feat(cli): port gen types (#5514)

## TL;DR

Ports `supabase gen types` to native ts

## What’s introduced

adds a ts implementation for `gen types` that preserves the existing
command surface for local, linked, `--project-id`, and `--db-url` flows,
keeps the legacy behavior, reuses the management api path for hosted ts
generation,
and runs `pg-meta` directly for generation 
also moves the ca bundle into ts based template files 

& coverage for all of this! 

## ref

- Closes CLI-1310

---------

Co-authored-by: Colum Ferry <cferry09@gmail.com>

Author: 7ttp

apps/cli/docs/go-cli-porting-status.md

@@ -281,7 +281,7 @@ Legend:
 | `migration up`                         | `wrapped`     | [`../src/legacy/commands/migration/up/up.command.ts`](../src/legacy/commands/migration/up/up.command.ts)                                                                                  |
 | `migration down`                       | `wrapped`     | [`../src/legacy/commands/migration/down/down.command.ts`](../src/legacy/commands/migration/down/down.command.ts)                                                                          |
 | `migration fetch`                      | `wrapped`     | [`../src/legacy/commands/migration/fetch/fetch.command.ts`](../src/legacy/commands/migration/fetch/fetch.command.ts)                                                                      |
-| `gen types`                            | `wrapped`     | [`../src/legacy/commands/gen/types/types.command.ts`](../src/legacy/commands/gen/types/types.command.ts)                                                                                  |
+| `gen types`                            | `ported`      | [`../src/legacy/commands/gen/types/types.command.ts`](../src/legacy/commands/gen/types/types.command.ts)                                                                                  |
 | `gen signing-key`                      | `ported`      | [`../src/legacy/commands/gen/signing-key/signing-key.command.ts`](../src/legacy/commands/gen/signing-key/signing-key.command.ts)                                                          |
 | `gen bearer-jwt`                       | `wrapped`     | [`../src/legacy/commands/gen/bearer-jwt/bearer-jwt.command.ts`](../src/legacy/commands/gen/bearer-jwt/bearer-jwt.command.ts)                                                              |
 | `gen keys`                             | `wrapped`     | [`../src/legacy/commands/gen/keys/keys.command.ts`](../src/legacy/commands/gen/keys/keys.command.ts)                                                                                      |

apps/cli/src/legacy/commands/gen/types/SIDE_EFFECTS.md

@@ -2,43 +2,71 @@
 
 ## Files Read
 
-| Path                             | Format     | When                                                                |
-| -------------------------------- | ---------- | ------------------------------------------------------------------- |
-| `~/.supabase/access-token`       | plain text | when `SUPABASE_ACCESS_TOKEN` unset and `--linked` or `--project-id` |
-| `<workdir>/supabase/config.toml` | TOML       | when `--local` is specified                                         |
+| Path                                      | Format     | When                                                                                     |
+| ----------------------------------------- | ---------- | ---------------------------------------------------------------------------------------- |
+| `~/.supabase/access-token`                | plain text | when `SUPABASE_ACCESS_TOKEN` unset and `--linked` or `--project-id`                      |
+| `<workdir>/supabase/config.toml`          | TOML       | when `--local` (required) or `--db-url` (best-effort) is specified                       |
+| `<workdir>/supabase/.temp/rest-version`   | plain text | `--local` only, when `db.major_version > 14` — forces v9 compat if the tag contains `v9` |
+| `<workdir>/supabase/.temp/pgmeta-version` | plain text | `--local` only — overrides the pg-meta docker image tag                                  |
 
 ## Files Written
 
 | Path | Format | When |
 | ---- | ------ | ---- |
 | —    | —      | —    |
 
+No files are written. Container env (including the DB URL and TLS CA bundle) is
+passed via `docker run --env KEY=VALUE` arguments, mirroring Go's
+`container.Config.Env`; no temporary env-file is created.
+
 ## API Routes
 
 | Method | Path                                  | Auth         | Request body | Response (used fields)           |
 | ------ | ------------------------------------- | ------------ | ------------ | -------------------------------- |
 | `GET`  | `/v1/projects/{ref}/types/typescript` | Bearer token | none         | TypeScript type definitions text |
 
+Called only for `--linked`, `--project-id`, and the implicit linked-project
+fallback. `--local` and `--db-url` do not call the Management API.
+
+## Subprocesses
+
+| Command                                                                       | When                  | Purpose                                            |
+| ----------------------------------------------------------------------------- | --------------------- | -------------------------------------------------- |
+| `docker container inspect supabase_db_<project_id>`                           | `--local`             | assert `supabase start` is running                 |
+| `docker run --rm --network <net> --env … <pgmeta> node dist/server/server.js` | `--local`, `--db-url` | run pg-meta to generate types from a live database |
+
+A raw TCP `SSLRequest` probe is also opened to the target database host/port to
+detect TLS support before launching pg-meta (mirrors Go's `isRequireSSL`).
+
 ## Environment Variables
 
-| Variable                | Purpose                               | Required?                                               |
-| ----------------------- | ------------------------------------- | ------------------------------------------------------- |
-| `SUPABASE_ACCESS_TOKEN` | auth token for linked/project-id mode | no (falls back to keyring → `~/.supabase/access-token`) |
-| `SUPABASE_API_URL`      | override Management API base URL      | no (defaults to `https://api.supabase.com`)             |
+| Variable                           | Purpose                                                           | Required?                                               |
+| ---------------------------------- | ----------------------------------------------------------------- | ------------------------------------------------------- |
+| `SUPABASE_ACCESS_TOKEN`            | auth token for linked/project-id mode                             | no (falls back to keyring → `~/.supabase/access-token`) |
+| `SUPABASE_API_URL`                 | override Management API base URL                                  | no (defaults to `https://api.supabase.com`)             |
+| `SUPABASE_DB_PASSWORD`             | local database password for `--local`                             | no (defaults to `postgres`)                             |
+| `SUPABASE_SERVICES_HOSTNAME`       | host used for the local TLS probe                                 | no (defaults to `127.0.0.1`)                            |
+| `SUPABASE_INTERNAL_IMAGE_REGISTRY` | pg-meta image registry override (`docker.io` → Docker Hub)        | no (defaults to the ECR registry)                       |
+| `SUPABASE_CA_SKIP_VERIFY`          | when `true`, prints a TLS-verification-disabled warning to stderr | no                                                      |
 
 ## Exit Codes
 
-| Code | Condition                                |
-| ---- | ---------------------------------------- |
-| `0`  | success — types printed to stdout        |
-| `1`  | no target specified (must use one flag)  |
-| `1`  | API error or database connection failure |
+| Code | Condition                                                        |
+| ---- | ---------------------------------------------------------------- |
+| `0`  | success — types printed to stdout                                |
+| `1`  | no target specified (must use one flag)                          |
+| `1`  | mutually exclusive flags combined                                |
+| `1`  | `--postgrest-v9-compat` used without `--db-url`                  |
+| `1`  | invalid `--query-timeout` duration or invalid `--db-url`         |
+| `1`  | `supabase start` not running (`--local`) or db inspection failed |
+| `1`  | API error, TLS probe failure, or pg-meta container non-zero exit |
 
 ## Output
 
 ### `--output-format text` (Go CLI compatible)
 
 Prints generated TypeScript (or other language) type definitions to stdout.
+Diagnostics (`Connecting to …`, pg-meta logs) go to stderr.
 
 ### `--output-format json`
 
@@ -51,8 +79,14 @@ Not applicable.
 ## Notes
 
 - Exactly one of `--local`, `--linked`, `--project-id`, or `--db-url` must be specified.
-- `--lang` flag accepts `typescript` (default), `go`, `swift`, or `python`.
+- `--lang` flag accepts `typescript` (default), `go`, `swift`, or `python`. Non-typescript
+  languages require a direct database connection (`--local` or `--db-url`).
 - `--schema` / `-s` accepts a comma-separated list of schemas to include.
 - `--swift-access-control` accepts `internal` (default) or `public`.
 - `--postgrest-v9-compat` generates types compatible with PostgREST v9 and below (requires `--db-url`).
 - `--query-timeout` sets the maximum timeout for the database query (default 15s, direct connection only).
+- The legacy positional language argument (`supabase gen types typescript`) is still accepted;
+  any other positional language requires an explicit `--lang` flag.
+- The linked-project telemetry cache is written only when a project ref is resolved
+  (`--linked`/`--project-id`/fallback), matching Go's `ensureProjectGroupsCached`, which
+  returns early when no ref is available.

apps/cli/src/legacy/commands/gen/types/templates/prod-ca-2021.ts

@@ -0,0 +1,24 @@
+export default `-----BEGIN CERTIFICATE-----
+MIIDxDCCAqygAwIBAgIUbLxMod62P2ktCiAkxnKJwtE9VPYwDQYJKoZIhvcNAQEL
+BQAwazELMAkGA1UEBhMCVVMxEDAOBgNVBAgMB0RlbHdhcmUxEzARBgNVBAcMCk5l
+dyBDYXN0bGUxFTATBgNVBAoMDFN1cGFiYXNlIEluYzEeMBwGA1UEAwwVU3VwYWJh
+c2UgUm9vdCAyMDIxIENBMB4XDTIxMDQyODEwNTY1M1oXDTMxMDQyNjEwNTY1M1ow
+azELMAkGA1UEBhMCVVMxEDAOBgNVBAgMB0RlbHdhcmUxEzARBgNVBAcMCk5ldyBD
+YXN0bGUxFTATBgNVBAoMDFN1cGFiYXNlIEluYzEeMBwGA1UEAwwVU3VwYWJhc2Ug
+Um9vdCAyMDIxIENBMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAqQXW
+QyHOB+qR2GJobCq/CBmQ40G0oDmCC3mzVnn8sv4XNeWtE5XcEL0uVih7Jo4Dkx1Q
+DmGHBH1zDfgs2qXiLb6xpw/CKQPypZW1JssOTMIfQppNQ87K75Ya0p25Y3ePS2t2
+GtvHxNjUV6kjOZjEn2yWEcBdpOVCUYBVFBNMB4YBHkNRDa/+S4uywAoaTWnCJLUi
+cvTlHmMw6xSQQn1UfRQHk50DMCEJ7Cy1RxrZJrkXXRP3LqQL2ijJ6F4yMfh+Gyb4
+O4XajoVj/+R4GwywKYrrS8PrSNtwxr5StlQO8zIQUSMiq26wM8mgELFlS/32Uclt
+NaQ1xBRizkzpZct9DwIDAQABo2AwXjALBgNVHQ8EBAMCAQYwHQYDVR0OBBYEFKjX
+uXY32CztkhImng4yJNUtaUYsMB8GA1UdIwQYMBaAFKjXuXY32CztkhImng4yJNUt
+aUYsMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEBAB8spzNn+4VU
+tVxbdMaX+39Z50sc7uATmus16jmmHjhIHz+l/9GlJ5KqAMOx26mPZgfzG7oneL2b
+VW+WgYUkTT3XEPFWnTp2RJwQao8/tYPXWEJDc0WVQHrpmnWOFKU/d3MqBgBm5y+6
+jB81TU/RG2rVerPDWP+1MMcNNy0491CTL5XQZ7JfDJJ9CCmXSdtTl4uUQnSuv/Qx
+Cea13BX2ZgJc7Au30vihLhub52De4P/4gonKsNHYdbWjg7OWKwNv/zitGDVDB9Y2
+CMTyZKG3XEu5Ghl1LEnI3QmEKsqaCLv12BnVjbkSeZsMnevJPs1Ye6TjjJwdik5P
+o/bKiIz+Fq8=
+-----END CERTIFICATE-----
+`;

apps/cli/src/legacy/commands/gen/types/templates/prod-ca-2025.ts

@@ -0,0 +1,24 @@
+export default `-----BEGIN CERTIFICATE-----
+MIIDxzCCAq+gAwIBAgIUeX+gpfmsRW9asFkRvjyXjHxbfgcwDQYJKoZIhvcNAQEL
+BQAwazELMAkGA1UEBhMCVVMxEDAOBgNVBAgMB0RlbHdhcmUxEzARBgNVBAcMCk5l
+dyBDYXN0bGUxFTATBgNVBAoMDFN1cGFiYXNlIEluYzEeMBwGA1UEAwwVU3VwYWJh
+c2UgUm9vdCAyMDIxIENBMB4XDTI1MDkwMzA4MDEyNVoXDTM1MDkwMTA4MDEyNVow
+azELMAkGA1UEBhMCVVMxEDAOBgNVBAgMB0RlbHdhcmUxEzARBgNVBAcMCk5ldyBD
+YXN0bGUxFTATBgNVBAoMDFN1cGFiYXNlIEluYzEeMBwGA1UEAwwVU3VwYWJhc2Ug
+Um9vdCAyMDIxIENBMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA5Ve7
+i9UAmc7luUilELPtqzEk8nGHxg7nY0aCStr625M7+K4OPO6RUllTsHh47k1jWyzm
+LXLlyYwCsYCjQp+3vn06H+F/HRUxBt6CK2B7bNng230exTunk0xFvfkX6YgHR7B3
+1B7L25Rq3PhuRFPV4hnGYRam2XBZC4UNPqoAgrhV0HOYzXXAVoTr2yaBTMnB331Z
+RwOmINh7eqTCk/JRZbb6vfZOhZRAVAe9AoRLoG8aKwmeoLGwlu0UuFx6z3E+6bmA
+fSNa8Lx02GEoCdPLw9IRKUFq/SgBpQUKm44H1fDwTjH2CMM0N4p0mL/6wXnNeHvt
+C40MmKZ0RcVmHE5wBwIDAQABo2MwYTAdBgNVHQ4EFgQUjvEE541toZcwtXQlZlcB
+YOBRTnowHwYDVR0jBBgwFoAUjvEE541toZcwtXQlZlcBYOBRTnowDwYDVR0TAQH/
+BAUwAwEB/zAOBgNVHQ8BAf8EBAMCAYYwDQYJKoZIhvcNAQELBQADggEBACD5IcGP
+XKvS9qg0CgEQPFqYavt5c7P+0xxFgiZe+xoG8fUw58yNeK2APtgGPRpxEOGfAlNx
+z9HDt4gcyHEE00B3qAVDm49pqNxioFWzNqU2LGfM/HL1QmN6urR7hCOkVCJddvOc
+FhFX4nZDuRfaBboDvS5HlK3Pzxddp9hvrJi2bemr8HLqYc3HzmVckgPGSLML6t+h
+4LRCXSlQsDgQ1LZ4KHsl4cq7K51N6FOXQBLB5q4lMKhs0VUhCT8Pdsj12+84laCV
+c22q6p2mdT9SaernCSRnWazXWisgpjv3H7Ex4S1DCYjJIwn3PUToGFv1r8YRN2/S
+O19yVSxxCIf64Sg=
+-----END CERTIFICATE-----
+`;

apps/cli/src/legacy/commands/gen/types/templates/staging-ca-2021.ts

@@ -0,0 +1,24 @@
+export default `-----BEGIN CERTIFICATE-----
+MIID1DCCArygAwIBAgIUbYRdq/8/uNq8G9stMCdOFSBgA2MwDQYJKoZIhvcNAQEL
+BQAwczELMAkGA1UEBhMCVVMxEDAOBgNVBAgMB0RlbHdhcmUxEzARBgNVBAcMCk5l
+dyBDYXN0bGUxFTATBgNVBAoMDFN1cGFiYXNlIEluYzEmMCQGA1UEAwwdU3VwYWJh
+c2UgU3RhZ2luZyBSb290IDIwMjEgQ0EwHhcNMjEwNDI4MTAzNjEzWhcNMzEwNDI2
+MTAzNjEzWjBzMQswCQYDVQQGEwJVUzEQMA4GA1UECAwHRGVsd2FyZTETMBEGA1UE
+BwwKTmV3IENhc3RsZTEVMBMGA1UECgwMU3VwYWJhc2UgSW5jMSYwJAYDVQQDDB1T
+dXBhYmFzZSBTdGFnaW5nIFJvb3QgMjAyMSBDQTCCASIwDQYJKoZIhvcNAQEBBQAD
+ggEPADCCAQoCggEBAN0AKRE8a56O8LaZxiOAcHFUFnwiKUvPoXPq26Ifw+Nv+7zg
+N2V5WnMZbbw24q61Os60ZUn0XmbVtuIeJ+stPHsO7qxxuL+bmPR+qU5tkDrIOyEe
+YD/2u8/q6ssVv42k4XcXbhM6RVz7CkCDY0TiBm1bMtRZso3xB6E9wAjxDf43XfV5
+PAGs3JI+Zo/vyqCDlN0hHOrB/aBl01JXqQWI84Gia5ooucq4SjA1CyawBcQ2IAvG
+rXuy1BouY+xM3zRuNvtfFP6rb5Mta+jCYEMh1AZ8yP8sYUWAyhxX6k9EbOb009wQ
+aZljbUCh/UglGWuBxdzePavx+zPjzWXB1NyVkpkCAwEAAaNgMF4wCwYDVR0PBAQD
+AgEGMB0GA1UdDgQWBBQFx+PHLf27iIo/PMfIfGqXF7Zb+DAfBgNVHSMEGDAWgBQF
+x+PHLf27iIo/PMfIfGqXF7Zb+DAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEB
+CwUAA4IBAQB/xIiz5dDqzGXjqYqXZYx4iSfSxsVayeOPDMfmaiCfSMJEUG4cUiwG
+OvMPGztaUEYeip5SCvSKuAAjVkXyP7ahKR7t7lZ9mErVXyxSZoVLbOd578CuYiZk
+OgT17UjPv66WMzEKEr8wGpomTYWWfEkuqt8ENdiM1Z4LNFahdKj36+jm6/a+9R8K
+25VIL68DTaQpBxFWG6ixC1HRMHJ12lDhKsshIi099BVpkGibESlxPrQOdKKqBB/J
+vIX+/Hb+mS4H5zYMeK2wX0onp+GBcD6X9L1UJuXMVd+BRan8RFidXL5s3++xXjQq
+Nzbc6lnA69urKffvcT07YwMsY/OmHzVa
+-----END CERTIFICATE-----
+`;

apps/cli/src/legacy/commands/gen/types/types.command.ts

@@ -1,5 +1,8 @@
 import { Command, Flag } from "effect/unstable/cli";
 import type * as CliCommand from "effect/unstable/cli/Command";
+import { withJsonErrorHandling } from "../../../../shared/output/json-error-handling.ts";
+import { legacyManagementApiRuntimeLayer } from "../../../shared/legacy-management-api-runtime.layer.ts";
+import { withLegacyCommandInstrumentation } from "../../../telemetry/legacy-command-instrumentation.ts";
 import { legacyGenTypes } from "./types.handler.ts";
 
 const LANG_VALUES = ["typescript", "go", "swift", "python"] as const;
@@ -21,24 +24,24 @@ const config = {
     Flag.optional,
   ),
   lang: Flag.choice("lang", LANG_VALUES).pipe(
-    Flag.withDescription("Output language of the generated types."),
-    Flag.optional,
+    Flag.withDescription("Output language of the generated types. (default typescript)"),
+    Flag.withDefault("typescript"),
   ),
   schema: Flag.string("schema").pipe(
     Flag.withAlias("s"),
     Flag.withDescription("Comma separated list of schema to include."),
     Flag.atLeast(0),
   ),
   swiftAccessControl: Flag.choice("swift-access-control", SWIFT_ACCESS_CONTROL_VALUES).pipe(
-    Flag.withDescription("Access control for Swift generated types."),
-    Flag.optional,
+    Flag.withDescription("Access control for Swift generated types. (default internal)"),
+    Flag.withDefault("internal"),
   ),
   postgrestV9Compat: Flag.boolean("postgrest-v9-compat").pipe(
     Flag.withDescription("Generate types compatible with PostgREST v9 and below."),
   ),
   queryTimeout: Flag.string("query-timeout").pipe(
-    Flag.withDescription("Maximum timeout allowed for the database query."),
-    Flag.optional,
+    Flag.withDescription("Maximum timeout allowed for the database query. (default 15s)"),
+    Flag.withDefault("15s"),
   ),
 } as const;
 
@@ -65,5 +68,11 @@ export const legacyGenTypesCommand = Command.make("types", config).pipe(
       description: "Generate types from a database URL",
     },
   ]),
-  Command.withHandler((flags) => legacyGenTypes(flags)),
+  Command.withHandler((flags) =>
+    legacyGenTypes(flags).pipe(
+      withLegacyCommandInstrumentation({ flags, safeFlags: ["project-id"] }),
+      withJsonErrorHandling,
+    ),
+  ),
+  Command.provide(legacyManagementApiRuntimeLayer(["gen", "types"])),
 );

apps/cli/src/legacy/commands/gen/types/types.errors.ts

@@ -0,0 +1,25 @@
+import { Data } from "effect";
+
+export class LegacyGenTypesNetworkError extends Data.TaggedError("LegacyGenTypesNetworkError")<{
+  readonly message: string;
+}> {}
+
+export class LegacyGenTypesUnexpectedStatusError extends Data.TaggedError(
+  "LegacyGenTypesUnexpectedStatusError",
+)<{
+  readonly status: number;
+  readonly body: string;
+  readonly message: string;
+}> {}
+
+export class LegacyInvalidGenTypesDurationError extends Data.TaggedError(
+  "LegacyInvalidGenTypesDurationError",
+)<{
+  readonly message: string;
+}> {}
+
+export class LegacyInvalidGenTypesDatabaseUrlError extends Data.TaggedError(
+  "LegacyInvalidGenTypesDatabaseUrlError",
+)<{
+  readonly message: string;
+}> {}