chore: production deploy

.github/workflows/api-package-sync.yml

@@ -25,14 +25,16 @@ jobs:
       - name: Regenerate API package
         run: pnpm generate
         working-directory: packages/api
+        env:
+          SUPABASE_API_URL: https://api.supabase.com
 
       - name: Format API package
         run: pnpm exec nx run @supabase/api:fmt:fix
 
       - name: Check for generated changes
         id: check
         run: |
-          if git diff --ignore-space-at-eol --exit-code --quiet packages/api/src/generated; then
+          if git diff --ignore-space-at-eol --exit-code --quiet packages/api/src/generated packages/api/scripts/openapi-source.json; then
             echo "No generated changes detected."
             echo "has_changes=false" >> "$GITHUB_OUTPUT"
           else
@@ -61,7 +63,7 @@ jobs:
           body: |
             This PR was automatically created to sync the generated `@supabase/api` package with the latest Management API OpenAPI document.
 
-            Changes were detected in the upstream OpenAPI document exposed by `https://api.supabase.com/api/v1-json`.
+            Changes were detected in the upstream OpenAPI documents exposed by `https://api.supabase.com/api/v1-json` and `https://api.supabase.com/api/v2-json`.
           branch: sync/api-package
           base: develop
 

.github/workflows/cli-go-codeql.yml

@@ -67,7 +67,7 @@ jobs:
 
       # Initializes the CodeQL tools for scanning.
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@f205ea1c3313d32999d8d6a48b4f6530d4437b38 # v4.37.4
+        uses: github/codeql-action/init@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6
         with:
           languages: ${{ matrix.language }}
           build-mode: ${{ matrix.build-mode }}
@@ -95,7 +95,7 @@ jobs:
           exit 1
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@f205ea1c3313d32999d8d6a48b4f6530d4437b38 # v4.37.4
+        uses: github/codeql-action/analyze@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6
         with:
           category: "/language:${{matrix.language}}"
 defaults:

AGENTS.md

@@ -59,6 +59,14 @@ Key references:
 - `.repos/effect/packages/vitest/` — `@effect/vitest` test helpers
 - `.repos/effect/MIGRATION.md` — V3 to V4 migration guide
 
+### Effect-native by default
+
+Write new runtime code Effect-native from the start; do not build a sync or Promise-based core and wrap it in Effect afterwards. Retrofitting Effect onto a Promise core is expensive and error-prone: it resurfaces as blocking waits where a `Schedule` belongs, interruption gaps around resource acquisition, and untyped failures leaking through `Effect.tryPromise`.
+
+- Model failures as `Data.TaggedError` classes with typed error channels, dependencies as services provided through `Layer`, retries/polling as `Schedule`s, and resource lifecycles with scopes and interruption-safe masks — never `Atomics.wait`, ad-hoc `setTimeout` loops, or manual try/finally resource juggling in core code.
+- Expose Promise-based facades only at the outermost package edge (public entrypoints for non-Effect consumers), acquired asynchronously — never inside the core.
+- A small leaf primitive with no Effect semantics of its own (a pure function, a single-syscall fs helper) may stay plain async and be wrapped at its call boundary; everything with failure modes, retries, resources, or concurrency belongs in Effect.
+
 ## Code Quality
 
 Run quality checks from the workspace directory you changed. Do not consider a task complete until all relevant scripts pass.

apps/cli-go/cmd/db.go

@@ -200,76 +200,6 @@ var (
 		},
 	}
 
-	shadowMode        string
-	shadowTargetLocal bool
-	shadowUsePgDelta  bool
-	shadowSchema      []string
-	shadowProjectRef  string
-
-	// dbShadowCmd is a hidden seam used by the native-TypeScript db diff/pull
-	// commands to provision the throwaway shadow database that the diff "source"
-	// runs against, then leave it running so the TS caller can run the differ
-	// (migra or pg-delta) itself and remove the container afterwards. It prints
-	// three newline-separated lines to stdout: the container id, the source
-	// Postgres URL, and an optional target-override URL (empty unless the
-	// local-target declarative branch redirects the diff target to a second
-	// shadow database). The URLs are emitted WITHOUT the password
-	// (ToPostgresURLWithoutPassword) so we never log a credential to stdout
-	// (CWE-312); the TS caller re-injects the local Postgres password it already
-	// resolves from config.toml, which is the same value the shadow uses. Shadow
-	// provisioning (start.SetupDatabase) is not yet ported, which is why this
-	// stays in Go.
-	dbShadowCmd = &cobra.Command{
-		Use:    "__shadow",
-		Hidden: true,
-		Short:  "Internal: provision a shadow database for the native db diff/pull commands",
-		RunE: func(cmd *cobra.Command, args []string) error {
-			// The hidden __shadow command carries none of the db-url/local/linked
-			// target flags, so the root PersistentPreRunE's ParseDatabaseConfig
-			// never loads supabase/config.toml (it only loads when a target flag
-			// is set, internal/utils/flags/db_url.go:46-90). Load it explicitly so
-			// the shadow is provisioned from the project's [db] settings — shadow
-			// port, Postgres version, service baseline, and especially the
-			// password: the native-TS caller injects the config.toml password into
-			// the seam URLs, so the shadow must be created with that same password.
-			fsys := afero.NewOsFs()
-			// On the linked path the native-TS caller passes the resolved project
-			// ref via --project-ref so the shadow is built from the same
-			// remote-merged config the Go monolith uses: LoadConfig seeds
-			// utils.Config.ProjectId from flags.ProjectRef and merges the matching
-			// [remotes.<ref>] block (pkg/config/config.go). Omitted on local/db-url
-			// shadows, which the monolith never remote-merges, so the base config is
-			// used exactly as before.
-			if len(shadowProjectRef) > 0 {
-				flags.ProjectRef = shadowProjectRef
-			}
-			if err := flags.LoadConfig(fsys); err != nil {
-				return err
-			}
-			var src diff.ShadowSource
-			var err error
-			switch shadowMode {
-			case "declarative":
-				src, err = diff.PrepareRawShadow(cmd.Context())
-			case "diff", "":
-				src, err = diff.PrepareShadowSource(cmd.Context(), shadowSchema, shadowTargetLocal, shadowUsePgDelta, fsys)
-			default:
-				return fmt.Errorf("unknown shadow mode: %s", shadowMode)
-			}
-			if err != nil {
-				return err
-			}
-			fmt.Println(src.Container)
-			fmt.Println(utils.ToPostgresURLWithoutPassword(src.Source))
-			if src.TargetOverride != nil {
-				fmt.Println(utils.ToPostgresURLWithoutPassword(*src.TargetOverride))
-			} else {
-				fmt.Println("")
-			}
-			return nil
-		},
-	}
-
 	dbRemoteCmd = &cobra.Command{
 		Hidden: true,
 		Use:    "remote",
@@ -612,14 +542,6 @@ func init() {
 	pullFlags.StringVarP(&dbPassword, "password", "p", "", "Password to your remote Postgres database.")
 	cobra.CheckErr(viper.BindPFlag("DB_PASSWORD", pullFlags.Lookup("password")))
 	dbCmd.AddCommand(dbPullCmd)
-	// Build hidden shadow-provisioning seam command
-	shadowFlags := dbShadowCmd.Flags()
-	shadowFlags.StringVar(&shadowMode, "mode", "diff", "Shadow mode: diff (baseline + migrations) or declarative (bare shadow).")
-	shadowFlags.BoolVar(&shadowTargetLocal, "target-local", false, "Whether the diff target is the local database (enables the declarative-schema branch).")
-	shadowFlags.BoolVar(&shadowUsePgDelta, "use-pg-delta", false, "Whether pg-delta is the active diff engine (selects the declarative-apply path).")
-	shadowFlags.StringSliceVarP(&shadowSchema, "schema", "s", []string{}, "Comma separated list of schema to include.")
-	shadowFlags.StringVar(&shadowProjectRef, "project-ref", "", "Linked project ref, so the shadow merges the matching [remotes.<ref>] config override.")
-	dbCmd.AddCommand(dbShadowCmd)
 	// Build remote command
 	remoteFlags := dbRemoteCmd.PersistentFlags()
 	remoteFlags.StringSliceVarP(&schema, "schema", "s", []string{}, "Comma separated list of schema to include.")

apps/cli-go/cmd/start.go

@@ -5,7 +5,9 @@ package cmd
 // talks to Docker directly for `start` and never delegates to this binary
 // for it, and no other still-live TS->Go delegation seam (db test, db
 // branch/remote, db diff --use-pgadmin/--use-pg-schema, db pull
-// --experimental, the hidden db __shadow/__catalog seams -- the sibling
+// --experimental, the hidden db __catalog seam (baseline/declarative modes
+// only -- the migrations mode was removed by CLI-1959, and the sibling
+// hidden db __shadow seam was removed outright by CLI-1956) -- the sibling
 // hidden db __db-bootstrap seam was removed outright by CLI-1955, once
 // native `db reset --local` became its last remaining caller -- etc.) ever
 // called into internal/start either -- see

apps/cli-go/go.mod

@@ -52,7 +52,7 @@ require (
 	github.com/tidwall/jsonc v0.3.3
 	github.com/withfig/autocomplete-tools/packages/cobra v1.2.0
 	github.com/zalando/go-keyring v0.2.8
-	go.opentelemetry.io/otel v1.44.0
+	go.opentelemetry.io/otel v1.45.0
 	golang.org/x/mod v0.38.0
 	golang.org/x/net v0.57.0
 	golang.org/x/oauth2 v0.36.0
@@ -160,7 +160,7 @@ require (
 	github.com/go-critic/go-critic v0.14.3 // indirect
 	github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376 // indirect
 	github.com/go-git/go-billy/v5 v5.9.0 // indirect
-	github.com/go-logr/logr v1.4.3 // indirect
+	github.com/go-logr/logr v1.4.4 // indirect
 	github.com/go-logr/stdr v1.2.2 // indirect
 	github.com/go-openapi/jsonpointer v0.22.4 // indirect
 	github.com/go-openapi/swag/jsonname v0.25.4 // indirect
@@ -359,10 +359,10 @@ require (
 	go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.43.0 // indirect
 	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.39.0 // indirect
 	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.43.0 // indirect
-	go.opentelemetry.io/otel/metric v1.44.0 // indirect
+	go.opentelemetry.io/otel/metric v1.45.0 // indirect
 	go.opentelemetry.io/otel/sdk v1.44.0 // indirect
 	go.opentelemetry.io/otel/sdk/metric v1.44.0 // indirect
-	go.opentelemetry.io/otel/trace v1.44.0 // indirect
+	go.opentelemetry.io/otel/trace v1.45.0 // indirect
 	go.opentelemetry.io/proto/otlp v1.10.0 // indirect
 	go.uber.org/multierr v1.11.0 // indirect
 	go.uber.org/zap v1.27.0 // indirect

apps/cli-go/go.sum

@@ -306,8 +306,8 @@ github.com/go-logfmt/logfmt v0.3.0/go.mod h1:Qt1PoO58o5twSAckw1HlFXLmHsOX5/0LbT9
 github.com/go-logfmt/logfmt v0.4.0/go.mod h1:3RMwSq7FuexP4Kalkev3ejPJsZTpXXBr9+V4qmtdjCk=
 github.com/go-logfmt/logfmt v0.5.0/go.mod h1:wCYkCAKZfumFQihp8CzCvQ3paCTfi41vtzG1KdI/P7A=
 github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
-github.com/go-logr/logr v1.4.3 h1:CjnDlHq8ikf6E492q6eKboGOC0T8CDaOvkHCIg8idEI=
-github.com/go-logr/logr v1.4.3/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
+github.com/go-logr/logr v1.4.4 h1:tG4xh9yMsRCAiodLVTxyrkzSZ9+o0L1Kg/+cPVcbP/8=
+github.com/go-logr/logr v1.4.4/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
 github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=
 github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE=
 github.com/go-openapi/jsonpointer v0.22.4 h1:dZtK82WlNpVLDW2jlA1YCiVJFVqkED1MegOUy9kR5T4=
@@ -1004,8 +1004,8 @@ go.opentelemetry.io/auto/sdk v1.2.1 h1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ/ipaZ
 go.opentelemetry.io/auto/sdk v1.2.1/go.mod h1:KRTj+aOaElaLi+wW1kO/DZRXwkF4C5xPbEe3ZiIhN7Y=
 go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.64.0 h1:ssfIgGNANqpVFCndZvcuyKbl0g+UAVcbBcqGkG28H0Y=
 go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.64.0/go.mod h1:GQ/474YrbE4Jx8gZ4q5I4hrhUzM6UPzyrqJYV2AqPoQ=
-go.opentelemetry.io/otel v1.44.0 h1:JjwHmHpA4iZ3wBxluu2fbbE7j4kqlE8jXyAyPXH7HqU=
-go.opentelemetry.io/otel v1.44.0/go.mod h1:BMgjTHL9WPRlRjL2oZCBTL4whCGtXch2H4BhOPIAyYc=
+go.opentelemetry.io/otel v1.45.0 h1:pdrWmLHofpubmArBv1LgFSv1Z0Ie/ppdZzu+kUN5EeU=
+go.opentelemetry.io/otel v1.45.0/go.mod h1:XZxIqPapzEYnhNSScF5DIqXhm/rYi0FzCe2XddAwZfQ=
 go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.39.0 h1:cEf8jF6WbuGQWUVcqgyWtTR0kOOAWY1DYZ+UhvdmQPw=
 go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.39.0/go.mod h1:k1lzV5n5U3HkGvTCJHraTAGJ7MqsgL1wrGwTj1Isfiw=
 go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.43.0 h1:88Y4s2C8oTui1LGM6bTWkw0ICGcOLCAI5l6zsD1j20k=
@@ -1014,16 +1014,16 @@ go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.39.0 h1:in9O8
 go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.39.0/go.mod h1:Rp0EXBm5tfnv0WL+ARyO/PHBEaEAT8UUHQ6AGJcSq6c=
 go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.43.0 h1:3iZJKlCZufyRzPzlQhUIWVmfltrXuGyfjREgGP3UUjc=
 go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.43.0/go.mod h1:/G+nUPfhq2e+qiXMGxMwumDrP5jtzU+mWN7/sjT2rak=
-go.opentelemetry.io/otel/metric v1.44.0 h1:1w0gILTcHdr3YI+ixLyjemwrVnsMURbTZFrSYCdDdmc=
-go.opentelemetry.io/otel/metric v1.44.0/go.mod h1:8O7hanEPBNgEMmybD3s2VBKcgWOCsA6tzHBPODAiquo=
+go.opentelemetry.io/otel/metric v1.45.0 h1:7Eg1uH7CJ5cXv9is6tnBe1FI6rj1nwUdbFypRm3br/M=
+go.opentelemetry.io/otel/metric v1.45.0/go.mod h1:HAPbm1nd3p1PmFH7v2dR+6BjXxw+Lq4a2+pndMAm08s=
 go.opentelemetry.io/otel/metric/x v0.66.0 h1:YkCrx1zLOChi9ZcZ6euupOcsgzbVlec7D/xoEU1+cTA=
 go.opentelemetry.io/otel/metric/x v0.66.0/go.mod h1:d1+BDj9t96do0/1LoU1ayfCv79ZgNE41qbhBvnMOBZk=
 go.opentelemetry.io/otel/sdk v1.44.0 h1:nHYwb9lK+fJPU/dnT6s7W7Z8itMWyqrnVfbheVYrZ58=
 go.opentelemetry.io/otel/sdk v1.44.0/go.mod h1:Osuydd3Se74nqjAKxid74N5eC+jfEqfTegHRnq58oK0=
 go.opentelemetry.io/otel/sdk/metric v1.44.0 h1:3LlKgI+VjbVsjNRFZJZAJ30WjXC5VkNRks6si09iEfI=
 go.opentelemetry.io/otel/sdk/metric v1.44.0/go.mod h1:5B5pMARnXxKhltooO4xUuCBorl65a4EpnTalObqOigA=
-go.opentelemetry.io/otel/trace v1.44.0 h1:jxF5CsGYCe74MCRx2X4g7WsY/VBKRqqpNvXlX/6gtIk=
-go.opentelemetry.io/otel/trace v1.44.0/go.mod h1:oLl1jrMQAVo6v3GAggN+1VH9VIz9iUSvW53sW1Q8PIE=
+go.opentelemetry.io/otel/trace v1.45.0 h1:l/mP6Uv7oNO7/TblbhpbgMidxhq1uO/rPsikOyVhxag=
+go.opentelemetry.io/otel/trace v1.45.0/go.mod h1:qoJJA2xNMnxRrdISU/kLtfUH2wNeQbiv+jhs/CxI8bc=
 go.opentelemetry.io/proto/otlp v1.10.0 h1:IQRWgT5srOCYfiWnpqUYz9CVmbO8bFmKcwYxpuCSL2g=
 go.opentelemetry.io/proto/otlp v1.10.0/go.mod h1:/CV4QoCR/S9yaPj8utp3lvQPoqMtxXdzn7ozvvozVqk=
 go.uber.org/atomic v1.3.2/go.mod h1:gD2HeocX3+yG+ygLZcrzQJaqmWj9AIm7n08wl/qW/PE=

apps/cli-go/internal/utils/connect.go

@@ -26,17 +26,6 @@ func ToPostgresURL(config pgconn.Config) string {
 	return toPostgresURL(config, url.UserPassword(config.User, config.Password))
 }
 
-// ToPostgresURLWithoutPassword renders the connection URL exactly like
-// ToPostgresURL but omits the password from the userinfo. Use it for callers that
-// print the URL to stdout (the hidden `db __shadow` seam): embedding the password
-// there is clear-text logging of a credential (CWE-312, flagged by CodeQL). The
-// password is never the seam's to share — the TS caller that consumes the seam
-// output re-injects the local Postgres password it already resolves from
-// config.toml (`utils.Config.Db.Password`).
-func ToPostgresURLWithoutPassword(config pgconn.Config) string {
-	return toPostgresURL(config, url.User(config.User))
-}
-
 func toPostgresURL(config pgconn.Config, userinfo *url.Userinfo) string {
 	timeoutSecond := int64(config.ConnectTimeout.Seconds())
 	if timeoutSecond == 0 {

apps/cli-go/internal/utils/connect_test.go

@@ -398,23 +398,6 @@ func TestPostgresURL(t *testing.T) {
 	assert.Equal(t, `postgresql://postgres:%21%40%23$%25%5E&%2A%28%29@[2406:da18:4fd:9b0d:80ec:9812:3e65:450b]:5432/?connect_timeout=10&options=test`, url)
 }
 
-func TestPostgresURLWithoutPassword(t *testing.T) {
-	config := pgconn.Config{
-		Host:     "2406:da18:4fd:9b0d:80ec:9812:3e65:450b",
-		Port:     5432,
-		User:     "postgres",
-		Password: "!@#$%^&*()",
-		RuntimeParams: map[string]string{
-			"options": "test",
-		},
-	}
-	url := ToPostgresURLWithoutPassword(config)
-	// Same as ToPostgresURL but with the password omitted from the userinfo, so a
-	// credential is never written to stdout by the db __shadow seam.
-	assert.Equal(t, `postgresql://postgres@[2406:da18:4fd:9b0d:80ec:9812:3e65:450b]:5432/?connect_timeout=10&options=test`, url)
-	assert.NotContains(t, url, "%21%40%23")
-}
-
 func TestPreserveTLSConfig(t *testing.T) {
 	const dsn = "postgresql://postgres:pw@example.com:5432/postgres"
 

apps/cli-go/pkg/config/templates/Dockerfile

@@ -3,17 +3,17 @@ FROM supabase/postgres:17.6.1.158 AS pg
 # Append to ServiceImages when adding new dependencies below
 FROM library/kong:2.8.1 AS kong
 FROM axllent/mailpit:v1.30.2 AS mailpit
-FROM postgrest/postgrest:v14.16 AS postgrest
-FROM supabase/postgres-meta:v0.96.8 AS pgmeta
-FROM supabase/studio:2026.08.03-sha-022b374 AS studio
+FROM postgrest/postgrest:v16.1 AS postgrest
+FROM supabase/postgres-meta:v0.97.0 AS pgmeta
+FROM supabase/studio:2026.08.10-sha-5b68af1 AS studio
 FROM darthsim/imgproxy:v3.8.0 AS imgproxy
 FROM supabase/edge-runtime:v1.74.3 AS edgeruntime
 FROM timberio/vector:0.53.0-alpine AS vector
 FROM supabase/supavisor:2.9.7 AS supavisor
 FROM supabase/gotrue:v2.195.0 AS gotrue
-FROM supabase/realtime:v2.124.2 AS realtime
-FROM supabase/storage-api:v1.68.10 AS storage
-FROM supabase/logflare:1.50.1 AS logflare
+FROM supabase/realtime:v2.124.4 AS realtime
+FROM supabase/storage-api:v1.69.0 AS storage
+FROM supabase/logflare:1.50.2 AS logflare
 # Append to JobImages when adding new dependencies below
 FROM supabase/pgadmin-schema-diff:cli-0.0.5 AS differ
 FROM supabase/migra:3.0.1663481299 AS migra

apps/cli/.gitignore

@@ -1,3 +1,4 @@
 dist/
 coverage/
 supabase/
+!docs/supabase/