supabase · Coly010 · Jun 22, 2026 · Jun 22, 2026 · Jun 22, 2026 · Jun 22, 2026
diff --git a/apps/cli/package.json b/apps/cli/package.json
@@ -115,7 +115,8 @@
       "src/shared/telemetry/event-catalog.ts"
     ],
     "ignoreBinaries": [
-      "nx"
+      "nx",
+      "mkfifo"
     ],
     "ignoreDependencies": [
       "@parcel/watcher-darwin-arm64",

@@ -153,6 +153,7 @@ function setup(opts: SetupOpts = {}) {
     BunServices.layer,
     out.layer,
     api.layer,
+    api.factoryLayer,
     api.httpClientLayer,
     cliConfig,
     mockTty({ stdinIsTty: opts.stdinIsTty ?? true, stdoutIsTty: false }),

@@ -149,6 +149,7 @@ describe("legacy bootstrap linked-project cache location", () => {
         BunServices.layer,
         out.layer,
         api.layer,
+        api.factoryLayer,
         api.httpClientLayer,
         configLayer,
         cacheLayer,

@@ -2,7 +2,7 @@ import type { ProjectConfig } from "@supabase/config";
 
 import { diff } from "./config-sync.diff.ts";
 import { encodeToml, type TomlField, type TomlValue } from "./config-sync.toml.ts";
-import { intToUint } from "./config-sync.units.ts";
+import { intToUint } from "../../../../shared/legacy-size-units.ts";
 
 /**
  * Push-subset of Go's `api` struct (`pkg/config/api.go`). Only `toml`-tagged

@@ -13,7 +13,7 @@ import type { ProjectConfig } from "@supabase/config";
 
 import { diff } from "./config-sync.diff.ts";
 import { type TomlField, type TomlValue, encodeToml } from "./config-sync.toml.ts";
-import { intToUint } from "./config-sync.units.ts";
+import { intToUint } from "../../../../shared/legacy-size-units.ts";
 import { durationString, parseDuration, secondsToDurationString } from "./config-sync.duration.ts";
 import { secretHash } from "./config-sync.secret.ts";
 

@@ -2,7 +2,7 @@ import type { ProjectConfig } from "@supabase/config";
 
 import { diff } from "./config-sync.diff.ts";
 import { encodeToml, type TomlField, type TomlValue } from "./config-sync.toml.ts";
-import { intToUint } from "./config-sync.units.ts";
+import { intToUint } from "../../../../shared/legacy-size-units.ts";
 
 /**
  * Push-subset of Go's `db.Settings`, `db.NetworkRestrictions`,

@@ -2,7 +2,7 @@ import type { ProjectConfig } from "@supabase/config";
 
 import { diff } from "./config-sync.diff.ts";
 import { encodeToml, type TomlField, type TomlValue } from "./config-sync.toml.ts";
-import { bytesSize, intToUint, ramInBytes } from "./config-sync.units.ts";
+import { bytesSize, intToUint, ramInBytes } from "../../../../shared/legacy-size-units.ts";
 
 /**
  * Push-subset of Go's `storage` struct (`pkg/config/storage.go`). `toml:"-"`

@@ -0,0 +1,27 @@
+/**
+ * Vector-bucket error classifiers — ports of `isVectorBucketsFeatureNotEnabled`
+ * and `isLocalVectorBucketsUnavailable` (`apps/cli-go/internal/seed/buckets/buckets.go:71-84`).
+ *
+ * Both inspect the error message string. The Storage gateway client raises
+ * status errors whose message reproduces Go's `Error status <d>: <body>`, so the
+ * same substring checks apply.
+ */
+
+/** Remote region has not enabled vector buckets yet (`buckets.go:71-73`). */
+export function legacyIsVectorBucketsFeatureNotEnabled(message: string): boolean {
+  return message.includes("FeatureNotEnabled");
+}
+
+/**
+ * The local Storage service does not expose the vector routes (`buckets.go:75-84`):
+ * either it reports the vector service is not configured, or the `ListVectorBuckets`
+ * route returns 404 (older local image without vector support).
+ */
+export function legacyIsLocalVectorBucketsUnavailable(message: string): boolean {
+  return (
+    message.includes("Vector service not configured") ||
+    (message.includes("Error status 404:") &&
+      message.includes("Route POST:") &&
+      message.includes("ListVectorBuckets"))
+  );
+}
@@ -0,0 +1,46 @@
+import { describe, expect, it } from "@effect/vitest";
+
+import {
+  legacyIsLocalVectorBucketsUnavailable,
+  legacyIsVectorBucketsFeatureNotEnabled,
+} from "./buckets.classify.ts";
+
+describe("legacyIsVectorBucketsFeatureNotEnabled", () => {
+  it("matches when the message mentions FeatureNotEnabled", () => {
+    expect(
+      legacyIsVectorBucketsFeatureNotEnabled('Error status 400: {"code":"FeatureNotEnabled"}'),
+    ).toBe(true);
+  });
+
+  it("does not match an unrelated error", () => {
+    expect(legacyIsVectorBucketsFeatureNotEnabled("Error status 500: boom")).toBe(false);
+  });
+});
+
+describe("legacyIsLocalVectorBucketsUnavailable", () => {
+  it("matches the 'Vector service not configured' message", () => {
+    expect(
+      legacyIsLocalVectorBucketsUnavailable(
+        "Error status 409: The feature Vector service not configured is not enabled",
+      ),
+    ).toBe(true);
+  });
+
+  it("matches a 404 on the ListVectorBuckets route", () => {
+    expect(
+      legacyIsLocalVectorBucketsUnavailable(
+        "Error status 404: Route POST:/vector/ListVectorBuckets not found",
+      ),
+    ).toBe(true);
+  });
+
+  it("does not match a 404 on a different route", () => {
+    expect(
+      legacyIsLocalVectorBucketsUnavailable("Error status 404: Route POST:/something not found"),
+    ).toBe(false);
+  });
+
+  it("does not match an unrelated error", () => {
+    expect(legacyIsLocalVectorBucketsUnavailable("Error status 500: boom")).toBe(false);
+  });
+});
@@ -1,6 +1,13 @@
+import { Effect } from "effect";
 import { Command, Flag } from "effect/unstable/cli";
 import type * as CliCommand from "effect/unstable/cli/Command";
-import { legacyBuckets } from "./buckets.handler.ts";
+
+import { CliArgs } from "../../../../shared/cli/cli-args.service.ts";
+import { withJsonErrorHandling } from "../../../../shared/output/json-error-handling.ts";
+import { withLegacyCommandInstrumentation } from "../../../telemetry/legacy-command-instrumentation.ts";
+import { legacyAssertSeedTargetsExclusive } from "./buckets.flags.ts";
+import { legacySeedRuntimeLayer } from "../seed.layers.ts";
+import { legacySeedBuckets } from "./buckets.handler.ts";
 
 const config = {
   linked: Flag.boolean("linked").pipe(Flag.withDescription("Seeds the linked project.")),
@@ -12,5 +19,15 @@ export type LegacyBucketsFlags = CliCommand.Command.Config.Infer<typeof config>;
 export const legacyBucketsCommand = Command.make("buckets", config).pipe(
   Command.withDescription("Seed buckets declared in [storage.buckets]."),
   Command.withShortDescription("Seed buckets declared in [storage.buckets]"),
-  Command.withHandler((flags) => legacyBuckets(flags)),
+  Command.withHandler((flags) =>
+    Effect.gen(function* () {
+      // Enforce --local/--linked mutual exclusivity BEFORE instrumentation, so a
+      // flag-validation rejection doesn't emit `cli_command_executed` (Go rejects
+      // it at cobra flag validation, before RunE/PostRun).
+      const cliArgs = yield* CliArgs;
+      yield* legacyAssertSeedTargetsExclusive(cliArgs.args);
+      return yield* legacySeedBuckets(flags).pipe(withLegacyCommandInstrumentation({ flags }));
+    }).pipe(withJsonErrorHandling),
+  ),
+  Command.provide(legacySeedRuntimeLayer(["seed", "buckets"])),
 );
@@ -0,0 +1,53 @@
+import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { afterAll, beforeAll, describe, expect, test } from "vitest";
+
+import { runSupabase } from "../../../../../tests/helpers/cli.ts";
+
+const E2E_TIMEOUT_MS = 30_000;
+
+/**
+ * Golden-path e2e: exercises the real compiled-binary boundary for the two
+ * network-free paths of `seed buckets`:
+ *  - an empty `[storage]` config is a no-op (exit 0, no stdout);
+ *  - `--local --linked` is rejected by the mutually-exclusive flag check.
+ * Bucket/object seeding parity is covered by the integration + unit suites.
+ */
+describe("supabase seed buckets (legacy)", () => {
+  let projectDir: string;
+
+  beforeAll(() => {
+    projectDir = mkdtempSync(join(tmpdir(), "supabase-seed-buckets-e2e-"));
+    mkdirSync(join(projectDir, "supabase"), { recursive: true });
+    writeFileSync(join(projectDir, "supabase", "config.toml"), 'project_id = "test"\n');
+  });
+
+  afterAll(() => {
+    rmSync(projectDir, { recursive: true, force: true });
+  });
+
+  test(
+    "is a no-op with exit 0 when no buckets are configured",
+    { timeout: E2E_TIMEOUT_MS },
+    async () => {
+      const { exitCode, stdout } = await runSupabase(["seed", "buckets"], {
+        entrypoint: "legacy",
+        cwd: projectDir,
+      });
+      expect(exitCode).toBe(0);
+      expect(stdout.trim()).toBe("");
+    },
+  );
+
+  test("rejects passing both --local and --linked", { timeout: E2E_TIMEOUT_MS }, async () => {
+    const { exitCode, stdout, stderr } = await runSupabase(
+      ["seed", "buckets", "--local", "--linked"],
+      { entrypoint: "legacy", cwd: projectDir },
+    );
+    expect(exitCode).toBe(1);
+    expect(`${stdout}${stderr}`).toContain(
+      "if any flags in the group [linked local] are set none of the others can be",
+    );
+  });
+});
@@ -0,0 +1,56 @@
+import { Data } from "effect";
+
+/**
+ * Domain errors for `supabase seed buckets`.
+ *
+ * The Storage service-gateway calls fail with one of two shapes, mirroring Go's
+ * `pkg/fetcher`:
+ *   - transport failure (`failed to execute http request`) →
+ *     `LegacySeedStorageNetworkError`
+ *   - non-2xx response (`Error status <d>: <body>`, `pkg/fetcher/http.go:112`) →
+ *     `LegacySeedStorageStatusError`
+ *
+ * `message` reproduces Go's verbatim error text so the vector graceful-skip
+ * classifiers in `buckets.classify.ts` match on the same substrings Go inspects.
+ */
+export class LegacySeedStorageNetworkError extends Data.TaggedError(
+  "LegacySeedStorageNetworkError",
+)<{
+  readonly message: string;
+}> {}
+
+export class LegacySeedStorageStatusError extends Data.TaggedError("LegacySeedStorageStatusError")<{
+  readonly status: number;
+  readonly body: string;
+  readonly message: string;
+}> {}
+
+/**
+ * Raised when `supabase/config.toml` cannot be parsed. Mirrors the `config push`
+ * CLI-1489 tradeoff (`config/push/push.handler.ts:96-114`): `loadProjectConfig`
+ * raises `ProjectConfigParseError` on `env(...)` refs over numeric/bool fields,
+ * which Go resolves transparently.
+ */
+export class LegacySeedConfigLoadError extends Data.TaggedError("LegacySeedConfigLoadError")<{
+  readonly message: string;
+}> {}
+
+/**
+ * Raised when `--local` and `--linked` are both passed, reproducing cobra's
+ * `MarkFlagsMutuallyExclusive("local", "linked")` (`apps/cli-go/cmd/seed.go:32`).
+ */
+export class LegacySeedMutuallyExclusiveFlagsError extends Data.TaggedError(
+  "LegacySeedMutuallyExclusiveFlagsError",
+)<{
+  readonly message: string;
+}> {}
+
+/**
+ * Raised on `--linked` when the project's api-keys response yields no keys,
+ * mirroring Go's `tenant.GetApiKeys` → `errMissingKey` ("Anon key not found.",
+ * `apps/cli-go/internal/utils/tenant/client.go:16,80-82`), which aborts before
+ * the remote Storage client is built. Message matches Go verbatim.
+ */
+export class LegacySeedMissingApiKeyError extends Data.TaggedError("LegacySeedMissingApiKeyError")<{
+  readonly message: string;
+}> {}
@@ -0,0 +1,77 @@
+import { Effect } from "effect";
+
+import {
+  VALUE_CONSUMING_LONG_FLAGS,
+  VALUE_CONSUMING_SHORT_FLAGS,
+} from "../../../shared/legacy-db-target-flags.ts";
+import { LegacySeedMutuallyExclusiveFlagsError } from "./buckets.errors.ts";
+
+/**
+ * Detects which of `--local` / `--linked` were explicitly set on the command
+ * line, reproducing cobra's `pflag.Changed` for `seed`'s
+ * `MarkFlagsMutuallyExclusive("local", "linked")` (`apps/cli-go/cmd/seed.go:32`).
+ *
+ * Effect CLI's parsed flags carry no `Changed` bit, so we re-derive it from raw
+ * argv. Value-consuming flags (`--workdir <path>`, `-o <fmt>`, …) skip their
+ * value token to avoid false positives like `--workdir --linked`.
+ *
+ * Returned in cobra's alphabetically-sorted order `["linked", "local"]` so the
+ * rendered conflict string matches Go exactly.
+ */
+export function legacySeedChangedTargetFlags(args: ReadonlyArray<string>): ReadonlyArray<string> {
+  let linked = false;
+  let local = false;
+  let skipNext = false;
+
+  for (const token of args) {
+    if (skipNext) {
+      skipNext = false;
+      continue;
+    }
+    if (token === "--") break;
+
+    if (token.startsWith("--")) {
+      const eqIdx = token.indexOf("=");
+      const name = eqIdx === -1 ? token.slice(2) : token.slice(2, eqIdx);
+      const isBare = eqIdx === -1;
+      if (name === "linked") {
+        linked = true;
+        continue;
+      }
+      if (name === "local") {
+        local = true;
+        continue;
+      }
+      if (isBare && VALUE_CONSUMING_LONG_FLAGS.has(name)) skipNext = true;
+      continue;
+    }
+
+    if (token.startsWith("-") && token.length >= 2 && token.charAt(1) !== "-") {
+      if (token.length === 2 && VALUE_CONSUMING_SHORT_FLAGS.has(token.charAt(1))) {
+        skipNext = true;
+      }
+    }
+  }
+
+  const setFlags: Array<string> = [];
+  if (linked) setFlags.push("linked");
+  if (local) setFlags.push("local");
+  return setFlags;
+}
+
+/**
+ * Reproduce cobra's `MarkFlagsMutuallyExclusive("local", "linked")`
+ * (`apps/cli-go/cmd/seed.go:32`). Go rejects this at flag validation — before
+ * `RunE`/`PersistentPostRun` — so it must NOT emit `cli_command_executed`; the
+ * command calls this BEFORE `withLegacyCommandInstrumentation`.
+ */
+export const legacyAssertSeedTargetsExclusive = Effect.fnUntraced(function* (
+  args: ReadonlyArray<string>,
+) {
+  const setFlags = legacySeedChangedTargetFlags(args);
+  if (setFlags.length > 1) {
+    return yield* new LegacySeedMutuallyExclusiveFlagsError({
+      message: `if any flags in the group [linked local] are set none of the others can be; [${setFlags.join(" ")}] were all set`,
+    });
+  }
+});