable substitution instead.",
                   "examples": [
-                    "env(SUPABASE_AUTH_EXTERNAL_SLACK_SECRET)"
+                    "env(SUPABASE_AUTH_EXTERNAL_SLACK_OIDC_SECRET)"
                   ]
                 },
                 "url": {
@@ -2334,19 +2293,10 @@
               "default": 54329
             },
             "pool_mode": {
-              "anyOf": [
-                {
-                  "type": "string",
-                  "enum": [
-                    "transaction"
-                  ]
-                },
-                {
-                  "type": "string",
-                  "enum": [
-                    "session"
-                  ]
-                }
+              "type": "string",
+              "enum": [
+                "transaction",
+                "session"
               ],
               "description": "Specifies when a server connection can be reused by other clients.",
               "default": "transaction"
@@ -2675,25 +2625,11 @@
               ]
             },
             "session_replication_role": {
-              "anyOf": [
-                {
-                  "type": "string",
-                  "enum": [
-                    "origin"
-                  ]
-                },
-                {
-                  "type": "string",
-                  "enum": [
-                    "replica"
-                  ]
-                },
-                {
-                  "type": "string",
-                  "enum": [
-                    "local"
-                  ]
-                }
+              "type": "string",
+              "enum": [
+                "origin",
+                "replica",
+                "local"
               ],
               "description": "Session replication role."
             },
@@ -2783,19 +2719,10 @@
           "default": true
         },
         "policy": {
-          "anyOf": [
-            {
-              "type": "string",
-              "enum": [
-                "oneshot"
-              ]
-            },
-            {
-              "type": "string",
-              "enum": [
-                "per_worker"
-              ]
-            }
+          "type": "string",
+          "enum": [
+            "oneshot",
+            "per_worker"
           ],
           "description": "Configure the supported request policy.",
           "default": "per_worker"
@@ -2903,6 +2830,22 @@
                       },
                       "description": "Static files to bundle with the function.",
                       "default": []
+                    },
+                    "env": {
+                      "type": "object",
+                      "patternProperties": {
+                        "^[A-Z_][A-Z0-9_]*$": {
+                          "type": "string",
+                          "allOf": [
+                            {
+                              "pattern": "^env\\((.*)\\)$",
+                              "description": "Reference to a project environment variable available to the Function."
+                            }
+                          ]
+                        }
+                      },
+                      "description": "Environment variables from the project environment that this Function can access.",
+                      "default": {}
                     }
                   },
                   "additionalProperties": false
@@ -3028,19 +2971,10 @@
           "default": true
         },
         "ip_version": {
-          "anyOf": [
-            {
-              "type": "string",
-              "enum": [
-                "IPv4"
-              ]
-            },
-            {
-              "type": "string",
-              "enum": [
-                "IPv6"
-              ]
-            }
+          "type": "string",
+          "enum": [
+            "IPv4",
+            "IPv6"
           ],
           "description": "Bind realtime via either IPv4 or IPv6.",
           "default": "IPv4"
@@ -3084,12 +3018,35 @@
           "default": true
         },
         "file_size_limit": {
-          "type": "string",
-          "description": "The maximum file size allowed.",
-          "default": "50MiB",
-          "examples": [
-            "5MB",
-            "500KB"
+          "anyOf": [
+            {
+              "type": "string"
+            },
+            {
+              "anyOf": [
+                {
+                  "type": "number"
+                },
+                {
+                  "type": "string",
+                  "enum": [
+                    "NaN"
+                  ]
+                },
+                {
+                  "type": "string",
+                  "enum": [
+                    "Infinity"
+                  ]
+                },
+                {
+                  "type": "string",
+                  "enum": [
+                    "-Infinity"
+                  ]
+                }
+              ]
+            }
           ]
         },
         "image_transformation": {
@@ -3116,12 +3073,35 @@
                     "default": false
                   },
                   "file_size_limit": {
-                    "type": "string",
-                    "description": "The maximum file size allowed for the bucket.",
-                    "default": "50MiB",
-                    "examples": [
-                      "5MB",
-                      "500KB"
+                    "anyOf": [
+                      {
+                        "type": "string"
+                      },
+                      {
+                        "anyOf": [
+                          {
+                            "type": "number"
+                          },
+                          {
+                            "type": "string",
+                            "enum": [
+                              "NaN"
+                            ]
+                          },
+                          {
+                            "type": "string",
+                            "enum": [
+                              "Infinity"
+                            ]
+                          },
+                          {
+                            "type": "string",
+                            "enum": [
+                              "-Infinity"
+                            ]
+                          }
+                        ]
+                      }
                     ]
                   },
                   "allowed_mime_types": {
@@ -3286,7 +3266,7 @@
             "enabled": {
               "type": "boolean",
               "description": "Enable vector buckets.",
-              "default": false
+              "default": true
             },
             "max_buckets": {
               "anyOf": [
@@ -3586,19 +3566,10 @@
                         "default": 54327
                       },
                       "backend": {
-                        "anyOf": [
-                          {
-                            "type": "string",
-                            "enum": [
-                              "postgres"
-                            ]
-                          },
-                          {
-                            "type": "string",
-                            "enum": [
-                              "bigquery"
-                            ]
-                          }
+                        "type": "string",
+                        "enum": [
+                          "postgres",
+                          "bigquery"
                         ],
                         "description": "Configure one of the supported backends:\n\n- `postgres`\n- `bigquery`",
                         "default": "postgres"
@@ -3892,31 +3863,12 @@
                         "default": 6
                       },
                       "password_requirements": {
-                        "anyOf": [
-                          {
-                            "type": "string",
-                            "enum": [
-                              ""
-                            ]
-                          },
-                          {
-                            "type": "string",
-                            "enum": [
-                              "letters_digits"
-                            ]
-                          },
-                          {
-                            "type": "string",
-                            "enum": [
-                              "lower_upper_letters_digits"
-                            ]
-                          },
-                          {
-                            "type": "string",
-                            "enum": [
-                              "lower_upper_letters_digits_symbols"
-                            ]
-                          }
+                        "type": "string",
+                        "enum": [
+                          "",
+                          "letters_digits",
+                          "lower_upper_letters_digits",
+                          "lower_upper_letters_digits_symbols"
                         ],
                         "description": "Password character requirements.",
                         "default": ""
@@ -4145,19 +4097,10 @@
                             "default": false
                           },
                           "provider": {
-                            "anyOf": [
-                              {
-                                "type": "string",
-                                "enum": [
-                                  "hcaptcha"
-                                ]
-                              },
-                              {
-                                "type": "string",
-                                "enum": [
-                                  "turnstile"
-                                ]
-                              }
+                            "type": "string",
+                            "enum": [
+                              "hcaptcha",
+                              "turnstile"
                             ],
                             "description": "CAPTCHA provider to use."
                           },
@@ -4564,30 +4507,28 @@
                             "anyOf": [
                               {
                                 "type": "object",
-                                "patternProperties": {
-                                  "^(invite|confirmation|recovery|magic_link|email_change|reauthentication)$": {
-                                    "anyOf": [
-                                      {
-                                        "type": "object",
-                                        "properties": {
-                                          "subject": {
-                                            "type": "string",
-                                            "description": "Subject line for the email template.",
-                                            "default": ""
-                                          },
-                                          "content_path": {
-                                            "type": "string",
-                                            "description": "Path to the HTML template.",
-                                            "default": ""
-                                          }
+                                "additionalProperties": {
+                                  "anyOf": [
+                                    {
+                                      "type": "object",
+                                      "properties": {
+                                        "subject": {
+                                          "type": "string",
+                                          "description": "Subject line for the email template.",
+                                          "default": ""
                                         },
-                                        "additionalProperties": false
+                                        "content_path": {
+                                          "type": "string",
+                                          "description": "Path to the HTML template.",
+                                          "default": ""
+                                        }
                                       },
-                                      {
-                                        "type": "null"
-                                      }
-                                    ]
-                                  }
+                                      "additionalProperties": false
+                                    },
+                                    {
+                                      "type": "null"
+                                    }
+                                  ]
                                 },
                                 "description": "Custom email template configuration.",
                                 "default": {}
@@ -4601,35 +4542,33 @@
                             "anyOf": [
                               {
                                 "type": "object",
-                                "patternProperties": {
-                                  "^(password_changed|email_changed|phone_changed|identity_linked|identity_unlinked|mfa_factor_enrolled|mfa_factor_unenrolled)$": {
-                                    "anyOf": [
-                                      {
-                                        "type": "object",
-                                        "properties": {
-                                          "enabled": {
-                                            "type": "boolean",
-                                            "description": "Enable the notification email.",
-                                            "default": false
-                                          },
-                                          "subject": {
-                                            "type": "string",
-                                            "description": "Subject line for the notification email.",
-                                            "default": ""
-                                          },
-                                          "content_path": {
-                                            "type": "string",
-                                            "description": "Path to the HTML notification template.",
-                                            "default": ""
-                                          }
+                                "additionalProperties": {
+                                  "anyOf": [
+                                    {
+                                      "type": "object",
+                                      "properties": {
+                                        "enabled": {
+                                          "type": "boolean",
+                                          "description": "Enable the notification email.",
+                                          "default": false
                                         },
-                                        "additionalProperties": false
+                                        "subject": {
+                                          "type": "string",
+                                          "description": "Subject line for the notification email.",
+                                          "default": ""
+                                        },
+                                        "content_path": {
+                                          "type": "string",
+                                          "description": "Path to the HTML notification template.",
+                                          "default": ""
+                                        }
                                       },
-                                      {
-                                        "type": "null"
-                                      }
-                                    ]
-                                  }
+                                      "additionalProperties": false
+                                    },
+                                    {
+                                      "type": "null"
+                                    }
+                                  ]
                                 },
                                 "description": "Notification email configuration.",
                                 "default": {}
@@ -5438,7 +5377,7 @@
                             },
                             "additionalProperties": false
                           },
-                          "slack": {
+                          "slack_oidc": {
                             "type": "object",
                             "properties": {
                               "enabled": {
@@ -5455,7 +5394,7 @@
                                 "type": "string",
                                 "description": "Client secret for the Slack OAuth provider.\n\nDO NOT commit your OAuth provider secret to git. Use environment variable substitution instead.",
                                 "examples": [
-                                  "env(SUPABASE_AUTH_EXTERNAL_SLACK_SECRET)"
+                                  "env(SUPABASE_AUTH_EXTERNAL_SLACK_OIDC_SECRET)"
                                 ]
                               },
                               "url": {
@@ -5879,19 +5818,10 @@
                             "default": 54329
                           },
                           "pool_mode": {
-                            "anyOf": [
-                              {
-                                "type": "string",
-                                "enum": [
-                                  "transaction"
-                                ]
-                              },
-                              {
-                                "type": "string",
-                                "enum": [
-                                  "session"
-                                ]
-                              }
+                            "type": "string",
+                            "enum": [
+                              "transaction",
+                              "session"
                             ],
                             "description": "Specifies when a server connection can be reused by other clients.",
                             "default": "transaction"
@@ -6220,25 +6150,11 @@
                             ]
                           },
                           "session_replication_role": {
-                            "anyOf": [
-                              {
-                                "type": "string",
-                                "enum": [
-                                  "origin"
-                                ]
-                              },
-                              {
-                                "type": "string",
-                                "enum": [
-                                  "replica"
-                                ]
-                              },
-                              {
-                                "type": "string",
-                                "enum": [
-                                  "local"
-                                ]
-                              }
+                            "type": "string",
+                            "enum": [
+                              "origin",
+                              "replica",
+                              "local"
                             ],
                             "description": "Session replication role."
                           },
@@ -6328,19 +6244,10 @@
                         "default": true
                       },
                       "policy": {
-                        "anyOf": [
-                          {
-                            "type": "string",
-                            "enum": [
-                              "oneshot"
-                            ]
-                          },
-                          {
-                            "type": "string",
-                            "enum": [
-                              "per_worker"
-                            ]
-                          }
+                        "type": "string",
+                        "enum": [
+                          "oneshot",
+                          "per_worker"
                         ],
                         "description": "Configure the supported request policy.",
                         "default": "per_worker"
@@ -6448,6 +6355,22 @@
                                     },
                                     "description": "Static files to bundle with the function.",
                                     "default": []
+                                  },
+                                  "env": {
+                                    "type": "object",
+                                    "patternProperties": {
+                                      "^[A-Z_][A-Z0-9_]*$": {
+                                        "type": "string",
+                                        "allOf": [
+                                          {
+                                            "pattern": "^env\\((.*)\\)$",
+                                            "description": "Reference to a project environment variable available to the Function."
+                                          }
+                                        ]
+                                      }
+                                    },
+                                    "description": "Environment variables from the project environment that this Function can access.",
+                                    "default": {}
                                   }
                                 },
                                 "additionalProperties": false
@@ -6573,19 +6496,10 @@
                         "default": true
                       },
                       "ip_version": {
-                        "anyOf": [
-                          {
-                            "type": "string",
-                            "enum": [
-                              "IPv4"
-                            ]
-                          },
-                          {
-                            "type": "string",
-                            "enum": [
-                              "IPv6"
-                            ]
-                          }
+                        "type": "string",
+                        "enum": [
+                          "IPv4",
+                          "IPv6"
                         ],
                         "description": "Bind realtime via either IPv4 or IPv6.",
                         "default": "IPv4"
@@ -6629,12 +6543,35 @@
                         "default": true
                       },
                       "file_size_limit": {
-                        "type": "string",
-                        "description": "The maximum file size allowed.",
-                        "default": "50MiB",
-                        "examples": [
-                          "5MB",
-                          "500KB"
+                        "anyOf": [
+                          {
+                            "type": "string"
+                          },
+                          {
+                            "anyOf": [
+                              {
+                                "type": "number"
+                              },
+                              {
+                                "type": "string",
+                                "enum": [
+                                  "NaN"
+                                ]
+                              },
+                              {
+                                "type": "string",
+                                "enum": [
+                                  "Infinity"
+                                ]
+                              },
+                              {
+                                "type": "string",
+                                "enum": [
+                                  "-Infinity"
+                                ]
+                              }
+                            ]
+                          }
                         ]
                       },
                       "image_transformation": {
@@ -6661,12 +6598,35 @@
                                   "default": false
                                 },
                                 "file_size_limit": {
-                                  "type": "string",
-                                  "description": "The maximum file size allowed for the bucket.",
-                                  "default": "50MiB",
-                                  "examples": [
-                                    "5MB",
-                                    "500KB"
+                                  "anyOf": [
+                                    {
+                                      "type": "string"
+                                    },
+                                    {
+                                      "anyOf": [
+                                        {
+                                          "type": "number"
+                                        },
+                                        {
+                                          "type": "string",
+                                          "enum": [
+                                            "NaN"
+                                          ]
+                                        },
+                                        {
+                                          "type": "string",
+                                          "enum": [
+                                            "Infinity"
+                                          ]
+                                        },
+                                        {
+                                          "type": "string",
+                                          "enum": [
+                                            "-Infinity"
+                                          ]
+                                        }
+                                      ]
+                                    }
                                   ]
                                 },
                                 "allowed_mime_types": {
@@ -6831,7 +6791,7 @@
                           "enabled": {
                             "type": "boolean",
                             "description": "Enable vector buckets.",
-                            "default": false
+                            "default": true
                           },
                           "max_buckets": {
                             "anyOf": [
diff --git a/docs/nx-inference-plugins.md b/docs/nx-inference-plugins.md
index d6fafd719d..c408031d9a 100644
--- a/docs/nx-inference-plugins.md
+++ b/docs/nx-inference-plugins.md
@@ -164,4 +164,6 @@ export const createNodesV2: CreateNodesV2 = [
 
 ## How TypeScript plugins are loaded
 
-Nx 22 loads `.ts` plugin files by registering `@swc-node/register` as a CommonJS transpiler before calling `require()` on the plugin path. This workspace has `@swc-node/register` and `@swc/core` installed at the root, along with a minimal `tsconfig.json` at the workspace root — both are required for Nx to find and activate the transpiler. Without either, Nx falls back to Node.js's native TypeScript type-stripping, which returns a non-extensible ES module namespace that Nx cannot annotate.
+Nx loads `.ts` plugin files by registering `@swc-node/register` as a CommonJS transpiler before calling `require()` on the plugin path. This workspace has `@swc-node/register` and `@swc/core` installed at the root, along with a minimal `tsconfig.json` at the workspace root — both are required for Nx to find and activate the transpiler. Without either, Nx falls back to Node.js's native TypeScript type-stripping, which returns a non-extensible ES module namespace that Nx cannot annotate.
+
+TypeScript 7 does not yet expose the programmatic compiler API that the Nx transpiler uses. Following the [Nx TypeScript 7 guide](https://nx.dev/docs/technologies/typescript/guides/typescript-7), the root package aliases `typescript` to `@typescript/typescript6` for API consumers and installs TypeScript 7 as `@typescript/native`, which provides the `tsc` executable.
diff --git a/package.json b/package.json
index d835f5b2c4..4ac9174815 100644
--- a/package.json
+++ b/package.json
@@ -22,8 +22,10 @@
   "devDependencies": {
     "@swc-node/register": "catalog:",
     "@swc/core": "catalog:",
+    "@typescript/native": "npm:typescript@^7.0.2",
     "nx": "catalog:",
     "pkg-pr-new": "0.0.75",
+    "typescript": "npm:@typescript/typescript6@^6.0.2",
     "verdaccio": "^6.7.4"
   }
 }
diff --git a/packages/api/package.json b/packages/api/package.json
index 463c09af39..8e60e45359 100644
--- a/packages/api/package.json
+++ b/packages/api/package.json
@@ -23,7 +23,7 @@
     "@effect/platform-bun": "catalog:",
     "@effect/platform-node": "catalog:",
     "effect": "catalog:",
-    "undici": "^8.5.0"
+    "undici": "^8.7.0"
   },
   "devDependencies": {
     "@tsconfig/bun": "catalog:",
diff --git a/packages/api/src/generated/contracts.ts b/packages/api/src/generated/contracts.ts
index ce1f153aa9..d694679387 100644
--- a/packages/api/src/generated/contracts.ts
+++ b/packages/api/src/generated/contracts.ts
@@ -419,7 +419,7 @@ export const V1BulkCreateSecretsInput = Schema.Struct({
         .check(Schema.isPattern(new RegExp("^(?!SUPABASE_).*"))),
       value: Schema.String.check(Schema.isMaxLength(24576)),
     }),
-  ),
+  ).check(Schema.isMaxLength(100)),
 });
 export const V1BulkDeleteSecretsInput = Schema.Struct({
   ref: Schema.String.check(Schema.isMinLength(20))
@@ -2421,7 +2421,11 @@ export const V1GetJitAccessConfigOutput = Schema.Union(
     }),
     Schema.Struct({
       state: Schema.Literal("unavailable"),
-      unavailableReason: Schema.Literals(["postgres_upgrade_required", "temporarily_unavailable"]),
+      unavailableReason: Schema.Literals([
+        "postgres_upgrade_required",
+        "ssl_enforcement_required",
+        "temporarily_unavailable",
+      ]),
     }),
   ],
   { mode: "oneOf" },
@@ -2657,7 +2661,11 @@ export const V1GetPgsodiumConfigInput = Schema.Struct({
     .check(Schema.isMaxLength(20))
     .check(Schema.isPattern(new RegExp("^[a-z]+$"))),
 });
-export const V1GetPgsodiumConfigOutput = Schema.Struct({ root_key: Schema.String });
+export const V1GetPgsodiumConfigOutput = Schema.Struct({
+  root_key: Schema.String.annotate({
+    description: "The pgsodium root key: 32 bytes, hex-encoded (64 characters).",
+  }),
+});
 export const V1GetPoolerConfigInput = Schema.Struct({
   ref: Schema.String.check(Schema.isMinLength(20))
     .check(Schema.isMaxLength(20))
@@ -2703,6 +2711,11 @@ export const V1GetPostgresConfigOutput = Schema.Struct({
       .check(Schema.isGreaterThanOrEqualTo(10))
       .check(Schema.isLessThanOrEqualTo(2147483640)),
   ),
+  max_logical_replication_workers: Schema.optionalKey(
+    Schema.Number.check(Schema.isInt())
+      .check(Schema.isGreaterThanOrEqualTo(0))
+      .check(Schema.isLessThanOrEqualTo(262143)),
+  ),
   max_parallel_maintenance_workers: Schema.optionalKey(
     Schema.Number.check(Schema.isInt())
       .check(Schema.isGreaterThanOrEqualTo(0))
@@ -2722,6 +2735,11 @@ export const V1GetPostgresConfigOutput = Schema.Struct({
   max_slot_wal_keep_size: Schema.optionalKey(Schema.String),
   max_standby_archive_delay: Schema.optionalKey(Schema.String),
   max_standby_streaming_delay: Schema.optionalKey(Schema.String),
+  max_sync_workers_per_subscription: Schema.optionalKey(
+    Schema.Number.check(Schema.isInt())
+      .check(Schema.isGreaterThanOrEqualTo(0))
+      .check(Schema.isLessThanOrEqualTo(262143)),
+  ),
   max_wal_size: Schema.optionalKey(Schema.String),
   max_wal_senders: Schema.optionalKey(Schema.Number.check(Schema.isInt())),
   max_worker_processes: Schema.optionalKey(
@@ -4344,6 +4362,12 @@ export const V1RunAQueryInput = Schema.Struct({
   parameters: Schema.optionalKey(Schema.Array(Schema.Json)),
   read_only: Schema.optionalKey(Schema.Boolean),
 });
+export const V1ScrapeProjectMetricsInput = Schema.Struct({
+  ref: Schema.String.check(Schema.isMinLength(20))
+    .check(Schema.isMaxLength(20))
+    .check(Schema.isPattern(new RegExp("^[a-z]+$"))),
+});
+export const V1ScrapeProjectMetricsOutput = Schema.String;
 export const V1SetupAReadReplicaInput = Schema.Struct({
   ref: Schema.String.check(Schema.isMinLength(20))
     .check(Schema.isMaxLength(20))
@@ -5549,7 +5573,11 @@ export const V1UpdateJitAccessConfigOutput = Schema.Union(
     }),
     Schema.Struct({
       state: Schema.Literal("unavailable"),
-      unavailableReason: Schema.Literals(["postgres_upgrade_required", "temporarily_unavailable"]),
+      unavailableReason: Schema.Literals([
+        "postgres_upgrade_required",
+        "ssl_enforcement_required",
+        "temporarily_unavailable",
+      ]),
     }),
   ],
   { mode: "oneOf" },
@@ -5587,9 +5615,15 @@ export const V1UpdatePgsodiumConfigInput = Schema.Struct({
   ref: Schema.String.check(Schema.isMinLength(20))
     .check(Schema.isMaxLength(20))
     .check(Schema.isPattern(new RegExp("^[a-z]+$"))),
-  root_key: Schema.String,
+  root_key: Schema.String.annotate({
+    description: "The pgsodium root key: 32 bytes, hex-encoded (64 characters).",
+  }),
+});
+export const V1UpdatePgsodiumConfigOutput = Schema.Struct({
+  root_key: Schema.String.annotate({
+    description: "The pgsodium root key: 32 bytes, hex-encoded (64 characters).",
+  }),
 });
-export const V1UpdatePgsodiumConfigOutput = Schema.Struct({ root_key: Schema.String });
 export const V1UpdatePoolerConfigInput = Schema.Struct({
   ref: Schema.String.check(Schema.isMinLength(20))
     .check(Schema.isMaxLength(20))
@@ -5649,6 +5683,11 @@ export const V1UpdatePostgresConfigInput = Schema.Struct({
       .check(Schema.isGreaterThanOrEqualTo(10))
       .check(Schema.isLessThanOrEqualTo(2147483640)),
   ),
+  max_logical_replication_workers: Schema.optionalKey(
+    Schema.Number.check(Schema.isInt())
+      .check(Schema.isGreaterThanOrEqualTo(0))
+      .check(Schema.isLessThanOrEqualTo(262143)),
+  ),
   max_parallel_maintenance_workers: Schema.optionalKey(
     Schema.Number.check(Schema.isInt())
       .check(Schema.isGreaterThanOrEqualTo(0))
@@ -5668,6 +5707,11 @@ export const V1UpdatePostgresConfigInput = Schema.Struct({
   max_slot_wal_keep_size: Schema.optionalKey(Schema.String),
   max_standby_archive_delay: Schema.optionalKey(Schema.String),
   max_standby_streaming_delay: Schema.optionalKey(Schema.String),
+  max_sync_workers_per_subscription: Schema.optionalKey(
+    Schema.Number.check(Schema.isInt())
+      .check(Schema.isGreaterThanOrEqualTo(0))
+      .check(Schema.isLessThanOrEqualTo(262143)),
+  ),
   max_wal_size: Schema.optionalKey(Schema.String),
   max_wal_senders: Schema.optionalKey(Schema.Number.check(Schema.isInt())),
   max_worker_processes: Schema.optionalKey(
@@ -5732,6 +5776,11 @@ export const V1UpdatePostgresConfigOutput = Schema.Struct({
       .check(Schema.isGreaterThanOrEqualTo(10))
       .check(Schema.isLessThanOrEqualTo(2147483640)),
   ),
+  max_logical_replication_workers: Schema.optionalKey(
+    Schema.Number.check(Schema.isInt())
+      .check(Schema.isGreaterThanOrEqualTo(0))
+      .check(Schema.isLessThanOrEqualTo(262143)),
+  ),
   max_parallel_maintenance_workers: Schema.optionalKey(
     Schema.Number.check(Schema.isInt())
       .check(Schema.isGreaterThanOrEqualTo(0))
@@ -5751,6 +5800,11 @@ export const V1UpdatePostgresConfigOutput = Schema.Struct({
   max_slot_wal_keep_size: Schema.optionalKey(Schema.String),
   max_standby_archive_delay: Schema.optionalKey(Schema.String),
   max_standby_streaming_delay: Schema.optionalKey(Schema.String),
+  max_sync_workers_per_subscription: Schema.optionalKey(
+    Schema.Number.check(Schema.isInt())
+      .check(Schema.isGreaterThanOrEqualTo(0))
+      .check(Schema.isLessThanOrEqualTo(262143)),
+  ),
   max_wal_size: Schema.optionalKey(Schema.String),
   max_wal_senders: Schema.optionalKey(Schema.Number.check(Schema.isInt())),
   max_worker_processes: Schema.optionalKey(
@@ -6252,6 +6306,7 @@ export const openApiOperationIdMap = {
   "v1-revoke-token": "v1RevokeToken",
   "v1-rollback-migrations": "v1RollbackMigrations",
   "v1-run-a-query": "v1RunAQuery",
+  "v1-scrape-project-metrics": "v1ScrapeProjectMetrics",
   "v1-setup-a-read-replica": "v1SetupAReadReplica",
   "v1-shutdown-realtime": "v1ShutdownRealtime",
   "v1-undo": "v1Undo",
@@ -8246,6 +8301,20 @@ export const operationDefinitions = {
     inputSchema: V1RunAQueryInput,
     outputSchema: V1RunAQueryOutput,
   },
+  v1ScrapeProjectMetrics: {
+    id: "v1ScrapeProjectMetrics",
+    description:
+      "Prometheus scrape endpoint. Returns metrics of a customer project in the Prometheus open exposition format.",
+    method: "GET",
+    path: "/v1/projects/{ref}/analytics/endpoints/metrics",
+    pathParams: ["ref"],
+    queryParams: [],
+    headerParams: [],
+    requestBody: { kind: "none" },
+    response: { kind: "text" },
+    inputSchema: V1ScrapeProjectMetricsInput,
+    outputSchema: V1ScrapeProjectMetricsOutput,
+  },
   v1SetupAReadReplica: {
     id: "v1SetupAReadReplica",
     description: "[Beta] Set up a read replica",
@@ -8773,6 +8842,7 @@ export const operationDefinitions = {
         "track_activity_query_size",
         "max_connections",
         "max_locks_per_transaction",
+        "max_logical_replication_workers",
         "max_parallel_maintenance_workers",
         "max_parallel_workers",
         "max_parallel_workers_per_gather",
@@ -8780,6 +8850,7 @@ export const operationDefinitions = {
         "max_slot_wal_keep_size",
         "max_standby_archive_delay",
         "max_standby_streaming_delay",
+        "max_sync_workers_per_subscription",
         "max_wal_size",
         "max_wal_senders",
         "max_worker_processes",
diff --git a/packages/api/src/generated/effect-client.ts b/packages/api/src/generated/effect-client.ts
index 43648171dd..f8651d8acf 100644
--- a/packages/api/src/generated/effect-client.ts
+++ b/packages/api/src/generated/effect-client.ts
@@ -1936,6 +1936,20 @@ export const versionedEffectOperations = {
         const client = yield* SupabaseApiClient;
         return yield* client.execute<"v1RunAQuery">(operationDefinitions.v1RunAQuery, input);
       }),
+    scrapeProjectMetrics: (
+      input: typeof operationDefinitions.v1ScrapeProjectMetrics.inputSchema.Type,
+    ): Effect.Effect<
+      typeof operationDefinitions.v1ScrapeProjectMetrics.outputSchema.Type,
+      SupabaseApiError,
+      SupabaseApiClient
+    > =>
+      Effect.gen(function* () {
+        const client = yield* SupabaseApiClient;
+        return yield* client.execute<"v1ScrapeProjectMetrics">(
+          operationDefinitions.v1ScrapeProjectMetrics,
+          input,
+        );
+      }),
     setupAReadReplica: (
       input: typeof operationDefinitions.v1SetupAReadReplica.inputSchema.Type,
     ): Effect.Effect<
@@ -2901,6 +2915,10 @@ export function executeApiClientOperation(
       return Schema.decodeUnknownEffect(operationDefinitions.v1RunAQuery.inputSchema)(input).pipe(
         Effect.flatMap((decoded) => api.v1.runAQuery(decoded)),
       );
+    case "v1ScrapeProjectMetrics":
+      return Schema.decodeUnknownEffect(operationDefinitions.v1ScrapeProjectMetrics.inputSchema)(
+        input,
+      ).pipe(Effect.flatMap((decoded) => api.v1.scrapeProjectMetrics(decoded)));
     case "v1SetupAReadReplica":
       return Schema.decodeUnknownEffect(operationDefinitions.v1SetupAReadReplica.inputSchema)(
         input,
diff --git a/packages/api/src/generated/openapi.json b/packages/api/src/generated/openapi.json
index 0cc0c762a7..3ae234fd03 100644
--- a/packages/api/src/generated/openapi.json
+++ b/packages/api/src/generated/openapi.json
@@ -4273,7 +4273,14 @@
             }
           },
           "400": {
-            "description": "This feature requires the Pro, Team, or Enterprise organization plan."
+            "description": "This feature requires the Pro, Team, or Enterprise organization plan.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/PlanGateErrorBody"
+                }
+              }
+            }
           },
           "401": {
             "description": "Unauthorized"
@@ -4406,7 +4413,14 @@
             }
           },
           "400": {
-            "description": "This feature requires the Pro, Team, or Enterprise organization plan."
+            "description": "This feature requires the Pro, Team, or Enterprise organization plan.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/PlanGateErrorBody"
+                }
+              }
+            }
           },
           "401": {
             "description": "Unauthorized"
@@ -4486,7 +4500,14 @@
             }
           },
           "400": {
-            "description": "This feature requires the Pro, Team, or Enterprise organization plan."
+            "description": "This feature requires the Pro, Team, or Enterprise organization plan.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/PlanGateErrorBody"
+                }
+              }
+            }
           },
           "401": {
             "description": "Unauthorized"
@@ -4884,7 +4905,14 @@
             "description": "Unauthorized"
           },
           "402": {
-            "description": "This feature requires the Pro, Team, or Enterprise organization plan."
+            "description": "This feature requires the Pro, Team, or Enterprise organization plan.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/PlanGateErrorBody"
+                }
+              }
+            }
           },
           "403": {
             "description": "Forbidden action"
@@ -7049,6 +7077,74 @@
         "x-endpoint-owners": ["analytics"]
       }
     },
+    "/v1/projects/{ref}/analytics/endpoints/metrics": {
+      "get": {
+        "description": "Prometheus scrape endpoint. Returns metrics of a customer project in the Prometheus open exposition format.",
+        "operationId": "v1-scrape-project-metrics",
+        "parameters": [
+          {
+            "name": "ref",
+            "required": true,
+            "in": "path",
+            "description": "Project ref",
+            "schema": {
+              "minLength": 20,
+              "maxLength": 20,
+              "pattern": "^[a-z]+$",
+              "example": "abcdefghijklmnopqrst",
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Prometheus / OpenMetrics text exposition",
+            "content": {
+              "text/plain": {
+                "schema": {
+                  "type": "string"
+                }
+              },
+              "application/openmetrics-text": {
+                "schema": {
+                  "type": "string"
+                }
+              }
+            }
+          },
+          "401": {
+            "description": "Unauthorized"
+          },
+          "403": {
+            "description": "Forbidden action"
+          },
+          "429": {
+            "description": "Rate limit exceeded"
+          },
+          "500": {
+            "description": "Failed to fetch project's metrics"
+          }
+        },
+        "security": [
+          {
+            "bearer": []
+          },
+          {
+            "fga_permissions": ["analytics_logs_read"]
+          }
+        ],
+        "summary": "Scrape a project's metrics",
+        "tags": ["Analytics"],
+        "x-badges": [
+          {
+            "name": "OAuth scope: analytics:read",
+            "position": "after"
+          }
+        ],
+        "x-endpoint-owners": ["analytics"],
+        "x-oauth-scope": "analytics:read"
+      }
+    },
     "/v1/projects/{ref}/cli/login-role": {
       "post": {
         "operationId": "v1-create-login-role",
@@ -10829,7 +10925,14 @@
             "description": "Unauthorized"
           },
           "402": {
-            "description": "This feature requires the Enterprise organization plan."
+            "description": "This feature requires the Enterprise organization plan.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/PlanGateErrorBody"
+                }
+              }
+            }
           },
           "403": {
             "description": "Forbidden action"
@@ -10914,7 +11017,14 @@
             "description": "Unauthorized"
           },
           "402": {
-            "description": "This feature requires the Enterprise organization plan."
+            "description": "This feature requires the Enterprise organization plan.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/PlanGateErrorBody"
+                }
+              }
+            }
           },
           "403": {
             "description": "Forbidden action"
@@ -13018,7 +13128,11 @@
               },
               "unavailableReason": {
                 "type": "string",
-                "enum": ["postgres_upgrade_required", "temporarily_unavailable"]
+                "enum": [
+                  "postgres_upgrade_required",
+                  "ssl_enforcement_required",
+                  "temporarily_unavailable"
+                ]
               }
             },
             "required": ["state", "unavailableReason"]
@@ -13299,21 +13413,26 @@
         "type": "object",
         "properties": {
           "root_key": {
-            "type": "string"
+            "type": "string",
+            "description": "The pgsodium root key: 32 bytes, hex-encoded (64 characters)."
           }
         },
-        "required": ["root_key"]
+        "required": ["root_key"],
+        "example": {
+          "root_key": "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
+        }
       },
       "UpdatePgsodiumConfigBody": {
         "type": "object",
         "properties": {
           "root_key": {
-            "type": "string"
+            "type": "string",
+            "description": "The pgsodium root key: 32 bytes, hex-encoded (64 characters)."
           }
         },
         "required": ["root_key"],
         "example": {
-          "root_key": "MDEyMzQ1Njc4OWFiY2RlZjAxMjM0NTY3ODlhYmNkZWY="
+          "root_key": "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
         }
       },
       "PostgrestConfigWithJWTSecretResponse": {
@@ -13474,6 +13593,7 @@
           },
           "required": ["name", "value"]
         },
+        "maxItems": 100,
         "example": [
           {
             "name": "OPENAI_API_KEY",
@@ -13553,6 +13673,36 @@
         },
         "required": ["status"]
       },
+      "PlanGateErrorBody": {
+        "type": "object",
+        "properties": {
+          "message": {
+            "type": "string",
+            "description": "Human-readable explanation of the plan gate"
+          },
+          "error": {
+            "type": "object",
+            "properties": {
+              "code": {
+                "type": "string",
+                "enum": ["entitlement_required"],
+                "description": "Machine-readable marker for plan-gated denials"
+              },
+              "feature": {
+                "type": "string",
+                "description": "Entitlement feature key that failed the check"
+              },
+              "upgrade_url": {
+                "type": "string",
+                "description": "Billing page URL for the organization, present when the org is resolvable"
+              }
+            },
+            "required": ["code", "feature"],
+            "description": "Present on entitlement denials. Other errors with this status code (validation, billing state) carry only message."
+          }
+        },
+        "required": ["message"]
+      },
       "VanitySubdomainBody": {
         "type": "object",
         "properties": {
@@ -19015,6 +19165,11 @@
             "minimum": 10,
             "maximum": 2147483640
           },
+          "max_logical_replication_workers": {
+            "type": "integer",
+            "minimum": 0,
+            "maximum": 262143
+          },
           "max_parallel_maintenance_workers": {
             "type": "integer",
             "minimum": 0,
@@ -19042,6 +19197,11 @@
           "max_standby_streaming_delay": {
             "type": "string"
           },
+          "max_sync_workers_per_subscription": {
+            "type": "integer",
+            "minimum": 0,
+            "maximum": 262143
+          },
           "max_wal_size": {
             "type": "string"
           },
@@ -19151,6 +19311,11 @@
             "minimum": 10,
             "maximum": 2147483640
           },
+          "max_logical_replication_workers": {
+            "type": "integer",
+            "minimum": 0,
+            "maximum": 262143
+          },
           "max_parallel_maintenance_workers": {
             "type": "integer",
             "minimum": 0,
@@ -19178,6 +19343,11 @@
           "max_standby_streaming_delay": {
             "type": "string"
           },
+          "max_sync_workers_per_subscription": {
+            "type": "integer",
+            "minimum": 0,
+            "maximum": 262143
+          },
           "max_wal_size": {
             "type": "string"
           },
diff --git a/packages/cli-test-helpers/src/normalize.ts b/packages/cli-test-helpers/src/normalize.ts
index fb9ac28687..ec0d3e7815 100644
--- a/packages/cli-test-helpers/src/normalize.ts
+++ b/packages/cli-test-helpers/src/normalize.ts
@@ -148,6 +148,19 @@ export function normalize(output: string, options: NormalizeOptions = {}): strin
       )
       .replace(/^Digest: sha256:[0-9a-f]+\n?/gm, "")
       .replace(/^Status: (?:Downloaded newer image for|Image is up to date for)[^\n]*\n?/gm, "")
+      // 17d. Postgres connection-error detail. Go wraps pgconn's driver error
+      //      (`failed to connect to \`host=… user=… database=…\`: dial error … connection
+      //      refused` locally, `server error (FATAL: … SQLSTATE …)` from the pooler) while
+      //      the ts-legacy port surfaces the @effect/sql error (`effect/sql/SqlError:
+      //      PgClient: Failed to connect`). Both share the `failed to connect to postgres: `
+      //      prefix (the port reproduces Go's wrapper verbatim); only the driver-specific
+      //      suffix differs, which is a connection-layer implementation detail rather than
+      //      command behavior. Canonicalize the suffix so connection-refused parity
+      //      (e.g. `db push --local`/`--dry-run`) compares equal on both sides.
+      .replace(
+        /failed to connect to postgres: .*/g,
+        "failed to connect to postgres: <CONNECTION_ERROR>",
+      )
       // 18. Trailing whitespace on each line
       .replace(/[ \t]+$/gm, "")
       // 19. Collapse 3+ consecutive blank lines to two newlines
diff --git a/packages/cli-test-helpers/src/normalize.unit.test.ts b/packages/cli-test-helpers/src/normalize.unit.test.ts
index c80c4bb641..1ccd8895b2 100644
--- a/packages/cli-test-helpers/src/normalize.unit.test.ts
+++ b/packages/cli-test-helpers/src/normalize.unit.test.ts
@@ -230,4 +230,25 @@ describe("normalize", () => {
     const tsLegacy = `Dumping schemas from local database...\n${tail}`;
     expect(normalize(go)).toBe(normalize(tsLegacy));
   });
+
+  it("canonicalizes the postgres connection-error suffix (pgconn vs @effect/sql)", () => {
+    // Reproduces the `db push --local` / `--dry-run` parity divergence: Go wraps
+    // pgconn's driver detail while the ts-legacy port surfaces the @effect/sql
+    // SqlError. Both share the `failed to connect to postgres: ` prefix, so after
+    // normalization the connection-refused stderr compares equal on both sides.
+    const goLocal =
+      "Connecting to local database...\nfailed to connect to postgres: failed to connect to `host=127.0.0.1 user=postgres database=postgres`: dial error (dial tcp 127.0.0.1:54322: connect: connection refused)";
+    const goPooler =
+      "Connecting to remote database...\nfailed to connect to postgres: failed to connect to `host=aws-0-eu-central-1.pooler.supabase.com user=postgres.aaaaaaaaaaaaaaaaaaaa database=postgres`: server error (FATAL: (ENOTFOUND) tenant/user postgres.aaaaaaaaaaaaaaaaaaaa not found (SQLSTATE XX000))";
+    const tsLegacy =
+      "failed to connect to postgres: effect/sql/SqlError: PgClient: Failed to connect";
+
+    expect(normalize(goLocal)).toBe(
+      "Connecting to local database...\nfailed to connect to postgres: <CONNECTION_ERROR>",
+    );
+    expect(normalize(goPooler)).toBe(
+      "Connecting to remote database...\nfailed to connect to postgres: <CONNECTION_ERROR>",
+    );
+    expect(normalize(tsLegacy)).toBe("failed to connect to postgres: <CONNECTION_ERROR>");
+  });
 });
diff --git a/packages/cli-test-helpers/src/parity.ts b/packages/cli-test-helpers/src/parity.ts
index 9b0aae97c1..a52401f85f 100644
--- a/packages/cli-test-helpers/src/parity.ts
+++ b/packages/cli-test-helpers/src/parity.ts
@@ -214,6 +214,24 @@ function snapshotChangedFiles(dir: string): FileRecord[] {
 // RunResult collection
 // ---------------------------------------------------------------------------
 
+/**
+ * Docker Engine API calls carry two client-negotiation artifacts that reflect
+ * nothing about CLI behavior: an `HEAD /_ping` handshake the real `docker` CLI
+ * issues before every subprocess invocation (Go's SDK pings once per command
+ * via a persistent client; ts-legacy shells out to `docker` per operation, so
+ * it pings once per operation), and a negotiated API version segment in the
+ * URL path (`/v1.51/...` vs `/v1.53/...`) that reflects the installed docker
+ * CLI/daemon version, not anything the command controls. Strip both so parity
+ * comparisons reflect actual Docker operations (list, stop, prune, inspect,
+ * with their filters) rather than client plumbing. Mirrors the equivalent
+ * normalization in `apps/cli-e2e/src/server/placeholder.ts`'s
+ * `normalizeUrlPath`, applied here to the request-log comparison instead of
+ * fixture matching.
+ */
+function normalizeDockerRequestPath(pathname: string): string {
+  return pathname.replace(/\/v1\.\d+(\/|$)/g, "/__DOCKER_VERSION__$1");
+}
+
 async function fetchRequestLog(apiUrl: string): Promise<RequestRecord[]> {
   const res = await fetch(`${apiUrl}/_ctrl/requests`);
   const raw = (await res.json()) as Array<{
@@ -222,12 +240,14 @@ async function fetchRequestLog(apiUrl: string): Promise<RequestRecord[]> {
     query: Record<string, string>;
     body: unknown;
   }>;
-  return raw.map(({ method, pathname, query, body }) => ({
-    method,
-    pathname,
-    query,
-    body,
-  }));
+  return raw
+    .filter(({ method, pathname }) => !(method === "HEAD" && pathname === "/_ping"))
+    .map(({ method, pathname, query, body }) => ({
+      method,
+      pathname: normalizeDockerRequestPath(pathname),
+      query,
+      body,
+    }));
 }
 
 async function collectRunResult(
diff --git a/packages/config/src/auth/email.ts b/packages/config/src/auth/email.ts
index 536282874b..4b17fb0a6f 100644
--- a/packages/config/src/auth/email.ts
+++ b/packages/config/src/auth/email.ts
@@ -25,16 +25,19 @@ const defaultNotificationEnabled = false;
 const defaultSubject = "";
 const defaultContentPath = "";
 
-const templateNamePattern = new RegExp(
-  "^(invite|confirmation|recovery|magic_link|email_change|reauthentication)$",
-);
-
-const notificationNamePattern = new RegExp(
-  "^(password_changed|email_changed|phone_changed|identity_linked|identity_unlinked|mfa_factor_enrolled|mfa_factor_unenrolled)$",
-);
-
-const templateName = Schema.String.check(Schema.isPattern(templateNamePattern));
-const notificationName = Schema.String.check(Schema.isPattern(notificationNamePattern));
+/**
+ * Go's `Auth.Email.Template`/`Notification` are genuine `map[string]emailTemplate`/
+ * `map[string]notification` (`apps/cli-go/pkg/config/auth.go:247-248`) — open maps with no key
+ * restriction at all; `(e *email) validate(fsys)` (`pkg/config/config.go:1293-1313`) iterates
+ * every entry regardless of name. The known template/notification names below are the ones the
+ * Studio/docs UI and `config push`'s Management API sync recognise, but an unrecognized key like
+ * `[auth.email.template.custom]` is still a legitimate config shape Go accepts — it's simply
+ * never synced anywhere, same as an unmodeled `auth.external` provider. Record keys therefore
+ * accept any string, matching Go; only decode failures on a KNOWN/matching name would be a
+ * Go-parity bug.
+ */
+const templateName = Schema.String;
+const notificationName = Schema.String;
 
 function requiredWhenEnabled<
   T extends Record<string, string | number | boolean | undefined> & { enabled: boolean },
diff --git a/packages/config/src/auth/providers.ts b/packages/config/src/auth/providers.ts
index fcb059220d..4e7691d117 100644
--- a/packages/config/src/auth/providers.ts
+++ b/packages/config/src/auth/providers.ts
@@ -118,6 +118,15 @@ const provider = (providerConfig: {
 
 const defaultExternal = {};
 
+/**
+ * Go's deprecated `linkedin`/`slack` provider ids (`pkg/config/config.go:1418-
+ * 1423`) are intentionally NOT modeled here — only their `_oidc` replacements
+ * (`linkedin_oidc`, `slack_oidc`) are, matching Go's `(e external) validate()`,
+ * which unconditionally deletes the deprecated keys before anything decodes
+ * them. `io.ts`'s `normalizeDeprecatedExternalProviders` strips a config's
+ * `linkedin`/`slack` table (warning on stderr when it was `enabled`, same as
+ * Go) before this schema ever sees it.
+ */
 export const external = Schema.Struct({
   apple: provider({
     id: "apple",
@@ -185,8 +194,8 @@ export const external = Schema.Struct({
     id: "x",
     name: "X",
   }),
-  slack: provider({
-    id: "slack",
+  slack_oidc: provider({
+    id: "slack_oidc",
     name: "Slack",
   }),
   spotify: provider({
diff --git a/packages/config/src/auth/sms.ts b/packages/config/src/auth/sms.ts
index 3f7b781f80..05b1570139 100644
--- a/packages/config/src/auth/sms.ts
+++ b/packages/config/src/auth/sms.ts
@@ -32,19 +32,114 @@ const defaultTextlocalEnabled = false;
 const defaultVonage = {};
 const defaultVonageEnabled = false;
 
-function requiredWhenEnabled<
-  T extends Record<string, string | number | boolean | undefined> & { enabled: boolean },
->(path: string, predicate: (value: T) => boolean, message: string) {
-  return Schema.makeFilter((value: T) => {
-    if (!value.enabled || predicate(value)) {
-      return undefined;
-    }
+interface SmsProviderSwitchInput {
+  readonly twilio: {
+    readonly enabled: boolean;
+    readonly account_sid: string;
+    readonly message_service_sid: string;
+    readonly auth_token?: string;
+  };
+  readonly twilio_verify: {
+    readonly enabled: boolean;
+    readonly account_sid?: string;
+    readonly message_service_sid?: string;
+    readonly auth_token?: string;
+  };
+  readonly messagebird: {
+    readonly enabled: boolean;
+    readonly originator?: string;
+    readonly access_key?: string;
+  };
+  readonly textlocal: {
+    readonly enabled: boolean;
+    readonly sender?: string;
+    readonly api_key?: string;
+  };
+  readonly vonage: {
+    readonly enabled: boolean;
+    readonly from?: string;
+    readonly api_key?: string;
+    readonly api_secret?: string;
+  };
+}
+
+function missing(provider: string, field: string) {
+  return {
+    path: [provider, field],
+    issue: `Missing required field in config: auth.sms.${provider}.${field}`,
+  };
+}
 
-    return {
-      path: [path],
-      issue: message,
-    };
-  });
+/**
+ * Go's `(s *sms) validate()` (`apps/cli-go/pkg/config/config.go:1348-1410`): a boolean `switch`
+ * that inspects providers in a FIXED priority order — twilio, twilio_verify, messagebird,
+ * textlocal, vonage — and validates ONLY the first one whose `enabled` is true, matching Go's
+ * `switch` short-circuit semantics. A later enabled-but-incomplete provider is never even looked
+ * at. This replaces five independent per-provider `requiredWhenEnabled` checks (one per provider
+ * sub-struct) that used to validate EVERY enabled provider table regardless of priority — a real
+ * Go-parity gap, since a stale secondary `[auth.sms.*]` block Go silently ignores could make this
+ * schema reject a config Go accepts. `s.EnableSignup`'s own switch case (`config.go:1408-1410`, a
+ * WARN-only "no SMS provider enabled" notice with no throwing equivalent) isn't reproduced here,
+ * matching this package's established precedent of not porting WARN-only branches (e.g. the
+ * `auth.captcha.secret`/`assertEnvLoaded` case).
+ */
+function validateSmsProviderSwitch(value: SmsProviderSwitchInput) {
+  if (value.twilio.enabled) {
+    if (value.twilio.account_sid === "") return missing("twilio", "account_sid");
+    if (value.twilio.message_service_sid === "") {
+      return missing("twilio", "message_service_sid");
+    }
+    if (value.twilio.auth_token === undefined || value.twilio.auth_token === "") {
+      return missing("twilio", "auth_token");
+    }
+    return undefined;
+  }
+  if (value.twilio_verify.enabled) {
+    if (value.twilio_verify.account_sid === undefined || value.twilio_verify.account_sid === "") {
+      return missing("twilio_verify", "account_sid");
+    }
+    if (
+      value.twilio_verify.message_service_sid === undefined ||
+      value.twilio_verify.message_service_sid === ""
+    ) {
+      return missing("twilio_verify", "message_service_sid");
+    }
+    if (value.twilio_verify.auth_token === undefined || value.twilio_verify.auth_token === "") {
+      return missing("twilio_verify", "auth_token");
+    }
+    return undefined;
+  }
+  if (value.messagebird.enabled) {
+    if (value.messagebird.originator === undefined || value.messagebird.originator === "") {
+      return missing("messagebird", "originator");
+    }
+    if (value.messagebird.access_key === undefined || value.messagebird.access_key === "") {
+      return missing("messagebird", "access_key");
+    }
+    return undefined;
+  }
+  if (value.textlocal.enabled) {
+    if (value.textlocal.sender === undefined || value.textlocal.sender === "") {
+      return missing("textlocal", "sender");
+    }
+    if (value.textlocal.api_key === undefined || value.textlocal.api_key === "") {
+      return missing("textlocal", "api_key");
+    }
+    return undefined;
+  }
+  if (value.vonage.enabled) {
+    if (value.vonage.from === undefined || value.vonage.from === "") {
+      return missing("vonage", "from");
+    }
+    if (value.vonage.api_key === undefined || value.vonage.api_key === "") {
+      return missing("vonage", "api_key");
+    }
+    if (value.vonage.api_secret === undefined || value.vonage.api_secret === "") {
+      return missing("vonage", "api_secret");
+    }
+    return undefined;
+  }
+  return undefined;
 }
 
 export const sms = Schema.Struct({
@@ -100,25 +195,7 @@ export const sms = Schema.Struct({
         links: [links.phoneLogin("Twilio")],
       }),
     ),
-  })
-    .check(
-      requiredWhenEnabled(
-        "account_sid",
-        (value) => value.account_sid !== "",
-        "Missing required field in config: auth.sms.twilio.account_sid",
-      ),
-      requiredWhenEnabled(
-        "message_service_sid",
-        (value) => value.message_service_sid !== "",
-        "Missing required field in config: auth.sms.twilio.message_service_sid",
-      ),
-      requiredWhenEnabled(
-        "auth_token",
-        (value) => value.auth_token !== undefined && value.auth_token !== "",
-        "Missing required field in config: auth.sms.twilio.auth_token",
-      ),
-    )
-    .pipe(Schema.withDecodingDefaultKey(Effect.succeed({ ...defaultTwilio }))),
+  }).pipe(Schema.withDecodingDefaultKey(Effect.succeed({ ...defaultTwilio }))),
   twilio_verify: Schema.Struct({
     enabled: Schema.Boolean.annotate({
       default: defaultTwilioVerifyEnabled,
@@ -147,25 +224,7 @@ export const sms = Schema.Struct({
         links: [links.phoneLogin("Twilio")],
       }),
     ),
-  })
-    .check(
-      requiredWhenEnabled(
-        "account_sid",
-        (value) => value.account_sid !== undefined && value.account_sid !== "",
-        "Missing required field in config: auth.sms.twilio_verify.account_sid",
-      ),
-      requiredWhenEnabled(
-        "message_service_sid",
-        (value) => value.message_service_sid !== undefined && value.message_service_sid !== "",
-        "Missing required field in config: auth.sms.twilio_verify.message_service_sid",
-      ),
-      requiredWhenEnabled(
-        "auth_token",
-        (value) => value.auth_token !== undefined && value.auth_token !== "",
-        "Missing required field in config: auth.sms.twilio_verify.auth_token",
-      ),
-    )
-    .pipe(Schema.withDecodingDefaultKey(Effect.succeed({ ...defaultTwilioVerify }))),
+  }).pipe(Schema.withDecodingDefaultKey(Effect.succeed({ ...defaultTwilioVerify }))),
   messagebird: Schema.Struct({
     enabled: Schema.Boolean.annotate({
       default: defaultMessagebirdEnabled,
@@ -187,20 +246,7 @@ export const sms = Schema.Struct({
         links: [links.phoneLogin("MessageBird")],
       }),
     ),
-  })
-    .check(
-      requiredWhenEnabled(
-        "originator",
-        (value) => value.originator !== undefined && value.originator !== "",
-        "Missing required field in config: auth.sms.messagebird.originator",
-      ),
-      requiredWhenEnabled(
-        "access_key",
-        (value) => value.access_key !== undefined && value.access_key !== "",
-        "Missing required field in config: auth.sms.messagebird.access_key",
-      ),
-    )
-    .pipe(Schema.withDecodingDefaultKey(Effect.succeed({ ...defaultMessagebird }))),
+  }).pipe(Schema.withDecodingDefaultKey(Effect.succeed({ ...defaultMessagebird }))),
   textlocal: Schema.Struct({
     enabled: Schema.Boolean.annotate({
       default: defaultTextlocalEnabled,
@@ -222,20 +268,7 @@ export const sms = Schema.Struct({
         links: [links.phoneLogin("Textlocal%2520(Community%2520Supported)")],
       }),
     ),
-  })
-    .check(
-      requiredWhenEnabled(
-        "sender",
-        (value) => value.sender !== undefined && value.sender !== "",
-        "Missing required field in config: auth.sms.textlocal.sender",
-      ),
-      requiredWhenEnabled(
-        "api_key",
-        (value) => value.api_key !== undefined && value.api_key !== "",
-        "Missing required field in config: auth.sms.textlocal.api_key",
-      ),
-    )
-    .pipe(Schema.withDecodingDefaultKey(Effect.succeed({ ...defaultTextlocal }))),
+  }).pipe(Schema.withDecodingDefaultKey(Effect.succeed({ ...defaultTextlocal }))),
   vonage: Schema.Struct({
     enabled: Schema.Boolean.annotate({
       default: defaultVonageEnabled,
@@ -264,25 +297,7 @@ export const sms = Schema.Struct({
         links: [links.phoneLogin("Vonage")],
       }),
     ),
-  })
-    .check(
-      requiredWhenEnabled(
-        "from",
-        (value) => value.from !== undefined && value.from !== "",
-        "Missing required field in config: auth.sms.vonage.from",
-      ),
-      requiredWhenEnabled(
-        "api_key",
-        (value) => value.api_key !== undefined && value.api_key !== "",
-        "Missing required field in config: auth.sms.vonage.api_key",
-      ),
-      requiredWhenEnabled(
-        "api_secret",
-        (value) => value.api_secret !== undefined && value.api_secret !== "",
-        "Missing required field in config: auth.sms.vonage.api_secret",
-      ),
-    )
-    .pipe(Schema.withDecodingDefaultKey(Effect.succeed({ ...defaultVonage }))),
+  }).pipe(Schema.withDecodingDefaultKey(Effect.succeed({ ...defaultVonage }))),
   test_otp: Schema.optionalKey(
     Schema.Record(Schema.String, Schema.String).annotate({
       description: "Use pre-defined map of phone number to OTP for testing.",
@@ -290,4 +305,6 @@ export const sms = Schema.Struct({
       links: [links.auth],
     }),
   ),
-}).pipe(Schema.withDecodingDefaultKey(Effect.succeed({ ...defaultSms })));
+})
+  .check(Schema.makeFilter(validateSmsProviderSwitch))
+  .pipe(Schema.withDecodingDefaultKey(Effect.succeed({ ...defaultSms })));
diff --git a/packages/config/src/base.ts b/packages/config/src/base.ts
index 26e14810e0..35c727fc3b 100644
--- a/packages/config/src/base.ts
+++ b/packages/config/src/base.ts
@@ -55,15 +55,30 @@ const remoteProjectConfig = Schema.Struct({
   experimental,
 }).pipe(Schema.withDecodingDefault(Effect.succeed({})));
 
+/**
+ * Exported separately (not inlined into {@link ProjectConfigSchema}) so
+ * `packages/config/src/io.ts` can decode it on its own with
+ * `disableChecks: true`. Go's `Config.Validate` only ever checks
+ * `remotes.*.project_id` format for every remote block
+ * (`apps/cli-go/pkg/config/config.go:996-1001`, "Since remote config is merged
+ * to base, we only need to validate the project_id field") — every other
+ * business-rule check (`Auth.External.validate()`, `Auth.Sms.validate()`,
+ * etc.) runs exactly once, against the merged effective config
+ * (`config.go:1136-1152`), never iterated over `c.Remotes[*]`. Decoding this
+ * schema normally (checks enabled) would apply those same business-rule
+ * `.check()`s — embedded in `auth`/`db`/etc. — to every remote regardless of
+ * selection, rejecting configs Go accepts (e.g. an unselected
+ * `[remotes.prod.auth.external.github] enabled = true` stub with no secret).
+ */
+export const RemotesSchema = Schema.Record(Schema.String, remoteProjectConfig).annotate({
+  default: {},
+  description: "Remote branch-specific project configuration.",
+  tags: ["general"],
+});
+
 export const ProjectConfigSchema = Schema.Struct({
   ...baseProjectConfigFields,
-  remotes: Schema.Record(Schema.String, remoteProjectConfig)
-    .annotate({
-      default: {},
-      description: "Remote branch-specific project configuration.",
-      tags: ["general"],
-    })
-    .pipe(Schema.withDecodingDefault(Effect.succeed({}))),
+  remotes: RemotesSchema.pipe(Schema.withDecodingDefault(Effect.succeed({}))),
 });
 
 export type ProjectConfig = typeof ProjectConfigSchema.Type;
diff --git a/packages/config/src/errors.ts b/packages/config/src/errors.ts
index a7d1e82b75..1a3c17bc42 100644
--- a/packages/config/src/errors.ts
+++ b/packages/config/src/errors.ts
@@ -5,6 +5,47 @@ export class ProjectConfigParseError extends Data.TaggedError("ProjectConfigPars
   readonly path: string;
   readonly format: ConfigFormat;
   readonly cause: unknown;
+  /**
+   * The pre-schema-decode `edge_runtime` subtree (post env-interpolation and
+   * `[remotes.*]` merge) — present only when the failure happened during
+   * *schema* decode (`Schema.decodeUnknownSync`), not during raw TOML/JSON
+   * parsing. `Schema.decodeUnknownSync` is all-or-nothing: a single invalid
+   * field anywhere in the document discards the entire decode, unlike Go's
+   * `viper`+`mapstructure` decode (`apps/cli-go/pkg/config/config.go:749`),
+   * which mutates the target struct field-by-field and keeps whatever
+   * independently decoded before hitting an unrelated error. Callers that
+   * need Go's tolerance for a single subtree (e.g. `secrets set` recovering
+   * `edge_runtime.secrets` when an unrelated field like `analytics.port` is
+   * malformed) can re-decode this subtree against the full schema themselves.
+   * Only `edge_runtime` is retained, not the whole document — several callers
+   * of `loadProjectConfig` don't catch `ProjectConfigParseError` at all, so
+   * this error can propagate with whatever is attached here, and no caller
+   * needs anything outside `edge_runtime` today. Every `edge_runtime.secrets`
+   * value is wrapped in `Redacted` (mirroring `secret()`'s `x-secret`
+   * treatment elsewhere in this package) so an uncaught error can't
+   * accidentally leak a resolved secret into a log or trace; callers must
+   * unwrap via `Redacted.value` before re-decoding. `undefined` when the
+   * document never parsed at all — that class has no recoverable structure in
+   * either implementation.
+   */
+  readonly document?: { readonly edge_runtime?: unknown };
+  /**
+   * Name of the `[remotes.<name>]` block whose subtree was merged over the
+   * base document before the decode that produced this error, when a
+   * `projectRef` was supplied and one matched. Mirrors `appliedRemote` on
+   * {@link LoadedProjectConfig} for the success path. Go's `loadFromFile`
+   * prints `Loading config override: [remotes.<name>]` to stderr
+   * unconditionally, *before* `mapstructure` decode ever runs
+   * (`apps/cli-go/pkg/config/config.go:604-609`) — so the notice is still due
+   * even when the subsequent decode fails. Callers that tolerate a
+   * schema-decode failure and keep going (e.g. `secrets set`) must surface
+   * this themselves; callers that let the error propagate get no such
+   * notice from Go either, since `c.load(v)` fails before `Run` prints
+   * anything else. `undefined` when no `projectRef` was requested or none
+   * matched — same as the raw-parse-failure case, where remote merging never
+   * runs at all.
+   */
+  readonly appliedRemote?: string;
 }> {}
 
 export class ProjectEnvParseError extends Data.TaggedError("ProjectEnvParseError")<{
@@ -29,3 +70,15 @@ export class DuplicateRemoteProjectIdError extends Data.TaggedError(
 )<{
   readonly message: string;
 }> {}
+
+/**
+ * A `[remotes.<name>]` block's `project_id` is not a valid 20-lowercase-letter
+ * project ref. Mirrors Go's `Config.Validate` (`apps/cli-go/pkg/config/config.go:
+ * 558,996-1001`), which checks every remote's `project_id` against `refPattern`
+ * on every config load — regardless of whether that remote ends up selected —
+ * so this fails before Docker/API access, same as Go. `message` matches the Go
+ * string verbatim so callers can surface it without rewrapping.
+ */
+export class InvalidRemoteProjectIdError extends Data.TaggedError("InvalidRemoteProjectIdError")<{
+  readonly message: string;
+}> {}
diff --git a/packages/config/src/functions-manifest.ts b/packages/config/src/functions-manifest.ts
index 63322169fa..02896aa0aa 100644
--- a/packages/config/src/functions-manifest.ts
+++ b/packages/config/src/functions-manifest.ts
@@ -25,6 +25,8 @@ export type FunctionsManifest = Readonly<Record<string, ResolvedFunctionConfig>>
 interface InferFunctionsManifestOptions {
   readonly cwd: string;
   readonly config?: ProjectConfig;
+  /** Forwarded to {@link findProjectPaths}'s own `search` option — see its doc comment. */
+  readonly search?: boolean;
 }
 
 function filesystemFunctionConfig(slug: string, hasDenoJson: boolean): ResolvedFunctionConfig {
@@ -78,7 +80,7 @@ export const inferFunctionsManifest = Effect.fnUntraced(function* (
 ) {
   const fs = yield* FileSystem.FileSystem;
   const path = yield* Path.Path;
-  const projectPaths = yield* findProjectPaths(options.cwd);
+  const projectPaths = yield* findProjectPaths(options.cwd, { search: options.search });
   const projectRoot = projectPaths?.projectRoot ?? options.cwd;
   const config =
     options.config ??
diff --git a/packages/config/src/functions-manifest.unit.test.ts b/packages/config/src/functions-manifest.unit.test.ts
index c2b1e28e96..085d160768 100644
--- a/packages/config/src/functions-manifest.unit.test.ts
+++ b/packages/config/src/functions-manifest.unit.test.ts
@@ -186,4 +186,34 @@ describe("functions manifest", () => {
       await rm(cwd, { recursive: true, force: true });
     }
   });
+
+  test("search: false does not climb to an ancestor project's functions", async () => {
+    const projectRoot = makeTempProject();
+    const nestedCwd = join(projectRoot, "nested", "workdir");
+
+    try {
+      const functionDir = join(projectRoot, "supabase", "functions", "hello-world");
+      await mkdir(functionDir, { recursive: true });
+      await writeFile(join(functionDir, "index.ts"), "Deno.serve(() => new Response())\n");
+      await writeFile(join(projectRoot, "supabase", "config.json"), "{}\n");
+      await mkdir(nestedCwd, { recursive: true });
+
+      await expect(runConfigEffect(inferFunctionsManifest({ cwd: nestedCwd }))).resolves.toEqual({
+        "hello-world": {
+          enabled: true,
+          verify_jwt: true,
+          import_map: "",
+          entrypoint: "./functions/hello-world/index.ts",
+          static_files: [],
+          env: {},
+        },
+      });
+
+      await expect(
+        runConfigEffect(inferFunctionsManifest({ cwd: nestedCwd, search: false })),
+      ).resolves.toEqual({});
+    } finally {
+      await rm(projectRoot, { recursive: true, force: true });
+    }
+  });
 });
diff --git a/packages/config/src/index.ts b/packages/config/src/index.ts
index e9a8eed763..77af2064ae 100644
--- a/packages/config/src/index.ts
+++ b/packages/config/src/index.ts
@@ -1,6 +1,7 @@
 export { ProjectConfigSchema, type ProjectConfig, type ProjectConfigJson } from "./base.ts";
 export {
   DuplicateRemoteProjectIdError,
+  InvalidRemoteProjectIdError,
   MissingProjectConfigValueError,
   ProjectConfigParseError,
   ProjectEnvParseError,
@@ -30,6 +31,7 @@ export {
   type LoadProjectEnvironmentOptions,
   type ProjectEnvironment,
   type ResolvedProjectValue,
+  type ResolveProjectOptions,
   loadProjectEnvironment,
   resolveProjectSubtree,
   resolveProjectValue,
@@ -39,3 +41,4 @@ export { projectConfigStoreLayer } from "./project-config.layer.ts";
 export { ProjectConfigStore } from "./project-config.service.ts";
 export { PROJECT_CONFIG_SCHEMA_URL } from "./schema-metadata.ts";
 export { KONG_LOCAL_CA_CERT } from "./tls.ts";
+export { ENV_CAPTURE_REGEX } from "./lib/env.ts";
diff --git a/packages/config/src/io.ts b/packages/config/src/io.ts
index 85f9ca6201..ae427d5f67 100644
--- a/packages/config/src/io.ts
+++ b/packages/config/src/io.ts
@@ -1,7 +1,11 @@
-import { Console, Effect, FileSystem, Path, Schema } from "effect";
+import { Console, Effect, FileSystem, Path, Redacted, Schema } from "effect";
 import * as SmolToml from "smol-toml";
-import { ProjectConfigSchema, type ProjectConfig } from "./base.ts";
-import { DuplicateRemoteProjectIdError, ProjectConfigParseError } from "./errors.ts";
+import { ProjectConfigSchema, RemotesSchema, type ProjectConfig } from "./base.ts";
+import {
+  DuplicateRemoteProjectIdError,
+  InvalidRemoteProjectIdError,
+  ProjectConfigParseError,
+} from "./errors.ts";
 import { interpolateEnvReferencesAgainstSchema } from "./lib/env.ts";
 import { findProjectPaths } from "./paths.ts";
 import { loadProjectEnvironment, type ProjectEnvironment } from "./project.ts";
@@ -31,14 +35,33 @@ export interface LoadedProjectConfig {
    * `undefined` when no `projectRef` was requested or none matched.
    */
   readonly appliedRemote?: string;
+  /**
+   * The top-level `auth.external.{linkedin,slack}` sub-objects that were stripped from
+   * {@link document} before it was returned (provider id → the removed object), keyed by
+   * provider id. Empty when neither deprecated block was present. See
+   * `normalizeDeprecatedExternalProviders`'s doc comment for why a caller doing its own
+   * Go-parity scan over `document` (e.g. a decrypt-or-abort secret check) may need to fold
+   * this back in — Go's decode-time decrypt hook sees these blocks before its later
+   * validate-time deletion, so `document` alone under-reports what Go would have decrypted.
+   * Present (possibly `{}`) whenever {@link document} is; absent from `saveProjectConfig`'s
+   * result, which has no document to strip from.
+   */
+  readonly removedDeprecatedExternalProviders?: Readonly<Record<string, unknown>>;
 }
 
 /**
- * When `projectRef` is set, the matching `[remotes.<name>]` block (the one whose
- * `project_id` equals it) is merged over the base config before decode, mirroring
- * Go's `config.Load` with `Config.ProjectId` set
- * (`apps/cli-go/pkg/config/config.go:503-562`). Omitting it loads the base config
- * verbatim, so existing callers are unaffected.
+ * When `projectRef` is set, the matching `[remotes.<name>]` block (the one
+ * whose `project_id` equals it) is merged over the base config before decode,
+ * mirroring Go's `config.Load` with `Config.ProjectId` set
+ * (`apps/cli-go/pkg/config/config.go:503-562`). Omitting it loads the base
+ * config verbatim (no merge), so existing callers are unaffected. Go's
+ * duplicate-`project_id`/project-ref-format checks across every
+ * `[remotes.*]` block (`config.go:594-602,996-1001`) run unconditionally on
+ * every config load in Go, not only when a caller ends up selecting a
+ * remote — but here they only run when {@link LoadProjectConfigOptions.goViperCompat}
+ * is `true`, regardless of whether `projectRef` is set, so non-Go-parity
+ * callers that never select a remote (and never opt into Go parity) aren't
+ * broken by an unrelated duplicate/malformed `[remotes.*]` block.
  */
 export interface LoadProjectConfigOptions {
   readonly projectRef?: string;
@@ -51,6 +74,37 @@ export interface LoadProjectConfigOptions {
    * so loading does not re-read those files or depend on `process.env` mutation.
    */
   readonly projectEnv?: ProjectEnvironment;
+  /** See {@link FindProjectPathsOptions.search}. */
+  readonly search?: boolean;
+  /**
+   * Skip the `config.json`-over-`config.toml` preference below and only ever
+   * load `config.toml`. Go's `Config.Load`/`NewPathBuilder`
+   * (`apps/cli-go/pkg/config/utils.go:43-48`) has no concept of a JSON project
+   * config file — it always resolves `supabase/config.toml` and treats a
+   * missing file as defaults — so Go-parity callers (the legacy `status`/`stop`
+   * ports) must set this to avoid picking up a stray `config.json` that Go
+   * would never see.
+   */
+  readonly tomlOnly?: boolean;
+  /**
+   * Opt into the Go/viper-parity decode+validation semantics this loader
+   * otherwise omits, so only the Go-parity legacy shell (and shared modules
+   * invoked exclusively by it) pays for them. Defaults to `false` = pre-PR-#5765
+   * behavior, which `next/`, `packages/stack`, and the functions manifest rely
+   * on. When `true`, mirrors Go's `config.Load` exactly:
+   *  - runs the unconditional duplicate-`project_id` and project-ref-format
+   *    checks across every `[remotes.*]` block (`config.go:594-602,996-1001`),
+   *    even when no `projectRef` is requested;
+   *  - warns on stderr for deprecated `auth.external.{linkedin,slack}` blocks
+   *    (`config.go:1418-1423`) — the block is stripped from the decoded config
+   *    either way, since the schema ignores excess properties;
+   *  - matches `env(...)` references case-agnostically (`^env\((.*)\)$`)
+   *    rather than the strict SCREAMING_SNAKE_CASE form;
+   *  - splits a comma-separated string into a `[]string`-typed field (Go's
+   *    `mapstructure.StringToSliceHookFunc(",")`, `config.go:775-784`), not
+   *    just an `env()`-substituted one.
+   */
+  readonly goViperCompat?: boolean;
 }
 
 export interface SaveProjectConfigOptions {
@@ -61,6 +115,18 @@ export interface SaveProjectConfigOptions {
 }
 
 const decodeProjectConfig = Schema.decodeUnknownSync(ProjectConfigSchema);
+/**
+ * Decodes the `remotes` map with `disableChecks: true` — full type/shape
+ * decoding, defaults, and transformations (e.g. secret redaction) still run,
+ * but the `.check()`-based business-rule refinements embedded in `auth`/`db`/
+ * etc. (e.g. "external provider requires a secret when enabled") are skipped.
+ * See {@link RemotesSchema}'s doc comment for why: Go only ever applies those
+ * business rules to the merged effective config, never to a `[remotes.*]`
+ * block that wasn't selected.
+ */
+const decodeRemotesWithoutChecks = Schema.decodeUnknownSync(RemotesSchema, {
+  disableChecks: true,
+});
 const encodeProjectConfig = Schema.encodeSync(ProjectConfigSchema);
 const defaultEncodedProjectConfig = encodeProjectConfig(decodeProjectConfig({}));
 const defaultEncodedFunctionConfig = {
@@ -124,28 +190,20 @@ function withDbSeedDisabled(document: Record<string, unknown>): Record<string, u
 }
 
 /**
- * Applies the `[remotes.<name>]` override whose `project_id` matches `projectRef`
- * to `document`, mirroring Go's `loadFromFile` remote resolution
- * (`config.go:503-518`). Returns the merged document (with `remotes` stripped) and
- * the matched remote name.
- *
- * Like Go, duplicate `project_id`s are detected across *all* `[remotes.*]` blocks —
- * not just the ones matching `projectRef` — before the matching override is applied.
- * A missing `project_id` reads as `""` (Go's `viper.GetString`), so two remotes that
+ * Builds a `project_id -> "[remotes.<name>]"` map across every `[remotes.*]`
+ * block, failing on the first duplicate. Mirrors Go's `loadFromFile`
+ * (`config.go:594-602`): that loop runs unconditionally on every config load,
+ * regardless of whether any remote's `project_id` ends up matching
+ * `Config.ProjectId`. Here, {@link applyRemoteOverride} only invokes this when
+ * `goViperCompat` is set, so it still runs even for callers that don't
+ * request a specific `projectRef` — but only under Go-parity mode. A missing
+ * `project_id` reads as `""` (Go's `viper.GetString`), so two remotes that
  * both omit it collide on the empty key and fail just as in Go.
  */
-const applyRemoteOverride = Effect.fnUntraced(function* (
-  document: Record<string, unknown>,
-  projectRef: string,
+const checkDuplicateRemoteProjectIds = Effect.fnUntraced(function* (
+  remotes: Record<string, unknown>,
 ) {
-  const remotes = document["remotes"];
-  if (!isObject(remotes)) {
-    return { document, appliedRemote: undefined as string | undefined };
-  }
-  // Build a project_id -> "[remotes.<name>]" map over every remote, failing on the
-  // first duplicate, then resolve the single block matching projectRef.
   const idToName = new Map<string, string>();
-  let name: string | undefined;
   for (const [remoteName, remote] of Object.entries(remotes)) {
     const projectId =
       isObject(remote) && typeof remote["project_id"] === "string" ? remote["project_id"] : "";
@@ -156,17 +214,91 @@ const applyRemoteOverride = Effect.fnUntraced(function* (
       });
     }
     idToName.set(projectId, `[remotes.${remoteName}]`);
-    if (projectId === projectRef) {
-      name = remoteName;
+  }
+});
+
+/** Go's project-ref pattern (`apps/cli-go/pkg/config/config.go:558`): exactly 20
+ * lowercase ASCII letters. */
+const REMOTE_PROJECT_ID_PATTERN = /^[a-z]{20}$/;
+
+/**
+ * Rejects the first `[remotes.*]` block whose `project_id` is not a valid
+ * project ref, mirroring Go's `Config.Validate` (`config.go:996-1001`) — that
+ * loop runs unconditionally over every remote on every config load, not only
+ * the one that ends up selected/merged. Here, {@link applyRemoteOverride} only
+ * invokes this when `goViperCompat` is set.
+ *
+ * Unlike {@link checkDuplicateRemoteProjectIds}/the match below (which read
+ * viper's raw, pre-`LoadEnvHook` values — see {@link applyRemoteOverride}'s
+ * doc comment), `Config.Validate` runs entirely AFTER the struct decode
+ * (`config.go:882`), by which point `LoadEnvHook` has already resolved every
+ * `env(...)` reference (`config.go:749-753`). So this check must see the
+ * already-interpolated `project_id`, not the literal `env(REF)` form — an
+ * `[remotes.x] project_id = "env(REF)"` that resolves to a valid 20-letter ref
+ * passes here even though the raw string doesn't match the pattern itself.
+ */
+const checkRemoteProjectIdFormat = Effect.fnUntraced(function* (remotes: Record<string, unknown>) {
+  for (const [remoteName, remote] of Object.entries(remotes)) {
+    const projectId =
+      isObject(remote) && typeof remote["project_id"] === "string" ? remote["project_id"] : "";
+    if (!REMOTE_PROJECT_ID_PATTERN.test(projectId)) {
+      return yield* new InvalidRemoteProjectIdError({
+        message: `Invalid config for remotes.${remoteName}.project_id. Must be like: abcdefghijklmnopqrst`,
+      });
     }
   }
+});
+
+/**
+ * Applies the `[remotes.<name>]` override whose `project_id` matches `projectRef`
+ * to `rawDocument`, mirroring Go's `loadFromFile` remote resolution
+ * (`config.go:503-518`). Returns the merged document (with `remotes` stripped,
+ * still pre-`env()`-interpolation — the caller re-interpolates the result) and
+ * the matched remote name. `projectRef` of `undefined` never matches any remote
+ * (including one that itself omits `project_id`, which reads as `""`) — callers
+ * that don't request a specific remote get the duplicate/format checks below
+ * without the merge, so the base document loads verbatim as before.
+ *
+ * `rawDocument`'s `remotes` block is the PRE-interpolation document: Go's
+ * duplicate-check/selection loop in `loadFromFile` reads directly off viper's
+ * raw config values (`v.GetString(fmt.Sprintf("remotes.%s.project_id", name))`,
+ * `config.go:596-610`) and only calls `c.load(v)` — which resolves `env(...)`
+ * via `LoadEnvHook` during the struct decode (`config.go:749-753`,
+ * `decode_hooks.go:13-26`) — afterward (`config.go:611`). So a
+ * `[remotes.prod] project_id = "env(REF)"` is matched/deduped against the
+ * LITERAL `env(REF)` string in Go, never against `REF`'s resolved value; this
+ * mirrors that exactly rather than matching post-interpolation, which would
+ * merge a remote Go itself would never select. `interpolatedRemotes` (Go's
+ * post-decode `c.Remotes`, mirrored here as the already-interpolated
+ * `remotes` subtree) is used only for {@link checkRemoteProjectIdFormat} — see
+ * its doc comment for why that check needs the resolved value instead.
+ */
+const applyRemoteOverride = Effect.fnUntraced(function* (
+  rawDocument: Record<string, unknown>,
+  interpolatedRemotes: Record<string, unknown> | undefined,
+  projectRef: string | undefined,
+  goViperCompat: boolean,
+) {
+  const remotes = rawDocument["remotes"];
+  if (!isObject(remotes)) {
+    return { document: rawDocument, appliedRemote: undefined as string | undefined };
+  }
+  if (goViperCompat) {
+    yield* checkDuplicateRemoteProjectIds(remotes);
+    yield* checkRemoteProjectIdFormat(interpolatedRemotes ?? remotes);
+  }
+  const name = Object.entries(remotes).find(([, remote]) => {
+    const projectId =
+      isObject(remote) && typeof remote["project_id"] === "string" ? remote["project_id"] : "";
+    return projectRef !== undefined && projectId === projectRef;
+  })?.[0];
   if (name === undefined) {
-    return { document, appliedRemote: undefined as string | undefined };
+    return { document: rawDocument, appliedRemote: undefined as string | undefined };
   }
   const remoteSubtree = remotes[name];
   let merged = isObject(remoteSubtree)
-    ? mergeRemoteSubtree(document, remoteSubtree)
-    : { ...document };
+    ? mergeRemoteSubtree(rawDocument, remoteSubtree)
+    : { ...rawDocument };
   if (!(isObject(remoteSubtree) && remoteSetsDbSeedEnabled(remoteSubtree))) {
     merged = withDbSeedDisabled(merged);
   }
@@ -317,6 +449,142 @@ function normalizeDeprecatedSMTPSections(document: unknown): NormalizedSMTPDocum
   return { document: normalized, deprecatedSections };
 }
 
+interface NormalizedExternalProvidersDocument {
+  readonly document: unknown;
+  /** Provider ids (`"linkedin"` | `"slack"`) whose deprecated top-level block was `enabled` — drives the WARN. */
+  readonly deprecatedProviders: ReadonlyArray<string>;
+  /**
+   * The removed top-level `auth.external.{linkedin,slack}` sub-objects (provider id → the
+   * object that was deleted), regardless of `enabled`. Go's global `DecryptSecretHookFunc`
+   * runs during decode — strictly BEFORE `Config.Validate()` → `external.validate()` (which
+   * this function mirrors) ever deletes these blocks (`config.go:753,775-783` decode vs.
+   * `config.go:882,1148,1419-1425` validate) — so an `encrypted:` secret hiding in one of
+   * these blocks still gets decrypted-or-aborted in Go. A caller that needs to reproduce that
+   * decrypt-or-abort check against the returned (already-stripped) {@link LoadedProjectConfig.document}
+   * (e.g. `config push`'s pre-check) can fold this back in. Only the top-level blocks are
+   * captured, not any surviving `remotes.*.auth.external.{linkedin,slack}` — that's the
+   * separate, already-documented "non-matching remote" gap.
+   */
+  readonly removedProviders: Readonly<Record<string, unknown>>;
+}
+
+const DEPRECATED_EXTERNAL_PROVIDERS = ["linkedin", "slack"] as const;
+
+/**
+ * Go's `(e external) validate()` deprecated-provider handling
+ * (`apps/cli-go/pkg/config/config.go:1418-1423`): `linkedin`/`slack` are
+ * unconditionally deleted from `auth.external` before the required-field loop
+ * runs, so a bare `[auth.external.slack] enabled = true` with no
+ * `client_id`/`secret` loads fine in Go — a warning prints to stderr only
+ * when the deleted provider was `enabled`, never a hard failure.
+ *
+ * Unlike {@link normalizeDeprecatedSMTPSections}'s `[inbucket]` rename — which
+ * Go's own `normalizeDeprecatedSMTPConfig` runs BEFORE remote selection, over
+ * every `[remotes.*]` entry unconditionally (`config.go:594,614-640`) — Go's
+ * `external.validate()` runs from `Config.Validate()`, exactly ONCE on the
+ * final post-remote-merge struct (`config.go:882,1148`). A non-selected
+ * remote's own `auth.external.slack` block is never even looked at by Go. So
+ * this must run on the POST-merge document (`documentForDecode`, after
+ * `applyRemoteOverride`), not the pre-merge one:
+ *  - the top-level `auth.external.{linkedin,slack}` is always stripped, and
+ *    reported (for the caller to warn on) only when it was `enabled`,
+ *    matching Go's single `external.validate()` call.
+ *  - any `remotes.*.auth.external.{linkedin,slack}` still present (only
+ *    possible when no remote matched `projectRef`, so `applyRemoteOverride`
+ *    left `remotes` in place) is also stripped, but never reported — purely
+ *    so `remoteProjectConfig`'s eager, whole-map schema decode
+ *    (`packages/config/src/base.ts`) doesn't reject an unselected remote's
+ *    deprecated block over a field Go itself never struct-decodes at all for
+ *    a remote that isn't in effect.
+ */
+function normalizeDeprecatedExternalProviders(
+  document: unknown,
+): NormalizedExternalProvidersDocument {
+  if (!isObject(document)) {
+    return { document, deprecatedProviders: [], removedProviders: {} };
+  }
+  const normalized = { ...document };
+  const deprecatedProviders: Array<string> = [];
+  const removedProviders: Record<string, unknown> = {};
+  if (isObject(normalized.auth) && isObject(normalized.auth.external)) {
+    const external = { ...normalized.auth.external };
+    for (const ext of DEPRECATED_EXTERNAL_PROVIDERS) {
+      const provider = external[ext];
+      if (provider === undefined) continue;
+      removedProviders[ext] = provider;
+      if (isObject(provider) && provider.enabled === true) {
+        deprecatedProviders.push(ext);
+      }
+      delete external[ext];
+    }
+    normalized.auth = { ...normalized.auth, external };
+  }
+  if (isObject(normalized.remotes)) {
+    normalized.remotes = Object.fromEntries(
+      Object.entries(normalized.remotes).map(([name, remote]) => {
+        if (!isObject(remote) || !isObject(remote.auth) || !isObject(remote.auth.external)) {
+          return [name, remote];
+        }
+        const external = { ...remote.auth.external };
+        for (const ext of DEPRECATED_EXTERNAL_PROVIDERS) {
+          delete external[ext];
+        }
+        return [name, { ...remote, auth: { ...remote.auth, external } }];
+      }),
+    );
+  }
+  return { document: normalized, deprecatedProviders, removedProviders };
+}
+
+/**
+ * Wraps every `edge_runtime.secrets` value in `Redacted` before it's attached
+ * to `ProjectConfigParseError.document`. By this point `secrets` values are
+ * real, resolved secrets (post `env()` interpolation, see
+ * `interpolateEnvReferencesAgainstSchema` in `loadProjectConfigFile`) — the
+ * same values `secret()` (`lib/env.ts`) annotates `x-secret` for elsewhere in
+ * this package (`resolveProjectValue`'s `redactValue`). Several callers of
+ * `loadProjectConfig` (`gen types`, `next start`, `functions dev/serve/deploy`)
+ * don't catch `ProjectConfigParseError` at all, so this keeps the same
+ * accidental-leak protection `Redacted` already gives every other secret path
+ * in this package, in case an uncaught error's `document` ever reaches a log
+ * or trace. `secrets set`'s `recoverEdgeRuntimeConfig`/`filterDecodableSecrets`
+ * unwrap via `Redacted.isRedacted`/`Redacted.value` before re-decoding.
+ */
+function redactEdgeRuntimeSecrets(edgeRuntime: unknown): unknown {
+  if (!isObject(edgeRuntime) || !("secrets" in edgeRuntime)) {
+    return edgeRuntime;
+  }
+  if (!isObject(edgeRuntime.secrets)) {
+    // The whole `secrets` field is malformed — e.g. `secrets = ["actual-secret"]`
+    // (a TOML array instead of a table) — rather than a single bad entry
+    // inside an otherwise-valid table. Still carries a secret in its
+    // structure, so wrap the field as one unit with the same rationale as
+    // the per-entry case below. Guarded by `"secrets" in edgeRuntime`
+    // (not just falling through on `undefined`) so `edge_runtime` documents
+    // that legitimately omit `secrets` don't gain a spurious
+    // `Redacted.make(undefined)` field.
+    return {
+      ...edgeRuntime,
+      secrets: Redacted.make(edgeRuntime.secrets, { label: "edge_runtime.secrets" }),
+    };
+  }
+  return {
+    ...edgeRuntime,
+    // Wrap the whole entry, not just string values: a malformed
+    // `[edge_runtime.secrets]` entry (e.g. a TOML array `FOO = ["actual-secret"]`
+    // or inline table) still carries the secret in its structure, and
+    // `Redacted.make` accepts any value — `toString`/`toJSON` always render
+    // `<redacted:...>` regardless of the wrapped type, so this can't leak a
+    // non-string entry either.
+    secrets: Object.fromEntries(
+      Object.entries(edgeRuntime.secrets).map(([name, value]) => [
+        name,
+        Redacted.make(value, { label: `edge_runtime.secrets.${name}` }),
+      ]),
+    ),
+  };
+}
+
 function getSchemaRef(document: unknown): string | undefined {
   if (!isObject(document)) {
     return undefined;
@@ -330,10 +598,51 @@ function parseProjectConfig(
   document: unknown,
   format: ConfigFormat,
   path: string,
+  appliedRemote: string | undefined,
 ): Effect.Effect<ProjectConfig, ProjectConfigParseError> {
   return Effect.try({
-    try: () => decodeProjectConfig(document),
-    catch: (cause) => new ProjectConfigParseError({ path, format, cause }),
+    try: () => {
+      // Decode `remotes` separately, with business-rule checks disabled — see
+      // `decodeRemotesWithoutChecks`/`RemotesSchema`'s doc comments. Non-selected
+      // `[remotes.*]` blocks reach here still attached to `document` (only a
+      // SELECTED remote gets merged in and stripped from `remotes` by
+      // `applyRemoteOverride`), so decoding them through the normal,
+      // checks-enabled `decodeProjectConfig` below would apply Go's
+      // merged-config-only business rules to every remote regardless of
+      // selection. Structural decoding (types, defaults, transformations)
+      // still runs either way, matching Go's unconditional `UnmarshalExact`
+      // struct decode of every remote.
+      const rawRemotes = isObject(document) ? document.remotes : undefined;
+      const config = decodeProjectConfig(
+        isObject(document) ? { ...document, remotes: {} } : document,
+      );
+      return { ...config, remotes: decodeRemotesWithoutChecks(rawRemotes ?? {}) };
+    },
+    // `document` always parsed successfully by this point (raw parse failures
+    // are caught earlier, in `loadProjectConfigFile`), so any error here is a
+    // schema-decode failure — attach it so callers can attempt a narrower,
+    // Go-tolerant re-decode of an unaffected subtree. See the field doc on
+    // `ProjectConfigParseError.document`. Only the `edge_runtime` subtree is
+    // retained (not the whole document): it's the only slice any caller
+    // re-decodes today (`secrets set`'s `recoverEdgeRuntimeConfig`), and several
+    // callers of `loadProjectConfig` (e.g. `gen types`, `next start`,
+    // `functions dev/serve/deploy`) don't catch `ProjectConfigParseError` at
+    // all, so this error can propagate with whatever we attach here — no
+    // reason to carry unrelated sections (db credentials, other
+    // `[remotes.*]` blocks, etc.) along for the ride. `appliedRemote` is passed
+    // through unconditionally too — see the field doc on
+    // `ProjectConfigParseError.appliedRemote` for why a tolerant caller still
+    // owes the override notice on this path.
+    catch: (cause) =>
+      new ProjectConfigParseError({
+        path,
+        format,
+        cause,
+        document: isObject(document)
+          ? { edge_runtime: redactEdgeRuntimeSecrets(document.edge_runtime) }
+          : undefined,
+        appliedRemote,
+      }),
   });
 }
 
@@ -385,12 +694,19 @@ export const loadProjectConfigFile = Effect.fnUntraced(function* (
   });
   const { document: normalized, deprecatedSections } = normalizeDeprecatedSMTPSections(document);
   // Warn on stderr (matching Go's normalizeDeprecatedSMTPConfig) so the notice
-  // never pollutes machine-readable stdout payloads.
+  // never pollutes machine-readable stdout payloads. Pinned to the real
+  // console (bypassing whatever `Console.Console` is ambient) so this always
+  // writes immediately, matching Go's synchronous `fmt.Fprintln(os.Stderr, ...)`
+  // (config.go:618,630) — a caller wrapping this in a deferred/buffered
+  // `Console.Console` (e.g. `apps/cli/src/shared/cli/run.ts`'s
+  // `withoutParseErrorHelpDump`, which only buffers the CLI parser's own
+  // duplicate-render writes and must never delay a handler's real output; see
+  // CLI-1901) must not silently swallow or delay it.
   for (const section of deprecatedSections) {
     const replacement = section.replace(/inbucket$/, "local_smtp");
     yield* Console.error(
       `WARN: config section [${section}] is deprecated. Please use [${replacement}] instead.`,
-    );
+    ).pipe(Effect.provideService(Console.Console, globalThis.console));
   }
 
   // Substitute `env(VAR)` references against `.env`/`.env.local`/ambient env
@@ -405,25 +721,83 @@ export const loadProjectConfigFile = Effect.fnUntraced(function* (
     (yield* loadProjectEnvironment({
       cwd: projectRoot,
       baseEnv: process.env,
+      search: options?.search,
     }));
-  const interpolated = interpolateEnvReferencesAgainstSchema(
-    normalized,
-    projectEnv?.values ?? {},
-    ProjectConfigSchema,
-  );
-
-  // Merge the matching `[remotes.*]` override over the base document before
-  // decode (Go's `loadFromFile` with `Config.ProjectId` set). Only requested
-  // when a `projectRef` is supplied, so other callers load the base verbatim.
-  let documentForDecode: unknown = interpolated;
+  const goViperCompat = options?.goViperCompat ?? false;
+  const interpolateDocument = (document: unknown): unknown =>
+    interpolateEnvReferencesAgainstSchema(document, projectEnv?.values ?? {}, ProjectConfigSchema, {
+      goViperCompat,
+    });
+
+  // Interpolated once here purely to give `applyRemoteOverride`'s FORMAT check
+  // (not its match/merge — see that function's doc comment) the resolved
+  // `remotes.*.project_id`, matching Go's post-decode `Config.Validate`.
+  const interpolatedForValidation = interpolateDocument(normalized);
+  const interpolatedRemotes =
+    isObject(interpolatedForValidation) && isObject(interpolatedForValidation["remotes"])
+      ? interpolatedForValidation["remotes"]
+      : undefined;
+
+  // Merge the matching `[remotes.*]` override over the RAW (pre-`env()`-
+  // interpolation) document — Go's `loadFromFile` duplicate-check/selection
+  // loop runs on viper's raw string values, before `LoadEnvHook` ever resolves
+  // `env(...)` (`config.go:594-611`, `decode_hooks.go:13-26`); see
+  // `applyRemoteOverride`'s doc comment. The match/merge itself always runs
+  // (callers that don't request a `projectRef` just never match a remote, so
+  // the base document loads verbatim), but the duplicate-`project_id`/format
+  // checks only run when `goViperCompat` is set — see `applyRemoteOverride`.
+  let documentForDecode: unknown = normalized;
   let appliedRemote: string | undefined;
-  if (options?.projectRef !== undefined && isObject(interpolated)) {
-    const resolved = yield* applyRemoteOverride(interpolated, options.projectRef);
+  if (isObject(normalized)) {
+    const resolved = yield* applyRemoteOverride(
+      normalized,
+      interpolatedRemotes,
+      options?.projectRef,
+      goViperCompat,
+    );
     documentForDecode = resolved.document;
     appliedRemote = resolved.appliedRemote;
   }
 
-  const config = yield* parseProjectConfig(documentForDecode, format, filePath);
+  // The merge above ran on the raw document, so any `env(...)` reference in
+  // the winning remote's subtree (or elsewhere in the base) still needs
+  // resolving before decode — mirrors Go's `LoadEnvHook` running on the
+  // post-merge viper store inside `c.load(v)`. When no remote matched, this
+  // recomputes the same substitutions `interpolatedForValidation` already
+  // made (documentForDecode is just `normalized` again) — a redundant walk on
+  // that path, but correctness on the match+`env()` path matters more than
+  // avoiding it.
+  documentForDecode = isObject(documentForDecode)
+    ? interpolateDocument(documentForDecode)
+    : documentForDecode;
+
+  // Strip Go's deprecated `auth.external.{linkedin,slack}` provider ids from
+  // the POST-remote-merge document, matching `external.validate()` running
+  // once on the final effective config (see `normalizeDeprecatedExternalProviders`).
+  const {
+    document: normalizedForDecode,
+    deprecatedProviders,
+    removedProviders,
+  } = normalizeDeprecatedExternalProviders(documentForDecode);
+  // Warn on stderr, matching Go's `external.validate()` (`config.go:1418-1423`).
+  // Go's own format string is a raw string literal ending in a literal
+  // backslash-n (raw string literals never process escapes, and `Fprintf`
+  // doesn't append a newline the way `Fprintln` does), so Go's actual stderr
+  // bytes have no real line break after this message — a library-internal
+  // artifact, not the parity-relevant part, same call already made for
+  // `LegacyInvalidPortEnvOverrideError` in the legacy shell. Not reproduced
+  // byte-for-byte; `Console.error` supplies a normal trailing newline instead.
+  // Pinned to the real console for the same reason as the `[inbucket]`
+  // warning above — see that comment.
+  if (goViperCompat) {
+    for (const ext of deprecatedProviders) {
+      yield* Console.error(
+        `WARN: disabling deprecated "${ext}" provider. Please use [auth.external.${ext}_oidc] instead`,
+      ).pipe(Effect.provideService(Console.Console, globalThis.console));
+    }
+  }
+
+  const config = yield* parseProjectConfig(normalizedForDecode, format, filePath, appliedRemote);
 
   return {
     path: filePath,
@@ -431,8 +805,9 @@ export const loadProjectConfigFile = Effect.fnUntraced(function* (
     config,
     schemaRef: getSchemaRef(document),
     ignoredPaths: [],
-    document: isObject(documentForDecode) ? documentForDecode : undefined,
+    document: isObject(normalizedForDecode) ? normalizedForDecode : undefined,
     appliedRemote,
+    removedDeprecatedExternalProviders: removedProviders,
   } satisfies LoadedProjectConfig;
 });
 
@@ -441,7 +816,7 @@ export const loadProjectConfig = Effect.fnUntraced(function* (
   options?: LoadProjectConfigOptions,
 ) {
   const fs = yield* FileSystem.FileSystem;
-  const project = yield* findProjectPaths(cwd);
+  const project = yield* findProjectPaths(cwd, { search: options?.search });
 
   if (project === null) {
     return null;
@@ -454,7 +829,7 @@ export const loadProjectConfig = Effect.fnUntraced(function* (
     ? project.configPath
     : project.configPath.replace(/config\.json$/, "config.toml");
 
-  if (yield* fs.exists(jsonPath)) {
+  if (!options?.tomlOnly && (yield* fs.exists(jsonPath))) {
     const json = yield* loadProjectConfigFile(jsonPath, options);
 
     return {
diff --git a/packages/config/src/io.unit.test.ts b/packages/config/src/io.unit.test.ts
index d22d4eaf85..a09b321502 100644
--- a/packages/config/src/io.unit.test.ts
+++ b/packages/config/src/io.unit.test.ts
@@ -5,7 +5,7 @@ import { mkdir, readFile, rm, writeFile } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";
-import { Cause, Effect, Exit, FileSystem, Layer, Option, Path, Schema } from "effect";
+import { Cause, Effect, Exit, FileSystem, Layer, Option, Path, Redacted, Schema } from "effect";
 import { ProjectConfigSchema } from "./base.ts";
 import { loadProjectConfig as loadProjectConfigFromBun } from "./bun.ts";
 import {
@@ -16,6 +16,7 @@ import {
   loadProjectConfig,
   loadProjectConfigFile,
   saveProjectConfig,
+  type LoadProjectConfigOptions,
 } from "./io.ts";
 import { loadProjectConfig as loadProjectConfigFromNode } from "./node.ts";
 import { projectConfigStoreLayer } from "./project-config.layer.ts";
@@ -173,6 +174,45 @@ describe("config io", () => {
     ).toThrow();
   });
 
+  test("only validates the highest-priority enabled sms provider during decode (Go switch parity)", () => {
+    // Go's `(s *sms) validate()` (`apps/cli-go/pkg/config/config.go:1348-1410`) is a boolean
+    // `switch` that inspects providers in a fixed priority order (twilio, twilio_verify,
+    // messagebird, textlocal, vonage) and validates ONLY the first enabled one — a later
+    // enabled-but-incomplete provider is never even looked at. A complete, higher-priority
+    // `twilio` block plus an incomplete, lower-priority `messagebird` block must decode fine.
+    const config = decodeProjectConfig({
+      auth: {
+        sms: {
+          twilio: {
+            enabled: true,
+            account_sid: "AC123",
+            message_service_sid: "MG123",
+            auth_token: "secret",
+          },
+          messagebird: {
+            enabled: true,
+          },
+        },
+      },
+    });
+    expect(config.auth.sms.twilio.enabled).toBe(true);
+    expect(config.auth.sms.messagebird.enabled).toBe(true);
+  });
+
+  test("rejects an incomplete sms provider when no higher-priority provider is enabled", () => {
+    expect(() =>
+      decodeProjectConfig({
+        auth: {
+          sms: {
+            messagebird: {
+              enabled: true,
+            },
+          },
+        },
+      }),
+    ).toThrow(/auth\.sms\.messagebird\.originator/);
+  });
+
   test("requires enabled smtp fields during decode", () => {
     expect(() =>
       decodeProjectConfig({
@@ -187,6 +227,24 @@ describe("config io", () => {
     ).toThrow();
   });
 
+  test("decodes an unmodeled email template/notification name (Go map[string] parity)", () => {
+    // Go's `Auth.Email.Template`/`Notification` are genuine `map[string]emailTemplate`/
+    // `map[string]notification` (`apps/cli-go/pkg/config/auth.go:247-248`) — open maps with no
+    // key restriction; `(e *email) validate(fsys)` (`pkg/config/config.go:1293-1313`) iterates
+    // every entry regardless of name. An unrecognized key like `[auth.email.template.custom]`
+    // is a legitimate config shape Go accepts, not a decode error.
+    const config = decodeProjectConfig({
+      auth: {
+        email: {
+          template: { custom: { subject: "Hi" } },
+          notification: { custom_notice: { enabled: true, content_path: "custom.html" } },
+        },
+      },
+    });
+    expect(config.auth.email.template["custom"]?.subject).toBe("Hi");
+    expect(config.auth.email.notification["custom_notice"]?.enabled).toBe(true);
+  });
+
   test("requires enabled external provider credentials during decode", () => {
     expect(() =>
       decodeProjectConfig({
@@ -323,6 +381,50 @@ major_version = 16
     }
   });
 
+  // Go's `NewPathBuilder`/`Config.Load` (`apps/cli-go/pkg/config/utils.go:
+  // 43-48`) only ever resolves `supabase/config.toml` — it has no concept of a
+  // JSON project config file. Go-parity callers (legacy `status`/`stop`) pass
+  // `tomlOnly: true` so a stray `config.json` never wins over `config.toml`.
+  test("loads TOML instead of JSON when tomlOnly is set, even if JSON exists", async () => {
+    const cwd = makeTempProject();
+    const jsonPath = await runConfigEffect(configJsonPath(cwd));
+    const tomlPath = await runConfigEffect(configTomlPath(cwd));
+
+    try {
+      await mkdir(join(cwd, "supabase"), { recursive: true });
+      await writeFile(jsonPath, encodeProjectConfigToJson(sampleConfig));
+      await writeFile(
+        tomlPath,
+        `project_id = "toml-ref"
+
+[db]
+major_version = 16
+`,
+      );
+
+      const loaded = await runConfigEffect(loadProjectConfig(cwd, { tomlOnly: true }));
+      expect(loaded?.format).toBe("toml");
+      expect(loaded?.config.project_id).toBe("toml-ref");
+    } finally {
+      await rm(cwd, { recursive: true, force: true });
+    }
+  });
+
+  test("returns null when tomlOnly is set and only JSON exists", async () => {
+    const cwd = makeTempProject();
+    const jsonPath = await runConfigEffect(configJsonPath(cwd));
+
+    try {
+      await mkdir(join(cwd, "supabase"), { recursive: true });
+      await writeFile(jsonPath, encodeProjectConfigToJson(sampleConfig));
+
+      const loaded = await runConfigEffect(loadProjectConfig(cwd, { tomlOnly: true }));
+      expect(loaded).toBeNull();
+    } finally {
+      await rm(cwd, { recursive: true, force: true });
+    }
+  });
+
   test("loads TOML when JSON is absent", async () => {
     const cwd = makeTempProject();
     const tomlPath = await runConfigEffect(configTomlPath(cwd));
@@ -430,6 +532,158 @@ major_version = 16
     }
   });
 
+  test("redacts edge_runtime.secrets on the ProjectConfigParseError document", async () => {
+    const cwd = makeTempProject();
+    const tomlPath = await runConfigEffect(configTomlPath(cwd));
+
+    try {
+      await mkdir(join(cwd, "supabase"), { recursive: true });
+      // `analytics.port` fails schema decode (expects a number), which is
+      // enough to fail the whole `Schema.decodeUnknownSync` call while
+      // `edge_runtime.secrets` parses fine on its own — the scenario
+      // `recoverEdgeRuntimeConfig` (apps/cli's `secrets set`) exists to
+      // recover from. `MY_SUPER_SECRET_VALUE` stands in for a real secret so
+      // the assertion below can confirm it never appears in plaintext.
+      await writeFile(
+        tomlPath,
+        `[analytics]
+port = "not-a-number"
+
+[edge_runtime.secrets]
+FOO = "MY_SUPER_SECRET_VALUE"
+`,
+      );
+
+      const exit = await Effect.runPromiseExit(
+        loadProjectConfigFile(tomlPath).pipe(Effect.provide(BunServices.layer)),
+      );
+
+      expect(Exit.isFailure(exit)).toBe(true);
+      if (!Exit.isFailure(exit)) {
+        return;
+      }
+      const error = Cause.findErrorOption(exit.cause);
+      expect(Option.isSome(error)).toBe(true);
+      if (!Option.isSome(error) || error.value._tag !== "ProjectConfigParseError") {
+        return;
+      }
+
+      const edgeRuntime = error.value.document?.edge_runtime;
+      const secrets =
+        edgeRuntime !== null && typeof edgeRuntime === "object" && edgeRuntime !== undefined
+          ? (edgeRuntime as Record<string, unknown>).secrets
+          : undefined;
+      expect(secrets).toBeDefined();
+      const foo = (secrets as Record<string, unknown>).FOO;
+      expect(Redacted.isRedacted(foo)).toBe(true);
+      expect(Redacted.value(foo as Redacted.Redacted<string>)).toBe("MY_SUPER_SECRET_VALUE");
+      // The whole point: a caller that doesn't know to unwrap `Redacted`
+      // (e.g. an uncaught error serialized into a log) never sees the raw
+      // secret, even via JSON.stringify.
+      expect(JSON.stringify(error.value.document)).not.toContain("MY_SUPER_SECRET_VALUE");
+    } finally {
+      await rm(cwd, { recursive: true, force: true });
+    }
+  });
+
+  test("redacts a non-string edge_runtime.secrets value on the ProjectConfigParseError document", async () => {
+    const cwd = makeTempProject();
+    const tomlPath = await runConfigEffect(configTomlPath(cwd));
+
+    try {
+      await mkdir(join(cwd, "supabase"), { recursive: true });
+      // `FOO` is a TOML array, not a string — the schema decode for this
+      // entry fails, but the raw pre-decode value still carries
+      // `MY_SUPER_SECRET_VALUE` in plaintext. `redactEdgeRuntimeSecrets` must
+      // wrap the entry regardless of its shape, not just string entries.
+      await writeFile(
+        tomlPath,
+        `[analytics]
+port = "not-a-number"
+
+[edge_runtime.secrets]
+FOO = ["MY_SUPER_SECRET_VALUE"]
+`,
+      );
+
+      const exit = await Effect.runPromiseExit(
+        loadProjectConfigFile(tomlPath).pipe(Effect.provide(BunServices.layer)),
+      );
+
+      expect(Exit.isFailure(exit)).toBe(true);
+      if (!Exit.isFailure(exit)) {
+        return;
+      }
+      const error = Cause.findErrorOption(exit.cause);
+      expect(Option.isSome(error)).toBe(true);
+      if (!Option.isSome(error) || error.value._tag !== "ProjectConfigParseError") {
+        return;
+      }
+
+      const edgeRuntime = error.value.document?.edge_runtime;
+      const secrets =
+        edgeRuntime !== null && typeof edgeRuntime === "object" && edgeRuntime !== undefined
+          ? (edgeRuntime as Record<string, unknown>).secrets
+          : undefined;
+      expect(secrets).toBeDefined();
+      const foo = (secrets as Record<string, unknown>).FOO;
+      expect(Redacted.isRedacted(foo)).toBe(true);
+      expect(Redacted.value(foo as Redacted.Redacted<unknown>)).toEqual(["MY_SUPER_SECRET_VALUE"]);
+      expect(JSON.stringify(error.value.document)).not.toContain("MY_SUPER_SECRET_VALUE");
+    } finally {
+      await rm(cwd, { recursive: true, force: true });
+    }
+  });
+
+  test("redacts a non-object edge_runtime.secrets field on the ProjectConfigParseError document", async () => {
+    const cwd = makeTempProject();
+    const tomlPath = await runConfigEffect(configTomlPath(cwd));
+
+    try {
+      await mkdir(join(cwd, "supabase"), { recursive: true });
+      // `secrets` itself is a TOML array here, not a table — the whole field
+      // is malformed rather than a single entry inside it. `isObject` rejects
+      // arrays, so `redactEdgeRuntimeSecrets` must wrap the field as one unit
+      // instead of falling through its early-return and leaving it raw.
+      await writeFile(
+        tomlPath,
+        `[analytics]
+port = "not-a-number"
+
+[edge_runtime]
+secrets = ["MY_SUPER_SECRET_VALUE"]
+`,
+      );
+
+      const exit = await Effect.runPromiseExit(
+        loadProjectConfigFile(tomlPath).pipe(Effect.provide(BunServices.layer)),
+      );
+
+      expect(Exit.isFailure(exit)).toBe(true);
+      if (!Exit.isFailure(exit)) {
+        return;
+      }
+      const error = Cause.findErrorOption(exit.cause);
+      expect(Option.isSome(error)).toBe(true);
+      if (!Option.isSome(error) || error.value._tag !== "ProjectConfigParseError") {
+        return;
+      }
+
+      const edgeRuntime = error.value.document?.edge_runtime;
+      const secrets =
+        edgeRuntime !== null && typeof edgeRuntime === "object" && edgeRuntime !== undefined
+          ? (edgeRuntime as Record<string, unknown>).secrets
+          : undefined;
+      expect(Redacted.isRedacted(secrets)).toBe(true);
+      expect(Redacted.value(secrets as Redacted.Redacted<unknown>)).toEqual([
+        "MY_SUPER_SECRET_VALUE",
+      ]);
+      expect(JSON.stringify(error.value.document)).not.toContain("MY_SUPER_SECRET_VALUE");
+    } finally {
+      await rm(cwd, { recursive: true, force: true });
+    }
+  });
+
   test("preserves TOML as the active format on save", async () => {
     const cwd = makeTempProject();
     const tomlPath = await runConfigEffect(configTomlPath(cwd));
@@ -737,6 +991,128 @@ enabled = "env(SUPABASE_ANALYTICS_ENABLED)"
     }
   });
 
+  test.each([
+    ["1", true],
+    ["TRUE", true],
+    ["T", true],
+    ["True", true],
+    ["0", false],
+    ["f", false],
+    ["FALSE", false],
+  ] as const)(
+    "resolves env() on boolean fields using Go's strconv.ParseBool acceptance set (%s -> %s)",
+    async (envValue, expected) => {
+      const cwd = makeTempProject();
+
+      try {
+        await mkdir(join(cwd, "supabase"), { recursive: true });
+        await writeFile(
+          join(cwd, "supabase", "config.toml"),
+          `project_id = "ref_123"
+
+[analytics]
+enabled = "env(SUPABASE_ANALYTICS_ENABLED)"
+`,
+        );
+        await writeFile(join(cwd, "supabase", ".env"), `SUPABASE_ANALYTICS_ENABLED=${envValue}\n`);
+
+        const loaded = await runConfigEffect(loadProjectConfig(cwd));
+        expect(loaded!.config.analytics.enabled).toBe(expected);
+      } finally {
+        await rm(cwd, { recursive: true, force: true });
+      }
+    },
+  );
+
+  test("splits a comma-separated string literal into a slice (Go's StringToSliceHookFunc)", async () => {
+    // Go's `newDecodeHook` (`apps/cli-go/pkg/config/config.go:775-784`) wires
+    // `mapstructure.StringToSliceHookFunc(",")` unconditionally, so a plain
+    // string value for a `[]string` field like `additional_redirect_urls`
+    // decodes fine in Go — not just via `env(...)`.
+    const cwd = makeTempProject();
+
+    try {
+      await mkdir(join(cwd, "supabase"), { recursive: true });
+      await writeFile(
+        join(cwd, "supabase", "config.toml"),
+        `project_id = "ref_123"
+
+[auth]
+additional_redirect_urls = "http://a,http://b"
+`,
+      );
+
+      const loaded = await runConfigEffect(loadProjectConfig(cwd, { goViperCompat: true }));
+      expect(loaded!.config.auth.additional_redirect_urls).toEqual(["http://a", "http://b"]);
+    } finally {
+      await rm(cwd, { recursive: true, force: true });
+    }
+  });
+
+  test("splits an env()-substituted comma-separated string into a slice", async () => {
+    const cwd = makeTempProject();
+
+    try {
+      await mkdir(join(cwd, "supabase"), { recursive: true });
+      await writeFile(
+        join(cwd, "supabase", "config.toml"),
+        `project_id = "ref_123"
+
+[auth]
+additional_redirect_urls = "env(SUPABASE_REDIRECT_URLS)"
+`,
+      );
+      await writeFile(join(cwd, "supabase", ".env"), "SUPABASE_REDIRECT_URLS=http://a,http://b\n");
+
+      const loaded = await runConfigEffect(loadProjectConfig(cwd, { goViperCompat: true }));
+      expect(loaded!.config.auth.additional_redirect_urls).toEqual(["http://a", "http://b"]);
+    } finally {
+      await rm(cwd, { recursive: true, force: true });
+    }
+  });
+
+  test("an empty string literal for a slice field decodes to an empty array", async () => {
+    const cwd = makeTempProject();
+
+    try {
+      await mkdir(join(cwd, "supabase"), { recursive: true });
+      await writeFile(
+        join(cwd, "supabase", "config.toml"),
+        `project_id = "ref_123"
+
+[auth]
+additional_redirect_urls = ""
+`,
+      );
+
+      const loaded = await runConfigEffect(loadProjectConfig(cwd, { goViperCompat: true }));
+      expect(loaded!.config.auth.additional_redirect_urls).toEqual([]);
+    } finally {
+      await rm(cwd, { recursive: true, force: true });
+    }
+  });
+
+  test("an actual array value for a slice field is left untouched", async () => {
+    const cwd = makeTempProject();
+
+    try {
+      await mkdir(join(cwd, "supabase"), { recursive: true });
+      await writeFile(
+        join(cwd, "supabase", "config.toml"),
+        `project_id = "ref_123"
+
+[auth]
+additional_redirect_urls = ["http://a", "http://b"]
+`,
+      );
+
+      const loaded = await runConfigEffect(loadProjectConfig(cwd));
+      expect(loaded!.config.auth.additional_redirect_urls).toEqual(["http://a", "http://b"]);
+    } finally {
+      await rm(cwd, { recursive: true, force: true });
+    }
+  });
+
   test("preserves env() literals on string fields when the var is unset (Go parity)", async () => {
     const cwd = makeTempProject();
 
@@ -758,6 +1134,28 @@ jwt_secret = "env(MISSING_SECRET)"
     }
   });
 
+  test("preserves env() literals on string fields when the var is set but empty (Go parity)", async () => {
+    const cwd = makeTempProject();
+
+    try {
+      await mkdir(join(cwd, "supabase"), { recursive: true });
+      await writeFile(
+        join(cwd, "supabase", "config.toml"),
+        `project_id = "ref_123"
+
+[auth]
+jwt_secret = "env(MISSING_SECRET)"
+`,
+      );
+      await writeFile(join(cwd, "supabase", ".env"), "MISSING_SECRET=\n");
+
+      const loaded = await runConfigEffect(loadProjectConfig(cwd));
+      expect(loaded!.config.auth.jwt_secret).toBe("env(MISSING_SECRET)");
+    } finally {
+      await rm(cwd, { recursive: true, force: true });
+    }
+  });
+
   test("fails to decode a numeric field when env var is unset", async () => {
     const cwd = makeTempProject();
 
@@ -816,45 +1214,210 @@ port = "env(SUPABASE_DB_PORT_TEST)"
       await rm(cwd, { recursive: true, force: true });
     }
   });
-});
 
-describe("config io [remotes.*] merge", () => {
-  async function writeTomlProject(toml: string): Promise<string> {
+  // Regression coverage for the default-off (`goViperCompat` omitted) path —
+  // these pin pre-PR-#5765 behavior so `next/`, `packages/stack`, and the
+  // functions manifest (none of which pass `goViperCompat`) don't inherit the
+  // Go-parity legacy shell's stricter/wider semantics.
+  test("loads successfully with a duplicate [remotes.*] project_id when goViperCompat is omitted", async () => {
     const cwd = makeTempProject();
-    await mkdir(join(cwd, "supabase"), { recursive: true });
-    await writeFile(join(cwd, "supabase", "config.toml"), toml);
-    return cwd;
-  }
-
-  const BASE_WITH_REMOTES = `project_id = "baseref"
 
-[api]
-enabled = true
-schemas = ["public", "custom_base"]
-max_rows = 123
+    try {
+      await mkdir(join(cwd, "supabase"), { recursive: true });
+      await writeFile(
+        join(cwd, "supabase", "config.toml"),
+        `project_id = "baseref"
 
-[db]
-major_version = 15
+[remotes.a]
+project_id = "dupref"
 
-[remotes.preview]
-project_id = "previewref"
-[remotes.preview.api]
-schemas = ["remote_only"]
-max_rows = 999
+[remotes.b]
+project_id = "dupref"
+`,
+      );
 
-[remotes.staging]
-project_id = "stagingref"
-[remotes.staging.api]
-enabled = false
+      const loaded = await runConfigEffect(loadProjectConfig(cwd));
+      expect(loaded).not.toBeNull();
+      expect(loaded!.config.project_id).toBe("baseref");
+    } finally {
+      await rm(cwd, { recursive: true, force: true });
+    }
+  });
+
+  test("loads successfully with an invalid [remotes.*] project_id format when goViperCompat is omitted", async () => {
+    const cwd = makeTempProject();
+
+    try {
+      await mkdir(join(cwd, "supabase"), { recursive: true });
+      await writeFile(
+        join(cwd, "supabase", "config.toml"),
+        `project_id = "baseref"
+
+[remotes.bad]
+project_id = "not-a-ref"
+`,
+      );
+
+      const loaded = await runConfigEffect(loadProjectConfig(cwd));
+      expect(loaded).not.toBeNull();
+      expect(loaded!.config.project_id).toBe("baseref");
+    } finally {
+      await rm(cwd, { recursive: true, force: true });
+    }
+  });
+
+  test("does not split a comma-separated string literal for an array field when goViperCompat is omitted", async () => {
+    const cwd = makeTempProject();
+
+    try {
+      await mkdir(join(cwd, "supabase"), { recursive: true });
+      await writeFile(
+        join(cwd, "supabase", "config.toml"),
+        `project_id = "ref_123"
+
+[auth]
+additional_redirect_urls = "http://a,http://b"
+`,
+      );
+
+      const exit = await Effect.runPromiseExit(
+        loadProjectConfig(cwd).pipe(Effect.provide(BunServices.layer)),
+      );
+
+      expect(Exit.isFailure(exit)).toBe(true);
+      if (Exit.isFailure(exit)) {
+        const error = Cause.findErrorOption(exit.cause);
+        expect(Option.isSome(error)).toBe(true);
+        if (Option.isSome(error)) {
+          expect((error.value as { _tag: string })._tag).toBe("ProjectConfigParseError");
+        }
+      }
+    } finally {
+      await rm(cwd, { recursive: true, force: true });
+    }
+  });
+
+  test("does not warn on a deprecated provider (but still strips it) when goViperCompat is omitted", async () => {
+    const cwd = makeTempProject();
+    const warnings: Array<string> = [];
+    const errorSpy = vi.spyOn(console, "error").mockImplementation((...args) => {
+      warnings.push(args.map((a) => String(a)).join(" "));
+    });
+
+    try {
+      await mkdir(join(cwd, "supabase"), { recursive: true });
+      await writeFile(
+        join(cwd, "supabase", "config.toml"),
+        `project_id = "abc123"
+
+[auth.external.slack]
+enabled = true
+`,
+      );
+
+      const loaded = await runConfigEffect(loadProjectConfig(cwd));
+      expect("slack" in loaded!.config.auth.external).toBe(false);
+      expect(warnings.some((m) => m.includes("is deprecated"))).toBe(false);
+    } finally {
+      errorSpy.mockRestore();
+      await rm(cwd, { recursive: true, force: true });
+    }
+  });
+
+  test("does not resolve a lowercase-named env() reference when goViperCompat is omitted", async () => {
+    const previous = process.env.lowercase_ref_default_off_test;
+    process.env.lowercase_ref_default_off_test = "lowercase-ref-value";
+    const cwd = makeTempProject();
+
+    try {
+      await mkdir(join(cwd, "supabase"), { recursive: true });
+      await writeFile(
+        join(cwd, "supabase", "config.toml"),
+        `project_id = "env(lowercase_ref_default_off_test)"\n`,
+      );
+
+      const loaded = await runConfigEffect(loadProjectConfig(cwd));
+      expect(loaded!.config.project_id).toBe("env(lowercase_ref_default_off_test)");
+    } finally {
+      if (previous === undefined) {
+        delete process.env.lowercase_ref_default_off_test;
+      } else {
+        process.env.lowercase_ref_default_off_test = previous;
+      }
+      await rm(cwd, { recursive: true, force: true });
+    }
+  });
+
+  test("resolves a lowercase-named env() reference when goViperCompat is true", async () => {
+    const previous = process.env.lowercase_ref_default_on_test;
+    process.env.lowercase_ref_default_on_test = "lowercase-ref-value";
+    const cwd = makeTempProject();
+
+    try {
+      await mkdir(join(cwd, "supabase"), { recursive: true });
+      await writeFile(
+        join(cwd, "supabase", "config.toml"),
+        `project_id = "env(lowercase_ref_default_on_test)"\n`,
+      );
+
+      const loaded = await runConfigEffect(loadProjectConfig(cwd, { goViperCompat: true }));
+      expect(loaded!.config.project_id).toBe("lowercase-ref-value");
+    } finally {
+      if (previous === undefined) {
+        delete process.env.lowercase_ref_default_on_test;
+      } else {
+        process.env.lowercase_ref_default_on_test = previous;
+      }
+      await rm(cwd, { recursive: true, force: true });
+    }
+  });
+});
+
+describe("config io [remotes.*] merge", () => {
+  async function writeTomlProject(toml: string): Promise<string> {
+    const cwd = makeTempProject();
+    await mkdir(join(cwd, "supabase"), { recursive: true });
+    await writeFile(join(cwd, "supabase", "config.toml"), toml);
+    return cwd;
+  }
+
+  // Remote `project_id`s below are valid 20-lowercase-letter refs (Go's
+  // `refPattern`, `config.go:558`) — `Config.Validate` rejects every
+  // `[remotes.*].project_id` against that pattern unconditionally on every
+  // config load (`config.go:996-1001`), so test fixtures must satisfy it too,
+  // even for scenarios that don't care about the ref's specific value.
+  const PREVIEW_REF = "previewrefaaaaaaaaaa";
+  const STAGING_REF = "stagingrefaaaaaaaaaa";
+
+  const BASE_WITH_REMOTES = `project_id = "baseref"
+
+[api]
+enabled = true
+schemas = ["public", "custom_base"]
+max_rows = 123
+
+[db]
+major_version = 15
+
+[remotes.preview]
+project_id = "${PREVIEW_REF}"
+[remotes.preview.api]
+schemas = ["remote_only"]
+max_rows = 999
+
+[remotes.staging]
+project_id = "${STAGING_REF}"
+[remotes.staging.api]
+enabled = false
 `;
 
   test("merges the matching remote subtree over the base before decode", async () => {
     const cwd = await writeTomlProject(BASE_WITH_REMOTES);
     try {
-      const loaded = await runConfigEffect(loadProjectConfig(cwd, { projectRef: "previewref" }));
+      const loaded = await runConfigEffect(loadProjectConfig(cwd, { projectRef: PREVIEW_REF }));
       expect(loaded!.appliedRemote).toBe("preview");
       // remote block's project_id overrides the base
-      expect(loaded!.config.project_id).toBe("previewref");
+      expect(loaded!.config.project_id).toBe(PREVIEW_REF);
       // remote scalar wins
       expect(loaded!.config.api.max_rows).toBe(999);
       // array replaced wholesale (not element-merged)
@@ -870,6 +1433,38 @@ enabled = false
     }
   });
 
+  test("carries appliedRemote on ProjectConfigParseError when the matched remote's decode fails", async () => {
+    // Go prints `Loading config override: [remotes.<name>]` unconditionally
+    // as soon as the `project_id` match is found, *before* `mapstructure`
+    // decode runs (`apps/cli-go/pkg/config/config.go:604-609`) — so the notice
+    // is still owed even when the decode that follows fails. `db.major_version`
+    // is an unrelated schema-decode error; the remote merge must still have
+    // happened (and be reported) ahead of it.
+    const cwd = await writeTomlProject(
+      `${BASE_WITH_REMOTES}
+[remotes.preview.db]
+major_version = "not-a-number"
+`,
+    );
+    try {
+      const exit = await Effect.runPromiseExit(
+        loadProjectConfig(cwd, { projectRef: PREVIEW_REF }).pipe(Effect.provide(BunServices.layer)),
+      );
+      expect(Exit.isFailure(exit)).toBe(true);
+      if (!Exit.isFailure(exit)) {
+        return;
+      }
+      const error = Cause.findErrorOption(exit.cause);
+      expect(Option.isSome(error)).toBe(true);
+      if (!Option.isSome(error) || error.value._tag !== "ProjectConfigParseError") {
+        return;
+      }
+      expect(error.value.appliedRemote).toBe("preview");
+    } finally {
+      await rm(cwd, { recursive: true, force: true });
+    }
+  });
+
   test("loads the base config verbatim when no remote matches", async () => {
     const cwd = await writeTomlProject(BASE_WITH_REMOTES);
     try {
@@ -883,7 +1478,10 @@ enabled = false
     }
   });
 
-  test("does not merge remotes when no projectRef is requested", async () => {
+  test("does not merge remotes when no projectRef is requested and none has an empty project_id", async () => {
+    // `projectRef` defaults to "" (Go's own `Config.ProjectId` default for
+    // commands with no `--project-ref` flag), so this only stays unmerged
+    // because neither remote's `project_id` is empty.
     const cwd = await writeTomlProject(BASE_WITH_REMOTES);
     try {
       const loaded = await runConfigEffect(loadProjectConfig(cwd));
@@ -895,6 +1493,42 @@ enabled = false
     }
   });
 
+  test("rejects duplicate project_id across remotes even when no projectRef is requested", async () => {
+    // Go's duplicate-project_id check (config.go:594-602) runs unconditionally
+    // on every config load, inside the same loop that resolves the [remotes.*]
+    // override — it is not gated on a caller actually selecting a remote.
+    // status/stop (internal/utils/flags/config_path.go:11) never bind a
+    // `--project-ref` flag, so they hit this check with `Config.ProjectId == ""`,
+    // and it must still fail on a config-wide duplicate.
+    const cwd = await writeTomlProject(`project_id = "baseref"
+
+[remotes.a]
+project_id = "dupref"
+
+[remotes.b]
+project_id = "dupref"
+`);
+    try {
+      const message = await Effect.runPromise(
+        loadProjectConfig(cwd, { goViperCompat: true }).pipe(
+          Effect.catchTag("DuplicateRemoteProjectIdError", (error) =>
+            Effect.succeed(error.message),
+          ),
+          Effect.provide(BunServices.layer),
+        ),
+      );
+      expect(message).toBe("duplicate project_id for [remotes.b] and [remotes.a]");
+    } finally {
+      await rm(cwd, { recursive: true, force: true });
+    }
+  });
+
+  // `goViperCompat` is required even though a `projectRef` is passed: the
+  // duplicate/format checks in `applyRemoteOverride` are gated solely on
+  // `goViperCompat`, not on whether a remote is being selected — the remote
+  // match/merge itself stays unconditional, but pre-PR-#5765 callers that
+  // pass a `projectRef` without opting into Go parity no longer get these
+  // checks for free.
   test("rejects duplicate project_id across remotes with Go's message", async () => {
     const cwd = await writeTomlProject(`project_id = "baseref"
 
@@ -906,7 +1540,7 @@ project_id = "dupref"
 `);
     try {
       const message = await Effect.runPromise(
-        loadProjectConfig(cwd, { projectRef: "dupref" }).pipe(
+        loadProjectConfig(cwd, { projectRef: "dupref", goViperCompat: true }).pipe(
           Effect.catchTag("DuplicateRemoteProjectIdError", (error) =>
             Effect.succeed(error.message),
           ),
@@ -936,7 +1570,7 @@ project_id = "dupref"
 `);
     try {
       const message = await Effect.runPromise(
-        loadProjectConfig(cwd, { projectRef: "previewref" }).pipe(
+        loadProjectConfig(cwd, { projectRef: "previewref", goViperCompat: true }).pipe(
           Effect.catchTag("DuplicateRemoteProjectIdError", (error) =>
             Effect.succeed(error.message),
           ),
@@ -964,7 +1598,7 @@ max_rows = 2
 `);
     try {
       const message = await Effect.runPromise(
-        loadProjectConfig(cwd, { projectRef: "previewref" }).pipe(
+        loadProjectConfig(cwd, { projectRef: "previewref", goViperCompat: true }).pipe(
           Effect.catchTag("DuplicateRemoteProjectIdError", (error) =>
             Effect.succeed(error.message),
           ),
@@ -977,16 +1611,41 @@ max_rows = 2
     }
   });
 
+  test("rejects a remote project_id that is not a valid 20-letter ref, even with no projectRef requested", async () => {
+    // Go's Config.Validate (config.go:996-1001) checks every [remotes.*].project_id
+    // against refPattern unconditionally on every config load — not only the one
+    // that ends up selected — so this must fail closed before status/stop reach
+    // Docker, exactly like Go, even when the caller never selects a remote.
+    const cwd = await writeTomlProject(`project_id = "baseref"
+
+[remotes.bad]
+project_id = "not-a-ref"
+`);
+    try {
+      const message = await Effect.runPromise(
+        loadProjectConfig(cwd, { goViperCompat: true }).pipe(
+          Effect.catchTag("InvalidRemoteProjectIdError", (error) => Effect.succeed(error.message)),
+          Effect.provide(BunServices.layer),
+        ),
+      );
+      expect(message).toBe(
+        "Invalid config for remotes.bad.project_id. Must be like: abcdefghijklmnopqrst",
+      );
+    } finally {
+      await rm(cwd, { recursive: true, force: true });
+    }
+  });
+
   test("the merged document carries pointer sections introduced by the remote", async () => {
     const cwd = await writeTomlProject(`project_id = "baseref"
 
 [remotes.preview]
-project_id = "previewref"
+project_id = "${PREVIEW_REF}"
 [remotes.preview.db.ssl_enforcement]
 enabled = true
 `);
     try {
-      const loaded = await runConfigEffect(loadProjectConfig(cwd, { projectRef: "previewref" }));
+      const loaded = await runConfigEffect(loadProjectConfig(cwd, { projectRef: PREVIEW_REF }));
       // `legacyPresenceIn` reads `document` to detect optional pointer sections;
       // a remote-introduced `db.ssl_enforcement` must be present there.
       const db = loaded!.document?.db;
@@ -1003,12 +1662,12 @@ enabled = true
 enabled = true
 
 [remotes.preview]
-project_id = "previewref"
+project_id = "${PREVIEW_REF}"
 [remotes.preview.api]
 max_rows = 5
 `);
     try {
-      const loaded = await runConfigEffect(loadProjectConfig(cwd, { projectRef: "previewref" }));
+      const loaded = await runConfigEffect(loadProjectConfig(cwd, { projectRef: PREVIEW_REF }));
       expect(loaded!.config.db.seed.enabled).toBe(false);
     } finally {
       await rm(cwd, { recursive: true, force: true });
@@ -1019,18 +1678,103 @@ max_rows = 5
     const cwd = await writeTomlProject(`project_id = "baseref"
 
 [remotes.preview]
-project_id = "previewref"
+project_id = "${PREVIEW_REF}"
 [remotes.preview.db.seed]
 enabled = true
 `);
     try {
-      const loaded = await runConfigEffect(loadProjectConfig(cwd, { projectRef: "previewref" }));
+      const loaded = await runConfigEffect(loadProjectConfig(cwd, { projectRef: PREVIEW_REF }));
       expect(loaded!.config.db.seed.enabled).toBe(true);
     } finally {
       await rm(cwd, { recursive: true, force: true });
     }
   });
 
+  test("resolves env() on a lowercase-named variable, matching Go's case-agnostic matcher", async () => {
+    // Go's `LoadEnvHook` (`apps/cli-go/pkg/config/decode_hooks.go:11`) is
+    // `^env\((.*)\)$` — it doesn't restrict the captured name's case, so
+    // `project_id = "env(project_id)"` resolves against a same-case env var
+    // in the Go CLI. This isn't specific to `project_id`; any string field
+    // goes through the same pre-decode walk. This case-agnostic matching is
+    // itself one of the four Go-viper-parity behaviors gated by
+    // `goViperCompat` — without it, the strict SCREAMING_SNAKE_CASE matcher
+    // wouldn't match this lowercase name at all.
+    const previous = process.env.project_id;
+    process.env.project_id = "lowercase-ref";
+    const cwd = await writeTomlProject(`project_id = "env(project_id)"\n`);
+    try {
+      const loaded = await runConfigEffect(loadProjectConfig(cwd, { goViperCompat: true }));
+      expect(loaded!.config.project_id).toBe("lowercase-ref");
+    } finally {
+      if (previous === undefined) {
+        delete process.env.project_id;
+      } else {
+        process.env.project_id = previous;
+      }
+      await rm(cwd, { recursive: true, force: true });
+    }
+  });
+
+  test("does not match a remote whose project_id is env(REF) against the resolved ref (Go parity)", async () => {
+    // Go's `loadFromFile` duplicate-check/selection loop reads viper's RAW
+    // string values (`config.go:596-610`) and only calls `c.load(v)` — which
+    // resolves `env(...)` via `LoadEnvHook` — afterward (`config.go:611`,
+    // `decode_hooks.go:13-26`). So a `[remotes.x] project_id = "env(REF)"`
+    // never matches a caller-supplied, already-resolved `REF`: Go compares the
+    // literal `env(REF)` string, not what it resolves to.
+    const previous = process.env.SUPABASE_REMOTE_ENV_REF_TEST;
+    process.env.SUPABASE_REMOTE_ENV_REF_TEST = PREVIEW_REF;
+    const cwd = await writeTomlProject(`project_id = "baseref"
+
+[api]
+max_rows = 1
+
+[remotes.preview]
+project_id = "env(SUPABASE_REMOTE_ENV_REF_TEST)"
+[remotes.preview.api]
+max_rows = 999
+`);
+    try {
+      const loaded = await runConfigEffect(loadProjectConfig(cwd, { projectRef: PREVIEW_REF }));
+      expect(loaded!.appliedRemote).toBeUndefined();
+      expect(loaded!.config.api.max_rows).toBe(1);
+    } finally {
+      if (previous === undefined) {
+        delete process.env.SUPABASE_REMOTE_ENV_REF_TEST;
+      } else {
+        process.env.SUPABASE_REMOTE_ENV_REF_TEST = previous;
+      }
+      await rm(cwd, { recursive: true, force: true });
+    }
+  });
+
+  test("validates a remote's env(REF) project_id format against its resolved value, not the literal", async () => {
+    // Go's `Config.Validate` (`config.go:989-1001`) runs entirely after the
+    // struct decode, by which point `LoadEnvHook` has already resolved
+    // `env(...)` — so it validates the RESOLVED project_id against the
+    // 20-lowercase-letter pattern, not the literal `env(REF)` string (which
+    // would never match the pattern itself).
+    const previous = process.env.SUPABASE_REMOTE_ENV_REF_FORMAT_TEST;
+    process.env.SUPABASE_REMOTE_ENV_REF_FORMAT_TEST = PREVIEW_REF;
+    const cwd = await writeTomlProject(`project_id = "baseref"
+
+[remotes.preview]
+project_id = "env(SUPABASE_REMOTE_ENV_REF_FORMAT_TEST)"
+`);
+    try {
+      const loaded = await runConfigEffect(loadProjectConfig(cwd));
+      expect(loaded!.appliedRemote).toBeUndefined();
+      expect(loaded!.config.project_id).toBe("baseref");
+    } finally {
+      if (previous === undefined) {
+        delete process.env.SUPABASE_REMOTE_ENV_REF_FORMAT_TEST;
+      } else {
+        process.env.SUPABASE_REMOTE_ENV_REF_FORMAT_TEST = previous;
+      }
+      await rm(cwd, { recursive: true, force: true });
+    }
+  });
+
   test("resolves env() references inside the matching remote before merge", async () => {
     const previous = process.env.SUPABASE_REMOTE_MAX_ROWS_TEST;
     process.env.SUPABASE_REMOTE_MAX_ROWS_TEST = "777";
@@ -1040,12 +1784,12 @@ enabled = true
 max_rows = 1
 
 [remotes.preview]
-project_id = "previewref"
+project_id = "${PREVIEW_REF}"
 [remotes.preview.api]
 max_rows = "env(SUPABASE_REMOTE_MAX_ROWS_TEST)"
 `);
     try {
-      const loaded = await runConfigEffect(loadProjectConfig(cwd, { projectRef: "previewref" }));
+      const loaded = await runConfigEffect(loadProjectConfig(cwd, { projectRef: PREVIEW_REF }));
       expect(loaded!.config.api.max_rows).toBe(777);
     } finally {
       if (previous === undefined) {
@@ -1056,6 +1800,81 @@ max_rows = "env(SUPABASE_REMOTE_MAX_ROWS_TEST)"
       await rm(cwd, { recursive: true, force: true });
     }
   });
+
+  // Go's `Config.Validate` only checks `remotes.*.project_id` format for
+  // every remote (`config.go:996-1001`, "Since remote config is merged to
+  // base, we only need to validate the project_id field") — every other
+  // business-rule check (`Auth.External.validate()`, etc.) runs exactly once,
+  // against the merged effective config (`config.go:1136-1152`), never
+  // iterated over `c.Remotes[*]`. A non-selected `[remotes.*]` block's own
+  // business-rule violations must not fail the whole config load.
+  test("loads an unselected remote whose external provider is enabled without a secret", async () => {
+    const cwd = await writeTomlProject(
+      `project_id = "baseref"
+
+[remotes.staging]
+project_id = "${STAGING_REF}"
+
+[remotes.staging.auth.external.github]
+enabled = true
+`,
+    );
+    try {
+      // No projectRef requested, so [remotes.staging] is never selected/merged —
+      // Go would never business-rule-validate it, even though it decodes fine
+      // structurally.
+      const loaded = await runConfigEffect(loadProjectConfig(cwd));
+      expect(loaded!.appliedRemote).toBeUndefined();
+      expect(loaded!.config.remotes.staging?.auth.external.github.enabled).toBe(true);
+    } finally {
+      await rm(cwd, { recursive: true, force: true });
+    }
+  });
+
+  test("still validates the same remote's external provider once it is selected", async () => {
+    const cwd = await writeTomlProject(
+      `project_id = "baseref"
+
+[remotes.staging]
+project_id = "${STAGING_REF}"
+
+[remotes.staging.auth.external.github]
+enabled = true
+`,
+    );
+    try {
+      // Selecting [remotes.staging] merges it into the effective config, which
+      // Go DOES business-rule-validate (config.go:1136-1152) — a required
+      // `client_id`/`secret` is missing, so this must still fail.
+      const exit = await Effect.runPromiseExit(
+        loadProjectConfig(cwd, { projectRef: STAGING_REF }).pipe(Effect.provide(BunServices.layer)),
+      );
+      expect(Exit.isFailure(exit)).toBe(true);
+    } finally {
+      await rm(cwd, { recursive: true, force: true });
+    }
+  });
+
+  test("still fails on a structurally malformed value inside an unselected remote", async () => {
+    // Go's `UnmarshalExact` always structurally decodes every remote
+    // (`config.go:246,749-756`) regardless of selection — only the
+    // merged-config-only business rules are skipped for a non-selected
+    // remote, not type/shape decoding.
+    const cwd = await writeTomlProject(
+      `${BASE_WITH_REMOTES}
+[remotes.staging.db]
+major_version = "not-a-number"
+`,
+    );
+    try {
+      const exit = await Effect.runPromiseExit(
+        loadProjectConfig(cwd).pipe(Effect.provide(BunServices.layer)),
+      );
+      expect(Exit.isFailure(exit)).toBe(true);
+    } finally {
+      await rm(cwd, { recursive: true, force: true });
+    }
+  });
 });
 
 describe("config io deprecated [inbucket] back-compat", () => {
@@ -1155,7 +1974,7 @@ port = 22222
       `project_id = "abc123"
 
 [remotes.staging]
-project_id = "stagingref"
+project_id = "stagingrefaaaaaaaaaa"
 
 [remotes.staging.inbucket]
 enabled = true
@@ -1190,3 +2009,124 @@ port = 54324
     expect(warnings.some((m) => m.includes("is deprecated"))).toBe(false);
   });
 });
+
+describe("config io deprecated [auth.external.{linkedin,slack}] back-compat", () => {
+  let warnings: Array<string> = [];
+  let errorSpy: ReturnType<typeof vi.spyOn> | undefined;
+
+  function captureWarnings() {
+    warnings = [];
+    errorSpy = vi.spyOn(console, "error").mockImplementation((...args) => {
+      warnings.push(args.map((a) => String(a)).join(" "));
+    });
+  }
+
+  afterEach(() => {
+    errorSpy?.mockRestore();
+    errorSpy = undefined;
+  });
+
+  async function loadToml(contents: string, options?: LoadProjectConfigOptions) {
+    const cwd = makeTempProject();
+    const path = await runConfigEffect(configTomlPath(cwd));
+    await mkdir(join(cwd, "supabase"), { recursive: true });
+    await writeFile(path, contents);
+    try {
+      return await runConfigEffect(loadProjectConfigFile(path, options));
+    } finally {
+      await rm(cwd, { recursive: true, force: true });
+    }
+  }
+
+  test("loads a bare [auth.external.slack] block without required fields", async () => {
+    captureWarnings();
+    const loaded = await loadToml(
+      `project_id = "abc123"
+
+[auth.external.slack]
+enabled = true
+`,
+      { goViperCompat: true },
+    );
+
+    expect("slack" in loaded.config.auth.external).toBe(false);
+    expect(loaded.document).not.toHaveProperty("auth.external.slack");
+    expect(
+      warnings.some((m) =>
+        m.includes(
+          'WARN: disabling deprecated "slack" provider. Please use [auth.external.slack_oidc] instead',
+        ),
+      ),
+    ).toBe(true);
+  });
+
+  test("loads a bare [auth.external.linkedin] block without required fields", async () => {
+    captureWarnings();
+    const loaded = await loadToml(
+      `project_id = "abc123"
+
+[auth.external.linkedin]
+enabled = true
+`,
+      { goViperCompat: true },
+    );
+
+    expect("linkedin" in loaded.config.auth.external).toBe(false);
+    expect(
+      warnings.some((m) =>
+        m.includes(
+          'WARN: disabling deprecated "linkedin" provider. Please use [auth.external.linkedin_oidc] instead',
+        ),
+      ),
+    ).toBe(true);
+  });
+
+  test("does not warn when the deprecated section is present but disabled", async () => {
+    captureWarnings();
+    const loaded = await loadToml(
+      `project_id = "abc123"
+
+[auth.external.slack]
+enabled = false
+`,
+    );
+
+    expect("slack" in loaded.config.auth.external).toBe(false);
+    expect(warnings.some((m) => m.includes("is deprecated"))).toBe(false);
+  });
+
+  test("does not warn when only [auth.external.slack_oidc] is used", async () => {
+    captureWarnings();
+    const loaded = await loadToml(
+      `project_id = "abc123"
+
+[auth.external.slack_oidc]
+enabled = true
+client_id = "abc"
+secret = "shh"
+`,
+    );
+
+    expect(loaded.config.auth.external.slack_oidc.enabled).toBe(true);
+    expect(warnings.some((m) => m.includes("is deprecated"))).toBe(false);
+  });
+
+  test("strips a deprecated [remotes.*.auth.external.slack] block without warning for an unselected remote", async () => {
+    captureWarnings();
+    const loaded = await loadToml(
+      `project_id = "abc123"
+
+[remotes.staging]
+project_id = "stagingrefaaaaaaaaaa"
+
+[remotes.staging.auth.external.slack]
+enabled = true
+`,
+    );
+
+    // Not requesting `projectRef` means no remote is selected, so `remotes` survives
+    // decode verbatim (minus the deprecated key) rather than being merged/dropped.
+    expect(loaded.config.remotes.staging?.auth.external).not.toHaveProperty("slack");
+    expect(warnings.some((m) => m.includes("is deprecated"))).toBe(false);
+  });
+});
diff --git a/packages/config/src/lib/env.ts b/packages/config/src/lib/env.ts
index bd16819293..23a0c30056 100644
--- a/packages/config/src/lib/env.ts
+++ b/packages/config/src/lib/env.ts
@@ -1,11 +1,22 @@
 import { Schema, SchemaAST } from "effect";
 
-export const ENV_PATTERN = "^env\\([A-Z_][A-Z0-9_]*\\)$";
-export const ENV_CAPTURE_REGEX = /^env\(([A-Z_][A-Z0-9_]*)\)$/;
+// Go's `LoadEnvHook` matcher (`apps/cli-go/pkg/config/decode_hooks.go:11`) is
+// `^env\((.*)\)$` — permissive on the captured name's case/content, and
+// reused verbatim for secrets (`secret.go:99`) and the unset-var warning
+// (`config.go:1195`). Matching that exactly (not an uppercase-only
+// restriction) so e.g. `project_id = "env(project_id)"` substitutes the same
+// way it does in the Go CLI.
+export const ENV_PATTERN = "^env\\((.*)\\)$";
+export const ENV_CAPTURE_REGEX = /^env\((.*)\)$/;
+// Pre-PR-#5765 strict matcher: SCREAMING_SNAKE_CASE names only. Selected when
+// `goViperCompat` is off so non-Go-parity surfaces (next/, packages/stack, the
+// functions manifest) keep the narrower matching they had before PR #5765
+// widened env() resolution to Go's case-agnostic `^env\((.*)\)$`.
+export const ENV_CAPTURE_REGEX_STRICT = /^env\(([A-Z_][A-Z0-9_]*)\)$/;
 const envRegex = new RegExp(ENV_PATTERN);
 
-export function isEnvReference(value: string): boolean {
-  return envRegex.test(value);
+export function isEnvReference(value: string, goViperCompat: boolean): boolean {
+  return (goViperCompat ? ENV_CAPTURE_REGEX : ENV_CAPTURE_REGEX_STRICT).test(value);
 }
 
 interface EnvAnnotations extends Schema.Annotations.Documentation<string> {
@@ -52,12 +63,29 @@ export const secret = (annotations?: SecretAnnotations) =>
 //     and the value is still a string, coerce it. This mirrors Go's
 //     mapstructure chain where `LoadEnvHook` returns a string and subsequent
 //     hooks convert it to the target type.
-//   - Coercion is only attempted on strings produced by env() substitution.
-//     Pre-existing string literals at non-string paths are left untouched —
-//     they'll surface as schema errors at decode time with their original
-//     value, preserving error clarity.
+//   - Number/boolean coercion is only attempted on strings produced by env()
+//     substitution. Pre-existing string literals at non-string paths are left
+//     untouched — they'll surface as schema errors at decode time with their
+//     original value, preserving error clarity.
+//   - Array coercion is the one exception: if the schema at that path expects
+//     a homogeneous string array, ANY string leaf (substituted or a plain
+//     literal) is split on `,` — mirroring Go's `StringToSliceHookFunc(",")`
+//     (`apps/cli-go/pkg/config/config.go:775-784`), which is wired
+//     unconditionally into the decode hook chain regardless of where the
+//     string came from (e.g. `additional_redirect_urls = "http://a,http://b"`
+//     decodes fine in Go today, not just via `env(...)`).
 
-type ExpectedType = "number" | "boolean" | "string" | "unknown";
+type ExpectedType = "number" | "boolean" | "string" | "array" | "unknown";
+
+// Go decodes an env()-substituted boolean via mapstructure's weakly-typed
+// `decodeBool`, which runs `strconv.ParseBool` on the string — a wider
+// acceptance set than the literal `"true"`/`"false"` this module used to
+// require. Mirrors `legacyParseGoBool`'s `GO_BOOL_TRUE`/`GO_BOOL_FALSE`
+// (`apps/cli/src/legacy/shared/legacy-db-config.toml-read.ts:615-616`);
+// duplicated here (not imported) so `packages/config` doesn't depend on
+// `apps/cli`.
+const GO_BOOL_TRUE = new Set(["1", "t", "T", "TRUE", "true", "True"]);
+const GO_BOOL_FALSE = new Set(["0", "f", "F", "FALSE", "false", "False", ""]);
 
 // Unwrap Suspend (lazy AST refs from recursive schemas). Other transformation
 // wrappers expose the target type via `.ast` directly, so no additional
@@ -69,6 +97,20 @@ function unwrapAst(ast: SchemaAST.AST): SchemaAST.AST {
   return ast;
 }
 
+// A homogeneous `Schema.Array(Schema.String)` compiles to an `Arrays` AST
+// node with no fixed tuple `elements` and a single `rest` spread type. Only
+// this shape (not a fixed string tuple, and not a mixed-type array) is
+// eligible for Go's `StringToSliceHookFunc(",")` coercion below — mirroring
+// that Go itself only wires the hook for `[]string`-kind targets
+// (`apps/cli-go/pkg/config/config.go:775-784`), not fixed-arity tuples.
+function isHomogeneousStringArray(node: SchemaAST.AST): boolean {
+  if (node._tag !== "Arrays" || node.elements.length !== 0 || node.rest.length !== 1) {
+    return false;
+  }
+  const spread = node.rest[0];
+  return spread !== undefined && unwrapAst(spread)._tag === "String";
+}
+
 function leafExpectedType(ast: SchemaAST.AST): ExpectedType {
   const node = unwrapAst(ast);
   switch (node._tag) {
@@ -78,6 +120,8 @@ function leafExpectedType(ast: SchemaAST.AST): ExpectedType {
       return "boolean";
     case "String":
       return "string";
+    case "Arrays":
+      return isHomogeneousStringArray(node) ? "array" : "unknown";
     case "Union": {
       // Walk Union branches in declared order; first concrete primitive wins.
       // For unions like `Schema.Union(Schema.Number, Schema.Null)` this picks
@@ -156,23 +200,39 @@ function coerceLeaf(value: unknown, expected: ExpectedType): unknown {
     return value;
   }
   if (expected === "boolean") {
-    if (value === "true") return true;
-    if (value === "false") return false;
+    if (GO_BOOL_TRUE.has(value)) return true;
+    if (GO_BOOL_FALSE.has(value)) return false;
     return value;
   }
+  if (expected === "array") {
+    // Go's `mapstructure.StringToSliceHookFunc(",")` (wired in
+    // `apps/cli-go/pkg/config/config.go:775-784`): an empty string decodes to
+    // an empty slice, otherwise the string is split on the separator with no
+    // further trimming of the resulting elements.
+    return value === "" ? [] : value.split(",");
+  }
   return value;
 }
 
-function substituteEnvLeaf(value: string, env: Readonly<Record<string, string>>): string {
-  const match = ENV_CAPTURE_REGEX.exec(value);
+function substituteEnvLeaf(
+  value: string,
+  env: Readonly<Record<string, string>>,
+  goViperCompat: boolean,
+): string {
+  const match = (goViperCompat ? ENV_CAPTURE_REGEX : ENV_CAPTURE_REGEX_STRICT).exec(value);
   if (match === null) {
     return value;
   }
   const envName = match[1];
-  if (envName === undefined || !Object.prototype.hasOwnProperty.call(env, envName)) {
+  const resolved = envName === undefined ? undefined : env[envName];
+  // Go's LoadEnvHook only substitutes when the env var is non-empty
+  // (`apps/cli-go/pkg/config/decode_hooks.go:19-24`: `len(env) > 0`), so a
+  // key that's present but empty (e.g. a dotenv `KEY=` line) preserves the
+  // `env(KEY)` literal exactly like an unset key, rather than substituting "".
+  if (resolved === undefined || resolved === "") {
     return value;
   }
-  return env[envName] ?? value;
+  return resolved;
 }
 
 function isDeferredEnvField(ast: SchemaAST.AST): boolean {
@@ -196,11 +256,12 @@ function walk(
   document: unknown,
   env: Readonly<Record<string, string>>,
   ast: SchemaAST.AST | null,
+  goViperCompat: boolean,
 ): unknown {
   if (Array.isArray(document)) {
     return document.map((item, index) => {
       const child = ast === null ? null : descendAst(ast, String(index));
-      return walk(item, env, child);
+      return walk(item, env, child, goViperCompat);
     });
   }
 
@@ -208,7 +269,7 @@ function walk(
     const result: Record<string, unknown> = {};
     for (const [key, value] of Object.entries(document)) {
       const child = ast === null ? null : descendAst(ast, key);
-      result[key] = walk(value, env, child);
+      result[key] = walk(value, env, child, goViperCompat);
     }
     return result;
   }
@@ -220,18 +281,37 @@ function walk(
     if (ast !== null && isDeferredEnvField(ast)) {
       return document;
     }
+
+    const substituted = substituteEnvLeaf(document, env, goViperCompat);
+    const expected = ast === null ? "unknown" : leafExpectedType(ast);
+
+    // Go's `StringToSliceHookFunc(",")` (`apps/cli-go/pkg/config/config.go:
+    // 775-784`) is wired unconditionally into `v.UnmarshalExact`'s decode
+    // hook chain, so it splits ANY string being decoded into a `[]string`
+    // field — a plain TOML literal (`additional_redirect_urls = "a,b"`) just
+    // as much as an `env()`-substituted one. Unlike the number/boolean
+    // coercion below (scoped to substituted values only, since TOML already
+    // decodes literal numbers/booleans to their native type), array coercion
+    // must also apply to literal strings that never went through
+    // `substituteEnvLeaf`. Gated by `goViperCompat`: when off, the string is
+    // left unsplit — literal and substituted alike — so an array-typed field
+    // fed a string fails decode instead of silently coercing, matching
+    // pre-PR-#5765 behavior.
+    if (expected === "array") {
+      return goViperCompat ? coerceLeaf(substituted, expected) : substituted;
+    }
+
     // Substitute env() then coerce based on the schema's expected type at this
     // path. Only the substituted form is fed to coercion — literal strings at
     // non-string paths are left untouched so the decoder can report them with
     // their original value.
-    const substituted = substituteEnvLeaf(document, env);
     if (substituted === document) {
       return document;
     }
     if (ast === null) {
       return substituted;
     }
-    return coerceLeaf(substituted, leafExpectedType(ast));
+    return coerceLeaf(substituted, expected);
   }
 
   return document;
@@ -242,8 +322,11 @@ function walk(
  *
  * Walks the raw parsed document and the schema AST in parallel. For every
  * string leaf matching `env(VAR)`:
- *   1. Substitutes `env[VAR]` if set, else preserves the literal verbatim
- *      (Go-parity with `apps/cli-go/pkg/config/decode_hooks.go:14-21`).
+ *   1. Substitutes `env[VAR]` if set AND non-empty, else preserves the
+ *      literal verbatim (Go-parity with
+ *      `apps/cli-go/pkg/config/decode_hooks.go:14-21`, which gates on
+ *      `len(env) > 0` — a set-but-empty var, e.g. a dotenv `KEY=` line,
+ *      leaves the `env(KEY)` literal untouched just like an unset one).
  *   2. If the schema at that path expects Number or Boolean, coerces the
  *      substituted string to the expected primitive — mirroring Go's
  *      mapstructure chain where `LoadEnvHook` returns a string that the next
@@ -255,6 +338,7 @@ export function interpolateEnvReferencesAgainstSchema(
   document: unknown,
   env: Readonly<Record<string, string>>,
   schema: { readonly ast: SchemaAST.AST },
+  options?: { readonly goViperCompat?: boolean },
 ): unknown {
-  return walk(document, env, schema.ast);
+  return walk(document, env, schema.ast, options?.goViperCompat ?? false);
 }
diff --git a/packages/config/src/paths.ts b/packages/config/src/paths.ts
index e41017793d..bf29f44dcc 100644
--- a/packages/config/src/paths.ts
+++ b/packages/config/src/paths.ts
@@ -31,10 +31,41 @@ const findConfigInRoot = Effect.fnUntraced(function* (root: string) {
   } satisfies ProjectPaths;
 });
 
-export const findProjectPaths = Effect.fnUntraced(function* (cwd: string) {
+export interface FindProjectPathsOptions {
+  /**
+   * When `false`, only `cwd` itself is checked for `supabase/config.{json,toml}` —
+   * no ancestor climb. Go's own resolution never searches twice: an explicit
+   * `--workdir`/`SUPABASE_WORKDIR` is used exactly as given (`ChangeWorkDir`,
+   * `apps/cli-go/internal/utils/misc.go:231-247`), and once `os.Chdir`'d there,
+   * `config.toml` is read as a plain relative path with no further ancestor
+   * search (`NewPathBuilder`, `pkg/config/utils.go:43-48`). Ancestor climbing in
+   * Go only ever happens once, as the *default* when workdir is unset
+   * (`getProjectRoot`, `internal/utils/misc.go:209-224`).
+   *
+   * Callers that already hold an authoritative, Go-equivalent project root
+   * (e.g. the legacy `stop`/`status` ports' `cliConfig.workdir`, which mirrors
+   * `ChangeWorkDir`'s own explicit-vs-default resolution) should pass `false`
+   * here to avoid a second, un-Go-like ancestor search that could otherwise
+   * pick up an unrelated ancestor project's config.
+   *
+   * Defaults to `true` (the original ancestor-search behavior), so existing
+   * callers are unaffected.
+   */
+  readonly search?: boolean;
+}
+
+export const findProjectPaths = Effect.fnUntraced(function* (
+  cwd: string,
+  options?: FindProjectPathsOptions,
+) {
   const path = yield* Path.Path;
-  let current = path.resolve(cwd);
+  const start = path.resolve(cwd);
+
+  if (options?.search === false) {
+    return yield* findConfigInRoot(start);
+  }
 
+  let current = start;
   while (true) {
     const match = yield* findConfigInRoot(current);
 
diff --git a/packages/config/src/project.ts b/packages/config/src/project.ts
index 68953f2b1b..eb1def2642 100644
--- a/packages/config/src/project.ts
+++ b/packages/config/src/project.ts
@@ -1,10 +1,9 @@
 import { Effect, FileSystem, Redacted } from "effect";
 import { ProjectConfigSchema } from "./base.ts";
 import { ProjectEnvParseError } from "./errors.ts";
-import { ENV_CAPTURE_REGEX, isEnvReference } from "./lib/env.ts";
+import { ENV_CAPTURE_REGEX, ENV_CAPTURE_REGEX_STRICT, isEnvReference } from "./lib/env.ts";
 import { findProjectPaths, type ProjectPaths } from "./paths.ts";
 
-const envReferencePattern = ENV_CAPTURE_REGEX;
 const dotEnvLinePattern =
   /^\s*(?:export\s+)?([\w.-]+)(?:\s*=\s*?|:\s+?)(\s*'(?:\\'|[^'])*'|\s*"(?:\\"|[^"])*"|\s*`(?:\\`|[^`])*`|[^#\r\n]+)?\s*(?:#.*)?$/;
 
@@ -45,6 +44,41 @@ function normalizeAmbientEnv(
   return values;
 }
 
+// Detects a line of the form `KEY=<quote>...` (or `KEY: <quote>...`) whose
+// quoted value does NOT close on that same physical line — the start of a
+// godotenv-style multiline quoted value (e.g. a PEM block). Returns the quote
+// character and the index of the opening quote within `line`, or `null` if
+// the line doesn't open an unterminated quote (either no quote at all, or one
+// that already closes on this line).
+const dotEnvValueOpenerPattern = /^\s*(?:export\s+)?[\w.-]+(?:\s*=\s*?|:\s+?)(['"`])/;
+
+function findUnescapedQuoteIndex(text: string, quote: string, from: number): number {
+  for (let i = from; i < text.length; i += 1) {
+    if (text[i] === quote && text[i - 1] !== "\\") {
+      return i;
+    }
+  }
+  return -1;
+}
+
+function detectOpenQuoteStart(line: string): { quote: string; openIndex: number } | null {
+  const openerMatch = dotEnvValueOpenerPattern.exec(line);
+  if (openerMatch === null) {
+    return null;
+  }
+  const quote = openerMatch[1];
+  if (quote === undefined) {
+    return null;
+  }
+  const openIndex = openerMatch[0].length - 1;
+  if (findUnescapedQuoteIndex(line, quote, openIndex + 1) !== -1) {
+    // Already closes on this same line — this isn't the multiline case, so
+    // whatever made the outer match fail is a genuine parse error.
+    return null;
+  }
+  return { quote, openIndex };
+}
+
 function parseDotEnvValue(rawValue: string): string {
   let value = rawValue.trim();
   const maybeQuote = value[0];
@@ -78,7 +112,40 @@ function parseDotEnv(
         continue;
       }
 
-      const match = dotEnvLinePattern.exec(line);
+      let candidate = line;
+      let consumedThrough = index;
+
+      // Check for an unterminated quote BEFORE attempting the single-line
+      // match: `dotEnvLinePattern`'s value alternatives fall back to an
+      // unquoted match (`[^#\r\n]+`) when none of the quoted alternatives
+      // close on this line, which would otherwise "succeed" with a truncated,
+      // still-quote-prefixed value instead of signaling a multiline value —
+      // masking the real bug rather than triggering accumulation. This is a
+      // godotenv-style quoted value spanning multiple physical lines (e.g. a
+      // PEM block); Go's `loadNestedEnv` parses this fine (`godotenv@v1.5.1`'s
+      // cursor-based scanner never splits into lines up front; see
+      // `legacy-dotenv.ts` for the Go-compatible reference implementation used
+      // elsewhere in this repo). Accumulate subsequent lines until the opened
+      // quote closes (or EOF), then match the same per-line pattern against
+      // the joined multiline chunk — its quoted-value alternatives use
+      // negated character classes (`[^"]` etc.), which already match embedded
+      // newlines once given the full span.
+      const opener = detectOpenQuoteStart(line);
+      if (opener !== null) {
+        for (let next = index + 1; next < lines.length; next += 1) {
+          const nextLine = lines[next];
+          if (nextLine === undefined) {
+            continue;
+          }
+          candidate += "\n" + nextLine;
+          consumedThrough = next;
+          if (findUnescapedQuoteIndex(candidate, opener.quote, opener.openIndex + 1) !== -1) {
+            break;
+          }
+        }
+      }
+
+      const match = dotEnvLinePattern.exec(candidate);
 
       if (match === null) {
         return yield* Effect.fail(new ProjectEnvParseError({ path, line: index + 1 }));
@@ -92,6 +159,7 @@ function parseDotEnv(
       }
 
       values[key] = parseDotEnvValue(rawValue);
+      index = consumedThrough;
     }
 
     return values;
@@ -113,13 +181,36 @@ function applySource(
 export interface LoadProjectEnvironmentOptions {
   readonly cwd: string;
   readonly baseEnv?: Readonly<Record<string, string | undefined>>;
+  /** See {@link FindProjectPathsOptions.search}. */
+  readonly search?: boolean;
+  /**
+   * Skip reading/parsing `paths.envLocalPath` (`supabase/.env.local`)
+   * entirely. Mirrors Go's `loadDefaultEnv` (`apps/cli-go/pkg/config/
+   * config.go:1243-1250`), which omits `.env.local` from its candidate
+   * filename list whenever `SUPABASE_ENV=test` — so a malformed or
+   * intentionally non-test `.env.local` is invisible to Go in that mode and
+   * must not fail config loading here either. Defaults to `false` so
+   * existing callers that don't have a `SUPABASE_ENV` gate of their own
+   * (`next/`, `secrets set`) are unaffected.
+   */
+  readonly skipEnvLocal?: boolean;
+}
+
+export interface ResolveProjectOptions {
+  /**
+   * Opt into Go/viper-parity `env()` matching (case-agnostic
+   * `^env\((.*)\)$`). Defaults to `false`, which uses the pre-PR-#5765 strict
+   * SCREAMING_SNAKE_CASE matcher (`ENV_CAPTURE_REGEX_STRICT`). Only the
+   * Go-parity legacy shell sets this to `true`.
+   */
+  readonly goViperCompat?: boolean;
 }
 
 export const loadProjectEnvironment = Effect.fnUntraced(function* (
   options: LoadProjectEnvironmentOptions,
 ) {
   const fs = yield* FileSystem.FileSystem;
-  const paths = yield* findProjectPaths(options.cwd);
+  const paths = yield* findProjectPaths(options.cwd, { search: options.search });
 
   if (paths === null) {
     return null;
@@ -136,7 +227,7 @@ export const loadProjectEnvironment = Effect.fnUntraced(function* (
     loadedPaths.push(paths.envPath);
   }
 
-  if (yield* fs.exists(paths.envLocalPath)) {
+  if (!options.skipEnvLocal && (yield* fs.exists(paths.envLocalPath))) {
     const contents = yield* fs.readFileString(paths.envLocalPath);
     const parsed = yield* parseDotEnv(paths.envLocalPath, contents);
     applySource(values, sources, parsed, ".env.local");
@@ -216,21 +307,33 @@ function isSecretPath(path: ReadonlyArray<string>): boolean {
   return secretPathPatterns.some((pattern) => matchesPathPattern(pattern, path));
 }
 
-function interpolateLeafValue(value: string, env: Readonly<Record<string, string>>): string {
-  const match = envReferencePattern.exec(value);
+function interpolateLeafValue(
+  value: string,
+  env: Readonly<Record<string, string>>,
+  goViperCompat: boolean,
+): string {
+  const match = (goViperCompat ? ENV_CAPTURE_REGEX : ENV_CAPTURE_REGEX_STRICT).exec(value);
   const envName = match?.[1];
 
   if (envName === undefined) {
     return value;
   }
 
-  // Preserve the literal `env(VAR)` verbatim when VAR is unset. Matches Go's
-  // `apps/cli-go/pkg/config/decode_hooks.go:14-21` (LoadEnvHook).
-  if (!Object.prototype.hasOwnProperty.call(env, envName)) {
+  const resolved = env[envName];
+  // Preserve the literal `env(VAR)` verbatim when VAR is unset OR present but
+  // empty (e.g. a dotenv `KEY=` line). Matches Go's `LoadEnvHook`
+  // (`apps/cli-go/pkg/config/decode_hooks.go:19-24`: `len(env) > 0`), which
+  // only substitutes a non-empty value — same gate as `substituteEnvLeaf` in
+  // `lib/env.ts`. Without this, a present-but-empty `env(...)` secret (e.g.
+  // `edge_runtime.secrets.FOO = "env(EMPTY)"`) resolves to `""` here, gets
+  // redacted by `redactValue` as a real value instead of skipped as an
+  // unresolved literal, and `secrets set` uploads a blank secret Go would
+  // never send.
+  if (resolved === undefined || resolved === "") {
     return value;
   }
 
-  return env[envName] ?? value;
+  return resolved;
 }
 
 function toPathSegments(path: string): ReadonlyArray<string> {
@@ -241,44 +344,48 @@ function toPathSegments(path: string): ReadonlyArray<string> {
   return path.split(".").filter((segment) => segment.length > 0);
 }
 
-function interpolateValue(value: unknown, env: Readonly<Record<string, string>>): unknown {
+function interpolateValue(
+  value: unknown,
+  env: Readonly<Record<string, string>>,
+  goViperCompat: boolean,
+): unknown {
   if (Array.isArray(value)) {
-    return value.map((item) => interpolateValue(item, env));
+    return value.map((item) => interpolateValue(item, env, goViperCompat));
   }
 
   if (typeof value === "object" && value !== null) {
     const result: Record<string, unknown> = {};
 
     for (const [key, child] of Object.entries(value)) {
-      result[key] = interpolateValue(child, env);
+      result[key] = interpolateValue(child, env, goViperCompat);
     }
 
     return result;
   }
 
   if (typeof value === "string") {
-    return interpolateLeafValue(value, env);
+    return interpolateLeafValue(value, env, goViperCompat);
   }
 
   return value;
 }
 
-function redactValue(value: unknown, path: ReadonlyArray<string> = []): unknown {
+function redactValue(value: unknown, path: ReadonlyArray<string>, goViperCompat: boolean): unknown {
   if (Array.isArray(value)) {
-    return value.map((item, index) => redactValue(item, [...path, String(index)]));
+    return value.map((item, index) => redactValue(item, [...path, String(index)], goViperCompat));
   }
 
   if (typeof value === "object" && value !== null) {
     const result: Record<string, unknown> = {};
 
     for (const [key, child] of Object.entries(value)) {
-      result[key] = redactValue(child, [...path, key]);
+      result[key] = redactValue(child, [...path, key], goViperCompat);
     }
 
     return result;
   }
 
-  if (typeof value === "string" && isSecretPath(path) && !isEnvReference(value)) {
+  if (typeof value === "string" && isSecretPath(path) && !isEnvReference(value, goViperCompat)) {
     return Redacted.make(value, { label: path.join(".") });
   }
 
@@ -287,17 +394,25 @@ function redactValue(value: unknown, path: ReadonlyArray<string> = []): unknown
 
 function resolveProjectValueAtPath(
   value: unknown,
-  projectEnv: ProjectEnvironment,
+  projectEnv: Pick<ProjectEnvironment, "values">,
   path: ReadonlyArray<string>,
+  goViperCompat: boolean,
 ): unknown {
-  const interpolated = interpolateValue(value, projectEnv.values);
-  return redactValue(interpolated, path);
+  const interpolated = interpolateValue(value, projectEnv.values, goViperCompat);
+  return redactValue(interpolated, path, goViperCompat);
 }
 
+/**
+ * `projectEnv` only needs `.values` (`Pick<ProjectEnvironment, "values">`) —
+ * a caller that already has a project's env values but not the full
+ * `ProjectEnvironment` shape (e.g. `paths`/`loadedPaths`/`sources`) can pass
+ * `{ values }` directly instead of threading through the whole loaded object.
+ */
 export function resolveProjectValue<T>(
   value: T,
-  projectEnv: ProjectEnvironment,
+  projectEnv: Pick<ProjectEnvironment, "values">,
   configPath: string,
+  options?: ResolveProjectOptions,
 ): Effect.Effect<ResolvedProjectValue<T>> {
   return Effect.sync(
     () =>
@@ -305,14 +420,17 @@ export function resolveProjectValue<T>(
         value,
         projectEnv,
         toPathSegments(configPath),
+        options?.goViperCompat ?? false,
       ) as ResolvedProjectValue<T>,
   );
 }
 
+/** See {@link resolveProjectValue}'s doc comment for why `projectEnv` only needs `.values`. */
 export function resolveProjectSubtree<T>(
   value: T,
-  projectEnv: ProjectEnvironment,
+  projectEnv: Pick<ProjectEnvironment, "values">,
   pathPrefix: string,
+  options?: ResolveProjectOptions,
 ): Effect.Effect<ResolvedProjectValue<T>> {
   return Effect.sync(
     () =>
@@ -320,6 +438,7 @@ export function resolveProjectSubtree<T>(
         value,
         projectEnv,
         toPathSegments(pathPrefix),
+        options?.goViperCompat ?? false,
       ) as ResolvedProjectValue<T>,
   );
 }
diff --git a/packages/config/src/project.unit.test.ts b/packages/config/src/project.unit.test.ts
index de22a465fe..9f29094bc2 100644
--- a/packages/config/src/project.unit.test.ts
+++ b/packages/config/src/project.unit.test.ts
@@ -6,7 +6,7 @@ import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { Effect, FileSystem, Path, Redacted } from "effect";
 import { findProjectRootFor, loadProjectEnvironmentFor } from "./bun.ts";
-import { ProjectConfigParseError } from "./errors.ts";
+import { ProjectConfigParseError, ProjectEnvParseError } from "./errors.ts";
 import {
   findProjectPaths,
   loadProjectConfig,
@@ -50,6 +50,41 @@ describe("project discovery and lazy env resolution", () => {
     }
   });
 
+  test("search: false only checks cwd itself, matching Go's exact-workdir resolution", async () => {
+    // Mirrors Go's `ChangeWorkDir` (`apps/cli-go/internal/utils/misc.go:231-247`):
+    // an explicit workdir is used exactly as given, with no ancestor climb —
+    // callers that already hold a Go-equivalent project root (e.g. the legacy
+    // `stop`/`status` ports' `cliConfig.workdir`) pass `search: false` to avoid
+    // picking up an unrelated ancestor project.
+    const cwd = makeTempProject();
+    const repoRoot = join(cwd, "repo");
+    const packageRoot = join(repoRoot, "apps", "web");
+    const nestedCwd = join(packageRoot, "src", "components");
+
+    try {
+      await mkdir(join(repoRoot, "supabase"), { recursive: true });
+      await mkdir(nestedCwd, { recursive: true });
+      await writeFile(join(repoRoot, "supabase", "config.toml"), 'project_id = "repo"\n');
+
+      // nestedCwd has no supabase/ of its own; only an ancestor (repoRoot) does.
+      const searched = await runConfigEffect(findProjectPaths(nestedCwd));
+      expect(searched?.projectRoot).toBe(repoRoot);
+
+      const unsearched = await runConfigEffect(findProjectPaths(nestedCwd, { search: false }));
+      expect(unsearched).toBeNull();
+
+      const configAtRepoRoot = await runConfigEffect(findProjectPaths(repoRoot, { search: false }));
+      expect(configAtRepoRoot?.projectRoot).toBe(repoRoot);
+
+      expect(await runConfigEffect(loadProjectConfig(nestedCwd, { search: false }))).toBeNull();
+      expect(
+        await runConfigEffect(loadProjectEnvironment({ cwd: nestedCwd, search: false })),
+      ).toBeNull();
+    } finally {
+      await rm(cwd, { recursive: true, force: true });
+    }
+  });
+
   test("loads env from the discovered supabase directory with the right precedence", async () => {
     const cwd = makeTempProject();
     const repoRoot = join(cwd, "repo");
@@ -107,6 +142,105 @@ describe("project discovery and lazy env resolution", () => {
     }
   });
 
+  test("parses a multiline double-quoted .env value (godotenv/Go parity)", async () => {
+    const cwd = makeTempProject();
+
+    try {
+      await mkdir(join(cwd, "supabase"), { recursive: true });
+      await writeFile(join(cwd, "supabase", "config.toml"), 'project_id = "ref_123"\n');
+      await writeFile(
+        join(cwd, "supabase", ".env"),
+        [
+          'PRIVATE_KEY="-----BEGIN RSA PRIVATE KEY-----',
+          "MIIEpAIBAAKCAQEA1c7+9z5Pad7OejecsQ0bu3aumga",
+          '-----END RSA PRIVATE KEY-----"',
+          "OTHER=value",
+          "",
+        ].join("\n"),
+      );
+
+      const projectEnv = await runConfigEffect(loadProjectEnvironment({ cwd }));
+
+      expect(projectEnv).not.toBeNull();
+      expect(projectEnv?.values.PRIVATE_KEY).toBe(
+        [
+          "-----BEGIN RSA PRIVATE KEY-----",
+          "MIIEpAIBAAKCAQEA1c7+9z5Pad7OejecsQ0bu3aumga",
+          "-----END RSA PRIVATE KEY-----",
+        ].join("\n"),
+      );
+      expect(projectEnv?.values.OTHER).toBe("value");
+    } finally {
+      await rm(cwd, { recursive: true, force: true });
+    }
+  });
+
+  test("parses a multiline single-quoted .env value followed by a trailing comment", async () => {
+    const cwd = makeTempProject();
+
+    try {
+      await mkdir(join(cwd, "supabase"), { recursive: true });
+      await writeFile(join(cwd, "supabase", "config.toml"), 'project_id = "ref_123"\n');
+      await writeFile(
+        join(cwd, "supabase", ".env"),
+        ["MULTI='line one", "line two' # trailing comment", "AFTER=ok", ""].join("\n"),
+      );
+
+      const projectEnv = await runConfigEffect(loadProjectEnvironment({ cwd }));
+
+      expect(projectEnv).not.toBeNull();
+      expect(projectEnv?.values.MULTI).toBe(["line one", "line two"].join("\n"));
+      expect(projectEnv?.values.AFTER).toBe("ok");
+    } finally {
+      await rm(cwd, { recursive: true, force: true });
+    }
+  });
+
+  test("still fails a genuinely malformed .env line (not a multiline quote)", async () => {
+    const cwd = makeTempProject();
+
+    try {
+      await mkdir(join(cwd, "supabase"), { recursive: true });
+      await writeFile(join(cwd, "supabase", "config.toml"), 'project_id = "ref_123"\n');
+      await writeFile(join(cwd, "supabase", ".env"), "!!!not-a-valid-line\n");
+
+      await expect(runConfigEffect(loadProjectEnvironment({ cwd }))).rejects.toBeInstanceOf(
+        ProjectEnvParseError,
+      );
+    } finally {
+      await rm(cwd, { recursive: true, force: true });
+    }
+  });
+
+  test("skipEnvLocal ignores .env.local entirely, matching Go's SUPABASE_ENV=test gate", async () => {
+    // Go's `loadDefaultEnv` (`apps/cli-go/pkg/config/config.go:1243-1250`) omits
+    // `.env.local` from its candidate filename list whenever `SUPABASE_ENV=test`,
+    // so a malformed `.env.local` is invisible to Go in that mode. Callers that
+    // reproduce this gate (`status`/`stop` handlers) pass `skipEnvLocal: true`.
+    const cwd = makeTempProject();
+
+    try {
+      await mkdir(join(cwd, "supabase"), { recursive: true });
+      await writeFile(join(cwd, "supabase", "config.toml"), 'project_id = "ref_123"\n');
+      await writeFile(join(cwd, "supabase", ".env"), "FROM_ENV=1\n");
+      // Malformed — would normally throw ProjectEnvParseError.
+      await writeFile(join(cwd, "supabase", ".env.local"), "!!!not-a-valid-line\n");
+
+      const projectEnv = await runConfigEffect(loadProjectEnvironment({ cwd, skipEnvLocal: true }));
+
+      expect(projectEnv).not.toBeNull();
+      expect(projectEnv?.values.FROM_ENV).toBe("1");
+      expect(projectEnv?.loadedPaths).toEqual([join(cwd, "supabase", ".env")]);
+
+      // Without the flag, the same malformed file still fails as before.
+      await expect(runConfigEffect(loadProjectEnvironment({ cwd }))).rejects.toBeInstanceOf(
+        ProjectEnvParseError,
+      );
+    } finally {
+      await rm(cwd, { recursive: true, force: true });
+    }
+  });
+
   test("leaves [api].auto_expose_new_tables unset by default and round-trips an explicit value", async () => {
     const cwd = makeTempProject();
     const projectRoot = join(cwd, "repo");
@@ -214,6 +348,9 @@ jwt_secret = "env(AUTH_JWT_SECRET)"
 [edge_runtime.secrets]
 api_key = "env(EDGE_API_KEY)"
 
+[remotes.preview]
+project_id = "previewrefaaaaaaaaaa"
+
 [remotes.preview.auth]
 jwt_secret = "env(PREVIEW_JWT_SECRET)"
 `,
@@ -282,6 +419,44 @@ jwt_secret = "env(MISSING_SECRET)"
     }
   });
 
+  // Go's `LoadEnvHook` (`apps/cli-go/pkg/config/decode_hooks.go:19-24`) only
+  // substitutes a non-empty env var (`len(env) > 0`) — a present-but-empty
+  // dotenv line (`EMPTY_SECRET=`) is treated the same as an unset var, so the
+  // literal `env(...)` reference is preserved rather than resolved to `""`.
+  test("resolveProjectValue preserves env() literal when the env var is present but empty (Go parity)", async () => {
+    const cwd = makeTempProject();
+    const projectRoot = join(cwd, "repo");
+
+    try {
+      await mkdir(join(projectRoot, "supabase"), { recursive: true });
+      await writeFile(
+        join(projectRoot, "supabase", "config.toml"),
+        `project_id = "ref_123"
+
+[edge_runtime.secrets]
+foo = "env(EMPTY_SECRET)"
+`,
+      );
+      await writeFile(join(projectRoot, "supabase", ".env"), "EMPTY_SECRET=\n");
+
+      const loaded = await runConfigEffect(loadProjectConfig(projectRoot));
+      const projectEnv = await runConfigEffect(loadProjectEnvironment({ cwd: projectRoot }));
+
+      const resolved = await runConfigEffect(
+        resolveProjectValue(
+          loaded!.config.edge_runtime.secrets!.foo,
+          projectEnv!,
+          "edge_runtime.secrets.foo",
+        ),
+      );
+
+      expect(Redacted.isRedacted(resolved)).toBe(false);
+      expect(resolved).toBe("env(EMPTY_SECRET)");
+    } finally {
+      await rm(cwd, { recursive: true, force: true });
+    }
+  });
+
   test("resolveProjectSubtree preserves env() literals nested inside the selected subtree", async () => {
     const cwd = makeTempProject();
     const projectRoot = join(cwd, "repo");
@@ -334,4 +509,75 @@ account_sid = "AC123"
       await rm(cwd, { recursive: true, force: true });
     }
   });
+
+  // Pins the pre-PR-#5765 strict SCREAMING_SNAKE_CASE `env()` matcher as the
+  // default for `resolveProjectValue`/`resolveProjectSubtree`, since `next/`
+  // and `packages/stack` call these without ever passing `goViperCompat`.
+  test("resolveProjectValue does not resolve a lowercase-named env() reference by default", async () => {
+    const cwd = makeTempProject();
+    const projectRoot = join(cwd, "repo");
+
+    try {
+      await mkdir(join(projectRoot, "supabase"), { recursive: true });
+      await writeFile(
+        join(projectRoot, "supabase", "config.toml"),
+        `project_id = "ref_123"
+
+[auth]
+jwt_secret = "env(lowercase_secret)"
+`,
+      );
+      await writeFile(join(projectRoot, "supabase", ".env"), "lowercase_secret=super-secret\n");
+
+      const loaded = await runConfigEffect(loadProjectConfig(projectRoot));
+      const projectEnv = await runConfigEffect(loadProjectEnvironment({ cwd: projectRoot }));
+
+      const resolved = await runConfigEffect(
+        resolveProjectValue(loaded!.config.auth.jwt_secret, projectEnv!, "auth.jwt_secret"),
+      );
+
+      expect(Redacted.isRedacted(resolved)).toBe(true);
+      if (!Redacted.isRedacted(resolved)) {
+        throw new Error("Expected auth.jwt_secret to be redacted.");
+      }
+      expect(Redacted.value(resolved)).toBe("env(lowercase_secret)");
+    } finally {
+      await rm(cwd, { recursive: true, force: true });
+    }
+  });
+
+  test("resolveProjectValue resolves a lowercase-named env() reference when goViperCompat is true", async () => {
+    const cwd = makeTempProject();
+    const projectRoot = join(cwd, "repo");
+
+    try {
+      await mkdir(join(projectRoot, "supabase"), { recursive: true });
+      await writeFile(
+        join(projectRoot, "supabase", "config.toml"),
+        `project_id = "ref_123"
+
+[auth]
+jwt_secret = "env(lowercase_secret)"
+`,
+      );
+      await writeFile(join(projectRoot, "supabase", ".env"), "lowercase_secret=super-secret\n");
+
+      const loaded = await runConfigEffect(loadProjectConfig(projectRoot));
+      const projectEnv = await runConfigEffect(loadProjectEnvironment({ cwd: projectRoot }));
+
+      const resolved = await runConfigEffect(
+        resolveProjectValue(loaded!.config.auth.jwt_secret, projectEnv!, "auth.jwt_secret", {
+          goViperCompat: true,
+        }),
+      );
+
+      expect(Redacted.isRedacted(resolved)).toBe(true);
+      if (!Redacted.isRedacted(resolved)) {
+        throw new Error("Expected auth.jwt_secret to be redacted.");
+      }
+      expect(Redacted.value(resolved)).toBe("super-secret");
+    } finally {
+      await rm(cwd, { recursive: true, force: true });
+    }
+  });
 });
diff --git a/packages/stack/package.json b/packages/stack/package.json
index 284f92a896..632976a7e2 100644
--- a/packages/stack/package.json
+++ b/packages/stack/package.json
@@ -28,7 +28,7 @@
   },
   "devDependencies": {
     "@effect/vitest": "catalog:",
-    "@supabase/supabase-js": "^2.108.2",
+    "@supabase/supabase-js": "^2.110.2",
     "@tsconfig/bun": "catalog:",
     "@types/bun": "catalog:",
     "@typescript/native-preview": "catalog:",
diff --git a/packages/stack/src/ApiProxy.ts b/packages/stack/src/ApiProxy.ts
index 12f258235e..116de838f2 100644
--- a/packages/stack/src/ApiProxy.ts
+++ b/packages/stack/src/ApiProxy.ts
@@ -110,7 +110,7 @@ function addCorsHeaders(
 // does so. Its `/_internal/health` probe answers immediately, so "Healthy"
 // status does not mean a function is servable yet. Briefly retry transport
 // failures on that route so a user's first call doesn't surface as a 502.
-const COLD_START_RETRY_SCHEDULE = Schedule.spaced("250 millis").pipe(Schedule.take(8));
+const COLD_START_RETRY_SCHEDULE = Schedule.spaced("250 millis").pipe(Schedule.upTo({ times: 8 }));
 
 interface ProxyHandlerOptions {
   readonly backendPort: number;
diff --git a/packages/stack/src/versions.ts b/packages/stack/src/versions.ts
index ce7b086789..989d9357b0 100644
--- a/packages/stack/src/versions.ts
+++ b/packages/stack/src/versions.ts
@@ -47,16 +47,16 @@ export interface VersionManifest {
 
 export const DEFAULT_VERSIONS: VersionManifest = {
   postgres: "17.6.1.143",
-  postgrest: "14.14",
-  auth: "2.192.0",
+  postgrest: "14.15",
+  auth: "2.193.0",
   "edge-runtime": "1.74.2",
-  realtime: "2.112.6",
-  storage: "1.62.5",
+  realtime: "2.113.4",
+  storage: "1.66.4",
   imgproxy: "v3.8.0",
   mailpit: "v1.30.2",
   pgmeta: "0.96.6",
-  studio: "2026.07.06-sha-66cf431",
-  analytics: "1.46.0",
+  studio: "2026.07.13-sha-b5ada96",
+  analytics: "1.47.1",
   vector: "0.53.0-alpine",
   pooler: "2.9.7",
 } as const;
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index a8a9506881..c2db0ba728 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -7,23 +7,23 @@ settings:
 catalogs:
   default:
     '@effect/atom-react':
-      specifier: 4.0.0-beta.93
-      version: 4.0.0-beta.93
+      specifier: 4.0.0-beta.97
+      version: 4.0.0-beta.97
     '@effect/platform-bun':
-      specifier: 4.0.0-beta.93
-      version: 4.0.0-beta.93
+      specifier: 4.0.0-beta.97
+      version: 4.0.0-beta.97
     '@effect/platform-node':
-      specifier: 4.0.0-beta.93
-      version: 4.0.0-beta.93
+      specifier: 4.0.0-beta.97
+      version: 4.0.0-beta.97
     '@effect/sql-pg':
-      specifier: 4.0.0-beta.93
-      version: 4.0.0-beta.93
+      specifier: 4.0.0-beta.97
+      version: 4.0.0-beta.97
     '@effect/vitest':
-      specifier: ^4.0.0-beta.93
-      version: 4.0.0-beta.93
+      specifier: 4.0.0-beta.97
+      version: 4.0.0-beta.97
     '@nx/devkit':
-      specifier: ^23.0.0
-      version: 23.0.1
+      specifier: ^23.0.2
+      version: 23.1.0
     '@swc-node/register':
       specifier: ^1.10.9
       version: 1.11.1
@@ -37,35 +37,38 @@ catalogs:
       specifier: ^1.3.14
       version: 1.3.14
     '@typescript/native-preview':
-      specifier: 7.0.0-dev.20260629.1
-      version: 7.0.0-dev.20260629.1
+      specifier: 7.0.0-dev.20260707.2
+      version: 7.0.0-dev.20260707.2
     '@vitest/coverage-istanbul':
-      specifier: ^4.1.9
-      version: 4.1.9
+      specifier: ^4.1.10
+      version: 4.1.10
     effect:
-      specifier: 4.0.0-beta.93
-      version: 4.0.0-beta.93
+      specifier: 4.0.0-beta.97
+      version: 4.0.0-beta.97
     knip:
-      specifier: ^6.17.1
-      version: 6.23.0
+      specifier: ^6.26.0
+      version: 6.26.0
     nx:
-      specifier: ^23.0.0
-      version: 23.0.1
+      specifier: ^23.0.2
+      version: 23.1.0
     oxfmt:
-      specifier: ^0.57.0
-      version: 0.57.0
+      specifier: ^0.58.0
+      version: 0.58.0
     oxlint:
       specifier: ^1.72.0
-      version: 1.73.0
+      version: 1.74.0
     oxlint-tsgolint:
-      specifier: ^0.23.0
-      version: 0.23.0
+      specifier: ^0.24.0
+      version: 0.24.0
     tldts:
-      specifier: ^7.4.5
-      version: 7.4.5
+      specifier: ^7.4.8
+      version: 7.4.8
     vitest:
-      specifier: ^4.1.9
-      version: 4.1.9
+      specifier: ^4.1.10
+      version: 4.1.10
+
+overrides:
+  '@effect/platform-node-shared': 4.0.0-beta.97
 
 importers:
 
@@ -73,19 +76,25 @@ importers:
     devDependencies:
       '@swc-node/register':
         specifier: 'catalog:'
-        version: 1.11.1(@swc/core@1.15.43)(@swc/types@0.1.27)(typescript@6.0.3)
+        version: 1.11.1(@swc/core@1.15.43)(@swc/types@0.1.27)(@typescript/typescript6@6.0.2)
       '@swc/core':
         specifier: 'catalog:'
         version: 1.15.43
+      '@typescript/native':
+        specifier: npm:typescript@^7.0.2
+        version: typescript@7.0.2
       nx:
         specifier: 'catalog:'
-        version: 23.0.1(@swc-node/register@1.11.1(@swc/core@1.15.43)(@swc/types@0.1.27)(typescript@6.0.3))(@swc/core@1.15.43)
+        version: 23.1.0(@swc-node/register@1.11.1(@swc/core@1.15.43)(@swc/types@0.1.27)(@typescript/typescript6@6.0.2))(@swc/core@1.15.43)
       pkg-pr-new:
         specifier: 0.0.75
         version: 0.0.75
+      typescript:
+        specifier: npm:@typescript/typescript6@^6.0.2
+        version: '@typescript/typescript6@6.0.2'
       verdaccio:
         specifier: ^6.7.4
-        version: 6.7.4(typanion@3.14.0)
+        version: 6.8.0(typanion@3.14.0)
 
   apps/cli:
     dependencies:
@@ -97,26 +106,26 @@ importers:
         version: 6.2.3
     devDependencies:
       '@anthropic-ai/claude-agent-sdk':
-        specifier: ^0.3.196
-        version: 0.3.196(@anthropic-ai/sdk@0.107.0(zod@4.4.3))(@modelcontextprotocol/sdk@1.29.0(zod@4.4.3))(zod@4.4.3)
+        specifier: ^0.3.207
+        version: 0.3.209(@anthropic-ai/sdk@0.111.0(zod@4.4.3))(@modelcontextprotocol/sdk@1.29.0(zod@4.4.3))(zod@4.4.3)
       '@anthropic-ai/sdk':
-        specifier: ^0.107.0
-        version: 0.107.0(zod@4.4.3)
+        specifier: ^0.111.0
+        version: 0.111.0(zod@4.4.3)
       '@clack/prompts':
-        specifier: ^1.6.0
-        version: 1.6.0
+        specifier: ^1.7.0
+        version: 1.7.0
       '@effect/atom-react':
         specifier: 'catalog:'
-        version: 4.0.0-beta.93(effect@4.0.0-beta.93)(react@19.2.7)(scheduler@0.27.0)
+        version: 4.0.0-beta.97(effect@4.0.0-beta.97)(react@19.2.7)(scheduler@0.27.0)
       '@effect/platform-bun':
         specifier: 'catalog:'
-        version: 4.0.0-beta.93(effect@4.0.0-beta.93)
+        version: 4.0.0-beta.97(effect@4.0.0-beta.97)
       '@effect/sql-pg':
         specifier: 'catalog:'
-        version: 4.0.0-beta.93(effect@4.0.0-beta.93)
+        version: 4.0.0-beta.97(effect@4.0.0-beta.97)
       '@effect/vitest':
         specifier: 'catalog:'
-        version: 4.0.0-beta.93(effect@4.0.0-beta.93)(vitest@4.1.9)
+        version: 4.0.0-beta.97(effect@4.0.0-beta.97)(vitest@4.1.10)
       '@modelcontextprotocol/sdk':
         specifier: ^1.29.0
         version: 1.29.0(zod@4.4.3)
@@ -155,19 +164,19 @@ importers:
         version: 19.2.17
       '@typescript/native-preview':
         specifier: 'catalog:'
-        version: 7.0.0-dev.20260629.1
+        version: 7.0.0-dev.20260707.2
       '@vercel/detect-agent':
         specifier: ^1.2.3
         version: 1.2.3
       '@vitest/coverage-istanbul':
         specifier: 'catalog:'
-        version: 4.1.9(vitest@4.1.9)
+        version: 4.1.10(vitest@4.1.10)
       dotenv:
         specifier: ^17.4.2
         version: 17.4.2
       effect:
         specifier: 'catalog:'
-        version: 4.0.0-beta.93
+        version: 4.0.0-beta.97
       esbuild:
         specifier: ^0.28.1
         version: 0.28.1
@@ -179,16 +188,16 @@ importers:
         version: 5.0.0(ink@7.1.0(@types/react@19.2.17)(react-devtools-core@7.0.1)(react@19.2.7))(react@19.2.7)
       knip:
         specifier: 'catalog:'
-        version: 6.23.0
+        version: 6.26.0
       oxfmt:
         specifier: 'catalog:'
-        version: 0.57.0
+        version: 0.58.0
       oxlint:
         specifier: 'catalog:'
-        version: 1.73.0(oxlint-tsgolint@0.23.0)
+        version: 1.74.0(oxlint-tsgolint@0.24.0)
       oxlint-tsgolint:
         specifier: 'catalog:'
-        version: 0.23.0
+        version: 0.24.0
       pg:
         specifier: ^8.22.0
         version: 8.22.0
@@ -196,8 +205,8 @@ importers:
         specifier: ^7.0.0
         version: 7.0.0
       posthog-node:
-        specifier: ^5.38.8
-        version: 5.38.8
+        specifier: ^5.41.0
+        version: 5.41.0
       react:
         specifier: ^19.2.7
         version: 19.2.7
@@ -205,17 +214,17 @@ importers:
         specifier: ^7.0.1
         version: 7.0.1
       semantic-release:
-        specifier: ^25.0.5
-        version: 25.0.5(typescript@6.0.3)
+        specifier: ^25.0.6
+        version: 25.0.7(typescript@7.0.2)
       smol-toml:
         specifier: ^1.7.0
         version: 1.7.0
       tldts:
         specifier: 'catalog:'
-        version: 7.4.5
+        version: 7.4.8
       vitest:
         specifier: 'catalog:'
-        version: 4.1.9(@types/node@26.0.1)(@vitest/coverage-istanbul@4.1.9)(vite@8.0.14(@types/node@26.0.1)(esbuild@0.28.1)(jiti@2.7.0)(yaml@2.9.0))
+        version: 4.1.10(@types/node@26.1.1)(@vitest/coverage-istanbul@4.1.10)(vite@8.1.4(@types/node@26.1.1)(esbuild@0.28.1)(jiti@2.7.0)(yaml@2.9.0))
       yaml:
         specifier: ^2.9.0
         version: 2.9.0
@@ -259,40 +268,40 @@ importers:
         version: 1.3.14
       '@typescript/native-preview':
         specifier: 'catalog:'
-        version: 7.0.0-dev.20260629.1
+        version: 7.0.0-dev.20260707.2
       '@vitest/coverage-istanbul':
         specifier: 'catalog:'
-        version: 4.1.9(vitest@4.1.9)
+        version: 4.1.10(vitest@4.1.10)
       knip:
         specifier: 'catalog:'
-        version: 6.23.0
+        version: 6.26.0
       oxfmt:
         specifier: 'catalog:'
-        version: 0.57.0
+        version: 0.58.0
       oxlint:
         specifier: 'catalog:'
-        version: 1.73.0(oxlint-tsgolint@0.23.0)
+        version: 1.74.0(oxlint-tsgolint@0.24.0)
       oxlint-tsgolint:
         specifier: 'catalog:'
-        version: 0.23.0
+        version: 0.24.0
       vitest:
         specifier: 'catalog:'
-        version: 4.1.9(@types/node@26.0.1)(@vitest/coverage-istanbul@4.1.9)(vite@8.0.14(@types/node@26.0.1)(esbuild@0.28.1)(jiti@2.7.0)(yaml@2.9.0))
+        version: 4.1.10(@types/node@26.1.1)(@vitest/coverage-istanbul@4.1.10)(vite@8.1.4(@types/node@26.1.1)(esbuild@0.28.1)(jiti@2.7.0)(yaml@2.9.0))
 
   apps/docs:
     dependencies:
       fumadocs-core:
-        specifier: ^16.10.7
-        version: 16.10.7(@mdx-js/mdx@3.1.1)(@types/estree-jsx@1.0.5)(@types/hast@3.0.4)(@types/mdast@4.0.4)(@types/react@19.2.17)(lucide-react@1.23.0(react@19.2.7))(next@16.2.9(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(zod@4.4.3)
+        specifier: ^16.11.3
+        version: 16.11.4(@mdx-js/mdx@3.1.1)(@types/estree-jsx@1.0.5)(@types/hast@3.0.5)(@types/mdast@4.0.4)(@types/react@19.2.17)(lucide-react@1.24.0(react@19.2.7))(next@16.3.0-preview.6(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(zod@4.4.3)
       fumadocs-mdx:
-        specifier: ^15.0.13
-        version: 15.0.13(@types/mdast@4.0.4)(@types/mdx@2.0.14)(@types/react@19.2.17)(fumadocs-core@16.10.7(@mdx-js/mdx@3.1.1)(@types/estree-jsx@1.0.5)(@types/hast@3.0.4)(@types/mdast@4.0.4)(@types/react@19.2.17)(lucide-react@1.23.0(react@19.2.7))(next@16.2.9(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(zod@4.4.3))(next@16.2.9(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react@19.2.7)(rolldown@1.0.2)(vite@8.0.14(@types/node@26.0.1)(esbuild@0.28.1)(jiti@2.7.0)(yaml@2.9.0))
+        specifier: ^15.1.0
+        version: 15.1.1(@types/mdast@4.0.4)(@types/mdx@2.0.14)(@types/react@19.2.17)(fumadocs-core@16.11.4(@mdx-js/mdx@3.1.1)(@types/estree-jsx@1.0.5)(@types/hast@3.0.5)(@types/mdast@4.0.4)(@types/react@19.2.17)(lucide-react@1.24.0(react@19.2.7))(next@16.3.0-preview.6(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(zod@4.4.3))(next@16.3.0-preview.6(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react@19.2.7)(rolldown@1.1.5)(vite@8.1.4(@types/node@26.1.1)(esbuild@0.28.1)(jiti@2.7.0)(yaml@2.9.0))
       fumadocs-ui:
-        specifier: ^16.10.7
-        version: 16.10.7(@types/mdx@2.0.14)(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(fumadocs-core@16.10.7(@mdx-js/mdx@3.1.1)(@types/estree-jsx@1.0.5)(@types/hast@3.0.4)(@types/mdast@4.0.4)(@types/react@19.2.17)(lucide-react@1.23.0(react@19.2.7))(next@16.2.9(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(zod@4.4.3))(next@16.2.9(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+        specifier: ^16.11.3
+        version: 16.11.4(@types/mdx@2.0.14)(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(fumadocs-core@16.11.4(@mdx-js/mdx@3.1.1)(@types/estree-jsx@1.0.5)(@types/hast@3.0.5)(@types/mdast@4.0.4)(@types/react@19.2.17)(lucide-react@1.24.0(react@19.2.7))(next@16.3.0-preview.6(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(zod@4.4.3))(next@16.3.0-preview.6(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
       next:
-        specifier: ^16.2.9
-        version: 16.2.9(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+        specifier: 16.3.0-preview.6
+        version: 16.3.0-preview.6(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
       react:
         specifier: ^19.2.7
         version: 19.2.7
@@ -304,8 +313,8 @@ importers:
         specifier: ^2.0.14
         version: 2.0.14
       '@types/node':
-        specifier: ^26.0.0
-        version: 26.0.1
+        specifier: ^26.1.0
+        version: 26.1.1
       '@types/react':
         specifier: ^19.2.17
         version: 19.2.17
@@ -313,23 +322,23 @@ importers:
         specifier: ^19.1.6
         version: 19.2.3(@types/react@19.2.17)
       typescript:
-        specifier: ^6.0.3
-        version: 6.0.3
+        specifier: ^7.0.2
+        version: 7.0.2
 
   packages/api:
     dependencies:
       '@effect/platform-bun':
         specifier: 'catalog:'
-        version: 4.0.0-beta.93(effect@4.0.0-beta.93)
+        version: 4.0.0-beta.97(effect@4.0.0-beta.97)
       '@effect/platform-node':
         specifier: 'catalog:'
-        version: 4.0.0-beta.93(effect@4.0.0-beta.93)(ioredis@5.11.0)
+        version: 4.0.0-beta.97(effect@4.0.0-beta.97)(ioredis@5.11.1)
       effect:
         specifier: 'catalog:'
-        version: 4.0.0-beta.93
+        version: 4.0.0-beta.97
       undici:
-        specifier: ^8.5.0
-        version: 8.5.0
+        specifier: ^8.7.0
+        version: 8.7.0
     devDependencies:
       '@tsconfig/bun':
         specifier: 'catalog:'
@@ -339,25 +348,25 @@ importers:
         version: 1.3.14
       '@typescript/native-preview':
         specifier: 'catalog:'
-        version: 7.0.0-dev.20260629.1
+        version: 7.0.0-dev.20260707.2
       '@vitest/coverage-istanbul':
         specifier: 'catalog:'
-        version: 4.1.9(vitest@4.1.9)
+        version: 4.1.10(vitest@4.1.10)
       knip:
         specifier: 'catalog:'
-        version: 6.23.0
+        version: 6.26.0
       oxfmt:
         specifier: 'catalog:'
-        version: 0.57.0
+        version: 0.58.0
       oxlint:
         specifier: 'catalog:'
-        version: 1.73.0(oxlint-tsgolint@0.23.0)
+        version: 1.74.0(oxlint-tsgolint@0.24.0)
       oxlint-tsgolint:
         specifier: 'catalog:'
-        version: 0.23.0
+        version: 0.24.0
       vitest:
         specifier: 'catalog:'
-        version: 4.1.9(@types/node@26.0.1)(@vitest/coverage-istanbul@4.1.9)(vite@8.0.14(@types/node@26.0.1)(esbuild@0.28.1)(jiti@2.7.0)(yaml@2.9.0))
+        version: 4.1.10(@types/node@26.1.1)(@vitest/coverage-istanbul@4.1.10)(vite@8.1.4(@types/node@26.1.1)(esbuild@0.28.1)(jiti@2.7.0)(yaml@2.9.0))
 
   packages/cli-darwin-arm64: {}
 
@@ -381,25 +390,25 @@ importers:
         version: 1.3.14
       '@typescript/native-preview':
         specifier: 'catalog:'
-        version: 7.0.0-dev.20260629.1
+        version: 7.0.0-dev.20260707.2
       '@vitest/coverage-istanbul':
         specifier: 'catalog:'
-        version: 4.1.9(vitest@4.1.9)
+        version: 4.1.10(vitest@4.1.10)
       knip:
         specifier: 'catalog:'
-        version: 6.23.0
+        version: 6.26.0
       oxfmt:
         specifier: 'catalog:'
-        version: 0.57.0
+        version: 0.58.0
       oxlint:
         specifier: 'catalog:'
-        version: 1.73.0(oxlint-tsgolint@0.23.0)
+        version: 1.74.0(oxlint-tsgolint@0.24.0)
       oxlint-tsgolint:
         specifier: 'catalog:'
-        version: 0.23.0
+        version: 0.24.0
       vitest:
         specifier: 'catalog:'
-        version: 4.1.9(@types/node@26.0.1)(@vitest/coverage-istanbul@4.1.9)(vite@8.0.14(@types/node@26.0.1)(esbuild@0.28.1)(jiti@2.7.0)(yaml@2.9.0))
+        version: 4.1.10(@types/node@26.1.1)(@vitest/coverage-istanbul@4.1.10)(vite@8.1.4(@types/node@26.1.1)(esbuild@0.28.1)(jiti@2.7.0)(yaml@2.9.0))
 
   packages/cli-windows-arm64: {}
 
@@ -409,16 +418,16 @@ importers:
     dependencies:
       '@effect/platform-bun':
         specifier: 'catalog:'
-        version: 4.0.0-beta.93(effect@4.0.0-beta.93)
+        version: 4.0.0-beta.97(effect@4.0.0-beta.97)
       '@effect/platform-node':
         specifier: 'catalog:'
-        version: 4.0.0-beta.93(effect@4.0.0-beta.93)(ioredis@5.11.0)
+        version: 4.0.0-beta.97(effect@4.0.0-beta.97)(ioredis@5.11.1)
       dedent:
         specifier: ^1.7.2
         version: 1.7.2
       effect:
         specifier: 'catalog:'
-        version: 4.0.0-beta.93
+        version: 4.0.0-beta.97
       smol-toml:
         specifier: ^1.7.0
         version: 1.7.0
@@ -431,38 +440,38 @@ importers:
         version: 1.3.14
       '@typescript/native-preview':
         specifier: 'catalog:'
-        version: 7.0.0-dev.20260629.1
+        version: 7.0.0-dev.20260707.2
       '@vitest/coverage-istanbul':
         specifier: 'catalog:'
-        version: 4.1.9(vitest@4.1.9)
+        version: 4.1.10(vitest@4.1.10)
       knip:
         specifier: 'catalog:'
-        version: 6.23.0
+        version: 6.26.0
       oxfmt:
         specifier: 'catalog:'
-        version: 0.57.0
+        version: 0.58.0
       oxlint:
         specifier: 'catalog:'
-        version: 1.73.0(oxlint-tsgolint@0.23.0)
+        version: 1.74.0(oxlint-tsgolint@0.24.0)
       oxlint-tsgolint:
         specifier: 'catalog:'
-        version: 0.23.0
+        version: 0.24.0
       vitest:
         specifier: 'catalog:'
-        version: 4.1.9(@types/node@26.0.1)(@vitest/coverage-istanbul@4.1.9)(vite@8.0.14(@types/node@26.0.1)(esbuild@0.28.1)(jiti@2.7.0)(yaml@2.9.0))
+        version: 4.1.10(@types/node@26.1.1)(@vitest/coverage-istanbul@4.1.10)(vite@8.1.4(@types/node@26.1.1)(esbuild@0.28.1)(jiti@2.7.0)(yaml@2.9.0))
 
   packages/process-compose:
     dependencies:
       '@effect/platform-bun':
         specifier: 'catalog:'
-        version: 4.0.0-beta.93(effect@4.0.0-beta.93)
+        version: 4.0.0-beta.97(effect@4.0.0-beta.97)
       effect:
         specifier: 'catalog:'
-        version: 4.0.0-beta.93
+        version: 4.0.0-beta.97
     devDependencies:
       '@effect/vitest':
         specifier: 'catalog:'
-        version: 4.0.0-beta.93(effect@4.0.0-beta.93)(vitest@4.1.9)
+        version: 4.0.0-beta.97(effect@4.0.0-beta.97)(vitest@4.1.10)
       '@tsconfig/bun':
         specifier: 'catalog:'
         version: 1.0.10
@@ -471,34 +480,34 @@ importers:
         version: 1.3.14
       '@typescript/native-preview':
         specifier: 'catalog:'
-        version: 7.0.0-dev.20260629.1
+        version: 7.0.0-dev.20260707.2
       '@vitest/coverage-istanbul':
         specifier: 'catalog:'
-        version: 4.1.9(vitest@4.1.9)
+        version: 4.1.10(vitest@4.1.10)
       knip:
         specifier: 'catalog:'
-        version: 6.23.0
+        version: 6.26.0
       oxfmt:
         specifier: 'catalog:'
-        version: 0.57.0
+        version: 0.58.0
       oxlint:
         specifier: 'catalog:'
-        version: 1.73.0(oxlint-tsgolint@0.23.0)
+        version: 1.74.0(oxlint-tsgolint@0.24.0)
       oxlint-tsgolint:
         specifier: 'catalog:'
-        version: 0.23.0
+        version: 0.24.0
       vitest:
         specifier: 'catalog:'
-        version: 4.1.9(@types/node@26.0.1)(@vitest/coverage-istanbul@4.1.9)(vite@8.0.14(@types/node@26.0.1)(esbuild@0.28.1)(jiti@2.7.0)(yaml@2.9.0))
+        version: 4.1.10(@types/node@26.1.1)(@vitest/coverage-istanbul@4.1.10)(vite@8.1.4(@types/node@26.1.1)(esbuild@0.28.1)(jiti@2.7.0)(yaml@2.9.0))
 
   packages/stack:
     dependencies:
       '@effect/platform-bun':
         specifier: 'catalog:'
-        version: 4.0.0-beta.93(effect@4.0.0-beta.93)
+        version: 4.0.0-beta.97(effect@4.0.0-beta.97)
       '@effect/platform-node':
         specifier: 'catalog:'
-        version: 4.0.0-beta.93(effect@4.0.0-beta.93)(ioredis@5.11.0)
+        version: 4.0.0-beta.97(effect@4.0.0-beta.97)(ioredis@5.11.1)
       '@supabase/config':
         specifier: workspace:*
         version: link:../config
@@ -507,14 +516,14 @@ importers:
         version: link:../process-compose
       effect:
         specifier: 'catalog:'
-        version: 4.0.0-beta.93
+        version: 4.0.0-beta.97
     devDependencies:
       '@effect/vitest':
         specifier: 'catalog:'
-        version: 4.0.0-beta.93(effect@4.0.0-beta.93)(vitest@4.1.9)
+        version: 4.0.0-beta.97(effect@4.0.0-beta.97)(vitest@4.1.10)
       '@supabase/supabase-js':
-        specifier: ^2.108.2
-        version: 2.108.2
+        specifier: ^2.110.2
+        version: 2.110.5
       '@tsconfig/bun':
         specifier: 'catalog:'
         version: 1.0.10
@@ -523,34 +532,37 @@ importers:
         version: 1.3.14
       '@typescript/native-preview':
         specifier: 'catalog:'
-        version: 7.0.0-dev.20260629.1
+        version: 7.0.0-dev.20260707.2
       '@vitest/coverage-istanbul':
         specifier: 'catalog:'
-        version: 4.1.9(vitest@4.1.9)
+        version: 4.1.10(vitest@4.1.10)
       knip:
         specifier: 'catalog:'
-        version: 6.23.0
+        version: 6.26.0
       oxfmt:
         specifier: 'catalog:'
-        version: 0.57.0
+        version: 0.58.0
       oxlint:
         specifier: 'catalog:'
-        version: 1.73.0(oxlint-tsgolint@0.23.0)
+        version: 1.74.0(oxlint-tsgolint@0.24.0)
       oxlint-tsgolint:
         specifier: 'catalog:'
-        version: 0.23.0
+        version: 0.24.0
       vitest:
         specifier: 'catalog:'
-        version: 4.1.9(@types/node@26.0.1)(@vitest/coverage-istanbul@4.1.9)(vite@8.0.14(@types/node@26.0.1)(esbuild@0.28.1)(jiti@2.7.0)(yaml@2.9.0))
+        version: 4.1.10(@types/node@26.1.1)(@vitest/coverage-istanbul@4.1.10)(vite@8.1.4(@types/node@26.1.1)(esbuild@0.28.1)(jiti@2.7.0)(yaml@2.9.0))
 
   tools/nx-plugins:
     dependencies:
       '@nx/devkit':
         specifier: 'catalog:'
-        version: 23.0.1(nx@23.0.1(@swc-node/register@1.11.1(@swc/core@1.15.43)(@swc/types@0.1.27)(typescript@6.0.3))(@swc/core@1.15.43))
+        version: 23.1.0(nx@23.1.0(@swc-node/register@1.11.1(@swc/core@1.15.43)(@swc/types@0.1.27)(@typescript/typescript6@6.0.2))(@swc/core@1.15.43))
+      typescript:
+        specifier: npm:@typescript/typescript6@^6.0.2
+        version: '@typescript/typescript6@6.0.2'
       vitest:
         specifier: 'catalog:'
-        version: 4.1.9(@types/node@26.0.1)(@vitest/coverage-istanbul@4.1.9)(vite@8.0.14(@types/node@26.0.1)(esbuild@0.28.1)(jiti@2.7.0)(yaml@2.9.0))
+        version: 4.1.10(@types/node@26.1.1)(@vitest/coverage-istanbul@4.1.10)(vite@8.1.4(@types/node@26.1.1)(esbuild@0.28.1)(jiti@2.7.0)(yaml@2.9.0))
 
 packages:
 
@@ -570,60 +582,60 @@ packages:
     resolution: {integrity: sha512-p+CMKJ93HFmLkjXKlXiVGlMQEuRb6H0MokBSwUsX+S6BRX8eV5naFZpQJFfJHjRZY0Hmnqy1/r6UWl3x+19zYA==}
     engines: {node: '>=18'}
 
-  '@anthropic-ai/claude-agent-sdk-darwin-arm64@0.3.196':
-    resolution: {integrity: sha512-k1MKRDhSiNKpkTwhtU8QKGzfuRfr3YXS6oqsTuldMROX56L5iMXjzC7AYU1/KmPTeMl3SCQBQeDu0i8ciA0hQA==}
+  '@anthropic-ai/claude-agent-sdk-darwin-arm64@0.3.209':
+    resolution: {integrity: sha512-08qu5ZImKxAsfyxQdXw2fHpIvTS39kAN/T6iWdRPY/1yicnqAxIl8R9PQ63TJaDnWTo7wWu6O26GKbEX9d7xDw==}
     cpu: [arm64]
     os: [darwin]
 
-  '@anthropic-ai/claude-agent-sdk-darwin-x64@0.3.196':
-    resolution: {integrity: sha512-bBwx/7yKZMQ9NSUt4bg8P+zp6pgd/O/DTkzdqsRIivBvARmwo1QY/2qGrLO8RH0T8CG2lTjFNfDfOlJWbAkvAg==}
+  '@anthropic-ai/claude-agent-sdk-darwin-x64@0.3.209':
+    resolution: {integrity: sha512-p3egSQ75amhjOO0P21pNfs94SueEAbOc0s7IFrGy8CZKXcFMIrOzUXKoi2iTWtR8P9v4ayibf38AJRa2Rz7KPA==}
     cpu: [x64]
     os: [darwin]
 
-  '@anthropic-ai/claude-agent-sdk-linux-arm64-musl@0.3.196':
-    resolution: {integrity: sha512-BhLxfx4j6mC3Uzmve1IbhFS1uvNlwATeo6uWyYDOMW4n3XKjiSgjD8bTfkamijrxCMvJo5swLju2y14ayDsokA==}
+  '@anthropic-ai/claude-agent-sdk-linux-arm64-musl@0.3.209':
+    resolution: {integrity: sha512-jtoia0l10xgrsBWjA12n6Q0WxOyr/8qf1eUMOGSO7zdNau/7wABYBXS+VGF8utBEsF4NJjfCEEj2yhEB8uHjLA==}
     cpu: [arm64]
     os: [linux]
     libc: [musl]
 
-  '@anthropic-ai/claude-agent-sdk-linux-arm64@0.3.196':
-    resolution: {integrity: sha512-fR5fy+pSQSpKZK0zTtAl3LZEGQTuwVK7svutH1bZUS5RGT2HdUWc71oltSZgW4upGaslj+gyusHGJHA5eAc+dw==}
+  '@anthropic-ai/claude-agent-sdk-linux-arm64@0.3.209':
+    resolution: {integrity: sha512-eTgga/TuganOj9VAWUrjtt6BSqapeJau4ioCrQRw0RbDN/d/oLih/hdKzPeCn3yBw4Wdwwlip2z1cHKPNEggtQ==}
     cpu: [arm64]
     os: [linux]
     libc: [glibc]
 
-  '@anthropic-ai/claude-agent-sdk-linux-x64-musl@0.3.196':
-    resolution: {integrity: sha512-EOiNbxCXQLYzV7SQhMWkUC1ScWyTw/Qp+JyV2sEmIbzl/e7KMOxNE9J20k+lpPs6CXdxVzuMwH7yAGuDu5y+IQ==}
+  '@anthropic-ai/claude-agent-sdk-linux-x64-musl@0.3.209':
+    resolution: {integrity: sha512-GjxSlqk6yYCxb9BApVZvJ/Aq3OoI5mDRhpBpsZM23idNHg5/019sBBx4IGmkBjmfxTX5zzvu+m0fU18vl3W2Mg==}
     cpu: [x64]
     os: [linux]
     libc: [musl]
 
-  '@anthropic-ai/claude-agent-sdk-linux-x64@0.3.196':
-    resolution: {integrity: sha512-9spZON7/tn0q9J+jICrdfHi7o7Fmjs9pIohCCxL+Yv7HbBXWVtEYJbYipBGLTl8ICG3mgPeEVMNsvOuh/jDTuA==}
+  '@anthropic-ai/claude-agent-sdk-linux-x64@0.3.209':
+    resolution: {integrity: sha512-XGhc23qmqk1yUwG633iZUxPM91iJjrX/a+DVy+Pz5X5J64aXFAsR9R+kNkJ1X5FDcm+MSYywUtQm9AmAZaiG2Q==}
     cpu: [x64]
     os: [linux]
     libc: [glibc]
 
-  '@anthropic-ai/claude-agent-sdk-win32-arm64@0.3.196':
-    resolution: {integrity: sha512-0xXkAWlDof/qFi3k5KJZ5WYbgp1X8hZHjyasOWTZWAmldoYaENI0vkL+PVMarvoAFYRRqcWoS81FSgm0QgH2sA==}
+  '@anthropic-ai/claude-agent-sdk-win32-arm64@0.3.209':
+    resolution: {integrity: sha512-LIMVnToVRmcTeN/dDAdFP/U60/aM0/qbKOWza+0BabhrGwF/3nPIIoGrMrkLsKPzOsfNWrl+kepexP1zWb1x5w==}
     cpu: [arm64]
     os: [win32]
 
-  '@anthropic-ai/claude-agent-sdk-win32-x64@0.3.196':
-    resolution: {integrity: sha512-FxWLA3aOYgDf2J0o6Ov1/wgg9X6RkrgnX4ifUWO1i3+6mbc4efNLHkDZLxCHEnQgW8yBidX+iro19f9k64vV8A==}
+  '@anthropic-ai/claude-agent-sdk-win32-x64@0.3.209':
+    resolution: {integrity: sha512-tY5/+lmhqm7JQhvxLVTkhe2/UAw46gu8RnFrTwhoM0gEXDTmQhNlTM+m4F9LGeSfgKb2TElHpcQ237XNG1Ok6Q==}
     cpu: [x64]
     os: [win32]
 
-  '@anthropic-ai/claude-agent-sdk@0.3.196':
-    resolution: {integrity: sha512-yqsp1/04T2/tJ54jz+7YLsTZOPeQ/myUCrv17/IVZ9dbl+izIMP9ULuLpPCH5pj5msXxR80es+hpVgHoFuNm0A==}
+  '@anthropic-ai/claude-agent-sdk@0.3.209':
+    resolution: {integrity: sha512-HdxLmpnIOd4CSYxdlD/4ShKFvHAuWefP1MTf/B+Mj0Oq8Tb9qzmhLuHCZMd5Pf21Knrt7jke/t4coYAtokFcuw==}
     engines: {node: '>=18.0.0'}
     peerDependencies:
       '@anthropic-ai/sdk': '>=0.93.0'
       '@modelcontextprotocol/sdk': ^1.29.0
       zod: ^4.0.0
 
-  '@anthropic-ai/sdk@0.107.0':
-    resolution: {integrity: sha512-RWDWyvIeZnatUTzyX8+ayFzAqqLyoDHKnDEODFyW8H89zH+qEsh5h6XAmnbHY5DCoa58o3rjuNe3F3Hg851ayA==}
+  '@anthropic-ai/sdk@0.111.0':
+    resolution: {integrity: sha512-1hUqKi+uJQoS5X90+InwHbFAXMvgq0DnsC5hVLEeSRaODiU5WvmqDAcVCmGS2wC0pN9Z8jtWCbWw7JLzeDdm/Q==}
     hasBin: true
     peerDependencies:
       zod: ^3.25.0 || ^4.0.0
@@ -702,12 +714,12 @@ packages:
     resolution: {integrity: sha512-4zBIxpPzowiZpusoFkyGVwakdRJUyuH5PxQ/PrqghfdFWWasvnCdPfQXHrenDai+gyLARulZjZowCOj6fjT4pA==}
     engines: {node: '>=6.9.0'}
 
-  '@clack/core@1.4.2':
-    resolution: {integrity: sha512-0Ty/1Gfm+Kb07sXcuESjyKfwEhSy4Ns1AgeEisHb/bDY5fWme0tTeTkU14T1Gmcs17YIjB/teiDe4uaCghbYqQ==}
+  '@clack/core@1.4.3':
+    resolution: {integrity: sha512-/kr3UWNtdJfxZtPgDqUOmG2pvwlmcLGheex5yiZKdwbzZJxhV+HMNR9QNmyY5cGwTNV6LrR7Jtp+KjhUAP1qBQ==}
     engines: {node: '>= 20.12.0'}
 
-  '@clack/prompts@1.6.0':
-    resolution: {integrity: sha512-EYlRokl8szrP9Z25qT5aepMdBjzBvHF9ZEhzIiUBc9guz/T31EqRgvD0QSgZcpE93xiwrr+OkB4nz0BZyF6fSA==}
+  '@clack/prompts@1.7.0':
+    resolution: {integrity: sha512-y7/yvZ2TPAnR9+jnc00klvNNLkJiXFFrQA/hlLCcxA9a2A4zQIOimyFQ9XfwYKiGD1fb5GY8vbKIIgO8d5Tb2A==}
     engines: {node: '>= 20.12.0'}
 
   '@colors/colors@1.5.0':
@@ -724,72 +736,69 @@ packages:
     peerDependencies:
       '@noble/ciphers': ^1.0.0
 
-  '@effect/atom-react@4.0.0-beta.93':
-    resolution: {integrity: sha512-43FOYozhZT+VIQBH5LVAbabhdjGCuxGKdVTeUnkMp5NY+/g3nDLcAyAkNYn99G3+XDbqFvJaqmNJP7NLF5+WFg==}
+  '@effect/atom-react@4.0.0-beta.97':
+    resolution: {integrity: sha512-yKj5KqgDuAayxkVdXzt0kJaqob0QLozqepPVhGj/I0QPIvGSEfX3OaBGt09irGMyqbP4CKMGtiewyHwRwPZSsw==}
     peerDependencies:
-      effect: ^4.0.0-beta.93
+      effect: ^4.0.0-beta.97
       react: ^19.2.4
       scheduler: '*'
 
-  '@effect/platform-bun@4.0.0-beta.93':
-    resolution: {integrity: sha512-pny29d1NhJ7XLv19as7A0pIZr+QFi5KejnwB/lLW1c8P63t+PDMPEn21toy2vx2yzl9xRTo8heyiXPXRsqPN5w==}
+  '@effect/platform-bun@4.0.0-beta.97':
+    resolution: {integrity: sha512-WYjC7nKiWfNywIz1zeBEXnrpuHJM86DOi3lSZSSBeHCPz8HYw7IT2FL7u+aaJHHsJCyFiZVAgg2KFS8aMFSJBQ==}
     peerDependencies:
-      effect: ^4.0.0-beta.93
+      effect: ^4.0.0-beta.97
 
-  '@effect/platform-node-shared@4.0.0-beta.93':
-    resolution: {integrity: sha512-XUqZ2u5GglBqY8q2jj4Q7GjN5K/enedk8auZM9rY/l5a/myaQTrQp3QnvpIK4/Yg0WFjLGuctGPMKWRk3OLIrA==}
+  '@effect/platform-node-shared@4.0.0-beta.97':
+    resolution: {integrity: sha512-sAlygOlDLLERk7fC24f7Aa4G3wkEbGyyMEileHTHU2fThiPYSGMqNRK1LLnNr17m2+JR7BHbycwXkJkM18BAQw==}
     engines: {node: '>=18.0.0'}
     peerDependencies:
-      effect: ^4.0.0-beta.93
+      effect: ^4.0.0-beta.97
 
-  '@effect/platform-node@4.0.0-beta.93':
-    resolution: {integrity: sha512-QagsCGR0ZOXaCQqS5qGR2mcDng4LiP2bYhiiX1D6UC8cT9vsusVVOHiJWn8CupeDx+yVnPcu81QmA/SDt6GM1w==}
+  '@effect/platform-node@4.0.0-beta.97':
+    resolution: {integrity: sha512-Vd40VLh+Y08Bs37KWtbe9AgO2+t3RKZKGX9YC6ZKAcswu4tXR3CwSI7V2MN+GgS+ez/GLmqH1WrzDDlaIAxKPA==}
     engines: {node: '>=18.0.0'}
     peerDependencies:
-      effect: ^4.0.0-beta.93
+      effect: ^4.0.0-beta.97
       ioredis: ^5.7.0
 
-  '@effect/sql-pg@4.0.0-beta.93':
-    resolution: {integrity: sha512-wpoGGezcmMVGG9p9vumFTR42+LPE2PaaUZ+vTcpo0hyc4TvChSRZiv4uZafrXEnDdYgdUFw7UQzrEO8+pa5crg==}
+  '@effect/sql-pg@4.0.0-beta.97':
+    resolution: {integrity: sha512-q0SZRN63Spm4lM72b1Aji0HZHEZgQxqp3mdYSVaskqXQxdZGyFxni+c19mzFNTYp+op8N+2PGoFzwqUdxFrxZA==}
     peerDependencies:
-      effect: ^4.0.0-beta.93
+      effect: ^4.0.0-beta.97
 
-  '@effect/vitest@4.0.0-beta.93':
-    resolution: {integrity: sha512-gMAnZ9PiMeJMDED9s0jWgCOhc2JccrTCxowhur/KriImsHnHIRj4VG/vK0xLw0Axe4AkTWzXNdRsFrYOjBTl3A==}
+  '@effect/vitest@4.0.0-beta.97':
+    resolution: {integrity: sha512-1dH6LBWSZyqnTV7ZO+yIpPGPf/xd7RtFfvQ4ZpTy9elzFN+wr1YBFpHSCr8+BfXOml6b8g9Mtj5eDy1qjbizUA==}
     peerDependencies:
-      effect: ^4.0.0-beta.93
+      effect: ^4.0.0-beta.97
       vitest: ^3.0.0 || ^4.0.0
 
-  '@emnapi/core@1.10.0':
-    resolution: {integrity: sha512-yq6OkJ4p82CAfPl0u9mQebQHKPJkY7WrIuk205cTYnYe+k2Z8YBh11FrbRG/H6ihirqcacOgl2BIO8oyMQLeXw==}
-
   '@emnapi/core@1.11.0':
     resolution: {integrity: sha512-l9Oo58x0HOP5znGzVhYW9U3e5wVuA4LAZU2AGezTmkhO1CgQRFDhDg4nneHsu/t3WniXg9QrG2nIXL/ZS8ln8Q==}
 
   '@emnapi/core@1.11.1':
     resolution: {integrity: sha512-RSvbQmHzdKzNsLYa/wHrbc3KN4sYLKAdPZxqiM2HATqv/SBk2/ENSHpvXGaLOMcsAyz0poEGqkmmKYG3OWiJEQ==}
 
+  '@emnapi/core@1.11.2':
+    resolution: {integrity: sha512-TC8MkTuZUtcTSiFeuC0ksCh9QIJ5+F21MvZ4Wn4ORfYaFJ/0dsiudv5tVkejgwZlwQ39jL9WWDe2lz8x0WglOA==}
+
   '@emnapi/core@1.4.5':
     resolution: {integrity: sha512-XsLw1dEOpkSX/WucdqUhPWP7hDxSvZiY+fsUC14h+FtQ2Ifni4znbBt8punRX+Uj2JG/uDb8nEHVKvrVlvdZ5Q==}
 
-  '@emnapi/runtime@1.10.0':
-    resolution: {integrity: sha512-ewvYlk86xUoGI0zQRNq/mC+16R1QeDlKQy21Ki3oSYXNgLb45GV1P6A0M+/s6nyCuNDqe5VpaY84BzXGwVbwFA==}
-
   '@emnapi/runtime@1.11.0':
     resolution: {integrity: sha512-55coeOFKHv1ywEcUXJtWU5f+Jr/W5tZDvZig8DLKSwUN1JpROQ4rk/SNOQiFWmaR/VKF4zuFyW1B8JduOSv6Pg==}
 
   '@emnapi/runtime@1.11.1':
     resolution: {integrity: sha512-vgj7R3y3Wgx24IQaGPA/R6YFXLHVMOZ0uVEyIQPaWs+rd1AzfEMXlAC22FYwO1XkKR6NPsq7mUandH8oIRdZFw==}
 
+  '@emnapi/runtime@1.11.2':
+    resolution: {integrity: sha512-kyOl3X0DuTiT1h2ft8r2fYO8JYtU9a9Xis/zBSiGArNaagCOWx90N1k2wxp18czFDH+OgcWGb5ZP/XMt3dcyPA==}
+
   '@emnapi/runtime@1.4.5':
     resolution: {integrity: sha512-++LApOtY0pEEz1zrd9vy1/zXVaVJJ/EbAF3u0fXIzPJEDtnITsBGbbK0EkM72amhl/R5b+5xx0Y/QhcVOpuulg==}
 
   '@emnapi/wasi-threads@1.0.4':
     resolution: {integrity: sha512-PJR+bOmMOPH8AtcTGAyYNiuJ3/Fcoj2XN/gBEWzDIKh254XO+mM9XoXHk5GNEhodxeMznbg7BlRojVbKN+gC6g==}
 
-  '@emnapi/wasi-threads@1.2.1':
-    resolution: {integrity: sha512-uTII7OYF+/Mes/MrcIOYp5yOtSMLBWSIoLPpcgwipoiKbli6k322tcoFsxoIIxPDqW01SQGAgko4EzZi2BNv2w==}
-
   '@emnapi/wasi-threads@1.2.2':
     resolution: {integrity: sha512-c95qOXkHdydNKhscBTebqEC1CVAZpyqOfVfBzQ1qgzyl3gfeldUjIggDbIZgDKsHLgnsM+igH7TJ/eAasaVuMA==}
 
@@ -949,20 +958,20 @@ packages:
     cpu: [x64]
     os: [win32]
 
-  '@floating-ui/core@1.7.5':
-    resolution: {integrity: sha512-1Ih4WTWyw0+lKyFMcBHGbb5U5FtuHJuujoyyr5zTaWS5EYMeT6Jb2AuDeftsCsEuchO+mM2ij5+q9crhydzLhQ==}
+  '@floating-ui/core@1.8.0':
+    resolution: {integrity: sha512-0CIZ5itps/8x7BG8dEIhs53BvCUH2PCoogtakwRTut+Arm58sJooJ0AuZhLw2HJYIR5cMLNPBSS728sPho2khQ==}
 
-  '@floating-ui/dom@1.7.6':
-    resolution: {integrity: sha512-9gZSAI5XM36880PPMm//9dfiEngYoC6Am2izES1FF406YFsjvyBMmeJ2g4SAju3xWwtuynNRFL2s9hgxpLI5SQ==}
+  '@floating-ui/dom@1.8.0':
+    resolution: {integrity: sha512-yXSrzeHZBTZadLOlfyhCkJHNeLJnHRnRInwdZ40L7ZiaAtrBwoYlsDrX3v5zB1Utk7CLfzcOVnVVWoXEky7Ceg==}
 
-  '@floating-ui/react-dom@2.1.8':
-    resolution: {integrity: sha512-cC52bHwM/n/CxS87FH0yWdngEZrjdtLW/qVruo68qg+prK7ZQ4YGdut2GyDVpoGeAYe/h899rVeOVm6Oi40k2A==}
+  '@floating-ui/react-dom@2.1.9':
+    resolution: {integrity: sha512-JDjEFGCpImxDCA7JJKviA0M9+RtmJdj0m/NVU5IMgBK+AmZouAQQ7/+2GLH0GXXY0YMw9oXPB8hKdbPYg5QLYg==}
     peerDependencies:
       react: '>=16.8.0'
       react-dom: '>=16.8.0'
 
-  '@floating-ui/utils@0.2.11':
-    resolution: {integrity: sha512-RiB/yIh78pcIxl6lLMG0CgBXAZ2Y0eVHqMPYugu+9U0AeT6YBeiJpf7lbdJNIugFP5SIjwNRgo4DhR1Qxi26Gg==}
+  '@floating-ui/utils@0.2.12':
+    resolution: {integrity: sha512-HpCo8tmWzLVad5s2d19EhAz5zqrrQ6s69qd6moPMQvkOuSwDT1YgRfWSVuc4ennqrgv3OHppiOGMQ7oC13yIww==}
 
   '@fuma-translate/react@1.0.2':
     resolution: {integrity: sha512-uOiOtBx3nRXR8Nu1GzBf1tApgF1FErDBTHxRIAQeyQdyOoZbrNRN6H4kDCWObY4qyGeGbHydG0DHzgeUgFDMIw==}
@@ -974,14 +983,11 @@ packages:
       '@types/react':
         optional: true
 
-  '@fumadocs/tailwind@0.0.5':
-    resolution: {integrity: sha512-ENKPWUDRmriccsrUDE4bDBq3FNr/ms3BP2rWlsAEMV1yP23pcCaan+ceGfeBUsAQjw7sj9Q3R4Kl3g/TCStPzQ==}
+  '@fumadocs/tailwind@0.1.1':
+    resolution: {integrity: sha512-BnPe52UxSaG8yKlHMKBxXw8h6GpK5qO55ci6+Qd5JnquTvIw6SpfbC1P+qAi82PuPWv1KZAWY8bxRk4+x9ctXw==}
     peerDependencies:
-      '@tailwindcss/oxide': ^4.0.0
       tailwindcss: ^4.0.0
     peerDependenciesMeta:
-      '@tailwindcss/oxide':
-        optional: true
       tailwindcss:
         optional: true
 
@@ -1304,57 +1310,57 @@ packages:
       '@emnapi/core': ^1.7.1
       '@emnapi/runtime': ^1.7.1
 
-  '@next/env@16.2.9':
-    resolution: {integrity: sha512-ki5VxxXfzD/9TDe13wyeTKIjQTAwBVpnr8KhRDUr8ltMUq1/NBpWNT5tiPoxiGl+PHM4X2ahSOiPk6iAimIzPg==}
+  '@next/env@16.3.0-preview.6':
+    resolution: {integrity: sha512-tdsih48yzumsL060VIsZ9BwDYlZk0AAMT8HccspSbPUzp6ntCZ9xOMFU4W0SmqaOCEpPmTyP+5e6WT36mqN2fw==}
 
-  '@next/swc-darwin-arm64@16.2.9':
-    resolution: {integrity: sha512-HkfxNYUCmcct0Xsqib5KxqMSHV4AHJq857BNRchyBDs4YS19aHzVfn1kDuBYKqLLQBjXgnkIsjV2Kd4d2wzYhw==}
+  '@next/swc-darwin-arm64@16.3.0-preview.6':
+    resolution: {integrity: sha512-cQB2whnW1PD/Q+AxoI2X4LU3af1B+aFxWx+kmAiCCKDyjoO5Nh+9GyNu+nDAbP/WoloohbOWgO8m1U9j1EIZuw==}
     engines: {node: '>= 10'}
     cpu: [arm64]
     os: [darwin]
 
-  '@next/swc-darwin-x64@16.2.9':
-    resolution: {integrity: sha512-7IAtK4MeybpqRV9GRABWEhJ62mOS+rzWOzOTFie4cSEtm12xsoOMJRcECoZx3FHPzFAqN/IJtHqWAFOLfl152w==}
+  '@next/swc-darwin-x64@16.3.0-preview.6':
+    resolution: {integrity: sha512-Ctrzjav21HlHwMV6afeC9/PePUdyJ+AXDQNfrrqdkIEdem9f3vsBVKtuB6gcCNT4umtql7ZLB1qaQObVqKVp5g==}
     engines: {node: '>= 10'}
     cpu: [x64]
     os: [darwin]
 
-  '@next/swc-linux-arm64-gnu@16.2.9':
-    resolution: {integrity: sha512-hBD75iWpUtkL9SmQmcRhmLomn9jgkPzCEkbOcLgHymPEKzv+6ONy13RRiIEz/iEObjkS2Jlb5gYS2XGoS3X4rw==}
+  '@next/swc-linux-arm64-gnu@16.3.0-preview.6':
+    resolution: {integrity: sha512-V2o4V3ghCDwZ0K3BI2ts/+zDaLI1Y28Q/Bs53K3Zqk4/3M8yBTImXX7XL6BVOihncvSl8QUG3c32/W6AlgEsJA==}
     engines: {node: '>= 10'}
     cpu: [arm64]
     os: [linux]
     libc: [glibc]
 
-  '@next/swc-linux-arm64-musl@16.2.9':
-    resolution: {integrity: sha512-qZTI3pf9SGc/obr8NkQAekBxmp1QK+kVm+VAf3BALLfFAj+1kUhkTxmrWpVos9R/UYIA8AWX2p6cGI5WdwzVUA==}
+  '@next/swc-linux-arm64-musl@16.3.0-preview.6':
+    resolution: {integrity: sha512-btfR0TMj4RvscjYW7QvRQHstXas2969M4TBaQW98BFBLyuD8R0RFwmxYxep/aDu+xkKzfDvLsBFYcYX0ucsIHQ==}
     engines: {node: '>= 10'}
     cpu: [arm64]
     os: [linux]
     libc: [musl]
 
-  '@next/swc-linux-x64-gnu@16.2.9':
-    resolution: {integrity: sha512-xm0HfRNX+UkH4R3c18ynswjj5o5uEj/7iI9p9omdtTSIsRCzQqkGMA+10nzJ4EHnYC3as65IMhbbl5fWRUWHYg==}
+  '@next/swc-linux-x64-gnu@16.3.0-preview.6':
+    resolution: {integrity: sha512-arKlC6NTJ43NjhH+yVwEChLSWLWRtuUQPHYkuoKBK62hyL9rnMhNOXUWcQdvvhQ75UBqIDo7dpkfpOlizLClGw==}
     engines: {node: '>= 10'}
     cpu: [x64]
     os: [linux]
     libc: [glibc]
 
-  '@next/swc-linux-x64-musl@16.2.9':
-    resolution: {integrity: sha512-QumimHkGEG6vM3PfEDWKyKen03NcqLOkeKB1EfcPe7VxzmEiCa4jNnMyBn/US5zcd/VE1CI+O8Ovb3lfjVHfGw==}
+  '@next/swc-linux-x64-musl@16.3.0-preview.6':
+    resolution: {integrity: sha512-ETrNCY3R1FJpOmh6I3pM+EbNA5kTTxQsCxVJTvKE9QN6+AxC6H4Ybu9F26WBseZT7zOFawlujWl8P6xo1hbgDQ==}
     engines: {node: '>= 10'}
     cpu: [x64]
     os: [linux]
     libc: [musl]
 
-  '@next/swc-win32-arm64-msvc@16.2.9':
-    resolution: {integrity: sha512-hzQpKZvw8rAwI6A2uQh6SacCSvNAXaIkPNsWwzqqfRiIMiXMfH936skDhz1OO6KpvdKkJrgHHtqQOq5PIXOvdQ==}
+  '@next/swc-win32-arm64-msvc@16.3.0-preview.6':
+    resolution: {integrity: sha512-6N92Tg9ImGX3anKiUu1EQYcFRXvrteL2+U/cQ863SMX9Huh8+/o3jIyCni15+NJD02Va7KQIAovURMd+EkaSOA==}
     engines: {node: '>= 10'}
     cpu: [arm64]
     os: [win32]
 
-  '@next/swc-win32-x64-msvc@16.2.9':
-    resolution: {integrity: sha512-qr2VL3Ce5QrwgO2yh1ujSBawrimjVKX8FGF/cOynmdYKJY0BdHpGVNIRK1tqONB10Vkm25Ub1BD2bkjWs4+96w==}
+  '@next/swc-win32-x64-msvc@16.3.0-preview.6':
+    resolution: {integrity: sha512-DR6uqZI+ytCOg+F3MouQKjWwEI1I7+cAuunKtI0V3mEHdBGUmhh0t60+rrKhh+h24bvEfVr5UrH/aljAV9L0rw==}
     engines: {node: '>= 10'}
     cpu: [x64]
     os: [win32]
@@ -1383,62 +1389,62 @@ packages:
     resolution: {integrity: sha512-oGB+UxlgWcgQkgwo8GcEGwemoTFt3FIO9ababBmaGwXIoBKZ+GTy0pP185beGg7Llih/NSHSV2XAs1lnznocSg==}
     engines: {node: '>= 8'}
 
-  '@nx/devkit@23.0.1':
-    resolution: {integrity: sha512-A/chuNS1RZwdbRe/Nf+w0qtPEFHLcZNPzo8Abw5mBxyXmy9yvHZpuZuqDbt/lASFU+TEb74xExL1AnKWwqpOIg==}
+  '@nx/devkit@23.1.0':
+    resolution: {integrity: sha512-4LPBrjwtretBQksqph2aXqz2Atd5+oO7RTVlQoOweU8Sh2A0wM8CNig8n+LX2iwxniPYRooLN4kRtKxO4mi2Mw==}
     peerDependencies:
       nx: '>= 22 <= 24 || ^23.0.0-0'
 
-  '@nx/nx-darwin-arm64@23.0.1':
-    resolution: {integrity: sha512-gQJvgPnbI91DBe23Th2CqD9R/S54cPS3C1f0DhyQ8YEf9rR7EEc+sVGjhgVxlhfOk2W7I1Gy6EkXwpN4aDoW4w==}
+  '@nx/nx-darwin-arm64@23.1.0':
+    resolution: {integrity: sha512-wIFH5p0AXLxbYUHgYEH/zpWpPTQ9LpqESo/GcOPXkSBtUkSAZcqXZ6jmFzTPqGAeP4PBcVZIetO0TXmSSyEO7Q==}
     cpu: [arm64]
     os: [darwin]
 
-  '@nx/nx-darwin-x64@23.0.1':
-    resolution: {integrity: sha512-e/lvzHKN6gpuD7MqEtfH1fOfnR75E55ytYNt8jaRxKI6EvpCq+Q3MunDuh9GQYAkqDrUqE7AhHrHc+eKATVEHw==}
+  '@nx/nx-darwin-x64@23.1.0':
+    resolution: {integrity: sha512-D7fEW3+agyb0cWGi8qgN/0irHUwcO8nsuYOrRJjphtWE6J76EORW5sMY93/YFfnLeFVhBMBNVrE6aj2Y4wYCbA==}
     cpu: [x64]
     os: [darwin]
 
-  '@nx/nx-freebsd-x64@23.0.1':
-    resolution: {integrity: sha512-f582OhSYN9qHpA9Ox9qnr3kZSZ7gQHs7crmBUutmbXmZQB2TDS/TlhvYSNnxudpwHR/tuWGi2IOQqa7zGOZj1Q==}
+  '@nx/nx-freebsd-x64@23.1.0':
+    resolution: {integrity: sha512-yZoZyc9t3ViaA9WWDe5F7IlJ+58Hqdn6gqoO9UG2FH3Io1mj+KpF3jhUoj3S1m18D28MN2oItS762QIt6otO3g==}
     cpu: [x64]
     os: [freebsd]
 
-  '@nx/nx-linux-arm-gnueabihf@23.0.1':
-    resolution: {integrity: sha512-VjhqPc6E7aiI0e+lowrkVbdyulsmP9fgMdcX1mCzXCEu/XZDcUbZ5qveR964cMhvm5qKn0ILJtJOUqZgmOT3Xg==}
+  '@nx/nx-linux-arm-gnueabihf@23.1.0':
+    resolution: {integrity: sha512-D6QhBsLRUmwCc1jSjmY5MkyKOSWuQXQmu5K3BH6d1/uoX2HEZ68XgNyMkSwMA0g6jBKHIAguGkujiaCiXBEPeA==}
     cpu: [arm]
     os: [linux]
 
-  '@nx/nx-linux-arm64-gnu@23.0.1':
-    resolution: {integrity: sha512-zX2JdHQejZWB3DRgNsh77qOVYaSSjSLuBP2qIqc7EWVlCUnR7Aj3e65PTIps4LxMMmUp4twZA2ezS0rtyK2A4w==}
+  '@nx/nx-linux-arm64-gnu@23.1.0':
+    resolution: {integrity: sha512-Q61stbUFVBw9TprlVLkRQmk+fuMXPlyTlvGExJ1y8KYymDTFsjs8LFk7zTnRvFpI9LVMRuhyD3osaLy2TxPU7Q==}
     cpu: [arm64]
     os: [linux]
     libc: [glibc]
 
-  '@nx/nx-linux-arm64-musl@23.0.1':
-    resolution: {integrity: sha512-9lyhxRNBgNYwHt6paq0OLzoKNoEGF5LnNW2YYrgFY8Cjtsg/Q4pcfZ1vB5o9FX9OmUgUQs3t2d4tU8YDukRUWg==}
+  '@nx/nx-linux-arm64-musl@23.1.0':
+    resolution: {integrity: sha512-Lm5PC4yuBHw4gr37vcAX3kvS75prqL1VpbQkPHs4Z2Us1ri29ALxgdrEFgF6fbCXxl4w3sWmcbKGvrcMdpuvIQ==}
     cpu: [arm64]
     os: [linux]
     libc: [musl]
 
-  '@nx/nx-linux-x64-gnu@23.0.1':
-    resolution: {integrity: sha512-kVszY2xRyyrCXgdCdM1qG1WUhDjNPZxtdWq86a0TyIRJjfJTP9NHqpyhmvj9c2RdZxKVWHotx6fBJzY6Vn2ZrA==}
+  '@nx/nx-linux-x64-gnu@23.1.0':
+    resolution: {integrity: sha512-v1ELSkVskidK6A+mm/Ynm8TWIb5UdzGWMcD7CTgmvjTzKfXIO0QY1ToDTqvoBwnetcehWR5gnhQlhQgOSH8XFA==}
     cpu: [x64]
     os: [linux]
     libc: [glibc]
 
-  '@nx/nx-linux-x64-musl@23.0.1':
-    resolution: {integrity: sha512-co71K2n4zcS1SYR8EBRlCvIko7M1YycO2tZL0nrCrga87AF5dzCwx+wEclpyCR/4tNOY3FrACk4gIkVskh3CdA==}
+  '@nx/nx-linux-x64-musl@23.1.0':
+    resolution: {integrity: sha512-pD/Axn0usK2/RV2bSrLX7h59YpOXGiaYHmlZynVVS+CqkKbyFzxnrvvLmRdOdMxsfM6oDXom4lCcJMg+wUYcpw==}
     cpu: [x64]
     os: [linux]
     libc: [musl]
 
-  '@nx/nx-win32-arm64-msvc@23.0.1':
-    resolution: {integrity: sha512-7oma7iy5fbnn+x5AP7SFGMuleAA2R5RZm26dn+faikyQ4PXjoRAikWJJNiOWAeCA0BaMAeVedI6fJeAsVeDUKg==}
+  '@nx/nx-win32-arm64-msvc@23.1.0':
+    resolution: {integrity: sha512-lhnRaXPGUwqw/dqBnWl/6d6r8mRQXuZS7qnnTd+U5O1R7YPb2494BQyE7aSVEFLHcX9nXywMGxo5+OUCH84xQA==}
     cpu: [arm64]
     os: [win32]
 
-  '@nx/nx-win32-x64-msvc@23.0.1':
-    resolution: {integrity: sha512-TE/wvBa2cpkVXmk/AXUQAneong4JReS2hyNpAUONKG1yXU7TDKe0wvn1xQXxAbyspudT9NuCnVtpVuEkRz8S+Q==}
+  '@nx/nx-win32-x64-msvc@23.1.0':
+    resolution: {integrity: sha512-fJaNYwNk4RiUnyEDTc0bMu69dmUzgM7iGinoqFenwYEtwaXPWREBRWL6lgRDyR3CFsJw3Wi0uc+33cfreTbhVw==}
     cpu: [x64]
     os: [win32]
 
@@ -1483,8 +1489,8 @@ packages:
     resolution: {integrity: sha512-KMQIfq5sOPpkQYajXHwnhjCC0slzCNScLHs9JafXc4RAJI+9f+jNDlBNaIMTvazOPLgb4BnlhGJOTbnN0wIjPw==}
     engines: {node: '>= 20'}
 
-  '@octokit/request@10.0.10':
-    resolution: {integrity: sha512-KxNC2pTqqhszMNrf12ZRd4PonRgyJdsM4F/jySiddQK+DsRcfBtUvqn8t7UsyZhnRJHvX46OohDt5N3VqIWC2w==}
+  '@octokit/request@10.0.11':
+    resolution: {integrity: sha512-+s7HUxjfFqOMS9VlIwDffq0MikjSAK0gSpG73W+meAvVAvX4MBrHYTK5Bj3Uot55qFT4gzUtfzE4mGWY4Br8/Q==}
     engines: {node: '>= 20'}
 
   '@octokit/types@16.0.0':
@@ -1621,385 +1627,488 @@ packages:
     cpu: [x64]
     os: [win32]
 
-  '@oxc-project/types@0.132.0':
-    resolution: {integrity: sha512-FESMOxil5Se014ui/Eq8fT5uHJo6nIRwH0PfJrZJXs6Gek3ZVFOrpUv3YIZT20m+extU98Hg1Ym72U58rlsxUQ==}
-
   '@oxc-project/types@0.137.0':
     resolution: {integrity: sha512-WT+Gb24i8hmvo85AIv2oEYouEXkRlKAlT9WaCa3TfLgNCN+GhrJOGZuIlMouAh38Qe4QOx26eUOVsq70qXrywA==}
 
+  '@oxc-project/types@0.139.0':
+    resolution: {integrity: sha512-r9gHphtCs+1M7J0pw6Sn/hh/Wpa/iQrOOkrNAlVLF/gHq+/CJmHIWKKUUhdWjcD6CIa8idarspCsASiXCXvFUw==}
+
   '@oxc-resolver/binding-android-arm-eabi@11.21.3':
     resolution: {integrity: sha512-eNU11A2WNizh04v3uyaJCootrHIaS0B9aHYXvAvVnPNk4xYSjMUjHnhQ6dewPN2MRYDskV85d1N0Aw0WNWhcyg==}
     cpu: [arm]
     os: [android]
 
+  '@oxc-resolver/binding-android-arm-eabi@11.24.2':
+    resolution: {integrity: sha512-y09e0L0SRI2OA2tUIrjBgoV3eH5hvUKXNkJqXmNo5V2WxIjyC7I7aJfRLMEVpA8yi95f90gFDvO0VMgrDw+vwA==}
+    cpu: [arm]
+    os: [android]
+
   '@oxc-resolver/binding-android-arm64@11.21.3':
     resolution: {integrity: sha512-8Q+ZjTLvn2dIcWsrmhdrEihm7q+ag/k+mkry7Z+t0QbbHaVxXQfvH9AewyVMh/WrpEKhQ3DDgx9fYbqeCpeOEw==}
     cpu: [arm64]
     os: [android]
 
+  '@oxc-resolver/binding-android-arm64@11.24.2':
+    resolution: {integrity: sha512-cl4icWaZFnLdg8m6qtnh5rBMuGbxc/ptStFHLeCNwr+2cZjkjNwQu/jYRS0CHlnPecOJMpuS5M6/BH+0J/YkEg==}
+    cpu: [arm64]
+    os: [android]
+
   '@oxc-resolver/binding-darwin-arm64@11.21.3':
     resolution: {integrity: sha512-wkh0qKZGHXVUDxFw3oA1TXnU2BDYY/r775oJflGeIr8uDPPoN2pk8gijQIzYRT6hoql/lg3+Tx/SaTn9e2/aGg==}
     cpu: [arm64]
     os: [darwin]
 
+  '@oxc-resolver/binding-darwin-arm64@11.24.2':
+    resolution: {integrity: sha512-At29QEMF6HajbQvgY8K6OXnHD1x9rad74xBEfmCB6ZqCGsdq75aK7tOYcTbOanMy8qdIBrfL3SMr3p/lfSlb9w==}
+    cpu: [arm64]
+    os: [darwin]
+
   '@oxc-resolver/binding-darwin-x64@11.21.3':
     resolution: {integrity: sha512-HbNc23FAQYbuyDV2vBWMez4u4mrsm5RAkniGZAWqr6lYZ3N4beeqIb776jzwRl8qL2zRhHVXpUj97X0QgogVzg==}
     cpu: [x64]
     os: [darwin]
 
+  '@oxc-resolver/binding-darwin-x64@11.24.2':
+    resolution: {integrity: sha512-A5Kqr1EUj4oIL5CF4WRssq/o5P0Y11cwoFouMRmQ7YnC/A8V93nv1nb7aSU8HwcgmXropjLNkVTl4MN87cu28Q==}
+    cpu: [x64]
+    os: [darwin]
+
   '@oxc-resolver/binding-freebsd-x64@11.21.3':
     resolution: {integrity: sha512-K6xNsTUPEUdfrn0+kbMq5nOUB5w1C5pavPQngt4TM2FpN91lP0PBe2srSpamb4d69O7h86oAi/qWX/kZNRSjkw==}
     cpu: [x64]
     os: [freebsd]
 
+  '@oxc-resolver/binding-freebsd-x64@11.24.2':
+    resolution: {integrity: sha512-R5xkRBRRz7ceH/P5Jrc6G7FmdUdgpLYyESFAUDVTNQ9K0sGPxcp4ljiwEwEqsvNcQ4sYbMRrWcHHBCu7ksAJVw==}
+    cpu: [x64]
+    os: [freebsd]
+
   '@oxc-resolver/binding-linux-arm-gnueabihf@11.21.3':
     resolution: {integrity: sha512-VcFmOpcpWX1zoEy8M58tR2M9YxM+Z9RuQhqAx5q0CTmrruaP7Gveejg75hzd/5sg5nk9G3aLALEa3hE2FsmmTQ==}
     cpu: [arm]
     os: [linux]
 
+  '@oxc-resolver/binding-linux-arm-gnueabihf@11.24.2':
+    resolution: {integrity: sha512-k/RuYL4L/R58IBn3wT5ma3Wh4k62bp1eYCFRWCmMsasUOqL+H6sW0VGFadEzKWXFFlz+2uIMoeMk9ySSZJHgbg==}
+    cpu: [arm]
+    os: [linux]
+
   '@oxc-resolver/binding-linux-arm-musleabihf@11.21.3':
     resolution: {integrity: sha512-quVoxFLBy43hWaQbbDtQNRwAX5vX76mv7n64icAtQcJ3eNgVeblqmkupF/hAneNthdqSlnd1sTjb3aQSaDPaCQ==}
     cpu: [arm]
     os: [linux]
 
+  '@oxc-resolver/binding-linux-arm-musleabihf@11.24.2':
+    resolution: {integrity: sha512-bnHAak3ujYfH5pKk4NieFNbvYvernfoQDgwLddbZ3OtMYrem87/qjlA+u+aKG0oZcqSLGCful/6/CEA+aeAgaA==}
+    cpu: [arm]
+    os: [linux]
+
   '@oxc-resolver/binding-linux-arm64-gnu@11.21.3':
     resolution: {integrity: sha512-X0AqNZgcD07Q4V3RDK18/vYOj/HQT/FnmEFGYS2jTWqY7JO13ryE3TEs3eAIgUJhBnNkpEaiXqz3VK8M7qQhWQ==}
     cpu: [arm64]
     os: [linux]
     libc: [glibc]
 
+  '@oxc-resolver/binding-linux-arm64-gnu@11.24.2':
+    resolution: {integrity: sha512-vDT3KHgzYp47gmtNOqL2VNhCyl5Zv643eyxm//A68J8DeUGXrvD1pZFiaT4jSfe+RInfnn1R2yVHye4enx6RnA==}
+    cpu: [arm64]
+    os: [linux]
+    libc: [glibc]
+
   '@oxc-resolver/binding-linux-arm64-musl@11.21.3':
     resolution: {integrity: sha512-YkaQnaKYdbuaXvRt5Qd0GpbihzVnyfR6z1SpYfIUC6RTu4NF7lDKPjVkYb+jRI2gedVO2rVpN35Y6akG6ud4Lw==}
     cpu: [arm64]
     os: [linux]
     libc: [musl]
 
+  '@oxc-resolver/binding-linux-arm64-musl@11.24.2':
+    resolution: {integrity: sha512-+kMlQvbzfyEYtu5FcjE4p+ttBLpKW4d/AsAsuE69BxV6V4twZJeIQZFfD8gh/wqglY0MkPSezWXQH0jBV13MUw==}
+    cpu: [arm64]
+    os: [linux]
+    libc: [musl]
+
   '@oxc-resolver/binding-linux-ppc64-gnu@11.21.3':
     resolution: {integrity: sha512-gB9HwhrPiFqUzDeEq+y/CgAijz1YdI6BnXz5GaH2Pa9cWdutchlkGFAiAuGb/PjVQpiK6NFKzFuztxrweoit7A==}
     cpu: [ppc64]
     os: [linux]
     libc: [glibc]
 
+  '@oxc-resolver/binding-linux-ppc64-gnu@11.24.2':
+    resolution: {integrity: sha512-shjfMhmZ3gq9fv/w7bi3PnZlgOPG+2QAOFf0BJF0EgBSIGZ6PMLN2zbGEblTUYB/NKVDRyYhE2ff3dJ1QqNPkA==}
+    cpu: [ppc64]
+    os: [linux]
+    libc: [glibc]
+
   '@oxc-resolver/binding-linux-riscv64-gnu@11.21.3':
     resolution: {integrity: sha512-zjDWBlYk8QGv0H8dsPUWqkfjYIIjG2TvspGkzXL0eImbgxtZorA/klKeHyolevoT3Kvbi+1iMr9Lhrh7jf54Og==}
     cpu: [riscv64]
     os: [linux]
     libc: [glibc]
 
+  '@oxc-resolver/binding-linux-riscv64-gnu@11.24.2':
+    resolution: {integrity: sha512-zGelwFR5oRo+b69k8Lrzun86DyUHzfKN6cnjbR9l7Z7NIRznOE/2ZvPa1IUKqAL2PzAXOdwkfVqNvO1H2RlpAw==}
+    cpu: [riscv64]
+    os: [linux]
+    libc: [glibc]
+
   '@oxc-resolver/binding-linux-riscv64-musl@11.21.3':
     resolution: {integrity: sha512-4UfsQvacV388y1zpXL7C1x1FNYaV52JtuNRiuzrfQA2z1z6ElVrsidkGsrvQ5EgeSq1Pj7kaKqrgGkvFuxJ/tw==}
     cpu: [riscv64]
     os: [linux]
     libc: [musl]
 
+  '@oxc-resolver/binding-linux-riscv64-musl@11.24.2':
+    resolution: {integrity: sha512-qxZ1SWCXJY0eyhAlP6Lmo9F2Nrtx7EkYj9oCgL8apDPCwXwCEDA2U697bbT81JIc2IrVjxO4KX6WU2N+oN9Z4w==}
+    cpu: [riscv64]
+    os: [linux]
+    libc: [musl]
+
   '@oxc-resolver/binding-linux-s390x-gnu@11.21.3':
     resolution: {integrity: sha512-b5uH+HKH0MP5mNBYaK75SKsJbw52URqrx2LavYdq6wb0l3ExAG5niYRP9DWUNHdKilpaBVM2bXk9HNWrH3ew7Q==}
     cpu: [s390x]
     os: [linux]
     libc: [glibc]
 
+  '@oxc-resolver/binding-linux-s390x-gnu@11.24.2':
+    resolution: {integrity: sha512-sGCecF3cx2DFlH4t/z7ApnOnXqN48p5p5mlHDEnHTAukQa2P+qMVE4CwyWE9W+q/m3QJ7kKfGrIjax31f44oFQ==}
+    cpu: [s390x]
+    os: [linux]
+    libc: [glibc]
+
   '@oxc-resolver/binding-linux-x64-gnu@11.21.3':
     resolution: {integrity: sha512-PjYlmilBpNRh2ntXNYAK3Am5w/nPfEpnU/96iNx7CI8EzAn12J4JRiec63wHJTH31nLoCNxBg/829pN+3CfG3Q==}
     cpu: [x64]
     os: [linux]
     libc: [glibc]
 
+  '@oxc-resolver/binding-linux-x64-gnu@11.24.2':
+    resolution: {integrity: sha512-k/VlMMcSzMlahb3/fENM4rTlsJ0s3fFROA0KXPBmKggqmTSaE383sl8F3KCOXPLmVsYfW6hCitMhXCEtNeZxxg==}
+    cpu: [x64]
+    os: [linux]
+    libc: [glibc]
+
   '@oxc-resolver/binding-linux-x64-musl@11.21.3':
     resolution: {integrity: sha512-QTBAb7JuHlZ7JUEyM8UiQi2f7m/L4swBhP2TNpYIDc9Wp/wRw1G/8sl6i13aIzQAXH7LKIm294LeOHd0lQR8zA==}
     cpu: [x64]
     os: [linux]
     libc: [musl]
 
+  '@oxc-resolver/binding-linux-x64-musl@11.24.2':
+    resolution: {integrity: sha512-8hbnZyNi97b/8wapYaIF9+t9GmZKBW2vunaOc3h9HGJptH7b7XpvZqOTBSm/MpTjr7H497BlgOaSfLUdhmy2bw==}
+    cpu: [x64]
+    os: [linux]
+    libc: [musl]
+
   '@oxc-resolver/binding-openharmony-arm64@11.21.3':
     resolution: {integrity: sha512-4j1DFwjwv36ec9kds0jU/ucQ5Ha4ERO/H95BxR5JFf0kqUUAJ1kwII7XhTc1vZrkdJkvLGC9Q2MbpObpum8RBg==}
     cpu: [arm64]
     os: [openharmony]
 
+  '@oxc-resolver/binding-openharmony-arm64@11.24.2':
+    resolution: {integrity: sha512-MvyGik3a6pVgZ0t/kWlbmFxFLmXQJwgLsY2eYFHLpy0wGwRbfzeIGgDwQ3kXqE30z+kSXennRkCrT7TUvkptNg==}
+    cpu: [arm64]
+    os: [openharmony]
+
   '@oxc-resolver/binding-wasm32-wasi@11.21.3':
     resolution: {integrity: sha512-i8oluoel5kru/j1WNrjmQSiA3GQ7wvIYVR1IwIoZtKogAhya2iub+ZKIeSIkcJOrnzQ18Tzl/F+kL3fYOxZLvA==}
     engines: {node: '>=14.0.0'}
     cpu: [wasm32]
 
+  '@oxc-resolver/binding-wasm32-wasi@11.24.2':
+    resolution: {integrity: sha512-vHcssMPwO08RTvj/c0iOBz90attxyG3wQJ0dTcyEQK43LRpcdLWZlV5feBhv6Isn6ahbQIzHbCgfa81+RiML0Q==}
+    engines: {node: '>=14.0.0'}
+    cpu: [wasm32]
+
   '@oxc-resolver/binding-win32-arm64-msvc@11.21.3':
     resolution: {integrity: sha512-M/8dw8dD6aOs+NlPJax401CZB9I7Aut84isQLgALGGwke4Afvw+/7yYhZb94yXf6t2sPLhQLmSmtSV+2FhsOWg==}
     cpu: [arm64]
     os: [win32]
 
+  '@oxc-resolver/binding-win32-arm64-msvc@11.24.2':
+    resolution: {integrity: sha512-uokJqro2iBqkFvJdKQLP7d8/BUmFwESQFVmIJUQKj1Xn1a/LysJoe1vmeECLF5b3jsV8CAL5sEMJXX6SdK9Nhg==}
+    cpu: [arm64]
+    os: [win32]
+
   '@oxc-resolver/binding-win32-x64-msvc@11.21.3':
     resolution: {integrity: sha512-H7BCt/VnS9hnmMp42eGhZ99izSCRvlnWwy/N71K1/J8QoExwY4262Z8QiEkMDtduRJrztayDxETTckmUuAVL9Q==}
     cpu: [x64]
     os: [win32]
 
-  '@oxfmt/binding-android-arm-eabi@0.57.0':
-    resolution: {integrity: sha512-qVBsEO+KugOsCmUHcO8iqNnqc65p7PCKpCs8M66mPZ+Ri+CWbcpoQOEJBg2OTu03+0qu++NK1jj6IzvQVs0Sig==}
+  '@oxc-resolver/binding-win32-x64-msvc@11.24.2':
+    resolution: {integrity: sha512-UqGPmo56KDfLlfXFAFIrNflHT8tFxWGEivWg3Zeyp4Uy2NlKN1FGPr6/BxcLGG3+kZ6Wp14g5Uj+n71boqZfiw==}
+    cpu: [x64]
+    os: [win32]
+
+  '@oxfmt/binding-android-arm-eabi@0.58.0':
+    resolution: {integrity: sha512-Uz62sHduGGPftXtILGyxdSW4PX82rUg+rfdNqhsgxe881g4rIoXlIqmZQ6HVKcF4f+F8qMhdD03Bx5u7gmeTdg==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm]
     os: [android]
 
-  '@oxfmt/binding-android-arm64@0.57.0':
-    resolution: {integrity: sha512-mp6PibWbao3aizijcheOeHQaYEhcUAt8pwLniYbtLfHxL/psFF0BykAwCj+s3c6qIpa8yN8keZICWrqtZ70w8g==}
+  '@oxfmt/binding-android-arm64@0.58.0':
+    resolution: {integrity: sha512-rD0lRaJp1b+9vw6X4A2dJWKukd6X8yxiicN4JxXcXayolmUypRZxk+lKR+fVOu5q/iYc0fh5fR4bgmfOfVlbaA==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm64]
     os: [android]
 
-  '@oxfmt/binding-darwin-arm64@0.57.0':
-    resolution: {integrity: sha512-T+0stuCBqmUVY+aMIvrgXhzGhHO3sD5tNiiEcYqgSdPsnukskQqn2u5qOVD0sv1l7RLdFS5Z/f5Wi9Ktyjr3Eg==}
+  '@oxfmt/binding-darwin-arm64@0.58.0':
+    resolution: {integrity: sha512-uzbPPk7O6M+w2K65vcQ1woga3wgP8zghjL1KOG5b6qJ8dvYHZJ1VShaslg2KOK6yQIwCQtcMCXqLBM6sqXUNTg==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm64]
     os: [darwin]
 
-  '@oxfmt/binding-darwin-x64@0.57.0':
-    resolution: {integrity: sha512-O+3JbqWs/mCI2oi4xfhRO2IVPFJNDDEBV8Odo+ZpmsUOeKJfjXoNH7nDmBEQcDgK7NfjDIyE7kRgYSZcTLDO0A==}
+  '@oxfmt/binding-darwin-x64@0.58.0':
+    resolution: {integrity: sha512-L0nKYDxU32oxeQqJj21W9SlIMnf81VZEhyah6iDvFhf5q0oynq498Fopth7blErUJVBpVtxQ98RMCfMPqpJX6w==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [x64]
     os: [darwin]
 
-  '@oxfmt/binding-freebsd-x64@0.57.0':
-    resolution: {integrity: sha512-pxwhxVC+JkLX9twOQ/8C/vbuOQcMZyKIDmiRDZfO7yITuVcIdZCiLRqqf4QOxb2+8FWrRXzQpm+1DBKcMpHSSQ==}
+  '@oxfmt/binding-freebsd-x64@0.58.0':
+    resolution: {integrity: sha512-woNwfD58dC5PGS9LSLSD5JYfo/EFK5iG9vhDWkcCg3q78ag7KC8bpDqgvPHrMoXpx83OLXxoSOhu6z8FsVTHlg==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [x64]
     os: [freebsd]
 
-  '@oxfmt/binding-linux-arm-gnueabihf@0.57.0':
-    resolution: {integrity: sha512-pxBU4zH2imB/MDBfth2rOMeVxXUMjRQLCazagwLARIFH3hVlxZJBlM4nSnHXaIHJK4/qezoFCIORN6AY8Mra4A==}
+  '@oxfmt/binding-linux-arm-gnueabihf@0.58.0':
+    resolution: {integrity: sha512-Sqs8nMLxuQpY21NKJ1u4stPDmO5hskBCNNh2E3AdCfI1QqWtf4m+Qn4mGEIUO4KGmuq3SWc/SZ80uy5IiwTCDw==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm]
     os: [linux]
 
-  '@oxfmt/binding-linux-arm-musleabihf@0.57.0':
-    resolution: {integrity: sha512-JAprOzt8tycYou36ZgEw14DlRHTiN8qdtKANdV3VZIRIvTI/lh/cX13c9pJ/EnDk2GT3FASH7KvCgQ2AufAifQ==}
+  '@oxfmt/binding-linux-arm-musleabihf@0.58.0':
+    resolution: {integrity: sha512-Vd4exzBI5B5hB9m22JiTQzIL23WvHo/Pe+sNXPNeBLXSP9swCBPKCEBRwKpmpQzYhlgYaCgfPcGXPKAJBRIiZQ==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm]
     os: [linux]
 
-  '@oxfmt/binding-linux-arm64-gnu@0.57.0':
-    resolution: {integrity: sha512-ajtjaxSaj9xl4BW7REt+Cef/ttzbAq00Bq4z7JUDZEfgFXdwSjH8K9bF+IcIJzZB9lKqMfQ4eHuSFOvvlvtqOg==}
+  '@oxfmt/binding-linux-arm64-gnu@0.58.0':
+    resolution: {integrity: sha512-bUWi5mHV+4Vi56RLHE1h6q/HHfwAIT3XoB9vJAVeRzfu5NriXM8y6eeJu0vlKa0C9kq2rq1sOWRClhdLHPocrg==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm64]
     os: [linux]
     libc: [glibc]
 
-  '@oxfmt/binding-linux-arm64-musl@0.57.0':
-    resolution: {integrity: sha512-p4Y/+RYk9Bk5WO+zHSUXAClRmZ2fbJCejMuCAsU2HhyME4jqf6Ftt/mJYEwIah1wGCBDYOB7wEGV1x5bCEZ6hA==}
+  '@oxfmt/binding-linux-arm64-musl@0.58.0':
+    resolution: {integrity: sha512-2ZHxemzgHcjtktAuVUwSoyXmGo/t+aF5tS1ciPpPei4rhSyrz3JOqDosXXrmhN/yLUSzJjtuW7ToTWqfQpCj2w==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm64]
     os: [linux]
     libc: [musl]
 
-  '@oxfmt/binding-linux-ppc64-gnu@0.57.0':
-    resolution: {integrity: sha512-By6tRALAZsno0F4zedmtG+wdMvJiJmJoXM4d3+A9zHE4HRXLqXITwRH8mgrlcXc5yJM2g2W3riRPwTYdgemZLQ==}
+  '@oxfmt/binding-linux-ppc64-gnu@0.58.0':
+    resolution: {integrity: sha512-AwKkVwjVmFQ3bcO7j0McGYAqCKH2a326fswfofng/E8VewCT/raeeGQr4huVhY704deK8AWASSTlxzMj0eZc6Q==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [ppc64]
     os: [linux]
     libc: [glibc]
 
-  '@oxfmt/binding-linux-riscv64-gnu@0.57.0':
-    resolution: {integrity: sha512-skYeG+RgvyzspqVEBsEprL90OYYZfoVNqB3HcCNR6QDJyXKOzfDRT3zncnHmUaFluIlBHuY23mU1b5WGgR98hA==}
+  '@oxfmt/binding-linux-riscv64-gnu@0.58.0':
+    resolution: {integrity: sha512-xsRpTxfUnJF8D3AUKko/qyWdjw4GZVHlCVFuGlzSCTeewLmykKINW8em1+wx+axsDVtJJcMtvsiaXggXxrlHgw==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [riscv64]
     os: [linux]
     libc: [glibc]
 
-  '@oxfmt/binding-linux-riscv64-musl@0.57.0':
-    resolution: {integrity: sha512-FFgACrZOXAXUh5KQh2mt1CDOVOZmn+QzHP71wM9QobNwyQvoFfyAeefVUltW83g3sm7LTiH3yfFqLLVUpA5ZFQ==}
+  '@oxfmt/binding-linux-riscv64-musl@0.58.0':
+    resolution: {integrity: sha512-Z4AYOTcy7nYEIiXwD62PlerimyYRcfJOgUbQAEBjXz098kxKuERBlRntofGy69HHhe9E0TLVNMl1yspVNu+efw==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [riscv64]
     os: [linux]
     libc: [musl]
 
-  '@oxfmt/binding-linux-s390x-gnu@0.57.0':
-    resolution: {integrity: sha512-Nm/BAOfQeFiiKd502mZn/GAVKJwtd0RdCg17G3Wz/WSOIQmDi3+7/SZH4BHn1Ye5KvTVH3ua8WvfwLLycNIuvA==}
+  '@oxfmt/binding-linux-s390x-gnu@0.58.0':
+    resolution: {integrity: sha512-A3nhhtZPC/TKVWOPj9q/H3p2znJDCcHWYlJBhWL8hGq/bFmBaNBHC8Np6E581yVq1w9Mi3rMDNzDalWvtUfJtQ==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [s390x]
     os: [linux]
     libc: [glibc]
 
-  '@oxfmt/binding-linux-x64-gnu@0.57.0':
-    resolution: {integrity: sha512-BiSy5Ku3mQqyxS6YIqAJgd403wEUWvI7kerfzPxc2l/txZVmZM0pSj7oDM+4bGBExowxOi7o73jEam1W0EDTZg==}
+  '@oxfmt/binding-linux-x64-gnu@0.58.0':
+    resolution: {integrity: sha512-2g+tVkgwqphw8R4hgo+kF4oz8+P5RwVOtr9+irsC7uwEp0e9j7Crw8kDGKL20uYlLPD7g02DqA61mC/UNYx98A==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [x64]
     os: [linux]
     libc: [glibc]
 
-  '@oxfmt/binding-linux-x64-musl@0.57.0':
-    resolution: {integrity: sha512-BCRkJiotz5s9afLYD2LuMvzAoDYx9H17E/YbDyu4xK7l4zHDPeny9ErSXL//i/nJyaOwRk08x4b8cgJC00+JDg==}
+  '@oxfmt/binding-linux-x64-musl@0.58.0':
+    resolution: {integrity: sha512-rc15P6AbyyB7426aN8AakLd02Trb3a6ML/mmfAQeVHJEfVofWLcWIrBdy6zDEY+DIaL/s8E4GGPboVw+oP3+EA==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [x64]
     os: [linux]
     libc: [musl]
 
-  '@oxfmt/binding-openharmony-arm64@0.57.0':
-    resolution: {integrity: sha512-4Oaxe1qrGgXfpCJ1C/ERJ2iCtV2rN1R79ga9fsfyVHfSQRu/hVW780u2KDqZWFZ/iGTHODJji0JemxqFZ63eIQ==}
+  '@oxfmt/binding-openharmony-arm64@0.58.0':
+    resolution: {integrity: sha512-ZWoTM27/HYPOh9iq86DAbhPu9nXb8qKvvGU/h8OfliyVUFAMMNTLDkGsWDKKnDqIkqvZ9+dXlgUOsH1LYO3O7g==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm64]
     os: [openharmony]
 
-  '@oxfmt/binding-win32-arm64-msvc@0.57.0':
-    resolution: {integrity: sha512-MYLAsDnhdNsSGheLYhWgbk0vfIrlS84iQYun/y21fX6u0jj8iBtYtbpZMdiqYeuf8U12eVPUjVY2xE2NrCfJ0g==}
+  '@oxfmt/binding-win32-arm64-msvc@0.58.0':
+    resolution: {integrity: sha512-LHZnqFXe2dEfkRI4XdZS/57nEOT/I4UCRX5IyM9v4GYW9XwQCjGe1IUK59SuKw3POwvcgWQ4pme2cYXmNqTNPg==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm64]
     os: [win32]
 
-  '@oxfmt/binding-win32-ia32-msvc@0.57.0':
-    resolution: {integrity: sha512-PBwdzZALJY/jcCx2E6is0yu+cuVXeySTDmwuseD+9j0mHqlRNxwlKgsyRTBed/woPeqfVfuXfWjoq4Cx2Zt3Eg==}
+  '@oxfmt/binding-win32-ia32-msvc@0.58.0':
+    resolution: {integrity: sha512-mZKpg20TpheCJym1rarcZCUJeW1sSruw8zAAaCYWvuVfwIUDN1CXdrPU/JgCWReXTCTrEfCB8Wyo3hh9jSZ2EA==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [ia32]
     os: [win32]
 
-  '@oxfmt/binding-win32-x64-msvc@0.57.0':
-    resolution: {integrity: sha512-bQJdH9i4RRfw55jm7+8/xS7GzHLLTbHx4huhrrDxQJaJtbSDbsyOnODvP1ftT7EG0KFKAYO2S+q6AcioXODx8w==}
+  '@oxfmt/binding-win32-x64-msvc@0.58.0':
+    resolution: {integrity: sha512-N/wUU4N5PZ2orBtI+Ko7MnMfYLfE7K91UrGMY/c/pYyHR3lA9kwst1XugkZx+92YcRh/Eo+iv2eTESSWXfiZPA==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [x64]
     os: [win32]
 
-  '@oxlint-tsgolint/darwin-arm64@0.23.0':
-    resolution: {integrity: sha512-gOs9PVr2wEg4ox9z0aJo+RKhhImW86YL5N6yav8BK/rgPsIrwN/igSZ+pbRr723NFvUNKde9fgMhRA6JrXAOZw==}
+  '@oxlint-tsgolint/darwin-arm64@0.24.0':
+    resolution: {integrity: sha512-C2uMmwK5Bc4ri4ysZ6sA8Rcu+A5zBQTp6ml2u0CLLbRZp4kMFPV3yWk8B5DK9Aw7y9bbjogIm75tUwGLFzlsYQ==}
     cpu: [arm64]
     os: [darwin]
 
-  '@oxlint-tsgolint/darwin-x64@0.23.0':
-    resolution: {integrity: sha512-kjJ8B+7n4tB9VJdxS5A9GdJt6/bYpzbu4lXp2uO1S3sRmCB5gDEABlGoiePNApRWaW+xqL4b4xgiE727jSLhuA==}
+  '@oxlint-tsgolint/darwin-x64@0.24.0':
+    resolution: {integrity: sha512-Wgvt/1lRbDxmoNqWQKKcL+UIiqLmdJ+EWLpQa1qzoNVAfNB0PJpa82/8dH1twT/3rSs4zrP5TXPWl4juB71WuQ==}
     cpu: [x64]
     os: [darwin]
 
-  '@oxlint-tsgolint/linux-arm64@0.23.0':
-    resolution: {integrity: sha512-6dCZuKNu135seMXilkRk9SpCx6i1XgmiipYGalLij5WVRX6ZYS8c4xI7preN/zv9fCXhsQclTIMDu2Y/cytTjw==}
+  '@oxlint-tsgolint/linux-arm64@0.24.0':
+    resolution: {integrity: sha512-PB1rxII7KV83+ASY4sSkXtqvpij6ME66+QCRL49uksi/ofs2Rf/UVboYr095n0Rkbl2wgvlsHGl6DHC361jQUQ==}
     cpu: [arm64]
     os: [linux]
 
-  '@oxlint-tsgolint/linux-x64@0.23.0':
-    resolution: {integrity: sha512-3bdilnyA7kmSTjK27rvjIjSxL5SIg3wt7vwNiRkouWB83ytssyKnuGvxSYJxgMEmFpSutzaBzcCUM2jDtPGcgA==}
+  '@oxlint-tsgolint/linux-x64@0.24.0':
+    resolution: {integrity: sha512-xcz3CxKmjTQLREtE/UShh+ruWmm9nAb7UM9zKcD65BStiuYgOakAKkPHl4YS5DztpVcDrE0+HqbOolTlRKYWmw==}
     cpu: [x64]
     os: [linux]
 
-  '@oxlint-tsgolint/win32-arm64@0.23.0':
-    resolution: {integrity: sha512-j+OEp44SVYiQ+ZD+uttsX7u6L9SvmbbQ77SO1pSFCcJlsVMeCk8qZsjhKfGKuT/jIA+ipOJMVs/+pqUfObBWNw==}
+  '@oxlint-tsgolint/win32-arm64@0.24.0':
+    resolution: {integrity: sha512-A2i6ZGBec3i20S7RaxkgHc6r3HYtD5Mn7j/mb22NkTz14u0JuudvTu6JggAnbGMcv8+dBKQI//EasxSPJLD8pw==}
     cpu: [arm64]
     os: [win32]
 
-  '@oxlint-tsgolint/win32-x64@0.23.0':
-    resolution: {integrity: sha512-5MyjFuqf+g8OUPJBSGWHJtmoWnzFJYyOg4To9WMQshZYEWig/vtu7JtJ03VWnzHv9LJkAUeApY0gVCOywFR/iQ==}
+  '@oxlint-tsgolint/win32-x64@0.24.0':
+    resolution: {integrity: sha512-0ZbGd9qRB6zs82moekaKdEvncRANq49EAwfNX62JpTS46feXUhKAuoyVDvZMj6Rywejylrmmu79Wo6faYCo4Ew==}
     cpu: [x64]
     os: [win32]
 
-  '@oxlint/binding-android-arm-eabi@1.73.0':
-    resolution: {integrity: sha512-HZQRN/UMBu+Ut+/9MiAChkbP4qZqrNOWBcNI45vOT40GVhbGR0JgHB87L48D4iAqFQIdVmeQYtV9RF89AjTKkg==}
+  '@oxlint/binding-android-arm-eabi@1.74.0':
+    resolution: {integrity: sha512-+gHd12muVI9ZLBaWLPkHt3Fj7jihFjgQ1MGtBaRL8vWrWrI0P7dLUty/cHrHS0oqPYIRgQUJsPu2CExQuMcwNw==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm]
     os: [android]
 
-  '@oxlint/binding-android-arm64@1.73.0':
-    resolution: {integrity: sha512-Gp+KJRylv2aW7thRpG5p1KTxZq4ZJFbWowrKzufNq9d3ssl3r3JviYV45/+p+7CN1Nv0zDd1e8Ex0b/HUDq4TQ==}
+  '@oxlint/binding-android-arm64@1.74.0':
+    resolution: {integrity: sha512-xjKdoMB+H+RCOByv/7l7nfIGW9mlOisqYdcyC75UqYuQecLpReAeEYUf2CNeDEI3KtmUgxpRw/+c63y4AeF/Bw==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm64]
     os: [android]
 
-  '@oxlint/binding-darwin-arm64@1.73.0':
-    resolution: {integrity: sha512-3de96NdtXhxERMjIz7wsp2HYMY6pMQycGxFWac2mFecAx6VeARF/IqFb1QIaqiCRIdfzBwzTed+pCTCoiS+CYA==}
+  '@oxlint/binding-darwin-arm64@1.74.0':
+    resolution: {integrity: sha512-iUK7wvc6sejMKsC+Pt67mntoF5weFcyEunhZfLJceU6gL419mexz5wBkSx/EnkFBExMLNtOi9fnDSc5xfK0IzQ==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm64]
     os: [darwin]
 
-  '@oxlint/binding-darwin-x64@1.73.0':
-    resolution: {integrity: sha512-5zx/uPW32TiaOeVY1dQ/H5iOf0K1HOdFKOJhLqGl4o63+i1fpzoqqu/mKtd7OFgFjNCdhlyTGgjVkQTZm1ELcg==}
+  '@oxlint/binding-darwin-x64@1.74.0':
+    resolution: {integrity: sha512-ggKc/tn5SJ1u2yG2izC6VKODfYKV8MQ2AicJlNzOjuyrC29udvOef6/JzK2r32xqCnBDLFouR1VCkjzEI0/N9Q==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [x64]
     os: [darwin]
 
-  '@oxlint/binding-freebsd-x64@1.73.0':
-    resolution: {integrity: sha512-qNe4gKHaGnLuZJ8toUg90JAa0S2vTVvDw+0bRi3q1avXZXDT4u5mMeECf3nD4HYrbdn1O7dXqWut4onY/yx/Xg==}
+  '@oxlint/binding-freebsd-x64@1.74.0':
+    resolution: {integrity: sha512-u++dH/43jy9hTLbneaWlS0gla/Bp1JdwJ2zgevCl8nDFUh6qRCGMxcL0f0lb7By3A9p/LfFr+7cG4HU1hG856g==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [x64]
     os: [freebsd]
 
-  '@oxlint/binding-linux-arm-gnueabihf@1.73.0':
-    resolution: {integrity: sha512-cCehYh5hTbfShm/fxTD6wwrGUWIpvX+N5OxmAMhFhDeTGXvw+BeNj889tpxsFQ9ZLatQ6wImuY8tsKLZ+FMz7w==}
+  '@oxlint/binding-linux-arm-gnueabihf@1.74.0':
+    resolution: {integrity: sha512-Sj1zmtFDVTPeIbIz4ZfcXAbFHqCmKCXdCUlAJzvTF7I20NTH1RDpoF2PhkqNODutJzVhJYmm3oz0GwgY+tvE2g==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm]
     os: [linux]
 
-  '@oxlint/binding-linux-arm-musleabihf@1.73.0':
-    resolution: {integrity: sha512-d5j5GDU/2dMgjVhw7TQT9ITrsIr1Y02KEXKyVGIXUkD+KiaxE9TP65FS2ZdgTBemQvoRL+gSBdbrIm3cQIeacg==}
+  '@oxlint/binding-linux-arm-musleabihf@1.74.0':
+    resolution: {integrity: sha512-//PKyQb/tQXcHArx2f7z+oVI/eMS2Jpv+edNuAtOrgIhWdGcpHxogveAxzmF2rpH1AIHp4Hq04RF/rgJdiICnQ==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm]
     os: [linux]
 
-  '@oxlint/binding-linux-arm64-gnu@1.73.0':
-    resolution: {integrity: sha512-Eyf1SrP3+yR1DI3OJgOY2Pvrr9dWP9TK37xPaDYycwTtlGlI45erJAVIfH5/m/xosDt6BupJYEFi47bvbTuuyw==}
+  '@oxlint/binding-linux-arm64-gnu@1.74.0':
+    resolution: {integrity: sha512-/k1Me+aX2tjuH10K62mLS0y8cLkJBHX6Ce0xPK+eWeel4bSdEGZ8dv4+hYMzg0GrSmjwy4yAYsDPeEeKBft/2w==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm64]
     os: [linux]
     libc: [glibc]
 
-  '@oxlint/binding-linux-arm64-musl@1.73.0':
-    resolution: {integrity: sha512-IlT/OJApEDKaMmCooHuncgJZbbCe7T5QIWmTZBEtYscWvzPQuuEinVcid6kwQRVQOUdb7PUCz4jQHnaYXdfJXw==}
+  '@oxlint/binding-linux-arm64-musl@1.74.0':
+    resolution: {integrity: sha512-3tFSjBxc5D8/zvjEuLvOqcA8ZXKD0+6NuaVO/edeamNc49MoAsbfaC9s1UiwODwgF6slGaF8yJA2TPkukd77tg==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm64]
     os: [linux]
     libc: [musl]
 
-  '@oxlint/binding-linux-ppc64-gnu@1.73.0':
-    resolution: {integrity: sha512-L+JYcb/vdg5fmcH08V6o0YYLU28cTH1SPNulwJdvK9NK49aXSkYy6oNpKBmddArVOXYqNepriDGiZ04G54kh1Q==}
+  '@oxlint/binding-linux-ppc64-gnu@1.74.0':
+    resolution: {integrity: sha512-9QggtPkSPXOCTu8Szis7auOK/sC7KdQaN+/TujP7YVVhzCAOhgdRfgv8uEz0r2tk5xdgus5rLYUrCDoZNtiRUw==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [ppc64]
     os: [linux]
     libc: [glibc]
 
-  '@oxlint/binding-linux-riscv64-gnu@1.73.0':
-    resolution: {integrity: sha512-Qtk0g3bKV6OwWjIm7R8kQN1uOZRKQt/MODK2a8QfkwhTpXBD53ozx5XLVWLGDQAVyp2otLW4D2wB98XfAfMPGA==}
+  '@oxlint/binding-linux-riscv64-gnu@1.74.0':
+    resolution: {integrity: sha512-VM5VPUJ4DJIWiK+AZn8FScUqMr6OFrCAYybMYjEEi7W13ParI64MByiXTkKMqZpBmvQ9zxl9Ebq2VUOiZRJYUg==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [riscv64]
     os: [linux]
     libc: [glibc]
 
-  '@oxlint/binding-linux-riscv64-musl@1.73.0':
-    resolution: {integrity: sha512-wX0NQKZVxltkAOVmzFcpOaMpdaUvsq1Eqpx9tkAfl71UdkTlSo1R4AdAnGccR1Fm2+TzFgZ22CyyGuZ41RDr/A==}
+  '@oxlint/binding-linux-riscv64-musl@1.74.0':
+    resolution: {integrity: sha512-SaDY1gh9rOA592J54g+gu5hkOFFQBZsMmIYHs+NRHG+Uq0OxtuuCXMWQ3vu1830Eugv5uMXyjG+bv2Z9y4IXjw==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [riscv64]
     os: [linux]
     libc: [musl]
 
-  '@oxlint/binding-linux-s390x-gnu@1.73.0':
-    resolution: {integrity: sha512-vPe7UGBMWyiLTtnqS4xxgMQFSFGmtQwhwCxuiw6lXygaO6bVt0D8dFVg8Xv05eaiN3ybC0HXXHUAohFMFvqoCQ==}
+  '@oxlint/binding-linux-s390x-gnu@1.74.0':
+    resolution: {integrity: sha512-ZATQeHZCyr6MbDveg0obD5sxLHFOghtOdC5jwVwYlvFWqtFOxctgFEG6Ef/64hYvZrWyhyCckB10AelqLopeDA==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [s390x]
     os: [linux]
     libc: [glibc]
 
-  '@oxlint/binding-linux-x64-gnu@1.73.0':
-    resolution: {integrity: sha512-2CwIWr9cemFC/CbRBWZvuk5mffz6ObmfFkfcC/9rTQ7f+icNhYr2kOjf9Rt8lLvugvkdGDOmkoVoFFHh6ClCTw==}
+  '@oxlint/binding-linux-x64-gnu@1.74.0':
+    resolution: {integrity: sha512-+aIvJyrdeD7LwCQ2WYLMUWNmnbeDRSPb40aBYtPjD9+PTqUwgJnk+HK5yLfSMeqXrMrDhE9uTmtt2y50tvjhHw==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [x64]
     os: [linux]
     libc: [glibc]
 
-  '@oxlint/binding-linux-x64-musl@1.73.0':
-    resolution: {integrity: sha512-nDadfJgg7NBBxG0N560wOe7LLX5QiYp6qBaI7viuk5EUORFBktU/NfV0MbTqU3gTqQDCh4VyxKdo5VADxk9w8Q==}
+  '@oxlint/binding-linux-x64-musl@1.74.0':
+    resolution: {integrity: sha512-XyktaR8lhK2qWiCK0Tk8oYD+/cgn+oHA6ddRnxSSXUKkkojkV78CmShZUxQF+yrBFs0SuW+JBOPG6hecyc/iZg==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [x64]
     os: [linux]
     libc: [musl]
 
-  '@oxlint/binding-openharmony-arm64@1.73.0':
-    resolution: {integrity: sha512-wGjJC+NLH9xP+IKGn9RDW94ojJR/wPbg5WCnQjj/oReaOtCQthr8ws1zICe77JFmo4ouUdeTHHZL/ESGiF6Pmw==}
+  '@oxlint/binding-openharmony-arm64@1.74.0':
+    resolution: {integrity: sha512-mzbjrPl4neaVUiJ1fUiEUxTGaSZBoiKtaoB6jmIpz9S+VOA2vDYmJpihQ82w6178V5jxziclTg8Cgj5yF6tTDg==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm64]
     os: [openharmony]
 
-  '@oxlint/binding-win32-arm64-msvc@1.73.0':
-    resolution: {integrity: sha512-I7X47GPGljw225YUQ5SbC/rb1Kkdrd0yQf0x+hYxeKS6DpfjMbo9ccQPQ6LNY6BoJQ1sHhgDUGuMn5Vg5gHT6w==}
+  '@oxlint/binding-win32-arm64-msvc@1.74.0':
+    resolution: {integrity: sha512-vUAe9okpS2Oa5+lX67lqHMuNUvfkleRKwrUDJ/WJBsgmddvZ1mrsh2HVmuFDRzqFELhaJhFaCNOuR6a7L3rtIA==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm64]
     os: [win32]
 
-  '@oxlint/binding-win32-ia32-msvc@1.73.0':
-    resolution: {integrity: sha512-5lWj+3h+74Fm1jYOO9qkJA4xkAlZA099DkXppuXsk7UpnpZLttsefrZU469vChGaG6hcSqrkKXQOvMTZtbjeNg==}
+  '@oxlint/binding-win32-ia32-msvc@1.74.0':
+    resolution: {integrity: sha512-yyXXJyYYSXL4I8K8jAWjJs+J3fa9gH2JmEbo4f5adm+1tNC9itseicBNuwK7BDHvqQ5J534s+yDULu89vYL2ZQ==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [ia32]
     os: [win32]
 
-  '@oxlint/binding-win32-x64-msvc@1.73.0':
-    resolution: {integrity: sha512-WaNRvh4f6zY9CvUQk2YoA1O90ieWrIklI84+HXFr9Isjz9CSESrdqo/RtIYt4Dll/cAchqGDMehfaZd0vqEFZw==}
+  '@oxlint/binding-win32-x64-msvc@1.74.0':
+    resolution: {integrity: sha512-VTC9IYTIMrVUk/i6Ms1ohzzDKZFkWn0KU2OBbPBzgmVZ2V30165T/zK4LztTr0Xgp9fZ1qQZ1rsZAu/rEmySlA==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [x64]
     os: [win32]
@@ -2107,11 +2216,11 @@ packages:
     resolution: {integrity: sha512-//0sR/cow/s4ICQaYoAobOl4aU8cjU6x/V24V7XkKotb9+O+3zySIYp146vpaobYHnxa4pZX8NkV54Z5AwbDKA==}
     engines: {node: '>=12'}
 
-  '@posthog/core@1.39.6':
-    resolution: {integrity: sha512-o6ajIwN5zXoNP0D4H/QPmOyibNTUkSyOR6ya7AG5U2ywXx4awo72L2KnCoiZPQM5x/bXv6jPBdimH8M18Ax0aw==}
+  '@posthog/core@1.40.2':
+    resolution: {integrity: sha512-H12j7O9iHGvpK9t2ko8W4pvfbV1pBDxrsWC1LA6yp2RhzwvC4T3sWhu+AekDQJSRSrJEWlB0t/Ueq9QhPSq7FQ==}
 
-  '@posthog/types@1.392.1':
-    resolution: {integrity: sha512-Qg6Gl7/1vlr8+gPtBi5gwnLgAgiyFoKOVmTvTtDcvya9cpTwZfna7rQmkGQ4B63CunUYNNbOlqcwiUwUDyTK6w==}
+  '@posthog/types@1.393.0':
+    resolution: {integrity: sha512-vzWeEJZ7ERQhFRoQYaP5jzN1JvIu46UJyHXsuv+dTGW2r3sMgREOhNxXLZjmFHwZ8/FOHQoyqqQmXTCXZSfMSg==}
 
   '@radix-ui/number@1.1.2':
     resolution: {integrity: sha512-ceTwaxc4I5IOi97DgCotl3pqiyRGvffcc0oOsE2dQYaJOFIDsDt4VWG6xEbg1QePv9QWausCEIppud/tJ1wNig==}
@@ -2469,97 +2578,97 @@ packages:
   '@radix-ui/rect@1.1.2':
     resolution: {integrity: sha512-xnXE7wG13PI+cxieVssYXlQJuYVRhH9NBoxt3KNwzghDIA69GMm7d4wXRouHIYjE+KvS6U/MsMO73NdS2MH9ZA==}
 
-  '@rolldown/binding-android-arm64@1.0.2':
-    resolution: {integrity: sha512-ZS4D1JPGn/MYQN/SYDWftIE/nVsM8j/AFOYEzAoOE2O3NktQOZru+/vYXGbR/qtdLdIfGCP0lcoJiYVzsEz+iQ==}
+  '@rolldown/binding-android-arm64@1.1.5':
+    resolution: {integrity: sha512-lZg8fqIv2v7FF237bwMgzGZEJvGL79/s5knJ/i6FmsGF4XXlzccZ4jb+TrFIxtSSxFtIpdsgrPZeMk1I9AFcyQ==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm64]
     os: [android]
 
-  '@rolldown/binding-darwin-arm64@1.0.2':
-    resolution: {integrity: sha512-vdFA9+C/rekyGce7WqHs/xoT0ioZEWaOFyZLIV1mEeNFaFDUQrPIo8Vs2GvJ6eetb3rzDUtUBgzto3ExpXJB3w==}
+  '@rolldown/binding-darwin-arm64@1.1.5':
+    resolution: {integrity: sha512-51Bnx9pNiMRKSUNtBfySkNJ9vMU9Hh3I1ozDd6gyPPYzaXCfnptUcEZxXGYFn+ul2dtcMUiqGR1Yai2K10uoTw==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm64]
     os: [darwin]
 
-  '@rolldown/binding-darwin-x64@1.0.2':
-    resolution: {integrity: sha512-BewSOwTHazv77DTYiAZXSqqKZ4KP/KonFisDMVU7PImxoWfB2aepnPhd2E4SWz3zDzYgDNbs6jBmTdgNnF02GA==}
+  '@rolldown/binding-darwin-x64@1.1.5':
+    resolution: {integrity: sha512-Tm+gbfC0aHu1tBA/JvKQh32S0K6YgCHkiAF4/W6xX0K0RmNuc94VeK419dJoE65R5aRxmo+noZQSWrAMF6yb6g==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [x64]
     os: [darwin]
 
-  '@rolldown/binding-freebsd-x64@1.0.2':
-    resolution: {integrity: sha512-m41o7M0YWtUdqk61Tb+jnKb2rN++iRdIASlExkUoKfIAH30DOHCB8fVLzSUpbWHHU8esmEioY62PxzexE8MBuA==}
+  '@rolldown/binding-freebsd-x64@1.1.5':
+    resolution: {integrity: sha512-JMzDKCCXq93YccG5gz3hvOs1oXRKAf0XYpfOS88e+wZrC8Iugj6j68867vrYZkvpDDpKn/KoKORThmchMpF6TA==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [x64]
     os: [freebsd]
 
-  '@rolldown/binding-linux-arm-gnueabihf@1.0.2':
-    resolution: {integrity: sha512-jcojB9H7W/jS29pMKWAK1N+fU99vXodHDTatS3b3y/XSOCiHo0kkA74pL3jJmkoQtYpOCxDvaKs1fo2Ij/1X5w==}
+  '@rolldown/binding-linux-arm-gnueabihf@1.1.5':
+    resolution: {integrity: sha512-uML21j2K5TfPGutKxub+M+nLjZIrWjXQ5Grx4lCe/nimTj9B4L63zHpjXLl4y0L3mcm2htEQIb06oCG/szerNw==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm]
     os: [linux]
 
-  '@rolldown/binding-linux-arm64-gnu@1.0.2':
-    resolution: {integrity: sha512-1jn6qDU5iiOgFgygDzKUuKP0maTi0/f1+sBLgvij/76C77Nm3ts6ufz9Bjg5q5dduxiUIxtq86JIoBvo1xQ4Ig==}
+  '@rolldown/binding-linux-arm64-gnu@1.1.5':
+    resolution: {integrity: sha512-navSiuTMogvnQoZoM/v+l3ZWo50/NTwSHSzheABx/RCnmUPaKwq9qSo4Br2OYRs21+Fz8uFqITZM3H4opOB0/Q==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm64]
     os: [linux]
     libc: [glibc]
 
-  '@rolldown/binding-linux-arm64-musl@1.0.2':
-    resolution: {integrity: sha512-QVLO/czFMdoMFSqlX3bcswcJNm/23r+qoa/jgtmFc/qEp6/jXmIkDjF/XIo8dPfGaiwy1xfQn8o77L79GeXFgw==}
+  '@rolldown/binding-linux-arm64-musl@1.1.5':
+    resolution: {integrity: sha512-lAryqH7IteztmCXQXk0etKj4wBQ7Gx5S6LjKhsgp9zb8I5bsuvU/2llH1hDQcjsFeqIsovMVN339/8pUDDBXxA==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm64]
     os: [linux]
     libc: [musl]
 
-  '@rolldown/binding-linux-ppc64-gnu@1.0.2':
-    resolution: {integrity: sha512-hgO5Abm0w5UL6FEa2iFnZqo2KlK7TQ5QhV5x09hujBf7t5KzHQ1VmfPuTpqRy/rNlSxua3eWH374xxiVrP+lcA==}
+  '@rolldown/binding-linux-ppc64-gnu@1.1.5':
+    resolution: {integrity: sha512-fsK/sNBnxzBlL4O1JNrZakVQxPspqpED5dLtNsZS9oOKmtSpdNIzxH2kkol5HYTWJN47sE20ztMJPxfZ89qGOg==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [ppc64]
     os: [linux]
     libc: [glibc]
 
-  '@rolldown/binding-linux-s390x-gnu@1.0.2':
-    resolution: {integrity: sha512-fy8rXxuYEu602abC8MUNaPjYLIFzReOaEIEMKMUa0rFEUxNpVXhs15KSSQ4qlqSaM7B6rcj9rDZgADh/IGDzLQ==}
+  '@rolldown/binding-linux-s390x-gnu@1.1.5':
+    resolution: {integrity: sha512-gLYb4BIadlfTOYT5gO503n8zQjXflgzpD0FcyKh0Mzx3rqCZKnHoJWV9xe1KXUJ5lx2JfcSHr/mhzS0PC/McAA==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [s390x]
     os: [linux]
     libc: [glibc]
 
-  '@rolldown/binding-linux-x64-gnu@1.0.2':
-    resolution: {integrity: sha512-0+bOkiQ779+r1WpoHOWHqncvyySci0vKph+myNDYb+im6meJAzHQXay6oEgnkHuUGouM1LKTZwqKpBow6Kj7CQ==}
+  '@rolldown/binding-linux-x64-gnu@1.1.5':
+    resolution: {integrity: sha512-FjcpEKUyJygHgs1o50VYNvkt5+7Le/VEdYt0AkRpkL33MnyQfwr8l5mXwMmfmTbyMPr5vJLC+8/Gd9gXnwU1QQ==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [x64]
     os: [linux]
     libc: [glibc]
 
-  '@rolldown/binding-linux-x64-musl@1.0.2':
-    resolution: {integrity: sha512-mjSkrzZK5Qsl0a9d1JgILOiuZOSDTVdKENcSXBoqbzSrspLR/4/IRVDo5wd2GgZjNss/viBFJdeq+j7qH2nypw==}
+  '@rolldown/binding-linux-x64-musl@1.1.5':
+    resolution: {integrity: sha512-Me+PfPI2TMeOQk0gYWfLQZtTktrmzbr8cDboqX83XKc7UrgAi55gF+2dUkWdxd19n55Essp2yeca+O9N5rBxHg==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [x64]
     os: [linux]
     libc: [musl]
 
-  '@rolldown/binding-openharmony-arm64@1.0.2':
-    resolution: {integrity: sha512-1v5vHasdfQAZoEHakBV72LIFAC9JjnymsiKxp+GEr/ma3+NJCPSaYK+qavInOovJkgwFrs7GccX2d6IgDA3Z5w==}
+  '@rolldown/binding-openharmony-arm64@1.1.5':
+    resolution: {integrity: sha512-yc5WrLzXks6zCQfn9Oxr8pORKyl/pF+QjHmW/Qx3qu0oyrrNC+y2JLTU1E2rcWYAmzlnqngWXHQjy51VzW70Vw==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm64]
     os: [openharmony]
 
-  '@rolldown/binding-wasm32-wasi@1.0.2':
-    resolution: {integrity: sha512-mb1VobWn6NheziTk5/WEaR6AKVbrwT5sOi6C7zk3gy/pD1qtJfU1j4PgTo2NJnOtbL9Dl3Aeei8w9jJ7qC2jZQ==}
+  '@rolldown/binding-wasm32-wasi@1.1.5':
+    resolution: {integrity: sha512-VbQGPX2b4r48TAMIM2cjgluIM1HYutm4pcTEJsle7iEP7sB1dFqtPLBVbdLAZCxy1txCcPxf4QFf4v8uvltPqA==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [wasm32]
 
-  '@rolldown/binding-win32-arm64-msvc@1.0.2':
-    resolution: {integrity: sha512-SqKonF56vA/L2yHwHYcEp2P34URpOZ7d1fS635cTkpDnUtEGdUbhI6NzsPdqeSWvAAeGDrxjWjNmibDIdFf9/A==}
+  '@rolldown/binding-win32-arm64-msvc@1.1.5':
+    resolution: {integrity: sha512-gHv82k63z4qpV5+Q1y/12KrK0ltWBukVDI8nZcbT7Tt/ZlOIVwppazneq0F93oDxTo3IgAMEDIoQh3E2n6mVsw==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm64]
     os: [win32]
 
-  '@rolldown/binding-win32-x64-msvc@1.0.2':
-    resolution: {integrity: sha512-v7qRI7gXLRINcOGXt+7YmAZ6iFuyZVMIoXAxhd8oP+DR9dLfL9GfNIx7PLMxmhZdvq8waUJBQiWN9EKNy+TRBQ==}
+  '@rolldown/binding-win32-x64-msvc@1.1.5':
+    resolution: {integrity: sha512-tTZuDBPw85tEN5PQi1pnEBzDy0Z49HtScLAbD5t6hyeU92A95pRWaSMw1GZZi/RwgSgUIl0xrSlXIT/9QzvYSA==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [x64]
     os: [win32]
@@ -2580,8 +2689,8 @@ packages:
     resolution: {integrity: sha512-mgdxrHTLOjOddRVYIYDo0fR3/v61GNN1YGkfbrjuIKg/uMgCd+Qzo3UAXJ+woLQQpos4pl5Esuw5A7AoNlzjUQ==}
     engines: {node: '>=18'}
 
-  '@semantic-release/github@12.0.8':
-    resolution: {integrity: sha512-tej5AAgK5X9wHRoDmYhecMXEHEkFeGOY1XsEblKxu8pIQwahzf1STYyr7iPU6Lpbg6C5I3N2w/ocXrBo+L7jhw==}
+  '@semantic-release/github@12.0.9':
+    resolution: {integrity: sha512-ODIqb0V3QqndipryEEiaBxUQCFjvv7Oese5Dt4omMGa60YRNEW0Sx3K+zri0uac2Y6S9nOlMehciWIzvvRCTGQ==}
     engines: {node: ^22.14.0 || >= 24.10.0}
     peerDependencies:
       semantic-release: '>=24.1.0'
@@ -2647,32 +2756,32 @@ packages:
   '@standard-schema/spec@1.1.0':
     resolution: {integrity: sha512-l2aFy5jALhniG5HgqrD6jXLi/rUWrKvqN/qJx6yoJsgKhblVd+iqqU4RCXavm/jPityDo5TCvKMnpjKnOriy0w==}
 
-  '@supabase/auth-js@2.108.2':
-    resolution: {integrity: sha512-tNaQmBgodDZwgB40mRwVbxFy8IDYwjdpcZ0BYrWiwlULCSQoJj4QoG4zgJT7QRPXcqipefNOzvO/qAu4dF98ag==}
-    engines: {node: '>=20.0.0'}
+  '@supabase/auth-js@2.110.5':
+    resolution: {integrity: sha512-QSlI5CNeEefHP95/GbeMhNgr8aHEHiXFh8c1IWthYyI9ZzBwEigYzJFCw4Ff+GkL8OK9tArBmGGv6rpg5zLXSw==}
+    engines: {node: '>=22.0.0'}
 
-  '@supabase/functions-js@2.108.2':
-    resolution: {integrity: sha512-RNUX8EiBy3iLwAX19jtRzLyePnl11/fHcgwDHLnpKcDSXt/5qBnh3LUwAtIjT21Q66QsmNUR2esrHziLCpNubw==}
-    engines: {node: '>=20.0.0'}
+  '@supabase/functions-js@2.110.5':
+    resolution: {integrity: sha512-nuQuoIoEGT8ukrwr6THlY5v50bSMJ2rqti1FFsGyDaC98POLmcFQVFFh23PVPhRsKWUxrFc0MpmEoHKa7CY4mg==}
+    engines: {node: '>=22.0.0'}
 
   '@supabase/phoenix@0.4.4':
     resolution: {integrity: sha512-Gt0pqoXuIqX/8dvG0OKp/wMCobXNH3klNbUPBNyOfN0YA1IswrM3HyWFMOPk1Jy+BRaIyDPcFx4jLBwHNmlyfQ==}
 
-  '@supabase/postgrest-js@2.108.2':
-    resolution: {integrity: sha512-GQ28/Y8hk3CFmkb3kXH1h/AQx6JIYSQfO0CJMRVBcEKZoNy6C45cXAZ4fcJvRC5Id0cs6xnkUV0+c0rIocigsw==}
-    engines: {node: '>=20.0.0'}
+  '@supabase/postgrest-js@2.110.5':
+    resolution: {integrity: sha512-eObfgBjxLPzFakwMpUmsv8nuNPOhoDhzzN8cwvEvGkxkmuRIZcOCYH9+DRbpKnxh7tgsBZW+KWtaZI2j98b2/g==}
+    engines: {node: '>=22.0.0'}
 
-  '@supabase/realtime-js@2.108.2':
-    resolution: {integrity: sha512-aAGxCSUemZvQIibnCdvNvgaKib28I4rfrNjKbQ9cG1uBLwUsI7hVpGXgEbypCCDhLjQlDTAiJlu7rgljYUT73g==}
-    engines: {node: '>=20.0.0'}
+  '@supabase/realtime-js@2.110.5':
+    resolution: {integrity: sha512-VtOZxw5jfrc37KgIfFdp9SOFJjtvJ0qU+gT8CPQjL7cqy4DJlaTXacw5aBBogLZksqAI0YN67qhlDaMKFwfOuw==}
+    engines: {node: '>=22.0.0'}
 
-  '@supabase/storage-js@2.108.2':
-    resolution: {integrity: sha512-TVZPQxXGxY2+A6yTtm77zUHsh70lBhYUEaJL8RQC+BghcX/ygiMG/rmXrNVBce30/WAeNPa8FiG8HbqlGeV05g==}
-    engines: {node: '>=20.0.0'}
+  '@supabase/storage-js@2.110.5':
+    resolution: {integrity: sha512-7GkOZlrYknVGVPyijoDbu5OXGvQ2oQ6dkU0juAkIMPZ9QgtmJ8IPrxe76zGSbmzbaC1GdKw7pqeXEi2HT67sbA==}
+    engines: {node: '>=22.0.0'}
 
-  '@supabase/supabase-js@2.108.2':
-    resolution: {integrity: sha512-hFhnPveb5JQg4a0QYicM0swT253YHMdfeRAl2BKHOlI5VAzuHxUGSr8RbwNLYNPauWOgQMS1H8sz8bvYlgwUfQ==}
-    engines: {node: '>=20.0.0'}
+  '@supabase/supabase-js@2.110.5':
+    resolution: {integrity: sha512-cAO1Nm+CCogRNVXN93bBkh0vjOdLM5e6J9gB/cHV9Lqni/gEmN2HJFrnn4NI33GYIfmlh4Wbm6siH+XXRgpexA==}
+    engines: {node: '>=22.0.0'}
 
   '@swc-node/core@1.14.1':
     resolution: {integrity: sha512-jrt5GUaZUU6cmMS+WTJEvGvaB6j1YNKPHPzC2PUi2BjaFbtxURHj6641Az6xN7b665hNniAIdvjxWcRml5yCnw==}
@@ -2817,8 +2926,8 @@ packages:
   '@types/estree@1.0.9':
     resolution: {integrity: sha512-GhdPgy1el4/ImP05X05Uw4cw2/M93BCUmnEvWZNStlCzEKME4Fkk+YpoA5OiHNQmoS7Cafb8Xa3Pya8m1Qrzeg==}
 
-  '@types/hast@3.0.4':
-    resolution: {integrity: sha512-WPs+bbQw5aCj+x6laNGWLH3wviHtoCv/P3+otBhbOhJgG8qtpdAMlTCxLtsTWA7LH1Oh/bFCHsBn0TPS5m30EQ==}
+  '@types/hast@3.0.5':
+    resolution: {integrity: sha512-rp/ezSWaD1m44dPKICGhiskI13nVr7qTloFwDa/IYkhhf5nzwP+zIQcIJh3WIFSBOy/H1PzB40jPjMDksN4F+g==}
 
   '@types/mdast@4.0.4':
     resolution: {integrity: sha512-kGaNbPh1k7AFzgpud/gMdvIm5xuECykRR+JnWKQno9TAXVa6WIVCGTPvYGekIDL4uwCZQSYbUxNBSb1aUo79oA==}
@@ -2829,11 +2938,8 @@ packages:
   '@types/ms@2.1.0':
     resolution: {integrity: sha512-GsCCIZDE/p3i96vtEqx+7dBUGXrc7zeSK3wwPHIaRThS+9OhWIXRqzs4d6k1SVU8g91DrNRWxWUGhp5KXQb2VA==}
 
-  '@types/node@25.9.3':
-    resolution: {integrity: sha512-603BddQMv3pUcr4U2dhujk83N2tTDVr/34wII2B6bJy6g+8WD6yUb11jszNs0gdi4PesVWl7ABt8nYMVpnLUcg==}
-
-  '@types/node@26.0.1':
-    resolution: {integrity: sha512-fc3KiUoBt6kie0N9bIW3E47vZsuaMf0PM2AaUpLCLT0s/LvX1nxAim6Fc049cNxODPpGm6qRAuUOB86SkRuPQw==}
+  '@types/node@26.1.1':
+    resolution: {integrity: sha512-nxAkRSVkN1Y0JC1W8ky/fTfkGsMmcrRsbx+3XoZE+rMOX71kLYTV7fLXpqud1GpbpP5TuffXFqfX7fH2GgZREw==}
 
   '@types/normalize-package-data@2.4.4':
     resolution: {integrity: sha512-37i+OaWTh9qeK4LSHPsyRC7NahnGotNuZvjLSgcPzblpHB3rrCJxAOgI5gCdKm7coonsaX1Of0ILiTcnZjbfxA==}
@@ -2864,55 +2970,179 @@ packages:
   '@types/ws@8.18.1':
     resolution: {integrity: sha512-ThVF6DCVhA8kUGy+aazFQ4kXQ7E1Ty7A3ypFOe0IcJV8O/M511G99AW24irKrW56Wt44yG9+ij8FaqoBGkuBXg==}
 
-  '@typescript/native-preview-darwin-arm64@7.0.0-dev.20260629.1':
-    resolution: {integrity: sha512-wXRExZJweYoTzE4atRR7T5HwKJYkl6/KHxON0eF0iy2fvgLXDlyq4AQqhmV8mMx10PQKc/4sNbfhD4kjWWvm8A==}
+  '@typescript/native-preview-darwin-arm64@7.0.0-dev.20260707.2':
+    resolution: {integrity: sha512-wny2pgKjGbiZtnOIHVa3tXC1UfDqxNEFzyPGmiqybedG8hipG2Nfp0l5UxbaKCjkLacUpH/W5bP2hBOMVhCOzg==}
     engines: {node: '>=16.20.0'}
     cpu: [arm64]
     os: [darwin]
 
-  '@typescript/native-preview-darwin-x64@7.0.0-dev.20260629.1':
-    resolution: {integrity: sha512-xkL/tETzUuDxfRkk2rD0/CjjjGLyOLHeE103T52rpgj0VNSXMnn7tTiw+TSdxnS61b8ImOrWgQJujhPFTp0jng==}
+  '@typescript/native-preview-darwin-x64@7.0.0-dev.20260707.2':
+    resolution: {integrity: sha512-Afc7M5zOwo+GpfcYwz5Z8HMB2tPVsui7nNIqEuuFB73MPdVqNn/Wmpe4tP4MRri0AtJnJknoHBaTJ/VDAp/Jhw==}
     engines: {node: '>=16.20.0'}
     cpu: [x64]
     os: [darwin]
 
-  '@typescript/native-preview-linux-arm64@7.0.0-dev.20260629.1':
-    resolution: {integrity: sha512-y4ey82krq4iLNHML4G1dUObBWY6gNAjVqaUHFDv7+LBu5bfAJy8VClBaLtAJce3siQQeB0/4SkN4XsAa0oZktQ==}
+  '@typescript/native-preview-linux-arm64@7.0.0-dev.20260707.2':
+    resolution: {integrity: sha512-iITBa2WjjTI5N9t5l7Z4KoOSI+2zBlhbvFzsD/f8qX8QoKjz/Y4DPyBDgezYi8nkqjjksbgSOJ3/ykzhwrB9cg==}
     engines: {node: '>=16.20.0'}
     cpu: [arm64]
     os: [linux]
 
-  '@typescript/native-preview-linux-arm@7.0.0-dev.20260629.1':
-    resolution: {integrity: sha512-QlTxO+O6yELc0NYZZYIbncZhkhw+K/vBoVg+mKipbEIK5b1E6cwW7ivWIrDp1FfssQ0Wu7zxincPappoci7KNw==}
+  '@typescript/native-preview-linux-arm@7.0.0-dev.20260707.2':
+    resolution: {integrity: sha512-hJm/UOqZTr9FHmR7uNm8VGX4oKtfWk0Jem0zPeJFNC8ckGUfSBueyiEYMZB+XmRc1aG4x1E46y3CplP4CLHvGQ==}
     engines: {node: '>=16.20.0'}
     cpu: [arm]
     os: [linux]
 
-  '@typescript/native-preview-linux-x64@7.0.0-dev.20260629.1':
-    resolution: {integrity: sha512-ckb4HyugC5beDpOMPOVpEx1H3l2Z2RgsGPxFOLGMU6LLIHQwlCaSdRjSfH8Hq8yffPgKuotTQLdA89cP1IC8xQ==}
+  '@typescript/native-preview-linux-x64@7.0.0-dev.20260707.2':
+    resolution: {integrity: sha512-du0dzi6y97Po5vDNdPJTyyijHCpaS22JLRnKZEJXBDaO9gCIymOv/5QQokFRuOlQm0bWl3i9PF4OVdGP6uAOQA==}
     engines: {node: '>=16.20.0'}
     cpu: [x64]
     os: [linux]
 
-  '@typescript/native-preview-win32-arm64@7.0.0-dev.20260629.1':
-    resolution: {integrity: sha512-Ktgepu9p0blqrbiryzYrw11ddnbESXPdeGKURDG/wXESoHQETsMNxKWhqAo587ItNnWjKOBFxoEM22eP9OzKnw==}
+  '@typescript/native-preview-win32-arm64@7.0.0-dev.20260707.2':
+    resolution: {integrity: sha512-SsAwfhyHJ1akgBc+99z4+hwdbHsdWaKB8EwCNIMA6JfSLMeUjffrYvxu+vfMyxVtOVOz7RrRXRoiDiu4a2sCtg==}
     engines: {node: '>=16.20.0'}
     cpu: [arm64]
     os: [win32]
 
-  '@typescript/native-preview-win32-x64@7.0.0-dev.20260629.1':
-    resolution: {integrity: sha512-b2wmeIpFJs/peej3NG26320ya+iYQz21JzFYDrnvtsEeR/g66rB9uvp4Owo4J1AG/BcmRWC/nuwrBy3Jdb+UDA==}
+  '@typescript/native-preview-win32-x64@7.0.0-dev.20260707.2':
+    resolution: {integrity: sha512-DL4u27stv0fo71sVhOzHSwE+YMZsbBijVI+kg5dLDLilSH79WFTJ8RSQ46vJrCMt+Gjlv/JOZP1PuLJDfioYeQ==}
     engines: {node: '>=16.20.0'}
     cpu: [x64]
     os: [win32]
 
-  '@typescript/native-preview@7.0.0-dev.20260629.1':
-    resolution: {integrity: sha512-KImWFkxGUa/V78bUEAgzeJQT+6wKQXDDYHHrOavof8wnbMCpj86KuPNyBIPQMtoHiz2If8aNTums2m50oE3oqw==}
+  '@typescript/native-preview@7.0.0-dev.20260707.2':
+    resolution: {integrity: sha512-oUGp+Rep/hqMhPunyinsALUwSlzHINSxitifPiSaeqoKOKD2OlR9NE3TaPqwsl4NlGslsOSUXI1JotWQzpYCPg==}
     engines: {node: '>=16.20.0'}
     hasBin: true
 
-  '@ungap/structured-clone@1.3.2':
-    resolution: {integrity: sha512-5jsZFwgR5rTdKwidH9Qmat75RKwqfpKlWWB1frDkljN127mwqBu8K0PYo7/hFpF03IEJpfVPpCQDY/eDx3iHvA==}
+  '@typescript/typescript-aix-ppc64@7.0.2':
+    resolution: {integrity: sha512-MTKKkWB7p/0E9xi1d1tHtZ5PiLkGEMIq88pK2CubZjOsLtYTLqhgIgi6zepFa+9GHZ6h05NMCkQxGKiPXMxXtQ==}
+    engines: {node: '>=16.20.0'}
+    cpu: [ppc64]
+    os: [aix]
+
+  '@typescript/typescript-darwin-arm64@7.0.2':
+    resolution: {integrity: sha512-gowzar9MwS/aRWp6f3a4KUqzRjAZjOsmGNCM6LcTgXum+dBfgsBVMN+AgvOCCbguXyick6LJhpBszxMebJ8syA==}
+    engines: {node: '>=16.20.0'}
+    cpu: [arm64]
+    os: [darwin]
+
+  '@typescript/typescript-darwin-x64@7.0.2':
+    resolution: {integrity: sha512-SZ9xZInqApNlNGc9s0W1VSsktYSOe9cFqNOIqmN1Gs8SmkjKZYFt017G4VwPxASInODuAdbTW7sXiFUf893RgA==}
+    engines: {node: '>=16.20.0'}
+    cpu: [x64]
+    os: [darwin]
+
+  '@typescript/typescript-freebsd-arm64@7.0.2':
+    resolution: {integrity: sha512-W5NH4y/J0plIIS5b2xvTEkU7JFxyqdMAOgf+Ilhl0vHQXKO5dZoxd+C/jEtq56c4F3wk71RB4BMRQ2XdI+bwYQ==}
+    engines: {node: '>=16.20.0'}
+    cpu: [arm64]
+    os: [freebsd]
+
+  '@typescript/typescript-freebsd-x64@7.0.2':
+    resolution: {integrity: sha512-UMGDx5sTpzNw3WiPebH7l90IWfJggEd+egHt/q6p7/Cm3zqoV7VxkGXt+3DxPIw8CcmvAB0j3sVVfbhX+M4Tpw==}
+    engines: {node: '>=16.20.0'}
+    cpu: [x64]
+    os: [freebsd]
+
+  '@typescript/typescript-linux-arm64@7.0.2':
+    resolution: {integrity: sha512-Qh4eU4/y3yDjnfjjyPYihMj5/ODIlmt+Bzu17OI+fiSRDW57QmU5SiN63exPRNJPKUzcc1INa1NXdrJ+MqHjUQ==}
+    engines: {node: '>=16.20.0'}
+    cpu: [arm64]
+    os: [linux]
+
+  '@typescript/typescript-linux-arm@7.0.2':
+    resolution: {integrity: sha512-gffT3xPz9sR7j/YJExkyPntrI0P2EP9XbOyWzth2/Gs0RstK+90RBcO0ncXoXy/beYll1SXw846Nf2zdnEz0QQ==}
+    engines: {node: '>=16.20.0'}
+    cpu: [arm]
+    os: [linux]
+
+  '@typescript/typescript-linux-loong64@7.0.2':
+    resolution: {integrity: sha512-uEHck9i8hoAzXPiYRib1O7miOnz23SxIeVl6F4LXox+qov1K35jHcEW6VHKvZI+pyvl7fZEP4MCU5LYvIq1GuQ==}
+    engines: {node: '>=16.20.0'}
+    cpu: [loong64]
+    os: [linux]
+
+  '@typescript/typescript-linux-mips64el@7.0.2':
+    resolution: {integrity: sha512-R4KvAMnE43W5Qeqb0Ly56O3mWMWIAgsMyz36DCaycd5nbg/9kzm0liw3JocfRqyJY0KPmzFjbswozXyW0DnIYA==}
+    engines: {node: '>=16.20.0'}
+    cpu: [mips64el]
+    os: [linux]
+
+  '@typescript/typescript-linux-ppc64@7.0.2':
+    resolution: {integrity: sha512-DORx5b3sd/4S7eayxm4FQv+A7CrkUIGRaHiwI8oiHTAI1fAPWhF4J0vAlkC8biAlHSVVwxMQ3tjZ2/DVbnQiiA==}
+    engines: {node: '>=16.20.0'}
+    cpu: [ppc64]
+    os: [linux]
+
+  '@typescript/typescript-linux-riscv64@7.0.2':
+    resolution: {integrity: sha512-wf0jqEDOjrPRnKwYRyyJDRo11KMbvMFrU+q4zqKyChODBzvlkbhNQfKvLxQCcwTpdDaXSHZTVuh0JoCrKCUMHQ==}
+    engines: {node: '>=16.20.0'}
+    cpu: [riscv64]
+    os: [linux]
+
+  '@typescript/typescript-linux-s390x@7.0.2':
+    resolution: {integrity: sha512-IkwJc3L7yhytWd/ewjyxNDfOmswCm9GWMJT/ue/dU4aZNbwZeYAetq42VyLmsmSjvoX7z74X6ZaYCtzAr0EuGw==}
+    engines: {node: '>=16.20.0'}
+    cpu: [s390x]
+    os: [linux]
+
+  '@typescript/typescript-linux-x64@7.0.2':
+    resolution: {integrity: sha512-EYdf2cNg7rgCWJnxCdJ+F3V39O8ihb37eHAu1LK8oAFizgTQbPOK7zHHXbPt8rX24COqODXeI3sIf0fCXG7H/A==}
+    engines: {node: '>=16.20.0'}
+    cpu: [x64]
+    os: [linux]
+
+  '@typescript/typescript-netbsd-arm64@7.0.2':
+    resolution: {integrity: sha512-+polYF4MF04aPpO5FTkHran9yUQDSXqy5GiSDKpsll5jy3l3+g9QLhpf39T+ePtefhXLOGrLl0QIjkQP6VnelA==}
+    engines: {node: '>=16.20.0'}
+    cpu: [arm64]
+    os: [netbsd]
+
+  '@typescript/typescript-netbsd-x64@7.0.2':
+    resolution: {integrity: sha512-8YIT0EHM/3dq10ZOVF/A7pc/YSMtbcecct4rWtexrnSCHOPcpC2KTLXfTCR6vDpnSiY12heNb1GiN/wu+T/FyA==}
+    engines: {node: '>=16.20.0'}
+    cpu: [x64]
+    os: [netbsd]
+
+  '@typescript/typescript-openbsd-arm64@7.0.2':
+    resolution: {integrity: sha512-APT8+ClYnuYm1u9+kgGXoMj2VzWzcymwh2gNSQVySHfkRDGOTVkoWLjCmOQSaO+PoqQ57B0flRp9SA+7GnnkzQ==}
+    engines: {node: '>=16.20.0'}
+    cpu: [arm64]
+    os: [openbsd]
+
+  '@typescript/typescript-openbsd-x64@7.0.2':
+    resolution: {integrity: sha512-yX7s+Q0Dln0Dt9tEzZsAjXXR/+ytBM7AlglaqyeMPxQszJ1JhlJdZ6jLA+IzldHtflX81em7lDao1xXu+aRRkg==}
+    engines: {node: '>=16.20.0'}
+    cpu: [x64]
+    os: [openbsd]
+
+  '@typescript/typescript-sunos-x64@7.0.2':
+    resolution: {integrity: sha512-dLJDGaLZ1D4HPQn62u1n8mBDkJREwMsAkCdkwd4Ieqw+x3TUyTsqY0YiBCtE6H6OzzgGk3iuZ3vFWRS+E8/d1g==}
+    engines: {node: '>=16.20.0'}
+    cpu: [x64]
+    os: [sunos]
+
+  '@typescript/typescript-win32-arm64@7.0.2':
+    resolution: {integrity: sha512-Gyl1Vy6OsWesLzmq+EP0Fb7b4Nid5232AvcA2SFcdYreldpNtYFFofPjnt62y9hQy7VTaZp65ICJjuAQRaVcIQ==}
+    engines: {node: '>=16.20.0'}
+    cpu: [arm64]
+    os: [win32]
+
+  '@typescript/typescript-win32-x64@7.0.2':
+    resolution: {integrity: sha512-0BQ3HkAHHlKLSp1qRvf3SUhGpGsDuhB/jgFw75guyqbxJqEaS0Cw/VFO8i2nHglJUzQCRtMMR/IBAKE3ETMC4g==}
+    engines: {node: '>=16.20.0'}
+    cpu: [x64]
+    os: [win32]
+
+  '@typescript/typescript6@6.0.2':
+    resolution: {integrity: sha512-mbCddXd+jm7hfx7w2YU64/Av4/NqqeG3GoRZgxPcgoTxYjhrcfJRw9ULch71SS4G+Q3bOXFhRvPqjguN0Hyp5w==}
+    hasBin: true
+
+  '@ungap/structured-clone@1.3.3':
+    resolution: {integrity: sha512-60YRaenCQcVjYEKOcG824+DRGGIQ3VKErcBoAEDJZz5bKIs2ZG+X/H9Nk+Q6EVkwJk5QNApxbrc5QtBSwtrXAg==}
 
   '@vercel/detect-agent@1.2.3':
     resolution: {integrity: sha512-VYNCgUc0nOmC4WJmWw9GkrKdfr8Zl4/rxhC5SvgacBgxiW9W/9NRttUoHHXV8xdII3MaRgkZZVX8Ikzc/Jmjag==}
@@ -2934,8 +3164,8 @@ packages:
     resolution: {integrity: sha512-SZ9uxnQKppiM+/67xTaaBP4AZ/Q+weUB22ci1gF861icYWhWFu3njA3ofYig/4yNqkYRVEKVAIwnH97BaBEYbg==}
     engines: {node: '>=18'}
 
-  '@verdaccio/hooks@8.0.3':
-    resolution: {integrity: sha512-5e71ArLhvcc/CFkDZW/gS3GWFkIAgIr0SCmEUXsTYHoqfyLV6VlXIpb6baGCnQ1EoQQ5ZkHtaWNFxSzM96ZlXA==}
+  '@verdaccio/hooks@8.0.4':
+    resolution: {integrity: sha512-FJRCe7pH8c1pCqf7BVwKwCtvN63HMQhM6991qQwBS8CgZf86a1TY9TMxW1ICSHqD+jPidtLq+6W2s+bfaiHwJA==}
     engines: {node: '>=18'}
 
   '@verdaccio/loaders@8.0.3':
@@ -2982,8 +3212,8 @@ packages:
     resolution: {integrity: sha512-BKdksIRaqhrptP6JmVW71TeUTuA1hHWcGeEabSDzYgi1PXgLS9l8On3HWLs+TZ93PRtTjZiZJGCJPbqoy5itvg==}
     engines: {node: '>=18'}
 
-  '@verdaccio/ui-theme@9.0.0-next-9.20':
-    resolution: {integrity: sha512-eo4xqFzzUU382zKozJxipJGLp3HUNQvMZ81oTBa0SZ+Q/Bk2Fum82qAiE5ww4hTaVDV0Rjb7fqC4qJeBuLcGww==}
+  '@verdaccio/ui-theme@9.0.0-next-9.21':
+    resolution: {integrity: sha512-w423IDgBOTmUW94CF84bXosW9Kg6khNhbGxCAPEOtE7yZUyASMxoZP14Ro3N2F492pd0Nd/MV3a//opI+SNPQA==}
 
   '@verdaccio/url@13.0.3':
     resolution: {integrity: sha512-BGH19Qc0pwoefyafJ100izQkgqKuuSF0EVdNjgipG8154yIluELxyliL8cqvTTDVZLVwz/CBuBq8IpUU9lhv9g==}
@@ -2993,16 +3223,16 @@ packages:
     resolution: {integrity: sha512-tJ3XO0MaFe8gx9oiLBu3Jim8JVyJRC08c2Y4dfx3wd1j9HlVkiWnW5qYOoTHA4NfdMzugsBsI8GlX3v/y/EtPg==}
     engines: {node: '>=18'}
 
-  '@vitest/coverage-istanbul@4.1.9':
-    resolution: {integrity: sha512-4a7DsIwycTf4eYwEDtnMfMV8H80KSKH9PuMHhqL5SwPZzDyUKq2X/TPCVZ7NqIuSz7UbZckmEmkip6iZBI/gEA==}
+  '@vitest/coverage-istanbul@4.1.10':
+    resolution: {integrity: sha512-AyNJ5pQRFqCX7pwB9PSTmoVKPaZ4H5IEVJfJsT+q1DYkXvZMEFYgJlyk5sfStmt9rVYRyYYRRsuBeImCOc39ww==}
     peerDependencies:
-      vitest: 4.1.9
+      vitest: 4.1.10
 
-  '@vitest/expect@4.1.9':
-    resolution: {integrity: sha512-vl/rYsUKcBr3SnQn166+XR5ZQcgMx3DQhFWdfli/cWpLnLUmbxZvyrJZotLFUryib+LtArYMSTJ5RbQ57ZqrlA==}
+  '@vitest/expect@4.1.10':
+    resolution: {integrity: sha512-YsCn+qAk1GWjQOWFEsEcL2gNQ0zmVmQu3T03qP6UyjhtmdtwtbuI+DASn/7iQB3HGTXkdBwGddzxPlmiql5vlA==}
 
-  '@vitest/mocker@4.1.9':
-    resolution: {integrity: sha512-EVkXzBjrPGM+cK8/ANWgBrkUCfJfb38/EfTSO8h7pWvKkyPkpWxvR7BkD2MyItMF62C97zAEoqdpUixwR/e+Rw==}
+  '@vitest/mocker@4.1.10':
+    resolution: {integrity: sha512-v0xaezt+DKEmKfaxg133ldzADrwLGd7Ze1MfQQTYfvs8OqZIwbxyxaYURivwV7sWy5fqn3rH5uOrSp07bp44Ow==}
     peerDependencies:
       msw: ^2.4.9
       vite: ^6.0.0 || ^7.0.0 || ^8.0.0
@@ -3012,20 +3242,20 @@ packages:
       vite:
         optional: true
 
-  '@vitest/pretty-format@4.1.9':
-    resolution: {integrity: sha512-s0iufns3iIFitdgm+YR7g1whCAaGtXz459VS9/PqyKDEEFgYIhsHOQmXgIgDuYCt7DeQmiZT0Qe2OA2p4ZPu5A==}
+  '@vitest/pretty-format@4.1.10':
+    resolution: {integrity: sha512-W1HsjSH4MXQ9YfmmhLAoIYf1HRfekQCGngeIgcei6MP5QQGWUe0gkopdZQaVCFO+JDJMrAJGwa5pRpNpvy4P8Q==}
 
-  '@vitest/runner@4.1.9':
-    resolution: {integrity: sha512-KXLMDtc7oe70+3mJfGrPUWPesswH+3sTxAMAMl8DG7I8IUQT4XW718dY5ID3vPUcmlu27CcKfY4P3h3I29SLJg==}
+  '@vitest/runner@4.1.10':
+    resolution: {integrity: sha512-IKI6kpIH+LmpROplyLwBBaCfMgOZOMsygVa6BARD6ahA04VRuJSa6OaVG7kRvSEMD870Vd91rSSw0eegtWyLGg==}
 
-  '@vitest/snapshot@4.1.9':
-    resolution: {integrity: sha512-Jc7RKGNBo8Z28WYIm0Niej4xdSPByRf6mU58VpHQkd6Zh05rlnA+twjbK5HyeIGHxrzsc3mJgS43uM0CZKzaIA==}
+  '@vitest/snapshot@4.1.10':
+    resolution: {integrity: sha512-xRkfOT1qpTAi/Ti4Y1LtfRc3kEuqxGw59eN2jN9pRWMtS/XDevekhcFSqvQqjUNGksfjMJu3Y+oJ+4Ypn2OaJw==}
 
-  '@vitest/spy@4.1.9':
-    resolution: {integrity: sha512-fHpsS6mIi+PiEW+vcRVOMkX1oSaPKne3VOclSFICPcGOmfKgXPU5iAah+wcNcj2xPrCCmfq99IDGf+EojhhvhA==}
+  '@vitest/spy@4.1.10':
+    resolution: {integrity: sha512-PLf/Ugvoq5wO/b4rwYCR1h2PSIdXz7wnkQFMiUpLdtM7l6pqVFcQIBEHyT1+l+cj7mNwAfZHzqXqDyjvOuwbDw==}
 
-  '@vitest/utils@4.1.9':
-    resolution: {integrity: sha512-A51o8ymO5PpqlWNnBP9ZHPXDIpuMtTLlGSjN7la4US+LJzoUMyhwjA5QXlm39JexgwHKW4Xjs8Z2d3dLCXOeuA==}
+  '@vitest/utils@4.1.10':
+    resolution: {integrity: sha512-fy9am/HWxbaGt/Sawrp90vt6Y6jQwf1RX77cz3uwoJwJVMli/e1IEwRPnMNJ7vKfPTwo0diXifkpPvwH9v7nGA==}
 
   '@yarnpkg/lockfile@1.1.0':
     resolution: {integrity: sha512-GpSwvyXOcOOlV70vbnzjj4fW5xW/FdUF6nQEt1ENy7m4ZCczi1+/buVUPAqmGfqznsORNFzUMjctTIp8a9tuCQ==}
@@ -3083,6 +3313,9 @@ packages:
   ajv@8.18.0:
     resolution: {integrity: sha512-PlXPeEWMXMZ7sPYOHqmDyCJzcfNrUr3fGNKtezX14ykXOEIvyK81d+qydx89KY5O71FKMPaQ2vBfBFI5NHR63A==}
 
+  ajv@8.20.0:
+    resolution: {integrity: sha512-Thbli+OlOj+iMPYFBVBfJ3OmCAnaSyNn4M1vz9T6Gka5Jt9ba/HIR56joy65tY6kx/FCF5VXNB819Y7/GUrBGA==}
+
   ansi-colors@4.1.3:
     resolution: {integrity: sha512-/6w/C21Pm1A7aZitlI5Ni/2J6FFQN8i1Cvz3kHABAAbw93v/NlvKdVOqz7CCWz/3iv/JplRSEEZ83XION15ovw==}
     engines: {node: '>=6'}
@@ -3173,8 +3406,8 @@ packages:
   aws4@1.13.2:
     resolution: {integrity: sha512-lHe62zvbTB5eEABUVi/AwVh0ZKY9rMMDhmm+eeyuuUQbQ3+J+fONVQOZyj+DdrvD4BY33uYniyRJ4UJIaSKAfw==}
 
-  axios@1.16.0:
-    resolution: {integrity: sha512-6hp5CwvTPlN2A31g5dxnwAX0orzM7pmCRDLnZSX772mv8WDqICwFjowHuPs04Mc8deIld1+ejhtaMn5vp6b+1w==}
+  axios@1.16.1:
+    resolution: {integrity: sha512-caYkukvroVPO8KrzuJEb50Hm07KwfBZPEC3VeFHTsqWHvKTsy54hjJz9BS/cdaypROE2rH6xvm9mHX4fgWkr3A==}
 
   b4a@1.8.1:
     resolution: {integrity: sha512-aiqre1Nr0B/6DgE2N5vwTc+2/oQZ4Wh1t4NznYY4E00y8LCt6NqdRv81so00oo27D8MVKTpUa/MwUUtBLXCoDw==}
@@ -3205,8 +3438,8 @@ packages:
   base64-js@1.5.1:
     resolution: {integrity: sha512-AKpaYlHn8t4SVbOHCy+b5+KKgvR4vrsD8vbvrbiQJps7fKDTkjkDry6ji0rUJjC0kzbNePLwzxq8iypo41qeWA==}
 
-  baseline-browser-mapping@2.10.37:
-    resolution: {integrity: sha512-girxaJ7WZssDOFhzCGZTDKoTa1gk6A1TbflaYTpykLJ4UU9Fz9kx1aREM8JCuoVHbL8X8T/mJg7w2oYSq72Oig==}
+  baseline-browser-mapping@2.10.43:
+    resolution: {integrity: sha512-AjYpR78kDWAY3Efj+cDTFH9t9SCoL7OoTp1BOb0mQV7S+6CiLwnWM3FyxhJtdPufDFKzmCSFoUncKjWgJEZTCQ==}
     engines: {node: '>=6.0.0'}
     hasBin: true
 
@@ -3222,19 +3455,19 @@ packages:
   bl@4.1.0:
     resolution: {integrity: sha512-1W07cM9gS6DcLperZfFSj+bWLtaPGSOHWhPiGzXmvVJbRLdG82sH/Kn8EtW1VqWVA54AKf2h5k5BbnIbwF3h6w==}
 
-  body-parser@1.20.5:
-    resolution: {integrity: sha512-3grm+/2tUOvu2cjJkvsIxrv/wVpfXQW4PsQHYm7yk4vfpu7Ekl6nEsYBoJUL6qDwZUx8wUhQ8tR2qz+ad9c9OA==}
+  body-parser@1.20.6:
+    resolution: {integrity: sha512-p5tAzS57i5MV9fZFDj9LeIiTZEufbSe2eDozP+ElheSUq1m74CRq1jI4mYNDdVs9vQztXFLuk/Gd6BWTdwRJ5g==}
     engines: {node: '>= 0.8', npm: 1.2.8000 || >= 1.4.16}
 
-  body-parser@2.2.2:
-    resolution: {integrity: sha512-oP5VkATKlNwcgvxi0vM0p/D3n2C3EReYVX+DNYs5TjZFn/oQt2j+4sVJtSMr18pdRr8wjTcBl6LoV+FUwzPmNA==}
+  body-parser@2.3.0:
+    resolution: {integrity: sha512-2cGmJupaNgg+QUwVLAucDuWuoMZ6EX9iHDRswZ5lsNYEmwPaRknMPCLZz07yTzVq/83p4o/wzbDZbBrTvGGTIw==}
     engines: {node: '>=18'}
 
   bottleneck@2.19.5:
     resolution: {integrity: sha512-VHiNCbI1lKdl44tGrhNfU3lup0Tj/ZBMJB5/2ZbNXRCPuRCO7ed2mgcK4r17y+KB2EfuYuRaVlwNbAeaWGSpbw==}
 
-  brace-expansion@2.1.1:
-    resolution: {integrity: sha512-WR1cURNjuvBLMZBMbqM0UoE+WAfdUcEV1ccD8PVBVOI+Z3ND4+SZbN8RsfT2bMuG1qwz5RFvPukSZm5fF2D5eA==}
+  brace-expansion@2.1.2:
+    resolution: {integrity: sha512-w5JZcKgdhDOgOwm8H+KgbosopHMuGcl6qbulwjtz3SM7I7P3yW1eAjzMPLrIE+NQ9vjgANKHWeMHnrT0OXW1oA==}
 
   brace-expansion@5.0.6:
     resolution: {integrity: sha512-kLpxurY4Z4r9sgMsyG0Z9uzsBlgiU/EFKhj/h91/8yHu0edo7XuixOIH3VcJ8kkxs6/jPzoI6U9Vj3WqbMQ94g==}
@@ -3247,8 +3480,8 @@ packages:
   browserify-zlib@0.1.4:
     resolution: {integrity: sha512-19OEpq7vWgsH6WkvkBJQDFvJS1uPcbFOQ4v9CU839dO+ZZXUZO6XpE6hNCqvlIIj+4fZvRiJ6DsAQ382GwiyTQ==}
 
-  browserslist@4.28.2:
-    resolution: {integrity: sha512-48xSriZYYg+8qXna9kwqjIVzuQxi+KYWp2+5nCYnYKPTr0LvD89Jqk2Or5ogxz0NUMfIjhh2lIUX/LyX9B4oIg==}
+  browserslist@4.28.6:
+    resolution: {integrity: sha512-FQBYNK15VMslhLHpA7+n+n1GOlF1kId2xcCg7/j95f24AOF6VDYMNH4mFxF7KuaTdv627faazpOAjFzMrfJOUw==}
     engines: {node: ^6 || ^7 || ^8 || ^9 || ^10 || ^11 || ^12 || >=13.7}
     hasBin: true
 
@@ -3291,8 +3524,8 @@ packages:
     resolution: {integrity: sha512-P8BjAsXvZS+VIDUI11hHCQEv74YT67YUi5JJFNWIqL235sBmjX4+qx9Muvls5ivyNENctx46xQLQ3aTuE7ssaQ==}
     engines: {node: '>=6'}
 
-  caniuse-lite@1.0.30001799:
-    resolution: {integrity: sha512-hG1bReV+OUU+MOqK4t/ZWI0tZOyz3rqS9XuhOUz1cIcbwBKjOyJEJuw9ER5JuNyqxNk8u/JUVbGibBOL1yrjFw==}
+  caniuse-lite@1.0.30001805:
+    resolution: {integrity: sha512-52noaS3DubycKSXaU30TwPGIp+POyQSUVa5jBEq3vkRkY0kjyb3LQgvhU6WGyCcyXqVLWO0Cw0Q6BSdD0kUfVA==}
 
   caseless@0.12.0:
     resolution: {integrity: sha512-4tYFyifaFfGacoiObjJegolkwSU4xQNGbVgUiNYVUxbQ2x2lUsFvY4hVgVzGiIe6WLOPqycWXA40l+PWsxthUw==}
@@ -3372,8 +3605,8 @@ packages:
     resolution: {integrity: sha512-+W/5efTR7y5HRD7gACw9yQjqMVvEMLBHmboM/kPWam+H+Hmyrgjh6YncVKK122YZkXrLudzTuAukUw9FnMf7IQ==}
     engines: {node: 10.* || >= 12.*}
 
-  cli-truncate@6.1.0:
-    resolution: {integrity: sha512-ofWtXdvPO1WepoE9Gn4dPdZw+ADud1Yz9K+xm9FjK5vvrs/D60vrlKIQeSw1wJX4cphW2bnWi8GZSKvf9T6shw==}
+  cli-truncate@6.1.1:
+    resolution: {integrity: sha512-06p9vyLahLa4zkGcgsGxU6iEkSOiuI4fhCH6Emhe2lPAcoUv73n72DnODsnHA+5wwXGnV0n9M9/qOQJSjYhFhw==}
     engines: {node: '>=22'}
 
   client-only@0.0.1:
@@ -3674,16 +3907,16 @@ packages:
   ee-first@1.1.1:
     resolution: {integrity: sha512-WMwm9LhRUo+WUaRN+vRuETqG89IgZphVSNkdFgeb6sS/E4OrDIN7t48CAewSHXc6C8lefD8KKfr5vY61brQlow==}
 
-  effect@4.0.0-beta.93:
-    resolution: {integrity: sha512-wNS5MKFa3C42uBfIDik2oJ78lhpoYz2hN4oBR0229BeeDCIrkg/FiOvoiPGdCVlWa7MEKxEL5I0f8AILVHSD9A==}
+  effect@4.0.0-beta.97:
+    resolution: {integrity: sha512-pK03HpQVxGZOWdwDAy/iwvV8u3KYcUf2mOWyWqaut2zau8V2u6ejWP7b4BELjyUIiZWW1fl/s/VJpgZUcTjThg==}
 
   ejs@5.0.1:
     resolution: {integrity: sha512-COqBPFMxuPTPspXl2DkVYaDS3HtrD1GpzOGkNTJ1IYkifq/r9h8SVEFrjA3D9/VJGOEoMQcrlhpntcSUrM8k6A==}
     engines: {node: '>=0.12.18'}
     hasBin: true
 
-  electron-to-chromium@1.5.363:
-    resolution: {integrity: sha512-VjUKPyWzGnT1fujlkEGC/BvN70Hh70KXtAqcmniXviYlJC/ivcT+BWGPyxWVbJZLfvtKR6dqg1L7T7pgAMBtWA==}
+  electron-to-chromium@1.5.389:
+    resolution: {integrity: sha512-cEto7aeOqBfU1D+c5py5pE+ooscKE75JifxLBdFUZsqAxRS6y7kebtxAZvICszSl05gPjYHDTjY+lXpyGvpJbg==}
 
   emoji-regex@10.6.0:
     resolution: {integrity: sha512-toUI84YS5YmxW219erniWD0CIVOo46xGKColeNQRgOzDorgBi1v4D71/OFzgD9GO2UGKIv1C3Sp8DAn0+j5w7A==}
@@ -3737,8 +3970,8 @@ packages:
     resolution: {integrity: sha512-Zf5H2Kxt2xjTvbJvP2ZWLEICxA6j+hAmMzIlypy4xcBg1vKVnx89Wy0GbS+kf5cwCVFFzdCFh2XSCFNULS6csw==}
     engines: {node: '>= 0.4'}
 
-  es-module-lexer@2.1.0:
-    resolution: {integrity: sha512-n27zTYMjYu1aj4MjCWzSP7G9r75utsaoc8m61weK+W8JMBGGQybd43GstCXZ3WNmSFtGT9wi59qQTW6mhTR5LQ==}
+  es-module-lexer@2.3.1:
+    resolution: {integrity: sha512-shc1dbU90Yl/xq1QrC7QRtfcwURZuVRfPhZbDoldJ1cn1gzDvBaBWlv0eFolj5+0znnPJz5TXLxsN77X/12KTA==}
 
   es-object-atoms@1.1.1:
     resolution: {integrity: sha512-FGgH2h8zKNim9ljj7dankFPcICIK9Cp5bm+c2gQSYePhpaG5+esrLODihIorn+Pe6FGJzWhXQotPv73jTaldXA==}
@@ -3820,8 +4053,8 @@ packages:
     resolution: {integrity: sha512-mQw+2fkQbALzQ7V0MY0IqdnXNOeTtP4r0lN9z7AAawCXgqea7bDii20AYrIBrFd/Hx0M2Ocz6S111CaFkUcb0Q==}
     engines: {node: '>=0.8.x'}
 
-  eventsource-parser@3.0.8:
-    resolution: {integrity: sha512-70QWGkr4snxr0OXLRWsFLeRBIRPuQOvt4s8QYjmUlmlkyTZkRqS7EDVRZtzU3TiyDbXSzaOeF0XUKy8PchzukQ==}
+  eventsource-parser@3.1.0:
+    resolution: {integrity: sha512-kJezFj9YFAMLeORyi7aCLxLbD5/qWMQnoMVlVPyHIll7lgRJCc3JVln9Vgl9nwQi0YkMnhdGTMNn7CkRRAptMg==}
     engines: {node: '>=18.0.0'}
 
   eventsource@3.0.7:
@@ -3836,8 +4069,8 @@ packages:
     resolution: {integrity: sha512-9Be3ZoN4LmYR90tUoVu2te2BsbzHfhJyfEiAVfz7N5/zv+jduIfLrV2xdQXOHbaD6KgpGdO9PRPM1Y4Q9QkPkA==}
     engines: {node: ^18.19.0 || >=20.5.0}
 
-  expect-type@1.3.0:
-    resolution: {integrity: sha512-knvyeauYhqjOYvQ66MznSMs83wmHrCycNEN6Ao+2AeYEfxUIkuiVxdEa1qlGEPK+We3n0THiDciYSsCcgW/DoA==}
+  expect-type@1.4.0:
+    resolution: {integrity: sha512-KfYbmpRm0VbLjEvVa9yGwCi9GI34xvi7A/HXYWQO65CSD2u3MczUJSuwXKFIxlGsgBQizV9q5J9NHj4VG0n+pA==}
     engines: {node: '>=12.0.0'}
 
   express-rate-limit@5.5.1:
@@ -3868,8 +4101,8 @@ packages:
     resolution: {integrity: sha512-11Ndz7Nv+mvAC1j0ktTa7fAb0vLyGGX+rMHNBYQviQDGU0Hw7lhctJANqbPhu9nV9/izT/IntTgZ7Im/9LJs9g==}
     engines: {'0': node >=0.6.0}
 
-  fast-check@4.8.0:
-    resolution: {integrity: sha512-GOJ158CUMnN6cSahsv4+ExARvIDuzzinFjkp0E9WtiBa5zcVeLozVkWaE4IzFcc+Y48Wp1EDlUZsXRyAztQcSg==}
+  fast-check@4.9.0:
+    resolution: {integrity: sha512-7ms6T7SybUev/PQITciI0yLM2pOSFy5zpG8Ty7tQofcVaQUvrMXp6CBwqF6fThLCLOrfBtuHAtwq6Yu4XPCllg==}
     engines: {node: '>=12.17.0'}
 
   fast-deep-equal@3.1.3:
@@ -3891,8 +4124,8 @@ packages:
   fast-string-width@3.0.2:
     resolution: {integrity: sha512-gX8LrtNEI5hq8DVUfRQMbr5lpaS4nMIWV+7XEbXk2b8kiQIizgnlr12B4dA3ZEx3308ze0O4Q1R+cHts8kyUJg==}
 
-  fast-uri@3.1.2:
-    resolution: {integrity: sha512-rVjf7ArG3LTk+FS6Yw81V1DLuZl1bRbNrev6Tmd/9RaroeeRRJhAt7jg/6YFxbvAQXUCavSoZhPPj6oOx+5KjQ==}
+  fast-uri@3.1.3:
+    resolution: {integrity: sha512-i70LwGWUduXqzicKXWshooq+sWL1K3WUU5rKZNG/0i3a1OSoX3HqhH5WbWwTmqWfor4urUakGPiRQcleRZTwOg==}
 
   fast-wrap-ansi@0.2.2:
     resolution: {integrity: sha512-7F2Fl+TjRSenLqlU3UjSH0iyqopqoZIu7eZVpEirP2g1GtWa2G/ecEmBdgz31+Mxr+ELclgg6sokpSFIQiZ02Q==}
@@ -4008,8 +4241,8 @@ packages:
   fs-constants@1.0.0:
     resolution: {integrity: sha512-y6OAwoSIf7FyjMIv94u+b5rdheZEjzR63GTyZJm5qh4Bi+2YgwLCcI/fPFZkL5PSixOt6ZNKm+w+Hfp/Bciwow==}
 
-  fs-extra@11.3.5:
-    resolution: {integrity: sha512-eKpRKAovdpZtR1WopLHxlBWvAgPny3c4gX1G5Jhwmmw4XJj0ifSD5qB5TOo8hmA0wlRKDAOAhEE1yVPgs6Fgcg==}
+  fs-extra@11.3.6:
+    resolution: {integrity: sha512-w8ZNZr2mKIc7qeNaQ9AVPT1+iFaI+Avd4xudVOvdDJ8VytREi1Ft5Ih7hd9jjehod8vAM5GMsfQ/TpPf4EyoEA==}
     engines: {node: '>=14.14'}
 
   fsevents@2.3.3:
@@ -4017,8 +4250,8 @@ packages:
     engines: {node: ^8.16.0 || ^10.6.0 || >=11.0.0}
     os: [darwin]
 
-  fumadocs-core@16.10.7:
-    resolution: {integrity: sha512-lR1hDOtJ8ubsLKYH2VMkp+iVZTDdOiMh4StFaWtuTvy8Wfnngz0YSHeFijmm2K+4lg2DLXLMuCEHQ6my54g2Eg==}
+  fumadocs-core@16.11.4:
+    resolution: {integrity: sha512-PckGsjeXoQ7UkOn6XuJSNMoZYgYHAtEV5izxCHbjry1A9CM1m/u2dLM6Fefi9PS3SDVGQ8BKiYxtx1i4FF7T7g==}
     peerDependencies:
       '@mdx-js/mdx': '*'
       '@mixedbread/sdk': 0.x.x
@@ -4076,10 +4309,11 @@ packages:
       zod:
         optional: true
 
-  fumadocs-mdx@15.0.13:
-    resolution: {integrity: sha512-VsGhCiLriXXMzm3WbgrVP7t6LvOthwh1BC+IGSI1ZW63UcSo1jE4aAiuUrTIF0jv1EGQkJG8cPsy0cOnf4sejA==}
+  fumadocs-mdx@15.1.1:
+    resolution: {integrity: sha512-qJ5WstRONnCkidmxdKcu9WgYfmM8TbAZRsprWXWnSZk+RIa+QQCnn0FXa1c9Pm8qesYSFVm6HmgKGSI2uPpQ6w==}
     hasBin: true
     peerDependencies:
+      '@fumadocs/satteri': 0.x.x
       '@types/mdast': '*'
       '@types/mdx': '*'
       '@types/react': '*'
@@ -4088,8 +4322,11 @@ packages:
       next: ^15.3.0 || ^16.0.0
       react: ^19.2.0
       rolldown: '*'
+      satteri: ^0.9.4
       vite: 7.x.x || 8.x.x
     peerDependenciesMeta:
+      '@fumadocs/satteri':
+        optional: true
       '@types/mdast':
         optional: true
       '@types/mdx':
@@ -4104,28 +4341,30 @@ packages:
         optional: true
       rolldown:
         optional: true
+      satteri:
+        optional: true
       vite:
         optional: true
 
-  fumadocs-ui@16.10.7:
-    resolution: {integrity: sha512-zE93/DKW5bhedXRKHYg3rhE/juYi+kXx1xl3ey1dArWbCiPx6lq6/4RLswYXS0lQp1W1f8NsbY1TeA8wSQuEvw==}
+  fumadocs-ui@16.11.4:
+    resolution: {integrity: sha512-ZLvyfPQjqa3m0+R6P9vkYtFW0HDC34b9lWiA6UPIJil7BwC8OUE9tpebKfQD69/DZF1KAC9lxz6929vLTraylQ==}
     peerDependencies:
-      '@takumi-rs/image-response': '*'
       '@types/mdx': '*'
       '@types/react': '*'
-      fumadocs-core: 16.10.7
+      fumadocs-core: 16.11.4
       next: 16.x.x
       react: ^19.2.0
       react-dom: ^19.2.0
+      takumi-js: '*'
     peerDependenciesMeta:
-      '@takumi-rs/image-response':
-        optional: true
       '@types/mdx':
         optional: true
       '@types/react':
         optional: true
       next:
         optional: true
+      takumi-js:
+        optional: true
 
   function-bind@1.1.2:
     resolution: {integrity: sha512-7XHNxH7qX9xG5mIwxkhumTox/MIRNcOgDrxWsMt2pAr23WHp6MrRlN7FBSFpCpr+oVO0F744iUgR82nJMfG2SA==}
@@ -4271,8 +4510,8 @@ packages:
   highlight.js@10.7.3:
     resolution: {integrity: sha512-tzcUFauisWKNHaRkN4Wjl/ZA07gENAjFl3J/c480dprkGTg5EQstgaNFqBfUqCq54kZRIEcreTsAgF/m2quD7A==}
 
-  hono@4.12.21:
-    resolution: {integrity: sha512-uV63apnb0kyPtAUwoWgaGh9HyIFcv8lgmzPZSiTBQAFOFGIzka5EZ1dZocmGnn0XdX0+XTqJ6Tqv7selMuGLRQ==}
+  hono@4.12.30:
+    resolution: {integrity: sha512-emn+JoJjrN9YTpRDS5it/UI2SO9BAE37T6I3d963RxcZ81G9A4pr2SZTEiiaiKbzx+NKRg5BZ89fCL7gCJCUog==}
     engines: {node: '>=16.9.0'}
 
   hook-std@4.0.0:
@@ -4339,8 +4578,8 @@ packages:
     resolution: {integrity: sha512-v3MXnZAcvnywkTUEZomIActle7RXXeedOR31wwl7VlyoXO4Qi9arvSenNQWne1TcRwhCL1HwLI21bEqdpj8/rA==}
     engines: {node: '>=0.10.0'}
 
-  iconv-lite@0.7.2:
-    resolution: {integrity: sha512-im9DjEDQ55s9fL4EYzOAv0yMqmMBSZp6G0VvFyTMPKWxiSBHUj9NW/qqLmXUwXrrM7AvqSlTCfvqRb0cM8yYqw==}
+  iconv-lite@0.7.3:
+    resolution: {integrity: sha512-IKXpvIzjnC9XTAUbVBcMfGS0EPaIXtW6v+zr+RRp+hqULEpo0owZax6wyRwPOJbWbzjYspQwusTsfVr0ifh4uQ==}
     engines: {node: '>=0.10.0'}
 
   ieee754@1.2.1:
@@ -4406,8 +4645,8 @@ packages:
   inline-style-parser@0.2.7:
     resolution: {integrity: sha512-Nb2ctOyNR8DqQoR0OwRG95uNWIC0C1lCgf5Naz5H6Ji72KZ8OcFZLz2P5sNgwlyoJ8Yif11oMuYs5pBQa86csA==}
 
-  ioredis@5.11.0:
-    resolution: {integrity: sha512-EZBErytyVovD8f6pDfG3Kb37N6Y3lmDA9NNj+4+IP13CzzHGeX+OyeRM2Um13khRzoBSzzL+5lVnCX8V2RLeMg==}
+  ioredis@5.11.1:
+    resolution: {integrity: sha512-ehuGcf94bQXhfagULNXrJdfnWO38v070jxSx/qE87Kjzmu2fU7ro5EFAb+OPituLqgfyuQaym5DlrNydW2sJ9A==}
     engines: {node: '>=12.22.0'}
 
   ip-address@10.2.0:
@@ -4558,10 +4797,6 @@ packages:
     resolution: {integrity: sha512-1td788aAnnZ5qs7V2QIRl1owjtYpbKt749Y3xauqQgwIIGF/xXWz1wMTEBx5O3LK3lXLVuqXPdPxj2BoFHaW9Q==}
     hasBin: true
 
-  js-yaml@5.2.1:
-    resolution: {integrity: sha512-zfLtNfQqxVqq3uaTqSkh4x4hZw3KHobGUA0fJUj4wawW8bsQLTVqpHdXSIzidh7o+4lEW36tANuAGdaFx6Zgnw==}
-    hasBin: true
-
   jsbn@0.1.1:
     resolution: {integrity: sha512-UVU9dibq2JcFWxQPA6KCqj5O42VOmAY3zQUfEKxU0KpTGXwNoCjkX1e13eHNvw/xPynt6pU0rZ1htjWTNTSXsg==}
 
@@ -4595,8 +4830,8 @@ packages:
   json-stringify-safe@5.0.1:
     resolution: {integrity: sha512-ZClg6AaYvamvYEE82d3Iyd3vSSIjQ+odgjaTzRuO3s7toCdFKczob2i0zCh7JE8kWn17yvAWhUVxvqGwUalsRA==}
 
-  json-with-bigint@3.5.8:
-    resolution: {integrity: sha512-eq/4KP6K34kwa7TcFdtvnftvHCD9KvHOGGICWwMFc4dOOKF5t4iYqnfLK8otCRCRv06FXOzGGyqE8h8ElMvvdw==}
+  json-with-bigint@3.5.10:
+    resolution: {integrity: sha512-Vcx+JVNEBts/xfcoCS69sKrOhOk/3TVlvlT+XzUOefVKnnrbYSCKpDCm10pohsJFtsJVYnwa/cXRZ4eElzaM6w==}
 
   json5@2.2.3:
     resolution: {integrity: sha512-XmOWe7eyHYH14cLdVPoyg+GOH3rYX++KpzrylJwSW98t3Nk+U8XOl8FWKOgwtzdb8lXGf6zYwDUzeHMWfxasyg==}
@@ -4630,8 +4865,8 @@ packages:
   keyv@4.5.4:
     resolution: {integrity: sha512-oxVHkHR/EJf2CNXnWxRLW6mg7JyCCUcG0DtEGmL2ctUo1PNTin1PUil+r/+4r5MpVgC/fn1kjsx7mjSujKqIpw==}
 
-  knip@6.23.0:
-    resolution: {integrity: sha512-2DvAOX2pZWiG4SLvRRxOAU0aWGEn1ZoVblI541xIoXFdHqq2THMZXy66/qcY5WGuW3TXhb9T1x1zd/Hd1u+yqg==}
+  knip@6.26.0:
+    resolution: {integrity: sha512-e9eELEEpBpGTd4H4HB7818/DYj9dMzMyUqAddfYwUN/EbSkgIjOuWEF96W/xHsmV0SDrsdXjIM+oZ2xpPzPsBA==}
     engines: {node: ^20.19.0 || >=22.12.0}
     hasBin: true
 
@@ -4784,8 +5019,8 @@ packages:
   lru-cache@10.4.3:
     resolution: {integrity: sha512-JNAzZcXrCt42VGLuYz0zfAzDfAvJWW6AfYlDBQyDV5DClI2m5sAmK+OIO7s59XfsRsWHp02jAJrRadPRGTt6SQ==}
 
-  lru-cache@11.5.1:
-    resolution: {integrity: sha512-RPimw/7aMdv2oqRrxKwvZXcPfwBrn/JZ2xYcY9Hus/6LaS3VOAKVWKWgNLCFSiOm1ESXinjsDlidVU7JlnCN2A==}
+  lru-cache@11.5.2:
+    resolution: {integrity: sha512-4pfM1Ff0x50o0tQwb5ucw/RzNyD0/YJME6IVcStalZuMWxdt3sR3huStTtxz4PUmvZfRguvDejasvQ2kifR11g==}
     engines: {node: 20 || >=22}
 
   lru-cache@5.1.1:
@@ -4795,8 +5030,8 @@ packages:
     resolution: {integrity: sha512-jumlc0BIUrS3qJGgIkWZsyfAM7NCWiBcCDhnd+3NNM5KbBmLTgHVfWBcg6W+rLUsIpzpERPsvwUP7CckAQSOoA==}
     engines: {node: '>=12'}
 
-  lucide-react@1.23.0:
-    resolution: {integrity: sha512-38BpJcD0JhFosxHApP/BYsBetLpQFRoTRzEzstM/XCc3jsAG7wqaY1lgVwxiUe3xqYE+lNxo2PkCmYwXWrwwIw==}
+  lucide-react@1.24.0:
+    resolution: {integrity: sha512-YT6mBD8lGKkg4nM39enlm94/sfJIiW0YKUT60fBy4YK8tai31ylg1VhGNWxkpSKHo9UagfnZqwIff3HTDQwXeA==}
     peerDependencies:
       react: ^16.5.1 || ^17.0.0 || ^18.0.0 || ^19.0.0
 
@@ -5116,22 +5351,17 @@ packages:
     resolution: {integrity: sha512-4kmO/MdyUIkLIvTPr8VHLil4AtoKIoniWPIEk5+CDy0xnWC84azhSFmuJ7PxZdsYtiP5kEeQsORAVIeMgxT+Hw==}
     hasBin: true
 
-  msgpackr@2.0.2:
-    resolution: {integrity: sha512-c5hYOXFbP79Slh6Dzd2wzk+jnV7mX1UxfMYtilnY1NmalXPqG8DGb5cYCMBrW4AsH3zekBBZd4QrKz9NhtvYLQ==}
+  msgpackr@2.0.4:
+    resolution: {integrity: sha512-o1C5KRmuRt+apqMr1HuGSqWStZoRBUpEsCsl15uM9VdAF1qHLtvMOU2En747EnTyEl6c4pzPewRMFF31s1CNbA==}
 
-  multipasta@0.2.7:
-    resolution: {integrity: sha512-KPA58d68KgGil15oDqXjkUBEBYc00XvbPj5/X+dyzeo/lWm9Nc25pQRlf1D+gv4OpK7NM0J1odrbu9JNNGvynA==}
+  multipasta@0.2.8:
+    resolution: {integrity: sha512-ZPWuMKyv0cSO29f7hozp+k6+crZbQijV8ipMvxNxRf2SwtYGTX1ZX89Kd20VV4H9Znonx+EQn+iy1wGQsJ+b+Q==}
 
   mz@2.7.0:
     resolution: {integrity: sha512-z81GNO7nnYMEhrGh9LeymoE4+Yr0Wn5McHIZMK5cfQCl+NDX08sCZgUc9/6MHni9IWuFLm1Z3HTCXu2z9fN62Q==}
 
-  nanoid@3.3.12:
-    resolution: {integrity: sha512-ZB9RH/39qpq5Vu6Y+NmUaFhQR6pp+M2Xt76XBnEwDaGcVAqhlvxrl3B2bKS5D3NH3QR76v3aSrKaF/Kiy7lEtQ==}
-    engines: {node: ^10 || ^12 || ^13.7 || ^14 || >=15.0.1}
-    hasBin: true
-
-  nanoid@3.3.15:
-    resolution: {integrity: sha512-y7Wygv/7mEOvxTuEQDB8StXdMRBWf1kR/tlhAzBRUFkB2jfcLOAxO/SHmOO2zgz1pVgK29/kyupn059/bCHdjA==}
+  nanoid@3.3.16:
+    resolution: {integrity: sha512-bzlKTyNJ7+LdGIIwy8ijFpIqEQIvafahV7eYykJ8Cvh42EdJeODoJ6gUJXpQJvej1BddH8OqTXZNE/KfbWAu8Q==}
     engines: {node: ^10 || ^12 || ^13.7 || ^14 || >=15.0.1}
     hasBin: true
 
@@ -5159,8 +5389,8 @@ packages:
       react: ^16.8 || ^17 || ^18 || ^19 || ^19.0.0-rc
       react-dom: ^16.8 || ^17 || ^18 || ^19 || ^19.0.0-rc
 
-  next@16.2.9:
-    resolution: {integrity: sha512-MEOJiq/UvuezAdqVSceHbqDgZt1kDw2tpGVOlsdIoJsQdbN2JY2hpVG4xnXGkbdJUOEWhnRfiu/O4Hpc9Juwww==}
+  next@16.3.0-preview.6:
+    resolution: {integrity: sha512-mNUH6FJz/oB0htRV2wBPeXXU+bT3+ZCrTtGkZe1YTRdV0qmsx3P8ajMAKfVQI/dTQ/Me9IOAVjfEHfeoFGmPtQ==}
     engines: {node: '>=20.9.0'}
     hasBin: true
     peerDependencies:
@@ -5200,8 +5430,8 @@ packages:
     resolution: {integrity: sha512-s+w+rBWnpTMwSFbaE0UXsRlg7hU4FjekKU4eyAih5T8nJuNZT1nNsskXpxmeqSK9UzkBl6UgRlnKc8hz8IEqOw==}
     hasBin: true
 
-  node-releases@2.0.46:
-    resolution: {integrity: sha512-GYVXHE2KnrzAfsAjl4uP++evGFCrAU1jta4ubEjIG7YWt/64Gqv66a30yKwWczVjA6j3bM4nBwH7Pk1JmDHaxQ==}
+  node-releases@2.0.51:
+    resolution: {integrity: sha512-wRNIrw4DmVLKQlbgOMdkMx27Wrpzes2hh5Jtbi2bjPd+4wJstWIqP5A+lscnqbm0xxmT5Bpg8Lec5ItEBwx6BQ==}
     engines: {node: '>=18'}
 
   normalize-package-data@6.0.2:
@@ -5232,8 +5462,8 @@ packages:
     resolution: {integrity: sha512-9qny7Z9DsQU8Ou39ERsPU4OZQlSTP47ShQzuKZ6PRXpYLtIFgl/DEBYEXKlvcEa+9tHVcK8CF81Y2V72qaZhWA==}
     engines: {node: '>=18'}
 
-  npm@11.17.0:
-    resolution: {integrity: sha512-PurxiZexEHDTE4SSaLI3ZrnbAGiZfeyUcQcxcP5D+hfytNAze/D1IzDuInTn9XVLIbAQUnQuSPXJx02LHjLvQw==}
+  npm@11.18.0:
+    resolution: {integrity: sha512-T67M4L5wNm0cZ7EBLErcEkY1SmzEW/WJ+SADBzsFUY1UdAPfFHXFQtZ6SEXiK0+vzXysCvAsepbMaBTwnrAD+w==}
     engines: {node: ^20.17.0 || >=22.9.0}
     hasBin: true
     bundledDependencies:
@@ -5303,8 +5533,8 @@ packages:
       - validate-npm-package-name
       - which
 
-  nx@23.0.1:
-    resolution: {integrity: sha512-HnK0Ke8FcPeVQffYm1oyzkLNn7khrI8SeDeC3iyLhw/UEMCB24hjI5JSs6Amlyeb0/GaeiuQuts8NkQKd/NpGA==}
+  nx@23.1.0:
+    resolution: {integrity: sha512-Z4hzIdRF6naDDpOTOazrJODmbU5D7slq94FR5q/dySW+evGxiOSFLO981VqDVvtNEvHPnEDh/C1wvFseWyvSrQ==}
     hasBin: true
     peerDependencies:
       '@swc-node/register': ^1.11.1
@@ -5326,8 +5556,9 @@ packages:
   obuf@1.1.2:
     resolution: {integrity: sha512-PX1wu0AmAdPqOL1mWhqmlOd8kOIZQwGZw6rh7uby9fTc5lhaOWFLX3I6R1hrF9k3zUY40e6igsLGkDXK92LJNg==}
 
-  obug@2.1.1:
-    resolution: {integrity: sha512-uTqF9MuPraAQ+IsnPf366RG4cP9RtUi7MLO1N3KEc+wb0a6yKpeL0lmk2IB1jY5KHPAlTc6T/JRdC/YqxHNwkQ==}
+  obug@2.1.3:
+    resolution: {integrity: sha512-9miFgM2OFba7hB+pRgvtV84pYTBaoTHohvmIgiRt6dRIzbwEOIaNaP+dIlGs2fNFoB0SeISs0Jz5WFVRid6Xyg==}
+    engines: {node: '>=12.20.0'}
 
   on-exit-leak-free@2.1.2:
     resolution: {integrity: sha512-0eJJY6hXLGf1udHwfNftBqH+g73EU4B504nZeKpz1sYRKafAghwxEJunB2O7rDZkL4PGfsMVnTXZ2EjibbqcsA==}
@@ -5373,8 +5604,11 @@ packages:
   oxc-resolver@11.21.3:
     resolution: {integrity: sha512-2Mx3fKQz7+xgrBONjsxOgCGtMHOn38/HxMzW1I5efwXB5a4lRN0Vp40gYUJFBWJslcrvwoofTrqoTnLbwTd3pA==}
 
-  oxfmt@0.57.0:
-    resolution: {integrity: sha512-ZB7Bi+rGDSqmVIo9jwcLyFgjxXvQhDdU+jx+ZrVy6VRiVXK2+CHc4hO3J4dUQjHe7V0ymHB+MDuv5z+NhK07HA==}
+  oxc-resolver@11.24.2:
+    resolution: {integrity: sha512-FY91FiDBj7ls5MsFS9jN3tjz2o0/zsdSsymlakySaBwVJZorHhkWyICLZMKxlu1R9vYo+sd3z1jwb4J8x7bNDw==}
+
+  oxfmt@0.58.0:
+    resolution: {integrity: sha512-8feG/7NVEHDVwc1OUpP6Pks+TnaDFUw2jLLFIMi5bcmmwxAX2wBQvjSzj62RRTYBf2Op1Wt8xbkmagmPTR5ETg==}
     engines: {node: ^20.19.0 || >=22.12.0}
     hasBin: true
     peerDependencies:
@@ -5386,12 +5620,12 @@ packages:
       vite-plus:
         optional: true
 
-  oxlint-tsgolint@0.23.0:
-    resolution: {integrity: sha512-3mBv3CoPbh8dFbzfDGIWa2ytZjn2v+3EX4aKRXjIhsoGFzG8GCjfRirz3rwZf1wYbZzsNLTSgpw8VjQuWdp/jA==}
+  oxlint-tsgolint@0.24.0:
+    resolution: {integrity: sha512-giCk5sEvG02d5tzPmFMX3hem8ndzEEu1xvGYS5OwNfO2WGl6ZVxt5LjE0yiMDoz94INI7XkXwgFAQiydPvVHDw==}
     hasBin: true
 
-  oxlint@1.73.0:
-    resolution: {integrity: sha512-u91G9TJzU6yqKWNZUYprQB07W7YvntZXaRxQ6CkoytepYhLWUXWsr1M8zUJ34VatNPuUAr3Z8GH+O2A331CluQ==}
+  oxlint@1.74.0:
+    resolution: {integrity: sha512-odGl2s2x5IOJoj3A0v1k0PGBXVFBZeZ2+AK/+K2MJur7Ghi3bkyX5NuLUWHKqa4js1wjep3hJeuTQJOlr+4+dA==}
     engines: {node: ^20.19.0 || >=22.12.0}
     hasBin: true
     peerDependencies:
@@ -5427,8 +5661,8 @@ packages:
     resolution: {integrity: sha512-nQja7m7gSKuewoVRen45CtVfODR3crN3goVQ0DDZ9N3yHxgpkuBhZqsaiotSQRrADUrne346peY7kT3TSACykg==}
     engines: {node: '>=4'}
 
-  p-map@7.0.4:
-    resolution: {integrity: sha512-tkAQEw8ysMzmkhgw8k+1U/iPhWNhykKnSk4Rd5zLoPJCuJaGRPo6YposrZgaxHKzDHdDWWZvE/Sk7hsL2X/CpQ==}
+  p-map@7.0.5:
+    resolution: {integrity: sha512-e8vJF4XdVkzqqSHguEMz41mQO1wKwxKm5ENrUJQUu9kLDCtn83cxbyHZcszr4QC5zEA7WffRRC4gsTecC7J9oA==}
     engines: {node: '>=18'}
 
   p-reduce@3.0.0:
@@ -5523,17 +5757,14 @@ packages:
   pg-cloudflare@1.4.0:
     resolution: {integrity: sha512-Vo7z/6rrQYxpNRylp4Tlob2elzbh+N/MOQbxFVWCxS7oEx6jF53GTJFxK2WWpKuBRkmiin4Mt+xofFDjx09R0A==}
 
-  pg-connection-string@2.12.0:
-    resolution: {integrity: sha512-U7qg+bpswf3Cs5xLzRqbXbQl85ng0mfSV/J0nnA31MCLgvEaAo7CIhmeyrmJpOr7o+zm0rXK+hNnT5l9RHkCkQ==}
-
   pg-connection-string@2.14.0:
     resolution: {integrity: sha512-XwWDGcLRGCXAR8F/AM5bG7Q+A3Wm2s6QeEjlOKZLlH3UYcguiqCWKyWXVag5TLTIjR7oOJUY8kcADaZgWPyLeg==}
 
   pg-copy-streams@7.0.0:
     resolution: {integrity: sha512-zBvnY6wtaBRE2ae2xXWOOGMaNVPkXh1vhypAkNSKgMdciJeTyIQAHZaEeRAxUjs/p1El5jgzYmwG5u871Zj3dQ==}
 
-  pg-cursor@2.20.0:
-    resolution: {integrity: sha512-HP/EbUafheaUOs7DxlG6tda/rhmsX2hCTJJJ+gCnhljGyNEs6pBHddbNuomlW3DqEhP3zYD+GqBWkYnJPIZ4tA==}
+  pg-cursor@2.21.0:
+    resolution: {integrity: sha512-IYvk/j+Suhtbo/C3uOf4JLsLK/gWxOTUOmYbDsbKnLaVJDq+KwhwK6ngpRfiCk8eDMS3AmGQABZCv0cREEzHQw==}
     peerDependencies:
       pg: ^8
 
@@ -5550,9 +5781,6 @@ packages:
     peerDependencies:
       pg: '>=8.0'
 
-  pg-protocol@1.14.0:
-    resolution: {integrity: sha512-n5taZ1kO3s9ngDTVxsEznOqCyToTgz0FLuPq0B33COy5pPpuWJpY3/2oRBVETuOgzdqRXfWpM9HIhp2LBBT1BA==}
-
   pg-protocol@1.15.0:
     resolution: {integrity: sha512-cq9sECI5s0+uPUXjbz8ioyPJni6RzsRib0US67i5IoTZKw8fNeYlVE7u8F4dG7vEJJtc5wdD1K189lCCUwqWTQ==}
 
@@ -5583,10 +5811,6 @@ packages:
     resolution: {integrity: sha512-V7+vQEJ06Z+c5tSye8S+nHUfI51xoXIXjHQ99cQtKUkQqqO1kO/KCJUfZXuB47h/YBlDhah2H3hdUGXn8ie0oA==}
     engines: {node: '>=8.6'}
 
-  picomatch@4.0.4:
-    resolution: {integrity: sha512-QP88BAKvMam/3NxH6vj2o21R6MjxZUAd6nlwAS/pnGvN9IVLocLHxGYIzFhg6fUQ+5th6P4dv4eW9jX3DSIj7A==}
-    engines: {node: '>=12'}
-
   picomatch@4.0.5:
     resolution: {integrity: sha512-RvwwcruNjI1ncT5xRakeyS9Lf8lcItv34KD+aif+VH9kduAyfYBipGh12274xtenIPZ119/R9BdTBa8gAwSh0A==}
     engines: {node: '>=12'}
@@ -5624,12 +5848,12 @@ packages:
     resolution: {integrity: sha512-u9mdErTewKSMsr+ceCt8VcNuNP0ro5AXiPXhUVApuEyqr2Zlvt+DdCFBcm+yGWN8mhOdZJ27meIDbnoZgfzpOw==}
     hasBin: true
 
-  postcss@8.4.31:
-    resolution: {integrity: sha512-PS08Iboia9mts/2ygV3eLpY5ghnUcfLV/EXTOW1E2qYxJKGGBUtNjN76FYHnMs36RmARn41bC0AZmn+rR0OVpQ==}
+  postcss@8.5.10:
+    resolution: {integrity: sha512-pMMHxBOZKFU6HgAZ4eyGnwXF/EvPGGqUr0MnZ5+99485wwW41kW91A4LOGxSHhgugZmSChL5AlElNdwlNgcnLQ==}
     engines: {node: ^10 || ^12 || >=14}
 
-  postcss@8.5.16:
-    resolution: {integrity: sha512-vuwillviilfKZsg0VGj5R/YwwcHx4SLsIOI/7K6mQkWx+l5cUHTjj5g0AasTBcyXsbfTgrwsUNmVUb5xVwyPwg==}
+  postcss@8.5.19:
+    resolution: {integrity: sha512-Mz8SaolMd8nB+G13WkORcxQKHZ/NE4xXevtkJHVuG+guo9/wYKlIMTKAqGdEmYOXR2ijPjTYNHssizdaVSUNdQ==}
     engines: {node: ^10 || ^12 || >=14}
 
   postgres-array@2.0.0:
@@ -5667,8 +5891,8 @@ packages:
   postgres-range@1.1.4:
     resolution: {integrity: sha512-i/hbxIE9803Alj/6ytL7UHQxRvZkI9O4Sy+J3HGc4F4oo/2eQAjTSNJ0bfxyse3bH0nuVesCk+3IRLaMtG3H6w==}
 
-  posthog-node@5.38.8:
-    resolution: {integrity: sha512-AWsp9Tigf4iZepabPErAt/2sLTGwJ7w6631JP+3ifDqWzaBPyzcukD7cTPeoNDKGwJreQ69Ju4l53n9g2+X6nQ==}
+  posthog-node@5.41.0:
+    resolution: {integrity: sha512-jOkX6THOr5WD+FGUEaTxekas8c7NOC3TqJ2Byfe2KMimQdL/F/osz17uSbkNzR4V9WFZoe8YaGP3Xp0EUpPKGg==}
     engines: {node: ^20.20.0 || >=22.22.0}
     peerDependencies:
       rxjs: ^7.0.0
@@ -5725,8 +5949,8 @@ packages:
   pumpify@1.5.1:
     resolution: {integrity: sha512-oClZI37HvuUJJxSKKrC17bZ9Cu0ZYhEAGPsPUy9KlMUmv9dKX2o77RUmq7f3XjIxbwyGwYzbzQ1L2Ks8sIradQ==}
 
-  pure-rand@8.4.0:
-    resolution: {integrity: sha512-IoM8YF/jY0hiugFo/wOWqfmarlE6J0wc6fDK1PhftMk7MGhVZl88sZimmqBBFomLOCSmcCCpsfj7wXASCpvK9A==}
+  pure-rand@8.4.2:
+    resolution: {integrity: sha512-vvuOGgcuPJAirlHvuQw1TrOiw7ptaIXXmIbNuiNOY6lNGJJH49PQ1Kj4nd783nPdQhQdicgOjVI2yI/9BD6/Ng==}
 
   qs@6.14.2:
     resolution: {integrity: sha512-V/yCWTTF7VJ9hIh18Ugr2zhJMP01MY7c5kh4J870L7imm6/DIzBsNLTXzMwUA3yZ5b/KBqLx8Kp3uRvd7xSe3Q==}
@@ -5750,6 +5974,10 @@ packages:
     resolution: {integrity: sha512-Hrgsx+orqoygnmhFbKaHE6c296J+HTAQXoxEF6gNupROmmGJRoyzfG3ccAveqCBrwr/2yxQ5BVd/GTl5agOwSg==}
     engines: {node: '>= 0.6'}
 
+  range-parser@1.3.0:
+    resolution: {integrity: sha512-hek2mFQpPuI4E1BBKrSto+BU3e3x4xuarsbiwr3+lf7p44juvFMV0XFWQAP3xUyqXA4RrXLIoaSUGbSt056ZMw==}
+    engines: {node: '>= 0.6'}
+
   raw-body@2.5.3:
     resolution: {integrity: sha512-s4VSOf6yN0rvbRZGxs8Om5CWj6seneMwK3oDb4lWDH0UPhWcxwOWw5+qk24bxq87szX1ydrwylIOp2uG1ojUpA==}
     engines: {node: '>= 0.8'}
@@ -5945,8 +6173,8 @@ packages:
     resolution: {integrity: sha512-g6QUff04oZpHs0eG5p83rFLhHeV00ug/Yf9nZM6fLeUrPguBTkTQOdpAWWspMh55TZfVQDPaN3NQJfbVRAxdIw==}
     engines: {iojs: '>=1.0.0', node: '>=0.10.0'}
 
-  rolldown@1.0.2:
-    resolution: {integrity: sha512-oZx5zVDtVB44AW3eaifgDml1gWRDZGvjcfdxonE4swNPG98PrrXjaO/KrnUjzlMnztCCRVlUueA1kCXhARGk6g==}
+  rolldown@1.1.5:
+    resolution: {integrity: sha512-t9z29cJjXf/vxQ8dyhCSpt6H6aSwHTk8cT5I3iy6SMXuFpk5mB6PL6XfC8PCwrPTx93udwKUm9HRteAlTGBLiA==}
     engines: {node: ^20.19.0 || >=22.12.0}
     hasBin: true
 
@@ -5979,8 +6207,8 @@ packages:
   scroll-into-view-if-needed@3.1.0:
     resolution: {integrity: sha512-49oNpRjWRvnU8NyGVmUaYG4jtTkNonFZI86MmGRDqBphEK2EXT9gdEUoQPZhuBM8yWHxCWbobltqYO5M4XrUvQ==}
 
-  semantic-release@25.0.5:
-    resolution: {integrity: sha512-mn61SUJwtM8ThrWn2WmgLVpwVJeG/hPSupua1psdMoufmwRIPyvRLkRkL0JDXkP67OntlLWUYnBnfVc8EDO3/g==}
+  semantic-release@25.0.7:
+    resolution: {integrity: sha512-fFiUD7LNFI0TOGkc49WDHUX4GYKrOMDKct5ReSB1EJCZiPsPdbIPIJGys1xb2ILpK1v9JMsRkjJQgTRpbr7DgQ==}
     engines: {node: ^22.14.0 || >= 24.10.0}
     hasBin: true
 
@@ -5997,11 +6225,6 @@ packages:
     engines: {node: '>=10'}
     hasBin: true
 
-  semver@7.8.2:
-    resolution: {integrity: sha512-c8jsqUZm3omBOI66G90z1Dyw5z622G8oLG+omfsHBJf3CWQTlOcwOjvOG6wtiNfW6anKm/eA39LMwMtMez2TiQ==}
-    engines: {node: '>=10'}
-    hasBin: true
-
   semver@7.8.4:
     resolution: {integrity: sha512-rUCObTnP32Q08R2uuIrt7r9PlEonuTmtuXYcW6s5kjdlj3xbnwe+21yXptAUYcMAABLkYYTtnmzb3w3EDZfueA==}
     engines: {node: '>=10'}
@@ -6043,8 +6266,8 @@ packages:
     resolution: {integrity: sha512-7++dFhtcx3353uBaq8DDR4NuxBetBzC7ZQOhmTQInHEd6bSrXdiEyzCvG07Z44UYdLShWUyXt5M/yhz8ekcb1A==}
     engines: {node: '>=8'}
 
-  shell-quote@1.8.4:
-    resolution: {integrity: sha512-VsC6n6vz1ihYYyZZwX7YZSF5l5x36ca17OC+a69h94YqB7X6XLwf+5MOgynYir2SLFUbl8gIYvBo8K8RoNQ6bQ==}
+  shell-quote@1.10.0:
+    resolution: {integrity: sha512-w1aiOKwKuRgtwAReIIj89puqg+I7GvX4IbLrvmhXbzQsj1+Zwi4VO3+fa6ZF91TWSjIxoEkKnMeHcLEODK5ZXA==}
     engines: {node: '>= 0.4'}
 
   shiki@4.3.1:
@@ -6172,8 +6395,8 @@ packages:
     resolution: {integrity: sha512-DvEy55V3DB7uknRo+4iOGT5fP1slR8wQohVdknigZPMpMstaKJQWhwiYBACJE3Ul2pTnATihhBYnRhZQHGBiRw==}
     engines: {node: '>= 0.8'}
 
-  std-env@4.1.0:
-    resolution: {integrity: sha512-Rq7ybcX2RuC55r9oaPVEW7/xu3tj8u4GeBYHBWCychFtzMIr86A7e3PPEBPT37sHStKX3+TiX/Fr/ACmJLVlLQ==}
+  std-env@4.2.0:
+    resolution: {integrity: sha512-oCUKSupKTHX53EyjDtuZQ64pjLJ6yYCtpmEw0goYxtjG9KpbRe8KAsl2tBUGU9DyMcJ0RwJ8GqJAFzMXcXW1Rw==}
 
   steno@0.4.4:
     resolution: {integrity: sha512-EEHMVYHNXFHfGtgjNITnka0aHhiAlo93F7z2/Pwd+g0teG9CnM3JIINM7hVVB5/rhw9voufD7Wukwgtw2uqh6w==}
@@ -6195,8 +6418,8 @@ packages:
     resolution: {integrity: sha512-tsaTIkKW9b4N+AEj+SVA+WhJzV7/zMhcSu78mLKWSk7cXMOSHsBKFWUs0fWwq8QyK3MgJBQRX6Gbi4kYbdvGkQ==}
     engines: {node: '>=18'}
 
-  string-width@8.2.1:
-    resolution: {integrity: sha512-IIaP0g3iy9Cyy18w3M9YcaDudujEAVHKt3a3QJg1+sr/oX96TbaGUubG0hJyCjCBThFH+tFpcIyoUHUn1ogaLA==}
+  string-width@8.2.2:
+    resolution: {integrity: sha512-GaPUh5gfdrYzqeVNZvUfT23vYYxXzKYidUcnMtJg/3rxRV63EFZy3k6xfKlmfeJD0176lnUV/Usr3XcwSvFzpg==}
     engines: {node: '>=20'}
 
   string_decoder@1.1.1:
@@ -6339,15 +6562,15 @@ packages:
   tldts-core@6.1.86:
     resolution: {integrity: sha512-Je6p7pkk+KMzMv2XXKmAE3McmolOQFdxkKw0R8EYNr7sELW46JqnNeTX8ybPiQgvg1ymCoF8LXs5fzFaZvJPTA==}
 
-  tldts-core@7.4.5:
-    resolution: {integrity: sha512-pGrwzZDvPwKe+7NNUqAunb6rqTfynr0VOUhCMdqbu5xlvNiszsAJygRzwvpVycdzejlbpY+SWJOn+s75Og7FEA==}
+  tldts-core@7.4.8:
+    resolution: {integrity: sha512-c1P7u0EhACHj7lPy4MJm8iTFEU8+nB0LCtddH0fhP7noaVoXAqafMtOOeX+ulpuPBqnrRgRhw494RICT3mbhnw==}
 
   tldts@6.1.86:
     resolution: {integrity: sha512-WMi/OQ2axVTf/ykqCQgXiIct+mSQDFdH2fkwhPwgEwvJ1kSzZRiinb0zF2Xb8u4+OqPChmyI6MEu4EezNJz+FQ==}
     hasBin: true
 
-  tldts@7.4.5:
-    resolution: {integrity: sha512-RfEzKWcq5fHUOFq7J3rl3Oz6ylKGtcHqUznzj4EcXsxLSIjJcvpbXAQtWGeJQ0xKnimR5e0Cn+cn9TssfMzm+g==}
+  tldts@7.4.8:
+    resolution: {integrity: sha512-htwgN/8KRB3z3vnC0BOETVh2m499g5GmyTK9Wq5JBLX3FNz6tSBveAd+fQhzy9hkjif8vy2jwDMR1sGhLtZl2A==}
     hasBin: true
 
   tmp@0.2.7:
@@ -6362,8 +6585,8 @@ packages:
     resolution: {integrity: sha512-o5sSPKEkg/DIQNmH43V0/uerLrpzVedkUh8tGNvaeXpfpuwjKenlSox/2O/BTlZUtEe+JG7s5YhEz608PlAHRA==}
     engines: {node: '>=0.6'}
 
-  toml@4.1.1:
-    resolution: {integrity: sha512-EBJnVBr3dTXdA89WVFoAIPUqkBjxPMwRqsfuo1r240tKFHXv3zgca4+NJib/h6TyvGF7vOawz0jGuryJCdNHrw==}
+  toml@4.3.0:
+    resolution: {integrity: sha512-lVb8X9BsPVuH0M4BKeS91tXAmJvCjQ5UIyAbQFaxkKGyUFK2RPkhwaFSQH8vbpl1d23eu/IBH+dwVMHWaq9A5A==}
     engines: {node: '>=20'}
 
   tough-cookie@5.1.2:
@@ -6421,8 +6644,8 @@ packages:
     resolution: {integrity: sha512-TeTSQ6H5YHvpqVwBRcnLDCBnDOHWYu7IvGbHT6N8AOymcr9PJGjc1GTtiWZTYg0NCgYwvnYWEkVChQAr9bjfwA==}
     engines: {node: '>=16'}
 
-  type-fest@5.7.0:
-    resolution: {integrity: sha512-1URUxUqfHFM1c+zfSPsa3gnkO7Aq21qyH75SIduNYz4SzY964rn1X2vCMQaHSHhktiw+0kPa2iyb6PUpXqB6Vg==}
+  type-fest@5.8.0:
+    resolution: {integrity: sha512-YGYEVz3Fm5iy/AybuA0oyNFq7H4CgQNfRp/qfe8nurE1kuCeNm3/vfm9X4Mtl+qLyaKJUh5xrFZwogr41SMjYA==}
     engines: {node: '>=20'}
 
   type-is@1.6.18:
@@ -6438,6 +6661,11 @@ packages:
     engines: {node: '>=14.17'}
     hasBin: true
 
+  typescript@7.0.2:
+    resolution: {integrity: sha512-8FYau96o3NKOhbjKi/qNvG/W5jhzxkbdm5sj9AbZ/5T5sWqn3hJgLfGx27sRKZWTvyzCP8dLRBTf5tBTSRVUNA==}
+    engines: {node: '>=16.20.0'}
+    hasBin: true
+
   uglify-js@3.19.3:
     resolution: {integrity: sha512-v3Xu+yuwBXisp6QYTcH4UbH+xYJXqnq2m/LtQVWKWzYc1iehYnLixoQDN9FH6/j9/oybfd6W9Ghwkl8+UMKTKQ==}
     engines: {node: '>=0.8.0'}
@@ -6447,9 +6675,6 @@ packages:
     resolution: {integrity: sha512-8gwNZ29+0/3zmXw7ToIHZtg6wK37xnniRUdBt7B27xZxaxfgR5tGMaGHT0t0dLtBV9fXE7zurh0s6Z1DHVjfWg==}
     engines: {node: '>=14'}
 
-  undici-types@7.24.6:
-    resolution: {integrity: sha512-WRNW+sJgj5OBN4/0JpHFqtqzhpbnV0GuB+OozA9gCL7a993SmU+1JBZCzLNxYsbMfIeDL+lTsphD5jN5N+n0zg==}
-
   undici-types@8.3.0:
     resolution: {integrity: sha512-j375ScV60dom+YkPFIfTLcOiPxkN/buHz5GobjLhixFuANaNs3C9l4GmrWqejgXWJ7BbJcFYpTEUkS1Ge8bpZQ==}
 
@@ -6461,8 +6686,8 @@ packages:
     resolution: {integrity: sha512-cRZYrTDwWznlnRiPjggAGxZXanty6M8RV1ff8Wm4LWXBp7/IG8v5DnOm74DtUBp9OONpK75YlPnIjQqX0dBDtA==}
     engines: {node: '>=20.18.1'}
 
-  undici@8.5.0:
-    resolution: {integrity: sha512-xamtWoB1EshgjpmlXd7GGm2VfdDtw1+rD8uhry8pSNW3If6S8E0m2T2+orSKeZXEn/aPJMviCpDBA65WJt8zhg==}
+  undici@8.7.0:
+    resolution: {integrity: sha512-N7iQtfyLhIMOFgQubvmLV26svHpO0bqKnAiWotTQCVKCmWrcGbBotPuW1x+xwYZ2VHdSTVUfPQQnlEt1/LouTQ==}
     engines: {node: '>=22.19.0'}
 
   unicode-emoji-modifier-base@1.0.0:
@@ -6563,8 +6788,8 @@ packages:
     resolution: {integrity: sha512-pMZTvIkT1d+TFGvDOqodOclx0QWkkgi6Tdoa8gC8ffGAAqz9pzPTZWAybbsHHoED/ztMtkv/VoYTYyShUn81hA==}
     engines: {node: '>= 0.4.0'}
 
-  uuid@14.0.0:
-    resolution: {integrity: sha512-Qo+uWgilfSmAhXCMav1uYFynlQO7fMFiMVZsQqZRMIXp0O7rR7qjkj+cPvBHLgBqi960QCoo/PH2/6ZtVqKvrg==}
+  uuid@14.0.1:
+    resolution: {integrity: sha512-6ZxzVpzDXDa3bJWaHilVayA+BH/1zmxCJoVgvmqJnid/gPoKHxUrS/aC/T6LGQtNHT+XHG9fXPJB4d+IrU30Ew==}
     hasBin: true
 
   uuid@8.3.2:
@@ -6591,8 +6816,8 @@ packages:
     resolution: {integrity: sha512-xh0VO4zRfcbIR2bpH2SwW4kLHzCEKFYg9lykpuEENJ9OIcoc12mGXH5DTuOuJ9po8Y0mGTzFh3JUZIwXJlmOSw==}
     engines: {node: '>=18'}
 
-  verdaccio@6.7.4:
-    resolution: {integrity: sha512-C59DdKYtc1vayM3HiRFVRCRJMd4Hq4QCQnjTMM6CVanJvMpaqHlZ+DHE31/L8ScXkzUl1oS0HulizpxmMXW1LA==}
+  verdaccio@6.8.0:
+    resolution: {integrity: sha512-fGKQZnFQVuLiRYbTDnyOaQDtAs+SgnoK2gQSztM3MIMXMa5MfiRQ+Ub/+8OMFygoroZU21d05d+JJJr4f2TnEQ==}
     engines: {node: '>=20'}
     hasBin: true
 
@@ -6609,13 +6834,13 @@ packages:
   vfile@6.0.3:
     resolution: {integrity: sha512-KzIbH/9tXat2u30jf+smMwFCsno4wHVdNmzFyL+T/L3UGqqk6JKfVqOFOZEpZSHADH1k40ab6NUIXZq422ov3Q==}
 
-  vite@8.0.14:
-    resolution: {integrity: sha512-s4BJJ+5y1pYL6Otw51FHhVJQhPnuRinKig64g/1+EUNaJsd3gCKdD31IPFvswUgW9/60QT9oFHbZHbQK5imcxw==}
+  vite@8.1.4:
+    resolution: {integrity: sha512-bTT9PsdWO+MQMNG9ZXIP/qM9wGh37DFxTV/sPq9cFpHr3w4jkgef032PkAL9jAqhk3Nz8NQw3O8n6/xFkqO4QQ==}
     engines: {node: ^20.19.0 || >=22.12.0}
     hasBin: true
     peerDependencies:
       '@types/node': ^20.19.0 || >=22.12.0
-      '@vitejs/devtools': ^0.1.18
+      '@vitejs/devtools': ^0.3.0
       esbuild: ^0.27.0 || ^0.28.0
       jiti: '>=1.21.0'
       less: ^4.0.0
@@ -6652,20 +6877,20 @@ packages:
       yaml:
         optional: true
 
-  vitest@4.1.9:
-    resolution: {integrity: sha512-nE3/LEyc0z87uHYLZebqCUOaJr2hdtuPp7BQ4BosVFnfltxgAvMG08NyrSGlPpOUWvR27c5flSmYFTNr78L9GQ==}
+  vitest@4.1.10:
+    resolution: {integrity: sha512-R9jUTe5S4Qb0HCd4TNqpC7oGcrMssMRGXLW80ubjWsW9VH5GF8y1Y0SFLY9AbqSk6nt0PnOx4H4WNJYZ13GUPw==}
     engines: {node: ^20.0.0 || ^22.0.0 || >=24.0.0}
     hasBin: true
     peerDependencies:
       '@edge-runtime/vm': '*'
       '@opentelemetry/api': ^1.9.0
       '@types/node': ^20.0.0 || ^22.0.0 || >=24.0.0
-      '@vitest/browser-playwright': 4.1.9
-      '@vitest/browser-preview': 4.1.9
-      '@vitest/browser-webdriverio': 4.1.9
-      '@vitest/coverage-istanbul': 4.1.9
-      '@vitest/coverage-v8': 4.1.9
-      '@vitest/ui': 4.1.9
+      '@vitest/browser-playwright': 4.1.10
+      '@vitest/browser-preview': 4.1.10
+      '@vitest/browser-webdriverio': 4.1.10
+      '@vitest/coverage-istanbul': 4.1.10
+      '@vitest/coverage-v8': 4.1.10
+      '@vitest/ui': 4.1.10
       happy-dom: '*'
       jsdom: '*'
       vite: ^6.0.0 || ^7.0.0 || ^8.0.0
@@ -6854,46 +7079,46 @@ snapshots:
       ansi-styles: 6.2.3
       is-fullwidth-code-point: 5.1.0
 
-  '@anthropic-ai/claude-agent-sdk-darwin-arm64@0.3.196':
+  '@anthropic-ai/claude-agent-sdk-darwin-arm64@0.3.209':
     optional: true
 
-  '@anthropic-ai/claude-agent-sdk-darwin-x64@0.3.196':
+  '@anthropic-ai/claude-agent-sdk-darwin-x64@0.3.209':
     optional: true
 
-  '@anthropic-ai/claude-agent-sdk-linux-arm64-musl@0.3.196':
+  '@anthropic-ai/claude-agent-sdk-linux-arm64-musl@0.3.209':
     optional: true
 
-  '@anthropic-ai/claude-agent-sdk-linux-arm64@0.3.196':
+  '@anthropic-ai/claude-agent-sdk-linux-arm64@0.3.209':
     optional: true
 
-  '@anthropic-ai/claude-agent-sdk-linux-x64-musl@0.3.196':
+  '@anthropic-ai/claude-agent-sdk-linux-x64-musl@0.3.209':
     optional: true
 
-  '@anthropic-ai/claude-agent-sdk-linux-x64@0.3.196':
+  '@anthropic-ai/claude-agent-sdk-linux-x64@0.3.209':
     optional: true
 
-  '@anthropic-ai/claude-agent-sdk-win32-arm64@0.3.196':
+  '@anthropic-ai/claude-agent-sdk-win32-arm64@0.3.209':
     optional: true
 
-  '@anthropic-ai/claude-agent-sdk-win32-x64@0.3.196':
+  '@anthropic-ai/claude-agent-sdk-win32-x64@0.3.209':
     optional: true
 
-  '@anthropic-ai/claude-agent-sdk@0.3.196(@anthropic-ai/sdk@0.107.0(zod@4.4.3))(@modelcontextprotocol/sdk@1.29.0(zod@4.4.3))(zod@4.4.3)':
+  '@anthropic-ai/claude-agent-sdk@0.3.209(@anthropic-ai/sdk@0.111.0(zod@4.4.3))(@modelcontextprotocol/sdk@1.29.0(zod@4.4.3))(zod@4.4.3)':
     dependencies:
-      '@anthropic-ai/sdk': 0.107.0(zod@4.4.3)
+      '@anthropic-ai/sdk': 0.111.0(zod@4.4.3)
       '@modelcontextprotocol/sdk': 1.29.0(zod@4.4.3)
       zod: 4.4.3
     optionalDependencies:
-      '@anthropic-ai/claude-agent-sdk-darwin-arm64': 0.3.196
-      '@anthropic-ai/claude-agent-sdk-darwin-x64': 0.3.196
-      '@anthropic-ai/claude-agent-sdk-linux-arm64': 0.3.196
-      '@anthropic-ai/claude-agent-sdk-linux-arm64-musl': 0.3.196
-      '@anthropic-ai/claude-agent-sdk-linux-x64': 0.3.196
-      '@anthropic-ai/claude-agent-sdk-linux-x64-musl': 0.3.196
-      '@anthropic-ai/claude-agent-sdk-win32-arm64': 0.3.196
-      '@anthropic-ai/claude-agent-sdk-win32-x64': 0.3.196
+      '@anthropic-ai/claude-agent-sdk-darwin-arm64': 0.3.209
+      '@anthropic-ai/claude-agent-sdk-darwin-x64': 0.3.209
+      '@anthropic-ai/claude-agent-sdk-linux-arm64': 0.3.209
+      '@anthropic-ai/claude-agent-sdk-linux-arm64-musl': 0.3.209
+      '@anthropic-ai/claude-agent-sdk-linux-x64': 0.3.209
+      '@anthropic-ai/claude-agent-sdk-linux-x64-musl': 0.3.209
+      '@anthropic-ai/claude-agent-sdk-win32-arm64': 0.3.209
+      '@anthropic-ai/claude-agent-sdk-win32-x64': 0.3.209
 
-  '@anthropic-ai/sdk@0.107.0(zod@4.4.3)':
+  '@anthropic-ai/sdk@0.111.0(zod@4.4.3)':
     dependencies:
       json-schema-to-ts: 3.1.1
       standardwebhooks: 1.0.0
@@ -6921,7 +7146,7 @@ snapshots:
       '@babel/types': 7.29.7
       '@jridgewell/remapping': 2.3.5
       convert-source-map: 2.0.0
-      debug: 4.4.3
+      debug: 4.4.3(supports-color@7.2.0)
       gensync: 1.0.0-beta.2
       json5: 2.2.3
       semver: 6.3.1
@@ -6940,7 +7165,7 @@ snapshots:
     dependencies:
       '@babel/compat-data': 7.29.7
       '@babel/helper-validator-option': 7.29.7
-      browserslist: 4.28.2
+      browserslist: 4.28.6
       lru-cache: 5.1.1
       semver: 6.3.1
 
@@ -6993,7 +7218,7 @@ snapshots:
       '@babel/parser': 7.29.7
       '@babel/template': 7.29.7
       '@babel/types': 7.29.7
-      debug: 4.4.3
+      debug: 4.4.3(supports-color@7.2.0)
     transitivePeerDependencies:
       - supports-color
 
@@ -7002,14 +7227,14 @@ snapshots:
       '@babel/helper-string-parser': 7.29.7
       '@babel/helper-validator-identifier': 7.29.7
 
-  '@clack/core@1.4.2':
+  '@clack/core@1.4.3':
     dependencies:
       fast-wrap-ansi: 0.2.2
       sisteransi: 1.0.5
 
-  '@clack/prompts@1.6.0':
+  '@clack/prompts@1.7.0':
     dependencies:
-      '@clack/core': 1.4.2
+      '@clack/core': 1.4.3
       fast-string-width: 3.0.2
       fast-wrap-ansi: 0.2.2
       sisteransi: 1.0.5
@@ -7042,91 +7267,93 @@ snapshots:
     dependencies:
       '@noble/ciphers': 1.3.0
 
-  '@effect/atom-react@4.0.0-beta.93(effect@4.0.0-beta.93)(react@19.2.7)(scheduler@0.27.0)':
+  '@effect/atom-react@4.0.0-beta.97(effect@4.0.0-beta.97)(react@19.2.7)(scheduler@0.27.0)':
     dependencies:
-      effect: 4.0.0-beta.93
+      effect: 4.0.0-beta.97
       react: 19.2.7
       scheduler: 0.27.0
 
-  '@effect/platform-bun@4.0.0-beta.93(effect@4.0.0-beta.93)':
+  '@effect/platform-bun@4.0.0-beta.97(effect@4.0.0-beta.97)':
     dependencies:
-      '@effect/platform-node-shared': 4.0.0-beta.93(effect@4.0.0-beta.93)
-      effect: 4.0.0-beta.93
+      '@effect/platform-node-shared': 4.0.0-beta.97(effect@4.0.0-beta.97)
+      effect: 4.0.0-beta.97
     transitivePeerDependencies:
       - bufferutil
       - utf-8-validate
 
-  '@effect/platform-node-shared@4.0.0-beta.93(effect@4.0.0-beta.93)':
+  '@effect/platform-node-shared@4.0.0-beta.97(effect@4.0.0-beta.97)':
     dependencies:
       '@types/ws': 8.18.1
-      effect: 4.0.0-beta.93
+      effect: 4.0.0-beta.97
       ws: 8.21.0
     transitivePeerDependencies:
       - bufferutil
       - utf-8-validate
 
-  '@effect/platform-node@4.0.0-beta.93(effect@4.0.0-beta.93)(ioredis@5.11.0)':
+  '@effect/platform-node@4.0.0-beta.97(effect@4.0.0-beta.97)(ioredis@5.11.1)':
     dependencies:
-      '@effect/platform-node-shared': 4.0.0-beta.93(effect@4.0.0-beta.93)
-      effect: 4.0.0-beta.93
-      ioredis: 5.11.0
+      '@effect/platform-node-shared': 4.0.0-beta.97(effect@4.0.0-beta.97)
+      effect: 4.0.0-beta.97
+      ioredis: 5.11.1
       mime: 4.1.0
-      undici: 8.5.0
+      undici: 8.7.0
     transitivePeerDependencies:
       - bufferutil
       - utf-8-validate
 
-  '@effect/sql-pg@4.0.0-beta.93(effect@4.0.0-beta.93)':
+  '@effect/sql-pg@4.0.0-beta.97(effect@4.0.0-beta.97)':
     dependencies:
-      effect: 4.0.0-beta.93
+      effect: 4.0.0-beta.97
       pg: 8.22.0
-      pg-connection-string: 2.12.0
-      pg-cursor: 2.20.0(pg@8.22.0)
+      pg-connection-string: 2.14.0
+      pg-cursor: 2.21.0(pg@8.22.0)
       pg-pool: 3.14.0(pg@8.22.0)
       pg-types: 4.1.0
     transitivePeerDependencies:
       - pg-native
 
-  '@effect/vitest@4.0.0-beta.93(effect@4.0.0-beta.93)(vitest@4.1.9)':
+  '@effect/vitest@4.0.0-beta.97(effect@4.0.0-beta.97)(vitest@4.1.10)':
     dependencies:
-      effect: 4.0.0-beta.93
-      vitest: 4.1.9(@types/node@26.0.1)(@vitest/coverage-istanbul@4.1.9)(vite@8.0.14(@types/node@26.0.1)(esbuild@0.28.1)(jiti@2.7.0)(yaml@2.9.0))
+      effect: 4.0.0-beta.97
+      vitest: 4.1.10(@types/node@26.1.1)(@vitest/coverage-istanbul@4.1.10)(vite@8.1.4(@types/node@26.1.1)(esbuild@0.28.1)(jiti@2.7.0)(yaml@2.9.0))
 
-  '@emnapi/core@1.10.0':
+  '@emnapi/core@1.11.0':
     dependencies:
-      '@emnapi/wasi-threads': 1.2.1
+      '@emnapi/wasi-threads': 1.2.2
       tslib: 2.8.1
     optional: true
 
-  '@emnapi/core@1.11.0':
+  '@emnapi/core@1.11.1':
     dependencies:
       '@emnapi/wasi-threads': 1.2.2
       tslib: 2.8.1
     optional: true
 
-  '@emnapi/core@1.11.1':
+  '@emnapi/core@1.11.2':
     dependencies:
       '@emnapi/wasi-threads': 1.2.2
       tslib: 2.8.1
+    optional: true
 
   '@emnapi/core@1.4.5':
     dependencies:
       '@emnapi/wasi-threads': 1.0.4
       tslib: 2.8.1
 
-  '@emnapi/runtime@1.10.0':
+  '@emnapi/runtime@1.11.0':
     dependencies:
       tslib: 2.8.1
     optional: true
 
-  '@emnapi/runtime@1.11.0':
+  '@emnapi/runtime@1.11.1':
     dependencies:
       tslib: 2.8.1
     optional: true
 
-  '@emnapi/runtime@1.11.1':
+  '@emnapi/runtime@1.11.2':
     dependencies:
       tslib: 2.8.1
+    optional: true
 
   '@emnapi/runtime@1.4.5':
     dependencies:
@@ -7136,14 +7363,10 @@ snapshots:
     dependencies:
       tslib: 2.8.1
 
-  '@emnapi/wasi-threads@1.2.1':
-    dependencies:
-      tslib: 2.8.1
-    optional: true
-
   '@emnapi/wasi-threads@1.2.2':
     dependencies:
       tslib: 2.8.1
+    optional: true
 
   '@esbuild/aix-ppc64@0.28.1':
     optional: true
@@ -7223,22 +7446,22 @@ snapshots:
   '@esbuild/win32-x64@0.28.1':
     optional: true
 
-  '@floating-ui/core@1.7.5':
+  '@floating-ui/core@1.8.0':
     dependencies:
-      '@floating-ui/utils': 0.2.11
+      '@floating-ui/utils': 0.2.12
 
-  '@floating-ui/dom@1.7.6':
+  '@floating-ui/dom@1.8.0':
     dependencies:
-      '@floating-ui/core': 1.7.5
-      '@floating-ui/utils': 0.2.11
+      '@floating-ui/core': 1.8.0
+      '@floating-ui/utils': 0.2.12
 
-  '@floating-ui/react-dom@2.1.8(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
+  '@floating-ui/react-dom@2.1.9(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@floating-ui/dom': 1.7.6
+      '@floating-ui/dom': 1.8.0
       react: 19.2.7
       react-dom: 19.2.7(react@19.2.7)
 
-  '@floating-ui/utils@0.2.11': {}
+  '@floating-ui/utils@0.2.12': {}
 
   '@fuma-translate/react@1.0.2(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
@@ -7247,11 +7470,11 @@ snapshots:
     optionalDependencies:
       '@types/react': 19.2.17
 
-  '@fumadocs/tailwind@0.0.5': {}
+  '@fumadocs/tailwind@0.1.1': {}
 
-  '@hono/node-server@1.19.14(hono@4.12.21)':
+  '@hono/node-server@1.19.14(hono@4.12.30)':
     dependencies:
-      hono: 4.12.21
+      hono: 4.12.30
 
   '@img/colour@1.1.0':
     optional: true
@@ -7338,7 +7561,7 @@ snapshots:
 
   '@img/sharp-wasm32@0.34.5':
     dependencies:
-      '@emnapi/runtime': 1.11.1
+      '@emnapi/runtime': 1.11.2
     optional: true
 
   '@img/sharp-win32-arm64@0.34.5':
@@ -7379,7 +7602,7 @@ snapshots:
     dependencies:
       '@types/estree': 1.0.9
       '@types/estree-jsx': 1.0.5
-      '@types/hast': 3.0.4
+      '@types/hast': 3.0.5
       '@types/mdx': 2.0.14
       acorn: 8.17.0
       collapse-white-space: 2.1.0
@@ -7407,17 +7630,17 @@ snapshots:
 
   '@modelcontextprotocol/sdk@1.29.0(zod@4.4.3)':
     dependencies:
-      '@hono/node-server': 1.19.14(hono@4.12.21)
-      ajv: 8.18.0
-      ajv-formats: 3.0.1(ajv@8.18.0)
+      '@hono/node-server': 1.19.14(hono@4.12.30)
+      ajv: 8.20.0
+      ajv-formats: 3.0.1(ajv@8.20.0)
       content-type: 1.0.5
       cors: 2.8.6
       cross-spawn: 7.0.6
       eventsource: 3.0.7
-      eventsource-parser: 3.0.8
+      eventsource-parser: 3.1.0
       express: 5.2.1
       express-rate-limit: 8.5.2(express@5.2.1)
-      hono: 4.12.21
+      hono: 4.12.30
       jose: 6.2.3
       json-schema-typed: 8.0.2
       pkce-challenge: 5.0.1
@@ -7498,17 +7721,10 @@ snapshots:
 
   '@napi-rs/wasm-runtime@0.2.4':
     dependencies:
-      '@emnapi/core': 1.11.1
-      '@emnapi/runtime': 1.11.1
+      '@emnapi/core': 1.4.5
+      '@emnapi/runtime': 1.4.5
       '@tybys/wasm-util': 0.9.0
 
-  '@napi-rs/wasm-runtime@1.1.6(@emnapi/core@1.10.0)(@emnapi/runtime@1.10.0)':
-    dependencies:
-      '@emnapi/core': 1.10.0
-      '@emnapi/runtime': 1.10.0
-      '@tybys/wasm-util': 0.10.3
-    optional: true
-
   '@napi-rs/wasm-runtime@1.1.6(@emnapi/core@1.11.0)(@emnapi/runtime@1.11.0)':
     dependencies:
       '@emnapi/core': 1.11.0
@@ -7523,30 +7739,37 @@ snapshots:
       '@tybys/wasm-util': 0.10.3
     optional: true
 
-  '@next/env@16.2.9': {}
+  '@napi-rs/wasm-runtime@1.1.6(@emnapi/core@1.11.2)(@emnapi/runtime@1.11.2)':
+    dependencies:
+      '@emnapi/core': 1.11.2
+      '@emnapi/runtime': 1.11.2
+      '@tybys/wasm-util': 0.10.3
+    optional: true
 
-  '@next/swc-darwin-arm64@16.2.9':
+  '@next/env@16.3.0-preview.6': {}
+
+  '@next/swc-darwin-arm64@16.3.0-preview.6':
     optional: true
 
-  '@next/swc-darwin-x64@16.2.9':
+  '@next/swc-darwin-x64@16.3.0-preview.6':
     optional: true
 
-  '@next/swc-linux-arm64-gnu@16.2.9':
+  '@next/swc-linux-arm64-gnu@16.3.0-preview.6':
     optional: true
 
-  '@next/swc-linux-arm64-musl@16.2.9':
+  '@next/swc-linux-arm64-musl@16.3.0-preview.6':
     optional: true
 
-  '@next/swc-linux-x64-gnu@16.2.9':
+  '@next/swc-linux-x64-gnu@16.3.0-preview.6':
     optional: true
 
-  '@next/swc-linux-x64-musl@16.2.9':
+  '@next/swc-linux-x64-musl@16.3.0-preview.6':
     optional: true
 
-  '@next/swc-win32-arm64-msvc@16.2.9':
+  '@next/swc-win32-arm64-msvc@16.3.0-preview.6':
     optional: true
 
-  '@next/swc-win32-x64-msvc@16.2.9':
+  '@next/swc-win32-x64-msvc@16.3.0-preview.6':
     optional: true
 
   '@noble/ciphers@1.3.0': {}
@@ -7569,45 +7792,46 @@ snapshots:
       '@nodelib/fs.scandir': 2.1.5
       fastq: 1.20.1
 
-  '@nx/devkit@23.0.1(nx@23.0.1(@swc-node/register@1.11.1(@swc/core@1.15.43)(@swc/types@0.1.27)(typescript@6.0.3))(@swc/core@1.15.43))':
+  '@nx/devkit@23.1.0(nx@23.1.0(@swc-node/register@1.11.1(@swc/core@1.15.43)(@swc/types@0.1.27)(@typescript/typescript6@6.0.2))(@swc/core@1.15.43))':
     dependencies:
       '@zkochan/js-yaml': 0.0.7
       ejs: 5.0.1
       enquirer: 2.3.6
       minimatch: 10.2.5
-      nx: 23.0.1(@swc-node/register@1.11.1(@swc/core@1.15.43)(@swc/types@0.1.27)(typescript@6.0.3))(@swc/core@1.15.43)
+      nx: 23.1.0(@swc-node/register@1.11.1(@swc/core@1.15.43)(@swc/types@0.1.27)(@typescript/typescript6@6.0.2))(@swc/core@1.15.43)
       semver: 7.8.5
       tslib: 2.8.1
+      yaml: 2.9.0
       yargs-parser: 21.1.1
 
-  '@nx/nx-darwin-arm64@23.0.1':
+  '@nx/nx-darwin-arm64@23.1.0':
     optional: true
 
-  '@nx/nx-darwin-x64@23.0.1':
+  '@nx/nx-darwin-x64@23.1.0':
     optional: true
 
-  '@nx/nx-freebsd-x64@23.0.1':
+  '@nx/nx-freebsd-x64@23.1.0':
     optional: true
 
-  '@nx/nx-linux-arm-gnueabihf@23.0.1':
+  '@nx/nx-linux-arm-gnueabihf@23.1.0':
     optional: true
 
-  '@nx/nx-linux-arm64-gnu@23.0.1':
+  '@nx/nx-linux-arm64-gnu@23.1.0':
     optional: true
 
-  '@nx/nx-linux-arm64-musl@23.0.1':
+  '@nx/nx-linux-arm64-musl@23.1.0':
     optional: true
 
-  '@nx/nx-linux-x64-gnu@23.0.1':
+  '@nx/nx-linux-x64-gnu@23.1.0':
     optional: true
 
-  '@nx/nx-linux-x64-musl@23.0.1':
+  '@nx/nx-linux-x64-musl@23.1.0':
     optional: true
 
-  '@nx/nx-win32-arm64-msvc@23.0.1':
+  '@nx/nx-win32-arm64-msvc@23.1.0':
     optional: true
 
-  '@nx/nx-win32-x64-msvc@23.0.1':
+  '@nx/nx-win32-x64-msvc@23.1.0':
     optional: true
 
   '@octokit/auth-token@6.0.0': {}
@@ -7616,7 +7840,7 @@ snapshots:
     dependencies:
       '@octokit/auth-token': 6.0.0
       '@octokit/graphql': 9.0.3
-      '@octokit/request': 10.0.10
+      '@octokit/request': 10.0.11
       '@octokit/request-error': 7.1.0
       '@octokit/types': 16.0.0
       before-after-hook: 4.0.0
@@ -7629,7 +7853,7 @@ snapshots:
 
   '@octokit/graphql@9.0.3':
     dependencies:
-      '@octokit/request': 10.0.10
+      '@octokit/request': 10.0.11
       '@octokit/types': 16.0.0
       universal-user-agent: 7.0.3
 
@@ -7657,13 +7881,13 @@ snapshots:
     dependencies:
       '@octokit/types': 16.0.0
 
-  '@octokit/request@10.0.10':
+  '@octokit/request@10.0.11':
     dependencies:
       '@octokit/endpoint': 11.0.3
       '@octokit/request-error': 7.1.0
       '@octokit/types': 16.0.0
       content-type: 2.0.0
-      json-with-bigint: 3.5.8
+      json-with-bigint: 3.5.10
       universal-user-agent: 7.0.3
 
   '@octokit/types@16.0.0':
@@ -7736,58 +7960,106 @@ snapshots:
   '@oxc-parser/binding-win32-x64-msvc@0.137.0':
     optional: true
 
-  '@oxc-project/types@0.132.0': {}
-
   '@oxc-project/types@0.137.0': {}
 
+  '@oxc-project/types@0.139.0': {}
+
   '@oxc-resolver/binding-android-arm-eabi@11.21.3':
     optional: true
 
+  '@oxc-resolver/binding-android-arm-eabi@11.24.2':
+    optional: true
+
   '@oxc-resolver/binding-android-arm64@11.21.3':
     optional: true
 
+  '@oxc-resolver/binding-android-arm64@11.24.2':
+    optional: true
+
   '@oxc-resolver/binding-darwin-arm64@11.21.3':
     optional: true
 
+  '@oxc-resolver/binding-darwin-arm64@11.24.2':
+    optional: true
+
   '@oxc-resolver/binding-darwin-x64@11.21.3':
     optional: true
 
+  '@oxc-resolver/binding-darwin-x64@11.24.2':
+    optional: true
+
   '@oxc-resolver/binding-freebsd-x64@11.21.3':
     optional: true
 
+  '@oxc-resolver/binding-freebsd-x64@11.24.2':
+    optional: true
+
   '@oxc-resolver/binding-linux-arm-gnueabihf@11.21.3':
     optional: true
 
+  '@oxc-resolver/binding-linux-arm-gnueabihf@11.24.2':
+    optional: true
+
   '@oxc-resolver/binding-linux-arm-musleabihf@11.21.3':
     optional: true
 
+  '@oxc-resolver/binding-linux-arm-musleabihf@11.24.2':
+    optional: true
+
   '@oxc-resolver/binding-linux-arm64-gnu@11.21.3':
     optional: true
 
+  '@oxc-resolver/binding-linux-arm64-gnu@11.24.2':
+    optional: true
+
   '@oxc-resolver/binding-linux-arm64-musl@11.21.3':
     optional: true
 
+  '@oxc-resolver/binding-linux-arm64-musl@11.24.2':
+    optional: true
+
   '@oxc-resolver/binding-linux-ppc64-gnu@11.21.3':
     optional: true
 
+  '@oxc-resolver/binding-linux-ppc64-gnu@11.24.2':
+    optional: true
+
   '@oxc-resolver/binding-linux-riscv64-gnu@11.21.3':
     optional: true
 
+  '@oxc-resolver/binding-linux-riscv64-gnu@11.24.2':
+    optional: true
+
   '@oxc-resolver/binding-linux-riscv64-musl@11.21.3':
     optional: true
 
+  '@oxc-resolver/binding-linux-riscv64-musl@11.24.2':
+    optional: true
+
   '@oxc-resolver/binding-linux-s390x-gnu@11.21.3':
     optional: true
 
+  '@oxc-resolver/binding-linux-s390x-gnu@11.24.2':
+    optional: true
+
   '@oxc-resolver/binding-linux-x64-gnu@11.21.3':
     optional: true
 
+  '@oxc-resolver/binding-linux-x64-gnu@11.24.2':
+    optional: true
+
   '@oxc-resolver/binding-linux-x64-musl@11.21.3':
     optional: true
 
+  '@oxc-resolver/binding-linux-x64-musl@11.24.2':
+    optional: true
+
   '@oxc-resolver/binding-openharmony-arm64@11.21.3':
     optional: true
 
+  '@oxc-resolver/binding-openharmony-arm64@11.24.2':
+    optional: true
+
   '@oxc-resolver/binding-wasm32-wasi@11.21.3':
     dependencies:
       '@emnapi/core': 1.11.0
@@ -7795,142 +8067,155 @@ snapshots:
       '@napi-rs/wasm-runtime': 1.1.6(@emnapi/core@1.11.0)(@emnapi/runtime@1.11.0)
     optional: true
 
+  '@oxc-resolver/binding-wasm32-wasi@11.24.2':
+    dependencies:
+      '@emnapi/core': 1.11.2
+      '@emnapi/runtime': 1.11.2
+      '@napi-rs/wasm-runtime': 1.1.6(@emnapi/core@1.11.2)(@emnapi/runtime@1.11.2)
+    optional: true
+
   '@oxc-resolver/binding-win32-arm64-msvc@11.21.3':
     optional: true
 
+  '@oxc-resolver/binding-win32-arm64-msvc@11.24.2':
+    optional: true
+
   '@oxc-resolver/binding-win32-x64-msvc@11.21.3':
     optional: true
 
-  '@oxfmt/binding-android-arm-eabi@0.57.0':
+  '@oxc-resolver/binding-win32-x64-msvc@11.24.2':
+    optional: true
+
+  '@oxfmt/binding-android-arm-eabi@0.58.0':
     optional: true
 
-  '@oxfmt/binding-android-arm64@0.57.0':
+  '@oxfmt/binding-android-arm64@0.58.0':
     optional: true
 
-  '@oxfmt/binding-darwin-arm64@0.57.0':
+  '@oxfmt/binding-darwin-arm64@0.58.0':
     optional: true
 
-  '@oxfmt/binding-darwin-x64@0.57.0':
+  '@oxfmt/binding-darwin-x64@0.58.0':
     optional: true
 
-  '@oxfmt/binding-freebsd-x64@0.57.0':
+  '@oxfmt/binding-freebsd-x64@0.58.0':
     optional: true
 
-  '@oxfmt/binding-linux-arm-gnueabihf@0.57.0':
+  '@oxfmt/binding-linux-arm-gnueabihf@0.58.0':
     optional: true
 
-  '@oxfmt/binding-linux-arm-musleabihf@0.57.0':
+  '@oxfmt/binding-linux-arm-musleabihf@0.58.0':
     optional: true
 
-  '@oxfmt/binding-linux-arm64-gnu@0.57.0':
+  '@oxfmt/binding-linux-arm64-gnu@0.58.0':
     optional: true
 
-  '@oxfmt/binding-linux-arm64-musl@0.57.0':
+  '@oxfmt/binding-linux-arm64-musl@0.58.0':
     optional: true
 
-  '@oxfmt/binding-linux-ppc64-gnu@0.57.0':
+  '@oxfmt/binding-linux-ppc64-gnu@0.58.0':
     optional: true
 
-  '@oxfmt/binding-linux-riscv64-gnu@0.57.0':
+  '@oxfmt/binding-linux-riscv64-gnu@0.58.0':
     optional: true
 
-  '@oxfmt/binding-linux-riscv64-musl@0.57.0':
+  '@oxfmt/binding-linux-riscv64-musl@0.58.0':
     optional: true
 
-  '@oxfmt/binding-linux-s390x-gnu@0.57.0':
+  '@oxfmt/binding-linux-s390x-gnu@0.58.0':
     optional: true
 
-  '@oxfmt/binding-linux-x64-gnu@0.57.0':
+  '@oxfmt/binding-linux-x64-gnu@0.58.0':
     optional: true
 
-  '@oxfmt/binding-linux-x64-musl@0.57.0':
+  '@oxfmt/binding-linux-x64-musl@0.58.0':
     optional: true
 
-  '@oxfmt/binding-openharmony-arm64@0.57.0':
+  '@oxfmt/binding-openharmony-arm64@0.58.0':
     optional: true
 
-  '@oxfmt/binding-win32-arm64-msvc@0.57.0':
+  '@oxfmt/binding-win32-arm64-msvc@0.58.0':
     optional: true
 
-  '@oxfmt/binding-win32-ia32-msvc@0.57.0':
+  '@oxfmt/binding-win32-ia32-msvc@0.58.0':
     optional: true
 
-  '@oxfmt/binding-win32-x64-msvc@0.57.0':
+  '@oxfmt/binding-win32-x64-msvc@0.58.0':
     optional: true
 
-  '@oxlint-tsgolint/darwin-arm64@0.23.0':
+  '@oxlint-tsgolint/darwin-arm64@0.24.0':
     optional: true
 
-  '@oxlint-tsgolint/darwin-x64@0.23.0':
+  '@oxlint-tsgolint/darwin-x64@0.24.0':
     optional: true
 
-  '@oxlint-tsgolint/linux-arm64@0.23.0':
+  '@oxlint-tsgolint/linux-arm64@0.24.0':
     optional: true
 
-  '@oxlint-tsgolint/linux-x64@0.23.0':
+  '@oxlint-tsgolint/linux-x64@0.24.0':
     optional: true
 
-  '@oxlint-tsgolint/win32-arm64@0.23.0':
+  '@oxlint-tsgolint/win32-arm64@0.24.0':
     optional: true
 
-  '@oxlint-tsgolint/win32-x64@0.23.0':
+  '@oxlint-tsgolint/win32-x64@0.24.0':
     optional: true
 
-  '@oxlint/binding-android-arm-eabi@1.73.0':
+  '@oxlint/binding-android-arm-eabi@1.74.0':
     optional: true
 
-  '@oxlint/binding-android-arm64@1.73.0':
+  '@oxlint/binding-android-arm64@1.74.0':
     optional: true
 
-  '@oxlint/binding-darwin-arm64@1.73.0':
+  '@oxlint/binding-darwin-arm64@1.74.0':
     optional: true
 
-  '@oxlint/binding-darwin-x64@1.73.0':
+  '@oxlint/binding-darwin-x64@1.74.0':
     optional: true
 
-  '@oxlint/binding-freebsd-x64@1.73.0':
+  '@oxlint/binding-freebsd-x64@1.74.0':
     optional: true
 
-  '@oxlint/binding-linux-arm-gnueabihf@1.73.0':
+  '@oxlint/binding-linux-arm-gnueabihf@1.74.0':
     optional: true
 
-  '@oxlint/binding-linux-arm-musleabihf@1.73.0':
+  '@oxlint/binding-linux-arm-musleabihf@1.74.0':
     optional: true
 
-  '@oxlint/binding-linux-arm64-gnu@1.73.0':
+  '@oxlint/binding-linux-arm64-gnu@1.74.0':
     optional: true
 
-  '@oxlint/binding-linux-arm64-musl@1.73.0':
+  '@oxlint/binding-linux-arm64-musl@1.74.0':
     optional: true
 
-  '@oxlint/binding-linux-ppc64-gnu@1.73.0':
+  '@oxlint/binding-linux-ppc64-gnu@1.74.0':
     optional: true
 
-  '@oxlint/binding-linux-riscv64-gnu@1.73.0':
+  '@oxlint/binding-linux-riscv64-gnu@1.74.0':
     optional: true
 
-  '@oxlint/binding-linux-riscv64-musl@1.73.0':
+  '@oxlint/binding-linux-riscv64-musl@1.74.0':
     optional: true
 
-  '@oxlint/binding-linux-s390x-gnu@1.73.0':
+  '@oxlint/binding-linux-s390x-gnu@1.74.0':
     optional: true
 
-  '@oxlint/binding-linux-x64-gnu@1.73.0':
+  '@oxlint/binding-linux-x64-gnu@1.74.0':
     optional: true
 
-  '@oxlint/binding-linux-x64-musl@1.73.0':
+  '@oxlint/binding-linux-x64-musl@1.74.0':
     optional: true
 
-  '@oxlint/binding-openharmony-arm64@1.73.0':
+  '@oxlint/binding-openharmony-arm64@1.74.0':
     optional: true
 
-  '@oxlint/binding-win32-arm64-msvc@1.73.0':
+  '@oxlint/binding-win32-arm64-msvc@1.74.0':
     optional: true
 
-  '@oxlint/binding-win32-ia32-msvc@1.73.0':
+  '@oxlint/binding-win32-ia32-msvc@1.74.0':
     optional: true
 
-  '@oxlint/binding-win32-x64-msvc@1.73.0':
+  '@oxlint/binding-win32-x64-msvc@1.74.0':
     optional: true
 
   '@parcel/watcher-android-arm64@2.5.6':
@@ -7977,7 +8262,7 @@ snapshots:
       detect-libc: 2.1.2
       is-glob: 4.0.3
       node-addon-api: 7.1.1
-      picomatch: 4.0.4
+      picomatch: 4.0.5
     optionalDependencies:
       '@parcel/watcher-android-arm64': 2.5.6
       '@parcel/watcher-darwin-arm64': 2.5.6
@@ -8007,11 +8292,11 @@ snapshots:
       '@pnpm/network.ca-file': 1.0.2
       config-chain: 1.1.13
 
-  '@posthog/core@1.39.6':
+  '@posthog/core@1.40.2':
     dependencies:
-      '@posthog/types': 1.392.1
+      '@posthog/types': 1.393.0
 
-  '@posthog/types@1.392.1': {}
+  '@posthog/types@1.393.0': {}
 
   '@radix-ui/number@1.1.2': {}
 
@@ -8195,7 +8480,7 @@ snapshots:
 
   '@radix-ui/react-popper@1.3.3(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@floating-ui/react-dom': 2.1.8(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@floating-ui/react-dom': 2.1.9(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
       '@radix-ui/react-arrow': 1.1.11(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
       '@radix-ui/react-compose-refs': 1.1.3(@types/react@19.2.17)(react@19.2.7)
       '@radix-ui/react-context': 1.2.0(@types/react@19.2.17)(react@19.2.7)
@@ -8362,76 +8647,76 @@ snapshots:
 
   '@radix-ui/rect@1.1.2': {}
 
-  '@rolldown/binding-android-arm64@1.0.2':
+  '@rolldown/binding-android-arm64@1.1.5':
     optional: true
 
-  '@rolldown/binding-darwin-arm64@1.0.2':
+  '@rolldown/binding-darwin-arm64@1.1.5':
     optional: true
 
-  '@rolldown/binding-darwin-x64@1.0.2':
+  '@rolldown/binding-darwin-x64@1.1.5':
     optional: true
 
-  '@rolldown/binding-freebsd-x64@1.0.2':
+  '@rolldown/binding-freebsd-x64@1.1.5':
     optional: true
 
-  '@rolldown/binding-linux-arm-gnueabihf@1.0.2':
+  '@rolldown/binding-linux-arm-gnueabihf@1.1.5':
     optional: true
 
-  '@rolldown/binding-linux-arm64-gnu@1.0.2':
+  '@rolldown/binding-linux-arm64-gnu@1.1.5':
     optional: true
 
-  '@rolldown/binding-linux-arm64-musl@1.0.2':
+  '@rolldown/binding-linux-arm64-musl@1.1.5':
     optional: true
 
-  '@rolldown/binding-linux-ppc64-gnu@1.0.2':
+  '@rolldown/binding-linux-ppc64-gnu@1.1.5':
     optional: true
 
-  '@rolldown/binding-linux-s390x-gnu@1.0.2':
+  '@rolldown/binding-linux-s390x-gnu@1.1.5':
     optional: true
 
-  '@rolldown/binding-linux-x64-gnu@1.0.2':
+  '@rolldown/binding-linux-x64-gnu@1.1.5':
     optional: true
 
-  '@rolldown/binding-linux-x64-musl@1.0.2':
+  '@rolldown/binding-linux-x64-musl@1.1.5':
     optional: true
 
-  '@rolldown/binding-openharmony-arm64@1.0.2':
+  '@rolldown/binding-openharmony-arm64@1.1.5':
     optional: true
 
-  '@rolldown/binding-wasm32-wasi@1.0.2':
+  '@rolldown/binding-wasm32-wasi@1.1.5':
     dependencies:
-      '@emnapi/core': 1.10.0
-      '@emnapi/runtime': 1.10.0
-      '@napi-rs/wasm-runtime': 1.1.6(@emnapi/core@1.10.0)(@emnapi/runtime@1.10.0)
+      '@emnapi/core': 1.11.1
+      '@emnapi/runtime': 1.11.1
+      '@napi-rs/wasm-runtime': 1.1.6(@emnapi/core@1.11.1)(@emnapi/runtime@1.11.1)
     optional: true
 
-  '@rolldown/binding-win32-arm64-msvc@1.0.2':
+  '@rolldown/binding-win32-arm64-msvc@1.1.5':
     optional: true
 
-  '@rolldown/binding-win32-x64-msvc@1.0.2':
+  '@rolldown/binding-win32-x64-msvc@1.1.5':
     optional: true
 
   '@rolldown/pluginutils@1.0.1': {}
 
   '@sec-ant/readable-stream@0.4.1': {}
 
-  '@semantic-release/commit-analyzer@13.0.1(semantic-release@25.0.5(typescript@6.0.3))':
+  '@semantic-release/commit-analyzer@13.0.1(semantic-release@25.0.7(typescript@7.0.2))':
     dependencies:
       conventional-changelog-angular: 8.3.1
       conventional-changelog-writer: 8.4.0
       conventional-commits-filter: 5.0.0
       conventional-commits-parser: 6.4.0
-      debug: 4.4.3
+      debug: 4.4.3(supports-color@7.2.0)
       import-from-esm: 2.0.0
       lodash-es: 4.18.1
       micromatch: 4.0.8
-      semantic-release: 25.0.5(typescript@6.0.3)
+      semantic-release: 25.0.7(typescript@7.0.2)
     transitivePeerDependencies:
       - supports-color
 
   '@semantic-release/error@4.0.0': {}
 
-  '@semantic-release/github@12.0.8(semantic-release@25.0.5(typescript@6.0.3))':
+  '@semantic-release/github@12.0.9(semantic-release@25.0.7(typescript@7.0.2))':
     dependencies:
       '@octokit/core': 7.0.6
       '@octokit/plugin-paginate-rest': 14.0.0(@octokit/core@7.0.6)
@@ -8439,7 +8724,7 @@ snapshots:
       '@octokit/plugin-throttling': 11.0.3(@octokit/core@7.0.6)
       '@semantic-release/error': 4.0.0
       aggregate-error: 5.0.0
-      debug: 4.4.3
+      debug: 4.4.3(supports-color@7.2.0)
       dir-glob: 3.0.1
       http-proxy-agent: 9.1.0
       https-proxy-agent: 9.1.0
@@ -8447,7 +8732,7 @@ snapshots:
       lodash-es: 4.18.1
       mime: 4.1.0
       p-filter: 4.1.0
-      semantic-release: 25.0.5(typescript@6.0.3)
+      semantic-release: 25.0.7(typescript@7.0.2)
       tinyglobby: 0.2.17
       undici: 7.28.0
       url-join: 5.0.0
@@ -8455,36 +8740,36 @@ snapshots:
       - kerberos
       - supports-color
 
-  '@semantic-release/npm@13.1.5(semantic-release@25.0.5(typescript@6.0.3))':
+  '@semantic-release/npm@13.1.5(semantic-release@25.0.7(typescript@7.0.2))':
     dependencies:
       '@actions/core': 3.0.1
       '@semantic-release/error': 4.0.0
       aggregate-error: 5.0.0
       env-ci: 11.2.0
       execa: 9.6.1
-      fs-extra: 11.3.5
+      fs-extra: 11.3.6
       lodash-es: 4.18.1
       nerf-dart: 1.0.0
       normalize-url: 9.0.1
-      npm: 11.17.0
+      npm: 11.18.0
       rc: 1.2.8
       read-pkg: 10.1.0
       registry-auth-token: 5.1.1
-      semantic-release: 25.0.5(typescript@6.0.3)
+      semantic-release: 25.0.7(typescript@7.0.2)
       semver: 7.8.5
       tempy: 3.2.0
 
-  '@semantic-release/release-notes-generator@14.1.1(semantic-release@25.0.5(typescript@6.0.3))':
+  '@semantic-release/release-notes-generator@14.1.1(semantic-release@25.0.7(typescript@7.0.2))':
     dependencies:
       conventional-changelog-angular: 8.3.1
       conventional-changelog-writer: 8.4.0
       conventional-commits-filter: 5.0.0
       conventional-commits-parser: 6.4.0
-      debug: 4.4.3
+      debug: 4.4.3(supports-color@7.2.0)
       import-from-esm: 2.0.0
       lodash-es: 4.18.1
       read-package-up: 11.0.0
-      semantic-release: 25.0.5(typescript@6.0.3)
+      semantic-release: 25.0.7(typescript@7.0.2)
     transitivePeerDependencies:
       - supports-color
 
@@ -8493,7 +8778,7 @@ snapshots:
       '@shikijs/primitive': 4.3.1
       '@shikijs/types': 4.3.1
       '@shikijs/vscode-textmate': 10.0.2
-      '@types/hast': 3.0.4
+      '@types/hast': 3.0.5
       hast-util-to-html: 9.0.5
 
   '@shikijs/engine-javascript@4.3.1':
@@ -8515,7 +8800,7 @@ snapshots:
     dependencies:
       '@shikijs/types': 4.3.1
       '@shikijs/vscode-textmate': 10.0.2
-      '@types/hast': 3.0.4
+      '@types/hast': 3.0.5
 
   '@shikijs/themes@4.3.1':
     dependencies:
@@ -8524,7 +8809,7 @@ snapshots:
   '@shikijs/types@4.3.1':
     dependencies:
       '@shikijs/vscode-textmate': 10.0.2
-      '@types/hast': 3.0.4
+      '@types/hast': 3.0.5
 
   '@shikijs/vscode-textmate@10.0.2': {}
 
@@ -8538,54 +8823,54 @@ snapshots:
 
   '@standard-schema/spec@1.1.0': {}
 
-  '@supabase/auth-js@2.108.2':
+  '@supabase/auth-js@2.110.5':
     dependencies:
       tslib: 2.8.1
 
-  '@supabase/functions-js@2.108.2':
+  '@supabase/functions-js@2.110.5':
     dependencies:
       tslib: 2.8.1
 
   '@supabase/phoenix@0.4.4': {}
 
-  '@supabase/postgrest-js@2.108.2':
+  '@supabase/postgrest-js@2.110.5':
     dependencies:
       tslib: 2.8.1
 
-  '@supabase/realtime-js@2.108.2':
+  '@supabase/realtime-js@2.110.5':
     dependencies:
       '@supabase/phoenix': 0.4.4
       tslib: 2.8.1
 
-  '@supabase/storage-js@2.108.2':
+  '@supabase/storage-js@2.110.5':
     dependencies:
       iceberg-js: 0.8.1
       tslib: 2.8.1
 
-  '@supabase/supabase-js@2.108.2':
+  '@supabase/supabase-js@2.110.5':
     dependencies:
-      '@supabase/auth-js': 2.108.2
-      '@supabase/functions-js': 2.108.2
-      '@supabase/postgrest-js': 2.108.2
-      '@supabase/realtime-js': 2.108.2
-      '@supabase/storage-js': 2.108.2
+      '@supabase/auth-js': 2.110.5
+      '@supabase/functions-js': 2.110.5
+      '@supabase/postgrest-js': 2.110.5
+      '@supabase/realtime-js': 2.110.5
+      '@supabase/storage-js': 2.110.5
 
   '@swc-node/core@1.14.1(@swc/core@1.15.43)(@swc/types@0.1.27)':
     dependencies:
       '@swc/core': 1.15.43
       '@swc/types': 0.1.27
 
-  '@swc-node/register@1.11.1(@swc/core@1.15.43)(@swc/types@0.1.27)(typescript@6.0.3)':
+  '@swc-node/register@1.11.1(@swc/core@1.15.43)(@swc/types@0.1.27)(@typescript/typescript6@6.0.2)':
     dependencies:
       '@swc-node/core': 1.14.1(@swc/core@1.15.43)(@swc/types@0.1.27)
       '@swc-node/sourcemap-support': 0.6.1
       '@swc/core': 1.15.43
       colorette: 2.0.20
-      debug: 4.4.3
-      oxc-resolver: 11.21.3
+      debug: 4.4.3(supports-color@7.2.0)
+      oxc-resolver: 11.24.2
       pirates: 4.0.7
       tslib: 2.8.1
-      typescript: 6.0.3
+      typescript: '@typescript/typescript6@6.0.2'
     transitivePeerDependencies:
       - '@swc/types'
       - supports-color
@@ -8695,7 +8980,7 @@ snapshots:
 
   '@types/estree@1.0.9': {}
 
-  '@types/hast@3.0.4':
+  '@types/hast@3.0.5':
     dependencies:
       '@types/unist': 3.0.3
 
@@ -8707,11 +8992,7 @@ snapshots:
 
   '@types/ms@2.1.0': {}
 
-  '@types/node@25.9.3':
-    dependencies:
-      undici-types: 7.24.6
-
-  '@types/node@26.0.1':
+  '@types/node@26.1.1':
     dependencies:
       undici-types: 8.3.0
 
@@ -8719,13 +9000,13 @@ snapshots:
 
   '@types/pg-copy-streams@1.2.5':
     dependencies:
-      '@types/node': 25.9.3
+      '@types/node': 26.1.1
       '@types/pg': 8.20.0
 
   '@types/pg@8.20.0':
     dependencies:
-      '@types/node': 25.9.3
-      pg-protocol: 1.14.0
+      '@types/node': 26.1.1
+      pg-protocol: 1.15.0
       pg-types: 2.2.0
 
   '@types/react-dom@19.2.3(@types/react@19.2.17)':
@@ -8738,7 +9019,7 @@ snapshots:
 
   '@types/responselike@1.0.0':
     dependencies:
-      '@types/node': 26.0.1
+      '@types/node': 26.1.1
 
   '@types/unist@2.0.11': {}
 
@@ -8746,40 +9027,104 @@ snapshots:
 
   '@types/ws@8.18.1':
     dependencies:
-      '@types/node': 26.0.1
+      '@types/node': 26.1.1
 
-  '@typescript/native-preview-darwin-arm64@7.0.0-dev.20260629.1':
+  '@typescript/native-preview-darwin-arm64@7.0.0-dev.20260707.2':
     optional: true
 
-  '@typescript/native-preview-darwin-x64@7.0.0-dev.20260629.1':
+  '@typescript/native-preview-darwin-x64@7.0.0-dev.20260707.2':
     optional: true
 
-  '@typescript/native-preview-linux-arm64@7.0.0-dev.20260629.1':
+  '@typescript/native-preview-linux-arm64@7.0.0-dev.20260707.2':
     optional: true
 
-  '@typescript/native-preview-linux-arm@7.0.0-dev.20260629.1':
+  '@typescript/native-preview-linux-arm@7.0.0-dev.20260707.2':
     optional: true
 
-  '@typescript/native-preview-linux-x64@7.0.0-dev.20260629.1':
+  '@typescript/native-preview-linux-x64@7.0.0-dev.20260707.2':
     optional: true
 
-  '@typescript/native-preview-win32-arm64@7.0.0-dev.20260629.1':
+  '@typescript/native-preview-win32-arm64@7.0.0-dev.20260707.2':
     optional: true
 
-  '@typescript/native-preview-win32-x64@7.0.0-dev.20260629.1':
+  '@typescript/native-preview-win32-x64@7.0.0-dev.20260707.2':
     optional: true
 
-  '@typescript/native-preview@7.0.0-dev.20260629.1':
+  '@typescript/native-preview@7.0.0-dev.20260707.2':
     optionalDependencies:
-      '@typescript/native-preview-darwin-arm64': 7.0.0-dev.20260629.1
-      '@typescript/native-preview-darwin-x64': 7.0.0-dev.20260629.1
-      '@typescript/native-preview-linux-arm': 7.0.0-dev.20260629.1
-      '@typescript/native-preview-linux-arm64': 7.0.0-dev.20260629.1
-      '@typescript/native-preview-linux-x64': 7.0.0-dev.20260629.1
-      '@typescript/native-preview-win32-arm64': 7.0.0-dev.20260629.1
-      '@typescript/native-preview-win32-x64': 7.0.0-dev.20260629.1
+      '@typescript/native-preview-darwin-arm64': 7.0.0-dev.20260707.2
+      '@typescript/native-preview-darwin-x64': 7.0.0-dev.20260707.2
+      '@typescript/native-preview-linux-arm': 7.0.0-dev.20260707.2
+      '@typescript/native-preview-linux-arm64': 7.0.0-dev.20260707.2
+      '@typescript/native-preview-linux-x64': 7.0.0-dev.20260707.2
+      '@typescript/native-preview-win32-arm64': 7.0.0-dev.20260707.2
+      '@typescript/native-preview-win32-x64': 7.0.0-dev.20260707.2
+
+  '@typescript/typescript-aix-ppc64@7.0.2':
+    optional: true
 
-  '@ungap/structured-clone@1.3.2': {}
+  '@typescript/typescript-darwin-arm64@7.0.2':
+    optional: true
+
+  '@typescript/typescript-darwin-x64@7.0.2':
+    optional: true
+
+  '@typescript/typescript-freebsd-arm64@7.0.2':
+    optional: true
+
+  '@typescript/typescript-freebsd-x64@7.0.2':
+    optional: true
+
+  '@typescript/typescript-linux-arm64@7.0.2':
+    optional: true
+
+  '@typescript/typescript-linux-arm@7.0.2':
+    optional: true
+
+  '@typescript/typescript-linux-loong64@7.0.2':
+    optional: true
+
+  '@typescript/typescript-linux-mips64el@7.0.2':
+    optional: true
+
+  '@typescript/typescript-linux-ppc64@7.0.2':
+    optional: true
+
+  '@typescript/typescript-linux-riscv64@7.0.2':
+    optional: true
+
+  '@typescript/typescript-linux-s390x@7.0.2':
+    optional: true
+
+  '@typescript/typescript-linux-x64@7.0.2':
+    optional: true
+
+  '@typescript/typescript-netbsd-arm64@7.0.2':
+    optional: true
+
+  '@typescript/typescript-netbsd-x64@7.0.2':
+    optional: true
+
+  '@typescript/typescript-openbsd-arm64@7.0.2':
+    optional: true
+
+  '@typescript/typescript-openbsd-x64@7.0.2':
+    optional: true
+
+  '@typescript/typescript-sunos-x64@7.0.2':
+    optional: true
+
+  '@typescript/typescript-win32-arm64@7.0.2':
+    optional: true
+
+  '@typescript/typescript-win32-x64@7.0.2':
+    optional: true
+
+  '@typescript/typescript6@6.0.2':
+    dependencies:
+      '@typescript/old': typescript@6.0.3
+
+  '@ungap/structured-clone@1.3.3': {}
 
   '@vercel/detect-agent@1.2.3': {}
 
@@ -8789,7 +9134,7 @@ snapshots:
       '@verdaccio/core': 8.1.2
       '@verdaccio/loaders': 8.0.3
       '@verdaccio/signature': 8.0.3
-      debug: 4.4.3
+      debug: 4.4.3(supports-color@7.2.0)
       lodash: 4.18.1
       verdaccio-htpasswd: 13.0.3
     transitivePeerDependencies:
@@ -8798,7 +9143,7 @@ snapshots:
   '@verdaccio/config@8.1.2':
     dependencies:
       '@verdaccio/core': 8.1.2
-      debug: 4.4.3
+      debug: 4.4.3(supports-color@7.2.0)
       js-yaml: 4.1.1
       lodash: 4.18.1
     transitivePeerDependencies:
@@ -8817,11 +9162,11 @@ snapshots:
     dependencies:
       lockfile: 1.0.4
 
-  '@verdaccio/hooks@8.0.3':
+  '@verdaccio/hooks@8.0.4':
     dependencies:
       '@verdaccio/core': 8.1.2
       '@verdaccio/logger': 8.0.3
-      debug: 4.4.3
+      debug: 4.4.3(supports-color@7.2.0)
       got-cjs: 12.5.4
       handlebars: 4.7.9
     transitivePeerDependencies:
@@ -8830,7 +9175,7 @@ snapshots:
   '@verdaccio/loaders@8.0.3':
     dependencies:
       '@verdaccio/core': 8.1.2
-      debug: 4.4.3
+      debug: 4.4.3(supports-color@7.2.0)
       lodash: 4.18.1
     transitivePeerDependencies:
       - supports-color
@@ -8840,7 +9185,7 @@ snapshots:
       '@verdaccio/core': 8.1.2
       '@verdaccio/file-locking': 13.0.1
       '@verdaccio/streams': 10.2.5
-      debug: 4.4.3
+      debug: 4.4.3(supports-color@7.2.0)
       globby: 11.1.0
       lodash: 4.18.1
       lowdb: 1.0.0
@@ -8854,7 +9199,7 @@ snapshots:
       '@verdaccio/core': 8.1.2
       '@verdaccio/logger-prettify': 8.0.1
       colorette: 2.0.20
-      debug: 4.4.3
+      debug: 4.4.3(supports-color@7.2.0)
     transitivePeerDependencies:
       - supports-color
 
@@ -8879,7 +9224,7 @@ snapshots:
       '@verdaccio/config': 8.1.2
       '@verdaccio/core': 8.1.2
       '@verdaccio/url': 13.0.3
-      debug: 4.4.3
+      debug: 4.4.3(supports-color@7.2.0)
       express: 4.22.1
       express-rate-limit: 5.5.1
       lodash: 4.18.1
@@ -8890,14 +9235,14 @@ snapshots:
   '@verdaccio/package-filter@13.0.3':
     dependencies:
       '@verdaccio/core': 8.1.2
-      debug: 4.4.3
+      debug: 4.4.3(supports-color@7.2.0)
       semver: 7.7.4
     transitivePeerDependencies:
       - supports-color
 
   '@verdaccio/search-indexer@8.0.2':
     dependencies:
-      debug: 4.4.3
+      debug: 4.4.3(supports-color@7.2.0)
       fuse.js: 7.3.0
     transitivePeerDependencies:
       - supports-color
@@ -8906,7 +9251,7 @@ snapshots:
     dependencies:
       '@verdaccio/config': 8.1.2
       '@verdaccio/core': 8.1.2
-      debug: 4.4.3
+      debug: 4.4.3(supports-color@7.2.0)
       jsonwebtoken: 9.0.3
     transitivePeerDependencies:
       - supports-color
@@ -8917,7 +9262,7 @@ snapshots:
     dependencies:
       '@verdaccio/core': 8.1.2
       '@verdaccio/url': 13.0.3
-      debug: 4.4.3
+      debug: 4.4.3(supports-color@7.2.0)
       gunzip-maybe: 1.4.2
       tar-stream: 3.1.7
     transitivePeerDependencies:
@@ -8925,16 +9270,16 @@ snapshots:
       - react-native-b4a
       - supports-color
 
-  '@verdaccio/ui-theme@9.0.0-next-9.20':
+  '@verdaccio/ui-theme@9.0.0-next-9.21':
     dependencies:
-      debug: 4.4.3
+      debug: 4.4.3(supports-color@7.2.0)
     transitivePeerDependencies:
       - supports-color
 
   '@verdaccio/url@13.0.3':
     dependencies:
       '@verdaccio/core': 8.1.2
-      debug: 4.4.3
+      debug: 4.4.3(supports-color@7.2.0)
       validator: 13.15.26
     transitivePeerDependencies:
       - supports-color
@@ -8945,7 +9290,7 @@ snapshots:
       lodash: 4.18.1
       minimatch: 7.4.9
 
-  '@vitest/coverage-istanbul@4.1.9(vitest@4.1.9)':
+  '@vitest/coverage-istanbul@4.1.10(vitest@4.1.10)':
     dependencies:
       '@babel/core': 7.29.7
       '@istanbuljs/schema': 0.1.6
@@ -8955,50 +9300,50 @@ snapshots:
       istanbul-lib-report: 3.0.1
       istanbul-reports: 3.2.0
       magicast: 0.5.3
-      obug: 2.1.1
+      obug: 2.1.3
       tinyrainbow: 3.1.0
-      vitest: 4.1.9(@types/node@26.0.1)(@vitest/coverage-istanbul@4.1.9)(vite@8.0.14(@types/node@26.0.1)(esbuild@0.28.1)(jiti@2.7.0)(yaml@2.9.0))
+      vitest: 4.1.10(@types/node@26.1.1)(@vitest/coverage-istanbul@4.1.10)(vite@8.1.4(@types/node@26.1.1)(esbuild@0.28.1)(jiti@2.7.0)(yaml@2.9.0))
     transitivePeerDependencies:
       - supports-color
 
-  '@vitest/expect@4.1.9':
+  '@vitest/expect@4.1.10':
     dependencies:
       '@standard-schema/spec': 1.1.0
       '@types/chai': 5.2.3
-      '@vitest/spy': 4.1.9
-      '@vitest/utils': 4.1.9
+      '@vitest/spy': 4.1.10
+      '@vitest/utils': 4.1.10
       chai: 6.2.2
       tinyrainbow: 3.1.0
 
-  '@vitest/mocker@4.1.9(vite@8.0.14(@types/node@26.0.1)(esbuild@0.28.1)(jiti@2.7.0)(yaml@2.9.0))':
+  '@vitest/mocker@4.1.10(vite@8.1.4(@types/node@26.1.1)(esbuild@0.28.1)(jiti@2.7.0)(yaml@2.9.0))':
     dependencies:
-      '@vitest/spy': 4.1.9
+      '@vitest/spy': 4.1.10
       estree-walker: 3.0.3
       magic-string: 0.30.21
     optionalDependencies:
-      vite: 8.0.14(@types/node@26.0.1)(esbuild@0.28.1)(jiti@2.7.0)(yaml@2.9.0)
+      vite: 8.1.4(@types/node@26.1.1)(esbuild@0.28.1)(jiti@2.7.0)(yaml@2.9.0)
 
-  '@vitest/pretty-format@4.1.9':
+  '@vitest/pretty-format@4.1.10':
     dependencies:
       tinyrainbow: 3.1.0
 
-  '@vitest/runner@4.1.9':
+  '@vitest/runner@4.1.10':
     dependencies:
-      '@vitest/utils': 4.1.9
+      '@vitest/utils': 4.1.10
       pathe: 2.0.3
 
-  '@vitest/snapshot@4.1.9':
+  '@vitest/snapshot@4.1.10':
     dependencies:
-      '@vitest/pretty-format': 4.1.9
-      '@vitest/utils': 4.1.9
+      '@vitest/pretty-format': 4.1.10
+      '@vitest/utils': 4.1.10
       magic-string: 0.30.21
       pathe: 2.0.3
 
-  '@vitest/spy@4.1.9': {}
+  '@vitest/spy@4.1.10': {}
 
-  '@vitest/utils@4.1.9':
+  '@vitest/utils@4.1.10':
     dependencies:
-      '@vitest/pretty-format': 4.1.9
+      '@vitest/pretty-format': 4.1.10
       convert-source-map: 2.0.0
       tinyrainbow: 3.1.0
 
@@ -9033,9 +9378,9 @@ snapshots:
 
   acorn@8.17.0: {}
 
-  agent-base@6.0.2:
+  agent-base@6.0.2(supports-color@7.2.0):
     dependencies:
-      debug: 4.4.3
+      debug: 4.4.3(supports-color@7.2.0)
     transitivePeerDependencies:
       - supports-color
 
@@ -9046,14 +9391,21 @@ snapshots:
       clean-stack: 5.3.0
       indent-string: 5.0.0
 
-  ajv-formats@3.0.1(ajv@8.18.0):
+  ajv-formats@3.0.1(ajv@8.20.0):
     optionalDependencies:
-      ajv: 8.18.0
+      ajv: 8.20.0
 
   ajv@8.18.0:
     dependencies:
       fast-deep-equal: 3.1.3
-      fast-uri: 3.1.2
+      fast-uri: 3.1.3
+      json-schema-traverse: 1.0.0
+      require-from-string: 2.0.2
+
+  ajv@8.20.0:
+    dependencies:
+      fast-deep-equal: 3.1.3
+      fast-uri: 3.1.3
       json-schema-traverse: 1.0.0
       require-from-string: 2.0.2
 
@@ -9117,13 +9469,15 @@ snapshots:
 
   aws4@1.13.2: {}
 
-  axios@1.16.0:
+  axios@1.16.1(debug@4.4.3(supports-color@7.2.0))(supports-color@7.2.0):
     dependencies:
-      follow-redirects: 1.16.0
+      follow-redirects: 1.16.0(debug@4.4.3(supports-color@7.2.0))
       form-data: 4.0.6
+      https-proxy-agent: 5.0.1(supports-color@7.2.0)
       proxy-from-env: 2.1.0
     transitivePeerDependencies:
       - debug
+      - supports-color
 
   b4a@1.8.1: {}
 
@@ -9137,7 +9491,7 @@ snapshots:
 
   base64-js@1.5.1: {}
 
-  baseline-browser-mapping@2.10.37: {}
+  baseline-browser-mapping@2.10.43: {}
 
   bcrypt-pbkdf@1.0.2:
     dependencies:
@@ -9153,7 +9507,7 @@ snapshots:
       inherits: 2.0.4
       readable-stream: 3.6.2
 
-  body-parser@1.20.5:
+  body-parser@1.20.6:
     dependencies:
       bytes: 3.1.2
       content-type: 1.0.5
@@ -9170,15 +9524,15 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
-  body-parser@2.2.2:
+  body-parser@2.3.0:
     dependencies:
       bytes: 3.1.2
-      content-type: 1.0.5
-      debug: 4.4.3
+      content-type: 2.0.0
+      debug: 4.4.3(supports-color@7.2.0)
       http-errors: 2.0.1
-      iconv-lite: 0.7.2
+      iconv-lite: 0.7.3
       on-finished: 2.4.1
-      qs: 6.14.2
+      qs: 6.15.3
       raw-body: 3.0.2
       type-is: 2.1.0
     transitivePeerDependencies:
@@ -9186,7 +9540,7 @@ snapshots:
 
   bottleneck@2.19.5: {}
 
-  brace-expansion@2.1.1:
+  brace-expansion@2.1.2:
     dependencies:
       balanced-match: 1.0.2
 
@@ -9202,13 +9556,13 @@ snapshots:
     dependencies:
       pako: 0.2.9
 
-  browserslist@4.28.2:
+  browserslist@4.28.6:
     dependencies:
-      baseline-browser-mapping: 2.10.37
-      caniuse-lite: 1.0.30001799
-      electron-to-chromium: 1.5.363
-      node-releases: 2.0.46
-      update-browserslist-db: 1.2.3(browserslist@4.28.2)
+      baseline-browser-mapping: 2.10.43
+      caniuse-lite: 1.0.30001805
+      electron-to-chromium: 1.5.389
+      node-releases: 2.0.51
+      update-browserslist-db: 1.2.3(browserslist@4.28.6)
 
   buffer-equal-constant-time@1.0.1: {}
 
@@ -9226,7 +9580,7 @@ snapshots:
 
   bun-types@1.3.14:
     dependencies:
-      '@types/node': 26.0.1
+      '@types/node': 26.1.1
 
   bytes@3.1.2: {}
 
@@ -9254,7 +9608,7 @@ snapshots:
 
   callsites@3.1.0: {}
 
-  caniuse-lite@1.0.30001799: {}
+  caniuse-lite@1.0.30001805: {}
 
   caseless@0.12.0: {}
 
@@ -9326,10 +9680,10 @@ snapshots:
     optionalDependencies:
       '@colors/colors': 1.5.0
 
-  cli-truncate@6.1.0:
+  cli-truncate@6.1.1:
     dependencies:
       slice-ansi: 9.0.0
-      string-width: 8.2.1
+      string-width: 8.2.2
 
   client-only@0.0.1: {}
 
@@ -9471,14 +9825,14 @@ snapshots:
       object-assign: 4.1.1
       vary: 1.1.2
 
-  cosmiconfig@9.0.2(typescript@6.0.3):
+  cosmiconfig@9.0.2(typescript@7.0.2):
     dependencies:
       env-paths: 2.2.1
       import-fresh: 3.3.1
       js-yaml: 4.3.0
       parse-json: 5.2.0
     optionalDependencies:
-      typescript: 6.0.3
+      typescript: 7.0.2
 
   cross-spawn@7.0.6:
     dependencies:
@@ -9502,9 +9856,11 @@ snapshots:
     dependencies:
       ms: 2.0.0
 
-  debug@4.4.3:
+  debug@4.4.3(supports-color@7.2.0):
     dependencies:
       ms: 2.1.3
+    optionalDependencies:
+      supports-color: 7.2.0
 
   decode-named-character-reference@1.3.0:
     dependencies:
@@ -9595,22 +9951,22 @@ snapshots:
 
   ee-first@1.1.1: {}
 
-  effect@4.0.0-beta.93:
+  effect@4.0.0-beta.97:
     dependencies:
       '@standard-schema/spec': 1.1.0
-      fast-check: 4.8.0
+      fast-check: 4.9.0
       find-my-way-ts: 0.1.6
       ini: 7.0.0
       kubernetes-types: 1.30.0
-      msgpackr: 2.0.2
-      multipasta: 0.2.7
-      toml: 4.1.1
-      uuid: 14.0.0
+      msgpackr: 2.0.4
+      multipasta: 0.2.8
+      toml: 4.3.0
+      uuid: 14.0.1
       yaml: 2.9.0
 
   ejs@5.0.1: {}
 
-  electron-to-chromium@1.5.363: {}
+  electron-to-chromium@1.5.389: {}
 
   emoji-regex@10.6.0: {}
 
@@ -9649,7 +10005,7 @@ snapshots:
 
   es-errors@1.3.0: {}
 
-  es-module-lexer@2.1.0: {}
+  es-module-lexer@2.3.1: {}
 
   es-object-atoms@1.1.1:
     dependencies:
@@ -9766,11 +10122,11 @@ snapshots:
 
   events@3.3.0: {}
 
-  eventsource-parser@3.0.8: {}
+  eventsource-parser@3.1.0: {}
 
   eventsource@3.0.7:
     dependencies:
-      eventsource-parser: 3.0.8
+      eventsource-parser: 3.1.0
 
   execa@8.0.1:
     dependencies:
@@ -9799,7 +10155,7 @@ snapshots:
       strip-final-newline: 4.0.0
       yoctocolors: 2.1.2
 
-  expect-type@1.3.0: {}
+  expect-type@1.4.0: {}
 
   express-rate-limit@5.5.1: {}
 
@@ -9812,7 +10168,7 @@ snapshots:
     dependencies:
       accepts: 1.3.8
       array-flatten: 1.1.1
-      body-parser: 1.20.5
+      body-parser: 1.20.6
       content-disposition: 0.5.4
       content-type: 1.0.5
       cookie: 0.7.2
@@ -9848,7 +10204,7 @@ snapshots:
     dependencies:
       accepts: 1.3.8
       array-flatten: 1.1.1
-      body-parser: 1.20.5
+      body-parser: 1.20.6
       content-disposition: 0.5.4
       content-type: 1.0.5
       cookie: 0.7.2
@@ -9883,12 +10239,12 @@ snapshots:
   express@5.2.1:
     dependencies:
       accepts: 2.0.0
-      body-parser: 2.2.2
+      body-parser: 2.3.0
       content-disposition: 1.1.0
       content-type: 1.0.5
       cookie: 0.7.2
       cookie-signature: 1.2.2
-      debug: 4.4.3
+      debug: 4.4.3(supports-color@7.2.0)
       depd: 2.0.0
       encodeurl: 2.0.0
       escape-html: 1.0.3
@@ -9902,8 +10258,8 @@ snapshots:
       once: 1.4.0
       parseurl: 1.3.3
       proxy-addr: 2.0.7
-      qs: 6.14.2
-      range-parser: 1.2.1
+      qs: 6.15.3
+      range-parser: 1.3.0
       router: 2.2.0
       send: 1.2.1
       serve-static: 2.2.1
@@ -9917,9 +10273,9 @@ snapshots:
 
   extsprintf@1.3.0: {}
 
-  fast-check@4.8.0:
+  fast-check@4.9.0:
     dependencies:
-      pure-rand: 8.4.0
+      pure-rand: 8.4.2
 
   fast-deep-equal@3.1.3: {}
 
@@ -9941,7 +10297,7 @@ snapshots:
     dependencies:
       fast-string-truncated-width: 3.0.3
 
-  fast-uri@3.1.2: {}
+  fast-uri@3.1.3: {}
 
   fast-wrap-ansi@0.2.2:
     dependencies:
@@ -9955,9 +10311,9 @@ snapshots:
     dependencies:
       walk-up-path: 4.0.0
 
-  fdir@6.5.0(picomatch@4.0.4):
+  fdir@6.5.0(picomatch@4.0.5):
     optionalDependencies:
-      picomatch: 4.0.4
+      picomatch: 4.0.5
 
   figures@2.0.0:
     dependencies:
@@ -9989,7 +10345,7 @@ snapshots:
 
   finalhandler@2.1.1:
     dependencies:
-      debug: 4.4.3
+      debug: 4.4.3(supports-color@7.2.0)
       encodeurl: 2.0.0
       escape-html: 1.0.3
       on-finished: 2.4.1
@@ -10013,7 +10369,9 @@ snapshots:
 
   flat@5.0.2: {}
 
-  follow-redirects@1.16.0: {}
+  follow-redirects@1.16.0(debug@4.4.3(supports-color@7.2.0)):
+    optionalDependencies:
+      debug: 4.4.3(supports-color@7.2.0)
 
   forever-agent@0.6.1: {}
 
@@ -10048,7 +10406,7 @@ snapshots:
 
   fs-constants@1.0.0: {}
 
-  fs-extra@11.3.5:
+  fs-extra@11.3.6:
     dependencies:
       graceful-fs: 4.2.11
       jsonfile: 6.2.1
@@ -10057,14 +10415,13 @@ snapshots:
   fsevents@2.3.3:
     optional: true
 
-  fumadocs-core@16.10.7(@mdx-js/mdx@3.1.1)(@types/estree-jsx@1.0.5)(@types/hast@3.0.4)(@types/mdast@4.0.4)(@types/react@19.2.17)(lucide-react@1.23.0(react@19.2.7))(next@16.2.9(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(zod@4.4.3):
+  fumadocs-core@16.11.4(@mdx-js/mdx@3.1.1)(@types/estree-jsx@1.0.5)(@types/hast@3.0.5)(@types/mdast@4.0.4)(@types/react@19.2.17)(lucide-react@1.24.0(react@19.2.7))(next@16.3.0-preview.6(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(zod@4.4.3):
     dependencies:
       '@orama/orama': 3.1.18
       estree-util-value-to-estree: 3.5.0
       github-slugger: 2.0.0
       hast-util-to-estree: 3.1.3
       hast-util-to-jsx-runtime: 2.3.6
-      js-yaml: 5.2.1
       mdast-util-mdx: 3.0.0
       mdast-util-to-markdown: 2.1.2
       remark: 15.0.1
@@ -10076,29 +10433,30 @@ snapshots:
       unified: 11.0.5
       unist-util-visit: 5.1.0
       vfile: 6.0.3
+      yaml: 2.9.0
     optionalDependencies:
       '@mdx-js/mdx': 3.1.1
       '@types/estree-jsx': 1.0.5
-      '@types/hast': 3.0.4
+      '@types/hast': 3.0.5
       '@types/mdast': 4.0.4
       '@types/react': 19.2.17
-      lucide-react: 1.23.0(react@19.2.7)
-      next: 16.2.9(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      lucide-react: 1.24.0(react@19.2.7)
+      next: 16.3.0-preview.6(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
       react: 19.2.7
       react-dom: 19.2.7(react@19.2.7)
       zod: 4.4.3
     transitivePeerDependencies:
       - supports-color
 
-  fumadocs-mdx@15.0.13(@types/mdast@4.0.4)(@types/mdx@2.0.14)(@types/react@19.2.17)(fumadocs-core@16.10.7(@mdx-js/mdx@3.1.1)(@types/estree-jsx@1.0.5)(@types/hast@3.0.4)(@types/mdast@4.0.4)(@types/react@19.2.17)(lucide-react@1.23.0(react@19.2.7))(next@16.2.9(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(zod@4.4.3))(next@16.2.9(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react@19.2.7)(rolldown@1.0.2)(vite@8.0.14(@types/node@26.0.1)(esbuild@0.28.1)(jiti@2.7.0)(yaml@2.9.0)):
+  fumadocs-mdx@15.1.1(@types/mdast@4.0.4)(@types/mdx@2.0.14)(@types/react@19.2.17)(fumadocs-core@16.11.4(@mdx-js/mdx@3.1.1)(@types/estree-jsx@1.0.5)(@types/hast@3.0.5)(@types/mdast@4.0.4)(@types/react@19.2.17)(lucide-react@1.24.0(react@19.2.7))(next@16.3.0-preview.6(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(zod@4.4.3))(next@16.3.0-preview.6(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react@19.2.7)(rolldown@1.1.5)(vite@8.1.4(@types/node@26.1.1)(esbuild@0.28.1)(jiti@2.7.0)(yaml@2.9.0)):
     dependencies:
       '@mdx-js/mdx': 3.1.1
       '@standard-schema/spec': 1.1.0
       chokidar: 5.0.0
       esbuild: 0.28.1
       estree-util-value-to-estree: 3.5.0
-      fumadocs-core: 16.10.7(@mdx-js/mdx@3.1.1)(@types/estree-jsx@1.0.5)(@types/hast@3.0.4)(@types/mdast@4.0.4)(@types/react@19.2.17)(lucide-react@1.23.0(react@19.2.7))(next@16.2.9(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(zod@4.4.3)
-      js-yaml: 5.2.1
+      fumadocs-core: 16.11.4(@mdx-js/mdx@3.1.1)(@types/estree-jsx@1.0.5)(@types/hast@3.0.5)(@types/mdast@4.0.4)(@types/react@19.2.17)(lucide-react@1.24.0(react@19.2.7))(next@16.3.0-preview.6(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(zod@4.4.3)
+      github-slugger: 2.0.0
       mdast-util-mdx: 3.0.0
       picocolors: 1.1.1
       picomatch: 4.0.5
@@ -10108,22 +10466,23 @@ snapshots:
       unist-util-remove-position: 5.0.0
       unist-util-visit: 5.1.0
       vfile: 6.0.3
+      yaml: 2.9.0
       zod: 4.4.3
     optionalDependencies:
       '@types/mdast': 4.0.4
       '@types/mdx': 2.0.14
       '@types/react': 19.2.17
-      next: 16.2.9(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      next: 16.3.0-preview.6(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
       react: 19.2.7
-      rolldown: 1.0.2
-      vite: 8.0.14(@types/node@26.0.1)(esbuild@0.28.1)(jiti@2.7.0)(yaml@2.9.0)
+      rolldown: 1.1.5
+      vite: 8.1.4(@types/node@26.1.1)(esbuild@0.28.1)(jiti@2.7.0)(yaml@2.9.0)
     transitivePeerDependencies:
       - supports-color
 
-  fumadocs-ui@16.10.7(@types/mdx@2.0.14)(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(fumadocs-core@16.10.7(@mdx-js/mdx@3.1.1)(@types/estree-jsx@1.0.5)(@types/hast@3.0.4)(@types/mdast@4.0.4)(@types/react@19.2.17)(lucide-react@1.23.0(react@19.2.7))(next@16.2.9(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(zod@4.4.3))(next@16.2.9(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7):
+  fumadocs-ui@16.11.4(@types/mdx@2.0.14)(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(fumadocs-core@16.11.4(@mdx-js/mdx@3.1.1)(@types/estree-jsx@1.0.5)(@types/hast@3.0.5)(@types/mdast@4.0.4)(@types/react@19.2.17)(lucide-react@1.24.0(react@19.2.7))(next@16.3.0-preview.6(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(zod@4.4.3))(next@16.3.0-preview.6(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7):
     dependencies:
       '@fuma-translate/react': 1.0.2(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@fumadocs/tailwind': 0.0.5
+      '@fumadocs/tailwind': 0.1.1
       '@radix-ui/react-accordion': 1.2.16(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
       '@radix-ui/react-collapsible': 1.1.16(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
       '@radix-ui/react-dialog': 1.1.19(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
@@ -10136,8 +10495,8 @@ snapshots:
       '@radix-ui/react-tabs': 1.1.17(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
       class-variance-authority: 0.7.1
       cnfast: 0.0.8
-      fumadocs-core: 16.10.7(@mdx-js/mdx@3.1.1)(@types/estree-jsx@1.0.5)(@types/hast@3.0.4)(@types/mdast@4.0.4)(@types/react@19.2.17)(lucide-react@1.23.0(react@19.2.7))(next@16.2.9(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(zod@4.4.3)
-      lucide-react: 1.23.0(react@19.2.7)
+      fumadocs-core: 16.11.4(@mdx-js/mdx@3.1.1)(@types/estree-jsx@1.0.5)(@types/hast@3.0.5)(@types/mdast@4.0.4)(@types/react@19.2.17)(lucide-react@1.24.0(react@19.2.7))(next@16.3.0-preview.6(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(zod@4.4.3)
+      lucide-react: 1.24.0(react@19.2.7)
       motion: 12.42.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
       next-themes: 0.4.6(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
       react: 19.2.7
@@ -10150,10 +10509,9 @@ snapshots:
     optionalDependencies:
       '@types/mdx': 2.0.14
       '@types/react': 19.2.17
-      next: 16.2.9(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      next: 16.3.0-preview.6(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
     transitivePeerDependencies:
       - '@emotion/is-prop-valid'
-      - '@tailwindcss/oxide'
       - '@types/react-dom'
       - tailwindcss
 
@@ -10289,7 +10647,7 @@ snapshots:
 
   hast-util-from-parse5@8.0.3:
     dependencies:
-      '@types/hast': 3.0.4
+      '@types/hast': 3.0.5
       '@types/unist': 3.0.3
       devlop: 1.1.0
       hastscript: 9.0.1
@@ -10300,13 +10658,13 @@ snapshots:
 
   hast-util-parse-selector@4.0.0:
     dependencies:
-      '@types/hast': 3.0.4
+      '@types/hast': 3.0.5
 
   hast-util-raw@9.1.0:
     dependencies:
-      '@types/hast': 3.0.4
+      '@types/hast': 3.0.5
       '@types/unist': 3.0.3
-      '@ungap/structured-clone': 1.3.2
+      '@ungap/structured-clone': 1.3.3
       hast-util-from-parse5: 8.0.3
       hast-util-to-parse5: 8.0.1
       html-void-elements: 3.0.0
@@ -10322,7 +10680,7 @@ snapshots:
     dependencies:
       '@types/estree': 1.0.9
       '@types/estree-jsx': 1.0.5
-      '@types/hast': 3.0.4
+      '@types/hast': 3.0.5
       comma-separated-tokens: 2.0.3
       devlop: 1.1.0
       estree-util-attach-comments: 3.0.0
@@ -10341,7 +10699,7 @@ snapshots:
 
   hast-util-to-html@9.0.5:
     dependencies:
-      '@types/hast': 3.0.4
+      '@types/hast': 3.0.5
       '@types/unist': 3.0.3
       ccount: 2.0.1
       comma-separated-tokens: 2.0.3
@@ -10356,7 +10714,7 @@ snapshots:
   hast-util-to-jsx-runtime@2.3.6:
     dependencies:
       '@types/estree': 1.0.9
-      '@types/hast': 3.0.4
+      '@types/hast': 3.0.5
       '@types/unist': 3.0.3
       comma-separated-tokens: 2.0.3
       devlop: 1.1.0
@@ -10375,7 +10733,7 @@ snapshots:
 
   hast-util-to-parse5@8.0.1:
     dependencies:
-      '@types/hast': 3.0.4
+      '@types/hast': 3.0.5
       comma-separated-tokens: 2.0.3
       devlop: 1.1.0
       property-information: 7.2.0
@@ -10385,11 +10743,11 @@ snapshots:
 
   hast-util-whitespace@3.0.0:
     dependencies:
-      '@types/hast': 3.0.4
+      '@types/hast': 3.0.5
 
   hastscript@9.0.1:
     dependencies:
-      '@types/hast': 3.0.4
+      '@types/hast': 3.0.5
       comma-separated-tokens: 2.0.3
       hast-util-parse-selector: 4.0.0
       property-information: 7.2.0
@@ -10397,7 +10755,7 @@ snapshots:
 
   highlight.js@10.7.3: {}
 
-  hono@4.12.21: {}
+  hono@4.12.30: {}
 
   hook-std@4.0.0: {}
 
@@ -10407,7 +10765,7 @@ snapshots:
 
   hosted-git-info@9.0.3:
     dependencies:
-      lru-cache: 11.5.1
+      lru-cache: 11.5.2
 
   html-escaper@2.0.2: {}
 
@@ -10426,7 +10784,7 @@ snapshots:
   http-proxy-agent@9.1.0:
     dependencies:
       agent-base: 9.0.0
-      debug: 4.4.3
+      debug: 4.4.3(supports-color@7.2.0)
       proxy-agent-negotiate: 1.1.0
     transitivePeerDependencies:
       - kerberos
@@ -10445,17 +10803,17 @@ snapshots:
       quick-lru: 5.1.1
       resolve-alpn: 1.2.1
 
-  https-proxy-agent@5.0.1:
+  https-proxy-agent@5.0.1(supports-color@7.2.0):
     dependencies:
-      agent-base: 6.0.2
-      debug: 4.4.3
+      agent-base: 6.0.2(supports-color@7.2.0)
+      debug: 4.4.3(supports-color@7.2.0)
     transitivePeerDependencies:
       - supports-color
 
   https-proxy-agent@9.1.0:
     dependencies:
       agent-base: 9.0.0
-      debug: 4.4.3
+      debug: 4.4.3(supports-color@7.2.0)
       proxy-agent-negotiate: 1.1.0
     transitivePeerDependencies:
       - kerberos
@@ -10471,7 +10829,7 @@ snapshots:
     dependencies:
       safer-buffer: 2.1.2
 
-  iconv-lite@0.7.2:
+  iconv-lite@0.7.3:
     dependencies:
       safer-buffer: 2.1.2
 
@@ -10488,7 +10846,7 @@ snapshots:
 
   import-from-esm@2.0.0:
     dependencies:
-      debug: 4.4.3
+      debug: 4.4.3(supports-color@7.2.0)
       import-meta-resolve: 4.2.0
     transitivePeerDependencies:
       - supports-color
@@ -10520,7 +10878,7 @@ snapshots:
       chalk: 5.6.2
       cli-boxes: 4.0.1
       cli-cursor: 4.0.0
-      cli-truncate: 6.1.0
+      cli-truncate: 6.1.1
       code-excerpt: 4.0.0
       es-toolkit: 1.49.0
       indent-string: 5.0.0
@@ -10532,9 +10890,9 @@ snapshots:
       signal-exit: 3.0.7
       slice-ansi: 9.0.0
       stack-utils: 2.0.6
-      string-width: 8.2.1
+      string-width: 8.2.2
       terminal-size: 4.0.1
-      type-fest: 5.7.0
+      type-fest: 5.8.0
       widest-line: 6.0.0
       wrap-ansi: 10.0.0
       ws: 8.21.0
@@ -10548,11 +10906,11 @@ snapshots:
 
   inline-style-parser@0.2.7: {}
 
-  ioredis@5.11.0:
+  ioredis@5.11.1:
     dependencies:
       '@ioredis/commands': 1.10.0
       cluster-key-slot: 1.1.1
-      debug: 4.4.3
+      debug: 4.4.3(supports-color@7.2.0)
       denque: 2.1.0
       redis-errors: 1.2.0
       redis-parser: 3.0.0
@@ -10666,10 +11024,6 @@ snapshots:
     dependencies:
       argparse: 2.0.1
 
-  js-yaml@5.2.1:
-    dependencies:
-      argparse: 2.0.1
-
   jsbn@0.1.1: {}
 
   jsesc@3.1.0: {}
@@ -10693,7 +11047,7 @@ snapshots:
 
   json-stringify-safe@5.0.1: {}
 
-  json-with-bigint@3.5.8: {}
+  json-with-bigint@3.5.10: {}
 
   json5@2.2.3: {}
 
@@ -10742,15 +11096,15 @@ snapshots:
     dependencies:
       json-buffer: 3.0.1
 
-  knip@6.23.0:
+  knip@6.26.0:
     dependencies:
-      fdir: 6.5.0(picomatch@4.0.4)
+      fdir: 6.5.0(picomatch@4.0.5)
       formatly: 0.3.0
       get-tsconfig: 4.14.0
       jiti: 2.7.0
       oxc-parser: 0.137.0
       oxc-resolver: 11.21.3
-      picomatch: 4.0.4
+      picomatch: 4.0.5
       smol-toml: 1.7.0
       strip-json-comments: 5.0.3
       tinyglobby: 0.2.17
@@ -10872,7 +11226,7 @@ snapshots:
 
   lru-cache@10.4.3: {}
 
-  lru-cache@11.5.1: {}
+  lru-cache@11.5.2: {}
 
   lru-cache@5.1.1:
     dependencies:
@@ -10880,7 +11234,7 @@ snapshots:
 
   lru-cache@7.18.3: {}
 
-  lucide-react@1.23.0(react@19.2.7):
+  lucide-react@1.24.0(react@19.2.7):
     dependencies:
       react: 19.2.7
 
@@ -11007,7 +11361,7 @@ snapshots:
   mdast-util-mdx-expression@2.0.1:
     dependencies:
       '@types/estree-jsx': 1.0.5
-      '@types/hast': 3.0.4
+      '@types/hast': 3.0.5
       '@types/mdast': 4.0.4
       devlop: 1.1.0
       mdast-util-from-markdown: 2.0.3
@@ -11018,7 +11372,7 @@ snapshots:
   mdast-util-mdx-jsx@3.2.0:
     dependencies:
       '@types/estree-jsx': 1.0.5
-      '@types/hast': 3.0.4
+      '@types/hast': 3.0.5
       '@types/mdast': 4.0.4
       '@types/unist': 3.0.3
       ccount: 2.0.1
@@ -11045,7 +11399,7 @@ snapshots:
   mdast-util-mdxjs-esm@2.0.1:
     dependencies:
       '@types/estree-jsx': 1.0.5
-      '@types/hast': 3.0.4
+      '@types/hast': 3.0.5
       '@types/mdast': 4.0.4
       devlop: 1.1.0
       mdast-util-from-markdown: 2.0.3
@@ -11060,9 +11414,9 @@ snapshots:
 
   mdast-util-to-hast@13.2.1:
     dependencies:
-      '@types/hast': 3.0.4
+      '@types/hast': 3.0.5
       '@types/mdast': 4.0.4
-      '@ungap/structured-clone': 1.3.2
+      '@ungap/structured-clone': 1.3.3
       devlop: 1.1.0
       micromark-util-sanitize-uri: 2.0.1
       trim-lines: 3.0.1
@@ -11347,7 +11701,7 @@ snapshots:
   micromark@4.0.2:
     dependencies:
       '@types/debug': 4.1.13
-      debug: 4.4.3
+      debug: 4.4.3(supports-color@7.2.0)
       decode-named-character-reference: 1.3.0
       devlop: 1.1.0
       micromark-core-commonmark: 2.0.3
@@ -11403,7 +11757,7 @@ snapshots:
 
   minimatch@7.4.9:
     dependencies:
-      brace-expansion: 2.1.1
+      brace-expansion: 2.1.2
 
   minimist@1.2.8: {}
 
@@ -11439,11 +11793,11 @@ snapshots:
       '@msgpackr-extract/msgpackr-extract-win32-x64': 3.0.4
     optional: true
 
-  msgpackr@2.0.2:
+  msgpackr@2.0.4:
     optionalDependencies:
       msgpackr-extract: 3.0.4
 
-  multipasta@0.2.7: {}
+  multipasta@0.2.8: {}
 
   mz@2.7.0:
     dependencies:
@@ -11451,9 +11805,7 @@ snapshots:
       object-assign: 4.1.1
       thenify-all: 1.6.0
 
-  nanoid@3.3.12: {}
-
-  nanoid@3.3.15: {}
+  nanoid@3.3.16: {}
 
   negotiator@0.6.3: {}
 
@@ -11470,25 +11822,25 @@ snapshots:
       react: 19.2.7
       react-dom: 19.2.7(react@19.2.7)
 
-  next@16.2.9(react-dom@19.2.7(react@19.2.7))(react@19.2.7):
+  next@16.3.0-preview.6(react-dom@19.2.7(react@19.2.7))(react@19.2.7):
     dependencies:
-      '@next/env': 16.2.9
+      '@next/env': 16.3.0-preview.6
       '@swc/helpers': 0.5.15
-      baseline-browser-mapping: 2.10.37
-      caniuse-lite: 1.0.30001799
-      postcss: 8.4.31
+      baseline-browser-mapping: 2.10.43
+      caniuse-lite: 1.0.30001805
+      postcss: 8.5.10
       react: 19.2.7
       react-dom: 19.2.7(react@19.2.7)
       styled-jsx: 5.1.6(react@19.2.7)
     optionalDependencies:
-      '@next/swc-darwin-arm64': 16.2.9
-      '@next/swc-darwin-x64': 16.2.9
-      '@next/swc-linux-arm64-gnu': 16.2.9
-      '@next/swc-linux-arm64-musl': 16.2.9
-      '@next/swc-linux-x64-gnu': 16.2.9
-      '@next/swc-linux-x64-musl': 16.2.9
-      '@next/swc-win32-arm64-msvc': 16.2.9
-      '@next/swc-win32-x64-msvc': 16.2.9
+      '@next/swc-darwin-arm64': 16.3.0-preview.6
+      '@next/swc-darwin-x64': 16.3.0-preview.6
+      '@next/swc-linux-arm64-gnu': 16.3.0-preview.6
+      '@next/swc-linux-arm64-musl': 16.3.0-preview.6
+      '@next/swc-linux-x64-gnu': 16.3.0-preview.6
+      '@next/swc-linux-x64-musl': 16.3.0-preview.6
+      '@next/swc-win32-arm64-msvc': 16.3.0-preview.6
+      '@next/swc-win32-x64-msvc': 16.3.0-preview.6
       sharp: 0.34.5
     transitivePeerDependencies:
       - '@babel/core'
@@ -11512,7 +11864,7 @@ snapshots:
       detect-libc: 2.1.2
     optional: true
 
-  node-releases@2.0.46: {}
+  node-releases@2.0.51: {}
 
   normalize-package-data@6.0.2:
     dependencies:
@@ -11543,9 +11895,9 @@ snapshots:
       path-key: 4.0.0
       unicorn-magic: 0.3.0
 
-  npm@11.17.0: {}
+  npm@11.18.0: {}
 
-  nx@23.0.1(@swc-node/register@1.11.1(@swc/core@1.15.43)(@swc/types@0.1.27)(typescript@6.0.3))(@swc/core@1.15.43):
+  nx@23.1.0(@swc-node/register@1.11.1(@swc/core@1.15.43)(@swc/types@0.1.27)(@typescript/typescript6@6.0.2))(@swc/core@1.15.43):
     dependencies:
       '@emnapi/core': 1.4.5
       '@emnapi/runtime': 1.4.5
@@ -11555,12 +11907,13 @@ snapshots:
       '@tybys/wasm-util': 0.9.0
       '@yarnpkg/lockfile': 1.1.0
       '@zkochan/js-yaml': 0.0.7
+      agent-base: 6.0.2(supports-color@7.2.0)
       ansi-colors: 4.1.3
       ansi-regex: 5.0.1
       ansi-styles: 4.3.0
       argparse: 2.0.1
       asynckit: 0.4.0
-      axios: 1.16.0
+      axios: 1.16.1(debug@4.4.3(supports-color@7.2.0))(supports-color@7.2.0)
       balanced-match: 4.0.3
       base64-js: 1.5.1
       bl: 4.1.0
@@ -11575,6 +11928,7 @@ snapshots:
       color-convert: 2.0.1
       color-name: 1.1.4
       combined-stream: 1.0.8
+      debug: 4.4.3(supports-color@7.2.0)
       defaults: 1.0.4
       define-lazy-prop: 2.0.0
       delayed-stream: 1.0.0
@@ -11593,7 +11947,7 @@ snapshots:
       escape-string-regexp: 1.0.5
       figures: 3.2.0
       flat: 5.0.2
-      follow-redirects: 1.16.0
+      follow-redirects: 1.16.0(debug@4.4.3(supports-color@7.2.0))
       form-data: 4.0.6
       fs-constants: 1.0.0
       function-bind: 1.1.2
@@ -11605,6 +11959,7 @@ snapshots:
       has-symbols: 1.1.0
       has-tostringtag: 1.0.2
       hasown: 2.0.4
+      https-proxy-agent: 5.0.1(supports-color@7.2.0)
       ieee754: 1.2.1
       ignore: 7.0.5
       inherits: 2.0.4
@@ -11624,6 +11979,7 @@ snapshots:
       mimic-fn: 2.1.0
       minimatch: 10.2.5
       minimist: 1.2.8
+      ms: 2.1.3
       npm-run-path: 4.0.1
       once: 1.4.0
       onetime: 5.1.2
@@ -11637,7 +11993,7 @@ snapshots:
       resolve.exports: 2.0.3
       restore-cursor: 3.1.0
       safe-buffer: 5.2.1
-      semver: 7.7.4
+      semver: 7.8.4
       signal-exit: 3.0.7
       smol-toml: 1.6.1
       string-width: 4.2.3
@@ -11659,20 +12015,18 @@ snapshots:
       yargs: 17.7.2
       yargs-parser: 21.1.1
     optionalDependencies:
-      '@nx/nx-darwin-arm64': 23.0.1
-      '@nx/nx-darwin-x64': 23.0.1
-      '@nx/nx-freebsd-x64': 23.0.1
-      '@nx/nx-linux-arm-gnueabihf': 23.0.1
-      '@nx/nx-linux-arm64-gnu': 23.0.1
-      '@nx/nx-linux-arm64-musl': 23.0.1
-      '@nx/nx-linux-x64-gnu': 23.0.1
-      '@nx/nx-linux-x64-musl': 23.0.1
-      '@nx/nx-win32-arm64-msvc': 23.0.1
-      '@nx/nx-win32-x64-msvc': 23.0.1
-      '@swc-node/register': 1.11.1(@swc/core@1.15.43)(@swc/types@0.1.27)(typescript@6.0.3)
+      '@nx/nx-darwin-arm64': 23.1.0
+      '@nx/nx-darwin-x64': 23.1.0
+      '@nx/nx-freebsd-x64': 23.1.0
+      '@nx/nx-linux-arm-gnueabihf': 23.1.0
+      '@nx/nx-linux-arm64-gnu': 23.1.0
+      '@nx/nx-linux-arm64-musl': 23.1.0
+      '@nx/nx-linux-x64-gnu': 23.1.0
+      '@nx/nx-linux-x64-musl': 23.1.0
+      '@nx/nx-win32-arm64-msvc': 23.1.0
+      '@nx/nx-win32-x64-msvc': 23.1.0
+      '@swc-node/register': 1.11.1(@swc/core@1.15.43)(@swc/types@0.1.27)(@typescript/typescript6@6.0.2)
       '@swc/core': 1.15.43
-    transitivePeerDependencies:
-      - debug
 
   object-assign@4.1.1: {}
 
@@ -11680,7 +12034,7 @@ snapshots:
 
   obuf@1.1.2: {}
 
-  obug@2.1.1: {}
+  obug@2.1.3: {}
 
   on-exit-leak-free@2.1.2: {}
 
@@ -11721,7 +12075,7 @@ snapshots:
       bl: 4.1.0
       chalk: 4.1.2
       cli-cursor: 3.1.0
-      cli-spinners: 2.9.2
+      cli-spinners: 2.6.1
       is-interactive: 1.0.0
       is-unicode-supported: 0.1.0
       log-symbols: 4.1.0
@@ -11775,61 +12129,83 @@ snapshots:
       '@oxc-resolver/binding-win32-arm64-msvc': 11.21.3
       '@oxc-resolver/binding-win32-x64-msvc': 11.21.3
 
-  oxfmt@0.57.0:
+  oxc-resolver@11.24.2:
+    optionalDependencies:
+      '@oxc-resolver/binding-android-arm-eabi': 11.24.2
+      '@oxc-resolver/binding-android-arm64': 11.24.2
+      '@oxc-resolver/binding-darwin-arm64': 11.24.2
+      '@oxc-resolver/binding-darwin-x64': 11.24.2
+      '@oxc-resolver/binding-freebsd-x64': 11.24.2
+      '@oxc-resolver/binding-linux-arm-gnueabihf': 11.24.2
+      '@oxc-resolver/binding-linux-arm-musleabihf': 11.24.2
+      '@oxc-resolver/binding-linux-arm64-gnu': 11.24.2
+      '@oxc-resolver/binding-linux-arm64-musl': 11.24.2
+      '@oxc-resolver/binding-linux-ppc64-gnu': 11.24.2
+      '@oxc-resolver/binding-linux-riscv64-gnu': 11.24.2
+      '@oxc-resolver/binding-linux-riscv64-musl': 11.24.2
+      '@oxc-resolver/binding-linux-s390x-gnu': 11.24.2
+      '@oxc-resolver/binding-linux-x64-gnu': 11.24.2
+      '@oxc-resolver/binding-linux-x64-musl': 11.24.2
+      '@oxc-resolver/binding-openharmony-arm64': 11.24.2
+      '@oxc-resolver/binding-wasm32-wasi': 11.24.2
+      '@oxc-resolver/binding-win32-arm64-msvc': 11.24.2
+      '@oxc-resolver/binding-win32-x64-msvc': 11.24.2
+
+  oxfmt@0.58.0:
     dependencies:
       tinypool: 2.1.0
     optionalDependencies:
-      '@oxfmt/binding-android-arm-eabi': 0.57.0
-      '@oxfmt/binding-android-arm64': 0.57.0
-      '@oxfmt/binding-darwin-arm64': 0.57.0
-      '@oxfmt/binding-darwin-x64': 0.57.0
-      '@oxfmt/binding-freebsd-x64': 0.57.0
-      '@oxfmt/binding-linux-arm-gnueabihf': 0.57.0
-      '@oxfmt/binding-linux-arm-musleabihf': 0.57.0
-      '@oxfmt/binding-linux-arm64-gnu': 0.57.0
-      '@oxfmt/binding-linux-arm64-musl': 0.57.0
-      '@oxfmt/binding-linux-ppc64-gnu': 0.57.0
-      '@oxfmt/binding-linux-riscv64-gnu': 0.57.0
-      '@oxfmt/binding-linux-riscv64-musl': 0.57.0
-      '@oxfmt/binding-linux-s390x-gnu': 0.57.0
-      '@oxfmt/binding-linux-x64-gnu': 0.57.0
-      '@oxfmt/binding-linux-x64-musl': 0.57.0
-      '@oxfmt/binding-openharmony-arm64': 0.57.0
-      '@oxfmt/binding-win32-arm64-msvc': 0.57.0
-      '@oxfmt/binding-win32-ia32-msvc': 0.57.0
-      '@oxfmt/binding-win32-x64-msvc': 0.57.0
-
-  oxlint-tsgolint@0.23.0:
+      '@oxfmt/binding-android-arm-eabi': 0.58.0
+      '@oxfmt/binding-android-arm64': 0.58.0
+      '@oxfmt/binding-darwin-arm64': 0.58.0
+      '@oxfmt/binding-darwin-x64': 0.58.0
+      '@oxfmt/binding-freebsd-x64': 0.58.0
+      '@oxfmt/binding-linux-arm-gnueabihf': 0.58.0
+      '@oxfmt/binding-linux-arm-musleabihf': 0.58.0
+      '@oxfmt/binding-linux-arm64-gnu': 0.58.0
+      '@oxfmt/binding-linux-arm64-musl': 0.58.0
+      '@oxfmt/binding-linux-ppc64-gnu': 0.58.0
+      '@oxfmt/binding-linux-riscv64-gnu': 0.58.0
+      '@oxfmt/binding-linux-riscv64-musl': 0.58.0
+      '@oxfmt/binding-linux-s390x-gnu': 0.58.0
+      '@oxfmt/binding-linux-x64-gnu': 0.58.0
+      '@oxfmt/binding-linux-x64-musl': 0.58.0
+      '@oxfmt/binding-openharmony-arm64': 0.58.0
+      '@oxfmt/binding-win32-arm64-msvc': 0.58.0
+      '@oxfmt/binding-win32-ia32-msvc': 0.58.0
+      '@oxfmt/binding-win32-x64-msvc': 0.58.0
+
+  oxlint-tsgolint@0.24.0:
     optionalDependencies:
-      '@oxlint-tsgolint/darwin-arm64': 0.23.0
-      '@oxlint-tsgolint/darwin-x64': 0.23.0
-      '@oxlint-tsgolint/linux-arm64': 0.23.0
-      '@oxlint-tsgolint/linux-x64': 0.23.0
-      '@oxlint-tsgolint/win32-arm64': 0.23.0
-      '@oxlint-tsgolint/win32-x64': 0.23.0
-
-  oxlint@1.73.0(oxlint-tsgolint@0.23.0):
+      '@oxlint-tsgolint/darwin-arm64': 0.24.0
+      '@oxlint-tsgolint/darwin-x64': 0.24.0
+      '@oxlint-tsgolint/linux-arm64': 0.24.0
+      '@oxlint-tsgolint/linux-x64': 0.24.0
+      '@oxlint-tsgolint/win32-arm64': 0.24.0
+      '@oxlint-tsgolint/win32-x64': 0.24.0
+
+  oxlint@1.74.0(oxlint-tsgolint@0.24.0):
     optionalDependencies:
-      '@oxlint/binding-android-arm-eabi': 1.73.0
-      '@oxlint/binding-android-arm64': 1.73.0
-      '@oxlint/binding-darwin-arm64': 1.73.0
-      '@oxlint/binding-darwin-x64': 1.73.0
-      '@oxlint/binding-freebsd-x64': 1.73.0
-      '@oxlint/binding-linux-arm-gnueabihf': 1.73.0
-      '@oxlint/binding-linux-arm-musleabihf': 1.73.0
-      '@oxlint/binding-linux-arm64-gnu': 1.73.0
-      '@oxlint/binding-linux-arm64-musl': 1.73.0
-      '@oxlint/binding-linux-ppc64-gnu': 1.73.0
-      '@oxlint/binding-linux-riscv64-gnu': 1.73.0
-      '@oxlint/binding-linux-riscv64-musl': 1.73.0
-      '@oxlint/binding-linux-s390x-gnu': 1.73.0
-      '@oxlint/binding-linux-x64-gnu': 1.73.0
-      '@oxlint/binding-linux-x64-musl': 1.73.0
-      '@oxlint/binding-openharmony-arm64': 1.73.0
-      '@oxlint/binding-win32-arm64-msvc': 1.73.0
-      '@oxlint/binding-win32-ia32-msvc': 1.73.0
-      '@oxlint/binding-win32-x64-msvc': 1.73.0
-      oxlint-tsgolint: 0.23.0
+      '@oxlint/binding-android-arm-eabi': 1.74.0
+      '@oxlint/binding-android-arm64': 1.74.0
+      '@oxlint/binding-darwin-arm64': 1.74.0
+      '@oxlint/binding-darwin-x64': 1.74.0
+      '@oxlint/binding-freebsd-x64': 1.74.0
+      '@oxlint/binding-linux-arm-gnueabihf': 1.74.0
+      '@oxlint/binding-linux-arm-musleabihf': 1.74.0
+      '@oxlint/binding-linux-arm64-gnu': 1.74.0
+      '@oxlint/binding-linux-arm64-musl': 1.74.0
+      '@oxlint/binding-linux-ppc64-gnu': 1.74.0
+      '@oxlint/binding-linux-riscv64-gnu': 1.74.0
+      '@oxlint/binding-linux-riscv64-musl': 1.74.0
+      '@oxlint/binding-linux-s390x-gnu': 1.74.0
+      '@oxlint/binding-linux-x64-gnu': 1.74.0
+      '@oxlint/binding-linux-x64-musl': 1.74.0
+      '@oxlint/binding-openharmony-arm64': 1.74.0
+      '@oxlint/binding-win32-arm64-msvc': 1.74.0
+      '@oxlint/binding-win32-ia32-msvc': 1.74.0
+      '@oxlint/binding-win32-x64-msvc': 1.74.0
+      oxlint-tsgolint: 0.24.0
 
   p-cancelable@2.1.1: {}
 
@@ -11841,7 +12217,7 @@ snapshots:
 
   p-filter@4.1.0:
     dependencies:
-      p-map: 7.0.4
+      p-map: 7.0.5
 
   p-limit@1.3.0:
     dependencies:
@@ -11851,7 +12227,7 @@ snapshots:
     dependencies:
       p-limit: 1.3.0
 
-  p-map@7.0.4: {}
+  p-map@7.0.5: {}
 
   p-reduce@3.0.0: {}
 
@@ -11936,13 +12312,11 @@ snapshots:
   pg-cloudflare@1.4.0:
     optional: true
 
-  pg-connection-string@2.12.0: {}
-
   pg-connection-string@2.14.0: {}
 
   pg-copy-streams@7.0.0: {}
 
-  pg-cursor@2.20.0(pg@8.22.0):
+  pg-cursor@2.21.0(pg@8.22.0):
     dependencies:
       pg: 8.22.0
 
@@ -11954,8 +12328,6 @@ snapshots:
     dependencies:
       pg: 8.22.0
 
-  pg-protocol@1.14.0: {}
-
   pg-protocol@1.15.0: {}
 
   pg-types@2.2.0:
@@ -11994,8 +12366,6 @@ snapshots:
 
   picomatch@2.3.2: {}
 
-  picomatch@4.0.4: {}
-
   picomatch@4.0.5: {}
 
   pify@3.0.0: {}
@@ -12036,15 +12406,15 @@ snapshots:
 
   pkg-pr-new@0.0.75: {}
 
-  postcss@8.4.31:
+  postcss@8.5.10:
     dependencies:
-      nanoid: 3.3.12
+      nanoid: 3.3.16
       picocolors: 1.1.1
       source-map-js: 1.2.1
 
-  postcss@8.5.16:
+  postcss@8.5.19:
     dependencies:
-      nanoid: 3.3.15
+      nanoid: 3.3.16
       picocolors: 1.1.1
       source-map-js: 1.2.1
 
@@ -12070,9 +12440,9 @@ snapshots:
 
   postgres-range@1.1.4: {}
 
-  posthog-node@5.38.8:
+  posthog-node@5.41.0:
     dependencies:
-      '@posthog/core': 1.39.6
+      '@posthog/core': 1.40.2
 
   pretty-ms@9.3.0:
     dependencies:
@@ -12115,7 +12485,7 @@ snapshots:
       inherits: 2.0.4
       pump: 2.0.1
 
-  pure-rand@8.4.0: {}
+  pure-rand@8.4.2: {}
 
   qs@6.14.2:
     dependencies:
@@ -12134,6 +12504,8 @@ snapshots:
 
   range-parser@1.2.1: {}
 
+  range-parser@1.3.0: {}
+
   raw-body@2.5.3:
     dependencies:
       bytes: 3.1.2
@@ -12145,7 +12517,7 @@ snapshots:
     dependencies:
       bytes: 3.1.2
       http-errors: 2.0.1
-      iconv-lite: 0.7.2
+      iconv-lite: 0.7.3
       unpipe: 1.0.0
 
   rc@1.2.8:
@@ -12157,7 +12529,7 @@ snapshots:
 
   react-devtools-core@7.0.1:
     dependencies:
-      shell-quote: 1.8.4
+      shell-quote: 1.10.0
       ws: 7.5.11
     transitivePeerDependencies:
       - bufferutil
@@ -12212,14 +12584,14 @@ snapshots:
     dependencies:
       find-up-simple: 1.0.1
       read-pkg: 10.1.0
-      type-fest: 5.7.0
+      type-fest: 5.8.0
 
   read-pkg@10.1.0:
     dependencies:
       '@types/normalize-package-data': 2.4.4
       normalize-package-data: 8.0.0
       parse-json: 8.3.0
-      type-fest: 5.7.0
+      type-fest: 5.8.0
       unicorn-magic: 0.4.0
 
   read-pkg@9.0.1:
@@ -12309,14 +12681,14 @@ snapshots:
 
   rehype-raw@7.0.0:
     dependencies:
-      '@types/hast': 3.0.4
+      '@types/hast': 3.0.5
       hast-util-raw: 9.1.0
       vfile: 6.0.3
 
   rehype-recma@1.0.0:
     dependencies:
       '@types/estree': 1.0.9
-      '@types/hast': 3.0.4
+      '@types/hast': 3.0.5
       hast-util-to-estree: 3.1.3
     transitivePeerDependencies:
       - supports-color
@@ -12350,7 +12722,7 @@ snapshots:
 
   remark-rehype@11.1.2:
     dependencies:
-      '@types/hast': 3.0.4
+      '@types/hast': 3.0.5
       '@types/mdast': 4.0.4
       mdast-util-to-hast: 13.2.1
       unified: 11.0.5
@@ -12401,30 +12773,30 @@ snapshots:
 
   reusify@1.1.0: {}
 
-  rolldown@1.0.2:
+  rolldown@1.1.5:
     dependencies:
-      '@oxc-project/types': 0.132.0
+      '@oxc-project/types': 0.139.0
       '@rolldown/pluginutils': 1.0.1
     optionalDependencies:
-      '@rolldown/binding-android-arm64': 1.0.2
-      '@rolldown/binding-darwin-arm64': 1.0.2
-      '@rolldown/binding-darwin-x64': 1.0.2
-      '@rolldown/binding-freebsd-x64': 1.0.2
-      '@rolldown/binding-linux-arm-gnueabihf': 1.0.2
-      '@rolldown/binding-linux-arm64-gnu': 1.0.2
-      '@rolldown/binding-linux-arm64-musl': 1.0.2
-      '@rolldown/binding-linux-ppc64-gnu': 1.0.2
-      '@rolldown/binding-linux-s390x-gnu': 1.0.2
-      '@rolldown/binding-linux-x64-gnu': 1.0.2
-      '@rolldown/binding-linux-x64-musl': 1.0.2
-      '@rolldown/binding-openharmony-arm64': 1.0.2
-      '@rolldown/binding-wasm32-wasi': 1.0.2
-      '@rolldown/binding-win32-arm64-msvc': 1.0.2
-      '@rolldown/binding-win32-x64-msvc': 1.0.2
+      '@rolldown/binding-android-arm64': 1.1.5
+      '@rolldown/binding-darwin-arm64': 1.1.5
+      '@rolldown/binding-darwin-x64': 1.1.5
+      '@rolldown/binding-freebsd-x64': 1.1.5
+      '@rolldown/binding-linux-arm-gnueabihf': 1.1.5
+      '@rolldown/binding-linux-arm64-gnu': 1.1.5
+      '@rolldown/binding-linux-arm64-musl': 1.1.5
+      '@rolldown/binding-linux-ppc64-gnu': 1.1.5
+      '@rolldown/binding-linux-s390x-gnu': 1.1.5
+      '@rolldown/binding-linux-x64-gnu': 1.1.5
+      '@rolldown/binding-linux-x64-musl': 1.1.5
+      '@rolldown/binding-openharmony-arm64': 1.1.5
+      '@rolldown/binding-wasm32-wasi': 1.1.5
+      '@rolldown/binding-win32-arm64-msvc': 1.1.5
+      '@rolldown/binding-win32-x64-msvc': 1.1.5
 
   router@2.2.0:
     dependencies:
-      debug: 4.4.3
+      debug: 4.4.3(supports-color@7.2.0)
       depd: 2.0.0
       is-promise: 4.0.0
       parseurl: 1.3.3
@@ -12454,16 +12826,16 @@ snapshots:
     dependencies:
       compute-scroll-into-view: 3.1.1
 
-  semantic-release@25.0.5(typescript@6.0.3):
+  semantic-release@25.0.7(typescript@7.0.2):
     dependencies:
-      '@semantic-release/commit-analyzer': 13.0.1(semantic-release@25.0.5(typescript@6.0.3))
+      '@semantic-release/commit-analyzer': 13.0.1(semantic-release@25.0.7(typescript@7.0.2))
       '@semantic-release/error': 4.0.0
-      '@semantic-release/github': 12.0.8(semantic-release@25.0.5(typescript@6.0.3))
-      '@semantic-release/npm': 13.1.5(semantic-release@25.0.5(typescript@6.0.3))
-      '@semantic-release/release-notes-generator': 14.1.1(semantic-release@25.0.5(typescript@6.0.3))
+      '@semantic-release/github': 12.0.9(semantic-release@25.0.7(typescript@7.0.2))
+      '@semantic-release/npm': 13.1.5(semantic-release@25.0.7(typescript@7.0.2))
+      '@semantic-release/release-notes-generator': 14.1.1(semantic-release@25.0.7(typescript@7.0.2))
       aggregate-error: 5.0.0
-      cosmiconfig: 9.0.2(typescript@6.0.3)
-      debug: 4.4.3
+      cosmiconfig: 9.0.2(typescript@7.0.2)
+      debug: 4.4.3(supports-color@7.2.0)
       env-ci: 11.2.0
       execa: 9.6.1
       figures: 6.1.0
@@ -12481,7 +12853,7 @@ snapshots:
       p-reduce: 3.0.0
       read-package-up: 12.0.0
       resolve-from: 5.0.0
-      semver: 7.8.4
+      semver: 7.8.5
       signale: 1.4.0
       yargs: 18.0.0
     transitivePeerDependencies:
@@ -12495,8 +12867,6 @@ snapshots:
 
   semver@7.7.4: {}
 
-  semver@7.8.2: {}
-
   semver@7.8.4: {}
 
   semver@7.8.5: {}
@@ -12521,7 +12891,7 @@ snapshots:
 
   send@1.2.1:
     dependencies:
-      debug: 4.4.3
+      debug: 4.4.3(supports-color@7.2.0)
       encodeurl: 2.0.0
       escape-html: 1.0.3
       etag: 1.8.1
@@ -12530,7 +12900,7 @@ snapshots:
       mime-types: 3.0.2
       ms: 2.1.3
       on-finished: 2.4.1
-      range-parser: 1.2.1
+      range-parser: 1.3.0
       statuses: 2.0.2
     transitivePeerDependencies:
       - supports-color
@@ -12593,7 +12963,7 @@ snapshots:
 
   shebang-regex@3.0.0: {}
 
-  shell-quote@1.8.4: {}
+  shell-quote@1.10.0: {}
 
   shiki@4.3.1:
     dependencies:
@@ -12604,7 +12974,7 @@ snapshots:
       '@shikijs/themes': 4.3.1
       '@shikijs/types': 4.3.1
       '@shikijs/vscode-textmate': 10.0.2
-      '@types/hast': 3.0.4
+      '@types/hast': 3.0.5
 
   side-channel-list@1.0.1:
     dependencies:
@@ -12733,7 +13103,7 @@ snapshots:
 
   statuses@2.0.2: {}
 
-  std-env@4.1.0: {}
+  std-env@4.2.0: {}
 
   steno@0.4.4:
     dependencies:
@@ -12767,7 +13137,7 @@ snapshots:
       get-east-asian-width: 1.6.0
       strip-ansi: 7.2.0
 
-  string-width@8.2.1:
+  string-width@8.2.2:
     dependencies:
       get-east-asian-width: 1.6.0
       strip-ansi: 7.2.0
@@ -12900,8 +13270,8 @@ snapshots:
 
   tinyglobby@0.2.17:
     dependencies:
-      fdir: 6.5.0(picomatch@4.0.4)
-      picomatch: 4.0.4
+      fdir: 6.5.0(picomatch@4.0.5)
+      picomatch: 4.0.5
 
   tinypool@2.1.0: {}
 
@@ -12909,15 +13279,15 @@ snapshots:
 
   tldts-core@6.1.86: {}
 
-  tldts-core@7.4.5: {}
+  tldts-core@7.4.8: {}
 
   tldts@6.1.86:
     dependencies:
       tldts-core: 6.1.86
 
-  tldts@7.4.5:
+  tldts@7.4.8:
     dependencies:
-      tldts-core: 7.4.5
+      tldts-core: 7.4.8
 
   tmp@0.2.7: {}
 
@@ -12927,7 +13297,7 @@ snapshots:
 
   toidentifier@1.0.1: {}
 
-  toml@4.1.1: {}
+  toml@4.3.0: {}
 
   tough-cookie@5.1.2:
     dependencies:
@@ -12971,7 +13341,7 @@ snapshots:
 
   type-fest@4.41.0: {}
 
-  type-fest@5.7.0:
+  type-fest@5.8.0:
     dependencies:
       tagged-tag: 1.0.0
 
@@ -12988,20 +13358,41 @@ snapshots:
 
   typescript@6.0.3: {}
 
+  typescript@7.0.2:
+    optionalDependencies:
+      '@typescript/typescript-aix-ppc64': 7.0.2
+      '@typescript/typescript-darwin-arm64': 7.0.2
+      '@typescript/typescript-darwin-x64': 7.0.2
+      '@typescript/typescript-freebsd-arm64': 7.0.2
+      '@typescript/typescript-freebsd-x64': 7.0.2
+      '@typescript/typescript-linux-arm': 7.0.2
+      '@typescript/typescript-linux-arm64': 7.0.2
+      '@typescript/typescript-linux-loong64': 7.0.2
+      '@typescript/typescript-linux-mips64el': 7.0.2
+      '@typescript/typescript-linux-ppc64': 7.0.2
+      '@typescript/typescript-linux-riscv64': 7.0.2
+      '@typescript/typescript-linux-s390x': 7.0.2
+      '@typescript/typescript-linux-x64': 7.0.2
+      '@typescript/typescript-netbsd-arm64': 7.0.2
+      '@typescript/typescript-netbsd-x64': 7.0.2
+      '@typescript/typescript-openbsd-arm64': 7.0.2
+      '@typescript/typescript-openbsd-x64': 7.0.2
+      '@typescript/typescript-sunos-x64': 7.0.2
+      '@typescript/typescript-win32-arm64': 7.0.2
+      '@typescript/typescript-win32-x64': 7.0.2
+
   uglify-js@3.19.3:
     optional: true
 
   unbash@4.0.2: {}
 
-  undici-types@7.24.6: {}
-
   undici-types@8.3.0: {}
 
   undici@6.27.0: {}
 
   undici@7.28.0: {}
 
-  undici@8.5.0: {}
+  undici@8.7.0: {}
 
   unicode-emoji-modifier-base@1.0.0: {}
 
@@ -13065,9 +13456,9 @@ snapshots:
 
   unpipe@1.0.0: {}
 
-  update-browserslist-db@1.2.3(browserslist@4.28.2):
+  update-browserslist-db@1.2.3(browserslist@4.28.6):
     dependencies:
-      browserslist: 4.28.2
+      browserslist: 4.28.6
       escalade: 3.2.0
       picocolors: 1.1.1
 
@@ -13094,7 +13485,7 @@ snapshots:
 
   utils-merge@1.0.1: {}
 
-  uuid@14.0.0: {}
+  uuid@14.0.1: {}
 
   uuid@8.3.2: {}
 
@@ -13112,7 +13503,7 @@ snapshots:
       '@verdaccio/config': 8.1.2
       '@verdaccio/core': 8.1.2
       express: 4.22.1
-      https-proxy-agent: 5.0.1
+      https-proxy-agent: 5.0.1(supports-color@7.2.0)
       node-fetch: 2.6.7
     transitivePeerDependencies:
       - encoding
@@ -13124,19 +13515,19 @@ snapshots:
       '@verdaccio/file-locking': 13.0.1
       apache-md5: 1.1.8
       bcryptjs: 2.4.3
-      debug: 4.4.3
+      debug: 4.4.3(supports-color@7.2.0)
       http-errors: 2.0.1
       unix-crypt-td-js: 1.1.4
     transitivePeerDependencies:
       - supports-color
 
-  verdaccio@6.7.4(typanion@3.14.0):
+  verdaccio@6.8.0(typanion@3.14.0):
     dependencies:
       '@cypress/request': 3.0.10
       '@verdaccio/auth': 8.0.4
       '@verdaccio/config': 8.1.2
       '@verdaccio/core': 8.1.2
-      '@verdaccio/hooks': 8.0.3
+      '@verdaccio/hooks': 8.0.4
       '@verdaccio/loaders': 8.0.3
       '@verdaccio/local-storage-legacy': 11.3.4
       '@verdaccio/logger': 8.0.3
@@ -13146,7 +13537,7 @@ snapshots:
       '@verdaccio/signature': 8.0.3
       '@verdaccio/streams': 10.2.5
       '@verdaccio/tarball': 13.0.3
-      '@verdaccio/ui-theme': 9.0.0-next-9.20
+      '@verdaccio/ui-theme': 9.0.0-next-9.21
       '@verdaccio/url': 13.0.3
       '@verdaccio/utils': 8.1.3
       JSONStream: 1.3.5
@@ -13154,13 +13545,13 @@ snapshots:
       clipanion: 4.0.0-rc.4(typanion@3.14.0)
       compression: 1.8.1
       cors: 2.8.6
-      debug: 4.4.3
+      debug: 4.4.3(supports-color@7.2.0)
       envinfo: 7.21.0
       express: 4.22.2
       lodash: 4.18.1
       lru-cache: 7.18.3
       mime: 3.0.0
-      semver: 7.8.2
+      semver: 7.8.5
       verdaccio-audit: 13.0.3
       verdaccio-htpasswd: 13.0.3
     transitivePeerDependencies:
@@ -13191,45 +13582,45 @@ snapshots:
       '@types/unist': 3.0.3
       vfile-message: 4.0.3
 
-  vite@8.0.14(@types/node@26.0.1)(esbuild@0.28.1)(jiti@2.7.0)(yaml@2.9.0):
+  vite@8.1.4(@types/node@26.1.1)(esbuild@0.28.1)(jiti@2.7.0)(yaml@2.9.0):
     dependencies:
       lightningcss: 1.32.0
       picomatch: 4.0.5
-      postcss: 8.5.16
-      rolldown: 1.0.2
+      postcss: 8.5.19
+      rolldown: 1.1.5
       tinyglobby: 0.2.17
     optionalDependencies:
-      '@types/node': 26.0.1
+      '@types/node': 26.1.1
       esbuild: 0.28.1
       fsevents: 2.3.3
       jiti: 2.7.0
       yaml: 2.9.0
 
-  vitest@4.1.9(@types/node@26.0.1)(@vitest/coverage-istanbul@4.1.9)(vite@8.0.14(@types/node@26.0.1)(esbuild@0.28.1)(jiti@2.7.0)(yaml@2.9.0)):
-    dependencies:
-      '@vitest/expect': 4.1.9
-      '@vitest/mocker': 4.1.9(vite@8.0.14(@types/node@26.0.1)(esbuild@0.28.1)(jiti@2.7.0)(yaml@2.9.0))
-      '@vitest/pretty-format': 4.1.9
-      '@vitest/runner': 4.1.9
-      '@vitest/snapshot': 4.1.9
-      '@vitest/spy': 4.1.9
-      '@vitest/utils': 4.1.9
-      es-module-lexer: 2.1.0
-      expect-type: 1.3.0
+  vitest@4.1.10(@types/node@26.1.1)(@vitest/coverage-istanbul@4.1.10)(vite@8.1.4(@types/node@26.1.1)(esbuild@0.28.1)(jiti@2.7.0)(yaml@2.9.0)):
+    dependencies:
+      '@vitest/expect': 4.1.10
+      '@vitest/mocker': 4.1.10(vite@8.1.4(@types/node@26.1.1)(esbuild@0.28.1)(jiti@2.7.0)(yaml@2.9.0))
+      '@vitest/pretty-format': 4.1.10
+      '@vitest/runner': 4.1.10
+      '@vitest/snapshot': 4.1.10
+      '@vitest/spy': 4.1.10
+      '@vitest/utils': 4.1.10
+      es-module-lexer: 2.3.1
+      expect-type: 1.4.0
       magic-string: 0.30.21
-      obug: 2.1.1
+      obug: 2.1.3
       pathe: 2.0.3
-      picomatch: 4.0.4
-      std-env: 4.1.0
+      picomatch: 4.0.5
+      std-env: 4.2.0
       tinybench: 2.9.0
       tinyexec: 1.2.4
       tinyglobby: 0.2.17
       tinyrainbow: 3.1.0
-      vite: 8.0.14(@types/node@26.0.1)(esbuild@0.28.1)(jiti@2.7.0)(yaml@2.9.0)
+      vite: 8.1.4(@types/node@26.1.1)(esbuild@0.28.1)(jiti@2.7.0)(yaml@2.9.0)
       why-is-node-running: 2.3.0
     optionalDependencies:
-      '@types/node': 26.0.1
-      '@vitest/coverage-istanbul': 4.1.9(vitest@4.1.9)
+      '@types/node': 26.1.1
+      '@vitest/coverage-istanbul': 4.1.10(vitest@4.1.10)
     transitivePeerDependencies:
       - msw
 
@@ -13265,14 +13656,14 @@ snapshots:
 
   widest-line@6.0.0:
     dependencies:
-      string-width: 8.2.1
+      string-width: 8.2.2
 
   wordwrap@1.0.0: {}
 
   wrap-ansi@10.0.0:
     dependencies:
       ansi-styles: 6.2.3
-      string-width: 8.2.1
+      string-width: 8.2.2
       strip-ansi: 7.2.0
 
   wrap-ansi@7.0.0:
diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml
index d42a59a931..42ff83fbac 100644
--- a/pnpm-workspace.yaml
+++ b/pnpm-workspace.yaml
@@ -12,30 +12,33 @@ allowBuilds:
   sharp: true
 
 catalog:
-  "@effect/atom-react": "4.0.0-beta.93"
-  "@effect/platform-bun": "4.0.0-beta.93"
-  "@effect/platform-node": "4.0.0-beta.93"
-  "@effect/sql-pg": "4.0.0-beta.93"
-  "@effect/vitest": "^4.0.0-beta.93"
-  "@nx/devkit": "^23.0.0"
+  "@effect/atom-react": "4.0.0-beta.97"
+  "@effect/platform-bun": "4.0.0-beta.97"
+  "@effect/platform-node": "4.0.0-beta.97"
+  "@effect/sql-pg": "4.0.0-beta.97"
+  "@effect/vitest": "4.0.0-beta.97"
+  "@nx/devkit": "^23.0.2"
   "@swc-node/register": "^1.10.9"
   "@swc/core": "^1.15.43"
   "@tsconfig/bun": "^1.0.10"
   "@types/bun": "^1.3.14"
-  "@typescript/native-preview": "7.0.0-dev.20260629.1"
-  "@vitest/coverage-istanbul": "^4.1.9"
-  "effect": "4.0.0-beta.93"
-  "knip": "^6.17.1"
-  "nx": "^23.0.0"
-  "oxfmt": "^0.57.0"
+  "@typescript/native-preview": "7.0.0-dev.20260707.2"
+  "@vitest/coverage-istanbul": "^4.1.10"
+  "effect": "4.0.0-beta.97"
+  "knip": "^6.26.0"
+  "nx": "^23.0.2"
+  "oxfmt": "^0.58.0"
   "oxlint": "^1.72.0"
-  "oxlint-tsgolint": "^0.23.0"
-  "tldts": "^7.4.5"
-  "vitest": "^4.1.9"
+  "oxlint-tsgolint": "^0.24.0"
+  "tldts": "^7.4.8"
+  "vitest": "^4.1.10"
 
 blockExoticSubdeps: true
 
-minimumReleaseAge: 0
+overrides:
+  "@effect/platform-node-shared": "4.0.0-beta.97"
+
+minimumReleaseAge: 10200
 
 supportedArchitectures:
   cpu:
diff --git a/tools/nx-plugins/package.json b/tools/nx-plugins/package.json
index 875f079ca7..10615425b1 100644
--- a/tools/nx-plugins/package.json
+++ b/tools/nx-plugins/package.json
@@ -3,6 +3,7 @@
   "private": true,
   "dependencies": {
     "@nx/devkit": "catalog:",
+    "typescript": "npm:@typescript/typescript6@^6.0.2",
     "vitest": "catalog:"
   }
 }
diff --git a/tools/release/local-registry.ts b/tools/release/local-registry.ts
index 9f1ed524de..695cdc43fb 100644
--- a/tools/release/local-registry.ts
+++ b/tools/release/local-registry.ts
@@ -5,11 +5,13 @@
  *
  * - Starts Verdaccio on http://localhost:4873
  * - Creates a local publish user and stores the auth token in tmp/verdaccio-token
- * - Redirects the global npm and pnpm registry config to the local registry
- * - Restores the original registry config and kills Verdaccio on Ctrl+C / SIGTERM
+ * - Kills Verdaccio on Ctrl+C / SIGTERM / SIGHUP
+ *
+ * Global npm/pnpm registry config is never modified — everything that talks to
+ * the local registry passes --registry explicitly (see local-release.ts), so a
+ * crash or hard kill cannot leave the developer's machine pointed at localhost.
  */
 
-import { $ } from "bun";
 import { openSync } from "node:fs";
 import { mkdir, rm, writeFile } from "node:fs/promises";
 import path from "node:path";
@@ -80,15 +82,6 @@ async function createUser(): Promise<string> {
 	return body.token;
 }
 
-async function getRegistryConfig(tool: "npm" | "pnpm"): Promise<string> {
-	try {
-		const value = (await $`${tool} config get registry`.quiet().text()).trim();
-		return value === "undefined" ? "https://registry.npmjs.org/" : value;
-	} catch {
-		return "https://registry.npmjs.org/";
-	}
-}
-
 async function main() {
 	if (await isPortInUse()) {
 		console.error(`\nError: Something is already running on port ${PORT}.`);
@@ -134,13 +127,6 @@ async function main() {
 	const token = await createUser();
 	await writeFile(tokenPath, token, "utf-8");
 
-	// Capture current global registry settings so we can restore them on exit.
-	const origNpm = await getRegistryConfig("npm");
-	const origPnpm = await getRegistryConfig("pnpm");
-
-	await $`npm config set registry ${REGISTRY}`.quiet();
-	await $`pnpm config set registry ${REGISTRY}`.quiet();
-
 	console.log(`
   Registry : ${REGISTRY}
   Token    : ${tokenPath}
@@ -150,28 +136,21 @@ async function main() {
     pnpm cli-release --next
     pnpm cli-release --legacy
 
-  Press Ctrl+C to stop and restore the original registry settings.
+  Global npm/pnpm registry config is untouched — pass --registry ${REGISTRY}
+  to npx / npm install when testing the published package.
+
+  Press Ctrl+C to stop.
 `);
 
-	const cleanup = async () => {
-		process.stdout.write("\nShutting down local registry...");
-		try {
-			await $`npm config set registry ${origNpm}`.quiet();
-			await $`pnpm config set registry ${origPnpm}`.quiet();
-			process.stdout.write(" registry restored.\n");
-		} catch {
-			process.stdout.write(
-				"\nWarning: could not restore registry config — run:\n" +
-					`  npm config set registry ${origNpm}\n` +
-					`  pnpm config set registry ${origPnpm}\n`,
-			);
-		}
+	const cleanup = () => {
+		process.stdout.write("\nShutting down local registry...\n");
 		proc.kill();
 		process.exit(0);
 	};
 
 	process.on("SIGINT", cleanup);
 	process.on("SIGTERM", cleanup);
+	process.on("SIGHUP", cleanup);
 
 	// Block until a signal is received.
 	await new Promise<never>(() => {});