From 1639c247f41857494d0eabfd1ab870895e2a3295 Mon Sep 17 00:00:00 2001 From: Alex Metelli Date: Fri, 19 Jun 2026 03:43:32 +0800 Subject: [PATCH 01/12] fix(cli): respect SUPABASE_HOME for token fallback --- apps/cli-go/internal/utils/access_token.go | 7 +++---- .../internal/utils/access_token_test.go | 19 ++++++++++++++++++ apps/cli-go/internal/utils/supabase_home.go | 20 +++++++++++++++++++ 3 files changed, 42 insertions(+), 4 deletions(-) create mode 100644 apps/cli-go/internal/utils/supabase_home.go diff --git a/apps/cli-go/internal/utils/access_token.go b/apps/cli-go/internal/utils/access_token.go index 6d1c06b704..fb6ddc4af7 100644 --- a/apps/cli-go/internal/utils/access_token.go +++ b/apps/cli-go/internal/utils/access_token.go @@ -130,10 +130,9 @@ func fallbackDeleteToken(fsys afero.Fs) error { } func getAccessTokenPath() (string, error) { - home, err := os.UserHomeDir() + home, err := SupabaseHomeDir() if err != nil { - return "", errors.Errorf("failed to get $HOME directory: %w", err) + return "", err } - // TODO: fallback to workdir - return filepath.Join(home, ".supabase", AccessTokenKey), nil + return filepath.Join(home, AccessTokenKey), nil } diff --git a/apps/cli-go/internal/utils/access_token_test.go b/apps/cli-go/internal/utils/access_token_test.go index 77743d30d8..c829113fea 100644 --- a/apps/cli-go/internal/utils/access_token_test.go +++ b/apps/cli-go/internal/utils/access_token_test.go @@ -2,6 +2,7 @@ package utils import ( "os" + "path/filepath" "testing" "github.com/spf13/afero" @@ -130,6 +131,24 @@ func TestSaveTokenFallback(t *testing.T) { assert.Equal(t, []byte(token), contents) }) + t.Run("fallback saves to SUPABASE_HOME when configured", func(t *testing.T) { + t.Setenv("HOME", "/home/test") + t.Setenv("SUPABASE_HOME", "/custom/supabase") + // Setup in-memory fs + fsys := afero.NewMemMapFs() + // Run test + assert.NoError(t, fallbackSaveToken(token, fsys)) + // Validate saved token + configuredPath := filepath.Join("/custom/supabase", AccessTokenKey) + contents, err := afero.ReadFile(fsys, configuredPath) + assert.NoError(t, err) + assert.Equal(t, []byte(token), contents) + defaultPath := filepath.Join("/home/test", ".supabase", AccessTokenKey) + exists, err := afero.Exists(fsys, defaultPath) + assert.NoError(t, err) + assert.False(t, exists) + }) + t.Run("throws error on home dir failure", func(t *testing.T) { // Setup in-memory fs fsys := afero.NewReadOnlyFs(afero.NewMemMapFs()) diff --git a/apps/cli-go/internal/utils/supabase_home.go b/apps/cli-go/internal/utils/supabase_home.go new file mode 100644 index 0000000000..7f3963fdcb --- /dev/null +++ b/apps/cli-go/internal/utils/supabase_home.go @@ -0,0 +1,20 @@ +package utils + +import ( + "os" + "path/filepath" + "strings" + + "github.com/go-errors/errors" +) + +func SupabaseHomeDir() (string, error) { + if home := strings.TrimSpace(os.Getenv("SUPABASE_HOME")); home != "" { + return home, nil + } + home, err := os.UserHomeDir() + if err != nil { + return "", errors.Errorf("failed to get $HOME directory: %w", err) + } + return filepath.Join(home, ".supabase"), nil +} From 5eed902b6bffa425c0f67d86e4dd63f5e3817933 Mon Sep 17 00:00:00 2001 From: Alex Metelli Date: Fri, 19 Jun 2026 03:44:56 +0800 Subject: [PATCH 02/12] fix(cli): respect SUPABASE_HOME for profile fallback --- apps/cli-go/internal/utils/profile.go | 7 +++---- apps/cli-go/internal/utils/profile_test.go | 20 ++++++++++++++++++++ 2 files changed, 23 insertions(+), 4 deletions(-) diff --git a/apps/cli-go/internal/utils/profile.go b/apps/cli-go/internal/utils/profile.go index e9495a481b..4b24870271 100644 --- a/apps/cli-go/internal/utils/profile.go +++ b/apps/cli-go/internal/utils/profile.go @@ -3,7 +3,6 @@ package utils import ( "context" "fmt" - "os" "path/filepath" "sort" "strings" @@ -136,11 +135,11 @@ func getProfileName(fsys afero.Fs) string { } func getProfilePath() (string, error) { - home, err := os.UserHomeDir() + home, err := SupabaseHomeDir() if err != nil { - return "", errors.Errorf("failed to get $HOME directory: %w", err) + return "", err } - return filepath.Join(home, ".supabase", "profile"), nil + return filepath.Join(home, "profile"), nil } func SaveProfileName(prof string, fsys afero.Fs) error { diff --git a/apps/cli-go/internal/utils/profile_test.go b/apps/cli-go/internal/utils/profile_test.go index c3ebcf39d8..4c5925e2d4 100644 --- a/apps/cli-go/internal/utils/profile_test.go +++ b/apps/cli-go/internal/utils/profile_test.go @@ -4,6 +4,7 @@ import ( "context" "embed" "os" + "path/filepath" "testing" "github.com/go-playground/validator/v10" @@ -76,3 +77,22 @@ func TestLoadProfile(t *testing.T) { assert.ErrorIs(t, err, os.ErrNotExist) }) } + +func TestSaveProfileName(t *testing.T) { + t.Run("saves to SUPABASE_HOME when configured", func(t *testing.T) { + t.Setenv("HOME", "/home/test") + t.Setenv("SUPABASE_HOME", "/custom/supabase") + // Setup in-memory fs + fsys := afero.NewMemMapFs() + // Run test + err := SaveProfileName("supabase-staging", fsys) + // Check error + assert.NoError(t, err) + contents, err := afero.ReadFile(fsys, filepath.Join("/custom/supabase", "profile")) + assert.NoError(t, err) + assert.Equal(t, "supabase-staging", string(contents)) + exists, err := afero.Exists(fsys, filepath.Join("/home/test", ".supabase", "profile")) + assert.NoError(t, err) + assert.False(t, exists) + }) +} From ac6b77f876c69f4a7bafc8060f92adbb491addeb Mon Sep 17 00:00:00 2001 From: Alex Metelli Date: Fri, 19 Jun 2026 03:45:23 +0800 Subject: [PATCH 03/12] fix(cli): respect SUPABASE_HOME for deno cache --- apps/cli-go/internal/utils/deno.go | 4 ++-- apps/cli-go/internal/utils/deno_test.go | 13 +++++++++++++ 2 files changed, 15 insertions(+), 2 deletions(-) diff --git a/apps/cli-go/internal/utils/deno.go b/apps/cli-go/internal/utils/deno.go index 86d12da0d0..79786c0b56 100644 --- a/apps/cli-go/internal/utils/deno.go +++ b/apps/cli-go/internal/utils/deno.go @@ -40,7 +40,7 @@ func GetDenoPath() (string, error) { if len(DenoPathOverride) > 0 { return DenoPathOverride, nil } - home, err := os.UserHomeDir() + home, err := SupabaseHomeDir() if err != nil { return "", err } @@ -48,7 +48,7 @@ func GetDenoPath() (string, error) { if runtime.GOOS == "windows" { denoBinName = "deno.exe" } - denoPath := filepath.Join(home, ".supabase", denoBinName) + denoPath := filepath.Join(home, denoBinName) return denoPath, nil } diff --git a/apps/cli-go/internal/utils/deno_test.go b/apps/cli-go/internal/utils/deno_test.go index c5b140a8f7..1c104870d7 100644 --- a/apps/cli-go/internal/utils/deno_test.go +++ b/apps/cli-go/internal/utils/deno_test.go @@ -64,6 +64,19 @@ func TestGetDenoPath(t *testing.T) { assert.NoError(t, err) assert.Equal(t, expected, path) }) + + t.Run("returns SUPABASE_HOME path when configured", func(t *testing.T) { + t.Setenv("SUPABASE_HOME", "/custom/supabase") + expected := filepath.Join("/custom/supabase", "deno") + if runtime.GOOS == "windows" { + expected += ".exe" + } + + path, err := GetDenoPath() + + assert.NoError(t, err) + assert.Equal(t, expected, path) + }) } func TestIsScriptModified(t *testing.T) { From ab20dfe7c439c5725b1abee68b32273ec32eed5e Mon Sep 17 00:00:00 2001 From: Alex Metelli Date: Fri, 19 Jun 2026 03:47:50 +0800 Subject: [PATCH 04/12] fix(cli): respect SUPABASE_HOME in legacy paths --- .../legacy/auth/legacy-credentials.layer.ts | 5 +-- .../legacy-credentials.layer.unit.test.ts | 36 +++++++++++++++++++ .../legacy/config/legacy-cli-config.layer.ts | 2 +- .../legacy-cli-config.layer.unit.test.ts | 13 +++++++ .../src/legacy/config/legacy-profile-file.ts | 25 ++++++++++--- 5 files changed, 73 insertions(+), 8 deletions(-) diff --git a/apps/cli/src/legacy/auth/legacy-credentials.layer.ts b/apps/cli/src/legacy/auth/legacy-credentials.layer.ts index 66bf62d07e..8a67e478e6 100644 --- a/apps/cli/src/legacy/auth/legacy-credentials.layer.ts +++ b/apps/cli/src/legacy/auth/legacy-credentials.layer.ts @@ -4,6 +4,7 @@ import { RuntimeInfo } from "../../shared/runtime/runtime-info.service.ts"; import { normalizeKeyringToken } from "../../shared/auth/keyring-token.ts"; import { LegacyDebugLogger } from "../shared/legacy-debug-logger.service.ts"; import { LegacyCliConfig } from "../config/legacy-cli-config.service.ts"; +import { legacySupabaseHome } from "../config/legacy-profile-file.ts"; import { LEGACY_ACCESS_TOKEN_PATTERN, validateLegacyAccessToken } from "./legacy-access-token.ts"; import { LegacyCredentials } from "./legacy-credentials.service.ts"; import { @@ -318,8 +319,8 @@ const makeLegacyCredentials = Effect.gen(function* () { const debugLogger = yield* LegacyDebugLogger; const profileAccount = cliConfig.profile; - // ~/.supabase/access-token — fallback file path - const fallbackDir = path.join(runtimeInfo.homeDir, ".supabase"); + // /access-token — fallback file path + const fallbackDir = legacySupabaseHome(path, runtimeInfo.homeDir, process.env); const fallbackPath = path.join(fallbackDir, "access-token"); // `SUPABASE_NO_KEYRING=1` disables the OS keyring entirely (matches `next/`'s diff --git a/apps/cli/src/legacy/auth/legacy-credentials.layer.unit.test.ts b/apps/cli/src/legacy/auth/legacy-credentials.layer.unit.test.ts index 805b5631d9..890f9d2118 100644 --- a/apps/cli/src/legacy/auth/legacy-credentials.layer.unit.test.ts +++ b/apps/cli/src/legacy/auth/legacy-credentials.layer.unit.test.ts @@ -256,6 +256,17 @@ describe("legacyCredentialsLayer.getAccessToken", () => { }).pipe(Effect.provide(makeLayer())); }); + it.effect("falls back to SUPABASE_HOME/access-token when configured", () => { + const supabaseHome = join(tempHome, "custom-supabase-home"); + mkdirSync(supabaseHome, { recursive: true }); + writeFileSync(join(supabaseHome, "access-token"), `${VALID_TOKEN}\n`, { mode: 0o600 }); + return Effect.gen(function* () { + const { getAccessToken } = yield* LegacyCredentials; + const token = yield* getAccessToken; + expectSomeToken(token, VALID_TOKEN); + }).pipe(Effect.provide(makeLayer({ env: { SUPABASE_HOME: supabaseHome } }))); + }); + it.effect("returns None when no source provides a token", () => Effect.gen(function* () { const { getAccessToken } = yield* LegacyCredentials; @@ -342,6 +353,18 @@ describe("legacyCredentialsLayer.saveAccessToken", () => { expect(content).toBe(VALID_TOKEN); }).pipe(Effect.provide(makeLayer())); }); + + it.effect("falls back to SUPABASE_HOME/access-token when configured", () => { + throwOnSetPassword = true; + const supabaseHome = join(tempHome, "custom-supabase-home"); + return Effect.gen(function* () { + const { saveAccessToken } = yield* LegacyCredentials; + yield* saveAccessToken(VALID_TOKEN); + const content = readFileSync(join(supabaseHome, "access-token"), "utf-8"); + expect(content).toBe(VALID_TOKEN); + expect(existsSync(join(tempHome, ".supabase", "access-token"))).toBe(false); + }).pipe(Effect.provide(makeLayer({ env: { SUPABASE_HOME: supabaseHome } }))); + }); }); // Go's `utils.DeleteAccessToken` (`access_token.go:100-119`) collapses three @@ -369,6 +392,19 @@ describe("legacyCredentialsLayer.deleteAccessToken", () => { }).pipe(Effect.provide(makeLayer())); }); + it.effect("logged in via keyring profile entry → deletes SUPABASE_HOME file", () => { + const supabaseHome = join(tempHome, "custom-supabase-home"); + mkdirSync(supabaseHome, { recursive: true }); + writeFileSync(join(supabaseHome, "access-token"), VALID_TOKEN, { mode: 0o600 }); + passwords.set("Supabase CLI/supabase", VALID_TOKEN); + return Effect.gen(function* () { + const { deleteAccessToken } = yield* LegacyCredentials; + yield* deleteAccessToken; + expect(passwords.has("Supabase CLI/supabase")).toBe(false); + expect(existsSync(join(supabaseHome, "access-token"))).toBe(false); + }).pipe(Effect.provide(makeLayer({ env: { SUPABASE_HOME: supabaseHome } }))); + }); + it.effect( "keyring profile entry absent → LegacyNotLoggedInError even though the file was removed", () => { diff --git a/apps/cli/src/legacy/config/legacy-cli-config.layer.ts b/apps/cli/src/legacy/config/legacy-cli-config.layer.ts index 70ec567d30..84f8062c42 100644 --- a/apps/cli/src/legacy/config/legacy-cli-config.layer.ts +++ b/apps/cli/src/legacy/config/legacy-cli-config.layer.ts @@ -108,7 +108,7 @@ function resolveProfile( } else { // Lowest precedence: the persisted `~/.supabase/profile` file (Go's // `getProfileName` file fallback, `profile.go:129-131`). - const filePath = legacyProfileFilePath(path, homeDir); + const filePath = legacyProfileFilePath(path, homeDir, process.env); const content = yield* fs.readFileString(filePath).pipe( Effect.tap(() => debugLogger.debug(`Loading profile from file: ${filePath}`)), Effect.map(Option.some), diff --git a/apps/cli/src/legacy/config/legacy-cli-config.layer.unit.test.ts b/apps/cli/src/legacy/config/legacy-cli-config.layer.unit.test.ts index b4220a3891..541e2d4a9b 100644 --- a/apps/cli/src/legacy/config/legacy-cli-config.layer.unit.test.ts +++ b/apps/cli/src/legacy/config/legacy-cli-config.layer.unit.test.ts @@ -96,6 +96,19 @@ describe("legacyCliConfigLayer", () => { }).pipe(Effect.provide(makeLayer({ home, cwd: tempRoot }))); }); + it.effect("reads the persisted profile file from SUPABASE_HOME when configured", () => { + const home = join(tempRoot, "home"); + const supabaseHome = join(tempRoot, "custom-supabase-home"); + mkdirSync(supabaseHome, { recursive: true }); + writeFileSync(join(supabaseHome, "profile"), "supabase-staging\n"); + return Effect.gen(function* () { + const config = yield* LegacyCliConfig; + expect(config.profile).toBe("supabase-staging"); + }).pipe( + Effect.provide(makeLayer({ home, cwd: tempRoot, env: { SUPABASE_HOME: supabaseHome } })), + ); + }); + it.effect("debug logs the persisted profile file source", () => { const home = join(tempRoot, "home"); const profilePath = join(home, ".supabase", "profile"); diff --git a/apps/cli/src/legacy/config/legacy-profile-file.ts b/apps/cli/src/legacy/config/legacy-profile-file.ts index cf7ae6a609..d4a9db7257 100644 --- a/apps/cli/src/legacy/config/legacy-profile-file.ts +++ b/apps/cli/src/legacy/config/legacy-profile-file.ts @@ -1,8 +1,8 @@ import { Data, Effect, FileSystem, Path } from "effect"; /** - * Helpers for the persisted profile-name file `~/.supabase/profile`, mirroring - * Go's `getProfileName` file fallback and `SaveProfileName` + * Helpers for the persisted profile-name file under the global Supabase home, + * mirroring Go's `getProfileName` file fallback and `SaveProfileName` * (`apps/cli-go/internal/utils/profile.go:121-152`). * * `login` writes this file (on success, when a profile was explicitly set) so a @@ -17,11 +17,26 @@ export class LegacyProfileSaveError extends Data.TaggedError("LegacyProfileSaveE readonly message: string; }> {} -export function legacyProfileFilePath(path: Path.Path, homeDir: string): string { - return path.join(homeDir, ".supabase", "profile"); +export function legacySupabaseHome( + path: Path.Path, + homeDir: string, + env: Readonly> = process.env, +): string { + const configured = env["SUPABASE_HOME"]?.trim(); + return configured !== undefined && configured.length > 0 + ? configured + : path.join(homeDir, ".supabase"); +} + +export function legacyProfileFilePath( + path: Path.Path, + homeDir: string, + env?: Readonly>, +): string { + return path.join(legacySupabaseHome(path, homeDir, env), "profile"); } -/** Writes the profile name to `~/.supabase/profile`. Fatal on failure (Go parity). */ +/** Writes the profile name to `/profile`. Fatal on failure (Go parity). */ export const saveLegacyProfileName = ( fs: FileSystem.FileSystem, path: Path.Path, From c07e07759b1adadea5a2f63598f40e642df1ce71 Mon Sep 17 00:00:00 2001 From: Alex Metelli Date: Fri, 19 Jun 2026 03:48:47 +0800 Subject: [PATCH 05/12] fix(stack): respect SUPABASE_HOME for default cache root --- packages/stack/src/paths.ts | 7 ++++++- packages/stack/src/paths.unit.test.ts | 18 ++++++++++++++++++ 2 files changed, 24 insertions(+), 1 deletion(-) create mode 100644 packages/stack/src/paths.unit.test.ts diff --git a/packages/stack/src/paths.ts b/packages/stack/src/paths.ts index dc92d1f30a..1235d27dcc 100644 --- a/packages/stack/src/paths.ts +++ b/packages/stack/src/paths.ts @@ -4,7 +4,12 @@ import { basename, join, resolve } from "node:path"; const shortTempRoot = () => (process.platform === "win32" ? tmpdir() : "/tmp"); -export const defaultCacheRoot = (): string => join(homedir(), ".supabase"); +export const defaultCacheRoot = (): string => { + const configured = process.env["SUPABASE_HOME"]?.trim(); + return configured !== undefined && configured.length > 0 + ? configured + : join(homedir(), ".supabase"); +}; export const DEFAULT_MANAGED_STACK_NAME = "default"; diff --git a/packages/stack/src/paths.unit.test.ts b/packages/stack/src/paths.unit.test.ts new file mode 100644 index 0000000000..b560599a34 --- /dev/null +++ b/packages/stack/src/paths.unit.test.ts @@ -0,0 +1,18 @@ +import { describe, expect, it } from "vitest"; +import { defaultCacheRoot } from "./paths.ts"; + +describe("defaultCacheRoot", () => { + it("uses SUPABASE_HOME when configured", () => { + const previous = process.env["SUPABASE_HOME"]; + process.env["SUPABASE_HOME"] = "/custom/supabase-home"; + try { + expect(defaultCacheRoot()).toBe("/custom/supabase-home"); + } finally { + if (previous === undefined) { + delete process.env["SUPABASE_HOME"]; + } else { + process.env["SUPABASE_HOME"] = previous; + } + } + }); +}); From 7e301d12c08295216db864f5366140147efd0a1d Mon Sep 17 00:00:00 2001 From: Alex Metelli Date: Fri, 19 Jun 2026 03:49:28 +0800 Subject: [PATCH 06/12] refactor(cli): share Supabase home path helper --- apps/cli-go/internal/telemetry/state.go | 10 +++------- 1 file changed, 3 insertions(+), 7 deletions(-) diff --git a/apps/cli-go/internal/telemetry/state.go b/apps/cli-go/internal/telemetry/state.go index 825ce5fc7c..3808abb78a 100644 --- a/apps/cli-go/internal/telemetry/state.go +++ b/apps/cli-go/internal/telemetry/state.go @@ -4,7 +4,6 @@ import ( "encoding/json" "os" "path/filepath" - "strings" "time" "github.com/go-errors/errors" @@ -43,14 +42,11 @@ type rawState struct { } func telemetryPath() (string, error) { - if home := strings.TrimSpace(os.Getenv("SUPABASE_HOME")); home != "" { - return filepath.Join(home, "telemetry.json"), nil - } - home, err := os.UserHomeDir() + home, err := utils.SupabaseHomeDir() if err != nil { - return "", errors.Errorf("failed to get $HOME directory: %w", err) + return "", err } - return filepath.Join(home, ".supabase", "telemetry.json"), nil + return filepath.Join(home, "telemetry.json"), nil } func parseConsent(raw rawState) (bool, bool, error) { From e0dd2f8c2309d474312dda268c1fbcf09cbe05c8 Mon Sep 17 00:00:00 2001 From: Alex Metelli Date: Fri, 19 Jun 2026 03:51:32 +0800 Subject: [PATCH 07/12] test(cli): fix function deploy path normalization --- .../functions/deploy/deploy.integration.test.ts | 14 +++++--------- apps/cli/src/shared/functions/deploy.ts | 12 +++++++++++- 2 files changed, 16 insertions(+), 10 deletions(-) diff --git a/apps/cli/src/next/commands/functions/deploy/deploy.integration.test.ts b/apps/cli/src/next/commands/functions/deploy/deploy.integration.test.ts index 3f19ed9573..699c5d8847 100644 --- a/apps/cli/src/next/commands/functions/deploy/deploy.integration.test.ts +++ b/apps/cli/src/next/commands/functions/deploy/deploy.integration.test.ts @@ -1,7 +1,7 @@ import { describe, expect, it } from "@effect/vitest"; import { makeApiClient, FunctionResponse } from "@supabase/api/effect"; import { BunServices } from "@effect/platform-bun"; -import { mkdirSync, mkdtempSync, writeFileSync } from "node:fs"; +import { mkdirSync, mkdtempSync, realpathSync, writeFileSync } from "node:fs"; import { mkdir, rm, writeFile } from "node:fs/promises"; import { tmpdir } from "node:os"; import { dirname, join, sep } from "node:path"; @@ -1207,14 +1207,9 @@ describe("functions deploy", () => { expect(api.requests[1]?.urlParams).toContain("slug=hello-world"); expect(api.requests[1]?.urlParams).toContain("verify_jwt=false"); expect(child.spawned.at(-1)?.args).toContain("public.ecr.aws/supabase/edge-runtime:v1.68.4"); + const importMapPath = realpathSync(join(tempDir, "supabase", "custom_import_map.json")); expect(child.spawned.at(-1)?.args).toContain( - `${join(tempDir, "supabase", "custom_import_map.json")}:${join( - tempDir, - "supabase", - "custom_import_map.json", - ) - .replaceAll("\\", "/") - .replace(/^[A-Za-z]:/, "")}:ro`, + `${importMapPath}:${importMapPath.replaceAll("\\", "/").replace(/^[A-Za-z]:/, "")}:ro`, ); expect(out.stderrText).toContain("Bundling Function: hello-world\n"); expect(out.stderrText).toContain("Deploying Function: hello-world (script size:"); @@ -1511,8 +1506,9 @@ describe("functions deploy", () => { }).pipe(Effect.provide(layer)); expect(child.spawned).toHaveLength(4); + const realStaticFile = realpathSync(staticFile); expect(child.spawned.at(-1)?.args).toContain( - `${staticFile}:${staticFile.replaceAll("\\", "/").replace(/^[A-Za-z]:/, "")}:ro`, + `${realStaticFile}:${realStaticFile.replaceAll("\\", "/").replace(/^[A-Za-z]:/, "")}:ro`, ); }).pipe(Effect.ensuring(cleanupTempDir(tempDir))); }); diff --git a/apps/cli/src/shared/functions/deploy.ts b/apps/cli/src/shared/functions/deploy.ts index 1e7e0af0a6..b500198ca6 100644 --- a/apps/cli/src/shared/functions/deploy.ts +++ b/apps/cli/src/shared/functions/deploy.ts @@ -656,7 +656,17 @@ async function walkImportPaths( } const resolvedModule = resolve(modulePath); - if (!isContainedInAnyPath(allowedRoots, resolvedModule)) { + let realResolvedModule: string; + try { + realResolvedModule = await realpath(resolvedModule); + } catch (error) { + if (error instanceof Error && "code" in error && error.code === "ENOENT") { + queue.push(toSlash(resolvedModule)); + continue; + } + throw error; + } + if (!isContainedInAnyPath(allowedRoots, realResolvedModule)) { await onWarning(`WARN: Skipping import path outside project root: ${modulePath}\n`); continue; } From 6b23fcc68d647e15b4d4922c51aa46483a5e16af Mon Sep 17 00:00:00 2001 From: Alex Metelli Date: Sat, 20 Jun 2026 10:07:13 +0800 Subject: [PATCH 08/12] fix(cli): normalize Supabase home handling --- apps/cli-go/docs/supabase/login.md | 2 +- apps/cli/AGENTS.md | 2 +- apps/cli/docs/supabase-home.md | 4 +- apps/cli/src/legacy/SIDE_EFFECTS_TEMPLATE.md | 16 +++---- .../legacy/auth/legacy-credentials.layer.ts | 2 +- .../legacy-credentials.layer.unit.test.ts | 2 +- .../legacy/auth/legacy-credentials.service.ts | 4 +- apps/cli/src/legacy/auth/legacy-errors.ts | 2 +- .../commands/backups/list/SIDE_EFFECTS.md | 16 +++---- .../commands/backups/restore/SIDE_EFFECTS.md | 16 +++---- .../legacy/commands/bootstrap/SIDE_EFFECTS.md | 12 ++--- .../commands/branches/create/SIDE_EFFECTS.md | 30 ++++++------ .../commands/branches/delete/SIDE_EFFECTS.md | 2 +- .../commands/branches/disable/SIDE_EFFECTS.md | 2 +- .../commands/branches/get/SIDE_EFFECTS.md | 4 +- .../commands/branches/list/SIDE_EFFECTS.md | 16 +++---- .../commands/branches/pause/SIDE_EFFECTS.md | 2 +- .../commands/branches/unpause/SIDE_EFFECTS.md | 2 +- .../commands/branches/update/SIDE_EFFECTS.md | 2 +- .../commands/config/push/SIDE_EFFECTS.md | 20 ++++---- .../commands/db/advisors/SIDE_EFFECTS.md | 30 ++++++------ .../legacy/commands/db/diff/SIDE_EFFECTS.md | 16 +++---- .../legacy/commands/db/dump/SIDE_EFFECTS.md | 14 +++--- .../legacy/commands/db/lint/SIDE_EFFECTS.md | 26 +++++------ .../legacy/commands/db/pull/SIDE_EFFECTS.md | 14 +++--- .../legacy/commands/db/push/SIDE_EFFECTS.md | 20 ++++---- .../legacy/commands/db/query/SIDE_EFFECTS.md | 14 +++--- .../db/remote/changes/SIDE_EFFECTS.md | 14 +++--- .../commands/db/remote/commit/SIDE_EFFECTS.md | 14 +++--- .../legacy/commands/db/reset/SIDE_EFFECTS.md | 18 ++++---- .../declarative/generate/SIDE_EFFECTS.md | 2 +- .../legacy/commands/db/test/SIDE_EFFECTS.md | 16 +++---- .../legacy/commands/domains/SIDE_EFFECTS.md | 20 ++++---- .../commands/encryption/SIDE_EFFECTS.md | 16 +++---- .../commands/functions/delete/SIDE_EFFECTS.md | 14 +++--- .../commands/functions/deploy/SIDE_EFFECTS.md | 16 +++---- .../functions/download/SIDE_EFFECTS.md | 14 +++--- .../commands/functions/list/SIDE_EFFECTS.md | 14 +++--- .../legacy/commands/gen/keys/SIDE_EFFECTS.md | 8 ++-- .../legacy/commands/gen/types/SIDE_EFFECTS.md | 28 +++++------ .../commands/inspect/db/SIDE_EFFECTS.md | 18 ++++---- .../commands/inspect/report/SIDE_EFFECTS.md | 4 +- .../src/legacy/commands/link/SIDE_EFFECTS.md | 10 ++-- .../src/legacy/commands/login/SIDE_EFFECTS.md | 28 +++++------ .../legacy/commands/login/login.e2e.test.ts | 2 +- .../legacy/commands/login/login.handler.ts | 9 ++-- .../commands/login/login.integration.test.ts | 2 +- .../legacy/commands/logout/SIDE_EFFECTS.md | 8 ++-- .../commands/migration/down/SIDE_EFFECTS.md | 14 +++--- .../commands/migration/fetch/SIDE_EFFECTS.md | 12 ++--- .../commands/migration/list/SIDE_EFFECTS.md | 16 +++---- .../commands/migration/repair/SIDE_EFFECTS.md | 14 +++--- .../commands/migration/squash/SIDE_EFFECTS.md | 16 +++---- .../commands/migration/up/SIDE_EFFECTS.md | 14 +++--- .../commands/network-bans/get/SIDE_EFFECTS.md | 20 ++++---- .../network-bans/remove/SIDE_EFFECTS.md | 20 ++++---- .../network-restrictions/get/SIDE_EFFECTS.md | 20 ++++---- .../update/SIDE_EFFECTS.md | 20 ++++---- .../commands/orgs/create/SIDE_EFFECTS.md | 24 +++++----- .../legacy/commands/orgs/list/SIDE_EFFECTS.md | 24 +++++----- .../postgres-config/delete/SIDE_EFFECTS.md | 20 ++++---- .../postgres-config/get/SIDE_EFFECTS.md | 20 ++++---- .../postgres-config/update/SIDE_EFFECTS.md | 20 ++++---- .../legacy/commands/projects/SIDE_EFFECTS.md | 18 ++++---- .../projects/api-keys/SIDE_EFFECTS.md | 16 +++---- .../commands/projects/create/SIDE_EFFECTS.md | 16 +++---- .../commands/projects/delete/SIDE_EFFECTS.md | 16 +++---- .../commands/projects/list/SIDE_EFFECTS.md | 16 +++---- .../commands/secrets/list/SIDE_EFFECTS.md | 18 ++++---- .../commands/secrets/set/SIDE_EFFECTS.md | 26 +++++------ .../commands/secrets/unset/SIDE_EFFECTS.md | 18 ++++---- .../commands/seed/buckets/SIDE_EFFECTS.md | 16 +++---- .../legacy/commands/services/SIDE_EFFECTS.md | 24 +++++----- .../snippets/download/SIDE_EFFECTS.md | 22 ++++----- .../commands/snippets/list/SIDE_EFFECTS.md | 22 ++++----- .../ssl-enforcement/get/SIDE_EFFECTS.md | 20 ++++---- .../ssl-enforcement/update/SIDE_EFFECTS.md | 20 ++++---- .../legacy/commands/sso/add/SIDE_EFFECTS.md | 18 ++++---- .../legacy/commands/sso/info/SIDE_EFFECTS.md | 8 ++-- .../legacy/commands/sso/list/SIDE_EFFECTS.md | 18 ++++---- .../commands/sso/remove/SIDE_EFFECTS.md | 18 ++++---- .../legacy/commands/sso/show/SIDE_EFFECTS.md | 18 ++++---- .../commands/sso/update/SIDE_EFFECTS.md | 18 ++++---- .../commands/storage/cp/SIDE_EFFECTS.md | 16 +++---- .../commands/storage/ls/SIDE_EFFECTS.md | 14 +++--- .../commands/storage/mv/SIDE_EFFECTS.md | 14 +++--- .../commands/storage/rm/SIDE_EFFECTS.md | 14 +++--- .../telemetry/disable/SIDE_EFFECTS.md | 14 +++--- .../commands/telemetry/enable/SIDE_EFFECTS.md | 14 +++--- .../commands/telemetry/status/SIDE_EFFECTS.md | 14 +++--- .../legacy/commands/test/db/SIDE_EFFECTS.md | 14 +++--- .../activate/SIDE_EFFECTS.md | 20 ++++---- .../check-availability/SIDE_EFFECTS.md | 20 ++++---- .../vanity-subdomains/delete/SIDE_EFFECTS.md | 20 ++++---- .../vanity-subdomains/get/SIDE_EFFECTS.md | 20 ++++---- .../legacy/config/legacy-cli-config.layer.ts | 4 +- .../legacy-cli-config.layer.unit.test.ts | 21 +++++---- .../src/next/commands/logout/logout.guide.md | 2 +- apps/cli/src/next/config/cli-config.layer.ts | 10 +++- .../next/config/cli-config.layer.unit.test.ts | 46 +++++++++++++++++++ packages/stack/docs/architecture.md | 6 +-- 101 files changed, 774 insertions(+), 716 deletions(-) diff --git a/apps/cli-go/docs/supabase/login.md b/apps/cli-go/docs/supabase/login.md index 59841e7a59..0387dbd3f6 100644 --- a/apps/cli-go/docs/supabase/login.md +++ b/apps/cli-go/docs/supabase/login.md @@ -2,7 +2,7 @@ Connect the Supabase CLI to your Supabase account by logging in with your [personal access token](https://supabase.com/dashboard/account/tokens). -Your access token is stored securely in [native credentials storage](https://github.com/zalando/go-keyring#dependencies). If native credentials storage is unavailable, it will be written to a plain text file at `~/.supabase/access-token`. +Your access token is stored securely in [native credentials storage](https://github.com/zalando/go-keyring#dependencies). If native credentials storage is unavailable, it will be written to a plain text file at `/access-token`. > If this behavior is not desired, such as in a CI environment, you may skip login by specifying the `SUPABASE_ACCESS_TOKEN` environment variable in other commands. diff --git a/apps/cli/AGENTS.md b/apps/cli/AGENTS.md index c30465cd85..6ed1be43ea 100644 --- a/apps/cli/AGENTS.md +++ b/apps/cli/AGENTS.md @@ -94,7 +94,7 @@ Also check the following `legacy/` infrastructure before writing equivalent help | ------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `legacy/config/legacy-cli-config.layer.ts` | `LegacyCliConfig` — resolves `SUPABASE_PROFILE` (built-in name **or** YAML file path), `--workdir`, `--experimental`, project-id from `supabase/config.toml` | | `legacy/config/legacy-project-ref.layer.ts` | `LegacyProjectRefResolver` — `--project-ref` flag → env → linked-project.json → config fallback chain; matches Go's resolver order | -| `legacy/telemetry/legacy-telemetry-state.layer.ts` | `LegacyTelemetryState.flush` — writes `~/.supabase/telemetry.json`, runs in every command's `Effect.ensuring` | +| `legacy/telemetry/legacy-telemetry-state.layer.ts` | `LegacyTelemetryState.flush` — writes `/telemetry.json`, runs in every command's `Effect.ensuring` | | `legacy/telemetry/legacy-linked-project-cache.layer.ts` | `LegacyLinkedProjectCache.cache(ref)` — writes `~/.supabase//linked-project.json` after `--project-ref` resolves; bypasses generated schema validation (uses raw HTTP client) | | `legacy/auth/legacy-http-debug.layer.ts` | `legacyHttpClientLayer` — wraps the HTTP transport with a `--debug` stderr logger in Go's `log.LstdFlags` format | | `legacy/output/legacy-glamour-table.ts` | `renderGlamourTable(headers, rows)` — byte-exact ASCII match for Go's `glamour.RenderTable(..., AsciiStyle)` | diff --git a/apps/cli/docs/supabase-home.md b/apps/cli/docs/supabase-home.md index e96210caa2..e8c137cece 100644 --- a/apps/cli/docs/supabase-home.md +++ b/apps/cli/docs/supabase-home.md @@ -254,7 +254,7 @@ Not all runtime files live in the repo. Auth is still machine-global today: - keyring entry: `Supabase CLI/access-token` -- filesystem fallback: `~/.supabase/access-token` +- filesystem fallback: `/access-token` ### Telemetry and traces @@ -268,7 +268,7 @@ Telemetry state remains in `SUPABASE_HOME`: Downloaded binaries remain shared across projects in: ```text -~/.supabase/bin/ +/bin/ ``` ### Live runtime sockets diff --git a/apps/cli/src/legacy/SIDE_EFFECTS_TEMPLATE.md b/apps/cli/src/legacy/SIDE_EFFECTS_TEMPLATE.md index a27b7f3ab6..d51f7e543f 100644 --- a/apps/cli/src/legacy/SIDE_EFFECTS_TEMPLATE.md +++ b/apps/cli/src/legacy/SIDE_EFFECTS_TEMPLATE.md @@ -27,10 +27,10 @@ When: the condition under which this file is read (e.g. "always", "when --flag is set", "when SUPABASE_ACCESS_TOKEN is not set"). --> -| Path | Format | When | -| --------------------------------- | ------------------------- | ---------------------------------------------------------- | -| `~/.supabase/access-token` | plain text (token string) | when `SUPABASE_ACCESS_TOKEN` unset and keyring unavailable | -| `/.supabase/config.json` | JSON | always, to resolve linked project ref | +| Path | Format | When | +| --------------------------------------------- | ------------------------- | ---------------------------------------------------------- | +| `/access-token` | plain text (token string) | when `SUPABASE_ACCESS_TOKEN` unset and keyring unavailable | +| `/.supabase/config.json` | JSON | always, to resolve linked project ref | ## Files Written @@ -58,10 +58,10 @@ -| Variable | Purpose | Required? | -| ----------------------- | ---------------------------------------------------- | ------------------------------------------------------- | -| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `~/.supabase/access-token`) | -| `SUPABASE_API_URL` | override Management API base URL | no (defaults to `https://api.supabase.com`) | +| Variable | Purpose | Required? | +| ----------------------- | ---------------------------------------------------- | -------------------------------------------------------------------------- | +| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `/access-token`) | +| `SUPABASE_API_URL` | override Management API base URL | no (defaults to `https://api.supabase.com`) | ## Exit Codes diff --git a/apps/cli/src/legacy/auth/legacy-credentials.layer.ts b/apps/cli/src/legacy/auth/legacy-credentials.layer.ts index 8a67e478e6..117b3b708e 100644 --- a/apps/cli/src/legacy/auth/legacy-credentials.layer.ts +++ b/apps/cli/src/legacy/auth/legacy-credentials.layer.ts @@ -380,7 +380,7 @@ const makeLegacyCredentials = Effect.gen(function* () { return Option.some(Redacted.make(keyringValue.value)); } - // Filesystem fallback at ~/.supabase/access-token. + // Filesystem fallback in the Supabase home directory. const fileValue = yield* readFile; if (Option.isSome(fileValue)) { yield* debugLogger.debug(`Using access token from file: ${fallbackPath}`); diff --git a/apps/cli/src/legacy/auth/legacy-credentials.layer.unit.test.ts b/apps/cli/src/legacy/auth/legacy-credentials.layer.unit.test.ts index 890f9d2118..8ab728f7ff 100644 --- a/apps/cli/src/legacy/auth/legacy-credentials.layer.unit.test.ts +++ b/apps/cli/src/legacy/auth/legacy-credentials.layer.unit.test.ts @@ -245,7 +245,7 @@ describe("legacyCredentialsLayer.getAccessToken", () => { }).pipe(Effect.provide(makeLayer())); }); - it.effect("falls back to ~/.supabase/access-token when keyring entries miss", () => { + it.effect("falls back to the Supabase home access-token file when keyring entries miss", () => { const supaDir = join(tempHome, ".supabase"); mkdirSync(supaDir, { recursive: true }); writeFileSync(join(supaDir, "access-token"), `${VALID_TOKEN}\n`, { mode: 0o600 }); diff --git a/apps/cli/src/legacy/auth/legacy-credentials.service.ts b/apps/cli/src/legacy/auth/legacy-credentials.service.ts index def4668443..8d7c723205 100644 --- a/apps/cli/src/legacy/auth/legacy-credentials.service.ts +++ b/apps/cli/src/legacy/auth/legacy-credentials.service.ts @@ -18,8 +18,8 @@ interface LegacyCredentialsShape { * Deletes the access token, reproducing Go's `utils.DeleteAccessToken` * (`apps/cli-go/internal/utils/access_token.go:100-119`) exactly: * - * 1. Remove `~/.supabase/access-token` first. A non-`ENOENT` removal error - * fails `LegacyDeleteTokenError`; a missing file is ignored. + * 1. Remove the Supabase home access-token file first. A non-`ENOENT` + * removal error fails `LegacyDeleteTokenError`; a missing file is ignored. * 2. Best-effort delete of the legacy `access-token` keyring account — any * error other than not-found is swallowed and never affects the outcome. * 3. Delete the profile keyring account (account = profile name). This diff --git a/apps/cli/src/legacy/auth/legacy-errors.ts b/apps/cli/src/legacy/auth/legacy-errors.ts index effab2b544..d2e6d1a80e 100644 --- a/apps/cli/src/legacy/auth/legacy-errors.ts +++ b/apps/cli/src/legacy/auth/legacy-errors.ts @@ -37,7 +37,7 @@ export class LegacyNotLoggedInError extends Data.TaggedError("LegacyNotLoggedInE /** * Raised by `deleteAccessToken` when removing the token fails for a real reason - * — a non-`ENOENT` failure removing `~/.supabase/access-token`, or a non + * — a non-`ENOENT` failure removing the Supabase home access-token file, or a non * not-found error deleting the profile keyring entry. Mirrors Go's * `failed to remove access token file: …` / `failed to delete access token from * keyring: …` errors (`access_token.go:100-119`), which exit 1. diff --git a/apps/cli/src/legacy/commands/backups/list/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/backups/list/SIDE_EFFECTS.md index f69b0219d6..dced70b611 100644 --- a/apps/cli/src/legacy/commands/backups/list/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/backups/list/SIDE_EFFECTS.md @@ -2,13 +2,13 @@ ## Files Read -| Path | Format | When | -| ----------------------------------------- | ------------------------- | --------------------------------------------------------------------------------------------- | -| `/proc/sys/kernel/osrelease` (Linux) | plain text | once on layer init — disables keyring on WSL (`WSL` / `Microsoft` substring match) | -| keyring `"Supabase CLI"` / `` | OS keychain | when `SUPABASE_ACCESS_TOKEN` unset and keyring available; account = `LegacyCliConfig.profile` | -| keyring `"Supabase CLI"` / `access-token` | OS keychain | legacy-key fallback when the profile-keyed lookup misses | -| `~/.supabase/access-token` | plain text (token string) | last-resort fallback after env + keyring miss | -| `/supabase/.temp/project-ref` | plain text | when `--project-ref` and `SUPABASE_PROJECT_ID` are both unset | +| Path | Format | When | +| --------------------------------------------- | ------------------------- | --------------------------------------------------------------------------------------------- | +| `/proc/sys/kernel/osrelease` (Linux) | plain text | once on layer init — disables keyring on WSL (`WSL` / `Microsoft` substring match) | +| keyring `"Supabase CLI"` / `` | OS keychain | when `SUPABASE_ACCESS_TOKEN` unset and keyring available; account = `LegacyCliConfig.profile` | +| keyring `"Supabase CLI"` / `access-token` | OS keychain | legacy-key fallback when the profile-keyed lookup misses | +| `/access-token` | plain text (token string) | last-resort fallback after env + keyring miss | +| `/supabase/.temp/project-ref` | plain text | when `--project-ref` and `SUPABASE_PROJECT_ID` are both unset | ## Files Written @@ -27,7 +27,7 @@ | Variable | Purpose | Required? | | ----------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------- | -| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `~/.supabase/access-token`) | +| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `/access-token`) | | `SUPABASE_PROFILE` | selects API base URL: `supabase` → `api.supabase.com`, `supabase-staging` → `api.supabase.green`, `supabase-local` → `http://localhost:8080`. May alternatively be a filesystem path to a YAML profile with at least `api_url:` and optional `name:` (Go parity — used by the cli-e2e test harness). | no (defaults to `supabase`) | | `SUPABASE_PROJECT_ID` | project ref fallback when `--project-ref` is unset | no (also reads `/supabase/.temp/project-ref` then prompts on TTY) | | `SUPABASE_WORKDIR` | base directory for the `.temp/project-ref` lookup | no (walks up from CWD looking for `supabase/config.toml`) | diff --git a/apps/cli/src/legacy/commands/backups/restore/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/backups/restore/SIDE_EFFECTS.md index 8b08e2727b..d8090e1fb5 100644 --- a/apps/cli/src/legacy/commands/backups/restore/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/backups/restore/SIDE_EFFECTS.md @@ -2,13 +2,13 @@ ## Files Read -| Path | Format | When | -| ----------------------------------------- | ------------------------- | --------------------------------------------------------------------------------------------- | -| `/proc/sys/kernel/osrelease` (Linux) | plain text | once on layer init — disables keyring on WSL (`WSL` / `Microsoft` substring match) | -| keyring `"Supabase CLI"` / `` | OS keychain | when `SUPABASE_ACCESS_TOKEN` unset and keyring available; account = `LegacyCliConfig.profile` | -| keyring `"Supabase CLI"` / `access-token` | OS keychain | legacy-key fallback when the profile-keyed lookup misses | -| `~/.supabase/access-token` | plain text (token string) | last-resort fallback after env + keyring miss | -| `/supabase/.temp/project-ref` | plain text | when `--project-ref` and `SUPABASE_PROJECT_ID` are both unset | +| Path | Format | When | +| --------------------------------------------- | ------------------------- | --------------------------------------------------------------------------------------------- | +| `/proc/sys/kernel/osrelease` (Linux) | plain text | once on layer init — disables keyring on WSL (`WSL` / `Microsoft` substring match) | +| keyring `"Supabase CLI"` / `` | OS keychain | when `SUPABASE_ACCESS_TOKEN` unset and keyring available; account = `LegacyCliConfig.profile` | +| keyring `"Supabase CLI"` / `access-token` | OS keychain | legacy-key fallback when the profile-keyed lookup misses | +| `/access-token` | plain text (token string) | last-resort fallback after env + keyring miss | +| `/supabase/.temp/project-ref` | plain text | when `--project-ref` and `SUPABASE_PROJECT_ID` are both unset | ## Files Written @@ -27,7 +27,7 @@ | Variable | Purpose | Required? | | ----------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------- | -| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `~/.supabase/access-token`) | +| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `/access-token`) | | `SUPABASE_PROFILE` | selects API base URL: `supabase` → `api.supabase.com`, `supabase-staging` → `api.supabase.green`, `supabase-local` → `http://localhost:8080`. May alternatively be a filesystem path to a YAML profile with at least `api_url:` and optional `name:` (Go parity — used by the cli-e2e test harness). | no (defaults to `supabase`) | | `SUPABASE_PROJECT_ID` | project ref fallback when `--project-ref` is unset | no (also reads `/supabase/.temp/project-ref` then prompts on TTY) | | `SUPABASE_WORKDIR` | base directory for the `.temp/project-ref` lookup | no (walks up from CWD looking for `supabase/config.toml`) | diff --git a/apps/cli/src/legacy/commands/bootstrap/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/bootstrap/SIDE_EFFECTS.md index a6428d8f47..d623dd845f 100644 --- a/apps/cli/src/legacy/commands/bootstrap/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/bootstrap/SIDE_EFFECTS.md @@ -7,11 +7,11 @@ health poll → write `.env` → `db push` → start suggestion. Every step is n ## Files Read -| Path | Format | When | -| -------------------------------------- | ---------- | ----------------------------------------------------------- | -| `~/.supabase/access-token` | plain text | ensure-login token miss (env unset and keyring unavailable) | -| `/.env.example` | dotenv | optional; merged into the generated `.env` | -| `/supabase/.temp/project-ref` | plain text | read by the delegated `db push` subprocess (post-`chdir`) | +| Path | Format | When | +| --------------------------------------------- | ---------- | ----------------------------------------------------------- | +| `/access-token` | plain text | ensure-login token miss (env unset and keyring unavailable) | +| `/.env.example` | dotenv | optional; merged into the generated `.env` | +| `/supabase/.temp/project-ref` | plain text | read by the delegated `db push` subprocess (post-`chdir`) | ## Files Written @@ -23,7 +23,7 @@ health poll → write `.env` → `db push` → start suggestion. Every step is n | `/supabase/.temp/{pooler-url,rest-version,gotrue-version,storage-version,storage-migration}` | plain text | best-effort, from `link.LinkServices` | | `/.env` | dotenv | best-effort (write failure prints a warning and continues) | | `/supabase/.temp/linked-project.json` | JSON | PersistentPostRun linked-project cache (`Effect.ensuring`); resolves against the bootstrap workdir (the prompted/`--workdir`/env target), not `cliConfig.workdir` | -| `~/.supabase/telemetry.json` | JSON | PersistentPostRun telemetry flush (`Effect.ensuring`) | +| `/telemetry.json` | JSON | PersistentPostRun telemetry flush (`Effect.ensuring`) | **Process side effect:** `process.chdir()` mirrors Go's `ChangeWorkDir` and prints `Using workdir \n` to stderr (`workdir` bolded on a TTY). The original cwd is restored diff --git a/apps/cli/src/legacy/commands/branches/create/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/branches/create/SIDE_EFFECTS.md index 98d5134fe2..e20b0dc007 100644 --- a/apps/cli/src/legacy/commands/branches/create/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/branches/create/SIDE_EFFECTS.md @@ -2,20 +2,20 @@ ## Files Read -| Path | Format | When | -| ----------------------------------------- | ------------------------- | --------------------------------------------------------------------------------------------- | -| keyring `"Supabase CLI"` / `` | OS keychain | when `SUPABASE_ACCESS_TOKEN` unset and keyring available; account = `LegacyCliConfig.profile` | -| keyring `"Supabase CLI"` / `access-token` | OS keychain | legacy-key fallback when the profile-keyed lookup misses | -| `~/.supabase/access-token` | plain text (token string) | last-resort fallback after env + keyring miss | -| `/supabase/.temp/project-ref` | plain text | when `--project-ref` and `SUPABASE_PROJECT_ID` are both unset | -| `/.git/HEAD` (walking parents) | plain text | when the positional `[name]` arg is omitted — fallback branch name detection | +| Path | Format | When | +| --------------------------------------------- | ------------------------- | --------------------------------------------------------------------------------------------- | +| keyring `"Supabase CLI"` / `` | OS keychain | when `SUPABASE_ACCESS_TOKEN` unset and keyring available; account = `LegacyCliConfig.profile` | +| keyring `"Supabase CLI"` / `access-token` | OS keychain | legacy-key fallback when the profile-keyed lookup misses | +| `/access-token` | plain text (token string) | last-resort fallback after env + keyring miss | +| `/supabase/.temp/project-ref` | plain text | when `--project-ref` and `SUPABASE_PROJECT_ID` are both unset | +| `/.git/HEAD` (walking parents) | plain text | when the positional `[name]` arg is omitted — fallback branch name detection | ## Files Written | Path | Format | When | | ------------------------------------------------ | ------ | ------------------------------------------------------------------------ | | `~/.supabase//linked-project.json` | JSON | always (in `Effect.ensuring`) after `--project-ref` resolves — Go parity | -| `~/.supabase/telemetry.json` | JSON | always (in `Effect.ensuring`) at end of command — Go parity | +| `/telemetry.json` | JSON | always (in `Effect.ensuring`) at end of command — Go parity | ## API Routes @@ -27,13 +27,13 @@ ## Environment Variables -| Variable | Purpose | Required? | -| ----------------------- | ------------------------------------------------------------------------------------------------ | ------------------------------------------------------- | -| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `~/.supabase/access-token`) | -| `SUPABASE_PROFILE` | selects API base URL (`supabase` / `supabase-staging` / `supabase-local`) or a YAML profile path | no | -| `SUPABASE_PROJECT_ID` | parent project ref fallback when `--project-ref` is unset | no | -| `SUPABASE_WORKDIR` | base directory for the `.temp/project-ref` lookup | no | -| `GITHUB_HEAD_REF` | preferred over walking `.git/HEAD` when detecting the default branch name in CI | no | +| Variable | Purpose | Required? | +| ----------------------- | ------------------------------------------------------------------------------------------------ | -------------------------------------------------------------------------- | +| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `/access-token`) | +| `SUPABASE_PROFILE` | selects API base URL (`supabase` / `supabase-staging` / `supabase-local`) or a YAML profile path | no | +| `SUPABASE_PROJECT_ID` | parent project ref fallback when `--project-ref` is unset | no | +| `SUPABASE_WORKDIR` | base directory for the `.temp/project-ref` lookup | no | +| `GITHUB_HEAD_REF` | preferred over walking `.git/HEAD` when detecting the default branch name in CI | no | ## Exit Codes diff --git a/apps/cli/src/legacy/commands/branches/delete/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/branches/delete/SIDE_EFFECTS.md index f0ccf933df..1cb4dd622b 100644 --- a/apps/cli/src/legacy/commands/branches/delete/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/branches/delete/SIDE_EFFECTS.md @@ -9,7 +9,7 @@ Same auth and project-ref resolution chain as every Management-API legacy comman | Path | Format | When | | ------------------------------------------------ | ------ | ------------------------------------------------------------------------ | | `~/.supabase//linked-project.json` | JSON | always (in `Effect.ensuring`) after `--project-ref` resolves — Go parity | -| `~/.supabase/telemetry.json` | JSON | always (in `Effect.ensuring`) at end of command — Go parity | +| `/telemetry.json` | JSON | always (in `Effect.ensuring`) at end of command — Go parity | ## API Routes diff --git a/apps/cli/src/legacy/commands/branches/disable/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/branches/disable/SIDE_EFFECTS.md index 75c9288c66..340dff5ebe 100644 --- a/apps/cli/src/legacy/commands/branches/disable/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/branches/disable/SIDE_EFFECTS.md @@ -11,7 +11,7 @@ Same auth and project-ref resolution chain as every Management-API legacy comman | Path | Format | When | | ------------------------------------------------ | ------ | ------------------------------------------------------------------------ | | `~/.supabase//linked-project.json` | JSON | always (in `Effect.ensuring`) after `--project-ref` resolves — Go parity | -| `~/.supabase/telemetry.json` | JSON | always (in `Effect.ensuring`) at end of command — Go parity | +| `/telemetry.json` | JSON | always (in `Effect.ensuring`) at end of command — Go parity | ## API Routes diff --git a/apps/cli/src/legacy/commands/branches/get/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/branches/get/SIDE_EFFECTS.md index babda6ee3b..8250effb59 100644 --- a/apps/cli/src/legacy/commands/branches/get/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/branches/get/SIDE_EFFECTS.md @@ -2,14 +2,14 @@ ## Files Read -Same auth fallback chain (env / keyring / `~/.supabase/access-token`) and project-ref discovery (`/supabase/.temp/project-ref`) as every Management-API legacy command. +Same auth fallback chain (env / keyring / `/access-token`) and project-ref discovery (`/supabase/.temp/project-ref`) as every Management-API legacy command. ## Files Written | Path | Format | When | | ------------------------------------------------ | ------ | ------------------------------------------------------------------------ | | `~/.supabase//linked-project.json` | JSON | always (in `Effect.ensuring`) after `--project-ref` resolves — Go parity | -| `~/.supabase/telemetry.json` | JSON | always (in `Effect.ensuring`) at end of command — Go parity | +| `/telemetry.json` | JSON | always (in `Effect.ensuring`) at end of command — Go parity | ## API Routes diff --git a/apps/cli/src/legacy/commands/branches/list/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/branches/list/SIDE_EFFECTS.md index f759df0adf..fd14622126 100644 --- a/apps/cli/src/legacy/commands/branches/list/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/branches/list/SIDE_EFFECTS.md @@ -2,19 +2,19 @@ ## Files Read -| Path | Format | When | -| ----------------------------------------- | ------------------------- | --------------------------------------------------------------------------------------------- | -| keyring `"Supabase CLI"` / `` | OS keychain | when `SUPABASE_ACCESS_TOKEN` unset and keyring available; account = `LegacyCliConfig.profile` | -| keyring `"Supabase CLI"` / `access-token` | OS keychain | legacy-key fallback when the profile-keyed lookup misses | -| `~/.supabase/access-token` | plain text (token string) | last-resort fallback after env + keyring miss | -| `/supabase/.temp/project-ref` | plain text | when `--project-ref` and `SUPABASE_PROJECT_ID` are both unset | +| Path | Format | When | +| --------------------------------------------- | ------------------------- | --------------------------------------------------------------------------------------------- | +| keyring `"Supabase CLI"` / `` | OS keychain | when `SUPABASE_ACCESS_TOKEN` unset and keyring available; account = `LegacyCliConfig.profile` | +| keyring `"Supabase CLI"` / `access-token` | OS keychain | legacy-key fallback when the profile-keyed lookup misses | +| `/access-token` | plain text (token string) | last-resort fallback after env + keyring miss | +| `/supabase/.temp/project-ref` | plain text | when `--project-ref` and `SUPABASE_PROJECT_ID` are both unset | ## Files Written | Path | Format | When | | ------------------------------------------------ | ------ | ------------------------------------------------------------------------ | | `~/.supabase//linked-project.json` | JSON | always (in `Effect.ensuring`) after `--project-ref` resolves — Go parity | -| `~/.supabase/telemetry.json` | JSON | always (in `Effect.ensuring`) at end of command — Go parity | +| `/telemetry.json` | JSON | always (in `Effect.ensuring`) at end of command — Go parity | ## API Routes @@ -26,7 +26,7 @@ | Variable | Purpose | Required? | | ----------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------- | -| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `~/.supabase/access-token`) | +| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `/access-token`) | | `SUPABASE_PROFILE` | selects API base URL: `supabase` → `api.supabase.com`, `supabase-staging` → `api.supabase.green`, `supabase-local` → `http://localhost:8080`. May alternatively be a filesystem path to a YAML profile with at least `api_url:` and optional `name:` (Go parity — used by the cli-e2e test harness). | no (defaults to `supabase`) | | `SUPABASE_PROJECT_ID` | project ref fallback when `--project-ref` is unset | no (also reads `/supabase/.temp/project-ref` then prompts on TTY) | | `SUPABASE_WORKDIR` | base directory for the `.temp/project-ref` lookup | no (walks up from CWD looking for `supabase/config.toml`) | diff --git a/apps/cli/src/legacy/commands/branches/pause/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/branches/pause/SIDE_EFFECTS.md index 205f188186..f07abc4b42 100644 --- a/apps/cli/src/legacy/commands/branches/pause/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/branches/pause/SIDE_EFFECTS.md @@ -9,7 +9,7 @@ Same auth and project-ref resolution chain as every Management-API legacy comman | Path | Format | When | | ------------------------------------------------ | ------ | ------------------------------------------------------------------------ | | `~/.supabase//linked-project.json` | JSON | always (in `Effect.ensuring`) after `--project-ref` resolves — Go parity | -| `~/.supabase/telemetry.json` | JSON | always (in `Effect.ensuring`) at end of command — Go parity | +| `/telemetry.json` | JSON | always (in `Effect.ensuring`) at end of command — Go parity | ## API Routes diff --git a/apps/cli/src/legacy/commands/branches/unpause/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/branches/unpause/SIDE_EFFECTS.md index 0fe42e2410..a8862c0e24 100644 --- a/apps/cli/src/legacy/commands/branches/unpause/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/branches/unpause/SIDE_EFFECTS.md @@ -9,7 +9,7 @@ Same auth and project-ref resolution chain as every Management-API legacy comman | Path | Format | When | | ------------------------------------------------ | ------ | ------------------------------------------------------------------------ | | `~/.supabase//linked-project.json` | JSON | always (in `Effect.ensuring`) after `--project-ref` resolves — Go parity | -| `~/.supabase/telemetry.json` | JSON | always (in `Effect.ensuring`) at end of command — Go parity | +| `/telemetry.json` | JSON | always (in `Effect.ensuring`) at end of command — Go parity | ## API Routes diff --git a/apps/cli/src/legacy/commands/branches/update/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/branches/update/SIDE_EFFECTS.md index 09bab3fd8f..fede52845a 100644 --- a/apps/cli/src/legacy/commands/branches/update/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/branches/update/SIDE_EFFECTS.md @@ -9,7 +9,7 @@ Same auth and project-ref resolution chain as every Management-API legacy comman | Path | Format | When | | ------------------------------------------------ | ------ | ------------------------------------------------------------------------ | | `~/.supabase//linked-project.json` | JSON | always (in `Effect.ensuring`) after `--project-ref` resolves — Go parity | -| `~/.supabase/telemetry.json` | JSON | always (in `Effect.ensuring`) at end of command — Go parity | +| `/telemetry.json` | JSON | always (in `Effect.ensuring`) at end of command — Go parity | ## API Routes diff --git a/apps/cli/src/legacy/commands/config/push/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/config/push/SIDE_EFFECTS.md index dcc9a9aa53..c9767f8f78 100644 --- a/apps/cli/src/legacy/commands/config/push/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/config/push/SIDE_EFFECTS.md @@ -12,14 +12,14 @@ local → if changed, print the unified diff and confirm → PATCH/PUT/POST. | `/supabase/config.toml` | TOML | always, before any network call (parse error aborts, exit 1) | | `/supabase/.env`, `.env.local` | dotenv | always, to resolve `env(VAR)` references inside `config.toml` | | `~/.supabase//linked-project.json` | JSON | project-ref fallback (flag → `SUPABASE_PROJECT_ID` → this file) | -| `~/.supabase/access-token` | plain text (token string) | when `SUPABASE_ACCESS_TOKEN` unset and keyring unavailable | +| `/access-token` | plain text (token string) | when `SUPABASE_ACCESS_TOKEN` unset and keyring unavailable | ## Files Written | Path | Format | When | | ------------------------------------------------ | ------ | ---------------------------------------------------------------------- | | `~/.supabase//linked-project.json` | JSON | `Effect.ensuring` after run (success **and** failure), if ref resolved | -| `~/.supabase/telemetry.json` | JSON | `Effect.ensuring` after run (success **and** failure) | +| `/telemetry.json` | JSON | `Effect.ensuring` after run (success **and** failure) | No writes to `config.toml`. @@ -49,14 +49,14 @@ when its local gate is off. ## Environment Variables -| Variable | Purpose | Required? | -| ----------------------- | -------------------------------------------------------- | ------------------------------------------------------- | -| `SUPABASE_PROJECT_ID` | project ref (flag → this → `.temp/project-ref` → prompt) | no | -| `SUPABASE_YES` | auto-confirm prompts (`--yes`) | no | -| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `~/.supabase/access-token`) | -| `SUPABASE_API_URL` | override Management API base URL | no (defaults to `https://api.supabase.com`) | -| `SUPABASE_PROFILE` | API profile selection | no | -| `env(VAR)` references | interpolated into `config.toml` values at load | no | +| Variable | Purpose | Required? | +| ----------------------- | -------------------------------------------------------- | -------------------------------------------------------------------------- | +| `SUPABASE_PROJECT_ID` | project ref (flag → this → `.temp/project-ref` → prompt) | no | +| `SUPABASE_YES` | auto-confirm prompts (`--yes`) | no | +| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `/access-token`) | +| `SUPABASE_API_URL` | override Management API base URL | no (defaults to `https://api.supabase.com`) | +| `SUPABASE_PROFILE` | API profile selection | no | +| `env(VAR)` references | interpolated into `config.toml` values at load | no | ## Exit Codes diff --git a/apps/cli/src/legacy/commands/db/advisors/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/db/advisors/SIDE_EFFECTS.md index 2a4fad7e05..802e7156a7 100644 --- a/apps/cli/src/legacy/commands/db/advisors/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/db/advisors/SIDE_EFFECTS.md @@ -6,18 +6,18 @@ database directly; `--linked` fetches from the Management API. ## Files Read -| Path | Format | When | -| -------------------------------------- | ---------- | -------------------------------------------------------------------- | -| `/supabase/config.toml` | TOML | local / `--db-url` — to resolve the DB connection config | -| `~/.supabase/access-token` | plain text | `--linked` only, when `SUPABASE_ACCESS_TOKEN` unset (keyring → file) | -| `/supabase/.temp/project-ref` | plain text | `--linked` only — to resolve the project ref | +| Path | Format | When | +| --------------------------------------------- | ---------- | -------------------------------------------------------------------- | +| `/supabase/config.toml` | TOML | local / `--db-url` — to resolve the DB connection config | +| `/access-token` | plain text | `--linked` only, when `SUPABASE_ACCESS_TOKEN` unset (keyring → file) | +| `/supabase/.temp/project-ref` | plain text | `--linked` only — to resolve the project ref | ## Files Written -| Path | Format | When | -| ---------------------------------------------- | ------ | ----------------------------------------------------- | -| `~/.supabase/telemetry.json` | JSON | always (PostHog state flush, Go `PersistentPostRun`) | -| `/supabase/.temp/linked-project.json` | JSON | `--linked` only, via `LegacyLinkedProjectCache.cache` | +| Path | Format | When | +| ----------------------------------------------- | ------ | ----------------------------------------------------- | +| `/telemetry.json` | JSON | always (PostHog state flush, Go `PersistentPostRun`) | +| `/supabase/.temp/linked-project.json` | JSON | `--linked` only, via `LegacyLinkedProjectCache.cache` | The local lint query runs inside a transaction that is **always rolled back**. @@ -41,12 +41,12 @@ One connection. Within one transaction: `BEGIN` → `set local search_path = ''` ## Environment Variables -| Variable | Purpose | Required? | -| ----------------------- | ----------------------------------------- | ----------------------------------------- | -| `SUPABASE_ACCESS_TOKEN` | auth token for `--linked` | no (keyring → `~/.supabase/access-token`) | -| `SUPABASE_PROJECT_ID` | linked project ref override | no | -| `SUPABASE_PROFILE` | API profile (built-in name or YAML path) | no | -| `PGHOST` / `PGPORT` / … | connection overrides (local / `--db-url`) | no | +| Variable | Purpose | Required? | +| ----------------------- | ----------------------------------------- | ------------------------------------------------------------ | +| `SUPABASE_ACCESS_TOKEN` | auth token for `--linked` | no (keyring → `/access-token`) | +| `SUPABASE_PROJECT_ID` | linked project ref override | no | +| `SUPABASE_PROFILE` | API profile (built-in name or YAML path) | no | +| `PGHOST` / `PGPORT` / … | connection overrides (local / `--db-url`) | no | The API base URL is derived from `SUPABASE_PROFILE`; `SUPABASE_API_URL` is **not** honored (Go parity — see `legacy-cli-config.layer.unit.test.ts`). diff --git a/apps/cli/src/legacy/commands/db/diff/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/db/diff/SIDE_EFFECTS.md index 6f600f741f..00435a87db 100644 --- a/apps/cli/src/legacy/commands/db/diff/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/db/diff/SIDE_EFFECTS.md @@ -2,10 +2,10 @@ ## Files Read -| Path | Format | When | -| -------------------------------- | ---------- | --------------------------------------------------------------- | -| `~/.supabase/access-token` | plain text | when `SUPABASE_ACCESS_TOKEN` unset and `--linked` or `--db-url` | -| `/supabase/config.toml` | TOML | always, to resolve local DB config | +| Path | Format | When | +| --------------------------------------------- | ---------- | --------------------------------------------------------------- | +| `/access-token` | plain text | when `SUPABASE_ACCESS_TOKEN` unset and `--linked` or `--db-url` | +| `/supabase/config.toml` | TOML | always, to resolve local DB config | ## Files Written @@ -21,10 +21,10 @@ ## Environment Variables -| Variable | Purpose | Required? | -| ----------------------- | --------------------------------------- | ------------------------------------------------------- | -| `SUPABASE_ACCESS_TOKEN` | auth token for `--linked` mode | no (falls back to keyring → `~/.supabase/access-token`) | -| `DB_PASSWORD` | password for direct database connection | no | +| Variable | Purpose | Required? | +| ----------------------- | --------------------------------------- | -------------------------------------------------------------------------- | +| `SUPABASE_ACCESS_TOKEN` | auth token for `--linked` mode | no (falls back to keyring → `/access-token`) | +| `DB_PASSWORD` | password for direct database connection | no | ## Exit Codes diff --git a/apps/cli/src/legacy/commands/db/dump/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/db/dump/SIDE_EFFECTS.md index 477ee86159..7d774fa728 100644 --- a/apps/cli/src/legacy/commands/db/dump/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/db/dump/SIDE_EFFECTS.md @@ -5,13 +5,13 @@ script run inside the local Postgres image to stdout or `--file`. ## Files Read -| Path | Format | When | -| --------------------------------- | ---------- | ----------------------------------------------------------- | -| `supabase/config.toml` | TOML | always (db port/password/major_version, project_id) | -| `supabase/.temp/postgres-version` | plain text | always (best-effort) — pins the pg image tag when present | -| `supabase/.temp/pooler-url` | plain text | `--linked` when the direct host is unreachable (pooler URL) | -| `~/.supabase/access-token` | plain text | `--linked` when `SUPABASE_ACCESS_TOKEN` unset | -| `supabase/.env*` | dotenv | always (project env, feeds `SUPABASE_DB_PASSWORD` / `PG*`) | +| Path | Format | When | +| --------------------------------------------- | ---------- | ----------------------------------------------------------- | +| `supabase/config.toml` | TOML | always (db port/password/major_version, project_id) | +| `supabase/.temp/postgres-version` | plain text | always (best-effort) — pins the pg image tag when present | +| `supabase/.temp/pooler-url` | plain text | `--linked` when the direct host is unreachable (pooler URL) | +| `/access-token` | plain text | `--linked` when `SUPABASE_ACCESS_TOKEN` unset | +| `supabase/.env*` | dotenv | always (project env, feeds `SUPABASE_DB_PASSWORD` / `PG*`) | ## Files Written diff --git a/apps/cli/src/legacy/commands/db/lint/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/db/lint/SIDE_EFFECTS.md index f76f966c3c..7226bd28c0 100644 --- a/apps/cli/src/legacy/commands/db/lint/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/db/lint/SIDE_EFFECTS.md @@ -5,16 +5,16 @@ Native TypeScript port of Go's `internal/db/lint`. ## Files Read -| Path | Format | When | -| -------------------------------- | ---------- | -------------------------------------------------------------------- | -| `/supabase/config.toml` | TOML | always — to resolve the local / linked DB connection config | -| `~/.supabase/access-token` | plain text | `--linked` only, when `SUPABASE_ACCESS_TOKEN` unset (keyring → file) | +| Path | Format | When | +| --------------------------------------------- | ---------- | -------------------------------------------------------------------- | +| `/supabase/config.toml` | TOML | always — to resolve the local / linked DB connection config | +| `/access-token` | plain text | `--linked` only, when `SUPABASE_ACCESS_TOKEN` unset (keyring → file) | ## Files Written -| Path | Format | When | -| ---------------------------- | ------ | ---------------------------------------------------- | -| `~/.supabase/telemetry.json` | JSON | always (PostHog state flush, Go `PersistentPostRun`) | +| Path | Format | When | +| ----------------------------------------------- | ------ | ---------------------------------------------------- | +| `/telemetry.json` | JSON | always (PostHog state flush, Go `PersistentPostRun`) | No user data is written: the lint runs inside a transaction that is **always rolled back** (`BEGIN` … `ROLLBACK`), matching Go — including @@ -43,12 +43,12 @@ the extension fails at step 3 (matching Go). ## Environment Variables -| Variable | Purpose | Required? | -| ----------------------- | ---------------------------------------- | ----------------------------------------- | -| `SUPABASE_ACCESS_TOKEN` | auth token for `--linked` resolution | no (keyring → `~/.supabase/access-token`) | -| `SUPABASE_DB_PASSWORD` | linked direct-DB password | no | -| `SUPABASE_PROFILE` | API profile (built-in name or YAML path) | no | -| `PGHOST` / `PGPORT` / … | connection overrides | no | +| Variable | Purpose | Required? | +| ----------------------- | ---------------------------------------- | ------------------------------------------------------------ | +| `SUPABASE_ACCESS_TOKEN` | auth token for `--linked` resolution | no (keyring → `/access-token`) | +| `SUPABASE_DB_PASSWORD` | linked direct-DB password | no | +| `SUPABASE_PROFILE` | API profile (built-in name or YAML path) | no | +| `PGHOST` / `PGPORT` / … | connection overrides | no | ## Exit Codes diff --git a/apps/cli/src/legacy/commands/db/pull/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/db/pull/SIDE_EFFECTS.md index f027cb07d8..48224f640b 100644 --- a/apps/cli/src/legacy/commands/db/pull/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/db/pull/SIDE_EFFECTS.md @@ -2,9 +2,9 @@ ## Files Read -| Path | Format | When | -| -------------------------- | ---------- | ------------------------------------------------- | -| `~/.supabase/access-token` | plain text | when `SUPABASE_ACCESS_TOKEN` unset and `--linked` | +| Path | Format | When | +| --------------------------------------------- | ---------- | ------------------------------------------------- | +| `/access-token` | plain text | when `SUPABASE_ACCESS_TOKEN` unset and `--linked` | ## Files Written @@ -20,10 +20,10 @@ ## Environment Variables -| Variable | Purpose | Required? | -| ----------------------- | --------------------------------------- | ------------------------------------------------------- | -| `SUPABASE_ACCESS_TOKEN` | auth token for `--linked` mode | no (falls back to keyring → `~/.supabase/access-token`) | -| `DB_PASSWORD` | password for direct database connection | no | +| Variable | Purpose | Required? | +| ----------------------- | --------------------------------------- | -------------------------------------------------------------------------- | +| `SUPABASE_ACCESS_TOKEN` | auth token for `--linked` mode | no (falls back to keyring → `/access-token`) | +| `DB_PASSWORD` | password for direct database connection | no | ## Exit Codes diff --git a/apps/cli/src/legacy/commands/db/push/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/db/push/SIDE_EFFECTS.md index 11337a8955..a940e9657b 100644 --- a/apps/cli/src/legacy/commands/db/push/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/db/push/SIDE_EFFECTS.md @@ -2,12 +2,12 @@ ## Files Read -| Path | Format | When | -| -------------------------------- | ---------- | ------------------------------------------------- | -| `~/.supabase/access-token` | plain text | when `SUPABASE_ACCESS_TOKEN` unset and `--linked` | -| `/supabase/migrations/` | directory | always, to list migration files to push | -| `/supabase/roles.sql` | SQL | when `--include-roles` is set | -| seed files from config | SQL | when `--include-seed` is set | +| Path | Format | When | +| --------------------------------------------- | ---------- | ------------------------------------------------- | +| `/access-token` | plain text | when `SUPABASE_ACCESS_TOKEN` unset and `--linked` | +| `/supabase/migrations/` | directory | always, to list migration files to push | +| `/supabase/roles.sql` | SQL | when `--include-roles` is set | +| seed files from config | SQL | when `--include-seed` is set | ## Files Written @@ -23,10 +23,10 @@ ## Environment Variables -| Variable | Purpose | Required? | -| ----------------------- | --------------------------------------- | ------------------------------------------------------- | -| `SUPABASE_ACCESS_TOKEN` | auth token for `--linked` mode | no (falls back to keyring → `~/.supabase/access-token`) | -| `DB_PASSWORD` | password for direct database connection | no | +| Variable | Purpose | Required? | +| ----------------------- | --------------------------------------- | -------------------------------------------------------------------------- | +| `SUPABASE_ACCESS_TOKEN` | auth token for `--linked` mode | no (falls back to keyring → `/access-token`) | +| `DB_PASSWORD` | password for direct database connection | no | ## Exit Codes diff --git a/apps/cli/src/legacy/commands/db/query/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/db/query/SIDE_EFFECTS.md index 775bac2733..8689e9f038 100644 --- a/apps/cli/src/legacy/commands/db/query/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/db/query/SIDE_EFFECTS.md @@ -6,13 +6,13 @@ the result as a table or JSON. ## Files Read -| Path | Format | When | -| ------------------------------------ | ---------- | ------------------------------------------------------------- | -| `` (from `--file`) | SQL | when `--file` / `-f` is set (takes precedence over arg/stdin) | -| stdin | SQL | when piped (not a TTY) and no `--file`/positional SQL | -| `supabase/config.toml` | TOML | local / `--db-url` connection resolution | -| `~/.supabase/access-token` | plain text | `--linked` when `SUPABASE_ACCESS_TOKEN` unset | -| `supabase/.temp/linked-project.json` | JSON | `--linked` existence check before the cache write (see below) | +| Path | Format | When | +| --------------------------------------------- | ---------- | ------------------------------------------------------------- | +| `` (from `--file`) | SQL | when `--file` / `-f` is set (takes precedence over arg/stdin) | +| stdin | SQL | when piped (not a TTY) and no `--file`/positional SQL | +| `supabase/config.toml` | TOML | local / `--db-url` connection resolution | +| `/access-token` | plain text | `--linked` when `SUPABASE_ACCESS_TOKEN` unset | +| `supabase/.temp/linked-project.json` | JSON | `--linked` existence check before the cache write (see below) | ## Files Written diff --git a/apps/cli/src/legacy/commands/db/remote/changes/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/db/remote/changes/SIDE_EFFECTS.md index 5ac5c8f9fa..a347c0f58f 100644 --- a/apps/cli/src/legacy/commands/db/remote/changes/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/db/remote/changes/SIDE_EFFECTS.md @@ -2,9 +2,9 @@ ## Files Read -| Path | Format | When | -| -------------------------- | ---------- | ---------------------------------- | -| `~/.supabase/access-token` | plain text | when `SUPABASE_ACCESS_TOKEN` unset | +| Path | Format | When | +| --------------------------------------------- | ---------- | ---------------------------------- | +| `/access-token` | plain text | when `SUPABASE_ACCESS_TOKEN` unset | ## Files Written @@ -20,10 +20,10 @@ ## Environment Variables -| Variable | Purpose | Required? | -| ----------------------- | --------------------------------------- | ------------------------------------------------------- | -| `SUPABASE_ACCESS_TOKEN` | auth token | no (falls back to keyring → `~/.supabase/access-token`) | -| `DB_PASSWORD` | password for direct database connection | no | +| Variable | Purpose | Required? | +| ----------------------- | --------------------------------------- | -------------------------------------------------------------------------- | +| `SUPABASE_ACCESS_TOKEN` | auth token | no (falls back to keyring → `/access-token`) | +| `DB_PASSWORD` | password for direct database connection | no | ## Exit Codes diff --git a/apps/cli/src/legacy/commands/db/remote/commit/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/db/remote/commit/SIDE_EFFECTS.md index 2b2e6ad3d2..b656ff3b76 100644 --- a/apps/cli/src/legacy/commands/db/remote/commit/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/db/remote/commit/SIDE_EFFECTS.md @@ -2,9 +2,9 @@ ## Files Read -| Path | Format | When | -| -------------------------- | ---------- | ---------------------------------- | -| `~/.supabase/access-token` | plain text | when `SUPABASE_ACCESS_TOKEN` unset | +| Path | Format | When | +| --------------------------------------------- | ---------- | ---------------------------------- | +| `/access-token` | plain text | when `SUPABASE_ACCESS_TOKEN` unset | ## Files Written @@ -20,10 +20,10 @@ ## Environment Variables -| Variable | Purpose | Required? | -| ----------------------- | --------------------------------------- | ------------------------------------------------------- | -| `SUPABASE_ACCESS_TOKEN` | auth token | no (falls back to keyring → `~/.supabase/access-token`) | -| `DB_PASSWORD` | password for direct database connection | no | +| Variable | Purpose | Required? | +| ----------------------- | --------------------------------------- | -------------------------------------------------------------------------- | +| `SUPABASE_ACCESS_TOKEN` | auth token | no (falls back to keyring → `/access-token`) | +| `DB_PASSWORD` | password for direct database connection | no | ## Exit Codes diff --git a/apps/cli/src/legacy/commands/db/reset/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/db/reset/SIDE_EFFECTS.md index a2c24f24d2..825373d293 100644 --- a/apps/cli/src/legacy/commands/db/reset/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/db/reset/SIDE_EFFECTS.md @@ -2,11 +2,11 @@ ## Files Read -| Path | Format | When | -| -------------------------------- | ---------- | ------------------------------------------------- | -| `~/.supabase/access-token` | plain text | when `SUPABASE_ACCESS_TOKEN` unset and `--linked` | -| `/supabase/migrations/` | directory | always, to load migration files | -| seed files from config | SQL | unless `--no-seed` is set | +| Path | Format | When | +| --------------------------------------------- | ---------- | ------------------------------------------------- | +| `/access-token` | plain text | when `SUPABASE_ACCESS_TOKEN` unset and `--linked` | +| `/supabase/migrations/` | directory | always, to load migration files | +| seed files from config | SQL | unless `--no-seed` is set | ## Files Written @@ -22,10 +22,10 @@ ## Environment Variables -| Variable | Purpose | Required? | -| ----------------------- | --------------------------------------- | ------------------------------------------------------- | -| `SUPABASE_ACCESS_TOKEN` | auth token for `--linked` mode | no (falls back to keyring → `~/.supabase/access-token`) | -| `DB_PASSWORD` | password for direct database connection | no | +| Variable | Purpose | Required? | +| ----------------------- | --------------------------------------- | -------------------------------------------------------------------------- | +| `SUPABASE_ACCESS_TOKEN` | auth token for `--linked` mode | no (falls back to keyring → `/access-token`) | +| `DB_PASSWORD` | password for direct database connection | no | ## Exit Codes diff --git a/apps/cli/src/legacy/commands/db/schema/declarative/generate/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/db/schema/declarative/generate/SIDE_EFFECTS.md index 5df90ac1a9..5bac89ce53 100644 --- a/apps/cli/src/legacy/commands/db/schema/declarative/generate/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/db/schema/declarative/generate/SIDE_EFFECTS.md @@ -13,7 +13,7 @@ pg-delta catalog (source) against the target database's catalog (target). | `/supabase/.temp/postgres-version` | plain text | shadow-DB image resolution (Go seam) | | `/supabase/migrations/*.sql` | SQL | smart mode — detect whether migrations exist | | `/supabase/.temp/pgdelta/*.json` | JSON | catalog cache (read/written by the Go seam) | -| `~/.supabase/access-token` | plain text | `--linked` (token resolution) | +| `/access-token` | plain text | `--linked` (token resolution) | ## Files Written diff --git a/apps/cli/src/legacy/commands/db/test/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/db/test/SIDE_EFFECTS.md index 628a03173c..223ee37308 100644 --- a/apps/cli/src/legacy/commands/db/test/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/db/test/SIDE_EFFECTS.md @@ -2,10 +2,10 @@ ## Files Read -| Path | Format | When | -| -------------------------- | ---------- | ------------------------------------------------- | -| `~/.supabase/access-token` | plain text | when `SUPABASE_ACCESS_TOKEN` unset and `--linked` | -| `[path] ...` (positional) | SQL (TAP) | test files specified as positional arguments | +| Path | Format | When | +| --------------------------------------------- | ---------- | ------------------------------------------------- | +| `/access-token` | plain text | when `SUPABASE_ACCESS_TOKEN` unset and `--linked` | +| `[path] ...` (positional) | SQL (TAP) | test files specified as positional arguments | ## Files Written @@ -21,10 +21,10 @@ ## Environment Variables -| Variable | Purpose | Required? | -| ----------------------- | --------------------------------------- | ------------------------------------------------------- | -| `SUPABASE_ACCESS_TOKEN` | auth token for `--linked` mode | no (falls back to keyring → `~/.supabase/access-token`) | -| `DB_PASSWORD` | password for direct database connection | no | +| Variable | Purpose | Required? | +| ----------------------- | --------------------------------------- | -------------------------------------------------------------------------- | +| `SUPABASE_ACCESS_TOKEN` | auth token for `--linked` mode | no (falls back to keyring → `/access-token`) | +| `DB_PASSWORD` | password for direct database connection | no | ## Exit Codes diff --git a/apps/cli/src/legacy/commands/domains/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/domains/SIDE_EFFECTS.md index 90660186db..cf15857bf6 100644 --- a/apps/cli/src/legacy/commands/domains/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/domains/SIDE_EFFECTS.md @@ -6,17 +6,17 @@ Cloudflare DNS-over-HTTPS CNAME pre-check. ## Files Read -| Path | Format | When | -| -------------------------------------- | ------------------------- | ---------------------------------------------------------- | -| `~/.supabase/access-token` | plain text (token string) | when `SUPABASE_ACCESS_TOKEN` unset and keyring unavailable | -| `/supabase/.temp/project-ref` | plain text | when `--project-ref` flag and `PROJECT_ID` env are unset | +| Path | Format | When | +| --------------------------------------------- | ------------------------- | ---------------------------------------------------------- | +| `/access-token` | plain text (token string) | when `SUPABASE_ACCESS_TOKEN` unset and keyring unavailable | +| `/supabase/.temp/project-ref` | plain text | when `--project-ref` flag and `PROJECT_ID` env are unset | ## Files Written | Path | Format | When | | ------------------------------------------------ | ------ | -------------------------------------------------- | | `~/.supabase//linked-project.json` | JSON | always (PersistentPostRun), after the ref resolves | -| `~/.supabase/telemetry.json` | JSON | always (PersistentPostRun), success or failure | +| `/telemetry.json` | JSON | always (PersistentPostRun), success or failure | ## API Routes @@ -31,11 +31,11 @@ Cloudflare DNS-over-HTTPS CNAME pre-check. ## Environment Variables -| Variable | Purpose | Required? | -| ----------------------- | ---------------------------------------------------- | -------------------------------------------------------- | -| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `~/.supabase/access-token`) | -| `SUPABASE_PROJECT_ID` | project ref fallback when `--project-ref` is unset | no (falls back to linked-project file) | -| `SUPABASE_PROFILE` | built-in profile name or path to a YAML profile | no (defaults to `supabase`; sets API URL + project host) | +| Variable | Purpose | Required? | +| ----------------------- | ---------------------------------------------------- | -------------------------------------------------------------------------- | +| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `/access-token`) | +| `SUPABASE_PROJECT_ID` | project ref fallback when `--project-ref` is unset | no (falls back to linked-project file) | +| `SUPABASE_PROFILE` | built-in profile name or path to a YAML profile | no (defaults to `supabase`; sets API URL + project host) | ## Exit Codes diff --git a/apps/cli/src/legacy/commands/encryption/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/encryption/SIDE_EFFECTS.md index 458b7aeb86..2151828cca 100644 --- a/apps/cli/src/legacy/commands/encryption/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/encryption/SIDE_EFFECTS.md @@ -8,7 +8,7 @@ additionally reads the new key from stdin. | Path | Format | When | | ------------------------------------------------ | ------------------------- | ------------------------------------------------------------------ | -| `~/.supabase/access-token` | plain text (token string) | when `SUPABASE_ACCESS_TOKEN` unset and keyring unavailable | +| `/access-token` | plain text (token string) | when `SUPABASE_ACCESS_TOKEN` unset and keyring unavailable | | `~/.supabase//linked-project.json` | JSON | when `--project-ref` / `PROJECT_ID` unset, to resolve linked ref | | stdin | raw bytes / masked TTY | `update-root-key` only — masked TTY input or piped bytes (the key) | @@ -17,7 +17,7 @@ additionally reads the new key from stdin. | Path | Format | When | | ------------------------------------------------ | ------ | ------------------------------------------------- | | `~/.supabase//linked-project.json` | JSON | PersistentPostRun, after the project ref resolves | -| `~/.supabase/telemetry.json` | JSON | PersistentPostRun, on success or failure | +| `/telemetry.json` | JSON | PersistentPostRun, on success or failure | ## API Routes @@ -30,12 +30,12 @@ additionally reads the new key from stdin. ## Environment Variables -| Variable | Purpose | Required? | -| ------------------------------------ | ---------------------------------------------------- | ------------------------------------------------------- | -| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `~/.supabase/access-token`) | -| `SUPABASE_PROJECT_ID` / `PROJECT_ID` | project ref (fallback when `--project-ref` unset) | no (falls back to linked-project file → prompt) | -| `SUPABASE_API_URL` | override Management API base URL | no (defaults to `https://api.supabase.com`) | -| `SUPABASE_PROFILE` | built-in profile name or YAML file path | no (defaults to `supabase`) | +| Variable | Purpose | Required? | +| ------------------------------------ | ---------------------------------------------------- | -------------------------------------------------------------------------- | +| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `/access-token`) | +| `SUPABASE_PROJECT_ID` / `PROJECT_ID` | project ref (fallback when `--project-ref` unset) | no (falls back to linked-project file → prompt) | +| `SUPABASE_API_URL` | override Management API base URL | no (defaults to `https://api.supabase.com`) | +| `SUPABASE_PROFILE` | built-in profile name or YAML file path | no (defaults to `supabase`) | ## Exit Codes diff --git a/apps/cli/src/legacy/commands/functions/delete/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/functions/delete/SIDE_EFFECTS.md index f3914b1b22..bda12fa6a8 100644 --- a/apps/cli/src/legacy/commands/functions/delete/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/functions/delete/SIDE_EFFECTS.md @@ -2,9 +2,9 @@ ## Files Read -| Path | Format | When | -| -------------------------- | ---------- | ---------------------------------------------------------- | -| `~/.supabase/access-token` | plain text | when `SUPABASE_ACCESS_TOKEN` unset and keyring unavailable | +| Path | Format | When | +| --------------------------------------------- | ---------- | ---------------------------------------------------------- | +| `/access-token` | plain text | when `SUPABASE_ACCESS_TOKEN` unset and keyring unavailable | ## Files Written @@ -20,10 +20,10 @@ ## Environment Variables -| Variable | Purpose | Required? | -| ----------------------- | ---------------------------------------------------- | ------------------------------------------------------- | -| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `~/.supabase/access-token`) | -| `SUPABASE_API_URL` | override Management API base URL | no (defaults to `https://api.supabase.com`) | +| Variable | Purpose | Required? | +| ----------------------- | ---------------------------------------------------- | -------------------------------------------------------------------------- | +| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `/access-token`) | +| `SUPABASE_API_URL` | override Management API base URL | no (defaults to `https://api.supabase.com`) | ## Exit Codes diff --git a/apps/cli/src/legacy/commands/functions/deploy/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/functions/deploy/SIDE_EFFECTS.md index caa742cc89..835099d79c 100644 --- a/apps/cli/src/legacy/commands/functions/deploy/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/functions/deploy/SIDE_EFFECTS.md @@ -4,7 +4,7 @@ | Path | Format | When | | ---------------------------------------------- | ---------- | ----------------------------------------------------------- | -| `~/.supabase/access-token` | plain text | when `SUPABASE_ACCESS_TOKEN` unset and keyring unavailable | +| `/access-token` | plain text | when `SUPABASE_ACCESS_TOKEN` unset and keyring unavailable | | `/supabase/config.toml` | TOML | to resolve function config, project id, and local Functions | | `/supabase/functions//index.ts` | TypeScript | function source to deploy | | `/supabase/functions/**/deno.json*` | JSON/JSONC | when resolving import maps | @@ -43,13 +43,13 @@ Docker bundling may pull or run the configured edge-runtime image and uses the ## Environment Variables -| Variable | Purpose | Required? | -| ---------------------------------- | ---------------------------------------------------- | ------------------------------------------------------- | -| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `~/.supabase/access-token`) | -| `SUPABASE_PROJECT_ID` | optional project ref fallback | no | -| `SUPABASE_INTERNAL_IMAGE_REGISTRY` | selects the Functions bundler image registry | no | -| `NPM_CONFIG_REGISTRY` | forwarded into Docker bundling when set | no | -| `DEBUG` | enables verbose Docker bundle output when `true` | no | +| Variable | Purpose | Required? | +| ---------------------------------- | ---------------------------------------------------- | -------------------------------------------------------------------------- | +| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `/access-token`) | +| `SUPABASE_PROJECT_ID` | optional project ref fallback | no | +| `SUPABASE_INTERNAL_IMAGE_REGISTRY` | selects the Functions bundler image registry | no | +| `NPM_CONFIG_REGISTRY` | forwarded into Docker bundling when set | no | +| `DEBUG` | enables verbose Docker bundle output when `true` | no | ## Exit Codes diff --git a/apps/cli/src/legacy/commands/functions/download/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/functions/download/SIDE_EFFECTS.md index 7a70bcb517..9bbd1cd35a 100644 --- a/apps/cli/src/legacy/commands/functions/download/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/functions/download/SIDE_EFFECTS.md @@ -2,9 +2,9 @@ ## Files Read -| Path | Format | When | -| -------------------------- | ---------- | ---------------------------------------------------------- | -| `~/.supabase/access-token` | plain text | when `SUPABASE_ACCESS_TOKEN` unset and keyring unavailable | +| Path | Format | When | +| --------------------------------------------- | ---------- | ---------------------------------------------------------- | +| `/access-token` | plain text | when `SUPABASE_ACCESS_TOKEN` unset and keyring unavailable | ## Files Written @@ -28,10 +28,10 @@ ## Environment Variables -| Variable | Purpose | Required? | -| ----------------------- | ---------------------------------------------------- | ------------------------------------------------------- | -| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `~/.supabase/access-token`) | -| `SUPABASE_API_URL` | override Management API base URL | no (defaults to `https://api.supabase.com`) | +| Variable | Purpose | Required? | +| ----------------------- | ---------------------------------------------------- | -------------------------------------------------------------------------- | +| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `/access-token`) | +| `SUPABASE_API_URL` | override Management API base URL | no (defaults to `https://api.supabase.com`) | ## Exit Codes diff --git a/apps/cli/src/legacy/commands/functions/list/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/functions/list/SIDE_EFFECTS.md index e725372ecc..70034ea88e 100644 --- a/apps/cli/src/legacy/commands/functions/list/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/functions/list/SIDE_EFFECTS.md @@ -2,9 +2,9 @@ ## Files Read -| Path | Format | When | -| -------------------------- | ---------- | ---------------------------------------------------------- | -| `~/.supabase/access-token` | plain text | when `SUPABASE_ACCESS_TOKEN` unset and keyring unavailable | +| Path | Format | When | +| --------------------------------------------- | ---------- | ---------------------------------------------------------- | +| `/access-token` | plain text | when `SUPABASE_ACCESS_TOKEN` unset and keyring unavailable | ## Files Written @@ -20,10 +20,10 @@ ## Environment Variables -| Variable | Purpose | Required? | -| ----------------------- | ---------------------------------------------------- | ------------------------------------------------------- | -| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `~/.supabase/access-token`) | -| `SUPABASE_API_URL` | override Management API base URL | no (defaults to `https://api.supabase.com`) | +| Variable | Purpose | Required? | +| ----------------------- | ---------------------------------------------------- | -------------------------------------------------------------------------- | +| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `/access-token`) | +| `SUPABASE_API_URL` | override Management API base URL | no (defaults to `https://api.supabase.com`) | ## Exit Codes diff --git a/apps/cli/src/legacy/commands/gen/keys/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/gen/keys/SIDE_EFFECTS.md index 325e8d58ed..4e5934ef8e 100644 --- a/apps/cli/src/legacy/commands/gen/keys/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/gen/keys/SIDE_EFFECTS.md @@ -20,10 +20,10 @@ ## Environment Variables -| Variable | Purpose | Required? | -| ----------------------- | -------------------------------- | ------------------------------------------------------- | -| `SUPABASE_ACCESS_TOKEN` | auth token | no (falls back to keyring → `~/.supabase/access-token`) | -| `SUPABASE_API_URL` | override Management API base URL | no (defaults to `https://api.supabase.com`) | +| Variable | Purpose | Required? | +| ----------------------- | -------------------------------- | -------------------------------------------------------------------------- | +| `SUPABASE_ACCESS_TOKEN` | auth token | no (falls back to keyring → `/access-token`) | +| `SUPABASE_API_URL` | override Management API base URL | no (defaults to `https://api.supabase.com`) | ## Exit Codes diff --git a/apps/cli/src/legacy/commands/gen/types/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/gen/types/SIDE_EFFECTS.md index fbfc293fa2..18f12e9d8b 100644 --- a/apps/cli/src/legacy/commands/gen/types/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/gen/types/SIDE_EFFECTS.md @@ -2,12 +2,12 @@ ## Files Read -| Path | Format | When | -| ----------------------------------------- | ---------- | ---------------------------------------------------------------------------------------- | -| `~/.supabase/access-token` | plain text | when `SUPABASE_ACCESS_TOKEN` unset and `--linked` or `--project-id` | -| `/supabase/config.toml` | TOML | when `--local` (required) or `--db-url` (best-effort) is specified | -| `/supabase/.temp/rest-version` | plain text | `--local` only, when `db.major_version > 14` — forces v9 compat if the tag contains `v9` | -| `/supabase/.temp/pgmeta-version` | plain text | `--local` only — overrides the pg-meta docker image tag | +| Path | Format | When | +| --------------------------------------------- | ---------- | ---------------------------------------------------------------------------------------- | +| `/access-token` | plain text | when `SUPABASE_ACCESS_TOKEN` unset and `--linked` or `--project-id` | +| `/supabase/config.toml` | TOML | when `--local` (required) or `--db-url` (best-effort) is specified | +| `/supabase/.temp/rest-version` | plain text | `--local` only, when `db.major_version > 14` — forces v9 compat if the tag contains `v9` | +| `/supabase/.temp/pgmeta-version` | plain text | `--local` only — overrides the pg-meta docker image tag | ## Files Written @@ -40,14 +40,14 @@ detect TLS support before launching pg-meta (mirrors Go's `isRequireSSL`). ## Environment Variables -| Variable | Purpose | Required? | -| ---------------------------------- | ----------------------------------------------------------------- | ------------------------------------------------------- | -| `SUPABASE_ACCESS_TOKEN` | auth token for linked/project-id mode | no (falls back to keyring → `~/.supabase/access-token`) | -| `SUPABASE_API_URL` | override Management API base URL | no (defaults to `https://api.supabase.com`) | -| `SUPABASE_DB_PASSWORD` | local database password for `--local` | no (defaults to `postgres`) | -| `SUPABASE_SERVICES_HOSTNAME` | host used for the local TLS probe | no (defaults to `127.0.0.1`) | -| `SUPABASE_INTERNAL_IMAGE_REGISTRY` | pg-meta image registry override (`docker.io` → Docker Hub) | no (defaults to the ECR registry) | -| `SUPABASE_CA_SKIP_VERIFY` | when `true`, prints a TLS-verification-disabled warning to stderr | no | +| Variable | Purpose | Required? | +| ---------------------------------- | ----------------------------------------------------------------- | -------------------------------------------------------------------------- | +| `SUPABASE_ACCESS_TOKEN` | auth token for linked/project-id mode | no (falls back to keyring → `/access-token`) | +| `SUPABASE_API_URL` | override Management API base URL | no (defaults to `https://api.supabase.com`) | +| `SUPABASE_DB_PASSWORD` | local database password for `--local` | no (defaults to `postgres`) | +| `SUPABASE_SERVICES_HOSTNAME` | host used for the local TLS probe | no (defaults to `127.0.0.1`) | +| `SUPABASE_INTERNAL_IMAGE_REGISTRY` | pg-meta image registry override (`docker.io` → Docker Hub) | no (defaults to the ECR registry) | +| `SUPABASE_CA_SKIP_VERIFY` | when `true`, prints a TLS-verification-disabled warning to stderr | no | ## Exit Codes diff --git a/apps/cli/src/legacy/commands/inspect/db/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/inspect/db/SIDE_EFFECTS.md index f5728c86be..263e7964b6 100644 --- a/apps/cli/src/legacy/commands/inspect/db/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/inspect/db/SIDE_EFFECTS.md @@ -8,12 +8,12 @@ SQL run and the columns rendered (see the per-subcommand `.query.ts`). ## Files Read -| Path | Format | When | -| -------------------------------- | ---------- | ----------------------------------------------------------------------------------- | -| `/supabase/config.toml` | TOML | `--local` (db host/port/password); `--linked` (project ref) | -| `~/.supabase/access-token` | plain text | `--linked` only, lazily, when `SUPABASE_ACCESS_TOKEN` unset and keyring unavailable | -| `.pgpass` / `pg_service.conf` | libpq | only if referenced by a `--db-url` connection string | -| `$PGSSLROOTCERT` CA bundle | PEM | only if a `--db-url` sets `sslrootcert` / `PGSSLROOTCERT` | +| Path | Format | When | +| --------------------------------------------- | ---------- | ----------------------------------------------------------------------------------- | +| `/supabase/config.toml` | TOML | `--local` (db host/port/password); `--linked` (project ref) | +| `/access-token` | plain text | `--linked` only, lazily, when `SUPABASE_ACCESS_TOKEN` unset and keyring unavailable | +| `.pgpass` / `pg_service.conf` | libpq | only if referenced by a `--db-url` connection string | +| `$PGSSLROOTCERT` CA bundle | PEM | only if a `--db-url` sets `sslrootcert` / `PGSSLROOTCERT` | Connection resolution and all of the above are handled inside the already-ported `LegacyDbConfigResolver` (`legacy/shared/legacy-db-config.layer.ts`); this port adds @@ -21,9 +21,9 @@ no new config reads. ## Files Written -| Path | Format | When | -| ---------------------------- | ------ | ----------------------------------------------- | -| `~/.supabase/telemetry.json` | JSON | always, post-run (`LegacyTelemetryState.flush`) | +| Path | Format | When | +| ----------------------------------------------- | ------ | ----------------------------------------------- | +| `/telemetry.json` | JSON | always, post-run (`LegacyTelemetryState.flush`) | ## API Routes (MAY fire on `--linked`, inside the resolver) diff --git a/apps/cli/src/legacy/commands/inspect/report/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/inspect/report/SIDE_EFFECTS.md index 7aa35d483f..6f97024606 100644 --- a/apps/cli/src/legacy/commands/inspect/report/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/inspect/report/SIDE_EFFECTS.md @@ -12,7 +12,7 @@ validating those CSVs. Native TypeScript port of `apps/cli-go/internal/inspect/r | `/supabase/.env*` (nested) | dotenv | always — `env(VAR)` expansion for `[db]` and rule string fields | | `/supabase/.temp/pooler-url` | plain text | `--linked` path (pooler connection string) | | `/supabase/.temp/linked-project.json` | JSON | `--linked` path (resolve linked project ref) | -| `~/.supabase/access-token` | plain text | `--linked` path, when `SUPABASE_ACCESS_TOKEN` unset and keyring unavailable | +| `/access-token` | plain text | `--linked` path, when `SUPABASE_ACCESS_TOKEN` unset and keyring unavailable | | `//.csv` ×14 | CSV | read back in-memory for rule evaluation | `config.toml` policy mirrors Go: a **missing** file is fine (defaults apply); a @@ -24,7 +24,7 @@ validating those CSVs. Native TypeScript port of `apps/cli-go/internal/inspect/r | ------------------------------------------------ | ---- | --------------------------------------------------------------- | | `//` (directory) | 0755 | always — created recursively | | `//.csv` ×14 | 0644 | always — one CSV per inspect query (server-side `COPY ... CSV`) | -| `~/.supabase/telemetry.json` | — | always (telemetry flush) | +| `/telemetry.json` | — | always (telemetry flush) | | `~/.supabase//linked-project.json` | — | `--linked` path (linked-project cache) | The 14 CSV basenames (underscored, matching Go's SQL filenames — **not** the diff --git a/apps/cli/src/legacy/commands/link/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/link/SIDE_EFFECTS.md index dab9fddf79..8916872419 100644 --- a/apps/cli/src/legacy/commands/link/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/link/SIDE_EFFECTS.md @@ -5,10 +5,10 @@ Native TypeScript port of Go's `internal/link`. Writes flat state files under ## Files Read -| Path | Format | When | -| -------------------------- | ------------------- | ------------------------------------------------------------------------------------------------- | -| `supabase/config.toml` | TOML (`project_id`) | for ref resolution when `--project-ref` / `SUPABASE_PROJECT_ID` are unset (via `LegacyCliConfig`) | -| `~/.supabase/access-token` | plain text | when `SUPABASE_ACCESS_TOKEN` is unset and the keyring is unavailable | +| Path | Format | When | +| --------------------------------------------- | ------------------- | ------------------------------------------------------------------------------------------------- | +| `supabase/config.toml` | TOML (`project_id`) | for ref resolution when `--project-ref` / `SUPABASE_PROJECT_ID` are unset (via `LegacyCliConfig`) | +| `/access-token` | plain text | when `SUPABASE_ACCESS_TOKEN` is unset and the keyring is unavailable | > The on-disk `supabase/.temp/project-ref` file is **not** read for ref resolution — Go passes an > empty in-memory FS to `ParseProjectRef` (`cmd/link.go:30`), so `link` never falls back to it. @@ -57,7 +57,7 @@ Tenant service gateway (`https://.`, `apikey: ` + | Variable | Purpose | | ----------------------- | ---------------------------------------------------------------------------------------------------------------------------- | | `SUPABASE_PROJECT_ID` | project-ref resolution (flag → env → TTY prompt) | -| `SUPABASE_ACCESS_TOKEN` | Management API bearer auth (env → keyring → `~/.supabase/access-token`) | +| `SUPABASE_ACCESS_TOKEN` | Management API bearer auth (env → keyring → `/access-token`) | | `SUPABASE_DB_PASSWORD` | bound to `--password`; **accepted but a no-op** for `link` (the DB-connection path that would consume it is dead code in Go) | ## Exit Codes diff --git a/apps/cli/src/legacy/commands/login/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/login/SIDE_EFFECTS.md index ef6af8dcdb..21b9fd2742 100644 --- a/apps/cli/src/legacy/commands/login/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/login/SIDE_EFFECTS.md @@ -5,19 +5,19 @@ stitches/clears the telemetry identity and captures `cli_login_completed`. ## Files Read -| Path | Format | When | -| --------------------------------------- | ------------------------- | -------------------------------------------------------------------------- | -| stdin | plain text (token string) | non-TTY only, when `--token` is unset and `SUPABASE_ACCESS_TOKEN` is unset | -| OS keyring / `~/.supabase/access-token` | token string | written, not read, on the login path | +| Path | Format | When | +| ---------------------------------------------------------- | ------------------------- | -------------------------------------------------------------------------- | +| stdin | plain text (token string) | non-TTY only, when `--token` is unset and `SUPABASE_ACCESS_TOKEN` is unset | +| OS keyring / `/access-token` | token string | written, not read, on the login path | ## Files Written | Path | Format | When | | ----------------------------------------------- | ------------------------- | -------------------------------------------------------------------------------------------------------------------------------------- | | OS keyring (`Supabase CLI` / profile) | token string | always on success when the keyring is available | -| `~/.supabase/access-token` | plain text (mode `0600`) | on success when the keyring is unavailable (WSL / `SUPABASE_NO_KEYRING`) | +| `/access-token` | plain text (mode `0600`) | on success when the keyring is unavailable (WSL / `SUPABASE_NO_KEYRING`) | | `/telemetry.json` | JSON | always (PersistentPostRun flush); `distinct_id` set on stitch, removed on clear | -| `~/.supabase/profile` | plain text (profile name) | on success only, when a profile is explicitly set (`--profile` ≠ default, else `SUPABASE_PROFILE`) — Go's `PostRunE`/`SaveProfileName` | +| `/profile` | plain text (profile name) | on success only, when a profile is explicitly set (`--profile` ≠ default, else `SUPABASE_PROFILE`) — Go's `PostRunE`/`SaveProfileName` | ## API Routes @@ -38,13 +38,13 @@ stitches/clears the telemetry identity and captures `cli_login_completed`. ## Exit Codes -| Code | Condition | -| ---- | ------------------------------------------------------------------------------------------- | -| `0` | success (token path or browser path) | -| `1` | invalid `--token` (`cannot save provided token: …`) | -| `1` | non-TTY with no token (`Cannot use automatic login flow inside non-TTY environments. …`) | -| `1` | keygen failure, verification retries exhausted, or decryption failure (browser path) | -| `1` | failure to persist `~/.supabase/profile` (Go blocks subsequent CI commands on save failure) | +| Code | Condition | +| ---- | -------------------------------------------------------------------------------------------------------------- | +| `0` | success (token path or browser path) | +| `1` | invalid `--token` (`cannot save provided token: …`) | +| `1` | non-TTY with no token (`Cannot use automatic login flow inside non-TTY environments. …`) | +| `1` | keygen failure, verification retries exhausted, or decryption failure (browser path) | +| `1` | failure to persist `/profile` (Go blocks subsequent CI commands on save failure) | Browser-open failure is non-fatal (logged, ignored — `login.go:206-208`). @@ -79,5 +79,5 @@ are suppressed. Interactive prompts (browser path) fail with `NonInteractiveErro - Token resolution priority: `--token` → `SUPABASE_ACCESS_TOKEN` → piped stdin (non-TTY) → browser flow (TTY). - The login-session query string is built without URL-encoding, matching Go (`login.go:197-198`). - Telemetry stitch always replaces a stale `distinct_id` (Go's `StitchLogin`), independent of the platform-API auto-stitch. The stitch _aliases_ only — Go's login never calls `identify`. -- On success, an explicitly-set profile is persisted to `~/.supabase/profile` (Go's `PostRunE`); `LegacyCliConfig` reads it back as the lowest-precedence profile source. +- On success, an explicitly-set profile is persisted to `/profile` (Go's `PostRunE`); `LegacyCliConfig` reads it back as the lowest-precedence profile source. - Aqua/Bold styling from Go renders as plain text (parity on a non-TTY). diff --git a/apps/cli/src/legacy/commands/login/login.e2e.test.ts b/apps/cli/src/legacy/commands/login/login.e2e.test.ts index 3158d3a3ea..3f11eb944b 100644 --- a/apps/cli/src/legacy/commands/login/login.e2e.test.ts +++ b/apps/cli/src/legacy/commands/login/login.e2e.test.ts @@ -11,7 +11,7 @@ const VALID_TOKEN = "sbp_" + "a".repeat(40); describe("supabase login (legacy)", () => { // Golden path: --token persists the access token and reports success. The e2e // harness sets SUPABASE_NO_KEYRING=1, so the token lands in the isolated - // HOME's ~/.supabase/access-token rather than the OS keyring. + // The Supabase home access-token file rather than the OS keyring. test( "login --token persists the token and prints the logged-in message", { timeout: E2E_TIMEOUT_MS }, diff --git a/apps/cli/src/legacy/commands/login/login.handler.ts b/apps/cli/src/legacy/commands/login/login.handler.ts index 52e0a08aae..e08cf6b942 100644 --- a/apps/cli/src/legacy/commands/login/login.handler.ts +++ b/apps/cli/src/legacy/commands/login/login.handler.ts @@ -36,10 +36,11 @@ export const legacyLogin = Effect.fn("legacy.login")(function* (flags: LegacyLog // Mirrors Go's login `PostRunE` (`cmd/login.go:42-48`): when a profile was // explicitly chosen (`--profile` over its default, else `SUPABASE_PROFILE`), - // persist it to `~/.supabase/profile` on success so later commands resolve the - // same profile. The raw token is written (Go's `viper.GetString("PROFILE")`), - // so a YAML-path profile round-trips. A write failure is fatal (Go: "Failure - // to save should block subsequent commands on CI"). + // persist it to `/profile` on success so later + // commands resolve the same profile. The raw token is written (Go's + // `viper.GetString("PROFILE")`), so a YAML-path profile round-trips. A write + // failure is fatal (Go: "Failure to save should block subsequent commands on + // CI"). const envProfile = process.env["SUPABASE_PROFILE"]; const profileToken = profileFlag !== "supabase" diff --git a/apps/cli/src/legacy/commands/login/login.integration.test.ts b/apps/cli/src/legacy/commands/login/login.integration.test.ts index 1902ce5721..63fa7214bf 100644 --- a/apps/cli/src/legacy/commands/login/login.integration.test.ts +++ b/apps/cli/src/legacy/commands/login/login.integration.test.ts @@ -328,7 +328,7 @@ describe("legacy login integration", () => { }, ); - it.live("persists ~/.supabase/profile on success when --profile is set", () => { + it.live("persists the Supabase home profile on success when --profile is set", () => { const { layer } = setupLegacyLogin({ profileFlag: "supabase-staging", homeDir: tempRoot.current, diff --git a/apps/cli/src/legacy/commands/logout/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/logout/SIDE_EFFECTS.md index 292843f8f9..81f1b9348d 100644 --- a/apps/cli/src/legacy/commands/logout/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/logout/SIDE_EFFECTS.md @@ -5,15 +5,15 @@ sweeps all stored project credentials. Makes no API calls. ## Files Read -| Path | Format | When | -| -------------------------- | ------------------------- | ---------------------------------------------------- | -| `~/.supabase/access-token` | plain text (token string) | existence is checked before removal (no token parse) | +| Path | Format | When | +| --------------------------------------------- | ------------------------- | ---------------------------------------------------- | +| `/access-token` | plain text (token string) | existence is checked before removal (no token parse) | ## Files Written | Path | Format | When | | ----------------------------------------------- | ------ | ---------------------------------------------------------------------------- | -| `~/.supabase/access-token` | — | deleted first, always (a missing file is ignored) | +| `/access-token` | — | deleted first, always (a missing file is ignored) | | OS keyring (`Supabase CLI` namespace) | — | the access-token entries **and** all project DB-password entries are deleted | | `/telemetry.json` | JSON | always (PersistentPostRun flush) | diff --git a/apps/cli/src/legacy/commands/migration/down/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/migration/down/SIDE_EFFECTS.md index acd5efd4b0..bdb1bc0d26 100644 --- a/apps/cli/src/legacy/commands/migration/down/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/migration/down/SIDE_EFFECTS.md @@ -2,10 +2,10 @@ ## Files Read -| Path | Format | When | -| -------------------------------- | ---------- | ------------------------------------------------- | -| `/supabase/migrations/` | directory | always, to read migration files | -| `~/.supabase/access-token` | plain text | when `SUPABASE_ACCESS_TOKEN` unset and `--linked` | +| Path | Format | When | +| --------------------------------------------- | ---------- | ------------------------------------------------- | +| `/supabase/migrations/` | directory | always, to read migration files | +| `/access-token` | plain text | when `SUPABASE_ACCESS_TOKEN` unset and `--linked` | ## Files Written @@ -21,9 +21,9 @@ ## Environment Variables -| Variable | Purpose | Required? | -| ----------------------- | ------------------------------ | ------------------------------------------------------- | -| `SUPABASE_ACCESS_TOKEN` | auth token for `--linked` mode | no (falls back to keyring → `~/.supabase/access-token`) | +| Variable | Purpose | Required? | +| ----------------------- | ------------------------------ | -------------------------------------------------------------------------- | +| `SUPABASE_ACCESS_TOKEN` | auth token for `--linked` mode | no (falls back to keyring → `/access-token`) | ## Exit Codes diff --git a/apps/cli/src/legacy/commands/migration/fetch/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/migration/fetch/SIDE_EFFECTS.md index 5b7da97b12..4caafd3613 100644 --- a/apps/cli/src/legacy/commands/migration/fetch/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/migration/fetch/SIDE_EFFECTS.md @@ -2,9 +2,9 @@ ## Files Read -| Path | Format | When | -| -------------------------- | ---------- | ------------------------------------------------- | -| `~/.supabase/access-token` | plain text | when `SUPABASE_ACCESS_TOKEN` unset and `--linked` | +| Path | Format | When | +| --------------------------------------------- | ---------- | ------------------------------------------------- | +| `/access-token` | plain text | when `SUPABASE_ACCESS_TOKEN` unset and `--linked` | ## Files Written @@ -20,9 +20,9 @@ ## Environment Variables -| Variable | Purpose | Required? | -| ----------------------- | ------------------------------ | ------------------------------------------------------- | -| `SUPABASE_ACCESS_TOKEN` | auth token for `--linked` mode | no (falls back to keyring → `~/.supabase/access-token`) | +| Variable | Purpose | Required? | +| ----------------------- | ------------------------------ | -------------------------------------------------------------------------- | +| `SUPABASE_ACCESS_TOKEN` | auth token for `--linked` mode | no (falls back to keyring → `/access-token`) | ## Exit Codes diff --git a/apps/cli/src/legacy/commands/migration/list/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/migration/list/SIDE_EFFECTS.md index f4489b05f6..d2c4597850 100644 --- a/apps/cli/src/legacy/commands/migration/list/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/migration/list/SIDE_EFFECTS.md @@ -2,10 +2,10 @@ ## Files Read -| Path | Format | When | -| -------------------------------- | ---------- | ------------------------------------------------- | -| `~/.supabase/access-token` | plain text | when `SUPABASE_ACCESS_TOKEN` unset and `--linked` | -| `/supabase/migrations/` | directory | always, to list local migration files | +| Path | Format | When | +| --------------------------------------------- | ---------- | ------------------------------------------------- | +| `/access-token` | plain text | when `SUPABASE_ACCESS_TOKEN` unset and `--linked` | +| `/supabase/migrations/` | directory | always, to list local migration files | ## Files Written @@ -21,10 +21,10 @@ ## Environment Variables -| Variable | Purpose | Required? | -| ----------------------- | --------------------------------------- | ------------------------------------------------------- | -| `SUPABASE_ACCESS_TOKEN` | auth token for `--linked` mode | no (falls back to keyring → `~/.supabase/access-token`) | -| `DB_PASSWORD` | password for direct database connection | no | +| Variable | Purpose | Required? | +| ----------------------- | --------------------------------------- | -------------------------------------------------------------------------- | +| `SUPABASE_ACCESS_TOKEN` | auth token for `--linked` mode | no (falls back to keyring → `/access-token`) | +| `DB_PASSWORD` | password for direct database connection | no | ## Exit Codes diff --git a/apps/cli/src/legacy/commands/migration/repair/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/migration/repair/SIDE_EFFECTS.md index 3972fbd0d5..f7296decf0 100644 --- a/apps/cli/src/legacy/commands/migration/repair/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/migration/repair/SIDE_EFFECTS.md @@ -2,9 +2,9 @@ ## Files Read -| Path | Format | When | -| -------------------------- | ---------- | ------------------------------------------------- | -| `~/.supabase/access-token` | plain text | when `SUPABASE_ACCESS_TOKEN` unset and `--linked` | +| Path | Format | When | +| --------------------------------------------- | ---------- | ------------------------------------------------- | +| `/access-token` | plain text | when `SUPABASE_ACCESS_TOKEN` unset and `--linked` | ## Files Written @@ -20,10 +20,10 @@ ## Environment Variables -| Variable | Purpose | Required? | -| ----------------------- | --------------------------------------- | ------------------------------------------------------- | -| `SUPABASE_ACCESS_TOKEN` | auth token for `--linked` mode | no (falls back to keyring → `~/.supabase/access-token`) | -| `DB_PASSWORD` | password for direct database connection | no | +| Variable | Purpose | Required? | +| ----------------------- | --------------------------------------- | -------------------------------------------------------------------------- | +| `SUPABASE_ACCESS_TOKEN` | auth token for `--linked` mode | no (falls back to keyring → `/access-token`) | +| `DB_PASSWORD` | password for direct database connection | no | ## Exit Codes diff --git a/apps/cli/src/legacy/commands/migration/squash/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/migration/squash/SIDE_EFFECTS.md index 0f2143dca9..144e57e57d 100644 --- a/apps/cli/src/legacy/commands/migration/squash/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/migration/squash/SIDE_EFFECTS.md @@ -2,10 +2,10 @@ ## Files Read -| Path | Format | When | -| -------------------------------- | ---------- | ------------------------------------------------- | -| `/supabase/migrations/` | directory | always, to read migration files | -| `~/.supabase/access-token` | plain text | when `SUPABASE_ACCESS_TOKEN` unset and `--linked` | +| Path | Format | When | +| --------------------------------------------- | ---------- | ------------------------------------------------- | +| `/supabase/migrations/` | directory | always, to read migration files | +| `/access-token` | plain text | when `SUPABASE_ACCESS_TOKEN` unset and `--linked` | ## Files Written @@ -21,10 +21,10 @@ ## Environment Variables -| Variable | Purpose | Required? | -| ----------------------- | --------------------------------------- | ------------------------------------------------------- | -| `SUPABASE_ACCESS_TOKEN` | auth token for `--linked` mode | no (falls back to keyring → `~/.supabase/access-token`) | -| `DB_PASSWORD` | password for direct database connection | no | +| Variable | Purpose | Required? | +| ----------------------- | --------------------------------------- | -------------------------------------------------------------------------- | +| `SUPABASE_ACCESS_TOKEN` | auth token for `--linked` mode | no (falls back to keyring → `/access-token`) | +| `DB_PASSWORD` | password for direct database connection | no | ## Exit Codes diff --git a/apps/cli/src/legacy/commands/migration/up/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/migration/up/SIDE_EFFECTS.md index f8c090e88c..542f1a3c3a 100644 --- a/apps/cli/src/legacy/commands/migration/up/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/migration/up/SIDE_EFFECTS.md @@ -2,10 +2,10 @@ ## Files Read -| Path | Format | When | -| -------------------------------- | ---------- | ------------------------------------------------- | -| `/supabase/migrations/` | directory | always, to read pending migration files | -| `~/.supabase/access-token` | plain text | when `SUPABASE_ACCESS_TOKEN` unset and `--linked` | +| Path | Format | When | +| --------------------------------------------- | ---------- | ------------------------------------------------- | +| `/supabase/migrations/` | directory | always, to read pending migration files | +| `/access-token` | plain text | when `SUPABASE_ACCESS_TOKEN` unset and `--linked` | ## Files Written @@ -21,9 +21,9 @@ ## Environment Variables -| Variable | Purpose | Required? | -| ----------------------- | ------------------------------ | ------------------------------------------------------- | -| `SUPABASE_ACCESS_TOKEN` | auth token for `--linked` mode | no (falls back to keyring → `~/.supabase/access-token`) | +| Variable | Purpose | Required? | +| ----------------------- | ------------------------------ | -------------------------------------------------------------------------- | +| `SUPABASE_ACCESS_TOKEN` | auth token for `--linked` mode | no (falls back to keyring → `/access-token`) | ## Exit Codes diff --git a/apps/cli/src/legacy/commands/network-bans/get/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/network-bans/get/SIDE_EFFECTS.md index fdb5dbaf68..21be796e4b 100644 --- a/apps/cli/src/legacy/commands/network-bans/get/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/network-bans/get/SIDE_EFFECTS.md @@ -2,17 +2,17 @@ ## Files Read -| Path | Format | When | -| -------------------------------------- | ------------------------- | ------------------------------------------------------------- | -| `~/.supabase/access-token` | plain text (token string) | when `SUPABASE_ACCESS_TOKEN` unset and keyring unavailable | -| `/supabase/.temp/project-ref` | plain text (project ref) | when `--project-ref` flag and `PROJECT_ID` env are both unset | +| Path | Format | When | +| --------------------------------------------- | ------------------------- | ------------------------------------------------------------- | +| `/access-token` | plain text (token string) | when `SUPABASE_ACCESS_TOKEN` unset and keyring unavailable | +| `/supabase/.temp/project-ref` | plain text (project ref) | when `--project-ref` flag and `PROJECT_ID` env are both unset | ## Files Written | Path | Format | When | | ------------------------------------------------ | ------ | ----------------------------------------------------------------------------- | | `~/.supabase//linked-project.json` | JSON | always (after ref resolution), via `Effect.ensuring` — on success and failure | -| `~/.supabase/telemetry.json` | JSON | always, via `Effect.ensuring` — on success and failure | +| `/telemetry.json` | JSON | always, via `Effect.ensuring` — on success and failure | ## API Routes @@ -24,11 +24,11 @@ The Management API exposes this read operation as `POST .../network-bans/retriev ## Environment Variables -| Variable | Purpose | Required? | -| ----------------------- | ---------------------------------------------------- | -------------------------------------------------------- | -| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `~/.supabase/access-token`) | -| `SUPABASE_API_URL` | override Management API base URL | no (defaults to `https://api.supabase.com`) | -| `PROJECT_ID` | project ref fallback when `--project-ref` is unset | no (falls back to `supabase/.temp/project-ref` → prompt) | +| Variable | Purpose | Required? | +| ----------------------- | ---------------------------------------------------- | -------------------------------------------------------------------------- | +| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `/access-token`) | +| `SUPABASE_API_URL` | override Management API base URL | no (defaults to `https://api.supabase.com`) | +| `PROJECT_ID` | project ref fallback when `--project-ref` is unset | no (falls back to `supabase/.temp/project-ref` → prompt) | ## Exit Codes diff --git a/apps/cli/src/legacy/commands/network-bans/remove/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/network-bans/remove/SIDE_EFFECTS.md index f1252d674b..2b5aca8835 100644 --- a/apps/cli/src/legacy/commands/network-bans/remove/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/network-bans/remove/SIDE_EFFECTS.md @@ -2,17 +2,17 @@ ## Files Read -| Path | Format | When | -| -------------------------------------- | ------------------------- | ------------------------------------------------------------- | -| `~/.supabase/access-token` | plain text (token string) | when `SUPABASE_ACCESS_TOKEN` unset and keyring unavailable | -| `/supabase/.temp/project-ref` | plain text (project ref) | when `--project-ref` flag and `PROJECT_ID` env are both unset | +| Path | Format | When | +| --------------------------------------------- | ------------------------- | ------------------------------------------------------------- | +| `/access-token` | plain text (token string) | when `SUPABASE_ACCESS_TOKEN` unset and keyring unavailable | +| `/supabase/.temp/project-ref` | plain text (project ref) | when `--project-ref` flag and `PROJECT_ID` env are both unset | ## Files Written | Path | Format | When | | ------------------------------------------------ | ------ | ----------------------------------------------------------------------------- | | `~/.supabase//linked-project.json` | JSON | always (after ref resolution), via `Effect.ensuring` — on success and failure | -| `~/.supabase/telemetry.json` | JSON | always, via `Effect.ensuring` — on success and failure | +| `/telemetry.json` | JSON | always, via `Effect.ensuring` — on success and failure | ## API Routes @@ -24,11 +24,11 @@ ## Environment Variables -| Variable | Purpose | Required? | -| ----------------------- | ---------------------------------------------------- | -------------------------------------------------------- | -| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `~/.supabase/access-token`) | -| `SUPABASE_API_URL` | override Management API base URL | no (defaults to `https://api.supabase.com`) | -| `PROJECT_ID` | project ref fallback when `--project-ref` is unset | no (falls back to `supabase/.temp/project-ref` → prompt) | +| Variable | Purpose | Required? | +| ----------------------- | ---------------------------------------------------- | -------------------------------------------------------------------------- | +| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `/access-token`) | +| `SUPABASE_API_URL` | override Management API base URL | no (defaults to `https://api.supabase.com`) | +| `PROJECT_ID` | project ref fallback when `--project-ref` is unset | no (falls back to `supabase/.temp/project-ref` → prompt) | ## Exit Codes diff --git a/apps/cli/src/legacy/commands/network-restrictions/get/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/network-restrictions/get/SIDE_EFFECTS.md index 7c746dbd01..2d11c413b9 100644 --- a/apps/cli/src/legacy/commands/network-restrictions/get/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/network-restrictions/get/SIDE_EFFECTS.md @@ -2,17 +2,17 @@ ## Files Read -| Path | Format | When | -| -------------------------------------- | ------------------------- | ------------------------------------------------------------- | -| `~/.supabase/access-token` | plain text (token string) | when `SUPABASE_ACCESS_TOKEN` unset and keyring unavailable | -| `/supabase/.temp/project-ref` | plain text (project ref) | when `--project-ref` flag and `PROJECT_ID` env are both unset | +| Path | Format | When | +| --------------------------------------------- | ------------------------- | ------------------------------------------------------------- | +| `/access-token` | plain text (token string) | when `SUPABASE_ACCESS_TOKEN` unset and keyring unavailable | +| `/supabase/.temp/project-ref` | plain text (project ref) | when `--project-ref` flag and `PROJECT_ID` env are both unset | ## Files Written | Path | Format | When | | ------------------------------------------------ | ------ | ----------------------------------------------------------------------------- | | `~/.supabase//linked-project.json` | JSON | always (after ref resolution), via `Effect.ensuring` — on success and failure | -| `~/.supabase/telemetry.json` | JSON | always, via `Effect.ensuring` — on success and failure | +| `/telemetry.json` | JSON | always, via `Effect.ensuring` — on success and failure | ## API Routes @@ -22,11 +22,11 @@ ## Environment Variables -| Variable | Purpose | Required? | -| ----------------------- | ---------------------------------------------------- | -------------------------------------------------------- | -| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `~/.supabase/access-token`) | -| `SUPABASE_API_URL` | override Management API base URL | no (defaults to `https://api.supabase.com`) | -| `PROJECT_ID` | project ref fallback when `--project-ref` is unset | no (falls back to `supabase/.temp/project-ref` → prompt) | +| Variable | Purpose | Required? | +| ----------------------- | ---------------------------------------------------- | -------------------------------------------------------------------------- | +| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `/access-token`) | +| `SUPABASE_API_URL` | override Management API base URL | no (defaults to `https://api.supabase.com`) | +| `PROJECT_ID` | project ref fallback when `--project-ref` is unset | no (falls back to `supabase/.temp/project-ref` → prompt) | ## Exit Codes diff --git a/apps/cli/src/legacy/commands/network-restrictions/update/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/network-restrictions/update/SIDE_EFFECTS.md index fb31633592..73d940ec4a 100644 --- a/apps/cli/src/legacy/commands/network-restrictions/update/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/network-restrictions/update/SIDE_EFFECTS.md @@ -2,17 +2,17 @@ ## Files Read -| Path | Format | When | -| -------------------------------------- | ------------------------- | ------------------------------------------------------------- | -| `~/.supabase/access-token` | plain text (token string) | when `SUPABASE_ACCESS_TOKEN` unset and keyring unavailable | -| `/supabase/.temp/project-ref` | plain text (project ref) | when `--project-ref` flag and `PROJECT_ID` env are both unset | +| Path | Format | When | +| --------------------------------------------- | ------------------------- | ------------------------------------------------------------- | +| `/access-token` | plain text (token string) | when `SUPABASE_ACCESS_TOKEN` unset and keyring unavailable | +| `/supabase/.temp/project-ref` | plain text (project ref) | when `--project-ref` flag and `PROJECT_ID` env are both unset | ## Files Written | Path | Format | When | | ------------------------------------------------ | ------ | ------------------------------------------------------------------------------- | | `~/.supabase//linked-project.json` | JSON | always (after ref resolution), via `Effect.ensuring` — success and HTTP failure | -| `~/.supabase/telemetry.json` | JSON | always, via outermost `Effect.ensuring` — including CIDR validation failures | +| `/telemetry.json` | JSON | always, via outermost `Effect.ensuring` — including CIDR validation failures | ## API Routes @@ -28,11 +28,11 @@ when no `--db-allow-cidr` was supplied), matching Go's `&[]string{}` initializat ## Environment Variables -| Variable | Purpose | Required? | -| ----------------------- | ---------------------------------------------------- | -------------------------------------------------------- | -| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `~/.supabase/access-token`) | -| `SUPABASE_API_URL` | override Management API base URL | no (defaults to `https://api.supabase.com`) | -| `PROJECT_ID` | project ref fallback when `--project-ref` is unset | no (falls back to `supabase/.temp/project-ref` → prompt) | +| Variable | Purpose | Required? | +| ----------------------- | ---------------------------------------------------- | -------------------------------------------------------------------------- | +| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `/access-token`) | +| `SUPABASE_API_URL` | override Management API base URL | no (defaults to `https://api.supabase.com`) | +| `PROJECT_ID` | project ref fallback when `--project-ref` is unset | no (falls back to `supabase/.temp/project-ref` → prompt) | ## Exit Codes diff --git a/apps/cli/src/legacy/commands/orgs/create/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/orgs/create/SIDE_EFFECTS.md index b6a2dfee84..902e8fe88f 100644 --- a/apps/cli/src/legacy/commands/orgs/create/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/orgs/create/SIDE_EFFECTS.md @@ -2,17 +2,17 @@ ## Files Read -| Path | Format | When | -| ----------------------------------------- | ------------------------- | --------------------------------------------------------------------------------------------- | -| keyring `"Supabase CLI"` / `` | OS keychain | when `SUPABASE_ACCESS_TOKEN` unset and keyring available; account = `LegacyCliConfig.profile` | -| keyring `"Supabase CLI"` / `access-token` | OS keychain | legacy-key fallback when the profile-keyed lookup misses | -| `~/.supabase/access-token` | plain text (token string) | last-resort fallback after env + keyring miss | +| Path | Format | When | +| --------------------------------------------- | ------------------------- | --------------------------------------------------------------------------------------------- | +| keyring `"Supabase CLI"` / `` | OS keychain | when `SUPABASE_ACCESS_TOKEN` unset and keyring available; account = `LegacyCliConfig.profile` | +| keyring `"Supabase CLI"` / `access-token` | OS keychain | legacy-key fallback when the profile-keyed lookup misses | +| `/access-token` | plain text (token string) | last-resort fallback after env + keyring miss | ## Files Written -| Path | Format | When | -| ---------------------------- | ------ | ----------------------------------------------------------- | -| `~/.supabase/telemetry.json` | JSON | always (in `Effect.ensuring`) at end of command — Go parity | +| Path | Format | When | +| ----------------------------------------------- | ------ | ----------------------------------------------------------- | +| `/telemetry.json` | JSON | always (in `Effect.ensuring`) at end of command — Go parity | `orgs create` is a user-level command — it does not resolve a `--project-ref`, so the legacy linked-project cache is never written. @@ -31,10 +31,10 @@ linked-project cache is never written. ## Environment Variables -| Variable | Purpose | Required? | -| ----------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------- | -| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `~/.supabase/access-token`) | -| `SUPABASE_PROFILE` | selects API base URL (`supabase`, `supabase-staging`, `supabase-local`), or a filesystem path to a YAML profile (Go parity — used by the cli-e2e harness) | no (defaults to `supabase`) | +| Variable | Purpose | Required? | +| ----------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------- | +| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `/access-token`) | +| `SUPABASE_PROFILE` | selects API base URL (`supabase`, `supabase-staging`, `supabase-local`), or a filesystem path to a YAML profile (Go parity — used by the cli-e2e harness) | no (defaults to `supabase`) | ## Exit Codes diff --git a/apps/cli/src/legacy/commands/orgs/list/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/orgs/list/SIDE_EFFECTS.md index 922c2087ce..57156aadcf 100644 --- a/apps/cli/src/legacy/commands/orgs/list/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/orgs/list/SIDE_EFFECTS.md @@ -2,17 +2,17 @@ ## Files Read -| Path | Format | When | -| ----------------------------------------- | ------------------------- | --------------------------------------------------------------------------------------------- | -| keyring `"Supabase CLI"` / `` | OS keychain | when `SUPABASE_ACCESS_TOKEN` unset and keyring available; account = `LegacyCliConfig.profile` | -| keyring `"Supabase CLI"` / `access-token` | OS keychain | legacy-key fallback when the profile-keyed lookup misses | -| `~/.supabase/access-token` | plain text (token string) | last-resort fallback after env + keyring miss | +| Path | Format | When | +| --------------------------------------------- | ------------------------- | --------------------------------------------------------------------------------------------- | +| keyring `"Supabase CLI"` / `` | OS keychain | when `SUPABASE_ACCESS_TOKEN` unset and keyring available; account = `LegacyCliConfig.profile` | +| keyring `"Supabase CLI"` / `access-token` | OS keychain | legacy-key fallback when the profile-keyed lookup misses | +| `/access-token` | plain text (token string) | last-resort fallback after env + keyring miss | ## Files Written -| Path | Format | When | -| ---------------------------- | ------ | ----------------------------------------------------------- | -| `~/.supabase/telemetry.json` | JSON | always (in `Effect.ensuring`) at end of command — Go parity | +| Path | Format | When | +| ----------------------------------------------- | ------ | ----------------------------------------------------------- | +| `/telemetry.json` | JSON | always (in `Effect.ensuring`) at end of command — Go parity | `orgs list` is a user-level command — it does not resolve a `--project-ref`, so the legacy linked-project cache (`~/.supabase//linked-project.json`) is never written. @@ -25,10 +25,10 @@ linked-project cache (`~/.supabase//linked-project.json`) is never ## Environment Variables -| Variable | Purpose | Required? | -| ----------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------- | -| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `~/.supabase/access-token`) | -| `SUPABASE_PROFILE` | selects API base URL (`supabase`, `supabase-staging`, `supabase-local`), or a filesystem path to a YAML profile (Go parity — used by the cli-e2e harness) | no (defaults to `supabase`) | +| Variable | Purpose | Required? | +| ----------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------- | +| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `/access-token`) | +| `SUPABASE_PROFILE` | selects API base URL (`supabase`, `supabase-staging`, `supabase-local`), or a filesystem path to a YAML profile (Go parity — used by the cli-e2e harness) | no (defaults to `supabase`) | ## Exit Codes diff --git a/apps/cli/src/legacy/commands/postgres-config/delete/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/postgres-config/delete/SIDE_EFFECTS.md index 892ae2b29c..f0e8bc8e25 100644 --- a/apps/cli/src/legacy/commands/postgres-config/delete/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/postgres-config/delete/SIDE_EFFECTS.md @@ -2,17 +2,17 @@ ## Files Read -| Path | Format | When | -| -------------------------------------- | ------------------------- | ------------------------------------------------------------- | -| `~/.supabase/access-token` | plain text (token string) | when `SUPABASE_ACCESS_TOKEN` unset and keyring unavailable | -| `/supabase/.temp/project-ref` | plain text (project ref) | when `--project-ref` flag and `PROJECT_ID` env are both unset | +| Path | Format | When | +| --------------------------------------------- | ------------------------- | ------------------------------------------------------------- | +| `/access-token` | plain text (token string) | when `SUPABASE_ACCESS_TOKEN` unset and keyring unavailable | +| `/supabase/.temp/project-ref` | plain text (project ref) | when `--project-ref` flag and `PROJECT_ID` env are both unset | ## Files Written | Path | Format | When | | ------------------------------------------------ | ------ | ----------------------------------------------------------------------------- | | `~/.supabase//linked-project.json` | JSON | always (after ref resolution), via `Effect.ensuring` - on success and failure | -| `~/.supabase/telemetry.json` | JSON | always, via `Effect.ensuring` - on success and failure | +| `/telemetry.json` | JSON | always, via `Effect.ensuring` - on success and failure | ## API Routes @@ -25,11 +25,11 @@ This command does not call a delete endpoint. It mirrors Go: fetch current confi ## Environment Variables -| Variable | Purpose | Required? | -| ----------------------- | ---------------------------------------------------- | --------------------------------------------------------- | -| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring -> `~/.supabase/access-token`) | -| `SUPABASE_API_URL` | override Management API base URL | no (defaults to `https://api.supabase.com`) | -| `PROJECT_ID` | project ref fallback when `--project-ref` is unset | no (falls back to `supabase/.temp/project-ref` -> prompt) | +| Variable | Purpose | Required? | +| ----------------------- | ---------------------------------------------------- | --------------------------------------------------------------------------- | +| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring -> `/access-token`) | +| `SUPABASE_API_URL` | override Management API base URL | no (defaults to `https://api.supabase.com`) | +| `PROJECT_ID` | project ref fallback when `--project-ref` is unset | no (falls back to `supabase/.temp/project-ref` -> prompt) | ## Exit Codes diff --git a/apps/cli/src/legacy/commands/postgres-config/get/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/postgres-config/get/SIDE_EFFECTS.md index 94e0953515..0220ff8fda 100644 --- a/apps/cli/src/legacy/commands/postgres-config/get/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/postgres-config/get/SIDE_EFFECTS.md @@ -2,17 +2,17 @@ ## Files Read -| Path | Format | When | -| -------------------------------------- | ------------------------- | ------------------------------------------------------------- | -| `~/.supabase/access-token` | plain text (token string) | when `SUPABASE_ACCESS_TOKEN` unset and keyring unavailable | -| `/supabase/.temp/project-ref` | plain text (project ref) | when `--project-ref` flag and `PROJECT_ID` env are both unset | +| Path | Format | When | +| --------------------------------------------- | ------------------------- | ------------------------------------------------------------- | +| `/access-token` | plain text (token string) | when `SUPABASE_ACCESS_TOKEN` unset and keyring unavailable | +| `/supabase/.temp/project-ref` | plain text (project ref) | when `--project-ref` flag and `PROJECT_ID` env are both unset | ## Files Written | Path | Format | When | | ------------------------------------------------ | ------ | ----------------------------------------------------------------------------- | | `~/.supabase//linked-project.json` | JSON | always (after ref resolution), via `Effect.ensuring` - on success and failure | -| `~/.supabase/telemetry.json` | JSON | always, via `Effect.ensuring` - on success and failure | +| `/telemetry.json` | JSON | always, via `Effect.ensuring` - on success and failure | ## API Routes @@ -22,11 +22,11 @@ ## Environment Variables -| Variable | Purpose | Required? | -| ----------------------- | ---------------------------------------------------- | --------------------------------------------------------- | -| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring -> `~/.supabase/access-token`) | -| `SUPABASE_API_URL` | override Management API base URL | no (defaults to `https://api.supabase.com`) | -| `PROJECT_ID` | project ref fallback when `--project-ref` is unset | no (falls back to `supabase/.temp/project-ref` -> prompt) | +| Variable | Purpose | Required? | +| ----------------------- | ---------------------------------------------------- | --------------------------------------------------------------------------- | +| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring -> `/access-token`) | +| `SUPABASE_API_URL` | override Management API base URL | no (defaults to `https://api.supabase.com`) | +| `PROJECT_ID` | project ref fallback when `--project-ref` is unset | no (falls back to `supabase/.temp/project-ref` -> prompt) | ## Exit Codes diff --git a/apps/cli/src/legacy/commands/postgres-config/update/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/postgres-config/update/SIDE_EFFECTS.md index 030a6a322d..bb493636f2 100644 --- a/apps/cli/src/legacy/commands/postgres-config/update/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/postgres-config/update/SIDE_EFFECTS.md @@ -2,17 +2,17 @@ ## Files Read -| Path | Format | When | -| -------------------------------------- | ------------------------- | ------------------------------------------------------------- | -| `~/.supabase/access-token` | plain text (token string) | when `SUPABASE_ACCESS_TOKEN` unset and keyring unavailable | -| `/supabase/.temp/project-ref` | plain text (project ref) | when `--project-ref` flag and `PROJECT_ID` env are both unset | +| Path | Format | When | +| --------------------------------------------- | ------------------------- | ------------------------------------------------------------- | +| `/access-token` | plain text (token string) | when `SUPABASE_ACCESS_TOKEN` unset and keyring unavailable | +| `/supabase/.temp/project-ref` | plain text (project ref) | when `--project-ref` flag and `PROJECT_ID` env are both unset | ## Files Written | Path | Format | When | | ------------------------------------------------ | ------ | ----------------------------------------------------------------------------- | | `~/.supabase//linked-project.json` | JSON | always (after ref resolution), via `Effect.ensuring` - on success and failure | -| `~/.supabase/telemetry.json` | JSON | always, via `Effect.ensuring` - on success and failure | +| `/telemetry.json` | JSON | always, via `Effect.ensuring` - on success and failure | ## API Routes @@ -25,11 +25,11 @@ The initial `GET` is skipped when `--replace-existing-overrides` is set. Otherwi ## Environment Variables -| Variable | Purpose | Required? | -| ----------------------- | ---------------------------------------------------- | --------------------------------------------------------- | -| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring -> `~/.supabase/access-token`) | -| `SUPABASE_API_URL` | override Management API base URL | no (defaults to `https://api.supabase.com`) | -| `PROJECT_ID` | project ref fallback when `--project-ref` is unset | no (falls back to `supabase/.temp/project-ref` -> prompt) | +| Variable | Purpose | Required? | +| ----------------------- | ---------------------------------------------------- | --------------------------------------------------------------------------- | +| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring -> `/access-token`) | +| `SUPABASE_API_URL` | override Management API base URL | no (defaults to `https://api.supabase.com`) | +| `PROJECT_ID` | project ref fallback when `--project-ref` is unset | no (falls back to `supabase/.temp/project-ref` -> prompt) | ## Exit Codes diff --git a/apps/cli/src/legacy/commands/projects/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/projects/SIDE_EFFECTS.md index 23e0b9711e..8a91e897c6 100644 --- a/apps/cli/src/legacy/commands/projects/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/projects/SIDE_EFFECTS.md @@ -6,10 +6,10 @@ subcommand's own `SIDE_EFFECTS.md`. ## Files Read -| Path | Format | When | -| -------------------------------------- | ------------------------- | ------------------------------------------------------------------------ | -| `~/.supabase/access-token` | plain text (token string) | when `SUPABASE_ACCESS_TOKEN` unset and keyring unavailable | -| `/supabase/.temp/project-ref` | plain text (ref string) | `list` (linked marker), `api-keys` (ref source), `delete` (unlink match) | +| Path | Format | When | +| --------------------------------------------- | ------------------------- | ------------------------------------------------------------------------ | +| `/access-token` | plain text (token string) | when `SUPABASE_ACCESS_TOKEN` unset and keyring unavailable | +| `/supabase/.temp/project-ref` | plain text (ref string) | `list` (linked marker), `api-keys` (ref source), `delete` (unlink match) | ## Files Written / Removed @@ -37,11 +37,11 @@ subcommand's own `SIDE_EFFECTS.md`. ## Environment Variables -| Variable | Purpose | Required? | -| ----------------------- | ---------------------------------------------------- | ------------------------------------------------------------- | -| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `~/.supabase/access-token`) | -| `SUPABASE_PROJECT_REF` | linked project ref (via the config layer) | no (used by `list` marker / `api-keys` ref / `delete` unlink) | -| `SUPABASE_API_URL` | override Management API base URL | no (defaults to `https://api.supabase.com`) | +| Variable | Purpose | Required? | +| ----------------------- | ---------------------------------------------------- | -------------------------------------------------------------------------- | +| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `/access-token`) | +| `SUPABASE_PROJECT_REF` | linked project ref (via the config layer) | no (used by `list` marker / `api-keys` ref / `delete` unlink) | +| `SUPABASE_API_URL` | override Management API base URL | no (defaults to `https://api.supabase.com`) | > `DB_PASSWORD` is **not** consumed. In Go it only mirrors `--db-password` via a > viper binding for downstream local-stack use; `projects create` never reads it. diff --git a/apps/cli/src/legacy/commands/projects/api-keys/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/projects/api-keys/SIDE_EFFECTS.md index 2071a7aefc..e120468224 100644 --- a/apps/cli/src/legacy/commands/projects/api-keys/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/projects/api-keys/SIDE_EFFECTS.md @@ -2,10 +2,10 @@ ## Files Read -| Path | Format | When | -| -------------------------------------- | ------------------------- | ----------------------------------------------------------------------- | -| `~/.supabase/access-token` | plain text (token string) | when `SUPABASE_ACCESS_TOKEN` unset and keyring unavailable | -| `/supabase/.temp/project-ref` | plain text (ref string) | when `--project-ref` is not provided, to resolve the linked project ref | +| Path | Format | When | +| --------------------------------------------- | ------------------------- | ----------------------------------------------------------------------- | +| `/access-token` | plain text (token string) | when `SUPABASE_ACCESS_TOKEN` unset and keyring unavailable | +| `/supabase/.temp/project-ref` | plain text (ref string) | when `--project-ref` is not provided, to resolve the linked project ref | ## Files Written @@ -21,10 +21,10 @@ ## Environment Variables -| Variable | Purpose | Required? | -| ----------------------- | ---------------------------------------------------- | ------------------------------------------------------- | -| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `~/.supabase/access-token`) | -| `SUPABASE_API_URL` | override Management API base URL | no (defaults to `https://api.supabase.com`) | +| Variable | Purpose | Required? | +| ----------------------- | ---------------------------------------------------- | -------------------------------------------------------------------------- | +| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `/access-token`) | +| `SUPABASE_API_URL` | override Management API base URL | no (defaults to `https://api.supabase.com`) | ## Flags diff --git a/apps/cli/src/legacy/commands/projects/create/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/projects/create/SIDE_EFFECTS.md index 0726aaa348..6a750c5f9f 100644 --- a/apps/cli/src/legacy/commands/projects/create/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/projects/create/SIDE_EFFECTS.md @@ -2,9 +2,9 @@ ## Files Read -| Path | Format | When | -| -------------------------- | ------------------------- | ---------------------------------------------------------- | -| `~/.supabase/access-token` | plain text (token string) | when `SUPABASE_ACCESS_TOKEN` unset and keyring unavailable | +| Path | Format | When | +| --------------------------------------------- | ------------------------- | ---------------------------------------------------------- | +| `/access-token` | plain text (token string) | when `SUPABASE_ACCESS_TOKEN` unset and keyring unavailable | ## Files Written @@ -21,11 +21,11 @@ ## Environment Variables -| Variable | Purpose | Required? | -| ----------------------- | --------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------- | -| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `~/.supabase/access-token`) | -| `SUPABASE_API_URL` | override Management API base URL | no (defaults to `https://api.supabase.com`) | -| `DB_PASSWORD` | **not consumed** — Go only mirrors `--db-password` into viper for local-stack reuse; `projects create` never reads it | n/a | +| Variable | Purpose | Required? | +| ----------------------- | --------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------- | +| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `/access-token`) | +| `SUPABASE_API_URL` | override Management API base URL | no (defaults to `https://api.supabase.com`) | +| `DB_PASSWORD` | **not consumed** — Go only mirrors `--db-password` into viper for local-stack reuse; `projects create` never reads it | n/a | ## Exit Codes diff --git a/apps/cli/src/legacy/commands/projects/delete/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/projects/delete/SIDE_EFFECTS.md index f4e46eab50..8b4af93c81 100644 --- a/apps/cli/src/legacy/commands/projects/delete/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/projects/delete/SIDE_EFFECTS.md @@ -2,10 +2,10 @@ ## Files Read -| Path | Format | When | -| -------------------------------------- | ------------------------- | ---------------------------------------------------------- | -| `~/.supabase/access-token` | plain text (token string) | when `SUPABASE_ACCESS_TOKEN` unset and keyring unavailable | -| `/supabase/.temp/project-ref` | plain text (ref string) | after a successful delete, to decide whether to unlink | +| Path | Format | When | +| --------------------------------------------- | ------------------------- | ---------------------------------------------------------- | +| `/access-token` | plain text (token string) | when `SUPABASE_ACCESS_TOKEN` unset and keyring unavailable | +| `/supabase/.temp/project-ref` | plain text (ref string) | after a successful delete, to decide whether to unlink | ## Files Written / Removed @@ -27,10 +27,10 @@ ## Environment Variables -| Variable | Purpose | Required? | -| ----------------------- | ---------------------------------------------------- | ------------------------------------------------------- | -| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `~/.supabase/access-token`) | -| `SUPABASE_API_URL` | override Management API base URL | no (defaults to `https://api.supabase.com`) | +| Variable | Purpose | Required? | +| ----------------------- | ---------------------------------------------------- | -------------------------------------------------------------------------- | +| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `/access-token`) | +| `SUPABASE_API_URL` | override Management API base URL | no (defaults to `https://api.supabase.com`) | ## Exit Codes diff --git a/apps/cli/src/legacy/commands/projects/list/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/projects/list/SIDE_EFFECTS.md index f4785c0f14..3668b5bfac 100644 --- a/apps/cli/src/legacy/commands/projects/list/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/projects/list/SIDE_EFFECTS.md @@ -2,10 +2,10 @@ ## Files Read -| Path | Format | When | -| -------------------------------------- | ------------------------- | ---------------------------------------------------------- | -| `~/.supabase/access-token` | plain text (token string) | when `SUPABASE_ACCESS_TOKEN` unset and keyring unavailable | -| `/supabase/.temp/project-ref` | plain text (ref string) | always (soft) — used only to flag the linked project | +| Path | Format | When | +| --------------------------------------------- | ------------------------- | ---------------------------------------------------------- | +| `/access-token` | plain text (token string) | when `SUPABASE_ACCESS_TOKEN` unset and keyring unavailable | +| `/supabase/.temp/project-ref` | plain text (ref string) | always (soft) — used only to flag the linked project | ## Files Written @@ -21,10 +21,10 @@ ## Environment Variables -| Variable | Purpose | Required? | -| ----------------------- | ---------------------------------------------------- | ------------------------------------------------------- | -| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `~/.supabase/access-token`) | -| `SUPABASE_API_URL` | override Management API base URL | no (defaults to `https://api.supabase.com`) | +| Variable | Purpose | Required? | +| ----------------------- | ---------------------------------------------------- | -------------------------------------------------------------------------- | +| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `/access-token`) | +| `SUPABASE_API_URL` | override Management API base URL | no (defaults to `https://api.supabase.com`) | ## Exit Codes diff --git a/apps/cli/src/legacy/commands/secrets/list/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/secrets/list/SIDE_EFFECTS.md index a7a248607e..7faf0beab0 100644 --- a/apps/cli/src/legacy/commands/secrets/list/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/secrets/list/SIDE_EFFECTS.md @@ -2,20 +2,20 @@ ## Files Read -| Path | Format | When | -| ----------------------------------------- | ------------------------- | --------------------------------------------------------------------------------------------- | -| `/proc/sys/kernel/osrelease` (Linux) | plain text | once on layer init — disables keyring on WSL (`WSL` / `Microsoft` substring match) | -| keyring `"Supabase CLI"` / `` | OS keychain | when `SUPABASE_ACCESS_TOKEN` unset and keyring available; account = `LegacyCliConfig.profile` | -| keyring `"Supabase CLI"` / `access-token` | OS keychain | legacy-key fallback when the profile-keyed lookup misses | -| `~/.supabase/access-token` | plain text (token string) | last-resort fallback after env + keyring miss | -| `/supabase/.temp/project-ref` | plain text | when `--project-ref` and `SUPABASE_PROJECT_ID` are both unset | +| Path | Format | When | +| --------------------------------------------- | ------------------------- | --------------------------------------------------------------------------------------------- | +| `/proc/sys/kernel/osrelease` (Linux) | plain text | once on layer init — disables keyring on WSL (`WSL` / `Microsoft` substring match) | +| keyring `"Supabase CLI"` / `` | OS keychain | when `SUPABASE_ACCESS_TOKEN` unset and keyring available; account = `LegacyCliConfig.profile` | +| keyring `"Supabase CLI"` / `access-token` | OS keychain | legacy-key fallback when the profile-keyed lookup misses | +| `/access-token` | plain text (token string) | last-resort fallback after env + keyring miss | +| `/supabase/.temp/project-ref` | plain text | when `--project-ref` and `SUPABASE_PROJECT_ID` are both unset | ## Files Written | Path | Format | When | | ------------------------------------------------ | ------ | ------------------------------------------------------------------------ | | `~/.supabase//linked-project.json` | JSON | always (in `Effect.ensuring`) after `--project-ref` resolves — Go parity | -| `~/.supabase/telemetry.json` | JSON | always (in `Effect.ensuring`) at end of command — Go parity | +| `/telemetry.json` | JSON | always (in `Effect.ensuring`) at end of command — Go parity | ## API Routes @@ -28,7 +28,7 @@ | Variable | Purpose | Required? | | ----------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------- | -| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `~/.supabase/access-token`) | +| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `/access-token`) | | `SUPABASE_PROFILE` | selects API base URL: `supabase` → `api.supabase.com`, `supabase-staging` → `api.supabase.green`, `supabase-local` → `http://localhost:8080`. May alternatively be a filesystem path to a YAML profile with at least `api_url:` and optional `name:` (Go parity — used by the cli-e2e test harness). | no (defaults to `supabase`) | | `SUPABASE_PROJECT_ID` | project ref fallback when `--project-ref` is unset | no (also reads `/supabase/.temp/project-ref` then prompts on TTY) | | `SUPABASE_WORKDIR` | base directory for the `.temp/project-ref` lookup | no (walks up from CWD looking for `supabase/config.toml`) | diff --git a/apps/cli/src/legacy/commands/secrets/set/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/secrets/set/SIDE_EFFECTS.md index c99884485e..d9bd60de05 100644 --- a/apps/cli/src/legacy/commands/secrets/set/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/secrets/set/SIDE_EFFECTS.md @@ -2,24 +2,24 @@ ## Files Read -| Path | Format | When | -| ----------------------------------------- | ------------------------- | --------------------------------------------------------------------------------------------- | -| `/proc/sys/kernel/osrelease` (Linux) | plain text | once on layer init — disables keyring on WSL (`WSL` / `Microsoft` substring match) | -| keyring `"Supabase CLI"` / `` | OS keychain | when `SUPABASE_ACCESS_TOKEN` unset and keyring available; account = `LegacyCliConfig.profile` | -| keyring `"Supabase CLI"` / `access-token` | OS keychain | legacy-key fallback when the profile-keyed lookup misses | -| `~/.supabase/access-token` | plain text (token string) | last-resort fallback after env + keyring miss | -| `/supabase/.temp/project-ref` | plain text | when `--project-ref` and `SUPABASE_PROJECT_ID` are both unset | -| `/supabase/config.toml` | TOML | always (for `[edge_runtime.secrets]`) — via `@supabase/config`'s `loadProjectConfig` | -| `/.env` | dotenv | always — context for `env(VAR)` interpolation in `[edge_runtime.secrets]` values | -| `/.env.local` | dotenv | always — overrides `.env` for `env(VAR)` interpolation context | -| `` (absolute or CWD-relative) | dotenv | when `--env-file` flag is provided | +| Path | Format | When | +| --------------------------------------------- | ------------------------- | --------------------------------------------------------------------------------------------- | +| `/proc/sys/kernel/osrelease` (Linux) | plain text | once on layer init — disables keyring on WSL (`WSL` / `Microsoft` substring match) | +| keyring `"Supabase CLI"` / `` | OS keychain | when `SUPABASE_ACCESS_TOKEN` unset and keyring available; account = `LegacyCliConfig.profile` | +| keyring `"Supabase CLI"` / `access-token` | OS keychain | legacy-key fallback when the profile-keyed lookup misses | +| `/access-token` | plain text (token string) | last-resort fallback after env + keyring miss | +| `/supabase/.temp/project-ref` | plain text | when `--project-ref` and `SUPABASE_PROJECT_ID` are both unset | +| `/supabase/config.toml` | TOML | always (for `[edge_runtime.secrets]`) — via `@supabase/config`'s `loadProjectConfig` | +| `/.env` | dotenv | always — context for `env(VAR)` interpolation in `[edge_runtime.secrets]` values | +| `/.env.local` | dotenv | always — overrides `.env` for `env(VAR)` interpolation context | +| `` (absolute or CWD-relative) | dotenv | when `--env-file` flag is provided | ## Files Written | Path | Format | When | | ------------------------------------------------ | ------ | ------------------------------------------------------------------------ | | `~/.supabase//linked-project.json` | JSON | always (in `Effect.ensuring`) after `--project-ref` resolves — Go parity | -| `~/.supabase/telemetry.json` | JSON | always (in `Effect.ensuring`) at end of command — Go parity | +| `/telemetry.json` | JSON | always (in `Effect.ensuring`) at end of command — Go parity | ## API Routes @@ -32,7 +32,7 @@ | Variable | Purpose | Required? | | ----------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------- | -| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `~/.supabase/access-token`) | +| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `/access-token`) | | `SUPABASE_PROFILE` | selects API base URL: `supabase` → `api.supabase.com`, `supabase-staging` → `api.supabase.green`, `supabase-local` → `http://localhost:8080`. May alternatively be a filesystem path to a YAML profile with at least `api_url:` and optional `name:` (Go parity — used by the cli-e2e test harness). | no (defaults to `supabase`) | | `SUPABASE_PROJECT_ID` | project ref fallback when `--project-ref` is unset | no (also reads `/supabase/.temp/project-ref` then prompts on TTY) | | `SUPABASE_WORKDIR` | base directory for the `.temp/project-ref` lookup | no (walks up from CWD looking for `supabase/config.toml`) | diff --git a/apps/cli/src/legacy/commands/secrets/unset/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/secrets/unset/SIDE_EFFECTS.md index 504a4d99f1..d68740defc 100644 --- a/apps/cli/src/legacy/commands/secrets/unset/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/secrets/unset/SIDE_EFFECTS.md @@ -2,20 +2,20 @@ ## Files Read -| Path | Format | When | -| ----------------------------------------- | ------------------------- | --------------------------------------------------------------------------------------------- | -| `/proc/sys/kernel/osrelease` (Linux) | plain text | once on layer init — disables keyring on WSL (`WSL` / `Microsoft` substring match) | -| keyring `"Supabase CLI"` / `` | OS keychain | when `SUPABASE_ACCESS_TOKEN` unset and keyring available; account = `LegacyCliConfig.profile` | -| keyring `"Supabase CLI"` / `access-token` | OS keychain | legacy-key fallback when the profile-keyed lookup misses | -| `~/.supabase/access-token` | plain text (token string) | last-resort fallback after env + keyring miss | -| `/supabase/.temp/project-ref` | plain text | when `--project-ref` and `SUPABASE_PROJECT_ID` are both unset | +| Path | Format | When | +| --------------------------------------------- | ------------------------- | --------------------------------------------------------------------------------------------- | +| `/proc/sys/kernel/osrelease` (Linux) | plain text | once on layer init — disables keyring on WSL (`WSL` / `Microsoft` substring match) | +| keyring `"Supabase CLI"` / `` | OS keychain | when `SUPABASE_ACCESS_TOKEN` unset and keyring available; account = `LegacyCliConfig.profile` | +| keyring `"Supabase CLI"` / `access-token` | OS keychain | legacy-key fallback when the profile-keyed lookup misses | +| `/access-token` | plain text (token string) | last-resort fallback after env + keyring miss | +| `/supabase/.temp/project-ref` | plain text | when `--project-ref` and `SUPABASE_PROJECT_ID` are both unset | ## Files Written | Path | Format | When | | ------------------------------------------------ | ------ | ------------------------------------------------------------------------ | | `~/.supabase//linked-project.json` | JSON | always (in `Effect.ensuring`) after `--project-ref` resolves — Go parity | -| `~/.supabase/telemetry.json` | JSON | always (in `Effect.ensuring`) at end of command — Go parity | +| `/telemetry.json` | JSON | always (in `Effect.ensuring`) at end of command — Go parity | ## API Routes @@ -29,7 +29,7 @@ | Variable | Purpose | Required? | | ----------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------- | -| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `~/.supabase/access-token`) | +| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `/access-token`) | | `SUPABASE_PROFILE` | selects API base URL: `supabase` → `api.supabase.com`, `supabase-staging` → `api.supabase.green`, `supabase-local` → `http://localhost:8080`. May alternatively be a filesystem path to a YAML profile with at least `api_url:` and optional `name:` (Go parity — used by the cli-e2e test harness). | no (defaults to `supabase`) | | `SUPABASE_PROJECT_ID` | project ref fallback when `--project-ref` is unset | no (also reads `/supabase/.temp/project-ref` then prompts on TTY) | | `SUPABASE_WORKDIR` | base directory for the `.temp/project-ref` lookup | no (walks up from CWD looking for `supabase/config.toml`) | diff --git a/apps/cli/src/legacy/commands/seed/buckets/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/seed/buckets/SIDE_EFFECTS.md index ac81101201..abadb1e957 100644 --- a/apps/cli/src/legacy/commands/seed/buckets/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/seed/buckets/SIDE_EFFECTS.md @@ -2,10 +2,10 @@ ## Files Read -| Path | Format | When | -| -------------------------------- | ---------- | ------------------------------------------------- | -| `/supabase/config.toml` | TOML | always, to read `[storage.buckets]` configuration | -| `~/.supabase/access-token` | plain text | when `--linked` and `SUPABASE_ACCESS_TOKEN` unset | +| Path | Format | When | +| --------------------------------------------- | ---------- | ------------------------------------------------- | +| `/supabase/config.toml` | TOML | always, to read `[storage.buckets]` configuration | +| `/access-token` | plain text | when `--linked` and `SUPABASE_ACCESS_TOKEN` unset | ## Files Written @@ -21,10 +21,10 @@ ## Environment Variables -| Variable | Purpose | Required? | -| ----------------------- | -------------------------------- | ------------------------------------------------------- | -| `SUPABASE_ACCESS_TOKEN` | auth token for `--linked` mode | no (falls back to keyring → `~/.supabase/access-token`) | -| `SUPABASE_API_URL` | override Management API base URL | no (defaults to `https://api.supabase.com`) | +| Variable | Purpose | Required? | +| ----------------------- | -------------------------------- | -------------------------------------------------------------------------- | +| `SUPABASE_ACCESS_TOKEN` | auth token for `--linked` mode | no (falls back to keyring → `/access-token`) | +| `SUPABASE_API_URL` | override Management API base URL | no (defaults to `https://api.supabase.com`) | ## Exit Codes diff --git a/apps/cli/src/legacy/commands/services/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/services/SIDE_EFFECTS.md index 07092ca913..21ec3a1847 100644 --- a/apps/cli/src/legacy/commands/services/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/services/SIDE_EFFECTS.md @@ -2,17 +2,17 @@ ## Files Read -| Path | Format | When | -| ---------------------------- | ---------- | ------------------------------------------------------------------------------------------ | -| `supabase/.temp/project-ref` | plain text | when the checkout is linked and no explicit ref is already loaded | -| `~/.supabase/access-token` | plain text | when `SUPABASE_ACCESS_TOKEN` is unset and keyring access falls back to the home token file | +| Path | Format | When | +| --------------------------------------------- | ---------- | ------------------------------------------------------------------------------------------ | +| `supabase/.temp/project-ref` | plain text | when the checkout is linked and no explicit ref is already loaded | +| `/access-token` | plain text | when `SUPABASE_ACCESS_TOKEN` is unset and keyring access falls back to the home token file | ## Files Written -| Path | Format | When | -| ------------------------------------ | ------ | ------------------------------------------------------------------------------------------------------------------------------------------------ | -| `supabase/.temp/linked-project.json` | JSON | when a project ref resolves and no cache exists yet (`Effect.ensuring(linkedProjectCache.cache(ref))`, mirrors Go's `ensureProjectGroupsCached`) | -| `~/.supabase/telemetry.json` | JSON | always (`Effect.ensuring(telemetryState.flush)`) at end of the command | +| Path | Format | When | +| ----------------------------------------------- | ------ | ------------------------------------------------------------------------------------------------------------------------------------------------ | +| `supabase/.temp/linked-project.json` | JSON | when a project ref resolves and no cache exists yet (`Effect.ensuring(linkedProjectCache.cache(ref))`, mirrors Go's `ensureProjectGroupsCached`) | +| `/telemetry.json` | JSON | always (`Effect.ensuring(telemetryState.flush)`) at end of the command | ## API Routes @@ -33,10 +33,10 @@ matching `apps/cli-go/pkg/fetcher/gateway.go`. ## Environment Variables -| Variable | Purpose | Required? | -| ----------------------- | --------------------------------------------------- | ----------------------------------------------------------- | -| `SUPABASE_ACCESS_TOKEN` | auth token for Management API linked-version checks | no (falls back to keyring, then `~/.supabase/access-token`) | -| `SUPABASE_API_URL` | override Management API base URL | no (defaults to `https://api.supabase.com`) | +| Variable | Purpose | Required? | +| ----------------------- | --------------------------------------------------- | ------------------------------------------------------------------------------ | +| `SUPABASE_ACCESS_TOKEN` | auth token for Management API linked-version checks | no (falls back to keyring, then `/access-token`) | +| `SUPABASE_API_URL` | override Management API base URL | no (defaults to `https://api.supabase.com`) | ## Exit Codes diff --git a/apps/cli/src/legacy/commands/snippets/download/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/snippets/download/SIDE_EFFECTS.md index 19f3323f9e..e2804d931b 100644 --- a/apps/cli/src/legacy/commands/snippets/download/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/snippets/download/SIDE_EFFECTS.md @@ -6,16 +6,16 @@ | ---------------------------------------------- | ------------------------- | --------------------------------------------------------------------------------------------- | | keyring `"Supabase CLI"` / `` | OS keychain | when `SUPABASE_ACCESS_TOKEN` unset and keyring available; account = `LegacyCliConfig.profile` | | keyring `"Supabase CLI"` / `access-token` | OS keychain | legacy-key fallback when the profile-keyed lookup misses | -| `~/.supabase/access-token` | plain text (token string) | last-resort fallback after env + keyring miss | +| `/access-token` | plain text (token string) | last-resort fallback after env + keyring miss | | `/supabase/.temp/project-ref` | plain text | when `--project-ref` flag and `PROJECT_ID` env are unset | | `/supabase/.temp/linked-project.json` | JSON | always — `linkedProjectCache` reads to decide whether to write | ## Files Written -| Path | Format | When | -| ---------------------------------------------- | ------ | ------------------------------------------------------------------- | -| `~/.supabase/telemetry.json` | JSON | always (`Effect.ensuring(telemetryState.flush)`) | -| `/supabase/.temp/linked-project.json` | JSON | best-effort after `--project-ref` resolves (Go `PersistentPostRun`) | +| Path | Format | When | +| ----------------------------------------------- | ------ | ------------------------------------------------------------------- | +| `/telemetry.json` | JSON | always (`Effect.ensuring(telemetryState.flush)`) | +| `/supabase/.temp/linked-project.json` | JSON | best-effort after `--project-ref` resolves (Go `PersistentPostRun`) | ## API Routes @@ -27,12 +27,12 @@ Only `content.sql` is rendered in text mode. The full payload is exposed via `-- ## Environment Variables -| Variable | Purpose | Required? | -| ----------------------- | ---------------------------------------------------- | ------------------------------------------------------- | -| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `~/.supabase/access-token`) | -| `PROJECT_ID` | project ref fallback when `--project-ref` is unset | no (falls back to `supabase/.temp/project-ref`) | -| `SUPABASE_API_URL` | override Management API base URL | no (defaults to `https://api.supabase.com`) | -| `SUPABASE_PROFILE` | profile selector (built-in name or YAML file path) | no (defaults to `supabase`) | +| Variable | Purpose | Required? | +| ----------------------- | ---------------------------------------------------- | -------------------------------------------------------------------------- | +| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `/access-token`) | +| `PROJECT_ID` | project ref fallback when `--project-ref` is unset | no (falls back to `supabase/.temp/project-ref`) | +| `SUPABASE_API_URL` | override Management API base URL | no (defaults to `https://api.supabase.com`) | +| `SUPABASE_PROFILE` | profile selector (built-in name or YAML file path) | no (defaults to `supabase`) | ## Exit Codes diff --git a/apps/cli/src/legacy/commands/snippets/list/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/snippets/list/SIDE_EFFECTS.md index 867b2331ac..1899ee45a0 100644 --- a/apps/cli/src/legacy/commands/snippets/list/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/snippets/list/SIDE_EFFECTS.md @@ -6,16 +6,16 @@ | ---------------------------------------------- | ------------------------- | --------------------------------------------------------------------------------------------- | | keyring `"Supabase CLI"` / `` | OS keychain | when `SUPABASE_ACCESS_TOKEN` unset and keyring available; account = `LegacyCliConfig.profile` | | keyring `"Supabase CLI"` / `access-token` | OS keychain | legacy-key fallback when the profile-keyed lookup misses | -| `~/.supabase/access-token` | plain text (token string) | last-resort fallback after env + keyring miss | +| `/access-token` | plain text (token string) | last-resort fallback after env + keyring miss | | `/supabase/.temp/project-ref` | plain text | when `--project-ref` flag and `PROJECT_ID` env are unset | | `/supabase/.temp/linked-project.json` | JSON | always — `linkedProjectCache` reads to decide whether to write | ## Files Written -| Path | Format | When | -| ---------------------------------------------- | ------ | ------------------------------------------------------------------- | -| `~/.supabase/telemetry.json` | JSON | always (`Effect.ensuring(telemetryState.flush)`) | -| `/supabase/.temp/linked-project.json` | JSON | best-effort after `--project-ref` resolves (Go `PersistentPostRun`) | +| Path | Format | When | +| ----------------------------------------------- | ------ | ------------------------------------------------------------------- | +| `/telemetry.json` | JSON | always (`Effect.ensuring(telemetryState.flush)`) | +| `/supabase/.temp/linked-project.json` | JSON | best-effort after `--project-ref` resolves (Go `PersistentPostRun`) | ## API Routes @@ -25,12 +25,12 @@ ## Environment Variables -| Variable | Purpose | Required? | -| ----------------------- | ---------------------------------------------------- | ------------------------------------------------------- | -| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `~/.supabase/access-token`) | -| `PROJECT_ID` | project ref fallback when `--project-ref` is unset | no (falls back to `supabase/.temp/project-ref`) | -| `SUPABASE_API_URL` | override Management API base URL | no (defaults to `https://api.supabase.com`) | -| `SUPABASE_PROFILE` | profile selector (built-in name or YAML file path) | no (defaults to `supabase`) | +| Variable | Purpose | Required? | +| ----------------------- | ---------------------------------------------------- | -------------------------------------------------------------------------- | +| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `/access-token`) | +| `PROJECT_ID` | project ref fallback when `--project-ref` is unset | no (falls back to `supabase/.temp/project-ref`) | +| `SUPABASE_API_URL` | override Management API base URL | no (defaults to `https://api.supabase.com`) | +| `SUPABASE_PROFILE` | profile selector (built-in name or YAML file path) | no (defaults to `supabase`) | ## Exit Codes diff --git a/apps/cli/src/legacy/commands/ssl-enforcement/get/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/ssl-enforcement/get/SIDE_EFFECTS.md index d06a2d9671..7cb4d6fea0 100644 --- a/apps/cli/src/legacy/commands/ssl-enforcement/get/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/ssl-enforcement/get/SIDE_EFFECTS.md @@ -2,17 +2,17 @@ ## Files Read -| Path | Format | When | -| -------------------------------------- | ------------------------- | ------------------------------------------------------------- | -| `~/.supabase/access-token` | plain text (token string) | when `SUPABASE_ACCESS_TOKEN` unset and keyring unavailable | -| `/supabase/.temp/project-ref` | plain text (project ref) | when `--project-ref` flag and `PROJECT_ID` env are both unset | +| Path | Format | When | +| --------------------------------------------- | ------------------------- | ------------------------------------------------------------- | +| `/access-token` | plain text (token string) | when `SUPABASE_ACCESS_TOKEN` unset and keyring unavailable | +| `/supabase/.temp/project-ref` | plain text (project ref) | when `--project-ref` flag and `PROJECT_ID` env are both unset | ## Files Written | Path | Format | When | | ------------------------------------------------ | ------ | ----------------------------------------------------------------------------- | | `~/.supabase//linked-project.json` | JSON | always (after ref resolution), via `Effect.ensuring` — on success and failure | -| `~/.supabase/telemetry.json` | JSON | always, via `Effect.ensuring` — on success and failure | +| `/telemetry.json` | JSON | always, via `Effect.ensuring` — on success and failure | ## API Routes @@ -22,11 +22,11 @@ ## Environment Variables -| Variable | Purpose | Required? | -| ----------------------- | ---------------------------------------------------- | -------------------------------------------------------- | -| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `~/.supabase/access-token`) | -| `SUPABASE_API_URL` | override Management API base URL | no (defaults to `https://api.supabase.com`) | -| `PROJECT_ID` | project ref fallback when `--project-ref` is unset | no (falls back to `supabase/.temp/project-ref` → prompt) | +| Variable | Purpose | Required? | +| ----------------------- | ---------------------------------------------------- | -------------------------------------------------------------------------- | +| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `/access-token`) | +| `SUPABASE_API_URL` | override Management API base URL | no (defaults to `https://api.supabase.com`) | +| `PROJECT_ID` | project ref fallback when `--project-ref` is unset | no (falls back to `supabase/.temp/project-ref` → prompt) | ## Exit Codes diff --git a/apps/cli/src/legacy/commands/ssl-enforcement/update/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/ssl-enforcement/update/SIDE_EFFECTS.md index f6caab93da..270c8fdd81 100644 --- a/apps/cli/src/legacy/commands/ssl-enforcement/update/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/ssl-enforcement/update/SIDE_EFFECTS.md @@ -2,17 +2,17 @@ ## Files Read -| Path | Format | When | -| -------------------------------------- | ------------------------- | ------------------------------------------------------------- | -| `~/.supabase/access-token` | plain text (token string) | when `SUPABASE_ACCESS_TOKEN` unset and keyring unavailable | -| `/supabase/.temp/project-ref` | plain text (project ref) | when `--project-ref` flag and `PROJECT_ID` env are both unset | +| Path | Format | When | +| --------------------------------------------- | ------------------------- | ------------------------------------------------------------- | +| `/access-token` | plain text (token string) | when `SUPABASE_ACCESS_TOKEN` unset and keyring unavailable | +| `/supabase/.temp/project-ref` | plain text (project ref) | when `--project-ref` flag and `PROJECT_ID` env are both unset | ## Files Written | Path | Format | When | | ------------------------------------------------ | ------ | ----------------------------------------------------------------------------------------- | | `~/.supabase//linked-project.json` | JSON | after the project ref is resolved (only if flag validation passes), via `Effect.ensuring` | -| `~/.supabase/telemetry.json` | JSON | always, via `Effect.ensuring` — including flag-validation failures | +| `/telemetry.json` | JSON | always, via `Effect.ensuring` — including flag-validation failures | ## API Routes @@ -22,11 +22,11 @@ ## Environment Variables -| Variable | Purpose | Required? | -| ----------------------- | ---------------------------------------------------- | -------------------------------------------------------- | -| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `~/.supabase/access-token`) | -| `SUPABASE_API_URL` | override Management API base URL | no (defaults to `https://api.supabase.com`) | -| `PROJECT_ID` | project ref fallback when `--project-ref` is unset | no (falls back to `supabase/.temp/project-ref` → prompt) | +| Variable | Purpose | Required? | +| ----------------------- | ---------------------------------------------------- | -------------------------------------------------------------------------- | +| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `/access-token`) | +| `SUPABASE_API_URL` | override Management API base URL | no (defaults to `https://api.supabase.com`) | +| `PROJECT_ID` | project ref fallback when `--project-ref` is unset | no (falls back to `supabase/.temp/project-ref` → prompt) | ## Exit Codes diff --git a/apps/cli/src/legacy/commands/sso/add/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/sso/add/SIDE_EFFECTS.md index 350a2d34c9..bd3d20cf38 100644 --- a/apps/cli/src/legacy/commands/sso/add/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/sso/add/SIDE_EFFECTS.md @@ -6,17 +6,17 @@ | ---------------------------------------------- | ------------------------- | --------------------------------------------------------------------------------------------- | | keyring `"Supabase CLI"` / `` | OS keychain | when `SUPABASE_ACCESS_TOKEN` unset and keyring available; account = `LegacyCliConfig.profile` | | keyring `"Supabase CLI"` / `access-token` | OS keychain | legacy-key fallback when the profile-keyed lookup misses | -| `~/.supabase/access-token` | plain text (token string) | last-resort fallback after env + keyring miss | +| `/access-token` | plain text (token string) | last-resort fallback after env + keyring miss | | `/supabase/.temp/linked-project.json` | JSON | always — `linkedProjectCache` reads to decide whether to write | | `` | XML (UTF-8) | when `--metadata-file` is provided | | `` | JSON | when `--attribute-mapping-file` is provided | ## Files Written -| Path | Format | When | -| ---------------------------------------------- | ------ | ------------------------------------------------------------------- | -| `~/.supabase/telemetry.json` | JSON | always (`Effect.ensuring(telemetryState.flush)`) | -| `/supabase/.temp/linked-project.json` | JSON | best-effort after `--project-ref` resolves (Go `PersistentPostRun`) | +| Path | Format | When | +| ----------------------------------------------- | ------ | ------------------------------------------------------------------- | +| `/telemetry.json` | JSON | always (`Effect.ensuring(telemetryState.flush)`) | +| `/supabase/.temp/linked-project.json` | JSON | best-effort after `--project-ref` resolves (Go `PersistentPostRun`) | ## API Routes @@ -33,10 +33,10 @@ same shape via an inline anonymous struct with `Default *any`. ## Environment Variables -| Variable | Purpose | Required? | -| ----------------------- | ---------------------------------------------------- | ------------------------------------------------------- | -| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `~/.supabase/access-token`) | -| `SUPABASE_PROFILE` | profile selector (built-in name or YAML file path) | no (defaults to `supabase`) | +| Variable | Purpose | Required? | +| ----------------------- | ---------------------------------------------------- | -------------------------------------------------------------------------- | +| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `/access-token`) | +| `SUPABASE_PROFILE` | profile selector (built-in name or YAML file path) | no (defaults to `supabase`) | ## Exit Codes diff --git a/apps/cli/src/legacy/commands/sso/info/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/sso/info/SIDE_EFFECTS.md index 9f53e45af8..bb2fb6a254 100644 --- a/apps/cli/src/legacy/commands/sso/info/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/sso/info/SIDE_EFFECTS.md @@ -10,10 +10,10 @@ ## Files Written -| Path | Format | When | -| ---------------------------------------------- | ------ | ------------------------------------------------------------------- | -| `~/.supabase/telemetry.json` | JSON | always (`Effect.ensuring(telemetryState.flush)`) | -| `/supabase/.temp/linked-project.json` | JSON | best-effort after `--project-ref` resolves (Go `PersistentPostRun`) | +| Path | Format | When | +| ----------------------------------------------- | ------ | ------------------------------------------------------------------- | +| `/telemetry.json` | JSON | always (`Effect.ensuring(telemetryState.flush)`) | +| `/supabase/.temp/linked-project.json` | JSON | best-effort after `--project-ref` resolves (Go `PersistentPostRun`) | ## API Routes diff --git a/apps/cli/src/legacy/commands/sso/list/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/sso/list/SIDE_EFFECTS.md index 4648596fd8..8f34b159f9 100644 --- a/apps/cli/src/legacy/commands/sso/list/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/sso/list/SIDE_EFFECTS.md @@ -6,15 +6,15 @@ | ---------------------------------------------- | ------------------------- | --------------------------------------------------------------------------------------------- | | keyring `"Supabase CLI"` / `` | OS keychain | when `SUPABASE_ACCESS_TOKEN` unset and keyring available; account = `LegacyCliConfig.profile` | | keyring `"Supabase CLI"` / `access-token` | OS keychain | legacy-key fallback when the profile-keyed lookup misses | -| `~/.supabase/access-token` | plain text (token string) | last-resort fallback after env + keyring miss | +| `/access-token` | plain text (token string) | last-resort fallback after env + keyring miss | | `/supabase/.temp/linked-project.json` | JSON | always — `linkedProjectCache` reads to decide whether to write | ## Files Written -| Path | Format | When | -| ---------------------------------------------- | ------ | ------------------------------------------------------------------- | -| `~/.supabase/telemetry.json` | JSON | always (`Effect.ensuring(telemetryState.flush)`) | -| `/supabase/.temp/linked-project.json` | JSON | best-effort after `--project-ref` resolves (Go `PersistentPostRun`) | +| Path | Format | When | +| ----------------------------------------------- | ------ | ------------------------------------------------------------------- | +| `/telemetry.json` | JSON | always (`Effect.ensuring(telemetryState.flush)`) | +| `/supabase/.temp/linked-project.json` | JSON | best-effort after `--project-ref` resolves (Go `PersistentPostRun`) | ## API Routes @@ -26,10 +26,10 @@ ## Environment Variables -| Variable | Purpose | Required? | -| ----------------------- | ---------------------------------------------------- | ------------------------------------------------------- | -| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `~/.supabase/access-token`) | -| `SUPABASE_PROFILE` | profile selector (built-in name or YAML file path) | no (defaults to `supabase`) | +| Variable | Purpose | Required? | +| ----------------------- | ---------------------------------------------------- | -------------------------------------------------------------------------- | +| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `/access-token`) | +| `SUPABASE_PROFILE` | profile selector (built-in name or YAML file path) | no (defaults to `supabase`) | ## Exit Codes diff --git a/apps/cli/src/legacy/commands/sso/remove/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/sso/remove/SIDE_EFFECTS.md index 34bcb32e3c..3cc143577a 100644 --- a/apps/cli/src/legacy/commands/sso/remove/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/sso/remove/SIDE_EFFECTS.md @@ -6,15 +6,15 @@ | ---------------------------------------------- | ------------------------- | --------------------------------------------------------------------------------------------- | | keyring `"Supabase CLI"` / `` | OS keychain | when `SUPABASE_ACCESS_TOKEN` unset and keyring available; account = `LegacyCliConfig.profile` | | keyring `"Supabase CLI"` / `access-token` | OS keychain | legacy-key fallback when the profile-keyed lookup misses | -| `~/.supabase/access-token` | plain text (token string) | last-resort fallback after env + keyring miss | +| `/access-token` | plain text (token string) | last-resort fallback after env + keyring miss | | `/supabase/.temp/linked-project.json` | JSON | always — `linkedProjectCache` reads to decide whether to write | ## Files Written -| Path | Format | When | -| ---------------------------------------------- | ------ | ------------------------------------------------------------------- | -| `~/.supabase/telemetry.json` | JSON | always (`Effect.ensuring(telemetryState.flush)`) | -| `/supabase/.temp/linked-project.json` | JSON | best-effort after `--project-ref` resolves (Go `PersistentPostRun`) | +| Path | Format | When | +| ----------------------------------------------- | ------ | ------------------------------------------------------------------- | +| `/telemetry.json` | JSON | always (`Effect.ensuring(telemetryState.flush)`) | +| `/supabase/.temp/linked-project.json` | JSON | best-effort after `--project-ref` resolves (Go `PersistentPostRun`) | ## API Routes @@ -26,10 +26,10 @@ ## Environment Variables -| Variable | Purpose | Required? | -| ----------------------- | ---------------------------------------------------- | ------------------------------------------------------- | -| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `~/.supabase/access-token`) | -| `SUPABASE_PROFILE` | profile selector (built-in name or YAML file path) | no (defaults to `supabase`) | +| Variable | Purpose | Required? | +| ----------------------- | ---------------------------------------------------- | -------------------------------------------------------------------------- | +| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `/access-token`) | +| `SUPABASE_PROFILE` | profile selector (built-in name or YAML file path) | no (defaults to `supabase`) | ## Exit Codes diff --git a/apps/cli/src/legacy/commands/sso/show/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/sso/show/SIDE_EFFECTS.md index ea25d6e730..8dfdf55532 100644 --- a/apps/cli/src/legacy/commands/sso/show/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/sso/show/SIDE_EFFECTS.md @@ -6,15 +6,15 @@ | ---------------------------------------------- | ------------------------- | --------------------------------------------------------------------------------------------- | | keyring `"Supabase CLI"` / `` | OS keychain | when `SUPABASE_ACCESS_TOKEN` unset and keyring available; account = `LegacyCliConfig.profile` | | keyring `"Supabase CLI"` / `access-token` | OS keychain | legacy-key fallback when the profile-keyed lookup misses | -| `~/.supabase/access-token` | plain text (token string) | last-resort fallback after env + keyring miss | +| `/access-token` | plain text (token string) | last-resort fallback after env + keyring miss | | `/supabase/.temp/linked-project.json` | JSON | always — `linkedProjectCache` reads to decide whether to write | ## Files Written -| Path | Format | When | -| ---------------------------------------------- | ------ | ------------------------------------------------------------------- | -| `~/.supabase/telemetry.json` | JSON | always (`Effect.ensuring(telemetryState.flush)`) | -| `/supabase/.temp/linked-project.json` | JSON | best-effort after `--project-ref` resolves (Go `PersistentPostRun`) | +| Path | Format | When | +| ----------------------------------------------- | ------ | ------------------------------------------------------------------- | +| `/telemetry.json` | JSON | always (`Effect.ensuring(telemetryState.flush)`) | +| `/supabase/.temp/linked-project.json` | JSON | best-effort after `--project-ref` resolves (Go `PersistentPostRun`) | ## API Routes @@ -27,10 +27,10 @@ side-calls — matches Go's `get.go`. ## Environment Variables -| Variable | Purpose | Required? | -| ----------------------- | ---------------------------------------------------- | ------------------------------------------------------- | -| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `~/.supabase/access-token`) | -| `SUPABASE_PROFILE` | profile selector (built-in name or YAML file path) | no (defaults to `supabase`) | +| Variable | Purpose | Required? | +| ----------------------- | ---------------------------------------------------- | -------------------------------------------------------------------------- | +| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `/access-token`) | +| `SUPABASE_PROFILE` | profile selector (built-in name or YAML file path) | no (defaults to `supabase`) | ## Exit Codes diff --git a/apps/cli/src/legacy/commands/sso/update/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/sso/update/SIDE_EFFECTS.md index 961ea33239..c378e2d0a5 100644 --- a/apps/cli/src/legacy/commands/sso/update/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/sso/update/SIDE_EFFECTS.md @@ -6,17 +6,17 @@ | ---------------------------------------------- | ------------------------- | --------------------------------------------------------------------------------------------- | | keyring `"Supabase CLI"` / `` | OS keychain | when `SUPABASE_ACCESS_TOKEN` unset and keyring available; account = `LegacyCliConfig.profile` | | keyring `"Supabase CLI"` / `access-token` | OS keychain | legacy-key fallback when the profile-keyed lookup misses | -| `~/.supabase/access-token` | plain text (token string) | last-resort fallback after env + keyring miss | +| `/access-token` | plain text (token string) | last-resort fallback after env + keyring miss | | `/supabase/.temp/linked-project.json` | JSON | always — `linkedProjectCache` reads to decide whether to write | | `` | XML (UTF-8) | when `--metadata-file` is provided | | `` | JSON | when `--attribute-mapping-file` is provided | ## Files Written -| Path | Format | When | -| ---------------------------------------------- | ------ | ------------------------------------------------------------------- | -| `~/.supabase/telemetry.json` | JSON | always (`Effect.ensuring(telemetryState.flush)`) | -| `/supabase/.temp/linked-project.json` | JSON | best-effort after `--project-ref` resolves (Go `PersistentPostRun`) | +| Path | Format | When | +| ----------------------------------------------- | ------ | ------------------------------------------------------------------- | +| `/telemetry.json` | JSON | always (`Effect.ensuring(telemetryState.flush)`) | +| `/supabase/.temp/linked-project.json` | JSON | best-effort after `--project-ref` resolves (Go `PersistentPostRun`) | ## API Routes @@ -34,10 +34,10 @@ GET still uses the typed client. ## Environment Variables -| Variable | Purpose | Required? | -| ----------------------- | ---------------------------------------------------- | ------------------------------------------------------- | -| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `~/.supabase/access-token`) | -| `SUPABASE_PROFILE` | profile selector (built-in name or YAML file path) | no (defaults to `supabase`) | +| Variable | Purpose | Required? | +| ----------------------- | ---------------------------------------------------- | -------------------------------------------------------------------------- | +| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `/access-token`) | +| `SUPABASE_PROFILE` | profile selector (built-in name or YAML file path) | no (defaults to `supabase`) | ## Exit Codes diff --git a/apps/cli/src/legacy/commands/storage/cp/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/storage/cp/SIDE_EFFECTS.md index 5865755099..ad7bdd46da 100644 --- a/apps/cli/src/legacy/commands/storage/cp/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/storage/cp/SIDE_EFFECTS.md @@ -2,10 +2,10 @@ ## Files Read -| Path | Format | When | -| -------------------------- | ---------- | ---------------------------------------------------------- | -| `~/.supabase/access-token` | plain text | when `SUPABASE_ACCESS_TOKEN` unset and keyring unavailable | -| `` | binary | when src is a local file path | +| Path | Format | When | +| --------------------------------------------- | ---------- | ---------------------------------------------------------- | +| `/access-token` | plain text | when `SUPABASE_ACCESS_TOKEN` unset and keyring unavailable | +| `` | binary | when src is a local file path | ## Files Written @@ -22,10 +22,10 @@ ## Environment Variables -| Variable | Purpose | Required? | -| ----------------------- | ---------------------------------------------------- | ------------------------------------------------------- | -| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `~/.supabase/access-token`) | -| `SUPABASE_API_URL` | override Management API base URL | no (defaults to `https://api.supabase.com`) | +| Variable | Purpose | Required? | +| ----------------------- | ---------------------------------------------------- | -------------------------------------------------------------------------- | +| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `/access-token`) | +| `SUPABASE_API_URL` | override Management API base URL | no (defaults to `https://api.supabase.com`) | ## Exit Codes diff --git a/apps/cli/src/legacy/commands/storage/ls/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/storage/ls/SIDE_EFFECTS.md index 13ae89b088..a884d55528 100644 --- a/apps/cli/src/legacy/commands/storage/ls/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/storage/ls/SIDE_EFFECTS.md @@ -2,9 +2,9 @@ ## Files Read -| Path | Format | When | -| -------------------------- | ---------- | ---------------------------------------------------------- | -| `~/.supabase/access-token` | plain text | when `SUPABASE_ACCESS_TOKEN` unset and keyring unavailable | +| Path | Format | When | +| --------------------------------------------- | ---------- | ---------------------------------------------------------- | +| `/access-token` | plain text | when `SUPABASE_ACCESS_TOKEN` unset and keyring unavailable | ## Files Written @@ -20,10 +20,10 @@ ## Environment Variables -| Variable | Purpose | Required? | -| ----------------------- | ---------------------------------------------------- | ------------------------------------------------------- | -| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `~/.supabase/access-token`) | -| `SUPABASE_API_URL` | override Management API base URL | no (defaults to `https://api.supabase.com`) | +| Variable | Purpose | Required? | +| ----------------------- | ---------------------------------------------------- | -------------------------------------------------------------------------- | +| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `/access-token`) | +| `SUPABASE_API_URL` | override Management API base URL | no (defaults to `https://api.supabase.com`) | ## Exit Codes diff --git a/apps/cli/src/legacy/commands/storage/mv/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/storage/mv/SIDE_EFFECTS.md index 1187b8e36a..2d539a50cc 100644 --- a/apps/cli/src/legacy/commands/storage/mv/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/storage/mv/SIDE_EFFECTS.md @@ -2,9 +2,9 @@ ## Files Read -| Path | Format | When | -| -------------------------- | ---------- | ---------------------------------------------------------- | -| `~/.supabase/access-token` | plain text | when `SUPABASE_ACCESS_TOKEN` unset and keyring unavailable | +| Path | Format | When | +| --------------------------------------------- | ---------- | ---------------------------------------------------------- | +| `/access-token` | plain text | when `SUPABASE_ACCESS_TOKEN` unset and keyring unavailable | ## Files Written @@ -20,10 +20,10 @@ ## Environment Variables -| Variable | Purpose | Required? | -| ----------------------- | ---------------------------------------------------- | ------------------------------------------------------- | -| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `~/.supabase/access-token`) | -| `SUPABASE_API_URL` | override Management API base URL | no (defaults to `https://api.supabase.com`) | +| Variable | Purpose | Required? | +| ----------------------- | ---------------------------------------------------- | -------------------------------------------------------------------------- | +| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `/access-token`) | +| `SUPABASE_API_URL` | override Management API base URL | no (defaults to `https://api.supabase.com`) | ## Exit Codes diff --git a/apps/cli/src/legacy/commands/storage/rm/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/storage/rm/SIDE_EFFECTS.md index 66ceb44709..384247fb25 100644 --- a/apps/cli/src/legacy/commands/storage/rm/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/storage/rm/SIDE_EFFECTS.md @@ -2,9 +2,9 @@ ## Files Read -| Path | Format | When | -| -------------------------- | ---------- | ---------------------------------------------------------- | -| `~/.supabase/access-token` | plain text | when `SUPABASE_ACCESS_TOKEN` unset and keyring unavailable | +| Path | Format | When | +| --------------------------------------------- | ---------- | ---------------------------------------------------------- | +| `/access-token` | plain text | when `SUPABASE_ACCESS_TOKEN` unset and keyring unavailable | ## Files Written @@ -20,10 +20,10 @@ ## Environment Variables -| Variable | Purpose | Required? | -| ----------------------- | ---------------------------------------------------- | ------------------------------------------------------- | -| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `~/.supabase/access-token`) | -| `SUPABASE_API_URL` | override Management API base URL | no (defaults to `https://api.supabase.com`) | +| Variable | Purpose | Required? | +| ----------------------- | ---------------------------------------------------- | -------------------------------------------------------------------------- | +| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `/access-token`) | +| `SUPABASE_API_URL` | override Management API base URL | no (defaults to `https://api.supabase.com`) | ## Exit Codes diff --git a/apps/cli/src/legacy/commands/telemetry/disable/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/telemetry/disable/SIDE_EFFECTS.md index 1be0ffbf9f..688d2e7ba7 100644 --- a/apps/cli/src/legacy/commands/telemetry/disable/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/telemetry/disable/SIDE_EFFECTS.md @@ -2,18 +2,18 @@ ## Files Read -| Path | Format | When | -| ---------------------------- | ------ | --------------------------------------------------------------------------- | -| `~/.supabase/telemetry.json` | JSON | when the file exists, to preserve prior identity fields before rewriting it | +| Path | Format | When | +| ----------------------------------------------- | ------ | --------------------------------------------------------------------------- | +| `/telemetry.json` | JSON | when the file exists, to preserve prior identity fields before rewriting it | When `SUPABASE_HOME` is set, the command uses `$SUPABASE_HOME/telemetry.json` -instead of `~/.supabase/telemetry.json`. +instead of `/telemetry.json`. ## Files Written -| Path | Format | When | -| ---------------------------- | ------ | ------ | -| `~/.supabase/telemetry.json` | JSON | always | +| Path | Format | When | +| ----------------------------------------------- | ------ | ------ | +| `/telemetry.json` | JSON | always | ## API Routes diff --git a/apps/cli/src/legacy/commands/telemetry/enable/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/telemetry/enable/SIDE_EFFECTS.md index 3942a107dc..07d82dba1f 100644 --- a/apps/cli/src/legacy/commands/telemetry/enable/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/telemetry/enable/SIDE_EFFECTS.md @@ -2,18 +2,18 @@ ## Files Read -| Path | Format | When | -| ---------------------------- | ------ | --------------------------------------------------------------------------- | -| `~/.supabase/telemetry.json` | JSON | when the file exists, to preserve prior identity fields before rewriting it | +| Path | Format | When | +| ----------------------------------------------- | ------ | --------------------------------------------------------------------------- | +| `/telemetry.json` | JSON | when the file exists, to preserve prior identity fields before rewriting it | When `SUPABASE_HOME` is set, the command uses `$SUPABASE_HOME/telemetry.json` -instead of `~/.supabase/telemetry.json`. +instead of `/telemetry.json`. ## Files Written -| Path | Format | When | -| ---------------------------- | ------ | ------ | -| `~/.supabase/telemetry.json` | JSON | always | +| Path | Format | When | +| ----------------------------------------------- | ------ | ------ | +| `/telemetry.json` | JSON | always | ## API Routes diff --git a/apps/cli/src/legacy/commands/telemetry/status/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/telemetry/status/SIDE_EFFECTS.md index 2c93acd75b..fe9d242087 100644 --- a/apps/cli/src/legacy/commands/telemetry/status/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/telemetry/status/SIDE_EFFECTS.md @@ -2,18 +2,18 @@ ## Files Read -| Path | Format | When | -| ---------------------------- | ------ | ------------------------------------------------------------------ | -| `~/.supabase/telemetry.json` | JSON | when the file exists, to load the current state before printing it | +| Path | Format | When | +| ----------------------------------------------- | ------ | ------------------------------------------------------------------ | +| `/telemetry.json` | JSON | when the file exists, to load the current state before printing it | When `SUPABASE_HOME` is set, the command uses `$SUPABASE_HOME/telemetry.json` -instead of `~/.supabase/telemetry.json`. +instead of `/telemetry.json`. ## Files Written -| Path | Format | When | -| ---------------------------- | ------ | -------------------------------------------------------------------------------------- | -| `~/.supabase/telemetry.json` | JSON | always, because `status` refreshes `session_last_active` and recreates malformed state | +| Path | Format | When | +| ----------------------------------------------- | ------ | -------------------------------------------------------------------------------------- | +| `/telemetry.json` | JSON | always, because `status` refreshes `session_last_active` and recreates malformed state | ## API Routes diff --git a/apps/cli/src/legacy/commands/test/db/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/test/db/SIDE_EFFECTS.md index 81014d92af..d6acc8c82e 100644 --- a/apps/cli/src/legacy/commands/test/db/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/test/db/SIDE_EFFECTS.md @@ -2,13 +2,13 @@ ## Files Read -| Path | Format | When | -| ------------------------------------- | ------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------- | -| `/supabase/tests/**/*.{sql,pg}` | SQL | default test discovery when no `[path]` given | -| `` | SQL | when explicit test files/dirs are passed | -| `/supabase/config.toml` | TOML | always: `db.port`, `db.shadow_port`, `db.password`, `project_id`. Absent → defaults; **present but malformed → command fails** (Go's `config.Load` parity) | -| `/supabase/.temp/pooler-url` | text | `--linked` pooler fallback only — the connection-pooler URL written by `supabase link` (Go reads it here, not from config.toml) | -| `~/.supabase/access-token` | text | `--linked` only, when `SUPABASE_ACCESS_TOKEN` unset | +| Path | Format | When | +| --------------------------------------------- | ------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------- | +| `/supabase/tests/**/*.{sql,pg}` | SQL | default test discovery when no `[path]` given | +| `` | SQL | when explicit test files/dirs are passed | +| `/supabase/config.toml` | TOML | always: `db.port`, `db.shadow_port`, `db.password`, `project_id`. Absent → defaults; **present but malformed → command fails** (Go's `config.Load` parity) | +| `/supabase/.temp/pooler-url` | text | `--linked` pooler fallback only — the connection-pooler URL written by `supabase link` (Go reads it here, not from config.toml) | +| `/access-token` | text | `--linked` only, when `SUPABASE_ACCESS_TOKEN` unset | ## Files Written diff --git a/apps/cli/src/legacy/commands/vanity-subdomains/activate/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/vanity-subdomains/activate/SIDE_EFFECTS.md index 23fbe98051..d2d3a9e2d5 100644 --- a/apps/cli/src/legacy/commands/vanity-subdomains/activate/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/vanity-subdomains/activate/SIDE_EFFECTS.md @@ -2,17 +2,17 @@ ## Files Read -| Path | Format | When | -| -------------------------------------- | ------------------------- | ------------------------------------------------------------- | -| `~/.supabase/access-token` | plain text (token string) | when `SUPABASE_ACCESS_TOKEN` unset and keyring unavailable | -| `/supabase/.temp/project-ref` | plain text (project ref) | when `--project-ref` flag and `PROJECT_ID` env are both unset | +| Path | Format | When | +| --------------------------------------------- | ------------------------- | ------------------------------------------------------------- | +| `/access-token` | plain text (token string) | when `SUPABASE_ACCESS_TOKEN` unset and keyring unavailable | +| `/supabase/.temp/project-ref` | plain text (project ref) | when `--project-ref` flag and `PROJECT_ID` env are both unset | ## Files Written | Path | Format | When | | ------------------------------------------------ | ------ | ----------------------------------------------------- | | `~/.supabase//linked-project.json` | JSON | after ref resolution, on success and failure | -| `~/.supabase/telemetry.json` | JSON | always, via `Effect.ensuring`, on success and failure | +| `/telemetry.json` | JSON | always, via `Effect.ensuring`, on success and failure | ## API Routes @@ -22,11 +22,11 @@ ## Environment Variables -| Variable | Purpose | Required? | -| ----------------------- | ---------------------------------------------------- | ---------------------------------------------------------- | -| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring then `~/.supabase/access-token`) | -| `SUPABASE_API_URL` | override Management API base URL | no (defaults to `https://api.supabase.com`) | -| `PROJECT_ID` | project ref fallback when `--project-ref` is unset | no (falls back to `supabase/.temp/project-ref`) | +| Variable | Purpose | Required? | +| ----------------------- | ---------------------------------------------------- | ----------------------------------------------------------------------------- | +| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring then `/access-token`) | +| `SUPABASE_API_URL` | override Management API base URL | no (defaults to `https://api.supabase.com`) | +| `PROJECT_ID` | project ref fallback when `--project-ref` is unset | no (falls back to `supabase/.temp/project-ref`) | ## Exit Codes diff --git a/apps/cli/src/legacy/commands/vanity-subdomains/check-availability/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/vanity-subdomains/check-availability/SIDE_EFFECTS.md index dc361d9fbc..e95889b17f 100644 --- a/apps/cli/src/legacy/commands/vanity-subdomains/check-availability/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/vanity-subdomains/check-availability/SIDE_EFFECTS.md @@ -2,17 +2,17 @@ ## Files Read -| Path | Format | When | -| -------------------------------------- | ------------------------- | ------------------------------------------------------------- | -| `~/.supabase/access-token` | plain text (token string) | when `SUPABASE_ACCESS_TOKEN` unset and keyring unavailable | -| `/supabase/.temp/project-ref` | plain text (project ref) | when `--project-ref` flag and `PROJECT_ID` env are both unset | +| Path | Format | When | +| --------------------------------------------- | ------------------------- | ------------------------------------------------------------- | +| `/access-token` | plain text (token string) | when `SUPABASE_ACCESS_TOKEN` unset and keyring unavailable | +| `/supabase/.temp/project-ref` | plain text (project ref) | when `--project-ref` flag and `PROJECT_ID` env are both unset | ## Files Written | Path | Format | When | | ------------------------------------------------ | ------ | ----------------------------------------------------- | | `~/.supabase//linked-project.json` | JSON | after ref resolution, on success and failure | -| `~/.supabase/telemetry.json` | JSON | always, via `Effect.ensuring`, on success and failure | +| `/telemetry.json` | JSON | always, via `Effect.ensuring`, on success and failure | ## API Routes @@ -22,11 +22,11 @@ ## Environment Variables -| Variable | Purpose | Required? | -| ----------------------- | ---------------------------------------------------- | ---------------------------------------------------------- | -| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring then `~/.supabase/access-token`) | -| `SUPABASE_API_URL` | override Management API base URL | no (defaults to `https://api.supabase.com`) | -| `PROJECT_ID` | project ref fallback when `--project-ref` is unset | no (falls back to `supabase/.temp/project-ref`) | +| Variable | Purpose | Required? | +| ----------------------- | ---------------------------------------------------- | ----------------------------------------------------------------------------- | +| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring then `/access-token`) | +| `SUPABASE_API_URL` | override Management API base URL | no (defaults to `https://api.supabase.com`) | +| `PROJECT_ID` | project ref fallback when `--project-ref` is unset | no (falls back to `supabase/.temp/project-ref`) | ## Exit Codes diff --git a/apps/cli/src/legacy/commands/vanity-subdomains/delete/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/vanity-subdomains/delete/SIDE_EFFECTS.md index 2596dc4cb6..a662252cb2 100644 --- a/apps/cli/src/legacy/commands/vanity-subdomains/delete/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/vanity-subdomains/delete/SIDE_EFFECTS.md @@ -2,17 +2,17 @@ ## Files Read -| Path | Format | When | -| -------------------------------------- | ------------------------- | ------------------------------------------------------------- | -| `~/.supabase/access-token` | plain text (token string) | when `SUPABASE_ACCESS_TOKEN` unset and keyring unavailable | -| `/supabase/.temp/project-ref` | plain text (project ref) | when `--project-ref` flag and `PROJECT_ID` env are both unset | +| Path | Format | When | +| --------------------------------------------- | ------------------------- | ------------------------------------------------------------- | +| `/access-token` | plain text (token string) | when `SUPABASE_ACCESS_TOKEN` unset and keyring unavailable | +| `/supabase/.temp/project-ref` | plain text (project ref) | when `--project-ref` flag and `PROJECT_ID` env are both unset | ## Files Written | Path | Format | When | | ------------------------------------------------ | ------ | ----------------------------------------------------- | | `~/.supabase//linked-project.json` | JSON | after ref resolution, on success and failure | -| `~/.supabase/telemetry.json` | JSON | always, via `Effect.ensuring`, on success and failure | +| `/telemetry.json` | JSON | always, via `Effect.ensuring`, on success and failure | ## API Routes @@ -22,11 +22,11 @@ ## Environment Variables -| Variable | Purpose | Required? | -| ----------------------- | ---------------------------------------------------- | ---------------------------------------------------------- | -| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring then `~/.supabase/access-token`) | -| `SUPABASE_API_URL` | override Management API base URL | no (defaults to `https://api.supabase.com`) | -| `PROJECT_ID` | project ref fallback when `--project-ref` is unset | no (falls back to `supabase/.temp/project-ref`) | +| Variable | Purpose | Required? | +| ----------------------- | ---------------------------------------------------- | ----------------------------------------------------------------------------- | +| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring then `/access-token`) | +| `SUPABASE_API_URL` | override Management API base URL | no (defaults to `https://api.supabase.com`) | +| `PROJECT_ID` | project ref fallback when `--project-ref` is unset | no (falls back to `supabase/.temp/project-ref`) | ## Exit Codes diff --git a/apps/cli/src/legacy/commands/vanity-subdomains/get/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/vanity-subdomains/get/SIDE_EFFECTS.md index 15c79abde7..12198ed40a 100644 --- a/apps/cli/src/legacy/commands/vanity-subdomains/get/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/vanity-subdomains/get/SIDE_EFFECTS.md @@ -2,17 +2,17 @@ ## Files Read -| Path | Format | When | -| -------------------------------------- | ------------------------- | ------------------------------------------------------------- | -| `~/.supabase/access-token` | plain text (token string) | when `SUPABASE_ACCESS_TOKEN` unset and keyring unavailable | -| `/supabase/.temp/project-ref` | plain text (project ref) | when `--project-ref` flag and `PROJECT_ID` env are both unset | +| Path | Format | When | +| --------------------------------------------- | ------------------------- | ------------------------------------------------------------- | +| `/access-token` | plain text (token string) | when `SUPABASE_ACCESS_TOKEN` unset and keyring unavailable | +| `/supabase/.temp/project-ref` | plain text (project ref) | when `--project-ref` flag and `PROJECT_ID` env are both unset | ## Files Written | Path | Format | When | | ------------------------------------------------ | ------ | ----------------------------------------------------- | | `~/.supabase//linked-project.json` | JSON | after ref resolution, on success and failure | -| `~/.supabase/telemetry.json` | JSON | always, via `Effect.ensuring`, on success and failure | +| `/telemetry.json` | JSON | always, via `Effect.ensuring`, on success and failure | ## API Routes @@ -22,11 +22,11 @@ ## Environment Variables -| Variable | Purpose | Required? | -| ----------------------- | ---------------------------------------------------- | ---------------------------------------------------------- | -| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring then `~/.supabase/access-token`) | -| `SUPABASE_API_URL` | override Management API base URL | no (defaults to `https://api.supabase.com`) | -| `PROJECT_ID` | project ref fallback when `--project-ref` is unset | no (falls back to `supabase/.temp/project-ref`) | +| Variable | Purpose | Required? | +| ----------------------- | ---------------------------------------------------- | ----------------------------------------------------------------------------- | +| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring then `/access-token`) | +| `SUPABASE_API_URL` | override Management API base URL | no (defaults to `https://api.supabase.com`) | +| `PROJECT_ID` | project ref fallback when `--project-ref` is unset | no (falls back to `supabase/.temp/project-ref`) | ## Exit Codes diff --git a/apps/cli/src/legacy/config/legacy-cli-config.layer.ts b/apps/cli/src/legacy/config/legacy-cli-config.layer.ts index 84f8062c42..d98465a63f 100644 --- a/apps/cli/src/legacy/config/legacy-cli-config.layer.ts +++ b/apps/cli/src/legacy/config/legacy-cli-config.layer.ts @@ -74,7 +74,7 @@ function unknownMessage(error: unknown): string { * * Profile-name precedence mirrors Go's `getProfileName` (`profile.go:121-136`): * `--profile` flag (when not the default) → `SUPABASE_PROFILE` env → the - * persisted `~/.supabase/profile` file → `supabase`. The resolved token is then: + * persisted Supabase home profile file → `supabase`. The resolved token is then: * * 1. If the token matches a built-in profile name, use that. * 2. Otherwise treat the token as a path to a YAML config file with `api_url:`. @@ -106,7 +106,7 @@ function resolveProfile( yield* debugLogger.debug(`Loading profile from flag: ${envValue}`); token = envValue; } else { - // Lowest precedence: the persisted `~/.supabase/profile` file (Go's + // Lowest precedence: the persisted Supabase home profile file (Go's // `getProfileName` file fallback, `profile.go:129-131`). const filePath = legacyProfileFilePath(path, homeDir, process.env); const content = yield* fs.readFileString(filePath).pipe( diff --git a/apps/cli/src/legacy/config/legacy-cli-config.layer.unit.test.ts b/apps/cli/src/legacy/config/legacy-cli-config.layer.unit.test.ts index 541e2d4a9b..53098aaf3b 100644 --- a/apps/cli/src/legacy/config/legacy-cli-config.layer.unit.test.ts +++ b/apps/cli/src/legacy/config/legacy-cli-config.layer.unit.test.ts @@ -86,15 +86,18 @@ describe("legacyCliConfigLayer", () => { }).pipe(Effect.provide(makeLayer({ profileFlag: "snap", cwd: tempRoot }))), ); - it.effect("reads the persisted ~/.supabase/profile file when no flag/env is set", () => { - const home = join(tempRoot, "home"); - mkdirSync(join(home, ".supabase"), { recursive: true }); - writeFileSync(join(home, ".supabase", "profile"), "supabase-staging\n"); - return Effect.gen(function* () { - const config = yield* LegacyCliConfig; - expect(config.profile).toBe("supabase-staging"); - }).pipe(Effect.provide(makeLayer({ home, cwd: tempRoot }))); - }); + it.effect( + "reads the persisted default Supabase home profile file when no flag/env is set", + () => { + const home = join(tempRoot, "home"); + mkdirSync(join(home, ".supabase"), { recursive: true }); + writeFileSync(join(home, ".supabase", "profile"), "supabase-staging\n"); + return Effect.gen(function* () { + const config = yield* LegacyCliConfig; + expect(config.profile).toBe("supabase-staging"); + }).pipe(Effect.provide(makeLayer({ home, cwd: tempRoot }))); + }, + ); it.effect("reads the persisted profile file from SUPABASE_HOME when configured", () => { const home = join(tempRoot, "home"); diff --git a/apps/cli/src/next/commands/logout/logout.guide.md b/apps/cli/src/next/commands/logout/logout.guide.md index 531323309d..ca609e370c 100644 --- a/apps/cli/src/next/commands/logout/logout.guide.md +++ b/apps/cli/src/next/commands/logout/logout.guide.md @@ -4,7 +4,7 @@ Log out of Supabase and remove the stored access token from your system. ## When to use -Run to revoke local CLI access — for example when switching accounts, on a shared machine, or after finishing work. The stored token is deleted from your system keyring (or the fallback file `~/.supabase/access-token`). After logging out, commands that require auth will prompt you to log in again. +Run to revoke local CLI access — for example when switching accounts, on a shared machine, or after finishing work. The stored token is deleted from your system keyring (or the fallback file `/access-token`). After logging out, commands that require auth will prompt you to log in again. diff --git a/apps/cli/src/next/config/cli-config.layer.ts b/apps/cli/src/next/config/cli-config.layer.ts index 07b9264306..13bddb1a1f 100644 --- a/apps/cli/src/next/config/cli-config.layer.ts +++ b/apps/cli/src/next/config/cli-config.layer.ts @@ -16,6 +16,14 @@ function readEnv( return value === undefined ? Option.none() : Option.some(value); } +function readTrimmedNonEmptyEnv( + env: Readonly>, + key: string, +): Option.Option { + const value = env[key]?.trim(); + return value === undefined || value.length === 0 ? Option.none() : Option.some(value); +} + const makeCliConfig = Effect.gen(function* () { const runtimeInfo = yield* RuntimeInfo; const projectContext = yield* ProjectContext; @@ -42,7 +50,7 @@ const makeCliConfig = Effect.gen(function* () { ), noKeyring: readEnv(effectiveEnv, "SUPABASE_NO_KEYRING"), supabaseHome: Option.getOrElse( - readEnv(effectiveEnv, "SUPABASE_HOME"), + readTrimmedNonEmptyEnv(effectiveEnv, "SUPABASE_HOME"), () => `${runtimeInfo.homeDir}/.supabase`, ), debug: readEnv(effectiveEnv, "SUPABASE_DEBUG"), diff --git a/apps/cli/src/next/config/cli-config.layer.unit.test.ts b/apps/cli/src/next/config/cli-config.layer.unit.test.ts index 7d34137e64..0fc05a16d2 100644 --- a/apps/cli/src/next/config/cli-config.layer.unit.test.ts +++ b/apps/cli/src/next/config/cli-config.layer.unit.test.ts @@ -170,6 +170,52 @@ describe("cliConfigLayer", () => { ); }); + it.live("uses SUPABASE_HOME when configured", () => { + const tempDir = makeTempDir(); + const supabaseHome = join(tempDir, "custom-supabase-home"); + return Effect.gen(function* () { + const cliConfig = yield* CliConfig; + + expect(cliConfig.supabaseHome).toBe(supabaseHome); + }).pipe( + Effect.provide( + buildLayer({ + cwd: tempDir, + env: { + SUPABASE_HOME: ` ${supabaseHome} `, + }, + }), + ), + Effect.ensuring(Effect.tryPromise(() => rm(tempDir, { recursive: true, force: true }))), + ); + }); + + for (const value of ["", " "]) { + it.live( + `falls back to the default Supabase home when SUPABASE_HOME is ${JSON.stringify(value)}`, + () => { + const tempDir = makeTempDir(); + const homeDir = join(tempDir, "home"); + return Effect.gen(function* () { + const cliConfig = yield* CliConfig; + + expect(cliConfig.supabaseHome).toBe(join(homeDir, ".supabase")); + }).pipe( + Effect.provide( + buildLayer({ + cwd: tempDir, + homeDir, + env: { + SUPABASE_HOME: value, + }, + }), + ), + Effect.ensuring(Effect.tryPromise(() => rm(tempDir, { recursive: true, force: true }))), + ); + }, + ); + } + it.live("prefers SUPABASE_TELEMETRY_POSTHOG_KEY over the shipped default", () => { const tempDir = makeTempDir(); return Effect.gen(function* () { diff --git a/packages/stack/docs/architecture.md b/packages/stack/docs/architecture.md index 75d39fcf93..308ea8c6ea 100644 --- a/packages/stack/docs/architecture.md +++ b/packages/stack/docs/architecture.md @@ -256,7 +256,7 @@ class BinaryResolver extends ServiceMap.Service< interface BinarySpec { readonly service: ServiceName; // "postgres" | "postgrest" | "auth" readonly version: string; - readonly cacheDir?: string; // defaults to ~/.supabase/bin + readonly cacheDir?: string; // defaults to /bin } ``` @@ -291,7 +291,7 @@ flowchart TD The cache directory mirrors the logical identity of each binary: `////`. Two versions of the same service coexist without conflict. The check is a simple `fs.exists` — if the directory is present, it was extracted successfully on a previous run. ``` -~/.supabase/bin/ +/bin/ postgres/ 17.6.1.081-cli/ darwin-arm64/ <- extracted binary tree @@ -1020,7 +1020,7 @@ graph TB subgraph "3. Asset preparation" DP["detectPlatform()"] - CH["check ~/.supabase/bin cache"] + CH["check /bin cache"] DL["HttpClient.get GitHub release tarball"] PI["docker pull image when service resolves to Docker"] VR["verify SHA-256 (node:crypto createHash)"] From af9f50168894825e0fca127c79dd32c9d13725d9 Mon Sep 17 00:00:00 2001 From: Alex Metelli Date: Sat, 20 Jun 2026 10:13:33 +0800 Subject: [PATCH 09/12] docs(cli): align Supabase home side effects --- apps/cli/AGENTS.md | 16 ++++---- apps/cli/docs/supabase-home.md | 6 +++ apps/cli/src/legacy/SIDE_EFFECTS_TEMPLATE.md | 9 +++-- .../commands/backups/list/SIDE_EFFECTS.md | 1 + .../commands/backups/restore/SIDE_EFFECTS.md | 1 + .../legacy/commands/bootstrap/SIDE_EFFECTS.md | 15 ++++---- .../commands/branches/create/SIDE_EFFECTS.md | 9 +++-- .../commands/branches/delete/SIDE_EFFECTS.md | 10 ++--- .../commands/branches/disable/SIDE_EFFECTS.md | 10 ++--- .../commands/branches/get/SIDE_EFFECTS.md | 10 ++--- .../commands/branches/list/SIDE_EFFECTS.md | 9 +++-- .../commands/branches/pause/SIDE_EFFECTS.md | 10 ++--- .../commands/branches/unpause/SIDE_EFFECTS.md | 10 ++--- .../commands/branches/update/SIDE_EFFECTS.md | 10 ++--- .../commands/config/push/SIDE_EFFECTS.md | 37 ++++++++++--------- .../commands/db/advisors/SIDE_EFFECTS.md | 13 ++++--- .../legacy/commands/db/diff/SIDE_EFFECTS.md | 9 +++-- .../legacy/commands/db/dump/SIDE_EFFECTS.md | 15 ++++---- .../legacy/commands/db/lint/SIDE_EFFECTS.md | 13 ++++--- .../legacy/commands/db/pull/SIDE_EFFECTS.md | 9 +++-- .../legacy/commands/db/push/SIDE_EFFECTS.md | 9 +++-- .../legacy/commands/db/query/SIDE_EFFECTS.md | 3 +- .../db/remote/changes/SIDE_EFFECTS.md | 9 +++-- .../commands/db/remote/commit/SIDE_EFFECTS.md | 9 +++-- .../legacy/commands/db/reset/SIDE_EFFECTS.md | 9 +++-- .../declarative/generate/SIDE_EFFECTS.md | 19 +++++----- .../legacy/commands/db/test/SIDE_EFFECTS.md | 9 +++-- .../legacy/commands/domains/SIDE_EFFECTS.md | 19 +++++----- .../commands/encryption/SIDE_EFFECTS.md | 31 ++++++++-------- .../commands/functions/delete/SIDE_EFFECTS.md | 9 +++-- .../commands/functions/deploy/SIDE_EFFECTS.md | 15 ++++---- .../functions/download/SIDE_EFFECTS.md | 9 +++-- .../commands/functions/list/SIDE_EFFECTS.md | 9 +++-- .../legacy/commands/gen/keys/SIDE_EFFECTS.md | 9 +++-- .../legacy/commands/gen/types/SIDE_EFFECTS.md | 17 +++++---- .../commands/inspect/db/SIDE_EFFECTS.md | 13 ++++--- .../commands/inspect/report/SIDE_EFFECTS.md | 25 +++++++------ .../src/legacy/commands/link/SIDE_EFFECTS.md | 3 +- .../src/legacy/commands/login/SIDE_EFFECTS.md | 13 ++++--- .../legacy/commands/logout/SIDE_EFFECTS.md | 9 +++-- .../commands/migration/down/SIDE_EFFECTS.md | 7 ++-- .../commands/migration/fetch/SIDE_EFFECTS.md | 7 ++-- .../commands/migration/list/SIDE_EFFECTS.md | 9 +++-- .../commands/migration/repair/SIDE_EFFECTS.md | 9 +++-- .../commands/migration/squash/SIDE_EFFECTS.md | 9 +++-- .../commands/migration/up/SIDE_EFFECTS.md | 7 ++-- .../commands/network-bans/get/SIDE_EFFECTS.md | 19 +++++----- .../network-bans/remove/SIDE_EFFECTS.md | 19 +++++----- .../network-restrictions/get/SIDE_EFFECTS.md | 19 +++++----- .../update/SIDE_EFFECTS.md | 19 +++++----- .../commands/orgs/create/SIDE_EFFECTS.md | 1 + .../legacy/commands/orgs/list/SIDE_EFFECTS.md | 3 +- .../postgres-config/delete/SIDE_EFFECTS.md | 19 +++++----- .../postgres-config/get/SIDE_EFFECTS.md | 19 +++++----- .../postgres-config/update/SIDE_EFFECTS.md | 19 +++++----- .../legacy/commands/projects/SIDE_EFFECTS.md | 11 +++--- .../projects/api-keys/SIDE_EFFECTS.md | 9 +++-- .../commands/projects/create/SIDE_EFFECTS.md | 1 + .../commands/projects/delete/SIDE_EFFECTS.md | 9 +++-- .../commands/projects/list/SIDE_EFFECTS.md | 9 +++-- .../commands/secrets/list/SIDE_EFFECTS.md | 9 +++-- .../commands/secrets/set/SIDE_EFFECTS.md | 9 +++-- .../commands/secrets/unset/SIDE_EFFECTS.md | 9 +++-- .../commands/seed/buckets/SIDE_EFFECTS.md | 9 +++-- .../legacy/commands/services/SIDE_EFFECTS.md | 9 +++-- .../snippets/download/SIDE_EFFECTS.md | 13 ++++--- .../commands/snippets/list/SIDE_EFFECTS.md | 13 ++++--- .../ssl-enforcement/get/SIDE_EFFECTS.md | 19 +++++----- .../ssl-enforcement/update/SIDE_EFFECTS.md | 19 +++++----- .../legacy/commands/sso/add/SIDE_EFFECTS.md | 9 +++-- .../legacy/commands/sso/info/SIDE_EFFECTS.md | 7 ++-- .../legacy/commands/sso/list/SIDE_EFFECTS.md | 9 +++-- .../commands/sso/remove/SIDE_EFFECTS.md | 9 +++-- .../legacy/commands/sso/show/SIDE_EFFECTS.md | 9 +++-- .../commands/sso/update/SIDE_EFFECTS.md | 9 +++-- .../commands/storage/cp/SIDE_EFFECTS.md | 9 +++-- .../commands/storage/ls/SIDE_EFFECTS.md | 9 +++-- .../commands/storage/mv/SIDE_EFFECTS.md | 9 +++-- .../commands/storage/rm/SIDE_EFFECTS.md | 9 +++-- .../legacy/commands/test/db/SIDE_EFFECTS.md | 17 +++++---- .../activate/SIDE_EFFECTS.md | 19 +++++----- .../check-availability/SIDE_EFFECTS.md | 19 +++++----- .../vanity-subdomains/delete/SIDE_EFFECTS.md | 19 +++++----- .../vanity-subdomains/get/SIDE_EFFECTS.md | 19 +++++----- 84 files changed, 533 insertions(+), 451 deletions(-) diff --git a/apps/cli/AGENTS.md b/apps/cli/AGENTS.md index 6ed1be43ea..52bc115acf 100644 --- a/apps/cli/AGENTS.md +++ b/apps/cli/AGENTS.md @@ -90,14 +90,14 @@ Always check `src/shared/` before writing new infrastructure. Do not duplicate w Also check the following `legacy/` infrastructure before writing equivalent helpers from scratch: -| Path | What it provides | -| ------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -| `legacy/config/legacy-cli-config.layer.ts` | `LegacyCliConfig` — resolves `SUPABASE_PROFILE` (built-in name **or** YAML file path), `--workdir`, `--experimental`, project-id from `supabase/config.toml` | -| `legacy/config/legacy-project-ref.layer.ts` | `LegacyProjectRefResolver` — `--project-ref` flag → env → linked-project.json → config fallback chain; matches Go's resolver order | -| `legacy/telemetry/legacy-telemetry-state.layer.ts` | `LegacyTelemetryState.flush` — writes `/telemetry.json`, runs in every command's `Effect.ensuring` | -| `legacy/telemetry/legacy-linked-project-cache.layer.ts` | `LegacyLinkedProjectCache.cache(ref)` — writes `~/.supabase//linked-project.json` after `--project-ref` resolves; bypasses generated schema validation (uses raw HTTP client) | -| `legacy/auth/legacy-http-debug.layer.ts` | `legacyHttpClientLayer` — wraps the HTTP transport with a `--debug` stderr logger in Go's `log.LstdFlags` format | -| `legacy/output/legacy-glamour-table.ts` | `renderGlamourTable(headers, rows)` — byte-exact ASCII match for Go's `glamour.RenderTable(..., AsciiStyle)` | +| Path | What it provides | +| ------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | +| `legacy/config/legacy-cli-config.layer.ts` | `LegacyCliConfig` — resolves `SUPABASE_PROFILE` (built-in name **or** YAML file path), `--workdir`, `--experimental`, project-id from `supabase/config.toml` | +| `legacy/config/legacy-project-ref.layer.ts` | `LegacyProjectRefResolver` — `--project-ref` flag → env → linked-project.json → config fallback chain; matches Go's resolver order | +| `legacy/telemetry/legacy-telemetry-state.layer.ts` | `LegacyTelemetryState.flush` — writes `/telemetry.json`, runs in every command's `Effect.ensuring` | +| `legacy/telemetry/legacy-linked-project-cache.layer.ts` | `LegacyLinkedProjectCache.cache(ref)` — writes `/supabase/.temp/linked-project.json` after `--project-ref` resolves; bypasses generated schema validation (uses raw HTTP client) | +| `legacy/auth/legacy-http-debug.layer.ts` | `legacyHttpClientLayer` — wraps the HTTP transport with a `--debug` stderr logger in Go's `log.LstdFlags` format | +| `legacy/output/legacy-glamour-table.ts` | `renderGlamourTable(headers, rows)` — byte-exact ASCII match for Go's `glamour.RenderTable(..., AsciiStyle)` | --- diff --git a/apps/cli/docs/supabase-home.md b/apps/cli/docs/supabase-home.md index e8c137cece..0f83e8c26f 100644 --- a/apps/cli/docs/supabase-home.md +++ b/apps/cli/docs/supabase-home.md @@ -271,6 +271,12 @@ Downloaded binaries remain shared across projects in: /bin/ ``` +The legacy Go installer stores its Deno binary directly under the state root: + +```text +/deno +``` + ### Live runtime sockets Managed daemon runtime directories, including the live Unix socket path, still use the OS temp diff --git a/apps/cli/src/legacy/SIDE_EFFECTS_TEMPLATE.md b/apps/cli/src/legacy/SIDE_EFFECTS_TEMPLATE.md index d51f7e543f..cc21a5ef34 100644 --- a/apps/cli/src/legacy/SIDE_EFFECTS_TEMPLATE.md +++ b/apps/cli/src/legacy/SIDE_EFFECTS_TEMPLATE.md @@ -58,10 +58,11 @@ -| Variable | Purpose | Required? | -| ----------------------- | ---------------------------------------------------- | -------------------------------------------------------------------------- | -| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `/access-token`) | -| `SUPABASE_API_URL` | override Management API base URL | no (defaults to `https://api.supabase.com`) | +| Variable | Purpose | Required? | +| ----------------------- | ---------------------------------------------------------------------- | -------------------------------------------------------------------------- | +| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `/access-token`) | +| `SUPABASE_HOME` | global CLI state root for auth, telemetry, traces, and shared binaries | no (defaults to `~/.supabase`) | +| `SUPABASE_API_URL` | override Management API base URL | no (defaults to `https://api.supabase.com`) | ## Exit Codes diff --git a/apps/cli/src/legacy/commands/backups/list/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/backups/list/SIDE_EFFECTS.md index dced70b611..53c1d25022 100644 --- a/apps/cli/src/legacy/commands/backups/list/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/backups/list/SIDE_EFFECTS.md @@ -28,6 +28,7 @@ | Variable | Purpose | Required? | | ----------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------- | | `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `/access-token`) | +| `SUPABASE_HOME` | global CLI state root for auth, telemetry, traces, and shared binaries | no (defaults to `~/.supabase`) | | `SUPABASE_PROFILE` | selects API base URL: `supabase` → `api.supabase.com`, `supabase-staging` → `api.supabase.green`, `supabase-local` → `http://localhost:8080`. May alternatively be a filesystem path to a YAML profile with at least `api_url:` and optional `name:` (Go parity — used by the cli-e2e test harness). | no (defaults to `supabase`) | | `SUPABASE_PROJECT_ID` | project ref fallback when `--project-ref` is unset | no (also reads `/supabase/.temp/project-ref` then prompts on TTY) | | `SUPABASE_WORKDIR` | base directory for the `.temp/project-ref` lookup | no (walks up from CWD looking for `supabase/config.toml`) | diff --git a/apps/cli/src/legacy/commands/backups/restore/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/backups/restore/SIDE_EFFECTS.md index d8090e1fb5..c56a218a52 100644 --- a/apps/cli/src/legacy/commands/backups/restore/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/backups/restore/SIDE_EFFECTS.md @@ -28,6 +28,7 @@ | Variable | Purpose | Required? | | ----------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------- | | `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `/access-token`) | +| `SUPABASE_HOME` | global CLI state root for auth, telemetry, traces, and shared binaries | no (defaults to `~/.supabase`) | | `SUPABASE_PROFILE` | selects API base URL: `supabase` → `api.supabase.com`, `supabase-staging` → `api.supabase.green`, `supabase-local` → `http://localhost:8080`. May alternatively be a filesystem path to a YAML profile with at least `api_url:` and optional `name:` (Go parity — used by the cli-e2e test harness). | no (defaults to `supabase`) | | `SUPABASE_PROJECT_ID` | project ref fallback when `--project-ref` is unset | no (also reads `/supabase/.temp/project-ref` then prompts on TTY) | | `SUPABASE_WORKDIR` | base directory for the `.temp/project-ref` lookup | no (walks up from CWD looking for `supabase/config.toml`) | diff --git a/apps/cli/src/legacy/commands/bootstrap/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/bootstrap/SIDE_EFFECTS.md index d623dd845f..4392b7f133 100644 --- a/apps/cli/src/legacy/commands/bootstrap/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/bootstrap/SIDE_EFFECTS.md @@ -46,13 +46,14 @@ leaking the change to the surrounding process. ## Environment Variables -| Variable | Purpose | Required? | -| -------------------------------------- | -------------------------------------------------- | --------- | -| `SUPABASE_WORKDIR` | target dir (`--workdir` flag → env → prompt → cwd) | no | -| `SUPABASE_DB_PASSWORD` | DB password (`-p` flag → env → prompt/generate) | no | -| `GITHUB_TOKEN` | raise the GitHub API rate limit for template fetch | no | -| `SUPABASE_ACCESS_TOKEN` | auth bypass for ensure-login | no | -| `SUPABASE_API_URL`, `SUPABASE_PROFILE` | API host / profile | no | +| Variable | Purpose | Required? | +| -------------------------------------- | ---------------------------------------------------------------------- | ------------------------------ | +| `SUPABASE_WORKDIR` | target dir (`--workdir` flag → env → prompt → cwd) | no | +| `SUPABASE_DB_PASSWORD` | DB password (`-p` flag → env → prompt/generate) | no | +| `GITHUB_TOKEN` | raise the GitHub API rate limit for template fetch | no | +| `SUPABASE_ACCESS_TOKEN` | auth bypass for ensure-login | no | +| `SUPABASE_HOME` | global CLI state root for auth, telemetry, traces, and shared binaries | no (defaults to `~/.supabase`) | +| `SUPABASE_API_URL`, `SUPABASE_PROFILE` | API host / profile | no | ## Exit Codes diff --git a/apps/cli/src/legacy/commands/branches/create/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/branches/create/SIDE_EFFECTS.md index e20b0dc007..278cfce744 100644 --- a/apps/cli/src/legacy/commands/branches/create/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/branches/create/SIDE_EFFECTS.md @@ -12,10 +12,10 @@ ## Files Written -| Path | Format | When | -| ------------------------------------------------ | ------ | ------------------------------------------------------------------------ | -| `~/.supabase//linked-project.json` | JSON | always (in `Effect.ensuring`) after `--project-ref` resolves — Go parity | -| `/telemetry.json` | JSON | always (in `Effect.ensuring`) at end of command — Go parity | +| Path | Format | When | +| ----------------------------------------------- | ------ | ------------------------------------------------------------------------ | +| `/supabase/.temp/linked-project.json` | JSON | always (in `Effect.ensuring`) after `--project-ref` resolves — Go parity | +| `/telemetry.json` | JSON | always (in `Effect.ensuring`) at end of command — Go parity | ## API Routes @@ -30,6 +30,7 @@ | Variable | Purpose | Required? | | ----------------------- | ------------------------------------------------------------------------------------------------ | -------------------------------------------------------------------------- | | `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `/access-token`) | +| `SUPABASE_HOME` | global CLI state root for auth, telemetry, traces, and shared binaries | no (defaults to `~/.supabase`) | | `SUPABASE_PROFILE` | selects API base URL (`supabase` / `supabase-staging` / `supabase-local`) or a YAML profile path | no | | `SUPABASE_PROJECT_ID` | parent project ref fallback when `--project-ref` is unset | no | | `SUPABASE_WORKDIR` | base directory for the `.temp/project-ref` lookup | no | diff --git a/apps/cli/src/legacy/commands/branches/delete/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/branches/delete/SIDE_EFFECTS.md index 1cb4dd622b..49ee7e6b47 100644 --- a/apps/cli/src/legacy/commands/branches/delete/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/branches/delete/SIDE_EFFECTS.md @@ -6,10 +6,10 @@ Same auth and project-ref resolution chain as every Management-API legacy comman ## Files Written -| Path | Format | When | -| ------------------------------------------------ | ------ | ------------------------------------------------------------------------ | -| `~/.supabase//linked-project.json` | JSON | always (in `Effect.ensuring`) after `--project-ref` resolves — Go parity | -| `/telemetry.json` | JSON | always (in `Effect.ensuring`) at end of command — Go parity | +| Path | Format | When | +| ----------------------------------------------- | ------ | ------------------------------------------------------------------------ | +| `/supabase/.temp/linked-project.json` | JSON | always (in `Effect.ensuring`) after `--project-ref` resolves — Go parity | +| `/telemetry.json` | JSON | always (in `Effect.ensuring`) at end of command — Go parity | ## API Routes @@ -21,7 +21,7 @@ Same auth and project-ref resolution chain as every Management-API legacy comman ## Environment Variables -`SUPABASE_ACCESS_TOKEN`, `SUPABASE_PROFILE`, `SUPABASE_PROJECT_ID`, `SUPABASE_WORKDIR` — same semantics as `branches list`. +`SUPABASE_ACCESS_TOKEN`, `SUPABASE_HOME`, `SUPABASE_PROFILE`, `SUPABASE_PROJECT_ID`, `SUPABASE_WORKDIR` — same semantics as `branches list`. ## Exit Codes diff --git a/apps/cli/src/legacy/commands/branches/disable/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/branches/disable/SIDE_EFFECTS.md index 340dff5ebe..5dc3e037fa 100644 --- a/apps/cli/src/legacy/commands/branches/disable/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/branches/disable/SIDE_EFFECTS.md @@ -8,10 +8,10 @@ Same auth and project-ref resolution chain as every Management-API legacy comman ## Files Written -| Path | Format | When | -| ------------------------------------------------ | ------ | ------------------------------------------------------------------------ | -| `~/.supabase//linked-project.json` | JSON | always (in `Effect.ensuring`) after `--project-ref` resolves — Go parity | -| `/telemetry.json` | JSON | always (in `Effect.ensuring`) at end of command — Go parity | +| Path | Format | When | +| ----------------------------------------------- | ------ | ------------------------------------------------------------------------ | +| `/supabase/.temp/linked-project.json` | JSON | always (in `Effect.ensuring`) after `--project-ref` resolves — Go parity | +| `/telemetry.json` | JSON | always (in `Effect.ensuring`) at end of command — Go parity | ## API Routes @@ -21,7 +21,7 @@ Same auth and project-ref resolution chain as every Management-API legacy comman ## Environment Variables -`SUPABASE_ACCESS_TOKEN`, `SUPABASE_PROFILE`, `SUPABASE_PROJECT_ID`, `SUPABASE_WORKDIR` — same semantics as `branches list`. +`SUPABASE_ACCESS_TOKEN`, `SUPABASE_HOME`, `SUPABASE_PROFILE`, `SUPABASE_PROJECT_ID`, `SUPABASE_WORKDIR` — same semantics as `branches list`. ## Exit Codes diff --git a/apps/cli/src/legacy/commands/branches/get/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/branches/get/SIDE_EFFECTS.md index 8250effb59..9167c23abd 100644 --- a/apps/cli/src/legacy/commands/branches/get/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/branches/get/SIDE_EFFECTS.md @@ -6,10 +6,10 @@ Same auth fallback chain (env / keyring / `/access ## Files Written -| Path | Format | When | -| ------------------------------------------------ | ------ | ------------------------------------------------------------------------ | -| `~/.supabase//linked-project.json` | JSON | always (in `Effect.ensuring`) after `--project-ref` resolves — Go parity | -| `/telemetry.json` | JSON | always (in `Effect.ensuring`) at end of command — Go parity | +| Path | Format | When | +| ----------------------------------------------- | ------ | ------------------------------------------------------------------------ | +| `/supabase/.temp/linked-project.json` | JSON | always (in `Effect.ensuring`) after `--project-ref` resolves — Go parity | +| `/telemetry.json` | JSON | always (in `Effect.ensuring`) at end of command — Go parity | ## API Routes @@ -22,7 +22,7 @@ Same auth fallback chain (env / keyring / `/access ## Environment Variables -`SUPABASE_ACCESS_TOKEN`, `SUPABASE_PROFILE`, `SUPABASE_PROJECT_ID`, `SUPABASE_WORKDIR` — same semantics as `branches list`. +`SUPABASE_ACCESS_TOKEN`, `SUPABASE_HOME`, `SUPABASE_PROFILE`, `SUPABASE_PROJECT_ID`, `SUPABASE_WORKDIR` — same semantics as `branches list`. ## Exit Codes diff --git a/apps/cli/src/legacy/commands/branches/list/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/branches/list/SIDE_EFFECTS.md index fd14622126..020209df60 100644 --- a/apps/cli/src/legacy/commands/branches/list/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/branches/list/SIDE_EFFECTS.md @@ -11,10 +11,10 @@ ## Files Written -| Path | Format | When | -| ------------------------------------------------ | ------ | ------------------------------------------------------------------------ | -| `~/.supabase//linked-project.json` | JSON | always (in `Effect.ensuring`) after `--project-ref` resolves — Go parity | -| `/telemetry.json` | JSON | always (in `Effect.ensuring`) at end of command — Go parity | +| Path | Format | When | +| ----------------------------------------------- | ------ | ------------------------------------------------------------------------ | +| `/supabase/.temp/linked-project.json` | JSON | always (in `Effect.ensuring`) after `--project-ref` resolves — Go parity | +| `/telemetry.json` | JSON | always (in `Effect.ensuring`) at end of command — Go parity | ## API Routes @@ -27,6 +27,7 @@ | Variable | Purpose | Required? | | ----------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------- | | `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `/access-token`) | +| `SUPABASE_HOME` | global CLI state root for auth, telemetry, traces, and shared binaries | no (defaults to `~/.supabase`) | | `SUPABASE_PROFILE` | selects API base URL: `supabase` → `api.supabase.com`, `supabase-staging` → `api.supabase.green`, `supabase-local` → `http://localhost:8080`. May alternatively be a filesystem path to a YAML profile with at least `api_url:` and optional `name:` (Go parity — used by the cli-e2e test harness). | no (defaults to `supabase`) | | `SUPABASE_PROJECT_ID` | project ref fallback when `--project-ref` is unset | no (also reads `/supabase/.temp/project-ref` then prompts on TTY) | | `SUPABASE_WORKDIR` | base directory for the `.temp/project-ref` lookup | no (walks up from CWD looking for `supabase/config.toml`) | diff --git a/apps/cli/src/legacy/commands/branches/pause/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/branches/pause/SIDE_EFFECTS.md index f07abc4b42..e6a0bbb237 100644 --- a/apps/cli/src/legacy/commands/branches/pause/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/branches/pause/SIDE_EFFECTS.md @@ -6,10 +6,10 @@ Same auth and project-ref resolution chain as every Management-API legacy comman ## Files Written -| Path | Format | When | -| ------------------------------------------------ | ------ | ------------------------------------------------------------------------ | -| `~/.supabase//linked-project.json` | JSON | always (in `Effect.ensuring`) after `--project-ref` resolves — Go parity | -| `/telemetry.json` | JSON | always (in `Effect.ensuring`) at end of command — Go parity | +| Path | Format | When | +| ----------------------------------------------- | ------ | ------------------------------------------------------------------------ | +| `/supabase/.temp/linked-project.json` | JSON | always (in `Effect.ensuring`) after `--project-ref` resolves — Go parity | +| `/telemetry.json` | JSON | always (in `Effect.ensuring`) at end of command — Go parity | ## API Routes @@ -21,7 +21,7 @@ Same auth and project-ref resolution chain as every Management-API legacy comman ## Environment Variables -`SUPABASE_ACCESS_TOKEN`, `SUPABASE_PROFILE`, `SUPABASE_PROJECT_ID`, `SUPABASE_WORKDIR` — same semantics as `branches list`. +`SUPABASE_ACCESS_TOKEN`, `SUPABASE_HOME`, `SUPABASE_PROFILE`, `SUPABASE_PROJECT_ID`, `SUPABASE_WORKDIR` — same semantics as `branches list`. ## Exit Codes diff --git a/apps/cli/src/legacy/commands/branches/unpause/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/branches/unpause/SIDE_EFFECTS.md index a8862c0e24..757748b0f8 100644 --- a/apps/cli/src/legacy/commands/branches/unpause/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/branches/unpause/SIDE_EFFECTS.md @@ -6,10 +6,10 @@ Same auth and project-ref resolution chain as every Management-API legacy comman ## Files Written -| Path | Format | When | -| ------------------------------------------------ | ------ | ------------------------------------------------------------------------ | -| `~/.supabase//linked-project.json` | JSON | always (in `Effect.ensuring`) after `--project-ref` resolves — Go parity | -| `/telemetry.json` | JSON | always (in `Effect.ensuring`) at end of command — Go parity | +| Path | Format | When | +| ----------------------------------------------- | ------ | ------------------------------------------------------------------------ | +| `/supabase/.temp/linked-project.json` | JSON | always (in `Effect.ensuring`) after `--project-ref` resolves — Go parity | +| `/telemetry.json` | JSON | always (in `Effect.ensuring`) at end of command — Go parity | ## API Routes @@ -21,7 +21,7 @@ Same auth and project-ref resolution chain as every Management-API legacy comman ## Environment Variables -`SUPABASE_ACCESS_TOKEN`, `SUPABASE_PROFILE`, `SUPABASE_PROJECT_ID`, `SUPABASE_WORKDIR` — same semantics as `branches list`. +`SUPABASE_ACCESS_TOKEN`, `SUPABASE_HOME`, `SUPABASE_PROFILE`, `SUPABASE_PROJECT_ID`, `SUPABASE_WORKDIR` — same semantics as `branches list`. ## Exit Codes diff --git a/apps/cli/src/legacy/commands/branches/update/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/branches/update/SIDE_EFFECTS.md index fede52845a..c10cba1e3c 100644 --- a/apps/cli/src/legacy/commands/branches/update/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/branches/update/SIDE_EFFECTS.md @@ -6,10 +6,10 @@ Same auth and project-ref resolution chain as every Management-API legacy comman ## Files Written -| Path | Format | When | -| ------------------------------------------------ | ------ | ------------------------------------------------------------------------ | -| `~/.supabase//linked-project.json` | JSON | always (in `Effect.ensuring`) after `--project-ref` resolves — Go parity | -| `/telemetry.json` | JSON | always (in `Effect.ensuring`) at end of command — Go parity | +| Path | Format | When | +| ----------------------------------------------- | ------ | ------------------------------------------------------------------------ | +| `/supabase/.temp/linked-project.json` | JSON | always (in `Effect.ensuring`) after `--project-ref` resolves — Go parity | +| `/telemetry.json` | JSON | always (in `Effect.ensuring`) at end of command — Go parity | ## API Routes @@ -23,7 +23,7 @@ Same auth and project-ref resolution chain as every Management-API legacy comman ## Environment Variables -`SUPABASE_ACCESS_TOKEN`, `SUPABASE_PROFILE`, `SUPABASE_PROJECT_ID`, `SUPABASE_WORKDIR` — same semantics as `branches list`. +`SUPABASE_ACCESS_TOKEN`, `SUPABASE_HOME`, `SUPABASE_PROFILE`, `SUPABASE_PROJECT_ID`, `SUPABASE_WORKDIR` — same semantics as `branches list`. ## Exit Codes diff --git a/apps/cli/src/legacy/commands/config/push/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/config/push/SIDE_EFFECTS.md index c9767f8f78..a7ca779233 100644 --- a/apps/cli/src/legacy/commands/config/push/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/config/push/SIDE_EFFECTS.md @@ -7,19 +7,19 @@ local → if changed, print the unified diff and confirm → PATCH/PUT/POST. ## Files Read -| Path | Format | When | -| ------------------------------------------------ | ------------------------- | --------------------------------------------------------------- | -| `/supabase/config.toml` | TOML | always, before any network call (parse error aborts, exit 1) | -| `/supabase/.env`, `.env.local` | dotenv | always, to resolve `env(VAR)` references inside `config.toml` | -| `~/.supabase//linked-project.json` | JSON | project-ref fallback (flag → `SUPABASE_PROJECT_ID` → this file) | -| `/access-token` | plain text (token string) | when `SUPABASE_ACCESS_TOKEN` unset and keyring unavailable | +| Path | Format | When | +| ---------------------------------------------- | ------------------------- | --------------------------------------------------------------- | +| `/supabase/config.toml` | TOML | always, before any network call (parse error aborts, exit 1) | +| `/supabase/.env`, `.env.local` | dotenv | always, to resolve `env(VAR)` references inside `config.toml` | +| `/supabase/.temp/linked-project.json` | JSON | project-ref fallback (flag → `SUPABASE_PROJECT_ID` → this file) | +| `/access-token` | plain text (token string) | when `SUPABASE_ACCESS_TOKEN` unset and keyring unavailable | ## Files Written -| Path | Format | When | -| ------------------------------------------------ | ------ | ---------------------------------------------------------------------- | -| `~/.supabase//linked-project.json` | JSON | `Effect.ensuring` after run (success **and** failure), if ref resolved | -| `/telemetry.json` | JSON | `Effect.ensuring` after run (success **and** failure) | +| Path | Format | When | +| ----------------------------------------------- | ------ | ---------------------------------------------------------------------- | +| `/supabase/.temp/linked-project.json` | JSON | `Effect.ensuring` after run (success **and** failure), if ref resolved | +| `/telemetry.json` | JSON | `Effect.ensuring` after run (success **and** failure) | No writes to `config.toml`. @@ -49,14 +49,15 @@ when its local gate is off. ## Environment Variables -| Variable | Purpose | Required? | -| ----------------------- | -------------------------------------------------------- | -------------------------------------------------------------------------- | -| `SUPABASE_PROJECT_ID` | project ref (flag → this → `.temp/project-ref` → prompt) | no | -| `SUPABASE_YES` | auto-confirm prompts (`--yes`) | no | -| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `/access-token`) | -| `SUPABASE_API_URL` | override Management API base URL | no (defaults to `https://api.supabase.com`) | -| `SUPABASE_PROFILE` | API profile selection | no | -| `env(VAR)` references | interpolated into `config.toml` values at load | no | +| Variable | Purpose | Required? | +| ----------------------- | ---------------------------------------------------------------------- | -------------------------------------------------------------------------- | +| `SUPABASE_PROJECT_ID` | project ref (flag → this → `.temp/project-ref` → prompt) | no | +| `SUPABASE_YES` | auto-confirm prompts (`--yes`) | no | +| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `/access-token`) | +| `SUPABASE_HOME` | global CLI state root for auth, telemetry, traces, and shared binaries | no (defaults to `~/.supabase`) | +| `SUPABASE_API_URL` | override Management API base URL | no (defaults to `https://api.supabase.com`) | +| `SUPABASE_PROFILE` | API profile selection | no | +| `env(VAR)` references | interpolated into `config.toml` values at load | no | ## Exit Codes diff --git a/apps/cli/src/legacy/commands/db/advisors/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/db/advisors/SIDE_EFFECTS.md index 802e7156a7..ab3d1b8600 100644 --- a/apps/cli/src/legacy/commands/db/advisors/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/db/advisors/SIDE_EFFECTS.md @@ -41,12 +41,13 @@ One connection. Within one transaction: `BEGIN` → `set local search_path = ''` ## Environment Variables -| Variable | Purpose | Required? | -| ----------------------- | ----------------------------------------- | ------------------------------------------------------------ | -| `SUPABASE_ACCESS_TOKEN` | auth token for `--linked` | no (keyring → `/access-token`) | -| `SUPABASE_PROJECT_ID` | linked project ref override | no | -| `SUPABASE_PROFILE` | API profile (built-in name or YAML path) | no | -| `PGHOST` / `PGPORT` / … | connection overrides (local / `--db-url`) | no | +| Variable | Purpose | Required? | +| ----------------------- | ---------------------------------------------------------------------- | ------------------------------------------------------------ | +| `SUPABASE_ACCESS_TOKEN` | auth token for `--linked` | no (keyring → `/access-token`) | +| `SUPABASE_HOME` | global CLI state root for auth, telemetry, traces, and shared binaries | no (defaults to `~/.supabase`) | +| `SUPABASE_PROJECT_ID` | linked project ref override | no | +| `SUPABASE_PROFILE` | API profile (built-in name or YAML path) | no | +| `PGHOST` / `PGPORT` / … | connection overrides (local / `--db-url`) | no | The API base URL is derived from `SUPABASE_PROFILE`; `SUPABASE_API_URL` is **not** honored (Go parity — see `legacy-cli-config.layer.unit.test.ts`). diff --git a/apps/cli/src/legacy/commands/db/diff/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/db/diff/SIDE_EFFECTS.md index 00435a87db..f95913fde4 100644 --- a/apps/cli/src/legacy/commands/db/diff/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/db/diff/SIDE_EFFECTS.md @@ -21,10 +21,11 @@ ## Environment Variables -| Variable | Purpose | Required? | -| ----------------------- | --------------------------------------- | -------------------------------------------------------------------------- | -| `SUPABASE_ACCESS_TOKEN` | auth token for `--linked` mode | no (falls back to keyring → `/access-token`) | -| `DB_PASSWORD` | password for direct database connection | no | +| Variable | Purpose | Required? | +| ----------------------- | ---------------------------------------------------------------------- | -------------------------------------------------------------------------- | +| `SUPABASE_ACCESS_TOKEN` | auth token for `--linked` mode | no (falls back to keyring → `/access-token`) | +| `SUPABASE_HOME` | global CLI state root for auth, telemetry, traces, and shared binaries | no (defaults to `~/.supabase`) | +| `DB_PASSWORD` | password for direct database connection | no | ## Exit Codes diff --git a/apps/cli/src/legacy/commands/db/dump/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/db/dump/SIDE_EFFECTS.md index 7d774fa728..e464a3a373 100644 --- a/apps/cli/src/legacy/commands/db/dump/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/db/dump/SIDE_EFFECTS.md @@ -30,13 +30,14 @@ script run inside the local Postgres image to stdout or `--file`. ## Environment Variables -| Variable | Purpose | -| ----------------------------------------------------------------------------- | --------------------------------------------- | -| `SUPABASE_DB_PASSWORD` (`DB_PASSWORD` viper key; `--password`/`-p` overrides) | remote DB password | -| `SUPABASE_ACCESS_TOKEN` | `--linked` auth | -| `BITBUCKET_CLONE_DIR` | (no-op for dump — no `--security-opt` is set) | -| `SUPABASE_INTERNAL_IMAGE_REGISTRY` | rewrite the pg image registry | -| `DOCKER_HOST` | docker daemon endpoint | +| Variable | Purpose | +| ----------------------------------------------------------------------------- | ---------------------------------------------------------------------- | ------------------------------ | +| `SUPABASE_DB_PASSWORD` (`DB_PASSWORD` viper key; `--password`/`-p` overrides) | remote DB password | +| `SUPABASE_ACCESS_TOKEN` | `--linked` auth | +| `SUPABASE_HOME` | global CLI state root for auth, telemetry, traces, and shared binaries | no (defaults to `~/.supabase`) | +| `BITBUCKET_CLONE_DIR` | (no-op for dump — no `--security-opt` is set) | +| `SUPABASE_INTERNAL_IMAGE_REGISTRY` | rewrite the pg image registry | +| `DOCKER_HOST` | docker daemon endpoint | ## Exit Codes diff --git a/apps/cli/src/legacy/commands/db/lint/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/db/lint/SIDE_EFFECTS.md index 7226bd28c0..be0ca2575b 100644 --- a/apps/cli/src/legacy/commands/db/lint/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/db/lint/SIDE_EFFECTS.md @@ -43,12 +43,13 @@ the extension fails at step 3 (matching Go). ## Environment Variables -| Variable | Purpose | Required? | -| ----------------------- | ---------------------------------------- | ------------------------------------------------------------ | -| `SUPABASE_ACCESS_TOKEN` | auth token for `--linked` resolution | no (keyring → `/access-token`) | -| `SUPABASE_DB_PASSWORD` | linked direct-DB password | no | -| `SUPABASE_PROFILE` | API profile (built-in name or YAML path) | no | -| `PGHOST` / `PGPORT` / … | connection overrides | no | +| Variable | Purpose | Required? | +| ----------------------- | ---------------------------------------------------------------------- | ------------------------------------------------------------ | +| `SUPABASE_ACCESS_TOKEN` | auth token for `--linked` resolution | no (keyring → `/access-token`) | +| `SUPABASE_HOME` | global CLI state root for auth, telemetry, traces, and shared binaries | no (defaults to `~/.supabase`) | +| `SUPABASE_DB_PASSWORD` | linked direct-DB password | no | +| `SUPABASE_PROFILE` | API profile (built-in name or YAML path) | no | +| `PGHOST` / `PGPORT` / … | connection overrides | no | ## Exit Codes diff --git a/apps/cli/src/legacy/commands/db/pull/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/db/pull/SIDE_EFFECTS.md index 48224f640b..a951d442c4 100644 --- a/apps/cli/src/legacy/commands/db/pull/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/db/pull/SIDE_EFFECTS.md @@ -20,10 +20,11 @@ ## Environment Variables -| Variable | Purpose | Required? | -| ----------------------- | --------------------------------------- | -------------------------------------------------------------------------- | -| `SUPABASE_ACCESS_TOKEN` | auth token for `--linked` mode | no (falls back to keyring → `/access-token`) | -| `DB_PASSWORD` | password for direct database connection | no | +| Variable | Purpose | Required? | +| ----------------------- | ---------------------------------------------------------------------- | -------------------------------------------------------------------------- | +| `SUPABASE_ACCESS_TOKEN` | auth token for `--linked` mode | no (falls back to keyring → `/access-token`) | +| `SUPABASE_HOME` | global CLI state root for auth, telemetry, traces, and shared binaries | no (defaults to `~/.supabase`) | +| `DB_PASSWORD` | password for direct database connection | no | ## Exit Codes diff --git a/apps/cli/src/legacy/commands/db/push/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/db/push/SIDE_EFFECTS.md index a940e9657b..a62351b53c 100644 --- a/apps/cli/src/legacy/commands/db/push/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/db/push/SIDE_EFFECTS.md @@ -23,10 +23,11 @@ ## Environment Variables -| Variable | Purpose | Required? | -| ----------------------- | --------------------------------------- | -------------------------------------------------------------------------- | -| `SUPABASE_ACCESS_TOKEN` | auth token for `--linked` mode | no (falls back to keyring → `/access-token`) | -| `DB_PASSWORD` | password for direct database connection | no | +| Variable | Purpose | Required? | +| ----------------------- | ---------------------------------------------------------------------- | -------------------------------------------------------------------------- | +| `SUPABASE_ACCESS_TOKEN` | auth token for `--linked` mode | no (falls back to keyring → `/access-token`) | +| `SUPABASE_HOME` | global CLI state root for auth, telemetry, traces, and shared binaries | no (defaults to `~/.supabase`) | +| `DB_PASSWORD` | password for direct database connection | no | ## Exit Codes diff --git a/apps/cli/src/legacy/commands/db/query/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/db/query/SIDE_EFFECTS.md index 8689e9f038..9f9530ce0b 100644 --- a/apps/cli/src/legacy/commands/db/query/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/db/query/SIDE_EFFECTS.md @@ -30,8 +30,9 @@ the result as a table or JSON. ## Environment Variables | Variable | Purpose | -| ----------------------- | ---------------------------------------------------------------------------- | +| ----------------------- | ---------------------------------------------------------------------------- | ------------------------------ | | `SUPABASE_ACCESS_TOKEN` | `--linked` auth | +| `SUPABASE_HOME` | global CLI state root for auth, telemetry, traces, and shared binaries | no (defaults to `~/.supabase`) | | agent-detection signals | `--agent=auto` (e.g. `CURSOR_*`, `CLAUDECODE`, …) via `@vercel/detect-agent` | ## Exit Codes diff --git a/apps/cli/src/legacy/commands/db/remote/changes/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/db/remote/changes/SIDE_EFFECTS.md index a347c0f58f..74e1998278 100644 --- a/apps/cli/src/legacy/commands/db/remote/changes/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/db/remote/changes/SIDE_EFFECTS.md @@ -20,10 +20,11 @@ ## Environment Variables -| Variable | Purpose | Required? | -| ----------------------- | --------------------------------------- | -------------------------------------------------------------------------- | -| `SUPABASE_ACCESS_TOKEN` | auth token | no (falls back to keyring → `/access-token`) | -| `DB_PASSWORD` | password for direct database connection | no | +| Variable | Purpose | Required? | +| ----------------------- | ---------------------------------------------------------------------- | -------------------------------------------------------------------------- | +| `SUPABASE_ACCESS_TOKEN` | auth token | no (falls back to keyring → `/access-token`) | +| `SUPABASE_HOME` | global CLI state root for auth, telemetry, traces, and shared binaries | no (defaults to `~/.supabase`) | +| `DB_PASSWORD` | password for direct database connection | no | ## Exit Codes diff --git a/apps/cli/src/legacy/commands/db/remote/commit/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/db/remote/commit/SIDE_EFFECTS.md index b656ff3b76..97567c5af8 100644 --- a/apps/cli/src/legacy/commands/db/remote/commit/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/db/remote/commit/SIDE_EFFECTS.md @@ -20,10 +20,11 @@ ## Environment Variables -| Variable | Purpose | Required? | -| ----------------------- | --------------------------------------- | -------------------------------------------------------------------------- | -| `SUPABASE_ACCESS_TOKEN` | auth token | no (falls back to keyring → `/access-token`) | -| `DB_PASSWORD` | password for direct database connection | no | +| Variable | Purpose | Required? | +| ----------------------- | ---------------------------------------------------------------------- | -------------------------------------------------------------------------- | +| `SUPABASE_ACCESS_TOKEN` | auth token | no (falls back to keyring → `/access-token`) | +| `SUPABASE_HOME` | global CLI state root for auth, telemetry, traces, and shared binaries | no (defaults to `~/.supabase`) | +| `DB_PASSWORD` | password for direct database connection | no | ## Exit Codes diff --git a/apps/cli/src/legacy/commands/db/reset/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/db/reset/SIDE_EFFECTS.md index 825373d293..73e8a0f0d5 100644 --- a/apps/cli/src/legacy/commands/db/reset/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/db/reset/SIDE_EFFECTS.md @@ -22,10 +22,11 @@ ## Environment Variables -| Variable | Purpose | Required? | -| ----------------------- | --------------------------------------- | -------------------------------------------------------------------------- | -| `SUPABASE_ACCESS_TOKEN` | auth token for `--linked` mode | no (falls back to keyring → `/access-token`) | -| `DB_PASSWORD` | password for direct database connection | no | +| Variable | Purpose | Required? | +| ----------------------- | ---------------------------------------------------------------------- | -------------------------------------------------------------------------- | +| `SUPABASE_ACCESS_TOKEN` | auth token for `--linked` mode | no (falls back to keyring → `/access-token`) | +| `SUPABASE_HOME` | global CLI state root for auth, telemetry, traces, and shared binaries | no (defaults to `~/.supabase`) | +| `DB_PASSWORD` | password for direct database connection | no | ## Exit Codes diff --git a/apps/cli/src/legacy/commands/db/schema/declarative/generate/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/db/schema/declarative/generate/SIDE_EFFECTS.md index 5bac89ce53..a4c4e5452c 100644 --- a/apps/cli/src/legacy/commands/db/schema/declarative/generate/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/db/schema/declarative/generate/SIDE_EFFECTS.md @@ -32,15 +32,16 @@ pg-delta catalog (source) against the target database's catalog (target). ## Environment Variables -| Variable | Purpose | Required? | -| ---------------------------- | -------------------------------------------------- | --------- | -| `SUPABASE_ACCESS_TOKEN` | auth token for `--linked` | no | -| `DB_PASSWORD` | password for `--linked` / `--db-url` | no | -| `PGDELTA_NPM_REGISTRY` | private `@supabase` npm registry for pg-delta | no | -| `PGDELTA_DEBUG` | verbose pg-delta diagnostics | no | -| `SUPABASE_GO_BINARY` | override the `supabase-go` seam binary | no | -| `SUPABASE_SERVICES_HOSTNAME` | local DB host for `--local` (Go `GetHostname`) | no | -| `DOCKER_HOST` | tcp daemon host used as the local DB host fallback | no | +| Variable | Purpose | Required? | +| ---------------------------- | ---------------------------------------------------------------------- | ------------------------------ | +| `SUPABASE_ACCESS_TOKEN` | auth token for `--linked` | no | +| `SUPABASE_HOME` | global CLI state root for auth, telemetry, traces, and shared binaries | no (defaults to `~/.supabase`) | +| `DB_PASSWORD` | password for `--linked` / `--db-url` | no | +| `PGDELTA_NPM_REGISTRY` | private `@supabase` npm registry for pg-delta | no | +| `PGDELTA_DEBUG` | verbose pg-delta diagnostics | no | +| `SUPABASE_GO_BINARY` | override the `supabase-go` seam binary | no | +| `SUPABASE_SERVICES_HOSTNAME` | local DB host for `--local` (Go `GetHostname`) | no | +| `DOCKER_HOST` | tcp daemon host used as the local DB host fallback | no | ## Exit Codes diff --git a/apps/cli/src/legacy/commands/db/test/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/db/test/SIDE_EFFECTS.md index 223ee37308..f4bb96ed5a 100644 --- a/apps/cli/src/legacy/commands/db/test/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/db/test/SIDE_EFFECTS.md @@ -21,10 +21,11 @@ ## Environment Variables -| Variable | Purpose | Required? | -| ----------------------- | --------------------------------------- | -------------------------------------------------------------------------- | -| `SUPABASE_ACCESS_TOKEN` | auth token for `--linked` mode | no (falls back to keyring → `/access-token`) | -| `DB_PASSWORD` | password for direct database connection | no | +| Variable | Purpose | Required? | +| ----------------------- | ---------------------------------------------------------------------- | -------------------------------------------------------------------------- | +| `SUPABASE_ACCESS_TOKEN` | auth token for `--linked` mode | no (falls back to keyring → `/access-token`) | +| `SUPABASE_HOME` | global CLI state root for auth, telemetry, traces, and shared binaries | no (defaults to `~/.supabase`) | +| `DB_PASSWORD` | password for direct database connection | no | ## Exit Codes diff --git a/apps/cli/src/legacy/commands/domains/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/domains/SIDE_EFFECTS.md index cf15857bf6..45f42c39c2 100644 --- a/apps/cli/src/legacy/commands/domains/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/domains/SIDE_EFFECTS.md @@ -13,10 +13,10 @@ Cloudflare DNS-over-HTTPS CNAME pre-check. ## Files Written -| Path | Format | When | -| ------------------------------------------------ | ------ | -------------------------------------------------- | -| `~/.supabase//linked-project.json` | JSON | always (PersistentPostRun), after the ref resolves | -| `/telemetry.json` | JSON | always (PersistentPostRun), success or failure | +| Path | Format | When | +| ----------------------------------------------- | ------ | -------------------------------------------------- | +| `/supabase/.temp/linked-project.json` | JSON | always (PersistentPostRun), after the ref resolves | +| `/telemetry.json` | JSON | always (PersistentPostRun), success or failure | ## API Routes @@ -31,11 +31,12 @@ Cloudflare DNS-over-HTTPS CNAME pre-check. ## Environment Variables -| Variable | Purpose | Required? | -| ----------------------- | ---------------------------------------------------- | -------------------------------------------------------------------------- | -| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `/access-token`) | -| `SUPABASE_PROJECT_ID` | project ref fallback when `--project-ref` is unset | no (falls back to linked-project file) | -| `SUPABASE_PROFILE` | built-in profile name or path to a YAML profile | no (defaults to `supabase`; sets API URL + project host) | +| Variable | Purpose | Required? | +| ----------------------- | ---------------------------------------------------------------------- | -------------------------------------------------------------------------- | +| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `/access-token`) | +| `SUPABASE_HOME` | global CLI state root for auth, telemetry, traces, and shared binaries | no (defaults to `~/.supabase`) | +| `SUPABASE_PROJECT_ID` | project ref fallback when `--project-ref` is unset | no (falls back to linked-project file) | +| `SUPABASE_PROFILE` | built-in profile name or path to a YAML profile | no (defaults to `supabase`; sets API URL + project host) | ## Exit Codes diff --git a/apps/cli/src/legacy/commands/encryption/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/encryption/SIDE_EFFECTS.md index 2151828cca..3d74f4dfbc 100644 --- a/apps/cli/src/legacy/commands/encryption/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/encryption/SIDE_EFFECTS.md @@ -6,18 +6,18 @@ additionally reads the new key from stdin. ## Files Read -| Path | Format | When | -| ------------------------------------------------ | ------------------------- | ------------------------------------------------------------------ | -| `/access-token` | plain text (token string) | when `SUPABASE_ACCESS_TOKEN` unset and keyring unavailable | -| `~/.supabase//linked-project.json` | JSON | when `--project-ref` / `PROJECT_ID` unset, to resolve linked ref | -| stdin | raw bytes / masked TTY | `update-root-key` only — masked TTY input or piped bytes (the key) | +| Path | Format | When | +| ---------------------------------------------- | ------------------------- | ------------------------------------------------------------------ | +| `/access-token` | plain text (token string) | when `SUPABASE_ACCESS_TOKEN` unset and keyring unavailable | +| `/supabase/.temp/linked-project.json` | JSON | when `--project-ref` / `PROJECT_ID` unset, to resolve linked ref | +| stdin | raw bytes / masked TTY | `update-root-key` only — masked TTY input or piped bytes (the key) | ## Files Written -| Path | Format | When | -| ------------------------------------------------ | ------ | ------------------------------------------------- | -| `~/.supabase//linked-project.json` | JSON | PersistentPostRun, after the project ref resolves | -| `/telemetry.json` | JSON | PersistentPostRun, on success or failure | +| Path | Format | When | +| ----------------------------------------------- | ------ | ------------------------------------------------- | +| `/supabase/.temp/linked-project.json` | JSON | PersistentPostRun, after the project ref resolves | +| `/telemetry.json` | JSON | PersistentPostRun, on success or failure | ## API Routes @@ -30,12 +30,13 @@ additionally reads the new key from stdin. ## Environment Variables -| Variable | Purpose | Required? | -| ------------------------------------ | ---------------------------------------------------- | -------------------------------------------------------------------------- | -| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `/access-token`) | -| `SUPABASE_PROJECT_ID` / `PROJECT_ID` | project ref (fallback when `--project-ref` unset) | no (falls back to linked-project file → prompt) | -| `SUPABASE_API_URL` | override Management API base URL | no (defaults to `https://api.supabase.com`) | -| `SUPABASE_PROFILE` | built-in profile name or YAML file path | no (defaults to `supabase`) | +| Variable | Purpose | Required? | +| ------------------------------------ | ---------------------------------------------------------------------- | -------------------------------------------------------------------------- | +| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `/access-token`) | +| `SUPABASE_HOME` | global CLI state root for auth, telemetry, traces, and shared binaries | no (defaults to `~/.supabase`) | +| `SUPABASE_PROJECT_ID` / `PROJECT_ID` | project ref (fallback when `--project-ref` unset) | no (falls back to linked-project file → prompt) | +| `SUPABASE_API_URL` | override Management API base URL | no (defaults to `https://api.supabase.com`) | +| `SUPABASE_PROFILE` | built-in profile name or YAML file path | no (defaults to `supabase`) | ## Exit Codes diff --git a/apps/cli/src/legacy/commands/functions/delete/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/functions/delete/SIDE_EFFECTS.md index bda12fa6a8..b5f2fb7b2a 100644 --- a/apps/cli/src/legacy/commands/functions/delete/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/functions/delete/SIDE_EFFECTS.md @@ -20,10 +20,11 @@ ## Environment Variables -| Variable | Purpose | Required? | -| ----------------------- | ---------------------------------------------------- | -------------------------------------------------------------------------- | -| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `/access-token`) | -| `SUPABASE_API_URL` | override Management API base URL | no (defaults to `https://api.supabase.com`) | +| Variable | Purpose | Required? | +| ----------------------- | ---------------------------------------------------------------------- | -------------------------------------------------------------------------- | +| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `/access-token`) | +| `SUPABASE_HOME` | global CLI state root for auth, telemetry, traces, and shared binaries | no (defaults to `~/.supabase`) | +| `SUPABASE_API_URL` | override Management API base URL | no (defaults to `https://api.supabase.com`) | ## Exit Codes diff --git a/apps/cli/src/legacy/commands/functions/deploy/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/functions/deploy/SIDE_EFFECTS.md index 835099d79c..038486b5d5 100644 --- a/apps/cli/src/legacy/commands/functions/deploy/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/functions/deploy/SIDE_EFFECTS.md @@ -43,13 +43,14 @@ Docker bundling may pull or run the configured edge-runtime image and uses the ## Environment Variables -| Variable | Purpose | Required? | -| ---------------------------------- | ---------------------------------------------------- | -------------------------------------------------------------------------- | -| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `/access-token`) | -| `SUPABASE_PROJECT_ID` | optional project ref fallback | no | -| `SUPABASE_INTERNAL_IMAGE_REGISTRY` | selects the Functions bundler image registry | no | -| `NPM_CONFIG_REGISTRY` | forwarded into Docker bundling when set | no | -| `DEBUG` | enables verbose Docker bundle output when `true` | no | +| Variable | Purpose | Required? | +| ---------------------------------- | ---------------------------------------------------------------------- | -------------------------------------------------------------------------- | +| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `/access-token`) | +| `SUPABASE_HOME` | global CLI state root for auth, telemetry, traces, and shared binaries | no (defaults to `~/.supabase`) | +| `SUPABASE_PROJECT_ID` | optional project ref fallback | no | +| `SUPABASE_INTERNAL_IMAGE_REGISTRY` | selects the Functions bundler image registry | no | +| `NPM_CONFIG_REGISTRY` | forwarded into Docker bundling when set | no | +| `DEBUG` | enables verbose Docker bundle output when `true` | no | ## Exit Codes diff --git a/apps/cli/src/legacy/commands/functions/download/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/functions/download/SIDE_EFFECTS.md index 9bbd1cd35a..03a98a3022 100644 --- a/apps/cli/src/legacy/commands/functions/download/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/functions/download/SIDE_EFFECTS.md @@ -28,10 +28,11 @@ ## Environment Variables -| Variable | Purpose | Required? | -| ----------------------- | ---------------------------------------------------- | -------------------------------------------------------------------------- | -| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `/access-token`) | -| `SUPABASE_API_URL` | override Management API base URL | no (defaults to `https://api.supabase.com`) | +| Variable | Purpose | Required? | +| ----------------------- | ---------------------------------------------------------------------- | -------------------------------------------------------------------------- | +| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `/access-token`) | +| `SUPABASE_HOME` | global CLI state root for auth, telemetry, traces, and shared binaries | no (defaults to `~/.supabase`) | +| `SUPABASE_API_URL` | override Management API base URL | no (defaults to `https://api.supabase.com`) | ## Exit Codes diff --git a/apps/cli/src/legacy/commands/functions/list/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/functions/list/SIDE_EFFECTS.md index 70034ea88e..568801f170 100644 --- a/apps/cli/src/legacy/commands/functions/list/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/functions/list/SIDE_EFFECTS.md @@ -20,10 +20,11 @@ ## Environment Variables -| Variable | Purpose | Required? | -| ----------------------- | ---------------------------------------------------- | -------------------------------------------------------------------------- | -| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `/access-token`) | -| `SUPABASE_API_URL` | override Management API base URL | no (defaults to `https://api.supabase.com`) | +| Variable | Purpose | Required? | +| ----------------------- | ---------------------------------------------------------------------- | -------------------------------------------------------------------------- | +| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `/access-token`) | +| `SUPABASE_HOME` | global CLI state root for auth, telemetry, traces, and shared binaries | no (defaults to `~/.supabase`) | +| `SUPABASE_API_URL` | override Management API base URL | no (defaults to `https://api.supabase.com`) | ## Exit Codes diff --git a/apps/cli/src/legacy/commands/gen/keys/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/gen/keys/SIDE_EFFECTS.md index 4e5934ef8e..2cde984719 100644 --- a/apps/cli/src/legacy/commands/gen/keys/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/gen/keys/SIDE_EFFECTS.md @@ -20,10 +20,11 @@ ## Environment Variables -| Variable | Purpose | Required? | -| ----------------------- | -------------------------------- | -------------------------------------------------------------------------- | -| `SUPABASE_ACCESS_TOKEN` | auth token | no (falls back to keyring → `/access-token`) | -| `SUPABASE_API_URL` | override Management API base URL | no (defaults to `https://api.supabase.com`) | +| Variable | Purpose | Required? | +| ----------------------- | ---------------------------------------------------------------------- | -------------------------------------------------------------------------- | +| `SUPABASE_ACCESS_TOKEN` | auth token | no (falls back to keyring → `/access-token`) | +| `SUPABASE_HOME` | global CLI state root for auth, telemetry, traces, and shared binaries | no (defaults to `~/.supabase`) | +| `SUPABASE_API_URL` | override Management API base URL | no (defaults to `https://api.supabase.com`) | ## Exit Codes diff --git a/apps/cli/src/legacy/commands/gen/types/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/gen/types/SIDE_EFFECTS.md index 18f12e9d8b..264d71484d 100644 --- a/apps/cli/src/legacy/commands/gen/types/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/gen/types/SIDE_EFFECTS.md @@ -40,14 +40,15 @@ detect TLS support before launching pg-meta (mirrors Go's `isRequireSSL`). ## Environment Variables -| Variable | Purpose | Required? | -| ---------------------------------- | ----------------------------------------------------------------- | -------------------------------------------------------------------------- | -| `SUPABASE_ACCESS_TOKEN` | auth token for linked/project-id mode | no (falls back to keyring → `/access-token`) | -| `SUPABASE_API_URL` | override Management API base URL | no (defaults to `https://api.supabase.com`) | -| `SUPABASE_DB_PASSWORD` | local database password for `--local` | no (defaults to `postgres`) | -| `SUPABASE_SERVICES_HOSTNAME` | host used for the local TLS probe | no (defaults to `127.0.0.1`) | -| `SUPABASE_INTERNAL_IMAGE_REGISTRY` | pg-meta image registry override (`docker.io` → Docker Hub) | no (defaults to the ECR registry) | -| `SUPABASE_CA_SKIP_VERIFY` | when `true`, prints a TLS-verification-disabled warning to stderr | no | +| Variable | Purpose | Required? | +| ---------------------------------- | ---------------------------------------------------------------------- | -------------------------------------------------------------------------- | +| `SUPABASE_ACCESS_TOKEN` | auth token for linked/project-id mode | no (falls back to keyring → `/access-token`) | +| `SUPABASE_HOME` | global CLI state root for auth, telemetry, traces, and shared binaries | no (defaults to `~/.supabase`) | +| `SUPABASE_API_URL` | override Management API base URL | no (defaults to `https://api.supabase.com`) | +| `SUPABASE_DB_PASSWORD` | local database password for `--local` | no (defaults to `postgres`) | +| `SUPABASE_SERVICES_HOSTNAME` | host used for the local TLS probe | no (defaults to `127.0.0.1`) | +| `SUPABASE_INTERNAL_IMAGE_REGISTRY` | pg-meta image registry override (`docker.io` → Docker Hub) | no (defaults to the ECR registry) | +| `SUPABASE_CA_SKIP_VERIFY` | when `true`, prints a TLS-verification-disabled warning to stderr | no | ## Exit Codes diff --git a/apps/cli/src/legacy/commands/inspect/db/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/inspect/db/SIDE_EFFECTS.md index 263e7964b6..e6896162d9 100644 --- a/apps/cli/src/legacy/commands/inspect/db/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/inspect/db/SIDE_EFFECTS.md @@ -36,12 +36,13 @@ no new config reads. ## Environment Variables -| Variable | Purpose | Required? | -| ---------------------------------------------------- | --------------------------------- | --------------------------------------- | -| `SUPABASE_DB_PASSWORD` / `DB_PASSWORD` | database password (linked/local) | no (prompts / config fallback) | -| `SUPABASE_ACCESS_TOKEN` | Management API auth (linked only) | no (falls back to keyring / token file) | -| `PROJECT_ID` | project ref fallback (linked) | no (config resolution fallback) | -| libpq vars (`PGSSLROOTCERT`, `PGCONNECT_TIMEOUT`, …) | honored when `--db-url` is used | no | +| Variable | Purpose | Required? | +| ---------------------------------------------------- | ---------------------------------------------------------------------- | --------------------------------------- | +| `SUPABASE_DB_PASSWORD` / `DB_PASSWORD` | database password (linked/local) | no (prompts / config fallback) | +| `SUPABASE_ACCESS_TOKEN` | Management API auth (linked only) | no (falls back to keyring / token file) | +| `SUPABASE_HOME` | global CLI state root for auth, telemetry, traces, and shared binaries | no (defaults to `~/.supabase`) | +| `PROJECT_ID` | project ref fallback (linked) | no (config resolution fallback) | +| libpq vars (`PGSSLROOTCERT`, `PGCONNECT_TIMEOUT`, …) | honored when `--db-url` is used | no | ## Database Queries diff --git a/apps/cli/src/legacy/commands/inspect/report/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/inspect/report/SIDE_EFFECTS.md index 6f97024606..843939dcb6 100644 --- a/apps/cli/src/legacy/commands/inspect/report/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/inspect/report/SIDE_EFFECTS.md @@ -20,12 +20,12 @@ validating those CSVs. Native TypeScript port of `apps/cli-go/internal/inspect/r ## Files Written -| Path | Mode | When | -| ------------------------------------------------ | ---- | --------------------------------------------------------------- | -| `//` (directory) | 0755 | always — created recursively | -| `//.csv` ×14 | 0644 | always — one CSV per inspect query (server-side `COPY ... CSV`) | -| `/telemetry.json` | — | always (telemetry flush) | -| `~/.supabase//linked-project.json` | — | `--linked` path (linked-project cache) | +| Path | Mode | When | +| ----------------------------------------------- | ---- | --------------------------------------------------------------- | +| `//` (directory) | 0755 | always — created recursively | +| `//.csv` ×14 | 0644 | always — one CSV per inspect query (server-side `COPY ... CSV`) | +| `/telemetry.json` | — | always (telemetry flush) | +| `/supabase/.temp/linked-project.json` | — | `--linked` path (linked-project cache) | The 14 CSV basenames (underscored, matching Go's SQL filenames — **not** the `inspect db` command names): `bloat`, `blocking`, `calls`, `db_stats`, @@ -54,12 +54,13 @@ resolve the connection (via `LegacyDbConfigResolver`). ## Environment Variables -| Variable | Purpose | Required? | -| ----------------------- | ---------------------------------------------------- | --------- | -| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no | -| `SUPABASE_API_URL` | override Management API base URL | no | -| `SUPABASE_DB_*` | override `[db]` port / shadow_port / password | no | -| `SUPABASE_ENV` | selects which project `.env` files load | no | +| Variable | Purpose | Required? | +| ----------------------- | ---------------------------------------------------------------------- | ------------------------------ | +| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no | +| `SUPABASE_HOME` | global CLI state root for auth, telemetry, traces, and shared binaries | no (defaults to `~/.supabase`) | +| `SUPABASE_API_URL` | override Management API base URL | no | +| `SUPABASE_DB_*` | override `[db]` port / shadow_port / password | no | +| `SUPABASE_ENV` | selects which project `.env` files load | no | ## Exit Codes diff --git a/apps/cli/src/legacy/commands/link/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/link/SIDE_EFFECTS.md index 8916872419..92ee008055 100644 --- a/apps/cli/src/legacy/commands/link/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/link/SIDE_EFFECTS.md @@ -55,9 +55,10 @@ Tenant service gateway (`https://.`, `apikey: ` + ## Environment Variables | Variable | Purpose | -| ----------------------- | ---------------------------------------------------------------------------------------------------------------------------- | +| ----------------------- | ---------------------------------------------------------------------------------------------------------------------------- | ------------------------------ | | `SUPABASE_PROJECT_ID` | project-ref resolution (flag → env → TTY prompt) | | `SUPABASE_ACCESS_TOKEN` | Management API bearer auth (env → keyring → `/access-token`) | +| `SUPABASE_HOME` | global CLI state root for auth, telemetry, traces, and shared binaries | no (defaults to `~/.supabase`) | | `SUPABASE_DB_PASSWORD` | bound to `--password`; **accepted but a no-op** for `link` (the DB-connection path that would consume it is dead code in Go) | ## Exit Codes diff --git a/apps/cli/src/legacy/commands/login/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/login/SIDE_EFFECTS.md index 21b9fd2742..5687e6586d 100644 --- a/apps/cli/src/legacy/commands/login/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/login/SIDE_EFFECTS.md @@ -29,12 +29,13 @@ stitches/clears the telemetry identity and captures `cli_login_completed`. ## Environment Variables -| Variable | Purpose | Required? | -| ---------------------------------------------- | ------------------------------------------------------ | --------------------------------------------------------- | -| `SUPABASE_ACCESS_TOKEN` | non-interactive token source | no (falls back to `--token` → piped stdin → browser flow) | -| `SUPABASE_NO_KEYRING` | disables the OS keyring, forcing the file fallback | no | -| `CLAUDECODE` / `CLAUDE_CODE` | enables the Claude Code plugin hint (TTY stdout only) | no | -| `DO_NOT_TRACK` / `SUPABASE_TELEMETRY_DISABLED` | suppress analytics delivery (state file still written) | no | +| Variable | Purpose | Required? | +| ---------------------------------------------- | ---------------------------------------------------------------------- | --------------------------------------------------------- | +| `SUPABASE_ACCESS_TOKEN` | non-interactive token source | no (falls back to `--token` → piped stdin → browser flow) | +| `SUPABASE_HOME` | global CLI state root for auth, telemetry, traces, and shared binaries | no (defaults to `~/.supabase`) | +| `SUPABASE_NO_KEYRING` | disables the OS keyring, forcing the file fallback | no | +| `CLAUDECODE` / `CLAUDE_CODE` | enables the Claude Code plugin hint (TTY stdout only) | no | +| `DO_NOT_TRACK` / `SUPABASE_TELEMETRY_DISABLED` | suppress analytics delivery (state file still written) | no | ## Exit Codes diff --git a/apps/cli/src/legacy/commands/logout/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/logout/SIDE_EFFECTS.md index 81f1b9348d..31f0b31911 100644 --- a/apps/cli/src/legacy/commands/logout/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/logout/SIDE_EFFECTS.md @@ -25,10 +25,11 @@ sweeps all stored project credentials. Makes no API calls. ## Environment Variables -| Variable | Purpose | Required? | -| ---------------------- | -------------------------------------------------- | --------- | -| `SUPABASE_YES`/`--yes` | auto-confirm the logout prompt | no | -| `SUPABASE_NO_KEYRING` | disables the OS keyring (forces the file fallback) | no | +| Variable | Purpose | Required? | +| ---------------------- | ---------------------------------------------------------------------- | ------------------------------ | +| `SUPABASE_HOME` | global CLI state root for auth, telemetry, traces, and shared binaries | no (defaults to `~/.supabase`) | +| `SUPABASE_YES`/`--yes` | auto-confirm the logout prompt | no | +| `SUPABASE_NO_KEYRING` | disables the OS keyring (forces the file fallback) | no | ## Exit Codes diff --git a/apps/cli/src/legacy/commands/migration/down/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/migration/down/SIDE_EFFECTS.md index bdb1bc0d26..17d93ab902 100644 --- a/apps/cli/src/legacy/commands/migration/down/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/migration/down/SIDE_EFFECTS.md @@ -21,9 +21,10 @@ ## Environment Variables -| Variable | Purpose | Required? | -| ----------------------- | ------------------------------ | -------------------------------------------------------------------------- | -| `SUPABASE_ACCESS_TOKEN` | auth token for `--linked` mode | no (falls back to keyring → `/access-token`) | +| Variable | Purpose | Required? | +| ----------------------- | ---------------------------------------------------------------------- | -------------------------------------------------------------------------- | +| `SUPABASE_ACCESS_TOKEN` | auth token for `--linked` mode | no (falls back to keyring → `/access-token`) | +| `SUPABASE_HOME` | global CLI state root for auth, telemetry, traces, and shared binaries | no (defaults to `~/.supabase`) | ## Exit Codes diff --git a/apps/cli/src/legacy/commands/migration/fetch/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/migration/fetch/SIDE_EFFECTS.md index 4caafd3613..44e48d3f93 100644 --- a/apps/cli/src/legacy/commands/migration/fetch/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/migration/fetch/SIDE_EFFECTS.md @@ -20,9 +20,10 @@ ## Environment Variables -| Variable | Purpose | Required? | -| ----------------------- | ------------------------------ | -------------------------------------------------------------------------- | -| `SUPABASE_ACCESS_TOKEN` | auth token for `--linked` mode | no (falls back to keyring → `/access-token`) | +| Variable | Purpose | Required? | +| ----------------------- | ---------------------------------------------------------------------- | -------------------------------------------------------------------------- | +| `SUPABASE_ACCESS_TOKEN` | auth token for `--linked` mode | no (falls back to keyring → `/access-token`) | +| `SUPABASE_HOME` | global CLI state root for auth, telemetry, traces, and shared binaries | no (defaults to `~/.supabase`) | ## Exit Codes diff --git a/apps/cli/src/legacy/commands/migration/list/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/migration/list/SIDE_EFFECTS.md index d2c4597850..e449e32430 100644 --- a/apps/cli/src/legacy/commands/migration/list/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/migration/list/SIDE_EFFECTS.md @@ -21,10 +21,11 @@ ## Environment Variables -| Variable | Purpose | Required? | -| ----------------------- | --------------------------------------- | -------------------------------------------------------------------------- | -| `SUPABASE_ACCESS_TOKEN` | auth token for `--linked` mode | no (falls back to keyring → `/access-token`) | -| `DB_PASSWORD` | password for direct database connection | no | +| Variable | Purpose | Required? | +| ----------------------- | ---------------------------------------------------------------------- | -------------------------------------------------------------------------- | +| `SUPABASE_ACCESS_TOKEN` | auth token for `--linked` mode | no (falls back to keyring → `/access-token`) | +| `SUPABASE_HOME` | global CLI state root for auth, telemetry, traces, and shared binaries | no (defaults to `~/.supabase`) | +| `DB_PASSWORD` | password for direct database connection | no | ## Exit Codes diff --git a/apps/cli/src/legacy/commands/migration/repair/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/migration/repair/SIDE_EFFECTS.md index f7296decf0..b2b32303bb 100644 --- a/apps/cli/src/legacy/commands/migration/repair/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/migration/repair/SIDE_EFFECTS.md @@ -20,10 +20,11 @@ ## Environment Variables -| Variable | Purpose | Required? | -| ----------------------- | --------------------------------------- | -------------------------------------------------------------------------- | -| `SUPABASE_ACCESS_TOKEN` | auth token for `--linked` mode | no (falls back to keyring → `/access-token`) | -| `DB_PASSWORD` | password for direct database connection | no | +| Variable | Purpose | Required? | +| ----------------------- | ---------------------------------------------------------------------- | -------------------------------------------------------------------------- | +| `SUPABASE_ACCESS_TOKEN` | auth token for `--linked` mode | no (falls back to keyring → `/access-token`) | +| `SUPABASE_HOME` | global CLI state root for auth, telemetry, traces, and shared binaries | no (defaults to `~/.supabase`) | +| `DB_PASSWORD` | password for direct database connection | no | ## Exit Codes diff --git a/apps/cli/src/legacy/commands/migration/squash/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/migration/squash/SIDE_EFFECTS.md index 144e57e57d..73754e08fc 100644 --- a/apps/cli/src/legacy/commands/migration/squash/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/migration/squash/SIDE_EFFECTS.md @@ -21,10 +21,11 @@ ## Environment Variables -| Variable | Purpose | Required? | -| ----------------------- | --------------------------------------- | -------------------------------------------------------------------------- | -| `SUPABASE_ACCESS_TOKEN` | auth token for `--linked` mode | no (falls back to keyring → `/access-token`) | -| `DB_PASSWORD` | password for direct database connection | no | +| Variable | Purpose | Required? | +| ----------------------- | ---------------------------------------------------------------------- | -------------------------------------------------------------------------- | +| `SUPABASE_ACCESS_TOKEN` | auth token for `--linked` mode | no (falls back to keyring → `/access-token`) | +| `SUPABASE_HOME` | global CLI state root for auth, telemetry, traces, and shared binaries | no (defaults to `~/.supabase`) | +| `DB_PASSWORD` | password for direct database connection | no | ## Exit Codes diff --git a/apps/cli/src/legacy/commands/migration/up/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/migration/up/SIDE_EFFECTS.md index 542f1a3c3a..a0d428eef6 100644 --- a/apps/cli/src/legacy/commands/migration/up/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/migration/up/SIDE_EFFECTS.md @@ -21,9 +21,10 @@ ## Environment Variables -| Variable | Purpose | Required? | -| ----------------------- | ------------------------------ | -------------------------------------------------------------------------- | -| `SUPABASE_ACCESS_TOKEN` | auth token for `--linked` mode | no (falls back to keyring → `/access-token`) | +| Variable | Purpose | Required? | +| ----------------------- | ---------------------------------------------------------------------- | -------------------------------------------------------------------------- | +| `SUPABASE_ACCESS_TOKEN` | auth token for `--linked` mode | no (falls back to keyring → `/access-token`) | +| `SUPABASE_HOME` | global CLI state root for auth, telemetry, traces, and shared binaries | no (defaults to `~/.supabase`) | ## Exit Codes diff --git a/apps/cli/src/legacy/commands/network-bans/get/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/network-bans/get/SIDE_EFFECTS.md index 21be796e4b..c94d8bf5d9 100644 --- a/apps/cli/src/legacy/commands/network-bans/get/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/network-bans/get/SIDE_EFFECTS.md @@ -9,10 +9,10 @@ ## Files Written -| Path | Format | When | -| ------------------------------------------------ | ------ | ----------------------------------------------------------------------------- | -| `~/.supabase//linked-project.json` | JSON | always (after ref resolution), via `Effect.ensuring` — on success and failure | -| `/telemetry.json` | JSON | always, via `Effect.ensuring` — on success and failure | +| Path | Format | When | +| ----------------------------------------------- | ------ | ----------------------------------------------------------------------------- | +| `/supabase/.temp/linked-project.json` | JSON | always (after ref resolution), via `Effect.ensuring` — on success and failure | +| `/telemetry.json` | JSON | always, via `Effect.ensuring` — on success and failure | ## API Routes @@ -24,11 +24,12 @@ The Management API exposes this read operation as `POST .../network-bans/retriev ## Environment Variables -| Variable | Purpose | Required? | -| ----------------------- | ---------------------------------------------------- | -------------------------------------------------------------------------- | -| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `/access-token`) | -| `SUPABASE_API_URL` | override Management API base URL | no (defaults to `https://api.supabase.com`) | -| `PROJECT_ID` | project ref fallback when `--project-ref` is unset | no (falls back to `supabase/.temp/project-ref` → prompt) | +| Variable | Purpose | Required? | +| ----------------------- | ---------------------------------------------------------------------- | -------------------------------------------------------------------------- | +| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `/access-token`) | +| `SUPABASE_HOME` | global CLI state root for auth, telemetry, traces, and shared binaries | no (defaults to `~/.supabase`) | +| `SUPABASE_API_URL` | override Management API base URL | no (defaults to `https://api.supabase.com`) | +| `PROJECT_ID` | project ref fallback when `--project-ref` is unset | no (falls back to `supabase/.temp/project-ref` → prompt) | ## Exit Codes diff --git a/apps/cli/src/legacy/commands/network-bans/remove/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/network-bans/remove/SIDE_EFFECTS.md index 2b5aca8835..0c4dc9147e 100644 --- a/apps/cli/src/legacy/commands/network-bans/remove/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/network-bans/remove/SIDE_EFFECTS.md @@ -9,10 +9,10 @@ ## Files Written -| Path | Format | When | -| ------------------------------------------------ | ------ | ----------------------------------------------------------------------------- | -| `~/.supabase//linked-project.json` | JSON | always (after ref resolution), via `Effect.ensuring` — on success and failure | -| `/telemetry.json` | JSON | always, via `Effect.ensuring` — on success and failure | +| Path | Format | When | +| ----------------------------------------------- | ------ | ----------------------------------------------------------------------------- | +| `/supabase/.temp/linked-project.json` | JSON | always (after ref resolution), via `Effect.ensuring` — on success and failure | +| `/telemetry.json` | JSON | always, via `Effect.ensuring` — on success and failure | ## API Routes @@ -24,11 +24,12 @@ ## Environment Variables -| Variable | Purpose | Required? | -| ----------------------- | ---------------------------------------------------- | -------------------------------------------------------------------------- | -| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `/access-token`) | -| `SUPABASE_API_URL` | override Management API base URL | no (defaults to `https://api.supabase.com`) | -| `PROJECT_ID` | project ref fallback when `--project-ref` is unset | no (falls back to `supabase/.temp/project-ref` → prompt) | +| Variable | Purpose | Required? | +| ----------------------- | ---------------------------------------------------------------------- | -------------------------------------------------------------------------- | +| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `/access-token`) | +| `SUPABASE_HOME` | global CLI state root for auth, telemetry, traces, and shared binaries | no (defaults to `~/.supabase`) | +| `SUPABASE_API_URL` | override Management API base URL | no (defaults to `https://api.supabase.com`) | +| `PROJECT_ID` | project ref fallback when `--project-ref` is unset | no (falls back to `supabase/.temp/project-ref` → prompt) | ## Exit Codes diff --git a/apps/cli/src/legacy/commands/network-restrictions/get/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/network-restrictions/get/SIDE_EFFECTS.md index 2d11c413b9..ac65577b57 100644 --- a/apps/cli/src/legacy/commands/network-restrictions/get/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/network-restrictions/get/SIDE_EFFECTS.md @@ -9,10 +9,10 @@ ## Files Written -| Path | Format | When | -| ------------------------------------------------ | ------ | ----------------------------------------------------------------------------- | -| `~/.supabase//linked-project.json` | JSON | always (after ref resolution), via `Effect.ensuring` — on success and failure | -| `/telemetry.json` | JSON | always, via `Effect.ensuring` — on success and failure | +| Path | Format | When | +| ----------------------------------------------- | ------ | ----------------------------------------------------------------------------- | +| `/supabase/.temp/linked-project.json` | JSON | always (after ref resolution), via `Effect.ensuring` — on success and failure | +| `/telemetry.json` | JSON | always, via `Effect.ensuring` — on success and failure | ## API Routes @@ -22,11 +22,12 @@ ## Environment Variables -| Variable | Purpose | Required? | -| ----------------------- | ---------------------------------------------------- | -------------------------------------------------------------------------- | -| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `/access-token`) | -| `SUPABASE_API_URL` | override Management API base URL | no (defaults to `https://api.supabase.com`) | -| `PROJECT_ID` | project ref fallback when `--project-ref` is unset | no (falls back to `supabase/.temp/project-ref` → prompt) | +| Variable | Purpose | Required? | +| ----------------------- | ---------------------------------------------------------------------- | -------------------------------------------------------------------------- | +| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `/access-token`) | +| `SUPABASE_HOME` | global CLI state root for auth, telemetry, traces, and shared binaries | no (defaults to `~/.supabase`) | +| `SUPABASE_API_URL` | override Management API base URL | no (defaults to `https://api.supabase.com`) | +| `PROJECT_ID` | project ref fallback when `--project-ref` is unset | no (falls back to `supabase/.temp/project-ref` → prompt) | ## Exit Codes diff --git a/apps/cli/src/legacy/commands/network-restrictions/update/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/network-restrictions/update/SIDE_EFFECTS.md index 73d940ec4a..17b248a93d 100644 --- a/apps/cli/src/legacy/commands/network-restrictions/update/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/network-restrictions/update/SIDE_EFFECTS.md @@ -9,10 +9,10 @@ ## Files Written -| Path | Format | When | -| ------------------------------------------------ | ------ | ------------------------------------------------------------------------------- | -| `~/.supabase//linked-project.json` | JSON | always (after ref resolution), via `Effect.ensuring` — success and HTTP failure | -| `/telemetry.json` | JSON | always, via outermost `Effect.ensuring` — including CIDR validation failures | +| Path | Format | When | +| ----------------------------------------------- | ------ | ------------------------------------------------------------------------------- | +| `/supabase/.temp/linked-project.json` | JSON | always (after ref resolution), via `Effect.ensuring` — success and HTTP failure | +| `/telemetry.json` | JSON | always, via outermost `Effect.ensuring` — including CIDR validation failures | ## API Routes @@ -28,11 +28,12 @@ when no `--db-allow-cidr` was supplied), matching Go's `&[]string{}` initializat ## Environment Variables -| Variable | Purpose | Required? | -| ----------------------- | ---------------------------------------------------- | -------------------------------------------------------------------------- | -| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `/access-token`) | -| `SUPABASE_API_URL` | override Management API base URL | no (defaults to `https://api.supabase.com`) | -| `PROJECT_ID` | project ref fallback when `--project-ref` is unset | no (falls back to `supabase/.temp/project-ref` → prompt) | +| Variable | Purpose | Required? | +| ----------------------- | ---------------------------------------------------------------------- | -------------------------------------------------------------------------- | +| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `/access-token`) | +| `SUPABASE_HOME` | global CLI state root for auth, telemetry, traces, and shared binaries | no (defaults to `~/.supabase`) | +| `SUPABASE_API_URL` | override Management API base URL | no (defaults to `https://api.supabase.com`) | +| `PROJECT_ID` | project ref fallback when `--project-ref` is unset | no (falls back to `supabase/.temp/project-ref` → prompt) | ## Exit Codes diff --git a/apps/cli/src/legacy/commands/orgs/create/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/orgs/create/SIDE_EFFECTS.md index 902e8fe88f..64e168dbb3 100644 --- a/apps/cli/src/legacy/commands/orgs/create/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/orgs/create/SIDE_EFFECTS.md @@ -34,6 +34,7 @@ linked-project cache is never written. | Variable | Purpose | Required? | | ----------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------- | | `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `/access-token`) | +| `SUPABASE_HOME` | global CLI state root for auth, telemetry, traces, and shared binaries | no (defaults to `~/.supabase`) | | `SUPABASE_PROFILE` | selects API base URL (`supabase`, `supabase-staging`, `supabase-local`), or a filesystem path to a YAML profile (Go parity — used by the cli-e2e harness) | no (defaults to `supabase`) | ## Exit Codes diff --git a/apps/cli/src/legacy/commands/orgs/list/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/orgs/list/SIDE_EFFECTS.md index 57156aadcf..d2efff1bd5 100644 --- a/apps/cli/src/legacy/commands/orgs/list/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/orgs/list/SIDE_EFFECTS.md @@ -15,7 +15,7 @@ | `/telemetry.json` | JSON | always (in `Effect.ensuring`) at end of command — Go parity | `orgs list` is a user-level command — it does not resolve a `--project-ref`, so the legacy -linked-project cache (`~/.supabase//linked-project.json`) is never written. +linked-project cache (`/supabase/.temp/linked-project.json`) is never written. ## API Routes @@ -28,6 +28,7 @@ linked-project cache (`~/.supabase//linked-project.json`) is never | Variable | Purpose | Required? | | ----------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------- | | `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `/access-token`) | +| `SUPABASE_HOME` | global CLI state root for auth, telemetry, traces, and shared binaries | no (defaults to `~/.supabase`) | | `SUPABASE_PROFILE` | selects API base URL (`supabase`, `supabase-staging`, `supabase-local`), or a filesystem path to a YAML profile (Go parity — used by the cli-e2e harness) | no (defaults to `supabase`) | ## Exit Codes diff --git a/apps/cli/src/legacy/commands/postgres-config/delete/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/postgres-config/delete/SIDE_EFFECTS.md index f0e8bc8e25..8036559841 100644 --- a/apps/cli/src/legacy/commands/postgres-config/delete/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/postgres-config/delete/SIDE_EFFECTS.md @@ -9,10 +9,10 @@ ## Files Written -| Path | Format | When | -| ------------------------------------------------ | ------ | ----------------------------------------------------------------------------- | -| `~/.supabase//linked-project.json` | JSON | always (after ref resolution), via `Effect.ensuring` - on success and failure | -| `/telemetry.json` | JSON | always, via `Effect.ensuring` - on success and failure | +| Path | Format | When | +| ----------------------------------------------- | ------ | ----------------------------------------------------------------------------- | +| `/supabase/.temp/linked-project.json` | JSON | always (after ref resolution), via `Effect.ensuring` - on success and failure | +| `/telemetry.json` | JSON | always, via `Effect.ensuring` - on success and failure | ## API Routes @@ -25,11 +25,12 @@ This command does not call a delete endpoint. It mirrors Go: fetch current confi ## Environment Variables -| Variable | Purpose | Required? | -| ----------------------- | ---------------------------------------------------- | --------------------------------------------------------------------------- | -| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring -> `/access-token`) | -| `SUPABASE_API_URL` | override Management API base URL | no (defaults to `https://api.supabase.com`) | -| `PROJECT_ID` | project ref fallback when `--project-ref` is unset | no (falls back to `supabase/.temp/project-ref` -> prompt) | +| Variable | Purpose | Required? | +| ----------------------- | ---------------------------------------------------------------------- | --------------------------------------------------------------------------- | +| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring -> `/access-token`) | +| `SUPABASE_HOME` | global CLI state root for auth, telemetry, traces, and shared binaries | no (defaults to `~/.supabase`) | +| `SUPABASE_API_URL` | override Management API base URL | no (defaults to `https://api.supabase.com`) | +| `PROJECT_ID` | project ref fallback when `--project-ref` is unset | no (falls back to `supabase/.temp/project-ref` -> prompt) | ## Exit Codes diff --git a/apps/cli/src/legacy/commands/postgres-config/get/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/postgres-config/get/SIDE_EFFECTS.md index 0220ff8fda..42d67ed552 100644 --- a/apps/cli/src/legacy/commands/postgres-config/get/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/postgres-config/get/SIDE_EFFECTS.md @@ -9,10 +9,10 @@ ## Files Written -| Path | Format | When | -| ------------------------------------------------ | ------ | ----------------------------------------------------------------------------- | -| `~/.supabase//linked-project.json` | JSON | always (after ref resolution), via `Effect.ensuring` - on success and failure | -| `/telemetry.json` | JSON | always, via `Effect.ensuring` - on success and failure | +| Path | Format | When | +| ----------------------------------------------- | ------ | ----------------------------------------------------------------------------- | +| `/supabase/.temp/linked-project.json` | JSON | always (after ref resolution), via `Effect.ensuring` - on success and failure | +| `/telemetry.json` | JSON | always, via `Effect.ensuring` - on success and failure | ## API Routes @@ -22,11 +22,12 @@ ## Environment Variables -| Variable | Purpose | Required? | -| ----------------------- | ---------------------------------------------------- | --------------------------------------------------------------------------- | -| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring -> `/access-token`) | -| `SUPABASE_API_URL` | override Management API base URL | no (defaults to `https://api.supabase.com`) | -| `PROJECT_ID` | project ref fallback when `--project-ref` is unset | no (falls back to `supabase/.temp/project-ref` -> prompt) | +| Variable | Purpose | Required? | +| ----------------------- | ---------------------------------------------------------------------- | --------------------------------------------------------------------------- | +| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring -> `/access-token`) | +| `SUPABASE_HOME` | global CLI state root for auth, telemetry, traces, and shared binaries | no (defaults to `~/.supabase`) | +| `SUPABASE_API_URL` | override Management API base URL | no (defaults to `https://api.supabase.com`) | +| `PROJECT_ID` | project ref fallback when `--project-ref` is unset | no (falls back to `supabase/.temp/project-ref` -> prompt) | ## Exit Codes diff --git a/apps/cli/src/legacy/commands/postgres-config/update/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/postgres-config/update/SIDE_EFFECTS.md index bb493636f2..e8d746bea3 100644 --- a/apps/cli/src/legacy/commands/postgres-config/update/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/postgres-config/update/SIDE_EFFECTS.md @@ -9,10 +9,10 @@ ## Files Written -| Path | Format | When | -| ------------------------------------------------ | ------ | ----------------------------------------------------------------------------- | -| `~/.supabase//linked-project.json` | JSON | always (after ref resolution), via `Effect.ensuring` - on success and failure | -| `/telemetry.json` | JSON | always, via `Effect.ensuring` - on success and failure | +| Path | Format | When | +| ----------------------------------------------- | ------ | ----------------------------------------------------------------------------- | +| `/supabase/.temp/linked-project.json` | JSON | always (after ref resolution), via `Effect.ensuring` - on success and failure | +| `/telemetry.json` | JSON | always, via `Effect.ensuring` - on success and failure | ## API Routes @@ -25,11 +25,12 @@ The initial `GET` is skipped when `--replace-existing-overrides` is set. Otherwi ## Environment Variables -| Variable | Purpose | Required? | -| ----------------------- | ---------------------------------------------------- | --------------------------------------------------------------------------- | -| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring -> `/access-token`) | -| `SUPABASE_API_URL` | override Management API base URL | no (defaults to `https://api.supabase.com`) | -| `PROJECT_ID` | project ref fallback when `--project-ref` is unset | no (falls back to `supabase/.temp/project-ref` -> prompt) | +| Variable | Purpose | Required? | +| ----------------------- | ---------------------------------------------------------------------- | --------------------------------------------------------------------------- | +| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring -> `/access-token`) | +| `SUPABASE_HOME` | global CLI state root for auth, telemetry, traces, and shared binaries | no (defaults to `~/.supabase`) | +| `SUPABASE_API_URL` | override Management API base URL | no (defaults to `https://api.supabase.com`) | +| `PROJECT_ID` | project ref fallback when `--project-ref` is unset | no (falls back to `supabase/.temp/project-ref` -> prompt) | ## Exit Codes diff --git a/apps/cli/src/legacy/commands/projects/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/projects/SIDE_EFFECTS.md index 8a91e897c6..ab65bd72d2 100644 --- a/apps/cli/src/legacy/commands/projects/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/projects/SIDE_EFFECTS.md @@ -37,11 +37,12 @@ subcommand's own `SIDE_EFFECTS.md`. ## Environment Variables -| Variable | Purpose | Required? | -| ----------------------- | ---------------------------------------------------- | -------------------------------------------------------------------------- | -| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `/access-token`) | -| `SUPABASE_PROJECT_REF` | linked project ref (via the config layer) | no (used by `list` marker / `api-keys` ref / `delete` unlink) | -| `SUPABASE_API_URL` | override Management API base URL | no (defaults to `https://api.supabase.com`) | +| Variable | Purpose | Required? | +| ----------------------- | ---------------------------------------------------------------------- | -------------------------------------------------------------------------- | +| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `/access-token`) | +| `SUPABASE_HOME` | global CLI state root for auth, telemetry, traces, and shared binaries | no (defaults to `~/.supabase`) | +| `SUPABASE_PROJECT_REF` | linked project ref (via the config layer) | no (used by `list` marker / `api-keys` ref / `delete` unlink) | +| `SUPABASE_API_URL` | override Management API base URL | no (defaults to `https://api.supabase.com`) | > `DB_PASSWORD` is **not** consumed. In Go it only mirrors `--db-password` via a > viper binding for downstream local-stack use; `projects create` never reads it. diff --git a/apps/cli/src/legacy/commands/projects/api-keys/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/projects/api-keys/SIDE_EFFECTS.md index e120468224..9176b6a1c3 100644 --- a/apps/cli/src/legacy/commands/projects/api-keys/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/projects/api-keys/SIDE_EFFECTS.md @@ -21,10 +21,11 @@ ## Environment Variables -| Variable | Purpose | Required? | -| ----------------------- | ---------------------------------------------------- | -------------------------------------------------------------------------- | -| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `/access-token`) | -| `SUPABASE_API_URL` | override Management API base URL | no (defaults to `https://api.supabase.com`) | +| Variable | Purpose | Required? | +| ----------------------- | ---------------------------------------------------------------------- | -------------------------------------------------------------------------- | +| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `/access-token`) | +| `SUPABASE_HOME` | global CLI state root for auth, telemetry, traces, and shared binaries | no (defaults to `~/.supabase`) | +| `SUPABASE_API_URL` | override Management API base URL | no (defaults to `https://api.supabase.com`) | ## Flags diff --git a/apps/cli/src/legacy/commands/projects/create/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/projects/create/SIDE_EFFECTS.md index 6a750c5f9f..8d42c412f5 100644 --- a/apps/cli/src/legacy/commands/projects/create/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/projects/create/SIDE_EFFECTS.md @@ -24,6 +24,7 @@ | Variable | Purpose | Required? | | ----------------------- | --------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------- | | `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `/access-token`) | +| `SUPABASE_HOME` | global CLI state root for auth, telemetry, traces, and shared binaries | no (defaults to `~/.supabase`) | | `SUPABASE_API_URL` | override Management API base URL | no (defaults to `https://api.supabase.com`) | | `DB_PASSWORD` | **not consumed** — Go only mirrors `--db-password` into viper for local-stack reuse; `projects create` never reads it | n/a | diff --git a/apps/cli/src/legacy/commands/projects/delete/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/projects/delete/SIDE_EFFECTS.md index 8b4af93c81..7f702c44f5 100644 --- a/apps/cli/src/legacy/commands/projects/delete/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/projects/delete/SIDE_EFFECTS.md @@ -27,10 +27,11 @@ ## Environment Variables -| Variable | Purpose | Required? | -| ----------------------- | ---------------------------------------------------- | -------------------------------------------------------------------------- | -| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `/access-token`) | -| `SUPABASE_API_URL` | override Management API base URL | no (defaults to `https://api.supabase.com`) | +| Variable | Purpose | Required? | +| ----------------------- | ---------------------------------------------------------------------- | -------------------------------------------------------------------------- | +| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `/access-token`) | +| `SUPABASE_HOME` | global CLI state root for auth, telemetry, traces, and shared binaries | no (defaults to `~/.supabase`) | +| `SUPABASE_API_URL` | override Management API base URL | no (defaults to `https://api.supabase.com`) | ## Exit Codes diff --git a/apps/cli/src/legacy/commands/projects/list/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/projects/list/SIDE_EFFECTS.md index 3668b5bfac..180436ca9d 100644 --- a/apps/cli/src/legacy/commands/projects/list/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/projects/list/SIDE_EFFECTS.md @@ -21,10 +21,11 @@ ## Environment Variables -| Variable | Purpose | Required? | -| ----------------------- | ---------------------------------------------------- | -------------------------------------------------------------------------- | -| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `/access-token`) | -| `SUPABASE_API_URL` | override Management API base URL | no (defaults to `https://api.supabase.com`) | +| Variable | Purpose | Required? | +| ----------------------- | ---------------------------------------------------------------------- | -------------------------------------------------------------------------- | +| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `/access-token`) | +| `SUPABASE_HOME` | global CLI state root for auth, telemetry, traces, and shared binaries | no (defaults to `~/.supabase`) | +| `SUPABASE_API_URL` | override Management API base URL | no (defaults to `https://api.supabase.com`) | ## Exit Codes diff --git a/apps/cli/src/legacy/commands/secrets/list/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/secrets/list/SIDE_EFFECTS.md index 7faf0beab0..a99f0a8689 100644 --- a/apps/cli/src/legacy/commands/secrets/list/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/secrets/list/SIDE_EFFECTS.md @@ -12,10 +12,10 @@ ## Files Written -| Path | Format | When | -| ------------------------------------------------ | ------ | ------------------------------------------------------------------------ | -| `~/.supabase//linked-project.json` | JSON | always (in `Effect.ensuring`) after `--project-ref` resolves — Go parity | -| `/telemetry.json` | JSON | always (in `Effect.ensuring`) at end of command — Go parity | +| Path | Format | When | +| ----------------------------------------------- | ------ | ------------------------------------------------------------------------ | +| `/supabase/.temp/linked-project.json` | JSON | always (in `Effect.ensuring`) after `--project-ref` resolves — Go parity | +| `/telemetry.json` | JSON | always (in `Effect.ensuring`) at end of command — Go parity | ## API Routes @@ -29,6 +29,7 @@ | Variable | Purpose | Required? | | ----------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------- | | `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `/access-token`) | +| `SUPABASE_HOME` | global CLI state root for auth, telemetry, traces, and shared binaries | no (defaults to `~/.supabase`) | | `SUPABASE_PROFILE` | selects API base URL: `supabase` → `api.supabase.com`, `supabase-staging` → `api.supabase.green`, `supabase-local` → `http://localhost:8080`. May alternatively be a filesystem path to a YAML profile with at least `api_url:` and optional `name:` (Go parity — used by the cli-e2e test harness). | no (defaults to `supabase`) | | `SUPABASE_PROJECT_ID` | project ref fallback when `--project-ref` is unset | no (also reads `/supabase/.temp/project-ref` then prompts on TTY) | | `SUPABASE_WORKDIR` | base directory for the `.temp/project-ref` lookup | no (walks up from CWD looking for `supabase/config.toml`) | diff --git a/apps/cli/src/legacy/commands/secrets/set/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/secrets/set/SIDE_EFFECTS.md index d9bd60de05..d9587a6682 100644 --- a/apps/cli/src/legacy/commands/secrets/set/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/secrets/set/SIDE_EFFECTS.md @@ -16,10 +16,10 @@ ## Files Written -| Path | Format | When | -| ------------------------------------------------ | ------ | ------------------------------------------------------------------------ | -| `~/.supabase//linked-project.json` | JSON | always (in `Effect.ensuring`) after `--project-ref` resolves — Go parity | -| `/telemetry.json` | JSON | always (in `Effect.ensuring`) at end of command — Go parity | +| Path | Format | When | +| ----------------------------------------------- | ------ | ------------------------------------------------------------------------ | +| `/supabase/.temp/linked-project.json` | JSON | always (in `Effect.ensuring`) after `--project-ref` resolves — Go parity | +| `/telemetry.json` | JSON | always (in `Effect.ensuring`) at end of command — Go parity | ## API Routes @@ -33,6 +33,7 @@ | Variable | Purpose | Required? | | ----------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------- | | `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `/access-token`) | +| `SUPABASE_HOME` | global CLI state root for auth, telemetry, traces, and shared binaries | no (defaults to `~/.supabase`) | | `SUPABASE_PROFILE` | selects API base URL: `supabase` → `api.supabase.com`, `supabase-staging` → `api.supabase.green`, `supabase-local` → `http://localhost:8080`. May alternatively be a filesystem path to a YAML profile with at least `api_url:` and optional `name:` (Go parity — used by the cli-e2e test harness). | no (defaults to `supabase`) | | `SUPABASE_PROJECT_ID` | project ref fallback when `--project-ref` is unset | no (also reads `/supabase/.temp/project-ref` then prompts on TTY) | | `SUPABASE_WORKDIR` | base directory for the `.temp/project-ref` lookup | no (walks up from CWD looking for `supabase/config.toml`) | diff --git a/apps/cli/src/legacy/commands/secrets/unset/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/secrets/unset/SIDE_EFFECTS.md index d68740defc..4c26c407f7 100644 --- a/apps/cli/src/legacy/commands/secrets/unset/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/secrets/unset/SIDE_EFFECTS.md @@ -12,10 +12,10 @@ ## Files Written -| Path | Format | When | -| ------------------------------------------------ | ------ | ------------------------------------------------------------------------ | -| `~/.supabase//linked-project.json` | JSON | always (in `Effect.ensuring`) after `--project-ref` resolves — Go parity | -| `/telemetry.json` | JSON | always (in `Effect.ensuring`) at end of command — Go parity | +| Path | Format | When | +| ----------------------------------------------- | ------ | ------------------------------------------------------------------------ | +| `/supabase/.temp/linked-project.json` | JSON | always (in `Effect.ensuring`) after `--project-ref` resolves — Go parity | +| `/telemetry.json` | JSON | always (in `Effect.ensuring`) at end of command — Go parity | ## API Routes @@ -30,6 +30,7 @@ | Variable | Purpose | Required? | | ----------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------- | | `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `/access-token`) | +| `SUPABASE_HOME` | global CLI state root for auth, telemetry, traces, and shared binaries | no (defaults to `~/.supabase`) | | `SUPABASE_PROFILE` | selects API base URL: `supabase` → `api.supabase.com`, `supabase-staging` → `api.supabase.green`, `supabase-local` → `http://localhost:8080`. May alternatively be a filesystem path to a YAML profile with at least `api_url:` and optional `name:` (Go parity — used by the cli-e2e test harness). | no (defaults to `supabase`) | | `SUPABASE_PROJECT_ID` | project ref fallback when `--project-ref` is unset | no (also reads `/supabase/.temp/project-ref` then prompts on TTY) | | `SUPABASE_WORKDIR` | base directory for the `.temp/project-ref` lookup | no (walks up from CWD looking for `supabase/config.toml`) | diff --git a/apps/cli/src/legacy/commands/seed/buckets/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/seed/buckets/SIDE_EFFECTS.md index abadb1e957..054f4e2a97 100644 --- a/apps/cli/src/legacy/commands/seed/buckets/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/seed/buckets/SIDE_EFFECTS.md @@ -21,10 +21,11 @@ ## Environment Variables -| Variable | Purpose | Required? | -| ----------------------- | -------------------------------- | -------------------------------------------------------------------------- | -| `SUPABASE_ACCESS_TOKEN` | auth token for `--linked` mode | no (falls back to keyring → `/access-token`) | -| `SUPABASE_API_URL` | override Management API base URL | no (defaults to `https://api.supabase.com`) | +| Variable | Purpose | Required? | +| ----------------------- | ---------------------------------------------------------------------- | -------------------------------------------------------------------------- | +| `SUPABASE_ACCESS_TOKEN` | auth token for `--linked` mode | no (falls back to keyring → `/access-token`) | +| `SUPABASE_HOME` | global CLI state root for auth, telemetry, traces, and shared binaries | no (defaults to `~/.supabase`) | +| `SUPABASE_API_URL` | override Management API base URL | no (defaults to `https://api.supabase.com`) | ## Exit Codes diff --git a/apps/cli/src/legacy/commands/services/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/services/SIDE_EFFECTS.md index 21ec3a1847..633d868a69 100644 --- a/apps/cli/src/legacy/commands/services/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/services/SIDE_EFFECTS.md @@ -33,10 +33,11 @@ matching `apps/cli-go/pkg/fetcher/gateway.go`. ## Environment Variables -| Variable | Purpose | Required? | -| ----------------------- | --------------------------------------------------- | ------------------------------------------------------------------------------ | -| `SUPABASE_ACCESS_TOKEN` | auth token for Management API linked-version checks | no (falls back to keyring, then `/access-token`) | -| `SUPABASE_API_URL` | override Management API base URL | no (defaults to `https://api.supabase.com`) | +| Variable | Purpose | Required? | +| ----------------------- | ---------------------------------------------------------------------- | ------------------------------------------------------------------------------ | +| `SUPABASE_ACCESS_TOKEN` | auth token for Management API linked-version checks | no (falls back to keyring, then `/access-token`) | +| `SUPABASE_HOME` | global CLI state root for auth, telemetry, traces, and shared binaries | no (defaults to `~/.supabase`) | +| `SUPABASE_API_URL` | override Management API base URL | no (defaults to `https://api.supabase.com`) | ## Exit Codes diff --git a/apps/cli/src/legacy/commands/snippets/download/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/snippets/download/SIDE_EFFECTS.md index e2804d931b..15a07377c3 100644 --- a/apps/cli/src/legacy/commands/snippets/download/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/snippets/download/SIDE_EFFECTS.md @@ -27,12 +27,13 @@ Only `content.sql` is rendered in text mode. The full payload is exposed via `-- ## Environment Variables -| Variable | Purpose | Required? | -| ----------------------- | ---------------------------------------------------- | -------------------------------------------------------------------------- | -| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `/access-token`) | -| `PROJECT_ID` | project ref fallback when `--project-ref` is unset | no (falls back to `supabase/.temp/project-ref`) | -| `SUPABASE_API_URL` | override Management API base URL | no (defaults to `https://api.supabase.com`) | -| `SUPABASE_PROFILE` | profile selector (built-in name or YAML file path) | no (defaults to `supabase`) | +| Variable | Purpose | Required? | +| ----------------------- | ---------------------------------------------------------------------- | -------------------------------------------------------------------------- | +| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `/access-token`) | +| `SUPABASE_HOME` | global CLI state root for auth, telemetry, traces, and shared binaries | no (defaults to `~/.supabase`) | +| `PROJECT_ID` | project ref fallback when `--project-ref` is unset | no (falls back to `supabase/.temp/project-ref`) | +| `SUPABASE_API_URL` | override Management API base URL | no (defaults to `https://api.supabase.com`) | +| `SUPABASE_PROFILE` | profile selector (built-in name or YAML file path) | no (defaults to `supabase`) | ## Exit Codes diff --git a/apps/cli/src/legacy/commands/snippets/list/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/snippets/list/SIDE_EFFECTS.md index 1899ee45a0..21290329a8 100644 --- a/apps/cli/src/legacy/commands/snippets/list/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/snippets/list/SIDE_EFFECTS.md @@ -25,12 +25,13 @@ ## Environment Variables -| Variable | Purpose | Required? | -| ----------------------- | ---------------------------------------------------- | -------------------------------------------------------------------------- | -| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `/access-token`) | -| `PROJECT_ID` | project ref fallback when `--project-ref` is unset | no (falls back to `supabase/.temp/project-ref`) | -| `SUPABASE_API_URL` | override Management API base URL | no (defaults to `https://api.supabase.com`) | -| `SUPABASE_PROFILE` | profile selector (built-in name or YAML file path) | no (defaults to `supabase`) | +| Variable | Purpose | Required? | +| ----------------------- | ---------------------------------------------------------------------- | -------------------------------------------------------------------------- | +| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `/access-token`) | +| `SUPABASE_HOME` | global CLI state root for auth, telemetry, traces, and shared binaries | no (defaults to `~/.supabase`) | +| `PROJECT_ID` | project ref fallback when `--project-ref` is unset | no (falls back to `supabase/.temp/project-ref`) | +| `SUPABASE_API_URL` | override Management API base URL | no (defaults to `https://api.supabase.com`) | +| `SUPABASE_PROFILE` | profile selector (built-in name or YAML file path) | no (defaults to `supabase`) | ## Exit Codes diff --git a/apps/cli/src/legacy/commands/ssl-enforcement/get/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/ssl-enforcement/get/SIDE_EFFECTS.md index 7cb4d6fea0..61f44d920c 100644 --- a/apps/cli/src/legacy/commands/ssl-enforcement/get/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/ssl-enforcement/get/SIDE_EFFECTS.md @@ -9,10 +9,10 @@ ## Files Written -| Path | Format | When | -| ------------------------------------------------ | ------ | ----------------------------------------------------------------------------- | -| `~/.supabase//linked-project.json` | JSON | always (after ref resolution), via `Effect.ensuring` — on success and failure | -| `/telemetry.json` | JSON | always, via `Effect.ensuring` — on success and failure | +| Path | Format | When | +| ----------------------------------------------- | ------ | ----------------------------------------------------------------------------- | +| `/supabase/.temp/linked-project.json` | JSON | always (after ref resolution), via `Effect.ensuring` — on success and failure | +| `/telemetry.json` | JSON | always, via `Effect.ensuring` — on success and failure | ## API Routes @@ -22,11 +22,12 @@ ## Environment Variables -| Variable | Purpose | Required? | -| ----------------------- | ---------------------------------------------------- | -------------------------------------------------------------------------- | -| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `/access-token`) | -| `SUPABASE_API_URL` | override Management API base URL | no (defaults to `https://api.supabase.com`) | -| `PROJECT_ID` | project ref fallback when `--project-ref` is unset | no (falls back to `supabase/.temp/project-ref` → prompt) | +| Variable | Purpose | Required? | +| ----------------------- | ---------------------------------------------------------------------- | -------------------------------------------------------------------------- | +| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `/access-token`) | +| `SUPABASE_HOME` | global CLI state root for auth, telemetry, traces, and shared binaries | no (defaults to `~/.supabase`) | +| `SUPABASE_API_URL` | override Management API base URL | no (defaults to `https://api.supabase.com`) | +| `PROJECT_ID` | project ref fallback when `--project-ref` is unset | no (falls back to `supabase/.temp/project-ref` → prompt) | ## Exit Codes diff --git a/apps/cli/src/legacy/commands/ssl-enforcement/update/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/ssl-enforcement/update/SIDE_EFFECTS.md index 270c8fdd81..27d01d41da 100644 --- a/apps/cli/src/legacy/commands/ssl-enforcement/update/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/ssl-enforcement/update/SIDE_EFFECTS.md @@ -9,10 +9,10 @@ ## Files Written -| Path | Format | When | -| ------------------------------------------------ | ------ | ----------------------------------------------------------------------------------------- | -| `~/.supabase//linked-project.json` | JSON | after the project ref is resolved (only if flag validation passes), via `Effect.ensuring` | -| `/telemetry.json` | JSON | always, via `Effect.ensuring` — including flag-validation failures | +| Path | Format | When | +| ----------------------------------------------- | ------ | ----------------------------------------------------------------------------------------- | +| `/supabase/.temp/linked-project.json` | JSON | after the project ref is resolved (only if flag validation passes), via `Effect.ensuring` | +| `/telemetry.json` | JSON | always, via `Effect.ensuring` — including flag-validation failures | ## API Routes @@ -22,11 +22,12 @@ ## Environment Variables -| Variable | Purpose | Required? | -| ----------------------- | ---------------------------------------------------- | -------------------------------------------------------------------------- | -| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `/access-token`) | -| `SUPABASE_API_URL` | override Management API base URL | no (defaults to `https://api.supabase.com`) | -| `PROJECT_ID` | project ref fallback when `--project-ref` is unset | no (falls back to `supabase/.temp/project-ref` → prompt) | +| Variable | Purpose | Required? | +| ----------------------- | ---------------------------------------------------------------------- | -------------------------------------------------------------------------- | +| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `/access-token`) | +| `SUPABASE_HOME` | global CLI state root for auth, telemetry, traces, and shared binaries | no (defaults to `~/.supabase`) | +| `SUPABASE_API_URL` | override Management API base URL | no (defaults to `https://api.supabase.com`) | +| `PROJECT_ID` | project ref fallback when `--project-ref` is unset | no (falls back to `supabase/.temp/project-ref` → prompt) | ## Exit Codes diff --git a/apps/cli/src/legacy/commands/sso/add/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/sso/add/SIDE_EFFECTS.md index bd3d20cf38..ab5a9c119a 100644 --- a/apps/cli/src/legacy/commands/sso/add/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/sso/add/SIDE_EFFECTS.md @@ -33,10 +33,11 @@ same shape via an inline anonymous struct with `Default *any`. ## Environment Variables -| Variable | Purpose | Required? | -| ----------------------- | ---------------------------------------------------- | -------------------------------------------------------------------------- | -| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `/access-token`) | -| `SUPABASE_PROFILE` | profile selector (built-in name or YAML file path) | no (defaults to `supabase`) | +| Variable | Purpose | Required? | +| ----------------------- | ---------------------------------------------------------------------- | -------------------------------------------------------------------------- | +| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `/access-token`) | +| `SUPABASE_HOME` | global CLI state root for auth, telemetry, traces, and shared binaries | no (defaults to `~/.supabase`) | +| `SUPABASE_PROFILE` | profile selector (built-in name or YAML file path) | no (defaults to `supabase`) | ## Exit Codes diff --git a/apps/cli/src/legacy/commands/sso/info/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/sso/info/SIDE_EFFECTS.md index bb2fb6a254..769d0946e5 100644 --- a/apps/cli/src/legacy/commands/sso/info/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/sso/info/SIDE_EFFECTS.md @@ -22,9 +22,10 @@ calls are made. ## Environment Variables -| Variable | Purpose | Required? | -| ------------------ | -------------------------------------------------- | --------------------------- | -| `SUPABASE_PROFILE` | profile selector (built-in name or YAML file path) | no (defaults to `supabase`) | +| Variable | Purpose | Required? | +| ------------------ | ---------------------------------------------------------------------- | ------------------------------ | +| `SUPABASE_HOME` | global CLI state root for auth, telemetry, traces, and shared binaries | no (defaults to `~/.supabase`) | +| `SUPABASE_PROFILE` | profile selector (built-in name or YAML file path) | no (defaults to `supabase`) | ## Exit Codes diff --git a/apps/cli/src/legacy/commands/sso/list/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/sso/list/SIDE_EFFECTS.md index 8f34b159f9..bbd49b2a4d 100644 --- a/apps/cli/src/legacy/commands/sso/list/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/sso/list/SIDE_EFFECTS.md @@ -26,10 +26,11 @@ ## Environment Variables -| Variable | Purpose | Required? | -| ----------------------- | ---------------------------------------------------- | -------------------------------------------------------------------------- | -| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `/access-token`) | -| `SUPABASE_PROFILE` | profile selector (built-in name or YAML file path) | no (defaults to `supabase`) | +| Variable | Purpose | Required? | +| ----------------------- | ---------------------------------------------------------------------- | -------------------------------------------------------------------------- | +| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `/access-token`) | +| `SUPABASE_HOME` | global CLI state root for auth, telemetry, traces, and shared binaries | no (defaults to `~/.supabase`) | +| `SUPABASE_PROFILE` | profile selector (built-in name or YAML file path) | no (defaults to `supabase`) | ## Exit Codes diff --git a/apps/cli/src/legacy/commands/sso/remove/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/sso/remove/SIDE_EFFECTS.md index 3cc143577a..d1a12c7c75 100644 --- a/apps/cli/src/legacy/commands/sso/remove/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/sso/remove/SIDE_EFFECTS.md @@ -26,10 +26,11 @@ ## Environment Variables -| Variable | Purpose | Required? | -| ----------------------- | ---------------------------------------------------- | -------------------------------------------------------------------------- | -| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `/access-token`) | -| `SUPABASE_PROFILE` | profile selector (built-in name or YAML file path) | no (defaults to `supabase`) | +| Variable | Purpose | Required? | +| ----------------------- | ---------------------------------------------------------------------- | -------------------------------------------------------------------------- | +| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `/access-token`) | +| `SUPABASE_HOME` | global CLI state root for auth, telemetry, traces, and shared binaries | no (defaults to `~/.supabase`) | +| `SUPABASE_PROFILE` | profile selector (built-in name or YAML file path) | no (defaults to `supabase`) | ## Exit Codes diff --git a/apps/cli/src/legacy/commands/sso/show/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/sso/show/SIDE_EFFECTS.md index 8dfdf55532..cc436d8bfc 100644 --- a/apps/cli/src/legacy/commands/sso/show/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/sso/show/SIDE_EFFECTS.md @@ -27,10 +27,11 @@ side-calls — matches Go's `get.go`. ## Environment Variables -| Variable | Purpose | Required? | -| ----------------------- | ---------------------------------------------------- | -------------------------------------------------------------------------- | -| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `/access-token`) | -| `SUPABASE_PROFILE` | profile selector (built-in name or YAML file path) | no (defaults to `supabase`) | +| Variable | Purpose | Required? | +| ----------------------- | ---------------------------------------------------------------------- | -------------------------------------------------------------------------- | +| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `/access-token`) | +| `SUPABASE_HOME` | global CLI state root for auth, telemetry, traces, and shared binaries | no (defaults to `~/.supabase`) | +| `SUPABASE_PROFILE` | profile selector (built-in name or YAML file path) | no (defaults to `supabase`) | ## Exit Codes diff --git a/apps/cli/src/legacy/commands/sso/update/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/sso/update/SIDE_EFFECTS.md index c378e2d0a5..fc3a086675 100644 --- a/apps/cli/src/legacy/commands/sso/update/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/sso/update/SIDE_EFFECTS.md @@ -34,10 +34,11 @@ GET still uses the typed client. ## Environment Variables -| Variable | Purpose | Required? | -| ----------------------- | ---------------------------------------------------- | -------------------------------------------------------------------------- | -| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `/access-token`) | -| `SUPABASE_PROFILE` | profile selector (built-in name or YAML file path) | no (defaults to `supabase`) | +| Variable | Purpose | Required? | +| ----------------------- | ---------------------------------------------------------------------- | -------------------------------------------------------------------------- | +| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `/access-token`) | +| `SUPABASE_HOME` | global CLI state root for auth, telemetry, traces, and shared binaries | no (defaults to `~/.supabase`) | +| `SUPABASE_PROFILE` | profile selector (built-in name or YAML file path) | no (defaults to `supabase`) | ## Exit Codes diff --git a/apps/cli/src/legacy/commands/storage/cp/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/storage/cp/SIDE_EFFECTS.md index ad7bdd46da..c211e7e7ea 100644 --- a/apps/cli/src/legacy/commands/storage/cp/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/storage/cp/SIDE_EFFECTS.md @@ -22,10 +22,11 @@ ## Environment Variables -| Variable | Purpose | Required? | -| ----------------------- | ---------------------------------------------------- | -------------------------------------------------------------------------- | -| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `/access-token`) | -| `SUPABASE_API_URL` | override Management API base URL | no (defaults to `https://api.supabase.com`) | +| Variable | Purpose | Required? | +| ----------------------- | ---------------------------------------------------------------------- | -------------------------------------------------------------------------- | +| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `/access-token`) | +| `SUPABASE_HOME` | global CLI state root for auth, telemetry, traces, and shared binaries | no (defaults to `~/.supabase`) | +| `SUPABASE_API_URL` | override Management API base URL | no (defaults to `https://api.supabase.com`) | ## Exit Codes diff --git a/apps/cli/src/legacy/commands/storage/ls/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/storage/ls/SIDE_EFFECTS.md index a884d55528..35253e7740 100644 --- a/apps/cli/src/legacy/commands/storage/ls/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/storage/ls/SIDE_EFFECTS.md @@ -20,10 +20,11 @@ ## Environment Variables -| Variable | Purpose | Required? | -| ----------------------- | ---------------------------------------------------- | -------------------------------------------------------------------------- | -| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `/access-token`) | -| `SUPABASE_API_URL` | override Management API base URL | no (defaults to `https://api.supabase.com`) | +| Variable | Purpose | Required? | +| ----------------------- | ---------------------------------------------------------------------- | -------------------------------------------------------------------------- | +| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `/access-token`) | +| `SUPABASE_HOME` | global CLI state root for auth, telemetry, traces, and shared binaries | no (defaults to `~/.supabase`) | +| `SUPABASE_API_URL` | override Management API base URL | no (defaults to `https://api.supabase.com`) | ## Exit Codes diff --git a/apps/cli/src/legacy/commands/storage/mv/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/storage/mv/SIDE_EFFECTS.md index 2d539a50cc..a5ec50253a 100644 --- a/apps/cli/src/legacy/commands/storage/mv/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/storage/mv/SIDE_EFFECTS.md @@ -20,10 +20,11 @@ ## Environment Variables -| Variable | Purpose | Required? | -| ----------------------- | ---------------------------------------------------- | -------------------------------------------------------------------------- | -| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `/access-token`) | -| `SUPABASE_API_URL` | override Management API base URL | no (defaults to `https://api.supabase.com`) | +| Variable | Purpose | Required? | +| ----------------------- | ---------------------------------------------------------------------- | -------------------------------------------------------------------------- | +| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `/access-token`) | +| `SUPABASE_HOME` | global CLI state root for auth, telemetry, traces, and shared binaries | no (defaults to `~/.supabase`) | +| `SUPABASE_API_URL` | override Management API base URL | no (defaults to `https://api.supabase.com`) | ## Exit Codes diff --git a/apps/cli/src/legacy/commands/storage/rm/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/storage/rm/SIDE_EFFECTS.md index 384247fb25..f41abe340f 100644 --- a/apps/cli/src/legacy/commands/storage/rm/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/storage/rm/SIDE_EFFECTS.md @@ -20,10 +20,11 @@ ## Environment Variables -| Variable | Purpose | Required? | -| ----------------------- | ---------------------------------------------------- | -------------------------------------------------------------------------- | -| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `/access-token`) | -| `SUPABASE_API_URL` | override Management API base URL | no (defaults to `https://api.supabase.com`) | +| Variable | Purpose | Required? | +| ----------------------- | ---------------------------------------------------------------------- | -------------------------------------------------------------------------- | +| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `/access-token`) | +| `SUPABASE_HOME` | global CLI state root for auth, telemetry, traces, and shared binaries | no (defaults to `~/.supabase`) | +| `SUPABASE_API_URL` | override Management API base URL | no (defaults to `https://api.supabase.com`) | ## Exit Codes diff --git a/apps/cli/src/legacy/commands/test/db/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/test/db/SIDE_EFFECTS.md index d6acc8c82e..1158415414 100644 --- a/apps/cli/src/legacy/commands/test/db/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/test/db/SIDE_EFFECTS.md @@ -45,14 +45,15 @@ One-shot `docker run --rm `, where the image is `supabase/pg_pro ## Environment Variables -| Variable | Purpose | Required? | -| ---------------------------- | -------------------------------------------------------------------- | --------------------------------------------- | -| `SUPABASE_DB_PASSWORD` | `--linked`: skip temporary login-role creation | no | -| `SUPABASE_ACCESS_TOKEN` | `--linked`: Management API auth | no (falls back to keyring/file) | -| `SUPABASE_SERVICES_HOSTNAME` | `--local`: overrides the local DB host (dev-container/remote Docker) | no (defaults via `DOCKER_HOST` → `127.0.0.1`) | -| `DOCKER_HOST` | `--local`: tcp daemon host used when no services-hostname override | no | -| `BITBUCKET_CLONE_DIR` | when set, omit `--security-opt label:disable` (Bitbucket rejects it) | no | -| `DEBUG` / `--debug` | append `--verbose` to `pg_prove` | no | +| Variable | Purpose | Required? | +| ---------------------------- | ---------------------------------------------------------------------- | --------------------------------------------- | +| `SUPABASE_DB_PASSWORD` | `--linked`: skip temporary login-role creation | no | +| `SUPABASE_ACCESS_TOKEN` | `--linked`: Management API auth | no (falls back to keyring/file) | +| `SUPABASE_HOME` | global CLI state root for auth, telemetry, traces, and shared binaries | no (defaults to `~/.supabase`) | +| `SUPABASE_SERVICES_HOSTNAME` | `--local`: overrides the local DB host (dev-container/remote Docker) | no (defaults via `DOCKER_HOST` → `127.0.0.1`) | +| `DOCKER_HOST` | `--local`: tcp daemon host used when no services-hostname override | no | +| `BITBUCKET_CLONE_DIR` | when set, omit `--security-opt label:disable` (Bitbucket rejects it) | no | +| `DEBUG` / `--debug` | append `--verbose` to `pg_prove` | no | ## Exit Codes diff --git a/apps/cli/src/legacy/commands/vanity-subdomains/activate/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/vanity-subdomains/activate/SIDE_EFFECTS.md index d2d3a9e2d5..f489833209 100644 --- a/apps/cli/src/legacy/commands/vanity-subdomains/activate/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/vanity-subdomains/activate/SIDE_EFFECTS.md @@ -9,10 +9,10 @@ ## Files Written -| Path | Format | When | -| ------------------------------------------------ | ------ | ----------------------------------------------------- | -| `~/.supabase//linked-project.json` | JSON | after ref resolution, on success and failure | -| `/telemetry.json` | JSON | always, via `Effect.ensuring`, on success and failure | +| Path | Format | When | +| ----------------------------------------------- | ------ | ----------------------------------------------------- | +| `/supabase/.temp/linked-project.json` | JSON | after ref resolution, on success and failure | +| `/telemetry.json` | JSON | always, via `Effect.ensuring`, on success and failure | ## API Routes @@ -22,11 +22,12 @@ ## Environment Variables -| Variable | Purpose | Required? | -| ----------------------- | ---------------------------------------------------- | ----------------------------------------------------------------------------- | -| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring then `/access-token`) | -| `SUPABASE_API_URL` | override Management API base URL | no (defaults to `https://api.supabase.com`) | -| `PROJECT_ID` | project ref fallback when `--project-ref` is unset | no (falls back to `supabase/.temp/project-ref`) | +| Variable | Purpose | Required? | +| ----------------------- | ---------------------------------------------------------------------- | ----------------------------------------------------------------------------- | +| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring then `/access-token`) | +| `SUPABASE_HOME` | global CLI state root for auth, telemetry, traces, and shared binaries | no (defaults to `~/.supabase`) | +| `SUPABASE_API_URL` | override Management API base URL | no (defaults to `https://api.supabase.com`) | +| `PROJECT_ID` | project ref fallback when `--project-ref` is unset | no (falls back to `supabase/.temp/project-ref`) | ## Exit Codes diff --git a/apps/cli/src/legacy/commands/vanity-subdomains/check-availability/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/vanity-subdomains/check-availability/SIDE_EFFECTS.md index e95889b17f..95ba7d138b 100644 --- a/apps/cli/src/legacy/commands/vanity-subdomains/check-availability/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/vanity-subdomains/check-availability/SIDE_EFFECTS.md @@ -9,10 +9,10 @@ ## Files Written -| Path | Format | When | -| ------------------------------------------------ | ------ | ----------------------------------------------------- | -| `~/.supabase//linked-project.json` | JSON | after ref resolution, on success and failure | -| `/telemetry.json` | JSON | always, via `Effect.ensuring`, on success and failure | +| Path | Format | When | +| ----------------------------------------------- | ------ | ----------------------------------------------------- | +| `/supabase/.temp/linked-project.json` | JSON | after ref resolution, on success and failure | +| `/telemetry.json` | JSON | always, via `Effect.ensuring`, on success and failure | ## API Routes @@ -22,11 +22,12 @@ ## Environment Variables -| Variable | Purpose | Required? | -| ----------------------- | ---------------------------------------------------- | ----------------------------------------------------------------------------- | -| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring then `/access-token`) | -| `SUPABASE_API_URL` | override Management API base URL | no (defaults to `https://api.supabase.com`) | -| `PROJECT_ID` | project ref fallback when `--project-ref` is unset | no (falls back to `supabase/.temp/project-ref`) | +| Variable | Purpose | Required? | +| ----------------------- | ---------------------------------------------------------------------- | ----------------------------------------------------------------------------- | +| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring then `/access-token`) | +| `SUPABASE_HOME` | global CLI state root for auth, telemetry, traces, and shared binaries | no (defaults to `~/.supabase`) | +| `SUPABASE_API_URL` | override Management API base URL | no (defaults to `https://api.supabase.com`) | +| `PROJECT_ID` | project ref fallback when `--project-ref` is unset | no (falls back to `supabase/.temp/project-ref`) | ## Exit Codes diff --git a/apps/cli/src/legacy/commands/vanity-subdomains/delete/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/vanity-subdomains/delete/SIDE_EFFECTS.md index a662252cb2..946d1beaee 100644 --- a/apps/cli/src/legacy/commands/vanity-subdomains/delete/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/vanity-subdomains/delete/SIDE_EFFECTS.md @@ -9,10 +9,10 @@ ## Files Written -| Path | Format | When | -| ------------------------------------------------ | ------ | ----------------------------------------------------- | -| `~/.supabase//linked-project.json` | JSON | after ref resolution, on success and failure | -| `/telemetry.json` | JSON | always, via `Effect.ensuring`, on success and failure | +| Path | Format | When | +| ----------------------------------------------- | ------ | ----------------------------------------------------- | +| `/supabase/.temp/linked-project.json` | JSON | after ref resolution, on success and failure | +| `/telemetry.json` | JSON | always, via `Effect.ensuring`, on success and failure | ## API Routes @@ -22,11 +22,12 @@ ## Environment Variables -| Variable | Purpose | Required? | -| ----------------------- | ---------------------------------------------------- | ----------------------------------------------------------------------------- | -| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring then `/access-token`) | -| `SUPABASE_API_URL` | override Management API base URL | no (defaults to `https://api.supabase.com`) | -| `PROJECT_ID` | project ref fallback when `--project-ref` is unset | no (falls back to `supabase/.temp/project-ref`) | +| Variable | Purpose | Required? | +| ----------------------- | ---------------------------------------------------------------------- | ----------------------------------------------------------------------------- | +| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring then `/access-token`) | +| `SUPABASE_HOME` | global CLI state root for auth, telemetry, traces, and shared binaries | no (defaults to `~/.supabase`) | +| `SUPABASE_API_URL` | override Management API base URL | no (defaults to `https://api.supabase.com`) | +| `PROJECT_ID` | project ref fallback when `--project-ref` is unset | no (falls back to `supabase/.temp/project-ref`) | ## Exit Codes diff --git a/apps/cli/src/legacy/commands/vanity-subdomains/get/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/vanity-subdomains/get/SIDE_EFFECTS.md index 12198ed40a..9f64694f37 100644 --- a/apps/cli/src/legacy/commands/vanity-subdomains/get/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/vanity-subdomains/get/SIDE_EFFECTS.md @@ -9,10 +9,10 @@ ## Files Written -| Path | Format | When | -| ------------------------------------------------ | ------ | ----------------------------------------------------- | -| `~/.supabase//linked-project.json` | JSON | after ref resolution, on success and failure | -| `/telemetry.json` | JSON | always, via `Effect.ensuring`, on success and failure | +| Path | Format | When | +| ----------------------------------------------- | ------ | ----------------------------------------------------- | +| `/supabase/.temp/linked-project.json` | JSON | after ref resolution, on success and failure | +| `/telemetry.json` | JSON | always, via `Effect.ensuring`, on success and failure | ## API Routes @@ -22,11 +22,12 @@ ## Environment Variables -| Variable | Purpose | Required? | -| ----------------------- | ---------------------------------------------------- | ----------------------------------------------------------------------------- | -| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring then `/access-token`) | -| `SUPABASE_API_URL` | override Management API base URL | no (defaults to `https://api.supabase.com`) | -| `PROJECT_ID` | project ref fallback when `--project-ref` is unset | no (falls back to `supabase/.temp/project-ref`) | +| Variable | Purpose | Required? | +| ----------------------- | ---------------------------------------------------------------------- | ----------------------------------------------------------------------------- | +| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring then `/access-token`) | +| `SUPABASE_HOME` | global CLI state root for auth, telemetry, traces, and shared binaries | no (defaults to `~/.supabase`) | +| `SUPABASE_API_URL` | override Management API base URL | no (defaults to `https://api.supabase.com`) | +| `PROJECT_ID` | project ref fallback when `--project-ref` is unset | no (falls back to `supabase/.temp/project-ref`) | ## Exit Codes From 7a417a35eb30d891bec2247338c110bb2d89ae67 Mon Sep 17 00:00:00 2001 From: Alex Metelli Date: Sat, 20 Jun 2026 10:20:36 +0800 Subject: [PATCH 10/12] docs(cli): align telemetry state root docs --- docs/telemetry.md | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) diff --git a/docs/telemetry.md b/docs/telemetry.md index 54405cab75..1d32b6dcea 100644 --- a/docs/telemetry.md +++ b/docs/telemetry.md @@ -27,7 +27,7 @@ ADR 0001 Pillar 5 and ADR 0002 share infrastructure. No separate metrics SDK and ┌─────────────┼─────────────┐ ▼ ▼ ▼ Local file --debug Remote -~/.supabase/ output export +state root/ output export traces/ (always) (opt-in) (always) │ │ │ │ ┌─────┴─────┐ @@ -39,6 +39,8 @@ Observability Observability Sentry Grafana Sentry receives every command span via its native OpenTelemetry integration and powers error diagnostics, performance monitoring, and product analytics dashboards for all 5 metric categories from ADR 0002. In Phase 2, spans will also be exported to a company-owned Grafana instance via OTLP for long-term retention and custom analytics. The CLI code does not change between phases — only the exporter configuration. +In the diagram, "state root" means ``. + ## Collection Architecture `withTelemetry()` middleware wrapping Stricli command handlers. The middleware: @@ -112,7 +114,7 @@ command({ **Anonymous phase** — before login: -`device_id`: random UUID generated on first run, persisted in `~/.supabase/telemetry.json`. Never changes unless the file is deleted. This is the only identity before the user runs `supabase login`. It is attached to every span as the `cli.device_id` resource attribute. +`device_id`: random UUID generated on first run, persisted in `/telemetry.json`. Never changes unless the file is deleted. This is the only identity before the user runs `supabase login`. It is attached to every span as the `cli.device_id` resource attribute. `session_id`: random UUID that rotates after 30 minutes of inactivity (no CLI commands). This defines "session" for the Engagement metrics. @@ -156,7 +158,7 @@ Privacy guarantees: ## Local Storage -NDJSON files in `~/.supabase/traces/`: +NDJSON files in `/traces/`: - One file per day: `2025-01-15.ndjson` - 7-day automatic retention (older files deleted on CLI startup) @@ -246,7 +248,7 @@ span.setStatus({ code: SpanStatusCode.OK }); span.end(); // 5. Always: append to local trace file -// ~/.supabase/traces/2025-01-15.ndjson += JSON.stringify(spanData) + "\n" +// /traces/2025-01-15.ndjson += JSON.stringify(spanData) + "\n" // 6. If consent === "granted": Sentry SDK exports the span // Non-blocking — SDK batches internally @@ -334,7 +336,7 @@ rootSpan.end(); ## Consent Implementation -Three-state model stored in `~/.supabase/telemetry.json`: +Three-state model stored in `/telemetry.json`: ```typescript type ConsentState = "pending" | "granted" | "denied"; From 52696806feaa2fb4b6c9ac5468fd0731acbe7754 Mon Sep 17 00:00:00 2001 From: Alex Metelli Date: Sat, 20 Jun 2026 10:30:12 +0800 Subject: [PATCH 11/12] fix(cli): skip outside function imports before realpath --- .../deploy/deploy.integration.test.ts | 34 ++++++++++++++++++- apps/cli/src/shared/functions/deploy.ts | 6 ++++ 2 files changed, 39 insertions(+), 1 deletion(-) diff --git a/apps/cli/src/next/commands/functions/deploy/deploy.integration.test.ts b/apps/cli/src/next/commands/functions/deploy/deploy.integration.test.ts index 699c5d8847..65dbfd30fe 100644 --- a/apps/cli/src/next/commands/functions/deploy/deploy.integration.test.ts +++ b/apps/cli/src/next/commands/functions/deploy/deploy.integration.test.ts @@ -4,7 +4,7 @@ import { BunServices } from "@effect/platform-bun"; import { mkdirSync, mkdtempSync, realpathSync, writeFileSync } from "node:fs"; import { mkdir, rm, writeFile } from "node:fs/promises"; import { tmpdir } from "node:os"; -import { dirname, join, sep } from "node:path"; +import { dirname, join, relative, sep } from "node:path"; import { Effect, Layer, Option, Sink, Stdio, Stream } from "effect"; import * as HttpClient from "effect/unstable/http/HttpClient"; import * as HttpClientResponse from "effect/unstable/http/HttpClientResponse"; @@ -1061,6 +1061,38 @@ describe("functions deploy", () => { }).pipe(Effect.ensuring(Effect.all([cleanupTempDir(tempDir), cleanupTempDir(outsideDir)]))); }); + it.live("skips outside imports before resolving their real paths", () => { + const tempDir = makeTempDir(); + const projectDir = join(tempDir, "project"); + const functionDir = join(projectDir, "supabase", "functions", "hello-world"); + const outsidePath = join(tempDir, "private", "secret.ts"); + const outsideImport = relative(functionDir, outsidePath).replaceAll(sep, "/"); + + return Effect.gen(function* () { + yield* Effect.promise(() => writeProjectConfig(projectDir)); + yield* Effect.promise(() => + writeLocalFunction( + projectDir, + "hello-world", + `import { secret } from "${outsideImport}"\nDeno.serve(() => new Response(secret))\n`, + ), + ); + + const { out, api, layer } = setup(projectDir, { + rawArgs: ["functions", "deploy", "hello-world"], + }); + + yield* functionsDeploy({ + ...BASE_FLAGS, + functionNames: ["hello-world"], + }).pipe(Effect.provide(layer)); + + expect(api.multiparts[0]?.fileNames).not.toContain(outsidePath); + expect(out.stderrText).toContain("WARN: Skipping import path outside project root:"); + expect(out.stderrText).not.toContain("failed to read file"); + }).pipe(Effect.ensuring(cleanupTempDir(tempDir))); + }); + it.live("falls back to source upload and warns when explicit Docker is not running", () => { const tempDir = makeTempDir(); const child = mockChildProcessSpawner({ exitCode: 1 }); diff --git a/apps/cli/src/shared/functions/deploy.ts b/apps/cli/src/shared/functions/deploy.ts index b500198ca6..65873ccd38 100644 --- a/apps/cli/src/shared/functions/deploy.ts +++ b/apps/cli/src/shared/functions/deploy.ts @@ -656,6 +656,12 @@ async function walkImportPaths( } const resolvedModule = resolve(modulePath); + const lexicalAllowedRoots = [dirname(current), displayRoot, ...allowedRoots]; + if (!isContainedInAnyPath(lexicalAllowedRoots, resolvedModule)) { + await onWarning(`WARN: Skipping import path outside project root: ${modulePath}\n`); + continue; + } + let realResolvedModule: string; try { realResolvedModule = await realpath(resolvedModule); From d64d0f39168c8eedae810b70003ccf4f96a5b102 Mon Sep 17 00:00:00 2001 From: Alex Metelli Date: Sat, 20 Jun 2026 10:34:39 +0800 Subject: [PATCH 12/12] chore(cli): reduce Supabase home PR docs scope --- apps/cli/AGENTS.md | 16 ++++---- apps/cli/src/legacy/SIDE_EFFECTS_TEMPLATE.md | 17 ++++---- .../commands/backups/list/SIDE_EFFECTS.md | 17 ++++---- .../commands/backups/restore/SIDE_EFFECTS.md | 17 ++++---- .../legacy/commands/bootstrap/SIDE_EFFECTS.md | 27 ++++++------ .../commands/branches/create/SIDE_EFFECTS.md | 37 ++++++++--------- .../commands/branches/delete/SIDE_EFFECTS.md | 10 ++--- .../commands/branches/disable/SIDE_EFFECTS.md | 10 ++--- .../commands/branches/get/SIDE_EFFECTS.md | 12 +++--- .../commands/branches/list/SIDE_EFFECTS.md | 23 +++++------ .../commands/branches/pause/SIDE_EFFECTS.md | 10 ++--- .../commands/branches/unpause/SIDE_EFFECTS.md | 10 ++--- .../commands/branches/update/SIDE_EFFECTS.md | 10 ++--- .../commands/config/push/SIDE_EFFECTS.md | 37 ++++++++--------- .../commands/db/advisors/SIDE_EFFECTS.md | 31 +++++++------- .../legacy/commands/db/diff/SIDE_EFFECTS.md | 17 ++++---- .../legacy/commands/db/dump/SIDE_EFFECTS.md | 29 +++++++------ .../legacy/commands/db/lint/SIDE_EFFECTS.md | 27 ++++++------ .../legacy/commands/db/pull/SIDE_EFFECTS.md | 15 ++++--- .../legacy/commands/db/push/SIDE_EFFECTS.md | 21 +++++----- .../legacy/commands/db/query/SIDE_EFFECTS.md | 17 ++++---- .../db/remote/changes/SIDE_EFFECTS.md | 15 ++++--- .../commands/db/remote/commit/SIDE_EFFECTS.md | 15 ++++--- .../legacy/commands/db/reset/SIDE_EFFECTS.md | 19 ++++----- .../declarative/generate/SIDE_EFFECTS.md | 21 +++++----- .../legacy/commands/db/test/SIDE_EFFECTS.md | 17 ++++---- .../legacy/commands/domains/SIDE_EFFECTS.md | 27 ++++++------ .../commands/encryption/SIDE_EFFECTS.md | 31 +++++++------- .../commands/functions/delete/SIDE_EFFECTS.md | 15 ++++--- .../commands/functions/deploy/SIDE_EFFECTS.md | 17 ++++---- .../functions/download/SIDE_EFFECTS.md | 15 ++++--- .../commands/functions/list/SIDE_EFFECTS.md | 15 ++++--- .../legacy/commands/gen/keys/SIDE_EFFECTS.md | 9 ++-- .../legacy/commands/gen/types/SIDE_EFFECTS.md | 29 +++++++------ .../commands/inspect/db/SIDE_EFFECTS.md | 31 +++++++------- .../commands/inspect/report/SIDE_EFFECTS.md | 27 ++++++------ .../src/legacy/commands/link/SIDE_EFFECTS.md | 13 +++--- .../src/legacy/commands/login/SIDE_EFFECTS.md | 41 +++++++++---------- .../legacy/commands/logout/SIDE_EFFECTS.md | 17 ++++---- .../commands/migration/down/SIDE_EFFECTS.md | 15 ++++--- .../commands/migration/fetch/SIDE_EFFECTS.md | 13 +++--- .../commands/migration/list/SIDE_EFFECTS.md | 17 ++++---- .../commands/migration/repair/SIDE_EFFECTS.md | 15 ++++--- .../commands/migration/squash/SIDE_EFFECTS.md | 17 ++++---- .../commands/migration/up/SIDE_EFFECTS.md | 15 ++++--- .../commands/network-bans/get/SIDE_EFFECTS.md | 27 ++++++------ .../network-bans/remove/SIDE_EFFECTS.md | 27 ++++++------ .../network-restrictions/get/SIDE_EFFECTS.md | 27 ++++++------ .../update/SIDE_EFFECTS.md | 27 ++++++------ .../commands/orgs/create/SIDE_EFFECTS.md | 25 ++++++----- .../legacy/commands/orgs/list/SIDE_EFFECTS.md | 27 ++++++------ .../postgres-config/delete/SIDE_EFFECTS.md | 27 ++++++------ .../postgres-config/get/SIDE_EFFECTS.md | 27 ++++++------ .../postgres-config/update/SIDE_EFFECTS.md | 27 ++++++------ .../legacy/commands/projects/SIDE_EFFECTS.md | 19 ++++----- .../projects/api-keys/SIDE_EFFECTS.md | 17 ++++---- .../commands/projects/create/SIDE_EFFECTS.md | 17 ++++---- .../commands/projects/delete/SIDE_EFFECTS.md | 17 ++++---- .../commands/projects/list/SIDE_EFFECTS.md | 17 ++++---- .../commands/secrets/list/SIDE_EFFECTS.md | 25 ++++++----- .../commands/secrets/set/SIDE_EFFECTS.md | 33 ++++++++------- .../commands/secrets/unset/SIDE_EFFECTS.md | 25 ++++++----- .../commands/seed/buckets/SIDE_EFFECTS.md | 17 ++++---- .../legacy/commands/services/SIDE_EFFECTS.md | 25 ++++++----- .../snippets/download/SIDE_EFFECTS.md | 23 +++++------ .../commands/snippets/list/SIDE_EFFECTS.md | 23 +++++------ .../ssl-enforcement/get/SIDE_EFFECTS.md | 27 ++++++------ .../ssl-enforcement/update/SIDE_EFFECTS.md | 27 ++++++------ .../legacy/commands/sso/add/SIDE_EFFECTS.md | 19 ++++----- .../legacy/commands/sso/info/SIDE_EFFECTS.md | 15 ++++--- .../legacy/commands/sso/list/SIDE_EFFECTS.md | 19 ++++----- .../commands/sso/remove/SIDE_EFFECTS.md | 19 ++++----- .../legacy/commands/sso/show/SIDE_EFFECTS.md | 19 ++++----- .../commands/sso/update/SIDE_EFFECTS.md | 19 ++++----- .../commands/storage/cp/SIDE_EFFECTS.md | 17 ++++---- .../commands/storage/ls/SIDE_EFFECTS.md | 15 ++++--- .../commands/storage/mv/SIDE_EFFECTS.md | 15 ++++--- .../commands/storage/rm/SIDE_EFFECTS.md | 15 ++++--- .../telemetry/disable/SIDE_EFFECTS.md | 14 +++---- .../commands/telemetry/enable/SIDE_EFFECTS.md | 14 +++---- .../commands/telemetry/status/SIDE_EFFECTS.md | 14 +++---- .../legacy/commands/test/db/SIDE_EFFECTS.md | 31 +++++++------- .../activate/SIDE_EFFECTS.md | 27 ++++++------ .../check-availability/SIDE_EFFECTS.md | 27 ++++++------ .../vanity-subdomains/delete/SIDE_EFFECTS.md | 27 ++++++------ .../vanity-subdomains/get/SIDE_EFFECTS.md | 27 ++++++------ 86 files changed, 853 insertions(+), 929 deletions(-) diff --git a/apps/cli/AGENTS.md b/apps/cli/AGENTS.md index 52bc115acf..c30465cd85 100644 --- a/apps/cli/AGENTS.md +++ b/apps/cli/AGENTS.md @@ -90,14 +90,14 @@ Always check `src/shared/` before writing new infrastructure. Do not duplicate w Also check the following `legacy/` infrastructure before writing equivalent helpers from scratch: -| Path | What it provides | -| ------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -| `legacy/config/legacy-cli-config.layer.ts` | `LegacyCliConfig` — resolves `SUPABASE_PROFILE` (built-in name **or** YAML file path), `--workdir`, `--experimental`, project-id from `supabase/config.toml` | -| `legacy/config/legacy-project-ref.layer.ts` | `LegacyProjectRefResolver` — `--project-ref` flag → env → linked-project.json → config fallback chain; matches Go's resolver order | -| `legacy/telemetry/legacy-telemetry-state.layer.ts` | `LegacyTelemetryState.flush` — writes `/telemetry.json`, runs in every command's `Effect.ensuring` | -| `legacy/telemetry/legacy-linked-project-cache.layer.ts` | `LegacyLinkedProjectCache.cache(ref)` — writes `/supabase/.temp/linked-project.json` after `--project-ref` resolves; bypasses generated schema validation (uses raw HTTP client) | -| `legacy/auth/legacy-http-debug.layer.ts` | `legacyHttpClientLayer` — wraps the HTTP transport with a `--debug` stderr logger in Go's `log.LstdFlags` format | -| `legacy/output/legacy-glamour-table.ts` | `renderGlamourTable(headers, rows)` — byte-exact ASCII match for Go's `glamour.RenderTable(..., AsciiStyle)` | +| Path | What it provides | +| ------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | +| `legacy/config/legacy-cli-config.layer.ts` | `LegacyCliConfig` — resolves `SUPABASE_PROFILE` (built-in name **or** YAML file path), `--workdir`, `--experimental`, project-id from `supabase/config.toml` | +| `legacy/config/legacy-project-ref.layer.ts` | `LegacyProjectRefResolver` — `--project-ref` flag → env → linked-project.json → config fallback chain; matches Go's resolver order | +| `legacy/telemetry/legacy-telemetry-state.layer.ts` | `LegacyTelemetryState.flush` — writes `~/.supabase/telemetry.json`, runs in every command's `Effect.ensuring` | +| `legacy/telemetry/legacy-linked-project-cache.layer.ts` | `LegacyLinkedProjectCache.cache(ref)` — writes `~/.supabase//linked-project.json` after `--project-ref` resolves; bypasses generated schema validation (uses raw HTTP client) | +| `legacy/auth/legacy-http-debug.layer.ts` | `legacyHttpClientLayer` — wraps the HTTP transport with a `--debug` stderr logger in Go's `log.LstdFlags` format | +| `legacy/output/legacy-glamour-table.ts` | `renderGlamourTable(headers, rows)` — byte-exact ASCII match for Go's `glamour.RenderTable(..., AsciiStyle)` | --- diff --git a/apps/cli/src/legacy/SIDE_EFFECTS_TEMPLATE.md b/apps/cli/src/legacy/SIDE_EFFECTS_TEMPLATE.md index cc21a5ef34..a27b7f3ab6 100644 --- a/apps/cli/src/legacy/SIDE_EFFECTS_TEMPLATE.md +++ b/apps/cli/src/legacy/SIDE_EFFECTS_TEMPLATE.md @@ -27,10 +27,10 @@ When: the condition under which this file is read (e.g. "always", "when --flag is set", "when SUPABASE_ACCESS_TOKEN is not set"). --> -| Path | Format | When | -| --------------------------------------------- | ------------------------- | ---------------------------------------------------------- | -| `/access-token` | plain text (token string) | when `SUPABASE_ACCESS_TOKEN` unset and keyring unavailable | -| `/.supabase/config.json` | JSON | always, to resolve linked project ref | +| Path | Format | When | +| --------------------------------- | ------------------------- | ---------------------------------------------------------- | +| `~/.supabase/access-token` | plain text (token string) | when `SUPABASE_ACCESS_TOKEN` unset and keyring unavailable | +| `/.supabase/config.json` | JSON | always, to resolve linked project ref | ## Files Written @@ -58,11 +58,10 @@ -| Variable | Purpose | Required? | -| ----------------------- | ---------------------------------------------------------------------- | -------------------------------------------------------------------------- | -| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `/access-token`) | -| `SUPABASE_HOME` | global CLI state root for auth, telemetry, traces, and shared binaries | no (defaults to `~/.supabase`) | -| `SUPABASE_API_URL` | override Management API base URL | no (defaults to `https://api.supabase.com`) | +| Variable | Purpose | Required? | +| ----------------------- | ---------------------------------------------------- | ------------------------------------------------------- | +| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `~/.supabase/access-token`) | +| `SUPABASE_API_URL` | override Management API base URL | no (defaults to `https://api.supabase.com`) | ## Exit Codes diff --git a/apps/cli/src/legacy/commands/backups/list/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/backups/list/SIDE_EFFECTS.md index 53c1d25022..f69b0219d6 100644 --- a/apps/cli/src/legacy/commands/backups/list/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/backups/list/SIDE_EFFECTS.md @@ -2,13 +2,13 @@ ## Files Read -| Path | Format | When | -| --------------------------------------------- | ------------------------- | --------------------------------------------------------------------------------------------- | -| `/proc/sys/kernel/osrelease` (Linux) | plain text | once on layer init — disables keyring on WSL (`WSL` / `Microsoft` substring match) | -| keyring `"Supabase CLI"` / `` | OS keychain | when `SUPABASE_ACCESS_TOKEN` unset and keyring available; account = `LegacyCliConfig.profile` | -| keyring `"Supabase CLI"` / `access-token` | OS keychain | legacy-key fallback when the profile-keyed lookup misses | -| `/access-token` | plain text (token string) | last-resort fallback after env + keyring miss | -| `/supabase/.temp/project-ref` | plain text | when `--project-ref` and `SUPABASE_PROJECT_ID` are both unset | +| Path | Format | When | +| ----------------------------------------- | ------------------------- | --------------------------------------------------------------------------------------------- | +| `/proc/sys/kernel/osrelease` (Linux) | plain text | once on layer init — disables keyring on WSL (`WSL` / `Microsoft` substring match) | +| keyring `"Supabase CLI"` / `` | OS keychain | when `SUPABASE_ACCESS_TOKEN` unset and keyring available; account = `LegacyCliConfig.profile` | +| keyring `"Supabase CLI"` / `access-token` | OS keychain | legacy-key fallback when the profile-keyed lookup misses | +| `~/.supabase/access-token` | plain text (token string) | last-resort fallback after env + keyring miss | +| `/supabase/.temp/project-ref` | plain text | when `--project-ref` and `SUPABASE_PROJECT_ID` are both unset | ## Files Written @@ -27,8 +27,7 @@ | Variable | Purpose | Required? | | ----------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------- | -| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `/access-token`) | -| `SUPABASE_HOME` | global CLI state root for auth, telemetry, traces, and shared binaries | no (defaults to `~/.supabase`) | +| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `~/.supabase/access-token`) | | `SUPABASE_PROFILE` | selects API base URL: `supabase` → `api.supabase.com`, `supabase-staging` → `api.supabase.green`, `supabase-local` → `http://localhost:8080`. May alternatively be a filesystem path to a YAML profile with at least `api_url:` and optional `name:` (Go parity — used by the cli-e2e test harness). | no (defaults to `supabase`) | | `SUPABASE_PROJECT_ID` | project ref fallback when `--project-ref` is unset | no (also reads `/supabase/.temp/project-ref` then prompts on TTY) | | `SUPABASE_WORKDIR` | base directory for the `.temp/project-ref` lookup | no (walks up from CWD looking for `supabase/config.toml`) | diff --git a/apps/cli/src/legacy/commands/backups/restore/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/backups/restore/SIDE_EFFECTS.md index c56a218a52..8b08e2727b 100644 --- a/apps/cli/src/legacy/commands/backups/restore/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/backups/restore/SIDE_EFFECTS.md @@ -2,13 +2,13 @@ ## Files Read -| Path | Format | When | -| --------------------------------------------- | ------------------------- | --------------------------------------------------------------------------------------------- | -| `/proc/sys/kernel/osrelease` (Linux) | plain text | once on layer init — disables keyring on WSL (`WSL` / `Microsoft` substring match) | -| keyring `"Supabase CLI"` / `` | OS keychain | when `SUPABASE_ACCESS_TOKEN` unset and keyring available; account = `LegacyCliConfig.profile` | -| keyring `"Supabase CLI"` / `access-token` | OS keychain | legacy-key fallback when the profile-keyed lookup misses | -| `/access-token` | plain text (token string) | last-resort fallback after env + keyring miss | -| `/supabase/.temp/project-ref` | plain text | when `--project-ref` and `SUPABASE_PROJECT_ID` are both unset | +| Path | Format | When | +| ----------------------------------------- | ------------------------- | --------------------------------------------------------------------------------------------- | +| `/proc/sys/kernel/osrelease` (Linux) | plain text | once on layer init — disables keyring on WSL (`WSL` / `Microsoft` substring match) | +| keyring `"Supabase CLI"` / `` | OS keychain | when `SUPABASE_ACCESS_TOKEN` unset and keyring available; account = `LegacyCliConfig.profile` | +| keyring `"Supabase CLI"` / `access-token` | OS keychain | legacy-key fallback when the profile-keyed lookup misses | +| `~/.supabase/access-token` | plain text (token string) | last-resort fallback after env + keyring miss | +| `/supabase/.temp/project-ref` | plain text | when `--project-ref` and `SUPABASE_PROJECT_ID` are both unset | ## Files Written @@ -27,8 +27,7 @@ | Variable | Purpose | Required? | | ----------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------- | -| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `/access-token`) | -| `SUPABASE_HOME` | global CLI state root for auth, telemetry, traces, and shared binaries | no (defaults to `~/.supabase`) | +| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `~/.supabase/access-token`) | | `SUPABASE_PROFILE` | selects API base URL: `supabase` → `api.supabase.com`, `supabase-staging` → `api.supabase.green`, `supabase-local` → `http://localhost:8080`. May alternatively be a filesystem path to a YAML profile with at least `api_url:` and optional `name:` (Go parity — used by the cli-e2e test harness). | no (defaults to `supabase`) | | `SUPABASE_PROJECT_ID` | project ref fallback when `--project-ref` is unset | no (also reads `/supabase/.temp/project-ref` then prompts on TTY) | | `SUPABASE_WORKDIR` | base directory for the `.temp/project-ref` lookup | no (walks up from CWD looking for `supabase/config.toml`) | diff --git a/apps/cli/src/legacy/commands/bootstrap/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/bootstrap/SIDE_EFFECTS.md index 4392b7f133..a6428d8f47 100644 --- a/apps/cli/src/legacy/commands/bootstrap/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/bootstrap/SIDE_EFFECTS.md @@ -7,11 +7,11 @@ health poll → write `.env` → `db push` → start suggestion. Every step is n ## Files Read -| Path | Format | When | -| --------------------------------------------- | ---------- | ----------------------------------------------------------- | -| `/access-token` | plain text | ensure-login token miss (env unset and keyring unavailable) | -| `/.env.example` | dotenv | optional; merged into the generated `.env` | -| `/supabase/.temp/project-ref` | plain text | read by the delegated `db push` subprocess (post-`chdir`) | +| Path | Format | When | +| -------------------------------------- | ---------- | ----------------------------------------------------------- | +| `~/.supabase/access-token` | plain text | ensure-login token miss (env unset and keyring unavailable) | +| `/.env.example` | dotenv | optional; merged into the generated `.env` | +| `/supabase/.temp/project-ref` | plain text | read by the delegated `db push` subprocess (post-`chdir`) | ## Files Written @@ -23,7 +23,7 @@ health poll → write `.env` → `db push` → start suggestion. Every step is n | `/supabase/.temp/{pooler-url,rest-version,gotrue-version,storage-version,storage-migration}` | plain text | best-effort, from `link.LinkServices` | | `/.env` | dotenv | best-effort (write failure prints a warning and continues) | | `/supabase/.temp/linked-project.json` | JSON | PersistentPostRun linked-project cache (`Effect.ensuring`); resolves against the bootstrap workdir (the prompted/`--workdir`/env target), not `cliConfig.workdir` | -| `/telemetry.json` | JSON | PersistentPostRun telemetry flush (`Effect.ensuring`) | +| `~/.supabase/telemetry.json` | JSON | PersistentPostRun telemetry flush (`Effect.ensuring`) | **Process side effect:** `process.chdir()` mirrors Go's `ChangeWorkDir` and prints `Using workdir \n` to stderr (`workdir` bolded on a TTY). The original cwd is restored @@ -46,14 +46,13 @@ leaking the change to the surrounding process. ## Environment Variables -| Variable | Purpose | Required? | -| -------------------------------------- | ---------------------------------------------------------------------- | ------------------------------ | -| `SUPABASE_WORKDIR` | target dir (`--workdir` flag → env → prompt → cwd) | no | -| `SUPABASE_DB_PASSWORD` | DB password (`-p` flag → env → prompt/generate) | no | -| `GITHUB_TOKEN` | raise the GitHub API rate limit for template fetch | no | -| `SUPABASE_ACCESS_TOKEN` | auth bypass for ensure-login | no | -| `SUPABASE_HOME` | global CLI state root for auth, telemetry, traces, and shared binaries | no (defaults to `~/.supabase`) | -| `SUPABASE_API_URL`, `SUPABASE_PROFILE` | API host / profile | no | +| Variable | Purpose | Required? | +| -------------------------------------- | -------------------------------------------------- | --------- | +| `SUPABASE_WORKDIR` | target dir (`--workdir` flag → env → prompt → cwd) | no | +| `SUPABASE_DB_PASSWORD` | DB password (`-p` flag → env → prompt/generate) | no | +| `GITHUB_TOKEN` | raise the GitHub API rate limit for template fetch | no | +| `SUPABASE_ACCESS_TOKEN` | auth bypass for ensure-login | no | +| `SUPABASE_API_URL`, `SUPABASE_PROFILE` | API host / profile | no | ## Exit Codes diff --git a/apps/cli/src/legacy/commands/branches/create/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/branches/create/SIDE_EFFECTS.md index 278cfce744..98d5134fe2 100644 --- a/apps/cli/src/legacy/commands/branches/create/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/branches/create/SIDE_EFFECTS.md @@ -2,20 +2,20 @@ ## Files Read -| Path | Format | When | -| --------------------------------------------- | ------------------------- | --------------------------------------------------------------------------------------------- | -| keyring `"Supabase CLI"` / `` | OS keychain | when `SUPABASE_ACCESS_TOKEN` unset and keyring available; account = `LegacyCliConfig.profile` | -| keyring `"Supabase CLI"` / `access-token` | OS keychain | legacy-key fallback when the profile-keyed lookup misses | -| `/access-token` | plain text (token string) | last-resort fallback after env + keyring miss | -| `/supabase/.temp/project-ref` | plain text | when `--project-ref` and `SUPABASE_PROJECT_ID` are both unset | -| `/.git/HEAD` (walking parents) | plain text | when the positional `[name]` arg is omitted — fallback branch name detection | +| Path | Format | When | +| ----------------------------------------- | ------------------------- | --------------------------------------------------------------------------------------------- | +| keyring `"Supabase CLI"` / `` | OS keychain | when `SUPABASE_ACCESS_TOKEN` unset and keyring available; account = `LegacyCliConfig.profile` | +| keyring `"Supabase CLI"` / `access-token` | OS keychain | legacy-key fallback when the profile-keyed lookup misses | +| `~/.supabase/access-token` | plain text (token string) | last-resort fallback after env + keyring miss | +| `/supabase/.temp/project-ref` | plain text | when `--project-ref` and `SUPABASE_PROJECT_ID` are both unset | +| `/.git/HEAD` (walking parents) | plain text | when the positional `[name]` arg is omitted — fallback branch name detection | ## Files Written -| Path | Format | When | -| ----------------------------------------------- | ------ | ------------------------------------------------------------------------ | -| `/supabase/.temp/linked-project.json` | JSON | always (in `Effect.ensuring`) after `--project-ref` resolves — Go parity | -| `/telemetry.json` | JSON | always (in `Effect.ensuring`) at end of command — Go parity | +| Path | Format | When | +| ------------------------------------------------ | ------ | ------------------------------------------------------------------------ | +| `~/.supabase//linked-project.json` | JSON | always (in `Effect.ensuring`) after `--project-ref` resolves — Go parity | +| `~/.supabase/telemetry.json` | JSON | always (in `Effect.ensuring`) at end of command — Go parity | ## API Routes @@ -27,14 +27,13 @@ ## Environment Variables -| Variable | Purpose | Required? | -| ----------------------- | ------------------------------------------------------------------------------------------------ | -------------------------------------------------------------------------- | -| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `/access-token`) | -| `SUPABASE_HOME` | global CLI state root for auth, telemetry, traces, and shared binaries | no (defaults to `~/.supabase`) | -| `SUPABASE_PROFILE` | selects API base URL (`supabase` / `supabase-staging` / `supabase-local`) or a YAML profile path | no | -| `SUPABASE_PROJECT_ID` | parent project ref fallback when `--project-ref` is unset | no | -| `SUPABASE_WORKDIR` | base directory for the `.temp/project-ref` lookup | no | -| `GITHUB_HEAD_REF` | preferred over walking `.git/HEAD` when detecting the default branch name in CI | no | +| Variable | Purpose | Required? | +| ----------------------- | ------------------------------------------------------------------------------------------------ | ------------------------------------------------------- | +| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `~/.supabase/access-token`) | +| `SUPABASE_PROFILE` | selects API base URL (`supabase` / `supabase-staging` / `supabase-local`) or a YAML profile path | no | +| `SUPABASE_PROJECT_ID` | parent project ref fallback when `--project-ref` is unset | no | +| `SUPABASE_WORKDIR` | base directory for the `.temp/project-ref` lookup | no | +| `GITHUB_HEAD_REF` | preferred over walking `.git/HEAD` when detecting the default branch name in CI | no | ## Exit Codes diff --git a/apps/cli/src/legacy/commands/branches/delete/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/branches/delete/SIDE_EFFECTS.md index 49ee7e6b47..f0ccf933df 100644 --- a/apps/cli/src/legacy/commands/branches/delete/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/branches/delete/SIDE_EFFECTS.md @@ -6,10 +6,10 @@ Same auth and project-ref resolution chain as every Management-API legacy comman ## Files Written -| Path | Format | When | -| ----------------------------------------------- | ------ | ------------------------------------------------------------------------ | -| `/supabase/.temp/linked-project.json` | JSON | always (in `Effect.ensuring`) after `--project-ref` resolves — Go parity | -| `/telemetry.json` | JSON | always (in `Effect.ensuring`) at end of command — Go parity | +| Path | Format | When | +| ------------------------------------------------ | ------ | ------------------------------------------------------------------------ | +| `~/.supabase//linked-project.json` | JSON | always (in `Effect.ensuring`) after `--project-ref` resolves — Go parity | +| `~/.supabase/telemetry.json` | JSON | always (in `Effect.ensuring`) at end of command — Go parity | ## API Routes @@ -21,7 +21,7 @@ Same auth and project-ref resolution chain as every Management-API legacy comman ## Environment Variables -`SUPABASE_ACCESS_TOKEN`, `SUPABASE_HOME`, `SUPABASE_PROFILE`, `SUPABASE_PROJECT_ID`, `SUPABASE_WORKDIR` — same semantics as `branches list`. +`SUPABASE_ACCESS_TOKEN`, `SUPABASE_PROFILE`, `SUPABASE_PROJECT_ID`, `SUPABASE_WORKDIR` — same semantics as `branches list`. ## Exit Codes diff --git a/apps/cli/src/legacy/commands/branches/disable/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/branches/disable/SIDE_EFFECTS.md index 5dc3e037fa..75c9288c66 100644 --- a/apps/cli/src/legacy/commands/branches/disable/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/branches/disable/SIDE_EFFECTS.md @@ -8,10 +8,10 @@ Same auth and project-ref resolution chain as every Management-API legacy comman ## Files Written -| Path | Format | When | -| ----------------------------------------------- | ------ | ------------------------------------------------------------------------ | -| `/supabase/.temp/linked-project.json` | JSON | always (in `Effect.ensuring`) after `--project-ref` resolves — Go parity | -| `/telemetry.json` | JSON | always (in `Effect.ensuring`) at end of command — Go parity | +| Path | Format | When | +| ------------------------------------------------ | ------ | ------------------------------------------------------------------------ | +| `~/.supabase//linked-project.json` | JSON | always (in `Effect.ensuring`) after `--project-ref` resolves — Go parity | +| `~/.supabase/telemetry.json` | JSON | always (in `Effect.ensuring`) at end of command — Go parity | ## API Routes @@ -21,7 +21,7 @@ Same auth and project-ref resolution chain as every Management-API legacy comman ## Environment Variables -`SUPABASE_ACCESS_TOKEN`, `SUPABASE_HOME`, `SUPABASE_PROFILE`, `SUPABASE_PROJECT_ID`, `SUPABASE_WORKDIR` — same semantics as `branches list`. +`SUPABASE_ACCESS_TOKEN`, `SUPABASE_PROFILE`, `SUPABASE_PROJECT_ID`, `SUPABASE_WORKDIR` — same semantics as `branches list`. ## Exit Codes diff --git a/apps/cli/src/legacy/commands/branches/get/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/branches/get/SIDE_EFFECTS.md index 9167c23abd..babda6ee3b 100644 --- a/apps/cli/src/legacy/commands/branches/get/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/branches/get/SIDE_EFFECTS.md @@ -2,14 +2,14 @@ ## Files Read -Same auth fallback chain (env / keyring / `/access-token`) and project-ref discovery (`/supabase/.temp/project-ref`) as every Management-API legacy command. +Same auth fallback chain (env / keyring / `~/.supabase/access-token`) and project-ref discovery (`/supabase/.temp/project-ref`) as every Management-API legacy command. ## Files Written -| Path | Format | When | -| ----------------------------------------------- | ------ | ------------------------------------------------------------------------ | -| `/supabase/.temp/linked-project.json` | JSON | always (in `Effect.ensuring`) after `--project-ref` resolves — Go parity | -| `/telemetry.json` | JSON | always (in `Effect.ensuring`) at end of command — Go parity | +| Path | Format | When | +| ------------------------------------------------ | ------ | ------------------------------------------------------------------------ | +| `~/.supabase//linked-project.json` | JSON | always (in `Effect.ensuring`) after `--project-ref` resolves — Go parity | +| `~/.supabase/telemetry.json` | JSON | always (in `Effect.ensuring`) at end of command — Go parity | ## API Routes @@ -22,7 +22,7 @@ Same auth fallback chain (env / keyring / `/access ## Environment Variables -`SUPABASE_ACCESS_TOKEN`, `SUPABASE_HOME`, `SUPABASE_PROFILE`, `SUPABASE_PROJECT_ID`, `SUPABASE_WORKDIR` — same semantics as `branches list`. +`SUPABASE_ACCESS_TOKEN`, `SUPABASE_PROFILE`, `SUPABASE_PROJECT_ID`, `SUPABASE_WORKDIR` — same semantics as `branches list`. ## Exit Codes diff --git a/apps/cli/src/legacy/commands/branches/list/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/branches/list/SIDE_EFFECTS.md index 020209df60..f759df0adf 100644 --- a/apps/cli/src/legacy/commands/branches/list/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/branches/list/SIDE_EFFECTS.md @@ -2,19 +2,19 @@ ## Files Read -| Path | Format | When | -| --------------------------------------------- | ------------------------- | --------------------------------------------------------------------------------------------- | -| keyring `"Supabase CLI"` / `` | OS keychain | when `SUPABASE_ACCESS_TOKEN` unset and keyring available; account = `LegacyCliConfig.profile` | -| keyring `"Supabase CLI"` / `access-token` | OS keychain | legacy-key fallback when the profile-keyed lookup misses | -| `/access-token` | plain text (token string) | last-resort fallback after env + keyring miss | -| `/supabase/.temp/project-ref` | plain text | when `--project-ref` and `SUPABASE_PROJECT_ID` are both unset | +| Path | Format | When | +| ----------------------------------------- | ------------------------- | --------------------------------------------------------------------------------------------- | +| keyring `"Supabase CLI"` / `` | OS keychain | when `SUPABASE_ACCESS_TOKEN` unset and keyring available; account = `LegacyCliConfig.profile` | +| keyring `"Supabase CLI"` / `access-token` | OS keychain | legacy-key fallback when the profile-keyed lookup misses | +| `~/.supabase/access-token` | plain text (token string) | last-resort fallback after env + keyring miss | +| `/supabase/.temp/project-ref` | plain text | when `--project-ref` and `SUPABASE_PROJECT_ID` are both unset | ## Files Written -| Path | Format | When | -| ----------------------------------------------- | ------ | ------------------------------------------------------------------------ | -| `/supabase/.temp/linked-project.json` | JSON | always (in `Effect.ensuring`) after `--project-ref` resolves — Go parity | -| `/telemetry.json` | JSON | always (in `Effect.ensuring`) at end of command — Go parity | +| Path | Format | When | +| ------------------------------------------------ | ------ | ------------------------------------------------------------------------ | +| `~/.supabase//linked-project.json` | JSON | always (in `Effect.ensuring`) after `--project-ref` resolves — Go parity | +| `~/.supabase/telemetry.json` | JSON | always (in `Effect.ensuring`) at end of command — Go parity | ## API Routes @@ -26,8 +26,7 @@ | Variable | Purpose | Required? | | ----------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------- | -| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `/access-token`) | -| `SUPABASE_HOME` | global CLI state root for auth, telemetry, traces, and shared binaries | no (defaults to `~/.supabase`) | +| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `~/.supabase/access-token`) | | `SUPABASE_PROFILE` | selects API base URL: `supabase` → `api.supabase.com`, `supabase-staging` → `api.supabase.green`, `supabase-local` → `http://localhost:8080`. May alternatively be a filesystem path to a YAML profile with at least `api_url:` and optional `name:` (Go parity — used by the cli-e2e test harness). | no (defaults to `supabase`) | | `SUPABASE_PROJECT_ID` | project ref fallback when `--project-ref` is unset | no (also reads `/supabase/.temp/project-ref` then prompts on TTY) | | `SUPABASE_WORKDIR` | base directory for the `.temp/project-ref` lookup | no (walks up from CWD looking for `supabase/config.toml`) | diff --git a/apps/cli/src/legacy/commands/branches/pause/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/branches/pause/SIDE_EFFECTS.md index e6a0bbb237..205f188186 100644 --- a/apps/cli/src/legacy/commands/branches/pause/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/branches/pause/SIDE_EFFECTS.md @@ -6,10 +6,10 @@ Same auth and project-ref resolution chain as every Management-API legacy comman ## Files Written -| Path | Format | When | -| ----------------------------------------------- | ------ | ------------------------------------------------------------------------ | -| `/supabase/.temp/linked-project.json` | JSON | always (in `Effect.ensuring`) after `--project-ref` resolves — Go parity | -| `/telemetry.json` | JSON | always (in `Effect.ensuring`) at end of command — Go parity | +| Path | Format | When | +| ------------------------------------------------ | ------ | ------------------------------------------------------------------------ | +| `~/.supabase//linked-project.json` | JSON | always (in `Effect.ensuring`) after `--project-ref` resolves — Go parity | +| `~/.supabase/telemetry.json` | JSON | always (in `Effect.ensuring`) at end of command — Go parity | ## API Routes @@ -21,7 +21,7 @@ Same auth and project-ref resolution chain as every Management-API legacy comman ## Environment Variables -`SUPABASE_ACCESS_TOKEN`, `SUPABASE_HOME`, `SUPABASE_PROFILE`, `SUPABASE_PROJECT_ID`, `SUPABASE_WORKDIR` — same semantics as `branches list`. +`SUPABASE_ACCESS_TOKEN`, `SUPABASE_PROFILE`, `SUPABASE_PROJECT_ID`, `SUPABASE_WORKDIR` — same semantics as `branches list`. ## Exit Codes diff --git a/apps/cli/src/legacy/commands/branches/unpause/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/branches/unpause/SIDE_EFFECTS.md index 757748b0f8..0fe42e2410 100644 --- a/apps/cli/src/legacy/commands/branches/unpause/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/branches/unpause/SIDE_EFFECTS.md @@ -6,10 +6,10 @@ Same auth and project-ref resolution chain as every Management-API legacy comman ## Files Written -| Path | Format | When | -| ----------------------------------------------- | ------ | ------------------------------------------------------------------------ | -| `/supabase/.temp/linked-project.json` | JSON | always (in `Effect.ensuring`) after `--project-ref` resolves — Go parity | -| `/telemetry.json` | JSON | always (in `Effect.ensuring`) at end of command — Go parity | +| Path | Format | When | +| ------------------------------------------------ | ------ | ------------------------------------------------------------------------ | +| `~/.supabase//linked-project.json` | JSON | always (in `Effect.ensuring`) after `--project-ref` resolves — Go parity | +| `~/.supabase/telemetry.json` | JSON | always (in `Effect.ensuring`) at end of command — Go parity | ## API Routes @@ -21,7 +21,7 @@ Same auth and project-ref resolution chain as every Management-API legacy comman ## Environment Variables -`SUPABASE_ACCESS_TOKEN`, `SUPABASE_HOME`, `SUPABASE_PROFILE`, `SUPABASE_PROJECT_ID`, `SUPABASE_WORKDIR` — same semantics as `branches list`. +`SUPABASE_ACCESS_TOKEN`, `SUPABASE_PROFILE`, `SUPABASE_PROJECT_ID`, `SUPABASE_WORKDIR` — same semantics as `branches list`. ## Exit Codes diff --git a/apps/cli/src/legacy/commands/branches/update/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/branches/update/SIDE_EFFECTS.md index c10cba1e3c..09bab3fd8f 100644 --- a/apps/cli/src/legacy/commands/branches/update/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/branches/update/SIDE_EFFECTS.md @@ -6,10 +6,10 @@ Same auth and project-ref resolution chain as every Management-API legacy comman ## Files Written -| Path | Format | When | -| ----------------------------------------------- | ------ | ------------------------------------------------------------------------ | -| `/supabase/.temp/linked-project.json` | JSON | always (in `Effect.ensuring`) after `--project-ref` resolves — Go parity | -| `/telemetry.json` | JSON | always (in `Effect.ensuring`) at end of command — Go parity | +| Path | Format | When | +| ------------------------------------------------ | ------ | ------------------------------------------------------------------------ | +| `~/.supabase//linked-project.json` | JSON | always (in `Effect.ensuring`) after `--project-ref` resolves — Go parity | +| `~/.supabase/telemetry.json` | JSON | always (in `Effect.ensuring`) at end of command — Go parity | ## API Routes @@ -23,7 +23,7 @@ Same auth and project-ref resolution chain as every Management-API legacy comman ## Environment Variables -`SUPABASE_ACCESS_TOKEN`, `SUPABASE_HOME`, `SUPABASE_PROFILE`, `SUPABASE_PROJECT_ID`, `SUPABASE_WORKDIR` — same semantics as `branches list`. +`SUPABASE_ACCESS_TOKEN`, `SUPABASE_PROFILE`, `SUPABASE_PROJECT_ID`, `SUPABASE_WORKDIR` — same semantics as `branches list`. ## Exit Codes diff --git a/apps/cli/src/legacy/commands/config/push/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/config/push/SIDE_EFFECTS.md index a7ca779233..dcc9a9aa53 100644 --- a/apps/cli/src/legacy/commands/config/push/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/config/push/SIDE_EFFECTS.md @@ -7,19 +7,19 @@ local → if changed, print the unified diff and confirm → PATCH/PUT/POST. ## Files Read -| Path | Format | When | -| ---------------------------------------------- | ------------------------- | --------------------------------------------------------------- | -| `/supabase/config.toml` | TOML | always, before any network call (parse error aborts, exit 1) | -| `/supabase/.env`, `.env.local` | dotenv | always, to resolve `env(VAR)` references inside `config.toml` | -| `/supabase/.temp/linked-project.json` | JSON | project-ref fallback (flag → `SUPABASE_PROJECT_ID` → this file) | -| `/access-token` | plain text (token string) | when `SUPABASE_ACCESS_TOKEN` unset and keyring unavailable | +| Path | Format | When | +| ------------------------------------------------ | ------------------------- | --------------------------------------------------------------- | +| `/supabase/config.toml` | TOML | always, before any network call (parse error aborts, exit 1) | +| `/supabase/.env`, `.env.local` | dotenv | always, to resolve `env(VAR)` references inside `config.toml` | +| `~/.supabase//linked-project.json` | JSON | project-ref fallback (flag → `SUPABASE_PROJECT_ID` → this file) | +| `~/.supabase/access-token` | plain text (token string) | when `SUPABASE_ACCESS_TOKEN` unset and keyring unavailable | ## Files Written -| Path | Format | When | -| ----------------------------------------------- | ------ | ---------------------------------------------------------------------- | -| `/supabase/.temp/linked-project.json` | JSON | `Effect.ensuring` after run (success **and** failure), if ref resolved | -| `/telemetry.json` | JSON | `Effect.ensuring` after run (success **and** failure) | +| Path | Format | When | +| ------------------------------------------------ | ------ | ---------------------------------------------------------------------- | +| `~/.supabase//linked-project.json` | JSON | `Effect.ensuring` after run (success **and** failure), if ref resolved | +| `~/.supabase/telemetry.json` | JSON | `Effect.ensuring` after run (success **and** failure) | No writes to `config.toml`. @@ -49,15 +49,14 @@ when its local gate is off. ## Environment Variables -| Variable | Purpose | Required? | -| ----------------------- | ---------------------------------------------------------------------- | -------------------------------------------------------------------------- | -| `SUPABASE_PROJECT_ID` | project ref (flag → this → `.temp/project-ref` → prompt) | no | -| `SUPABASE_YES` | auto-confirm prompts (`--yes`) | no | -| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `/access-token`) | -| `SUPABASE_HOME` | global CLI state root for auth, telemetry, traces, and shared binaries | no (defaults to `~/.supabase`) | -| `SUPABASE_API_URL` | override Management API base URL | no (defaults to `https://api.supabase.com`) | -| `SUPABASE_PROFILE` | API profile selection | no | -| `env(VAR)` references | interpolated into `config.toml` values at load | no | +| Variable | Purpose | Required? | +| ----------------------- | -------------------------------------------------------- | ------------------------------------------------------- | +| `SUPABASE_PROJECT_ID` | project ref (flag → this → `.temp/project-ref` → prompt) | no | +| `SUPABASE_YES` | auto-confirm prompts (`--yes`) | no | +| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `~/.supabase/access-token`) | +| `SUPABASE_API_URL` | override Management API base URL | no (defaults to `https://api.supabase.com`) | +| `SUPABASE_PROFILE` | API profile selection | no | +| `env(VAR)` references | interpolated into `config.toml` values at load | no | ## Exit Codes diff --git a/apps/cli/src/legacy/commands/db/advisors/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/db/advisors/SIDE_EFFECTS.md index ab3d1b8600..2a4fad7e05 100644 --- a/apps/cli/src/legacy/commands/db/advisors/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/db/advisors/SIDE_EFFECTS.md @@ -6,18 +6,18 @@ database directly; `--linked` fetches from the Management API. ## Files Read -| Path | Format | When | -| --------------------------------------------- | ---------- | -------------------------------------------------------------------- | -| `/supabase/config.toml` | TOML | local / `--db-url` — to resolve the DB connection config | -| `/access-token` | plain text | `--linked` only, when `SUPABASE_ACCESS_TOKEN` unset (keyring → file) | -| `/supabase/.temp/project-ref` | plain text | `--linked` only — to resolve the project ref | +| Path | Format | When | +| -------------------------------------- | ---------- | -------------------------------------------------------------------- | +| `/supabase/config.toml` | TOML | local / `--db-url` — to resolve the DB connection config | +| `~/.supabase/access-token` | plain text | `--linked` only, when `SUPABASE_ACCESS_TOKEN` unset (keyring → file) | +| `/supabase/.temp/project-ref` | plain text | `--linked` only — to resolve the project ref | ## Files Written -| Path | Format | When | -| ----------------------------------------------- | ------ | ----------------------------------------------------- | -| `/telemetry.json` | JSON | always (PostHog state flush, Go `PersistentPostRun`) | -| `/supabase/.temp/linked-project.json` | JSON | `--linked` only, via `LegacyLinkedProjectCache.cache` | +| Path | Format | When | +| ---------------------------------------------- | ------ | ----------------------------------------------------- | +| `~/.supabase/telemetry.json` | JSON | always (PostHog state flush, Go `PersistentPostRun`) | +| `/supabase/.temp/linked-project.json` | JSON | `--linked` only, via `LegacyLinkedProjectCache.cache` | The local lint query runs inside a transaction that is **always rolled back**. @@ -41,13 +41,12 @@ One connection. Within one transaction: `BEGIN` → `set local search_path = ''` ## Environment Variables -| Variable | Purpose | Required? | -| ----------------------- | ---------------------------------------------------------------------- | ------------------------------------------------------------ | -| `SUPABASE_ACCESS_TOKEN` | auth token for `--linked` | no (keyring → `/access-token`) | -| `SUPABASE_HOME` | global CLI state root for auth, telemetry, traces, and shared binaries | no (defaults to `~/.supabase`) | -| `SUPABASE_PROJECT_ID` | linked project ref override | no | -| `SUPABASE_PROFILE` | API profile (built-in name or YAML path) | no | -| `PGHOST` / `PGPORT` / … | connection overrides (local / `--db-url`) | no | +| Variable | Purpose | Required? | +| ----------------------- | ----------------------------------------- | ----------------------------------------- | +| `SUPABASE_ACCESS_TOKEN` | auth token for `--linked` | no (keyring → `~/.supabase/access-token`) | +| `SUPABASE_PROJECT_ID` | linked project ref override | no | +| `SUPABASE_PROFILE` | API profile (built-in name or YAML path) | no | +| `PGHOST` / `PGPORT` / … | connection overrides (local / `--db-url`) | no | The API base URL is derived from `SUPABASE_PROFILE`; `SUPABASE_API_URL` is **not** honored (Go parity — see `legacy-cli-config.layer.unit.test.ts`). diff --git a/apps/cli/src/legacy/commands/db/diff/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/db/diff/SIDE_EFFECTS.md index f95913fde4..6f600f741f 100644 --- a/apps/cli/src/legacy/commands/db/diff/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/db/diff/SIDE_EFFECTS.md @@ -2,10 +2,10 @@ ## Files Read -| Path | Format | When | -| --------------------------------------------- | ---------- | --------------------------------------------------------------- | -| `/access-token` | plain text | when `SUPABASE_ACCESS_TOKEN` unset and `--linked` or `--db-url` | -| `/supabase/config.toml` | TOML | always, to resolve local DB config | +| Path | Format | When | +| -------------------------------- | ---------- | --------------------------------------------------------------- | +| `~/.supabase/access-token` | plain text | when `SUPABASE_ACCESS_TOKEN` unset and `--linked` or `--db-url` | +| `/supabase/config.toml` | TOML | always, to resolve local DB config | ## Files Written @@ -21,11 +21,10 @@ ## Environment Variables -| Variable | Purpose | Required? | -| ----------------------- | ---------------------------------------------------------------------- | -------------------------------------------------------------------------- | -| `SUPABASE_ACCESS_TOKEN` | auth token for `--linked` mode | no (falls back to keyring → `/access-token`) | -| `SUPABASE_HOME` | global CLI state root for auth, telemetry, traces, and shared binaries | no (defaults to `~/.supabase`) | -| `DB_PASSWORD` | password for direct database connection | no | +| Variable | Purpose | Required? | +| ----------------------- | --------------------------------------- | ------------------------------------------------------- | +| `SUPABASE_ACCESS_TOKEN` | auth token for `--linked` mode | no (falls back to keyring → `~/.supabase/access-token`) | +| `DB_PASSWORD` | password for direct database connection | no | ## Exit Codes diff --git a/apps/cli/src/legacy/commands/db/dump/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/db/dump/SIDE_EFFECTS.md index e464a3a373..477ee86159 100644 --- a/apps/cli/src/legacy/commands/db/dump/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/db/dump/SIDE_EFFECTS.md @@ -5,13 +5,13 @@ script run inside the local Postgres image to stdout or `--file`. ## Files Read -| Path | Format | When | -| --------------------------------------------- | ---------- | ----------------------------------------------------------- | -| `supabase/config.toml` | TOML | always (db port/password/major_version, project_id) | -| `supabase/.temp/postgres-version` | plain text | always (best-effort) — pins the pg image tag when present | -| `supabase/.temp/pooler-url` | plain text | `--linked` when the direct host is unreachable (pooler URL) | -| `/access-token` | plain text | `--linked` when `SUPABASE_ACCESS_TOKEN` unset | -| `supabase/.env*` | dotenv | always (project env, feeds `SUPABASE_DB_PASSWORD` / `PG*`) | +| Path | Format | When | +| --------------------------------- | ---------- | ----------------------------------------------------------- | +| `supabase/config.toml` | TOML | always (db port/password/major_version, project_id) | +| `supabase/.temp/postgres-version` | plain text | always (best-effort) — pins the pg image tag when present | +| `supabase/.temp/pooler-url` | plain text | `--linked` when the direct host is unreachable (pooler URL) | +| `~/.supabase/access-token` | plain text | `--linked` when `SUPABASE_ACCESS_TOKEN` unset | +| `supabase/.env*` | dotenv | always (project env, feeds `SUPABASE_DB_PASSWORD` / `PG*`) | ## Files Written @@ -30,14 +30,13 @@ script run inside the local Postgres image to stdout or `--file`. ## Environment Variables -| Variable | Purpose | -| ----------------------------------------------------------------------------- | ---------------------------------------------------------------------- | ------------------------------ | -| `SUPABASE_DB_PASSWORD` (`DB_PASSWORD` viper key; `--password`/`-p` overrides) | remote DB password | -| `SUPABASE_ACCESS_TOKEN` | `--linked` auth | -| `SUPABASE_HOME` | global CLI state root for auth, telemetry, traces, and shared binaries | no (defaults to `~/.supabase`) | -| `BITBUCKET_CLONE_DIR` | (no-op for dump — no `--security-opt` is set) | -| `SUPABASE_INTERNAL_IMAGE_REGISTRY` | rewrite the pg image registry | -| `DOCKER_HOST` | docker daemon endpoint | +| Variable | Purpose | +| ----------------------------------------------------------------------------- | --------------------------------------------- | +| `SUPABASE_DB_PASSWORD` (`DB_PASSWORD` viper key; `--password`/`-p` overrides) | remote DB password | +| `SUPABASE_ACCESS_TOKEN` | `--linked` auth | +| `BITBUCKET_CLONE_DIR` | (no-op for dump — no `--security-opt` is set) | +| `SUPABASE_INTERNAL_IMAGE_REGISTRY` | rewrite the pg image registry | +| `DOCKER_HOST` | docker daemon endpoint | ## Exit Codes diff --git a/apps/cli/src/legacy/commands/db/lint/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/db/lint/SIDE_EFFECTS.md index be0ca2575b..f76f966c3c 100644 --- a/apps/cli/src/legacy/commands/db/lint/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/db/lint/SIDE_EFFECTS.md @@ -5,16 +5,16 @@ Native TypeScript port of Go's `internal/db/lint`. ## Files Read -| Path | Format | When | -| --------------------------------------------- | ---------- | -------------------------------------------------------------------- | -| `/supabase/config.toml` | TOML | always — to resolve the local / linked DB connection config | -| `/access-token` | plain text | `--linked` only, when `SUPABASE_ACCESS_TOKEN` unset (keyring → file) | +| Path | Format | When | +| -------------------------------- | ---------- | -------------------------------------------------------------------- | +| `/supabase/config.toml` | TOML | always — to resolve the local / linked DB connection config | +| `~/.supabase/access-token` | plain text | `--linked` only, when `SUPABASE_ACCESS_TOKEN` unset (keyring → file) | ## Files Written -| Path | Format | When | -| ----------------------------------------------- | ------ | ---------------------------------------------------- | -| `/telemetry.json` | JSON | always (PostHog state flush, Go `PersistentPostRun`) | +| Path | Format | When | +| ---------------------------- | ------ | ---------------------------------------------------- | +| `~/.supabase/telemetry.json` | JSON | always (PostHog state flush, Go `PersistentPostRun`) | No user data is written: the lint runs inside a transaction that is **always rolled back** (`BEGIN` … `ROLLBACK`), matching Go — including @@ -43,13 +43,12 @@ the extension fails at step 3 (matching Go). ## Environment Variables -| Variable | Purpose | Required? | -| ----------------------- | ---------------------------------------------------------------------- | ------------------------------------------------------------ | -| `SUPABASE_ACCESS_TOKEN` | auth token for `--linked` resolution | no (keyring → `/access-token`) | -| `SUPABASE_HOME` | global CLI state root for auth, telemetry, traces, and shared binaries | no (defaults to `~/.supabase`) | -| `SUPABASE_DB_PASSWORD` | linked direct-DB password | no | -| `SUPABASE_PROFILE` | API profile (built-in name or YAML path) | no | -| `PGHOST` / `PGPORT` / … | connection overrides | no | +| Variable | Purpose | Required? | +| ----------------------- | ---------------------------------------- | ----------------------------------------- | +| `SUPABASE_ACCESS_TOKEN` | auth token for `--linked` resolution | no (keyring → `~/.supabase/access-token`) | +| `SUPABASE_DB_PASSWORD` | linked direct-DB password | no | +| `SUPABASE_PROFILE` | API profile (built-in name or YAML path) | no | +| `PGHOST` / `PGPORT` / … | connection overrides | no | ## Exit Codes diff --git a/apps/cli/src/legacy/commands/db/pull/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/db/pull/SIDE_EFFECTS.md index a951d442c4..f027cb07d8 100644 --- a/apps/cli/src/legacy/commands/db/pull/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/db/pull/SIDE_EFFECTS.md @@ -2,9 +2,9 @@ ## Files Read -| Path | Format | When | -| --------------------------------------------- | ---------- | ------------------------------------------------- | -| `/access-token` | plain text | when `SUPABASE_ACCESS_TOKEN` unset and `--linked` | +| Path | Format | When | +| -------------------------- | ---------- | ------------------------------------------------- | +| `~/.supabase/access-token` | plain text | when `SUPABASE_ACCESS_TOKEN` unset and `--linked` | ## Files Written @@ -20,11 +20,10 @@ ## Environment Variables -| Variable | Purpose | Required? | -| ----------------------- | ---------------------------------------------------------------------- | -------------------------------------------------------------------------- | -| `SUPABASE_ACCESS_TOKEN` | auth token for `--linked` mode | no (falls back to keyring → `/access-token`) | -| `SUPABASE_HOME` | global CLI state root for auth, telemetry, traces, and shared binaries | no (defaults to `~/.supabase`) | -| `DB_PASSWORD` | password for direct database connection | no | +| Variable | Purpose | Required? | +| ----------------------- | --------------------------------------- | ------------------------------------------------------- | +| `SUPABASE_ACCESS_TOKEN` | auth token for `--linked` mode | no (falls back to keyring → `~/.supabase/access-token`) | +| `DB_PASSWORD` | password for direct database connection | no | ## Exit Codes diff --git a/apps/cli/src/legacy/commands/db/push/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/db/push/SIDE_EFFECTS.md index a62351b53c..11337a8955 100644 --- a/apps/cli/src/legacy/commands/db/push/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/db/push/SIDE_EFFECTS.md @@ -2,12 +2,12 @@ ## Files Read -| Path | Format | When | -| --------------------------------------------- | ---------- | ------------------------------------------------- | -| `/access-token` | plain text | when `SUPABASE_ACCESS_TOKEN` unset and `--linked` | -| `/supabase/migrations/` | directory | always, to list migration files to push | -| `/supabase/roles.sql` | SQL | when `--include-roles` is set | -| seed files from config | SQL | when `--include-seed` is set | +| Path | Format | When | +| -------------------------------- | ---------- | ------------------------------------------------- | +| `~/.supabase/access-token` | plain text | when `SUPABASE_ACCESS_TOKEN` unset and `--linked` | +| `/supabase/migrations/` | directory | always, to list migration files to push | +| `/supabase/roles.sql` | SQL | when `--include-roles` is set | +| seed files from config | SQL | when `--include-seed` is set | ## Files Written @@ -23,11 +23,10 @@ ## Environment Variables -| Variable | Purpose | Required? | -| ----------------------- | ---------------------------------------------------------------------- | -------------------------------------------------------------------------- | -| `SUPABASE_ACCESS_TOKEN` | auth token for `--linked` mode | no (falls back to keyring → `/access-token`) | -| `SUPABASE_HOME` | global CLI state root for auth, telemetry, traces, and shared binaries | no (defaults to `~/.supabase`) | -| `DB_PASSWORD` | password for direct database connection | no | +| Variable | Purpose | Required? | +| ----------------------- | --------------------------------------- | ------------------------------------------------------- | +| `SUPABASE_ACCESS_TOKEN` | auth token for `--linked` mode | no (falls back to keyring → `~/.supabase/access-token`) | +| `DB_PASSWORD` | password for direct database connection | no | ## Exit Codes diff --git a/apps/cli/src/legacy/commands/db/query/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/db/query/SIDE_EFFECTS.md index 9f9530ce0b..775bac2733 100644 --- a/apps/cli/src/legacy/commands/db/query/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/db/query/SIDE_EFFECTS.md @@ -6,13 +6,13 @@ the result as a table or JSON. ## Files Read -| Path | Format | When | -| --------------------------------------------- | ---------- | ------------------------------------------------------------- | -| `` (from `--file`) | SQL | when `--file` / `-f` is set (takes precedence over arg/stdin) | -| stdin | SQL | when piped (not a TTY) and no `--file`/positional SQL | -| `supabase/config.toml` | TOML | local / `--db-url` connection resolution | -| `/access-token` | plain text | `--linked` when `SUPABASE_ACCESS_TOKEN` unset | -| `supabase/.temp/linked-project.json` | JSON | `--linked` existence check before the cache write (see below) | +| Path | Format | When | +| ------------------------------------ | ---------- | ------------------------------------------------------------- | +| `` (from `--file`) | SQL | when `--file` / `-f` is set (takes precedence over arg/stdin) | +| stdin | SQL | when piped (not a TTY) and no `--file`/positional SQL | +| `supabase/config.toml` | TOML | local / `--db-url` connection resolution | +| `~/.supabase/access-token` | plain text | `--linked` when `SUPABASE_ACCESS_TOKEN` unset | +| `supabase/.temp/linked-project.json` | JSON | `--linked` existence check before the cache write (see below) | ## Files Written @@ -30,9 +30,8 @@ the result as a table or JSON. ## Environment Variables | Variable | Purpose | -| ----------------------- | ---------------------------------------------------------------------------- | ------------------------------ | +| ----------------------- | ---------------------------------------------------------------------------- | | `SUPABASE_ACCESS_TOKEN` | `--linked` auth | -| `SUPABASE_HOME` | global CLI state root for auth, telemetry, traces, and shared binaries | no (defaults to `~/.supabase`) | | agent-detection signals | `--agent=auto` (e.g. `CURSOR_*`, `CLAUDECODE`, …) via `@vercel/detect-agent` | ## Exit Codes diff --git a/apps/cli/src/legacy/commands/db/remote/changes/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/db/remote/changes/SIDE_EFFECTS.md index 74e1998278..5ac5c8f9fa 100644 --- a/apps/cli/src/legacy/commands/db/remote/changes/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/db/remote/changes/SIDE_EFFECTS.md @@ -2,9 +2,9 @@ ## Files Read -| Path | Format | When | -| --------------------------------------------- | ---------- | ---------------------------------- | -| `/access-token` | plain text | when `SUPABASE_ACCESS_TOKEN` unset | +| Path | Format | When | +| -------------------------- | ---------- | ---------------------------------- | +| `~/.supabase/access-token` | plain text | when `SUPABASE_ACCESS_TOKEN` unset | ## Files Written @@ -20,11 +20,10 @@ ## Environment Variables -| Variable | Purpose | Required? | -| ----------------------- | ---------------------------------------------------------------------- | -------------------------------------------------------------------------- | -| `SUPABASE_ACCESS_TOKEN` | auth token | no (falls back to keyring → `/access-token`) | -| `SUPABASE_HOME` | global CLI state root for auth, telemetry, traces, and shared binaries | no (defaults to `~/.supabase`) | -| `DB_PASSWORD` | password for direct database connection | no | +| Variable | Purpose | Required? | +| ----------------------- | --------------------------------------- | ------------------------------------------------------- | +| `SUPABASE_ACCESS_TOKEN` | auth token | no (falls back to keyring → `~/.supabase/access-token`) | +| `DB_PASSWORD` | password for direct database connection | no | ## Exit Codes diff --git a/apps/cli/src/legacy/commands/db/remote/commit/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/db/remote/commit/SIDE_EFFECTS.md index 97567c5af8..2b2e6ad3d2 100644 --- a/apps/cli/src/legacy/commands/db/remote/commit/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/db/remote/commit/SIDE_EFFECTS.md @@ -2,9 +2,9 @@ ## Files Read -| Path | Format | When | -| --------------------------------------------- | ---------- | ---------------------------------- | -| `/access-token` | plain text | when `SUPABASE_ACCESS_TOKEN` unset | +| Path | Format | When | +| -------------------------- | ---------- | ---------------------------------- | +| `~/.supabase/access-token` | plain text | when `SUPABASE_ACCESS_TOKEN` unset | ## Files Written @@ -20,11 +20,10 @@ ## Environment Variables -| Variable | Purpose | Required? | -| ----------------------- | ---------------------------------------------------------------------- | -------------------------------------------------------------------------- | -| `SUPABASE_ACCESS_TOKEN` | auth token | no (falls back to keyring → `/access-token`) | -| `SUPABASE_HOME` | global CLI state root for auth, telemetry, traces, and shared binaries | no (defaults to `~/.supabase`) | -| `DB_PASSWORD` | password for direct database connection | no | +| Variable | Purpose | Required? | +| ----------------------- | --------------------------------------- | ------------------------------------------------------- | +| `SUPABASE_ACCESS_TOKEN` | auth token | no (falls back to keyring → `~/.supabase/access-token`) | +| `DB_PASSWORD` | password for direct database connection | no | ## Exit Codes diff --git a/apps/cli/src/legacy/commands/db/reset/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/db/reset/SIDE_EFFECTS.md index 73e8a0f0d5..a2c24f24d2 100644 --- a/apps/cli/src/legacy/commands/db/reset/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/db/reset/SIDE_EFFECTS.md @@ -2,11 +2,11 @@ ## Files Read -| Path | Format | When | -| --------------------------------------------- | ---------- | ------------------------------------------------- | -| `/access-token` | plain text | when `SUPABASE_ACCESS_TOKEN` unset and `--linked` | -| `/supabase/migrations/` | directory | always, to load migration files | -| seed files from config | SQL | unless `--no-seed` is set | +| Path | Format | When | +| -------------------------------- | ---------- | ------------------------------------------------- | +| `~/.supabase/access-token` | plain text | when `SUPABASE_ACCESS_TOKEN` unset and `--linked` | +| `/supabase/migrations/` | directory | always, to load migration files | +| seed files from config | SQL | unless `--no-seed` is set | ## Files Written @@ -22,11 +22,10 @@ ## Environment Variables -| Variable | Purpose | Required? | -| ----------------------- | ---------------------------------------------------------------------- | -------------------------------------------------------------------------- | -| `SUPABASE_ACCESS_TOKEN` | auth token for `--linked` mode | no (falls back to keyring → `/access-token`) | -| `SUPABASE_HOME` | global CLI state root for auth, telemetry, traces, and shared binaries | no (defaults to `~/.supabase`) | -| `DB_PASSWORD` | password for direct database connection | no | +| Variable | Purpose | Required? | +| ----------------------- | --------------------------------------- | ------------------------------------------------------- | +| `SUPABASE_ACCESS_TOKEN` | auth token for `--linked` mode | no (falls back to keyring → `~/.supabase/access-token`) | +| `DB_PASSWORD` | password for direct database connection | no | ## Exit Codes diff --git a/apps/cli/src/legacy/commands/db/schema/declarative/generate/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/db/schema/declarative/generate/SIDE_EFFECTS.md index a4c4e5452c..5df90ac1a9 100644 --- a/apps/cli/src/legacy/commands/db/schema/declarative/generate/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/db/schema/declarative/generate/SIDE_EFFECTS.md @@ -13,7 +13,7 @@ pg-delta catalog (source) against the target database's catalog (target). | `/supabase/.temp/postgres-version` | plain text | shadow-DB image resolution (Go seam) | | `/supabase/migrations/*.sql` | SQL | smart mode — detect whether migrations exist | | `/supabase/.temp/pgdelta/*.json` | JSON | catalog cache (read/written by the Go seam) | -| `/access-token` | plain text | `--linked` (token resolution) | +| `~/.supabase/access-token` | plain text | `--linked` (token resolution) | ## Files Written @@ -32,16 +32,15 @@ pg-delta catalog (source) against the target database's catalog (target). ## Environment Variables -| Variable | Purpose | Required? | -| ---------------------------- | ---------------------------------------------------------------------- | ------------------------------ | -| `SUPABASE_ACCESS_TOKEN` | auth token for `--linked` | no | -| `SUPABASE_HOME` | global CLI state root for auth, telemetry, traces, and shared binaries | no (defaults to `~/.supabase`) | -| `DB_PASSWORD` | password for `--linked` / `--db-url` | no | -| `PGDELTA_NPM_REGISTRY` | private `@supabase` npm registry for pg-delta | no | -| `PGDELTA_DEBUG` | verbose pg-delta diagnostics | no | -| `SUPABASE_GO_BINARY` | override the `supabase-go` seam binary | no | -| `SUPABASE_SERVICES_HOSTNAME` | local DB host for `--local` (Go `GetHostname`) | no | -| `DOCKER_HOST` | tcp daemon host used as the local DB host fallback | no | +| Variable | Purpose | Required? | +| ---------------------------- | -------------------------------------------------- | --------- | +| `SUPABASE_ACCESS_TOKEN` | auth token for `--linked` | no | +| `DB_PASSWORD` | password for `--linked` / `--db-url` | no | +| `PGDELTA_NPM_REGISTRY` | private `@supabase` npm registry for pg-delta | no | +| `PGDELTA_DEBUG` | verbose pg-delta diagnostics | no | +| `SUPABASE_GO_BINARY` | override the `supabase-go` seam binary | no | +| `SUPABASE_SERVICES_HOSTNAME` | local DB host for `--local` (Go `GetHostname`) | no | +| `DOCKER_HOST` | tcp daemon host used as the local DB host fallback | no | ## Exit Codes diff --git a/apps/cli/src/legacy/commands/db/test/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/db/test/SIDE_EFFECTS.md index f4bb96ed5a..628a03173c 100644 --- a/apps/cli/src/legacy/commands/db/test/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/db/test/SIDE_EFFECTS.md @@ -2,10 +2,10 @@ ## Files Read -| Path | Format | When | -| --------------------------------------------- | ---------- | ------------------------------------------------- | -| `/access-token` | plain text | when `SUPABASE_ACCESS_TOKEN` unset and `--linked` | -| `[path] ...` (positional) | SQL (TAP) | test files specified as positional arguments | +| Path | Format | When | +| -------------------------- | ---------- | ------------------------------------------------- | +| `~/.supabase/access-token` | plain text | when `SUPABASE_ACCESS_TOKEN` unset and `--linked` | +| `[path] ...` (positional) | SQL (TAP) | test files specified as positional arguments | ## Files Written @@ -21,11 +21,10 @@ ## Environment Variables -| Variable | Purpose | Required? | -| ----------------------- | ---------------------------------------------------------------------- | -------------------------------------------------------------------------- | -| `SUPABASE_ACCESS_TOKEN` | auth token for `--linked` mode | no (falls back to keyring → `/access-token`) | -| `SUPABASE_HOME` | global CLI state root for auth, telemetry, traces, and shared binaries | no (defaults to `~/.supabase`) | -| `DB_PASSWORD` | password for direct database connection | no | +| Variable | Purpose | Required? | +| ----------------------- | --------------------------------------- | ------------------------------------------------------- | +| `SUPABASE_ACCESS_TOKEN` | auth token for `--linked` mode | no (falls back to keyring → `~/.supabase/access-token`) | +| `DB_PASSWORD` | password for direct database connection | no | ## Exit Codes diff --git a/apps/cli/src/legacy/commands/domains/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/domains/SIDE_EFFECTS.md index 45f42c39c2..90660186db 100644 --- a/apps/cli/src/legacy/commands/domains/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/domains/SIDE_EFFECTS.md @@ -6,17 +6,17 @@ Cloudflare DNS-over-HTTPS CNAME pre-check. ## Files Read -| Path | Format | When | -| --------------------------------------------- | ------------------------- | ---------------------------------------------------------- | -| `/access-token` | plain text (token string) | when `SUPABASE_ACCESS_TOKEN` unset and keyring unavailable | -| `/supabase/.temp/project-ref` | plain text | when `--project-ref` flag and `PROJECT_ID` env are unset | +| Path | Format | When | +| -------------------------------------- | ------------------------- | ---------------------------------------------------------- | +| `~/.supabase/access-token` | plain text (token string) | when `SUPABASE_ACCESS_TOKEN` unset and keyring unavailable | +| `/supabase/.temp/project-ref` | plain text | when `--project-ref` flag and `PROJECT_ID` env are unset | ## Files Written -| Path | Format | When | -| ----------------------------------------------- | ------ | -------------------------------------------------- | -| `/supabase/.temp/linked-project.json` | JSON | always (PersistentPostRun), after the ref resolves | -| `/telemetry.json` | JSON | always (PersistentPostRun), success or failure | +| Path | Format | When | +| ------------------------------------------------ | ------ | -------------------------------------------------- | +| `~/.supabase//linked-project.json` | JSON | always (PersistentPostRun), after the ref resolves | +| `~/.supabase/telemetry.json` | JSON | always (PersistentPostRun), success or failure | ## API Routes @@ -31,12 +31,11 @@ Cloudflare DNS-over-HTTPS CNAME pre-check. ## Environment Variables -| Variable | Purpose | Required? | -| ----------------------- | ---------------------------------------------------------------------- | -------------------------------------------------------------------------- | -| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `/access-token`) | -| `SUPABASE_HOME` | global CLI state root for auth, telemetry, traces, and shared binaries | no (defaults to `~/.supabase`) | -| `SUPABASE_PROJECT_ID` | project ref fallback when `--project-ref` is unset | no (falls back to linked-project file) | -| `SUPABASE_PROFILE` | built-in profile name or path to a YAML profile | no (defaults to `supabase`; sets API URL + project host) | +| Variable | Purpose | Required? | +| ----------------------- | ---------------------------------------------------- | -------------------------------------------------------- | +| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `~/.supabase/access-token`) | +| `SUPABASE_PROJECT_ID` | project ref fallback when `--project-ref` is unset | no (falls back to linked-project file) | +| `SUPABASE_PROFILE` | built-in profile name or path to a YAML profile | no (defaults to `supabase`; sets API URL + project host) | ## Exit Codes diff --git a/apps/cli/src/legacy/commands/encryption/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/encryption/SIDE_EFFECTS.md index 3d74f4dfbc..458b7aeb86 100644 --- a/apps/cli/src/legacy/commands/encryption/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/encryption/SIDE_EFFECTS.md @@ -6,18 +6,18 @@ additionally reads the new key from stdin. ## Files Read -| Path | Format | When | -| ---------------------------------------------- | ------------------------- | ------------------------------------------------------------------ | -| `/access-token` | plain text (token string) | when `SUPABASE_ACCESS_TOKEN` unset and keyring unavailable | -| `/supabase/.temp/linked-project.json` | JSON | when `--project-ref` / `PROJECT_ID` unset, to resolve linked ref | -| stdin | raw bytes / masked TTY | `update-root-key` only — masked TTY input or piped bytes (the key) | +| Path | Format | When | +| ------------------------------------------------ | ------------------------- | ------------------------------------------------------------------ | +| `~/.supabase/access-token` | plain text (token string) | when `SUPABASE_ACCESS_TOKEN` unset and keyring unavailable | +| `~/.supabase//linked-project.json` | JSON | when `--project-ref` / `PROJECT_ID` unset, to resolve linked ref | +| stdin | raw bytes / masked TTY | `update-root-key` only — masked TTY input or piped bytes (the key) | ## Files Written -| Path | Format | When | -| ----------------------------------------------- | ------ | ------------------------------------------------- | -| `/supabase/.temp/linked-project.json` | JSON | PersistentPostRun, after the project ref resolves | -| `/telemetry.json` | JSON | PersistentPostRun, on success or failure | +| Path | Format | When | +| ------------------------------------------------ | ------ | ------------------------------------------------- | +| `~/.supabase//linked-project.json` | JSON | PersistentPostRun, after the project ref resolves | +| `~/.supabase/telemetry.json` | JSON | PersistentPostRun, on success or failure | ## API Routes @@ -30,13 +30,12 @@ additionally reads the new key from stdin. ## Environment Variables -| Variable | Purpose | Required? | -| ------------------------------------ | ---------------------------------------------------------------------- | -------------------------------------------------------------------------- | -| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `/access-token`) | -| `SUPABASE_HOME` | global CLI state root for auth, telemetry, traces, and shared binaries | no (defaults to `~/.supabase`) | -| `SUPABASE_PROJECT_ID` / `PROJECT_ID` | project ref (fallback when `--project-ref` unset) | no (falls back to linked-project file → prompt) | -| `SUPABASE_API_URL` | override Management API base URL | no (defaults to `https://api.supabase.com`) | -| `SUPABASE_PROFILE` | built-in profile name or YAML file path | no (defaults to `supabase`) | +| Variable | Purpose | Required? | +| ------------------------------------ | ---------------------------------------------------- | ------------------------------------------------------- | +| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `~/.supabase/access-token`) | +| `SUPABASE_PROJECT_ID` / `PROJECT_ID` | project ref (fallback when `--project-ref` unset) | no (falls back to linked-project file → prompt) | +| `SUPABASE_API_URL` | override Management API base URL | no (defaults to `https://api.supabase.com`) | +| `SUPABASE_PROFILE` | built-in profile name or YAML file path | no (defaults to `supabase`) | ## Exit Codes diff --git a/apps/cli/src/legacy/commands/functions/delete/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/functions/delete/SIDE_EFFECTS.md index b5f2fb7b2a..f3914b1b22 100644 --- a/apps/cli/src/legacy/commands/functions/delete/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/functions/delete/SIDE_EFFECTS.md @@ -2,9 +2,9 @@ ## Files Read -| Path | Format | When | -| --------------------------------------------- | ---------- | ---------------------------------------------------------- | -| `/access-token` | plain text | when `SUPABASE_ACCESS_TOKEN` unset and keyring unavailable | +| Path | Format | When | +| -------------------------- | ---------- | ---------------------------------------------------------- | +| `~/.supabase/access-token` | plain text | when `SUPABASE_ACCESS_TOKEN` unset and keyring unavailable | ## Files Written @@ -20,11 +20,10 @@ ## Environment Variables -| Variable | Purpose | Required? | -| ----------------------- | ---------------------------------------------------------------------- | -------------------------------------------------------------------------- | -| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `/access-token`) | -| `SUPABASE_HOME` | global CLI state root for auth, telemetry, traces, and shared binaries | no (defaults to `~/.supabase`) | -| `SUPABASE_API_URL` | override Management API base URL | no (defaults to `https://api.supabase.com`) | +| Variable | Purpose | Required? | +| ----------------------- | ---------------------------------------------------- | ------------------------------------------------------- | +| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `~/.supabase/access-token`) | +| `SUPABASE_API_URL` | override Management API base URL | no (defaults to `https://api.supabase.com`) | ## Exit Codes diff --git a/apps/cli/src/legacy/commands/functions/deploy/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/functions/deploy/SIDE_EFFECTS.md index 038486b5d5..caa742cc89 100644 --- a/apps/cli/src/legacy/commands/functions/deploy/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/functions/deploy/SIDE_EFFECTS.md @@ -4,7 +4,7 @@ | Path | Format | When | | ---------------------------------------------- | ---------- | ----------------------------------------------------------- | -| `/access-token` | plain text | when `SUPABASE_ACCESS_TOKEN` unset and keyring unavailable | +| `~/.supabase/access-token` | plain text | when `SUPABASE_ACCESS_TOKEN` unset and keyring unavailable | | `/supabase/config.toml` | TOML | to resolve function config, project id, and local Functions | | `/supabase/functions//index.ts` | TypeScript | function source to deploy | | `/supabase/functions/**/deno.json*` | JSON/JSONC | when resolving import maps | @@ -43,14 +43,13 @@ Docker bundling may pull or run the configured edge-runtime image and uses the ## Environment Variables -| Variable | Purpose | Required? | -| ---------------------------------- | ---------------------------------------------------------------------- | -------------------------------------------------------------------------- | -| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `/access-token`) | -| `SUPABASE_HOME` | global CLI state root for auth, telemetry, traces, and shared binaries | no (defaults to `~/.supabase`) | -| `SUPABASE_PROJECT_ID` | optional project ref fallback | no | -| `SUPABASE_INTERNAL_IMAGE_REGISTRY` | selects the Functions bundler image registry | no | -| `NPM_CONFIG_REGISTRY` | forwarded into Docker bundling when set | no | -| `DEBUG` | enables verbose Docker bundle output when `true` | no | +| Variable | Purpose | Required? | +| ---------------------------------- | ---------------------------------------------------- | ------------------------------------------------------- | +| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `~/.supabase/access-token`) | +| `SUPABASE_PROJECT_ID` | optional project ref fallback | no | +| `SUPABASE_INTERNAL_IMAGE_REGISTRY` | selects the Functions bundler image registry | no | +| `NPM_CONFIG_REGISTRY` | forwarded into Docker bundling when set | no | +| `DEBUG` | enables verbose Docker bundle output when `true` | no | ## Exit Codes diff --git a/apps/cli/src/legacy/commands/functions/download/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/functions/download/SIDE_EFFECTS.md index 03a98a3022..7a70bcb517 100644 --- a/apps/cli/src/legacy/commands/functions/download/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/functions/download/SIDE_EFFECTS.md @@ -2,9 +2,9 @@ ## Files Read -| Path | Format | When | -| --------------------------------------------- | ---------- | ---------------------------------------------------------- | -| `/access-token` | plain text | when `SUPABASE_ACCESS_TOKEN` unset and keyring unavailable | +| Path | Format | When | +| -------------------------- | ---------- | ---------------------------------------------------------- | +| `~/.supabase/access-token` | plain text | when `SUPABASE_ACCESS_TOKEN` unset and keyring unavailable | ## Files Written @@ -28,11 +28,10 @@ ## Environment Variables -| Variable | Purpose | Required? | -| ----------------------- | ---------------------------------------------------------------------- | -------------------------------------------------------------------------- | -| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `/access-token`) | -| `SUPABASE_HOME` | global CLI state root for auth, telemetry, traces, and shared binaries | no (defaults to `~/.supabase`) | -| `SUPABASE_API_URL` | override Management API base URL | no (defaults to `https://api.supabase.com`) | +| Variable | Purpose | Required? | +| ----------------------- | ---------------------------------------------------- | ------------------------------------------------------- | +| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `~/.supabase/access-token`) | +| `SUPABASE_API_URL` | override Management API base URL | no (defaults to `https://api.supabase.com`) | ## Exit Codes diff --git a/apps/cli/src/legacy/commands/functions/list/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/functions/list/SIDE_EFFECTS.md index 568801f170..e725372ecc 100644 --- a/apps/cli/src/legacy/commands/functions/list/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/functions/list/SIDE_EFFECTS.md @@ -2,9 +2,9 @@ ## Files Read -| Path | Format | When | -| --------------------------------------------- | ---------- | ---------------------------------------------------------- | -| `/access-token` | plain text | when `SUPABASE_ACCESS_TOKEN` unset and keyring unavailable | +| Path | Format | When | +| -------------------------- | ---------- | ---------------------------------------------------------- | +| `~/.supabase/access-token` | plain text | when `SUPABASE_ACCESS_TOKEN` unset and keyring unavailable | ## Files Written @@ -20,11 +20,10 @@ ## Environment Variables -| Variable | Purpose | Required? | -| ----------------------- | ---------------------------------------------------------------------- | -------------------------------------------------------------------------- | -| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `/access-token`) | -| `SUPABASE_HOME` | global CLI state root for auth, telemetry, traces, and shared binaries | no (defaults to `~/.supabase`) | -| `SUPABASE_API_URL` | override Management API base URL | no (defaults to `https://api.supabase.com`) | +| Variable | Purpose | Required? | +| ----------------------- | ---------------------------------------------------- | ------------------------------------------------------- | +| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `~/.supabase/access-token`) | +| `SUPABASE_API_URL` | override Management API base URL | no (defaults to `https://api.supabase.com`) | ## Exit Codes diff --git a/apps/cli/src/legacy/commands/gen/keys/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/gen/keys/SIDE_EFFECTS.md index 2cde984719..325e8d58ed 100644 --- a/apps/cli/src/legacy/commands/gen/keys/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/gen/keys/SIDE_EFFECTS.md @@ -20,11 +20,10 @@ ## Environment Variables -| Variable | Purpose | Required? | -| ----------------------- | ---------------------------------------------------------------------- | -------------------------------------------------------------------------- | -| `SUPABASE_ACCESS_TOKEN` | auth token | no (falls back to keyring → `/access-token`) | -| `SUPABASE_HOME` | global CLI state root for auth, telemetry, traces, and shared binaries | no (defaults to `~/.supabase`) | -| `SUPABASE_API_URL` | override Management API base URL | no (defaults to `https://api.supabase.com`) | +| Variable | Purpose | Required? | +| ----------------------- | -------------------------------- | ------------------------------------------------------- | +| `SUPABASE_ACCESS_TOKEN` | auth token | no (falls back to keyring → `~/.supabase/access-token`) | +| `SUPABASE_API_URL` | override Management API base URL | no (defaults to `https://api.supabase.com`) | ## Exit Codes diff --git a/apps/cli/src/legacy/commands/gen/types/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/gen/types/SIDE_EFFECTS.md index 264d71484d..fbfc293fa2 100644 --- a/apps/cli/src/legacy/commands/gen/types/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/gen/types/SIDE_EFFECTS.md @@ -2,12 +2,12 @@ ## Files Read -| Path | Format | When | -| --------------------------------------------- | ---------- | ---------------------------------------------------------------------------------------- | -| `/access-token` | plain text | when `SUPABASE_ACCESS_TOKEN` unset and `--linked` or `--project-id` | -| `/supabase/config.toml` | TOML | when `--local` (required) or `--db-url` (best-effort) is specified | -| `/supabase/.temp/rest-version` | plain text | `--local` only, when `db.major_version > 14` — forces v9 compat if the tag contains `v9` | -| `/supabase/.temp/pgmeta-version` | plain text | `--local` only — overrides the pg-meta docker image tag | +| Path | Format | When | +| ----------------------------------------- | ---------- | ---------------------------------------------------------------------------------------- | +| `~/.supabase/access-token` | plain text | when `SUPABASE_ACCESS_TOKEN` unset and `--linked` or `--project-id` | +| `/supabase/config.toml` | TOML | when `--local` (required) or `--db-url` (best-effort) is specified | +| `/supabase/.temp/rest-version` | plain text | `--local` only, when `db.major_version > 14` — forces v9 compat if the tag contains `v9` | +| `/supabase/.temp/pgmeta-version` | plain text | `--local` only — overrides the pg-meta docker image tag | ## Files Written @@ -40,15 +40,14 @@ detect TLS support before launching pg-meta (mirrors Go's `isRequireSSL`). ## Environment Variables -| Variable | Purpose | Required? | -| ---------------------------------- | ---------------------------------------------------------------------- | -------------------------------------------------------------------------- | -| `SUPABASE_ACCESS_TOKEN` | auth token for linked/project-id mode | no (falls back to keyring → `/access-token`) | -| `SUPABASE_HOME` | global CLI state root for auth, telemetry, traces, and shared binaries | no (defaults to `~/.supabase`) | -| `SUPABASE_API_URL` | override Management API base URL | no (defaults to `https://api.supabase.com`) | -| `SUPABASE_DB_PASSWORD` | local database password for `--local` | no (defaults to `postgres`) | -| `SUPABASE_SERVICES_HOSTNAME` | host used for the local TLS probe | no (defaults to `127.0.0.1`) | -| `SUPABASE_INTERNAL_IMAGE_REGISTRY` | pg-meta image registry override (`docker.io` → Docker Hub) | no (defaults to the ECR registry) | -| `SUPABASE_CA_SKIP_VERIFY` | when `true`, prints a TLS-verification-disabled warning to stderr | no | +| Variable | Purpose | Required? | +| ---------------------------------- | ----------------------------------------------------------------- | ------------------------------------------------------- | +| `SUPABASE_ACCESS_TOKEN` | auth token for linked/project-id mode | no (falls back to keyring → `~/.supabase/access-token`) | +| `SUPABASE_API_URL` | override Management API base URL | no (defaults to `https://api.supabase.com`) | +| `SUPABASE_DB_PASSWORD` | local database password for `--local` | no (defaults to `postgres`) | +| `SUPABASE_SERVICES_HOSTNAME` | host used for the local TLS probe | no (defaults to `127.0.0.1`) | +| `SUPABASE_INTERNAL_IMAGE_REGISTRY` | pg-meta image registry override (`docker.io` → Docker Hub) | no (defaults to the ECR registry) | +| `SUPABASE_CA_SKIP_VERIFY` | when `true`, prints a TLS-verification-disabled warning to stderr | no | ## Exit Codes diff --git a/apps/cli/src/legacy/commands/inspect/db/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/inspect/db/SIDE_EFFECTS.md index e6896162d9..f5728c86be 100644 --- a/apps/cli/src/legacy/commands/inspect/db/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/inspect/db/SIDE_EFFECTS.md @@ -8,12 +8,12 @@ SQL run and the columns rendered (see the per-subcommand `.query.ts`). ## Files Read -| Path | Format | When | -| --------------------------------------------- | ---------- | ----------------------------------------------------------------------------------- | -| `/supabase/config.toml` | TOML | `--local` (db host/port/password); `--linked` (project ref) | -| `/access-token` | plain text | `--linked` only, lazily, when `SUPABASE_ACCESS_TOKEN` unset and keyring unavailable | -| `.pgpass` / `pg_service.conf` | libpq | only if referenced by a `--db-url` connection string | -| `$PGSSLROOTCERT` CA bundle | PEM | only if a `--db-url` sets `sslrootcert` / `PGSSLROOTCERT` | +| Path | Format | When | +| -------------------------------- | ---------- | ----------------------------------------------------------------------------------- | +| `/supabase/config.toml` | TOML | `--local` (db host/port/password); `--linked` (project ref) | +| `~/.supabase/access-token` | plain text | `--linked` only, lazily, when `SUPABASE_ACCESS_TOKEN` unset and keyring unavailable | +| `.pgpass` / `pg_service.conf` | libpq | only if referenced by a `--db-url` connection string | +| `$PGSSLROOTCERT` CA bundle | PEM | only if a `--db-url` sets `sslrootcert` / `PGSSLROOTCERT` | Connection resolution and all of the above are handled inside the already-ported `LegacyDbConfigResolver` (`legacy/shared/legacy-db-config.layer.ts`); this port adds @@ -21,9 +21,9 @@ no new config reads. ## Files Written -| Path | Format | When | -| ----------------------------------------------- | ------ | ----------------------------------------------- | -| `/telemetry.json` | JSON | always, post-run (`LegacyTelemetryState.flush`) | +| Path | Format | When | +| ---------------------------- | ------ | ----------------------------------------------- | +| `~/.supabase/telemetry.json` | JSON | always, post-run (`LegacyTelemetryState.flush`) | ## API Routes (MAY fire on `--linked`, inside the resolver) @@ -36,13 +36,12 @@ no new config reads. ## Environment Variables -| Variable | Purpose | Required? | -| ---------------------------------------------------- | ---------------------------------------------------------------------- | --------------------------------------- | -| `SUPABASE_DB_PASSWORD` / `DB_PASSWORD` | database password (linked/local) | no (prompts / config fallback) | -| `SUPABASE_ACCESS_TOKEN` | Management API auth (linked only) | no (falls back to keyring / token file) | -| `SUPABASE_HOME` | global CLI state root for auth, telemetry, traces, and shared binaries | no (defaults to `~/.supabase`) | -| `PROJECT_ID` | project ref fallback (linked) | no (config resolution fallback) | -| libpq vars (`PGSSLROOTCERT`, `PGCONNECT_TIMEOUT`, …) | honored when `--db-url` is used | no | +| Variable | Purpose | Required? | +| ---------------------------------------------------- | --------------------------------- | --------------------------------------- | +| `SUPABASE_DB_PASSWORD` / `DB_PASSWORD` | database password (linked/local) | no (prompts / config fallback) | +| `SUPABASE_ACCESS_TOKEN` | Management API auth (linked only) | no (falls back to keyring / token file) | +| `PROJECT_ID` | project ref fallback (linked) | no (config resolution fallback) | +| libpq vars (`PGSSLROOTCERT`, `PGCONNECT_TIMEOUT`, …) | honored when `--db-url` is used | no | ## Database Queries diff --git a/apps/cli/src/legacy/commands/inspect/report/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/inspect/report/SIDE_EFFECTS.md index 843939dcb6..7aa35d483f 100644 --- a/apps/cli/src/legacy/commands/inspect/report/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/inspect/report/SIDE_EFFECTS.md @@ -12,7 +12,7 @@ validating those CSVs. Native TypeScript port of `apps/cli-go/internal/inspect/r | `/supabase/.env*` (nested) | dotenv | always — `env(VAR)` expansion for `[db]` and rule string fields | | `/supabase/.temp/pooler-url` | plain text | `--linked` path (pooler connection string) | | `/supabase/.temp/linked-project.json` | JSON | `--linked` path (resolve linked project ref) | -| `/access-token` | plain text | `--linked` path, when `SUPABASE_ACCESS_TOKEN` unset and keyring unavailable | +| `~/.supabase/access-token` | plain text | `--linked` path, when `SUPABASE_ACCESS_TOKEN` unset and keyring unavailable | | `//.csv` ×14 | CSV | read back in-memory for rule evaluation | `config.toml` policy mirrors Go: a **missing** file is fine (defaults apply); a @@ -20,12 +20,12 @@ validating those CSVs. Native TypeScript port of `apps/cli-go/internal/inspect/r ## Files Written -| Path | Mode | When | -| ----------------------------------------------- | ---- | --------------------------------------------------------------- | -| `//` (directory) | 0755 | always — created recursively | -| `//.csv` ×14 | 0644 | always — one CSV per inspect query (server-side `COPY ... CSV`) | -| `/telemetry.json` | — | always (telemetry flush) | -| `/supabase/.temp/linked-project.json` | — | `--linked` path (linked-project cache) | +| Path | Mode | When | +| ------------------------------------------------ | ---- | --------------------------------------------------------------- | +| `//` (directory) | 0755 | always — created recursively | +| `//.csv` ×14 | 0644 | always — one CSV per inspect query (server-side `COPY ... CSV`) | +| `~/.supabase/telemetry.json` | — | always (telemetry flush) | +| `~/.supabase//linked-project.json` | — | `--linked` path (linked-project cache) | The 14 CSV basenames (underscored, matching Go's SQL filenames — **not** the `inspect db` command names): `bloat`, `blocking`, `calls`, `db_stats`, @@ -54,13 +54,12 @@ resolve the connection (via `LegacyDbConfigResolver`). ## Environment Variables -| Variable | Purpose | Required? | -| ----------------------- | ---------------------------------------------------------------------- | ------------------------------ | -| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no | -| `SUPABASE_HOME` | global CLI state root for auth, telemetry, traces, and shared binaries | no (defaults to `~/.supabase`) | -| `SUPABASE_API_URL` | override Management API base URL | no | -| `SUPABASE_DB_*` | override `[db]` port / shadow_port / password | no | -| `SUPABASE_ENV` | selects which project `.env` files load | no | +| Variable | Purpose | Required? | +| ----------------------- | ---------------------------------------------------- | --------- | +| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no | +| `SUPABASE_API_URL` | override Management API base URL | no | +| `SUPABASE_DB_*` | override `[db]` port / shadow_port / password | no | +| `SUPABASE_ENV` | selects which project `.env` files load | no | ## Exit Codes diff --git a/apps/cli/src/legacy/commands/link/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/link/SIDE_EFFECTS.md index 92ee008055..dab9fddf79 100644 --- a/apps/cli/src/legacy/commands/link/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/link/SIDE_EFFECTS.md @@ -5,10 +5,10 @@ Native TypeScript port of Go's `internal/link`. Writes flat state files under ## Files Read -| Path | Format | When | -| --------------------------------------------- | ------------------- | ------------------------------------------------------------------------------------------------- | -| `supabase/config.toml` | TOML (`project_id`) | for ref resolution when `--project-ref` / `SUPABASE_PROJECT_ID` are unset (via `LegacyCliConfig`) | -| `/access-token` | plain text | when `SUPABASE_ACCESS_TOKEN` is unset and the keyring is unavailable | +| Path | Format | When | +| -------------------------- | ------------------- | ------------------------------------------------------------------------------------------------- | +| `supabase/config.toml` | TOML (`project_id`) | for ref resolution when `--project-ref` / `SUPABASE_PROJECT_ID` are unset (via `LegacyCliConfig`) | +| `~/.supabase/access-token` | plain text | when `SUPABASE_ACCESS_TOKEN` is unset and the keyring is unavailable | > The on-disk `supabase/.temp/project-ref` file is **not** read for ref resolution — Go passes an > empty in-memory FS to `ParseProjectRef` (`cmd/link.go:30`), so `link` never falls back to it. @@ -55,10 +55,9 @@ Tenant service gateway (`https://.`, `apikey: ` + ## Environment Variables | Variable | Purpose | -| ----------------------- | ---------------------------------------------------------------------------------------------------------------------------- | ------------------------------ | +| ----------------------- | ---------------------------------------------------------------------------------------------------------------------------- | | `SUPABASE_PROJECT_ID` | project-ref resolution (flag → env → TTY prompt) | -| `SUPABASE_ACCESS_TOKEN` | Management API bearer auth (env → keyring → `/access-token`) | -| `SUPABASE_HOME` | global CLI state root for auth, telemetry, traces, and shared binaries | no (defaults to `~/.supabase`) | +| `SUPABASE_ACCESS_TOKEN` | Management API bearer auth (env → keyring → `~/.supabase/access-token`) | | `SUPABASE_DB_PASSWORD` | bound to `--password`; **accepted but a no-op** for `link` (the DB-connection path that would consume it is dead code in Go) | ## Exit Codes diff --git a/apps/cli/src/legacy/commands/login/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/login/SIDE_EFFECTS.md index 5687e6586d..ef6af8dcdb 100644 --- a/apps/cli/src/legacy/commands/login/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/login/SIDE_EFFECTS.md @@ -5,19 +5,19 @@ stitches/clears the telemetry identity and captures `cli_login_completed`. ## Files Read -| Path | Format | When | -| ---------------------------------------------------------- | ------------------------- | -------------------------------------------------------------------------- | -| stdin | plain text (token string) | non-TTY only, when `--token` is unset and `SUPABASE_ACCESS_TOKEN` is unset | -| OS keyring / `/access-token` | token string | written, not read, on the login path | +| Path | Format | When | +| --------------------------------------- | ------------------------- | -------------------------------------------------------------------------- | +| stdin | plain text (token string) | non-TTY only, when `--token` is unset and `SUPABASE_ACCESS_TOKEN` is unset | +| OS keyring / `~/.supabase/access-token` | token string | written, not read, on the login path | ## Files Written | Path | Format | When | | ----------------------------------------------- | ------------------------- | -------------------------------------------------------------------------------------------------------------------------------------- | | OS keyring (`Supabase CLI` / profile) | token string | always on success when the keyring is available | -| `/access-token` | plain text (mode `0600`) | on success when the keyring is unavailable (WSL / `SUPABASE_NO_KEYRING`) | +| `~/.supabase/access-token` | plain text (mode `0600`) | on success when the keyring is unavailable (WSL / `SUPABASE_NO_KEYRING`) | | `/telemetry.json` | JSON | always (PersistentPostRun flush); `distinct_id` set on stitch, removed on clear | -| `/profile` | plain text (profile name) | on success only, when a profile is explicitly set (`--profile` ≠ default, else `SUPABASE_PROFILE`) — Go's `PostRunE`/`SaveProfileName` | +| `~/.supabase/profile` | plain text (profile name) | on success only, when a profile is explicitly set (`--profile` ≠ default, else `SUPABASE_PROFILE`) — Go's `PostRunE`/`SaveProfileName` | ## API Routes @@ -29,23 +29,22 @@ stitches/clears the telemetry identity and captures `cli_login_completed`. ## Environment Variables -| Variable | Purpose | Required? | -| ---------------------------------------------- | ---------------------------------------------------------------------- | --------------------------------------------------------- | -| `SUPABASE_ACCESS_TOKEN` | non-interactive token source | no (falls back to `--token` → piped stdin → browser flow) | -| `SUPABASE_HOME` | global CLI state root for auth, telemetry, traces, and shared binaries | no (defaults to `~/.supabase`) | -| `SUPABASE_NO_KEYRING` | disables the OS keyring, forcing the file fallback | no | -| `CLAUDECODE` / `CLAUDE_CODE` | enables the Claude Code plugin hint (TTY stdout only) | no | -| `DO_NOT_TRACK` / `SUPABASE_TELEMETRY_DISABLED` | suppress analytics delivery (state file still written) | no | +| Variable | Purpose | Required? | +| ---------------------------------------------- | ------------------------------------------------------ | --------------------------------------------------------- | +| `SUPABASE_ACCESS_TOKEN` | non-interactive token source | no (falls back to `--token` → piped stdin → browser flow) | +| `SUPABASE_NO_KEYRING` | disables the OS keyring, forcing the file fallback | no | +| `CLAUDECODE` / `CLAUDE_CODE` | enables the Claude Code plugin hint (TTY stdout only) | no | +| `DO_NOT_TRACK` / `SUPABASE_TELEMETRY_DISABLED` | suppress analytics delivery (state file still written) | no | ## Exit Codes -| Code | Condition | -| ---- | -------------------------------------------------------------------------------------------------------------- | -| `0` | success (token path or browser path) | -| `1` | invalid `--token` (`cannot save provided token: …`) | -| `1` | non-TTY with no token (`Cannot use automatic login flow inside non-TTY environments. …`) | -| `1` | keygen failure, verification retries exhausted, or decryption failure (browser path) | -| `1` | failure to persist `/profile` (Go blocks subsequent CI commands on save failure) | +| Code | Condition | +| ---- | ------------------------------------------------------------------------------------------- | +| `0` | success (token path or browser path) | +| `1` | invalid `--token` (`cannot save provided token: …`) | +| `1` | non-TTY with no token (`Cannot use automatic login flow inside non-TTY environments. …`) | +| `1` | keygen failure, verification retries exhausted, or decryption failure (browser path) | +| `1` | failure to persist `~/.supabase/profile` (Go blocks subsequent CI commands on save failure) | Browser-open failure is non-fatal (logged, ignored — `login.go:206-208`). @@ -80,5 +79,5 @@ are suppressed. Interactive prompts (browser path) fail with `NonInteractiveErro - Token resolution priority: `--token` → `SUPABASE_ACCESS_TOKEN` → piped stdin (non-TTY) → browser flow (TTY). - The login-session query string is built without URL-encoding, matching Go (`login.go:197-198`). - Telemetry stitch always replaces a stale `distinct_id` (Go's `StitchLogin`), independent of the platform-API auto-stitch. The stitch _aliases_ only — Go's login never calls `identify`. -- On success, an explicitly-set profile is persisted to `/profile` (Go's `PostRunE`); `LegacyCliConfig` reads it back as the lowest-precedence profile source. +- On success, an explicitly-set profile is persisted to `~/.supabase/profile` (Go's `PostRunE`); `LegacyCliConfig` reads it back as the lowest-precedence profile source. - Aqua/Bold styling from Go renders as plain text (parity on a non-TTY). diff --git a/apps/cli/src/legacy/commands/logout/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/logout/SIDE_EFFECTS.md index 31f0b31911..292843f8f9 100644 --- a/apps/cli/src/legacy/commands/logout/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/logout/SIDE_EFFECTS.md @@ -5,15 +5,15 @@ sweeps all stored project credentials. Makes no API calls. ## Files Read -| Path | Format | When | -| --------------------------------------------- | ------------------------- | ---------------------------------------------------- | -| `/access-token` | plain text (token string) | existence is checked before removal (no token parse) | +| Path | Format | When | +| -------------------------- | ------------------------- | ---------------------------------------------------- | +| `~/.supabase/access-token` | plain text (token string) | existence is checked before removal (no token parse) | ## Files Written | Path | Format | When | | ----------------------------------------------- | ------ | ---------------------------------------------------------------------------- | -| `/access-token` | — | deleted first, always (a missing file is ignored) | +| `~/.supabase/access-token` | — | deleted first, always (a missing file is ignored) | | OS keyring (`Supabase CLI` namespace) | — | the access-token entries **and** all project DB-password entries are deleted | | `/telemetry.json` | JSON | always (PersistentPostRun flush) | @@ -25,11 +25,10 @@ sweeps all stored project credentials. Makes no API calls. ## Environment Variables -| Variable | Purpose | Required? | -| ---------------------- | ---------------------------------------------------------------------- | ------------------------------ | -| `SUPABASE_HOME` | global CLI state root for auth, telemetry, traces, and shared binaries | no (defaults to `~/.supabase`) | -| `SUPABASE_YES`/`--yes` | auto-confirm the logout prompt | no | -| `SUPABASE_NO_KEYRING` | disables the OS keyring (forces the file fallback) | no | +| Variable | Purpose | Required? | +| ---------------------- | -------------------------------------------------- | --------- | +| `SUPABASE_YES`/`--yes` | auto-confirm the logout prompt | no | +| `SUPABASE_NO_KEYRING` | disables the OS keyring (forces the file fallback) | no | ## Exit Codes diff --git a/apps/cli/src/legacy/commands/migration/down/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/migration/down/SIDE_EFFECTS.md index 17d93ab902..acd5efd4b0 100644 --- a/apps/cli/src/legacy/commands/migration/down/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/migration/down/SIDE_EFFECTS.md @@ -2,10 +2,10 @@ ## Files Read -| Path | Format | When | -| --------------------------------------------- | ---------- | ------------------------------------------------- | -| `/supabase/migrations/` | directory | always, to read migration files | -| `/access-token` | plain text | when `SUPABASE_ACCESS_TOKEN` unset and `--linked` | +| Path | Format | When | +| -------------------------------- | ---------- | ------------------------------------------------- | +| `/supabase/migrations/` | directory | always, to read migration files | +| `~/.supabase/access-token` | plain text | when `SUPABASE_ACCESS_TOKEN` unset and `--linked` | ## Files Written @@ -21,10 +21,9 @@ ## Environment Variables -| Variable | Purpose | Required? | -| ----------------------- | ---------------------------------------------------------------------- | -------------------------------------------------------------------------- | -| `SUPABASE_ACCESS_TOKEN` | auth token for `--linked` mode | no (falls back to keyring → `/access-token`) | -| `SUPABASE_HOME` | global CLI state root for auth, telemetry, traces, and shared binaries | no (defaults to `~/.supabase`) | +| Variable | Purpose | Required? | +| ----------------------- | ------------------------------ | ------------------------------------------------------- | +| `SUPABASE_ACCESS_TOKEN` | auth token for `--linked` mode | no (falls back to keyring → `~/.supabase/access-token`) | ## Exit Codes diff --git a/apps/cli/src/legacy/commands/migration/fetch/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/migration/fetch/SIDE_EFFECTS.md index 44e48d3f93..5b7da97b12 100644 --- a/apps/cli/src/legacy/commands/migration/fetch/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/migration/fetch/SIDE_EFFECTS.md @@ -2,9 +2,9 @@ ## Files Read -| Path | Format | When | -| --------------------------------------------- | ---------- | ------------------------------------------------- | -| `/access-token` | plain text | when `SUPABASE_ACCESS_TOKEN` unset and `--linked` | +| Path | Format | When | +| -------------------------- | ---------- | ------------------------------------------------- | +| `~/.supabase/access-token` | plain text | when `SUPABASE_ACCESS_TOKEN` unset and `--linked` | ## Files Written @@ -20,10 +20,9 @@ ## Environment Variables -| Variable | Purpose | Required? | -| ----------------------- | ---------------------------------------------------------------------- | -------------------------------------------------------------------------- | -| `SUPABASE_ACCESS_TOKEN` | auth token for `--linked` mode | no (falls back to keyring → `/access-token`) | -| `SUPABASE_HOME` | global CLI state root for auth, telemetry, traces, and shared binaries | no (defaults to `~/.supabase`) | +| Variable | Purpose | Required? | +| ----------------------- | ------------------------------ | ------------------------------------------------------- | +| `SUPABASE_ACCESS_TOKEN` | auth token for `--linked` mode | no (falls back to keyring → `~/.supabase/access-token`) | ## Exit Codes diff --git a/apps/cli/src/legacy/commands/migration/list/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/migration/list/SIDE_EFFECTS.md index e449e32430..f4489b05f6 100644 --- a/apps/cli/src/legacy/commands/migration/list/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/migration/list/SIDE_EFFECTS.md @@ -2,10 +2,10 @@ ## Files Read -| Path | Format | When | -| --------------------------------------------- | ---------- | ------------------------------------------------- | -| `/access-token` | plain text | when `SUPABASE_ACCESS_TOKEN` unset and `--linked` | -| `/supabase/migrations/` | directory | always, to list local migration files | +| Path | Format | When | +| -------------------------------- | ---------- | ------------------------------------------------- | +| `~/.supabase/access-token` | plain text | when `SUPABASE_ACCESS_TOKEN` unset and `--linked` | +| `/supabase/migrations/` | directory | always, to list local migration files | ## Files Written @@ -21,11 +21,10 @@ ## Environment Variables -| Variable | Purpose | Required? | -| ----------------------- | ---------------------------------------------------------------------- | -------------------------------------------------------------------------- | -| `SUPABASE_ACCESS_TOKEN` | auth token for `--linked` mode | no (falls back to keyring → `/access-token`) | -| `SUPABASE_HOME` | global CLI state root for auth, telemetry, traces, and shared binaries | no (defaults to `~/.supabase`) | -| `DB_PASSWORD` | password for direct database connection | no | +| Variable | Purpose | Required? | +| ----------------------- | --------------------------------------- | ------------------------------------------------------- | +| `SUPABASE_ACCESS_TOKEN` | auth token for `--linked` mode | no (falls back to keyring → `~/.supabase/access-token`) | +| `DB_PASSWORD` | password for direct database connection | no | ## Exit Codes diff --git a/apps/cli/src/legacy/commands/migration/repair/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/migration/repair/SIDE_EFFECTS.md index b2b32303bb..3972fbd0d5 100644 --- a/apps/cli/src/legacy/commands/migration/repair/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/migration/repair/SIDE_EFFECTS.md @@ -2,9 +2,9 @@ ## Files Read -| Path | Format | When | -| --------------------------------------------- | ---------- | ------------------------------------------------- | -| `/access-token` | plain text | when `SUPABASE_ACCESS_TOKEN` unset and `--linked` | +| Path | Format | When | +| -------------------------- | ---------- | ------------------------------------------------- | +| `~/.supabase/access-token` | plain text | when `SUPABASE_ACCESS_TOKEN` unset and `--linked` | ## Files Written @@ -20,11 +20,10 @@ ## Environment Variables -| Variable | Purpose | Required? | -| ----------------------- | ---------------------------------------------------------------------- | -------------------------------------------------------------------------- | -| `SUPABASE_ACCESS_TOKEN` | auth token for `--linked` mode | no (falls back to keyring → `/access-token`) | -| `SUPABASE_HOME` | global CLI state root for auth, telemetry, traces, and shared binaries | no (defaults to `~/.supabase`) | -| `DB_PASSWORD` | password for direct database connection | no | +| Variable | Purpose | Required? | +| ----------------------- | --------------------------------------- | ------------------------------------------------------- | +| `SUPABASE_ACCESS_TOKEN` | auth token for `--linked` mode | no (falls back to keyring → `~/.supabase/access-token`) | +| `DB_PASSWORD` | password for direct database connection | no | ## Exit Codes diff --git a/apps/cli/src/legacy/commands/migration/squash/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/migration/squash/SIDE_EFFECTS.md index 73754e08fc..0f2143dca9 100644 --- a/apps/cli/src/legacy/commands/migration/squash/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/migration/squash/SIDE_EFFECTS.md @@ -2,10 +2,10 @@ ## Files Read -| Path | Format | When | -| --------------------------------------------- | ---------- | ------------------------------------------------- | -| `/supabase/migrations/` | directory | always, to read migration files | -| `/access-token` | plain text | when `SUPABASE_ACCESS_TOKEN` unset and `--linked` | +| Path | Format | When | +| -------------------------------- | ---------- | ------------------------------------------------- | +| `/supabase/migrations/` | directory | always, to read migration files | +| `~/.supabase/access-token` | plain text | when `SUPABASE_ACCESS_TOKEN` unset and `--linked` | ## Files Written @@ -21,11 +21,10 @@ ## Environment Variables -| Variable | Purpose | Required? | -| ----------------------- | ---------------------------------------------------------------------- | -------------------------------------------------------------------------- | -| `SUPABASE_ACCESS_TOKEN` | auth token for `--linked` mode | no (falls back to keyring → `/access-token`) | -| `SUPABASE_HOME` | global CLI state root for auth, telemetry, traces, and shared binaries | no (defaults to `~/.supabase`) | -| `DB_PASSWORD` | password for direct database connection | no | +| Variable | Purpose | Required? | +| ----------------------- | --------------------------------------- | ------------------------------------------------------- | +| `SUPABASE_ACCESS_TOKEN` | auth token for `--linked` mode | no (falls back to keyring → `~/.supabase/access-token`) | +| `DB_PASSWORD` | password for direct database connection | no | ## Exit Codes diff --git a/apps/cli/src/legacy/commands/migration/up/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/migration/up/SIDE_EFFECTS.md index a0d428eef6..f8c090e88c 100644 --- a/apps/cli/src/legacy/commands/migration/up/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/migration/up/SIDE_EFFECTS.md @@ -2,10 +2,10 @@ ## Files Read -| Path | Format | When | -| --------------------------------------------- | ---------- | ------------------------------------------------- | -| `/supabase/migrations/` | directory | always, to read pending migration files | -| `/access-token` | plain text | when `SUPABASE_ACCESS_TOKEN` unset and `--linked` | +| Path | Format | When | +| -------------------------------- | ---------- | ------------------------------------------------- | +| `/supabase/migrations/` | directory | always, to read pending migration files | +| `~/.supabase/access-token` | plain text | when `SUPABASE_ACCESS_TOKEN` unset and `--linked` | ## Files Written @@ -21,10 +21,9 @@ ## Environment Variables -| Variable | Purpose | Required? | -| ----------------------- | ---------------------------------------------------------------------- | -------------------------------------------------------------------------- | -| `SUPABASE_ACCESS_TOKEN` | auth token for `--linked` mode | no (falls back to keyring → `/access-token`) | -| `SUPABASE_HOME` | global CLI state root for auth, telemetry, traces, and shared binaries | no (defaults to `~/.supabase`) | +| Variable | Purpose | Required? | +| ----------------------- | ------------------------------ | ------------------------------------------------------- | +| `SUPABASE_ACCESS_TOKEN` | auth token for `--linked` mode | no (falls back to keyring → `~/.supabase/access-token`) | ## Exit Codes diff --git a/apps/cli/src/legacy/commands/network-bans/get/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/network-bans/get/SIDE_EFFECTS.md index c94d8bf5d9..fdb5dbaf68 100644 --- a/apps/cli/src/legacy/commands/network-bans/get/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/network-bans/get/SIDE_EFFECTS.md @@ -2,17 +2,17 @@ ## Files Read -| Path | Format | When | -| --------------------------------------------- | ------------------------- | ------------------------------------------------------------- | -| `/access-token` | plain text (token string) | when `SUPABASE_ACCESS_TOKEN` unset and keyring unavailable | -| `/supabase/.temp/project-ref` | plain text (project ref) | when `--project-ref` flag and `PROJECT_ID` env are both unset | +| Path | Format | When | +| -------------------------------------- | ------------------------- | ------------------------------------------------------------- | +| `~/.supabase/access-token` | plain text (token string) | when `SUPABASE_ACCESS_TOKEN` unset and keyring unavailable | +| `/supabase/.temp/project-ref` | plain text (project ref) | when `--project-ref` flag and `PROJECT_ID` env are both unset | ## Files Written -| Path | Format | When | -| ----------------------------------------------- | ------ | ----------------------------------------------------------------------------- | -| `/supabase/.temp/linked-project.json` | JSON | always (after ref resolution), via `Effect.ensuring` — on success and failure | -| `/telemetry.json` | JSON | always, via `Effect.ensuring` — on success and failure | +| Path | Format | When | +| ------------------------------------------------ | ------ | ----------------------------------------------------------------------------- | +| `~/.supabase//linked-project.json` | JSON | always (after ref resolution), via `Effect.ensuring` — on success and failure | +| `~/.supabase/telemetry.json` | JSON | always, via `Effect.ensuring` — on success and failure | ## API Routes @@ -24,12 +24,11 @@ The Management API exposes this read operation as `POST .../network-bans/retriev ## Environment Variables -| Variable | Purpose | Required? | -| ----------------------- | ---------------------------------------------------------------------- | -------------------------------------------------------------------------- | -| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `/access-token`) | -| `SUPABASE_HOME` | global CLI state root for auth, telemetry, traces, and shared binaries | no (defaults to `~/.supabase`) | -| `SUPABASE_API_URL` | override Management API base URL | no (defaults to `https://api.supabase.com`) | -| `PROJECT_ID` | project ref fallback when `--project-ref` is unset | no (falls back to `supabase/.temp/project-ref` → prompt) | +| Variable | Purpose | Required? | +| ----------------------- | ---------------------------------------------------- | -------------------------------------------------------- | +| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `~/.supabase/access-token`) | +| `SUPABASE_API_URL` | override Management API base URL | no (defaults to `https://api.supabase.com`) | +| `PROJECT_ID` | project ref fallback when `--project-ref` is unset | no (falls back to `supabase/.temp/project-ref` → prompt) | ## Exit Codes diff --git a/apps/cli/src/legacy/commands/network-bans/remove/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/network-bans/remove/SIDE_EFFECTS.md index 0c4dc9147e..f1252d674b 100644 --- a/apps/cli/src/legacy/commands/network-bans/remove/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/network-bans/remove/SIDE_EFFECTS.md @@ -2,17 +2,17 @@ ## Files Read -| Path | Format | When | -| --------------------------------------------- | ------------------------- | ------------------------------------------------------------- | -| `/access-token` | plain text (token string) | when `SUPABASE_ACCESS_TOKEN` unset and keyring unavailable | -| `/supabase/.temp/project-ref` | plain text (project ref) | when `--project-ref` flag and `PROJECT_ID` env are both unset | +| Path | Format | When | +| -------------------------------------- | ------------------------- | ------------------------------------------------------------- | +| `~/.supabase/access-token` | plain text (token string) | when `SUPABASE_ACCESS_TOKEN` unset and keyring unavailable | +| `/supabase/.temp/project-ref` | plain text (project ref) | when `--project-ref` flag and `PROJECT_ID` env are both unset | ## Files Written -| Path | Format | When | -| ----------------------------------------------- | ------ | ----------------------------------------------------------------------------- | -| `/supabase/.temp/linked-project.json` | JSON | always (after ref resolution), via `Effect.ensuring` — on success and failure | -| `/telemetry.json` | JSON | always, via `Effect.ensuring` — on success and failure | +| Path | Format | When | +| ------------------------------------------------ | ------ | ----------------------------------------------------------------------------- | +| `~/.supabase//linked-project.json` | JSON | always (after ref resolution), via `Effect.ensuring` — on success and failure | +| `~/.supabase/telemetry.json` | JSON | always, via `Effect.ensuring` — on success and failure | ## API Routes @@ -24,12 +24,11 @@ ## Environment Variables -| Variable | Purpose | Required? | -| ----------------------- | ---------------------------------------------------------------------- | -------------------------------------------------------------------------- | -| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `/access-token`) | -| `SUPABASE_HOME` | global CLI state root for auth, telemetry, traces, and shared binaries | no (defaults to `~/.supabase`) | -| `SUPABASE_API_URL` | override Management API base URL | no (defaults to `https://api.supabase.com`) | -| `PROJECT_ID` | project ref fallback when `--project-ref` is unset | no (falls back to `supabase/.temp/project-ref` → prompt) | +| Variable | Purpose | Required? | +| ----------------------- | ---------------------------------------------------- | -------------------------------------------------------- | +| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `~/.supabase/access-token`) | +| `SUPABASE_API_URL` | override Management API base URL | no (defaults to `https://api.supabase.com`) | +| `PROJECT_ID` | project ref fallback when `--project-ref` is unset | no (falls back to `supabase/.temp/project-ref` → prompt) | ## Exit Codes diff --git a/apps/cli/src/legacy/commands/network-restrictions/get/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/network-restrictions/get/SIDE_EFFECTS.md index ac65577b57..7c746dbd01 100644 --- a/apps/cli/src/legacy/commands/network-restrictions/get/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/network-restrictions/get/SIDE_EFFECTS.md @@ -2,17 +2,17 @@ ## Files Read -| Path | Format | When | -| --------------------------------------------- | ------------------------- | ------------------------------------------------------------- | -| `/access-token` | plain text (token string) | when `SUPABASE_ACCESS_TOKEN` unset and keyring unavailable | -| `/supabase/.temp/project-ref` | plain text (project ref) | when `--project-ref` flag and `PROJECT_ID` env are both unset | +| Path | Format | When | +| -------------------------------------- | ------------------------- | ------------------------------------------------------------- | +| `~/.supabase/access-token` | plain text (token string) | when `SUPABASE_ACCESS_TOKEN` unset and keyring unavailable | +| `/supabase/.temp/project-ref` | plain text (project ref) | when `--project-ref` flag and `PROJECT_ID` env are both unset | ## Files Written -| Path | Format | When | -| ----------------------------------------------- | ------ | ----------------------------------------------------------------------------- | -| `/supabase/.temp/linked-project.json` | JSON | always (after ref resolution), via `Effect.ensuring` — on success and failure | -| `/telemetry.json` | JSON | always, via `Effect.ensuring` — on success and failure | +| Path | Format | When | +| ------------------------------------------------ | ------ | ----------------------------------------------------------------------------- | +| `~/.supabase//linked-project.json` | JSON | always (after ref resolution), via `Effect.ensuring` — on success and failure | +| `~/.supabase/telemetry.json` | JSON | always, via `Effect.ensuring` — on success and failure | ## API Routes @@ -22,12 +22,11 @@ ## Environment Variables -| Variable | Purpose | Required? | -| ----------------------- | ---------------------------------------------------------------------- | -------------------------------------------------------------------------- | -| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `/access-token`) | -| `SUPABASE_HOME` | global CLI state root for auth, telemetry, traces, and shared binaries | no (defaults to `~/.supabase`) | -| `SUPABASE_API_URL` | override Management API base URL | no (defaults to `https://api.supabase.com`) | -| `PROJECT_ID` | project ref fallback when `--project-ref` is unset | no (falls back to `supabase/.temp/project-ref` → prompt) | +| Variable | Purpose | Required? | +| ----------------------- | ---------------------------------------------------- | -------------------------------------------------------- | +| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `~/.supabase/access-token`) | +| `SUPABASE_API_URL` | override Management API base URL | no (defaults to `https://api.supabase.com`) | +| `PROJECT_ID` | project ref fallback when `--project-ref` is unset | no (falls back to `supabase/.temp/project-ref` → prompt) | ## Exit Codes diff --git a/apps/cli/src/legacy/commands/network-restrictions/update/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/network-restrictions/update/SIDE_EFFECTS.md index 17b248a93d..fb31633592 100644 --- a/apps/cli/src/legacy/commands/network-restrictions/update/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/network-restrictions/update/SIDE_EFFECTS.md @@ -2,17 +2,17 @@ ## Files Read -| Path | Format | When | -| --------------------------------------------- | ------------------------- | ------------------------------------------------------------- | -| `/access-token` | plain text (token string) | when `SUPABASE_ACCESS_TOKEN` unset and keyring unavailable | -| `/supabase/.temp/project-ref` | plain text (project ref) | when `--project-ref` flag and `PROJECT_ID` env are both unset | +| Path | Format | When | +| -------------------------------------- | ------------------------- | ------------------------------------------------------------- | +| `~/.supabase/access-token` | plain text (token string) | when `SUPABASE_ACCESS_TOKEN` unset and keyring unavailable | +| `/supabase/.temp/project-ref` | plain text (project ref) | when `--project-ref` flag and `PROJECT_ID` env are both unset | ## Files Written -| Path | Format | When | -| ----------------------------------------------- | ------ | ------------------------------------------------------------------------------- | -| `/supabase/.temp/linked-project.json` | JSON | always (after ref resolution), via `Effect.ensuring` — success and HTTP failure | -| `/telemetry.json` | JSON | always, via outermost `Effect.ensuring` — including CIDR validation failures | +| Path | Format | When | +| ------------------------------------------------ | ------ | ------------------------------------------------------------------------------- | +| `~/.supabase//linked-project.json` | JSON | always (after ref resolution), via `Effect.ensuring` — success and HTTP failure | +| `~/.supabase/telemetry.json` | JSON | always, via outermost `Effect.ensuring` — including CIDR validation failures | ## API Routes @@ -28,12 +28,11 @@ when no `--db-allow-cidr` was supplied), matching Go's `&[]string{}` initializat ## Environment Variables -| Variable | Purpose | Required? | -| ----------------------- | ---------------------------------------------------------------------- | -------------------------------------------------------------------------- | -| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `/access-token`) | -| `SUPABASE_HOME` | global CLI state root for auth, telemetry, traces, and shared binaries | no (defaults to `~/.supabase`) | -| `SUPABASE_API_URL` | override Management API base URL | no (defaults to `https://api.supabase.com`) | -| `PROJECT_ID` | project ref fallback when `--project-ref` is unset | no (falls back to `supabase/.temp/project-ref` → prompt) | +| Variable | Purpose | Required? | +| ----------------------- | ---------------------------------------------------- | -------------------------------------------------------- | +| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `~/.supabase/access-token`) | +| `SUPABASE_API_URL` | override Management API base URL | no (defaults to `https://api.supabase.com`) | +| `PROJECT_ID` | project ref fallback when `--project-ref` is unset | no (falls back to `supabase/.temp/project-ref` → prompt) | ## Exit Codes diff --git a/apps/cli/src/legacy/commands/orgs/create/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/orgs/create/SIDE_EFFECTS.md index 64e168dbb3..b6a2dfee84 100644 --- a/apps/cli/src/legacy/commands/orgs/create/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/orgs/create/SIDE_EFFECTS.md @@ -2,17 +2,17 @@ ## Files Read -| Path | Format | When | -| --------------------------------------------- | ------------------------- | --------------------------------------------------------------------------------------------- | -| keyring `"Supabase CLI"` / `` | OS keychain | when `SUPABASE_ACCESS_TOKEN` unset and keyring available; account = `LegacyCliConfig.profile` | -| keyring `"Supabase CLI"` / `access-token` | OS keychain | legacy-key fallback when the profile-keyed lookup misses | -| `/access-token` | plain text (token string) | last-resort fallback after env + keyring miss | +| Path | Format | When | +| ----------------------------------------- | ------------------------- | --------------------------------------------------------------------------------------------- | +| keyring `"Supabase CLI"` / `` | OS keychain | when `SUPABASE_ACCESS_TOKEN` unset and keyring available; account = `LegacyCliConfig.profile` | +| keyring `"Supabase CLI"` / `access-token` | OS keychain | legacy-key fallback when the profile-keyed lookup misses | +| `~/.supabase/access-token` | plain text (token string) | last-resort fallback after env + keyring miss | ## Files Written -| Path | Format | When | -| ----------------------------------------------- | ------ | ----------------------------------------------------------- | -| `/telemetry.json` | JSON | always (in `Effect.ensuring`) at end of command — Go parity | +| Path | Format | When | +| ---------------------------- | ------ | ----------------------------------------------------------- | +| `~/.supabase/telemetry.json` | JSON | always (in `Effect.ensuring`) at end of command — Go parity | `orgs create` is a user-level command — it does not resolve a `--project-ref`, so the legacy linked-project cache is never written. @@ -31,11 +31,10 @@ linked-project cache is never written. ## Environment Variables -| Variable | Purpose | Required? | -| ----------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------- | -| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `/access-token`) | -| `SUPABASE_HOME` | global CLI state root for auth, telemetry, traces, and shared binaries | no (defaults to `~/.supabase`) | -| `SUPABASE_PROFILE` | selects API base URL (`supabase`, `supabase-staging`, `supabase-local`), or a filesystem path to a YAML profile (Go parity — used by the cli-e2e harness) | no (defaults to `supabase`) | +| Variable | Purpose | Required? | +| ----------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------- | +| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `~/.supabase/access-token`) | +| `SUPABASE_PROFILE` | selects API base URL (`supabase`, `supabase-staging`, `supabase-local`), or a filesystem path to a YAML profile (Go parity — used by the cli-e2e harness) | no (defaults to `supabase`) | ## Exit Codes diff --git a/apps/cli/src/legacy/commands/orgs/list/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/orgs/list/SIDE_EFFECTS.md index d2efff1bd5..922c2087ce 100644 --- a/apps/cli/src/legacy/commands/orgs/list/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/orgs/list/SIDE_EFFECTS.md @@ -2,20 +2,20 @@ ## Files Read -| Path | Format | When | -| --------------------------------------------- | ------------------------- | --------------------------------------------------------------------------------------------- | -| keyring `"Supabase CLI"` / `` | OS keychain | when `SUPABASE_ACCESS_TOKEN` unset and keyring available; account = `LegacyCliConfig.profile` | -| keyring `"Supabase CLI"` / `access-token` | OS keychain | legacy-key fallback when the profile-keyed lookup misses | -| `/access-token` | plain text (token string) | last-resort fallback after env + keyring miss | +| Path | Format | When | +| ----------------------------------------- | ------------------------- | --------------------------------------------------------------------------------------------- | +| keyring `"Supabase CLI"` / `` | OS keychain | when `SUPABASE_ACCESS_TOKEN` unset and keyring available; account = `LegacyCliConfig.profile` | +| keyring `"Supabase CLI"` / `access-token` | OS keychain | legacy-key fallback when the profile-keyed lookup misses | +| `~/.supabase/access-token` | plain text (token string) | last-resort fallback after env + keyring miss | ## Files Written -| Path | Format | When | -| ----------------------------------------------- | ------ | ----------------------------------------------------------- | -| `/telemetry.json` | JSON | always (in `Effect.ensuring`) at end of command — Go parity | +| Path | Format | When | +| ---------------------------- | ------ | ----------------------------------------------------------- | +| `~/.supabase/telemetry.json` | JSON | always (in `Effect.ensuring`) at end of command — Go parity | `orgs list` is a user-level command — it does not resolve a `--project-ref`, so the legacy -linked-project cache (`/supabase/.temp/linked-project.json`) is never written. +linked-project cache (`~/.supabase//linked-project.json`) is never written. ## API Routes @@ -25,11 +25,10 @@ linked-project cache (`/supabase/.temp/linked-project.json`) is never w ## Environment Variables -| Variable | Purpose | Required? | -| ----------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------- | -| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `/access-token`) | -| `SUPABASE_HOME` | global CLI state root for auth, telemetry, traces, and shared binaries | no (defaults to `~/.supabase`) | -| `SUPABASE_PROFILE` | selects API base URL (`supabase`, `supabase-staging`, `supabase-local`), or a filesystem path to a YAML profile (Go parity — used by the cli-e2e harness) | no (defaults to `supabase`) | +| Variable | Purpose | Required? | +| ----------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------- | +| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `~/.supabase/access-token`) | +| `SUPABASE_PROFILE` | selects API base URL (`supabase`, `supabase-staging`, `supabase-local`), or a filesystem path to a YAML profile (Go parity — used by the cli-e2e harness) | no (defaults to `supabase`) | ## Exit Codes diff --git a/apps/cli/src/legacy/commands/postgres-config/delete/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/postgres-config/delete/SIDE_EFFECTS.md index 8036559841..892ae2b29c 100644 --- a/apps/cli/src/legacy/commands/postgres-config/delete/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/postgres-config/delete/SIDE_EFFECTS.md @@ -2,17 +2,17 @@ ## Files Read -| Path | Format | When | -| --------------------------------------------- | ------------------------- | ------------------------------------------------------------- | -| `/access-token` | plain text (token string) | when `SUPABASE_ACCESS_TOKEN` unset and keyring unavailable | -| `/supabase/.temp/project-ref` | plain text (project ref) | when `--project-ref` flag and `PROJECT_ID` env are both unset | +| Path | Format | When | +| -------------------------------------- | ------------------------- | ------------------------------------------------------------- | +| `~/.supabase/access-token` | plain text (token string) | when `SUPABASE_ACCESS_TOKEN` unset and keyring unavailable | +| `/supabase/.temp/project-ref` | plain text (project ref) | when `--project-ref` flag and `PROJECT_ID` env are both unset | ## Files Written -| Path | Format | When | -| ----------------------------------------------- | ------ | ----------------------------------------------------------------------------- | -| `/supabase/.temp/linked-project.json` | JSON | always (after ref resolution), via `Effect.ensuring` - on success and failure | -| `/telemetry.json` | JSON | always, via `Effect.ensuring` - on success and failure | +| Path | Format | When | +| ------------------------------------------------ | ------ | ----------------------------------------------------------------------------- | +| `~/.supabase//linked-project.json` | JSON | always (after ref resolution), via `Effect.ensuring` - on success and failure | +| `~/.supabase/telemetry.json` | JSON | always, via `Effect.ensuring` - on success and failure | ## API Routes @@ -25,12 +25,11 @@ This command does not call a delete endpoint. It mirrors Go: fetch current confi ## Environment Variables -| Variable | Purpose | Required? | -| ----------------------- | ---------------------------------------------------------------------- | --------------------------------------------------------------------------- | -| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring -> `/access-token`) | -| `SUPABASE_HOME` | global CLI state root for auth, telemetry, traces, and shared binaries | no (defaults to `~/.supabase`) | -| `SUPABASE_API_URL` | override Management API base URL | no (defaults to `https://api.supabase.com`) | -| `PROJECT_ID` | project ref fallback when `--project-ref` is unset | no (falls back to `supabase/.temp/project-ref` -> prompt) | +| Variable | Purpose | Required? | +| ----------------------- | ---------------------------------------------------- | --------------------------------------------------------- | +| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring -> `~/.supabase/access-token`) | +| `SUPABASE_API_URL` | override Management API base URL | no (defaults to `https://api.supabase.com`) | +| `PROJECT_ID` | project ref fallback when `--project-ref` is unset | no (falls back to `supabase/.temp/project-ref` -> prompt) | ## Exit Codes diff --git a/apps/cli/src/legacy/commands/postgres-config/get/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/postgres-config/get/SIDE_EFFECTS.md index 42d67ed552..94e0953515 100644 --- a/apps/cli/src/legacy/commands/postgres-config/get/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/postgres-config/get/SIDE_EFFECTS.md @@ -2,17 +2,17 @@ ## Files Read -| Path | Format | When | -| --------------------------------------------- | ------------------------- | ------------------------------------------------------------- | -| `/access-token` | plain text (token string) | when `SUPABASE_ACCESS_TOKEN` unset and keyring unavailable | -| `/supabase/.temp/project-ref` | plain text (project ref) | when `--project-ref` flag and `PROJECT_ID` env are both unset | +| Path | Format | When | +| -------------------------------------- | ------------------------- | ------------------------------------------------------------- | +| `~/.supabase/access-token` | plain text (token string) | when `SUPABASE_ACCESS_TOKEN` unset and keyring unavailable | +| `/supabase/.temp/project-ref` | plain text (project ref) | when `--project-ref` flag and `PROJECT_ID` env are both unset | ## Files Written -| Path | Format | When | -| ----------------------------------------------- | ------ | ----------------------------------------------------------------------------- | -| `/supabase/.temp/linked-project.json` | JSON | always (after ref resolution), via `Effect.ensuring` - on success and failure | -| `/telemetry.json` | JSON | always, via `Effect.ensuring` - on success and failure | +| Path | Format | When | +| ------------------------------------------------ | ------ | ----------------------------------------------------------------------------- | +| `~/.supabase//linked-project.json` | JSON | always (after ref resolution), via `Effect.ensuring` - on success and failure | +| `~/.supabase/telemetry.json` | JSON | always, via `Effect.ensuring` - on success and failure | ## API Routes @@ -22,12 +22,11 @@ ## Environment Variables -| Variable | Purpose | Required? | -| ----------------------- | ---------------------------------------------------------------------- | --------------------------------------------------------------------------- | -| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring -> `/access-token`) | -| `SUPABASE_HOME` | global CLI state root for auth, telemetry, traces, and shared binaries | no (defaults to `~/.supabase`) | -| `SUPABASE_API_URL` | override Management API base URL | no (defaults to `https://api.supabase.com`) | -| `PROJECT_ID` | project ref fallback when `--project-ref` is unset | no (falls back to `supabase/.temp/project-ref` -> prompt) | +| Variable | Purpose | Required? | +| ----------------------- | ---------------------------------------------------- | --------------------------------------------------------- | +| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring -> `~/.supabase/access-token`) | +| `SUPABASE_API_URL` | override Management API base URL | no (defaults to `https://api.supabase.com`) | +| `PROJECT_ID` | project ref fallback when `--project-ref` is unset | no (falls back to `supabase/.temp/project-ref` -> prompt) | ## Exit Codes diff --git a/apps/cli/src/legacy/commands/postgres-config/update/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/postgres-config/update/SIDE_EFFECTS.md index e8d746bea3..030a6a322d 100644 --- a/apps/cli/src/legacy/commands/postgres-config/update/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/postgres-config/update/SIDE_EFFECTS.md @@ -2,17 +2,17 @@ ## Files Read -| Path | Format | When | -| --------------------------------------------- | ------------------------- | ------------------------------------------------------------- | -| `/access-token` | plain text (token string) | when `SUPABASE_ACCESS_TOKEN` unset and keyring unavailable | -| `/supabase/.temp/project-ref` | plain text (project ref) | when `--project-ref` flag and `PROJECT_ID` env are both unset | +| Path | Format | When | +| -------------------------------------- | ------------------------- | ------------------------------------------------------------- | +| `~/.supabase/access-token` | plain text (token string) | when `SUPABASE_ACCESS_TOKEN` unset and keyring unavailable | +| `/supabase/.temp/project-ref` | plain text (project ref) | when `--project-ref` flag and `PROJECT_ID` env are both unset | ## Files Written -| Path | Format | When | -| ----------------------------------------------- | ------ | ----------------------------------------------------------------------------- | -| `/supabase/.temp/linked-project.json` | JSON | always (after ref resolution), via `Effect.ensuring` - on success and failure | -| `/telemetry.json` | JSON | always, via `Effect.ensuring` - on success and failure | +| Path | Format | When | +| ------------------------------------------------ | ------ | ----------------------------------------------------------------------------- | +| `~/.supabase//linked-project.json` | JSON | always (after ref resolution), via `Effect.ensuring` - on success and failure | +| `~/.supabase/telemetry.json` | JSON | always, via `Effect.ensuring` - on success and failure | ## API Routes @@ -25,12 +25,11 @@ The initial `GET` is skipped when `--replace-existing-overrides` is set. Otherwi ## Environment Variables -| Variable | Purpose | Required? | -| ----------------------- | ---------------------------------------------------------------------- | --------------------------------------------------------------------------- | -| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring -> `/access-token`) | -| `SUPABASE_HOME` | global CLI state root for auth, telemetry, traces, and shared binaries | no (defaults to `~/.supabase`) | -| `SUPABASE_API_URL` | override Management API base URL | no (defaults to `https://api.supabase.com`) | -| `PROJECT_ID` | project ref fallback when `--project-ref` is unset | no (falls back to `supabase/.temp/project-ref` -> prompt) | +| Variable | Purpose | Required? | +| ----------------------- | ---------------------------------------------------- | --------------------------------------------------------- | +| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring -> `~/.supabase/access-token`) | +| `SUPABASE_API_URL` | override Management API base URL | no (defaults to `https://api.supabase.com`) | +| `PROJECT_ID` | project ref fallback when `--project-ref` is unset | no (falls back to `supabase/.temp/project-ref` -> prompt) | ## Exit Codes diff --git a/apps/cli/src/legacy/commands/projects/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/projects/SIDE_EFFECTS.md index ab65bd72d2..23e0b9711e 100644 --- a/apps/cli/src/legacy/commands/projects/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/projects/SIDE_EFFECTS.md @@ -6,10 +6,10 @@ subcommand's own `SIDE_EFFECTS.md`. ## Files Read -| Path | Format | When | -| --------------------------------------------- | ------------------------- | ------------------------------------------------------------------------ | -| `/access-token` | plain text (token string) | when `SUPABASE_ACCESS_TOKEN` unset and keyring unavailable | -| `/supabase/.temp/project-ref` | plain text (ref string) | `list` (linked marker), `api-keys` (ref source), `delete` (unlink match) | +| Path | Format | When | +| -------------------------------------- | ------------------------- | ------------------------------------------------------------------------ | +| `~/.supabase/access-token` | plain text (token string) | when `SUPABASE_ACCESS_TOKEN` unset and keyring unavailable | +| `/supabase/.temp/project-ref` | plain text (ref string) | `list` (linked marker), `api-keys` (ref source), `delete` (unlink match) | ## Files Written / Removed @@ -37,12 +37,11 @@ subcommand's own `SIDE_EFFECTS.md`. ## Environment Variables -| Variable | Purpose | Required? | -| ----------------------- | ---------------------------------------------------------------------- | -------------------------------------------------------------------------- | -| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `/access-token`) | -| `SUPABASE_HOME` | global CLI state root for auth, telemetry, traces, and shared binaries | no (defaults to `~/.supabase`) | -| `SUPABASE_PROJECT_REF` | linked project ref (via the config layer) | no (used by `list` marker / `api-keys` ref / `delete` unlink) | -| `SUPABASE_API_URL` | override Management API base URL | no (defaults to `https://api.supabase.com`) | +| Variable | Purpose | Required? | +| ----------------------- | ---------------------------------------------------- | ------------------------------------------------------------- | +| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `~/.supabase/access-token`) | +| `SUPABASE_PROJECT_REF` | linked project ref (via the config layer) | no (used by `list` marker / `api-keys` ref / `delete` unlink) | +| `SUPABASE_API_URL` | override Management API base URL | no (defaults to `https://api.supabase.com`) | > `DB_PASSWORD` is **not** consumed. In Go it only mirrors `--db-password` via a > viper binding for downstream local-stack use; `projects create` never reads it. diff --git a/apps/cli/src/legacy/commands/projects/api-keys/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/projects/api-keys/SIDE_EFFECTS.md index 9176b6a1c3..2071a7aefc 100644 --- a/apps/cli/src/legacy/commands/projects/api-keys/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/projects/api-keys/SIDE_EFFECTS.md @@ -2,10 +2,10 @@ ## Files Read -| Path | Format | When | -| --------------------------------------------- | ------------------------- | ----------------------------------------------------------------------- | -| `/access-token` | plain text (token string) | when `SUPABASE_ACCESS_TOKEN` unset and keyring unavailable | -| `/supabase/.temp/project-ref` | plain text (ref string) | when `--project-ref` is not provided, to resolve the linked project ref | +| Path | Format | When | +| -------------------------------------- | ------------------------- | ----------------------------------------------------------------------- | +| `~/.supabase/access-token` | plain text (token string) | when `SUPABASE_ACCESS_TOKEN` unset and keyring unavailable | +| `/supabase/.temp/project-ref` | plain text (ref string) | when `--project-ref` is not provided, to resolve the linked project ref | ## Files Written @@ -21,11 +21,10 @@ ## Environment Variables -| Variable | Purpose | Required? | -| ----------------------- | ---------------------------------------------------------------------- | -------------------------------------------------------------------------- | -| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `/access-token`) | -| `SUPABASE_HOME` | global CLI state root for auth, telemetry, traces, and shared binaries | no (defaults to `~/.supabase`) | -| `SUPABASE_API_URL` | override Management API base URL | no (defaults to `https://api.supabase.com`) | +| Variable | Purpose | Required? | +| ----------------------- | ---------------------------------------------------- | ------------------------------------------------------- | +| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `~/.supabase/access-token`) | +| `SUPABASE_API_URL` | override Management API base URL | no (defaults to `https://api.supabase.com`) | ## Flags diff --git a/apps/cli/src/legacy/commands/projects/create/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/projects/create/SIDE_EFFECTS.md index 8d42c412f5..0726aaa348 100644 --- a/apps/cli/src/legacy/commands/projects/create/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/projects/create/SIDE_EFFECTS.md @@ -2,9 +2,9 @@ ## Files Read -| Path | Format | When | -| --------------------------------------------- | ------------------------- | ---------------------------------------------------------- | -| `/access-token` | plain text (token string) | when `SUPABASE_ACCESS_TOKEN` unset and keyring unavailable | +| Path | Format | When | +| -------------------------- | ------------------------- | ---------------------------------------------------------- | +| `~/.supabase/access-token` | plain text (token string) | when `SUPABASE_ACCESS_TOKEN` unset and keyring unavailable | ## Files Written @@ -21,12 +21,11 @@ ## Environment Variables -| Variable | Purpose | Required? | -| ----------------------- | --------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------- | -| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `/access-token`) | -| `SUPABASE_HOME` | global CLI state root for auth, telemetry, traces, and shared binaries | no (defaults to `~/.supabase`) | -| `SUPABASE_API_URL` | override Management API base URL | no (defaults to `https://api.supabase.com`) | -| `DB_PASSWORD` | **not consumed** — Go only mirrors `--db-password` into viper for local-stack reuse; `projects create` never reads it | n/a | +| Variable | Purpose | Required? | +| ----------------------- | --------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------- | +| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `~/.supabase/access-token`) | +| `SUPABASE_API_URL` | override Management API base URL | no (defaults to `https://api.supabase.com`) | +| `DB_PASSWORD` | **not consumed** — Go only mirrors `--db-password` into viper for local-stack reuse; `projects create` never reads it | n/a | ## Exit Codes diff --git a/apps/cli/src/legacy/commands/projects/delete/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/projects/delete/SIDE_EFFECTS.md index 7f702c44f5..f4e46eab50 100644 --- a/apps/cli/src/legacy/commands/projects/delete/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/projects/delete/SIDE_EFFECTS.md @@ -2,10 +2,10 @@ ## Files Read -| Path | Format | When | -| --------------------------------------------- | ------------------------- | ---------------------------------------------------------- | -| `/access-token` | plain text (token string) | when `SUPABASE_ACCESS_TOKEN` unset and keyring unavailable | -| `/supabase/.temp/project-ref` | plain text (ref string) | after a successful delete, to decide whether to unlink | +| Path | Format | When | +| -------------------------------------- | ------------------------- | ---------------------------------------------------------- | +| `~/.supabase/access-token` | plain text (token string) | when `SUPABASE_ACCESS_TOKEN` unset and keyring unavailable | +| `/supabase/.temp/project-ref` | plain text (ref string) | after a successful delete, to decide whether to unlink | ## Files Written / Removed @@ -27,11 +27,10 @@ ## Environment Variables -| Variable | Purpose | Required? | -| ----------------------- | ---------------------------------------------------------------------- | -------------------------------------------------------------------------- | -| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `/access-token`) | -| `SUPABASE_HOME` | global CLI state root for auth, telemetry, traces, and shared binaries | no (defaults to `~/.supabase`) | -| `SUPABASE_API_URL` | override Management API base URL | no (defaults to `https://api.supabase.com`) | +| Variable | Purpose | Required? | +| ----------------------- | ---------------------------------------------------- | ------------------------------------------------------- | +| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `~/.supabase/access-token`) | +| `SUPABASE_API_URL` | override Management API base URL | no (defaults to `https://api.supabase.com`) | ## Exit Codes diff --git a/apps/cli/src/legacy/commands/projects/list/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/projects/list/SIDE_EFFECTS.md index 180436ca9d..f4785c0f14 100644 --- a/apps/cli/src/legacy/commands/projects/list/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/projects/list/SIDE_EFFECTS.md @@ -2,10 +2,10 @@ ## Files Read -| Path | Format | When | -| --------------------------------------------- | ------------------------- | ---------------------------------------------------------- | -| `/access-token` | plain text (token string) | when `SUPABASE_ACCESS_TOKEN` unset and keyring unavailable | -| `/supabase/.temp/project-ref` | plain text (ref string) | always (soft) — used only to flag the linked project | +| Path | Format | When | +| -------------------------------------- | ------------------------- | ---------------------------------------------------------- | +| `~/.supabase/access-token` | plain text (token string) | when `SUPABASE_ACCESS_TOKEN` unset and keyring unavailable | +| `/supabase/.temp/project-ref` | plain text (ref string) | always (soft) — used only to flag the linked project | ## Files Written @@ -21,11 +21,10 @@ ## Environment Variables -| Variable | Purpose | Required? | -| ----------------------- | ---------------------------------------------------------------------- | -------------------------------------------------------------------------- | -| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `/access-token`) | -| `SUPABASE_HOME` | global CLI state root for auth, telemetry, traces, and shared binaries | no (defaults to `~/.supabase`) | -| `SUPABASE_API_URL` | override Management API base URL | no (defaults to `https://api.supabase.com`) | +| Variable | Purpose | Required? | +| ----------------------- | ---------------------------------------------------- | ------------------------------------------------------- | +| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `~/.supabase/access-token`) | +| `SUPABASE_API_URL` | override Management API base URL | no (defaults to `https://api.supabase.com`) | ## Exit Codes diff --git a/apps/cli/src/legacy/commands/secrets/list/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/secrets/list/SIDE_EFFECTS.md index a99f0a8689..a7a248607e 100644 --- a/apps/cli/src/legacy/commands/secrets/list/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/secrets/list/SIDE_EFFECTS.md @@ -2,20 +2,20 @@ ## Files Read -| Path | Format | When | -| --------------------------------------------- | ------------------------- | --------------------------------------------------------------------------------------------- | -| `/proc/sys/kernel/osrelease` (Linux) | plain text | once on layer init — disables keyring on WSL (`WSL` / `Microsoft` substring match) | -| keyring `"Supabase CLI"` / `` | OS keychain | when `SUPABASE_ACCESS_TOKEN` unset and keyring available; account = `LegacyCliConfig.profile` | -| keyring `"Supabase CLI"` / `access-token` | OS keychain | legacy-key fallback when the profile-keyed lookup misses | -| `/access-token` | plain text (token string) | last-resort fallback after env + keyring miss | -| `/supabase/.temp/project-ref` | plain text | when `--project-ref` and `SUPABASE_PROJECT_ID` are both unset | +| Path | Format | When | +| ----------------------------------------- | ------------------------- | --------------------------------------------------------------------------------------------- | +| `/proc/sys/kernel/osrelease` (Linux) | plain text | once on layer init — disables keyring on WSL (`WSL` / `Microsoft` substring match) | +| keyring `"Supabase CLI"` / `` | OS keychain | when `SUPABASE_ACCESS_TOKEN` unset and keyring available; account = `LegacyCliConfig.profile` | +| keyring `"Supabase CLI"` / `access-token` | OS keychain | legacy-key fallback when the profile-keyed lookup misses | +| `~/.supabase/access-token` | plain text (token string) | last-resort fallback after env + keyring miss | +| `/supabase/.temp/project-ref` | plain text | when `--project-ref` and `SUPABASE_PROJECT_ID` are both unset | ## Files Written -| Path | Format | When | -| ----------------------------------------------- | ------ | ------------------------------------------------------------------------ | -| `/supabase/.temp/linked-project.json` | JSON | always (in `Effect.ensuring`) after `--project-ref` resolves — Go parity | -| `/telemetry.json` | JSON | always (in `Effect.ensuring`) at end of command — Go parity | +| Path | Format | When | +| ------------------------------------------------ | ------ | ------------------------------------------------------------------------ | +| `~/.supabase//linked-project.json` | JSON | always (in `Effect.ensuring`) after `--project-ref` resolves — Go parity | +| `~/.supabase/telemetry.json` | JSON | always (in `Effect.ensuring`) at end of command — Go parity | ## API Routes @@ -28,8 +28,7 @@ | Variable | Purpose | Required? | | ----------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------- | -| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `/access-token`) | -| `SUPABASE_HOME` | global CLI state root for auth, telemetry, traces, and shared binaries | no (defaults to `~/.supabase`) | +| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `~/.supabase/access-token`) | | `SUPABASE_PROFILE` | selects API base URL: `supabase` → `api.supabase.com`, `supabase-staging` → `api.supabase.green`, `supabase-local` → `http://localhost:8080`. May alternatively be a filesystem path to a YAML profile with at least `api_url:` and optional `name:` (Go parity — used by the cli-e2e test harness). | no (defaults to `supabase`) | | `SUPABASE_PROJECT_ID` | project ref fallback when `--project-ref` is unset | no (also reads `/supabase/.temp/project-ref` then prompts on TTY) | | `SUPABASE_WORKDIR` | base directory for the `.temp/project-ref` lookup | no (walks up from CWD looking for `supabase/config.toml`) | diff --git a/apps/cli/src/legacy/commands/secrets/set/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/secrets/set/SIDE_EFFECTS.md index d9587a6682..c99884485e 100644 --- a/apps/cli/src/legacy/commands/secrets/set/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/secrets/set/SIDE_EFFECTS.md @@ -2,24 +2,24 @@ ## Files Read -| Path | Format | When | -| --------------------------------------------- | ------------------------- | --------------------------------------------------------------------------------------------- | -| `/proc/sys/kernel/osrelease` (Linux) | plain text | once on layer init — disables keyring on WSL (`WSL` / `Microsoft` substring match) | -| keyring `"Supabase CLI"` / `` | OS keychain | when `SUPABASE_ACCESS_TOKEN` unset and keyring available; account = `LegacyCliConfig.profile` | -| keyring `"Supabase CLI"` / `access-token` | OS keychain | legacy-key fallback when the profile-keyed lookup misses | -| `/access-token` | plain text (token string) | last-resort fallback after env + keyring miss | -| `/supabase/.temp/project-ref` | plain text | when `--project-ref` and `SUPABASE_PROJECT_ID` are both unset | -| `/supabase/config.toml` | TOML | always (for `[edge_runtime.secrets]`) — via `@supabase/config`'s `loadProjectConfig` | -| `/.env` | dotenv | always — context for `env(VAR)` interpolation in `[edge_runtime.secrets]` values | -| `/.env.local` | dotenv | always — overrides `.env` for `env(VAR)` interpolation context | -| `` (absolute or CWD-relative) | dotenv | when `--env-file` flag is provided | +| Path | Format | When | +| ----------------------------------------- | ------------------------- | --------------------------------------------------------------------------------------------- | +| `/proc/sys/kernel/osrelease` (Linux) | plain text | once on layer init — disables keyring on WSL (`WSL` / `Microsoft` substring match) | +| keyring `"Supabase CLI"` / `` | OS keychain | when `SUPABASE_ACCESS_TOKEN` unset and keyring available; account = `LegacyCliConfig.profile` | +| keyring `"Supabase CLI"` / `access-token` | OS keychain | legacy-key fallback when the profile-keyed lookup misses | +| `~/.supabase/access-token` | plain text (token string) | last-resort fallback after env + keyring miss | +| `/supabase/.temp/project-ref` | plain text | when `--project-ref` and `SUPABASE_PROJECT_ID` are both unset | +| `/supabase/config.toml` | TOML | always (for `[edge_runtime.secrets]`) — via `@supabase/config`'s `loadProjectConfig` | +| `/.env` | dotenv | always — context for `env(VAR)` interpolation in `[edge_runtime.secrets]` values | +| `/.env.local` | dotenv | always — overrides `.env` for `env(VAR)` interpolation context | +| `` (absolute or CWD-relative) | dotenv | when `--env-file` flag is provided | ## Files Written -| Path | Format | When | -| ----------------------------------------------- | ------ | ------------------------------------------------------------------------ | -| `/supabase/.temp/linked-project.json` | JSON | always (in `Effect.ensuring`) after `--project-ref` resolves — Go parity | -| `/telemetry.json` | JSON | always (in `Effect.ensuring`) at end of command — Go parity | +| Path | Format | When | +| ------------------------------------------------ | ------ | ------------------------------------------------------------------------ | +| `~/.supabase//linked-project.json` | JSON | always (in `Effect.ensuring`) after `--project-ref` resolves — Go parity | +| `~/.supabase/telemetry.json` | JSON | always (in `Effect.ensuring`) at end of command — Go parity | ## API Routes @@ -32,8 +32,7 @@ | Variable | Purpose | Required? | | ----------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------- | -| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `/access-token`) | -| `SUPABASE_HOME` | global CLI state root for auth, telemetry, traces, and shared binaries | no (defaults to `~/.supabase`) | +| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `~/.supabase/access-token`) | | `SUPABASE_PROFILE` | selects API base URL: `supabase` → `api.supabase.com`, `supabase-staging` → `api.supabase.green`, `supabase-local` → `http://localhost:8080`. May alternatively be a filesystem path to a YAML profile with at least `api_url:` and optional `name:` (Go parity — used by the cli-e2e test harness). | no (defaults to `supabase`) | | `SUPABASE_PROJECT_ID` | project ref fallback when `--project-ref` is unset | no (also reads `/supabase/.temp/project-ref` then prompts on TTY) | | `SUPABASE_WORKDIR` | base directory for the `.temp/project-ref` lookup | no (walks up from CWD looking for `supabase/config.toml`) | diff --git a/apps/cli/src/legacy/commands/secrets/unset/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/secrets/unset/SIDE_EFFECTS.md index 4c26c407f7..504a4d99f1 100644 --- a/apps/cli/src/legacy/commands/secrets/unset/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/secrets/unset/SIDE_EFFECTS.md @@ -2,20 +2,20 @@ ## Files Read -| Path | Format | When | -| --------------------------------------------- | ------------------------- | --------------------------------------------------------------------------------------------- | -| `/proc/sys/kernel/osrelease` (Linux) | plain text | once on layer init — disables keyring on WSL (`WSL` / `Microsoft` substring match) | -| keyring `"Supabase CLI"` / `` | OS keychain | when `SUPABASE_ACCESS_TOKEN` unset and keyring available; account = `LegacyCliConfig.profile` | -| keyring `"Supabase CLI"` / `access-token` | OS keychain | legacy-key fallback when the profile-keyed lookup misses | -| `/access-token` | plain text (token string) | last-resort fallback after env + keyring miss | -| `/supabase/.temp/project-ref` | plain text | when `--project-ref` and `SUPABASE_PROJECT_ID` are both unset | +| Path | Format | When | +| ----------------------------------------- | ------------------------- | --------------------------------------------------------------------------------------------- | +| `/proc/sys/kernel/osrelease` (Linux) | plain text | once on layer init — disables keyring on WSL (`WSL` / `Microsoft` substring match) | +| keyring `"Supabase CLI"` / `` | OS keychain | when `SUPABASE_ACCESS_TOKEN` unset and keyring available; account = `LegacyCliConfig.profile` | +| keyring `"Supabase CLI"` / `access-token` | OS keychain | legacy-key fallback when the profile-keyed lookup misses | +| `~/.supabase/access-token` | plain text (token string) | last-resort fallback after env + keyring miss | +| `/supabase/.temp/project-ref` | plain text | when `--project-ref` and `SUPABASE_PROJECT_ID` are both unset | ## Files Written -| Path | Format | When | -| ----------------------------------------------- | ------ | ------------------------------------------------------------------------ | -| `/supabase/.temp/linked-project.json` | JSON | always (in `Effect.ensuring`) after `--project-ref` resolves — Go parity | -| `/telemetry.json` | JSON | always (in `Effect.ensuring`) at end of command — Go parity | +| Path | Format | When | +| ------------------------------------------------ | ------ | ------------------------------------------------------------------------ | +| `~/.supabase//linked-project.json` | JSON | always (in `Effect.ensuring`) after `--project-ref` resolves — Go parity | +| `~/.supabase/telemetry.json` | JSON | always (in `Effect.ensuring`) at end of command — Go parity | ## API Routes @@ -29,8 +29,7 @@ | Variable | Purpose | Required? | | ----------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------- | -| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `/access-token`) | -| `SUPABASE_HOME` | global CLI state root for auth, telemetry, traces, and shared binaries | no (defaults to `~/.supabase`) | +| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `~/.supabase/access-token`) | | `SUPABASE_PROFILE` | selects API base URL: `supabase` → `api.supabase.com`, `supabase-staging` → `api.supabase.green`, `supabase-local` → `http://localhost:8080`. May alternatively be a filesystem path to a YAML profile with at least `api_url:` and optional `name:` (Go parity — used by the cli-e2e test harness). | no (defaults to `supabase`) | | `SUPABASE_PROJECT_ID` | project ref fallback when `--project-ref` is unset | no (also reads `/supabase/.temp/project-ref` then prompts on TTY) | | `SUPABASE_WORKDIR` | base directory for the `.temp/project-ref` lookup | no (walks up from CWD looking for `supabase/config.toml`) | diff --git a/apps/cli/src/legacy/commands/seed/buckets/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/seed/buckets/SIDE_EFFECTS.md index 054f4e2a97..ac81101201 100644 --- a/apps/cli/src/legacy/commands/seed/buckets/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/seed/buckets/SIDE_EFFECTS.md @@ -2,10 +2,10 @@ ## Files Read -| Path | Format | When | -| --------------------------------------------- | ---------- | ------------------------------------------------- | -| `/supabase/config.toml` | TOML | always, to read `[storage.buckets]` configuration | -| `/access-token` | plain text | when `--linked` and `SUPABASE_ACCESS_TOKEN` unset | +| Path | Format | When | +| -------------------------------- | ---------- | ------------------------------------------------- | +| `/supabase/config.toml` | TOML | always, to read `[storage.buckets]` configuration | +| `~/.supabase/access-token` | plain text | when `--linked` and `SUPABASE_ACCESS_TOKEN` unset | ## Files Written @@ -21,11 +21,10 @@ ## Environment Variables -| Variable | Purpose | Required? | -| ----------------------- | ---------------------------------------------------------------------- | -------------------------------------------------------------------------- | -| `SUPABASE_ACCESS_TOKEN` | auth token for `--linked` mode | no (falls back to keyring → `/access-token`) | -| `SUPABASE_HOME` | global CLI state root for auth, telemetry, traces, and shared binaries | no (defaults to `~/.supabase`) | -| `SUPABASE_API_URL` | override Management API base URL | no (defaults to `https://api.supabase.com`) | +| Variable | Purpose | Required? | +| ----------------------- | -------------------------------- | ------------------------------------------------------- | +| `SUPABASE_ACCESS_TOKEN` | auth token for `--linked` mode | no (falls back to keyring → `~/.supabase/access-token`) | +| `SUPABASE_API_URL` | override Management API base URL | no (defaults to `https://api.supabase.com`) | ## Exit Codes diff --git a/apps/cli/src/legacy/commands/services/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/services/SIDE_EFFECTS.md index 633d868a69..07092ca913 100644 --- a/apps/cli/src/legacy/commands/services/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/services/SIDE_EFFECTS.md @@ -2,17 +2,17 @@ ## Files Read -| Path | Format | When | -| --------------------------------------------- | ---------- | ------------------------------------------------------------------------------------------ | -| `supabase/.temp/project-ref` | plain text | when the checkout is linked and no explicit ref is already loaded | -| `/access-token` | plain text | when `SUPABASE_ACCESS_TOKEN` is unset and keyring access falls back to the home token file | +| Path | Format | When | +| ---------------------------- | ---------- | ------------------------------------------------------------------------------------------ | +| `supabase/.temp/project-ref` | plain text | when the checkout is linked and no explicit ref is already loaded | +| `~/.supabase/access-token` | plain text | when `SUPABASE_ACCESS_TOKEN` is unset and keyring access falls back to the home token file | ## Files Written -| Path | Format | When | -| ----------------------------------------------- | ------ | ------------------------------------------------------------------------------------------------------------------------------------------------ | -| `supabase/.temp/linked-project.json` | JSON | when a project ref resolves and no cache exists yet (`Effect.ensuring(linkedProjectCache.cache(ref))`, mirrors Go's `ensureProjectGroupsCached`) | -| `/telemetry.json` | JSON | always (`Effect.ensuring(telemetryState.flush)`) at end of the command | +| Path | Format | When | +| ------------------------------------ | ------ | ------------------------------------------------------------------------------------------------------------------------------------------------ | +| `supabase/.temp/linked-project.json` | JSON | when a project ref resolves and no cache exists yet (`Effect.ensuring(linkedProjectCache.cache(ref))`, mirrors Go's `ensureProjectGroupsCached`) | +| `~/.supabase/telemetry.json` | JSON | always (`Effect.ensuring(telemetryState.flush)`) at end of the command | ## API Routes @@ -33,11 +33,10 @@ matching `apps/cli-go/pkg/fetcher/gateway.go`. ## Environment Variables -| Variable | Purpose | Required? | -| ----------------------- | ---------------------------------------------------------------------- | ------------------------------------------------------------------------------ | -| `SUPABASE_ACCESS_TOKEN` | auth token for Management API linked-version checks | no (falls back to keyring, then `/access-token`) | -| `SUPABASE_HOME` | global CLI state root for auth, telemetry, traces, and shared binaries | no (defaults to `~/.supabase`) | -| `SUPABASE_API_URL` | override Management API base URL | no (defaults to `https://api.supabase.com`) | +| Variable | Purpose | Required? | +| ----------------------- | --------------------------------------------------- | ----------------------------------------------------------- | +| `SUPABASE_ACCESS_TOKEN` | auth token for Management API linked-version checks | no (falls back to keyring, then `~/.supabase/access-token`) | +| `SUPABASE_API_URL` | override Management API base URL | no (defaults to `https://api.supabase.com`) | ## Exit Codes diff --git a/apps/cli/src/legacy/commands/snippets/download/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/snippets/download/SIDE_EFFECTS.md index 15a07377c3..19f3323f9e 100644 --- a/apps/cli/src/legacy/commands/snippets/download/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/snippets/download/SIDE_EFFECTS.md @@ -6,16 +6,16 @@ | ---------------------------------------------- | ------------------------- | --------------------------------------------------------------------------------------------- | | keyring `"Supabase CLI"` / `` | OS keychain | when `SUPABASE_ACCESS_TOKEN` unset and keyring available; account = `LegacyCliConfig.profile` | | keyring `"Supabase CLI"` / `access-token` | OS keychain | legacy-key fallback when the profile-keyed lookup misses | -| `/access-token` | plain text (token string) | last-resort fallback after env + keyring miss | +| `~/.supabase/access-token` | plain text (token string) | last-resort fallback after env + keyring miss | | `/supabase/.temp/project-ref` | plain text | when `--project-ref` flag and `PROJECT_ID` env are unset | | `/supabase/.temp/linked-project.json` | JSON | always — `linkedProjectCache` reads to decide whether to write | ## Files Written -| Path | Format | When | -| ----------------------------------------------- | ------ | ------------------------------------------------------------------- | -| `/telemetry.json` | JSON | always (`Effect.ensuring(telemetryState.flush)`) | -| `/supabase/.temp/linked-project.json` | JSON | best-effort after `--project-ref` resolves (Go `PersistentPostRun`) | +| Path | Format | When | +| ---------------------------------------------- | ------ | ------------------------------------------------------------------- | +| `~/.supabase/telemetry.json` | JSON | always (`Effect.ensuring(telemetryState.flush)`) | +| `/supabase/.temp/linked-project.json` | JSON | best-effort after `--project-ref` resolves (Go `PersistentPostRun`) | ## API Routes @@ -27,13 +27,12 @@ Only `content.sql` is rendered in text mode. The full payload is exposed via `-- ## Environment Variables -| Variable | Purpose | Required? | -| ----------------------- | ---------------------------------------------------------------------- | -------------------------------------------------------------------------- | -| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `/access-token`) | -| `SUPABASE_HOME` | global CLI state root for auth, telemetry, traces, and shared binaries | no (defaults to `~/.supabase`) | -| `PROJECT_ID` | project ref fallback when `--project-ref` is unset | no (falls back to `supabase/.temp/project-ref`) | -| `SUPABASE_API_URL` | override Management API base URL | no (defaults to `https://api.supabase.com`) | -| `SUPABASE_PROFILE` | profile selector (built-in name or YAML file path) | no (defaults to `supabase`) | +| Variable | Purpose | Required? | +| ----------------------- | ---------------------------------------------------- | ------------------------------------------------------- | +| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `~/.supabase/access-token`) | +| `PROJECT_ID` | project ref fallback when `--project-ref` is unset | no (falls back to `supabase/.temp/project-ref`) | +| `SUPABASE_API_URL` | override Management API base URL | no (defaults to `https://api.supabase.com`) | +| `SUPABASE_PROFILE` | profile selector (built-in name or YAML file path) | no (defaults to `supabase`) | ## Exit Codes diff --git a/apps/cli/src/legacy/commands/snippets/list/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/snippets/list/SIDE_EFFECTS.md index 21290329a8..867b2331ac 100644 --- a/apps/cli/src/legacy/commands/snippets/list/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/snippets/list/SIDE_EFFECTS.md @@ -6,16 +6,16 @@ | ---------------------------------------------- | ------------------------- | --------------------------------------------------------------------------------------------- | | keyring `"Supabase CLI"` / `` | OS keychain | when `SUPABASE_ACCESS_TOKEN` unset and keyring available; account = `LegacyCliConfig.profile` | | keyring `"Supabase CLI"` / `access-token` | OS keychain | legacy-key fallback when the profile-keyed lookup misses | -| `/access-token` | plain text (token string) | last-resort fallback after env + keyring miss | +| `~/.supabase/access-token` | plain text (token string) | last-resort fallback after env + keyring miss | | `/supabase/.temp/project-ref` | plain text | when `--project-ref` flag and `PROJECT_ID` env are unset | | `/supabase/.temp/linked-project.json` | JSON | always — `linkedProjectCache` reads to decide whether to write | ## Files Written -| Path | Format | When | -| ----------------------------------------------- | ------ | ------------------------------------------------------------------- | -| `/telemetry.json` | JSON | always (`Effect.ensuring(telemetryState.flush)`) | -| `/supabase/.temp/linked-project.json` | JSON | best-effort after `--project-ref` resolves (Go `PersistentPostRun`) | +| Path | Format | When | +| ---------------------------------------------- | ------ | ------------------------------------------------------------------- | +| `~/.supabase/telemetry.json` | JSON | always (`Effect.ensuring(telemetryState.flush)`) | +| `/supabase/.temp/linked-project.json` | JSON | best-effort after `--project-ref` resolves (Go `PersistentPostRun`) | ## API Routes @@ -25,13 +25,12 @@ ## Environment Variables -| Variable | Purpose | Required? | -| ----------------------- | ---------------------------------------------------------------------- | -------------------------------------------------------------------------- | -| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `/access-token`) | -| `SUPABASE_HOME` | global CLI state root for auth, telemetry, traces, and shared binaries | no (defaults to `~/.supabase`) | -| `PROJECT_ID` | project ref fallback when `--project-ref` is unset | no (falls back to `supabase/.temp/project-ref`) | -| `SUPABASE_API_URL` | override Management API base URL | no (defaults to `https://api.supabase.com`) | -| `SUPABASE_PROFILE` | profile selector (built-in name or YAML file path) | no (defaults to `supabase`) | +| Variable | Purpose | Required? | +| ----------------------- | ---------------------------------------------------- | ------------------------------------------------------- | +| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `~/.supabase/access-token`) | +| `PROJECT_ID` | project ref fallback when `--project-ref` is unset | no (falls back to `supabase/.temp/project-ref`) | +| `SUPABASE_API_URL` | override Management API base URL | no (defaults to `https://api.supabase.com`) | +| `SUPABASE_PROFILE` | profile selector (built-in name or YAML file path) | no (defaults to `supabase`) | ## Exit Codes diff --git a/apps/cli/src/legacy/commands/ssl-enforcement/get/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/ssl-enforcement/get/SIDE_EFFECTS.md index 61f44d920c..d06a2d9671 100644 --- a/apps/cli/src/legacy/commands/ssl-enforcement/get/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/ssl-enforcement/get/SIDE_EFFECTS.md @@ -2,17 +2,17 @@ ## Files Read -| Path | Format | When | -| --------------------------------------------- | ------------------------- | ------------------------------------------------------------- | -| `/access-token` | plain text (token string) | when `SUPABASE_ACCESS_TOKEN` unset and keyring unavailable | -| `/supabase/.temp/project-ref` | plain text (project ref) | when `--project-ref` flag and `PROJECT_ID` env are both unset | +| Path | Format | When | +| -------------------------------------- | ------------------------- | ------------------------------------------------------------- | +| `~/.supabase/access-token` | plain text (token string) | when `SUPABASE_ACCESS_TOKEN` unset and keyring unavailable | +| `/supabase/.temp/project-ref` | plain text (project ref) | when `--project-ref` flag and `PROJECT_ID` env are both unset | ## Files Written -| Path | Format | When | -| ----------------------------------------------- | ------ | ----------------------------------------------------------------------------- | -| `/supabase/.temp/linked-project.json` | JSON | always (after ref resolution), via `Effect.ensuring` — on success and failure | -| `/telemetry.json` | JSON | always, via `Effect.ensuring` — on success and failure | +| Path | Format | When | +| ------------------------------------------------ | ------ | ----------------------------------------------------------------------------- | +| `~/.supabase//linked-project.json` | JSON | always (after ref resolution), via `Effect.ensuring` — on success and failure | +| `~/.supabase/telemetry.json` | JSON | always, via `Effect.ensuring` — on success and failure | ## API Routes @@ -22,12 +22,11 @@ ## Environment Variables -| Variable | Purpose | Required? | -| ----------------------- | ---------------------------------------------------------------------- | -------------------------------------------------------------------------- | -| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `/access-token`) | -| `SUPABASE_HOME` | global CLI state root for auth, telemetry, traces, and shared binaries | no (defaults to `~/.supabase`) | -| `SUPABASE_API_URL` | override Management API base URL | no (defaults to `https://api.supabase.com`) | -| `PROJECT_ID` | project ref fallback when `--project-ref` is unset | no (falls back to `supabase/.temp/project-ref` → prompt) | +| Variable | Purpose | Required? | +| ----------------------- | ---------------------------------------------------- | -------------------------------------------------------- | +| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `~/.supabase/access-token`) | +| `SUPABASE_API_URL` | override Management API base URL | no (defaults to `https://api.supabase.com`) | +| `PROJECT_ID` | project ref fallback when `--project-ref` is unset | no (falls back to `supabase/.temp/project-ref` → prompt) | ## Exit Codes diff --git a/apps/cli/src/legacy/commands/ssl-enforcement/update/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/ssl-enforcement/update/SIDE_EFFECTS.md index 27d01d41da..f6caab93da 100644 --- a/apps/cli/src/legacy/commands/ssl-enforcement/update/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/ssl-enforcement/update/SIDE_EFFECTS.md @@ -2,17 +2,17 @@ ## Files Read -| Path | Format | When | -| --------------------------------------------- | ------------------------- | ------------------------------------------------------------- | -| `/access-token` | plain text (token string) | when `SUPABASE_ACCESS_TOKEN` unset and keyring unavailable | -| `/supabase/.temp/project-ref` | plain text (project ref) | when `--project-ref` flag and `PROJECT_ID` env are both unset | +| Path | Format | When | +| -------------------------------------- | ------------------------- | ------------------------------------------------------------- | +| `~/.supabase/access-token` | plain text (token string) | when `SUPABASE_ACCESS_TOKEN` unset and keyring unavailable | +| `/supabase/.temp/project-ref` | plain text (project ref) | when `--project-ref` flag and `PROJECT_ID` env are both unset | ## Files Written -| Path | Format | When | -| ----------------------------------------------- | ------ | ----------------------------------------------------------------------------------------- | -| `/supabase/.temp/linked-project.json` | JSON | after the project ref is resolved (only if flag validation passes), via `Effect.ensuring` | -| `/telemetry.json` | JSON | always, via `Effect.ensuring` — including flag-validation failures | +| Path | Format | When | +| ------------------------------------------------ | ------ | ----------------------------------------------------------------------------------------- | +| `~/.supabase//linked-project.json` | JSON | after the project ref is resolved (only if flag validation passes), via `Effect.ensuring` | +| `~/.supabase/telemetry.json` | JSON | always, via `Effect.ensuring` — including flag-validation failures | ## API Routes @@ -22,12 +22,11 @@ ## Environment Variables -| Variable | Purpose | Required? | -| ----------------------- | ---------------------------------------------------------------------- | -------------------------------------------------------------------------- | -| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `/access-token`) | -| `SUPABASE_HOME` | global CLI state root for auth, telemetry, traces, and shared binaries | no (defaults to `~/.supabase`) | -| `SUPABASE_API_URL` | override Management API base URL | no (defaults to `https://api.supabase.com`) | -| `PROJECT_ID` | project ref fallback when `--project-ref` is unset | no (falls back to `supabase/.temp/project-ref` → prompt) | +| Variable | Purpose | Required? | +| ----------------------- | ---------------------------------------------------- | -------------------------------------------------------- | +| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `~/.supabase/access-token`) | +| `SUPABASE_API_URL` | override Management API base URL | no (defaults to `https://api.supabase.com`) | +| `PROJECT_ID` | project ref fallback when `--project-ref` is unset | no (falls back to `supabase/.temp/project-ref` → prompt) | ## Exit Codes diff --git a/apps/cli/src/legacy/commands/sso/add/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/sso/add/SIDE_EFFECTS.md index ab5a9c119a..350a2d34c9 100644 --- a/apps/cli/src/legacy/commands/sso/add/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/sso/add/SIDE_EFFECTS.md @@ -6,17 +6,17 @@ | ---------------------------------------------- | ------------------------- | --------------------------------------------------------------------------------------------- | | keyring `"Supabase CLI"` / `` | OS keychain | when `SUPABASE_ACCESS_TOKEN` unset and keyring available; account = `LegacyCliConfig.profile` | | keyring `"Supabase CLI"` / `access-token` | OS keychain | legacy-key fallback when the profile-keyed lookup misses | -| `/access-token` | plain text (token string) | last-resort fallback after env + keyring miss | +| `~/.supabase/access-token` | plain text (token string) | last-resort fallback after env + keyring miss | | `/supabase/.temp/linked-project.json` | JSON | always — `linkedProjectCache` reads to decide whether to write | | `` | XML (UTF-8) | when `--metadata-file` is provided | | `` | JSON | when `--attribute-mapping-file` is provided | ## Files Written -| Path | Format | When | -| ----------------------------------------------- | ------ | ------------------------------------------------------------------- | -| `/telemetry.json` | JSON | always (`Effect.ensuring(telemetryState.flush)`) | -| `/supabase/.temp/linked-project.json` | JSON | best-effort after `--project-ref` resolves (Go `PersistentPostRun`) | +| Path | Format | When | +| ---------------------------------------------- | ------ | ------------------------------------------------------------------- | +| `~/.supabase/telemetry.json` | JSON | always (`Effect.ensuring(telemetryState.flush)`) | +| `/supabase/.temp/linked-project.json` | JSON | best-effort after `--project-ref` resolves (Go `PersistentPostRun`) | ## API Routes @@ -33,11 +33,10 @@ same shape via an inline anonymous struct with `Default *any`. ## Environment Variables -| Variable | Purpose | Required? | -| ----------------------- | ---------------------------------------------------------------------- | -------------------------------------------------------------------------- | -| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `/access-token`) | -| `SUPABASE_HOME` | global CLI state root for auth, telemetry, traces, and shared binaries | no (defaults to `~/.supabase`) | -| `SUPABASE_PROFILE` | profile selector (built-in name or YAML file path) | no (defaults to `supabase`) | +| Variable | Purpose | Required? | +| ----------------------- | ---------------------------------------------------- | ------------------------------------------------------- | +| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `~/.supabase/access-token`) | +| `SUPABASE_PROFILE` | profile selector (built-in name or YAML file path) | no (defaults to `supabase`) | ## Exit Codes diff --git a/apps/cli/src/legacy/commands/sso/info/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/sso/info/SIDE_EFFECTS.md index 769d0946e5..9f53e45af8 100644 --- a/apps/cli/src/legacy/commands/sso/info/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/sso/info/SIDE_EFFECTS.md @@ -10,10 +10,10 @@ ## Files Written -| Path | Format | When | -| ----------------------------------------------- | ------ | ------------------------------------------------------------------- | -| `/telemetry.json` | JSON | always (`Effect.ensuring(telemetryState.flush)`) | -| `/supabase/.temp/linked-project.json` | JSON | best-effort after `--project-ref` resolves (Go `PersistentPostRun`) | +| Path | Format | When | +| ---------------------------------------------- | ------ | ------------------------------------------------------------------- | +| `~/.supabase/telemetry.json` | JSON | always (`Effect.ensuring(telemetryState.flush)`) | +| `/supabase/.temp/linked-project.json` | JSON | best-effort after `--project-ref` resolves (Go `PersistentPostRun`) | ## API Routes @@ -22,10 +22,9 @@ calls are made. ## Environment Variables -| Variable | Purpose | Required? | -| ------------------ | ---------------------------------------------------------------------- | ------------------------------ | -| `SUPABASE_HOME` | global CLI state root for auth, telemetry, traces, and shared binaries | no (defaults to `~/.supabase`) | -| `SUPABASE_PROFILE` | profile selector (built-in name or YAML file path) | no (defaults to `supabase`) | +| Variable | Purpose | Required? | +| ------------------ | -------------------------------------------------- | --------------------------- | +| `SUPABASE_PROFILE` | profile selector (built-in name or YAML file path) | no (defaults to `supabase`) | ## Exit Codes diff --git a/apps/cli/src/legacy/commands/sso/list/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/sso/list/SIDE_EFFECTS.md index bbd49b2a4d..4648596fd8 100644 --- a/apps/cli/src/legacy/commands/sso/list/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/sso/list/SIDE_EFFECTS.md @@ -6,15 +6,15 @@ | ---------------------------------------------- | ------------------------- | --------------------------------------------------------------------------------------------- | | keyring `"Supabase CLI"` / `` | OS keychain | when `SUPABASE_ACCESS_TOKEN` unset and keyring available; account = `LegacyCliConfig.profile` | | keyring `"Supabase CLI"` / `access-token` | OS keychain | legacy-key fallback when the profile-keyed lookup misses | -| `/access-token` | plain text (token string) | last-resort fallback after env + keyring miss | +| `~/.supabase/access-token` | plain text (token string) | last-resort fallback after env + keyring miss | | `/supabase/.temp/linked-project.json` | JSON | always — `linkedProjectCache` reads to decide whether to write | ## Files Written -| Path | Format | When | -| ----------------------------------------------- | ------ | ------------------------------------------------------------------- | -| `/telemetry.json` | JSON | always (`Effect.ensuring(telemetryState.flush)`) | -| `/supabase/.temp/linked-project.json` | JSON | best-effort after `--project-ref` resolves (Go `PersistentPostRun`) | +| Path | Format | When | +| ---------------------------------------------- | ------ | ------------------------------------------------------------------- | +| `~/.supabase/telemetry.json` | JSON | always (`Effect.ensuring(telemetryState.flush)`) | +| `/supabase/.temp/linked-project.json` | JSON | best-effort after `--project-ref` resolves (Go `PersistentPostRun`) | ## API Routes @@ -26,11 +26,10 @@ ## Environment Variables -| Variable | Purpose | Required? | -| ----------------------- | ---------------------------------------------------------------------- | -------------------------------------------------------------------------- | -| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `/access-token`) | -| `SUPABASE_HOME` | global CLI state root for auth, telemetry, traces, and shared binaries | no (defaults to `~/.supabase`) | -| `SUPABASE_PROFILE` | profile selector (built-in name or YAML file path) | no (defaults to `supabase`) | +| Variable | Purpose | Required? | +| ----------------------- | ---------------------------------------------------- | ------------------------------------------------------- | +| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `~/.supabase/access-token`) | +| `SUPABASE_PROFILE` | profile selector (built-in name or YAML file path) | no (defaults to `supabase`) | ## Exit Codes diff --git a/apps/cli/src/legacy/commands/sso/remove/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/sso/remove/SIDE_EFFECTS.md index d1a12c7c75..34bcb32e3c 100644 --- a/apps/cli/src/legacy/commands/sso/remove/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/sso/remove/SIDE_EFFECTS.md @@ -6,15 +6,15 @@ | ---------------------------------------------- | ------------------------- | --------------------------------------------------------------------------------------------- | | keyring `"Supabase CLI"` / `` | OS keychain | when `SUPABASE_ACCESS_TOKEN` unset and keyring available; account = `LegacyCliConfig.profile` | | keyring `"Supabase CLI"` / `access-token` | OS keychain | legacy-key fallback when the profile-keyed lookup misses | -| `/access-token` | plain text (token string) | last-resort fallback after env + keyring miss | +| `~/.supabase/access-token` | plain text (token string) | last-resort fallback after env + keyring miss | | `/supabase/.temp/linked-project.json` | JSON | always — `linkedProjectCache` reads to decide whether to write | ## Files Written -| Path | Format | When | -| ----------------------------------------------- | ------ | ------------------------------------------------------------------- | -| `/telemetry.json` | JSON | always (`Effect.ensuring(telemetryState.flush)`) | -| `/supabase/.temp/linked-project.json` | JSON | best-effort after `--project-ref` resolves (Go `PersistentPostRun`) | +| Path | Format | When | +| ---------------------------------------------- | ------ | ------------------------------------------------------------------- | +| `~/.supabase/telemetry.json` | JSON | always (`Effect.ensuring(telemetryState.flush)`) | +| `/supabase/.temp/linked-project.json` | JSON | best-effort after `--project-ref` resolves (Go `PersistentPostRun`) | ## API Routes @@ -26,11 +26,10 @@ ## Environment Variables -| Variable | Purpose | Required? | -| ----------------------- | ---------------------------------------------------------------------- | -------------------------------------------------------------------------- | -| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `/access-token`) | -| `SUPABASE_HOME` | global CLI state root for auth, telemetry, traces, and shared binaries | no (defaults to `~/.supabase`) | -| `SUPABASE_PROFILE` | profile selector (built-in name or YAML file path) | no (defaults to `supabase`) | +| Variable | Purpose | Required? | +| ----------------------- | ---------------------------------------------------- | ------------------------------------------------------- | +| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `~/.supabase/access-token`) | +| `SUPABASE_PROFILE` | profile selector (built-in name or YAML file path) | no (defaults to `supabase`) | ## Exit Codes diff --git a/apps/cli/src/legacy/commands/sso/show/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/sso/show/SIDE_EFFECTS.md index cc436d8bfc..ea25d6e730 100644 --- a/apps/cli/src/legacy/commands/sso/show/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/sso/show/SIDE_EFFECTS.md @@ -6,15 +6,15 @@ | ---------------------------------------------- | ------------------------- | --------------------------------------------------------------------------------------------- | | keyring `"Supabase CLI"` / `` | OS keychain | when `SUPABASE_ACCESS_TOKEN` unset and keyring available; account = `LegacyCliConfig.profile` | | keyring `"Supabase CLI"` / `access-token` | OS keychain | legacy-key fallback when the profile-keyed lookup misses | -| `/access-token` | plain text (token string) | last-resort fallback after env + keyring miss | +| `~/.supabase/access-token` | plain text (token string) | last-resort fallback after env + keyring miss | | `/supabase/.temp/linked-project.json` | JSON | always — `linkedProjectCache` reads to decide whether to write | ## Files Written -| Path | Format | When | -| ----------------------------------------------- | ------ | ------------------------------------------------------------------- | -| `/telemetry.json` | JSON | always (`Effect.ensuring(telemetryState.flush)`) | -| `/supabase/.temp/linked-project.json` | JSON | best-effort after `--project-ref` resolves (Go `PersistentPostRun`) | +| Path | Format | When | +| ---------------------------------------------- | ------ | ------------------------------------------------------------------- | +| `~/.supabase/telemetry.json` | JSON | always (`Effect.ensuring(telemetryState.flush)`) | +| `/supabase/.temp/linked-project.json` | JSON | best-effort after `--project-ref` resolves (Go `PersistentPostRun`) | ## API Routes @@ -27,11 +27,10 @@ side-calls — matches Go's `get.go`. ## Environment Variables -| Variable | Purpose | Required? | -| ----------------------- | ---------------------------------------------------------------------- | -------------------------------------------------------------------------- | -| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `/access-token`) | -| `SUPABASE_HOME` | global CLI state root for auth, telemetry, traces, and shared binaries | no (defaults to `~/.supabase`) | -| `SUPABASE_PROFILE` | profile selector (built-in name or YAML file path) | no (defaults to `supabase`) | +| Variable | Purpose | Required? | +| ----------------------- | ---------------------------------------------------- | ------------------------------------------------------- | +| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `~/.supabase/access-token`) | +| `SUPABASE_PROFILE` | profile selector (built-in name or YAML file path) | no (defaults to `supabase`) | ## Exit Codes diff --git a/apps/cli/src/legacy/commands/sso/update/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/sso/update/SIDE_EFFECTS.md index fc3a086675..961ea33239 100644 --- a/apps/cli/src/legacy/commands/sso/update/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/sso/update/SIDE_EFFECTS.md @@ -6,17 +6,17 @@ | ---------------------------------------------- | ------------------------- | --------------------------------------------------------------------------------------------- | | keyring `"Supabase CLI"` / `` | OS keychain | when `SUPABASE_ACCESS_TOKEN` unset and keyring available; account = `LegacyCliConfig.profile` | | keyring `"Supabase CLI"` / `access-token` | OS keychain | legacy-key fallback when the profile-keyed lookup misses | -| `/access-token` | plain text (token string) | last-resort fallback after env + keyring miss | +| `~/.supabase/access-token` | plain text (token string) | last-resort fallback after env + keyring miss | | `/supabase/.temp/linked-project.json` | JSON | always — `linkedProjectCache` reads to decide whether to write | | `` | XML (UTF-8) | when `--metadata-file` is provided | | `` | JSON | when `--attribute-mapping-file` is provided | ## Files Written -| Path | Format | When | -| ----------------------------------------------- | ------ | ------------------------------------------------------------------- | -| `/telemetry.json` | JSON | always (`Effect.ensuring(telemetryState.flush)`) | -| `/supabase/.temp/linked-project.json` | JSON | best-effort after `--project-ref` resolves (Go `PersistentPostRun`) | +| Path | Format | When | +| ---------------------------------------------- | ------ | ------------------------------------------------------------------- | +| `~/.supabase/telemetry.json` | JSON | always (`Effect.ensuring(telemetryState.flush)`) | +| `/supabase/.temp/linked-project.json` | JSON | best-effort after `--project-ref` resolves (Go `PersistentPostRun`) | ## API Routes @@ -34,11 +34,10 @@ GET still uses the typed client. ## Environment Variables -| Variable | Purpose | Required? | -| ----------------------- | ---------------------------------------------------------------------- | -------------------------------------------------------------------------- | -| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `/access-token`) | -| `SUPABASE_HOME` | global CLI state root for auth, telemetry, traces, and shared binaries | no (defaults to `~/.supabase`) | -| `SUPABASE_PROFILE` | profile selector (built-in name or YAML file path) | no (defaults to `supabase`) | +| Variable | Purpose | Required? | +| ----------------------- | ---------------------------------------------------- | ------------------------------------------------------- | +| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `~/.supabase/access-token`) | +| `SUPABASE_PROFILE` | profile selector (built-in name or YAML file path) | no (defaults to `supabase`) | ## Exit Codes diff --git a/apps/cli/src/legacy/commands/storage/cp/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/storage/cp/SIDE_EFFECTS.md index c211e7e7ea..5865755099 100644 --- a/apps/cli/src/legacy/commands/storage/cp/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/storage/cp/SIDE_EFFECTS.md @@ -2,10 +2,10 @@ ## Files Read -| Path | Format | When | -| --------------------------------------------- | ---------- | ---------------------------------------------------------- | -| `/access-token` | plain text | when `SUPABASE_ACCESS_TOKEN` unset and keyring unavailable | -| `` | binary | when src is a local file path | +| Path | Format | When | +| -------------------------- | ---------- | ---------------------------------------------------------- | +| `~/.supabase/access-token` | plain text | when `SUPABASE_ACCESS_TOKEN` unset and keyring unavailable | +| `` | binary | when src is a local file path | ## Files Written @@ -22,11 +22,10 @@ ## Environment Variables -| Variable | Purpose | Required? | -| ----------------------- | ---------------------------------------------------------------------- | -------------------------------------------------------------------------- | -| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `/access-token`) | -| `SUPABASE_HOME` | global CLI state root for auth, telemetry, traces, and shared binaries | no (defaults to `~/.supabase`) | -| `SUPABASE_API_URL` | override Management API base URL | no (defaults to `https://api.supabase.com`) | +| Variable | Purpose | Required? | +| ----------------------- | ---------------------------------------------------- | ------------------------------------------------------- | +| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `~/.supabase/access-token`) | +| `SUPABASE_API_URL` | override Management API base URL | no (defaults to `https://api.supabase.com`) | ## Exit Codes diff --git a/apps/cli/src/legacy/commands/storage/ls/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/storage/ls/SIDE_EFFECTS.md index 35253e7740..13ae89b088 100644 --- a/apps/cli/src/legacy/commands/storage/ls/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/storage/ls/SIDE_EFFECTS.md @@ -2,9 +2,9 @@ ## Files Read -| Path | Format | When | -| --------------------------------------------- | ---------- | ---------------------------------------------------------- | -| `/access-token` | plain text | when `SUPABASE_ACCESS_TOKEN` unset and keyring unavailable | +| Path | Format | When | +| -------------------------- | ---------- | ---------------------------------------------------------- | +| `~/.supabase/access-token` | plain text | when `SUPABASE_ACCESS_TOKEN` unset and keyring unavailable | ## Files Written @@ -20,11 +20,10 @@ ## Environment Variables -| Variable | Purpose | Required? | -| ----------------------- | ---------------------------------------------------------------------- | -------------------------------------------------------------------------- | -| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `/access-token`) | -| `SUPABASE_HOME` | global CLI state root for auth, telemetry, traces, and shared binaries | no (defaults to `~/.supabase`) | -| `SUPABASE_API_URL` | override Management API base URL | no (defaults to `https://api.supabase.com`) | +| Variable | Purpose | Required? | +| ----------------------- | ---------------------------------------------------- | ------------------------------------------------------- | +| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `~/.supabase/access-token`) | +| `SUPABASE_API_URL` | override Management API base URL | no (defaults to `https://api.supabase.com`) | ## Exit Codes diff --git a/apps/cli/src/legacy/commands/storage/mv/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/storage/mv/SIDE_EFFECTS.md index a5ec50253a..1187b8e36a 100644 --- a/apps/cli/src/legacy/commands/storage/mv/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/storage/mv/SIDE_EFFECTS.md @@ -2,9 +2,9 @@ ## Files Read -| Path | Format | When | -| --------------------------------------------- | ---------- | ---------------------------------------------------------- | -| `/access-token` | plain text | when `SUPABASE_ACCESS_TOKEN` unset and keyring unavailable | +| Path | Format | When | +| -------------------------- | ---------- | ---------------------------------------------------------- | +| `~/.supabase/access-token` | plain text | when `SUPABASE_ACCESS_TOKEN` unset and keyring unavailable | ## Files Written @@ -20,11 +20,10 @@ ## Environment Variables -| Variable | Purpose | Required? | -| ----------------------- | ---------------------------------------------------------------------- | -------------------------------------------------------------------------- | -| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `/access-token`) | -| `SUPABASE_HOME` | global CLI state root for auth, telemetry, traces, and shared binaries | no (defaults to `~/.supabase`) | -| `SUPABASE_API_URL` | override Management API base URL | no (defaults to `https://api.supabase.com`) | +| Variable | Purpose | Required? | +| ----------------------- | ---------------------------------------------------- | ------------------------------------------------------- | +| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `~/.supabase/access-token`) | +| `SUPABASE_API_URL` | override Management API base URL | no (defaults to `https://api.supabase.com`) | ## Exit Codes diff --git a/apps/cli/src/legacy/commands/storage/rm/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/storage/rm/SIDE_EFFECTS.md index f41abe340f..66ceb44709 100644 --- a/apps/cli/src/legacy/commands/storage/rm/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/storage/rm/SIDE_EFFECTS.md @@ -2,9 +2,9 @@ ## Files Read -| Path | Format | When | -| --------------------------------------------- | ---------- | ---------------------------------------------------------- | -| `/access-token` | plain text | when `SUPABASE_ACCESS_TOKEN` unset and keyring unavailable | +| Path | Format | When | +| -------------------------- | ---------- | ---------------------------------------------------------- | +| `~/.supabase/access-token` | plain text | when `SUPABASE_ACCESS_TOKEN` unset and keyring unavailable | ## Files Written @@ -20,11 +20,10 @@ ## Environment Variables -| Variable | Purpose | Required? | -| ----------------------- | ---------------------------------------------------------------------- | -------------------------------------------------------------------------- | -| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `/access-token`) | -| `SUPABASE_HOME` | global CLI state root for auth, telemetry, traces, and shared binaries | no (defaults to `~/.supabase`) | -| `SUPABASE_API_URL` | override Management API base URL | no (defaults to `https://api.supabase.com`) | +| Variable | Purpose | Required? | +| ----------------------- | ---------------------------------------------------- | ------------------------------------------------------- | +| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `~/.supabase/access-token`) | +| `SUPABASE_API_URL` | override Management API base URL | no (defaults to `https://api.supabase.com`) | ## Exit Codes diff --git a/apps/cli/src/legacy/commands/telemetry/disable/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/telemetry/disable/SIDE_EFFECTS.md index 688d2e7ba7..1be0ffbf9f 100644 --- a/apps/cli/src/legacy/commands/telemetry/disable/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/telemetry/disable/SIDE_EFFECTS.md @@ -2,18 +2,18 @@ ## Files Read -| Path | Format | When | -| ----------------------------------------------- | ------ | --------------------------------------------------------------------------- | -| `/telemetry.json` | JSON | when the file exists, to preserve prior identity fields before rewriting it | +| Path | Format | When | +| ---------------------------- | ------ | --------------------------------------------------------------------------- | +| `~/.supabase/telemetry.json` | JSON | when the file exists, to preserve prior identity fields before rewriting it | When `SUPABASE_HOME` is set, the command uses `$SUPABASE_HOME/telemetry.json` -instead of `/telemetry.json`. +instead of `~/.supabase/telemetry.json`. ## Files Written -| Path | Format | When | -| ----------------------------------------------- | ------ | ------ | -| `/telemetry.json` | JSON | always | +| Path | Format | When | +| ---------------------------- | ------ | ------ | +| `~/.supabase/telemetry.json` | JSON | always | ## API Routes diff --git a/apps/cli/src/legacy/commands/telemetry/enable/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/telemetry/enable/SIDE_EFFECTS.md index 07d82dba1f..3942a107dc 100644 --- a/apps/cli/src/legacy/commands/telemetry/enable/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/telemetry/enable/SIDE_EFFECTS.md @@ -2,18 +2,18 @@ ## Files Read -| Path | Format | When | -| ----------------------------------------------- | ------ | --------------------------------------------------------------------------- | -| `/telemetry.json` | JSON | when the file exists, to preserve prior identity fields before rewriting it | +| Path | Format | When | +| ---------------------------- | ------ | --------------------------------------------------------------------------- | +| `~/.supabase/telemetry.json` | JSON | when the file exists, to preserve prior identity fields before rewriting it | When `SUPABASE_HOME` is set, the command uses `$SUPABASE_HOME/telemetry.json` -instead of `/telemetry.json`. +instead of `~/.supabase/telemetry.json`. ## Files Written -| Path | Format | When | -| ----------------------------------------------- | ------ | ------ | -| `/telemetry.json` | JSON | always | +| Path | Format | When | +| ---------------------------- | ------ | ------ | +| `~/.supabase/telemetry.json` | JSON | always | ## API Routes diff --git a/apps/cli/src/legacy/commands/telemetry/status/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/telemetry/status/SIDE_EFFECTS.md index fe9d242087..2c93acd75b 100644 --- a/apps/cli/src/legacy/commands/telemetry/status/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/telemetry/status/SIDE_EFFECTS.md @@ -2,18 +2,18 @@ ## Files Read -| Path | Format | When | -| ----------------------------------------------- | ------ | ------------------------------------------------------------------ | -| `/telemetry.json` | JSON | when the file exists, to load the current state before printing it | +| Path | Format | When | +| ---------------------------- | ------ | ------------------------------------------------------------------ | +| `~/.supabase/telemetry.json` | JSON | when the file exists, to load the current state before printing it | When `SUPABASE_HOME` is set, the command uses `$SUPABASE_HOME/telemetry.json` -instead of `/telemetry.json`. +instead of `~/.supabase/telemetry.json`. ## Files Written -| Path | Format | When | -| ----------------------------------------------- | ------ | -------------------------------------------------------------------------------------- | -| `/telemetry.json` | JSON | always, because `status` refreshes `session_last_active` and recreates malformed state | +| Path | Format | When | +| ---------------------------- | ------ | -------------------------------------------------------------------------------------- | +| `~/.supabase/telemetry.json` | JSON | always, because `status` refreshes `session_last_active` and recreates malformed state | ## API Routes diff --git a/apps/cli/src/legacy/commands/test/db/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/test/db/SIDE_EFFECTS.md index 1158415414..81014d92af 100644 --- a/apps/cli/src/legacy/commands/test/db/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/test/db/SIDE_EFFECTS.md @@ -2,13 +2,13 @@ ## Files Read -| Path | Format | When | -| --------------------------------------------- | ------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------- | -| `/supabase/tests/**/*.{sql,pg}` | SQL | default test discovery when no `[path]` given | -| `` | SQL | when explicit test files/dirs are passed | -| `/supabase/config.toml` | TOML | always: `db.port`, `db.shadow_port`, `db.password`, `project_id`. Absent → defaults; **present but malformed → command fails** (Go's `config.Load` parity) | -| `/supabase/.temp/pooler-url` | text | `--linked` pooler fallback only — the connection-pooler URL written by `supabase link` (Go reads it here, not from config.toml) | -| `/access-token` | text | `--linked` only, when `SUPABASE_ACCESS_TOKEN` unset | +| Path | Format | When | +| ------------------------------------- | ------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------- | +| `/supabase/tests/**/*.{sql,pg}` | SQL | default test discovery when no `[path]` given | +| `` | SQL | when explicit test files/dirs are passed | +| `/supabase/config.toml` | TOML | always: `db.port`, `db.shadow_port`, `db.password`, `project_id`. Absent → defaults; **present but malformed → command fails** (Go's `config.Load` parity) | +| `/supabase/.temp/pooler-url` | text | `--linked` pooler fallback only — the connection-pooler URL written by `supabase link` (Go reads it here, not from config.toml) | +| `~/.supabase/access-token` | text | `--linked` only, when `SUPABASE_ACCESS_TOKEN` unset | ## Files Written @@ -45,15 +45,14 @@ One-shot `docker run --rm `, where the image is `supabase/pg_pro ## Environment Variables -| Variable | Purpose | Required? | -| ---------------------------- | ---------------------------------------------------------------------- | --------------------------------------------- | -| `SUPABASE_DB_PASSWORD` | `--linked`: skip temporary login-role creation | no | -| `SUPABASE_ACCESS_TOKEN` | `--linked`: Management API auth | no (falls back to keyring/file) | -| `SUPABASE_HOME` | global CLI state root for auth, telemetry, traces, and shared binaries | no (defaults to `~/.supabase`) | -| `SUPABASE_SERVICES_HOSTNAME` | `--local`: overrides the local DB host (dev-container/remote Docker) | no (defaults via `DOCKER_HOST` → `127.0.0.1`) | -| `DOCKER_HOST` | `--local`: tcp daemon host used when no services-hostname override | no | -| `BITBUCKET_CLONE_DIR` | when set, omit `--security-opt label:disable` (Bitbucket rejects it) | no | -| `DEBUG` / `--debug` | append `--verbose` to `pg_prove` | no | +| Variable | Purpose | Required? | +| ---------------------------- | -------------------------------------------------------------------- | --------------------------------------------- | +| `SUPABASE_DB_PASSWORD` | `--linked`: skip temporary login-role creation | no | +| `SUPABASE_ACCESS_TOKEN` | `--linked`: Management API auth | no (falls back to keyring/file) | +| `SUPABASE_SERVICES_HOSTNAME` | `--local`: overrides the local DB host (dev-container/remote Docker) | no (defaults via `DOCKER_HOST` → `127.0.0.1`) | +| `DOCKER_HOST` | `--local`: tcp daemon host used when no services-hostname override | no | +| `BITBUCKET_CLONE_DIR` | when set, omit `--security-opt label:disable` (Bitbucket rejects it) | no | +| `DEBUG` / `--debug` | append `--verbose` to `pg_prove` | no | ## Exit Codes diff --git a/apps/cli/src/legacy/commands/vanity-subdomains/activate/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/vanity-subdomains/activate/SIDE_EFFECTS.md index f489833209..23fbe98051 100644 --- a/apps/cli/src/legacy/commands/vanity-subdomains/activate/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/vanity-subdomains/activate/SIDE_EFFECTS.md @@ -2,17 +2,17 @@ ## Files Read -| Path | Format | When | -| --------------------------------------------- | ------------------------- | ------------------------------------------------------------- | -| `/access-token` | plain text (token string) | when `SUPABASE_ACCESS_TOKEN` unset and keyring unavailable | -| `/supabase/.temp/project-ref` | plain text (project ref) | when `--project-ref` flag and `PROJECT_ID` env are both unset | +| Path | Format | When | +| -------------------------------------- | ------------------------- | ------------------------------------------------------------- | +| `~/.supabase/access-token` | plain text (token string) | when `SUPABASE_ACCESS_TOKEN` unset and keyring unavailable | +| `/supabase/.temp/project-ref` | plain text (project ref) | when `--project-ref` flag and `PROJECT_ID` env are both unset | ## Files Written -| Path | Format | When | -| ----------------------------------------------- | ------ | ----------------------------------------------------- | -| `/supabase/.temp/linked-project.json` | JSON | after ref resolution, on success and failure | -| `/telemetry.json` | JSON | always, via `Effect.ensuring`, on success and failure | +| Path | Format | When | +| ------------------------------------------------ | ------ | ----------------------------------------------------- | +| `~/.supabase//linked-project.json` | JSON | after ref resolution, on success and failure | +| `~/.supabase/telemetry.json` | JSON | always, via `Effect.ensuring`, on success and failure | ## API Routes @@ -22,12 +22,11 @@ ## Environment Variables -| Variable | Purpose | Required? | -| ----------------------- | ---------------------------------------------------------------------- | ----------------------------------------------------------------------------- | -| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring then `/access-token`) | -| `SUPABASE_HOME` | global CLI state root for auth, telemetry, traces, and shared binaries | no (defaults to `~/.supabase`) | -| `SUPABASE_API_URL` | override Management API base URL | no (defaults to `https://api.supabase.com`) | -| `PROJECT_ID` | project ref fallback when `--project-ref` is unset | no (falls back to `supabase/.temp/project-ref`) | +| Variable | Purpose | Required? | +| ----------------------- | ---------------------------------------------------- | ---------------------------------------------------------- | +| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring then `~/.supabase/access-token`) | +| `SUPABASE_API_URL` | override Management API base URL | no (defaults to `https://api.supabase.com`) | +| `PROJECT_ID` | project ref fallback when `--project-ref` is unset | no (falls back to `supabase/.temp/project-ref`) | ## Exit Codes diff --git a/apps/cli/src/legacy/commands/vanity-subdomains/check-availability/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/vanity-subdomains/check-availability/SIDE_EFFECTS.md index 95ba7d138b..dc361d9fbc 100644 --- a/apps/cli/src/legacy/commands/vanity-subdomains/check-availability/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/vanity-subdomains/check-availability/SIDE_EFFECTS.md @@ -2,17 +2,17 @@ ## Files Read -| Path | Format | When | -| --------------------------------------------- | ------------------------- | ------------------------------------------------------------- | -| `/access-token` | plain text (token string) | when `SUPABASE_ACCESS_TOKEN` unset and keyring unavailable | -| `/supabase/.temp/project-ref` | plain text (project ref) | when `--project-ref` flag and `PROJECT_ID` env are both unset | +| Path | Format | When | +| -------------------------------------- | ------------------------- | ------------------------------------------------------------- | +| `~/.supabase/access-token` | plain text (token string) | when `SUPABASE_ACCESS_TOKEN` unset and keyring unavailable | +| `/supabase/.temp/project-ref` | plain text (project ref) | when `--project-ref` flag and `PROJECT_ID` env are both unset | ## Files Written -| Path | Format | When | -| ----------------------------------------------- | ------ | ----------------------------------------------------- | -| `/supabase/.temp/linked-project.json` | JSON | after ref resolution, on success and failure | -| `/telemetry.json` | JSON | always, via `Effect.ensuring`, on success and failure | +| Path | Format | When | +| ------------------------------------------------ | ------ | ----------------------------------------------------- | +| `~/.supabase//linked-project.json` | JSON | after ref resolution, on success and failure | +| `~/.supabase/telemetry.json` | JSON | always, via `Effect.ensuring`, on success and failure | ## API Routes @@ -22,12 +22,11 @@ ## Environment Variables -| Variable | Purpose | Required? | -| ----------------------- | ---------------------------------------------------------------------- | ----------------------------------------------------------------------------- | -| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring then `/access-token`) | -| `SUPABASE_HOME` | global CLI state root for auth, telemetry, traces, and shared binaries | no (defaults to `~/.supabase`) | -| `SUPABASE_API_URL` | override Management API base URL | no (defaults to `https://api.supabase.com`) | -| `PROJECT_ID` | project ref fallback when `--project-ref` is unset | no (falls back to `supabase/.temp/project-ref`) | +| Variable | Purpose | Required? | +| ----------------------- | ---------------------------------------------------- | ---------------------------------------------------------- | +| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring then `~/.supabase/access-token`) | +| `SUPABASE_API_URL` | override Management API base URL | no (defaults to `https://api.supabase.com`) | +| `PROJECT_ID` | project ref fallback when `--project-ref` is unset | no (falls back to `supabase/.temp/project-ref`) | ## Exit Codes diff --git a/apps/cli/src/legacy/commands/vanity-subdomains/delete/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/vanity-subdomains/delete/SIDE_EFFECTS.md index 946d1beaee..2596dc4cb6 100644 --- a/apps/cli/src/legacy/commands/vanity-subdomains/delete/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/vanity-subdomains/delete/SIDE_EFFECTS.md @@ -2,17 +2,17 @@ ## Files Read -| Path | Format | When | -| --------------------------------------------- | ------------------------- | ------------------------------------------------------------- | -| `/access-token` | plain text (token string) | when `SUPABASE_ACCESS_TOKEN` unset and keyring unavailable | -| `/supabase/.temp/project-ref` | plain text (project ref) | when `--project-ref` flag and `PROJECT_ID` env are both unset | +| Path | Format | When | +| -------------------------------------- | ------------------------- | ------------------------------------------------------------- | +| `~/.supabase/access-token` | plain text (token string) | when `SUPABASE_ACCESS_TOKEN` unset and keyring unavailable | +| `/supabase/.temp/project-ref` | plain text (project ref) | when `--project-ref` flag and `PROJECT_ID` env are both unset | ## Files Written -| Path | Format | When | -| ----------------------------------------------- | ------ | ----------------------------------------------------- | -| `/supabase/.temp/linked-project.json` | JSON | after ref resolution, on success and failure | -| `/telemetry.json` | JSON | always, via `Effect.ensuring`, on success and failure | +| Path | Format | When | +| ------------------------------------------------ | ------ | ----------------------------------------------------- | +| `~/.supabase//linked-project.json` | JSON | after ref resolution, on success and failure | +| `~/.supabase/telemetry.json` | JSON | always, via `Effect.ensuring`, on success and failure | ## API Routes @@ -22,12 +22,11 @@ ## Environment Variables -| Variable | Purpose | Required? | -| ----------------------- | ---------------------------------------------------------------------- | ----------------------------------------------------------------------------- | -| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring then `/access-token`) | -| `SUPABASE_HOME` | global CLI state root for auth, telemetry, traces, and shared binaries | no (defaults to `~/.supabase`) | -| `SUPABASE_API_URL` | override Management API base URL | no (defaults to `https://api.supabase.com`) | -| `PROJECT_ID` | project ref fallback when `--project-ref` is unset | no (falls back to `supabase/.temp/project-ref`) | +| Variable | Purpose | Required? | +| ----------------------- | ---------------------------------------------------- | ---------------------------------------------------------- | +| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring then `~/.supabase/access-token`) | +| `SUPABASE_API_URL` | override Management API base URL | no (defaults to `https://api.supabase.com`) | +| `PROJECT_ID` | project ref fallback when `--project-ref` is unset | no (falls back to `supabase/.temp/project-ref`) | ## Exit Codes diff --git a/apps/cli/src/legacy/commands/vanity-subdomains/get/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/vanity-subdomains/get/SIDE_EFFECTS.md index 9f64694f37..15c79abde7 100644 --- a/apps/cli/src/legacy/commands/vanity-subdomains/get/SIDE_EFFECTS.md +++ b/apps/cli/src/legacy/commands/vanity-subdomains/get/SIDE_EFFECTS.md @@ -2,17 +2,17 @@ ## Files Read -| Path | Format | When | -| --------------------------------------------- | ------------------------- | ------------------------------------------------------------- | -| `/access-token` | plain text (token string) | when `SUPABASE_ACCESS_TOKEN` unset and keyring unavailable | -| `/supabase/.temp/project-ref` | plain text (project ref) | when `--project-ref` flag and `PROJECT_ID` env are both unset | +| Path | Format | When | +| -------------------------------------- | ------------------------- | ------------------------------------------------------------- | +| `~/.supabase/access-token` | plain text (token string) | when `SUPABASE_ACCESS_TOKEN` unset and keyring unavailable | +| `/supabase/.temp/project-ref` | plain text (project ref) | when `--project-ref` flag and `PROJECT_ID` env are both unset | ## Files Written -| Path | Format | When | -| ----------------------------------------------- | ------ | ----------------------------------------------------- | -| `/supabase/.temp/linked-project.json` | JSON | after ref resolution, on success and failure | -| `/telemetry.json` | JSON | always, via `Effect.ensuring`, on success and failure | +| Path | Format | When | +| ------------------------------------------------ | ------ | ----------------------------------------------------- | +| `~/.supabase//linked-project.json` | JSON | after ref resolution, on success and failure | +| `~/.supabase/telemetry.json` | JSON | always, via `Effect.ensuring`, on success and failure | ## API Routes @@ -22,12 +22,11 @@ ## Environment Variables -| Variable | Purpose | Required? | -| ----------------------- | ---------------------------------------------------------------------- | ----------------------------------------------------------------------------- | -| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring then `/access-token`) | -| `SUPABASE_HOME` | global CLI state root for auth, telemetry, traces, and shared binaries | no (defaults to `~/.supabase`) | -| `SUPABASE_API_URL` | override Management API base URL | no (defaults to `https://api.supabase.com`) | -| `PROJECT_ID` | project ref fallback when `--project-ref` is unset | no (falls back to `supabase/.temp/project-ref`) | +| Variable | Purpose | Required? | +| ----------------------- | ---------------------------------------------------- | ---------------------------------------------------------- | +| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring then `~/.supabase/access-token`) | +| `SUPABASE_API_URL` | override Management API base URL | no (defaults to `https://api.supabase.com`) | +| `PROJECT_ID` | project ref fallback when `--project-ref` is unset | no (falls back to `supabase/.temp/project-ref`) | ## Exit Codes