supabase · Coly010 · Jun 17, 2026 · Jun 15, 2026 · Jun 15, 2026 · Jun 15, 2026
@@ -293,7 +293,23 @@ describe("db lint", () => {
     expect(result.stderr).toContain("connect");
   });
 
-  testParity(["db", "lint", "--local"]);
+  // No testParity for `db lint --local`: like `test db --local`, lint connects via
+  // the shared utils.ConnectByConfig → pgxv5.Connect path on Go and the same
+  // LegacyDbConnection sql-pg layer on TS. With no local Postgres listening in the
+  // harness, the only reachable path is the connection-failure path, and its stderr
+  // diverges by driver in ways that aren't cosmetic and can't be normalized away.
+  // Both emit Go's leading diagnostic to stderr:
+  //   Connecting to local database...
+  // but the connect-error body and trailing hint still differ by driver. Go (pgx):
+  //   failed to connect to postgres: failed to connect to `host=… user=… database=…`: dial error (dial tcp …: connect: connection refused)
+  //   Make sure your local IP is allowed in Network Restrictions and Network Bans.
+  //   http://…/project/_/database/settings
+  // The TS port (@effect/sql-pg) prints the effect SqlError and the --debug hint:
+  //   failed to connect to postgres: effect/sql/SqlError: PgClient: Failed to connect
+  //   Try rerunning the command with --debug to troubleshoot the error.
+  // The meaningful contract (non-zero exit + a connect error on stderr) is covered
+  // by the behaviour test above. A real connect-path parity test would need a live
+  // local database in the harness.
 });
 
 // ---------------------------------------------------------------------------

@@ -84,7 +84,7 @@ These commands exist in the TS CLI today but have no direct top-level equivalent
 | --------------------------------- | --------- | -------------------------------------------------- | -------------------- | --------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
 | `db diff`                         | `missing` | `missing`                                          | `n/a`                | `n/a`                 | No native TS implementation yet. Wrapped in legacy shell.                                                                                                                                                                                                 |
 | `db dump`                         | `missing` | `missing`                                          | `n/a`                | `n/a`                 | No native TS implementation yet. Wrapped in legacy shell.                                                                                                                                                                                                 |
-| `db lint`                         | `missing` | `missing`                                          | `n/a`                | `n/a`                 | No native TS implementation yet. Wrapped in legacy shell.                                                                                                                                                                                                 |
+| `db lint`                         | `ported`  | `legacy/commands/db/lint/`                         | `n/a`                | `n/a`                 | Native TS port. Runs `plpgsql_check` in a rolled-back transaction via LegacyDbConnection; emits Go-parity pretty JSON.                                                                                                                                    |
 | `db pull`                         | `missing` | `missing`                                          | `n/a`                | `n/a`                 | No native TS implementation yet. Wrapped in legacy shell.                                                                                                                                                                                                 |
 | `db push`                         | `missing` | `missing`                                          | `n/a`                | `n/a`                 | No native TS implementation yet. Wrapped in legacy shell.                                                                                                                                                                                                 |
 | `db reset`                        | `missing` | `missing`                                          | `n/a`                | `n/a`                 | No native TS implementation yet. Wrapped in legacy shell.                                                                                                                                                                                                 |
@@ -303,10 +303,10 @@ Legend:
 | `db push`                              | `wrapped`     | [`../src/legacy/commands/db/push/push.command.ts`](../src/legacy/commands/db/push/push.command.ts)                                                                                                                                               |
 | `db pull`                              | `wrapped`     | [`../src/legacy/commands/db/pull/pull.command.ts`](../src/legacy/commands/db/pull/pull.command.ts) — includes `--declarative` (deprecated alias `--use-pg-delta`) and `--diff-engine` (migra\|pg-delta, mutually exclusive with `--declarative`) |
 | `db reset`                             | `wrapped`     | [`../src/legacy/commands/db/reset/reset.command.ts`](../src/legacy/commands/db/reset/reset.command.ts)                                                                                                                                           |
-| `db lint`                              | `wrapped`     | [`../src/legacy/commands/db/lint/lint.command.ts`](../src/legacy/commands/db/lint/lint.command.ts)                                                                                                                                               |
+| `db lint`                              | `ported`      | [`../src/legacy/commands/db/lint/lint.command.ts`](../src/legacy/commands/db/lint/lint.command.ts)                                                                                                                                               |
 | `db start`                             | `wrapped`     | [`../src/legacy/commands/db/start/start.command.ts`](../src/legacy/commands/db/start/start.command.ts)                                                                                                                                           |
 | `db query`                             | `wrapped`     | [`../src/legacy/commands/db/query/query.command.ts`](../src/legacy/commands/db/query/query.command.ts)                                                                                                                                           |
-| `db advisors`                          | `wrapped`     | [`../src/legacy/commands/db/advisors/advisors.command.ts`](../src/legacy/commands/db/advisors/advisors.command.ts)                                                                                                                               |
+| `db advisors`                          | `ported`      | [`../src/legacy/commands/db/advisors/advisors.command.ts`](../src/legacy/commands/db/advisors/advisors.command.ts)                                                                                                                               |
 | `db test`                              | `wrapped`     | [`../src/legacy/commands/db/test/test.command.ts`](../src/legacy/commands/db/test/test.command.ts)                                                                                                                                               |
 | `db branch create`                     | `wrapped`     | [`../src/legacy/commands/db/branch/create/create.command.ts`](../src/legacy/commands/db/branch/create/create.command.ts)                                                                                                                         |
 | `db branch delete`                     | `wrapped`     | [`../src/legacy/commands/db/branch/delete/delete.command.ts`](../src/legacy/commands/db/branch/delete/delete.command.ts)                                                                                                                         |

@@ -0,0 +1,25 @@
+import { Effect } from "effect";
+
+import { LegacyInvalidAccessTokenError } from "./legacy-errors.ts";
+
+/** Go's `utils.AccessTokenPattern` (`apps/cli-go/internal/utils/access_token.go:16`). */
+export const LEGACY_ACCESS_TOKEN_PATTERN = /^sbp_(oauth_)?[a-f0-9]{40}$/;
+
+/** Go's `utils.ErrInvalidToken` message (`internal/utils/access_token.go:17`). */
+const LEGACY_INVALID_ACCESS_TOKEN_MESSAGE =
+  "Invalid access token format. Must be like `sbp_0102...1920`.";
+
+/**
+ * Validates an access token against the `sbp_` pattern, failing with
+ * `LegacyInvalidAccessTokenError`. Mirrors Go's `LoadAccessTokenFS`, which runs
+ * the loaded token (env / keyring / file) through `AccessTokenPattern` before
+ * any Management API call (`internal/utils/access_token.go:24-33`).
+ */
+export const validateLegacyAccessToken = (
+  token: string,
+): Effect.Effect<string, LegacyInvalidAccessTokenError> =>
+  LEGACY_ACCESS_TOKEN_PATTERN.test(token)
+    ? Effect.succeed(token)
+    : Effect.fail(
+        new LegacyInvalidAccessTokenError({ message: LEGACY_INVALID_ACCESS_TOKEN_MESSAGE }),
+      );
@@ -4,22 +4,18 @@ import { RuntimeInfo } from "../../shared/runtime/runtime-info.service.ts";
 import { normalizeKeyringToken } from "../../shared/auth/keyring-token.ts";
 import { LegacyDebugLogger } from "../shared/legacy-debug-logger.service.ts";
 import { LegacyCliConfig } from "../config/legacy-cli-config.service.ts";
+import { LEGACY_ACCESS_TOKEN_PATTERN, validateLegacyAccessToken } from "./legacy-access-token.ts";
 import { LegacyCredentials } from "./legacy-credentials.service.ts";
 import {
   LegacyCredentialDeleteError,
   LegacyDeleteTokenError,
-  LegacyInvalidAccessTokenError,
   LegacyNotLoggedInError,
 } from "./legacy-errors.ts";
 
 const KEYRING_SERVICE = "Supabase CLI";
 const LEGACY_KEYRING_ACCOUNT = "access-token";
 const WSL_OSRELEASE_PATH = "/proc/sys/kernel/osrelease";
 
-const ACCESS_TOKEN_PATTERN = /^sbp_(oauth_)?[a-f0-9]{40}$/;
-
-const INVALID_TOKEN_MESSAGE = "Invalid access token format. Must be like `sbp_0102...1920`.";
-
 // Go's `utils.ErrNotLoggedIn` (`access_token.go:19`).
 const NOT_LOGGED_IN_MESSAGE = "You were not logged in, nothing to do.";
 
@@ -128,7 +124,7 @@ function readGoWindowsTarget(module: KeyringModule, account: string): string | n
 
 function normalizeGoWindowsPassword(value: string): string {
   const direct = normalizeKeyringToken(value);
-  if (ACCESS_TOKEN_PATTERN.test(direct)) return direct;
+  if (LEGACY_ACCESS_TOKEN_PATTERN.test(direct)) return direct;
 
   // Go writes Windows CredentialBlob values as raw UTF-8 bytes. The TS keyring
   // search API can surface those bytes packed into UTF-16 code units, so unpack
@@ -337,11 +333,6 @@ const makeLegacyCredentials = Effect.gen(function* () {
       ? Option.none<KeyringModule>()
       : yield* Effect.tryPromise(() => import("@napi-rs/keyring")).pipe(Effect.option);
 
-  const validate = (token: string): Effect.Effect<string, LegacyInvalidAccessTokenError> =>
-    ACCESS_TOKEN_PATTERN.test(token)
-      ? Effect.succeed(token)
-      : Effect.fail(new LegacyInvalidAccessTokenError({ message: INVALID_TOKEN_MESSAGE }));
-
   const readKeyring = Effect.gen(function* () {
     if (Option.isNone(keyringModule)) return Option.none<string>();
     const profileResult = yield* tryKeyringRead(
@@ -377,22 +368,22 @@ const makeLegacyCredentials = Effect.gen(function* () {
       // Env takes precedence (matches access_token.go:38).
       if (Option.isSome(cliConfig.accessToken)) {
         yield* debugLogger.debug("Using access token from env var...");
-        yield* validate(Redacted.value(cliConfig.accessToken.value));
+        yield* validateLegacyAccessToken(Redacted.value(cliConfig.accessToken.value));
         return Option.some(cliConfig.accessToken.value);
       }
 
       // Keyring (profile key, then legacy key). Skipped on WSL.
       const keyringValue = yield* readKeyring;
       if (Option.isSome(keyringValue)) {
-        yield* validate(keyringValue.value);
+        yield* validateLegacyAccessToken(keyringValue.value);
         return Option.some(Redacted.make(keyringValue.value));
       }
 
       // Filesystem fallback at ~/.supabase/access-token.
       const fileValue = yield* readFile;
       if (Option.isSome(fileValue)) {
         yield* debugLogger.debug(`Using access token from file: ${fallbackPath}`);
-        yield* validate(fileValue.value);
+        yield* validateLegacyAccessToken(fileValue.value);
         return Option.some(Redacted.make(fileValue.value));
       }
 
@@ -401,7 +392,7 @@ const makeLegacyCredentials = Effect.gen(function* () {
 
     saveAccessToken: (token: string) =>
       Effect.gen(function* () {
-        yield* validate(token);
+        yield* validateLegacyAccessToken(token);
         if (Option.isSome(keyringModule)) {
           const ok = yield* tryKeyringWrite(
             keyringModule.value,

@@ -1,118 +1,26 @@
 import { makeApiClient } from "@supabase/api/effect";
-import { Effect, FileSystem, Layer, Option, Path } from "effect";
+import { Effect, Layer, Option, Redacted } from "effect";
 import * as HttpClient from "effect/unstable/http/HttpClient";
-import type * as HttpClientResponse from "effect/unstable/http/HttpClientResponse";
 
 import { CLI_VERSION } from "../../shared/cli/version.ts";
 import { LegacyCliConfig } from "../config/legacy-cli-config.service.ts";
 import { LegacyDebugLogger } from "../shared/legacy-debug-logger.service.ts";
-import { Analytics } from "../../shared/telemetry/analytics.service.ts";
-import { TelemetryRuntime } from "../../shared/telemetry/runtime.service.ts";
+import { makeLegacyIdentityStitcher } from "../shared/legacy-identity-stitch.ts";
+import { validateLegacyAccessToken } from "./legacy-access-token.ts";
 import { LegacyCredentials } from "./legacy-credentials.service.ts";
 import { LegacyPlatformAuthRequiredError } from "./legacy-errors.ts";
 import { LegacyPlatformApi } from "./legacy-platform-api.service.ts";
 
 const MISSING_TOKEN_MESSAGE =
   "Access token not provided. Supply an access token by running `supabase login` or setting the SUPABASE_ACCESS_TOKEN environment variable.";
 
-const HEADER_GOTRUE_ID = "x-gotrue-id";
-const TELEMETRY_SCHEMA_VERSION = 1;
-
-interface LegacyTelemetryState {
-  readonly enabled: boolean;
-  readonly device_id: string;
-  readonly session_id: string;
-  readonly session_last_active: string;
-  readonly distinct_id: string;
-  readonly schema_version: number;
-}
-
-function gotrueIdFromResponse(response: HttpClientResponse.HttpClientResponse): string | undefined {
-  const value = response.headers[HEADER_GOTRUE_ID] ?? response.headers["X-Gotrue-Id"];
-  if (value === undefined) return undefined;
-  const trimmed = value.trim();
-  return trimmed.length === 0 ? undefined : trimmed;
-}
-
-function fieldValue(value: unknown, key: string): unknown {
-  if (typeof value !== "object" || value === null) return undefined;
-  return Reflect.get(value, key);
-}
-
-function stringField(value: unknown, key: string): string | undefined {
-  const field = fieldValue(value, key);
-  return typeof field === "string" && field.length > 0 ? field : undefined;
-}
-
-function boolField(value: unknown, key: string): boolean | undefined {
-  const field = fieldValue(value, key);
-  return typeof field === "boolean" ? field : undefined;
-}
-
-function numberField(value: unknown, key: string): number | undefined {
-  const field = fieldValue(value, key);
-  return typeof field === "number" && Number.isFinite(field) ? field : undefined;
-}
-
-function isEphemeralIdentityRuntime(runtime: {
-  readonly isCi: boolean;
-  readonly isFirstRun: boolean;
-  readonly isTty: boolean;
-}) {
-  return runtime.isCi || (runtime.isFirstRun && !runtime.isTty);
-}
-
 export const legacyMakePlatformApi = Effect.gen(function* () {
   const cliConfig = yield* LegacyCliConfig;
   const credentials = yield* LegacyCredentials;
-  const analytics = yield* Analytics;
-  const runtime = yield* TelemetryRuntime;
-  const fs = yield* FileSystem.FileSystem;
-  const path = yield* Path.Path;
   const debugLogger = yield* LegacyDebugLogger;
-  let stitchAttempted = false;
-
-  const needsIdentityStitch =
-    runtime.consent === "granted" &&
-    !isEphemeralIdentityRuntime(runtime) &&
-    (runtime.distinctId === undefined || runtime.distinctId.length === 0);
-
-  const stitchIdentity = (gotrueId: string) =>
-    Effect.gen(function* () {
-      if (!needsIdentityStitch || stitchAttempted) return;
-
-      const telemetryPath = path.join(runtime.configDir, "telemetry.json");
-      const existing = yield* fs.readFileString(telemetryPath).pipe(Effect.option);
-      const prior = Option.match(existing, {
-        onNone: () => undefined,
-        onSome: (content) => {
-          try {
-            const parsed: unknown = JSON.parse(content);
-            return parsed;
-          } catch {
-            return undefined;
-          }
-        },
-      });
-      const enabled = boolField(prior, "enabled") ?? true;
-      if (!enabled) return;
-
-      stitchAttempted = true;
-
-      yield* analytics.alias(gotrueId, runtime.deviceId);
-
-      const state: LegacyTelemetryState = {
-        enabled,
-        device_id: stringField(prior, "device_id") ?? runtime.deviceId,
-        session_id: stringField(prior, "session_id") ?? runtime.sessionId,
-        session_last_active: new Date().toISOString(),
-        distinct_id: gotrueId,
-        schema_version: numberField(prior, "schema_version") ?? TELEMETRY_SCHEMA_VERSION,
-      };
-
-      yield* fs.makeDirectory(runtime.configDir, { recursive: true });
-      yield* fs.writeFileString(telemetryPath, JSON.stringify(state));
-    });
+  // Go wraps every Management API response in identityTransport for session
+  // identity stitching; build the shared stitcher once for this client's transport.
+  const stitchIdentityFromResponse = yield* makeLegacyIdentityStitcher;
 
   const transformClient = (client: HttpClient.HttpClient) => {
     const debugClient = HttpClient.mapRequestEffect(client, (request) =>
@@ -121,13 +29,7 @@ export const legacyMakePlatformApi = Effect.gen(function* () {
 
     return Effect.succeed(
       HttpClient.transform(debugClient, (requestEffect) =>
-        requestEffect.pipe(
-          Effect.tap((response) => {
-            const gotrueId = gotrueIdFromResponse(response);
-            if (gotrueId === undefined) return Effect.void;
-            return stitchIdentity(gotrueId).pipe(Effect.exit, Effect.asVoid);
-          }),
-        ),
+        requestEffect.pipe(Effect.tap((response) => stitchIdentityFromResponse(response))),
       ),
     );
   };
@@ -136,6 +38,13 @@ export const legacyMakePlatformApi = Effect.gen(function* () {
   const resolveAccessToken = Effect.gen(function* () {
     if (Option.isSome(configuredToken)) {
       yield* debugLogger.debug("Using access token from env var...");
+      // Go's GetSupabase() → LoadAccessTokenFS validates the token — including the
+      // env value — against the sbp_ pattern before any API call
+      // (internal/utils/api.go:121, access_token.go:24-41). credentials.getAccessToken
+      // already validates the keyring/file paths; validate the env token here too so
+      // a malformed SUPABASE_ACCESS_TOKEN fails with the invalid-token error rather
+      // than being sent to the API.
+      yield* validateLegacyAccessToken(Redacted.value(configuredToken.value));
       return configuredToken;
     }
     return yield* credentials.getAccessToken;