feat(cli): port db dump, query, and schema declarative to native TypeScript

apps/cli-go/cmd/pgdelta_catalog.go

@@ -0,0 +1,38 @@
+package cmd
+
+import (
+	"fmt"
+
+	"github.com/spf13/afero"
+	"github.com/spf13/cobra"
+	"github.com/supabase/cli/internal/db/declarative"
+)
+
+// pgdeltaCatalogMode selects which catalog the hidden seam command produces.
+var pgdeltaCatalogMode string
+
+// dbDeclarativeCatalogCmd is a hidden seam used by the native-TypeScript
+// declarative commands to provision a shadow-database platform baseline (and,
+// for migrations/declarative modes, apply migrations / declarative files) and
+// export the resulting pg-delta catalog. It prints the catalog file path to
+// stdout. Inherits the declarative group's PersistentPreRunE (the
+// experimental/pg-delta gate + config load), so callers must pass
+// --experimental or enable [experimental.pgdelta].
+var dbDeclarativeCatalogCmd = &cobra.Command{
+	Use:    "__catalog",
+	Hidden: true,
+	Short:  "Internal: export a pg-delta catalog for the native declarative commands",
+	RunE: func(cmd *cobra.Command, args []string) error {
+		ref, err := declarative.ExportModeCatalog(cmd.Context(), pgdeltaCatalogMode, declarativeNoCache, afero.NewOsFs())
+		if err != nil {
+			return err
+		}
+		fmt.Println(ref)
+		return nil
+	},
+}
+
+func init() {
+	dbDeclarativeCatalogCmd.Flags().StringVar(&pgdeltaCatalogMode, "mode", "", "Catalog mode: baseline, migrations, or declarative.")
+	dbDeclarativeCmd.AddCommand(dbDeclarativeCatalogCmd)
+}

apps/cli-go/internal/db/declarative/seam.go

@@ -0,0 +1,41 @@
+package declarative
+
+import (
+	"context"
+
+	"github.com/go-errors/errors"
+	"github.com/jackc/pgx/v4"
+	"github.com/spf13/afero"
+)
+
+// ExportModeCatalog produces (and caches under supabase/.temp/pgdelta/) the
+// pg-delta catalog for the given mode and returns its on-disk path.
+//
+// It is the seam consumed by the native-TypeScript `db schema declarative`
+// commands: they own orchestration, the pg-delta diff/export, file writes, and
+// prompts, but delegate the shadow-database platform-baseline provisioning
+// (start.SetupDatabase, which runs the auth/storage/realtime service migrations)
+// to this Go path, which is not yet ported.
+//
+//   - "baseline":    platform baseline only (no user migrations) — the generate source.
+//   - "migrations":  platform baseline + local migrations applied — the sync source.
+//   - "declarative": platform baseline + declarative files applied — the sync target.
+func ExportModeCatalog(ctx context.Context, mode string, noCache bool, fsys afero.Fs, options ...func(*pgx.ConnConfig)) (string, error) {
+	switch mode {
+	case "migrations":
+		return getMigrationsCatalogRef(ctx, noCache, fsys, "local", options...)
+	case "declarative":
+		return getDeclarativeCatalogRef(ctx, noCache, fsys, options...)
+	case "baseline":
+		ref, err := getGenerateBaselineCatalogRef(ctx, noCache, fsys, options...)
+		if err != nil {
+			return "", err
+		}
+		if ref.shadow != nil {
+			ref.shadow.cleanup()
+		}
+		return ref.ref, nil
+	default:
+		return "", errors.Errorf("unknown catalog mode: %s", mode)
+	}
+}

apps/cli/docs/go-cli-porting-status.md

@@ -299,13 +299,13 @@ Legend:
 | `test new`                             | `ported`      | [`../src/legacy/commands/test/new/new.command.ts`](../src/legacy/commands/test/new/new.command.ts)                                                                                                                                               |
 | `seed buckets`                         | `wrapped`     | [`../src/legacy/commands/seed/buckets/buckets.command.ts`](../src/legacy/commands/seed/buckets/buckets.command.ts)                                                                                                                               |
 | `db diff`                              | `wrapped`     | [`../src/legacy/commands/db/diff/diff.command.ts`](../src/legacy/commands/db/diff/diff.command.ts)                                                                                                                                               |
-| `db dump`                              | `wrapped`     | [`../src/legacy/commands/db/dump/dump.command.ts`](../src/legacy/commands/db/dump/dump.command.ts)                                                                                                                                               |
+| `db dump`                              | `ported`      | [`../src/legacy/commands/db/dump/dump.command.ts`](../src/legacy/commands/db/dump/dump.command.ts)                                                                                                                                               |
 | `db push`                              | `wrapped`     | [`../src/legacy/commands/db/push/push.command.ts`](../src/legacy/commands/db/push/push.command.ts)                                                                                                                                               |
 | `db pull`                              | `wrapped`     | [`../src/legacy/commands/db/pull/pull.command.ts`](../src/legacy/commands/db/pull/pull.command.ts) — includes `--declarative` (deprecated alias `--use-pg-delta`) and `--diff-engine` (migra\|pg-delta, mutually exclusive with `--declarative`) |
 | `db reset`                             | `wrapped`     | [`../src/legacy/commands/db/reset/reset.command.ts`](../src/legacy/commands/db/reset/reset.command.ts)                                                                                                                                           |
 | `db lint`                              | `ported`      | [`../src/legacy/commands/db/lint/lint.command.ts`](../src/legacy/commands/db/lint/lint.command.ts)                                                                                                                                               |
 | `db start`                             | `wrapped`     | [`../src/legacy/commands/db/start/start.command.ts`](../src/legacy/commands/db/start/start.command.ts)                                                                                                                                           |
-| `db query`                             | `wrapped`     | [`../src/legacy/commands/db/query/query.command.ts`](../src/legacy/commands/db/query/query.command.ts)                                                                                                                                           |
+| `db query`                             | `ported`      | [`../src/legacy/commands/db/query/query.command.ts`](../src/legacy/commands/db/query/query.command.ts)                                                                                                                                           |
 | `db advisors`                          | `ported`      | [`../src/legacy/commands/db/advisors/advisors.command.ts`](../src/legacy/commands/db/advisors/advisors.command.ts)                                                                                                                               |
 | `db test`                              | `wrapped`     | [`../src/legacy/commands/db/test/test.command.ts`](../src/legacy/commands/db/test/test.command.ts)                                                                                                                                               |
 | `db branch create`                     | `wrapped`     | [`../src/legacy/commands/db/branch/create/create.command.ts`](../src/legacy/commands/db/branch/create/create.command.ts)                                                                                                                         |
@@ -314,5 +314,5 @@ Legend:
 | `db branch switch`                     | `wrapped`     | [`../src/legacy/commands/db/branch/switch/switch.command.ts`](../src/legacy/commands/db/branch/switch/switch.command.ts)                                                                                                                         |
 | `db remote changes`                    | `wrapped`     | [`../src/legacy/commands/db/remote/changes/changes.command.ts`](../src/legacy/commands/db/remote/changes/changes.command.ts)                                                                                                                     |
 | `db remote commit`                     | `wrapped`     | [`../src/legacy/commands/db/remote/commit/commit.command.ts`](../src/legacy/commands/db/remote/commit/commit.command.ts)                                                                                                                         |
-| `db schema declarative sync`           | `wrapped`     | [`../src/legacy/commands/db/schema/declarative/sync/sync.command.ts`](../src/legacy/commands/db/schema/declarative/sync/sync.command.ts)                                                                                                         |
-| `db schema declarative generate`       | `wrapped`     | [`../src/legacy/commands/db/schema/declarative/generate/generate.command.ts`](../src/legacy/commands/db/schema/declarative/generate/generate.command.ts)                                                                                         |
+| `db schema declarative sync`           | `ported`      | [`../src/legacy/commands/db/schema/declarative/sync/sync.command.ts`](../src/legacy/commands/db/schema/declarative/sync/sync.command.ts)                                                                                                         |
+| `db schema declarative generate`       | `ported`      | [`../src/legacy/commands/db/schema/declarative/generate/generate.command.ts`](../src/legacy/commands/db/schema/declarative/generate/generate.command.ts)                                                                                         |

apps/cli/src/legacy/auth/legacy-platform-api-factory.service.ts

@@ -6,6 +6,18 @@ import type {
   LegacyPlatformAuthRequiredError,
 } from "./legacy-errors.ts";
 
+/**
+ * The error `make` can fail with when it lazily resolves the access token and
+ * constructs the typed client. Surfaces only when a command branch actually
+ * reaches a Management API call — never at layer build — so consumers that route
+ * through the lazy factory (e.g. the `--linked` db-config resolver) must include
+ * it in their own effect error channel rather than a layer-build error channel.
+ */
+export type LegacyPlatformApiFactoryError =
+  | LegacyInvalidAccessTokenError
+  | LegacyPlatformAuthRequiredError
+  | SupabaseApiConfigError;
+
 /**
  * Lazy accessor for the typed Management API client.
  *
@@ -14,10 +26,7 @@ import type {
  * branch actually reaches a Management API call.
  */
 export interface LegacyPlatformApiFactoryShape {
-  readonly make: Effect.Effect<
-    ApiClient,
-    LegacyInvalidAccessTokenError | LegacyPlatformAuthRequiredError | SupabaseApiConfigError
-  >;
+  readonly make: Effect.Effect<ApiClient, LegacyPlatformApiFactoryError>;
 }
 
 export class LegacyPlatformApiFactory extends Context.Service<

apps/cli/src/legacy/auth/legacy-platform-api.layer.unit.test.ts

@@ -9,14 +9,16 @@ import { tmpdir } from "node:os";
 import path from "node:path";
 import { vi } from "vitest";
 
-import { LegacyDebugFlag } from "../../shared/legacy/global-flags.ts";
+import { LegacyDebugFlag, LegacyDnsResolverFlag } from "../../shared/legacy/global-flags.ts";
 import { Analytics } from "../../shared/telemetry/analytics.service.ts";
 import { TelemetryRuntime } from "../../shared/telemetry/runtime.service.ts";
 import { makeTelemetryIdentity } from "../../shared/telemetry/identity.ts";
 import { LegacyCliConfig } from "../config/legacy-cli-config.service.ts";
 import { legacyDebugLoggerLayer } from "../shared/legacy-debug-logger.layer.ts";
 import { legacyIdentityStitchLayer } from "../shared/legacy-identity-stitch.ts";
 import { LegacyCredentials } from "./legacy-credentials.service.ts";
+import { legacyPlatformApiFactoryLayer } from "./legacy-platform-api-factory.layer.ts";
+import { LegacyPlatformApiFactory } from "./legacy-platform-api-factory.service.ts";
 import { legacyPlatformApiLayer } from "./legacy-platform-api.layer.ts";
 import { LegacyPlatformApi } from "./legacy-platform-api.service.ts";
 
@@ -193,6 +195,8 @@ function withBaseDeps(
       Layer.provide(identityStitch),
       Layer.provide(legacyDebugLoggerLayer),
       Layer.provide(Layer.succeed(LegacyDebugFlag, opts.debug ?? false)),
+      // The lazy platform-API factory's DoH fetch layer reads the DNS-resolver flag.
+      Layer.provide(Layer.succeed(LegacyDnsResolverFlag, "native")),
     );
 }
 
@@ -522,3 +526,59 @@ describe("legacyPlatformApiLayer", () => {
     }).pipe(Effect.provide(layer));
   });
 });
+
+// The lazy factory underpins the `--linked` db-config resolver's auth-free
+// `--password` path (CLI port of Go's `NewDbConfigWithPassword`, which only calls
+// `GetSupabase` — and thus loads a token — when no password is supplied). Building
+// the factory must therefore resolve NO token; the friendly auth error must still
+// surface when a command branch actually reaches `make` (e.g. minting a temp role).
+describe("legacyPlatformApiFactoryLayer (lazy token)", () => {
+  it.effect("builds without resolving an access token even when none is configured", () => {
+    const layer = legacyPlatformApiFactoryLayer.pipe(
+      Layer.provide(mockCliConfig({})),
+      Layer.provide(mockCredentials(Option.none())),
+      withBaseDeps(),
+    );
+    // The eager `legacyPlatformApiLayer` would fail to build here; obtaining the
+    // factory service without touching `make` must succeed — this is exactly the
+    // `--linked --password` path, which never mints a temp role.
+    return Effect.gen(function* () {
+      const factory = yield* LegacyPlatformApiFactory;
+      expect(typeof factory.make).toBe("object");
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.effect("make fails with LegacyPlatformAuthRequiredError when no token is configured", () => {
+    const layer = legacyPlatformApiFactoryLayer.pipe(
+      Layer.provide(mockCliConfig({})),
+      Layer.provide(mockCredentials(Option.none())),
+      withBaseDeps(),
+    );
+    return Effect.gen(function* () {
+      const factory = yield* LegacyPlatformApiFactory;
+      const exit = yield* Effect.exit(factory.make);
+      expect(Exit.isFailure(exit)).toBe(true);
+      if (Exit.isFailure(exit)) {
+        const errorJson = JSON.stringify(exit.cause);
+        expect(errorJson).toContain("LegacyPlatformAuthRequiredError");
+        expect(errorJson).toContain("Access token not provided");
+      }
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.effect("make resolves a single cached client when a token is configured", () => {
+    const layer = legacyPlatformApiFactoryLayer.pipe(
+      Layer.provide(mockCliConfig({ accessToken: VALID_TOKEN })),
+      Layer.provide(mockCredentials(Option.none())),
+      withBaseDeps(),
+    );
+    return Effect.gen(function* () {
+      const factory = yield* LegacyPlatformApiFactory;
+      const first = yield* factory.make;
+      const second = yield* factory.make;
+      // `Effect.cached` guarantees the token is resolved once and the same client
+      // instance is reused across repeated `make` calls within one command run.
+      expect(first).toBe(second);
+    }).pipe(Effect.provide(layer));
+  });
+});

apps/cli/src/legacy/cli/root.ts

@@ -145,13 +145,14 @@ export const legacyRoot = Command.make("supabase").pipe(
         if (createTicket) globalArgs.push("--create-ticket");
         if (agent !== "auto") globalArgs.push("--agent", agent);
 
-        // Go's `-o {json,yaml,toml,env}` selects a machine encoder the handler
-        // writes via `output.raw`. Keep the text layer (so errors still render
-        // as red text on stderr, matching Go), but suppress its progress spinner
-        // — otherwise clack writes ANSI to stdout and corrupts the payload
-        // (CLI-1546). `-o pretty` / no `-o` keep the normal text/json layers.
+        // Go's `-o {json,yaml,toml,env,csv}` selects a machine encoder the
+        // handler writes via `output.raw`. Keep the text layer (so errors still
+        // render as red text on stderr, matching Go), but suppress its progress
+        // spinner — otherwise clack writes ANSI to stdout and corrupts the
+        // payload (CLI-1546). `-o pretty` / `-o table` (`db query`'s human
+        // default) / no `-o` keep the normal text/json layers.
         const goFmt = Option.getOrUndefined(goOutput);
-        const isGoMachineFormat = goFmt !== undefined && goFmt !== "pretty";
+        const isGoMachineFormat = goFmt !== undefined && goFmt !== "pretty" && goFmt !== "table";
         const outputLayer = isGoMachineFormat
           ? legacyQuietProgressTextOutputLayer
           : outputLayerFor(outputFormat);

apps/cli/src/legacy/commands/db/advisors/advisors.integration.test.ts

@@ -86,6 +86,7 @@ function mockResolver(opts: { ipv6Error?: boolean } = {}) {
           isLocal: flags.connType !== "linked",
         } satisfies LegacyResolvedDbConfig;
       }),
+    resolvePoolerFallback: () => Effect.succeed(Option.none()),
   });
   return {
     layer,
@@ -106,6 +107,7 @@ function mockConnection(opts: {
       Effect.succeed({
         extensionExists: () => Effect.succeed(false),
         copyToCsv: () => Effect.succeed(new Uint8Array()),
+        queryRaw: () => Effect.succeed({ fields: [], rows: [], commandTag: "" }),
         exec: (sql: string) =>
           Effect.suspend(() => {
             execs.push(sql);