diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 2e4f967307..cb2ebe6d72 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -33,7 +33,7 @@ updates:
         patterns:
           - "*"
   - package-ecosystem: "docker"
-    directory: "pkg/config/templates"
+    directory: "/apps/cli-go/pkg/config/templates"
     schedule:
       interval: "cron"
       cronjob: "0 0 * * *"
diff --git a/.github/workflows/cli-go-mirror-image.yml b/.github/workflows/cli-go-mirror-image.yml
index 92250bd79f..d3e34f2bf3 100644
--- a/.github/workflows/cli-go-mirror-image.yml
+++ b/.github/workflows/cli-go-mirror-image.yml
@@ -15,8 +15,6 @@ on:
         description: "org/image:tag"
         required: true
         type: string
-    paths:
-      - apps/cli-go/**
 
 permissions:
   contents: read
@@ -50,6 +48,3 @@ jobs:
           dst: |
             public.ecr.aws/supabase/${{ steps.strip.outputs.image }}
             ghcr.io/supabase/${{ steps.strip.outputs.image }}
-defaults:
-  run:
-    working-directory: apps/cli-go
diff --git a/apps/cli-e2e/fixtures/recorded/GET_v1_projects___PROJECT_REF___network_restrictions/2.response.json b/apps/cli-e2e/fixtures/recorded/GET_v1_projects___PROJECT_REF___network_restrictions/2.response.json
index dfb40cd92e..4a9ee4c083 100644
--- a/apps/cli-e2e/fixtures/recorded/GET_v1_projects___PROJECT_REF___network_restrictions/2.response.json
+++ b/apps/cli-e2e/fixtures/recorded/GET_v1_projects___PROJECT_REF___network_restrictions/2.response.json
@@ -12,6 +12,7 @@
     "config": {
       "dbAllowedCidrs": ["0.0.0.0/0"],
       "dbAllowedCidrsV6": ["::/0"]
-    }
+    },
+    "status": "applied"
   }
 }
diff --git a/apps/cli-e2e/fixtures/recorded/GET_v1_projects___PROJECT_REF___network_restrictions/4.response.json b/apps/cli-e2e/fixtures/recorded/GET_v1_projects___PROJECT_REF___network_restrictions/4.response.json
index cba240d2d5..88e8640a1c 100644
--- a/apps/cli-e2e/fixtures/recorded/GET_v1_projects___PROJECT_REF___network_restrictions/4.response.json
+++ b/apps/cli-e2e/fixtures/recorded/GET_v1_projects___PROJECT_REF___network_restrictions/4.response.json
@@ -12,6 +12,7 @@
     "config": {
       "dbAllowedCidrs": ["0.0.0.0/0"],
       "dbAllowedCidrsV6": ["::/0"]
-    }
+    },
+    "status": "applied"
   }
 }
diff --git a/apps/cli-e2e/fixtures/recorded/GET_v1_projects___PROJECT_REF___network_restrictions/default.response.json b/apps/cli-e2e/fixtures/recorded/GET_v1_projects___PROJECT_REF___network_restrictions/default.response.json
index 2766a91b1c..0e3cadf24b 100644
--- a/apps/cli-e2e/fixtures/recorded/GET_v1_projects___PROJECT_REF___network_restrictions/default.response.json
+++ b/apps/cli-e2e/fixtures/recorded/GET_v1_projects___PROJECT_REF___network_restrictions/default.response.json
@@ -12,6 +12,7 @@
     "config": {
       "dbAllowedCidrs": ["0.0.0.0/0"],
       "dbAllowedCidrsV6": ["::/0"]
-    }
+    },
+    "status": "applied"
   }
 }
diff --git a/apps/cli-e2e/fixtures/scenarios/branches-get-returns-json-output-with-output-json/interactions.json b/apps/cli-e2e/fixtures/scenarios/branches-get-returns-json-output-with-output-json/interactions.json
index 6a6fa3d0b4..7498935db3 100644
--- a/apps/cli-e2e/fixtures/scenarios/branches-get-returns-json-output-with-output-json/interactions.json
+++ b/apps/cli-e2e/fixtures/scenarios/branches-get-returns-json-output-with-output-json/interactions.json
@@ -125,6 +125,7 @@
       "body": [
         {
           "connection_string": "postgresql://postgres:password@my-branch.supabase.co:5432/postgres",
+          "connectionString": "postgresql://postgres:password@my-branch.supabase.co:5432/postgres",
           "database_type": "PRIMARY",
           "db_host": "my-branch.supabase.co",
           "db_name": "postgres",
diff --git a/apps/cli-e2e/fixtures/scenarios/network-restrictions-get-renders-fixture-data-in-output/interactions.json b/apps/cli-e2e/fixtures/scenarios/network-restrictions-get-renders-fixture-data-in-output/interactions.json
index bb472e2e01..40e570e6a1 100644
--- a/apps/cli-e2e/fixtures/scenarios/network-restrictions-get-renders-fixture-data-in-output/interactions.json
+++ b/apps/cli-e2e/fixtures/scenarios/network-restrictions-get-renders-fixture-data-in-output/interactions.json
@@ -26,7 +26,8 @@
         "config": {
           "dbAllowedCidrs": ["0.0.0.0/0"],
           "dbAllowedCidrsV6": ["::/0"]
-        }
+        },
+        "status": "applied"
       }
     }
   },
diff --git a/apps/cli-e2e/fixtures/scenarios/network-restrictions-get-returns-json-output-with-output-json/interactions.json b/apps/cli-e2e/fixtures/scenarios/network-restrictions-get-returns-json-output-with-output-json/interactions.json
index 11e99a6ef3..58a0472b91 100644
--- a/apps/cli-e2e/fixtures/scenarios/network-restrictions-get-returns-json-output-with-output-json/interactions.json
+++ b/apps/cli-e2e/fixtures/scenarios/network-restrictions-get-returns-json-output-with-output-json/interactions.json
@@ -26,7 +26,8 @@
         "config": {
           "dbAllowedCidrs": ["0.0.0.0/0"],
           "dbAllowedCidrsV6": ["::/0"]
-        }
+        },
+        "status": "applied"
       }
     }
   },
diff --git a/apps/cli-e2e/package.json b/apps/cli-e2e/package.json
index c493f0694d..6a5908fab7 100644
--- a/apps/cli-e2e/package.json
+++ b/apps/cli-e2e/package.json
@@ -66,7 +66,8 @@
       }
     },
     "implicitDependencies": [
-      "cli-go"
+      "cli-go",
+      "supabase"
     ]
   }
 }
diff --git a/apps/cli-go/internal/db/reset/reset.go b/apps/cli-go/internal/db/reset/reset.go
index d86f344975..7d841f4ba3 100644
--- a/apps/cli-go/internal/db/reset/reset.go
+++ b/apps/cli-go/internal/db/reset/reset.go
@@ -146,7 +146,10 @@ func initDatabase(ctx context.Context, options ...func(*pgx.ConnConfig)) error {
 		return err
 	}
 	defer conn.Close(context.Background())
-	return start.InitSchema14(ctx, conn)
+	if err := start.InitSchema14(ctx, conn); err != nil {
+		return err
+	}
+	return start.ApplyApiPrivileges(ctx, conn)
 }
 
 // Recreate postgres database by connecting to template1
diff --git a/apps/cli-go/internal/db/start/start.go b/apps/cli-go/internal/db/start/start.go
index cf9cdc8dfd..6f1eeacde3 100644
--- a/apps/cli-go/internal/db/start/start.go
+++ b/apps/cli-go/internal/db/start/start.go
@@ -384,6 +384,9 @@ func SetupDatabase(ctx context.Context, conn *pgx.Conn, host string, w io.Writer
 	if err := initSchema(ctx, conn, host, w); err != nil {
 		return err
 	}
+	if err := ApplyApiPrivileges(ctx, conn); err != nil {
+		return err
+	}
 	// Create vault secrets first so roles.sql can reference them
 	if err := vault.UpsertVaultSecrets(ctx, utils.Config.Db.Vault, conn); err != nil {
 		return err
@@ -394,3 +397,38 @@ func SetupDatabase(ctx context.Context, conn *pgx.Conn, host string, w io.Writer
 	}
 	return err
 }
+
+// RevokeDefaultDataApiPrivilegesSql matches the SQL that Studio runs at cloud project creation
+// when the "Default privileges for new entities" toggle is off. It removes the default GRANTs
+// applied by the initial schema so newly-created entities in `public` owned by `postgres` are
+// not exposed through the Data API roles until explicit GRANTs are issued.
+const RevokeDefaultDataApiPrivilegesSql = `
+alter default privileges for role postgres in schema public
+  revoke select, insert, update, delete on tables from anon, authenticated, service_role;
+alter default privileges for role postgres in schema public
+  revoke usage, select on sequences from anon, authenticated, service_role;
+alter default privileges for role postgres in schema public
+  revoke execute on functions from anon, authenticated, service_role;
+`
+
+// ApplyApiPrivileges adjusts the default privileges on the `public` schema to match the
+// `[api].auto_expose_new_tables` flag in config.toml. The flag is tri-state to give users a
+// safe migration window:
+//
+//   - unset (default today): keep the bundled initial-schema GRANTs in place, so local matches
+//     long-standing behaviour. This implicit default flips to false on May 30, 2026, and the
+//     flag is removed entirely in October 2026 (always-revoked behaviour).
+//   - true: explicit opt-in to today's behaviour. Treated identically to unset for now; from
+//     May 30 the CLI will warn that the flag is being deprecated.
+//   - false: revoke the default Data API GRANTs so newly-created entities in `public` require
+//     explicit GRANTs to surface through the Data API, matching the new cloud default.
+func ApplyApiPrivileges(ctx context.Context, conn *pgx.Conn) error {
+	if utils.Config.Api.AutoExposeNewTables == nil || *utils.Config.Api.AutoExposeNewTables {
+		return nil
+	}
+	file, err := migration.NewMigrationFromReader(strings.NewReader(RevokeDefaultDataApiPrivilegesSql))
+	if err != nil {
+		return err
+	}
+	return file.ExecBatch(ctx, conn)
+}
diff --git a/apps/cli-go/internal/db/start/start_test.go b/apps/cli-go/internal/db/start/start_test.go
index 39f23d8bad..b4d6411bcd 100644
--- a/apps/cli-go/internal/db/start/start_test.go
+++ b/apps/cli-go/internal/db/start/start_test.go
@@ -259,6 +259,43 @@ func TestSetupDatabase(t *testing.T) {
 		assert.Empty(t, apitest.ListUnmatchedRequests())
 	})
 
+	t.Run("revokes default data api privileges when auto_expose_new_tables is false", func(t *testing.T) {
+		utils.Config.Db.MajorVersion = 14
+		flag := false
+		utils.Config.Api.AutoExposeNewTables = &flag
+		defer func() {
+			utils.Config.Db.MajorVersion = 15
+			utils.Config.Api.AutoExposeNewTables = nil
+		}()
+		utils.Config.Db.Port = 5432
+		utils.GlobalsSql = "create schema public"
+		utils.InitialSchemaPg14Sql = "create schema private"
+		// Setup in-memory fs
+		fsys := afero.NewMemMapFs()
+		roles := "create role postgres"
+		require.NoError(t, afero.WriteFile(fsys, utils.CustomRolesPath, []byte(roles), 0644))
+		// Setup mock postgres: the revoke SQL must execute between the initial schema and roles.sql
+		conn := pgtest.NewConn()
+		defer conn.Close(t)
+		conn.Query(utils.GlobalsSql).
+			Reply("CREATE SCHEMA").
+			Query(utils.InitialSchemaPg14Sql).
+			Reply("CREATE SCHEMA").
+			Query("alter default privileges for role postgres in schema public\n  revoke select, insert, update, delete on tables from anon, authenticated, service_role").
+			Reply("ALTER DEFAULT PRIVILEGES").
+			Query("alter default privileges for role postgres in schema public\n  revoke usage, select on sequences from anon, authenticated, service_role").
+			Reply("ALTER DEFAULT PRIVILEGES").
+			Query("alter default privileges for role postgres in schema public\n  revoke execute on functions from anon, authenticated, service_role").
+			Reply("ALTER DEFAULT PRIVILEGES").
+			Query(roles).
+			Reply("CREATE ROLE")
+		// Run test
+		err := SetupLocalDatabase(context.Background(), "", fsys, io.Discard, conn.Intercept)
+		// Check error
+		assert.NoError(t, err)
+		assert.Empty(t, apitest.ListUnmatchedRequests())
+	})
+
 	t.Run("throws error on connect failure", func(t *testing.T) {
 		utils.Config.Db.Port = 0
 		// Run test
diff --git a/apps/cli-go/internal/seed/buckets/buckets.go b/apps/cli-go/internal/seed/buckets/buckets.go
index afad6a36db..2647032ce7 100644
--- a/apps/cli-go/internal/seed/buckets/buckets.go
+++ b/apps/cli-go/internal/seed/buckets/buckets.go
@@ -11,7 +11,9 @@ import (
 )
 
 func Run(ctx context.Context, projectRef string, interactive bool, fsys afero.Fs) error {
-	if len(projectRef) == 0 && len(utils.Config.Storage.Buckets) == 0 {
+	if len(projectRef) == 0 &&
+		len(utils.Config.Storage.Buckets) == 0 &&
+		!utils.Config.Storage.VectorBuckets.Enabled {
 		return nil
 	}
 	api, err := client.NewStorageAPI(ctx, projectRef)
@@ -47,7 +49,7 @@ func Run(ctx context.Context, projectRef string, interactive bool, fsys afero.Fs
 			return err
 		}
 	}
-	if utils.Config.Storage.VectorBuckets.Enabled && len(projectRef) > 0 {
+	if utils.Config.Storage.VectorBuckets.Enabled {
 		fmt.Fprintln(os.Stderr, "Updating vector buckets...")
 		if err := api.UpsertVectorBuckets(ctx, utils.Config.Storage.VectorBuckets.Buckets, prune); err != nil {
 			return err
diff --git a/apps/cli-go/internal/seed/buckets/buckets_test.go b/apps/cli-go/internal/seed/buckets/buckets_test.go
index 687f904b2a..733a34271a 100644
--- a/apps/cli-go/internal/seed/buckets/buckets_test.go
+++ b/apps/cli-go/internal/seed/buckets/buckets_test.go
@@ -74,4 +74,51 @@ public = false`
 		assert.Len(t, gock.Pending(), 1)
 		assert.Empty(t, apitest.ListUnmatchedRequests())
 	})
+
+	t.Run("seeds vector buckets locally", func(t *testing.T) {
+		t.Cleanup(func() {
+			utils.Config.Storage.VectorBuckets.Enabled = false
+			clear(utils.Config.Storage.VectorBuckets.Buckets)
+			gock.OffAll()
+		})
+		utils.Config.Storage.VectorBuckets.Enabled = true
+		utils.Config.Storage.VectorBuckets.Buckets = map[string]struct{}{
+			"documents-openai": {},
+			"existing-vec":     {},
+		}
+		// Setup mock api: regular buckets list is empty, vector list has one
+		// configured bucket plus one stale bucket that should be left alone
+		// because non-interactive prune defaults to false.
+		gock.New(utils.Config.Api.ExternalUrl).
+			Get("/storage/v1/bucket").
+			Reply(http.StatusOK).
+			JSON([]storage.BucketResponse{})
+		gock.New(utils.Config.Api.ExternalUrl).
+			Post("/storage/v1/vector/ListVectorBuckets").
+			Reply(http.StatusOK).
+			JSON(storage.ListVectorBucketsResponse{
+				VectorBuckets: []storage.VectorBucket{
+					{VectorBucketName: "existing-vec"},
+					{VectorBucketName: "stale-vec"},
+				},
+			})
+		gock.New(utils.Config.Api.ExternalUrl).
+			Post("/storage/v1/vector/CreateVectorBucket").
+			Reply(http.StatusOK).
+			JSON(map[string]string{})
+		gock.New(utils.Config.Api.ExternalUrl).
+			Post("/storage/v1/vector/DeleteVectorBucket").
+			Reply(http.StatusOK).
+			JSON(map[string]string{})
+		// Run test
+		err := Run(context.Background(), "", false, afero.NewMemMapFs())
+		// Check error
+		assert.NoError(t, err)
+		assert.Empty(t, apitest.ListUnmatchedRequests())
+		// The DeleteVectorBucket mock should remain pending because non-interactive
+		// prune returns the default (false) and skips the delete.
+		pending := gock.Pending()
+		require.Len(t, pending, 1)
+		assert.Contains(t, pending[0].Request().URLStruct.Path, "DeleteVectorBucket")
+	})
 }
diff --git a/apps/cli-go/internal/start/start.go b/apps/cli-go/internal/start/start.go
index fb9c886372..88ab8e7ed3 100644
--- a/apps/cli-go/internal/start/start.go
+++ b/apps/cli-go/internal/start/start.go
@@ -251,6 +251,7 @@ func run(ctx context.Context, fsys afero.Fs, excludedContainers []string, dbConf
 	isImgProxyEnabled := utils.Config.Storage.ImageTransformation != nil &&
 		utils.Config.Storage.ImageTransformation.Enabled && !isContainerExcluded(utils.Config.Storage.ImgProxyImage, excluded)
 	isS3ProtocolEnabled := utils.Config.Storage.S3Protocol != nil && utils.Config.Storage.S3Protocol.Enabled
+	isVectorBucketsEnabled := utils.Config.Storage.VectorBuckets.Enabled
 	fmt.Fprintln(os.Stderr, "Starting containers...")
 
 	workdir, err := os.Getwd()
@@ -938,35 +939,39 @@ EOF
 	// Start Storage.
 	if isStorageEnabled {
 		dockerStoragePath := "/mnt"
+		storageEnv := []string{
+			"DB_MIGRATIONS_FREEZE_AT=" + utils.Config.Storage.TargetMigration,
+			"ANON_KEY=" + utils.Config.Auth.AnonKey.Value,
+			"SERVICE_KEY=" + utils.Config.Auth.ServiceRoleKey.Value,
+			"AUTH_JWT_SECRET=" + utils.Config.Auth.JwtSecret.Value,
+			fmt.Sprintf("JWT_JWKS=%s", jwks),
+			fmt.Sprintf("DATABASE_URL=postgresql://supabase_storage_admin:%s@%s:%d/%s", dbConfig.Password, dbConfig.Host, dbConfig.Port, dbConfig.Database),
+			fmt.Sprintf("FILE_SIZE_LIMIT=%v", utils.Config.Storage.FileSizeLimit),
+			"STORAGE_BACKEND=file",
+			"FILE_STORAGE_BACKEND_PATH=" + dockerStoragePath,
+			"TENANT_ID=stub",
+			// TODO: https://github.com/supabase/storage-api/issues/55
+			"STORAGE_S3_REGION=" + utils.Config.Storage.S3Credentials.Region,
+			"GLOBAL_S3_BUCKET=stub",
+			fmt.Sprintf("ENABLE_IMAGE_TRANSFORMATION=%t", isImgProxyEnabled),
+			fmt.Sprintf("IMGPROXY_URL=http://%s:5001", utils.ImgProxyId),
+			"TUS_URL_PATH=/storage/v1/upload/resumable",
+			fmt.Sprintf("S3_PROTOCOL_ENABLED=%t", isS3ProtocolEnabled),
+			"S3_PROTOCOL_ACCESS_KEY_ID=" + utils.Config.Storage.S3Credentials.AccessKeyId,
+			"S3_PROTOCOL_ACCESS_KEY_SECRET=" + utils.Config.Storage.S3Credentials.SecretAccessKey,
+			"S3_PROTOCOL_PREFIX=/storage/v1",
+			"UPLOAD_FILE_SIZE_LIMIT=52428800000",
+			"UPLOAD_FILE_SIZE_LIMIT_STANDARD=5242880000",
+			"SIGNED_UPLOAD_URL_EXPIRATION_TIME=7200",
+		}
+		if isVectorBucketsEnabled {
+			storageEnv = appendStorageVectorEnv(storageEnv, dbConfig)
+		}
 		if _, err := utils.DockerStart(
 			ctx,
 			container.Config{
 				Image: utils.Config.Storage.Image,
-				Env: []string{
-					"DB_MIGRATIONS_FREEZE_AT=" + utils.Config.Storage.TargetMigration,
-					"ANON_KEY=" + utils.Config.Auth.AnonKey.Value,
-					"SERVICE_KEY=" + utils.Config.Auth.ServiceRoleKey.Value,
-					"AUTH_JWT_SECRET=" + utils.Config.Auth.JwtSecret.Value,
-					fmt.Sprintf("JWT_JWKS=%s", jwks),
-					fmt.Sprintf("DATABASE_URL=postgresql://supabase_storage_admin:%s@%s:%d/%s", dbConfig.Password, dbConfig.Host, dbConfig.Port, dbConfig.Database),
-					fmt.Sprintf("FILE_SIZE_LIMIT=%v", utils.Config.Storage.FileSizeLimit),
-					"STORAGE_BACKEND=file",
-					"FILE_STORAGE_BACKEND_PATH=" + dockerStoragePath,
-					"TENANT_ID=stub",
-					// TODO: https://github.com/supabase/storage-api/issues/55
-					"STORAGE_S3_REGION=" + utils.Config.Storage.S3Credentials.Region,
-					"GLOBAL_S3_BUCKET=stub",
-					fmt.Sprintf("ENABLE_IMAGE_TRANSFORMATION=%t", isImgProxyEnabled),
-					fmt.Sprintf("IMGPROXY_URL=http://%s:5001", utils.ImgProxyId),
-					"TUS_URL_PATH=/storage/v1/upload/resumable",
-					fmt.Sprintf("S3_PROTOCOL_ENABLED=%t", isS3ProtocolEnabled),
-					"S3_PROTOCOL_ACCESS_KEY_ID=" + utils.Config.Storage.S3Credentials.AccessKeyId,
-					"S3_PROTOCOL_ACCESS_KEY_SECRET=" + utils.Config.Storage.S3Credentials.SecretAccessKey,
-					"S3_PROTOCOL_PREFIX=/storage/v1",
-					"UPLOAD_FILE_SIZE_LIMIT=52428800000",
-					"UPLOAD_FILE_SIZE_LIMIT_STANDARD=5242880000",
-					"SIGNED_UPLOAD_URL_EXPIRATION_TIME=7200",
-				},
+				Env:   storageEnv,
 				Healthcheck: &container.HealthConfig{
 					// For some reason, localhost resolves to IPv6 address on GitPod which breaks healthcheck.
 					Test: []string{
@@ -1371,6 +1376,42 @@ func appendGotrueExternalProviderEnv(env []string) []string {
 	return env
 }
 
+// appendStorageVectorEnv wires the storage container with the vector-bucket
+// env contract from supabase/storage#1094. The CLI provides three CLI-owned
+// defaults that the operator can override from their shell environment:
+//
+//   - VECTOR_BUCKET_PROVIDER selects the local provider; pgvector is the only
+//     locally-available implementation.
+//   - VECTOR_STORE_MIGRATIONS_ENABLED tells storage to run its vector-store
+//     migrations on boot. Defaults on so a fresh stack is usable, but operators
+//     who run those migrations out of band can disable it.
+//   - VECTOR_DATABASE_URL hands storage a connection string with createdb
+//     permission so it can manage its own vectors database. We default to the
+//     postgres superuser on the local stack, mirroring the existing DATABASE_URL
+//     credentials, but operators are expected to override this to reach an
+//     external postgres in self-hosted setups.
+func appendStorageVectorEnv(env []string, dbConfig pgconn.Config) []string {
+	envOrDefault := func(key, def string) string {
+		if v, ok := os.LookupEnv(key); ok {
+			return key + "=" + v
+		}
+		return key + "=" + def
+	}
+	defaultVectorURL := fmt.Sprintf(
+		"postgresql://postgres:%s@%s:%d/%s",
+		dbConfig.Password,
+		dbConfig.Host,
+		dbConfig.Port,
+		dbConfig.Database,
+	)
+	return append(env,
+		envOrDefault("VECTOR_ENABLED", "true"),
+		envOrDefault("VECTOR_BUCKET_PROVIDER", "pgvector"),
+		envOrDefault("VECTOR_STORE_MIGRATIONS_ENABLED", "true"),
+		envOrDefault("VECTOR_DATABASE_URL", defaultVectorURL),
+	)
+}
+
 func printSecurityNotice() {
 	fmt.Fprintln(os.Stderr, utils.Yellow("Local dev security notice"))
 	fmt.Fprintln(os.Stderr, "All services bind to 0.0.0.0 (network-accessible, not just localhost)")
diff --git a/apps/cli-go/internal/telemetry/service.go b/apps/cli-go/internal/telemetry/service.go
index 39e0b6c073..26869ad5a8 100644
--- a/apps/cli-go/internal/telemetry/service.go
+++ b/apps/cli-go/internal/telemetry/service.go
@@ -154,7 +154,11 @@ func (s *Service) ClearDistinctID() error {
 }
 
 func (s *Service) NeedsIdentityStitch() bool {
-	return s != nil && s.state.DistinctID == "" && s.canSend()
+	return s != nil && s.state.DistinctID == "" && s.canSend() && !s.isEphemeralIdentityRuntime()
+}
+
+func (s *Service) isEphemeralIdentityRuntime() bool {
+	return s.isCI || (s.isFirstRun && !s.isTTY)
 }
 
 func (s *Service) GroupIdentify(groupType string, groupKey string, properties map[string]any) error {
diff --git a/apps/cli-go/internal/telemetry/service_test.go b/apps/cli-go/internal/telemetry/service_test.go
index c46a793bed..5a19198c83 100644
--- a/apps/cli-go/internal/telemetry/service_test.go
+++ b/apps/cli-go/internal/telemetry/service_test.go
@@ -222,6 +222,7 @@ func TestServiceNeedsIdentityStitch(t *testing.T) {
 	service, err := NewService(fsys, Options{
 		Analytics: analytics,
 		Now:       func() time.Time { return now },
+		IsTTY:     true,
 	})
 	require.NoError(t, err)
 
@@ -233,6 +234,45 @@ func TestServiceNeedsIdentityStitch(t *testing.T) {
 		require.NoError(t, service.StitchLogin("user-123"))
 		assert.False(t, service.NeedsIdentityStitch())
 	})
+
+	t.Run("false in CI even with empty DistinctID", func(t *testing.T) {
+		ciFsys := afero.NewMemMapFs()
+		ciService, err := NewService(ciFsys, Options{
+			Analytics: &fakeAnalytics{enabled: true},
+			Now:       func() time.Time { return now },
+			IsCI:      true,
+		})
+		require.NoError(t, err)
+		assert.False(t, ciService.NeedsIdentityStitch())
+	})
+
+	t.Run("false in first-run non-TTY runtime", func(t *testing.T) {
+		ephemeralFsys := afero.NewMemMapFs()
+		ephemeralService, err := NewService(ephemeralFsys, Options{
+			Analytics: &fakeAnalytics{enabled: true},
+			Now:       func() time.Time { return now },
+		})
+		require.NoError(t, err)
+		assert.False(t, ephemeralService.NeedsIdentityStitch())
+	})
+
+	t.Run("true in persisted non-TTY runtime", func(t *testing.T) {
+		persistedFsys := afero.NewMemMapFs()
+		require.NoError(t, SaveState(State{
+			Enabled:           true,
+			DeviceID:          uuid.NewString(),
+			SessionID:         uuid.NewString(),
+			SessionLastActive: now,
+			SchemaVersion:     SchemaVersion,
+		}, persistedFsys))
+
+		persistedService, err := NewService(persistedFsys, Options{
+			Analytics: &fakeAnalytics{enabled: true},
+			Now:       func() time.Time { return now },
+		})
+		require.NoError(t, err)
+		assert.True(t, persistedService.NeedsIdentityStitch())
+	})
 }
 
 func TestServiceCaptureHonorsConsentAndEnvOptOut(t *testing.T) {
diff --git a/apps/cli-go/pkg/config/api.go b/apps/cli-go/pkg/config/api.go
index 3fd3b6f187..2fdcabe103 100644
--- a/apps/cli-go/pkg/config/api.go
+++ b/apps/cli-go/pkg/config/api.go
@@ -14,6 +14,15 @@ type (
 		Schemas         []string `toml:"schemas" json:"schemas"`
 		ExtraSearchPath []string `toml:"extra_search_path" json:"extra_search_path"`
 		MaxRows         uint     `toml:"max_rows" json:"max_rows"`
+		// When unset (default today), new tables, views, sequences and functions created in
+		// the `public` schema by `postgres` are automatically reachable through the Data API
+		// roles `anon`, `authenticated`, and `service_role`, matching long-standing local
+		// behaviour. Set to false to match the new cloud default and require explicit GRANTs
+		// to expose entities through the Data API; set to true to opt out of the upcoming
+		// transition once the platform default flips. Stored as a pointer so the migration
+		// path (unset -> default true today, default false from May 30, removed in October)
+		// can flip the implicit value without losing the explicit user choice.
+		AutoExposeNewTables *bool `toml:"auto_expose_new_tables,omitempty" json:"auto_expose_new_tables,omitempty"`
 		// Local only config
 		Image     string  `toml:"-" json:"-"`
 		KongImage string  `toml:"-" json:"-"`
diff --git a/apps/cli-go/pkg/config/api_test.go b/apps/cli-go/pkg/config/api_test.go
index 92859c671c..ff5bb4a104 100644
--- a/apps/cli-go/pkg/config/api_test.go
+++ b/apps/cli-go/pkg/config/api_test.go
@@ -134,3 +134,10 @@ func TestApiDiff(t *testing.T) {
 		assertSnapshotEqual(t, diff)
 	})
 }
+
+func TestApiAutoExposeNewTablesDefault(t *testing.T) {
+	t.Run("is unset on a fresh config so today's implicit-true behaviour applies", func(t *testing.T) {
+		cfg := NewConfig()
+		assert.Nil(t, cfg.Api.AutoExposeNewTables)
+	})
+}
diff --git a/apps/cli-go/pkg/config/templates/Dockerfile b/apps/cli-go/pkg/config/templates/Dockerfile
index 99efdf2cf8..fa434fad4a 100644
--- a/apps/cli-go/pkg/config/templates/Dockerfile
+++ b/apps/cli-go/pkg/config/templates/Dockerfile
@@ -1,19 +1,19 @@
 # Exposed for updates by .github/dependabot.yml
-FROM supabase/postgres:17.6.1.106 AS pg
+FROM supabase/postgres:17.6.1.131 AS pg
 # Append to ServiceImages when adding new dependencies below
 FROM library/kong:2.8.1 AS kong
 FROM axllent/mailpit:v1.22.3 AS mailpit
-FROM postgrest/postgrest:v14.10 AS postgrest
-FROM supabase/postgres-meta:v0.96.4 AS pgmeta
-FROM supabase/studio:2026.04.28-sha-89d08a2 AS studio
+FROM postgrest/postgrest:v14.12 AS postgrest
+FROM supabase/postgres-meta:v0.96.6 AS pgmeta
+FROM supabase/studio:2026.05.25-sha-65c570e AS studio
 FROM darthsim/imgproxy:v3.8.0 AS imgproxy
-FROM supabase/edge-runtime:v1.73.13 AS edgeruntime
+FROM supabase/edge-runtime:v1.74.0 AS edgeruntime
 FROM timberio/vector:0.53.0-alpine AS vector
-FROM supabase/supavisor:2.7.4 AS supavisor
-FROM supabase/gotrue:v2.188.1 AS gotrue
-FROM supabase/realtime:v2.86.3 AS realtime
-FROM supabase/storage-api:v1.54.1 AS storage
-FROM supabase/logflare:1.39.1 AS logflare
+FROM supabase/supavisor:2.9.5 AS supavisor
+FROM supabase/gotrue:v2.189.0 AS gotrue
+FROM supabase/realtime:v2.100.0 AS realtime
+FROM supabase/storage-api:v1.60.0 AS storage
+FROM supabase/logflare:1.42.0 AS logflare
 # Append to JobImages when adding new dependencies below
 FROM supabase/pgadmin-schema-diff:cli-0.0.5 AS differ
 FROM supabase/migra:3.0.1663481299 AS migra
diff --git a/apps/cli-go/pkg/config/templates/config.toml b/apps/cli-go/pkg/config/templates/config.toml
index d34c36c9ba..c172cc4f4e 100644
--- a/apps/cli-go/pkg/config/templates/config.toml
+++ b/apps/cli-go/pkg/config/templates/config.toml
@@ -16,6 +16,12 @@ extra_search_path = ["public", "extensions"]
 # The maximum number of rows returns from a view, table, or stored procedure. Limits payload size
 # for accidental or malicious requests.
 max_rows = 1000
+# Controls whether new tables, views, sequences and functions created in the `public` schema by
+# `postgres` are reachable through the Data API roles (`anon`, `authenticated`, `service_role`)
+# without explicit GRANTs. Leave unset today to preserve local behaviour. The implicit default
+# flips to `false` on 2026-05-30 to match the new cloud default, and the field is removed in
+# 2026-10-30 once the always-revoked behaviour is permanent. Set to `false` to opt in early.
+# auto_expose_new_tables = false
 
 [api.tls]
 # Enable HTTPS endpoints locally using a self-signed certificate.
@@ -138,7 +144,6 @@ max_catalogs = 2
 # [storage.analytics.buckets.my-warehouse]
 
 # Store vector embeddings in S3 for large and durable datasets
-# This feature is only available on the hosted platform.
 [storage.vector]
 enabled = false
 max_buckets = 10
diff --git a/apps/cli/AGENTS.md b/apps/cli/AGENTS.md
index e59fed8f5c..dc2d2382b6 100644
--- a/apps/cli/AGENTS.md
+++ b/apps/cli/AGENTS.md
@@ -88,6 +88,17 @@ Always check `src/shared/` before writing new infrastructure. Do not duplicate w
 | `shared/runtime/`                      | `Browser`, `Stdin`, `Tty`, `ProcessControl`, `RuntimeInfo` services + layers    |
 | `shared/telemetry/`                    | `withCommandInstrumentation`, `Analytics`, tracing                              |
 
+Also check the following `legacy/` infrastructure before writing equivalent helpers from scratch:
+
+| Path                                                    | What it provides                                                                                                                                                                            |
+| ------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `legacy/config/legacy-cli-config.layer.ts`              | `LegacyCliConfig` — resolves `SUPABASE_PROFILE` (built-in name **or** YAML file path), `--workdir`, `--experimental`, project-id from `supabase/config.toml`                                |
+| `legacy/config/legacy-project-ref.layer.ts`             | `LegacyProjectRefResolver` — `--project-ref` flag → env → linked-project.json → config fallback chain; matches Go's resolver order                                                          |
+| `legacy/telemetry/legacy-telemetry-state.layer.ts`      | `LegacyTelemetryState.flush` — writes `~/.supabase/telemetry.json`, runs in every command's `Effect.ensuring`                                                                               |
+| `legacy/telemetry/legacy-linked-project-cache.layer.ts` | `LegacyLinkedProjectCache.cache(ref)` — writes `~/.supabase/<workdir-hash>/linked-project.json` after `--project-ref` resolves; bypasses generated schema validation (uses raw HTTP client) |
+| `legacy/auth/legacy-http-debug.layer.ts`                | `legacyHttpClientLayer` — wraps the HTTP transport with a `--debug` stderr logger in Go's `log.LstdFlags` format                                                                            |
+| `legacy/output/legacy-glamour-table.ts`                 | `renderGlamourTable(headers, rows)` — byte-exact ASCII match for Go's `glamour.RenderTable(..., AsciiStyle)`                                                                                |
+
 ---
 
 ## Phase 0: Go Binary Wrapper
@@ -139,6 +150,21 @@ src/legacy/commands/<command>/
   SIDE_EFFECTS.md        # Required for every legacy command — see section below
 ```
 
+When a command grows beyond a single handler file, follow the optional helper-file shape that emerged from the backups port:
+
+```
+src/legacy/commands/<command>/
+  <command>.command.ts        # Effect CLI Command + flag wiring + layer provide
+  <command>.handler.ts        # native Effect handler
+  <command>.errors.ts         # Data.TaggedError types
+  <command>.layers.ts         # runtime layer composition for the command family
+  <command>.format.ts         # text formatters (timestamps, regions, booleans)
+  <command>.encoders.ts       # Go-compatible JSON / YAML / TOML / env encoders
+  SIDE_EFFECTS.md
+```
+
+The `.format.ts` and `.encoders.ts` files should be pure functions with no Effect or service dependencies — that keeps them unit-testable and makes Go-parity rules explicit (e.g. JSON key sort order, env-var SCREAMING_SNAKE_CASE flattening, empty arrays coerced to null).
+
 Commands with subcommands use nested directories:
 
 ```
@@ -192,6 +218,27 @@ Many Management API commands in `next/commands/` have already been implemented.
 
 ---
 
+## Legacy Port: Hoist Before You Duplicate
+
+Before writing handler code for a new port, scan the already-ported commands for overlapping logic. If two commands need the same helper (HTTP-error mapping, output encoder, formatter, runtime layer composition), hoist it instead of inlining a copy.
+
+Decision rule:
+
+- **Used by one command only** → keep it in the command's own directory (e.g. `backups/backups.errors.ts`).
+- **Used by ≥2 commands in the same command family** → keep it in the family root (e.g. `backups/backups.encoders.ts` is shared by `list` and `restore`).
+- **Used by ≥2 commands across families** → hoist to `src/legacy/shared/` (create the directory if it doesn't exist) and refactor the existing call sites in the same change. Do not leave the older command using its inlined copy while the new command uses the hoisted version.
+
+Concrete examples worth watching for as more commands land:
+
+- HTTP-error → tagged-error mapping (`backups.errors.ts:mapLegacyBackupHttpError`) — almost every Management API command will need this shape.
+- Go-compatible JSON / YAML / TOML / env encoders (`backups.encoders.ts`) — the flag `--output {json,yaml,toml,env}` is supported by many Go subcommands.
+- Glamour-table rendering helpers and column padding — currently in `legacy/output/legacy-glamour-table.ts`, already correctly hoisted.
+- Timestamp / region / boolean formatters (`backups.format.ts`) — likely shared the moment a second command renders a backup/project/region field.
+
+This rule is consistent with the repo-wide **Refactoring Policy** ("delete obsolete helpers, shims, and parallel code paths as part of the refactor") — it just makes the policy concrete for the legacy-port workflow.
+
+---
+
 ## Legacy Port: Go CLI Output Parity
 
 The legacy shell is a **strict 1:1 port** — not a redesign. The compatibility contract covers:
@@ -206,6 +253,50 @@ When in doubt about expected output or behavior, run the equivalent command agai
 
 ---
 
+## Legacy Port: Go Parity Checklist
+
+When porting a Management-API-style command, verify each item before marking the command as `ported`:
+
+1. **Telemetry + linked-project writes run on every invocation** — Go uses `PersistentPostRun` (see `apps/cli-go/cmd/root.go:176`). Wrap the handler body in `.pipe(Effect.ensuring(linkedProjectCache.cache(ref)), Effect.ensuring(telemetryState.flush))` so both files are written on success **and** failure. See `backups/list/list.handler.ts:74-114` as the canonical pattern.
+
+2. **Errors go to stderr in text mode, byte-matching Go's template** — `Output.fail` now writes a frame-free message to stderr followed by the "Try rerunning the command with --debug to get more details." suggestion when `--debug` is unset. Don't reintroduce clack's `■ … │` frame. Reference: commits `ee041834`, `cf4f574b`.
+
+3. **`--debug` logs every HTTP request on stderr** — Format `"HTTP YYYY/MM/DD HH:MM:SS <METHOD>: <URL>\n"` (Go's `log.LstdFlags|log.Lmsgprefix`). Provided automatically by `legacyHttpClientLayer`; ensure that layer (not the raw `HttpClient.layer`) is what every legacy command's runtime composes. Reference: commit `39cfec20`.
+
+4. **`SUPABASE_PROFILE` is dual-mode** — accept either a built-in name (`supabase`, `supabase-staging`, `supabase-local`) **or** a filesystem path to a YAML file with `api_url:` / `gotrue_url:` / `db_url:` keys. cli-e2e harness relies on the file-path mode. Reference: commit `288c2937`.
+
+5. **`Layer.provide` does not share to siblings inside `Layer.mergeAll`** — if two sibling layers each require `LegacyCliConfig`, provide it to both explicitly. Smoke-test the bundled binary (`bun run build && ./dist/supabase-legacy …`) when changing production layer wiring; in-process tests don't always catch the missing-service panic. Reference: commit `a816b12e`, `backups.layers.ts:32-46`.
+
+6. **Both `--output` (Go) and `--output-format` (TS) must be honored** — Go's `--output` (`pretty|json|yaml|toml|env`) takes priority when set. Pattern in `backups/list/list.handler.ts:85-113`: branch on `goOutputFlag` first, then fall through to TS `--output-format` text/json/stream-json.
+
+7. **PostHog telemetry payload matches Go 1:1** — see the next section.
+
+---
+
+## Legacy Port: Telemetry Parity
+
+The legacy shell sends the same PostHog events to the same product analytics pipeline as the Go CLI. Drift is silent (no test will catch it) and breaks dashboards. The rules:
+
+- **The canonical catalog is `shared/telemetry/event-catalog.ts`** — a 1:1 mirror of `apps/cli-go/internal/telemetry/events.go`. Reference its exported constants (`EventCommandExecuted`, `PropFlags`, `EnvSignalPresenceKeys`, …) instead of writing bare strings. When the Go catalog changes, update the TS catalog in the same PR.
+- **Native legacy commands wrap with `withLegacyCommandInstrumentation`** (from `legacy/telemetry/legacy-command-instrumentation.ts`) — _not_ the shared `withCommandInstrumentation`. The legacy variant emits Go-shape properties: a single `flags` map (vs `flags_used`/`flag_values`), `is_agent: boolean` (vs `ai_tool: string`), and `env_signals`.
+- **Pass `flags` to the wrapper** so boolean flag values can be detected and logged verbatim: `handler(flags).pipe(withLegacyCommandInstrumentation({ flags }), ...)`. Sensitive values become the literal string `"<redacted>"` to match Go.
+- **Use `safeFlags: ["flag-name"]`** to whitelist flags that Go marks with `markFlagTelemetrySafe` (grep `apps/cli-go/cmd/*.go`). Today these are `--project-ref` (sso, branches, link, functions, projects/api-keys), `--project-id` (gen/types), `--org-id` (projects/create), and `--version` (migration/squash).
+- **Proxy handlers (`LegacyGoProxy.exec`) must NOT wrap with any instrumentation.** The Go subprocess fires its own telemetry; a TS wrapper would double-count `cli_command_executed`.
+- **When promoting a command from proxy to native, reproduce every `phtelemetry.*` call in the Go counterpart.** Grep `apps/cli-go/internal/<command>/` for `service.Capture`, `service.Alias`, `service.Identify`, `service.GroupIdentify`, and `TrackUpgradeSuggested`. The current Go custom events that legacy ports must reproduce when natively ported:
+
+  | Command                                                       | Event                   | Identity / groups                                                                                                  | Go source                                     |
+  | ------------------------------------------------------------- | ----------------------- | ------------------------------------------------------------------------------------------------------------------ | --------------------------------------------- |
+  | `login`                                                       | `cli_login_completed`   | `analytics.alias(gotrueId, deviceId)` + `analytics.identify(gotrueId)` after token persists                        | `internal/login/login.go:283-296`             |
+  | `link`                                                        | `cli_project_linked`    | `analytics.groupIdentify("organization", slug, …)` + `analytics.groupIdentify("project", ref, …)` after link write | `internal/link/link.go:60`                    |
+  | `start`                                                       | `cli_stack_started`     | none — fired after stack health check passes                                                                       | `internal/start/start.go:1245`                |
+  | `sso/{list,create,update,remove}`, `branches/{create,update}` | `cli_upgrade_suggested` | none — payload is `{feature_key, org_slug}`, fired inside billing-gate error branch                                | 7 call-sites under `internal/{sso,branches}/` |
+
+  Reference pattern for login: `next/commands/login/login.handler.ts:38-62`.
+
+- **Tracing layer is local-only observability**, not PostHog. Span names (`legacy.<command>.<sub>`) and the NDJSON exporter never leave the user's machine. No parity implication.
+
+---
+
 ## Legacy Port: File Location Compatibility
 
 The legacy shell bridges two worlds: it must behave exactly like the Go CLI for existing users, and it must lay the groundwork for a seamless upgrade to the next shell.
@@ -311,6 +402,7 @@ Read https://www.effect.solutions/testing for Effect testing patterns. Note that
 - If a test needs multiple service replacements or `Layer.mergeAll(...)`, it likely belongs in `*.integration.test.ts`.
 - Prefer assertions on outputs and accumulated state over spy-heavy interaction tests.
 - Keep `*.e2e.test.ts` focused on golden paths, CLI surface behavior, and subprocess correctness, not branch-by-branch coverage.
+- **Forbidden pattern (do not add):** spawning the CLI to assert that `--help` renders a flag. Help text is dynamic over flag wiring and is exercised by the integration test's flag parser. The two backups e2e files removed alongside this guidance update are the canonical example of what not to write.
 
 ---
 
diff --git a/apps/cli/docs/go-cli-porting-status.md b/apps/cli/docs/go-cli-porting-status.md
index ed5588abff..1a29409300 100644
--- a/apps/cli/docs/go-cli-porting-status.md
+++ b/apps/cli/docs/go-cli-porting-status.md
@@ -10,7 +10,7 @@ Reference:
 ## Legend
 
 - `ported`: TS command exists and the flag/parameter surface is materially aligned with the old Go CLI
-- `partial`: TS feature exists but differs materially from the old Go CLI shape, flag surface, or invocation style. This includes feature parity delivered through framework-built global flags such as `--help` and `--completions` instead of matching Go subcommands exactly.
+- `partial`: TS feature exists but differs materially from the old Go CLI shape, flag surface, or invocation style. This includes feature parity delivered through framework-built global flags such as `--help` instead of matching Go subcommands exactly.
 - `missing`: no TS command/subcommand exists yet
 
 Percentages and counts below are based on final leaf commands only. Command groups like `db`, `functions`, and `completion` are not counted as commands.
@@ -19,29 +19,29 @@ Percentages and counts below are based on final leaf commands only. Command grou
 
 | Metric                    |   Count | Percent |
 | ------------------------- | ------: | ------: |
-| Fully ported commands     |  2 / 94 |    2.1% |
-| Partially ported commands | 59 / 94 |   62.8% |
+| Fully ported commands     |  6 / 94 |    6.4% |
+| Partially ported commands | 55 / 94 |   58.5% |
 
 ## Family Summary
 
-| Family                    | Final commands |  `ported` |  `partial` | `missing` | Represented in TS |
-| ------------------------- | -------------: | --------: | ---------: | --------: | ----------------: |
-| Quick Start               |              1 |    0 (0%) |     0 (0%) |  1 (100%) |            0 (0%) |
-| Project / Stack Lifecycle |              9 | 2 (22.2%) |  7 (77.8%) |    0 (0%) |          9 (100%) |
-| Database                  |             19 |    0 (0%) |     0 (0%) | 19 (100%) |            0 (0%) |
-| Code Generation           |              3 |    0 (0%) |     0 (0%) |  3 (100%) |            0 (0%) |
-| Functions                 |              6 |    0 (0%) |     0 (0%) |  6 (100%) |            0 (0%) |
-| Storage                   |              4 |    0 (0%) |     0 (0%) |  4 (100%) |            0 (0%) |
-| Management APIs           |             47 |    0 (0%) |  47 (100%) |    0 (0%) |         47 (100%) |
-| Additional Commands       |              5 |    0 (0%) | 5 (100.0%) |    0 (0%) |        5 (100.0%) |
+| Family                    | Final commands |  `ported` | `partial` | `missing` | Represented in TS |
+| ------------------------- | -------------: | --------: | --------: | --------: | ----------------: |
+| Quick Start               |              1 |    0 (0%) |    0 (0%) |  1 (100%) |            0 (0%) |
+| Project / Stack Lifecycle |              9 | 2 (22.2%) | 7 (77.8%) |    0 (0%) |          9 (100%) |
+| Database                  |             19 |    0 (0%) |    0 (0%) | 19 (100%) |            0 (0%) |
+| Code Generation           |              3 |    0 (0%) |    0 (0%) |  3 (100%) |            0 (0%) |
+| Functions                 |              6 |    0 (0%) |    0 (0%) |  6 (100%) |            0 (0%) |
+| Storage                   |              4 |    0 (0%) |    0 (0%) |  4 (100%) |            0 (0%) |
+| Management APIs           |             47 |    0 (0%) | 47 (100%) |    0 (0%) |         47 (100%) |
+| Additional Commands       |              5 |   4 (80%) |   1 (20%) |    0 (0%) |        5 (100.0%) |
 
 ## Global Flags Overview
 
 This tracker is command-focused, but root global flag drift is large enough to note separately.
 
-| Surface                 | TS path                                                                  | Missing old flags/params                                                                                                        | Extra TS flags/params | Notes                                                                                                                                                                                                                                        |
-| ----------------------- | ------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------- | --------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `supabase` global flags | [`../src/shared/cli/global-flags.ts`](../src/shared/cli/global-flags.ts) | `--create-ticket`, `--debug`, `--dns-resolver`, `--experimental`, `--network-id`, `--output`, `--profile`, `--workdir`, `--yes` | `--output-format`     | Root flag parity is still far from the Go CLI, but the framework already provides global `--help` and `--completions`, so help and shell completion have feature parity even though they no longer live under explicit Go-style subcommands. |
+| Surface                 | TS path                                                                  | Missing old flags/params                                                                                                        | Extra TS flags/params | Notes                                                                                                                                                                                                                                                       |
+| ----------------------- | ------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------- | --------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `supabase` global flags | [`../src/shared/cli/global-flags.ts`](../src/shared/cli/global-flags.ts) | `--create-ticket`, `--debug`, `--dns-resolver`, `--experimental`, `--network-id`, `--output`, `--profile`, `--workdir`, `--yes` | `--output-format`     | Root flag parity is still far from the Go CLI, but the framework already provides global `--help`, and `supabase completion <shell>` is restored as a Go-style subcommand. The framework's `--completions` global flag remains available for `next/` users. |
 
 ## TS-only Commands
 
@@ -193,122 +193,123 @@ These route-first equivalents are intentionally lower-level than the old Go comm
 
 ## Additional Commands
 
-| Old command             | TS status | TS command path or `missing`        | Missing flags/params                              | Extra TS flags/params | Notes                                                                                                                |
-| ----------------------- | --------- | ----------------------------------- | ------------------------------------------------- | --------------------- | -------------------------------------------------------------------------------------------------------------------- |
-| `completion bash`       | `partial` | `supabase --completions bash`       | Go-style `completion bash` subcommand shape       | `-`                   | Feature parity exists via the framework-provided global `--completions` flag instead of a dedicated subcommand tree. |
-| `completion fish`       | `partial` | `supabase --completions fish`       | Go-style `completion fish` subcommand shape       | `-`                   | Feature parity exists via the framework-provided global `--completions` flag instead of a dedicated subcommand tree. |
-| `completion powershell` | `partial` | `supabase --completions powershell` | Go-style `completion powershell` subcommand shape | `-`                   | Feature parity exists via the framework-provided global `--completions` flag instead of a dedicated subcommand tree. |
-| `completion zsh`        | `partial` | `supabase --completions zsh`        | Go-style `completion zsh` subcommand shape        | `-`                   | Feature parity exists via the framework-provided global `--completions` flag instead of a dedicated subcommand tree. |
-| `help`                  | `partial` | `supabase --help`                   | Go-style top-level `help` command shape           | `-`                   | Feature parity exists via the framework-provided global `--help` flag instead of a dedicated `help` command.         |
+| Old command             | TS status | TS command path or `missing`     | Missing flags/params                    | Extra TS flags/params | Notes                                                                                                        |
+| ----------------------- | --------- | -------------------------------- | --------------------------------------- | --------------------- | ------------------------------------------------------------------------------------------------------------ |
+| `completion bash`       | `ported`  | `supabase completion bash`       | `-`                                     | `-`                   | Proxies verbatim to the Go binary so the emitted script is byte-identical to Cobra's output (CLI-1532).      |
+| `completion fish`       | `ported`  | `supabase completion fish`       | `-`                                     | `-`                   | Proxies verbatim to the Go binary so the emitted script is byte-identical to Cobra's output (CLI-1532).      |
+| `completion powershell` | `ported`  | `supabase completion powershell` | `-`                                     | `-`                   | Proxies verbatim to the Go binary so the emitted script is byte-identical to Cobra's output (CLI-1532).      |
+| `completion zsh`        | `ported`  | `supabase completion zsh`        | `-`                                     | `-`                   | Proxies verbatim to the Go binary so the emitted script is byte-identical to Cobra's output (CLI-1532).      |
+| `help`                  | `partial` | `supabase --help`                | Go-style top-level `help` command shape | `-`                   | Feature parity exists via the framework-provided global `--help` flag instead of a dedicated `help` command. |
 
 ## Legacy Shell Wrapping Status
 
 Phase 0 proxy wrappers in the legacy shell (`src/legacy/`). Each wrapped command forwards to the bundled Go binary via `LegacyGoProxy`.
+The `migration` command group also accepts Go's top-level `migrations` alias and forwards singular `migration` argv to Go.
 
 Legend:
 
 - `wrapped`: Phase 0 proxy wrapper exists in the legacy shell
 - `missing`: no legacy shell command yet
 
-| Command                                | Legacy status | Legacy command path                                                                                                                                                                                                                          |
-| -------------------------------------- | ------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `orgs list`                            | `wrapped`     | [`../src/legacy/commands/orgs/list/list.command.ts`](../src/legacy/commands/orgs/list/list.command.ts)                                                                                                                                       |
-| `orgs create`                          | `wrapped`     | [`../src/legacy/commands/orgs/create/create.command.ts`](../src/legacy/commands/orgs/create/create.command.ts)                                                                                                                               |
-| `projects list`                        | `wrapped`     | [`../src/legacy/commands/projects/list/list.command.ts`](../src/legacy/commands/projects/list/list.command.ts)                                                                                                                               |
-| `projects create`                      | `wrapped`     | [`../src/legacy/commands/projects/create/create.command.ts`](../src/legacy/commands/projects/create/create.command.ts)                                                                                                                       |
-| `projects delete`                      | `wrapped`     | [`../src/legacy/commands/projects/delete/delete.command.ts`](../src/legacy/commands/projects/delete/delete.command.ts)                                                                                                                       |
-| `projects api-keys`                    | `wrapped`     | [`../src/legacy/commands/projects/api-keys/api-keys.command.ts`](../src/legacy/commands/projects/api-keys/api-keys.command.ts)                                                                                                               |
-| `branches list`                        | `wrapped`     | [`../src/legacy/commands/branches/list/list.command.ts`](../src/legacy/commands/branches/list/list.command.ts)                                                                                                                               |
-| `branches create`                      | `wrapped`     | [`../src/legacy/commands/branches/create/create.command.ts`](../src/legacy/commands/branches/create/create.command.ts)                                                                                                                       |
-| `branches get`                         | `wrapped`     | [`../src/legacy/commands/branches/get/get.command.ts`](../src/legacy/commands/branches/get/get.command.ts)                                                                                                                                   |
-| `branches update`                      | `wrapped`     | [`../src/legacy/commands/branches/update/update.command.ts`](../src/legacy/commands/branches/update/update.command.ts)                                                                                                                       |
-| `branches pause`                       | `wrapped`     | [`../src/legacy/commands/branches/pause/pause.command.ts`](../src/legacy/commands/branches/pause/pause.command.ts)                                                                                                                           |
-| `branches unpause`                     | `wrapped`     | [`../src/legacy/commands/branches/unpause/unpause.command.ts`](../src/legacy/commands/branches/unpause/unpause.command.ts)                                                                                                                   |
-| `branches delete`                      | `wrapped`     | [`../src/legacy/commands/branches/delete/delete.command.ts`](../src/legacy/commands/branches/delete/delete.command.ts)                                                                                                                       |
-| `branches disable`                     | `wrapped`     | [`../src/legacy/commands/branches/disable/disable.command.ts`](../src/legacy/commands/branches/disable/disable.command.ts)                                                                                                                   |
-| `secrets list`                         | `wrapped`     | [`../src/legacy/commands/secrets/list/list.command.ts`](../src/legacy/commands/secrets/list/list.command.ts)                                                                                                                                 |
-| `secrets set`                          | `wrapped`     | [`../src/legacy/commands/secrets/set/set.command.ts`](../src/legacy/commands/secrets/set/set.command.ts)                                                                                                                                     |
-| `secrets unset`                        | `wrapped`     | [`../src/legacy/commands/secrets/unset/unset.command.ts`](../src/legacy/commands/secrets/unset/unset.command.ts)                                                                                                                             |
-| `config push`                          | `wrapped`     | [`../src/legacy/commands/config/push/push.command.ts`](../src/legacy/commands/config/push/push.command.ts)                                                                                                                                   |
-| `backups list`                         | `wrapped`     | [`../src/legacy/commands/backups/list/list.command.ts`](../src/legacy/commands/backups/list/list.command.ts)                                                                                                                                 |
-| `backups restore`                      | `wrapped`     | [`../src/legacy/commands/backups/restore/restore.command.ts`](../src/legacy/commands/backups/restore/restore.command.ts)                                                                                                                     |
-| `snippets list`                        | `wrapped`     | [`../src/legacy/commands/snippets/list/list.command.ts`](../src/legacy/commands/snippets/list/list.command.ts)                                                                                                                               |
-| `snippets download`                    | `wrapped`     | [`../src/legacy/commands/snippets/download/download.command.ts`](../src/legacy/commands/snippets/download/download.command.ts)                                                                                                               |
-| `sso list`                             | `wrapped`     | [`../src/legacy/commands/sso/list/list.command.ts`](../src/legacy/commands/sso/list/list.command.ts)                                                                                                                                         |
-| `sso add`                              | `wrapped`     | [`../src/legacy/commands/sso/add/add.command.ts`](../src/legacy/commands/sso/add/add.command.ts)                                                                                                                                             |
-| `sso remove`                           | `wrapped`     | [`../src/legacy/commands/sso/remove/remove.command.ts`](../src/legacy/commands/sso/remove/remove.command.ts)                                                                                                                                 |
-| `sso update`                           | `wrapped`     | [`../src/legacy/commands/sso/update/update.command.ts`](../src/legacy/commands/sso/update/update.command.ts)                                                                                                                                 |
-| `sso show`                             | `wrapped`     | [`../src/legacy/commands/sso/show/show.command.ts`](../src/legacy/commands/sso/show/show.command.ts)                                                                                                                                         |
-| `sso info`                             | `wrapped`     | [`../src/legacy/commands/sso/info/info.command.ts`](../src/legacy/commands/sso/info/info.command.ts)                                                                                                                                         |
-| `domains create`                       | `wrapped`     | [`../src/legacy/commands/domains/create/create.command.ts`](../src/legacy/commands/domains/create/create.command.ts)                                                                                                                         |
-| `domains get`                          | `wrapped`     | [`../src/legacy/commands/domains/get/get.command.ts`](../src/legacy/commands/domains/get/get.command.ts)                                                                                                                                     |
-| `domains reverify`                     | `wrapped`     | [`../src/legacy/commands/domains/reverify/reverify.command.ts`](../src/legacy/commands/domains/reverify/reverify.command.ts)                                                                                                                 |
-| `domains activate`                     | `wrapped`     | [`../src/legacy/commands/domains/activate/activate.command.ts`](../src/legacy/commands/domains/activate/activate.command.ts)                                                                                                                 |
-| `domains delete`                       | `wrapped`     | [`../src/legacy/commands/domains/delete/delete.command.ts`](../src/legacy/commands/domains/delete/delete.command.ts)                                                                                                                         |
-| `vanity-subdomains get`                | `wrapped`     | [`../src/legacy/commands/vanity-subdomains/get/get.command.ts`](../src/legacy/commands/vanity-subdomains/get/get.command.ts)                                                                                                                 |
-| `vanity-subdomains check-availability` | `wrapped`     | [`../src/legacy/commands/vanity-subdomains/check-availability/check-availability.command.ts`](../src/legacy/commands/vanity-subdomains/check-availability/check-availability.command.ts)                                                     |
-| `vanity-subdomains activate`           | `wrapped`     | [`../src/legacy/commands/vanity-subdomains/activate/activate.command.ts`](../src/legacy/commands/vanity-subdomains/activate/activate.command.ts)                                                                                             |
-| `vanity-subdomains delete`             | `wrapped`     | [`../src/legacy/commands/vanity-subdomains/delete/delete.command.ts`](../src/legacy/commands/vanity-subdomains/delete/delete.command.ts)                                                                                                     |
-| `network-bans get`                     | `wrapped`     | [`../src/legacy/commands/network-bans/get/get.command.ts`](../src/legacy/commands/network-bans/get/get.command.ts)                                                                                                                           |
-| `network-bans remove`                  | `wrapped`     | [`../src/legacy/commands/network-bans/remove/remove.command.ts`](../src/legacy/commands/network-bans/remove/remove.command.ts)                                                                                                               |
-| `network-restrictions get`             | `wrapped`     | [`../src/legacy/commands/network-restrictions/get/get.command.ts`](../src/legacy/commands/network-restrictions/get/get.command.ts)                                                                                                           |
-| `network-restrictions update`          | `wrapped`     | [`../src/legacy/commands/network-restrictions/update/update.command.ts`](../src/legacy/commands/network-restrictions/update/update.command.ts)                                                                                               |
-| `encryption get-root-key`              | `wrapped`     | [`../src/legacy/commands/encryption/get-root-key/get-root-key.command.ts`](../src/legacy/commands/encryption/get-root-key/get-root-key.command.ts)                                                                                           |
-| `encryption update-root-key`           | `wrapped`     | [`../src/legacy/commands/encryption/update-root-key/update-root-key.command.ts`](../src/legacy/commands/encryption/update-root-key/update-root-key.command.ts)                                                                               |
-| `ssl-enforcement get`                  | `wrapped`     | [`../src/legacy/commands/ssl-enforcement/get/get.command.ts`](../src/legacy/commands/ssl-enforcement/get/get.command.ts)                                                                                                                     |
-| `ssl-enforcement update`               | `wrapped`     | [`../src/legacy/commands/ssl-enforcement/update/update.command.ts`](../src/legacy/commands/ssl-enforcement/update/update.command.ts)                                                                                                         |
-| `postgres-config get`                  | `wrapped`     | [`../src/legacy/commands/postgres-config/get/get.command.ts`](../src/legacy/commands/postgres-config/get/get.command.ts)                                                                                                                     |
-| `postgres-config update`               | `wrapped`     | [`../src/legacy/commands/postgres-config/update/update.command.ts`](../src/legacy/commands/postgres-config/update/update.command.ts)                                                                                                         |
-| `postgres-config delete`               | `wrapped`     | [`../src/legacy/commands/postgres-config/delete/delete.command.ts`](../src/legacy/commands/postgres-config/delete/delete.command.ts)                                                                                                         |
-| `login`                                | `wrapped`     | [`../src/legacy/commands/login/login.command.ts`](../src/legacy/commands/login/login.command.ts)                                                                                                                                             |
-| `logout`                               | `wrapped`     | [`../src/legacy/commands/logout/logout.command.ts`](../src/legacy/commands/logout/logout.command.ts)                                                                                                                                         |
-| `link`                                 | `wrapped`     | [`../src/legacy/commands/link/link.command.ts`](../src/legacy/commands/link/link.command.ts)                                                                                                                                                 |
-| `unlink`                               | `wrapped`     | [`../src/legacy/commands/unlink/unlink.command.ts`](../src/legacy/commands/unlink/unlink.command.ts)                                                                                                                                         |
-| `bootstrap`                            | `wrapped`     | [`../src/legacy/commands/bootstrap/bootstrap.command.ts`](../src/legacy/commands/bootstrap/bootstrap.command.ts)                                                                                                                             |
-| `init`                                 | `wrapped`     | [`../src/legacy/commands/init/init.command.ts`](../src/legacy/commands/init/init.command.ts)                                                                                                                                                 |
-| `services`                             | `wrapped`     | [`../src/legacy/commands/services/services.command.ts`](../src/legacy/commands/services/services.command.ts)                                                                                                                                 |
-| `start`                                | `wrapped`     | [`../src/legacy/commands/start/start.command.ts`](../src/legacy/commands/start/start.command.ts)                                                                                                                                             |
-| `stop`                                 | `wrapped`     | [`../src/legacy/commands/stop/stop.command.ts`](../src/legacy/commands/stop/stop.command.ts)                                                                                                                                                 |
-| `status`                               | `wrapped`     | [`../src/legacy/commands/status/status.command.ts`](../src/legacy/commands/status/status.command.ts)                                                                                                                                         |
-| `migration list`                       | `wrapped`     | [`../src/legacy/commands/migration/list/list.command.ts`](../src/legacy/commands/migration/list/list.command.ts)                                                                                                                             |
-| `migration new`                        | `wrapped`     | [`../src/legacy/commands/migration/new/new.command.ts`](../src/legacy/commands/migration/new/new.command.ts)                                                                                                                                 |
-| `migration repair`                     | `wrapped`     | [`../src/legacy/commands/migration/repair/repair.command.ts`](../src/legacy/commands/migration/repair/repair.command.ts)                                                                                                                     |
-| `migration squash`                     | `wrapped`     | [`../src/legacy/commands/migration/squash/squash.command.ts`](../src/legacy/commands/migration/squash/squash.command.ts)                                                                                                                     |
-| `migration up`                         | `wrapped`     | [`../src/legacy/commands/migration/up/up.command.ts`](../src/legacy/commands/migration/up/up.command.ts)                                                                                                                                     |
-| `migration down`                       | `wrapped`     | [`../src/legacy/commands/migration/down/down.command.ts`](../src/legacy/commands/migration/down/down.command.ts)                                                                                                                             |
-| `migration fetch`                      | `wrapped`     | [`../src/legacy/commands/migration/fetch/fetch.command.ts`](../src/legacy/commands/migration/fetch/fetch.command.ts)                                                                                                                         |
-| `gen types`                            | `wrapped`     | [`../src/legacy/commands/gen/types/types.command.ts`](../src/legacy/commands/gen/types/types.command.ts)                                                                                                                                     |
-| `gen signing-key`                      | `wrapped`     | [`../src/legacy/commands/gen/signing-key/signing-key.command.ts`](../src/legacy/commands/gen/signing-key/signing-key.command.ts)                                                                                                             |
-| `gen bearer-jwt`                       | `wrapped`     | [`../src/legacy/commands/gen/bearer-jwt/bearer-jwt.command.ts`](../src/legacy/commands/gen/bearer-jwt/bearer-jwt.command.ts)                                                                                                                 |
-| `gen keys`                             | `wrapped`     | [`../src/legacy/commands/gen/keys/keys.command.ts`](../src/legacy/commands/gen/keys/keys.command.ts)                                                                                                                                         |
-| `functions list`                       | `wrapped`     | [`../src/legacy/commands/functions/list/list.command.ts`](../src/legacy/commands/functions/list/list.command.ts)                                                                                                                             |
-| `functions delete`                     | `wrapped`     | [`../src/legacy/commands/functions/delete/delete.command.ts`](../src/legacy/commands/functions/delete/delete.command.ts)                                                                                                                     |
-| `functions download`                   | `wrapped`     | [`../src/legacy/commands/functions/download/download.command.ts`](../src/legacy/commands/functions/download/download.command.ts)                                                                                                             |
-| `functions deploy`                     | `wrapped`     | [`../src/legacy/commands/functions/deploy/deploy.command.ts`](../src/legacy/commands/functions/deploy/deploy.command.ts)                                                                                                                     |
-| `functions new`                        | `wrapped`     | [`../src/legacy/commands/functions/new/new.command.ts`](../src/legacy/commands/functions/new/new.command.ts)                                                                                                                                 |
-| `functions serve`                      | `wrapped`     | [`../src/legacy/commands/functions/serve/serve.command.ts`](../src/legacy/commands/functions/serve/serve.command.ts)                                                                                                                         |
-| `storage ls`                           | `wrapped`     | [`../src/legacy/commands/storage/ls/ls.command.ts`](../src/legacy/commands/storage/ls/ls.command.ts)                                                                                                                                         |
-| `storage cp`                           | `wrapped`     | [`../src/legacy/commands/storage/cp/cp.command.ts`](../src/legacy/commands/storage/cp/cp.command.ts)                                                                                                                                         |
-| `storage mv`                           | `wrapped`     | [`../src/legacy/commands/storage/mv/mv.command.ts`](../src/legacy/commands/storage/mv/mv.command.ts)                                                                                                                                         |
-| `storage rm`                           | `wrapped`     | [`../src/legacy/commands/storage/rm/rm.command.ts`](../src/legacy/commands/storage/rm/rm.command.ts)                                                                                                                                         |
-| `test db`                              | `wrapped`     | [`../src/legacy/commands/test/db/db.command.ts`](../src/legacy/commands/test/db/db.command.ts)                                                                                                                                               |
-| `test new`                             | `wrapped`     | [`../src/legacy/commands/test/new/new.command.ts`](../src/legacy/commands/test/new/new.command.ts)                                                                                                                                           |
-| `seed buckets`                         | `wrapped`     | [`../src/legacy/commands/seed/buckets/buckets.command.ts`](../src/legacy/commands/seed/buckets/buckets.command.ts)                                                                                                                           |
-| `db diff`                              | `wrapped`     | [`../src/legacy/commands/db/diff/diff.command.ts`](../src/legacy/commands/db/diff/diff.command.ts)                                                                                                                                           |
-| `db dump`                              | `wrapped`     | [`../src/legacy/commands/db/dump/dump.command.ts`](../src/legacy/commands/db/dump/dump.command.ts)                                                                                                                                           |
-| `db push`                              | `wrapped`     | [`../src/legacy/commands/db/push/push.command.ts`](../src/legacy/commands/db/push/push.command.ts)                                                                                                                                           |
-| `db pull`                              | `wrapped`     | [`../src/legacy/commands/db/pull/pull.command.ts`](../src/legacy/commands/db/pull/pull.command.ts) — includes `--diff-engine` (migra\|pg-delta, mutually exclusive with `--use-pg-delta`)                                                    |
-| `db reset`                             | `wrapped`     | [`../src/legacy/commands/db/reset/reset.command.ts`](../src/legacy/commands/db/reset/reset.command.ts)                                                                                                                                       |
-| `db lint`                              | `wrapped`     | [`../src/legacy/commands/db/lint/lint.command.ts`](../src/legacy/commands/db/lint/lint.command.ts)                                                                                                                                           |
-| `db start`                             | `wrapped`     | [`../src/legacy/commands/db/start/start.command.ts`](../src/legacy/commands/db/start/start.command.ts)                                                                                                                                       |
-| `db query`                             | `wrapped`     | [`../src/legacy/commands/db/query/query.command.ts`](../src/legacy/commands/db/query/query.command.ts)                                                                                                                                       |
-| `db advisors`                          | `wrapped`     | [`../src/legacy/commands/db/advisors/advisors.command.ts`](../src/legacy/commands/db/advisors/advisors.command.ts)                                                                                                                           |
-| `db test`                              | `wrapped`     | [`../src/legacy/commands/db/test/test.command.ts`](../src/legacy/commands/db/test/test.command.ts)                                                                                                                                           |
-| `db branch create`                     | `wrapped`     | [`../src/legacy/commands/db/branch/create/create.command.ts`](../src/legacy/commands/db/branch/create/create.command.ts)                                                                                                                     |
-| `db branch delete`                     | `wrapped`     | [`../src/legacy/commands/db/branch/delete/delete.command.ts`](../src/legacy/commands/db/branch/delete/delete.command.ts)                                                                                                                     |
-| `db branch list`                       | `wrapped`     | [`../src/legacy/commands/db/branch/list/list.command.ts`](../src/legacy/commands/db/branch/list/list.command.ts)                                                                                                                             |
-| `db branch switch`                     | `wrapped`     | [`../src/legacy/commands/db/branch/switch/switch.command.ts`](../src/legacy/commands/db/branch/switch/switch.command.ts)                                                                                                                     |
-| `db remote changes`                    | `wrapped`     | [`../src/legacy/commands/db/remote/changes/changes.command.ts`](../src/legacy/commands/db/remote/changes/changes.command.ts)                                                                                                                 |
-| `db remote commit`                     | `wrapped`     | [`../src/legacy/commands/db/remote/commit/commit.command.ts`](../src/legacy/commands/db/remote/commit/commit.command.ts)                                                                                                                     |
-| `db schema declarative sync`           | `wrapped`     | [`../src/legacy/commands/db/schema/declarative/sync/sync.command.ts`](../src/legacy/commands/db/schema/declarative/sync/sync.command.ts) — `--apply` and `--no-apply` are mutually exclusive; `--no-apply` overrides the global `--yes` flag |
-| `db schema declarative generate`       | `wrapped`     | [`../src/legacy/commands/db/schema/declarative/generate/generate.command.ts`](../src/legacy/commands/db/schema/declarative/generate/generate.command.ts)                                                                                     |
+| Command                                | Legacy status | Legacy command path                                                                                                                                                                       |
+| -------------------------------------- | ------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `orgs list`                            | `ported`      | [`../src/legacy/commands/orgs/list/list.command.ts`](../src/legacy/commands/orgs/list/list.command.ts)                                                                                    |
+| `orgs create`                          | `ported`      | [`../src/legacy/commands/orgs/create/create.command.ts`](../src/legacy/commands/orgs/create/create.command.ts)                                                                            |
+| `projects list`                        | `wrapped`     | [`../src/legacy/commands/projects/list/list.command.ts`](../src/legacy/commands/projects/list/list.command.ts)                                                                            |
+| `projects create`                      | `wrapped`     | [`../src/legacy/commands/projects/create/create.command.ts`](../src/legacy/commands/projects/create/create.command.ts)                                                                    |
+| `projects delete`                      | `wrapped`     | [`../src/legacy/commands/projects/delete/delete.command.ts`](../src/legacy/commands/projects/delete/delete.command.ts)                                                                    |
+| `projects api-keys`                    | `wrapped`     | [`../src/legacy/commands/projects/api-keys/api-keys.command.ts`](../src/legacy/commands/projects/api-keys/api-keys.command.ts)                                                            |
+| `branches list`                        | `ported`      | [`../src/legacy/commands/branches/list/list.command.ts`](../src/legacy/commands/branches/list/list.command.ts)                                                                            |
+| `branches create`                      | `ported`      | [`../src/legacy/commands/branches/create/create.command.ts`](../src/legacy/commands/branches/create/create.command.ts)                                                                    |
+| `branches get`                         | `ported`      | [`../src/legacy/commands/branches/get/get.command.ts`](../src/legacy/commands/branches/get/get.command.ts)                                                                                |
+| `branches update`                      | `ported`      | [`../src/legacy/commands/branches/update/update.command.ts`](../src/legacy/commands/branches/update/update.command.ts)                                                                    |
+| `branches pause`                       | `ported`      | [`../src/legacy/commands/branches/pause/pause.command.ts`](../src/legacy/commands/branches/pause/pause.command.ts)                                                                        |
+| `branches unpause`                     | `ported`      | [`../src/legacy/commands/branches/unpause/unpause.command.ts`](../src/legacy/commands/branches/unpause/unpause.command.ts)                                                                |
+| `branches delete`                      | `ported`      | [`../src/legacy/commands/branches/delete/delete.command.ts`](../src/legacy/commands/branches/delete/delete.command.ts)                                                                    |
+| `branches disable`                     | `ported`      | [`../src/legacy/commands/branches/disable/disable.command.ts`](../src/legacy/commands/branches/disable/disable.command.ts)                                                                |
+| `secrets list`                         | `ported`      | [`../src/legacy/commands/secrets/list/list.command.ts`](../src/legacy/commands/secrets/list/list.command.ts)                                                                              |
+| `secrets set`                          | `ported`      | [`../src/legacy/commands/secrets/set/set.command.ts`](../src/legacy/commands/secrets/set/set.command.ts)                                                                                  |
+| `secrets unset`                        | `ported`      | [`../src/legacy/commands/secrets/unset/unset.command.ts`](../src/legacy/commands/secrets/unset/unset.command.ts)                                                                          |
+| `config push`                          | `wrapped`     | [`../src/legacy/commands/config/push/push.command.ts`](../src/legacy/commands/config/push/push.command.ts)                                                                                |
+| `backups list`                         | `ported`      | [`../src/legacy/commands/backups/list/list.command.ts`](../src/legacy/commands/backups/list/list.command.ts)                                                                              |
+| `backups restore`                      | `ported`      | [`../src/legacy/commands/backups/restore/restore.command.ts`](../src/legacy/commands/backups/restore/restore.command.ts)                                                                  |
+| `snippets list`                        | `wrapped`     | [`../src/legacy/commands/snippets/list/list.command.ts`](../src/legacy/commands/snippets/list/list.command.ts)                                                                            |
+| `snippets download`                    | `wrapped`     | [`../src/legacy/commands/snippets/download/download.command.ts`](../src/legacy/commands/snippets/download/download.command.ts)                                                            |
+| `sso list`                             | `ported`      | [`../src/legacy/commands/sso/list/list.command.ts`](../src/legacy/commands/sso/list/list.command.ts)                                                                                      |
+| `sso add`                              | `ported`      | [`../src/legacy/commands/sso/add/add.command.ts`](../src/legacy/commands/sso/add/add.command.ts)                                                                                          |
+| `sso remove`                           | `ported`      | [`../src/legacy/commands/sso/remove/remove.command.ts`](../src/legacy/commands/sso/remove/remove.command.ts)                                                                              |
+| `sso update`                           | `ported`      | [`../src/legacy/commands/sso/update/update.command.ts`](../src/legacy/commands/sso/update/update.command.ts)                                                                              |
+| `sso show`                             | `ported`      | [`../src/legacy/commands/sso/show/show.command.ts`](../src/legacy/commands/sso/show/show.command.ts)                                                                                      |
+| `sso info`                             | `ported`      | [`../src/legacy/commands/sso/info/info.command.ts`](../src/legacy/commands/sso/info/info.command.ts)                                                                                      |
+| `domains create`                       | `wrapped`     | [`../src/legacy/commands/domains/create/create.command.ts`](../src/legacy/commands/domains/create/create.command.ts)                                                                      |
+| `domains get`                          | `wrapped`     | [`../src/legacy/commands/domains/get/get.command.ts`](../src/legacy/commands/domains/get/get.command.ts)                                                                                  |
+| `domains reverify`                     | `wrapped`     | [`../src/legacy/commands/domains/reverify/reverify.command.ts`](../src/legacy/commands/domains/reverify/reverify.command.ts)                                                              |
+| `domains activate`                     | `wrapped`     | [`../src/legacy/commands/domains/activate/activate.command.ts`](../src/legacy/commands/domains/activate/activate.command.ts)                                                              |
+| `domains delete`                       | `wrapped`     | [`../src/legacy/commands/domains/delete/delete.command.ts`](../src/legacy/commands/domains/delete/delete.command.ts)                                                                      |
+| `vanity-subdomains get`                | `wrapped`     | [`../src/legacy/commands/vanity-subdomains/get/get.command.ts`](../src/legacy/commands/vanity-subdomains/get/get.command.ts)                                                              |
+| `vanity-subdomains check-availability` | `wrapped`     | [`../src/legacy/commands/vanity-subdomains/check-availability/check-availability.command.ts`](../src/legacy/commands/vanity-subdomains/check-availability/check-availability.command.ts)  |
+| `vanity-subdomains activate`           | `wrapped`     | [`../src/legacy/commands/vanity-subdomains/activate/activate.command.ts`](../src/legacy/commands/vanity-subdomains/activate/activate.command.ts)                                          |
+| `vanity-subdomains delete`             | `wrapped`     | [`../src/legacy/commands/vanity-subdomains/delete/delete.command.ts`](../src/legacy/commands/vanity-subdomains/delete/delete.command.ts)                                                  |
+| `network-bans get`                     | `wrapped`     | [`../src/legacy/commands/network-bans/get/get.command.ts`](../src/legacy/commands/network-bans/get/get.command.ts)                                                                        |
+| `network-bans remove`                  | `wrapped`     | [`../src/legacy/commands/network-bans/remove/remove.command.ts`](../src/legacy/commands/network-bans/remove/remove.command.ts)                                                            |
+| `network-restrictions get`             | `ported`      | [`../src/legacy/commands/network-restrictions/get/get.command.ts`](../src/legacy/commands/network-restrictions/get/get.command.ts)                                                        |
+| `network-restrictions update`          | `ported`      | [`../src/legacy/commands/network-restrictions/update/update.command.ts`](../src/legacy/commands/network-restrictions/update/update.command.ts)                                            |
+| `encryption get-root-key`              | `wrapped`     | [`../src/legacy/commands/encryption/get-root-key/get-root-key.command.ts`](../src/legacy/commands/encryption/get-root-key/get-root-key.command.ts)                                        |
+| `encryption update-root-key`           | `wrapped`     | [`../src/legacy/commands/encryption/update-root-key/update-root-key.command.ts`](../src/legacy/commands/encryption/update-root-key/update-root-key.command.ts)                            |
+| `ssl-enforcement get`                  | `ported`      | [`../src/legacy/commands/ssl-enforcement/get/get.command.ts`](../src/legacy/commands/ssl-enforcement/get/get.command.ts)                                                                  |
+| `ssl-enforcement update`               | `ported`      | [`../src/legacy/commands/ssl-enforcement/update/update.command.ts`](../src/legacy/commands/ssl-enforcement/update/update.command.ts)                                                      |
+| `postgres-config get`                  | `wrapped`     | [`../src/legacy/commands/postgres-config/get/get.command.ts`](../src/legacy/commands/postgres-config/get/get.command.ts)                                                                  |
+| `postgres-config update`               | `wrapped`     | [`../src/legacy/commands/postgres-config/update/update.command.ts`](../src/legacy/commands/postgres-config/update/update.command.ts)                                                      |
+| `postgres-config delete`               | `wrapped`     | [`../src/legacy/commands/postgres-config/delete/delete.command.ts`](../src/legacy/commands/postgres-config/delete/delete.command.ts)                                                      |
+| `login`                                | `wrapped`     | [`../src/legacy/commands/login/login.command.ts`](../src/legacy/commands/login/login.command.ts)                                                                                          |
+| `logout`                               | `wrapped`     | [`../src/legacy/commands/logout/logout.command.ts`](../src/legacy/commands/logout/logout.command.ts)                                                                                      |
+| `link`                                 | `wrapped`     | [`../src/legacy/commands/link/link.command.ts`](../src/legacy/commands/link/link.command.ts)                                                                                              |
+| `unlink`                               | `wrapped`     | [`../src/legacy/commands/unlink/unlink.command.ts`](../src/legacy/commands/unlink/unlink.command.ts)                                                                                      |
+| `bootstrap`                            | `wrapped`     | [`../src/legacy/commands/bootstrap/bootstrap.command.ts`](../src/legacy/commands/bootstrap/bootstrap.command.ts)                                                                          |
+| `init`                                 | `wrapped`     | [`../src/legacy/commands/init/init.command.ts`](../src/legacy/commands/init/init.command.ts)                                                                                              |
+| `services`                             | `wrapped`     | [`../src/legacy/commands/services/services.command.ts`](../src/legacy/commands/services/services.command.ts)                                                                              |
+| `start`                                | `wrapped`     | [`../src/legacy/commands/start/start.command.ts`](../src/legacy/commands/start/start.command.ts)                                                                                          |
+| `stop`                                 | `wrapped`     | [`../src/legacy/commands/stop/stop.command.ts`](../src/legacy/commands/stop/stop.command.ts)                                                                                              |
+| `status`                               | `wrapped`     | [`../src/legacy/commands/status/status.command.ts`](../src/legacy/commands/status/status.command.ts)                                                                                      |
+| `migration list`                       | `wrapped`     | [`../src/legacy/commands/migration/list/list.command.ts`](../src/legacy/commands/migration/list/list.command.ts)                                                                          |
+| `migration new`                        | `wrapped`     | [`../src/legacy/commands/migration/new/new.command.ts`](../src/legacy/commands/migration/new/new.command.ts)                                                                              |
+| `migration repair`                     | `wrapped`     | [`../src/legacy/commands/migration/repair/repair.command.ts`](../src/legacy/commands/migration/repair/repair.command.ts)                                                                  |
+| `migration squash`                     | `wrapped`     | [`../src/legacy/commands/migration/squash/squash.command.ts`](../src/legacy/commands/migration/squash/squash.command.ts)                                                                  |
+| `migration up`                         | `wrapped`     | [`../src/legacy/commands/migration/up/up.command.ts`](../src/legacy/commands/migration/up/up.command.ts)                                                                                  |
+| `migration down`                       | `wrapped`     | [`../src/legacy/commands/migration/down/down.command.ts`](../src/legacy/commands/migration/down/down.command.ts)                                                                          |
+| `migration fetch`                      | `wrapped`     | [`../src/legacy/commands/migration/fetch/fetch.command.ts`](../src/legacy/commands/migration/fetch/fetch.command.ts)                                                                      |
+| `gen types`                            | `wrapped`     | [`../src/legacy/commands/gen/types/types.command.ts`](../src/legacy/commands/gen/types/types.command.ts)                                                                                  |
+| `gen signing-key`                      | `wrapped`     | [`../src/legacy/commands/gen/signing-key/signing-key.command.ts`](../src/legacy/commands/gen/signing-key/signing-key.command.ts)                                                          |
+| `gen bearer-jwt`                       | `wrapped`     | [`../src/legacy/commands/gen/bearer-jwt/bearer-jwt.command.ts`](../src/legacy/commands/gen/bearer-jwt/bearer-jwt.command.ts)                                                              |
+| `gen keys`                             | `wrapped`     | [`../src/legacy/commands/gen/keys/keys.command.ts`](../src/legacy/commands/gen/keys/keys.command.ts)                                                                                      |
+| `functions list`                       | `wrapped`     | [`../src/legacy/commands/functions/list/list.command.ts`](../src/legacy/commands/functions/list/list.command.ts)                                                                          |
+| `functions delete`                     | `wrapped`     | [`../src/legacy/commands/functions/delete/delete.command.ts`](../src/legacy/commands/functions/delete/delete.command.ts)                                                                  |
+| `functions download`                   | `wrapped`     | [`../src/legacy/commands/functions/download/download.command.ts`](../src/legacy/commands/functions/download/download.command.ts)                                                          |
+| `functions deploy`                     | `wrapped`     | [`../src/legacy/commands/functions/deploy/deploy.command.ts`](../src/legacy/commands/functions/deploy/deploy.command.ts)                                                                  |
+| `functions new`                        | `wrapped`     | [`../src/legacy/commands/functions/new/new.command.ts`](../src/legacy/commands/functions/new/new.command.ts)                                                                              |
+| `functions serve`                      | `wrapped`     | [`../src/legacy/commands/functions/serve/serve.command.ts`](../src/legacy/commands/functions/serve/serve.command.ts)                                                                      |
+| `storage ls`                           | `wrapped`     | [`../src/legacy/commands/storage/ls/ls.command.ts`](../src/legacy/commands/storage/ls/ls.command.ts)                                                                                      |
+| `storage cp`                           | `wrapped`     | [`../src/legacy/commands/storage/cp/cp.command.ts`](../src/legacy/commands/storage/cp/cp.command.ts)                                                                                      |
+| `storage mv`                           | `wrapped`     | [`../src/legacy/commands/storage/mv/mv.command.ts`](../src/legacy/commands/storage/mv/mv.command.ts)                                                                                      |
+| `storage rm`                           | `wrapped`     | [`../src/legacy/commands/storage/rm/rm.command.ts`](../src/legacy/commands/storage/rm/rm.command.ts)                                                                                      |
+| `test db`                              | `wrapped`     | [`../src/legacy/commands/test/db/db.command.ts`](../src/legacy/commands/test/db/db.command.ts)                                                                                            |
+| `test new`                             | `wrapped`     | [`../src/legacy/commands/test/new/new.command.ts`](../src/legacy/commands/test/new/new.command.ts)                                                                                        |
+| `seed buckets`                         | `wrapped`     | [`../src/legacy/commands/seed/buckets/buckets.command.ts`](../src/legacy/commands/seed/buckets/buckets.command.ts)                                                                        |
+| `db diff`                              | `wrapped`     | [`../src/legacy/commands/db/diff/diff.command.ts`](../src/legacy/commands/db/diff/diff.command.ts)                                                                                        |
+| `db dump`                              | `wrapped`     | [`../src/legacy/commands/db/dump/dump.command.ts`](../src/legacy/commands/db/dump/dump.command.ts)                                                                                        |
+| `db push`                              | `wrapped`     | [`../src/legacy/commands/db/push/push.command.ts`](../src/legacy/commands/db/push/push.command.ts)                                                                                        |
+| `db pull`                              | `wrapped`     | [`../src/legacy/commands/db/pull/pull.command.ts`](../src/legacy/commands/db/pull/pull.command.ts) — includes `--diff-engine` (migra\|pg-delta, mutually exclusive with `--use-pg-delta`) |
+| `db reset`                             | `wrapped`     | [`../src/legacy/commands/db/reset/reset.command.ts`](../src/legacy/commands/db/reset/reset.command.ts)                                                                                    |
+| `db lint`                              | `wrapped`     | [`../src/legacy/commands/db/lint/lint.command.ts`](../src/legacy/commands/db/lint/lint.command.ts)                                                                                        |
+| `db start`                             | `wrapped`     | [`../src/legacy/commands/db/start/start.command.ts`](../src/legacy/commands/db/start/start.command.ts)                                                                                    |
+| `db query`                             | `wrapped`     | [`../src/legacy/commands/db/query/query.command.ts`](../src/legacy/commands/db/query/query.command.ts)                                                                                    |
+| `db advisors`                          | `wrapped`     | [`../src/legacy/commands/db/advisors/advisors.command.ts`](../src/legacy/commands/db/advisors/advisors.command.ts)                                                                        |
+| `db test`                              | `wrapped`     | [`../src/legacy/commands/db/test/test.command.ts`](../src/legacy/commands/db/test/test.command.ts)                                                                                        |
+| `db branch create`                     | `wrapped`     | [`../src/legacy/commands/db/branch/create/create.command.ts`](../src/legacy/commands/db/branch/create/create.command.ts)                                                                  |
+| `db branch delete`                     | `wrapped`     | [`../src/legacy/commands/db/branch/delete/delete.command.ts`](../src/legacy/commands/db/branch/delete/delete.command.ts)                                                                  |
+| `db branch list`                       | `wrapped`     | [`../src/legacy/commands/db/branch/list/list.command.ts`](../src/legacy/commands/db/branch/list/list.command.ts)                                                                          |
+| `db branch switch`                     | `wrapped`     | [`../src/legacy/commands/db/branch/switch/switch.command.ts`](../src/legacy/commands/db/branch/switch/switch.command.ts)                                                                  |
+| `db remote changes`                    | `wrapped`     | [`../src/legacy/commands/db/remote/changes/changes.command.ts`](../src/legacy/commands/db/remote/changes/changes.command.ts)                                                              |
+| `db remote commit`                     | `wrapped`     | [`../src/legacy/commands/db/remote/commit/commit.command.ts`](../src/legacy/commands/db/remote/commit/commit.command.ts)                                                                  |
+| `db schema declarative sync`           | `wrapped`     | [`../src/legacy/commands/db/schema/declarative/sync/sync.command.ts`](../src/legacy/commands/db/schema/declarative/sync/sync.command.ts)                                                  |
+| `db schema declarative generate`       | `wrapped`     | [`../src/legacy/commands/db/schema/declarative/generate/generate.command.ts`](../src/legacy/commands/db/schema/declarative/generate/generate.command.ts)                                  |
diff --git a/apps/cli/package.json b/apps/cli/package.json
index 67ab24316f..fa98c8d27c 100644
--- a/apps/cli/package.json
+++ b/apps/cli/package.json
@@ -49,22 +49,25 @@
     "@supabase/stack": "workspace:*",
     "@tsconfig/bun": "catalog:",
     "@types/bun": "catalog:",
-    "@types/react": "^19.2.14",
+    "@types/react": "^19.2.15",
     "@typescript/native-preview": "catalog:",
     "@vercel/detect-agent": "^1.2.3",
     "@vitest/coverage-istanbul": "catalog:",
+    "dotenv": "^17.4.2",
     "effect": "catalog:",
-    "ink": "^7.0.3",
+    "ink": "^7.0.4",
     "ink-spinner": "^5.0.0",
     "knip": "catalog:",
     "oxfmt": "catalog:",
     "oxlint": "catalog:",
     "oxlint-tsgolint": "catalog:",
-    "posthog-node": "^5.34.3",
+    "posthog-node": "^5.35.5",
     "react": "^19.2.6",
     "react-devtools-core": "^7.0.1",
-    "semantic-release": "^24.2.9",
-    "vitest": "catalog:"
+    "semantic-release": "^25.0.3",
+    "smol-toml": "^1.6.1",
+    "vitest": "catalog:",
+    "yaml": "^2.9.0"
   },
   "optionalDependencies": {
     "@supabase/cli-darwin-arm64": "workspace:*",
@@ -98,7 +101,8 @@
     ],
     "ignore": [
       "scripts/*.ts",
-      "tests/**/*.ts"
+      "tests/**/*.ts",
+      "src/shared/telemetry/event-catalog.ts"
     ],
     "ignoreBinaries": [
       "nx"
diff --git a/apps/cli/scripts/build.ts b/apps/cli/scripts/build.ts
index 07cca0deff..ca2a67a6da 100644
--- a/apps/cli/scripts/build.ts
+++ b/apps/cli/scripts/build.ts
@@ -12,7 +12,7 @@ const MUSL_TARGETS = [
     nfpmArch: "arm64",
   },
   {
-    bunTarget: "bun-linux-x64-musl",
+    bunTarget: "bun-linux-x64-musl-baseline",
     pkg: "cli-linux-x64-musl",
     nfpmArch: "amd64",
   },
@@ -62,14 +62,14 @@ const TARGETS = [
     ext: "",
   },
   {
-    bunTarget: "bun-linux-x64",
+    bunTarget: "bun-linux-x64-baseline",
     pkg: "cli-linux-x64",
     archive: `supabase_${version}_linux_amd64.tar.gz`,
     nfpmArch: "amd64",
     ext: "",
   },
   {
-    bunTarget: "bun-windows-x64",
+    bunTarget: "bun-windows-x64-baseline",
     pkg: "cli-windows-x64",
     archive: `supabase_${version}_windows_amd64.zip`,
     ext: ".exe",
@@ -93,8 +93,8 @@ const GO_TARGETS: Record<BunTarget, { goos: string; goarch: string }> = {
   "bun-darwin-arm64": { goos: "darwin", goarch: "arm64" },
   "bun-darwin-x64": { goos: "darwin", goarch: "amd64" },
   "bun-linux-arm64": { goos: "linux", goarch: "arm64" },
-  "bun-linux-x64": { goos: "linux", goarch: "amd64" },
-  "bun-windows-x64": { goos: "windows", goarch: "amd64" },
+  "bun-linux-x64-baseline": { goos: "linux", goarch: "amd64" },
+  "bun-windows-x64-baseline": { goos: "windows", goarch: "amd64" },
   "bun-windows-arm64": { goos: "windows", goarch: "arm64" },
 };
 
@@ -102,7 +102,7 @@ function libcForBunTarget(target: string): "glibc" | "musl" | "" {
   if (!target.startsWith("bun-linux-")) {
     return "";
   }
-  return target.endsWith("-musl") ? "musl" : "glibc";
+  return target.includes("-musl") ? "musl" : "glibc";
 }
 
 async function buildTarget(target: (typeof TARGETS)[number]) {
diff --git a/apps/cli/src/legacy/SIDE_EFFECTS_TEMPLATE.md b/apps/cli/src/legacy/SIDE_EFFECTS_TEMPLATE.md
index 50d8bd4786..a27b7f3ab6 100644
--- a/apps/cli/src/legacy/SIDE_EFFECTS_TEMPLATE.md
+++ b/apps/cli/src/legacy/SIDE_EFFECTS_TEMPLATE.md
@@ -74,6 +74,19 @@
 | `1`  | authentication error (no token found) |
 | `1`  | network / connection failure          |
 
+## Telemetry Events Fired
+
+<!-- List every PostHog event the command emits, including the universal cli_command_executed.
+     Source of truth for what Go emits: apps/cli-go/internal/<command>/*.go (grep for
+     `service.Capture`, `service.Alias`, `service.Identify`, `service.GroupIdentify`,
+     `TrackUpgradeSuggested`). If the legacy command is still a Phase 0 proxy, write
+     "proxy — see Go binary" and leave the table empty; the Go subprocess fires telemetry.
+     Constants live in apps/cli/src/shared/telemetry/event-catalog.ts. -->
+
+| Event                  | When                                       | Notable properties / groups         |
+| ---------------------- | ------------------------------------------ | ----------------------------------- |
+| `cli_command_executed` | post-run, success or failure (via wrapper) | `exit_code`, `duration_ms`, `flags` |
+
 ## Output
 
 <!-- Describe the user-visible output for each --output-format mode.
diff --git a/apps/cli/src/legacy/auth/legacy-credentials.layer.ts b/apps/cli/src/legacy/auth/legacy-credentials.layer.ts
new file mode 100644
index 0000000000..fca5e4c84c
--- /dev/null
+++ b/apps/cli/src/legacy/auth/legacy-credentials.layer.ts
@@ -0,0 +1,155 @@
+import { Effect, FileSystem, Layer, Option, Path, Redacted } from "effect";
+
+import { RuntimeInfo } from "../../shared/runtime/runtime-info.service.ts";
+import { LegacyCliConfig } from "../config/legacy-cli-config.service.ts";
+import { LegacyCredentials } from "./legacy-credentials.service.ts";
+import { LegacyInvalidAccessTokenError } from "./legacy-errors.ts";
+
+const KEYRING_SERVICE = "Supabase CLI";
+const LEGACY_KEYRING_ACCOUNT = "access-token";
+const WSL_OSRELEASE_PATH = "/proc/sys/kernel/osrelease";
+
+const ACCESS_TOKEN_PATTERN = /^sbp_(oauth_)?[a-f0-9]{40}$/;
+
+const INVALID_TOKEN_MESSAGE = "Invalid access token format. Must be like `sbp_0102...1920`.";
+
+type KeyringModule = typeof import("@napi-rs/keyring");
+
+const detectWsl = (fs: FileSystem.FileSystem): Effect.Effect<boolean> =>
+  Effect.gen(function* () {
+    const exists = yield* fs.exists(WSL_OSRELEASE_PATH).pipe(Effect.orElseSucceed(() => false));
+    if (!exists) return false;
+    const content = yield* fs
+      .readFileString(WSL_OSRELEASE_PATH)
+      .pipe(Effect.orElseSucceed(() => ""));
+    return content.includes("WSL") || content.includes("Microsoft");
+  });
+
+const tryKeyringRead = (
+  module: KeyringModule,
+  account: string,
+): Effect.Effect<Option.Option<string>> =>
+  Effect.try({
+    try: () => {
+      const entry = new module.Entry(KEYRING_SERVICE, account);
+      const value = entry.getPassword();
+      return value && value.length > 0 ? Option.some(value) : Option.none<string>();
+    },
+    catch: () => Option.none<string>(),
+  }).pipe(Effect.orElseSucceed(() => Option.none<string>()));
+
+const tryKeyringWrite = (
+  module: KeyringModule,
+  account: string,
+  token: string,
+): Effect.Effect<boolean> =>
+  Effect.try({
+    try: () => {
+      const entry = new module.Entry(KEYRING_SERVICE, account);
+      entry.setPassword(token);
+      return true;
+    },
+    catch: () => false,
+  }).pipe(Effect.orElseSucceed(() => false));
+
+const tryKeyringDelete = (module: KeyringModule, account: string): Effect.Effect<boolean> =>
+  Effect.try({
+    try: () => {
+      const entry = new module.Entry(KEYRING_SERVICE, account);
+      const value = entry.getPassword();
+      if (!value) return false;
+      entry.deleteCredential();
+      return true;
+    },
+    catch: () => false,
+  }).pipe(Effect.orElseSucceed(() => false));
+
+const makeLegacyCredentials = Effect.gen(function* () {
+  const fs = yield* FileSystem.FileSystem;
+  const path = yield* Path.Path;
+  const runtimeInfo = yield* RuntimeInfo;
+  const cliConfig = yield* LegacyCliConfig;
+  const profileAccount = cliConfig.profile;
+
+  // ~/.supabase/access-token — fallback file path
+  const fallbackDir = path.join(runtimeInfo.homeDir, ".supabase");
+  const fallbackPath = path.join(fallbackDir, "access-token");
+
+  const wsl = yield* detectWsl(fs);
+  const keyringModule = wsl
+    ? Option.none<KeyringModule>()
+    : yield* Effect.tryPromise(() => import("@napi-rs/keyring")).pipe(Effect.option);
+
+  const validate = (token: string): Effect.Effect<string, LegacyInvalidAccessTokenError> =>
+    ACCESS_TOKEN_PATTERN.test(token)
+      ? Effect.succeed(token)
+      : Effect.fail(new LegacyInvalidAccessTokenError({ message: INVALID_TOKEN_MESSAGE }));
+
+  const readKeyring = Effect.gen(function* () {
+    if (Option.isNone(keyringModule)) return Option.none<string>();
+    const profileResult = yield* tryKeyringRead(keyringModule.value, profileAccount);
+    if (Option.isSome(profileResult)) return profileResult;
+    return yield* tryKeyringRead(keyringModule.value, LEGACY_KEYRING_ACCOUNT);
+  });
+
+  const readFile = Effect.gen(function* () {
+    const exists = yield* fs.exists(fallbackPath).pipe(Effect.orElseSucceed(() => false));
+    if (!exists) return Option.none<string>();
+    const content = yield* fs.readFileString(fallbackPath).pipe(Effect.orElseSucceed(() => ""));
+    const trimmed = content.trim();
+    return trimmed.length === 0 ? Option.none<string>() : Option.some(trimmed);
+  });
+
+  return LegacyCredentials.of({
+    getAccessToken: Effect.gen(function* () {
+      // Env takes precedence (matches access_token.go:38).
+      if (Option.isSome(cliConfig.accessToken)) {
+        yield* validate(Redacted.value(cliConfig.accessToken.value));
+        return Option.some(cliConfig.accessToken.value);
+      }
+
+      // Keyring (profile key, then legacy key). Skipped on WSL.
+      const keyringValue = yield* readKeyring;
+      if (Option.isSome(keyringValue)) {
+        yield* validate(keyringValue.value);
+        return Option.some(Redacted.make(keyringValue.value));
+      }
+
+      // Filesystem fallback at ~/.supabase/access-token.
+      const fileValue = yield* readFile;
+      if (Option.isSome(fileValue)) {
+        yield* validate(fileValue.value);
+        return Option.some(Redacted.make(fileValue.value));
+      }
+
+      return Option.none();
+    }),
+
+    saveAccessToken: (token: string) =>
+      Effect.gen(function* () {
+        yield* validate(token);
+        if (Option.isSome(keyringModule)) {
+          const ok = yield* tryKeyringWrite(keyringModule.value, profileAccount, token);
+          if (ok) return;
+        }
+        yield* fs.makeDirectory(fallbackDir, { recursive: true, mode: 0o700 }).pipe(Effect.orDie);
+        yield* fs.writeFileString(fallbackPath, token, { mode: 0o600 }).pipe(Effect.orDie);
+      }),
+
+    deleteAccessToken: Effect.gen(function* () {
+      let anyDeleted = false;
+      if (Option.isSome(keyringModule)) {
+        if (yield* tryKeyringDelete(keyringModule.value, profileAccount)) anyDeleted = true;
+        if (yield* tryKeyringDelete(keyringModule.value, LEGACY_KEYRING_ACCOUNT)) anyDeleted = true;
+      }
+      const exists = yield* fs.exists(fallbackPath).pipe(Effect.orElseSucceed(() => false));
+      if (exists) {
+        yield* fs.remove(fallbackPath).pipe(Effect.orDie);
+        anyDeleted = true;
+      }
+      return anyDeleted;
+    }),
+  });
+});
+
+export const legacyCredentialsLayer = Layer.effect(LegacyCredentials, makeLegacyCredentials);
diff --git a/apps/cli/src/legacy/auth/legacy-credentials.layer.unit.test.ts b/apps/cli/src/legacy/auth/legacy-credentials.layer.unit.test.ts
new file mode 100644
index 0000000000..13b1a02866
--- /dev/null
+++ b/apps/cli/src/legacy/auth/legacy-credentials.layer.unit.test.ts
@@ -0,0 +1,230 @@
+import { existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+
+import { describe, expect, it } from "@effect/vitest";
+import { BunServices } from "@effect/platform-bun";
+import { Effect, Layer, Option, Redacted } from "effect";
+import { afterEach, beforeEach, vi } from "vitest";
+
+import { LegacyProfileFlag, LegacyWorkdirFlag } from "../../shared/legacy/global-flags.ts";
+import { mockRuntimeInfo, processEnvLayer } from "../../../tests/helpers/mocks.ts";
+import { legacyCliConfigLayer } from "../config/legacy-cli-config.layer.ts";
+import { legacyCredentialsLayer } from "./legacy-credentials.layer.ts";
+import { LegacyCredentials } from "./legacy-credentials.service.ts";
+import { LegacyInvalidAccessTokenError } from "./legacy-errors.ts";
+
+// ---------------------------------------------------------------------------
+// Keyring mock
+// ---------------------------------------------------------------------------
+
+const passwords = new Map<string, string>();
+let throwOnSetPassword = false;
+const throwOnGetPasswordAccounts = new Set<string>();
+
+vi.mock("@napi-rs/keyring", () => ({
+  Entry: class Entry {
+    service: string;
+    account: string;
+    constructor(service: string, account: string) {
+      this.service = service;
+      this.account = account;
+    }
+    getPassword(): string | null {
+      const key = `${this.service}/${this.account}`;
+      if (throwOnGetPasswordAccounts.has(key)) {
+        throw new Error("Keyring unavailable");
+      }
+      return passwords.get(key) ?? null;
+    }
+    setPassword(value: string): void {
+      if (throwOnSetPassword) throw new Error("Keyring unavailable");
+      passwords.set(`${this.service}/${this.account}`, value);
+    }
+    deleteCredential(): boolean {
+      const key = `${this.service}/${this.account}`;
+      if (!passwords.has(key)) throw new Error("not found");
+      passwords.delete(key);
+      return true;
+    }
+  },
+}));
+
+// ---------------------------------------------------------------------------
+// Layer wiring
+// ---------------------------------------------------------------------------
+
+let tempHome: string;
+
+function makeLayer(opts: { env?: Record<string, string | undefined>; home?: string } = {}) {
+  const home = opts.home ?? tempHome;
+  const env = { HOME: home, ...opts.env };
+  const runtimeInfoLayer = mockRuntimeInfo({ homeDir: home, cwd: home });
+  const cliConfigLayer = legacyCliConfigLayer.pipe(
+    Layer.provide(Layer.succeed(LegacyProfileFlag, "supabase")),
+    Layer.provide(Layer.succeed(LegacyWorkdirFlag, Option.none<string>())),
+    Layer.provide(runtimeInfoLayer),
+    Layer.provide(BunServices.layer),
+    Layer.provide(processEnvLayer(env)),
+  );
+  return legacyCredentialsLayer.pipe(
+    Layer.provide(cliConfigLayer),
+    Layer.provide(runtimeInfoLayer),
+    Layer.provide(BunServices.layer),
+    Layer.provide(processEnvLayer(env)),
+  );
+}
+
+beforeEach(() => {
+  passwords.clear();
+  throwOnSetPassword = false;
+  throwOnGetPasswordAccounts.clear();
+  tempHome = mkdtempSync(join(tmpdir(), "supabase-legacy-creds-"));
+});
+
+afterEach(() => {
+  rmSync(tempHome, { recursive: true, force: true });
+});
+
+const VALID_TOKEN = "sbp_" + "a".repeat(40);
+const VALID_OAUTH_TOKEN = "sbp_oauth_" + "b".repeat(40);
+
+const expectSomeToken = (token: Option.Option<Redacted.Redacted<string>>, expected: string) => {
+  expect(Option.isSome(token)).toBe(true);
+  if (Option.isSome(token)) {
+    expect(Redacted.value(token.value)).toBe(expected);
+  }
+};
+
+describe("legacyCredentialsLayer.getAccessToken", () => {
+  it.effect("returns the SUPABASE_ACCESS_TOKEN env value (highest precedence)", () => {
+    passwords.set("Supabase CLI/supabase", "sbp_" + "9".repeat(40));
+    return Effect.gen(function* () {
+      const { getAccessToken } = yield* LegacyCredentials;
+      const token = yield* getAccessToken;
+      expectSomeToken(token, VALID_TOKEN);
+    }).pipe(Effect.provide(makeLayer({ env: { SUPABASE_ACCESS_TOKEN: VALID_TOKEN } })));
+  });
+
+  it.effect("uses the keyring profile account when env is unset", () => {
+    passwords.set("Supabase CLI/supabase", VALID_TOKEN);
+    return Effect.gen(function* () {
+      const { getAccessToken } = yield* LegacyCredentials;
+      const token = yield* getAccessToken;
+      expectSomeToken(token, VALID_TOKEN);
+    }).pipe(Effect.provide(makeLayer()));
+  });
+
+  it.effect("falls through to the legacy access-token keyring entry", () => {
+    passwords.set("Supabase CLI/access-token", VALID_OAUTH_TOKEN);
+    return Effect.gen(function* () {
+      const { getAccessToken } = yield* LegacyCredentials;
+      const token = yield* getAccessToken;
+      expectSomeToken(token, VALID_OAUTH_TOKEN);
+    }).pipe(Effect.provide(makeLayer()));
+  });
+
+  it.effect("falls back to ~/.supabase/access-token when keyring entries miss", () => {
+    const supaDir = join(tempHome, ".supabase");
+    mkdirSync(supaDir, { recursive: true });
+    writeFileSync(join(supaDir, "access-token"), `${VALID_TOKEN}\n`, { mode: 0o600 });
+    return Effect.gen(function* () {
+      const { getAccessToken } = yield* LegacyCredentials;
+      const token = yield* getAccessToken;
+      expectSomeToken(token, VALID_TOKEN);
+    }).pipe(Effect.provide(makeLayer()));
+  });
+
+  it.effect("returns None when no source provides a token", () =>
+    Effect.gen(function* () {
+      const { getAccessToken } = yield* LegacyCredentials;
+      const token = yield* getAccessToken;
+      expect(token).toEqual(Option.none());
+    }).pipe(Effect.provide(makeLayer())),
+  );
+
+  it.effect("fails with LegacyInvalidAccessTokenError when token format is invalid", () => {
+    passwords.set("Supabase CLI/supabase", "not-a-valid-token");
+    return Effect.gen(function* () {
+      const { getAccessToken } = yield* LegacyCredentials;
+      const exit = yield* Effect.exit(getAccessToken);
+      expect(exit._tag).toBe("Failure");
+      if (exit._tag === "Failure") {
+        const errorJson = JSON.stringify(exit.cause);
+        expect(errorJson).toContain("LegacyInvalidAccessTokenError");
+        expect(errorJson).toContain("Invalid access token format");
+      }
+    }).pipe(Effect.provide(makeLayer()));
+  });
+
+  it.effect("falls back to the filesystem when keyring throws", () => {
+    throwOnGetPasswordAccounts.add("Supabase CLI/supabase");
+    throwOnGetPasswordAccounts.add("Supabase CLI/access-token");
+    const supaDir = join(tempHome, ".supabase");
+    mkdirSync(supaDir, { recursive: true });
+    writeFileSync(join(supaDir, "access-token"), VALID_TOKEN, { mode: 0o600 });
+    return Effect.gen(function* () {
+      const { getAccessToken } = yield* LegacyCredentials;
+      const token = yield* getAccessToken;
+      expectSomeToken(token, VALID_TOKEN);
+    }).pipe(Effect.provide(makeLayer()));
+  });
+});
+
+describe("legacyCredentialsLayer.saveAccessToken", () => {
+  it.effect("rejects invalid token formats up front", () =>
+    Effect.gen(function* () {
+      const { saveAccessToken } = yield* LegacyCredentials;
+      const exit = yield* Effect.exit(saveAccessToken("nope"));
+      expect(exit._tag).toBe("Failure");
+      if (exit._tag === "Failure") {
+        expect(JSON.stringify(exit.cause)).toContain("LegacyInvalidAccessTokenError");
+      }
+    }).pipe(Effect.provide(makeLayer())),
+  );
+
+  it.effect("writes to the keyring profile entry when available", () =>
+    Effect.gen(function* () {
+      const { saveAccessToken } = yield* LegacyCredentials;
+      yield* saveAccessToken(VALID_TOKEN);
+      expect(passwords.get("Supabase CLI/supabase")).toBe(VALID_TOKEN);
+    }).pipe(Effect.provide(makeLayer())),
+  );
+
+  it.effect("falls back to the filesystem when the keyring write throws", () => {
+    throwOnSetPassword = true;
+    return Effect.gen(function* () {
+      const { saveAccessToken } = yield* LegacyCredentials;
+      yield* saveAccessToken(VALID_TOKEN);
+      const content = readFileSync(join(tempHome, ".supabase", "access-token"), "utf-8");
+      expect(content).toBe(VALID_TOKEN);
+    }).pipe(Effect.provide(makeLayer()));
+  });
+});
+
+describe("legacyCredentialsLayer.deleteAccessToken", () => {
+  it.effect("returns false when no token is stored anywhere", () =>
+    Effect.gen(function* () {
+      const { deleteAccessToken } = yield* LegacyCredentials;
+      expect(yield* deleteAccessToken).toBe(false);
+    }).pipe(Effect.provide(makeLayer())),
+  );
+
+  it.effect("removes both keyring entries plus the filesystem file", () => {
+    passwords.set("Supabase CLI/supabase", VALID_TOKEN);
+    passwords.set("Supabase CLI/access-token", VALID_OAUTH_TOKEN);
+    const supaDir = join(tempHome, ".supabase");
+    mkdirSync(supaDir, { recursive: true });
+    writeFileSync(join(supaDir, "access-token"), VALID_TOKEN, { mode: 0o600 });
+    return Effect.gen(function* () {
+      const { deleteAccessToken } = yield* LegacyCredentials;
+      expect(yield* deleteAccessToken).toBe(true);
+      expect(passwords.has("Supabase CLI/supabase")).toBe(false);
+      expect(passwords.has("Supabase CLI/access-token")).toBe(false);
+      expect(existsSync(join(supaDir, "access-token"))).toBe(false);
+    }).pipe(Effect.provide(makeLayer()));
+  });
+});
+
+// Suppress unused-import nag — referenced in JSDoc.
+void LegacyInvalidAccessTokenError;
diff --git a/apps/cli/src/legacy/auth/legacy-credentials.service.ts b/apps/cli/src/legacy/auth/legacy-credentials.service.ts
new file mode 100644
index 0000000000..911b0f07d5
--- /dev/null
+++ b/apps/cli/src/legacy/auth/legacy-credentials.service.ts
@@ -0,0 +1,17 @@
+import type { Effect, Option, Redacted } from "effect";
+import { Context } from "effect";
+
+import type { LegacyInvalidAccessTokenError } from "./legacy-errors.ts";
+
+interface LegacyCredentialsShape {
+  readonly getAccessToken: Effect.Effect<
+    Option.Option<Redacted.Redacted<string>>,
+    LegacyInvalidAccessTokenError
+  >;
+  readonly saveAccessToken: (token: string) => Effect.Effect<void, LegacyInvalidAccessTokenError>;
+  readonly deleteAccessToken: Effect.Effect<boolean>;
+}
+
+export class LegacyCredentials extends Context.Service<LegacyCredentials, LegacyCredentialsShape>()(
+  "supabase/legacy/Credentials",
+) {}
diff --git a/apps/cli/src/legacy/auth/legacy-errors.ts b/apps/cli/src/legacy/auth/legacy-errors.ts
new file mode 100644
index 0000000000..ab5c936940
--- /dev/null
+++ b/apps/cli/src/legacy/auth/legacy-errors.ts
@@ -0,0 +1,13 @@
+import { Data } from "effect";
+
+export class LegacyInvalidAccessTokenError extends Data.TaggedError(
+  "LegacyInvalidAccessTokenError",
+)<{
+  readonly message: string;
+}> {}
+
+export class LegacyPlatformAuthRequiredError extends Data.TaggedError(
+  "LegacyPlatformAuthRequiredError",
+)<{
+  readonly message: string;
+}> {}
diff --git a/apps/cli/src/legacy/auth/legacy-http-debug.layer.ts b/apps/cli/src/legacy/auth/legacy-http-debug.layer.ts
new file mode 100644
index 0000000000..cd1ec08c50
--- /dev/null
+++ b/apps/cli/src/legacy/auth/legacy-http-debug.layer.ts
@@ -0,0 +1,43 @@
+import { Effect, Layer } from "effect";
+import { FetchHttpClient } from "effect/unstable/http";
+import * as HttpClient from "effect/unstable/http/HttpClient";
+
+import { LegacyDebugFlag } from "../../shared/legacy/global-flags.ts";
+
+const pad = (n: number): string => String(n).padStart(2, "0");
+
+/** Formats a timestamp matching Go's `log.LstdFlags`: `YYYY/MM/DD HH:MM:SS`. */
+function formatTimestamp(now: Date): string {
+  return (
+    `${now.getFullYear()}/${pad(now.getMonth() + 1)}/${pad(now.getDate())} ` +
+    `${pad(now.getHours())}:${pad(now.getMinutes())}:${pad(now.getSeconds())}`
+  );
+}
+
+/**
+ * Wraps `FetchHttpClient.layer` so that, when `--debug` is set, every HTTP
+ * request is logged to stderr in the exact format Go uses
+ * (`apps/cli-go/internal/debug/http.go`): `HTTP <YYYY/MM/DD HH:MM:SS> <METHOD>: <URL>\n`.
+ *
+ * When `--debug` is unset, this is identity over `FetchHttpClient.layer` — no
+ * runtime overhead beyond a single boolean check at layer-construction time.
+ */
+export const legacyHttpClientLayer = Layer.unwrap(
+  Effect.gen(function* () {
+    const debug = yield* LegacyDebugFlag;
+    if (!debug) {
+      return FetchHttpClient.layer;
+    }
+
+    return Layer.effect(
+      HttpClient.HttpClient,
+      Effect.gen(function* () {
+        const base = yield* HttpClient.HttpClient;
+        return HttpClient.mapRequest(base, (req) => {
+          process.stderr.write(`HTTP ${formatTimestamp(new Date())} ${req.method}: ${req.url}\n`);
+          return req;
+        });
+      }),
+    ).pipe(Layer.provide(FetchHttpClient.layer));
+  }),
+);
diff --git a/apps/cli/src/legacy/auth/legacy-platform-api.layer.ts b/apps/cli/src/legacy/auth/legacy-platform-api.layer.ts
new file mode 100644
index 0000000000..ff16c8afcf
--- /dev/null
+++ b/apps/cli/src/legacy/auth/legacy-platform-api.layer.ts
@@ -0,0 +1,154 @@
+import { makeApiClient } from "@supabase/api/effect";
+import { Effect, FileSystem, Layer, Option, Path } from "effect";
+import * as HttpClient from "effect/unstable/http/HttpClient";
+import type * as HttpClientResponse from "effect/unstable/http/HttpClientResponse";
+
+import { LegacyCliConfig } from "../config/legacy-cli-config.service.ts";
+import { Analytics } from "../../shared/telemetry/analytics.service.ts";
+import { TelemetryRuntime } from "../../shared/telemetry/runtime.service.ts";
+import { LegacyCredentials } from "./legacy-credentials.service.ts";
+import { LegacyPlatformAuthRequiredError } from "./legacy-errors.ts";
+import { LegacyPlatformApi } from "./legacy-platform-api.service.ts";
+
+const MISSING_TOKEN_MESSAGE =
+  "Access token not provided. Supply an access token by running `supabase login` or setting the SUPABASE_ACCESS_TOKEN environment variable.";
+
+const HEADER_GOTRUE_ID = "x-gotrue-id";
+const TELEMETRY_SCHEMA_VERSION = 1;
+
+interface LegacyTelemetryState {
+  readonly enabled: boolean;
+  readonly device_id: string;
+  readonly session_id: string;
+  readonly session_last_active: string;
+  readonly distinct_id: string;
+  readonly schema_version: number;
+}
+
+function gotrueIdFromResponse(response: HttpClientResponse.HttpClientResponse): string | undefined {
+  const value = response.headers[HEADER_GOTRUE_ID] ?? response.headers["X-Gotrue-Id"];
+  if (value === undefined) return undefined;
+  const trimmed = value.trim();
+  return trimmed.length === 0 ? undefined : trimmed;
+}
+
+function fieldValue(value: unknown, key: string): unknown {
+  if (typeof value !== "object" || value === null) return undefined;
+  return Reflect.get(value, key);
+}
+
+function stringField(value: unknown, key: string): string | undefined {
+  const field = fieldValue(value, key);
+  return typeof field === "string" && field.length > 0 ? field : undefined;
+}
+
+function boolField(value: unknown, key: string): boolean | undefined {
+  const field = fieldValue(value, key);
+  return typeof field === "boolean" ? field : undefined;
+}
+
+function numberField(value: unknown, key: string): number | undefined {
+  const field = fieldValue(value, key);
+  return typeof field === "number" && Number.isFinite(field) ? field : undefined;
+}
+
+function isEphemeralIdentityRuntime(runtime: {
+  readonly isCi: boolean;
+  readonly isFirstRun: boolean;
+  readonly isTty: boolean;
+}) {
+  return runtime.isCi || (runtime.isFirstRun && !runtime.isTty);
+}
+
+const makeLegacyPlatformApiServices = Effect.gen(function* () {
+  const cliConfig = yield* LegacyCliConfig;
+  const credentials = yield* LegacyCredentials;
+  const analytics = yield* Analytics;
+  const runtime = yield* TelemetryRuntime;
+  const fs = yield* FileSystem.FileSystem;
+  const path = yield* Path.Path;
+  let stitchAttempted = false;
+
+  const needsIdentityStitch =
+    runtime.consent === "granted" &&
+    !isEphemeralIdentityRuntime(runtime) &&
+    (runtime.distinctId === undefined || runtime.distinctId.length === 0);
+
+  const stitchIdentity = (gotrueId: string) =>
+    Effect.gen(function* () {
+      if (!needsIdentityStitch || stitchAttempted) return;
+
+      const telemetryPath = path.join(runtime.configDir, "telemetry.json");
+      const existing = yield* fs.readFileString(telemetryPath).pipe(Effect.option);
+      const prior = Option.match(existing, {
+        onNone: () => undefined,
+        onSome: (content) => {
+          try {
+            const parsed: unknown = JSON.parse(content);
+            return parsed;
+          } catch {
+            return undefined;
+          }
+        },
+      });
+      const enabled = boolField(prior, "enabled") ?? true;
+      if (!enabled) return;
+
+      stitchAttempted = true;
+
+      yield* analytics.alias(gotrueId, runtime.deviceId);
+      yield* analytics.identify(gotrueId);
+
+      const state: LegacyTelemetryState = {
+        enabled,
+        device_id: stringField(prior, "device_id") ?? runtime.deviceId,
+        session_id: stringField(prior, "session_id") ?? runtime.sessionId,
+        session_last_active: new Date().toISOString(),
+        distinct_id: gotrueId,
+        schema_version: numberField(prior, "schema_version") ?? TELEMETRY_SCHEMA_VERSION,
+      };
+
+      yield* fs.makeDirectory(runtime.configDir, { recursive: true });
+      yield* fs.writeFileString(telemetryPath, JSON.stringify(state));
+    });
+
+  const transformClient = (client: HttpClient.HttpClient) =>
+    Effect.succeed(
+      HttpClient.transform(client, (requestEffect) =>
+        requestEffect.pipe(
+          Effect.tap((response) => {
+            const gotrueId = gotrueIdFromResponse(response);
+            if (gotrueId === undefined) return Effect.void;
+            return stitchIdentity(gotrueId).pipe(Effect.exit, Effect.asVoid);
+          }),
+        ),
+      ),
+    );
+
+  // Env takes precedence over keyring/file (already inside LegacyCredentials), but
+  // LegacyCliConfig.accessToken is the env value alone — read in the same order Go uses.
+  const configuredToken = cliConfig.accessToken;
+  const storedToken = Option.isSome(configuredToken)
+    ? configuredToken
+    : yield* credentials.getAccessToken;
+
+  if (Option.isNone(storedToken)) {
+    return yield* Effect.fail(
+      new LegacyPlatformAuthRequiredError({ message: MISSING_TOKEN_MESSAGE }),
+    );
+  }
+
+  const api = yield* makeApiClient(
+    {
+      baseUrl: cliConfig.apiUrl,
+      accessToken: storedToken.value,
+      userAgent: cliConfig.userAgent,
+    },
+    {
+      transformClient,
+    },
+  );
+  return Layer.succeed(LegacyPlatformApi, api);
+});
+
+export const legacyPlatformApiLayer = Layer.unwrap(makeLegacyPlatformApiServices);
diff --git a/apps/cli/src/legacy/auth/legacy-platform-api.layer.unit.test.ts b/apps/cli/src/legacy/auth/legacy-platform-api.layer.unit.test.ts
new file mode 100644
index 0000000000..1047501322
--- /dev/null
+++ b/apps/cli/src/legacy/auth/legacy-platform-api.layer.unit.test.ts
@@ -0,0 +1,436 @@
+import { describe, expect, it } from "@effect/vitest";
+import { Effect, Exit, FileSystem, Layer, Option, Path, Redacted } from "effect";
+import * as HttpClient from "effect/unstable/http/HttpClient";
+import * as HttpClientResponse from "effect/unstable/http/HttpClientResponse";
+import type * as HttpClientRequest from "effect/unstable/http/HttpClientRequest";
+import { existsSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { access, mkdir, readFile, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import path from "node:path";
+
+import { Analytics } from "../../shared/telemetry/analytics.service.ts";
+import { TelemetryRuntime } from "../../shared/telemetry/runtime.service.ts";
+import { LegacyCliConfig } from "../config/legacy-cli-config.service.ts";
+import { LegacyCredentials } from "./legacy-credentials.service.ts";
+import { legacyPlatformApiLayer } from "./legacy-platform-api.layer.ts";
+import { LegacyPlatformApi } from "./legacy-platform-api.service.ts";
+
+const VALID_TOKEN = "sbp_" + "a".repeat(40);
+const SESSION_LAST_ACTIVE = 1_777_200_000_000;
+
+function mockCliConfig(opts: { accessToken?: string; apiUrl?: string; userAgent?: string }) {
+  return Layer.succeed(LegacyCliConfig, {
+    profile: "supabase",
+    apiUrl: opts.apiUrl ?? "https://api.supabase.com",
+    accessToken:
+      opts.accessToken === undefined ? Option.none() : Option.some(Redacted.make(opts.accessToken)),
+    projectId: Option.none(),
+    workdir: "/tmp",
+    userAgent: opts.userAgent ?? "SupabaseCLI/0.0.0-dev",
+  });
+}
+
+function mockCredentials(token: Option.Option<string>) {
+  return Layer.succeed(LegacyCredentials, {
+    getAccessToken: Effect.succeed(Option.map(token, Redacted.make)),
+    saveAccessToken: () => Effect.void,
+    deleteAccessToken: Effect.succeed(false),
+  });
+}
+
+function mockTelemetryRuntime(
+  opts: {
+    configDir?: string;
+    deviceId?: string;
+    distinctId?: string;
+    isFirstRun?: boolean;
+    isTty?: boolean;
+    isCi?: boolean;
+  } = {},
+) {
+  return Layer.succeed(
+    TelemetryRuntime,
+    TelemetryRuntime.of({
+      configDir: opts.configDir ?? "/tmp/supabase-cli-test-home",
+      tracesDir: path.join(opts.configDir ?? "/tmp/supabase-cli-test-home", "traces"),
+      consent: "granted",
+      showDebug: false,
+      deviceId: opts.deviceId ?? "device-123",
+      sessionId: "session-123",
+      ...(opts.distinctId === undefined ? {} : { distinctId: opts.distinctId }),
+      isFirstRun: opts.isFirstRun ?? false,
+      isTty: opts.isTty ?? false,
+      isCi: opts.isCi ?? false,
+      os: "darwin",
+      arch: "arm64",
+      cliVersion: "0.0.0-test",
+    }),
+  );
+}
+
+function mockAnalytics() {
+  const aliases: Array<{ distinctId: string; alias: string }> = [];
+  const identifies: Array<{ distinctId: string; properties: Record<string, unknown> }> = [];
+
+  const layer = Layer.succeed(
+    Analytics,
+    Analytics.of({
+      capture: () => Effect.void,
+      identify: (distinctId, properties = {}) =>
+        Effect.sync(() => {
+          identifies.push({ distinctId, properties });
+        }),
+      alias: (distinctId, alias) =>
+        Effect.sync(() => {
+          aliases.push({ distinctId, alias });
+        }),
+      groupIdentify: () => Effect.void,
+    }),
+  );
+
+  return { layer, aliases, identifies };
+}
+
+function nodeFileSystemLayer() {
+  return Layer.succeed(FileSystem.FileSystem, {
+    [FileSystem.FileSystem.key]: FileSystem.FileSystem.key,
+    exists: (filePath: string) =>
+      Effect.tryPromise(() =>
+        access(filePath)
+          .then(() => true)
+          .catch(() => false),
+      ),
+    makeDirectory: (dirPath: string, opts?: { recursive?: boolean; mode?: number }) =>
+      Effect.tryPromise(() =>
+        mkdir(dirPath, { recursive: opts?.recursive, mode: opts?.mode }).then(() => undefined),
+      ),
+    readFileString: (filePath: string) => Effect.tryPromise(() => readFile(filePath, "utf8")),
+    writeFileString: (filePath: string, content: string, opts?: { mode?: number }) =>
+      Effect.tryPromise(() => writeFile(filePath, content, { mode: opts?.mode })),
+  } as unknown as FileSystem.FileSystem);
+}
+
+function nodePathLayer() {
+  return Layer.succeed(Path.Path, {
+    [Path.Path.key]: Path.Path.key,
+    ...path,
+  } as unknown as Path.Path);
+}
+
+function tempTelemetryConfig(opts: { distinctId?: string; enabled?: boolean } = {}) {
+  const dir = mkdtempSync(path.join(tmpdir(), "supabase-legacy-platform-api-"));
+  writeFileSync(
+    path.join(dir, "telemetry.json"),
+    JSON.stringify({
+      enabled: opts.enabled ?? true,
+      device_id: "device-123",
+      session_id: "session-123",
+      session_last_active: new Date(SESSION_LAST_ACTIVE).toISOString(),
+      ...(opts.distinctId === undefined ? {} : { distinct_id: opts.distinctId }),
+      schema_version: 1,
+    }),
+  );
+  return dir;
+}
+
+function readTelemetryConfig(configDir: string) {
+  return JSON.parse(readFileSync(path.join(configDir, "telemetry.json"), "utf8")) as {
+    enabled?: boolean;
+    distinct_id?: string;
+    schema_version?: number;
+  };
+}
+
+function withBaseDeps(
+  opts: {
+    analytics?: ReturnType<typeof mockAnalytics>;
+    configDir?: string;
+    distinctId?: string;
+    isFirstRun?: boolean;
+    isTty?: boolean;
+    isCi?: boolean;
+  } = {},
+) {
+  const analytics = opts.analytics ?? mockAnalytics();
+  return <ROut, E, RIn>(layer: Layer.Layer<ROut, E, RIn>) =>
+    layer.pipe(
+      Layer.provide(analytics.layer),
+      Layer.provide(
+        mockTelemetryRuntime({
+          configDir: opts.configDir,
+          distinctId: opts.distinctId,
+          isFirstRun: opts.isFirstRun,
+          isTty: opts.isTty,
+          isCi: opts.isCi,
+        }),
+      ),
+      Layer.provide(nodeFileSystemLayer()),
+      Layer.provide(nodePathLayer()),
+    );
+}
+
+function captureRequests(responseHeaders: Record<string, string> = {}) {
+  const requests: Array<{
+    url: string;
+    headers: Readonly<Record<string, string | undefined>>;
+  }> = [];
+  const httpClient = HttpClient.make((request: HttpClientRequest.HttpClientRequest) => {
+    requests.push({ url: request.url, headers: request.headers });
+    return Effect.succeed(
+      HttpClientResponse.fromWeb(
+        request,
+        new Response(JSON.stringify([]), {
+          status: 200,
+          headers: { "content-type": "application/json", ...responseHeaders },
+        }),
+      ),
+    );
+  });
+  return { layer: Layer.succeed(HttpClient.HttpClient, httpClient), requests };
+}
+
+describe("legacyPlatformApiLayer", () => {
+  it.effect("uses env access token over keyring-stored token", () => {
+    const http = captureRequests();
+    const layer = legacyPlatformApiLayer.pipe(
+      Layer.provide(mockCliConfig({ accessToken: VALID_TOKEN })),
+      Layer.provide(mockCredentials(Option.some("sbp_" + "9".repeat(40)))),
+      Layer.provide(http.layer),
+      withBaseDeps(),
+    );
+    return Effect.gen(function* () {
+      const api = yield* LegacyPlatformApi;
+      yield* api.v1.listAllProjects();
+      expect(http.requests).toHaveLength(1);
+      expect(http.requests[0]?.headers.authorization).toBe(`Bearer ${VALID_TOKEN}`);
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.effect("uses LegacyCredentials.getAccessToken when env is unset", () => {
+    const http = captureRequests();
+    const layer = legacyPlatformApiLayer.pipe(
+      Layer.provide(mockCliConfig({})),
+      Layer.provide(mockCredentials(Option.some(VALID_TOKEN))),
+      Layer.provide(http.layer),
+      withBaseDeps(),
+    );
+    return Effect.gen(function* () {
+      const api = yield* LegacyPlatformApi;
+      yield* api.v1.listAllProjects();
+      expect(http.requests[0]?.headers.authorization).toBe(`Bearer ${VALID_TOKEN}`);
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.effect("fails with LegacyPlatformAuthRequiredError when no token is configured", () => {
+    const http = captureRequests();
+    const layer = legacyPlatformApiLayer.pipe(
+      Layer.provide(mockCliConfig({})),
+      Layer.provide(mockCredentials(Option.none())),
+      Layer.provide(http.layer),
+      withBaseDeps(),
+    );
+    return Effect.gen(function* () {
+      const exit = yield* Effect.exit(
+        Effect.gen(function* () {
+          const api = yield* LegacyPlatformApi;
+          return yield* api.v1.listAllProjects();
+        }).pipe(Effect.provide(layer)),
+      );
+      expect(Exit.isFailure(exit)).toBe(true);
+      if (Exit.isFailure(exit)) {
+        const errorJson = JSON.stringify(exit.cause);
+        expect(errorJson).toContain("LegacyPlatformAuthRequiredError");
+        expect(errorJson).toContain("Access token not provided");
+      }
+    });
+  });
+
+  it.effect("sends Go-style User-Agent and no X-Supabase-Command headers", () => {
+    const http = captureRequests();
+    const layer = legacyPlatformApiLayer.pipe(
+      Layer.provide(mockCliConfig({ accessToken: VALID_TOKEN, userAgent: "SupabaseCLI/1.123.4" })),
+      Layer.provide(mockCredentials(Option.none())),
+      Layer.provide(http.layer),
+      withBaseDeps(),
+    );
+    return Effect.gen(function* () {
+      const api = yield* LegacyPlatformApi;
+      yield* api.v1.listAllProjects();
+      expect(http.requests[0]?.headers["user-agent"]).toBe("SupabaseCLI/1.123.4");
+      expect(http.requests[0]?.headers["x-supabase-command"]).toBeUndefined();
+      expect(http.requests[0]?.headers["x-supabase-command-run-id"]).toBeUndefined();
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.effect("targets the configured apiUrl rather than SUPABASE_API_URL env", () => {
+    const http = captureRequests();
+    const layer = legacyPlatformApiLayer.pipe(
+      Layer.provide(
+        mockCliConfig({ accessToken: VALID_TOKEN, apiUrl: "https://api.supabase.green" }),
+      ),
+      Layer.provide(mockCredentials(Option.none())),
+      Layer.provide(http.layer),
+      withBaseDeps(),
+    );
+    return Effect.gen(function* () {
+      const api = yield* LegacyPlatformApi;
+      yield* api.v1.listAllProjects();
+      expect(http.requests[0]?.url).toContain("https://api.supabase.green/");
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.effect("stitches identity from X-Gotrue-Id responses outside CI", () => {
+    const configDir = tempTelemetryConfig();
+    const analytics = mockAnalytics();
+    const http = captureRequests({ "X-Gotrue-Id": "user-123" });
+    const layer = legacyPlatformApiLayer.pipe(
+      Layer.provide(mockCliConfig({ accessToken: VALID_TOKEN })),
+      Layer.provide(mockCredentials(Option.none())),
+      Layer.provide(http.layer),
+      withBaseDeps({ analytics, configDir }),
+    );
+
+    return Effect.gen(function* () {
+      try {
+        const api = yield* LegacyPlatformApi;
+        yield* api.v1.listAllProjects();
+
+        expect(analytics.aliases).toEqual([{ distinctId: "user-123", alias: "device-123" }]);
+        expect(analytics.identifies).toEqual([{ distinctId: "user-123", properties: {} }]);
+        const telemetry = readTelemetryConfig(configDir);
+        expect(telemetry.distinct_id).toBe("user-123");
+        expect(telemetry.enabled).toBe(true);
+        expect(telemetry.schema_version).toBe(1);
+      } finally {
+        rmSync(configDir, { recursive: true, force: true });
+      }
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.effect("does not stitch identity from X-Gotrue-Id responses in CI", () => {
+    const configDir = tempTelemetryConfig();
+    const analytics = mockAnalytics();
+    const http = captureRequests({ "X-Gotrue-Id": "user-123" });
+    const layer = legacyPlatformApiLayer.pipe(
+      Layer.provide(mockCliConfig({ accessToken: VALID_TOKEN })),
+      Layer.provide(mockCredentials(Option.none())),
+      Layer.provide(http.layer),
+      withBaseDeps({ analytics, configDir, isCi: true }),
+    );
+
+    return Effect.gen(function* () {
+      try {
+        const api = yield* LegacyPlatformApi;
+        yield* api.v1.listAllProjects();
+
+        expect(analytics.aliases).toEqual([]);
+        expect(analytics.identifies).toEqual([]);
+        expect(readTelemetryConfig(configDir).distinct_id).toBeUndefined();
+      } finally {
+        rmSync(configDir, { recursive: true, force: true });
+      }
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.effect("does not stitch identity in a first-run non-TTY runtime", () => {
+    const configDir = mkdtempSync(path.join(tmpdir(), "supabase-legacy-platform-api-"));
+    const analytics = mockAnalytics();
+    const http = captureRequests({ "X-Gotrue-Id": "user-123" });
+    const layer = legacyPlatformApiLayer.pipe(
+      Layer.provide(mockCliConfig({ accessToken: VALID_TOKEN })),
+      Layer.provide(mockCredentials(Option.none())),
+      Layer.provide(http.layer),
+      withBaseDeps({ analytics, configDir, isFirstRun: true, isTty: false }),
+    );
+
+    return Effect.gen(function* () {
+      try {
+        const api = yield* LegacyPlatformApi;
+        yield* api.v1.listAllProjects();
+
+        expect(analytics.aliases).toEqual([]);
+        expect(analytics.identifies).toEqual([]);
+        expect(existsSync(path.join(configDir, "telemetry.json"))).toBe(false);
+      } finally {
+        rmSync(configDir, { recursive: true, force: true });
+      }
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.effect("stitches identity in a first-run TTY runtime", () => {
+    const configDir = mkdtempSync(path.join(tmpdir(), "supabase-legacy-platform-api-"));
+    const analytics = mockAnalytics();
+    const http = captureRequests({ "X-Gotrue-Id": "user-123" });
+    const layer = legacyPlatformApiLayer.pipe(
+      Layer.provide(mockCliConfig({ accessToken: VALID_TOKEN })),
+      Layer.provide(mockCredentials(Option.none())),
+      Layer.provide(http.layer),
+      withBaseDeps({ analytics, configDir, isFirstRun: true, isTty: true }),
+    );
+
+    return Effect.gen(function* () {
+      try {
+        const api = yield* LegacyPlatformApi;
+        yield* api.v1.listAllProjects();
+
+        expect(analytics.aliases).toEqual([{ distinctId: "user-123", alias: "device-123" }]);
+        expect(analytics.identifies).toEqual([{ distinctId: "user-123", properties: {} }]);
+        expect(readTelemetryConfig(configDir).distinct_id).toBe("user-123");
+      } finally {
+        rmSync(configDir, { recursive: true, force: true });
+      }
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.effect("does not stitch identity when a distinct_id is already known", () => {
+    const configDir = tempTelemetryConfig({ distinctId: "existing-user" });
+    const analytics = mockAnalytics();
+    const http = captureRequests({ "X-Gotrue-Id": "user-123" });
+    const layer = legacyPlatformApiLayer.pipe(
+      Layer.provide(mockCliConfig({ accessToken: VALID_TOKEN })),
+      Layer.provide(mockCredentials(Option.none())),
+      Layer.provide(http.layer),
+      withBaseDeps({ analytics, configDir, distinctId: "existing-user" }),
+    );
+
+    return Effect.gen(function* () {
+      try {
+        const api = yield* LegacyPlatformApi;
+        yield* api.v1.listAllProjects();
+
+        expect(analytics.aliases).toEqual([]);
+        expect(analytics.identifies).toEqual([]);
+        expect(readTelemetryConfig(configDir).distinct_id).toBe("existing-user");
+      } finally {
+        rmSync(configDir, { recursive: true, force: true });
+      }
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.effect("does not stitch identity when legacy telemetry state is disabled", () => {
+    const configDir = tempTelemetryConfig({ enabled: false });
+    const analytics = mockAnalytics();
+    const http = captureRequests({ "X-Gotrue-Id": "user-123" });
+    const layer = legacyPlatformApiLayer.pipe(
+      Layer.provide(mockCliConfig({ accessToken: VALID_TOKEN })),
+      Layer.provide(mockCredentials(Option.none())),
+      Layer.provide(http.layer),
+      withBaseDeps({ analytics, configDir }),
+    );
+
+    return Effect.gen(function* () {
+      try {
+        const api = yield* LegacyPlatformApi;
+        yield* api.v1.listAllProjects();
+
+        expect(analytics.aliases).toEqual([]);
+        expect(analytics.identifies).toEqual([]);
+        const telemetry = readTelemetryConfig(configDir);
+        expect(telemetry.enabled).toBe(false);
+        expect(telemetry.distinct_id).toBeUndefined();
+      } finally {
+        rmSync(configDir, { recursive: true, force: true });
+      }
+    }).pipe(Effect.provide(layer));
+  });
+});
diff --git a/apps/cli/src/legacy/auth/legacy-platform-api.service.ts b/apps/cli/src/legacy/auth/legacy-platform-api.service.ts
new file mode 100644
index 0000000000..6631afa1e0
--- /dev/null
+++ b/apps/cli/src/legacy/auth/legacy-platform-api.service.ts
@@ -0,0 +1,6 @@
+import type { ApiClient } from "@supabase/api/effect";
+import { Context } from "effect";
+
+export class LegacyPlatformApi extends Context.Service<LegacyPlatformApi, ApiClient>()(
+  "supabase/legacy/PlatformApi",
+) {}
diff --git a/apps/cli/src/legacy/cli/complete-passthrough.ts b/apps/cli/src/legacy/cli/complete-passthrough.ts
new file mode 100644
index 0000000000..59d4d27947
--- /dev/null
+++ b/apps/cli/src/legacy/cli/complete-passthrough.ts
@@ -0,0 +1,60 @@
+import { spawnSync, type SpawnSyncReturns } from "node:child_process";
+import process from "node:process";
+import {
+  type BinaryResolution,
+  formatGoBinaryNotFoundError,
+  resolveBinary,
+} from "../../shared/legacy/go-proxy.layer.ts";
+
+export interface CompletePassthroughDeps {
+  readonly argv: ReadonlyArray<string>;
+  readonly resolveBinary: () => BinaryResolution;
+  readonly spawn: (cmd: string, args: ReadonlyArray<string>) => SpawnSyncReturns<Buffer>;
+  readonly stderrWrite: (message: string) => void;
+  readonly exit: (code: number) => void;
+}
+
+/**
+ * Cobra-generated completion scripts (`supabase completion {bash,zsh,fish,powershell}`)
+ * call back into `supabase __complete <args>` on every tab press. The args may
+ * include partial flag tokens (e.g. `--de` while the user is mid-completion of a
+ * flag name) that Effect's structured parser would reject. Bypass Effect entirely
+ * for this code path and proxy the raw argv to the bundled Go binary, which is
+ * the authority on completion behavior for the legacy shell.
+ *
+ * Returns `true` when the call was intercepted (caller must not continue), `false`
+ * otherwise.
+ */
+export function tryCompletePassthrough(deps: CompletePassthroughDeps): boolean {
+  if (deps.argv[0] !== "__complete") return false;
+
+  const resolved = deps.resolveBinary();
+  if (!("found" in resolved)) {
+    deps.stderrWrite(`${formatGoBinaryNotFoundError(resolved.notFound)}\n`);
+    deps.exit(1);
+    return true;
+  }
+
+  const result = deps.spawn(resolved.found, deps.argv);
+  if (result.error) {
+    deps.stderrWrite(`${result.error.message}\n`);
+    deps.exit(1);
+    return true;
+  }
+  deps.exit(result.status ?? 1);
+  return true;
+}
+
+export function defaultCompletePassthroughDeps(): CompletePassthroughDeps {
+  return {
+    argv: process.argv.slice(2),
+    resolveBinary,
+    spawn: (cmd, args) => spawnSync(cmd, [...args], { stdio: "inherit" }),
+    stderrWrite: (message) => {
+      process.stderr.write(message);
+    },
+    exit: (code) => {
+      process.exit(code);
+    },
+  };
+}
diff --git a/apps/cli/src/legacy/cli/complete-passthrough.unit.test.ts b/apps/cli/src/legacy/cli/complete-passthrough.unit.test.ts
new file mode 100644
index 0000000000..0e5f7c4801
--- /dev/null
+++ b/apps/cli/src/legacy/cli/complete-passthrough.unit.test.ts
@@ -0,0 +1,103 @@
+import type { SpawnSyncReturns } from "node:child_process";
+import { describe, expect, it, vi } from "vitest";
+import { type BinaryResolution } from "../../shared/legacy/go-proxy.layer.ts";
+import { type CompletePassthroughDeps, tryCompletePassthrough } from "./complete-passthrough.ts";
+
+function spawnResult(status: number | null, error?: Error): SpawnSyncReturns<Buffer> {
+  return {
+    pid: 1,
+    output: [],
+    stdout: Buffer.alloc(0),
+    stderr: Buffer.alloc(0),
+    status,
+    signal: null,
+    error,
+  };
+}
+
+function makeDeps(overrides: Partial<CompletePassthroughDeps> = {}): {
+  deps: CompletePassthroughDeps;
+  spawnCalls: Array<{ cmd: string; args: ReadonlyArray<string> }>;
+  stderr: Array<string>;
+  exits: Array<number>;
+} {
+  const spawnCalls: Array<{ cmd: string; args: ReadonlyArray<string> }> = [];
+  const stderr: Array<string> = [];
+  const exits: Array<number> = [];
+  const deps: CompletePassthroughDeps = {
+    argv: ["__complete", "migration", "li"],
+    resolveBinary: (): BinaryResolution => ({ found: "/path/to/supabase-go" }),
+    spawn: (cmd, args) => {
+      spawnCalls.push({ cmd, args });
+      return spawnResult(0);
+    },
+    stderrWrite: (msg) => {
+      stderr.push(msg);
+    },
+    exit: (code) => {
+      exits.push(code);
+    },
+    ...overrides,
+  };
+  return { deps, spawnCalls, stderr, exits };
+}
+
+describe("tryCompletePassthrough", () => {
+  it("returns false and does nothing when first argv is not __complete", () => {
+    const { deps, spawnCalls, exits } = makeDeps({ argv: ["migration", "list"] });
+    expect(tryCompletePassthrough(deps)).toBe(false);
+    expect(spawnCalls).toEqual([]);
+    expect(exits).toEqual([]);
+  });
+
+  it("returns false on empty argv (e.g. bare `supabase`)", () => {
+    const { deps, spawnCalls, exits } = makeDeps({ argv: [] });
+    expect(tryCompletePassthrough(deps)).toBe(false);
+    expect(spawnCalls).toEqual([]);
+    expect(exits).toEqual([]);
+  });
+
+  it("forwards verbatim argv (including flag-like tokens) to the Go binary on __complete", () => {
+    const { deps, spawnCalls, exits } = makeDeps({
+      argv: ["__complete", "--debug", "migration", "--de"],
+    });
+    expect(tryCompletePassthrough(deps)).toBe(true);
+    expect(spawnCalls).toEqual([
+      { cmd: "/path/to/supabase-go", args: ["__complete", "--debug", "migration", "--de"] },
+    ]);
+    expect(exits).toEqual([0]);
+  });
+
+  it("propagates the child's non-zero exit code", () => {
+    const spawn = vi.fn(() => spawnResult(7));
+    const { deps, exits } = makeDeps({ spawn });
+    tryCompletePassthrough(deps);
+    expect(exits).toEqual([7]);
+  });
+
+  it("exits 1 when the child has a null status (e.g. signal-terminated)", () => {
+    const spawn = vi.fn(() => spawnResult(null));
+    const { deps, exits } = makeDeps({ spawn });
+    tryCompletePassthrough(deps);
+    expect(exits).toEqual([1]);
+  });
+
+  it("prints the diagnostic and exits 1 when the Go binary cannot be resolved", () => {
+    const { deps, spawnCalls, stderr, exits } = makeDeps({
+      resolveBinary: () => ({ notFound: ["a", "b"] }),
+    });
+    tryCompletePassthrough(deps);
+    expect(spawnCalls).toEqual([]);
+    expect(exits).toEqual([1]);
+    expect(stderr).toHaveLength(1);
+    expect(stderr[0]).toContain("Could not find the `supabase-go` binary.");
+  });
+
+  it("prints the spawn error and exits 1 when spawnSync surfaces an error", () => {
+    const spawn = vi.fn(() => spawnResult(0, new Error("ENOENT")));
+    const { deps, stderr, exits } = makeDeps({ spawn });
+    tryCompletePassthrough(deps);
+    expect(exits).toEqual([1]);
+    expect(stderr).toEqual(["ENOENT\n"]);
+  });
+});
diff --git a/apps/cli/src/legacy/cli/main.ts b/apps/cli/src/legacy/cli/main.ts
index d5d1dc54fc..1866084cdc 100644
--- a/apps/cli/src/legacy/cli/main.ts
+++ b/apps/cli/src/legacy/cli/main.ts
@@ -1,5 +1,9 @@
 #!/usr/bin/env bun
 import { runCli } from "../../shared/cli/run.ts";
+import { legacyAnalyticsLayer } from "../telemetry/legacy-analytics.layer.ts";
+import { defaultCompletePassthroughDeps, tryCompletePassthrough } from "./complete-passthrough.ts";
 import { legacyRoot } from "./root.ts";
 
-await runCli(legacyRoot);
+if (!tryCompletePassthrough(defaultCompletePassthroughDeps())) {
+  await runCli(legacyRoot, { analyticsLayer: legacyAnalyticsLayer });
+}
diff --git a/apps/cli/src/legacy/cli/root.ts b/apps/cli/src/legacy/cli/root.ts
index bca04f7767..792b281d49 100644
--- a/apps/cli/src/legacy/cli/root.ts
+++ b/apps/cli/src/legacy/cli/root.ts
@@ -3,6 +3,7 @@ import { Command } from "effect/unstable/cli";
 import { legacyBackupsCommand } from "../commands/backups/backups.command.ts";
 import { legacyBootstrapCommand } from "../commands/bootstrap/bootstrap.command.ts";
 import { legacyBranchesCommand } from "../commands/branches/branches.command.ts";
+import { legacyCompletionCommand } from "../commands/completion/completion.command.ts";
 import { legacyConfigCommand } from "../commands/config/config.command.ts";
 import { legacyDbCommand } from "../commands/db/db.command.ts";
 import { legacyDomainsCommand } from "../commands/domains/domains.command.ts";
@@ -58,6 +59,7 @@ export const legacyRoot = Command.make("supabase").pipe(
     legacyBackupsCommand,
     legacyBootstrapCommand,
     legacyBranchesCommand,
+    legacyCompletionCommand,
     legacyConfigCommand,
     legacyDbCommand,
     legacyDomainsCommand,
diff --git a/apps/cli/src/legacy/commands/backups/backups.errors.ts b/apps/cli/src/legacy/commands/backups/backups.errors.ts
new file mode 100644
index 0000000000..b439a7210c
--- /dev/null
+++ b/apps/cli/src/legacy/commands/backups/backups.errors.ts
@@ -0,0 +1,27 @@
+import { Data } from "effect";
+
+export class LegacyBackupListNetworkError extends Data.TaggedError("LegacyBackupListNetworkError")<{
+  readonly message: string;
+}> {}
+
+export class LegacyBackupListUnexpectedStatusError extends Data.TaggedError(
+  "LegacyBackupListUnexpectedStatusError",
+)<{
+  readonly status: number;
+  readonly body: string;
+  readonly message: string;
+}> {}
+
+export class LegacyBackupRestoreNetworkError extends Data.TaggedError(
+  "LegacyBackupRestoreNetworkError",
+)<{
+  readonly message: string;
+}> {}
+
+export class LegacyBackupRestoreUnexpectedStatusError extends Data.TaggedError(
+  "LegacyBackupRestoreUnexpectedStatusError",
+)<{
+  readonly status: number;
+  readonly body: string;
+  readonly message: string;
+}> {}
diff --git a/apps/cli/src/legacy/commands/backups/backups.format.ts b/apps/cli/src/legacy/commands/backups/backups.format.ts
new file mode 100644
index 0000000000..a04ce811d7
--- /dev/null
+++ b/apps/cli/src/legacy/commands/backups/backups.format.ts
@@ -0,0 +1,51 @@
+const REGION_NAMES: Readonly<Record<string, string>> = {
+  "ap-east-1": "East Asia (Hong Kong)",
+  "ap-northeast-1": "Northeast Asia (Tokyo)",
+  "ap-northeast-2": "Northeast Asia (Seoul)",
+  "ap-south-1": "South Asia (Mumbai)",
+  "ap-southeast-1": "Southeast Asia (Singapore)",
+  "ap-southeast-2": "Oceania (Sydney)",
+  "ca-central-1": "Canada (Central)",
+  "eu-central-1": "Central EU (Frankfurt)",
+  "eu-central-2": "Central Europe (Zurich)",
+  "eu-north-1": "North EU (Stockholm)",
+  "eu-west-1": "West EU (Ireland)",
+  "eu-west-2": "West Europe (London)",
+  "eu-west-3": "West EU (Paris)",
+  "sa-east-1": "South America (São Paulo)",
+  "us-east-1": "East US (North Virginia)",
+  "us-east-2": "East US (Ohio)",
+  "us-west-1": "West US (North California)",
+  "us-west-2": "West US (Oregon)",
+};
+
+export function formatRegion(region: string): string {
+  return REGION_NAMES[region] ?? region;
+}
+
+function pad2(value: number): string {
+  return value.toString().padStart(2, "0");
+}
+
+/**
+ * Reproduces `utils.FormatTimestamp` from `apps/cli-go/internal/utils/render.go:17`:
+ * parse RFC3339; on success format as UTC "YYYY-MM-DD HH:MM:SS"; on failure
+ * return the input verbatim.
+ */
+export function formatBackupTimestamp(value: string): string {
+  if (value.length === 0) return value;
+  // Go uses time.Parse(time.RFC3339, value). Date.parse accepts a broader format
+  // surface, so we additionally require the year-month-day prefix to weed out
+  // values like "2026-02-08 16:44:07" (already-formatted) that Date.parse would
+  // happily accept but Go's strict RFC3339 parser would reject.
+  if (!/^\d{4}-\d{2}-\d{2}T/.test(value)) {
+    return value;
+  }
+  const parsed = Date.parse(value);
+  if (Number.isNaN(parsed)) return value;
+  const date = new Date(parsed);
+  return (
+    `${date.getUTCFullYear()}-${pad2(date.getUTCMonth() + 1)}-${pad2(date.getUTCDate())} ` +
+    `${pad2(date.getUTCHours())}:${pad2(date.getUTCMinutes())}:${pad2(date.getUTCSeconds())}`
+  );
+}
diff --git a/apps/cli/src/legacy/commands/backups/backups.format.unit.test.ts b/apps/cli/src/legacy/commands/backups/backups.format.unit.test.ts
new file mode 100644
index 0000000000..4d270cdc21
--- /dev/null
+++ b/apps/cli/src/legacy/commands/backups/backups.format.unit.test.ts
@@ -0,0 +1,55 @@
+import { describe, expect, it } from "vitest";
+
+import { formatBackupTimestamp, formatRegion } from "./backups.format.ts";
+
+describe("formatRegion", () => {
+  it.each([
+    ["ap-east-1", "East Asia (Hong Kong)"],
+    ["ap-northeast-1", "Northeast Asia (Tokyo)"],
+    ["ap-northeast-2", "Northeast Asia (Seoul)"],
+    ["ap-south-1", "South Asia (Mumbai)"],
+    ["ap-southeast-1", "Southeast Asia (Singapore)"],
+    ["ap-southeast-2", "Oceania (Sydney)"],
+    ["ca-central-1", "Canada (Central)"],
+    ["eu-central-1", "Central EU (Frankfurt)"],
+    ["eu-central-2", "Central Europe (Zurich)"],
+    ["eu-north-1", "North EU (Stockholm)"],
+    ["eu-west-1", "West EU (Ireland)"],
+    ["eu-west-2", "West Europe (London)"],
+    ["eu-west-3", "West EU (Paris)"],
+    ["sa-east-1", "South America (São Paulo)"],
+    ["us-east-1", "East US (North Virginia)"],
+    ["us-east-2", "East US (Ohio)"],
+    ["us-west-1", "West US (North California)"],
+    ["us-west-2", "West US (Oregon)"],
+  ])("maps %s to %s", (input, expected) => {
+    expect(formatRegion(input)).toBe(expected);
+  });
+
+  it("returns the region unchanged when unknown", () => {
+    expect(formatRegion("xx-unknown-9")).toBe("xx-unknown-9");
+  });
+});
+
+describe("formatBackupTimestamp", () => {
+  it("formats valid RFC3339 to YYYY-MM-DD HH:MM:SS UTC", () => {
+    expect(formatBackupTimestamp("2026-02-08T16:44:07Z")).toBe("2026-02-08 16:44:07");
+  });
+
+  it("handles offsets by normalizing to UTC", () => {
+    expect(formatBackupTimestamp("2026-02-08T18:44:07+02:00")).toBe("2026-02-08 16:44:07");
+  });
+
+  it("falls back to the original value for already-formatted timestamps", () => {
+    // Go's time.Parse(time.RFC3339, ...) rejects "2026-02-08 16:44:07" (space, not T).
+    expect(formatBackupTimestamp("2026-02-08 16:44:07")).toBe("2026-02-08 16:44:07");
+  });
+
+  it("falls back for malformed input", () => {
+    expect(formatBackupTimestamp("not-a-timestamp")).toBe("not-a-timestamp");
+  });
+
+  it("returns empty string unchanged", () => {
+    expect(formatBackupTimestamp("")).toBe("");
+  });
+});
diff --git a/apps/cli/src/legacy/commands/backups/list/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/backups/list/SIDE_EFFECTS.md
index 1b5c3b886d..f69b0219d6 100644
--- a/apps/cli/src/legacy/commands/backups/list/SIDE_EFFECTS.md
+++ b/apps/cli/src/legacy/commands/backups/list/SIDE_EFFECTS.md
@@ -2,9 +2,13 @@
 
 ## Files Read
 
-| Path                       | Format                    | When                                                       |
-| -------------------------- | ------------------------- | ---------------------------------------------------------- |
-| `~/.supabase/access-token` | plain text (token string) | when `SUPABASE_ACCESS_TOKEN` unset and keyring unavailable |
+| Path                                      | Format                    | When                                                                                          |
+| ----------------------------------------- | ------------------------- | --------------------------------------------------------------------------------------------- |
+| `/proc/sys/kernel/osrelease` (Linux)      | plain text                | once on layer init — disables keyring on WSL (`WSL` / `Microsoft` substring match)            |
+| keyring `"Supabase CLI"` / `<profile>`    | OS keychain               | when `SUPABASE_ACCESS_TOKEN` unset and keyring available; account = `LegacyCliConfig.profile` |
+| keyring `"Supabase CLI"` / `access-token` | OS keychain               | legacy-key fallback when the profile-keyed lookup misses                                      |
+| `~/.supabase/access-token`                | plain text (token string) | last-resort fallback after env + keyring miss                                                 |
+| `<workdir>/supabase/.temp/project-ref`    | plain text                | when `--project-ref` and `SUPABASE_PROJECT_ID` are both unset                                 |
 
 ## Files Written
 
@@ -14,44 +18,75 @@
 
 ## API Routes
 
-| Method | Path                                  | Auth         | Request body | Response (used fields)                                                                       |
-| ------ | ------------------------------------- | ------------ | ------------ | -------------------------------------------------------------------------------------------- |
-| `GET`  | `/v1/projects/{ref}/database/backups` | Bearer token | none         | `{region, walg_enabled, pitr_enabled, backups: [{inserted_at, status, is_physical_backup}]}` |
+| Method | Path                                  | Auth         | Request body | Response (used fields)                                                                                                                                                                       |
+| ------ | ------------------------------------- | ------------ | ------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `GET`  | `/v1/projects/{ref}/database/backups` | Bearer token | none         | `{region, walg_enabled, pitr_enabled, backups: [{inserted_at, status, is_physical_backup}], physical_backup_data: {earliest_physical_backup_date_unix?, latest_physical_backup_date_unix?}}` |
+| `GET`  | `/v1/projects`                        | Bearer token | none         | `[{id, ref, name, organization_slug, region, ...}]` — TTY-prompt fallback only                                                                                                               |
 
 ## Environment Variables
 
-| Variable                | Purpose                                              | Required?                                               |
-| ----------------------- | ---------------------------------------------------- | ------------------------------------------------------- |
-| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `~/.supabase/access-token`) |
-| `SUPABASE_API_URL`      | override Management API base URL                     | no (defaults to `https://api.supabase.com`)             |
+| Variable                | Purpose                                                                                                                                                                                                                                                                                              | Required?                                                                  |
+| ----------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------- |
+| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup)                                                                                                                                                                                                                                                 | no (falls back to keyring → `~/.supabase/access-token`)                    |
+| `SUPABASE_PROFILE`      | selects API base URL: `supabase` → `api.supabase.com`, `supabase-staging` → `api.supabase.green`, `supabase-local` → `http://localhost:8080`. May alternatively be a filesystem path to a YAML profile with at least `api_url:` and optional `name:` (Go parity — used by the cli-e2e test harness). | no (defaults to `supabase`)                                                |
+| `SUPABASE_PROJECT_ID`   | project ref fallback when `--project-ref` is unset                                                                                                                                                                                                                                                   | no (also reads `<workdir>/supabase/.temp/project-ref` then prompts on TTY) |
+| `SUPABASE_WORKDIR`      | base directory for the `.temp/project-ref` lookup                                                                                                                                                                                                                                                    | no (walks up from CWD looking for `supabase/config.toml`)                  |
+| ~~`SUPABASE_API_URL`~~  | **not honored** — Go parity. Use `SUPABASE_PROFILE` to override the API base URL.                                                                                                                                                                                                                    | —                                                                          |
 
 ## Exit Codes
 
-| Code | Condition                                              |
-| ---- | ------------------------------------------------------ |
-| `0`  | success — backup list printed to stdout                |
-| `1`  | authentication error — no valid token found            |
-| `1`  | missing `--project-ref` and no linked project          |
-| `1`  | API error — non-2xx response from the backups endpoint |
-| `1`  | network / connection failure                           |
+| Code | Condition                                                                                  |
+| ---- | ------------------------------------------------------------------------------------------ |
+| `0`  | success — backup list printed to stdout                                                    |
+| `1`  | `LegacyPlatformAuthRequiredError` — no token in env/keyring/file                           |
+| `1`  | `LegacyInvalidAccessTokenError` — token violates `^sbp_(oauth_)?[a-f0-9]{40}$`             |
+| `1`  | `LegacyProjectNotLinkedError` — `--project-ref` unset, env/file empty, and stdin not a TTY |
+| `1`  | `LegacyInvalidProjectRefError` — resolved ref violates `^[a-z]{20}$`                       |
+| `1`  | `LegacyBackupListUnexpectedStatusError` — non-2xx response from the backups endpoint       |
+| `1`  | `LegacyBackupListNetworkError` — transport-level network failure                           |
+
+## Telemetry Events Fired
+
+| Event                  | When                                       | Notable properties / groups                                          |
+| ---------------------- | ------------------------------------------ | -------------------------------------------------------------------- |
+| `cli_command_executed` | post-run, success or failure (via wrapper) | `exit_code`, `duration_ms`, `flags` (`--project-ref` → `<redacted>`) |
+
+Matches `apps/cli-go/internal/backups/list/`. Go does not fire any custom telemetry event for this command.
 
 ## Output
 
-### `--output-format text` (Go CLI compatible)
+The legacy `--output {pretty,json,yaml,toml,env}` flag (Go-compatible) and the new global `--output-format {text,json,stream-json}` flag are both honored. `--output` wins when both are supplied. `pretty` and `text` map to the same render path.
+
+### `--output pretty` (Go default) / `--output-format text`
+
+For PITR-only projects, prints a Glamour-styled markdown table with columns: `REGION`, `WALG`, `PITR`, `EARLIEST TIMESTAMP`, `LATEST TIMESTAMP`. For projects with logical/physical backups, prints columns: `REGION`, `BACKUP TYPE`, `STATUS`, `CREATED AT (UTC)`. The table is rendered byte-for-byte to match Go's `glamour.WithStandardStyle(styles.AsciiStyle)` output.
+
+### `--output json` (Go-compat)
+
+Indented JSON (`json.MarshalIndent(resp, "", "  ")` equivalent) of the full backup response, terminated by a newline.
+
+### `--output yaml`
+
+YAML document (`yaml@2` equivalent of Go's `yaml.v3`) of the full backup response.
+
+### `--output toml`
+
+TOML document (`smol-toml` equivalent of Go's `BurntSushi/toml`) of the full backup response. JSON shape is preserved; leaf order may differ from Go.
 
-For PITR-enabled projects, prints a table with columns: `REGION`, `WALG`, `PITR`, `EARLIEST TIMESTAMP`, `LATEST TIMESTAMP`.
+### `--output env`
 
-For projects with physical backups, prints a table with columns: `REGION`, `BACKUP TYPE`, `STATUS`, `CREATED AT (UTC)`.
+`KEY=VALUE` lines (one per leaf), one per line, sorted lexicographically. Keys are flattened with `.` separators then converted to SCREAMING_SNAKE_CASE; values are double-quoted with `"` and `\\` escaped.
 
 ### `--output-format json`
 
-Single JSON object with the full backup response as returned by the Management API.
+Single JSON object emitted via `Output.success` with the full backup response as the `data` field.
 
 ### `--output-format stream-json`
 
-One `result` event on success containing the backup response object.
+One `result` NDJSON event on success containing the backup response object.
 
 ## Notes
 
-- Requires `--project-ref` or a linked project (resolved from `.supabase/config.json`).
-- Phase 0 proxy: all invocations are forwarded to the bundled Go binary via `LegacyGoProxy`.
+- Requires `--project-ref`, `SUPABASE_PROJECT_ID`, a populated `<workdir>/supabase/.temp/project-ref` file, or a TTY for the interactive project picker.
+- The interactive picker calls `GET /v1/projects` and writes `"Selected project: <ref>"` to stderr in text mode (matches Go `project_ref.go:50`). It does **not** persist the choice; only `supabase link` and `supabase bootstrap` write the temp file.
+- Sends `User-Agent: SupabaseCLI/<version>` and Bearer auth. No `X-Supabase-Command` headers — Go parity.
diff --git a/apps/cli/src/legacy/commands/backups/list/list.command.ts b/apps/cli/src/legacy/commands/backups/list/list.command.ts
index 99a08adffe..142c7f4f6f 100644
--- a/apps/cli/src/legacy/commands/backups/list/list.command.ts
+++ b/apps/cli/src/legacy/commands/backups/list/list.command.ts
@@ -1,4 +1,9 @@
+import type * as CliCommand from "effect/unstable/cli/Command";
 import { Command, Flag } from "effect/unstable/cli";
+
+import { withJsonErrorHandling } from "../../../../shared/output/json-error-handling.ts";
+import { legacyManagementApiRuntimeLayer } from "../../../shared/legacy-management-api-runtime.layer.ts";
+import { withLegacyCommandInstrumentation } from "../../../telemetry/legacy-command-instrumentation.ts";
 import { legacyBackupsList } from "./list.handler.ts";
 
 const config = {
@@ -6,11 +11,13 @@ const config = {
     Flag.withDescription("Project ref of the Supabase project."),
     Flag.optional,
   ),
-};
+} as const;
+
+export type LegacyBackupsListFlags = CliCommand.Command.Config.Infer<typeof config>;
 
 export const legacyBackupsListCommand = Command.make("list", config).pipe(
-  Command.withDescription("Lists available physical backups for the linked project."),
-  Command.withShortDescription("List available physical backups"),
+  Command.withDescription("Lists available physical backups"),
+  Command.withShortDescription("Lists available physical backups"),
   Command.withExamples([
     {
       command: "supabase backups list",
@@ -21,5 +28,11 @@ export const legacyBackupsListCommand = Command.make("list", config).pipe(
       description: "List backups for a specific project",
     },
   ]),
-  Command.withHandler((flags) => legacyBackupsList(flags)),
+  Command.withHandler((flags) =>
+    legacyBackupsList(flags).pipe(
+      withLegacyCommandInstrumentation({ flags }),
+      withJsonErrorHandling,
+    ),
+  ),
+  Command.provide(legacyManagementApiRuntimeLayer(["backups", "list"])),
 );
diff --git a/apps/cli/src/legacy/commands/backups/list/list.handler.ts b/apps/cli/src/legacy/commands/backups/list/list.handler.ts
index 410bdae09e..85892779e7 100644
--- a/apps/cli/src/legacy/commands/backups/list/list.handler.ts
+++ b/apps/cli/src/legacy/commands/backups/list/list.handler.ts
@@ -1,15 +1,120 @@
+import type { V1ListAllBackupsOutput } from "@supabase/api/effect";
 import { Effect, Option } from "effect";
-import { LegacyGoProxy } from "../../../../shared/legacy/go-proxy.service.ts";
 
-interface LegacyBackupsListFlags {
-  readonly projectRef: Option.Option<string>;
+import { LegacyPlatformApi } from "../../../auth/legacy-platform-api.service.ts";
+import { LegacyProjectRefResolver } from "../../../config/legacy-project-ref.service.ts";
+import { LegacyLinkedProjectCache } from "../../../telemetry/legacy-linked-project-cache.service.ts";
+import { LegacyTelemetryState } from "../../../telemetry/legacy-telemetry-state.service.ts";
+import { LegacyOutputFlag } from "../../../../shared/legacy/global-flags.ts";
+import { Output } from "../../../../shared/output/output.service.ts";
+import { renderGlamourTable } from "../../../output/legacy-glamour-table.ts";
+import {
+  LegacyBackupListNetworkError,
+  LegacyBackupListUnexpectedStatusError,
+} from "../backups.errors.ts";
+import {
+  encodeEnv,
+  encodeGoJson,
+  encodeToml,
+  encodeYaml,
+} from "../../../shared/legacy-go-output.encoders.ts";
+import { mapLegacyHttpError } from "../../../shared/legacy-http-errors.ts";
+import { formatBackupTimestamp, formatRegion } from "../backups.format.ts";
+import type { LegacyBackupsListFlags } from "./list.command.ts";
+
+type BackupsResponse = typeof V1ListAllBackupsOutput.Type;
+
+const mapListError = mapLegacyHttpError({
+  networkError: LegacyBackupListNetworkError,
+  statusError: LegacyBackupListUnexpectedStatusError,
+  networkMessage: (cause) => `failed to list physical backups: ${cause}`,
+  statusMessage: (status, body) => `unexpected list backup status ${status}: ${body}`,
+});
+
+const PITR_HEADERS = ["REGION", "WALG", "PITR", "EARLIEST TIMESTAMP", "LATEST TIMESTAMP"] as const;
+
+const LOGICAL_HEADERS = ["REGION", "BACKUP TYPE", "STATUS", "CREATED AT (UTC)"] as const;
+
+function renderPitrTable(response: BackupsResponse): string {
+  const region = formatRegion(response.region);
+  const earliest = response.physical_backup_data.earliest_physical_backup_date_unix ?? 0;
+  const latest = response.physical_backup_data.latest_physical_backup_date_unix ?? 0;
+  return renderGlamourTable(PITR_HEADERS, [
+    [
+      region,
+      response.walg_enabled ? "true" : "false",
+      response.pitr_enabled ? "true" : "false",
+      String(earliest),
+      String(latest),
+    ],
+  ]);
+}
+
+function renderLogicalTable(response: BackupsResponse): string {
+  const region = formatRegion(response.region);
+  const rows = response.backups.map((backup) => [
+    region,
+    backup.is_physical_backup ? "PHYSICAL" : "LOGICAL",
+    backup.status,
+    formatBackupTimestamp(backup.inserted_at),
+  ]);
+  return renderGlamourTable(LOGICAL_HEADERS, rows);
 }
 
 export const legacyBackupsList = Effect.fn("legacy.backups.list")(function* (
   flags: LegacyBackupsListFlags,
 ) {
-  const proxy = yield* LegacyGoProxy;
-  const args: string[] = ["backups", "list"];
-  if (Option.isSome(flags.projectRef)) args.push("--project-ref", flags.projectRef.value);
-  yield* proxy.exec(args);
+  const output = yield* Output;
+  const goOutputFlag = yield* LegacyOutputFlag;
+  const api = yield* LegacyPlatformApi;
+  const resolver = yield* LegacyProjectRefResolver;
+  const linkedProjectCache = yield* LegacyLinkedProjectCache;
+  const telemetryState = yield* LegacyTelemetryState;
+
+  const ref = yield* resolver.resolve(flags.projectRef);
+
+  // Mirror Go's PersistentPostRun (`apps/cli-go/cmd/root.go:176`): write the
+  // linked-project cache and persist the telemetry state file whether the main
+  // API call succeeds or fails.
+  yield* Effect.gen(function* () {
+    // The fetching spinner is only meaningful in human-facing text mode — in JSON / stream-json
+    // it would surface dangling `[task] start:` lines on stderr with no completion message.
+    const fetching =
+      output.format === "text" ? yield* output.task("Fetching backups...") : undefined;
+    const response = yield* api.v1.listAllBackups({ ref }).pipe(
+      Effect.tapError(() => fetching?.fail() ?? Effect.void),
+      Effect.catch(mapListError),
+    );
+    yield* fetching?.clear() ?? Effect.void;
+
+    const goFmt = Option.getOrUndefined(goOutputFlag);
+
+    if (goFmt === "json") {
+      yield* output.raw(encodeGoJson(response, { nullForEmptyArrays: ["backups"] }));
+      return;
+    }
+    if (goFmt === "yaml") {
+      yield* output.raw(encodeYaml(response));
+      return;
+    }
+    if (goFmt === "toml") {
+      yield* output.raw(encodeToml(response) + "\n");
+      return;
+    }
+    if (goFmt === "env") {
+      yield* output.raw(encodeEnv(response) + "\n");
+      return;
+    }
+
+    // goFmt is undefined or "pretty" — defer to TS --output-format for JSON/stream-json,
+    // otherwise render the Glamour-styled table (Go --output pretty parity).
+    if (output.format === "json" || output.format === "stream-json") {
+      yield* output.success("", response);
+      return;
+    }
+
+    const table =
+      response.backups.length > 0 ? renderLogicalTable(response) : renderPitrTable(response);
+    yield* output.raw(table);
+  }).pipe(Effect.ensuring(linkedProjectCache.cache(ref)), Effect.ensuring(telemetryState.flush));
 });
diff --git a/apps/cli/src/legacy/commands/backups/list/list.integration.test.ts b/apps/cli/src/legacy/commands/backups/list/list.integration.test.ts
new file mode 100644
index 0000000000..2dfdc91641
--- /dev/null
+++ b/apps/cli/src/legacy/commands/backups/list/list.integration.test.ts
@@ -0,0 +1,336 @@
+import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+
+import { type V1ListAllBackupsOutput } from "@supabase/api/effect";
+import { describe, expect, it } from "@effect/vitest";
+import { Effect, Exit, Option } from "effect";
+
+import { withJsonErrorHandling } from "../../../../shared/output/json-error-handling.ts";
+import { mockOutput } from "../../../../../tests/helpers/mocks.ts";
+import {
+  LEGACY_VALID_REF,
+  buildLegacyTestRuntime,
+  mockLegacyCliConfig,
+  mockLegacyPlatformApi,
+  useLegacyTempWorkdir,
+} from "../../../../../tests/helpers/legacy-mocks.ts";
+import { legacyBackupsList } from "./list.handler.ts";
+
+// ---------------------------------------------------------------------------
+// Fixtures
+// ---------------------------------------------------------------------------
+
+const PITR_RESPONSE: typeof V1ListAllBackupsOutput.Type = {
+  region: "ap-southeast-1",
+  walg_enabled: true,
+  pitr_enabled: true,
+  backups: [],
+  physical_backup_data: {},
+};
+
+const LOGICAL_RESPONSE: typeof V1ListAllBackupsOutput.Type = {
+  region: "ap-southeast-1",
+  walg_enabled: true,
+  pitr_enabled: true,
+  backups: [
+    {
+      id: 1,
+      is_physical_backup: true,
+      status: "COMPLETED",
+      inserted_at: "2026-02-08T16:44:07Z",
+    },
+  ],
+  physical_backup_data: {},
+};
+
+// ---------------------------------------------------------------------------
+// Setup
+// ---------------------------------------------------------------------------
+
+interface SetupOpts {
+  format?: "text" | "json" | "stream-json";
+  goOutput?: "env" | "pretty" | "json" | "toml" | "yaml";
+  response?: typeof V1ListAllBackupsOutput.Type;
+  status?: number;
+  network?: "fail";
+  apiUrl?: string;
+  userAgent?: string;
+}
+
+const tempRoot = useLegacyTempWorkdir("supabase-backups-list-int-");
+
+function setup(opts: SetupOpts = {}) {
+  const out = mockOutput({ format: opts.format ?? "text" });
+  const api = mockLegacyPlatformApi({
+    response: { status: opts.status ?? 200, body: opts.response ?? PITR_RESPONSE },
+    network: opts.network,
+    apiUrl: opts.apiUrl,
+    userAgent: opts.userAgent,
+  });
+  const cliConfig = mockLegacyCliConfig({
+    workdir: tempRoot.current,
+    apiUrl: opts.apiUrl,
+    userAgent: opts.userAgent,
+  });
+  const layer = buildLegacyTestRuntime({
+    out,
+    api,
+    cliConfig,
+    goOutput: opts.goOutput === undefined ? Option.none() : Option.some(opts.goOutput),
+  });
+  return { layer, out, api };
+}
+
+// ---------------------------------------------------------------------------
+// Tests
+// ---------------------------------------------------------------------------
+
+describe("legacy backups list integration", () => {
+  it.live("renders a PITR-only table when no physical backups exist", () => {
+    const { layer, out } = setup({ response: PITR_RESPONSE });
+    return Effect.gen(function* () {
+      yield* legacyBackupsList({ projectRef: Option.none() });
+      expect(out.stdoutText).toContain("REGION");
+      expect(out.stdoutText).toContain("WALG");
+      expect(out.stdoutText).toContain("PITR");
+      expect(out.stdoutText).toContain("EARLIEST TIMESTAMP");
+      expect(out.stdoutText).toContain("LATEST TIMESTAMP");
+      expect(out.stdoutText).toContain("Southeast Asia (Singapore)");
+      expect(out.stdoutText).toContain("| true ");
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("renders a logical backups table with PHYSICAL classification", () => {
+    const { layer, out } = setup({ response: LOGICAL_RESPONSE });
+    return Effect.gen(function* () {
+      yield* legacyBackupsList({ projectRef: Option.none() });
+      expect(out.stdoutText).toContain("BACKUP TYPE");
+      expect(out.stdoutText).toContain("PHYSICAL");
+      expect(out.stdoutText).toContain("COMPLETED");
+      expect(out.stdoutText).toContain("2026-02-08 16:44:07");
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("translates ap-southeast-1 to Southeast Asia (Singapore)", () => {
+    const { layer, out } = setup({ response: PITR_RESPONSE });
+    return Effect.gen(function* () {
+      yield* legacyBackupsList({ projectRef: Option.none() });
+      expect(out.stdoutText).toContain("Southeast Asia (Singapore)");
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("emits a JSON success event when --output-format=json", () => {
+    const { layer, out } = setup({ format: "json", response: PITR_RESPONSE });
+    return Effect.gen(function* () {
+      yield* legacyBackupsList({ projectRef: Option.none() });
+      const success = out.messages.find((m) => m.type === "success");
+      expect(success).toBeDefined();
+      expect(success?.data).toMatchObject({ region: "ap-southeast-1", walg_enabled: true });
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("emits a result event for --output-format=stream-json", () => {
+    const { layer, out } = setup({ format: "stream-json", response: PITR_RESPONSE });
+    return Effect.gen(function* () {
+      yield* legacyBackupsList({ projectRef: Option.none() });
+      const success = out.messages.find((m) => m.type === "success");
+      expect(success).toBeDefined();
+      expect(success?.data).toMatchObject({ region: "ap-southeast-1" });
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("emits indented JSON to stdout for --output json (Go-compat)", () => {
+    const { layer, out } = setup({ goOutput: "json", response: PITR_RESPONSE });
+    return Effect.gen(function* () {
+      yield* legacyBackupsList({ projectRef: Option.none() });
+      // Byte-identical to Go's `encoding/json` output: alphabetical struct-field order,
+      // and a nil Backups slice serializes as `null` (matches
+      // `apps/cli-go/internal/backups/list/list_test.go` fixture).
+      expect(out.stdoutText).toBe(
+        `{
+  "backups": null,
+  "physical_backup_data": {},
+  "pitr_enabled": true,
+  "region": "ap-southeast-1",
+  "walg_enabled": true
+}
+`,
+      );
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("emits YAML to stdout for --output yaml", () => {
+    const { layer, out } = setup({ goOutput: "yaml", response: PITR_RESPONSE });
+    return Effect.gen(function* () {
+      yield* legacyBackupsList({ projectRef: Option.none() });
+      expect(out.stdoutText).toContain("region: ap-southeast-1");
+      expect(out.stdoutText).toContain("walg_enabled: true");
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("emits TOML to stdout for --output toml", () => {
+    const { layer, out } = setup({ goOutput: "toml", response: PITR_RESPONSE });
+    return Effect.gen(function* () {
+      yield* legacyBackupsList({ projectRef: Option.none() });
+      expect(out.stdoutText).toContain('region = "ap-southeast-1"');
+      expect(out.stdoutText).toContain("walg_enabled = true");
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("emits KEY=VALUE lines for --output env", () => {
+    const { layer, out } = setup({ goOutput: "env", response: PITR_RESPONSE });
+    return Effect.gen(function* () {
+      yield* legacyBackupsList({ projectRef: Option.none() });
+      expect(out.stdoutText).toContain('REGION="ap-southeast-1"');
+      expect(out.stdoutText).toContain('WALG_ENABLED="true"');
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("treats --output pretty as identical to text mode (Glamour table)", () => {
+    const { layer, out } = setup({ goOutput: "pretty", response: PITR_RESPONSE });
+    return Effect.gen(function* () {
+      yield* legacyBackupsList({ projectRef: Option.none() });
+      expect(out.stdoutText).toContain("Southeast Asia (Singapore)");
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("--output flag value wins over --output-format when both provided", () => {
+    const { layer, out } = setup({
+      format: "json",
+      goOutput: "yaml",
+      response: PITR_RESPONSE,
+    });
+    return Effect.gen(function* () {
+      yield* legacyBackupsList({ projectRef: Option.none() });
+      expect(out.stdoutText).toContain("region: ap-southeast-1");
+      expect(out.stdoutText.startsWith("{")).toBe(false);
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("passes the resolved project ref into the listAllBackups URL", () => {
+    const { layer, api } = setup({ response: PITR_RESPONSE });
+    return Effect.gen(function* () {
+      yield* legacyBackupsList({ projectRef: Option.none() });
+      expect(api.requests).toHaveLength(1);
+      expect(api.requests[0]?.url).toContain(`/v1/projects/${LEGACY_VALID_REF}/database/backups`);
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("uses --project-ref flag value over LegacyCliConfig.projectId env", () => {
+    const flagRef = "zzzzzzzzzzzzzzzzzzzz";
+    const { layer, api } = setup({ response: PITR_RESPONSE });
+    return Effect.gen(function* () {
+      yield* legacyBackupsList({ projectRef: Option.some(flagRef) });
+      expect(api.requests[0]?.url).toContain(`/v1/projects/${flagRef}/`);
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("reads supabase/.temp/project-ref when env and flag are unset", () => {
+    const localTempRoot = mkdtempSync(join(tmpdir(), "supabase-backups-list-int-fileref-"));
+    const fileRef = "filerefabcdefghijklm";
+    mkdirSync(join(localTempRoot, "supabase", ".temp"), { recursive: true });
+    writeFileSync(join(localTempRoot, "supabase", ".temp", "project-ref"), fileRef);
+
+    const out = mockOutput({ format: "text" });
+    const api = mockLegacyPlatformApi({ response: { status: 200, body: PITR_RESPONSE } });
+    const cliConfig = mockLegacyCliConfig({
+      workdir: localTempRoot,
+      projectId: Option.none(),
+    });
+    const layer = buildLegacyTestRuntime({ out, api, cliConfig });
+
+    return Effect.gen(function* () {
+      yield* legacyBackupsList({ projectRef: Option.none() });
+      expect(api.requests[0]?.url).toContain(`/v1/projects/${fileRef}/`);
+    }).pipe(
+      Effect.provide(layer),
+      Effect.ensuring(Effect.sync(() => rmSync(localTempRoot, { recursive: true, force: true }))),
+    );
+  });
+
+  it.live("fails with LegacyProjectNotLinkedError when no ref source matches off-TTY", () => {
+    const localTempRoot = mkdtempSync(join(tmpdir(), "supabase-backups-list-int-no-ref-"));
+    const out = mockOutput({ format: "text" });
+    const api = mockLegacyPlatformApi({ response: { status: 200, body: PITR_RESPONSE } });
+    const cliConfig = mockLegacyCliConfig({
+      workdir: localTempRoot,
+      projectId: Option.none(),
+    });
+    const layer = buildLegacyTestRuntime({ out, api, cliConfig });
+
+    return Effect.gen(function* () {
+      const exit = yield* Effect.exit(
+        legacyBackupsList({ projectRef: Option.none() }).pipe(Effect.provide(layer)),
+      );
+      expect(Exit.isFailure(exit)).toBe(true);
+      if (Exit.isFailure(exit)) {
+        expect(JSON.stringify(exit.cause)).toContain("LegacyProjectNotLinkedError");
+      }
+    }).pipe(
+      Effect.ensuring(Effect.sync(() => rmSync(localTempRoot, { recursive: true, force: true }))),
+    );
+  });
+
+  it.live("fails with LegacyInvalidProjectRefError when the resolved ref is malformed", () => {
+    const { layer } = setup({ response: PITR_RESPONSE });
+    return Effect.gen(function* () {
+      const exit = yield* Effect.exit(legacyBackupsList({ projectRef: Option.some("BADREF") }));
+      expect(Exit.isFailure(exit)).toBe(true);
+      if (Exit.isFailure(exit)) {
+        expect(JSON.stringify(exit.cause)).toContain("LegacyInvalidProjectRefError");
+      }
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("fails with LegacyBackupListUnexpectedStatusError on HTTP 503", () => {
+    const { layer } = setup({ status: 503, response: PITR_RESPONSE });
+    return Effect.gen(function* () {
+      const exit = yield* Effect.exit(legacyBackupsList({ projectRef: Option.none() }));
+      expect(Exit.isFailure(exit)).toBe(true);
+      if (Exit.isFailure(exit)) {
+        const errorJson = JSON.stringify(exit.cause);
+        expect(errorJson).toContain("LegacyBackupListUnexpectedStatusError");
+        expect(errorJson).toContain("unexpected list backup status 503");
+      }
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("fails with LegacyBackupListNetworkError on transport failure", () => {
+    const { layer } = setup({ network: "fail", response: PITR_RESPONSE });
+    return Effect.gen(function* () {
+      const exit = yield* Effect.exit(legacyBackupsList({ projectRef: Option.none() }));
+      expect(Exit.isFailure(exit)).toBe(true);
+      if (Exit.isFailure(exit)) {
+        const errorJson = JSON.stringify(exit.cause);
+        expect(errorJson).toContain("LegacyBackupListNetworkError");
+        expect(errorJson).toContain("failed to list physical backups");
+      }
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("emits a fail event when withJsonErrorHandling wraps a JSON-mode error", () => {
+    const { layer, out } = setup({ format: "json", status: 503, response: PITR_RESPONSE });
+    return Effect.gen(function* () {
+      yield* legacyBackupsList({ projectRef: Option.none() }).pipe(withJsonErrorHandling);
+      expect(out.messages.some((m) => m.type === "fail")).toBe(true);
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live(
+    "sends User-Agent SupabaseCLI/<version> and no X-Supabase-Command headers (Go parity)",
+    () => {
+      const { layer, api } = setup({
+        response: PITR_RESPONSE,
+        userAgent: "SupabaseCLI/1.42.0",
+      });
+      return Effect.gen(function* () {
+        yield* legacyBackupsList({ projectRef: Option.none() });
+        const headers = api.requests[0]?.headers;
+        expect(headers?.["user-agent"]).toBe("SupabaseCLI/1.42.0");
+        expect(headers?.["x-supabase-command"]).toBeUndefined();
+        expect(headers?.["x-supabase-command-run-id"]).toBeUndefined();
+      }).pipe(Effect.provide(layer));
+    },
+  );
+});
diff --git a/apps/cli/src/legacy/commands/backups/restore/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/backups/restore/SIDE_EFFECTS.md
index 07bc78a5de..8b08e2727b 100644
--- a/apps/cli/src/legacy/commands/backups/restore/SIDE_EFFECTS.md
+++ b/apps/cli/src/legacy/commands/backups/restore/SIDE_EFFECTS.md
@@ -2,9 +2,13 @@
 
 ## Files Read
 
-| Path                       | Format                    | When                                                       |
-| -------------------------- | ------------------------- | ---------------------------------------------------------- |
-| `~/.supabase/access-token` | plain text (token string) | when `SUPABASE_ACCESS_TOKEN` unset and keyring unavailable |
+| Path                                      | Format                    | When                                                                                          |
+| ----------------------------------------- | ------------------------- | --------------------------------------------------------------------------------------------- |
+| `/proc/sys/kernel/osrelease` (Linux)      | plain text                | once on layer init — disables keyring on WSL (`WSL` / `Microsoft` substring match)            |
+| keyring `"Supabase CLI"` / `<profile>`    | OS keychain               | when `SUPABASE_ACCESS_TOKEN` unset and keyring available; account = `LegacyCliConfig.profile` |
+| keyring `"Supabase CLI"` / `access-token` | OS keychain               | legacy-key fallback when the profile-keyed lookup misses                                      |
+| `~/.supabase/access-token`                | plain text (token string) | last-resort fallback after env + keyring miss                                                 |
+| `<workdir>/supabase/.temp/project-ref`    | plain text                | when `--project-ref` and `SUPABASE_PROJECT_ID` are both unset                                 |
 
 ## Files Written
 
@@ -14,43 +18,65 @@
 
 ## API Routes
 
-| Method | Path                                               | Auth         | Request body                         | Response (used fields) |
-| ------ | -------------------------------------------------- | ------------ | ------------------------------------ | ---------------------- |
-| `POST` | `/v1/projects/{ref}/database/backups/restore-pitr` | Bearer token | `{recovery_time_target_unix: int64}` | none (201 Created)     |
+| Method | Path                                               | Auth         | Request body                         | Response (used fields)                                                         |
+| ------ | -------------------------------------------------- | ------------ | ------------------------------------ | ------------------------------------------------------------------------------ |
+| `POST` | `/v1/projects/{ref}/database/backups/restore-pitr` | Bearer token | `{recovery_time_target_unix: int64}` | none (201 Created)                                                             |
+| `GET`  | `/v1/projects`                                     | Bearer token | none                                 | `[{id, ref, name, organization_slug, region, ...}]` — TTY-prompt fallback only |
 
 ## Environment Variables
 
-| Variable                | Purpose                                              | Required?                                               |
-| ----------------------- | ---------------------------------------------------- | ------------------------------------------------------- |
-| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `~/.supabase/access-token`) |
-| `SUPABASE_API_URL`      | override Management API base URL                     | no (defaults to `https://api.supabase.com`)             |
+| Variable                | Purpose                                                                                                                                                                                                                                                                                              | Required?                                                                  |
+| ----------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------- |
+| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup)                                                                                                                                                                                                                                                 | no (falls back to keyring → `~/.supabase/access-token`)                    |
+| `SUPABASE_PROFILE`      | selects API base URL: `supabase` → `api.supabase.com`, `supabase-staging` → `api.supabase.green`, `supabase-local` → `http://localhost:8080`. May alternatively be a filesystem path to a YAML profile with at least `api_url:` and optional `name:` (Go parity — used by the cli-e2e test harness). | no (defaults to `supabase`)                                                |
+| `SUPABASE_PROJECT_ID`   | project ref fallback when `--project-ref` is unset                                                                                                                                                                                                                                                   | no (also reads `<workdir>/supabase/.temp/project-ref` then prompts on TTY) |
+| `SUPABASE_WORKDIR`      | base directory for the `.temp/project-ref` lookup                                                                                                                                                                                                                                                    | no (walks up from CWD looking for `supabase/config.toml`)                  |
+| ~~`SUPABASE_API_URL`~~  | **not honored** — Go parity. Use `SUPABASE_PROFILE` to override the API base URL.                                                                                                                                                                                                                    | —                                                                          |
 
 ## Exit Codes
 
-| Code | Condition                                                   |
-| ---- | ----------------------------------------------------------- |
-| `0`  | success — restore initiated                                 |
-| `1`  | authentication error — no valid token found                 |
-| `1`  | missing `--project-ref` and no linked project               |
-| `1`  | API error — non-2xx response from the restore-pitr endpoint |
-| `1`  | network / connection failure                                |
+| Code | Condition                                                                                  |
+| ---- | ------------------------------------------------------------------------------------------ |
+| `0`  | success — restore initiated                                                                |
+| `1`  | `LegacyPlatformAuthRequiredError` — no token in env/keyring/file                           |
+| `1`  | `LegacyInvalidAccessTokenError` — token violates `^sbp_(oauth_)?[a-f0-9]{40}$`             |
+| `1`  | `LegacyProjectNotLinkedError` — `--project-ref` unset, env/file empty, and stdin not a TTY |
+| `1`  | `LegacyInvalidProjectRefError` — resolved ref violates `^[a-z]{20}$`                       |
+| `1`  | `LegacyBackupRestoreUnexpectedStatusError` — non-201 response from the restore endpoint    |
+| `1`  | `LegacyBackupRestoreNetworkError` — transport-level network failure                        |
+
+## Telemetry Events Fired
+
+| Event                  | When                                       | Notable properties / groups                                                          |
+| ---------------------- | ------------------------------------------ | ------------------------------------------------------------------------------------ |
+| `cli_command_executed` | post-run, success or failure (via wrapper) | `exit_code`, `duration_ms`, `flags` (`--project-ref` / `--timestamp` → `<redacted>`) |
+
+Matches `apps/cli-go/internal/backups/restore/`. Go does not fire any custom telemetry event for this command.
 
 ## Output
 
-### `--output-format text` (Go CLI compatible)
+Go's `restore` command ignores `--output` entirely (`apps/cli-go/internal/backups/restore/restore.go:22`) and always writes the success line to **stderr**. The legacy port mirrors that for every Go `--output` value. The `--output-format` (TS-only) JSON modes get a structured payload — non-breaking because Go has no JSON for restore.
+
+### `--output pretty|yaml|toml|env` (Go-compat) / `--output-format text`
+
+Writes `"Started PITR restore: <ref>\n"` to **stderr** (byte-identical to Go).
+
+### `--output json` (Go-compat)
 
-Prints a confirmation message on success. No table output.
+Indented JSON object on stdout: `{ "message": "Started PITR restore", "project_ref": "<ref>" }`.
 
 ### `--output-format json`
 
-No structured JSON output (command is action-only).
+Single JSON success event via `Output.success("Started PITR restore", { project_ref })`.
 
 ### `--output-format stream-json`
 
-One `result` event on success.
+One `result` NDJSON event on success with the project ref payload.
 
 ## Notes
 
-- `--timestamp` / `-t` accepts seconds since Unix epoch (int64). Defaults to `0`.
-- Requires `--project-ref` or a linked project.
-- Phase 0 proxy: all invocations are forwarded to the bundled Go binary via `LegacyGoProxy`.
+- `--timestamp` / `-t` accepts seconds since Unix epoch (int64). Defaults to `0`, which the API interprets as "now".
+- Known Go-parity gap: the generated `V1RestorePitrBackupInput` schema enforces `recovery_time_target_unix >= 0`. Go's `int64` has no lower bound, so a negative value is rejected locally with a schema decode error instead of being forwarded to the API. Resolving this requires an upstream OpenAPI spec change.
+- Requires `--project-ref`, `SUPABASE_PROJECT_ID`, a populated `<workdir>/supabase/.temp/project-ref` file, or a TTY for the interactive project picker.
+- The interactive picker calls `GET /v1/projects` and writes `"Selected project: <ref>"` to stderr in text mode (matches Go `project_ref.go:50`). It does **not** persist the choice; only `supabase link` and `supabase bootstrap` write the temp file.
+- Sends `User-Agent: SupabaseCLI/<version>` and Bearer auth. No `X-Supabase-Command` headers — Go parity.
diff --git a/apps/cli/src/legacy/commands/backups/restore/restore.command.ts b/apps/cli/src/legacy/commands/backups/restore/restore.command.ts
index 99a5cda4ef..4a627c64b0 100644
--- a/apps/cli/src/legacy/commands/backups/restore/restore.command.ts
+++ b/apps/cli/src/legacy/commands/backups/restore/restore.command.ts
@@ -1,4 +1,9 @@
+import type * as CliCommand from "effect/unstable/cli/Command";
 import { Command, Flag } from "effect/unstable/cli";
+
+import { withJsonErrorHandling } from "../../../../shared/output/json-error-handling.ts";
+import { legacyManagementApiRuntimeLayer } from "../../../shared/legacy-management-api-runtime.layer.ts";
+import { withLegacyCommandInstrumentation } from "../../../telemetry/legacy-command-instrumentation.ts";
 import { legacyBackupsRestore } from "./restore.handler.ts";
 
 const config = {
@@ -11,10 +16,12 @@ const config = {
     Flag.withDescription("The recovery time target in seconds since epoch."),
     Flag.optional,
   ),
-};
+} as const;
+
+export type LegacyBackupsRestoreFlags = CliCommand.Command.Config.Infer<typeof config>;
 
 export const legacyBackupsRestoreCommand = Command.make("restore", config).pipe(
-  Command.withDescription("Restore to a specific timestamp using Point-in-Time Recovery (PITR)."),
+  Command.withDescription("Restore to a specific timestamp using PITR"),
   Command.withShortDescription("Restore to a specific timestamp using PITR"),
   Command.withExamples([
     {
@@ -22,5 +29,11 @@ export const legacyBackupsRestoreCommand = Command.make("restore", config).pipe(
       description: "Restore to the given Unix epoch timestamp",
     },
   ]),
-  Command.withHandler((flags) => legacyBackupsRestore(flags)),
+  Command.withHandler((flags) =>
+    legacyBackupsRestore(flags).pipe(
+      withLegacyCommandInstrumentation({ flags }),
+      withJsonErrorHandling,
+    ),
+  ),
+  Command.provide(legacyManagementApiRuntimeLayer(["backups", "restore"])),
 );
diff --git a/apps/cli/src/legacy/commands/backups/restore/restore.handler.ts b/apps/cli/src/legacy/commands/backups/restore/restore.handler.ts
index 7dbf6a3e16..4ae6524f97 100644
--- a/apps/cli/src/legacy/commands/backups/restore/restore.handler.ts
+++ b/apps/cli/src/legacy/commands/backups/restore/restore.handler.ts
@@ -1,17 +1,70 @@
 import { Effect, Option } from "effect";
-import { LegacyGoProxy } from "../../../../shared/legacy/go-proxy.service.ts";
 
-interface LegacyBackupsRestoreFlags {
-  readonly projectRef: Option.Option<string>;
-  readonly timestamp: Option.Option<number>;
-}
+import { LegacyPlatformApi } from "../../../auth/legacy-platform-api.service.ts";
+import { LegacyProjectRefResolver } from "../../../config/legacy-project-ref.service.ts";
+import { LegacyLinkedProjectCache } from "../../../telemetry/legacy-linked-project-cache.service.ts";
+import { LegacyTelemetryState } from "../../../telemetry/legacy-telemetry-state.service.ts";
+import { LegacyOutputFlag } from "../../../../shared/legacy/global-flags.ts";
+import { Output } from "../../../../shared/output/output.service.ts";
+import {
+  LegacyBackupRestoreNetworkError,
+  LegacyBackupRestoreUnexpectedStatusError,
+} from "../backups.errors.ts";
+import { mapLegacyHttpError } from "../../../shared/legacy-http-errors.ts";
+import type { LegacyBackupsRestoreFlags } from "./restore.command.ts";
+
+const mapRestoreError = mapLegacyHttpError({
+  networkError: LegacyBackupRestoreNetworkError,
+  statusError: LegacyBackupRestoreUnexpectedStatusError,
+  networkMessage: (cause) => `failed to restore backup: ${cause}`,
+  statusMessage: (status, body) => `unexpected restore backup status ${status}: ${body}`,
+});
 
 export const legacyBackupsRestore = Effect.fn("legacy.backups.restore")(function* (
   flags: LegacyBackupsRestoreFlags,
 ) {
-  const proxy = yield* LegacyGoProxy;
-  const args: string[] = ["backups", "restore"];
-  if (Option.isSome(flags.projectRef)) args.push("--project-ref", flags.projectRef.value);
-  if (Option.isSome(flags.timestamp)) args.push("--timestamp", String(flags.timestamp.value));
-  yield* proxy.exec(args);
+  const output = yield* Output;
+  const goOutputFlag = yield* LegacyOutputFlag;
+  const api = yield* LegacyPlatformApi;
+  const resolver = yield* LegacyProjectRefResolver;
+  const linkedProjectCache = yield* LegacyLinkedProjectCache;
+  const telemetryState = yield* LegacyTelemetryState;
+
+  const ref = yield* resolver.resolve(flags.projectRef);
+  const recoveryTimeTargetUnix = Option.getOrElse(flags.timestamp, () => 0);
+
+  // Mirror Go's PersistentPostRun — cache + telemetry flush whether the main
+  // call succeeds or fails.
+  yield* Effect.gen(function* () {
+    // Spinner only in human-facing text mode — see list.handler.ts.
+    const restoring =
+      output.format === "text" ? yield* output.task("Initiating PITR restore...") : undefined;
+    yield* api.v1
+      .restorePitrBackup({ ref, recovery_time_target_unix: recoveryTimeTargetUnix })
+      .pipe(
+        Effect.tapError(() => restoring?.fail() ?? Effect.void),
+        Effect.catch(mapRestoreError),
+      );
+    yield* restoring?.clear() ?? Effect.void;
+
+    const goFmt = Option.getOrUndefined(goOutputFlag);
+
+    // Go ignores --output entirely (restore.go:22) and always writes the text line to stderr.
+    // We mirror that for every Go --output value except `json`, where we provide a TS-only
+    // structured payload (Go has no JSON for restore — adding one is non-breaking).
+    if (goFmt === "json") {
+      yield* output.raw(
+        JSON.stringify({ message: "Started PITR restore", project_ref: ref }, null, 2) + "\n",
+      );
+      return;
+    }
+
+    if (goFmt === undefined && (output.format === "json" || output.format === "stream-json")) {
+      yield* output.success("Started PITR restore", { project_ref: ref });
+      return;
+    }
+
+    // pretty/yaml/toml/env (Go-compat) + TS text mode → byte-identical text line on stderr.
+    yield* output.raw(`Started PITR restore: ${ref}\n`, "stderr");
+  }).pipe(Effect.ensuring(linkedProjectCache.cache(ref)), Effect.ensuring(telemetryState.flush));
 });
diff --git a/apps/cli/src/legacy/commands/backups/restore/restore.integration.test.ts b/apps/cli/src/legacy/commands/backups/restore/restore.integration.test.ts
new file mode 100644
index 0000000000..394426473a
--- /dev/null
+++ b/apps/cli/src/legacy/commands/backups/restore/restore.integration.test.ts
@@ -0,0 +1,285 @@
+import { mkdtempSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+
+import { describe, expect, it } from "@effect/vitest";
+import { Effect, Exit, Option } from "effect";
+import * as HttpClientResponse from "effect/unstable/http/HttpClientResponse";
+
+import { mockOutput, mockTty } from "../../../../../tests/helpers/mocks.ts";
+import {
+  LEGACY_VALID_REF,
+  buildLegacyTestRuntime,
+  legacyJsonResponse,
+  mockLegacyCliConfig,
+  mockLegacyPlatformApi,
+  useLegacyTempWorkdir,
+} from "../../../../../tests/helpers/legacy-mocks.ts";
+import { legacyBackupsRestore } from "./restore.handler.ts";
+
+// ---------------------------------------------------------------------------
+// Setup
+// ---------------------------------------------------------------------------
+
+interface SetupOpts {
+  format?: "text" | "json" | "stream-json";
+  goOutput?: "env" | "pretty" | "json" | "toml" | "yaml";
+  status?: number;
+  network?: "fail";
+}
+
+const tempRoot = useLegacyTempWorkdir("supabase-backups-restore-int-");
+
+function setup(opts: SetupOpts = {}) {
+  const out = mockOutput({ format: opts.format ?? "text" });
+  const api = mockLegacyPlatformApi({
+    // POST returns 201 with an empty/null body in the real Management API.
+    response: { status: opts.status ?? 201, body: null },
+    network: opts.network,
+  });
+  const cliConfig = mockLegacyCliConfig({ workdir: tempRoot.current });
+  const layer = buildLegacyTestRuntime({
+    out,
+    api,
+    cliConfig,
+    goOutput: opts.goOutput === undefined ? Option.none() : Option.some(opts.goOutput),
+  });
+  return { layer, out, api };
+}
+
+// ---------------------------------------------------------------------------
+// Tests
+// ---------------------------------------------------------------------------
+
+describe("legacy backups restore integration", () => {
+  it.live("sends recovery_time_target_unix=0 when --timestamp is omitted", () => {
+    const { layer, api } = setup();
+    return Effect.gen(function* () {
+      yield* legacyBackupsRestore({
+        projectRef: Option.none(),
+        timestamp: Option.none(),
+      });
+      expect(api.requests).toHaveLength(1);
+      expect(api.requests[0]?.body).toEqual({ recovery_time_target_unix: 0 });
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("sends the supplied timestamp when --timestamp is provided", () => {
+    const { layer, api } = setup();
+    return Effect.gen(function* () {
+      yield* legacyBackupsRestore({
+        projectRef: Option.none(),
+        timestamp: Option.some(1_707_407_047),
+      });
+      expect(api.requests[0]?.body).toEqual({ recovery_time_target_unix: 1_707_407_047 });
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("writes 'Started PITR restore: <ref>\\n' to stderr in text mode (Go parity)", () => {
+    const { layer, out } = setup();
+    return Effect.gen(function* () {
+      yield* legacyBackupsRestore({
+        projectRef: Option.none(),
+        timestamp: Option.none(),
+      });
+      expect(out.stderrText).toBe(`Started PITR restore: ${LEGACY_VALID_REF}\n`);
+      expect(out.stdoutText).toBe("");
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("emits a JSON success event for --output-format=json", () => {
+    const { layer, out } = setup({ format: "json" });
+    return Effect.gen(function* () {
+      yield* legacyBackupsRestore({
+        projectRef: Option.none(),
+        timestamp: Option.none(),
+      });
+      const success = out.messages.find((m) => m.type === "success");
+      expect(success?.message).toBe("Started PITR restore");
+      expect(success?.data).toEqual({ project_ref: LEGACY_VALID_REF });
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("emits a result event for --output-format=stream-json", () => {
+    const { layer, out } = setup({ format: "stream-json" });
+    return Effect.gen(function* () {
+      yield* legacyBackupsRestore({
+        projectRef: Option.none(),
+        timestamp: Option.none(),
+      });
+      const success = out.messages.find((m) => m.type === "success");
+      expect(success?.data).toEqual({ project_ref: LEGACY_VALID_REF });
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("emits indented JSON to stdout for --output json (Go-compat)", () => {
+    const { layer, out } = setup({ goOutput: "json" });
+    return Effect.gen(function* () {
+      yield* legacyBackupsRestore({
+        projectRef: Option.none(),
+        timestamp: Option.none(),
+      });
+      expect(out.stdoutText).toContain('"message": "Started PITR restore"');
+      expect(out.stdoutText).toContain(`"project_ref": "${LEGACY_VALID_REF}"`);
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live(
+    "renders the stderr text line for --output {pretty,yaml,toml,env} (Go ignores --output)",
+    () => {
+      const { layer, out } = setup({ goOutput: "yaml" });
+      return Effect.gen(function* () {
+        yield* legacyBackupsRestore({
+          projectRef: Option.none(),
+          timestamp: Option.none(),
+        });
+        expect(out.stderrText).toBe(`Started PITR restore: ${LEGACY_VALID_REF}\n`);
+        expect(out.stdoutText).toBe("");
+      }).pipe(Effect.provide(layer));
+    },
+  );
+
+  it.live("uses --project-ref flag over LegacyCliConfig.projectId", () => {
+    const flagRef = "zzzzzzzzzzzzzzzzzzzz";
+    const { layer, api } = setup();
+    return Effect.gen(function* () {
+      yield* legacyBackupsRestore({
+        projectRef: Option.some(flagRef),
+        timestamp: Option.none(),
+      });
+      expect(api.requests[0]?.url).toContain(`/v1/projects/${flagRef}/`);
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("fails with LegacyBackupRestoreUnexpectedStatusError on HTTP 503", () => {
+    const { layer } = setup({ status: 503 });
+    return Effect.gen(function* () {
+      const exit = yield* Effect.exit(
+        legacyBackupsRestore({ projectRef: Option.none(), timestamp: Option.none() }),
+      );
+      expect(Exit.isFailure(exit)).toBe(true);
+      if (Exit.isFailure(exit)) {
+        const errorJson = JSON.stringify(exit.cause);
+        expect(errorJson).toContain("LegacyBackupRestoreUnexpectedStatusError");
+        expect(errorJson).toContain("unexpected restore backup status 503");
+      }
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("fails with LegacyBackupRestoreNetworkError on transport failure", () => {
+    const { layer } = setup({ network: "fail" });
+    return Effect.gen(function* () {
+      const exit = yield* Effect.exit(
+        legacyBackupsRestore({ projectRef: Option.none(), timestamp: Option.none() }),
+      );
+      expect(Exit.isFailure(exit)).toBe(true);
+      if (Exit.isFailure(exit)) {
+        const errorJson = JSON.stringify(exit.cause);
+        expect(errorJson).toContain("LegacyBackupRestoreNetworkError");
+        expect(errorJson).toContain("failed to restore backup");
+      }
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("fails with LegacyProjectNotLinkedError non-interactively when no ref source", () => {
+    const localTempRoot = mkdtempSync(join(tmpdir(), "supabase-backups-restore-int-noref-"));
+    const out = mockOutput({ format: "text" });
+    const api = mockLegacyPlatformApi({});
+    const cliConfig = mockLegacyCliConfig({
+      workdir: localTempRoot,
+      projectId: Option.none(),
+    });
+    const layer = buildLegacyTestRuntime({ out, api, cliConfig });
+
+    return Effect.gen(function* () {
+      const exit = yield* Effect.exit(
+        legacyBackupsRestore({ projectRef: Option.none(), timestamp: Option.none() }).pipe(
+          Effect.provide(layer),
+        ),
+      );
+      expect(Exit.isFailure(exit)).toBe(true);
+      if (Exit.isFailure(exit)) {
+        expect(JSON.stringify(exit.cause)).toContain("LegacyProjectNotLinkedError");
+      }
+    }).pipe(
+      Effect.ensuring(Effect.sync(() => rmSync(localTempRoot, { recursive: true, force: true }))),
+    );
+  });
+
+  it.live("prompts via TTY when no ref source matches and stdin is a TTY", () => {
+    const localTempRoot = mkdtempSync(join(tmpdir(), "supabase-backups-restore-int-prompt-"));
+    const out = mockOutput({
+      format: "text",
+      promptSelectResponses: [LEGACY_VALID_REF],
+    });
+    // The resolver lists projects, then POSTs the restore. Branch on the path
+    // to give the list endpoint its project array and let the restore endpoint
+    // succeed with a 201.
+    const api = mockLegacyPlatformApi({
+      handler: (request) => {
+        if (request.url.includes("/v1/projects") && !request.url.includes("/database/backups")) {
+          return Effect.succeed(
+            HttpClientResponse.fromWeb(
+              request,
+              new Response(
+                JSON.stringify([
+                  {
+                    id: LEGACY_VALID_REF,
+                    ref: LEGACY_VALID_REF,
+                    organization_id: "org_123",
+                    organization_slug: "acme",
+                    name: "alpha",
+                    region: "us-east-1",
+                    created_at: "2026-01-01T00:00:00Z",
+                    status: "ACTIVE_HEALTHY",
+                    database: {
+                      host: "db.example.com",
+                      version: "15.0",
+                      postgres_engine: "supabase-postgres",
+                      release_channel: "ga",
+                    },
+                  },
+                ]),
+                { status: 200, headers: { "content-type": "application/json" } },
+              ),
+            ),
+          );
+        }
+        return Effect.succeed(legacyJsonResponse(request, 201, null));
+      },
+    });
+    const cliConfig = mockLegacyCliConfig({
+      workdir: localTempRoot,
+      projectId: Option.none(),
+    });
+    const layer = buildLegacyTestRuntime({
+      out,
+      api,
+      cliConfig,
+      tty: mockTty({ stdinIsTty: true, stdoutIsTty: true }),
+    });
+
+    return Effect.gen(function* () {
+      yield* legacyBackupsRestore({ projectRef: Option.none(), timestamp: Option.none() }).pipe(
+        Effect.provide(layer),
+      );
+      expect(out.promptSelectCalls).toHaveLength(1);
+      expect(out.stderrText).toContain(`Started PITR restore: ${LEGACY_VALID_REF}\n`);
+    }).pipe(
+      Effect.ensuring(Effect.sync(() => rmSync(localTempRoot, { recursive: true, force: true }))),
+    );
+  });
+
+  it.live("accepts --timestamp short alias -t in the same way (no separate parse path)", () => {
+    // The flag layer is responsible for parsing -t into `timestamp`; once parsed,
+    // the handler does not differentiate, so we just verify the handler honors the value.
+    const { layer, api } = setup();
+    return Effect.gen(function* () {
+      yield* legacyBackupsRestore({
+        projectRef: Option.none(),
+        timestamp: Option.some(42),
+      });
+      expect(api.requests[0]?.body).toEqual({ recovery_time_target_unix: 42 });
+    }).pipe(Effect.provide(layer));
+  });
+});
diff --git a/apps/cli/src/legacy/commands/branches/branches.command.ts b/apps/cli/src/legacy/commands/branches/branches.command.ts
index 21d3eda1c3..8571e9f085 100644
--- a/apps/cli/src/legacy/commands/branches/branches.command.ts
+++ b/apps/cli/src/legacy/commands/branches/branches.command.ts
@@ -1,5 +1,4 @@
 import { Command } from "effect/unstable/cli";
-import { withHiddenSubcommands } from "../../../shared/cli/hidden-flag.ts";
 import { legacyBranchesListCommand } from "./list/list.command.ts";
 import { legacyBranchesCreateCommand } from "./create/create.command.ts";
 import { legacyBranchesGetCommand } from "./get/get.command.ts";
@@ -12,7 +11,6 @@ import { legacyBranchesDisableCommand } from "./disable/disable.command.ts";
 export const legacyBranchesCommand = Command.make("branches").pipe(
   Command.withDescription("Manage Supabase preview branches."),
   Command.withShortDescription("Manage preview branches"),
-  withHiddenSubcommands(["disable"]),
   Command.withSubcommands([
     legacyBranchesListCommand,
     legacyBranchesCreateCommand,
@@ -21,6 +19,6 @@ export const legacyBranchesCommand = Command.make("branches").pipe(
     legacyBranchesPauseCommand,
     legacyBranchesUnpauseCommand,
     legacyBranchesDeleteCommand,
-    legacyBranchesDisableCommand,
+    legacyBranchesDisableCommand.pipe(Command.withHidden),
   ]),
 );
diff --git a/apps/cli/src/legacy/commands/branches/branches.errors.ts b/apps/cli/src/legacy/commands/branches/branches.errors.ts
new file mode 100644
index 0000000000..0092742e88
--- /dev/null
+++ b/apps/cli/src/legacy/commands/branches/branches.errors.ts
@@ -0,0 +1,204 @@
+import { Data } from "effect";
+
+// ---------------------------------------------------------------------------
+// HTTP-bound errors — one (Network + UnexpectedStatus) pair per Go errorf site.
+// Names trace back to `apps/cli-go/internal/branches/<sub>/` for grepability.
+// Templates match Go's `errors.Errorf(...)` phrasing byte-for-byte.
+// ---------------------------------------------------------------------------
+
+export class LegacyBranchesListNetworkError extends Data.TaggedError(
+  "LegacyBranchesListNetworkError",
+)<{
+  readonly message: string;
+}> {}
+
+export class LegacyBranchesListUnexpectedStatusError extends Data.TaggedError(
+  "LegacyBranchesListUnexpectedStatusError",
+)<{
+  readonly status: number;
+  readonly body: string;
+  readonly message: string;
+}> {}
+
+export class LegacyBranchesCreateNetworkError extends Data.TaggedError(
+  "LegacyBranchesCreateNetworkError",
+)<{
+  readonly message: string;
+}> {}
+
+export class LegacyBranchesCreateUnexpectedStatusError extends Data.TaggedError(
+  "LegacyBranchesCreateUnexpectedStatusError",
+)<{
+  readonly status: number;
+  readonly body: string;
+  readonly message: string;
+}> {}
+
+// Lookup phase of `branches get` (only runs when input is not UUID / not ref).
+export class LegacyBranchesFindNetworkError extends Data.TaggedError(
+  "LegacyBranchesFindNetworkError",
+)<{
+  readonly message: string;
+}> {}
+
+export class LegacyBranchesFindUnexpectedStatusError extends Data.TaggedError(
+  "LegacyBranchesFindUnexpectedStatusError",
+)<{
+  readonly status: number;
+  readonly body: string;
+  readonly message: string;
+}> {}
+
+// `branches get` detail phase + the resolver's UUID branch (both use
+// V1GetABranchConfig; Go shares the same error template).
+export class LegacyBranchesGetNetworkError extends Data.TaggedError(
+  "LegacyBranchesGetNetworkError",
+)<{
+  readonly message: string;
+}> {}
+
+export class LegacyBranchesGetUnexpectedStatusError extends Data.TaggedError(
+  "LegacyBranchesGetUnexpectedStatusError",
+)<{
+  readonly status: number;
+  readonly body: string;
+  readonly message: string;
+}> {}
+
+export class LegacyBranchesApiKeysNetworkError extends Data.TaggedError(
+  "LegacyBranchesApiKeysNetworkError",
+)<{
+  readonly message: string;
+}> {}
+
+export class LegacyBranchesApiKeysUnexpectedStatusError extends Data.TaggedError(
+  "LegacyBranchesApiKeysUnexpectedStatusError",
+)<{
+  readonly status: number;
+  readonly body: string;
+  readonly message: string;
+}> {}
+
+export class LegacyBranchesPoolerNetworkError extends Data.TaggedError(
+  "LegacyBranchesPoolerNetworkError",
+)<{
+  readonly message: string;
+}> {}
+
+export class LegacyBranchesPoolerUnexpectedStatusError extends Data.TaggedError(
+  "LegacyBranchesPoolerUnexpectedStatusError",
+)<{
+  readonly status: number;
+  readonly body: string;
+  readonly message: string;
+}> {}
+
+export class LegacyBranchesPrimaryNotFoundError extends Data.TaggedError(
+  "LegacyBranchesPrimaryNotFoundError",
+)<{
+  readonly message: string;
+}> {}
+
+export class LegacyBranchesUpdateNetworkError extends Data.TaggedError(
+  "LegacyBranchesUpdateNetworkError",
+)<{
+  readonly message: string;
+}> {}
+
+export class LegacyBranchesUpdateUnexpectedStatusError extends Data.TaggedError(
+  "LegacyBranchesUpdateUnexpectedStatusError",
+)<{
+  readonly status: number;
+  readonly body: string;
+  readonly message: string;
+}> {}
+
+export class LegacyBranchesPauseNetworkError extends Data.TaggedError(
+  "LegacyBranchesPauseNetworkError",
+)<{
+  readonly message: string;
+}> {}
+
+export class LegacyBranchesPauseUnexpectedStatusError extends Data.TaggedError(
+  "LegacyBranchesPauseUnexpectedStatusError",
+)<{
+  readonly status: number;
+  readonly body: string;
+  readonly message: string;
+}> {}
+
+export class LegacyBranchesUnpauseNetworkError extends Data.TaggedError(
+  "LegacyBranchesUnpauseNetworkError",
+)<{
+  readonly message: string;
+}> {}
+
+export class LegacyBranchesUnpauseUnexpectedStatusError extends Data.TaggedError(
+  "LegacyBranchesUnpauseUnexpectedStatusError",
+)<{
+  readonly status: number;
+  readonly body: string;
+  readonly message: string;
+}> {}
+
+export class LegacyBranchesDeleteNetworkError extends Data.TaggedError(
+  "LegacyBranchesDeleteNetworkError",
+)<{
+  readonly message: string;
+}> {}
+
+export class LegacyBranchesDeleteUnexpectedStatusError extends Data.TaggedError(
+  "LegacyBranchesDeleteUnexpectedStatusError",
+)<{
+  readonly status: number;
+  readonly body: string;
+  readonly message: string;
+}> {}
+
+export class LegacyBranchesDisableNetworkError extends Data.TaggedError(
+  "LegacyBranchesDisableNetworkError",
+)<{
+  readonly message: string;
+}> {}
+
+export class LegacyBranchesDisableUnexpectedStatusError extends Data.TaggedError(
+  "LegacyBranchesDisableUnexpectedStatusError",
+)<{
+  readonly status: number;
+  readonly body: string;
+  readonly message: string;
+}> {}
+
+// ---------------------------------------------------------------------------
+// Pure-path errors (validation, prompt-time semantics, user cancellation).
+// ---------------------------------------------------------------------------
+
+export class LegacyBranchesEnvNotSupportedError extends Data.TaggedError(
+  "LegacyBranchesEnvNotSupportedError",
+)<{
+  readonly message: string;
+}> {}
+
+export class LegacyBranchesCreateCancelledError extends Data.TaggedError(
+  "LegacyBranchesCreateCancelledError",
+)<{
+  readonly message: string;
+}> {}
+
+export class LegacyBranchesBranchNameEmptyError extends Data.TaggedError(
+  "LegacyBranchesBranchNameEmptyError",
+)<{
+  readonly message: string;
+}> {}
+
+export class LegacyBranchesBranchingDisabledError extends Data.TaggedError(
+  "LegacyBranchesBranchingDisabledError",
+)<{
+  readonly message: string;
+  /**
+   * Mirrors Go's `utils.CmdSuggestion = "Create your first branch with: supabase
+   * branches create"` (`apps/cli-go/cmd/branches.go:252`). Picked up by
+   * `normalizeCliError` and printed after the error message in text mode.
+   */
+  readonly suggestion: string;
+}> {}
diff --git a/apps/cli/src/legacy/commands/branches/branches.format.ts b/apps/cli/src/legacy/commands/branches/branches.format.ts
new file mode 100644
index 0000000000..4b4dc5293f
--- /dev/null
+++ b/apps/cli/src/legacy/commands/branches/branches.format.ts
@@ -0,0 +1,280 @@
+import type {
+  ApiKeyResponse,
+  BranchResponse,
+  SupavisorConfigResponse,
+  V1GetABranchConfigOutput,
+} from "@supabase/api/effect";
+
+import { renderGlamourTable } from "../../output/legacy-glamour-table.ts";
+
+// ---------------------------------------------------------------------------
+// Pure formatters — no Effect / no service dependencies, kept unit-testable.
+// Match Go's byte output for `branches list`, `branches create`, `branches get`.
+// ---------------------------------------------------------------------------
+
+const LIST_HEADERS = [
+  "ID",
+  "NAME",
+  "DEFAULT",
+  "GIT BRANCH",
+  "WITH DATA",
+  "STATUS",
+  "CREATED AT (UTC)",
+  "UPDATED AT (UTC)",
+] as const;
+
+const GET_HEADERS = [
+  "HOST",
+  "PORT",
+  "USER",
+  "PASSWORD",
+  "JWT SECRET",
+  "POSTGRES VERSION",
+  "STATUS",
+] as const;
+
+function pad2(value: number): string {
+  return value.toString().padStart(2, "0");
+}
+
+/**
+ * Reproduces Go's `utils.FormatTime`: parse the ISO date-time and re-render
+ * as UTC "YYYY-MM-DD HH:MM:SS". Used for the CREATED AT / UPDATED AT columns
+ * of `branches list`.
+ */
+export function formatUtcDateTime(value: string): string {
+  if (value.length === 0) return value;
+  const parsed = Date.parse(value);
+  if (Number.isNaN(parsed)) return value;
+  const d = new Date(parsed);
+  return (
+    `${d.getUTCFullYear()}-${pad2(d.getUTCMonth() + 1)}-${pad2(d.getUTCDate())} ` +
+    `${pad2(d.getUTCHours())}:${pad2(d.getUTCMinutes())}:${pad2(d.getUTCSeconds())}`
+  );
+}
+
+type Branch = typeof BranchResponse.Type;
+
+/**
+ * Reproduces Go's `branches/list/list.go:ToMarkdown` + glamour pipeline.
+ *
+ * Go's markdown intermediate wraps each cell in backticks and escapes `|`
+ * with `\|`; glamour decodes the escape sequence back to a literal `|` and
+ * strips the backticks. Our `renderGlamourTable` lays out cells directly,
+ * so we pass raw values — including any literal `|` in the name / git branch
+ * — and the byte output matches the Go binary fixture.
+ */
+export function renderBranchesListTable(branches: ReadonlyArray<Branch>): string {
+  const rows = branches.map((b) => [
+    b.project_ref,
+    b.name,
+    b.is_default ? "true" : "false",
+    b.git_branch ?? " ",
+    b.with_data ? "true" : "false",
+    b.status,
+    formatUtcDateTime(b.created_at),
+    formatUtcDateTime(b.updated_at),
+  ]);
+  return renderGlamourTable(LIST_HEADERS, rows);
+}
+
+/**
+ * Reproduces Go's `branches/get/get.go:38-51` pretty-table render: one row
+ * with 7 columns. `db_user` / `db_pass` / `jwt_secret` render as `******`
+ * when the API returns nil/undefined (matches Go's `if x == nil { x = &"******" }`
+ * mutation in `get.go:71-80`).
+ */
+export function renderBranchGetTable(detail: typeof V1GetABranchConfigOutput.Type): string {
+  const rows = [
+    [
+      detail.db_host,
+      String(detail.db_port),
+      detail.db_user ?? "******",
+      detail.db_pass ?? "******",
+      detail.jwt_secret ?? "******",
+      detail.postgres_version,
+      detail.status,
+    ],
+  ];
+  return renderGlamourTable(GET_HEADERS, rows);
+}
+
+// ---------------------------------------------------------------------------
+// Standard-env projection for `branches get` non-pretty modes.
+// Mirrors Go's `toStandardEnvs` + `apiKeys.ToEnv` (`get.go:84-105`,
+// `api_keys.go:51-66`).
+// ---------------------------------------------------------------------------
+
+const POOLER_PASSWORD_PLACEHOLDER = "[YOUR-PASSWORD]";
+
+interface PoolerParts {
+  readonly user: string;
+  readonly host: string;
+  readonly port: number;
+  readonly database: string;
+  readonly runtimeParams: Readonly<Record<string, string>>;
+}
+
+export type PoolerParseResult =
+  | { readonly ok: true; readonly parts: PoolerParts }
+  | { readonly ok: false; readonly error: string };
+
+/**
+ * Reproduces Go's `utils.ParsePoolerURL` (`apps/cli-go/internal/utils/connect.go:103`):
+ * remove the `[YOUR-PASSWORD]` placeholder text from the connection string
+ * (it confuses pgconn's strict URL parser) and then parse the host/port/user.
+ *
+ * On failure, returns a structured result with the parse error description —
+ * not the raw connection string. Go's WARNING line carries the pgconn parse
+ * error message (e.g. `failed to parse pooler URL: parse "...": invalid port`),
+ * never the URL itself. Returning the URL would leak the pooler username,
+ * host, and port into stderr logs.
+ */
+export function parsePoolerConnectionString(connString: string): PoolerParseResult {
+  const sanitized = connString.replaceAll(POOLER_PASSWORD_PLACEHOLDER, "");
+  let url: URL;
+  try {
+    url = new URL(sanitized);
+  } catch {
+    // Node's URL constructor embeds the input string in its error message.
+    // Return a stable description with no input fragments so the warning
+    // line on stderr never leaks the pooler URL.
+    return { ok: false, error: "invalid URL" };
+  }
+  if (url.protocol !== "postgresql:" && url.protocol !== "postgres:") {
+    return { ok: false, error: `unexpected scheme ${url.protocol}` };
+  }
+  const port = Number.parseInt(url.port || "5432", 10);
+  if (Number.isNaN(port)) {
+    return { ok: false, error: `invalid port ${url.port}` };
+  }
+  const database = decodeURIComponent(url.pathname.replace(/^\//, "") || "postgres");
+  const runtimeParams: Record<string, string> = {};
+  url.searchParams.forEach((value, key) => {
+    runtimeParams[key] = value;
+  });
+  return {
+    ok: true,
+    parts: {
+      user: decodeURIComponent(url.username),
+      host: url.hostname,
+      port,
+      database,
+      runtimeParams,
+    },
+  };
+}
+
+interface PgConfig {
+  readonly host: string;
+  readonly port: number;
+  readonly user: string;
+  readonly password: string;
+  readonly database: string;
+  readonly runtimeParams?: Readonly<Record<string, string>>;
+}
+
+/**
+ * Reproduces Go's `utils.ToPostgresURL` (`apps/cli-go/internal/utils/connect.go:23`):
+ *
+ *   postgresql://<urlencode(user):urlencode(pass)>@<host>:<port>/<pathEscape(db)>?connect_timeout=10[&k=urlencode(v)]
+ *
+ * IPv6 hosts get wrapped in square brackets. ConnectTimeout defaults to 10.
+ */
+export function toPostgresUrl(config: PgConfig, connectTimeoutSeconds: number = 10): string {
+  const params = new URLSearchParams();
+  params.set("connect_timeout", String(connectTimeoutSeconds));
+  for (const [k, v] of Object.entries(config.runtimeParams ?? {})) {
+    params.append(k, v);
+  }
+  let host = config.host;
+  // IPv6 detection: contains `:` and isn't already bracketed.
+  if (host.includes(":") && !host.startsWith("[")) {
+    host = `[${host}]`;
+  }
+  return (
+    `postgresql://${encodeURIComponent(config.user)}:${encodeURIComponent(config.password)}` +
+    `@${host}:${config.port}/${encodeURIComponent(config.database)}?${params.toString()}`
+  );
+}
+
+type ApiKey = typeof ApiKeyResponse.Type;
+type Pooler = typeof SupavisorConfigResponse.Type;
+type Detail = typeof V1GetABranchConfigOutput.Type;
+
+/**
+ * Reproduces Go's `apiKeys.ToEnv` (`api_keys.go:51-66`):
+ * uppercase the name, wrap as `SUPABASE_<NAME>_KEY`, fall back to `"******"`
+ * when the api_key value is nullable-null.
+ */
+export function apiKeysToEnv(keys: ReadonlyArray<ApiKey>): Record<string, string> {
+  const envs: Record<string, string> = {};
+  for (const entry of keys) {
+    const name = entry.name.toUpperCase();
+    const key = `SUPABASE_${name}_KEY`;
+    const value = entry.api_key === undefined || entry.api_key === null ? "******" : entry.api_key;
+    envs[key] = value;
+  }
+  return envs;
+}
+
+export interface StandardEnvsResult {
+  readonly envs: Record<string, string>;
+  /**
+   * Set when the pooler URL failed to parse, so the caller can mirror Go's
+   * `fmt.Fprintln(os.Stderr, utils.Yellow("WARNING:"), err)` line.
+   */
+  readonly poolerWarning?: string;
+}
+
+/**
+ * Reproduces Go's `toStandardEnvs` (`apps/cli-go/internal/branches/get/get.go:84-105`):
+ *
+ *   - `POSTGRES_URL`: pooled URL on success, falls back to the direct URL with
+ *     a stderr warning on parse failure.
+ *   - `POSTGRES_URL_NON_POOLING`: direct URL.
+ *   - `SUPABASE_URL`: `https://<projectRef>.<projectHost>`.
+ *   - `SUPABASE_JWT_SECRET`: the unmasked secret (which has already been
+ *     `******`-substituted upstream if the API returned null).
+ *   - `SUPABASE_<NAME>_KEY`: from `apiKeysToEnv`.
+ */
+export function toStandardEnvs(
+  detail: Detail,
+  pooler: Pooler,
+  keys: ReadonlyArray<ApiKey>,
+  projectHost: string,
+): StandardEnvsResult {
+  const direct: PgConfig = {
+    host: detail.db_host,
+    port: detail.db_port,
+    user: detail.db_user ?? "******",
+    password: detail.db_pass ?? "******",
+    database: "postgres",
+  };
+
+  let poolerWarning: string | undefined;
+  let pooled: PgConfig = direct;
+  const parsed = parsePoolerConnectionString(pooler.connection_string);
+  if (!parsed.ok) {
+    poolerWarning = `failed to parse pooler URL: ${parsed.error}`;
+  } else {
+    pooled = {
+      host: parsed.parts.host,
+      port: parsed.parts.port,
+      user: parsed.parts.user,
+      password: direct.password,
+      database: parsed.parts.database,
+      runtimeParams: parsed.parts.runtimeParams,
+    };
+  }
+
+  const envs: Record<string, string> = {
+    ...apiKeysToEnv(keys),
+    POSTGRES_URL: toPostgresUrl(pooled),
+    POSTGRES_URL_NON_POOLING: toPostgresUrl(direct),
+    SUPABASE_URL: `https://${detail.ref}.${projectHost}`,
+    SUPABASE_JWT_SECRET: detail.jwt_secret ?? "******",
+  };
+
+  return poolerWarning === undefined ? { envs } : { envs, poolerWarning };
+}
diff --git a/apps/cli/src/legacy/commands/branches/branches.format.unit.test.ts b/apps/cli/src/legacy/commands/branches/branches.format.unit.test.ts
new file mode 100644
index 0000000000..f7c8052753
--- /dev/null
+++ b/apps/cli/src/legacy/commands/branches/branches.format.unit.test.ts
@@ -0,0 +1,293 @@
+import { describe, expect, it } from "vitest";
+
+import {
+  apiKeysToEnv,
+  formatUtcDateTime,
+  parsePoolerConnectionString,
+  renderBranchGetTable,
+  renderBranchesListTable,
+  toPostgresUrl,
+  toStandardEnvs,
+} from "./branches.format.ts";
+
+describe("formatUtcDateTime", () => {
+  it("formats ISO date-time as UTC YYYY-MM-DD HH:MM:SS", () => {
+    expect(formatUtcDateTime("2026-05-27T03:04:05Z")).toBe("2026-05-27 03:04:05");
+  });
+
+  it("zero-pads single-digit months and minutes", () => {
+    expect(formatUtcDateTime("2026-01-02T03:04:05Z")).toBe("2026-01-02 03:04:05");
+  });
+
+  it("returns the empty string unchanged", () => {
+    expect(formatUtcDateTime("")).toBe("");
+  });
+
+  it("returns garbage input unchanged when Date.parse cannot decode it", () => {
+    expect(formatUtcDateTime("not-a-date")).toBe("not-a-date");
+  });
+});
+
+describe("renderBranchesListTable", () => {
+  it("renders all 8 columns in declared order", () => {
+    const out = renderBranchesListTable([
+      {
+        id: "11111111-2222-3333-4444-555555555555",
+        name: "feat-1",
+        project_ref: "abcdefghijklmnopqrst",
+        parent_project_ref: "parent-ref-aaaaaaaaa",
+        is_default: false,
+        git_branch: "feat-1",
+        persistent: false,
+        status: "MIGRATIONS_PASSED",
+        created_at: "2026-05-27T01:02:03Z",
+        updated_at: "2026-05-27T01:02:04Z",
+        with_data: true,
+      },
+    ]);
+    expect(out).toContain("ID");
+    expect(out).toContain("NAME");
+    expect(out).toContain("DEFAULT");
+    expect(out).toContain("GIT BRANCH");
+    expect(out).toContain("WITH DATA");
+    expect(out).toContain("STATUS");
+    expect(out).toContain("CREATED AT (UTC)");
+    expect(out).toContain("UPDATED AT (UTC)");
+    expect(out).toContain("abcdefghijklmnopqrst");
+    expect(out).toContain("feat-1");
+    expect(out).toContain("2026-05-27 01:02:03");
+  });
+
+  it("renders a literal `|` in branch name (Glamour does not double-escape)", () => {
+    const out = renderBranchesListTable([
+      {
+        id: "id",
+        name: "with|pipe",
+        project_ref: "ref",
+        parent_project_ref: "parent",
+        is_default: false,
+        git_branch: "git|pipe",
+        persistent: false,
+        status: "MIGRATIONS_PASSED",
+        created_at: "",
+        updated_at: "",
+        with_data: false,
+      },
+    ]);
+    expect(out).toContain("with|pipe");
+    expect(out).toContain("git|pipe");
+  });
+
+  it("renders empty git_branch as a single space (Go parity)", () => {
+    const out = renderBranchesListTable([
+      {
+        id: "id",
+        name: "n",
+        project_ref: "ref",
+        parent_project_ref: "parent",
+        is_default: false,
+        persistent: false,
+        status: "MIGRATIONS_PASSED",
+        created_at: "",
+        updated_at: "",
+        with_data: false,
+      },
+    ]);
+    // The space cell is hard to assert directly; assert the table renders.
+    expect(out).toContain("STATUS");
+  });
+});
+
+describe("renderBranchGetTable", () => {
+  it("masks db_user, db_pass, jwt_secret as ****** when undefined", () => {
+    const out = renderBranchGetTable({
+      ref: "abcdefghijklmnopqrst",
+      postgres_version: "15",
+      postgres_engine: "15",
+      release_channel: "ga",
+      status: "ACTIVE_HEALTHY",
+      db_host: "db.example.com",
+      db_port: 5432,
+    });
+    expect(out).toContain("******");
+    expect(out).toContain("HOST");
+    expect(out).toContain("POSTGRES VERSION");
+    expect(out).toContain("ACTIVE_HEALTHY");
+  });
+
+  it("uses provided db_user / db_pass / jwt_secret when set", () => {
+    const out = renderBranchGetTable({
+      ref: "abcdefghijklmnopqrst",
+      postgres_version: "15",
+      postgres_engine: "15",
+      release_channel: "ga",
+      status: "ACTIVE_HEALTHY",
+      db_host: "db.example.com",
+      db_port: 5432,
+      db_user: "postgres",
+      db_pass: "topsecret",
+      jwt_secret: "jwt-secret-value",
+    });
+    expect(out).toContain("postgres");
+    expect(out).toContain("topsecret");
+    expect(out).toContain("jwt-secret-value");
+  });
+});
+
+describe("apiKeysToEnv", () => {
+  it("uppercases name and wraps as SUPABASE_<NAME>_KEY", () => {
+    expect(
+      apiKeysToEnv([
+        { name: "anon", api_key: "anon-key" },
+        { name: "service_role", api_key: "sr-key" },
+      ]),
+    ).toEqual({
+      SUPABASE_ANON_KEY: "anon-key",
+      SUPABASE_SERVICE_ROLE_KEY: "sr-key",
+    });
+  });
+
+  it("masks null/undefined api_key as ******", () => {
+    expect(apiKeysToEnv([{ name: "anon", api_key: null }])).toEqual({
+      SUPABASE_ANON_KEY: "******",
+    });
+    expect(apiKeysToEnv([{ name: "service_role" }])).toEqual({
+      SUPABASE_SERVICE_ROLE_KEY: "******",
+    });
+  });
+});
+
+describe("toPostgresUrl", () => {
+  it("encodes IPv4 host with connect_timeout=10 default", () => {
+    const url = toPostgresUrl({
+      host: "192.0.2.10",
+      port: 5432,
+      user: "postgres",
+      password: "p",
+      database: "postgres",
+    });
+    expect(url).toBe("postgresql://postgres:p@192.0.2.10:5432/postgres?connect_timeout=10");
+  });
+
+  it("wraps IPv6 host in square brackets", () => {
+    const url = toPostgresUrl({
+      host: "2001:db8::1",
+      port: 5432,
+      user: "postgres",
+      password: "p",
+      database: "postgres",
+    });
+    expect(url).toContain("@[2001:db8::1]:5432");
+  });
+
+  it("appends runtime params after connect_timeout", () => {
+    const url = toPostgresUrl({
+      host: "h",
+      port: 5432,
+      user: "u",
+      password: "p",
+      database: "d",
+      runtimeParams: { options: "--cluster=foo" },
+    });
+    expect(url).toContain("connect_timeout=10");
+    expect(url).toContain("options=--cluster%3Dfoo");
+  });
+});
+
+describe("parsePoolerConnectionString", () => {
+  it("strips [YOUR-PASSWORD] placeholder before parsing", () => {
+    const parsed = parsePoolerConnectionString(
+      "postgresql://postgres.refxxxxxxxxxxxxxxxxxx:[YOUR-PASSWORD]@aws-0-us-east-1.pooler.supabase.com:6543/postgres",
+    );
+    expect(parsed.ok).toBe(true);
+    if (parsed.ok) {
+      expect(parsed.parts.host).toBe("aws-0-us-east-1.pooler.supabase.com");
+      expect(parsed.parts.port).toBe(6543);
+      expect(parsed.parts.database).toBe("postgres");
+      expect(parsed.parts.user).toBe("postgres.refxxxxxxxxxxxxxxxxxx");
+    }
+  });
+
+  it("returns an error description (not the raw URL) for unparseable input", () => {
+    const parsed = parsePoolerConnectionString("not a url");
+    expect(parsed.ok).toBe(false);
+    if (!parsed.ok) {
+      expect(parsed.error).not.toContain("not a url");
+      expect(parsed.error.length).toBeGreaterThan(0);
+    }
+  });
+
+  it("rejects a non-postgresql scheme with the scheme in the error", () => {
+    const parsed = parsePoolerConnectionString("http://example.com");
+    expect(parsed.ok).toBe(false);
+    if (!parsed.ok) {
+      expect(parsed.error).toContain("http:");
+    }
+  });
+});
+
+describe("toStandardEnvs", () => {
+  const detail = {
+    ref: "abcdefghijklmnopqrst",
+    postgres_version: "15",
+    postgres_engine: "15",
+    release_channel: "ga",
+    status: "ACTIVE_HEALTHY" as const,
+    db_host: "db.example.com",
+    db_port: 5432,
+    db_user: "postgres",
+    db_pass: "secret",
+    jwt_secret: "jwt-secret",
+  };
+  const pooler = {
+    identifier: "id",
+    database_type: "PRIMARY" as const,
+    is_using_scram_auth: true,
+    db_user: "u",
+    db_host: "h",
+    db_port: 5432,
+    db_name: "postgres",
+    connection_string:
+      "postgresql://postgres.abc:[YOUR-PASSWORD]@aws-0-us-east-1.pooler.supabase.com:6543/postgres",
+    connectionString: "n/a",
+    default_pool_size: null,
+    max_client_conn: null,
+    pool_mode: "transaction" as const,
+  };
+
+  it("produces the 4 fixed keys plus per-key SUPABASE_<NAME>_KEY entries", () => {
+    const result = toStandardEnvs(
+      detail,
+      pooler,
+      [
+        { name: "anon", api_key: "anon-value" },
+        { name: "service_role", api_key: "sr-value" },
+      ],
+      "supabase.co",
+    );
+    expect(Object.keys(result.envs).sort()).toEqual([
+      "POSTGRES_URL",
+      "POSTGRES_URL_NON_POOLING",
+      "SUPABASE_ANON_KEY",
+      "SUPABASE_JWT_SECRET",
+      "SUPABASE_SERVICE_ROLE_KEY",
+      "SUPABASE_URL",
+    ]);
+    expect(result.envs.SUPABASE_URL).toBe("https://abcdefghijklmnopqrst.supabase.co");
+    expect(result.envs.SUPABASE_JWT_SECRET).toBe("jwt-secret");
+    expect(result.envs.POSTGRES_URL).toContain(
+      "@aws-0-us-east-1.pooler.supabase.com:6543/postgres",
+    );
+    // The pooler password is replaced with the direct password — Go parity.
+    expect(result.envs.POSTGRES_URL).toContain(":secret@");
+    expect(result.envs.POSTGRES_URL_NON_POOLING).toContain("@db.example.com:5432/postgres");
+    expect(result.poolerWarning).toBeUndefined();
+  });
+
+  it("falls back to the direct URL and surfaces a warning on parse failure", () => {
+    const broken = { ...pooler, connection_string: "not a url" };
+    const result = toStandardEnvs(detail, broken, [], "supabase.co");
+    expect(result.envs.POSTGRES_URL).toBe(result.envs.POSTGRES_URL_NON_POOLING);
+    expect(result.poolerWarning).toBeDefined();
+  });
+});
diff --git a/apps/cli/src/legacy/commands/branches/branches.prompt.ts b/apps/cli/src/legacy/commands/branches/branches.prompt.ts
new file mode 100644
index 0000000000..07653be4af
--- /dev/null
+++ b/apps/cli/src/legacy/commands/branches/branches.prompt.ts
@@ -0,0 +1,101 @@
+import { styleText } from "node:util";
+
+import { Effect, Option } from "effect";
+
+import { LegacyPlatformApi } from "../../auth/legacy-platform-api.service.ts";
+import { mapLegacyHttpError } from "../../shared/legacy-http-errors.ts";
+import { Output } from "../../../shared/output/output.service.ts";
+import { detectGitBranch } from "../../../shared/git/git-branch.ts";
+import { Tty } from "../../../shared/runtime/tty.service.ts";
+import {
+  LegacyBranchesBranchNameEmptyError,
+  LegacyBranchesBranchingDisabledError,
+  LegacyBranchesListNetworkError,
+  LegacyBranchesListUnexpectedStatusError,
+} from "./branches.errors.ts";
+
+const mapListError = mapLegacyHttpError({
+  networkError: LegacyBranchesListNetworkError,
+  statusError: LegacyBranchesListUnexpectedStatusError,
+  networkMessage: (cause) => `failed to list branch: ${cause}`,
+  statusMessage: (status, body) => `unexpected list branch status ${status}: ${body}`,
+});
+
+/**
+ * Reproduces Go's `promptBranchId` (`apps/cli-go/cmd/branches.go:230-269`).
+ *
+ *   - Non-TTY: read from stdin via `Output.promptText`. The prompt label
+ *     includes the current git branch as a default when one is detected.
+ *     If the user enters an empty string and no git branch is available,
+ *     fail with "branch name cannot be empty".
+ *   - TTY: call the list endpoint; if empty, fail with "branching is disabled".
+ *     Otherwise present a `promptSelect` and write `"Selected branch ID: <ref>"`
+ *     to stderr (text mode only — Go writes via `fmt.Fprintln(os.Stderr, ...)`).
+ *
+ * Used by `get`, `update`, `pause`, `unpause`, `delete` whenever the positional
+ * `[name]` argument is omitted.
+ */
+export const legacyPromptBranchId = Effect.fnUntraced(function* (
+  input: Option.Option<string>,
+  projectRef: string,
+) {
+  if (Option.isSome(input) && input.value.length > 0) {
+    return input.value;
+  }
+
+  const tty = yield* Tty;
+  const output = yield* Output;
+
+  if (!tty.stdinIsTty) {
+    // Non-TTY path: read once from stdin, optionally with a git-branch default.
+    const gitBranch = yield* detectGitBranch;
+    const defaultBranch = Option.getOrElse(gitBranch, () => "");
+    // Go applies `utils.Aqua(branchId)` to the default in the prompt label
+    // (`apps/cli-go/cmd/branches.go:235`). lipgloss color "14" maps to ANSI
+    // bright cyan; `styleText("cyan", ...)` is the closest faithful match.
+    const label =
+      defaultBranch.length > 0
+        ? `Enter the name of your branch (or leave blank to use ${styleText("cyan", defaultBranch)}): `
+        : "Enter the name of your branch: ";
+    const entered = yield* output
+      .promptText(label, { defaultValue: defaultBranch })
+      .pipe(Effect.orElseSucceed(() => ""));
+    const resolved = entered.length > 0 ? entered : defaultBranch;
+    if (resolved.length === 0) {
+      return yield* new LegacyBranchesBranchNameEmptyError({
+        message: "branch name cannot be empty",
+      });
+    }
+    return resolved;
+  }
+
+  // TTY path: list branches via the same endpoint as `branches list`, then
+  // present a select prompt keyed by branch ref.
+  const api = yield* LegacyPlatformApi;
+  const branches = yield* api.v1
+    .listAllBranches({ ref: projectRef })
+    .pipe(Effect.catch(mapListError));
+  if (branches.length === 0) {
+    return yield* new LegacyBranchesBranchingDisabledError({
+      message: "branching is disabled",
+      // Go's `utils.CmdSuggestion` (`apps/cli-go/cmd/branches.go:252`).
+      // The command name is wrapped in lipgloss color "14" (ANSI cyan).
+      suggestion: `Create your first branch with: ${styleText("cyan", "supabase branches create")}`,
+    });
+  }
+
+  const options = branches.map((branch) => ({
+    value: branch.project_ref,
+    label: branch.name,
+    hint: branch.project_ref,
+  }));
+
+  const choice = yield* output
+    .promptSelect("Select a branch:", options)
+    .pipe(Effect.orElseSucceed(() => options[0]!.value));
+
+  if (output.format === "text") {
+    yield* output.raw(`Selected branch ID: ${choice}\n`, "stderr");
+  }
+  return choice;
+});
diff --git a/apps/cli/src/legacy/commands/branches/branches.resolver.ts b/apps/cli/src/legacy/commands/branches/branches.resolver.ts
new file mode 100644
index 0000000000..4ca9a6b879
--- /dev/null
+++ b/apps/cli/src/legacy/commands/branches/branches.resolver.ts
@@ -0,0 +1,77 @@
+import { Effect } from "effect";
+
+import { LegacyPlatformApi } from "../../auth/legacy-platform-api.service.ts";
+import { mapLegacyHttpError } from "../../shared/legacy-http-errors.ts";
+import {
+  LegacyBranchesFindNetworkError,
+  LegacyBranchesFindUnexpectedStatusError,
+  LegacyBranchesGetNetworkError,
+  LegacyBranchesGetUnexpectedStatusError,
+} from "./branches.errors.ts";
+
+/**
+ * Project ref pattern shared by every Management-API endpoint that accepts a
+ * 20-lowercase-letter project reference. Re-export so siblings (e.g.
+ * `get.handler.ts`) can classify branch-id inputs without re-declaring it.
+ */
+export const LEGACY_BRANCH_PROJECT_REF_PATTERN = /^[a-z]{20}$/;
+
+/**
+ * Permissive UUID pattern (any 8-4-4-4-12 hex sequence). Go uses
+ * `github.com/google/uuid`'s `uuid.Validate` which accepts any RFC 4122
+ * variant including v6/v7 and version 0 — we mirror that liberal acceptance
+ * rather than the v1–v5 + variant-1 subset.
+ */
+export const LEGACY_BRANCH_UUID_PATTERN =
+  /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+
+const mapFindError = mapLegacyHttpError({
+  networkError: LegacyBranchesFindNetworkError,
+  statusError: LegacyBranchesFindUnexpectedStatusError,
+  networkMessage: (cause) => `failed to find branch: ${cause}`,
+  statusMessage: (status, body) => `unexpected find branch status ${status}: ${body}`,
+});
+
+const mapGetError = mapLegacyHttpError({
+  networkError: LegacyBranchesGetNetworkError,
+  statusError: LegacyBranchesGetUnexpectedStatusError,
+  networkMessage: (cause) => `failed to get branch: ${cause}`,
+  statusMessage: (status, body) => `unexpected get branch status ${status}: ${body}`,
+});
+
+/**
+ * Reproduces `apps/cli-go/internal/branches/pause/pause.go:GetBranchProjectRef`:
+ *
+ * 1. If the input matches `^[a-z]{20}$`, it's already a project ref — return as-is.
+ * 2. Else if the input is a UUID, call `V1GetABranchConfig` (`GET /v1/branches/{id}`)
+ *    and return `JSON200.ref`.
+ * 3. Otherwise treat as a branch name under the linked project ref: call
+ *    `V1GetABranch` (`GET /v1/projects/{ref}/branches/{name}`) and return
+ *    `JSON200.project_ref`.
+ *
+ * The persistent `--project-ref` is required for path 3 and is passed in by
+ * the caller (which has already run `LegacyProjectRefResolver` so the linked
+ * project cache write does not re-fire here).
+ */
+export const legacyResolveBranchProjectRef = Effect.fnUntraced(function* (
+  input: string,
+  projectRef: string,
+) {
+  if (LEGACY_BRANCH_PROJECT_REF_PATTERN.test(input)) {
+    return input;
+  }
+
+  const api = yield* LegacyPlatformApi;
+
+  if (LEGACY_BRANCH_UUID_PATTERN.test(input)) {
+    const detail = yield* api.v1
+      .getABranchConfig({ branch_id_or_ref: input })
+      .pipe(Effect.catch(mapGetError));
+    return detail.ref;
+  }
+
+  const branch = yield* api.v1
+    .getABranch({ ref: projectRef, name: input })
+    .pipe(Effect.catch(mapFindError));
+  return branch.project_ref;
+});
diff --git a/apps/cli/src/legacy/commands/branches/create/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/branches/create/SIDE_EFFECTS.md
index a763eee186..98d5134fe2 100644
--- a/apps/cli/src/legacy/commands/branches/create/SIDE_EFFECTS.md
+++ b/apps/cli/src/legacy/commands/branches/create/SIDE_EFFECTS.md
@@ -2,58 +2,64 @@
 
 ## Files Read
 
-| Path                              | Format                    | When                                                       |
-| --------------------------------- | ------------------------- | ---------------------------------------------------------- |
-| `~/.supabase/access-token`        | plain text (token string) | when `SUPABASE_ACCESS_TOKEN` unset and keyring unavailable |
-| `<workdir>/.supabase/config.json` | JSON                      | always, to resolve linked project ref                      |
+| Path                                      | Format                    | When                                                                                          |
+| ----------------------------------------- | ------------------------- | --------------------------------------------------------------------------------------------- |
+| keyring `"Supabase CLI"` / `<profile>`    | OS keychain               | when `SUPABASE_ACCESS_TOKEN` unset and keyring available; account = `LegacyCliConfig.profile` |
+| keyring `"Supabase CLI"` / `access-token` | OS keychain               | legacy-key fallback when the profile-keyed lookup misses                                      |
+| `~/.supabase/access-token`                | plain text (token string) | last-resort fallback after env + keyring miss                                                 |
+| `<workdir>/supabase/.temp/project-ref`    | plain text                | when `--project-ref` and `SUPABASE_PROJECT_ID` are both unset                                 |
+| `<cwd>/.git/HEAD` (walking parents)       | plain text                | when the positional `[name]` arg is omitted — fallback branch name detection                  |
 
 ## Files Written
 
-| Path | Format | When |
-| ---- | ------ | ---- |
-| —    | —      | —    |
+| Path                                             | Format | When                                                                     |
+| ------------------------------------------------ | ------ | ------------------------------------------------------------------------ |
+| `~/.supabase/<workdir-hash>/linked-project.json` | JSON   | always (in `Effect.ensuring`) after `--project-ref` resolves — Go parity |
+| `~/.supabase/telemetry.json`                     | JSON   | always (in `Effect.ensuring`) at end of command — Go parity              |
 
 ## API Routes
 
-| Method | Path                          | Auth         | Request body                                                                            | Response (used fields) |
-| ------ | ----------------------------- | ------------ | --------------------------------------------------------------------------------------- | ---------------------- |
-| `POST` | `/v1/projects/{ref}/branches` | Bearer token | `{branch_name?, region?, desired_instance_size?, persistent?, with_data?, notify_url?}` | `{id}`                 |
+| Method | Path                                            | Auth         | Request body                                                                                                           | Response (used fields)               |
+| ------ | ----------------------------------------------- | ------------ | ---------------------------------------------------------------------------------------------------------------------- | ------------------------------------ |
+| `POST` | `/v1/projects/{ref}/branches`                   | Bearer token | `{branch_name, is_default: false, git_branch?, region?, desired_instance_size?, persistent?, with_data?, notify_url?}` | full `BranchResponse`                |
+| `GET`  | `/v1/projects/{ref}` (on 4xx gated)             | Bearer token | none                                                                                                                   | `{organization_slug}`                |
+| `GET`  | `/v1/organizations/{slug}/entitlements` (gated) | Bearer token | none                                                                                                                   | `[{feature: {key}, hasAccess, ...}]` |
 
 ## Environment Variables
 
-| Variable                | Purpose                                              | Required?                                               |
-| ----------------------- | ---------------------------------------------------- | ------------------------------------------------------- |
-| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `~/.supabase/access-token`) |
-| `SUPABASE_API_URL`      | override Management API base URL                     | no (defaults to `https://api.supabase.com`)             |
+| Variable                | Purpose                                                                                          | Required?                                               |
+| ----------------------- | ------------------------------------------------------------------------------------------------ | ------------------------------------------------------- |
+| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup)                                             | no (falls back to keyring → `~/.supabase/access-token`) |
+| `SUPABASE_PROFILE`      | selects API base URL (`supabase` / `supabase-staging` / `supabase-local`) or a YAML profile path | no                                                      |
+| `SUPABASE_PROJECT_ID`   | parent project ref fallback when `--project-ref` is unset                                        | no                                                      |
+| `SUPABASE_WORKDIR`      | base directory for the `.temp/project-ref` lookup                                                | no                                                      |
+| `GITHUB_HEAD_REF`       | preferred over walking `.git/HEAD` when detecting the default branch name in CI                  | no                                                      |
 
 ## Exit Codes
 
-| Code | Condition                                                       |
-| ---- | --------------------------------------------------------------- |
-| `0`  | success — branch created                                        |
-| `1`  | authentication error — no valid token found                     |
-| `1`  | API error — non-2xx response from `/v1/projects/{ref}/branches` |
-| `1`  | network / connection failure                                    |
+| Code | Condition                                                                                      |
+| ---- | ---------------------------------------------------------------------------------------------- |
+| `0`  | success — branch created                                                                       |
+| `1`  | `LegacyBranchesCreateCancelledError` — user declined the git-branch confirmation prompt        |
+| `1`  | `LegacyBranchesCreateUnexpectedStatusError` — non-201 response from the create branch endpoint |
+| `1`  | `LegacyBranchesCreateNetworkError` — transport-level network failure                           |
+| `1`  | Auth / project-ref resolution errors (`LegacyPlatformAuthRequiredError`, …)                    |
 
-## Output
-
-### `--output-format text` (Go CLI compatible)
+## Telemetry Events Fired
 
-Prints the created branch ID to stdout.
+| Event                   | When                                            | Notable properties / groups                                       |
+| ----------------------- | ----------------------------------------------- | ----------------------------------------------------------------- |
+| `cli_command_executed`  | post-run, success or failure (via wrapper)      | `exit_code`, `duration_ms`, `flags` (`--project-ref` whitelisted) |
+| `cli_upgrade_suggested` | on 4xx with `branching_limit` entitlement gated | `{feature_key: "branching_limit", org_slug}`                      |
 
-### `--output-format json`
+Matches `apps/cli-go/internal/branches/create/`.
 
-Single JSON object emitted to stdout on success containing the branch response.
-
-### `--output-format stream-json`
+## Output
 
-One `result` event on success.
+Honors both `--output {pretty,json,yaml,toml,env}` (Go) and `--output-format {text,json,stream-json}` (TS). `--output` wins when both are supplied.
 
-```ndjson
-{"type":"result","data":{...}}
-```
+In **text mode** (default / `--output pretty`), the header `Created preview branch:` writes to **stdout** (Go `fmt.Println`) followed by the single-row Glamour-styled list-table.
 
-## Notes
+In Go encoder modes, the same header writes to stdout followed by the encoded `V1CreateABranchOutput` payload.
 
-- Flags: `[name]` (positional), `--region`, `--size`, `--persistent`, `--with-data`, `--notify-url`, `--project-ref`.
-- Requires a linked project (reads `--project-ref` or `.supabase/config.json`).
+In `--output-format json` / `stream-json`, a `success` event carries the response payload.
diff --git a/apps/cli/src/legacy/commands/branches/create/create.command.ts b/apps/cli/src/legacy/commands/branches/create/create.command.ts
index a8f3d05a0b..ace5cbadb7 100644
--- a/apps/cli/src/legacy/commands/branches/create/create.command.ts
+++ b/apps/cli/src/legacy/commands/branches/create/create.command.ts
@@ -1,5 +1,9 @@
 import { Argument, Command, Flag } from "effect/unstable/cli";
 import type * as CliCommand from "effect/unstable/cli/Command";
+
+import { withJsonErrorHandling } from "../../../../shared/output/json-error-handling.ts";
+import { legacyManagementApiRuntimeLayer } from "../../../shared/legacy-management-api-runtime.layer.ts";
+import { withLegacyCommandInstrumentation } from "../../../telemetry/legacy-command-instrumentation.ts";
 import { legacyBranchesCreate } from "./create.handler.ts";
 
 const BRANCH_REGIONS = [
@@ -62,11 +66,18 @@ const config = {
     Flag.withDescription("Select a desired instance size for the branch database."),
     Flag.optional,
   ),
+  // Optional so the handler can distinguish "flag explicitly set false"
+  // from "flag absent" — mirrors Go's `cmdFlags.Changed("persistent")` check
+  // in `apps/cli-go/cmd/branches.go:53`. Effect CLI surface: `--persistent`
+  // sets `Option.some(true)`, `--no-persistent` sets `Option.some(false)`,
+  // absent stays `Option.none()`.
   persistent: Flag.boolean("persistent").pipe(
     Flag.withDescription("Whether to create a persistent branch."),
+    Flag.optional,
   ),
   withData: Flag.boolean("with-data").pipe(
     Flag.withDescription("Whether to clone production data to the branch database."),
+    Flag.optional,
   ),
   notifyUrl: Flag.string("notify-url").pipe(
     Flag.withDescription("URL to notify when branch is active healthy."),
@@ -79,5 +90,11 @@ export type LegacyBranchesCreateFlags = CliCommand.Command.Config.Infer<typeof c
 export const legacyBranchesCreateCommand = Command.make("create", config).pipe(
   Command.withDescription("Create a preview branch for the linked project."),
   Command.withShortDescription("Create a preview branch"),
-  Command.withHandler((flags) => legacyBranchesCreate(flags)),
+  Command.withHandler((flags) =>
+    legacyBranchesCreate(flags).pipe(
+      withLegacyCommandInstrumentation({ flags, safeFlags: ["project-ref"] }),
+      withJsonErrorHandling,
+    ),
+  ),
+  Command.provide(legacyManagementApiRuntimeLayer(["branches", "create"])),
 );
diff --git a/apps/cli/src/legacy/commands/branches/create/create.handler.ts b/apps/cli/src/legacy/commands/branches/create/create.handler.ts
index 6ee81f44cd..640ce83909 100644
--- a/apps/cli/src/legacy/commands/branches/create/create.handler.ts
+++ b/apps/cli/src/legacy/commands/branches/create/create.handler.ts
@@ -1,18 +1,148 @@
+import type { V1CreateABranchOutput } from "@supabase/api/effect";
 import { Effect, Option } from "effect";
-import { LegacyGoProxy } from "../../../../shared/legacy/go-proxy.service.ts";
+import * as HttpClientError from "effect/unstable/http/HttpClientError";
+
+import { LegacyPlatformApi } from "../../../auth/legacy-platform-api.service.ts";
+import { LegacyProjectRefResolver } from "../../../config/legacy-project-ref.service.ts";
+import { LegacyLinkedProjectCache } from "../../../telemetry/legacy-linked-project-cache.service.ts";
+import { LegacyTelemetryState } from "../../../telemetry/legacy-telemetry-state.service.ts";
+import { LegacyOutputFlag } from "../../../../shared/legacy/global-flags.ts";
+import { Output } from "../../../../shared/output/output.service.ts";
+import { detectGitBranch } from "../../../../shared/git/git-branch.ts";
+import {
+  encodeEnv,
+  encodeGoJson,
+  encodeToml,
+  encodeYaml,
+} from "../../../shared/legacy-go-output.encoders.ts";
+import { mapLegacyHttpError } from "../../../shared/legacy-http-errors.ts";
+import { legacySuggestUpgrade } from "../../../shared/legacy-upgrade-suggest.ts";
+import {
+  LegacyBranchesCreateCancelledError,
+  LegacyBranchesCreateNetworkError,
+  LegacyBranchesCreateUnexpectedStatusError,
+} from "../branches.errors.ts";
+import { renderBranchesListTable } from "../branches.format.ts";
 import type { LegacyBranchesCreateFlags } from "./create.command.ts";
 
+type CreatedBranch = typeof V1CreateABranchOutput.Type;
+
+const mapCreateErrorRaw = mapLegacyHttpError({
+  networkError: LegacyBranchesCreateNetworkError,
+  statusError: LegacyBranchesCreateUnexpectedStatusError,
+  networkMessage: (cause) => `failed to create preview branch: ${cause}`,
+  statusMessage: (status, body) => `unexpected create branch status ${status}: ${body}`,
+});
+
 export const legacyBranchesCreate = Effect.fn("legacy.branches.create")(function* (
   flags: LegacyBranchesCreateFlags,
 ) {
-  const proxy = yield* LegacyGoProxy;
-  const args: string[] = ["branches", "create"];
-  if (Option.isSome(flags.name)) args.push(flags.name.value);
-  if (Option.isSome(flags.projectRef)) args.push("--project-ref", flags.projectRef.value);
-  if (Option.isSome(flags.region)) args.push("--region", flags.region.value);
-  if (Option.isSome(flags.size)) args.push("--size", flags.size.value);
-  if (flags.persistent) args.push("--persistent");
-  if (flags.withData) args.push("--with-data");
-  if (Option.isSome(flags.notifyUrl)) args.push("--notify-url", flags.notifyUrl.value);
-  yield* proxy.exec(args);
+  const output = yield* Output;
+  const goOutputFlag = yield* LegacyOutputFlag;
+  const api = yield* LegacyPlatformApi;
+  const resolver = yield* LegacyProjectRefResolver;
+  const linkedProjectCache = yield* LegacyLinkedProjectCache;
+  const telemetryState = yield* LegacyTelemetryState;
+
+  // -----------------------------------------------------------------------
+  // Branch-name resolution. Go's `create.go:17-28` defaults to the current
+  // git branch when the arg is omitted, prompting Y/N first. The decline
+  // path returns `context.Canceled` — we tag-error and short-circuit before
+  // resolving the project ref so the linked-project cache write does not fire.
+  // -----------------------------------------------------------------------
+  let branchName = Option.getOrElse(flags.name, () => "");
+  let gitBranchForBody: string | undefined;
+
+  if (branchName.length === 0) {
+    const gitBranch = yield* detectGitBranch;
+    if (Option.isSome(gitBranch) && gitBranch.value.length > 0) {
+      // Go's `create.go:20-25` calls `utils.NewConsole().PromptYesNo(...)`
+      // unconditionally — on a TTY it blocks for input, off-TTY it reads stdin
+      // with a 100ms timeout and defaults to `true` on EOF. We always fire the
+      // confirm; the non-interactive `Output` layer auto-falls-through (via
+      // `Effect.orElseSucceed(true)`) which matches Go's EOF-default-true.
+      const confirmed = yield* output
+        .promptConfirm(`Do you want to create a branch named ${gitBranch.value}?`)
+        .pipe(Effect.orElseSucceed(() => true));
+      if (!confirmed) {
+        return yield* new LegacyBranchesCreateCancelledError({ message: "context canceled" });
+      }
+      branchName = gitBranch.value;
+      gitBranchForBody = gitBranch.value;
+    }
+  }
+
+  const ref = yield* resolver.resolve(flags.projectRef);
+
+  yield* Effect.gen(function* () {
+    const creating =
+      output.format === "text" ? yield* output.task("Creating branch...") : undefined;
+
+    const created: CreatedBranch = yield* api.v1
+      .createABranch({
+        ref,
+        branch_name: branchName,
+        is_default: false,
+        ...(gitBranchForBody !== undefined ? { git_branch: gitBranchForBody } : {}),
+        ...(Option.isSome(flags.region) ? { region: flags.region.value } : {}),
+        ...(Option.isSome(flags.size) ? { desired_instance_size: flags.size.value } : {}),
+        ...(Option.isSome(flags.persistent) ? { persistent: flags.persistent.value } : {}),
+        ...(Option.isSome(flags.withData) ? { with_data: flags.withData.value } : {}),
+        ...(Option.isSome(flags.notifyUrl) ? { notify_url: flags.notifyUrl.value } : {}),
+      })
+      .pipe(
+        Effect.tapError(() => creating?.fail() ?? Effect.void),
+        Effect.catch((cause) =>
+          // Mirror Go's `create.go:34-37`: on any non-201 status (including
+          // gated 4xx), run the entitlement check; `legacySuggestUpgrade`
+          // is a no-op for 2xx/5xx itself, so we can call it unconditionally.
+          Effect.gen(function* () {
+            const status =
+              HttpClientError.isHttpClientError(cause) && cause.response !== undefined
+                ? cause.response.status
+                : 0;
+            yield* legacySuggestUpgrade({
+              projectRef: ref,
+              featureKey: "branching_limit",
+              statusCode: status,
+            });
+            return yield* mapCreateErrorRaw(cause);
+          }),
+        ),
+      );
+    yield* creating?.clear() ?? Effect.void;
+
+    const goFmt = Option.getOrUndefined(goOutputFlag);
+
+    // Go writes "Created preview branch:" to stdout (`fmt.Println`), then
+    // the table or the encoded payload via EncodeOutput.
+    if (goFmt === "json") {
+      yield* output.raw("Created preview branch:\n");
+      yield* output.raw(encodeGoJson(created));
+      return;
+    }
+    if (goFmt === "yaml") {
+      yield* output.raw("Created preview branch:\n");
+      yield* output.raw(encodeYaml(created));
+      return;
+    }
+    if (goFmt === "toml") {
+      yield* output.raw("Created preview branch:\n");
+      yield* output.raw(encodeToml(created) + "\n");
+      return;
+    }
+    if (goFmt === "env") {
+      yield* output.raw("Created preview branch:\n");
+      yield* output.raw(encodeEnv(created) + "\n");
+      return;
+    }
+
+    if (output.format === "json" || output.format === "stream-json") {
+      yield* output.success("Created preview branch", { ...created });
+      return;
+    }
+
+    yield* output.raw("Created preview branch:\n");
+    yield* output.raw(renderBranchesListTable([created]));
+  }).pipe(Effect.ensuring(linkedProjectCache.cache(ref)), Effect.ensuring(telemetryState.flush));
 });
diff --git a/apps/cli/src/legacy/commands/branches/create/create.integration.test.ts b/apps/cli/src/legacy/commands/branches/create/create.integration.test.ts
new file mode 100644
index 0000000000..7d8d1cf034
--- /dev/null
+++ b/apps/cli/src/legacy/commands/branches/create/create.integration.test.ts
@@ -0,0 +1,269 @@
+import type { V1CreateABranchOutput } from "@supabase/api/effect";
+import { describe, expect, it } from "@effect/vitest";
+import { Effect, Exit, Option } from "effect";
+
+import { mockAnalytics, mockOutput } from "../../../../../tests/helpers/mocks.ts";
+import {
+  LEGACY_VALID_REF,
+  buildLegacyTestRuntime,
+  legacyJsonResponse,
+  mockLegacyCliConfig,
+  mockLegacyLinkedProjectCacheTracked,
+  mockLegacyPlatformApi,
+  mockLegacyTelemetryStateTracked,
+  useLegacyTempWorkdir,
+} from "../../../../../tests/helpers/legacy-mocks.ts";
+import type { LegacyBranchesCreateFlags } from "./create.command.ts";
+import { legacyBranchesCreate } from "./create.handler.ts";
+
+type CreatedBranch = typeof V1CreateABranchOutput.Type;
+
+const CREATED: CreatedBranch = {
+  id: "11111111-2222-3333-4444-555555555555",
+  name: "feat-x",
+  project_ref: "aaaaaaaaaaaaaaaaaaaa",
+  parent_project_ref: "bbbbbbbbbbbbbbbbbbbb",
+  is_default: false,
+  persistent: false,
+  status: "MIGRATIONS_PASSED",
+  created_at: "2026-05-27T01:02:03Z",
+  updated_at: "2026-05-27T01:02:04Z",
+  with_data: false,
+};
+
+const ORG_SLUG = "test-org";
+
+function projectResponse() {
+  return {
+    id: LEGACY_VALID_REF,
+    ref: LEGACY_VALID_REF,
+    organization_id: "org",
+    organization_slug: ORG_SLUG,
+    name: "Test",
+    region: "us-east-1",
+    created_at: "2026-01-01T00:00:00Z",
+    status: "ACTIVE_HEALTHY",
+    database: { host: "h", version: "15", postgres_engine: "15", release_channel: "ga" },
+  };
+}
+
+function entitlementResponse(opts: { readonly featureKey: string; readonly hasAccess: boolean }) {
+  return {
+    entitlements: [
+      {
+        feature: { key: opts.featureKey, type: "boolean" as const },
+        hasAccess: opts.hasAccess,
+        type: "boolean" as const,
+        config: { enabled: !opts.hasAccess },
+      },
+    ],
+  };
+}
+
+const tempRoot = useLegacyTempWorkdir("supabase-branches-create-int-");
+
+interface SetupOpts {
+  readonly format?: "text" | "json" | "stream-json";
+  readonly goOutput?: "env" | "pretty" | "json" | "toml" | "yaml";
+  readonly response?: CreatedBranch;
+  readonly status?: number;
+  readonly network?: "fail";
+  readonly gated?: boolean;
+  readonly featureKey?: string;
+}
+
+function buildApiLayer(opts: SetupOpts) {
+  const status = opts.status ?? 201;
+  const body = opts.response ?? CREATED;
+  const featureKey = opts.featureKey ?? "branching_limit";
+  return mockLegacyPlatformApi({
+    network: opts.network,
+    handler: (request) =>
+      Effect.sync(() => {
+        if (request.method === "POST" && request.url.includes("/branches")) {
+          return legacyJsonResponse(request, status, body);
+        }
+        if (request.method === "GET" && request.url.endsWith(`/v1/projects/${LEGACY_VALID_REF}`)) {
+          return legacyJsonResponse(request, 200, projectResponse());
+        }
+        if (request.method === "GET" && request.url.includes("/entitlements")) {
+          return legacyJsonResponse(
+            request,
+            200,
+            entitlementResponse({ featureKey, hasAccess: !(opts.gated ?? false) }),
+          );
+        }
+        return legacyJsonResponse(request, 200, null);
+      }),
+  });
+}
+
+function setup(opts: SetupOpts = {}) {
+  const out = mockOutput({ format: opts.format ?? "text" });
+  const analytics = mockAnalytics();
+  const api = buildApiLayer(opts);
+  const cliConfig = mockLegacyCliConfig({ workdir: tempRoot.current });
+  const layer = buildLegacyTestRuntime({
+    out,
+    api,
+    cliConfig,
+    analytics,
+    goOutput: opts.goOutput === undefined ? Option.none() : Option.some(opts.goOutput),
+  });
+  return { layer, out, api, analytics };
+}
+
+function setupTracked(opts: SetupOpts = {}) {
+  const out = mockOutput({ format: opts.format ?? "text" });
+  const analytics = mockAnalytics();
+  const api = buildApiLayer(opts);
+  const cliConfig = mockLegacyCliConfig({ workdir: tempRoot.current });
+  const telemetry = mockLegacyTelemetryStateTracked();
+  const cache = mockLegacyLinkedProjectCacheTracked();
+  const layer = buildLegacyTestRuntime({
+    out,
+    api,
+    cliConfig,
+    analytics,
+    telemetry: telemetry.layer,
+    linkedProjectCache: cache.layer,
+  });
+  return { layer, out, api, telemetry, cache, analytics };
+}
+
+const baseFlags: LegacyBranchesCreateFlags = {
+  name: Option.none(),
+  projectRef: Option.none(),
+  region: Option.none(),
+  size: Option.none(),
+  persistent: Option.none(),
+  withData: Option.none(),
+  notifyUrl: Option.none(),
+};
+
+describe("legacy branches create integration", () => {
+  it.live("creates a branch with explicit name and prints text-mode header + table", () => {
+    const { layer, out, api } = setup();
+    return Effect.gen(function* () {
+      yield* legacyBranchesCreate({ ...baseFlags, name: Option.some("feat-x") });
+      expect(out.stdoutText).toContain("Created preview branch:");
+      expect(out.stdoutText).toContain("feat-x");
+      expect(api.requests).toHaveLength(1);
+      expect(api.requests[0]?.url).toContain(`/v1/projects/${LEGACY_VALID_REF}/branches`);
+      expect(api.requests[0]?.body).toMatchObject({
+        branch_name: "feat-x",
+        is_default: false,
+      });
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("includes optional flags in the request body only when set", () => {
+    const { layer, api } = setup();
+    return Effect.gen(function* () {
+      yield* legacyBranchesCreate({
+        ...baseFlags,
+        name: Option.some("with-region"),
+        region: Option.some("us-east-1"),
+        persistent: Option.some(true),
+        withData: Option.some(true),
+        notifyUrl: Option.some("https://hook.example.com"),
+      });
+      expect(api.requests[0]?.body).toMatchObject({
+        branch_name: "with-region",
+        is_default: false,
+        region: "us-east-1",
+        persistent: true,
+        with_data: true,
+        notify_url: "https://hook.example.com",
+      });
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("emits a success event for --output-format=json", () => {
+    const { layer, out } = setup({ format: "json" });
+    return Effect.gen(function* () {
+      yield* legacyBranchesCreate({ ...baseFlags, name: Option.some("feat-x") });
+      const success = out.messages.find((m) => m.type === "success");
+      expect(success).toBeDefined();
+      expect(success?.data).toMatchObject({ name: "feat-x" });
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("emits Go-byte-exact indented JSON for --output json", () => {
+    const { layer, out } = setup({ goOutput: "json" });
+    return Effect.gen(function* () {
+      yield* legacyBranchesCreate({ ...baseFlags, name: Option.some("feat-x") });
+      expect(out.stdoutText).toContain("Created preview branch:");
+      expect(out.stdoutText).toContain('"name": "feat-x"');
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("fails with LegacyBranchesCreateNetworkError on transport failure", () => {
+    const { layer } = setup({ network: "fail" });
+    return Effect.gen(function* () {
+      const exit = yield* Effect.exit(
+        legacyBranchesCreate({ ...baseFlags, name: Option.some("feat-x") }),
+      );
+      expect(Exit.isFailure(exit)).toBe(true);
+      if (Exit.isFailure(exit)) {
+        const json = JSON.stringify(exit.cause);
+        expect(json).toContain("LegacyBranchesCreateNetworkError");
+        expect(json).toContain("failed to create preview branch");
+      }
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("fails with LegacyBranchesCreateUnexpectedStatusError on non-201", () => {
+    const { layer } = setup({ status: 500 });
+    return Effect.gen(function* () {
+      const exit = yield* Effect.exit(
+        legacyBranchesCreate({ ...baseFlags, name: Option.some("feat-x") }),
+      );
+      expect(Exit.isFailure(exit)).toBe(true);
+      if (Exit.isFailure(exit)) {
+        const json = JSON.stringify(exit.cause);
+        expect(json).toContain("LegacyBranchesCreateUnexpectedStatusError");
+        expect(json).toContain("unexpected create branch status 500");
+      }
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("fires cli_upgrade_suggested with feature_key=branching_limit on 402 gated", () => {
+    const { layer, analytics } = setup({ status: 402, gated: true });
+    return Effect.gen(function* () {
+      yield* Effect.exit(legacyBranchesCreate({ ...baseFlags, name: Option.some("feat-x") }));
+      expect(analytics.captured).toEqual([
+        {
+          event: "cli_upgrade_suggested",
+          properties: { feature_key: "branching_limit", org_slug: ORG_SLUG },
+        },
+      ]);
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("does NOT fire upgrade suggested on 500 (Go skips 5xx)", () => {
+    const { layer, analytics } = setup({ status: 500 });
+    return Effect.gen(function* () {
+      yield* Effect.exit(legacyBranchesCreate({ ...baseFlags, name: Option.some("feat-x") }));
+      expect(analytics.captured).toHaveLength(0);
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("writes linked-project cache and telemetry state on success", () => {
+    const { layer, telemetry, cache } = setupTracked();
+    return Effect.gen(function* () {
+      yield* legacyBranchesCreate({ ...baseFlags, name: Option.some("feat-x") });
+      expect(telemetry.flushed).toBe(true);
+      expect(cache.cached).toBe(true);
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("writes linked-project cache + telemetry on the upgrade-suggest failure path", () => {
+    const { layer, telemetry, cache } = setupTracked({ status: 402, gated: true });
+    return Effect.gen(function* () {
+      yield* Effect.exit(legacyBranchesCreate({ ...baseFlags, name: Option.some("feat-x") }));
+      expect(telemetry.flushed).toBe(true);
+      expect(cache.cached).toBe(true);
+    }).pipe(Effect.provide(layer));
+  });
+});
diff --git a/apps/cli/src/legacy/commands/branches/delete/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/branches/delete/SIDE_EFFECTS.md
index bf35f03ab1..f0ccf933df 100644
--- a/apps/cli/src/legacy/commands/branches/delete/SIDE_EFFECTS.md
+++ b/apps/cli/src/legacy/commands/branches/delete/SIDE_EFFECTS.md
@@ -2,55 +2,48 @@
 
 ## Files Read
 
-| Path                              | Format                    | When                                                       |
-| --------------------------------- | ------------------------- | ---------------------------------------------------------- |
-| `~/.supabase/access-token`        | plain text (token string) | when `SUPABASE_ACCESS_TOKEN` unset and keyring unavailable |
-| `<workdir>/.supabase/config.json` | JSON                      | always, to resolve linked project ref                      |
+Same auth and project-ref resolution chain as every Management-API legacy command.
 
 ## Files Written
 
-| Path | Format | When |
-| ---- | ------ | ---- |
-| —    | —      | —    |
+| Path                                             | Format | When                                                                     |
+| ------------------------------------------------ | ------ | ------------------------------------------------------------------------ |
+| `~/.supabase/<workdir-hash>/linked-project.json` | JSON   | always (in `Effect.ensuring`) after `--project-ref` resolves — Go parity |
+| `~/.supabase/telemetry.json`                     | JSON   | always (in `Effect.ensuring`) at end of command — Go parity              |
 
 ## API Routes
 
-| Method   | Path                       | Auth         | Request body | Response (used fields) |
-| -------- | -------------------------- | ------------ | ------------ | ---------------------- |
-| `DELETE` | `/v1/branches/{branch_id}` | Bearer token | none         | none                   |
+| Method   | Path                                 | Auth         | When                                                           | Response            |
+| -------- | ------------------------------------ | ------------ | -------------------------------------------------------------- | ------------------- |
+| `GET`    | `/v1/projects/{ref}/branches/{name}` | Bearer token | branch input is not a UUID and not a `^[a-z]{20}$` ref pattern | `{project_ref}`     |
+| `GET`    | `/v1/branches/{branch_id_or_ref}`    | Bearer token | branch input is a UUID                                         | `{ref}`             |
+| `DELETE` | `/v1/branches/{branch_id_or_ref}`    | Bearer token | always — `force` query param omitted (Go passes nil)           | `{ message: "ok" }` |
 
 ## Environment Variables
 
-| Variable                | Purpose                                              | Required?                                               |
-| ----------------------- | ---------------------------------------------------- | ------------------------------------------------------- |
-| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `~/.supabase/access-token`) |
-| `SUPABASE_API_URL`      | override Management API base URL                     | no (defaults to `https://api.supabase.com`)             |
+`SUPABASE_ACCESS_TOKEN`, `SUPABASE_PROFILE`, `SUPABASE_PROJECT_ID`, `SUPABASE_WORKDIR` — same semantics as `branches list`.
 
 ## Exit Codes
 
-| Code | Condition                                                    |
-| ---- | ------------------------------------------------------------ |
-| `0`  | success — branch deleted                                     |
-| `1`  | authentication error — no valid token found                  |
-| `1`  | API error — non-2xx response from `/v1/branches/{branch_id}` |
-| `1`  | network / connection failure                                 |
-| `1`  | branch not found                                             |
+| Code | Condition                                                                           |
+| ---- | ----------------------------------------------------------------------------------- |
+| `0`  | success — branch deleted                                                            |
+| `1`  | `LegacyBranchesDeleteUnexpectedStatusError` — non-200 response from delete endpoint |
+| `1`  | `LegacyBranchesDeleteNetworkError` — transport-level network failure                |
+| `1`  | Branch-id resolution errors                                                         |
 
-## Output
-
-### `--output-format text` (Go CLI compatible)
+## Telemetry Events Fired
 
-No output on success (exit 0).
+| Event                  | When                                       | Notable properties                  |
+| ---------------------- | ------------------------------------------ | ----------------------------------- |
+| `cli_command_executed` | post-run, success or failure (via wrapper) | `exit_code`, `duration_ms`, `flags` |
 
-### `--output-format json`
-
-No structured output on success.
+## Output
 
-### `--output-format stream-json`
+### `--output-format text` (Go CLI compatible)
 
-No structured output on success.
+`Deleted preview branch: <ref>` written to **stderr** (Go `fmt.Fprintln(os.Stderr, …)`).
 
-## Notes
+### `--output-format json` / `stream-json`
 
-- Accepts optional positional `[name]` argument (branch name or ID). If omitted in interactive mode, prompts the user to select a branch.
-- The Go CLI internally resolves a branch name to a branch ID by calling `/v1/projects/{ref}/branches/{name}` first.
+Single `success` event carrying `{project_ref}`.
diff --git a/apps/cli/src/legacy/commands/branches/delete/delete.command.ts b/apps/cli/src/legacy/commands/branches/delete/delete.command.ts
index cf52be674c..577cd59156 100644
--- a/apps/cli/src/legacy/commands/branches/delete/delete.command.ts
+++ b/apps/cli/src/legacy/commands/branches/delete/delete.command.ts
@@ -1,5 +1,9 @@
 import { Argument, Command, Flag } from "effect/unstable/cli";
 import type * as CliCommand from "effect/unstable/cli/Command";
+
+import { withJsonErrorHandling } from "../../../../shared/output/json-error-handling.ts";
+import { legacyManagementApiRuntimeLayer } from "../../../shared/legacy-management-api-runtime.layer.ts";
+import { withLegacyCommandInstrumentation } from "../../../telemetry/legacy-command-instrumentation.ts";
 import { legacyBranchesDelete } from "./delete.handler.ts";
 
 const config = {
@@ -17,5 +21,11 @@ export type LegacyBranchesDeleteFlags = CliCommand.Command.Config.Infer<typeof c
 export const legacyBranchesDeleteCommand = Command.make("delete", config).pipe(
   Command.withDescription("Delete a preview branch by its name or ID."),
   Command.withShortDescription("Delete a preview branch"),
-  Command.withHandler((flags) => legacyBranchesDelete(flags)),
+  Command.withHandler((flags) =>
+    legacyBranchesDelete(flags).pipe(
+      withLegacyCommandInstrumentation({ flags, safeFlags: ["project-ref"] }),
+      withJsonErrorHandling,
+    ),
+  ),
+  Command.provide(legacyManagementApiRuntimeLayer(["branches", "delete"])),
 );
diff --git a/apps/cli/src/legacy/commands/branches/delete/delete.handler.ts b/apps/cli/src/legacy/commands/branches/delete/delete.handler.ts
index b80ca3980f..298e92402f 100644
--- a/apps/cli/src/legacy/commands/branches/delete/delete.handler.ts
+++ b/apps/cli/src/legacy/commands/branches/delete/delete.handler.ts
@@ -1,13 +1,58 @@
-import { Effect, Option } from "effect";
-import { LegacyGoProxy } from "../../../../shared/legacy/go-proxy.service.ts";
+import { Effect } from "effect";
+
+import { LegacyPlatformApi } from "../../../auth/legacy-platform-api.service.ts";
+import { LegacyProjectRefResolver } from "../../../config/legacy-project-ref.service.ts";
+import { LegacyLinkedProjectCache } from "../../../telemetry/legacy-linked-project-cache.service.ts";
+import { LegacyTelemetryState } from "../../../telemetry/legacy-telemetry-state.service.ts";
+import { Output } from "../../../../shared/output/output.service.ts";
+import { Tty } from "../../../../shared/runtime/tty.service.ts";
+import { mapLegacyHttpError } from "../../../shared/legacy-http-errors.ts";
+import {
+  LegacyBranchesDeleteNetworkError,
+  LegacyBranchesDeleteUnexpectedStatusError,
+} from "../branches.errors.ts";
+import { legacyPromptBranchId } from "../branches.prompt.ts";
+import { legacyResolveBranchProjectRef } from "../branches.resolver.ts";
 import type { LegacyBranchesDeleteFlags } from "./delete.command.ts";
 
+const mapDeleteError = mapLegacyHttpError({
+  networkError: LegacyBranchesDeleteNetworkError,
+  statusError: LegacyBranchesDeleteUnexpectedStatusError,
+  networkMessage: (cause) => `failed to delete preview branch: ${cause}`,
+  statusMessage: (status, body) => `unexpected delete branch status ${status}: ${body}`,
+});
+
 export const legacyBranchesDelete = Effect.fn("legacy.branches.delete")(function* (
   flags: LegacyBranchesDeleteFlags,
 ) {
-  const proxy = yield* LegacyGoProxy;
-  const args: string[] = ["branches", "delete"];
-  if (Option.isSome(flags.name)) args.push(flags.name.value);
-  if (Option.isSome(flags.projectRef)) args.push("--project-ref", flags.projectRef.value);
-  yield* proxy.exec(args);
+  const output = yield* Output;
+  const api = yield* LegacyPlatformApi;
+  const resolver = yield* LegacyProjectRefResolver;
+  const linkedProjectCache = yield* LegacyLinkedProjectCache;
+  const telemetryState = yield* LegacyTelemetryState;
+  // Force `Tty` into the handler's R channel so `legacyPromptBranchId` (which
+  // requires it) resolves. The yielded value itself is unused.
+  void (yield* Tty);
+
+  const ref = yield* resolver.resolve(flags.projectRef);
+
+  yield* Effect.gen(function* () {
+    const branchInput = yield* legacyPromptBranchId(flags.name, ref);
+    const branchRef = yield* legacyResolveBranchProjectRef(branchInput, ref);
+
+    const deleting =
+      output.format === "text" ? yield* output.task("Deleting branch...") : undefined;
+    yield* api.v1.deleteABranch({ branch_id_or_ref: branchRef }).pipe(
+      Effect.tapError(() => deleting?.fail() ?? Effect.void),
+      Effect.catch(mapDeleteError),
+    );
+    yield* deleting?.clear() ?? Effect.void;
+
+    // Go's `delete.go:28` writes `"Deleted preview branch: <ref>\n"` to STDERR.
+    if (output.format === "json" || output.format === "stream-json") {
+      yield* output.success("Deleted preview branch", { project_ref: branchRef });
+      return;
+    }
+    yield* output.raw(`Deleted preview branch: ${branchRef}\n`, "stderr");
+  }).pipe(Effect.ensuring(linkedProjectCache.cache(ref)), Effect.ensuring(telemetryState.flush));
 });
diff --git a/apps/cli/src/legacy/commands/branches/delete/delete.integration.test.ts b/apps/cli/src/legacy/commands/branches/delete/delete.integration.test.ts
new file mode 100644
index 0000000000..3bfbcdea89
--- /dev/null
+++ b/apps/cli/src/legacy/commands/branches/delete/delete.integration.test.ts
@@ -0,0 +1,143 @@
+import { describe, expect, it } from "@effect/vitest";
+import { Effect, Exit, Option } from "effect";
+
+import { mockOutput } from "../../../../../tests/helpers/mocks.ts";
+import {
+  buildLegacyTestRuntime,
+  legacyJsonResponse,
+  mockLegacyCliConfig,
+  mockLegacyLinkedProjectCacheTracked,
+  mockLegacyPlatformApi,
+  mockLegacyTelemetryStateTracked,
+  useLegacyTempWorkdir,
+} from "../../../../../tests/helpers/legacy-mocks.ts";
+import type { LegacyBranchesDeleteFlags } from "./delete.command.ts";
+import { legacyBranchesDelete } from "./delete.handler.ts";
+
+// V1DeleteABranchInput.branch_id_or_ref is a oneOf [project-ref, uuid] union.
+// A 20-lowercase project ref matches BOTH branches → schema rejects.
+// Tests pass a v4 UUID so the schema picks exactly one branch.
+const BRANCH_UUID = "11111111-1111-4111-8111-111111111111";
+
+// V1GetABranchConfigOutput body — used by the resolver's UUID path. The
+// returned `ref` becomes the `branch_id_or_ref` for the DELETE call, so it
+// must be UUID-shaped.
+const BRANCH_CONFIG = {
+  ref: BRANCH_UUID,
+  postgres_version: "15",
+  postgres_engine: "15",
+  release_channel: "ga",
+  status: "ACTIVE_HEALTHY",
+  db_host: "h",
+  db_port: 5432,
+};
+
+const tempRoot = useLegacyTempWorkdir("supabase-branches-delete-int-");
+
+interface SetupOpts {
+  readonly deleteStatus?: number;
+}
+
+function buildApi(opts: SetupOpts) {
+  const deleteStatus = opts.deleteStatus ?? 200;
+  return mockLegacyPlatformApi({
+    handler: (request) =>
+      Effect.sync(() => {
+        if (request.method === "DELETE" && request.url.includes("/v1/branches/")) {
+          return legacyJsonResponse(
+            request,
+            deleteStatus,
+            deleteStatus === 200 ? { message: "ok" } : {},
+          );
+        }
+        if (request.method === "GET" && request.url.includes("/v1/branches/")) {
+          return legacyJsonResponse(request, 200, BRANCH_CONFIG);
+        }
+        return legacyJsonResponse(request, 200, null);
+      }),
+  });
+}
+
+function setup(opts: SetupOpts = {}) {
+  const out = mockOutput({ format: "text" });
+  const api = buildApi(opts);
+  const cliConfig = mockLegacyCliConfig({ workdir: tempRoot.current });
+  const layer = buildLegacyTestRuntime({ out, api, cliConfig });
+  return { layer, out, api };
+}
+
+function setupTracked(opts: SetupOpts = {}) {
+  const out = mockOutput({ format: "text" });
+  const api = buildApi(opts);
+  const cliConfig = mockLegacyCliConfig({ workdir: tempRoot.current });
+  const telemetry = mockLegacyTelemetryStateTracked();
+  const cache = mockLegacyLinkedProjectCacheTracked();
+  const layer = buildLegacyTestRuntime({
+    out,
+    api,
+    cliConfig,
+    telemetry: telemetry.layer,
+    linkedProjectCache: cache.layer,
+  });
+  return { layer, out, api, telemetry, cache };
+}
+
+const baseFlags: LegacyBranchesDeleteFlags = {
+  name: Option.none(),
+  projectRef: Option.none(),
+};
+
+describe("legacy branches delete integration", () => {
+  it.live("deletes a branch and emits 'Deleted preview branch: <ref>' to stderr", () => {
+    const { layer, out, api } = setup();
+    return Effect.gen(function* () {
+      yield* legacyBranchesDelete({ ...baseFlags, name: Option.some(BRANCH_UUID) });
+      expect(out.stderrText).toContain(`Deleted preview branch: ${BRANCH_UUID}`);
+      expect(api.requests.find((r) => r.method === "DELETE")?.url).toContain(
+        `/v1/branches/${BRANCH_UUID}`,
+      );
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("omits the force query param (Go passes nil)", () => {
+    const { layer, api } = setup();
+    return Effect.gen(function* () {
+      yield* legacyBranchesDelete({ ...baseFlags, name: Option.some(BRANCH_UUID) });
+      const del = api.requests.find((r) => r.method === "DELETE");
+      expect(del?.url).not.toContain("force=");
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("fails with LegacyBranchesDeleteUnexpectedStatusError on non-200", () => {
+    const { layer } = setup({ deleteStatus: 500 });
+    return Effect.gen(function* () {
+      const exit = yield* Effect.exit(
+        legacyBranchesDelete({ ...baseFlags, name: Option.some(BRANCH_UUID) }),
+      );
+      expect(Exit.isFailure(exit)).toBe(true);
+      if (Exit.isFailure(exit)) {
+        const json = JSON.stringify(exit.cause);
+        expect(json).toContain("LegacyBranchesDeleteUnexpectedStatusError");
+        expect(json).toContain("unexpected delete branch status 500");
+      }
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("writes linked-project cache + telemetry state on success", () => {
+    const { layer, telemetry, cache } = setupTracked();
+    return Effect.gen(function* () {
+      yield* legacyBranchesDelete({ ...baseFlags, name: Option.some(BRANCH_UUID) });
+      expect(telemetry.flushed).toBe(true);
+      expect(cache.cached).toBe(true);
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("writes linked-project cache + telemetry state on failure", () => {
+    const { layer, telemetry, cache } = setupTracked({ deleteStatus: 500 });
+    return Effect.gen(function* () {
+      yield* Effect.exit(legacyBranchesDelete({ ...baseFlags, name: Option.some(BRANCH_UUID) }));
+      expect(telemetry.flushed).toBe(true);
+      expect(cache.cached).toBe(true);
+    }).pipe(Effect.provide(layer));
+  });
+});
diff --git a/apps/cli/src/legacy/commands/branches/disable/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/branches/disable/SIDE_EFFECTS.md
index 3f9fa9ce51..75c9288c66 100644
--- a/apps/cli/src/legacy/commands/branches/disable/SIDE_EFFECTS.md
+++ b/apps/cli/src/legacy/commands/branches/disable/SIDE_EFFECTS.md
@@ -1,56 +1,48 @@
 # `supabase branches disable`
 
+Hidden subcommand (`Hidden: true` in Go). Operates on the entire linked project rather than a single branch.
+
 ## Files Read
 
-| Path                              | Format                    | When                                                       |
-| --------------------------------- | ------------------------- | ---------------------------------------------------------- |
-| `~/.supabase/access-token`        | plain text (token string) | when `SUPABASE_ACCESS_TOKEN` unset and keyring unavailable |
-| `<workdir>/.supabase/config.json` | JSON                      | always, to resolve linked project ref                      |
+Same auth and project-ref resolution chain as every Management-API legacy command.
 
 ## Files Written
 
-| Path | Format | When |
-| ---- | ------ | ---- |
-| —    | —      | —    |
+| Path                                             | Format | When                                                                     |
+| ------------------------------------------------ | ------ | ------------------------------------------------------------------------ |
+| `~/.supabase/<workdir-hash>/linked-project.json` | JSON   | always (in `Effect.ensuring`) after `--project-ref` resolves — Go parity |
+| `~/.supabase/telemetry.json`                     | JSON   | always (in `Effect.ensuring`) at end of command — Go parity              |
 
 ## API Routes
 
-| Method   | Path                          | Auth         | Request body | Response (used fields) |
-| -------- | ----------------------------- | ------------ | ------------ | ---------------------- |
-| `DELETE` | `/v1/projects/{ref}/branches` | Bearer token | none         | none                   |
+| Method   | Path                          | Auth         | Request body | Response          |
+| -------- | ----------------------------- | ------------ | ------------ | ----------------- |
+| `DELETE` | `/v1/projects/{ref}/branches` | Bearer token | none         | none (expect 200) |
 
 ## Environment Variables
 
-| Variable                | Purpose                                              | Required?                                               |
-| ----------------------- | ---------------------------------------------------- | ------------------------------------------------------- |
-| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `~/.supabase/access-token`) |
-| `SUPABASE_API_URL`      | override Management API base URL                     | no (defaults to `https://api.supabase.com`)             |
+`SUPABASE_ACCESS_TOKEN`, `SUPABASE_PROFILE`, `SUPABASE_PROJECT_ID`, `SUPABASE_WORKDIR` — same semantics as `branches list`.
 
 ## Exit Codes
 
-| Code | Condition                                                       |
-| ---- | --------------------------------------------------------------- |
-| `0`  | success — branching disabled for the project                    |
-| `1`  | authentication error — no valid token found                     |
-| `1`  | API error — non-2xx response from `/v1/projects/{ref}/branches` |
-| `1`  | network / connection failure                                    |
-
-## Output
+| Code | Condition                                                                                 |
+| ---- | ----------------------------------------------------------------------------------------- |
+| `0`  | success — preview branching disabled for the project                                      |
+| `1`  | `LegacyBranchesDisableUnexpectedStatusError` — non-200 response from the disable endpoint |
+| `1`  | `LegacyBranchesDisableNetworkError` — transport-level network failure                     |
 
-### `--output-format text` (Go CLI compatible)
+## Telemetry Events Fired
 
-No output on success (exit 0).
+| Event                  | When                                       | Notable properties                  |
+| ---------------------- | ------------------------------------------ | ----------------------------------- |
+| `cli_command_executed` | post-run, success or failure (via wrapper) | `exit_code`, `duration_ms`, `flags` |
 
-### `--output-format json`
-
-No structured output on success.
+## Output
 
-### `--output-format stream-json`
+### `--output-format text` (Go CLI compatible)
 
-No structured output on success.
+`Disabled preview branching for project: <ref>` written to **stdout** (Go `fmt.Println`).
 
-## Notes
+### `--output-format json` / `stream-json`
 
-- This command is hidden in the Go CLI (`Hidden: true`).
-- No positional arguments. Uses `--project-ref` or reads from `.supabase/config.json`.
-- Disables preview branching for the entire linked project (not a single branch).
+Single `success` event carrying `{project_ref}`.
diff --git a/apps/cli/src/legacy/commands/branches/disable/disable.command.ts b/apps/cli/src/legacy/commands/branches/disable/disable.command.ts
index 0c1becb6b4..2db062adfc 100644
--- a/apps/cli/src/legacy/commands/branches/disable/disable.command.ts
+++ b/apps/cli/src/legacy/commands/branches/disable/disable.command.ts
@@ -1,5 +1,9 @@
 import { Command, Flag } from "effect/unstable/cli";
 import type * as CliCommand from "effect/unstable/cli/Command";
+
+import { withJsonErrorHandling } from "../../../../shared/output/json-error-handling.ts";
+import { legacyManagementApiRuntimeLayer } from "../../../shared/legacy-management-api-runtime.layer.ts";
+import { withLegacyCommandInstrumentation } from "../../../telemetry/legacy-command-instrumentation.ts";
 import { legacyBranchesDisable } from "./disable.handler.ts";
 
 const config = {
@@ -14,5 +18,11 @@ export type LegacyBranchesDisableFlags = CliCommand.Command.Config.Infer<typeof
 export const legacyBranchesDisableCommand = Command.make("disable", config).pipe(
   Command.withDescription("Disable preview branching for the linked project."),
   Command.withShortDescription("Disable preview branching"),
-  Command.withHandler((flags) => legacyBranchesDisable(flags)),
+  Command.withHandler((flags) =>
+    legacyBranchesDisable(flags).pipe(
+      withLegacyCommandInstrumentation({ flags, safeFlags: ["project-ref"] }),
+      withJsonErrorHandling,
+    ),
+  ),
+  Command.provide(legacyManagementApiRuntimeLayer(["branches", "disable"])),
 );
diff --git a/apps/cli/src/legacy/commands/branches/disable/disable.handler.ts b/apps/cli/src/legacy/commands/branches/disable/disable.handler.ts
index 3fd4e13976..3579d249b9 100644
--- a/apps/cli/src/legacy/commands/branches/disable/disable.handler.ts
+++ b/apps/cli/src/legacy/commands/branches/disable/disable.handler.ts
@@ -1,12 +1,49 @@
-import { Effect, Option } from "effect";
-import { LegacyGoProxy } from "../../../../shared/legacy/go-proxy.service.ts";
+import { Effect } from "effect";
+
+import { LegacyPlatformApi } from "../../../auth/legacy-platform-api.service.ts";
+import { LegacyProjectRefResolver } from "../../../config/legacy-project-ref.service.ts";
+import { LegacyLinkedProjectCache } from "../../../telemetry/legacy-linked-project-cache.service.ts";
+import { LegacyTelemetryState } from "../../../telemetry/legacy-telemetry-state.service.ts";
+import { Output } from "../../../../shared/output/output.service.ts";
+import { mapLegacyHttpError } from "../../../shared/legacy-http-errors.ts";
+import {
+  LegacyBranchesDisableNetworkError,
+  LegacyBranchesDisableUnexpectedStatusError,
+} from "../branches.errors.ts";
 import type { LegacyBranchesDisableFlags } from "./disable.command.ts";
 
+const mapDisableError = mapLegacyHttpError({
+  networkError: LegacyBranchesDisableNetworkError,
+  statusError: LegacyBranchesDisableUnexpectedStatusError,
+  networkMessage: (cause) => `failed to disable preview branching: ${cause}`,
+  statusMessage: (status, body) => `unexpected disable branching status ${status}: ${body}`,
+});
+
 export const legacyBranchesDisable = Effect.fn("legacy.branches.disable")(function* (
   flags: LegacyBranchesDisableFlags,
 ) {
-  const proxy = yield* LegacyGoProxy;
-  const args: string[] = ["branches", "disable"];
-  if (Option.isSome(flags.projectRef)) args.push("--project-ref", flags.projectRef.value);
-  yield* proxy.exec(args);
+  const output = yield* Output;
+  const api = yield* LegacyPlatformApi;
+  const resolver = yield* LegacyProjectRefResolver;
+  const linkedProjectCache = yield* LegacyLinkedProjectCache;
+  const telemetryState = yield* LegacyTelemetryState;
+
+  const ref = yield* resolver.resolve(flags.projectRef);
+
+  yield* Effect.gen(function* () {
+    const disabling =
+      output.format === "text" ? yield* output.task("Disabling preview branching...") : undefined;
+    yield* api.v1.disablePreviewBranching({ ref }).pipe(
+      Effect.tapError(() => disabling?.fail() ?? Effect.void),
+      Effect.catch(mapDisableError),
+    );
+    yield* disabling?.clear() ?? Effect.void;
+
+    // Go's `disable.go:22` writes to STDOUT via `fmt.Println`.
+    if (output.format === "json" || output.format === "stream-json") {
+      yield* output.success("Disabled preview branching for project", { project_ref: ref });
+      return;
+    }
+    yield* output.raw(`Disabled preview branching for project: ${ref}\n`);
+  }).pipe(Effect.ensuring(linkedProjectCache.cache(ref)), Effect.ensuring(telemetryState.flush));
 });
diff --git a/apps/cli/src/legacy/commands/branches/disable/disable.integration.test.ts b/apps/cli/src/legacy/commands/branches/disable/disable.integration.test.ts
new file mode 100644
index 0000000000..9857a552d9
--- /dev/null
+++ b/apps/cli/src/legacy/commands/branches/disable/disable.integration.test.ts
@@ -0,0 +1,90 @@
+import { describe, expect, it } from "@effect/vitest";
+import { Effect, Exit, Option } from "effect";
+
+import { mockOutput } from "../../../../../tests/helpers/mocks.ts";
+import {
+  LEGACY_VALID_REF,
+  buildLegacyTestRuntime,
+  mockLegacyCliConfig,
+  mockLegacyLinkedProjectCacheTracked,
+  mockLegacyPlatformApi,
+  mockLegacyTelemetryStateTracked,
+  useLegacyTempWorkdir,
+} from "../../../../../tests/helpers/legacy-mocks.ts";
+import type { LegacyBranchesDisableFlags } from "./disable.command.ts";
+import { legacyBranchesDisable } from "./disable.handler.ts";
+
+const tempRoot = useLegacyTempWorkdir("supabase-branches-disable-int-");
+
+interface SetupOpts {
+  readonly status?: number;
+}
+
+function setup(opts: SetupOpts = {}) {
+  const out = mockOutput({ format: "text" });
+  const api = mockLegacyPlatformApi({
+    response: { status: opts.status ?? 200, body: null },
+  });
+  const cliConfig = mockLegacyCliConfig({ workdir: tempRoot.current });
+  const layer = buildLegacyTestRuntime({ out, api, cliConfig });
+  return { layer, out, api };
+}
+
+function setupTracked(opts: SetupOpts = {}) {
+  const out = mockOutput({ format: "text" });
+  const api = mockLegacyPlatformApi({
+    response: { status: opts.status ?? 200, body: null },
+  });
+  const cliConfig = mockLegacyCliConfig({ workdir: tempRoot.current });
+  const telemetry = mockLegacyTelemetryStateTracked();
+  const cache = mockLegacyLinkedProjectCacheTracked();
+  const layer = buildLegacyTestRuntime({
+    out,
+    api,
+    cliConfig,
+    telemetry: telemetry.layer,
+    linkedProjectCache: cache.layer,
+  });
+  return { layer, out, api, telemetry, cache };
+}
+
+const baseFlags: LegacyBranchesDisableFlags = {
+  projectRef: Option.none(),
+};
+
+describe("legacy branches disable integration", () => {
+  it.live("disables preview branching and emits header to stdout", () => {
+    const { layer, out, api } = setup();
+    return Effect.gen(function* () {
+      yield* legacyBranchesDisable(baseFlags);
+      expect(out.stdoutText).toContain(
+        `Disabled preview branching for project: ${LEGACY_VALID_REF}`,
+      );
+      expect(api.requests.find((r) => r.method === "DELETE")?.url).toContain(
+        `/v1/projects/${LEGACY_VALID_REF}/branches`,
+      );
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("fails with LegacyBranchesDisableUnexpectedStatusError on non-200", () => {
+    const { layer } = setup({ status: 500 });
+    return Effect.gen(function* () {
+      const exit = yield* Effect.exit(legacyBranchesDisable(baseFlags));
+      expect(Exit.isFailure(exit)).toBe(true);
+      if (Exit.isFailure(exit)) {
+        const json = JSON.stringify(exit.cause);
+        expect(json).toContain("LegacyBranchesDisableUnexpectedStatusError");
+        expect(json).toContain("unexpected disable branching status 500");
+      }
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("writes linked-project cache + telemetry state on success", () => {
+    const { layer, telemetry, cache } = setupTracked();
+    return Effect.gen(function* () {
+      yield* legacyBranchesDisable(baseFlags);
+      expect(telemetry.flushed).toBe(true);
+      expect(cache.cached).toBe(true);
+    }).pipe(Effect.provide(layer));
+  });
+});
diff --git a/apps/cli/src/legacy/commands/branches/get/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/branches/get/SIDE_EFFECTS.md
index 9d22a679d4..babda6ee3b 100644
--- a/apps/cli/src/legacy/commands/branches/get/SIDE_EFFECTS.md
+++ b/apps/cli/src/legacy/commands/branches/get/SIDE_EFFECTS.md
@@ -2,59 +2,51 @@
 
 ## Files Read
 
-| Path                              | Format                    | When                                                       |
-| --------------------------------- | ------------------------- | ---------------------------------------------------------- |
-| `~/.supabase/access-token`        | plain text (token string) | when `SUPABASE_ACCESS_TOKEN` unset and keyring unavailable |
-| `<workdir>/.supabase/config.json` | JSON                      | always, to resolve linked project ref                      |
+Same auth fallback chain (env / keyring / `~/.supabase/access-token`) and project-ref discovery (`<workdir>/supabase/.temp/project-ref`) as every Management-API legacy command.
 
 ## Files Written
 
-| Path | Format | When |
-| ---- | ------ | ---- |
-| —    | —      | —    |
+| Path                                             | Format | When                                                                     |
+| ------------------------------------------------ | ------ | ------------------------------------------------------------------------ |
+| `~/.supabase/<workdir-hash>/linked-project.json` | JSON   | always (in `Effect.ensuring`) after `--project-ref` resolves — Go parity |
+| `~/.supabase/telemetry.json`                     | JSON   | always (in `Effect.ensuring`) at end of command — Go parity              |
 
 ## API Routes
 
-| Method | Path                       | Auth         | Request body | Response (used fields)                                                                 |
-| ------ | -------------------------- | ------------ | ------------ | -------------------------------------------------------------------------------------- |
-| `GET`  | `/v1/branches/{branch_id}` | Bearer token | none         | `{db_host, db_port, db_user, db_pass, jwt_secret, ref, postgres_version, status, ...}` |
+| Method | Path                                        | Auth         | When                                                                          | Response (used fields)                                                                  |
+| ------ | ------------------------------------------- | ------------ | ----------------------------------------------------------------------------- | --------------------------------------------------------------------------------------- |
+| `GET`  | `/v1/projects/{ref}/branches/{name}`        | Bearer token | input is neither a UUID nor a `^[a-z]{20}$` ref pattern (named-branch lookup) | `{project_ref, ...}`                                                                    |
+| `GET`  | `/v1/branches/{branch_id_or_ref}`           | Bearer token | always — branch detail / config                                               | `{ref, db_host, db_port, db_user?, db_pass?, jwt_secret?, postgres_version, status, …}` |
+| `GET`  | `/v1/projects/{ref}/api-keys`               | Bearer token | only when `--output` is not `pretty`                                          | `[{name, api_key?}]`                                                                    |
+| `GET`  | `/v1/projects/{ref}/config/database/pooler` | Bearer token | only when `--output` is not `pretty`                                          | `[SupavisorConfigResponse]` — handler filters for `database_type === "PRIMARY"`         |
 
 ## Environment Variables
 
-| Variable                | Purpose                                              | Required?                                               |
-| ----------------------- | ---------------------------------------------------- | ------------------------------------------------------- |
-| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `~/.supabase/access-token`) |
-| `SUPABASE_API_URL`      | override Management API base URL                     | no (defaults to `https://api.supabase.com`)             |
+`SUPABASE_ACCESS_TOKEN`, `SUPABASE_PROFILE`, `SUPABASE_PROJECT_ID`, `SUPABASE_WORKDIR` — same semantics as `branches list`.
 
 ## Exit Codes
 
-| Code | Condition                                                    |
-| ---- | ------------------------------------------------------------ |
-| `0`  | success — branch details printed to stdout                   |
-| `1`  | authentication error — no valid token found                  |
-| `1`  | API error — non-2xx response from `/v1/branches/{branch_id}` |
-| `1`  | network / connection failure                                 |
-| `1`  | branch not found (404)                                       |
+| Code | Condition                                                                               |
+| ---- | --------------------------------------------------------------------------------------- |
+| `0`  | success                                                                                 |
+| `1`  | `LegacyBranchesFindUnexpectedStatusError` / `…NetworkError` — named-lookup phase failed |
+| `1`  | `LegacyBranchesGetUnexpectedStatusError` / `…NetworkError` — detail phase failed        |
+| `1`  | `LegacyBranchesApiKeysUnexpectedStatusError` / `…NetworkError` — api-keys phase failed  |
+| `1`  | `LegacyBranchesPoolerUnexpectedStatusError` / `…NetworkError` — pooler phase failed     |
+| `1`  | `LegacyBranchesPrimaryNotFoundError` — no `database_type === "PRIMARY"` pooler entry    |
 
-## Output
-
-### `--output-format text` (Go CLI compatible)
-
-Prints a table with columns: `HOST`, `PORT`, `USER`, `PASSWORD`, `JWT SECRET`, `POSTGRES VERSION`, `STATUS`.
+## Telemetry Events Fired
 
-### `--output-format json`
+| Event                  | When                                       | Notable properties                  |
+| ---------------------- | ------------------------------------------ | ----------------------------------- |
+| `cli_command_executed` | post-run, success or failure (via wrapper) | `exit_code`, `duration_ms`, `flags` |
 
-Single JSON object emitted to stdout on success.
-
-### `--output-format stream-json`
+## Output
 
-One `result` event on success.
+### `--output pretty` (Go default) / `--output-format text`
 
-```ndjson
-{"type":"result","data":{...}}
-```
+Glamour-styled 7-column table: `HOST`, `PORT`, `USER`, `PASSWORD`, `JWT SECRET`, `POSTGRES VERSION`, `STATUS`. Missing `db_user` / `db_pass` / `jwt_secret` render as `******`.
 
-## Notes
+### `--output {json,yaml,toml,env}` / `--output-format json` / `stream-json`
 
-- Accepts optional positional `[name]` argument (branch name or ID). If omitted in interactive mode, prompts the user to select from a list of branches.
-- When `--output toml` is used in Go CLI, it emits connection strings as `.env`-style TOML; this format is not reproduced in the TS port.
+Emits the standard-env projection: `POSTGRES_URL` (pooled, falls back to direct on parse failure with `WARNING:` to stderr), `POSTGRES_URL_NON_POOLING` (direct), `SUPABASE_URL = https://<ref>.<project_host>`, `SUPABASE_JWT_SECRET`, plus `SUPABASE_<NAME>_KEY` per API key.
diff --git a/apps/cli/src/legacy/commands/branches/get/get.command.ts b/apps/cli/src/legacy/commands/branches/get/get.command.ts
index 4d1fa12e30..48a7e5792d 100644
--- a/apps/cli/src/legacy/commands/branches/get/get.command.ts
+++ b/apps/cli/src/legacy/commands/branches/get/get.command.ts
@@ -1,5 +1,9 @@
 import { Argument, Command, Flag } from "effect/unstable/cli";
 import type * as CliCommand from "effect/unstable/cli/Command";
+
+import { withJsonErrorHandling } from "../../../../shared/output/json-error-handling.ts";
+import { legacyManagementApiRuntimeLayer } from "../../../shared/legacy-management-api-runtime.layer.ts";
+import { withLegacyCommandInstrumentation } from "../../../telemetry/legacy-command-instrumentation.ts";
 import { legacyBranchesGet } from "./get.handler.ts";
 
 const config = {
@@ -20,5 +24,11 @@ export const legacyBranchesGetCommand = Command.make("get", config).pipe(
     "Retrieve details of the specified preview branch.\n\nNote: For the main branch, password-dependent fields (POSTGRES_URL, POSTGRES_URL_NON_POOLING) are not populated because production database credentials are not retrievable via API.",
   ),
   Command.withShortDescription("Retrieve details of a preview branch"),
-  Command.withHandler((flags) => legacyBranchesGet(flags)),
+  Command.withHandler((flags) =>
+    legacyBranchesGet(flags).pipe(
+      withLegacyCommandInstrumentation({ flags, safeFlags: ["project-ref"] }),
+      withJsonErrorHandling,
+    ),
+  ),
+  Command.provide(legacyManagementApiRuntimeLayer(["branches", "get"])),
 );
diff --git a/apps/cli/src/legacy/commands/branches/get/get.handler.ts b/apps/cli/src/legacy/commands/branches/get/get.handler.ts
index 79cc104e17..335d2343b4 100644
--- a/apps/cli/src/legacy/commands/branches/get/get.handler.ts
+++ b/apps/cli/src/legacy/commands/branches/get/get.handler.ts
@@ -1,13 +1,195 @@
+import { styleText } from "node:util";
+
+import type {
+  V1GetABranchConfigOutput,
+  V1GetProjectApiKeysOutput,
+  V1GetPoolerConfigOutput,
+} from "@supabase/api/effect";
 import { Effect, Option } from "effect";
-import { LegacyGoProxy } from "../../../../shared/legacy/go-proxy.service.ts";
+
+import { LegacyPlatformApi } from "../../../auth/legacy-platform-api.service.ts";
+import { LegacyCliConfig } from "../../../config/legacy-cli-config.service.ts";
+import { LegacyProjectRefResolver } from "../../../config/legacy-project-ref.service.ts";
+import { LegacyLinkedProjectCache } from "../../../telemetry/legacy-linked-project-cache.service.ts";
+import { LegacyTelemetryState } from "../../../telemetry/legacy-telemetry-state.service.ts";
+import { LegacyOutputFlag } from "../../../../shared/legacy/global-flags.ts";
+import { Output } from "../../../../shared/output/output.service.ts";
+import { Tty } from "../../../../shared/runtime/tty.service.ts";
+import {
+  encodeEnv,
+  encodeGoJson,
+  encodeToml,
+  encodeYaml,
+} from "../../../shared/legacy-go-output.encoders.ts";
+import { mapLegacyHttpError } from "../../../shared/legacy-http-errors.ts";
+import {
+  LegacyBranchesApiKeysNetworkError,
+  LegacyBranchesApiKeysUnexpectedStatusError,
+  LegacyBranchesFindNetworkError,
+  LegacyBranchesFindUnexpectedStatusError,
+  LegacyBranchesGetNetworkError,
+  LegacyBranchesGetUnexpectedStatusError,
+  LegacyBranchesPoolerNetworkError,
+  LegacyBranchesPoolerUnexpectedStatusError,
+  LegacyBranchesPrimaryNotFoundError,
+} from "../branches.errors.ts";
+import { renderBranchGetTable, toStandardEnvs } from "../branches.format.ts";
+import { legacyProjectHost } from "../../../shared/legacy-profile.ts";
+import { legacyPromptBranchId } from "../branches.prompt.ts";
+import {
+  LEGACY_BRANCH_PROJECT_REF_PATTERN,
+  LEGACY_BRANCH_UUID_PATTERN,
+} from "../branches.resolver.ts";
 import type { LegacyBranchesGetFlags } from "./get.command.ts";
 
+type BranchDetail = typeof V1GetABranchConfigOutput.Type;
+type ApiKeys = typeof V1GetProjectApiKeysOutput.Type;
+type Pooler = typeof V1GetPoolerConfigOutput.Type;
+
+const mapFindError = mapLegacyHttpError({
+  networkError: LegacyBranchesFindNetworkError,
+  statusError: LegacyBranchesFindUnexpectedStatusError,
+  networkMessage: (cause) => `failed to find branch: ${cause}`,
+  statusMessage: (status, body) => `unexpected find branch status ${status}: ${body}`,
+});
+
+const mapGetError = mapLegacyHttpError({
+  networkError: LegacyBranchesGetNetworkError,
+  statusError: LegacyBranchesGetUnexpectedStatusError,
+  networkMessage: (cause) => `failed to get branch: ${cause}`,
+  statusMessage: (status, body) => `unexpected get branch status ${status}: ${body}`,
+});
+
+const mapApiKeysError = mapLegacyHttpError({
+  networkError: LegacyBranchesApiKeysNetworkError,
+  statusError: LegacyBranchesApiKeysUnexpectedStatusError,
+  networkMessage: (cause) => `failed to get api keys: ${cause}`,
+  statusMessage: (status, body) => `unexpected get api keys status ${status}: ${body}`,
+});
+
+const mapPoolerError = mapLegacyHttpError({
+  networkError: LegacyBranchesPoolerNetworkError,
+  statusError: LegacyBranchesPoolerUnexpectedStatusError,
+  networkMessage: (cause) => `failed to get pooler: ${cause}`,
+  statusMessage: (status, body) => `unexpected get pooler status ${status}: ${body}`,
+});
+
 export const legacyBranchesGet = Effect.fn("legacy.branches.get")(function* (
   flags: LegacyBranchesGetFlags,
 ) {
-  const proxy = yield* LegacyGoProxy;
-  const args: string[] = ["branches", "get"];
-  if (Option.isSome(flags.name)) args.push(flags.name.value);
-  if (Option.isSome(flags.projectRef)) args.push("--project-ref", flags.projectRef.value);
-  yield* proxy.exec(args);
+  const output = yield* Output;
+  const goOutputFlag = yield* LegacyOutputFlag;
+  const api = yield* LegacyPlatformApi;
+  const resolver = yield* LegacyProjectRefResolver;
+  const linkedProjectCache = yield* LegacyLinkedProjectCache;
+  const telemetryState = yield* LegacyTelemetryState;
+  const cliConfig = yield* LegacyCliConfig;
+  void (yield* Tty); // ensures Tty is in handler R so legacyPromptBranchId resolves
+
+  const ref = yield* resolver.resolve(flags.projectRef);
+
+  yield* Effect.gen(function* () {
+    // Branch-id resolution. Empty input goes through the prompt helper.
+    const branchInput = yield* legacyPromptBranchId(flags.name, ref);
+
+    // ------------------------------------------------------------------
+    // 1. Lookup: if input is not a UUID and not a ref pattern, fetch the
+    //    project ref via V1GetABranch (`GET /v1/projects/{ref}/branches/{name}`).
+    // ------------------------------------------------------------------
+    let branchIdOrRef = branchInput;
+    if (
+      !LEGACY_BRANCH_UUID_PATTERN.test(branchInput) &&
+      !LEGACY_BRANCH_PROJECT_REF_PATTERN.test(branchInput)
+    ) {
+      const lookup = yield* api.v1
+        .getABranch({ ref, name: branchInput })
+        .pipe(Effect.catch(mapFindError));
+      branchIdOrRef = lookup.project_ref;
+    }
+
+    // ------------------------------------------------------------------
+    // 2. Detail: V1GetABranchConfig (`GET /v1/branches/{id_or_ref}`).
+    //    Mask db_user / db_pass / jwt_secret with `******` when nil.
+    // ------------------------------------------------------------------
+    const fetching =
+      output.format === "text" ? yield* output.task("Fetching branch...") : undefined;
+    const rawDetail: BranchDetail = yield* api.v1
+      .getABranchConfig({ branch_id_or_ref: branchIdOrRef })
+      .pipe(
+        Effect.tapError(() => fetching?.fail() ?? Effect.void),
+        Effect.catch(mapGetError),
+      );
+    yield* fetching?.clear() ?? Effect.void;
+    const detail: BranchDetail = {
+      ...rawDetail,
+      db_user: rawDetail.db_user ?? "******",
+      db_pass: rawDetail.db_pass ?? "******",
+      jwt_secret: rawDetail.jwt_secret ?? "******",
+    };
+
+    const goFmt = Option.getOrUndefined(goOutputFlag);
+    const wantsEnvMap = goFmt !== undefined && goFmt !== "pretty";
+    const wantsTsStructured = output.format === "json" || output.format === "stream-json";
+
+    if (goFmt === "pretty" || (goFmt === undefined && output.format === "text")) {
+      yield* output.raw(renderBranchGetTable(detail));
+      return;
+    }
+
+    // ------------------------------------------------------------------
+    // 3+4. API keys + pooler config (only for non-pretty modes).
+    // ------------------------------------------------------------------
+    const keys: ApiKeys = yield* api.v1
+      .getProjectApiKeys({ ref: detail.ref })
+      .pipe(Effect.catch(mapApiKeysError));
+    const poolers: Pooler = yield* api.v1
+      .getPoolerConfig({ ref: detail.ref })
+      .pipe(Effect.catch(mapPoolerError));
+    const primary = poolers.find((p) => p.database_type === "PRIMARY");
+    if (primary === undefined) {
+      return yield* new LegacyBranchesPrimaryNotFoundError({
+        message: "primary database not found",
+      });
+    }
+
+    const projectHost = legacyProjectHost(cliConfig.profile);
+    const projected = toStandardEnvs(detail, primary, keys, projectHost);
+    if (projected.poolerWarning !== undefined && output.format === "text") {
+      // Mirror Go's `fmt.Fprintln(os.Stderr, utils.Yellow("WARNING:"), err)`
+      // (`apps/cli-go/internal/branches/get/get.go:94`). The "WARNING:" prefix
+      // is yellow, then a space, then the parse error message.
+      yield* output.raw(
+        `${styleText("yellow", "WARNING:")} ${projected.poolerWarning}\n`,
+        "stderr",
+      );
+    }
+    const envMap = projected.envs;
+
+    if (goFmt === "json") {
+      yield* output.raw(encodeGoJson(envMap));
+      return;
+    }
+    if (goFmt === "yaml") {
+      yield* output.raw(encodeYaml(envMap));
+      return;
+    }
+    if (goFmt === "toml") {
+      yield* output.raw(encodeToml(envMap) + "\n");
+      return;
+    }
+    if (goFmt === "env") {
+      yield* output.raw(encodeEnv(envMap) + "\n");
+      return;
+    }
+
+    if (wantsTsStructured) {
+      // No goFmt set but TS structured output requested.
+      yield* output.success("", envMap);
+      return;
+    }
+
+    // Defensive — should be unreachable given the wantsEnvMap branch above.
+    void wantsEnvMap;
+    yield* output.raw(encodeGoJson(envMap));
+  }).pipe(Effect.ensuring(linkedProjectCache.cache(ref)), Effect.ensuring(telemetryState.flush));
 });
diff --git a/apps/cli/src/legacy/commands/branches/get/get.integration.test.ts b/apps/cli/src/legacy/commands/branches/get/get.integration.test.ts
new file mode 100644
index 0000000000..f02e294f14
--- /dev/null
+++ b/apps/cli/src/legacy/commands/branches/get/get.integration.test.ts
@@ -0,0 +1,299 @@
+import type {
+  V1GetABranchConfigOutput,
+  V1GetABranchOutput,
+  V1GetPoolerConfigOutput,
+  V1GetProjectApiKeysOutput,
+} from "@supabase/api/effect";
+import { describe, expect, it } from "@effect/vitest";
+import { Effect, Exit, Option } from "effect";
+
+import { mockOutput } from "../../../../../tests/helpers/mocks.ts";
+import {
+  LEGACY_VALID_REF,
+  buildLegacyTestRuntime,
+  legacyJsonResponse,
+  mockLegacyCliConfig,
+  mockLegacyPlatformApi,
+  useLegacyTempWorkdir,
+} from "../../../../../tests/helpers/legacy-mocks.ts";
+import type { LegacyBranchesGetFlags } from "./get.command.ts";
+import { legacyBranchesGet } from "./get.handler.ts";
+
+type BranchDetail = typeof V1GetABranchConfigOutput.Type;
+type FindResponse = typeof V1GetABranchOutput.Type;
+type Pooler = typeof V1GetPoolerConfigOutput.Type;
+type ApiKeys = typeof V1GetProjectApiKeysOutput.Type;
+
+// V1GetABranchConfigInput.branch_id_or_ref is a oneOf [project-ref, uuid] union.
+// A 20-lowercase project-ref matches BOTH branches → schema rejects.
+// We use a valid v4 UUID for the input so the schema picks exactly one branch.
+const BRANCH_UUID = "11111111-1111-4111-8111-111111111111";
+// project_ref returned by mocks — 20 lowercase, the production shape.
+const BRANCH_REF = "cccccccccccccccccccc";
+
+const DETAIL: BranchDetail = {
+  ref: BRANCH_REF,
+  postgres_version: "15",
+  postgres_engine: "15",
+  release_channel: "ga",
+  status: "ACTIVE_HEALTHY",
+  db_host: "db.cccccccccccccccccccc.supabase.co",
+  db_port: 5432,
+  db_user: "postgres",
+  db_pass: "secret",
+  jwt_secret: "jwt-secret",
+};
+
+const DETAIL_MASKED: BranchDetail = {
+  ref: BRANCH_REF,
+  postgres_version: "15",
+  postgres_engine: "15",
+  release_channel: "ga",
+  status: "ACTIVE_HEALTHY",
+  db_host: "db.cccccccccccccccccccc.supabase.co",
+  db_port: 5432,
+};
+
+// V1GetABranch (named-lookup) returns this — note `project_ref` is a UUID so
+// the downstream getABranchConfig({ branch_id_or_ref: UUID }) passes the union.
+const FIND: FindResponse = {
+  id: BRANCH_UUID,
+  name: "feat-x",
+  project_ref: BRANCH_UUID,
+  parent_project_ref: LEGACY_VALID_REF,
+  is_default: false,
+  persistent: false,
+  status: "MIGRATIONS_PASSED",
+  created_at: "",
+  updated_at: "",
+  with_data: false,
+};
+
+const POOLER: Pooler = [
+  {
+    identifier: "id",
+    database_type: "PRIMARY",
+    is_using_scram_auth: true,
+    db_user: "postgres.cccccccccccccccccccc",
+    db_host: "aws-0-us-east-1.pooler.supabase.com",
+    db_port: 6543,
+    db_name: "postgres",
+    connection_string:
+      "postgresql://postgres.cccccccccccccccccccc:[YOUR-PASSWORD]@aws-0-us-east-1.pooler.supabase.com:6543/postgres",
+    connectionString: "n/a",
+    default_pool_size: null,
+    max_client_conn: null,
+    pool_mode: "transaction",
+  },
+];
+
+const KEYS: ApiKeys = [
+  { name: "anon", api_key: "anon-key" },
+  { name: "service_role", api_key: "sr-key" },
+];
+
+const tempRoot = useLegacyTempWorkdir("supabase-branches-get-int-");
+
+interface SetupOpts {
+  readonly format?: "text" | "json";
+  readonly goOutput?: "env" | "pretty" | "json" | "toml" | "yaml";
+  readonly findStatus?: number;
+  readonly detailStatus?: number;
+  readonly detailBody?: BranchDetail;
+  readonly poolerStatus?: number;
+  readonly poolerBody?: Pooler;
+  readonly apiKeysStatus?: number;
+  readonly skipPrimary?: boolean;
+}
+
+function buildApi(opts: SetupOpts) {
+  const findStatus = opts.findStatus ?? 200;
+  const detailStatus = opts.detailStatus ?? 200;
+  const detailBody = opts.detailBody ?? DETAIL;
+  const poolerStatus = opts.poolerStatus ?? 200;
+  const poolerBody = opts.poolerBody ?? POOLER;
+  const apiKeysStatus = opts.apiKeysStatus ?? 200;
+  return mockLegacyPlatformApi({
+    handler: (request) =>
+      Effect.sync(() => {
+        if (
+          request.method === "GET" &&
+          request.url.includes(`/v1/projects/${LEGACY_VALID_REF}/branches/`)
+        ) {
+          return legacyJsonResponse(request, findStatus, findStatus === 200 ? FIND : { err: 1 });
+        }
+        if (request.method === "GET" && request.url.includes("/v1/branches/")) {
+          return legacyJsonResponse(
+            request,
+            detailStatus,
+            detailStatus === 200 ? detailBody : { err: 1 },
+          );
+        }
+        if (request.method === "GET" && request.url.includes("/api-keys")) {
+          return legacyJsonResponse(request, apiKeysStatus, apiKeysStatus === 200 ? KEYS : []);
+        }
+        if (request.method === "GET" && request.url.includes("/config/database/pooler")) {
+          const body = opts.skipPrimary
+            ? poolerBody.filter((p) => p.database_type !== "PRIMARY")
+            : poolerBody;
+          return legacyJsonResponse(request, poolerStatus, poolerStatus === 200 ? body : []);
+        }
+        return legacyJsonResponse(request, 200, null);
+      }),
+  });
+}
+
+function setup(opts: SetupOpts = {}) {
+  const out = mockOutput({ format: opts.format ?? "text" });
+  const api = buildApi(opts);
+  const cliConfig = mockLegacyCliConfig({ workdir: tempRoot.current });
+  const layer = buildLegacyTestRuntime({
+    out,
+    api,
+    cliConfig,
+    goOutput: opts.goOutput === undefined ? Option.none() : Option.some(opts.goOutput),
+  });
+  return { layer, out, api };
+}
+
+const baseFlags: LegacyBranchesGetFlags = {
+  name: Option.none(),
+  projectRef: Option.none(),
+};
+
+describe("legacy branches get integration", () => {
+  it.live("fetches branch detail directly when input is a UUID (no lookup)", () => {
+    const { layer, api } = setup();
+    return Effect.gen(function* () {
+      yield* legacyBranchesGet({ ...baseFlags, name: Option.some(BRANCH_UUID) });
+      // Only the detail call hits /v1/branches/<uuid>; no /v1/projects/{ref}/branches/<name> lookup.
+      expect(api.requests.some((r) => r.url.includes(`/v1/branches/${BRANCH_UUID}`))).toBe(true);
+      expect(
+        api.requests.some((r) =>
+          r.url.includes(`/v1/projects/${LEGACY_VALID_REF}/branches/${BRANCH_UUID}`),
+        ),
+      ).toBe(false);
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("performs lookup-then-detail when input is a plain name", () => {
+    const { layer, api } = setup();
+    return Effect.gen(function* () {
+      yield* legacyBranchesGet({ ...baseFlags, name: Option.some("feat-x") });
+      expect(
+        api.requests.some((r) =>
+          r.url.includes(`/v1/projects/${LEGACY_VALID_REF}/branches/feat-x`),
+        ),
+      ).toBe(true);
+      expect(api.requests.some((r) => r.url.includes(`/v1/branches/${BRANCH_UUID}`))).toBe(true);
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("renders pretty 7-col table with masked ****** for missing credentials", () => {
+    const { layer, out } = setup({ detailBody: DETAIL_MASKED });
+    return Effect.gen(function* () {
+      yield* legacyBranchesGet({ ...baseFlags, name: Option.some(BRANCH_UUID) });
+      expect(out.stdoutText).toContain("HOST");
+      expect(out.stdoutText).toContain("******");
+      expect(out.stdoutText).toContain("ACTIVE_HEALTHY");
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("emits standard-env map for --output-format=json", () => {
+    const { layer, out } = setup({ format: "json" });
+    return Effect.gen(function* () {
+      yield* legacyBranchesGet({ ...baseFlags, name: Option.some(BRANCH_UUID) });
+      const success = out.messages.find((m) => m.type === "success");
+      expect(success).toBeDefined();
+      expect(success?.data).toHaveProperty("POSTGRES_URL");
+      expect(success?.data).toHaveProperty("POSTGRES_URL_NON_POOLING");
+      expect(success?.data).toHaveProperty("SUPABASE_URL");
+      expect(success?.data).toHaveProperty("SUPABASE_JWT_SECRET");
+      expect(success?.data).toHaveProperty("SUPABASE_ANON_KEY");
+      expect(success?.data).toHaveProperty("SUPABASE_SERVICE_ROLE_KEY");
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("emits standard-env map for --output env (env-format encoder)", () => {
+    const { layer, out } = setup({ goOutput: "env" });
+    return Effect.gen(function* () {
+      yield* legacyBranchesGet({ ...baseFlags, name: Option.some(BRANCH_UUID) });
+      expect(out.stdoutText).toContain("SUPABASE_URL=");
+      expect(out.stdoutText).toContain("SUPABASE_ANON_KEY=");
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("writes WARNING to stderr when pooler parse fails in text mode", () => {
+    const broken: Pooler = [
+      {
+        ...POOLER[0]!,
+        connection_string: "not a url",
+      },
+    ];
+    const { layer, out } = setup({ goOutput: "yaml", poolerBody: broken });
+    return Effect.gen(function* () {
+      yield* legacyBranchesGet({ ...baseFlags, name: Option.some(BRANCH_UUID) });
+      expect(out.stderrText).toContain("WARNING:");
+      expect(out.stderrText).toContain("failed to parse pooler URL");
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("fails with LegacyBranchesPrimaryNotFoundError when no PRIMARY pooler entry", () => {
+    const { layer } = setup({ goOutput: "json", skipPrimary: true });
+    return Effect.gen(function* () {
+      const exit = yield* Effect.exit(
+        legacyBranchesGet({ ...baseFlags, name: Option.some(BRANCH_UUID) }),
+      );
+      expect(Exit.isFailure(exit)).toBe(true);
+      if (Exit.isFailure(exit)) {
+        const json = JSON.stringify(exit.cause);
+        expect(json).toContain("LegacyBranchesPrimaryNotFoundError");
+        expect(json).toContain("primary database not found");
+      }
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("fails with LegacyBranchesFindUnexpectedStatusError on lookup 404", () => {
+    const { layer } = setup({ findStatus: 404 });
+    return Effect.gen(function* () {
+      const exit = yield* Effect.exit(
+        legacyBranchesGet({ ...baseFlags, name: Option.some("feat-x") }),
+      );
+      expect(Exit.isFailure(exit)).toBe(true);
+      if (Exit.isFailure(exit)) {
+        const json = JSON.stringify(exit.cause);
+        expect(json).toContain("LegacyBranchesFindUnexpectedStatusError");
+        expect(json).toContain("unexpected find branch status 404");
+      }
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("fails with LegacyBranchesGetUnexpectedStatusError on detail 503", () => {
+    const { layer } = setup({ detailStatus: 503 });
+    return Effect.gen(function* () {
+      const exit = yield* Effect.exit(
+        legacyBranchesGet({ ...baseFlags, name: Option.some(BRANCH_UUID) }),
+      );
+      expect(Exit.isFailure(exit)).toBe(true);
+      if (Exit.isFailure(exit)) {
+        const json = JSON.stringify(exit.cause);
+        expect(json).toContain("LegacyBranchesGetUnexpectedStatusError");
+        expect(json).toContain("unexpected get branch status 503");
+      }
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("fails with LegacyBranchesApiKeysUnexpectedStatusError on api-keys 403", () => {
+    const { layer } = setup({ goOutput: "json", apiKeysStatus: 403 });
+    return Effect.gen(function* () {
+      const exit = yield* Effect.exit(
+        legacyBranchesGet({ ...baseFlags, name: Option.some(BRANCH_UUID) }),
+      );
+      expect(Exit.isFailure(exit)).toBe(true);
+      if (Exit.isFailure(exit)) {
+        const json = JSON.stringify(exit.cause);
+        expect(json).toContain("LegacyBranchesApiKeysUnexpectedStatusError");
+      }
+    }).pipe(Effect.provide(layer));
+  });
+});
diff --git a/apps/cli/src/legacy/commands/branches/list/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/branches/list/SIDE_EFFECTS.md
index b009c99250..f759df0adf 100644
--- a/apps/cli/src/legacy/commands/branches/list/SIDE_EFFECTS.md
+++ b/apps/cli/src/legacy/commands/branches/list/SIDE_EFFECTS.md
@@ -2,65 +2,88 @@
 
 ## Files Read
 
-| Path                              | Format                    | When                                                       |
-| --------------------------------- | ------------------------- | ---------------------------------------------------------- |
-| `~/.supabase/access-token`        | plain text (token string) | when `SUPABASE_ACCESS_TOKEN` unset and keyring unavailable |
-| `<workdir>/.supabase/config.json` | JSON                      | always, to resolve linked project ref                      |
+| Path                                      | Format                    | When                                                                                          |
+| ----------------------------------------- | ------------------------- | --------------------------------------------------------------------------------------------- |
+| keyring `"Supabase CLI"` / `<profile>`    | OS keychain               | when `SUPABASE_ACCESS_TOKEN` unset and keyring available; account = `LegacyCliConfig.profile` |
+| keyring `"Supabase CLI"` / `access-token` | OS keychain               | legacy-key fallback when the profile-keyed lookup misses                                      |
+| `~/.supabase/access-token`                | plain text (token string) | last-resort fallback after env + keyring miss                                                 |
+| `<workdir>/supabase/.temp/project-ref`    | plain text                | when `--project-ref` and `SUPABASE_PROJECT_ID` are both unset                                 |
 
 ## Files Written
 
-| Path | Format | When |
-| ---- | ------ | ---- |
-| —    | —      | —    |
+| Path                                             | Format | When                                                                     |
+| ------------------------------------------------ | ------ | ------------------------------------------------------------------------ |
+| `~/.supabase/<workdir-hash>/linked-project.json` | JSON   | always (in `Effect.ensuring`) after `--project-ref` resolves — Go parity |
+| `~/.supabase/telemetry.json`                     | JSON   | always (in `Effect.ensuring`) at end of command — Go parity              |
 
 ## API Routes
 
-| Method | Path                          | Auth         | Request body | Response (used fields)                                                                                     |
-| ------ | ----------------------------- | ------------ | ------------ | ---------------------------------------------------------------------------------------------------------- |
-| `GET`  | `/v1/projects/{ref}/branches` | Bearer token | none         | `[{id, name, is_default, git_branch, with_data, status, created_at, updated_at, project_ref, persistent}]` |
+| Method | Path                          | Auth         | Request body | Response (used fields)                                                                                                               |
+| ------ | ----------------------------- | ------------ | ------------ | ------------------------------------------------------------------------------------------------------------------------------------ |
+| `GET`  | `/v1/projects/{ref}/branches` | Bearer token | none         | `[{id, name, project_ref, parent_project_ref, is_default, git_branch?, persistent, status, created_at, updated_at, with_data, ...}]` |
 
 ## Environment Variables
 
-| Variable                | Purpose                                              | Required?                                               |
-| ----------------------- | ---------------------------------------------------- | ------------------------------------------------------- |
-| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `~/.supabase/access-token`) |
-| `SUPABASE_API_URL`      | override Management API base URL                     | no (defaults to `https://api.supabase.com`)             |
+| Variable                | Purpose                                                                                                                                                                                                                                                                                              | Required?                                                                  |
+| ----------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------- |
+| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup)                                                                                                                                                                                                                                                 | no (falls back to keyring → `~/.supabase/access-token`)                    |
+| `SUPABASE_PROFILE`      | selects API base URL: `supabase` → `api.supabase.com`, `supabase-staging` → `api.supabase.green`, `supabase-local` → `http://localhost:8080`. May alternatively be a filesystem path to a YAML profile with at least `api_url:` and optional `name:` (Go parity — used by the cli-e2e test harness). | no (defaults to `supabase`)                                                |
+| `SUPABASE_PROJECT_ID`   | project ref fallback when `--project-ref` is unset                                                                                                                                                                                                                                                   | no (also reads `<workdir>/supabase/.temp/project-ref` then prompts on TTY) |
+| `SUPABASE_WORKDIR`      | base directory for the `.temp/project-ref` lookup                                                                                                                                                                                                                                                    | no (walks up from CWD looking for `supabase/config.toml`)                  |
 
 ## Exit Codes
 
-| Code | Condition                                                       |
-| ---- | --------------------------------------------------------------- |
-| `0`  | success — branches printed to stdout                            |
-| `1`  | authentication error — no valid token found                     |
-| `1`  | API error — non-2xx response from `/v1/projects/{ref}/branches` |
-| `1`  | network / connection failure                                    |
-| `1`  | unsupported output format (e.g. `--output env`)                 |
+| Code | Condition                                                                       |
+| ---- | ------------------------------------------------------------------------------- |
+| `0`  | success — branches printed to stdout                                            |
+| `1`  | `LegacyPlatformAuthRequiredError` — no token in env/keyring/file                |
+| `1`  | `LegacyProjectNotLinkedError` — `--project-ref` unset, env/file empty, non-TTY  |
+| `1`  | `LegacyInvalidProjectRefError` — resolved ref violates `^[a-z]{20}$`            |
+| `1`  | `LegacyBranchesListUnexpectedStatusError` — non-2xx response from list endpoint |
+| `1`  | `LegacyBranchesListNetworkError` — transport-level network failure              |
+| `1`  | `LegacyBranchesEnvNotSupportedError` — `--output env` flag is rejected          |
+
+## Telemetry Events Fired
+
+| Event                  | When                                       | Notable properties / groups                                       |
+| ---------------------- | ------------------------------------------ | ----------------------------------------------------------------- |
+| `cli_command_executed` | post-run, success or failure (via wrapper) | `exit_code`, `duration_ms`, `flags` (`--project-ref` whitelisted) |
+
+Matches `apps/cli-go/internal/branches/list/`. Go does not fire any custom telemetry event for this command.
 
 ## Output
 
-### `--output-format text` (Go CLI compatible)
+The legacy `--output {pretty,json,yaml,toml,env}` flag (Go-compatible) and the new global `--output-format {text,json,stream-json}` flag are both honored. `--output` wins when both are supplied. `pretty` and `text` map to the same Glamour render.
+
+### `--output pretty` (Go default) / `--output-format text`
+
+Prints a Glamour-styled markdown table with columns `ID`, `NAME`, `DEFAULT`, `GIT BRANCH`, `WITH DATA`, `STATUS`, `CREATED AT (UTC)`, `UPDATED AT (UTC)`. Byte-matched against the Go CLI.
+
+### `--output json` (Go-compat)
 
-Prints a Markdown-style table to stdout. Columns: `ID`, `NAME`, `DEFAULT`, `GIT BRANCH`, `WITH DATA`, `STATUS`, `CREATED AT (UTC)`, `UPDATED AT (UTC)`.
+Indented JSON of the `BranchResponse[]` array with alphabetical keys + trailing newline.
 
-```
- ID                  | NAME    | DEFAULT | GIT BRANCH | WITH DATA | STATUS           | CREATED AT (UTC)    | UPDATED AT (UTC)
- --------------------|---------|---------|------------|-----------|------------------|---------------------|--------------------
- staging-project-ref | Staging | false   | develop    | true      | CREATING_PROJECT | 2026-01-02 03:04:05 | 2026-01-03 03:04:05
-```
+### `--output yaml`
+
+YAML document of the branch array.
+
+### `--output toml`
+
+TOML document wrapping the array as `[[branches]]` (Go parity).
+
+### `--output env`
+
+Fails with `LegacyBranchesEnvNotSupportedError("--output env flag is not supported")`.
 
 ### `--output-format json`
 
-Single JSON array emitted to stdout on success. Each element is the full branch object as returned by the Management API.
+Single JSON object via `Output.success` with `{branches: [...]}` data.
 
 ### `--output-format stream-json`
 
-One `result` event on success.
-
-```ndjson
-{"type":"result","data":[{...}]}
-```
+One `result` NDJSON event with `{branches: [...]}`.
 
 ## Notes
 
-- Requires a linked project (reads `--project-ref` or `.supabase/config.json`).
-- The Go CLI also supports `--output toml` via its own flag. The TypeScript port uses the global `--output-format` flag instead.
+- Reads timestamp formatting follows Go's `utils.FormatTime` (UTC `YYYY-MM-DD HH:MM:SS`).
+- Sends `User-Agent: SupabaseCLI/<version>` and Bearer auth. No `X-Supabase-Command` headers.
diff --git a/apps/cli/src/legacy/commands/branches/list/list.command.ts b/apps/cli/src/legacy/commands/branches/list/list.command.ts
index 22e7f4f4c5..f5aae0e79c 100644
--- a/apps/cli/src/legacy/commands/branches/list/list.command.ts
+++ b/apps/cli/src/legacy/commands/branches/list/list.command.ts
@@ -1,5 +1,9 @@
 import { Command, Flag } from "effect/unstable/cli";
 import type * as CliCommand from "effect/unstable/cli/Command";
+
+import { withJsonErrorHandling } from "../../../../shared/output/json-error-handling.ts";
+import { legacyManagementApiRuntimeLayer } from "../../../shared/legacy-management-api-runtime.layer.ts";
+import { withLegacyCommandInstrumentation } from "../../../telemetry/legacy-command-instrumentation.ts";
 import { legacyBranchesList } from "./list.handler.ts";
 
 const config = {
@@ -14,5 +18,11 @@ export type LegacyBranchesListFlags = CliCommand.Command.Config.Infer<typeof con
 export const legacyBranchesListCommand = Command.make("list", config).pipe(
   Command.withDescription("List all preview branches of the linked project."),
   Command.withShortDescription("List all preview branches"),
-  Command.withHandler((flags) => legacyBranchesList(flags)),
+  Command.withHandler((flags) =>
+    legacyBranchesList(flags).pipe(
+      withLegacyCommandInstrumentation({ flags, safeFlags: ["project-ref"] }),
+      withJsonErrorHandling,
+    ),
+  ),
+  Command.provide(legacyManagementApiRuntimeLayer(["branches", "list"])),
 );
diff --git a/apps/cli/src/legacy/commands/branches/list/list.handler.ts b/apps/cli/src/legacy/commands/branches/list/list.handler.ts
index 11c7a35d2b..edcccc51e0 100644
--- a/apps/cli/src/legacy/commands/branches/list/list.handler.ts
+++ b/apps/cli/src/legacy/commands/branches/list/list.handler.ts
@@ -1,12 +1,79 @@
+import type { V1ListAllBranchesOutput } from "@supabase/api/effect";
 import { Effect, Option } from "effect";
-import { LegacyGoProxy } from "../../../../shared/legacy/go-proxy.service.ts";
+
+import { LegacyPlatformApi } from "../../../auth/legacy-platform-api.service.ts";
+import { LegacyProjectRefResolver } from "../../../config/legacy-project-ref.service.ts";
+import { LegacyLinkedProjectCache } from "../../../telemetry/legacy-linked-project-cache.service.ts";
+import { LegacyTelemetryState } from "../../../telemetry/legacy-telemetry-state.service.ts";
+import { LegacyOutputFlag } from "../../../../shared/legacy/global-flags.ts";
+import { Output } from "../../../../shared/output/output.service.ts";
+import { encodeGoJson, encodeToml, encodeYaml } from "../../../shared/legacy-go-output.encoders.ts";
+import { mapLegacyHttpError } from "../../../shared/legacy-http-errors.ts";
+import {
+  LegacyBranchesEnvNotSupportedError,
+  LegacyBranchesListNetworkError,
+  LegacyBranchesListUnexpectedStatusError,
+} from "../branches.errors.ts";
+import { renderBranchesListTable } from "../branches.format.ts";
 import type { LegacyBranchesListFlags } from "./list.command.ts";
 
+type Branches = typeof V1ListAllBranchesOutput.Type;
+
+const mapListError = mapLegacyHttpError({
+  networkError: LegacyBranchesListNetworkError,
+  statusError: LegacyBranchesListUnexpectedStatusError,
+  networkMessage: (cause) => `failed to list branch: ${cause}`,
+  statusMessage: (status, body) => `unexpected list branch status ${status}: ${body}`,
+});
+
 export const legacyBranchesList = Effect.fn("legacy.branches.list")(function* (
   flags: LegacyBranchesListFlags,
 ) {
-  const proxy = yield* LegacyGoProxy;
-  const args: string[] = ["branches", "list"];
-  if (Option.isSome(flags.projectRef)) args.push("--project-ref", flags.projectRef.value);
-  yield* proxy.exec(args);
+  const output = yield* Output;
+  const goOutputFlag = yield* LegacyOutputFlag;
+  const api = yield* LegacyPlatformApi;
+  const resolver = yield* LegacyProjectRefResolver;
+  const linkedProjectCache = yield* LegacyLinkedProjectCache;
+  const telemetryState = yield* LegacyTelemetryState;
+
+  const ref = yield* resolver.resolve(flags.projectRef);
+
+  yield* Effect.gen(function* () {
+    const fetching =
+      output.format === "text" ? yield* output.task("Fetching branches...") : undefined;
+    const branches: Branches = yield* api.v1.listAllBranches({ ref }).pipe(
+      Effect.tapError(() => fetching?.fail() ?? Effect.void),
+      Effect.catch(mapListError),
+    );
+    yield* fetching?.clear() ?? Effect.void;
+
+    const goFmt = Option.getOrUndefined(goOutputFlag);
+
+    if (goFmt === "env") {
+      return yield* new LegacyBranchesEnvNotSupportedError({
+        message: "--output env flag is not supported",
+      });
+    }
+    if (goFmt === "json") {
+      yield* output.raw(encodeGoJson(branches));
+      return;
+    }
+    if (goFmt === "yaml") {
+      yield* output.raw(encodeYaml(branches));
+      return;
+    }
+    if (goFmt === "toml") {
+      yield* output.raw(encodeToml({ branches }) + "\n");
+      return;
+    }
+
+    // goFmt is undefined or "pretty" — defer to TS --output-format for
+    // JSON/stream-json, otherwise render the Glamour-styled table.
+    if (output.format === "json" || output.format === "stream-json") {
+      yield* output.success("", { branches });
+      return;
+    }
+
+    yield* output.raw(renderBranchesListTable(branches));
+  }).pipe(Effect.ensuring(linkedProjectCache.cache(ref)), Effect.ensuring(telemetryState.flush));
 });
diff --git a/apps/cli/src/legacy/commands/branches/list/list.integration.test.ts b/apps/cli/src/legacy/commands/branches/list/list.integration.test.ts
new file mode 100644
index 0000000000..00cd3c8625
--- /dev/null
+++ b/apps/cli/src/legacy/commands/branches/list/list.integration.test.ts
@@ -0,0 +1,252 @@
+import type { V1ListAllBranchesOutput } from "@supabase/api/effect";
+import { describe, expect, it } from "@effect/vitest";
+import { Effect, Exit, Option } from "effect";
+
+import { mockOutput } from "../../../../../tests/helpers/mocks.ts";
+import {
+  LEGACY_VALID_REF,
+  buildLegacyTestRuntime,
+  mockLegacyCliConfig,
+  mockLegacyLinkedProjectCacheTracked,
+  mockLegacyPlatformApi,
+  mockLegacyTelemetryStateTracked,
+  useLegacyTempWorkdir,
+} from "../../../../../tests/helpers/legacy-mocks.ts";
+import { legacyBranchesList } from "./list.handler.ts";
+
+type Branches = typeof V1ListAllBranchesOutput.Type;
+
+const SAMPLE_BRANCH: Branches[number] = {
+  id: "11111111-2222-3333-4444-555555555555",
+  name: "feat-1",
+  project_ref: "aaaaaaaaaaaaaaaaaaaa",
+  parent_project_ref: "bbbbbbbbbbbbbbbbbbbb",
+  is_default: false,
+  git_branch: "feat-1",
+  persistent: false,
+  status: "MIGRATIONS_PASSED",
+  created_at: "2026-05-27T01:02:03Z",
+  updated_at: "2026-05-27T01:02:04Z",
+  with_data: true,
+};
+
+const SAMPLE_BRANCH_PIPE: Branches[number] = {
+  ...SAMPLE_BRANCH,
+  name: "with|pipe",
+  git_branch: "g|pipe",
+};
+
+const tempRoot = useLegacyTempWorkdir("supabase-branches-list-int-");
+
+interface SetupOpts {
+  readonly format?: "text" | "json" | "stream-json";
+  readonly goOutput?: "env" | "pretty" | "json" | "toml" | "yaml";
+  readonly response?: Branches;
+  readonly status?: number;
+  readonly network?: "fail";
+}
+
+function setup(opts: SetupOpts = {}) {
+  const out = mockOutput({ format: opts.format ?? "text" });
+  const api = mockLegacyPlatformApi({
+    response: { status: opts.status ?? 200, body: opts.response ?? [SAMPLE_BRANCH] },
+    network: opts.network,
+  });
+  const cliConfig = mockLegacyCliConfig({ workdir: tempRoot.current });
+  const layer = buildLegacyTestRuntime({
+    out,
+    api,
+    cliConfig,
+    goOutput: opts.goOutput === undefined ? Option.none() : Option.some(opts.goOutput),
+  });
+  return { layer, out, api };
+}
+
+function setupTracked(opts: SetupOpts = {}) {
+  const out = mockOutput({ format: opts.format ?? "text" });
+  const api = mockLegacyPlatformApi({
+    response: { status: opts.status ?? 200, body: opts.response ?? [SAMPLE_BRANCH] },
+    network: opts.network,
+  });
+  const cliConfig = mockLegacyCliConfig({ workdir: tempRoot.current });
+  const telemetry = mockLegacyTelemetryStateTracked();
+  const cache = mockLegacyLinkedProjectCacheTracked();
+  const layer = buildLegacyTestRuntime({
+    out,
+    api,
+    cliConfig,
+    telemetry: telemetry.layer,
+    linkedProjectCache: cache.layer,
+  });
+  return { layer, out, api, telemetry, cache };
+}
+
+describe("legacy branches list integration", () => {
+  it.live("renders a Glamour table with all 8 columns in text mode", () => {
+    const { layer, out } = setup({ response: [SAMPLE_BRANCH] });
+    return Effect.gen(function* () {
+      yield* legacyBranchesList({ projectRef: Option.none() });
+      expect(out.stdoutText).toContain("ID");
+      expect(out.stdoutText).toContain("NAME");
+      expect(out.stdoutText).toContain("DEFAULT");
+      expect(out.stdoutText).toContain("GIT BRANCH");
+      expect(out.stdoutText).toContain("WITH DATA");
+      expect(out.stdoutText).toContain("STATUS");
+      expect(out.stdoutText).toContain("CREATED AT (UTC)");
+      expect(out.stdoutText).toContain("UPDATED AT (UTC)");
+      expect(out.stdoutText).toContain("feat-1");
+      expect(out.stdoutText).toContain("2026-05-27 01:02:03");
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("renders literal `|` characters in branch fields (Go parity)", () => {
+    const { layer, out } = setup({ response: [SAMPLE_BRANCH_PIPE] });
+    return Effect.gen(function* () {
+      yield* legacyBranchesList({ projectRef: Option.none() });
+      expect(out.stdoutText).toContain("with|pipe");
+      expect(out.stdoutText).toContain("g|pipe");
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("renders an empty table when API returns []", () => {
+    const { layer, out } = setup({ response: [] });
+    return Effect.gen(function* () {
+      yield* legacyBranchesList({ projectRef: Option.none() });
+      expect(out.stdoutText).toContain("STATUS");
+      expect(out.stdoutText).not.toContain("feat-1");
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("emits a success event with { branches } for --output-format=json", () => {
+    const { layer, out } = setup({ format: "json", response: [SAMPLE_BRANCH] });
+    return Effect.gen(function* () {
+      yield* legacyBranchesList({ projectRef: Option.none() });
+      const success = out.messages.find((m) => m.type === "success");
+      expect(success).toBeDefined();
+      expect(success?.data).toMatchObject({ branches: [SAMPLE_BRANCH] });
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("emits a success event for --output-format=stream-json", () => {
+    const { layer, out } = setup({ format: "stream-json", response: [SAMPLE_BRANCH] });
+    return Effect.gen(function* () {
+      yield* legacyBranchesList({ projectRef: Option.none() });
+      expect(out.messages.find((m) => m.type === "success")).toBeDefined();
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("emits Go-byte-exact indented JSON for --output json", () => {
+    const { layer, out } = setup({ goOutput: "json", response: [SAMPLE_BRANCH] });
+    return Effect.gen(function* () {
+      yield* legacyBranchesList({ projectRef: Option.none() });
+      // Output is indented JSON with sorted keys + trailing newline.
+      expect(out.stdoutText.startsWith("[\n  {\n")).toBe(true);
+      expect(out.stdoutText.endsWith("]\n")).toBe(true);
+      // First key after sorting alphabetically is `created_at`.
+      expect(out.stdoutText).toContain('"created_at": "2026-05-27T01:02:03Z"');
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("emits a YAML array for --output yaml", () => {
+    const { layer, out } = setup({ goOutput: "yaml", response: [SAMPLE_BRANCH] });
+    return Effect.gen(function* () {
+      yield* legacyBranchesList({ projectRef: Option.none() });
+      expect(out.stdoutText).toContain("name: feat-1");
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("wraps result as { branches = [...] } for --output toml", () => {
+    const { layer, out } = setup({ goOutput: "toml", response: [SAMPLE_BRANCH] });
+    return Effect.gen(function* () {
+      yield* legacyBranchesList({ projectRef: Option.none() });
+      expect(out.stdoutText).toContain("[[branches]]");
+      expect(out.stdoutText).toContain('name = "feat-1"');
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("fails with LegacyBranchesEnvNotSupportedError for --output env", () => {
+    const { layer } = setup({ goOutput: "env", response: [SAMPLE_BRANCH] });
+    return Effect.gen(function* () {
+      const exit = yield* Effect.exit(legacyBranchesList({ projectRef: Option.none() }));
+      expect(Exit.isFailure(exit)).toBe(true);
+      if (Exit.isFailure(exit)) {
+        const json = JSON.stringify(exit.cause);
+        expect(json).toContain("LegacyBranchesEnvNotSupportedError");
+        expect(json).toContain("--output env flag is not supported");
+      }
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("treats --output pretty as identical to text mode (table render)", () => {
+    const { layer, out } = setup({ goOutput: "pretty", response: [SAMPLE_BRANCH] });
+    return Effect.gen(function* () {
+      yield* legacyBranchesList({ projectRef: Option.none() });
+      expect(out.stdoutText).toContain("STATUS");
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("--output flag wins over --output-format", () => {
+    const { layer, out } = setup({
+      format: "json",
+      goOutput: "yaml",
+      response: [SAMPLE_BRANCH],
+    });
+    return Effect.gen(function* () {
+      yield* legacyBranchesList({ projectRef: Option.none() });
+      expect(out.stdoutText).toContain("name: feat-1");
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("passes the resolved project ref to listAllBranches", () => {
+    const { layer, api } = setup({ response: [SAMPLE_BRANCH] });
+    return Effect.gen(function* () {
+      yield* legacyBranchesList({ projectRef: Option.none() });
+      expect(api.requests).toHaveLength(1);
+      expect(api.requests[0]?.url).toContain(`/v1/projects/${LEGACY_VALID_REF}/branches`);
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("fails with LegacyBranchesListUnexpectedStatusError on HTTP 503", () => {
+    const { layer } = setup({ status: 503, response: [] });
+    return Effect.gen(function* () {
+      const exit = yield* Effect.exit(legacyBranchesList({ projectRef: Option.none() }));
+      expect(Exit.isFailure(exit)).toBe(true);
+      if (Exit.isFailure(exit)) {
+        const json = JSON.stringify(exit.cause);
+        expect(json).toContain("LegacyBranchesListUnexpectedStatusError");
+        expect(json).toContain("unexpected list branch status 503");
+      }
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("fails with LegacyBranchesListNetworkError on transport failure", () => {
+    const { layer } = setup({ network: "fail" });
+    return Effect.gen(function* () {
+      const exit = yield* Effect.exit(legacyBranchesList({ projectRef: Option.none() }));
+      expect(Exit.isFailure(exit)).toBe(true);
+      if (Exit.isFailure(exit)) {
+        const json = JSON.stringify(exit.cause);
+        expect(json).toContain("LegacyBranchesListNetworkError");
+        expect(json).toContain("failed to list branch");
+      }
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("writes linked-project cache + telemetry state on success", () => {
+    const { layer, telemetry, cache } = setupTracked();
+    return Effect.gen(function* () {
+      yield* legacyBranchesList({ projectRef: Option.none() });
+      expect(telemetry.flushed).toBe(true);
+      expect(cache.cached).toBe(true);
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("writes linked-project cache + telemetry state on failure", () => {
+    const { layer, telemetry, cache } = setupTracked({ status: 503 });
+    return Effect.gen(function* () {
+      yield* Effect.exit(legacyBranchesList({ projectRef: Option.none() }));
+      expect(telemetry.flushed).toBe(true);
+      expect(cache.cached).toBe(true);
+    }).pipe(Effect.provide(layer));
+  });
+});
diff --git a/apps/cli/src/legacy/commands/branches/pause/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/branches/pause/SIDE_EFFECTS.md
index ca60a0e837..205f188186 100644
--- a/apps/cli/src/legacy/commands/branches/pause/SIDE_EFFECTS.md
+++ b/apps/cli/src/legacy/commands/branches/pause/SIDE_EFFECTS.md
@@ -2,55 +2,42 @@
 
 ## Files Read
 
-| Path                              | Format                    | When                                                       |
-| --------------------------------- | ------------------------- | ---------------------------------------------------------- |
-| `~/.supabase/access-token`        | plain text (token string) | when `SUPABASE_ACCESS_TOKEN` unset and keyring unavailable |
-| `<workdir>/.supabase/config.json` | JSON                      | always, to resolve linked project ref                      |
+Same auth and project-ref resolution chain as every Management-API legacy command.
 
 ## Files Written
 
-| Path | Format | When |
-| ---- | ------ | ---- |
-| —    | —      | —    |
+| Path                                             | Format | When                                                                     |
+| ------------------------------------------------ | ------ | ------------------------------------------------------------------------ |
+| `~/.supabase/<workdir-hash>/linked-project.json` | JSON   | always (in `Effect.ensuring`) after `--project-ref` resolves — Go parity |
+| `~/.supabase/telemetry.json`                     | JSON   | always (in `Effect.ensuring`) at end of command — Go parity              |
 
 ## API Routes
 
-| Method | Path                             | Auth         | Request body | Response (used fields) |
-| ------ | -------------------------------- | ------------ | ------------ | ---------------------- |
-| `POST` | `/v1/branches/{branch_id}/pause` | Bearer token | none         | none                   |
+| Method | Path                                 | Auth         | When                                                           | Response          |
+| ------ | ------------------------------------ | ------------ | -------------------------------------------------------------- | ----------------- |
+| `GET`  | `/v1/projects/{ref}/branches/{name}` | Bearer token | branch input is not a UUID and not a `^[a-z]{20}$` ref pattern | `{project_ref}`   |
+| `GET`  | `/v1/branches/{branch_id_or_ref}`    | Bearer token | branch input is a UUID                                         | `{ref}`           |
+| `POST` | `/v1/projects/{branch_ref}/pause`    | Bearer token | always — final pause action                                    | none (expect 200) |
 
 ## Environment Variables
 
-| Variable                | Purpose                                              | Required?                                               |
-| ----------------------- | ---------------------------------------------------- | ------------------------------------------------------- |
-| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `~/.supabase/access-token`) |
-| `SUPABASE_API_URL`      | override Management API base URL                     | no (defaults to `https://api.supabase.com`)             |
+`SUPABASE_ACCESS_TOKEN`, `SUPABASE_PROFILE`, `SUPABASE_PROJECT_ID`, `SUPABASE_WORKDIR` — same semantics as `branches list`.
 
 ## Exit Codes
 
-| Code | Condition                                                          |
-| ---- | ------------------------------------------------------------------ |
-| `0`  | success — branch paused                                            |
-| `1`  | authentication error — no valid token found                        |
-| `1`  | API error — non-2xx response from `/v1/branches/{branch_id}/pause` |
-| `1`  | network / connection failure                                       |
-| `1`  | branch not found                                                   |
+| Code | Condition                                                                         |
+| ---- | --------------------------------------------------------------------------------- |
+| `0`  | success — branch paused                                                           |
+| `1`  | `LegacyBranchesPauseUnexpectedStatusError` — non-200 response from pause endpoint |
+| `1`  | `LegacyBranchesPauseNetworkError` — transport-level network failure               |
+| `1`  | Branch-id resolution errors (find / config endpoints failed)                      |
 
-## Output
-
-### `--output-format text` (Go CLI compatible)
-
-No output on success (exit 0).
-
-### `--output-format json`
+## Telemetry Events Fired
 
-No structured output on success.
+| Event                  | When                                       | Notable properties                  |
+| ---------------------- | ------------------------------------------ | ----------------------------------- |
+| `cli_command_executed` | post-run, success or failure (via wrapper) | `exit_code`, `duration_ms`, `flags` |
 
-### `--output-format stream-json`
-
-No structured output on success.
-
-## Notes
+## Output
 
-- Accepts optional positional `[name]` argument (branch name or ID). If omitted in interactive mode, prompts the user to select a branch.
-- The Go CLI internally resolves a branch name to a project ref by calling `/v1/projects/{ref}/branches/{name}` first, then POSTs to `/v1/projects/{branch_project_ref}/pause`.
+Silent on success in every mode (Go parity — no stdout / stderr emission inside the handler). The prompt helper may write `Selected branch ID: <ref>` to stderr in text mode if the TTY picker was used.
diff --git a/apps/cli/src/legacy/commands/branches/pause/pause.command.ts b/apps/cli/src/legacy/commands/branches/pause/pause.command.ts
index 5845089a8a..c6622e6f61 100644
--- a/apps/cli/src/legacy/commands/branches/pause/pause.command.ts
+++ b/apps/cli/src/legacy/commands/branches/pause/pause.command.ts
@@ -1,5 +1,9 @@
 import { Argument, Command, Flag } from "effect/unstable/cli";
 import type * as CliCommand from "effect/unstable/cli/Command";
+
+import { withJsonErrorHandling } from "../../../../shared/output/json-error-handling.ts";
+import { legacyManagementApiRuntimeLayer } from "../../../shared/legacy-management-api-runtime.layer.ts";
+import { withLegacyCommandInstrumentation } from "../../../telemetry/legacy-command-instrumentation.ts";
 import { legacyBranchesPause } from "./pause.handler.ts";
 
 const config = {
@@ -18,5 +22,11 @@ export type LegacyBranchesPauseFlags = CliCommand.Command.Config.Infer<typeof co
 export const legacyBranchesPauseCommand = Command.make("pause", config).pipe(
   Command.withDescription("Pause a preview branch."),
   Command.withShortDescription("Pause a preview branch"),
-  Command.withHandler((flags) => legacyBranchesPause(flags)),
+  Command.withHandler((flags) =>
+    legacyBranchesPause(flags).pipe(
+      withLegacyCommandInstrumentation({ flags, safeFlags: ["project-ref"] }),
+      withJsonErrorHandling,
+    ),
+  ),
+  Command.provide(legacyManagementApiRuntimeLayer(["branches", "pause"])),
 );
diff --git a/apps/cli/src/legacy/commands/branches/pause/pause.handler.ts b/apps/cli/src/legacy/commands/branches/pause/pause.handler.ts
index 6b6d081ffc..c16baf66c2 100644
--- a/apps/cli/src/legacy/commands/branches/pause/pause.handler.ts
+++ b/apps/cli/src/legacy/commands/branches/pause/pause.handler.ts
@@ -1,13 +1,50 @@
-import { Effect, Option } from "effect";
-import { LegacyGoProxy } from "../../../../shared/legacy/go-proxy.service.ts";
+import { Effect } from "effect";
+
+import { LegacyPlatformApi } from "../../../auth/legacy-platform-api.service.ts";
+import { LegacyProjectRefResolver } from "../../../config/legacy-project-ref.service.ts";
+import { LegacyLinkedProjectCache } from "../../../telemetry/legacy-linked-project-cache.service.ts";
+import { LegacyTelemetryState } from "../../../telemetry/legacy-telemetry-state.service.ts";
+import { Output } from "../../../../shared/output/output.service.ts";
+import { Tty } from "../../../../shared/runtime/tty.service.ts";
+import { mapLegacyHttpError } from "../../../shared/legacy-http-errors.ts";
+import {
+  LegacyBranchesPauseNetworkError,
+  LegacyBranchesPauseUnexpectedStatusError,
+} from "../branches.errors.ts";
+import { legacyPromptBranchId } from "../branches.prompt.ts";
+import { legacyResolveBranchProjectRef } from "../branches.resolver.ts";
 import type { LegacyBranchesPauseFlags } from "./pause.command.ts";
 
+const mapPauseError = mapLegacyHttpError({
+  networkError: LegacyBranchesPauseNetworkError,
+  statusError: LegacyBranchesPauseUnexpectedStatusError,
+  networkMessage: (cause) => `failed to pause branch: ${cause}`,
+  statusMessage: (status, body) => `unexpected pause branch status ${status}: ${body}`,
+});
+
 export const legacyBranchesPause = Effect.fn("legacy.branches.pause")(function* (
   flags: LegacyBranchesPauseFlags,
 ) {
-  const proxy = yield* LegacyGoProxy;
-  const args: string[] = ["branches", "pause"];
-  if (Option.isSome(flags.name)) args.push(flags.name.value);
-  if (Option.isSome(flags.projectRef)) args.push("--project-ref", flags.projectRef.value);
-  yield* proxy.exec(args);
+  const output = yield* Output;
+  const api = yield* LegacyPlatformApi;
+  const resolver = yield* LegacyProjectRefResolver;
+  const linkedProjectCache = yield* LegacyLinkedProjectCache;
+  const telemetryState = yield* LegacyTelemetryState;
+  // Force `Tty` into the handler's R channel so `legacyPromptBranchId` (which
+  // requires it) resolves. The yielded value itself is unused.
+  void (yield* Tty);
+
+  const ref = yield* resolver.resolve(flags.projectRef);
+
+  yield* Effect.gen(function* () {
+    const branchInput = yield* legacyPromptBranchId(flags.name, ref);
+    const branchRef = yield* legacyResolveBranchProjectRef(branchInput, ref);
+
+    const pausing = output.format === "text" ? yield* output.task("Pausing branch...") : undefined;
+    yield* api.v1.pauseAProject({ ref: branchRef }).pipe(
+      Effect.tapError(() => pausing?.fail() ?? Effect.void),
+      Effect.catch(mapPauseError),
+    );
+    yield* pausing?.clear() ?? Effect.void;
+  }).pipe(Effect.ensuring(linkedProjectCache.cache(ref)), Effect.ensuring(telemetryState.flush));
 });
diff --git a/apps/cli/src/legacy/commands/branches/pause/pause.integration.test.ts b/apps/cli/src/legacy/commands/branches/pause/pause.integration.test.ts
new file mode 100644
index 0000000000..80996ef4d4
--- /dev/null
+++ b/apps/cli/src/legacy/commands/branches/pause/pause.integration.test.ts
@@ -0,0 +1,179 @@
+import { describe, expect, it } from "@effect/vitest";
+import { Effect, Exit, Option } from "effect";
+
+import { mockOutput } from "../../../../../tests/helpers/mocks.ts";
+import {
+  LEGACY_VALID_REF,
+  buildLegacyTestRuntime,
+  legacyJsonResponse,
+  mockLegacyCliConfig,
+  mockLegacyLinkedProjectCacheTracked,
+  mockLegacyPlatformApi,
+  mockLegacyTelemetryStateTracked,
+  useLegacyTempWorkdir,
+} from "../../../../../tests/helpers/legacy-mocks.ts";
+import type { LegacyBranchesPauseFlags } from "./pause.command.ts";
+import { legacyBranchesPause } from "./pause.handler.ts";
+
+// 20-lowercase project ref returned by the resolver and forwarded to the
+// pause endpoint. Pause/Restore endpoints accept plain project refs, no oneOf.
+const BRANCH_REF = "cccccccccccccccccccc";
+const BRANCH_UUID = "11111111-1111-4111-8111-111111111111";
+
+// Full V1GetABranchConfigOutput body for the resolver's UUID path.
+const BRANCH_CONFIG = {
+  ref: BRANCH_REF,
+  postgres_version: "15",
+  postgres_engine: "15",
+  release_channel: "ga",
+  status: "ACTIVE_HEALTHY",
+  db_host: "db.cccccccccccccccccccc.supabase.co",
+  db_port: 5432,
+};
+
+// Full V1GetABranchOutput body for the resolver's named-lookup path.
+const BRANCH_NAMED_LOOKUP = {
+  id: BRANCH_UUID,
+  name: "feat-x",
+  project_ref: BRANCH_REF,
+  parent_project_ref: LEGACY_VALID_REF,
+  is_default: false,
+  persistent: false,
+  status: "MIGRATIONS_PASSED",
+  created_at: "2026-05-27T01:02:03Z",
+  updated_at: "2026-05-27T01:02:04Z",
+  with_data: false,
+};
+
+const tempRoot = useLegacyTempWorkdir("supabase-branches-pause-int-");
+
+interface SetupOpts {
+  readonly pauseStatus?: number;
+}
+
+function buildApi(opts: SetupOpts) {
+  const pauseStatus = opts.pauseStatus ?? 200;
+  return mockLegacyPlatformApi({
+    handler: (request) =>
+      Effect.sync(() => {
+        if (request.method === "POST" && request.url.endsWith("/pause")) {
+          return legacyJsonResponse(request, pauseStatus, null);
+        }
+        // Resolver UUID path: GET /v1/branches/{uuid}
+        if (request.method === "GET" && request.url.includes("/v1/branches/")) {
+          return legacyJsonResponse(request, 200, BRANCH_CONFIG);
+        }
+        // Resolver named-lookup path: GET /v1/projects/{ref}/branches/{name}
+        if (
+          request.method === "GET" &&
+          request.url.includes(`/v1/projects/${LEGACY_VALID_REF}/branches/`)
+        ) {
+          return legacyJsonResponse(request, 200, BRANCH_NAMED_LOOKUP);
+        }
+        return legacyJsonResponse(request, 200, null);
+      }),
+  });
+}
+
+function setup(opts: SetupOpts = {}) {
+  const out = mockOutput({ format: "text" });
+  const api = buildApi(opts);
+  const cliConfig = mockLegacyCliConfig({ workdir: tempRoot.current });
+  const layer = buildLegacyTestRuntime({ out, api, cliConfig });
+  return { layer, out, api };
+}
+
+function setupTracked(opts: SetupOpts = {}) {
+  const out = mockOutput({ format: "text" });
+  const api = buildApi(opts);
+  const cliConfig = mockLegacyCliConfig({ workdir: tempRoot.current });
+  const telemetry = mockLegacyTelemetryStateTracked();
+  const cache = mockLegacyLinkedProjectCacheTracked();
+  const layer = buildLegacyTestRuntime({
+    out,
+    api,
+    cliConfig,
+    telemetry: telemetry.layer,
+    linkedProjectCache: cache.layer,
+  });
+  return { layer, out, api, telemetry, cache };
+}
+
+const baseFlags: LegacyBranchesPauseFlags = {
+  name: Option.none(),
+  projectRef: Option.none(),
+};
+
+describe("legacy branches pause integration", () => {
+  it.live("pauses a branch when given a project-ref pattern (skips lookup)", () => {
+    const { layer, api } = setup();
+    return Effect.gen(function* () {
+      yield* legacyBranchesPause({ ...baseFlags, name: Option.some(BRANCH_REF) });
+      const post = api.requests.find((r) => r.method === "POST");
+      expect(post?.url).toContain(`/v1/projects/${BRANCH_REF}/pause`);
+      // No resolver lookup
+      expect(api.requests.find((r) => r.method === "GET")).toBeUndefined();
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("resolves a UUID via V1GetABranchConfig and then pauses", () => {
+    const { layer, api } = setup();
+    return Effect.gen(function* () {
+      yield* legacyBranchesPause({ ...baseFlags, name: Option.some(BRANCH_UUID) });
+      expect(api.requests.some((r) => r.method === "GET" && r.url.includes("/v1/branches/"))).toBe(
+        true,
+      );
+      expect(api.requests.find((r) => r.method === "POST")?.url).toContain(
+        `/v1/projects/${BRANCH_REF}/pause`,
+      );
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("resolves a plain name via the project's branches endpoint", () => {
+    const { layer, api } = setup();
+    return Effect.gen(function* () {
+      yield* legacyBranchesPause({ ...baseFlags, name: Option.some("feat-x") });
+      expect(
+        api.requests.some((r) =>
+          r.url.includes(`/v1/projects/${LEGACY_VALID_REF}/branches/feat-x`),
+        ),
+      ).toBe(true);
+      expect(api.requests.find((r) => r.method === "POST")?.url).toContain(
+        `/v1/projects/${BRANCH_REF}/pause`,
+      );
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("does not emit anything on stdout/stderr on success (silent like Go)", () => {
+    const { layer, out } = setup();
+    return Effect.gen(function* () {
+      yield* legacyBranchesPause({ ...baseFlags, name: Option.some(BRANCH_REF) });
+      expect(out.stdoutText).toBe("");
+      expect(out.stderrText).toBe("");
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("fails with LegacyBranchesPauseUnexpectedStatusError on non-200", () => {
+    const { layer } = setup({ pauseStatus: 500 });
+    return Effect.gen(function* () {
+      const exit = yield* Effect.exit(
+        legacyBranchesPause({ ...baseFlags, name: Option.some(BRANCH_REF) }),
+      );
+      expect(Exit.isFailure(exit)).toBe(true);
+      if (Exit.isFailure(exit)) {
+        const json = JSON.stringify(exit.cause);
+        expect(json).toContain("LegacyBranchesPauseUnexpectedStatusError");
+        expect(json).toContain("unexpected pause branch status 500");
+      }
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("writes linked-project cache and telemetry state on success", () => {
+    const { layer, telemetry, cache } = setupTracked();
+    return Effect.gen(function* () {
+      yield* legacyBranchesPause({ ...baseFlags, name: Option.some(BRANCH_REF) });
+      expect(telemetry.flushed).toBe(true);
+      expect(cache.cached).toBe(true);
+    }).pipe(Effect.provide(layer));
+  });
+});
diff --git a/apps/cli/src/legacy/commands/branches/unpause/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/branches/unpause/SIDE_EFFECTS.md
index eae85c6a07..0fe42e2410 100644
--- a/apps/cli/src/legacy/commands/branches/unpause/SIDE_EFFECTS.md
+++ b/apps/cli/src/legacy/commands/branches/unpause/SIDE_EFFECTS.md
@@ -2,55 +2,42 @@
 
 ## Files Read
 
-| Path                              | Format                    | When                                                       |
-| --------------------------------- | ------------------------- | ---------------------------------------------------------- |
-| `~/.supabase/access-token`        | plain text (token string) | when `SUPABASE_ACCESS_TOKEN` unset and keyring unavailable |
-| `<workdir>/.supabase/config.json` | JSON                      | always, to resolve linked project ref                      |
+Same auth and project-ref resolution chain as every Management-API legacy command.
 
 ## Files Written
 
-| Path | Format | When |
-| ---- | ------ | ---- |
-| —    | —      | —    |
+| Path                                             | Format | When                                                                     |
+| ------------------------------------------------ | ------ | ------------------------------------------------------------------------ |
+| `~/.supabase/<workdir-hash>/linked-project.json` | JSON   | always (in `Effect.ensuring`) after `--project-ref` resolves — Go parity |
+| `~/.supabase/telemetry.json`                     | JSON   | always (in `Effect.ensuring`) at end of command — Go parity              |
 
 ## API Routes
 
-| Method | Path                               | Auth         | Request body | Response (used fields) |
-| ------ | ---------------------------------- | ------------ | ------------ | ---------------------- |
-| `POST` | `/v1/branches/{branch_id}/unpause` | Bearer token | none         | none                   |
+| Method | Path                                 | Auth         | When                                                           | Response          |
+| ------ | ------------------------------------ | ------------ | -------------------------------------------------------------- | ----------------- |
+| `GET`  | `/v1/projects/{ref}/branches/{name}` | Bearer token | branch input is not a UUID and not a `^[a-z]{20}$` ref pattern | `{project_ref}`   |
+| `GET`  | `/v1/branches/{branch_id_or_ref}`    | Bearer token | branch input is a UUID                                         | `{ref}`           |
+| `POST` | `/v1/projects/{branch_ref}/restore`  | Bearer token | always — final unpause action                                  | none (expect 200) |
 
 ## Environment Variables
 
-| Variable                | Purpose                                              | Required?                                               |
-| ----------------------- | ---------------------------------------------------- | ------------------------------------------------------- |
-| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `~/.supabase/access-token`) |
-| `SUPABASE_API_URL`      | override Management API base URL                     | no (defaults to `https://api.supabase.com`)             |
+`SUPABASE_ACCESS_TOKEN`, `SUPABASE_PROFILE`, `SUPABASE_PROJECT_ID`, `SUPABASE_WORKDIR` — same semantics as `branches list`.
 
 ## Exit Codes
 
-| Code | Condition                                                            |
-| ---- | -------------------------------------------------------------------- |
-| `0`  | success — branch unpaused                                            |
-| `1`  | authentication error — no valid token found                          |
-| `1`  | API error — non-2xx response from `/v1/branches/{branch_id}/unpause` |
-| `1`  | network / connection failure                                         |
-| `1`  | branch not found                                                     |
+| Code | Condition                                                                             |
+| ---- | ------------------------------------------------------------------------------------- |
+| `0`  | success — branch unpaused                                                             |
+| `1`  | `LegacyBranchesUnpauseUnexpectedStatusError` — non-200 response from restore endpoint |
+| `1`  | `LegacyBranchesUnpauseNetworkError` — transport-level network failure                 |
+| `1`  | Branch-id resolution errors                                                           |
 
-## Output
-
-### `--output-format text` (Go CLI compatible)
-
-No output on success (exit 0).
-
-### `--output-format json`
+## Telemetry Events Fired
 
-No structured output on success.
+| Event                  | When                                       | Notable properties                  |
+| ---------------------- | ------------------------------------------ | ----------------------------------- |
+| `cli_command_executed` | post-run, success or failure (via wrapper) | `exit_code`, `duration_ms`, `flags` |
 
-### `--output-format stream-json`
-
-No structured output on success.
-
-## Notes
+## Output
 
-- Accepts optional positional `[name]` argument (branch name or ID). If omitted in interactive mode, prompts the user to select a branch.
-- The Go CLI internally resolves a branch name to a project ref by calling `/v1/projects/{ref}/branches/{name}` first, then POSTs to `/v1/projects/{branch_project_ref}/restore`.
+Silent on success in every mode (Go parity).
diff --git a/apps/cli/src/legacy/commands/branches/unpause/unpause.command.ts b/apps/cli/src/legacy/commands/branches/unpause/unpause.command.ts
index 2d2d351622..5e19914ceb 100644
--- a/apps/cli/src/legacy/commands/branches/unpause/unpause.command.ts
+++ b/apps/cli/src/legacy/commands/branches/unpause/unpause.command.ts
@@ -1,5 +1,9 @@
 import { Argument, Command, Flag } from "effect/unstable/cli";
 import type * as CliCommand from "effect/unstable/cli/Command";
+
+import { withJsonErrorHandling } from "../../../../shared/output/json-error-handling.ts";
+import { legacyManagementApiRuntimeLayer } from "../../../shared/legacy-management-api-runtime.layer.ts";
+import { withLegacyCommandInstrumentation } from "../../../telemetry/legacy-command-instrumentation.ts";
 import { legacyBranchesUnpause } from "./unpause.handler.ts";
 
 const config = {
@@ -18,5 +22,11 @@ export type LegacyBranchesUnpauseFlags = CliCommand.Command.Config.Infer<typeof
 export const legacyBranchesUnpauseCommand = Command.make("unpause", config).pipe(
   Command.withDescription("Unpause a preview branch."),
   Command.withShortDescription("Unpause a preview branch"),
-  Command.withHandler((flags) => legacyBranchesUnpause(flags)),
+  Command.withHandler((flags) =>
+    legacyBranchesUnpause(flags).pipe(
+      withLegacyCommandInstrumentation({ flags, safeFlags: ["project-ref"] }),
+      withJsonErrorHandling,
+    ),
+  ),
+  Command.provide(legacyManagementApiRuntimeLayer(["branches", "unpause"])),
 );
diff --git a/apps/cli/src/legacy/commands/branches/unpause/unpause.handler.ts b/apps/cli/src/legacy/commands/branches/unpause/unpause.handler.ts
index f7b102e29b..d9f0288e9b 100644
--- a/apps/cli/src/legacy/commands/branches/unpause/unpause.handler.ts
+++ b/apps/cli/src/legacy/commands/branches/unpause/unpause.handler.ts
@@ -1,13 +1,51 @@
-import { Effect, Option } from "effect";
-import { LegacyGoProxy } from "../../../../shared/legacy/go-proxy.service.ts";
+import { Effect } from "effect";
+
+import { LegacyPlatformApi } from "../../../auth/legacy-platform-api.service.ts";
+import { LegacyProjectRefResolver } from "../../../config/legacy-project-ref.service.ts";
+import { LegacyLinkedProjectCache } from "../../../telemetry/legacy-linked-project-cache.service.ts";
+import { LegacyTelemetryState } from "../../../telemetry/legacy-telemetry-state.service.ts";
+import { Output } from "../../../../shared/output/output.service.ts";
+import { Tty } from "../../../../shared/runtime/tty.service.ts";
+import { mapLegacyHttpError } from "../../../shared/legacy-http-errors.ts";
+import {
+  LegacyBranchesUnpauseNetworkError,
+  LegacyBranchesUnpauseUnexpectedStatusError,
+} from "../branches.errors.ts";
+import { legacyPromptBranchId } from "../branches.prompt.ts";
+import { legacyResolveBranchProjectRef } from "../branches.resolver.ts";
 import type { LegacyBranchesUnpauseFlags } from "./unpause.command.ts";
 
+const mapUnpauseError = mapLegacyHttpError({
+  networkError: LegacyBranchesUnpauseNetworkError,
+  statusError: LegacyBranchesUnpauseUnexpectedStatusError,
+  networkMessage: (cause) => `failed to unpause branch: ${cause}`,
+  statusMessage: (status, body) => `unexpected unpause branch status ${status}: ${body}`,
+});
+
 export const legacyBranchesUnpause = Effect.fn("legacy.branches.unpause")(function* (
   flags: LegacyBranchesUnpauseFlags,
 ) {
-  const proxy = yield* LegacyGoProxy;
-  const args: string[] = ["branches", "unpause"];
-  if (Option.isSome(flags.name)) args.push(flags.name.value);
-  if (Option.isSome(flags.projectRef)) args.push("--project-ref", flags.projectRef.value);
-  yield* proxy.exec(args);
+  const output = yield* Output;
+  const api = yield* LegacyPlatformApi;
+  const resolver = yield* LegacyProjectRefResolver;
+  const linkedProjectCache = yield* LegacyLinkedProjectCache;
+  const telemetryState = yield* LegacyTelemetryState;
+  // Force `Tty` into the handler's R channel so `legacyPromptBranchId` (which
+  // requires it) resolves. The yielded value itself is unused.
+  void (yield* Tty);
+
+  const ref = yield* resolver.resolve(flags.projectRef);
+
+  yield* Effect.gen(function* () {
+    const branchInput = yield* legacyPromptBranchId(flags.name, ref);
+    const branchRef = yield* legacyResolveBranchProjectRef(branchInput, ref);
+
+    const restoring =
+      output.format === "text" ? yield* output.task("Unpausing branch...") : undefined;
+    yield* api.v1.restoreAProject({ ref: branchRef }).pipe(
+      Effect.tapError(() => restoring?.fail() ?? Effect.void),
+      Effect.catch(mapUnpauseError),
+    );
+    yield* restoring?.clear() ?? Effect.void;
+  }).pipe(Effect.ensuring(linkedProjectCache.cache(ref)), Effect.ensuring(telemetryState.flush));
 });
diff --git a/apps/cli/src/legacy/commands/branches/unpause/unpause.integration.test.ts b/apps/cli/src/legacy/commands/branches/unpause/unpause.integration.test.ts
new file mode 100644
index 0000000000..1256cca8d9
--- /dev/null
+++ b/apps/cli/src/legacy/commands/branches/unpause/unpause.integration.test.ts
@@ -0,0 +1,80 @@
+import { describe, expect, it } from "@effect/vitest";
+import { Effect, Exit, Option } from "effect";
+
+import { mockOutput } from "../../../../../tests/helpers/mocks.ts";
+import {
+  buildLegacyTestRuntime,
+  legacyJsonResponse,
+  mockLegacyCliConfig,
+  mockLegacyPlatformApi,
+  useLegacyTempWorkdir,
+} from "../../../../../tests/helpers/legacy-mocks.ts";
+import type { LegacyBranchesUnpauseFlags } from "./unpause.command.ts";
+import { legacyBranchesUnpause } from "./unpause.handler.ts";
+
+// 20-lowercase ref (matches V1RestoreAProjectInput.ref plain pattern).
+const BRANCH_REF = "cccccccccccccccccccc";
+
+const tempRoot = useLegacyTempWorkdir("supabase-branches-unpause-int-");
+
+interface SetupOpts {
+  readonly restoreStatus?: number;
+}
+
+function setup(opts: SetupOpts = {}) {
+  const restoreStatus = opts.restoreStatus ?? 200;
+  const out = mockOutput({ format: "text" });
+  const api = mockLegacyPlatformApi({
+    handler: (request) =>
+      Effect.sync(() => {
+        if (request.method === "POST" && request.url.endsWith("/restore")) {
+          return legacyJsonResponse(request, restoreStatus, null);
+        }
+        return legacyJsonResponse(request, 200, null);
+      }),
+  });
+  const cliConfig = mockLegacyCliConfig({ workdir: tempRoot.current });
+  const layer = buildLegacyTestRuntime({ out, api, cliConfig });
+  return { layer, out, api };
+}
+
+const baseFlags: LegacyBranchesUnpauseFlags = {
+  name: Option.none(),
+  projectRef: Option.none(),
+};
+
+describe("legacy branches unpause integration", () => {
+  it.live("unpauses a branch given a project-ref pattern", () => {
+    const { layer, api } = setup();
+    return Effect.gen(function* () {
+      yield* legacyBranchesUnpause({ ...baseFlags, name: Option.some(BRANCH_REF) });
+      expect(api.requests.find((r) => r.method === "POST")?.url).toContain(
+        `/v1/projects/${BRANCH_REF}/restore`,
+      );
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("is silent on stdout/stderr on success", () => {
+    const { layer, out } = setup();
+    return Effect.gen(function* () {
+      yield* legacyBranchesUnpause({ ...baseFlags, name: Option.some(BRANCH_REF) });
+      expect(out.stdoutText).toBe("");
+      expect(out.stderrText).toBe("");
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("fails with LegacyBranchesUnpauseUnexpectedStatusError on non-200", () => {
+    const { layer } = setup({ restoreStatus: 500 });
+    return Effect.gen(function* () {
+      const exit = yield* Effect.exit(
+        legacyBranchesUnpause({ ...baseFlags, name: Option.some(BRANCH_REF) }),
+      );
+      expect(Exit.isFailure(exit)).toBe(true);
+      if (Exit.isFailure(exit)) {
+        const json = JSON.stringify(exit.cause);
+        expect(json).toContain("LegacyBranchesUnpauseUnexpectedStatusError");
+        expect(json).toContain("unexpected unpause branch status 500");
+      }
+    }).pipe(Effect.provide(layer));
+  });
+});
diff --git a/apps/cli/src/legacy/commands/branches/update/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/branches/update/SIDE_EFFECTS.md
index 73dd3adcb6..09bab3fd8f 100644
--- a/apps/cli/src/legacy/commands/branches/update/SIDE_EFFECTS.md
+++ b/apps/cli/src/legacy/commands/branches/update/SIDE_EFFECTS.md
@@ -2,59 +2,53 @@
 
 ## Files Read
 
-| Path                              | Format                    | When                                                       |
-| --------------------------------- | ------------------------- | ---------------------------------------------------------- |
-| `~/.supabase/access-token`        | plain text (token string) | when `SUPABASE_ACCESS_TOKEN` unset and keyring unavailable |
-| `<workdir>/.supabase/config.json` | JSON                      | always, to resolve linked project ref                      |
+Same auth and project-ref resolution chain as every Management-API legacy command.
 
 ## Files Written
 
-| Path | Format | When |
-| ---- | ------ | ---- |
-| —    | —      | —    |
+| Path                                             | Format | When                                                                     |
+| ------------------------------------------------ | ------ | ------------------------------------------------------------------------ |
+| `~/.supabase/<workdir-hash>/linked-project.json` | JSON   | always (in `Effect.ensuring`) after `--project-ref` resolves — Go parity |
+| `~/.supabase/telemetry.json`                     | JSON   | always (in `Effect.ensuring`) at end of command — Go parity              |
 
 ## API Routes
 
-| Method  | Path                       | Auth         | Request body                                                     | Response (used fields)                 |
-| ------- | -------------------------- | ------------ | ---------------------------------------------------------------- | -------------------------------------- |
-| `PATCH` | `/v1/branches/{branch_id}` | Bearer token | `{branch_name?, git_branch?, persistent?, status?, notify_url?}` | `{id, name, status, project_ref, ...}` |
+| Method  | Path                                            | Auth         | When                                                           | Request body                                                                              | Response                             |
+| ------- | ----------------------------------------------- | ------------ | -------------------------------------------------------------- | ----------------------------------------------------------------------------------------- | ------------------------------------ |
+| `GET`   | `/v1/projects/{ref}/branches/{name}`            | Bearer token | branch input is not a UUID and not a `^[a-z]{20}$` ref pattern | none                                                                                      | `{project_ref}`                      |
+| `GET`   | `/v1/branches/{branch_id_or_ref}`               | Bearer token | branch input is a UUID                                         | none                                                                                      | `{ref}`                              |
+| `PATCH` | `/v1/branches/{branch_id_or_ref}`               | Bearer token | always                                                         | `{branch_name?, git_branch?, persistent?, status?, notify_url?}` (only set flags emitted) | full `BranchResponse`                |
+| `GET`   | `/v1/projects/{ref}` (on 4xx gated)             | Bearer token | upgrade-suggest path                                           | none                                                                                      | `{organization_slug}`                |
+| `GET`   | `/v1/organizations/{slug}/entitlements` (gated) | Bearer token | upgrade-suggest path                                           | none                                                                                      | `[{feature: {key}, hasAccess, ...}]` |
 
 ## Environment Variables
 
-| Variable                | Purpose                                              | Required?                                               |
-| ----------------------- | ---------------------------------------------------- | ------------------------------------------------------- |
-| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `~/.supabase/access-token`) |
-| `SUPABASE_API_URL`      | override Management API base URL                     | no (defaults to `https://api.supabase.com`)             |
+`SUPABASE_ACCESS_TOKEN`, `SUPABASE_PROFILE`, `SUPABASE_PROJECT_ID`, `SUPABASE_WORKDIR` — same semantics as `branches list`.
 
 ## Exit Codes
 
-| Code | Condition                                                    |
-| ---- | ------------------------------------------------------------ |
-| `0`  | success — branch updated and details printed to stdout       |
-| `1`  | authentication error — no valid token found                  |
-| `1`  | API error — non-2xx response from `/v1/branches/{branch_id}` |
-| `1`  | network / connection failure                                 |
-| `1`  | branch not found                                             |
+| Code | Condition                                                                               |
+| ---- | --------------------------------------------------------------------------------------- |
+| `0`  | success — branch updated                                                                |
+| `1`  | `LegacyBranchesUpdateUnexpectedStatusError` — non-200 response from the update endpoint |
+| `1`  | `LegacyBranchesUpdateNetworkError` — transport-level network failure                    |
+| `1`  | Branch-id resolution errors (find / config endpoints failed)                            |
 
-## Output
-
-### `--output-format text` (Go CLI compatible)
+## Telemetry Events Fired
 
-Prints a table with columns: `ID`, `NAME`, `DEFAULT`, `GIT BRANCH`, `WITH DATA`, `STATUS`, `CREATED AT (UTC)`, `UPDATED AT (UTC)`.
+| Event                   | When                                                 | Notable properties                                |
+| ----------------------- | ---------------------------------------------------- | ------------------------------------------------- |
+| `cli_command_executed`  | post-run, success or failure (via wrapper)           | `exit_code`, `duration_ms`, `flags`               |
+| `cli_upgrade_suggested` | on 4xx with `branching_persistent` entitlement gated | `{feature_key: "branching_persistent", org_slug}` |
 
-### `--output-format json`
-
-Single JSON object emitted to stdout on success containing the updated branch response.
+## Output
 
-### `--output-format stream-json`
+Honors both `--output {pretty,json,yaml,toml,env}` (Go) and `--output-format {text,json,stream-json}` (TS).
 
-One `result` event on success.
+In **text mode**, the header `Updated preview branch:` writes to **stderr** (Go `fmt.Fprintln(os.Stderr, …)`) followed by the single-row Glamour list-table on stdout.
 
-```ndjson
-{"type":"result","data":{...}}
-```
+In Go encoder modes, the header goes to stderr followed by the encoded payload on stdout. In `--output-format json` / `stream-json`, a `success` event carries the payload.
 
 ## Notes
 
-- Flags: `[name]` (positional branch name or ID), `--name`, `--git-branch`, `--persistent`, `--status`, `--notify-url`, `--project-ref`.
-- If the positional argument is not provided in interactive mode, the user is prompted to select a branch.
+The upgrade-suggest call uses the parent project ref (resolved from `--project-ref`) rather than the branch's project ref. Both refs belong to the same organization, so the entitlement check returns the same `org_slug` either way; this also sidesteps a known API schema constraint where `getProject` strictly requires a `^[a-z]{20}$` ref.
diff --git a/apps/cli/src/legacy/commands/branches/update/update.command.ts b/apps/cli/src/legacy/commands/branches/update/update.command.ts
index b717a49cf1..205f2cdb28 100644
--- a/apps/cli/src/legacy/commands/branches/update/update.command.ts
+++ b/apps/cli/src/legacy/commands/branches/update/update.command.ts
@@ -1,4 +1,9 @@
 import { Argument, Command, Flag } from "effect/unstable/cli";
+import type * as CliCommand from "effect/unstable/cli/Command";
+
+import { withJsonErrorHandling } from "../../../../shared/output/json-error-handling.ts";
+import { legacyManagementApiRuntimeLayer } from "../../../shared/legacy-management-api-runtime.layer.ts";
+import { withLegacyCommandInstrumentation } from "../../../telemetry/legacy-command-instrumentation.ts";
 import { legacyBranchesUpdate } from "./update.handler.ts";
 
 const BRANCH_STATUSES = [
@@ -10,7 +15,7 @@ const BRANCH_STATUSES = [
 ] as const;
 
 const config = {
-  branchId: Argument.string("branch-id").pipe(
+  branchId: Argument.string("name").pipe(
     Argument.withDescription("Branch name or ID to update."),
     Argument.optional,
   ),
@@ -23,8 +28,12 @@ const config = {
     Flag.withDescription("Change the associated git branch."),
     Flag.optional,
   ),
+  // Optional so the handler can distinguish "explicit false" (demote to
+  // ephemeral) from "absent". Mirrors Go's `cmdFlags.Changed("persistent")`
+  // in `apps/cli-go/cmd/branches.go:123`.
   persistent: Flag.boolean("persistent").pipe(
     Flag.withDescription("Switch between ephemeral and persistent branch."),
+    Flag.optional,
   ),
   status: Flag.choice("status", BRANCH_STATUSES).pipe(
     Flag.withDescription("Override the current branch status."),
@@ -36,8 +45,16 @@ const config = {
   ),
 } as const;
 
+export type LegacyBranchesUpdateFlags = CliCommand.Command.Config.Infer<typeof config>;
+
 export const legacyBranchesUpdateCommand = Command.make("update", config).pipe(
   Command.withDescription("Update a preview branch by its name or ID."),
   Command.withShortDescription("Update a preview branch"),
-  Command.withHandler((flags) => legacyBranchesUpdate(flags)),
+  Command.withHandler((flags) =>
+    legacyBranchesUpdate(flags).pipe(
+      withLegacyCommandInstrumentation({ flags, safeFlags: ["project-ref"] }),
+      withJsonErrorHandling,
+    ),
+  ),
+  Command.provide(legacyManagementApiRuntimeLayer(["branches", "update"])),
 );
diff --git a/apps/cli/src/legacy/commands/branches/update/update.handler.ts b/apps/cli/src/legacy/commands/branches/update/update.handler.ts
index 4e252eef08..5dc3085c74 100644
--- a/apps/cli/src/legacy/commands/branches/update/update.handler.ts
+++ b/apps/cli/src/legacy/commands/branches/update/update.handler.ts
@@ -1,34 +1,125 @@
+import type { V1UpdateABranchConfigInput, V1UpdateABranchConfigOutput } from "@supabase/api/effect";
 import { Effect, Option } from "effect";
-import { LegacyGoProxy } from "../../../../shared/legacy/go-proxy.service.ts";
-
-type BranchStatus =
-  | "RUNNING_MIGRATIONS"
-  | "MIGRATIONS_PASSED"
-  | "MIGRATIONS_FAILED"
-  | "FUNCTIONS_DEPLOYED"
-  | "FUNCTIONS_FAILED";
-
-interface LegacyBranchesUpdateFlags {
-  readonly branchId: Option.Option<string>;
-  readonly projectRef: Option.Option<string>;
-  readonly name: Option.Option<string>;
-  readonly gitBranch: Option.Option<string>;
-  readonly persistent: boolean;
-  readonly status: Option.Option<BranchStatus>;
-  readonly notifyUrl: Option.Option<string>;
-}
+import * as HttpClientError from "effect/unstable/http/HttpClientError";
+
+import { LegacyPlatformApi } from "../../../auth/legacy-platform-api.service.ts";
+import { LegacyProjectRefResolver } from "../../../config/legacy-project-ref.service.ts";
+import { LegacyLinkedProjectCache } from "../../../telemetry/legacy-linked-project-cache.service.ts";
+import { LegacyTelemetryState } from "../../../telemetry/legacy-telemetry-state.service.ts";
+import { LegacyOutputFlag } from "../../../../shared/legacy/global-flags.ts";
+import { Output } from "../../../../shared/output/output.service.ts";
+import { Tty } from "../../../../shared/runtime/tty.service.ts";
+import {
+  encodeEnv,
+  encodeGoJson,
+  encodeToml,
+  encodeYaml,
+} from "../../../shared/legacy-go-output.encoders.ts";
+import { mapLegacyHttpError } from "../../../shared/legacy-http-errors.ts";
+import { legacySuggestUpgrade } from "../../../shared/legacy-upgrade-suggest.ts";
+import {
+  LegacyBranchesUpdateNetworkError,
+  LegacyBranchesUpdateUnexpectedStatusError,
+} from "../branches.errors.ts";
+import { renderBranchesListTable } from "../branches.format.ts";
+import { legacyPromptBranchId } from "../branches.prompt.ts";
+import { legacyResolveBranchProjectRef } from "../branches.resolver.ts";
+import type { LegacyBranchesUpdateFlags } from "./update.command.ts";
+
+type UpdatedBranch = typeof V1UpdateABranchConfigOutput.Type;
+type UpdateInput = typeof V1UpdateABranchConfigInput.Type;
+type BranchStatus = NonNullable<UpdateInput["status"]>;
+
+const mapUpdateError = mapLegacyHttpError({
+  networkError: LegacyBranchesUpdateNetworkError,
+  statusError: LegacyBranchesUpdateUnexpectedStatusError,
+  networkMessage: (cause) => `failed to update preview branch: ${cause}`,
+  statusMessage: (status, body) => `unexpected update branch status ${status}: ${body}`,
+});
 
 export const legacyBranchesUpdate = Effect.fn("legacy.branches.update")(function* (
   flags: LegacyBranchesUpdateFlags,
 ) {
-  const proxy = yield* LegacyGoProxy;
-  const args: string[] = ["branches", "update"];
-  if (Option.isSome(flags.branchId)) args.push(flags.branchId.value);
-  if (Option.isSome(flags.projectRef)) args.push("--project-ref", flags.projectRef.value);
-  if (Option.isSome(flags.name)) args.push("--name", flags.name.value);
-  if (Option.isSome(flags.gitBranch)) args.push("--git-branch", flags.gitBranch.value);
-  if (flags.persistent) args.push("--persistent");
-  if (Option.isSome(flags.status)) args.push("--status", flags.status.value);
-  if (Option.isSome(flags.notifyUrl)) args.push("--notify-url", flags.notifyUrl.value);
-  yield* proxy.exec(args);
+  const output = yield* Output;
+  const goOutputFlag = yield* LegacyOutputFlag;
+  const api = yield* LegacyPlatformApi;
+  const resolver = yield* LegacyProjectRefResolver;
+  const linkedProjectCache = yield* LegacyLinkedProjectCache;
+  const telemetryState = yield* LegacyTelemetryState;
+  // Force `Tty` into the handler's R channel so `legacyPromptBranchId` (which
+  // requires it) resolves. The yielded value itself is unused.
+  void (yield* Tty);
+
+  const ref = yield* resolver.resolve(flags.projectRef);
+
+  yield* Effect.gen(function* () {
+    const branchInput = yield* legacyPromptBranchId(flags.branchId, ref);
+    const branchRef = yield* legacyResolveBranchProjectRef(branchInput, ref);
+
+    const patching =
+      output.format === "text" ? yield* output.task("Updating branch...") : undefined;
+
+    const updated: UpdatedBranch = yield* api.v1
+      .updateABranchConfig({
+        branch_id_or_ref: branchRef,
+        ...(Option.isSome(flags.name) ? { branch_name: flags.name.value } : {}),
+        ...(Option.isSome(flags.gitBranch) ? { git_branch: flags.gitBranch.value } : {}),
+        ...(Option.isSome(flags.persistent) ? { persistent: flags.persistent.value } : {}),
+        ...(Option.isSome(flags.status) ? { status: flags.status.value as BranchStatus } : {}),
+        ...(Option.isSome(flags.notifyUrl) ? { notify_url: flags.notifyUrl.value } : {}),
+      })
+      .pipe(
+        Effect.tapError(() => patching?.fail() ?? Effect.void),
+        Effect.catch((cause) =>
+          Effect.gen(function* () {
+            const status =
+              HttpClientError.isHttpClientError(cause) && cause.response !== undefined
+                ? cause.response.status
+                : 0;
+            // Mirrors Go's `update.go:26` — pass the resolved branch's project
+            // ref so the entitlements check is scoped to the branch's org.
+            yield* legacySuggestUpgrade({
+              projectRef: branchRef,
+              featureKey: "branching_persistent",
+              statusCode: status,
+            });
+            return yield* mapUpdateError(cause);
+          }),
+        ),
+      );
+    yield* patching?.clear() ?? Effect.void;
+
+    const goFmt = Option.getOrUndefined(goOutputFlag);
+
+    // Go writes "Updated preview branch:" to STDERR (`fmt.Fprintln(os.Stderr, ...)`),
+    // then the payload to stdout via EncodeOutput / RenderTable.
+    if (goFmt === "json") {
+      yield* output.raw("Updated preview branch:\n", "stderr");
+      yield* output.raw(encodeGoJson(updated));
+      return;
+    }
+    if (goFmt === "yaml") {
+      yield* output.raw("Updated preview branch:\n", "stderr");
+      yield* output.raw(encodeYaml(updated));
+      return;
+    }
+    if (goFmt === "toml") {
+      yield* output.raw("Updated preview branch:\n", "stderr");
+      yield* output.raw(encodeToml(updated) + "\n");
+      return;
+    }
+    if (goFmt === "env") {
+      yield* output.raw("Updated preview branch:\n", "stderr");
+      yield* output.raw(encodeEnv(updated) + "\n");
+      return;
+    }
+
+    if (output.format === "json" || output.format === "stream-json") {
+      yield* output.success("Updated preview branch", { ...updated });
+      return;
+    }
+
+    yield* output.raw("Updated preview branch:\n", "stderr");
+    yield* output.raw(renderBranchesListTable([updated]));
+  }).pipe(Effect.ensuring(linkedProjectCache.cache(ref)), Effect.ensuring(telemetryState.flush));
 });
diff --git a/apps/cli/src/legacy/commands/branches/update/update.integration.test.ts b/apps/cli/src/legacy/commands/branches/update/update.integration.test.ts
new file mode 100644
index 0000000000..8afab7f721
--- /dev/null
+++ b/apps/cli/src/legacy/commands/branches/update/update.integration.test.ts
@@ -0,0 +1,343 @@
+import { type V1UpdateABranchConfigOutput } from "@supabase/api/effect";
+import { describe, expect, it } from "@effect/vitest";
+import { Effect, Exit, Option } from "effect";
+
+import { mockAnalytics, mockOutput } from "../../../../../tests/helpers/mocks.ts";
+import {
+  buildLegacyTestRuntime,
+  legacyJsonResponse,
+  mockLegacyCliConfig,
+  mockLegacyLinkedProjectCacheTracked,
+  mockLegacyPlatformApi,
+  mockLegacyTelemetryStateTracked,
+  useLegacyTempWorkdir,
+} from "../../../../../tests/helpers/legacy-mocks.ts";
+import type { LegacyBranchesUpdateFlags } from "./update.command.ts";
+import { legacyBranchesUpdate } from "./update.handler.ts";
+
+type UpdatedBranch = typeof V1UpdateABranchConfigOutput.Type;
+
+// V1UpdateABranchConfigInput.branch_id_or_ref is a oneOf [project-ref, uuid] union.
+// A 20-lowercase project ref matches BOTH branches → schema rejects.
+// HTTP-level mock tests pass a v4 UUID so the schema picks exactly one branch.
+// HTTP-level mock tests pass a v4 UUID so the schema picks exactly one branch.
+const BRANCH_UUID = "11111111-1111-4111-8111-111111111111";
+const BRANCH_REF = "cccccccccccccccccccc";
+
+const UPDATED: UpdatedBranch = {
+  id: BRANCH_UUID,
+  name: "renamed",
+  project_ref: BRANCH_REF,
+  parent_project_ref: "bbbbbbbbbbbbbbbbbbbb",
+  is_default: false,
+  persistent: true,
+  status: "MIGRATIONS_PASSED",
+  created_at: "2026-05-27T01:02:03Z",
+  updated_at: "2026-05-27T01:02:04Z",
+  with_data: false,
+};
+
+const ORG_SLUG = "test-org";
+
+function projectResponse(ref: string = BRANCH_REF) {
+  return {
+    id: ref,
+    ref,
+    organization_id: "org",
+    organization_slug: ORG_SLUG,
+    name: "Test",
+    region: "us-east-1",
+    created_at: "2026-01-01T00:00:00Z",
+    status: "ACTIVE_HEALTHY" as const,
+    database: { host: "h", version: "15", postgres_engine: "15", release_channel: "ga" },
+  };
+}
+
+function entitlementResponse(opts: { readonly featureKey: string; readonly hasAccess: boolean }) {
+  return {
+    entitlements: [
+      {
+        feature: { key: opts.featureKey, type: "boolean" as const },
+        hasAccess: opts.hasAccess,
+        type: "boolean" as const,
+        config: { enabled: !opts.hasAccess },
+      },
+    ],
+  };
+}
+
+// V1GetABranchConfigOutput body — used by the resolver's UUID path. The
+// returned `ref` becomes the `branch_id_or_ref` for the PATCH call, so it must
+// be a value that schema-validates against the oneOf union — UUID-shaped.
+const BRANCH_CONFIG = {
+  ref: BRANCH_UUID,
+  postgres_version: "15",
+  postgres_engine: "15",
+  release_channel: "ga",
+  status: "ACTIVE_HEALTHY",
+  db_host: "h",
+  db_port: 5432,
+};
+
+const tempRoot = useLegacyTempWorkdir("supabase-branches-update-int-");
+
+interface SetupOpts {
+  readonly format?: "text" | "json" | "stream-json";
+  readonly goOutput?: "env" | "pretty" | "json" | "toml" | "yaml";
+  readonly patchStatus?: number;
+}
+
+function buildApi(opts: SetupOpts) {
+  const patchStatus = opts.patchStatus ?? 200;
+  return mockLegacyPlatformApi({
+    handler: (request) =>
+      Effect.sync(() => {
+        if (request.method === "PATCH" && request.url.includes("/v1/branches/")) {
+          return legacyJsonResponse(request, patchStatus, patchStatus === 200 ? UPDATED : {});
+        }
+        if (request.method === "GET" && request.url.includes("/v1/branches/")) {
+          return legacyJsonResponse(request, 200, BRANCH_CONFIG);
+        }
+        return legacyJsonResponse(request, 200, null);
+      }),
+  });
+}
+
+function setup(opts: SetupOpts = {}) {
+  const out = mockOutput({ format: opts.format ?? "text" });
+  const analytics = mockAnalytics();
+  const api = buildApi(opts);
+  const cliConfig = mockLegacyCliConfig({ workdir: tempRoot.current });
+  const layer = buildLegacyTestRuntime({
+    out,
+    api,
+    cliConfig,
+    analytics,
+    goOutput: opts.goOutput === undefined ? Option.none() : Option.some(opts.goOutput),
+  });
+  return { layer, out, api, analytics };
+}
+
+function setupTracked(opts: SetupOpts = {}) {
+  const out = mockOutput({ format: opts.format ?? "text" });
+  const analytics = mockAnalytics();
+  const api = buildApi(opts);
+  const cliConfig = mockLegacyCliConfig({ workdir: tempRoot.current });
+  const telemetry = mockLegacyTelemetryStateTracked();
+  const cache = mockLegacyLinkedProjectCacheTracked();
+  const layer = buildLegacyTestRuntime({
+    out,
+    api,
+    cliConfig,
+    analytics,
+    telemetry: telemetry.layer,
+    linkedProjectCache: cache.layer,
+  });
+  return { layer, out, api, analytics, telemetry, cache };
+}
+
+const baseFlags: LegacyBranchesUpdateFlags = {
+  branchId: Option.none(),
+  projectRef: Option.none(),
+  name: Option.none(),
+  gitBranch: Option.none(),
+  persistent: Option.none(),
+  status: Option.none(),
+  notifyUrl: Option.none(),
+};
+
+describe("legacy branches update integration", () => {
+  it.live("updates a branch with --name and emits 'Updated preview branch:' to stderr", () => {
+    const { layer, out } = setup();
+    return Effect.gen(function* () {
+      yield* legacyBranchesUpdate({
+        ...baseFlags,
+        branchId: Option.some(BRANCH_UUID),
+        name: Option.some("renamed"),
+      });
+      expect(out.stderrText).toContain("Updated preview branch:");
+      expect(out.stdoutText).toContain("renamed");
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("includes optional flags in body only when set", () => {
+    const { layer, api } = setup();
+    return Effect.gen(function* () {
+      yield* legacyBranchesUpdate({
+        ...baseFlags,
+        branchId: Option.some(BRANCH_UUID),
+        name: Option.some("rename-x"),
+        gitBranch: Option.some("git-x"),
+        persistent: Option.some(true),
+        notifyUrl: Option.some("https://hook.example.com"),
+      });
+      const patch = api.requests.find((r) => r.method === "PATCH");
+      expect(patch?.body).toMatchObject({
+        branch_name: "rename-x",
+        git_branch: "git-x",
+        persistent: true,
+        notify_url: "https://hook.example.com",
+      });
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("sends `persistent: false` when --persistent is explicitly false (demote)", () => {
+    const { layer, api } = setup();
+    return Effect.gen(function* () {
+      yield* legacyBranchesUpdate({
+        ...baseFlags,
+        branchId: Option.some(BRANCH_UUID),
+        persistent: Option.some(false),
+      });
+      const patch = api.requests.find((r) => r.method === "PATCH");
+      expect(patch?.body).toMatchObject({ persistent: false });
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("omits `persistent` from body when the flag is absent (default)", () => {
+    const { layer, api } = setup();
+    return Effect.gen(function* () {
+      yield* legacyBranchesUpdate({
+        ...baseFlags,
+        branchId: Option.some(BRANCH_UUID),
+      });
+      const patch = api.requests.find((r) => r.method === "PATCH");
+      expect(patch?.body).toBeDefined();
+      expect((patch?.body as Record<string, unknown>) ?? {}).not.toHaveProperty("persistent");
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("emits success event for --output-format=json", () => {
+    const { layer, out } = setup({ format: "json" });
+    return Effect.gen(function* () {
+      yield* legacyBranchesUpdate({
+        ...baseFlags,
+        branchId: Option.some(BRANCH_UUID),
+        name: Option.some("renamed"),
+      });
+      const success = out.messages.find((m) => m.type === "success");
+      expect(success).toBeDefined();
+      expect(success?.data).toMatchObject({ name: "renamed" });
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("fails with LegacyBranchesUpdateUnexpectedStatusError on non-200", () => {
+    const { layer } = setup({ patchStatus: 500 });
+    return Effect.gen(function* () {
+      const exit = yield* Effect.exit(
+        legacyBranchesUpdate({ ...baseFlags, branchId: Option.some(BRANCH_UUID) }),
+      );
+      expect(Exit.isFailure(exit)).toBe(true);
+      if (Exit.isFailure(exit)) {
+        const json = JSON.stringify(exit.cause);
+        expect(json).toContain("LegacyBranchesUpdateUnexpectedStatusError");
+        expect(json).toContain("unexpected update branch status 500");
+      }
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("writes linked-project cache + telemetry state on success", () => {
+    const { layer, telemetry, cache } = setupTracked();
+    return Effect.gen(function* () {
+      yield* legacyBranchesUpdate({
+        ...baseFlags,
+        branchId: Option.some(BRANCH_UUID),
+        name: Option.some("renamed"),
+      });
+      expect(telemetry.flushed).toBe(true);
+      expect(cache.cached).toBe(true);
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("writes linked-project cache + telemetry state on failure", () => {
+    const { layer, telemetry, cache } = setupTracked({ patchStatus: 500 });
+    return Effect.gen(function* () {
+      yield* Effect.exit(
+        legacyBranchesUpdate({ ...baseFlags, branchId: Option.some(BRANCH_UUID) }),
+      );
+      expect(telemetry.flushed).toBe(true);
+      expect(cache.cached).toBe(true);
+    }).pipe(Effect.provide(layer));
+  });
+
+  // -------------------------------------------------------------------------
+  // Upgrade-suggest path uses the direct service mock so we can exercise the
+  // production-shape branchRef (20-letter project ref) end-to-end. This is the
+  // Go-parity assertion: the helper must be called with the resolved branch's
+  // project ref, not the parent project ref. Mirrors `update.go:26`.
+  // -------------------------------------------------------------------------
+  it.live(
+    "fires cli_upgrade_suggested with the branch ref + branching_persistent on 4xx gated",
+    () => {
+      const out = mockOutput({ format: "text" });
+      const analytics = mockAnalytics();
+      const cliConfig = mockLegacyCliConfig({ workdir: tempRoot.current });
+
+      // `legacySuggestUpgrade` bypasses the typed Management API client to GET
+      // the project + entitlements (see its file-level comment — required so
+      // cli-e2e replay fixtures with `__PROJECT_REF__` placeholders don't trip
+      // strict schema decode). Route all three URLs through `mockLegacyPlatformApi`'s
+      // handler so the assertion covers the request log produced by the same
+      // HttpClient the production code uses.
+      const apiMock = mockLegacyPlatformApi({
+        handler: (request) =>
+          Effect.sync(() => {
+            if (request.method === "PATCH" && request.url.includes("/v1/branches/")) {
+              return legacyJsonResponse(request, 402, { message: "upgrade required" });
+            }
+            if (request.method === "GET" && request.url.endsWith(`/v1/projects/${BRANCH_REF}`)) {
+              return legacyJsonResponse(request, 200, projectResponse(BRANCH_REF));
+            }
+            if (
+              request.method === "GET" &&
+              request.url.endsWith(`/v1/organizations/${ORG_SLUG}/entitlements`)
+            ) {
+              return legacyJsonResponse(
+                request,
+                200,
+                entitlementResponse({
+                  featureKey: "branching_persistent",
+                  hasAccess: false,
+                }),
+              );
+            }
+            return legacyJsonResponse(request, 200, null);
+          }),
+      });
+
+      const layer = buildLegacyTestRuntime({
+        out,
+        api: apiMock,
+        cliConfig,
+        analytics,
+      });
+
+      return Effect.gen(function* () {
+        yield* Effect.exit(
+          legacyBranchesUpdate({
+            ...baseFlags,
+            branchId: Option.some(BRANCH_REF),
+            persistent: Option.some(true),
+          }),
+        );
+        // The branch ref the resolver returned is what `legacySuggestUpgrade`
+        // should query getProject with — Go parity.
+        const projectCall = apiMock.requests.find(
+          (r) => r.method === "GET" && r.url.endsWith(`/v1/projects/${BRANCH_REF}`),
+        );
+        expect(projectCall).toBeDefined();
+        const entitlementsCall = apiMock.requests.find((r) =>
+          r.url.endsWith(`/v1/organizations/${ORG_SLUG}/entitlements`),
+        );
+        expect(entitlementsCall).toBeDefined();
+        expect(analytics.captured).toEqual([
+          {
+            event: "cli_upgrade_suggested",
+            properties: { feature_key: "branching_persistent", org_slug: ORG_SLUG },
+          },
+        ]);
+        expect(out.stderrText).toContain("Upgrade your plan:");
+      }).pipe(Effect.provide(layer));
+    },
+  );
+});
diff --git a/apps/cli/src/legacy/commands/completion/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/completion/SIDE_EFFECTS.md
new file mode 100644
index 0000000000..9246628751
--- /dev/null
+++ b/apps/cli/src/legacy/commands/completion/SIDE_EFFECTS.md
@@ -0,0 +1,60 @@
+# `supabase completion`
+
+## Files Read
+
+| Path | Format | When |
+| ---- | ------ | ---- |
+| —    | —      | —    |
+
+## Files Written
+
+| Path | Format | When |
+| ---- | ------ | ---- |
+| —    | —      | —    |
+
+## API Routes
+
+| Method | Path | Auth | Request body | Response (used fields) |
+| ------ | ---- | ---- | ------------ | ---------------------- |
+| —      | —    | —    | —            | —                      |
+
+## Environment Variables
+
+| Variable | Purpose | Required? |
+| -------- | ------- | --------- |
+| —        | —       | —         |
+
+## Exit Codes
+
+| Code | Condition                                                          |
+| ---- | ------------------------------------------------------------------ |
+| `0`  | success — completion script for the chosen shell printed to stdout |
+| `1`  | invocation error (missing or unknown shell subcommand)             |
+
+## Output
+
+`supabase completion <shell>` prints a shell-specific autocompletion script to stdout.
+The subcommand tree mirrors the Go CLI exactly: `bash`, `fish`, `powershell`, `zsh`.
+
+In the legacy shell every subcommand proxies verbatim to the bundled Go binary via
+`LegacyGoProxy`, so the emitted scripts are byte-for-byte identical to what the Go
+CLI produced. This matters because users who installed completions with the Go CLI
+have those exact bytes cached in their `~/.zshrc` (`eval "$(supabase completion zsh)"`),
+brew-managed `_supabase` files in their `fpath`, or analogous bash/fish/powershell
+artifacts. Drift would break tab completion for those users.
+
+The generated scripts call back to `supabase __complete <args>` on every tab press to
+fetch dynamic completion candidates — see `apps/cli/src/legacy/commands/__complete/`,
+which provides the matching hidden command.
+
+## Notes
+
+- No native TS reimplementation is attempted. Effect's `Completions.generate` API
+  emits a static `_arguments`-based zsh function that diverges from Cobra's runtime-
+  callback shape; using it here would break the existing user setups described above.
+- Effect CLI's `--completions` global flag remains exposed at the root for `next/`
+  users; it does not satisfy the legacy parity contract and is not what this
+  subcommand routes through.
+- The Go CLI exits non-zero when called without a shell subcommand (e.g.
+  `supabase completion`). Effect CLI surfaces the same condition through its usual
+  "missing subcommand" help-with-exit-1 behavior.
diff --git a/apps/cli/src/legacy/commands/completion/bash/bash.command.ts b/apps/cli/src/legacy/commands/completion/bash/bash.command.ts
new file mode 100644
index 0000000000..5e8c1d9a10
--- /dev/null
+++ b/apps/cli/src/legacy/commands/completion/bash/bash.command.ts
@@ -0,0 +1,12 @@
+import { Command } from "effect/unstable/cli";
+import type * as CliCommand from "effect/unstable/cli/Command";
+import { legacyCompletionBash } from "./bash.handler.ts";
+
+const config = {};
+export type LegacyCompletionBashFlags = CliCommand.Command.Config.Infer<typeof config>;
+
+export const legacyCompletionBashCommand = Command.make("bash", config).pipe(
+  Command.withDescription("Generate the autocompletion script for bash"),
+  Command.withShortDescription("Generate the autocompletion script for bash"),
+  Command.withHandler((flags) => legacyCompletionBash(flags)),
+);
diff --git a/apps/cli/src/legacy/commands/completion/bash/bash.handler.ts b/apps/cli/src/legacy/commands/completion/bash/bash.handler.ts
new file mode 100644
index 0000000000..dce9331b4c
--- /dev/null
+++ b/apps/cli/src/legacy/commands/completion/bash/bash.handler.ts
@@ -0,0 +1,10 @@
+import { Effect } from "effect";
+import { LegacyGoProxy } from "../../../../shared/legacy/go-proxy.service.ts";
+import type { LegacyCompletionBashFlags } from "./bash.command.ts";
+
+export const legacyCompletionBash = Effect.fn("legacy.completion.bash")(function* (
+  _flags: LegacyCompletionBashFlags,
+) {
+  const proxy = yield* LegacyGoProxy;
+  yield* proxy.exec(["completion", "bash"]);
+});
diff --git a/apps/cli/src/legacy/commands/completion/bash/bash.integration.test.ts b/apps/cli/src/legacy/commands/completion/bash/bash.integration.test.ts
new file mode 100644
index 0000000000..884c75abd5
--- /dev/null
+++ b/apps/cli/src/legacy/commands/completion/bash/bash.integration.test.ts
@@ -0,0 +1,25 @@
+import { describe, expect, it } from "@effect/vitest";
+import { Effect, Layer } from "effect";
+import { LegacyGoProxy } from "../../../../shared/legacy/go-proxy.service.ts";
+import { legacyCompletionBash } from "./bash.handler.ts";
+
+function setupLegacyCompletionBash() {
+  const calls: Array<ReadonlyArray<string>> = [];
+  const layer = Layer.succeed(LegacyGoProxy, {
+    exec: (args) =>
+      Effect.sync(() => {
+        calls.push(args);
+      }),
+  });
+  return { layer, calls };
+}
+
+describe("legacy completion bash", () => {
+  it.live("forwards `completion bash` to the Go binary", () => {
+    const { layer, calls } = setupLegacyCompletionBash();
+    return Effect.gen(function* () {
+      yield* legacyCompletionBash({});
+      expect(calls).toEqual([["completion", "bash"]]);
+    }).pipe(Effect.provide(layer));
+  });
+});
diff --git a/apps/cli/src/legacy/commands/completion/completion.command.ts b/apps/cli/src/legacy/commands/completion/completion.command.ts
new file mode 100644
index 0000000000..38b7b53f88
--- /dev/null
+++ b/apps/cli/src/legacy/commands/completion/completion.command.ts
@@ -0,0 +1,19 @@
+import { Command } from "effect/unstable/cli";
+import { legacyCompletionBashCommand } from "./bash/bash.command.ts";
+import { legacyCompletionFishCommand } from "./fish/fish.command.ts";
+import { legacyCompletionPowershellCommand } from "./powershell/powershell.command.ts";
+import { legacyCompletionZshCommand } from "./zsh/zsh.command.ts";
+
+export const legacyCompletionCommand = Command.make("completion").pipe(
+  Command.withDescription(
+    "Generate the autocompletion script for supabase for the specified shell.\n" +
+      "See each sub-command's help for details on how to use the generated script.",
+  ),
+  Command.withShortDescription("Generate autocompletion scripts"),
+  Command.withSubcommands([
+    legacyCompletionBashCommand,
+    legacyCompletionFishCommand,
+    legacyCompletionPowershellCommand,
+    legacyCompletionZshCommand,
+  ]),
+);
diff --git a/apps/cli/src/legacy/commands/completion/fish/fish.command.ts b/apps/cli/src/legacy/commands/completion/fish/fish.command.ts
new file mode 100644
index 0000000000..2d22d4cd6e
--- /dev/null
+++ b/apps/cli/src/legacy/commands/completion/fish/fish.command.ts
@@ -0,0 +1,12 @@
+import { Command } from "effect/unstable/cli";
+import type * as CliCommand from "effect/unstable/cli/Command";
+import { legacyCompletionFish } from "./fish.handler.ts";
+
+const config = {};
+export type LegacyCompletionFishFlags = CliCommand.Command.Config.Infer<typeof config>;
+
+export const legacyCompletionFishCommand = Command.make("fish", config).pipe(
+  Command.withDescription("Generate the autocompletion script for fish"),
+  Command.withShortDescription("Generate the autocompletion script for fish"),
+  Command.withHandler((flags) => legacyCompletionFish(flags)),
+);
diff --git a/apps/cli/src/legacy/commands/completion/fish/fish.handler.ts b/apps/cli/src/legacy/commands/completion/fish/fish.handler.ts
new file mode 100644
index 0000000000..c293d2e3b4
--- /dev/null
+++ b/apps/cli/src/legacy/commands/completion/fish/fish.handler.ts
@@ -0,0 +1,10 @@
+import { Effect } from "effect";
+import { LegacyGoProxy } from "../../../../shared/legacy/go-proxy.service.ts";
+import type { LegacyCompletionFishFlags } from "./fish.command.ts";
+
+export const legacyCompletionFish = Effect.fn("legacy.completion.fish")(function* (
+  _flags: LegacyCompletionFishFlags,
+) {
+  const proxy = yield* LegacyGoProxy;
+  yield* proxy.exec(["completion", "fish"]);
+});
diff --git a/apps/cli/src/legacy/commands/completion/fish/fish.integration.test.ts b/apps/cli/src/legacy/commands/completion/fish/fish.integration.test.ts
new file mode 100644
index 0000000000..163b2483ca
--- /dev/null
+++ b/apps/cli/src/legacy/commands/completion/fish/fish.integration.test.ts
@@ -0,0 +1,25 @@
+import { describe, expect, it } from "@effect/vitest";
+import { Effect, Layer } from "effect";
+import { LegacyGoProxy } from "../../../../shared/legacy/go-proxy.service.ts";
+import { legacyCompletionFish } from "./fish.handler.ts";
+
+function setupLegacyCompletionFish() {
+  const calls: Array<ReadonlyArray<string>> = [];
+  const layer = Layer.succeed(LegacyGoProxy, {
+    exec: (args) =>
+      Effect.sync(() => {
+        calls.push(args);
+      }),
+  });
+  return { layer, calls };
+}
+
+describe("legacy completion fish", () => {
+  it.live("forwards `completion fish` to the Go binary", () => {
+    const { layer, calls } = setupLegacyCompletionFish();
+    return Effect.gen(function* () {
+      yield* legacyCompletionFish({});
+      expect(calls).toEqual([["completion", "fish"]]);
+    }).pipe(Effect.provide(layer));
+  });
+});
diff --git a/apps/cli/src/legacy/commands/completion/powershell/powershell.command.ts b/apps/cli/src/legacy/commands/completion/powershell/powershell.command.ts
new file mode 100644
index 0000000000..2034dc3f80
--- /dev/null
+++ b/apps/cli/src/legacy/commands/completion/powershell/powershell.command.ts
@@ -0,0 +1,12 @@
+import { Command } from "effect/unstable/cli";
+import type * as CliCommand from "effect/unstable/cli/Command";
+import { legacyCompletionPowershell } from "./powershell.handler.ts";
+
+const config = {};
+export type LegacyCompletionPowershellFlags = CliCommand.Command.Config.Infer<typeof config>;
+
+export const legacyCompletionPowershellCommand = Command.make("powershell", config).pipe(
+  Command.withDescription("Generate the autocompletion script for powershell"),
+  Command.withShortDescription("Generate the autocompletion script for powershell"),
+  Command.withHandler((flags) => legacyCompletionPowershell(flags)),
+);
diff --git a/apps/cli/src/legacy/commands/completion/powershell/powershell.handler.ts b/apps/cli/src/legacy/commands/completion/powershell/powershell.handler.ts
new file mode 100644
index 0000000000..9410dccccb
--- /dev/null
+++ b/apps/cli/src/legacy/commands/completion/powershell/powershell.handler.ts
@@ -0,0 +1,10 @@
+import { Effect } from "effect";
+import { LegacyGoProxy } from "../../../../shared/legacy/go-proxy.service.ts";
+import type { LegacyCompletionPowershellFlags } from "./powershell.command.ts";
+
+export const legacyCompletionPowershell = Effect.fn("legacy.completion.powershell")(function* (
+  _flags: LegacyCompletionPowershellFlags,
+) {
+  const proxy = yield* LegacyGoProxy;
+  yield* proxy.exec(["completion", "powershell"]);
+});
diff --git a/apps/cli/src/legacy/commands/completion/powershell/powershell.integration.test.ts b/apps/cli/src/legacy/commands/completion/powershell/powershell.integration.test.ts
new file mode 100644
index 0000000000..be1a0ee0c8
--- /dev/null
+++ b/apps/cli/src/legacy/commands/completion/powershell/powershell.integration.test.ts
@@ -0,0 +1,25 @@
+import { describe, expect, it } from "@effect/vitest";
+import { Effect, Layer } from "effect";
+import { LegacyGoProxy } from "../../../../shared/legacy/go-proxy.service.ts";
+import { legacyCompletionPowershell } from "./powershell.handler.ts";
+
+function setupLegacyCompletionPowershell() {
+  const calls: Array<ReadonlyArray<string>> = [];
+  const layer = Layer.succeed(LegacyGoProxy, {
+    exec: (args) =>
+      Effect.sync(() => {
+        calls.push(args);
+      }),
+  });
+  return { layer, calls };
+}
+
+describe("legacy completion powershell", () => {
+  it.live("forwards `completion powershell` to the Go binary", () => {
+    const { layer, calls } = setupLegacyCompletionPowershell();
+    return Effect.gen(function* () {
+      yield* legacyCompletionPowershell({});
+      expect(calls).toEqual([["completion", "powershell"]]);
+    }).pipe(Effect.provide(layer));
+  });
+});
diff --git a/apps/cli/src/legacy/commands/completion/zsh/zsh.command.ts b/apps/cli/src/legacy/commands/completion/zsh/zsh.command.ts
new file mode 100644
index 0000000000..fdda3df9e1
--- /dev/null
+++ b/apps/cli/src/legacy/commands/completion/zsh/zsh.command.ts
@@ -0,0 +1,12 @@
+import { Command } from "effect/unstable/cli";
+import type * as CliCommand from "effect/unstable/cli/Command";
+import { legacyCompletionZsh } from "./zsh.handler.ts";
+
+const config = {};
+export type LegacyCompletionZshFlags = CliCommand.Command.Config.Infer<typeof config>;
+
+export const legacyCompletionZshCommand = Command.make("zsh", config).pipe(
+  Command.withDescription("Generate the autocompletion script for zsh"),
+  Command.withShortDescription("Generate the autocompletion script for zsh"),
+  Command.withHandler((flags) => legacyCompletionZsh(flags)),
+);
diff --git a/apps/cli/src/legacy/commands/completion/zsh/zsh.handler.ts b/apps/cli/src/legacy/commands/completion/zsh/zsh.handler.ts
new file mode 100644
index 0000000000..10ca64ae3d
--- /dev/null
+++ b/apps/cli/src/legacy/commands/completion/zsh/zsh.handler.ts
@@ -0,0 +1,10 @@
+import { Effect } from "effect";
+import { LegacyGoProxy } from "../../../../shared/legacy/go-proxy.service.ts";
+import type { LegacyCompletionZshFlags } from "./zsh.command.ts";
+
+export const legacyCompletionZsh = Effect.fn("legacy.completion.zsh")(function* (
+  _flags: LegacyCompletionZshFlags,
+) {
+  const proxy = yield* LegacyGoProxy;
+  yield* proxy.exec(["completion", "zsh"]);
+});
diff --git a/apps/cli/src/legacy/commands/completion/zsh/zsh.integration.test.ts b/apps/cli/src/legacy/commands/completion/zsh/zsh.integration.test.ts
new file mode 100644
index 0000000000..e1cf6f4192
--- /dev/null
+++ b/apps/cli/src/legacy/commands/completion/zsh/zsh.integration.test.ts
@@ -0,0 +1,25 @@
+import { describe, expect, it } from "@effect/vitest";
+import { Effect, Layer } from "effect";
+import { LegacyGoProxy } from "../../../../shared/legacy/go-proxy.service.ts";
+import { legacyCompletionZsh } from "./zsh.handler.ts";
+
+function setupLegacyCompletionZsh() {
+  const calls: Array<ReadonlyArray<string>> = [];
+  const layer = Layer.succeed(LegacyGoProxy, {
+    exec: (args) =>
+      Effect.sync(() => {
+        calls.push(args);
+      }),
+  });
+  return { layer, calls };
+}
+
+describe("legacy completion zsh", () => {
+  it.live("forwards `completion zsh` to the Go binary", () => {
+    const { layer, calls } = setupLegacyCompletionZsh();
+    return Effect.gen(function* () {
+      yield* legacyCompletionZsh({});
+      expect(calls).toEqual([["completion", "zsh"]]);
+    }).pipe(Effect.provide(layer));
+  });
+});
diff --git a/apps/cli/src/legacy/commands/db/db.command.ts b/apps/cli/src/legacy/commands/db/db.command.ts
index 21e637f9a2..73eb3f5eeb 100644
--- a/apps/cli/src/legacy/commands/db/db.command.ts
+++ b/apps/cli/src/legacy/commands/db/db.command.ts
@@ -1,5 +1,4 @@
 import { Command } from "effect/unstable/cli";
-import { withHiddenSubcommands } from "../../../shared/cli/hidden-flag.ts";
 import { legacyDbDiffCommand } from "./diff/diff.command.ts";
 import { legacyDbDumpCommand } from "./dump/dump.command.ts";
 import { legacyDbPushCommand } from "./push/push.command.ts";
@@ -17,7 +16,6 @@ import { legacyDbSchemaCommand } from "./schema/schema.command.ts";
 export const legacyDbCommand = Command.make("db").pipe(
   Command.withDescription("Manage Postgres databases."),
   Command.withShortDescription("Manage databases"),
-  withHiddenSubcommands(["branch", "remote", "test"]),
   Command.withSubcommands([
     legacyDbDiffCommand,
     legacyDbDumpCommand,
@@ -28,9 +26,9 @@ export const legacyDbCommand = Command.make("db").pipe(
     legacyDbStartCommand,
     legacyDbQueryCommand,
     legacyDbAdvisorsCommand,
-    legacyDbTestCommand,
-    legacyDbBranchCommand,
-    legacyDbRemoteCommand,
+    legacyDbTestCommand.pipe(Command.withHidden),
+    legacyDbBranchCommand.pipe(Command.withHidden),
+    legacyDbRemoteCommand.pipe(Command.withHidden),
     legacyDbSchemaCommand,
   ]),
 );
diff --git a/apps/cli/src/legacy/commands/migration/migration.command.ts b/apps/cli/src/legacy/commands/migration/migration.command.ts
index d095e97f93..ff92238ecb 100644
--- a/apps/cli/src/legacy/commands/migration/migration.command.ts
+++ b/apps/cli/src/legacy/commands/migration/migration.command.ts
@@ -10,6 +10,7 @@ import { legacyMigrationFetchCommand } from "./fetch/fetch.command.ts";
 export const legacyMigrationCommand = Command.make("migration").pipe(
   Command.withDescription("Manage database migration scripts."),
   Command.withShortDescription("Manage database migration scripts"),
+  Command.withAlias("migrations"),
   Command.withSubcommands([
     legacyMigrationListCommand,
     legacyMigrationNewCommand,
diff --git a/apps/cli/src/legacy/commands/migration/migration.integration.test.ts b/apps/cli/src/legacy/commands/migration/migration.integration.test.ts
new file mode 100644
index 0000000000..a568cf3968
--- /dev/null
+++ b/apps/cli/src/legacy/commands/migration/migration.integration.test.ts
@@ -0,0 +1,42 @@
+import { describe, expect, it } from "@effect/vitest";
+import { Effect, Layer } from "effect";
+import { CliOutput, Command } from "effect/unstable/cli";
+
+import { textCliOutputFormatter } from "../../../shared/output/text-formatter.ts";
+import { LegacyGoProxy } from "../../../shared/legacy/go-proxy.service.ts";
+import { legacyMigrationCommand } from "./migration.command.ts";
+
+function mockLegacyGoProxy() {
+  const calls: Array<ReadonlyArray<string>> = [];
+  const layer = Layer.succeed(LegacyGoProxy, {
+    exec: (args) =>
+      Effect.sync(() => {
+        calls.push([...args]);
+      }),
+  });
+
+  return { layer, calls };
+}
+
+const legacyTestRoot = Command.make("supabase").pipe(
+  Command.withSubcommands([legacyMigrationCommand]),
+);
+
+describe("legacy migration command integration", () => {
+  it.live("accepts the Go-compatible plural migrations alias", () => {
+    const proxy = mockLegacyGoProxy();
+    const run = Effect.gen(function* () {
+      yield* Command.runWith(legacyTestRoot, { version: "0.0.0-test" })([
+        "migrations",
+        "new",
+        "create_widgets",
+      ]);
+
+      expect(proxy.calls).toEqual([["migration", "new", "create_widgets"]]);
+    }).pipe(Effect.provide(Layer.mergeAll(proxy.layer, CliOutput.layer(textCliOutputFormatter()))));
+
+    // Command.runWith's Environment type is retained even though this path only needs CliOutput
+    // and the mocked proxy at runtime.
+    return run as Effect.Effect<void>;
+  });
+});
diff --git a/apps/cli/src/legacy/commands/network-restrictions/get/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/network-restrictions/get/SIDE_EFFECTS.md
index e3325ba764..7c746dbd01 100644
--- a/apps/cli/src/legacy/commands/network-restrictions/get/SIDE_EFFECTS.md
+++ b/apps/cli/src/legacy/commands/network-restrictions/get/SIDE_EFFECTS.md
@@ -2,56 +2,94 @@
 
 ## Files Read
 
-| Path                       | Format                    | When                                                       |
-| -------------------------- | ------------------------- | ---------------------------------------------------------- |
-| `~/.supabase/access-token` | plain text (token string) | when `SUPABASE_ACCESS_TOKEN` unset and keyring unavailable |
+| Path                                   | Format                    | When                                                          |
+| -------------------------------------- | ------------------------- | ------------------------------------------------------------- |
+| `~/.supabase/access-token`             | plain text (token string) | when `SUPABASE_ACCESS_TOKEN` unset and keyring unavailable    |
+| `<workdir>/supabase/.temp/project-ref` | plain text (project ref)  | when `--project-ref` flag and `PROJECT_ID` env are both unset |
 
 ## Files Written
 
-| Path | Format | When |
-| ---- | ------ | ---- |
-| —    | —      | —    |
+| Path                                             | Format | When                                                                          |
+| ------------------------------------------------ | ------ | ----------------------------------------------------------------------------- |
+| `~/.supabase/<workdir-hash>/linked-project.json` | JSON   | always (after ref resolution), via `Effect.ensuring` — on success and failure |
+| `~/.supabase/telemetry.json`                     | JSON   | always, via `Effect.ensuring` — on success and failure                        |
 
 ## API Routes
 
-| Method | Path                                      | Auth         | Request body | Response (used fields)          |
-| ------ | ----------------------------------------- | ------------ | ------------ | ------------------------------- |
-| `GET`  | `/v1/projects/{ref}/network-restrictions` | Bearer token | none         | `{allowed_cidr_ranges, status}` |
+| Method | Path                                      | Auth         | Request body | Response (used fields)                                                                                                                                           |
+| ------ | ----------------------------------------- | ------------ | ------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `GET`  | `/v1/projects/{ref}/network-restrictions` | Bearer token | none         | `{ config: { dbAllowedCidrs?: string[], dbAllowedCidrsV6?: string[] }, status: "stored" \| "applied" }` (see `V1GetNetworkRestrictionsOutput` in `packages/api`) |
 
 ## Environment Variables
 
-| Variable                | Purpose                                              | Required?                                               |
-| ----------------------- | ---------------------------------------------------- | ------------------------------------------------------- |
-| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `~/.supabase/access-token`) |
-| `SUPABASE_API_URL`      | override Management API base URL                     | no (defaults to `https://api.supabase.com`)             |
+| Variable                | Purpose                                              | Required?                                                |
+| ----------------------- | ---------------------------------------------------- | -------------------------------------------------------- |
+| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `~/.supabase/access-token`)  |
+| `SUPABASE_API_URL`      | override Management API base URL                     | no (defaults to `https://api.supabase.com`)              |
+| `PROJECT_ID`            | project ref fallback when `--project-ref` is unset   | no (falls back to `supabase/.temp/project-ref` → prompt) |
 
 ## Exit Codes
 
-| Code | Condition                                                       |
-| ---- | --------------------------------------------------------------- |
-| `0`  | success — network restrictions printed to stdout                |
-| `1`  | authentication error — no valid token found                     |
-| `1`  | API error — non-2xx response from network restrictions endpoint |
-| `1`  | network / connection failure                                    |
+| Code | Condition                                                                               |
+| ---- | --------------------------------------------------------------------------------------- |
+| `0`  | success — network-restrictions status printed to stdout                                 |
+| `1`  | project ref unresolved (`LegacyProjectNotLinkedError` / `LegacyInvalidProjectRefError`) |
+| `1`  | API non-200 (`LegacyNetworkRestrictionsGetUnexpectedStatusError`)                       |
+| `1`  | transport failure (`LegacyNetworkRestrictionsGetNetworkError`)                          |
+
+## Telemetry Events Fired
+
+| Event                  | When                                       | Notable properties / groups                                          |
+| ---------------------- | ------------------------------------------ | -------------------------------------------------------------------- |
+| `cli_command_executed` | post-run, success or failure (via wrapper) | `exit_code`, `duration_ms`, `flags` (`--project-ref` → `<redacted>`) |
+
+Matches `apps/cli-go/internal/restrictions/get/`. Go does not fire any custom telemetry event for this command.
 
 ## Output
 
-### `--output-format text` (Go CLI compatible)
+### `--output-format text` (default) — Go CLI compatible
+
+Three hardcoded lines using Go's `fmt.Printf` slice rendering. The IPv4 and IPv6 fields
+are emitted byte-for-byte from Go's `%+v` on `*[]string`:
+
+- field absent in the API response → `<nil>`
+- field present, empty array → `&[]`
+- field present, populated → `&[a b c]` (single-space separated, no quotes)
+
+```
+DB Allowed IPv4 CIDRs: &[1.2.3.0/24 5.6.7.0/24]
+DB Allowed IPv6 CIDRs: &[2001:db8::/64]
+Restrictions applied successfully: true
+```
 
-Prints network restriction configuration to stdout.
+`applied successfully` is `true` iff `status === "applied"` in the response.
+
+### Go `--output {json,yaml,toml,env}`
+
+Byte-identical to the Go CLI's encoders (`apps/cli-go/internal/utils/output.go`).
+
+- `json` — alphabetical struct-field order with trailing newline.
+- `yaml` — `stringifyYaml(response)`.
+- `toml` — `stringifyToml(response)` with trailing newline.
+- `env` — Viper-flattened SCREAMING_SNAKE_CASE keys.
+
+### Go `--output pretty`
+
+Same as `text` mode (Go's default).
 
 ### `--output-format json`
 
-Single JSON object emitted to stdout on success.
+The full `V1GetNetworkRestrictionsOutput` emitted as the `success` event payload.
 
 ### `--output-format stream-json`
 
-One `result` event on success.
-
-```ndjson
-{"type":"result","data":{...}}
-```
+One `result` event whose `data` is the full response object.
 
 ## Notes
 
-- Requires `--project-ref` or a linked project (`.supabase/config.json`).
+- The Go `--output` flag wins over the TS `--output-format` flag when both are provided.
+- `linked-project.json` is written **after** the project ref is resolved, regardless of
+  whether the subsequent API call succeeds (mirrors Go's `PersistentPostRun`).
+- `telemetry.json` is written on every invocation, including failures.
+- Go's `restrictions/get` itself does not honor `--output`. The legacy TS port honors both
+  `--output` and `--output-format` per the legacy CLAUDE.md output-parity rules.
diff --git a/apps/cli/src/legacy/commands/network-restrictions/get/get.command.ts b/apps/cli/src/legacy/commands/network-restrictions/get/get.command.ts
index eda694e9e3..b9105e5d74 100644
--- a/apps/cli/src/legacy/commands/network-restrictions/get/get.command.ts
+++ b/apps/cli/src/legacy/commands/network-restrictions/get/get.command.ts
@@ -1,5 +1,9 @@
 import { Command, Flag } from "effect/unstable/cli";
 import type * as CliCommand from "effect/unstable/cli/Command";
+
+import { withJsonErrorHandling } from "../../../../shared/output/json-error-handling.ts";
+import { legacyManagementApiRuntimeLayer } from "../../../shared/legacy-management-api-runtime.layer.ts";
+import { withLegacyCommandInstrumentation } from "../../../telemetry/legacy-command-instrumentation.ts";
 import { legacyNetworkRestrictionsGet } from "./get.handler.ts";
 
 const config = {
@@ -14,5 +18,11 @@ export type LegacyNetworkRestrictionsGetFlags = CliCommand.Command.Config.Infer<
 export const legacyNetworkRestrictionsGetCommand = Command.make("get", config).pipe(
   Command.withDescription("Get the current network restrictions."),
   Command.withShortDescription("Get the current network restrictions"),
-  Command.withHandler((flags) => legacyNetworkRestrictionsGet(flags)),
+  Command.withHandler((flags) =>
+    legacyNetworkRestrictionsGet(flags).pipe(
+      withLegacyCommandInstrumentation({ flags }),
+      withJsonErrorHandling,
+    ),
+  ),
+  Command.provide(legacyManagementApiRuntimeLayer(["network-restrictions", "get"])),
 );
diff --git a/apps/cli/src/legacy/commands/network-restrictions/get/get.handler.ts b/apps/cli/src/legacy/commands/network-restrictions/get/get.handler.ts
index 4b12039e70..b022054aef 100644
--- a/apps/cli/src/legacy/commands/network-restrictions/get/get.handler.ts
+++ b/apps/cli/src/legacy/commands/network-restrictions/get/get.handler.ts
@@ -1,12 +1,90 @@
 import { Effect, Option } from "effect";
-import { LegacyGoProxy } from "../../../../shared/legacy/go-proxy.service.ts";
+
+import { LegacyPlatformApi } from "../../../auth/legacy-platform-api.service.ts";
+import { LegacyProjectRefResolver } from "../../../config/legacy-project-ref.service.ts";
+import { LegacyLinkedProjectCache } from "../../../telemetry/legacy-linked-project-cache.service.ts";
+import { LegacyTelemetryState } from "../../../telemetry/legacy-telemetry-state.service.ts";
+import { LegacyOutputFlag } from "../../../../shared/legacy/global-flags.ts";
+import { Output } from "../../../../shared/output/output.service.ts";
+import {
+  encodeEnv,
+  encodeGoJson,
+  encodeToml,
+  encodeYaml,
+} from "../../../shared/legacy-go-output.encoders.ts";
+import { mapLegacyHttpError } from "../../../shared/legacy-http-errors.ts";
+import {
+  LegacyNetworkRestrictionsGetNetworkError,
+  LegacyNetworkRestrictionsGetUnexpectedStatusError,
+} from "../network-restrictions.errors.ts";
+import { printNetworkRestrictionsStatus } from "../network-restrictions.format.ts";
 import type { LegacyNetworkRestrictionsGetFlags } from "./get.command.ts";
 
+// Templates lifted verbatim from `apps/cli-go/internal/restrictions/get/get.go:15,18`.
+// Note the *semicolon* in the status template — Go uses `; received: ` (vs the colon
+// used in the update/patch templates).
+const mapGetError = mapLegacyHttpError({
+  networkError: LegacyNetworkRestrictionsGetNetworkError,
+  statusError: LegacyNetworkRestrictionsGetUnexpectedStatusError,
+  networkMessage: (cause) => `failed to retrieve network restrictions: ${cause}`,
+  statusMessage: (_status, body) => `failed to retrieve network restrictions; received: ${body}`,
+});
+
 export const legacyNetworkRestrictionsGet = Effect.fn("legacy.network-restrictions.get")(function* (
   flags: LegacyNetworkRestrictionsGetFlags,
 ) {
-  const proxy = yield* LegacyGoProxy;
-  const args: string[] = ["network-restrictions", "get"];
-  if (Option.isSome(flags.projectRef)) args.push("--project-ref", flags.projectRef.value);
-  yield* proxy.exec(args);
+  const output = yield* Output;
+  const goOutputFlag = yield* LegacyOutputFlag;
+  const api = yield* LegacyPlatformApi;
+  const resolver = yield* LegacyProjectRefResolver;
+  const linkedProjectCache = yield* LegacyLinkedProjectCache;
+  const telemetryState = yield* LegacyTelemetryState;
+
+  yield* Effect.gen(function* () {
+    const ref = yield* resolver.resolve(flags.projectRef);
+
+    yield* Effect.gen(function* () {
+      const fetching =
+        output.format === "text"
+          ? yield* output.task("Fetching network restrictions...")
+          : undefined;
+      const response = yield* api.v1.getNetworkRestrictions({ ref }).pipe(
+        Effect.tapError(() => fetching?.fail() ?? Effect.void),
+        Effect.catch(mapGetError),
+      );
+      yield* fetching?.clear() ?? Effect.void;
+
+      const goFmt = Option.getOrUndefined(goOutputFlag);
+
+      if (goFmt === "json") {
+        yield* output.raw(encodeGoJson(response));
+        return;
+      }
+      if (goFmt === "yaml") {
+        yield* output.raw(encodeYaml(response));
+        return;
+      }
+      if (goFmt === "toml") {
+        yield* output.raw(encodeToml(response) + "\n");
+        return;
+      }
+      if (goFmt === "env") {
+        yield* output.raw(encodeEnv(response) + "\n");
+        return;
+      }
+
+      if (output.format === "json" || output.format === "stream-json") {
+        yield* output.success("", response);
+        return;
+      }
+
+      yield* output.raw(
+        printNetworkRestrictionsStatus({
+          v4: response.config.dbAllowedCidrs,
+          v6: response.config.dbAllowedCidrsV6,
+          applied: response.status === "applied",
+        }),
+      );
+    }).pipe(Effect.ensuring(linkedProjectCache.cache(ref)));
+  }).pipe(Effect.ensuring(telemetryState.flush));
 });
diff --git a/apps/cli/src/legacy/commands/network-restrictions/get/get.integration.test.ts b/apps/cli/src/legacy/commands/network-restrictions/get/get.integration.test.ts
new file mode 100644
index 0000000000..d832e35ff1
--- /dev/null
+++ b/apps/cli/src/legacy/commands/network-restrictions/get/get.integration.test.ts
@@ -0,0 +1,318 @@
+import { type V1GetNetworkRestrictionsOutput } from "@supabase/api/effect";
+import { describe, expect, it } from "@effect/vitest";
+import { Effect, Exit, Option } from "effect";
+
+import { withJsonErrorHandling } from "../../../../shared/output/json-error-handling.ts";
+import { mockOutput } from "../../../../../tests/helpers/mocks.ts";
+import {
+  LEGACY_VALID_REF,
+  buildLegacyTestRuntime,
+  mockLegacyCliConfig,
+  mockLegacyLinkedProjectCacheTracked,
+  mockLegacyPlatformApi,
+  mockLegacyTelemetryStateTracked,
+  useLegacyTempWorkdir,
+} from "../../../../../tests/helpers/legacy-mocks.ts";
+import { legacyNetworkRestrictionsGet } from "./get.handler.ts";
+
+// ---------------------------------------------------------------------------
+// Fixtures
+// ---------------------------------------------------------------------------
+
+const APPLIED_WITH_CIDRS: typeof V1GetNetworkRestrictionsOutput.Type = {
+  entitlement: "allowed",
+  config: {
+    dbAllowedCidrs: ["1.2.3.0/24", "5.6.7.0/24"],
+    dbAllowedCidrsV6: ["2001:db8::/64"],
+  },
+  status: "applied",
+};
+
+const APPLIED_NO_CIDRS: typeof V1GetNetworkRestrictionsOutput.Type = {
+  entitlement: "allowed",
+  config: { dbAllowedCidrs: [], dbAllowedCidrsV6: [] },
+  status: "applied",
+};
+
+const STORED_WITH_OMITTED_CIDRS: typeof V1GetNetworkRestrictionsOutput.Type = {
+  entitlement: "allowed",
+  config: {},
+  status: "stored",
+};
+
+// ---------------------------------------------------------------------------
+// Setup
+// ---------------------------------------------------------------------------
+
+interface SetupOpts {
+  format?: "text" | "json" | "stream-json";
+  goOutput?: "env" | "pretty" | "json" | "toml" | "yaml";
+  response?: typeof V1GetNetworkRestrictionsOutput.Type;
+  status?: number;
+  network?: "fail";
+}
+
+const tempRoot = useLegacyTempWorkdir("supabase-network-restrictions-get-int-");
+
+function setup(opts: SetupOpts = {}) {
+  const out = mockOutput({ format: opts.format ?? "text" });
+  const api = mockLegacyPlatformApi({
+    response: { status: opts.status ?? 200, body: opts.response ?? APPLIED_WITH_CIDRS },
+    network: opts.network,
+  });
+  const cliConfig = mockLegacyCliConfig({ workdir: tempRoot.current });
+  const layer = buildLegacyTestRuntime({
+    out,
+    api,
+    cliConfig,
+    goOutput: opts.goOutput === undefined ? Option.none() : Option.some(opts.goOutput),
+  });
+  return { layer, out, api };
+}
+
+function setupTracked(opts: SetupOpts = {}) {
+  const out = mockOutput({ format: opts.format ?? "text" });
+  const api = mockLegacyPlatformApi({
+    response: { status: opts.status ?? 200, body: opts.response ?? APPLIED_WITH_CIDRS },
+    network: opts.network,
+  });
+  const cliConfig = mockLegacyCliConfig({ workdir: tempRoot.current });
+  const telemetry = mockLegacyTelemetryStateTracked();
+  const cache = mockLegacyLinkedProjectCacheTracked();
+  const layer = buildLegacyTestRuntime({
+    out,
+    api,
+    cliConfig,
+    telemetry: telemetry.layer,
+    linkedProjectCache: cache.layer,
+  });
+  return { layer, out, api, telemetry, cache };
+}
+
+// ---------------------------------------------------------------------------
+// Tests
+// ---------------------------------------------------------------------------
+
+describe("legacy network-restrictions get integration", () => {
+  it.live("prints the Go-format text block when the response has v4 and v6 entries", () => {
+    const { layer, out } = setup({ response: APPLIED_WITH_CIDRS });
+    return Effect.gen(function* () {
+      yield* legacyNetworkRestrictionsGet({ projectRef: Option.none() });
+      expect(out.stdoutText).toBe(
+        "DB Allowed IPv4 CIDRs: &[1.2.3.0/24 5.6.7.0/24]\n" +
+          "DB Allowed IPv6 CIDRs: &[2001:db8::/64]\n" +
+          "Restrictions applied successfully: true\n",
+      );
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("prints `&[]` for both arrays when the API returns empty arrays", () => {
+    const { layer, out } = setup({ response: APPLIED_NO_CIDRS });
+    return Effect.gen(function* () {
+      yield* legacyNetworkRestrictionsGet({ projectRef: Option.none() });
+      expect(out.stdoutText).toBe(
+        "DB Allowed IPv4 CIDRs: &[]\n" +
+          "DB Allowed IPv6 CIDRs: &[]\n" +
+          "Restrictions applied successfully: true\n",
+      );
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("prints `<nil>` when the API omits the dbAllowedCidrs fields", () => {
+    const { layer, out } = setup({ response: STORED_WITH_OMITTED_CIDRS });
+    return Effect.gen(function* () {
+      yield* legacyNetworkRestrictionsGet({ projectRef: Option.none() });
+      expect(out.stdoutText).toBe(
+        "DB Allowed IPv4 CIDRs: <nil>\n" +
+          "DB Allowed IPv6 CIDRs: <nil>\n" +
+          "Restrictions applied successfully: false\n",
+      );
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("prints `Restrictions applied successfully: false` when status is `stored`", () => {
+    const stored: typeof V1GetNetworkRestrictionsOutput.Type = {
+      entitlement: "allowed",
+      config: { dbAllowedCidrs: ["1.2.3.0/24"], dbAllowedCidrsV6: [] },
+      status: "stored",
+    };
+    const { layer, out } = setup({ response: stored });
+    return Effect.gen(function* () {
+      yield* legacyNetworkRestrictionsGet({ projectRef: Option.none() });
+      expect(out.stdoutText).toBe(
+        "DB Allowed IPv4 CIDRs: &[1.2.3.0/24]\n" +
+          "DB Allowed IPv6 CIDRs: &[]\n" +
+          "Restrictions applied successfully: false\n",
+      );
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("emits a structured JSON success payload via --output-format=json", () => {
+    const { layer, out } = setup({ format: "json", response: APPLIED_WITH_CIDRS });
+    return Effect.gen(function* () {
+      yield* legacyNetworkRestrictionsGet({ projectRef: Option.none() });
+      const success = out.messages.find((m) => m.type === "success");
+      expect(success).toBeDefined();
+      expect(success?.data).toMatchObject({
+        status: "applied",
+        config: {
+          dbAllowedCidrs: ["1.2.3.0/24", "5.6.7.0/24"],
+          dbAllowedCidrsV6: ["2001:db8::/64"],
+        },
+      });
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("emits a result event via --output-format=stream-json", () => {
+    const { layer, out } = setup({ format: "stream-json", response: APPLIED_WITH_CIDRS });
+    return Effect.gen(function* () {
+      yield* legacyNetworkRestrictionsGet({ projectRef: Option.none() });
+      const success = out.messages.find((m) => m.type === "success");
+      expect(success).toBeDefined();
+      expect(success?.data).toMatchObject({ status: "applied" });
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("emits Go-compatible JSON when --output=json", () => {
+    const { layer, out } = setup({ goOutput: "json", response: APPLIED_WITH_CIDRS });
+    return Effect.gen(function* () {
+      yield* legacyNetworkRestrictionsGet({ projectRef: Option.none() });
+      expect(out.stdoutText.startsWith("{")).toBe(true);
+      expect(out.stdoutText.endsWith("\n")).toBe(true);
+      expect(out.stdoutText).toContain('"status": "applied"');
+      expect(out.stdoutText).toContain('"dbAllowedCidrs"');
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("emits Go-compatible YAML when --output=yaml", () => {
+    const { layer, out } = setup({ goOutput: "yaml", response: APPLIED_WITH_CIDRS });
+    return Effect.gen(function* () {
+      yield* legacyNetworkRestrictionsGet({ projectRef: Option.none() });
+      expect(out.stdoutText).toContain("status: applied");
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("emits Go-compatible TOML when --output=toml", () => {
+    const { layer, out } = setup({ goOutput: "toml", response: APPLIED_WITH_CIDRS });
+    return Effect.gen(function* () {
+      yield* legacyNetworkRestrictionsGet({ projectRef: Option.none() });
+      expect(out.stdoutText).toContain("status = ");
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("emits Go-compatible env output when --output=env", () => {
+    const { layer, out } = setup({ goOutput: "env", response: APPLIED_NO_CIDRS });
+    return Effect.gen(function* () {
+      yield* legacyNetworkRestrictionsGet({ projectRef: Option.none() });
+      expect(out.stdoutText).toContain('STATUS="applied"');
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("treats --output pretty identically to text mode", () => {
+    const { layer, out } = setup({ goOutput: "pretty", response: APPLIED_NO_CIDRS });
+    return Effect.gen(function* () {
+      yield* legacyNetworkRestrictionsGet({ projectRef: Option.none() });
+      expect(out.stdoutText).toBe(
+        "DB Allowed IPv4 CIDRs: &[]\n" +
+          "DB Allowed IPv6 CIDRs: &[]\n" +
+          "Restrictions applied successfully: true\n",
+      );
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("Go --output wins over TS --output-format when both are set", () => {
+    const { layer, out } = setup({
+      format: "json",
+      goOutput: "yaml",
+      response: APPLIED_WITH_CIDRS,
+    });
+    return Effect.gen(function* () {
+      yield* legacyNetworkRestrictionsGet({ projectRef: Option.none() });
+      expect(out.stdoutText.startsWith("{")).toBe(false);
+      expect(out.stdoutText).toContain("status: applied");
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("hits the GET /v1/projects/{ref}/network-restrictions URL", () => {
+    const { layer, api } = setup({ response: APPLIED_WITH_CIDRS });
+    return Effect.gen(function* () {
+      yield* legacyNetworkRestrictionsGet({ projectRef: Option.none() });
+      expect(api.requests).toHaveLength(1);
+      expect(api.requests[0]?.method).toBe("GET");
+      expect(api.requests[0]?.url).toContain(
+        `/v1/projects/${LEGACY_VALID_REF}/network-restrictions`,
+      );
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("uses --project-ref flag value over LegacyCliConfig.projectId", () => {
+    const flagRef = "zzzzzzzzzzzzzzzzzzzz";
+    const { layer, api } = setup({ response: APPLIED_WITH_CIDRS });
+    return Effect.gen(function* () {
+      yield* legacyNetworkRestrictionsGet({ projectRef: Option.some(flagRef) });
+      expect(api.requests[0]?.url).toContain(`/v1/projects/${flagRef}/`);
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("reports a Go-compatible error message when the API returns a non-200 status", () => {
+    const { layer } = setup({ status: 503, response: APPLIED_WITH_CIDRS });
+    return Effect.gen(function* () {
+      const exit = yield* Effect.exit(legacyNetworkRestrictionsGet({ projectRef: Option.none() }));
+      expect(Exit.isFailure(exit)).toBe(true);
+      if (Exit.isFailure(exit)) {
+        const errorJson = JSON.stringify(exit.cause);
+        expect(errorJson).toContain("LegacyNetworkRestrictionsGetUnexpectedStatusError");
+        expect(errorJson).toContain("failed to retrieve network restrictions; received:");
+      }
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("reports a Go-compatible error message when the network is unreachable", () => {
+    const { layer } = setup({ network: "fail" });
+    return Effect.gen(function* () {
+      const exit = yield* Effect.exit(legacyNetworkRestrictionsGet({ projectRef: Option.none() }));
+      expect(Exit.isFailure(exit)).toBe(true);
+      if (Exit.isFailure(exit)) {
+        const errorJson = JSON.stringify(exit.cause);
+        expect(errorJson).toContain("LegacyNetworkRestrictionsGetNetworkError");
+        expect(errorJson).toContain("failed to retrieve network restrictions:");
+      }
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("emits a fail event when withJsonErrorHandling wraps a JSON-mode error", () => {
+    const { layer, out } = setup({ format: "json", status: 503, response: APPLIED_WITH_CIDRS });
+    return Effect.gen(function* () {
+      yield* legacyNetworkRestrictionsGet({ projectRef: Option.none() }).pipe(
+        withJsonErrorHandling,
+      );
+      expect(out.messages.some((m) => m.type === "fail")).toBe(true);
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("flushes telemetry and writes linked-project cache on success", () => {
+    const { layer, telemetry, cache } = setupTracked({ response: APPLIED_WITH_CIDRS });
+    return Effect.gen(function* () {
+      yield* legacyNetworkRestrictionsGet({ projectRef: Option.none() });
+      expect(telemetry.flushed).toBe(true);
+      expect(cache.cached).toBe(true);
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("flushes telemetry even on API failure", () => {
+    const { layer, telemetry, cache } = setupTracked({
+      status: 500,
+      response: APPLIED_WITH_CIDRS,
+    });
+    return Effect.gen(function* () {
+      const exit = yield* Effect.exit(
+        legacyNetworkRestrictionsGet({ projectRef: Option.none() }).pipe(Effect.provide(layer)),
+      );
+      expect(Exit.isFailure(exit)).toBe(true);
+      expect(telemetry.flushed).toBe(true);
+      // Linked-project cache wraps the inner effect, so it still fires after ref
+      // resolution succeeded — matches Go's PersistentPostRun once ref is known.
+      expect(cache.cached).toBe(true);
+    });
+  });
+});
diff --git a/apps/cli/src/legacy/commands/network-restrictions/network-restrictions.cidr.ts b/apps/cli/src/legacy/commands/network-restrictions/network-restrictions.cidr.ts
new file mode 100644
index 0000000000..5d2f335219
--- /dev/null
+++ b/apps/cli/src/legacy/commands/network-restrictions/network-restrictions.cidr.ts
@@ -0,0 +1,179 @@
+import { isIP } from "node:net";
+
+export interface ParsedCidr {
+  readonly kind: "v4" | "v6";
+  readonly address: string;
+  readonly mask: number;
+  /**
+   * Set when the input was an IPv4-mapped IPv6 form (RFC 4291 §2.5.5.2,
+   * e.g. `::ffff:10.0.0.1`). Holds the unwrapped IPv4 dotted-decimal so
+   * `isPrivateCidr` and partitioning use Go's `To4()`-driven semantics.
+   * `kind` is `"v4"` in this case; the original IPv6 mask range (0-128)
+   * still applies, so we keep `mask` as the caller supplied it.
+   */
+  readonly v4MappedAddress?: string;
+}
+
+/**
+ * Parses a CIDR string the same way Go's `net.ParseCIDR` does for the inputs
+ * accepted by `supabase network-restrictions update` (see
+ * `apps/cli-go/internal/restrictions/update/update.go:21`).
+ *
+ * Returns `null` if the input is not a well-formed CIDR; callers translate
+ * `null` into `LegacyNetworkRestrictionsInvalidCidrError`.
+ */
+export function parseCidr(input: string): ParsedCidr | null {
+  const slashIdx = input.indexOf("/");
+  if (slashIdx === -1) return null;
+  if (input.indexOf("/", slashIdx + 1) !== -1) return null;
+
+  const address = input.slice(0, slashIdx);
+  const maskStr = input.slice(slashIdx + 1);
+  if (maskStr.length === 0 || !/^\d+$/.test(maskStr)) return null;
+  // `Number.parseInt(..., 10)` accepts leading zeros (`/024` → 24). Go's
+  // `net.ParseCIDR` does the same, so we keep parity intentionally.
+  const mask = Number.parseInt(maskStr, 10);
+
+  const family = isIP(address);
+  if (family === 4) {
+    if (mask < 0 || mask > 32) return null;
+    return { kind: "v4", address, mask };
+  }
+  if (family === 6) {
+    if (mask < 0 || mask > 128) return null;
+    // Go's `net.IP.To4()` unwraps IPv4-mapped IPv6 addresses (`::ffff:a.b.c.d`)
+    // to their v4 form before `IsPrivate()` and bucket classification. Mirror
+    // that here so `::ffff:10.0.0.1/128` is rejected as private and routed to
+    // `dbAllowedCidrs` (v4 list), not `dbAllowedCidrsV6`.
+    const v4Mapped = extractIpv4MappedAddress(address);
+    if (v4Mapped !== null) {
+      return { kind: "v4", address, mask, v4MappedAddress: v4Mapped };
+    }
+    return { kind: "v6", address, mask };
+  }
+  return null;
+}
+
+/**
+ * Mirrors Go's `net.IP.IsPrivate()` (`apps/cli-go/internal/restrictions/update/update.go:25`)
+ * for the address families accepted by `parseCidr`.
+ *
+ * - IPv4 (RFC 1918): `10.0.0.0/8`, `172.16.0.0/12`, `192.168.0.0/16`.
+ * - IPv6 (RFC 4193): `fc00::/7` — top 7 bits equal `1111110` (first byte `0xFC` or `0xFD`).
+ */
+export function isPrivateCidr(cidr: ParsedCidr): boolean {
+  if (cidr.kind === "v4") {
+    // IPv4-mapped IPv6 inputs surface here with `v4MappedAddress` set; check
+    // that unwrapped form so Go's `To4()` semantics apply.
+    const octets = cidr.v4MappedAddress ?? cidr.address;
+    const parts = octets.split(".");
+    if (parts.length !== 4) return false;
+    const a = Number.parseInt(parts[0]!, 10);
+    const b = Number.parseInt(parts[1]!, 10);
+    if (a === 10) return true;
+    if (a === 172 && b >= 16 && b <= 31) return true;
+    if (a === 192 && b === 168) return true;
+    return false;
+  }
+  const firstByte = parseFirstIpv6Byte(cidr.address);
+  if (firstByte === null) return false;
+  return (firstByte & 0xfe) === 0xfc;
+}
+
+/**
+ * Detects the RFC 4291 IPv4-mapped IPv6 form and returns the unwrapped IPv4
+ * dotted-decimal. Per the spec the high 80 bits must be zero and the next 16
+ * bits must be exactly `0xFFFF` (case-insensitive `ffff`); anything else is a
+ * regular IPv6 address.
+ *
+ * Supports the canonical short form (`::ffff:a.b.c.d`) and the fully-expanded
+ * long form (`0:0:0:0:0:ffff:a.b.c.d`), which are the only forms Node's
+ * `isIP` produces a "6" verdict for and that Go's `To4()` unwraps.
+ */
+function extractIpv4MappedAddress(address: string): string | null {
+  const lowered = address.toLowerCase();
+  // Short form: ::ffff:a.b.c.d (overwhelmingly the common case).
+  const shortPrefix = "::ffff:";
+  if (lowered.startsWith(shortPrefix)) {
+    const candidate = lowered.slice(shortPrefix.length);
+    return isIP(candidate) === 4 ? candidate : null;
+  }
+  // Long form: 0:0:0:0:0:ffff:a.b.c.d
+  const longMatch = /^(?:0:){5}ffff:(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})$/.exec(lowered);
+  if (longMatch !== null && longMatch[1] !== undefined && isIP(longMatch[1]) === 4) {
+    return longMatch[1];
+  }
+  return null;
+}
+
+function parseFirstIpv6Byte(address: string): number | null {
+  // Addresses starting with `::` have a leading all-zero hextet, so the high
+  // byte is unambiguously 0 (which is not in `fc00::/7`).
+  if (address.startsWith(":")) return 0;
+  const firstColon = address.indexOf(":");
+  if (firstColon === -1) return null;
+  const firstHextet = address.slice(0, firstColon);
+  if (firstHextet.length === 0 || firstHextet.length > 4) return null;
+  if (!/^[0-9a-fA-F]+$/.test(firstHextet)) return null;
+  // The first hextet is a big-endian 16-bit value. Left-padding to 4 hex
+  // digits and slicing the first two gives the *high* byte (which is what
+  // Go's `ip[0]` corresponds to). For example `"fc"` represents `0x00fc`, so
+  // the high byte is `0x00` — correctly NOT in `fc00::/7`.
+  const padded = firstHextet.padStart(4, "0");
+  return Number.parseInt(padded.slice(0, 2), 16);
+}
+
+/**
+ * Validate every input string and partition into IPv4 / IPv6 lists in the same
+ * order Go does (`apps/cli-go/internal/restrictions/update/update.go:20-33`).
+ *
+ * Returns either the partitioned lists or a discriminated error describing
+ * which input failed and why. Callers translate the discriminated error into
+ * the appropriate `Data.TaggedError` so telemetry and stderr render Go's
+ * verbatim message.
+ */
+export function validateAndPartitionCidrs(
+  inputs: readonly string[],
+  bypassCidrChecks: boolean,
+):
+  | { readonly ok: true; readonly v4: readonly string[]; readonly v6: readonly string[] }
+  | { readonly ok: false; readonly kind: "invalid" | "private"; readonly input: string } {
+  const v4: string[] = [];
+  const v6: string[] = [];
+  for (const cidr of inputs) {
+    const parsed = parseCidr(cidr);
+    if (parsed === null) {
+      return { ok: false, kind: "invalid", input: cidr };
+    }
+    if (!bypassCidrChecks && isPrivateCidr(parsed)) {
+      return { ok: false, kind: "private", input: cidr };
+    }
+    if (parsed.kind === "v4") {
+      v4.push(cidr);
+    } else {
+      v6.push(cidr);
+    }
+  }
+  return { ok: true, v4, v6 };
+}
+
+/**
+ * Splits the V2 PATCH response shape (`config.dbAllowedCidrs: Array<{address, type}>`)
+ * into the two flat string arrays the Go output template expects. Order matches
+ * `apps/cli-go/internal/restrictions/update/update.go:75-83`.
+ *
+ * Lives next to `parseCidr` / `validateAndPartitionCidrs` because it performs
+ * the same v4/v6 partitioning, just sourced from the response shape instead of
+ * raw CLI input.
+ */
+export function partitionPatchedCidrs(
+  items: ReadonlyArray<{ readonly address: string; readonly type: "v4" | "v6" }> | undefined,
+): { readonly v4: string[]; readonly v6: string[] } {
+  const v4: string[] = [];
+  const v6: string[] = [];
+  for (const item of items ?? []) {
+    if (item.type === "v4") v4.push(item.address);
+    else v6.push(item.address);
+  }
+  return { v4, v6 };
+}
diff --git a/apps/cli/src/legacy/commands/network-restrictions/network-restrictions.cidr.unit.test.ts b/apps/cli/src/legacy/commands/network-restrictions/network-restrictions.cidr.unit.test.ts
new file mode 100644
index 0000000000..dd62c07923
--- /dev/null
+++ b/apps/cli/src/legacy/commands/network-restrictions/network-restrictions.cidr.unit.test.ts
@@ -0,0 +1,292 @@
+import { describe, expect, it } from "vitest";
+
+import {
+  isPrivateCidr,
+  parseCidr,
+  validateAndPartitionCidrs,
+} from "./network-restrictions.cidr.ts";
+
+describe("parseCidr", () => {
+  it("parses a single IPv4 CIDR", () => {
+    expect(parseCidr("1.2.3.0/24")).toEqual({ kind: "v4", address: "1.2.3.0", mask: 24 });
+  });
+
+  it("parses a /32 IPv4 CIDR", () => {
+    expect(parseCidr("12.3.4.5/32")).toEqual({ kind: "v4", address: "12.3.4.5", mask: 32 });
+  });
+
+  it("parses a /0 IPv4 CIDR", () => {
+    expect(parseCidr("0.0.0.0/0")).toEqual({ kind: "v4", address: "0.0.0.0", mask: 0 });
+  });
+
+  it("parses a single IPv6 CIDR", () => {
+    expect(parseCidr("2001:db8:abcd:0012::0/64")).toEqual({
+      kind: "v6",
+      address: "2001:db8:abcd:0012::0",
+      mask: 64,
+    });
+  });
+
+  it("parses an IPv6 /128 CIDR", () => {
+    expect(parseCidr("::1/128")).toEqual({ kind: "v6", address: "::1", mask: 128 });
+  });
+
+  it("rejects an input missing the `/mask` suffix", () => {
+    expect(parseCidr("12.3.4.5")).toBeNull();
+  });
+
+  it("rejects an input with multiple `/` characters", () => {
+    expect(parseCidr("1.2.3.0/24/foo")).toBeNull();
+  });
+
+  it("rejects an empty mask", () => {
+    expect(parseCidr("1.2.3.0/")).toBeNull();
+  });
+
+  it("rejects a non-numeric mask", () => {
+    expect(parseCidr("1.2.3.0/abc")).toBeNull();
+  });
+
+  it("rejects an IPv4 mask > 32", () => {
+    expect(parseCidr("1.2.3.0/33")).toBeNull();
+  });
+
+  it("rejects an IPv6 mask > 128", () => {
+    expect(parseCidr("::1/129")).toBeNull();
+  });
+
+  it("rejects an IPv4 octet > 255", () => {
+    expect(parseCidr("256.1.2.3/24")).toBeNull();
+  });
+
+  it("rejects malformed IPv6 with too many groups", () => {
+    expect(parseCidr("1:2:3:4:5:6:7:8:9/64")).toBeNull();
+  });
+
+  it("rejects malformed IPv6 with invalid hex", () => {
+    expect(parseCidr("zzzz::1/64")).toBeNull();
+  });
+
+  it("rejects an empty string", () => {
+    expect(parseCidr("")).toBeNull();
+  });
+
+  it("accepts leading zeros in the mask to match Go's parser", () => {
+    expect(parseCidr("1.2.3.0/024")).toEqual({ kind: "v4", address: "1.2.3.0", mask: 24 });
+  });
+
+  it("reclassifies IPv4-mapped IPv6 inputs as v4 to match Go's To4() semantics", () => {
+    expect(parseCidr("::ffff:10.0.0.1/128")).toEqual({
+      kind: "v4",
+      address: "::ffff:10.0.0.1",
+      mask: 128,
+      v4MappedAddress: "10.0.0.1",
+    });
+  });
+
+  it("normalises an uppercase IPv4-mapped prefix to v4 (`::FFFF:`)", () => {
+    expect(parseCidr("::FFFF:1.2.3.4/128")?.kind).toBe("v4");
+  });
+
+  it("preserves the IPv6 mask range (0-128) for IPv4-mapped inputs", () => {
+    // /104 is out of range for v4 (0-32) but valid for IPv4-mapped IPv6.
+    const parsed = parseCidr("::ffff:10.0.0.0/104");
+    expect(parsed).not.toBeNull();
+    expect(parsed?.mask).toBe(104);
+    expect(parsed?.kind).toBe("v4");
+  });
+
+  it("treats the long-form IPv4-mapped IPv6 address as v4 (0:0:0:0:0:ffff:a.b.c.d)", () => {
+    const parsed = parseCidr("0:0:0:0:0:ffff:10.0.0.1/128");
+    expect(parsed?.kind).toBe("v4");
+    expect(parsed?.v4MappedAddress).toBe("10.0.0.1");
+  });
+
+  it("does not treat ::feff:1.2.3.4 as IPv4-mapped (only ::ffff: qualifies per RFC 4291)", () => {
+    // Go's `To4()` returns nil for `::feff:1.2.3.4`, so the address stays v6
+    // and isPrivateCidr falls through to the first-byte check (which yields
+    // 0 for `::`-leading addresses).
+    expect(parseCidr("::feff:1.2.3.4/128")).toEqual({
+      kind: "v6",
+      address: "::feff:1.2.3.4",
+      mask: 128,
+    });
+  });
+});
+
+describe("isPrivateCidr", () => {
+  it("flags 10.0.0.0/8 as private", () => {
+    expect(isPrivateCidr({ kind: "v4", address: "10.0.0.0", mask: 8 })).toBe(true);
+  });
+
+  it("flags any address in 10.0.0.0/8 as private", () => {
+    expect(isPrivateCidr({ kind: "v4", address: "10.255.255.255", mask: 32 })).toBe(true);
+  });
+
+  it("flags 172.16.0.0 - 172.31.255.255 as private", () => {
+    expect(isPrivateCidr({ kind: "v4", address: "172.16.0.0", mask: 12 })).toBe(true);
+    expect(isPrivateCidr({ kind: "v4", address: "172.31.255.255", mask: 32 })).toBe(true);
+  });
+
+  it("does NOT flag 172.15.0.0 or 172.32.0.0 as private", () => {
+    expect(isPrivateCidr({ kind: "v4", address: "172.15.0.0", mask: 12 })).toBe(false);
+    expect(isPrivateCidr({ kind: "v4", address: "172.32.0.0", mask: 12 })).toBe(false);
+  });
+
+  it("flags 192.168.0.0/16 as private", () => {
+    expect(isPrivateCidr({ kind: "v4", address: "192.168.0.0", mask: 16 })).toBe(true);
+    expect(isPrivateCidr({ kind: "v4", address: "192.168.255.255", mask: 32 })).toBe(true);
+  });
+
+  it("does NOT flag 192.169.0.0 as private", () => {
+    expect(isPrivateCidr({ kind: "v4", address: "192.169.0.0", mask: 16 })).toBe(false);
+  });
+
+  it("does NOT flag a public IPv4 (1.2.3.4) as private", () => {
+    expect(isPrivateCidr({ kind: "v4", address: "1.2.3.4", mask: 32 })).toBe(false);
+  });
+
+  it("flags fc00::/7 IPv6 addresses (0xFC) as private", () => {
+    expect(isPrivateCidr({ kind: "v6", address: "fc00::1", mask: 7 })).toBe(true);
+  });
+
+  it("flags fd00:: IPv6 addresses (0xFD) as private", () => {
+    expect(isPrivateCidr({ kind: "v6", address: "fd12::1", mask: 8 })).toBe(true);
+  });
+
+  it("does NOT flag a non-fc/fd IPv6 address as private", () => {
+    expect(isPrivateCidr({ kind: "v6", address: "2001:db8::1", mask: 32 })).toBe(false);
+  });
+
+  it("does NOT flag :: (all-zero) as private", () => {
+    expect(isPrivateCidr({ kind: "v6", address: "::1", mask: 128 })).toBe(false);
+  });
+
+  it("flags an IPv4-mapped private IPv6 address (::ffff:10.0.0.1) as private", () => {
+    expect(
+      isPrivateCidr({
+        kind: "v4",
+        address: "::ffff:10.0.0.1",
+        mask: 128,
+        v4MappedAddress: "10.0.0.1",
+      }),
+    ).toBe(true);
+  });
+
+  it("flags an IPv4-mapped 192.168.x private IPv6 address as private", () => {
+    expect(
+      isPrivateCidr({
+        kind: "v4",
+        address: "::ffff:192.168.0.1",
+        mask: 128,
+        v4MappedAddress: "192.168.0.1",
+      }),
+    ).toBe(true);
+  });
+
+  it("does NOT flag an IPv4-mapped public IPv6 address (::ffff:1.2.3.4) as private", () => {
+    expect(
+      isPrivateCidr({
+        kind: "v4",
+        address: "::ffff:1.2.3.4",
+        mask: 128,
+        v4MappedAddress: "1.2.3.4",
+      }),
+    ).toBe(false);
+  });
+});
+
+describe("validateAndPartitionCidrs", () => {
+  it("returns empty arrays for empty input", () => {
+    expect(validateAndPartitionCidrs([], false)).toEqual({ ok: true, v4: [], v6: [] });
+  });
+
+  it("partitions mixed v4/v6 inputs while preserving input order", () => {
+    const result = validateAndPartitionCidrs(
+      ["12.3.4.5/32", "2001:db8:abcd:0012::0/64", "1.2.3.1/24"],
+      false,
+    );
+    expect(result).toEqual({
+      ok: true,
+      v4: ["12.3.4.5/32", "1.2.3.1/24"],
+      v6: ["2001:db8:abcd:0012::0/64"],
+    });
+  });
+
+  it("rejects an invalid CIDR with the offending input", () => {
+    expect(validateAndPartitionCidrs(["12.3.4.5"], false)).toEqual({
+      ok: false,
+      kind: "invalid",
+      input: "12.3.4.5",
+    });
+  });
+
+  it("reports the first failing input when multiple inputs are present", () => {
+    expect(validateAndPartitionCidrs(["12.3.4.5", "10.0.0.0/8", "1.2.3.1/24"], false)).toEqual({
+      ok: false,
+      kind: "invalid",
+      input: "12.3.4.5",
+    });
+  });
+
+  it("rejects an RFC-1918 IPv4 private address by default", () => {
+    expect(validateAndPartitionCidrs(["12.3.4.5/32", "10.0.0.0/8", "1.2.3.1/24"], false)).toEqual({
+      ok: false,
+      kind: "private",
+      input: "10.0.0.0/8",
+    });
+  });
+
+  it("rejects each RFC-1918 IPv4 prefix", () => {
+    expect(validateAndPartitionCidrs(["172.16.0.0/12"], false).ok).toBe(false);
+    expect(validateAndPartitionCidrs(["192.168.0.0/16"], false).ok).toBe(false);
+  });
+
+  it("rejects an RFC-4193 IPv6 private address by default", () => {
+    expect(validateAndPartitionCidrs(["fc00::1/64"], false)).toEqual({
+      ok: false,
+      kind: "private",
+      input: "fc00::1/64",
+    });
+  });
+
+  it("bypasses private-IP rejection when bypassCidrChecks=true", () => {
+    expect(validateAndPartitionCidrs(["10.0.0.0/8"], true)).toEqual({
+      ok: true,
+      v4: ["10.0.0.0/8"],
+      v6: [],
+    });
+  });
+
+  it("bypasses v6 private-IP rejection when bypassCidrChecks=true", () => {
+    expect(validateAndPartitionCidrs(["fc00::1/64"], true)).toEqual({
+      ok: true,
+      v4: [],
+      v6: ["fc00::1/64"],
+    });
+  });
+
+  it("bypassCidrChecks does NOT suppress parse failures", () => {
+    expect(validateAndPartitionCidrs(["12.3.4.5"], true)).toEqual({
+      ok: false,
+      kind: "invalid",
+      input: "12.3.4.5",
+    });
+  });
+
+  it("rejects an IPv4-mapped private IPv6 address by default (Go parity)", () => {
+    expect(validateAndPartitionCidrs(["::ffff:10.0.0.0/104"], false)).toEqual({
+      ok: false,
+      kind: "private",
+      input: "::ffff:10.0.0.0/104",
+    });
+  });
+
+  it("routes an IPv4-mapped IPv6 input into the v4 bucket (preserves input string)", () => {
+    expect(validateAndPartitionCidrs(["::ffff:1.2.3.4/128"], false)).toEqual({
+      ok: true,
+      v4: ["::ffff:1.2.3.4/128"],
+      v6: [],
+    });
+  });
+});
diff --git a/apps/cli/src/legacy/commands/network-restrictions/network-restrictions.errors.ts b/apps/cli/src/legacy/commands/network-restrictions/network-restrictions.errors.ts
new file mode 100644
index 0000000000..8e7b0b2bf0
--- /dev/null
+++ b/apps/cli/src/legacy/commands/network-restrictions/network-restrictions.errors.ts
@@ -0,0 +1,53 @@
+import { Data } from "effect";
+
+export class LegacyNetworkRestrictionsGetNetworkError extends Data.TaggedError(
+  "LegacyNetworkRestrictionsGetNetworkError",
+)<{
+  readonly message: string;
+}> {}
+
+export class LegacyNetworkRestrictionsGetUnexpectedStatusError extends Data.TaggedError(
+  "LegacyNetworkRestrictionsGetUnexpectedStatusError",
+)<{
+  readonly status: number;
+  readonly body: string;
+  readonly message: string;
+}> {}
+
+export class LegacyNetworkRestrictionsUpdateNetworkError extends Data.TaggedError(
+  "LegacyNetworkRestrictionsUpdateNetworkError",
+)<{
+  readonly message: string;
+}> {}
+
+export class LegacyNetworkRestrictionsUpdateUnexpectedStatusError extends Data.TaggedError(
+  "LegacyNetworkRestrictionsUpdateUnexpectedStatusError",
+)<{
+  readonly status: number;
+  readonly body: string;
+  readonly message: string;
+}> {}
+
+export class LegacyNetworkRestrictionsInvalidCidrError extends Data.TaggedError(
+  "LegacyNetworkRestrictionsInvalidCidrError",
+)<{
+  readonly input: string;
+  readonly message: string;
+}> {
+  constructor(args: { readonly input: string }) {
+    // Verbatim Go string from `apps/cli-go/internal/restrictions/update/update.go:23`.
+    super({ input: args.input, message: `failed to parse IP: ${args.input}` });
+  }
+}
+
+export class LegacyNetworkRestrictionsPrivateIpError extends Data.TaggedError(
+  "LegacyNetworkRestrictionsPrivateIpError",
+)<{
+  readonly input: string;
+  readonly message: string;
+}> {
+  constructor(args: { readonly input: string }) {
+    // Verbatim Go string from `apps/cli-go/internal/restrictions/update/update.go:26`.
+    super({ input: args.input, message: `private IP provided: ${args.input}` });
+  }
+}
diff --git a/apps/cli/src/legacy/commands/network-restrictions/network-restrictions.format.ts b/apps/cli/src/legacy/commands/network-restrictions/network-restrictions.format.ts
new file mode 100644
index 0000000000..6610c77952
--- /dev/null
+++ b/apps/cli/src/legacy/commands/network-restrictions/network-restrictions.format.ts
@@ -0,0 +1,36 @@
+// Go's `fmt.Printf("%+v", x)` produces different bytes depending on whether `x`
+// is a nil `*[]string` (the API field is absent) or a non-nil pointer to a
+// possibly-empty slice. Specifically:
+//
+//   *[]string(nil) -> "<nil>"
+//   &[]string{}    -> "&[]"
+//   &[]string{"a"} -> "&[a]"
+//   &[]string{"a", "b"} -> "&[a b]"  (single-space separated, no quoting)
+//
+// The GET and POST handlers print `resp.JSON*.Config.DbAllowedCidrs` directly,
+// which is `*[]string` and therefore tri-state. The PATCH handler prints
+// `&localSlice`, which is always non-nil and so renders as `&[]` or `&[...]`.
+// `value === undefined` represents the GET/POST "field absent" case.
+
+interface PrintableStatus {
+  readonly v4: readonly string[] | undefined;
+  readonly v6: readonly string[] | undefined;
+  readonly applied: boolean;
+}
+
+function formatGoSlice(value: readonly string[] | undefined): string {
+  if (value === undefined) return "<nil>";
+  return `&[${value.join(" ")}]`;
+}
+
+/**
+ * Reproduces the three-line `fmt.Printf` block emitted by Go's
+ * `apps/cli-go/internal/restrictions/{get,update}/*.go` byte-for-byte.
+ */
+export function printNetworkRestrictionsStatus(input: PrintableStatus): string {
+  return (
+    `DB Allowed IPv4 CIDRs: ${formatGoSlice(input.v4)}\n` +
+    `DB Allowed IPv6 CIDRs: ${formatGoSlice(input.v6)}\n` +
+    `Restrictions applied successfully: ${input.applied ? "true" : "false"}\n`
+  );
+}
diff --git a/apps/cli/src/legacy/commands/network-restrictions/update/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/network-restrictions/update/SIDE_EFFECTS.md
index 7e8a539303..fb31633592 100644
--- a/apps/cli/src/legacy/commands/network-restrictions/update/SIDE_EFFECTS.md
+++ b/apps/cli/src/legacy/commands/network-restrictions/update/SIDE_EFFECTS.md
@@ -2,59 +2,114 @@
 
 ## Files Read
 
-| Path                       | Format                    | When                                                       |
-| -------------------------- | ------------------------- | ---------------------------------------------------------- |
-| `~/.supabase/access-token` | plain text (token string) | when `SUPABASE_ACCESS_TOKEN` unset and keyring unavailable |
+| Path                                   | Format                    | When                                                          |
+| -------------------------------------- | ------------------------- | ------------------------------------------------------------- |
+| `~/.supabase/access-token`             | plain text (token string) | when `SUPABASE_ACCESS_TOKEN` unset and keyring unavailable    |
+| `<workdir>/supabase/.temp/project-ref` | plain text (project ref)  | when `--project-ref` flag and `PROJECT_ID` env are both unset |
 
 ## Files Written
 
-| Path | Format | When |
-| ---- | ------ | ---- |
-| —    | —      | —    |
+| Path                                             | Format | When                                                                            |
+| ------------------------------------------------ | ------ | ------------------------------------------------------------------------------- |
+| `~/.supabase/<workdir-hash>/linked-project.json` | JSON   | always (after ref resolution), via `Effect.ensuring` — success and HTTP failure |
+| `~/.supabase/telemetry.json`                     | JSON   | always, via outermost `Effect.ensuring` — including CIDR validation failures    |
 
 ## API Routes
 
-| Method | Path                                      | Auth         | Request body                                           | Response (used fields)          |
-| ------ | ----------------------------------------- | ------------ | ------------------------------------------------------ | ------------------------------- |
-| `POST` | `/v1/projects/{ref}/network-restrictions` | Bearer token | `{allowed_cidr_ranges: string[], bypass_cidr_checks?}` | `{allowed_cidr_ranges, status}` |
+| Method  | Path                                            | Auth         | Request body                                                        | Response (used fields)                                                                                 |
+| ------- | ----------------------------------------------- | ------------ | ------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------ |
+| `POST`  | `/v1/projects/{ref}/network-restrictions/apply` | Bearer token | `{ dbAllowedCidrs: string[], dbAllowedCidrsV6: string[] }`          | `{ config: { dbAllowedCidrs?, dbAllowedCidrsV6? }, status }` (`V1UpdateNetworkRestrictionsOutput`)     |
+| `PATCH` | `/v1/projects/{ref}/network-restrictions`       | Bearer token | `{ add: { dbAllowedCidrs: string[], dbAllowedCidrsV6: string[] } }` | `{ config: { dbAllowedCidrs?: Array<{address, type}> }, status }` (`V1PatchNetworkRestrictionsOutput`) |
+
+`POST /apply` is the default (replace mode). `PATCH` is used when `--append=true`.
+
+Both endpoints always receive the full `dbAllowedCidrs` / `dbAllowedCidrsV6` arrays (empty
+when no `--db-allow-cidr` was supplied), matching Go's `&[]string{}` initialization.
 
 ## Environment Variables
 
-| Variable                | Purpose                                              | Required?                                               |
-| ----------------------- | ---------------------------------------------------- | ------------------------------------------------------- |
-| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `~/.supabase/access-token`) |
-| `SUPABASE_API_URL`      | override Management API base URL                     | no (defaults to `https://api.supabase.com`)             |
+| Variable                | Purpose                                              | Required?                                                |
+| ----------------------- | ---------------------------------------------------- | -------------------------------------------------------- |
+| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `~/.supabase/access-token`)  |
+| `SUPABASE_API_URL`      | override Management API base URL                     | no (defaults to `https://api.supabase.com`)              |
+| `PROJECT_ID`            | project ref fallback when `--project-ref` is unset   | no (falls back to `supabase/.temp/project-ref` → prompt) |
 
 ## Exit Codes
 
-| Code | Condition                                                       |
-| ---- | --------------------------------------------------------------- |
-| `0`  | success — network restrictions updated                          |
-| `1`  | authentication error — no valid token found                     |
-| `1`  | API error — non-2xx response from network restrictions endpoint |
-| `1`  | invalid CIDR address provided                                   |
-| `1`  | network / connection failure                                    |
+| Code | Condition                                                                                         |
+| ---- | ------------------------------------------------------------------------------------------------- |
+| `0`  | success — network restrictions updated and status printed to stdout                               |
+| `1`  | CIDR parse failure — `LegacyNetworkRestrictionsInvalidCidrError` (`failed to parse IP: <input>`)  |
+| `1`  | private-IP rejection — `LegacyNetworkRestrictionsPrivateIpError` (`private IP provided: <input>`) |
+| `1`  | project ref unresolved (`LegacyProjectNotLinkedError` / `LegacyInvalidProjectRefError`)           |
+| `1`  | API non-201 (POST) / non-200 (PATCH) — `LegacyNetworkRestrictionsUpdateUnexpectedStatusError`     |
+| `1`  | transport failure — `LegacyNetworkRestrictionsUpdateNetworkError`                                 |
+
+## Telemetry Events Fired
+
+| Event                  | When                                       | Notable properties / groups                                          |
+| ---------------------- | ------------------------------------------ | -------------------------------------------------------------------- |
+| `cli_command_executed` | post-run, success or failure (via wrapper) | `exit_code`, `duration_ms`, `flags` (`--project-ref` → `<redacted>`) |
+
+Matches `apps/cli-go/internal/restrictions/update/`. Go does not fire any custom telemetry event for this command.
+
+## CIDR Validation (runs locally before any HTTP call)
+
+For each `--db-allow-cidr` value, in input order:
+
+1. Parse as CIDR (Go's `net.ParseCIDR` semantics). Failure → `failed to parse IP: <input>` and exit `1`.
+2. If the parsed IP is private (RFC 1918 for IPv4 — `10.0.0.0/8`, `172.16.0.0/12`, `192.168.0.0/16`;
+   RFC 4193 for IPv6 — `fc00::/7`) and `--bypass-cidr-checks=false`, fail with
+   `private IP provided: <input>` and exit `1`.
+3. Classify as IPv4 / IPv6 and append to the appropriate list (preserving input order).
+
+CIDR validation runs **before** project-ref resolution, so a bad CIDR short-circuits without
+touching `linked-project.json`; telemetry still flushes via the outermost `Effect.ensuring`.
 
 ## Output
 
-### `--output-format text` (Go CLI compatible)
+### `--output-format text` (default) — Go CLI compatible
 
-Prints updated network restriction configuration to stdout.
+Same three-line template as `get`. In replace mode (POST `/apply`), the arrays come
+straight from `response.config.dbAllowedCidrs` / `dbAllowedCidrsV6` (`*[]string`, can render
+as `<nil>` if the API omits a field). In append mode (PATCH), the V2 response shape is
+partitioned by `type` before being printed via Go's `&localSlice` pattern (always renders
+as `&[]` or `&[...]`, never `<nil>`).
+
+```
+DB Allowed IPv4 CIDRs: &[1.2.3.0/24]
+DB Allowed IPv6 CIDRs: &[2001:db8::/64]
+Restrictions applied successfully: true
+```
+
+`applied successfully` is `true` iff `status === "applied"` in the response.
+
+### Go `--output {json,yaml,toml,env}`
+
+Byte-identical to the Go CLI's encoders. JSON is alphabetical with trailing newline; YAML,
+TOML, and env follow the standard Go encoder rules.
+
+### Go `--output pretty`
+
+Same as `text` mode (Go's default).
 
 ### `--output-format json`
 
-Single JSON object emitted to stdout on success.
+The full `V1UpdateNetworkRestrictionsOutput` (or `V1PatchNetworkRestrictionsOutput` in
+append mode) emitted as the `success` event payload.
 
 ### `--output-format stream-json`
 
-One `result` event on success.
-
-```ndjson
-{"type":"result","data":{...}}
-```
+One `result` event whose `data` is the full response object.
 
 ## Notes
 
-- Flags: `--db-allow-cidr` (repeatable), `--bypass-cidr-checks`, `--append`.
-- Requires `--project-ref` or a linked project (`.supabase/config.json`).
-- By default, replaces all existing restrictions. Use `--append` to merge.
+- The Go `--output` flag wins over the TS `--output-format` flag when both are provided.
+- `--append=true` switches the HTTP method (`POST /apply` → `PATCH`) and the request
+  envelope (`{ dbAllowedCidrs, dbAllowedCidrsV6 }` → `{ add: { dbAllowedCidrs, dbAllowedCidrsV6 } }`).
+- `linked-project.json` writes after a successful project-ref resolution, regardless of
+  whether the subsequent API call succeeds.
+- `telemetry.json` writes on every invocation, including CIDR validation failures, ref
+  resolution failures, and API failures.
+- Go's `restrictions/update` itself does not honor `--output`. The legacy TS port honors
+  both `--output` and `--output-format` per the legacy CLAUDE.md output-parity rules.
diff --git a/apps/cli/src/legacy/commands/network-restrictions/update/update.command.ts b/apps/cli/src/legacy/commands/network-restrictions/update/update.command.ts
index ffb0b14db0..047d17eff5 100644
--- a/apps/cli/src/legacy/commands/network-restrictions/update/update.command.ts
+++ b/apps/cli/src/legacy/commands/network-restrictions/update/update.command.ts
@@ -1,5 +1,9 @@
 import { Command, Flag } from "effect/unstable/cli";
 import type * as CliCommand from "effect/unstable/cli/Command";
+
+import { withJsonErrorHandling } from "../../../../shared/output/json-error-handling.ts";
+import { legacyManagementApiRuntimeLayer } from "../../../shared/legacy-management-api-runtime.layer.ts";
+import { withLegacyCommandInstrumentation } from "../../../telemetry/legacy-command-instrumentation.ts";
 import { legacyNetworkRestrictionsUpdate } from "./update.handler.ts";
 
 const config = {
@@ -24,5 +28,11 @@ export type LegacyNetworkRestrictionsUpdateFlags = CliCommand.Command.Config.Inf
 export const legacyNetworkRestrictionsUpdateCommand = Command.make("update", config).pipe(
   Command.withDescription("Update network restrictions."),
   Command.withShortDescription("Update network restrictions"),
-  Command.withHandler((flags) => legacyNetworkRestrictionsUpdate(flags)),
+  Command.withHandler((flags) =>
+    legacyNetworkRestrictionsUpdate(flags).pipe(
+      withLegacyCommandInstrumentation({ flags }),
+      withJsonErrorHandling,
+    ),
+  ),
+  Command.provide(legacyManagementApiRuntimeLayer(["network-restrictions", "update"])),
 );
diff --git a/apps/cli/src/legacy/commands/network-restrictions/update/update.handler.ts b/apps/cli/src/legacy/commands/network-restrictions/update/update.handler.ts
index 2e88b98e82..f1af8a785f 100644
--- a/apps/cli/src/legacy/commands/network-restrictions/update/update.handler.ts
+++ b/apps/cli/src/legacy/commands/network-restrictions/update/update.handler.ts
@@ -1,17 +1,144 @@
+import type {
+  V1PatchNetworkRestrictionsOutput,
+  V1UpdateNetworkRestrictionsOutput,
+} from "@supabase/api/effect";
 import { Effect, Option } from "effect";
-import { LegacyGoProxy } from "../../../../shared/legacy/go-proxy.service.ts";
+
+import { LegacyPlatformApi } from "../../../auth/legacy-platform-api.service.ts";
+import { LegacyProjectRefResolver } from "../../../config/legacy-project-ref.service.ts";
+import { LegacyLinkedProjectCache } from "../../../telemetry/legacy-linked-project-cache.service.ts";
+import { LegacyTelemetryState } from "../../../telemetry/legacy-telemetry-state.service.ts";
+import { LegacyOutputFlag } from "../../../../shared/legacy/global-flags.ts";
+import { Output } from "../../../../shared/output/output.service.ts";
+import {
+  encodeEnv,
+  encodeGoJson,
+  encodeToml,
+  encodeYaml,
+} from "../../../shared/legacy-go-output.encoders.ts";
+import { mapLegacyHttpError } from "../../../shared/legacy-http-errors.ts";
+import { partitionPatchedCidrs, validateAndPartitionCidrs } from "../network-restrictions.cidr.ts";
+import {
+  LegacyNetworkRestrictionsInvalidCidrError,
+  LegacyNetworkRestrictionsPrivateIpError,
+  LegacyNetworkRestrictionsUpdateNetworkError,
+  LegacyNetworkRestrictionsUpdateUnexpectedStatusError,
+} from "../network-restrictions.errors.ts";
+import { printNetworkRestrictionsStatus } from "../network-restrictions.format.ts";
 import type { LegacyNetworkRestrictionsUpdateFlags } from "./update.command.ts";
 
+// Templates lifted verbatim from `apps/cli-go/internal/restrictions/update/update.go:42,45,68,71`.
+// Both POST `/apply` and PATCH `/network-restrictions` use the same Go message strings;
+// we route through one mapper and discriminate downstream by the tagged error class.
+const mapUpdateError = mapLegacyHttpError({
+  networkError: LegacyNetworkRestrictionsUpdateNetworkError,
+  statusError: LegacyNetworkRestrictionsUpdateUnexpectedStatusError,
+  networkMessage: (cause) => `failed to apply network restrictions: ${cause}`,
+  statusMessage: (_status, body) => `failed to apply network restrictions: ${body}`,
+});
+
 export const legacyNetworkRestrictionsUpdate = Effect.fn("legacy.network-restrictions.update")(
   function* (flags: LegacyNetworkRestrictionsUpdateFlags) {
-    const proxy = yield* LegacyGoProxy;
-    const args: string[] = ["network-restrictions", "update"];
-    if (Option.isSome(flags.projectRef)) args.push("--project-ref", flags.projectRef.value);
-    for (const cidr of flags.dbAllowCidr) {
-      args.push("--db-allow-cidr", cidr);
-    }
-    if (flags.bypassCidrChecks) args.push("--bypass-cidr-checks");
-    if (flags.append) args.push("--append");
-    yield* proxy.exec(args);
+    const output = yield* Output;
+    const goOutputFlag = yield* LegacyOutputFlag;
+    const api = yield* LegacyPlatformApi;
+    const resolver = yield* LegacyProjectRefResolver;
+    const linkedProjectCache = yield* LegacyLinkedProjectCache;
+    const telemetryState = yield* LegacyTelemetryState;
+
+    yield* Effect.gen(function* () {
+      // Go validates every input before any I/O (`update.go:20-33`). Run the same
+      // pass first so a malformed CIDR short-circuits without resolving the ref
+      // or writing the linked-project cache.
+      const validation = validateAndPartitionCidrs(flags.dbAllowCidr, flags.bypassCidrChecks);
+      if (!validation.ok) {
+        if (validation.kind === "invalid") {
+          return yield* new LegacyNetworkRestrictionsInvalidCidrError({ input: validation.input });
+        }
+        return yield* new LegacyNetworkRestrictionsPrivateIpError({ input: validation.input });
+      }
+      const { v4, v6 } = validation;
+
+      const ref = yield* resolver.resolve(flags.projectRef);
+
+      yield* Effect.gen(function* () {
+        const updating =
+          output.format === "text"
+            ? yield* output.task("Updating network restrictions...")
+            : undefined;
+
+        let v4Out: readonly string[] | undefined;
+        let v6Out: readonly string[] | undefined;
+        let applied: boolean;
+        let envelope:
+          | typeof V1UpdateNetworkRestrictionsOutput.Type
+          | typeof V1PatchNetworkRestrictionsOutput.Type;
+
+        if (flags.append) {
+          const response = yield* api.v1
+            .patchNetworkRestrictions({
+              ref,
+              add: { dbAllowedCidrs: v4, dbAllowedCidrsV6: v6 },
+            })
+            .pipe(
+              Effect.tapError(() => updating?.fail() ?? Effect.void),
+              Effect.catch(mapUpdateError),
+            );
+          yield* updating?.clear() ?? Effect.void;
+          // PATCH uses `&localSlice` in Go, which always renders as `&[]` / `&[...]`
+          // even when no items match a given type. Partition returns concrete arrays
+          // to match that always-non-nil semantic.
+          const partitioned = partitionPatchedCidrs(response.config.dbAllowedCidrs);
+          v4Out = partitioned.v4;
+          v6Out = partitioned.v6;
+          applied = response.status === "applied";
+          envelope = response;
+        } else {
+          const response = yield* api.v1
+            .updateNetworkRestrictions({
+              ref,
+              dbAllowedCidrs: v4,
+              dbAllowedCidrsV6: v6,
+            })
+            .pipe(
+              Effect.tapError(() => updating?.fail() ?? Effect.void),
+              Effect.catch(mapUpdateError),
+            );
+          yield* updating?.clear() ?? Effect.void;
+          // POST `/apply` prints the response field directly; if the API omits
+          // either array it renders as `<nil>` (matches Go's `*[]string(nil)`).
+          v4Out = response.config.dbAllowedCidrs;
+          v6Out = response.config.dbAllowedCidrsV6;
+          applied = response.status === "applied";
+          envelope = response;
+        }
+
+        const goFmt = Option.getOrUndefined(goOutputFlag);
+
+        if (goFmt === "json") {
+          yield* output.raw(encodeGoJson(envelope));
+          return;
+        }
+        if (goFmt === "yaml") {
+          yield* output.raw(encodeYaml(envelope));
+          return;
+        }
+        if (goFmt === "toml") {
+          yield* output.raw(encodeToml(envelope) + "\n");
+          return;
+        }
+        if (goFmt === "env") {
+          yield* output.raw(encodeEnv(envelope) + "\n");
+          return;
+        }
+
+        if (output.format === "json" || output.format === "stream-json") {
+          yield* output.success("", envelope);
+          return;
+        }
+
+        yield* output.raw(printNetworkRestrictionsStatus({ v4: v4Out, v6: v6Out, applied }));
+      }).pipe(Effect.ensuring(linkedProjectCache.cache(ref)));
+    }).pipe(Effect.ensuring(telemetryState.flush));
   },
 );
diff --git a/apps/cli/src/legacy/commands/network-restrictions/update/update.integration.test.ts b/apps/cli/src/legacy/commands/network-restrictions/update/update.integration.test.ts
new file mode 100644
index 0000000000..71b4b5bc59
--- /dev/null
+++ b/apps/cli/src/legacy/commands/network-restrictions/update/update.integration.test.ts
@@ -0,0 +1,643 @@
+import {
+  type V1PatchNetworkRestrictionsOutput,
+  type V1UpdateNetworkRestrictionsOutput,
+} from "@supabase/api/effect";
+import { describe, expect, it } from "@effect/vitest";
+import { Effect, Exit, Option } from "effect";
+
+import { withJsonErrorHandling } from "../../../../shared/output/json-error-handling.ts";
+import { mockOutput } from "../../../../../tests/helpers/mocks.ts";
+import {
+  LEGACY_VALID_REF,
+  buildLegacyTestRuntime,
+  mockLegacyCliConfig,
+  mockLegacyLinkedProjectCacheTracked,
+  type MockLegacyPlatformApiOpts,
+  mockLegacyPlatformApi,
+  mockLegacyTelemetryStateTracked,
+  useLegacyTempWorkdir,
+} from "../../../../../tests/helpers/legacy-mocks.ts";
+import { legacyNetworkRestrictionsUpdate } from "./update.handler.ts";
+
+// ---------------------------------------------------------------------------
+// Fixtures
+// ---------------------------------------------------------------------------
+
+const POST_APPLIED: typeof V1UpdateNetworkRestrictionsOutput.Type = {
+  entitlement: "allowed",
+  config: {
+    dbAllowedCidrs: ["12.3.4.5/32", "1.2.3.1/24"],
+    dbAllowedCidrsV6: ["2001:db8:abcd:0012::0/64"],
+  },
+  status: "applied",
+};
+
+const POST_EMPTY_APPLIED: typeof V1UpdateNetworkRestrictionsOutput.Type = {
+  entitlement: "allowed",
+  config: { dbAllowedCidrs: [], dbAllowedCidrsV6: [] },
+  status: "applied",
+};
+
+const POST_STORED: typeof V1UpdateNetworkRestrictionsOutput.Type = {
+  entitlement: "allowed",
+  config: { dbAllowedCidrs: ["1.2.3.0/24"], dbAllowedCidrsV6: [] },
+  status: "stored",
+};
+
+const PATCH_APPLIED: typeof V1PatchNetworkRestrictionsOutput.Type = {
+  entitlement: "allowed",
+  config: {
+    dbAllowedCidrs: [
+      { address: "12.3.4.5/32", type: "v4" },
+      { address: "2001:db8:abcd:0012::0/64", type: "v6" },
+      { address: "1.2.3.1/24", type: "v4" },
+    ],
+  },
+  status: "applied",
+};
+
+// ---------------------------------------------------------------------------
+// Setup
+// ---------------------------------------------------------------------------
+
+interface SetupOpts {
+  format?: "text" | "json" | "stream-json";
+  goOutput?: "env" | "pretty" | "json" | "toml" | "yaml";
+  postResponse?: typeof V1UpdateNetworkRestrictionsOutput.Type;
+  postStatus?: number;
+  patchResponse?: typeof V1PatchNetworkRestrictionsOutput.Type;
+  patchStatus?: number;
+  network?: "fail";
+}
+
+const tempRoot = useLegacyTempWorkdir("supabase-network-restrictions-update-int-");
+
+function apiOpts(opts: SetupOpts): MockLegacyPlatformApiOpts {
+  return {
+    byMethod: {
+      POST: { status: opts.postStatus ?? 201, body: opts.postResponse ?? POST_APPLIED },
+      PATCH: { status: opts.patchStatus ?? 200, body: opts.patchResponse ?? PATCH_APPLIED },
+    },
+    network: opts.network,
+  };
+}
+
+function setup(opts: SetupOpts = {}) {
+  const out = mockOutput({ format: opts.format ?? "text" });
+  const api = mockLegacyPlatformApi(apiOpts(opts));
+  const cliConfig = mockLegacyCliConfig({ workdir: tempRoot.current });
+  const layer = buildLegacyTestRuntime({
+    out,
+    api,
+    cliConfig,
+    goOutput: opts.goOutput === undefined ? Option.none() : Option.some(opts.goOutput),
+  });
+  return { layer, out, api };
+}
+
+function setupTracked(opts: SetupOpts = {}) {
+  const out = mockOutput({ format: opts.format ?? "text" });
+  const api = mockLegacyPlatformApi(apiOpts(opts));
+  const cliConfig = mockLegacyCliConfig({ workdir: tempRoot.current });
+  const telemetry = mockLegacyTelemetryStateTracked();
+  const cache = mockLegacyLinkedProjectCacheTracked();
+  const layer = buildLegacyTestRuntime({
+    out,
+    api,
+    cliConfig,
+    telemetry: telemetry.layer,
+    linkedProjectCache: cache.layer,
+  });
+  return { layer, out, api, telemetry, cache };
+}
+
+const baseFlags = {
+  projectRef: Option.none<string>(),
+  dbAllowCidr: [] as readonly string[],
+  bypassCidrChecks: false,
+  append: false,
+};
+
+// ---------------------------------------------------------------------------
+// Tests
+// ---------------------------------------------------------------------------
+
+describe("legacy network-restrictions update integration", () => {
+  // -------------------------------------------------------------------------
+  // Replace mode (POST /apply)
+  // -------------------------------------------------------------------------
+
+  it.live("POSTs /apply with partitioned v4/v6 lists and prints the Go-format block", () => {
+    const { layer, out, api } = setup({ postResponse: POST_APPLIED });
+    return Effect.gen(function* () {
+      yield* legacyNetworkRestrictionsUpdate({
+        ...baseFlags,
+        dbAllowCidr: ["12.3.4.5/32", "2001:db8:abcd:0012::0/64", "1.2.3.1/24"],
+      });
+      expect(api.requests).toHaveLength(1);
+      expect(api.requests[0]?.method).toBe("POST");
+      expect(api.requests[0]?.url).toContain(
+        `/v1/projects/${LEGACY_VALID_REF}/network-restrictions/apply`,
+      );
+      expect(api.requests[0]?.body).toEqual({
+        dbAllowedCidrs: ["12.3.4.5/32", "1.2.3.1/24"],
+        dbAllowedCidrsV6: ["2001:db8:abcd:0012::0/64"],
+      });
+      expect(out.stdoutText).toBe(
+        "DB Allowed IPv4 CIDRs: &[12.3.4.5/32 1.2.3.1/24]\n" +
+          "DB Allowed IPv6 CIDRs: &[2001:db8:abcd:0012::0/64]\n" +
+          "Restrictions applied successfully: true\n",
+      );
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("sends empty arrays when no --db-allow-cidr is provided", () => {
+    const { layer, api } = setup({ postResponse: POST_EMPTY_APPLIED });
+    return Effect.gen(function* () {
+      yield* legacyNetworkRestrictionsUpdate(baseFlags);
+      expect(api.requests[0]?.body).toEqual({ dbAllowedCidrs: [], dbAllowedCidrsV6: [] });
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live(
+    "treats `applied successfully` as false when the POST response status is `stored`",
+    () => {
+      const { layer, out } = setup({ postResponse: POST_STORED });
+      return Effect.gen(function* () {
+        yield* legacyNetworkRestrictionsUpdate({ ...baseFlags, dbAllowCidr: ["1.2.3.0/24"] });
+        expect(out.stdoutText).toBe(
+          "DB Allowed IPv4 CIDRs: &[1.2.3.0/24]\n" +
+            "DB Allowed IPv6 CIDRs: &[]\n" +
+            "Restrictions applied successfully: false\n",
+        );
+      }).pipe(Effect.provide(layer));
+    },
+  );
+
+  it.live("routes an IPv4-mapped IPv6 input into the v4 request bucket (Go To4 parity)", () => {
+    const { layer, api } = setup({
+      postResponse: {
+        ...POST_EMPTY_APPLIED,
+        config: { dbAllowedCidrs: ["::ffff:1.2.3.4/128"], dbAllowedCidrsV6: [] },
+      },
+    });
+    return Effect.gen(function* () {
+      yield* legacyNetworkRestrictionsUpdate({
+        ...baseFlags,
+        dbAllowCidr: ["::ffff:1.2.3.4/128"],
+      });
+      expect(api.requests[0]?.body).toEqual({
+        dbAllowedCidrs: ["::ffff:1.2.3.4/128"],
+        dbAllowedCidrsV6: [],
+      });
+    }).pipe(Effect.provide(layer));
+  });
+
+  // -------------------------------------------------------------------------
+  // Append mode (PATCH /network-restrictions)
+  // -------------------------------------------------------------------------
+
+  it.live("PATCHes when --append=true with `add` payload and partitions the V2 response", () => {
+    const { layer, out, api } = setup({ patchResponse: PATCH_APPLIED });
+    return Effect.gen(function* () {
+      yield* legacyNetworkRestrictionsUpdate({
+        ...baseFlags,
+        append: true,
+        dbAllowCidr: ["12.3.4.5/32", "1.2.3.1/24", "2001:db8:abcd:0012::0/64"],
+      });
+      expect(api.requests).toHaveLength(1);
+      expect(api.requests[0]?.method).toBe("PATCH");
+      expect(api.requests[0]?.url).toContain(
+        `/v1/projects/${LEGACY_VALID_REF}/network-restrictions`,
+      );
+      expect(api.requests[0]?.url).not.toContain("/apply");
+      expect(api.requests[0]?.body).toEqual({
+        add: {
+          dbAllowedCidrs: ["12.3.4.5/32", "1.2.3.1/24"],
+          dbAllowedCidrsV6: ["2001:db8:abcd:0012::0/64"],
+        },
+      });
+      expect(out.stdoutText).toBe(
+        "DB Allowed IPv4 CIDRs: &[12.3.4.5/32 1.2.3.1/24]\n" +
+          "DB Allowed IPv6 CIDRs: &[2001:db8:abcd:0012::0/64]\n" +
+          "Restrictions applied successfully: true\n",
+      );
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("prints `&[]` for both arrays when the PATCH response has no matching items", () => {
+    const empty: typeof V1PatchNetworkRestrictionsOutput.Type = {
+      entitlement: "allowed",
+      config: {},
+      status: "applied",
+    };
+    const { layer, out } = setup({ patchResponse: empty });
+    return Effect.gen(function* () {
+      yield* legacyNetworkRestrictionsUpdate({ ...baseFlags, append: true });
+      expect(out.stdoutText).toBe(
+        "DB Allowed IPv4 CIDRs: &[]\n" +
+          "DB Allowed IPv6 CIDRs: &[]\n" +
+          "Restrictions applied successfully: true\n",
+      );
+    }).pipe(Effect.provide(layer));
+  });
+
+  // -------------------------------------------------------------------------
+  // CIDR validation
+  // -------------------------------------------------------------------------
+
+  it.live("rejects an input missing the /mask suffix with Go's verbatim message", () => {
+    const { layer } = setup();
+    return Effect.gen(function* () {
+      const exit = yield* Effect.exit(
+        legacyNetworkRestrictionsUpdate({
+          ...baseFlags,
+          dbAllowCidr: ["12.3.4.5", "10.0.0.0/8", "1.2.3.1/24"],
+        }),
+      );
+      expect(Exit.isFailure(exit)).toBe(true);
+      if (Exit.isFailure(exit)) {
+        const errorJson = JSON.stringify(exit.cause);
+        expect(errorJson).toContain("LegacyNetworkRestrictionsInvalidCidrError");
+        expect(errorJson).toContain("failed to parse IP: 12.3.4.5");
+      }
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("rejects an RFC-1918 private IPv4 input with Go's verbatim message", () => {
+    const { layer } = setup();
+    return Effect.gen(function* () {
+      const exit = yield* Effect.exit(
+        legacyNetworkRestrictionsUpdate({
+          ...baseFlags,
+          dbAllowCidr: ["12.3.4.5/32", "10.0.0.0/8", "1.2.3.1/24"],
+        }),
+      );
+      expect(Exit.isFailure(exit)).toBe(true);
+      if (Exit.isFailure(exit)) {
+        const errorJson = JSON.stringify(exit.cause);
+        expect(errorJson).toContain("LegacyNetworkRestrictionsPrivateIpError");
+        expect(errorJson).toContain("private IP provided: 10.0.0.0/8");
+      }
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("rejects an IPv4-mapped private IPv6 input (security regression guard)", () => {
+    // Without IPv4-mapped detection, ::ffff:10.0.0.0/104 would slip past the
+    // private check because the IPv6 first-byte is 0, not 0xfc. parseCidr now
+    // reclassifies these as v4 via Go's To4() semantics; the v4 path catches
+    // 10.0.0.0/8.
+    const { layer } = setup();
+    return Effect.gen(function* () {
+      const exit = yield* Effect.exit(
+        legacyNetworkRestrictionsUpdate({
+          ...baseFlags,
+          dbAllowCidr: ["::ffff:10.0.0.0/104"],
+        }),
+      );
+      expect(Exit.isFailure(exit)).toBe(true);
+      if (Exit.isFailure(exit)) {
+        const errorJson = JSON.stringify(exit.cause);
+        expect(errorJson).toContain("LegacyNetworkRestrictionsPrivateIpError");
+        expect(errorJson).toContain("private IP provided: ::ffff:10.0.0.0/104");
+      }
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("does NOT call the API when CIDR validation fails", () => {
+    const { layer, api } = setup();
+    return Effect.gen(function* () {
+      yield* Effect.exit(
+        legacyNetworkRestrictionsUpdate({
+          ...baseFlags,
+          dbAllowCidr: ["12.3.4.5"],
+        }),
+      );
+      expect(api.requests).toHaveLength(0);
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("passes private inputs through to the API when --bypass-cidr-checks=true", () => {
+    const { layer, api } = setup({
+      postResponse: {
+        ...POST_EMPTY_APPLIED,
+        config: { dbAllowedCidrs: ["10.0.0.0/8"], dbAllowedCidrsV6: [] },
+      },
+    });
+    return Effect.gen(function* () {
+      yield* legacyNetworkRestrictionsUpdate({
+        ...baseFlags,
+        bypassCidrChecks: true,
+        dbAllowCidr: ["10.0.0.0/8"],
+      });
+      expect(api.requests).toHaveLength(1);
+      expect(api.requests[0]?.body).toEqual({
+        dbAllowedCidrs: ["10.0.0.0/8"],
+        dbAllowedCidrsV6: [],
+      });
+    }).pipe(Effect.provide(layer));
+  });
+
+  // -------------------------------------------------------------------------
+  // HTTP error mapping
+  // -------------------------------------------------------------------------
+
+  it.live("reports a Go-compatible error message when the POST network is unreachable", () => {
+    const { layer } = setup({ network: "fail" });
+    return Effect.gen(function* () {
+      const exit = yield* Effect.exit(legacyNetworkRestrictionsUpdate(baseFlags));
+      expect(Exit.isFailure(exit)).toBe(true);
+      if (Exit.isFailure(exit)) {
+        const errorJson = JSON.stringify(exit.cause);
+        expect(errorJson).toContain("LegacyNetworkRestrictionsUpdateNetworkError");
+        expect(errorJson).toContain("failed to apply network restrictions:");
+      }
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("reports a Go-compatible error message when the POST returns 503", () => {
+    const { layer } = setup({ postStatus: 503, postResponse: POST_EMPTY_APPLIED });
+    return Effect.gen(function* () {
+      const exit = yield* Effect.exit(legacyNetworkRestrictionsUpdate(baseFlags));
+      expect(Exit.isFailure(exit)).toBe(true);
+      if (Exit.isFailure(exit)) {
+        const errorJson = JSON.stringify(exit.cause);
+        expect(errorJson).toContain("LegacyNetworkRestrictionsUpdateUnexpectedStatusError");
+        expect(errorJson).toContain("failed to apply network restrictions:");
+      }
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("reports a Go-compatible error message when the PATCH network is unreachable", () => {
+    const { layer } = setup({ network: "fail" });
+    return Effect.gen(function* () {
+      const exit = yield* Effect.exit(
+        legacyNetworkRestrictionsUpdate({ ...baseFlags, append: true }),
+      );
+      expect(Exit.isFailure(exit)).toBe(true);
+      if (Exit.isFailure(exit)) {
+        const errorJson = JSON.stringify(exit.cause);
+        expect(errorJson).toContain("LegacyNetworkRestrictionsUpdateNetworkError");
+        expect(errorJson).toContain("failed to apply network restrictions:");
+      }
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("reports a Go-compatible error message when the PATCH returns a non-200 status", () => {
+    const { layer } = setup({ patchStatus: 500, patchResponse: PATCH_APPLIED });
+    return Effect.gen(function* () {
+      const exit = yield* Effect.exit(
+        legacyNetworkRestrictionsUpdate({ ...baseFlags, append: true }),
+      );
+      expect(Exit.isFailure(exit)).toBe(true);
+      if (Exit.isFailure(exit)) {
+        const errorJson = JSON.stringify(exit.cause);
+        expect(errorJson).toContain("LegacyNetworkRestrictionsUpdateUnexpectedStatusError");
+        expect(errorJson).toContain("failed to apply network restrictions:");
+      }
+    }).pipe(Effect.provide(layer));
+  });
+
+  // -------------------------------------------------------------------------
+  // Output modes — POST
+  // -------------------------------------------------------------------------
+
+  it.live("emits a structured JSON success payload via --output-format=json after POST", () => {
+    const { layer, out } = setup({ format: "json", postResponse: POST_APPLIED });
+    return Effect.gen(function* () {
+      yield* legacyNetworkRestrictionsUpdate({
+        ...baseFlags,
+        dbAllowCidr: ["12.3.4.5/32"],
+      });
+      const success = out.messages.find((m) => m.type === "success");
+      expect(success).toBeDefined();
+      expect(success?.data).toMatchObject({ status: "applied" });
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("emits a result event via --output-format=stream-json", () => {
+    const { layer, out } = setup({ format: "stream-json", postResponse: POST_APPLIED });
+    return Effect.gen(function* () {
+      yield* legacyNetworkRestrictionsUpdate(baseFlags);
+      const success = out.messages.find((m) => m.type === "success");
+      expect(success).toBeDefined();
+      expect(success?.data).toMatchObject({ status: "applied" });
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("emits Go-compatible JSON when --output=json after POST", () => {
+    const { layer, out } = setup({ goOutput: "json", postResponse: POST_APPLIED });
+    return Effect.gen(function* () {
+      yield* legacyNetworkRestrictionsUpdate(baseFlags);
+      expect(out.stdoutText.startsWith("{")).toBe(true);
+      expect(out.stdoutText).toContain('"status": "applied"');
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("emits Go-compatible YAML when --output=yaml after POST", () => {
+    const { layer, out } = setup({ goOutput: "yaml", postResponse: POST_APPLIED });
+    return Effect.gen(function* () {
+      yield* legacyNetworkRestrictionsUpdate(baseFlags);
+      expect(out.stdoutText).toContain("status: applied");
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("emits Go-compatible TOML when --output=toml after POST", () => {
+    const { layer, out } = setup({ goOutput: "toml", postResponse: POST_APPLIED });
+    return Effect.gen(function* () {
+      yield* legacyNetworkRestrictionsUpdate(baseFlags);
+      expect(out.stdoutText).toContain("status = ");
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("emits Go-compatible env output when --output=env after POST", () => {
+    const { layer, out } = setup({ goOutput: "env", postResponse: POST_EMPTY_APPLIED });
+    return Effect.gen(function* () {
+      yield* legacyNetworkRestrictionsUpdate(baseFlags);
+      expect(out.stdoutText).toContain('STATUS="applied"');
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("treats --output pretty identically to text mode", () => {
+    const { layer, out } = setup({ goOutput: "pretty", postResponse: POST_EMPTY_APPLIED });
+    return Effect.gen(function* () {
+      yield* legacyNetworkRestrictionsUpdate(baseFlags);
+      expect(out.stdoutText).toBe(
+        "DB Allowed IPv4 CIDRs: &[]\n" +
+          "DB Allowed IPv6 CIDRs: &[]\n" +
+          "Restrictions applied successfully: true\n",
+      );
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("Go --output wins over TS --output-format after POST when both are set", () => {
+    const { layer, out } = setup({
+      format: "json",
+      goOutput: "yaml",
+      postResponse: POST_APPLIED,
+    });
+    return Effect.gen(function* () {
+      yield* legacyNetworkRestrictionsUpdate(baseFlags);
+      expect(out.stdoutText.startsWith("{")).toBe(false);
+      expect(out.stdoutText).toContain("status: applied");
+    }).pipe(Effect.provide(layer));
+  });
+
+  // -------------------------------------------------------------------------
+  // Output modes — PATCH (cover encoders against V2 response shape)
+  // -------------------------------------------------------------------------
+
+  it.live("emits a structured JSON success payload via --output-format=json after PATCH", () => {
+    const { layer, out } = setup({ format: "json", patchResponse: PATCH_APPLIED });
+    return Effect.gen(function* () {
+      yield* legacyNetworkRestrictionsUpdate({
+        ...baseFlags,
+        append: true,
+        dbAllowCidr: ["12.3.4.5/32"],
+      });
+      const success = out.messages.find((m) => m.type === "success");
+      expect(success).toBeDefined();
+      expect(success?.data).toMatchObject({ status: "applied" });
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("emits Go-compatible JSON when --output=json after PATCH", () => {
+    const { layer, out } = setup({ goOutput: "json", patchResponse: PATCH_APPLIED });
+    return Effect.gen(function* () {
+      yield* legacyNetworkRestrictionsUpdate({ ...baseFlags, append: true });
+      expect(out.stdoutText.startsWith("{")).toBe(true);
+      expect(out.stdoutText).toContain('"status": "applied"');
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("emits Go-compatible YAML when --output=yaml after PATCH", () => {
+    const { layer, out } = setup({ goOutput: "yaml", patchResponse: PATCH_APPLIED });
+    return Effect.gen(function* () {
+      yield* legacyNetworkRestrictionsUpdate({ ...baseFlags, append: true });
+      expect(out.stdoutText).toContain("status: applied");
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("emits Go-compatible TOML when --output=toml after PATCH", () => {
+    const { layer, out } = setup({ goOutput: "toml", patchResponse: PATCH_APPLIED });
+    return Effect.gen(function* () {
+      yield* legacyNetworkRestrictionsUpdate({ ...baseFlags, append: true });
+      expect(out.stdoutText).toContain("status = ");
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("emits Go-compatible env output when --output=env after PATCH", () => {
+    const { layer, out } = setup({
+      goOutput: "env",
+      patchResponse: {
+        entitlement: "allowed",
+        config: {},
+        status: "applied",
+      },
+    });
+    return Effect.gen(function* () {
+      yield* legacyNetworkRestrictionsUpdate({ ...baseFlags, append: true });
+      expect(out.stdoutText).toContain('STATUS="applied"');
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("Go --output wins over TS --output-format after PATCH when both are set", () => {
+    const { layer, out } = setup({
+      format: "json",
+      goOutput: "yaml",
+      patchResponse: PATCH_APPLIED,
+    });
+    return Effect.gen(function* () {
+      yield* legacyNetworkRestrictionsUpdate({ ...baseFlags, append: true });
+      expect(out.stdoutText.startsWith("{")).toBe(false);
+      expect(out.stdoutText).toContain("status: applied");
+    }).pipe(Effect.provide(layer));
+  });
+
+  // -------------------------------------------------------------------------
+  // Project ref resolution
+  // -------------------------------------------------------------------------
+
+  it.live("uses --project-ref flag value over LegacyCliConfig.projectId", () => {
+    const flagRef = "zzzzzzzzzzzzzzzzzzzz";
+    const { layer, api } = setup({ postResponse: POST_EMPTY_APPLIED });
+    return Effect.gen(function* () {
+      yield* legacyNetworkRestrictionsUpdate({
+        ...baseFlags,
+        projectRef: Option.some(flagRef),
+      });
+      expect(api.requests[0]?.url).toContain(`/v1/projects/${flagRef}/`);
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("rejects a malformed resolved project ref before issuing any HTTP call", () => {
+    const { layer } = setup({ postResponse: POST_EMPTY_APPLIED });
+    return Effect.gen(function* () {
+      const exit = yield* Effect.exit(
+        legacyNetworkRestrictionsUpdate({
+          ...baseFlags,
+          projectRef: Option.some("BADREF"),
+        }),
+      );
+      expect(Exit.isFailure(exit)).toBe(true);
+      if (Exit.isFailure(exit)) {
+        expect(JSON.stringify(exit.cause)).toContain("LegacyInvalidProjectRefError");
+      }
+    }).pipe(Effect.provide(layer));
+  });
+
+  // -------------------------------------------------------------------------
+  // withJsonErrorHandling
+  // -------------------------------------------------------------------------
+
+  it.live("emits a fail event when withJsonErrorHandling wraps a JSON-mode error", () => {
+    const { layer, out } = setup({
+      format: "json",
+      postStatus: 503,
+      postResponse: POST_EMPTY_APPLIED,
+    });
+    return Effect.gen(function* () {
+      yield* legacyNetworkRestrictionsUpdate(baseFlags).pipe(withJsonErrorHandling);
+      expect(out.messages.some((m) => m.type === "fail")).toBe(true);
+    }).pipe(Effect.provide(layer));
+  });
+
+  // -------------------------------------------------------------------------
+  // PersistentPostRun parity (telemetry + linked-project cache)
+  // -------------------------------------------------------------------------
+
+  it.live("flushes telemetry and writes linked-project cache on success", () => {
+    const { layer, telemetry, cache } = setupTracked({ postResponse: POST_APPLIED });
+    return Effect.gen(function* () {
+      yield* legacyNetworkRestrictionsUpdate(baseFlags);
+      expect(telemetry.flushed).toBe(true);
+      expect(cache.cached).toBe(true);
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("flushes telemetry on CIDR validation failure (before any HTTP call)", () => {
+    const { layer, telemetry, cache, api } = setupTracked();
+    return Effect.gen(function* () {
+      yield* Effect.exit(legacyNetworkRestrictionsUpdate({ ...baseFlags, dbAllowCidr: ["bad"] }));
+      // Telemetry is the outermost ensuring, so it always fires.
+      expect(telemetry.flushed).toBe(true);
+      // Linked-project cache is inside the ref-resolved scope; CIDR validation
+      // short-circuits before the ref is resolved, so it must not fire.
+      expect(cache.cached).toBe(false);
+      expect(api.requests).toHaveLength(0);
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("flushes telemetry on API failure", () => {
+    const { layer, telemetry, cache } = setupTracked({
+      postStatus: 500,
+      postResponse: POST_EMPTY_APPLIED,
+    });
+    return Effect.gen(function* () {
+      yield* Effect.exit(legacyNetworkRestrictionsUpdate(baseFlags));
+      expect(telemetry.flushed).toBe(true);
+      // Ref resolved successfully, so cache fires even though the API failed.
+      expect(cache.cached).toBe(true);
+    }).pipe(Effect.provide(layer));
+  });
+});
diff --git a/apps/cli/src/legacy/commands/orgs/create/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/orgs/create/SIDE_EFFECTS.md
index ec7b0c20ab..b6a2dfee84 100644
--- a/apps/cli/src/legacy/commands/orgs/create/SIDE_EFFECTS.md
+++ b/apps/cli/src/legacy/commands/orgs/create/SIDE_EFFECTS.md
@@ -2,77 +2,121 @@
 
 ## Files Read
 
-| Path                       | Format                    | When                                                       |
-| -------------------------- | ------------------------- | ---------------------------------------------------------- |
-| `~/.supabase/access-token` | plain text (token string) | when `SUPABASE_ACCESS_TOKEN` unset and keyring unavailable |
+| Path                                      | Format                    | When                                                                                          |
+| ----------------------------------------- | ------------------------- | --------------------------------------------------------------------------------------------- |
+| keyring `"Supabase CLI"` / `<profile>`    | OS keychain               | when `SUPABASE_ACCESS_TOKEN` unset and keyring available; account = `LegacyCliConfig.profile` |
+| keyring `"Supabase CLI"` / `access-token` | OS keychain               | legacy-key fallback when the profile-keyed lookup misses                                      |
+| `~/.supabase/access-token`                | plain text (token string) | last-resort fallback after env + keyring miss                                                 |
 
 ## Files Written
 
-| Path | Format | When |
-| ---- | ------ | ---- |
-| —    | —      | —    |
+| Path                         | Format | When                                                        |
+| ---------------------------- | ------ | ----------------------------------------------------------- |
+| `~/.supabase/telemetry.json` | JSON   | always (in `Effect.ensuring`) at end of command — Go parity |
+
+`orgs create` is a user-level command — it does not resolve a `--project-ref`, so the legacy
+linked-project cache is never written.
+
+## Positional Arguments
+
+| Argument | Required? | Description                  |
+| -------- | --------- | ---------------------------- |
+| `name`   | yes       | Name of the new organization |
 
 ## API Routes
 
-| Method | Path                | Auth         | Request body     | Response (used fields)       |
-| ------ | ------------------- | ------------ | ---------------- | ---------------------------- |
-| `POST` | `/v1/organizations` | Bearer token | `{name: string}` | `{id: string, name: string}` |
+| Method | Path                | Auth         | Request body     | Response (used fields)                     |
+| ------ | ------------------- | ------------ | ---------------- | ------------------------------------------ |
+| `POST` | `/v1/organizations` | Bearer token | `{name: string}` | `{id: string, slug: string, name: string}` |
 
 ## Environment Variables
 
-| Variable                | Purpose                                              | Required?                                               |
-| ----------------------- | ---------------------------------------------------- | ------------------------------------------------------- |
-| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `~/.supabase/access-token`) |
-| `SUPABASE_API_URL`      | override Management API base URL                     | no (defaults to `https://api.supabase.com`)             |
+| Variable                | Purpose                                                                                                                                                   | Required?                                               |
+| ----------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------- |
+| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup)                                                                                                      | no (falls back to keyring → `~/.supabase/access-token`) |
+| `SUPABASE_PROFILE`      | selects API base URL (`supabase`, `supabase-staging`, `supabase-local`), or a filesystem path to a YAML profile (Go parity — used by the cli-e2e harness) | no (defaults to `supabase`)                             |
 
 ## Exit Codes
 
-| Code | Condition                                             |
-| ---- | ----------------------------------------------------- |
-| `0`  | success — organization created                        |
-| `1`  | authentication error — no valid token found           |
-| `1`  | API error — non-2xx response from `/v1/organizations` |
-| `1`  | network / connection failure                          |
+| Code | Condition                                                                       |
+| ---- | ------------------------------------------------------------------------------- |
+| `0`  | success — organization created                                                  |
+| `1`  | `LegacyPlatformAuthRequiredError` — no token in env/keyring/file                |
+| `1`  | `LegacyOrgsCreateUnexpectedStatusError` — non-201 response from create endpoint |
+| `1`  | `LegacyOrgsCreateNetworkError` — transport-level network failure                |
+
+Unlike `orgs list`, there is no env-not-supported branch — Go's `EncodeOutput` happily
+flattens a single object into `ID=… NAME=… SLUG=…` env lines.
+
+## Telemetry Events Fired
+
+| Event                  | When                                       | Notable properties / groups         |
+| ---------------------- | ------------------------------------------ | ----------------------------------- |
+| `cli_command_executed` | post-run, success or failure (via wrapper) | `exit_code`, `duration_ms`, `flags` |
+
+Matches `apps/cli-go/internal/orgs/create/`. Go does not fire any custom telemetry event for
+this command.
 
 ## Output
 
-### `--output-format text` (Go CLI compatible)
+Every output mode (Go-compat and TS) starts by printing `Created organization: <id>\n` to
+stdout, except `--output-format json` / `stream-json`, which emit a single structured event
+instead. `--output` (Go) wins over `--output-format` (TS) when both are supplied.
 
-Prints `Created organization: <id>` followed by a Markdown-style table to stdout.
-Table has a header row and one row for the created organization.
-Column order: `ID`, `NAME`.
+### `--output pretty` (Go default) / `--output-format text`
 
-```
-Created organization: combined-fuchsia-lion
- ID                    NAME
- combined-fuchsia-lion  My Test Org
-```
+`Created organization: <id>` followed by a Glamour-styled markdown table with columns
+`ID`, `NAME` for the created organization. The rendered table always ends with a trailing
+newline (Glamour appends one).
 
-### `--output-format json`
+### `--output json` (Go-compat)
 
-Single JSON object emitted to stdout on success containing the full organization
-object as returned by the Management API.
+Preamble line followed by indented JSON of the created `OrganizationResponseV1` object with
+alphabetical keys + trailing newline.
 
-```json
-{ "id": "combined-fuchsia-lion", "name": "My Test Org" }
-```
+### `--output yaml`
 
-### `--output-format stream-json`
+Preamble line followed by a YAML document of the created organization object.
+
+### `--output toml`
 
-One `result` event on success.
+Preamble line followed by a TOML document of the created organization object.
 
-```ndjson
-{"type":"result","data":{"id":"combined-fuchsia-lion","name":"My Test Org"}}
-```
+### `--output env`
 
-On failure, an `error` event is emitted instead:
+Preamble line followed by `ID=…`, `NAME=…`, `SLUG=…` env lines — env IS supported here,
+unlike on `orgs list`. Matches the Go encoder behavior in
+`apps/cli-go/internal/orgs/create/create.go:27`.
+
+### `--output-format json`
+
+Single `Output.success` envelope written as JSON. The envelope carries the message
+`"Created organization"` plus the created org spread into `data` (`{id, slug, name}`). No
+`Created organization: <id>\n` preamble line — the message is delivered as a structured
+field instead of stdout text.
+
+### `--output-format stream-json`
 
-```ndjson
-{"type":"error","code":"ApiError","message":"…"}
-```
+One `result` NDJSON event with the created org as `data` and the same `"Created organization"`
+message. No preamble line.
 
 ## Notes
 
 - Takes exactly one positional argument: the organization name.
 - No `--project-ref` flag. `orgs create` is a user-level command.
-- The organization ID in the response is a human-readable slug (e.g. `combined-fuchsia-lion`), not a UUID.
+- The organization `id` and `slug` in the response are human-readable slugs (e.g.
+  `combined-fuchsia-lion`), not UUIDs.
+- Sends `User-Agent: SupabaseCLI/<version>` and Bearer auth.
+
+## Security Notes
+
+- The `Created organization: <id>` preamble and the rendered Glamour table interpolate the
+  API-supplied `id` and `name` strings without ANSI / control-character sanitization. This
+  is strict Go parity — Go's `fmt.Println` and `glamour` both pass these through verbatim.
+  A malicious or compromised Management API could in principle return values containing
+  terminal escape sequences. If sanitization is added later it should land at the renderer
+  (and at any shared preamble helper) so both shells inherit the fix.
+- `--output env` values are escaped via `encodeEnv` (`\n`, `\r`, `\t` → backslash-escaped),
+  matching Go's `%q` semantics. ESC (`0x1b`) is not escaped — again Go parity.
+- Error response bodies embedded in `LegacyOrgsCreateUnexpectedStatusError` are sanitized
+  by `mapLegacyHttpError` (control chars stripped, capped at 1024 bytes).
diff --git a/apps/cli/src/legacy/commands/orgs/create/create.command.ts b/apps/cli/src/legacy/commands/orgs/create/create.command.ts
index fcbdae577c..45fd2cdcce 100644
--- a/apps/cli/src/legacy/commands/orgs/create/create.command.ts
+++ b/apps/cli/src/legacy/commands/orgs/create/create.command.ts
@@ -1,10 +1,14 @@
 import { Argument, Command } from "effect/unstable/cli";
 import type * as CliCommand from "effect/unstable/cli/Command";
+
+import { withJsonErrorHandling } from "../../../../shared/output/json-error-handling.ts";
+import { legacyManagementApiRuntimeLayer } from "../../../shared/legacy-management-api-runtime.layer.ts";
+import { withLegacyCommandInstrumentation } from "../../../telemetry/legacy-command-instrumentation.ts";
 import { legacyOrgsCreate } from "./create.handler.ts";
 
 const config = {
   name: Argument.string("name").pipe(
-    Argument.withDescription("Name of the organization to create."),
+    Argument.withDescription("Display name for the new organization."),
   ),
 };
 export type LegacyOrgsCreateFlags = CliCommand.Command.Config.Infer<typeof config>;
@@ -12,5 +16,11 @@ export type LegacyOrgsCreateFlags = CliCommand.Command.Config.Infer<typeof confi
 export const legacyOrgsCreateCommand = Command.make("create", config).pipe(
   Command.withDescription("Create an organization for the logged-in user."),
   Command.withShortDescription("Create an organization"),
-  Command.withHandler((flags) => legacyOrgsCreate(flags)),
+  Command.withHandler((flags) =>
+    legacyOrgsCreate(flags).pipe(
+      withLegacyCommandInstrumentation({ flags }),
+      withJsonErrorHandling,
+    ),
+  ),
+  Command.provide(legacyManagementApiRuntimeLayer(["orgs", "create"])),
 );
diff --git a/apps/cli/src/legacy/commands/orgs/create/create.handler.ts b/apps/cli/src/legacy/commands/orgs/create/create.handler.ts
index 78514e3bd2..f710ff5b9c 100644
--- a/apps/cli/src/legacy/commands/orgs/create/create.handler.ts
+++ b/apps/cli/src/legacy/commands/orgs/create/create.handler.ts
@@ -1,11 +1,92 @@
-import { Effect } from "effect";
-import { LegacyGoProxy } from "../../../../shared/legacy/go-proxy.service.ts";
+import type { V1CreateAnOrganizationOutput } from "@supabase/api/effect";
+import { Effect, Option } from "effect";
+
+import { LegacyPlatformApi } from "../../../auth/legacy-platform-api.service.ts";
+import { LegacyTelemetryState } from "../../../telemetry/legacy-telemetry-state.service.ts";
+import { LegacyOutputFlag } from "../../../../shared/legacy/global-flags.ts";
+import { Output } from "../../../../shared/output/output.service.ts";
+import {
+  encodeEnv,
+  encodeGoJson,
+  encodeToml,
+  encodeYaml,
+} from "../../../shared/legacy-go-output.encoders.ts";
+import { mapLegacyHttpError } from "../../../shared/legacy-http-errors.ts";
+import {
+  LegacyOrgsCreateNetworkError,
+  LegacyOrgsCreateUnexpectedStatusError,
+} from "../orgs.errors.ts";
+import { renderOrgsListTable } from "../orgs.format.ts";
 import type { LegacyOrgsCreateFlags } from "./create.command.ts";
 
+type CreatedOrganization = typeof V1CreateAnOrganizationOutput.Type;
+
+const mapCreateError = mapLegacyHttpError({
+  networkError: LegacyOrgsCreateNetworkError,
+  statusError: LegacyOrgsCreateUnexpectedStatusError,
+  networkMessage: (cause) => `failed to create organization: ${cause}`,
+  statusMessage: (status, body) => `unexpected create organization status ${status}: ${body}`,
+});
+
 export const legacyOrgsCreate = Effect.fn("legacy.orgs.create")(function* (
   flags: LegacyOrgsCreateFlags,
 ) {
-  const proxy = yield* LegacyGoProxy;
-  const args: string[] = ["orgs", "create", flags.name];
-  yield* proxy.exec(args);
+  const output = yield* Output;
+  const goOutputFlag = yield* LegacyOutputFlag;
+  const api = yield* LegacyPlatformApi;
+  const telemetryState = yield* LegacyTelemetryState;
+
+  yield* Effect.gen(function* () {
+    // Spinner runs only in text mode — it would corrupt machine-readable
+    // stdout. The output-routing branches below dispatch on `goFmt`, but the
+    // spinner uses `output.format` because `--output pretty` keeps the format
+    // as "text" while requiring the table render; both paths need the spinner.
+    const creating =
+      output.format === "text" ? yield* output.task("Creating organization...") : undefined;
+    const created: CreatedOrganization = yield* api.v1
+      .createAnOrganization({ name: flags.name })
+      .pipe(
+        Effect.tapError(() => creating?.fail() ?? Effect.void),
+        Effect.catch(mapCreateError),
+      );
+    yield* creating?.clear() ?? Effect.void;
+
+    const goFmt = Option.getOrUndefined(goOutputFlag);
+
+    // Go calls `fmt.Println("Created organization:", id)` once before its
+    // format switch (`apps/cli-go/internal/orgs/create/create.go:22`). We
+    // repeat the preamble inside each Go-format branch rather than hoisting
+    // it, so the TS `--output-format json` / `stream-json` paths (which emit
+    // a single structured event below) stay preamble-free.
+    const preamble = `Created organization: ${created.id}\n`;
+
+    if (goFmt === "json") {
+      yield* output.raw(preamble);
+      yield* output.raw(encodeGoJson(created));
+      return;
+    }
+    if (goFmt === "yaml") {
+      yield* output.raw(preamble);
+      yield* output.raw(encodeYaml(created));
+      return;
+    }
+    if (goFmt === "toml") {
+      yield* output.raw(preamble);
+      yield* output.raw(encodeToml(created) + "\n");
+      return;
+    }
+    if (goFmt === "env") {
+      yield* output.raw(preamble);
+      yield* output.raw(encodeEnv(created) + "\n");
+      return;
+    }
+
+    if (output.format === "json" || output.format === "stream-json") {
+      yield* output.success("Created organization", { ...created });
+      return;
+    }
+
+    yield* output.raw(preamble);
+    yield* output.raw(renderOrgsListTable([created]));
+  }).pipe(Effect.ensuring(telemetryState.flush));
 });
diff --git a/apps/cli/src/legacy/commands/orgs/create/create.integration.test.ts b/apps/cli/src/legacy/commands/orgs/create/create.integration.test.ts
new file mode 100644
index 0000000000..5401a18497
--- /dev/null
+++ b/apps/cli/src/legacy/commands/orgs/create/create.integration.test.ts
@@ -0,0 +1,217 @@
+import type { V1CreateAnOrganizationOutput } from "@supabase/api/effect";
+import { describe, expect, it } from "@effect/vitest";
+import { Effect, Exit, Option } from "effect";
+
+import { mockOutput } from "../../../../../tests/helpers/mocks.ts";
+import {
+  buildLegacyTestRuntime,
+  mockLegacyCliConfig,
+  mockLegacyPlatformApi,
+  mockLegacyTelemetryStateTracked,
+  useLegacyTempWorkdir,
+} from "../../../../../tests/helpers/legacy-mocks.ts";
+import { legacyOrgsCreate } from "./create.handler.ts";
+
+type CreatedOrganization = typeof V1CreateAnOrganizationOutput.Type;
+
+const CREATED: CreatedOrganization = {
+  id: "combined-fuchsia-lion",
+  slug: "combined-fuchsia-lion",
+  name: "Acme",
+};
+
+const tempRoot = useLegacyTempWorkdir("supabase-orgs-create-int-");
+
+interface SetupOpts {
+  readonly format?: "text" | "json" | "stream-json";
+  readonly goOutput?: "env" | "pretty" | "json" | "toml" | "yaml";
+  readonly response?: CreatedOrganization;
+  readonly status?: number;
+  readonly network?: "fail";
+}
+
+function setup(opts: SetupOpts = {}) {
+  const out = mockOutput({ format: opts.format ?? "text" });
+  const api = mockLegacyPlatformApi({
+    response: { status: opts.status ?? 201, body: opts.response ?? CREATED },
+    network: opts.network,
+  });
+  const cliConfig = mockLegacyCliConfig({ workdir: tempRoot.current });
+  const layer = buildLegacyTestRuntime({
+    out,
+    api,
+    cliConfig,
+    goOutput: opts.goOutput === undefined ? Option.none() : Option.some(opts.goOutput),
+  });
+  return { layer, out, api };
+}
+
+function setupTracked(opts: SetupOpts = {}) {
+  const out = mockOutput({ format: opts.format ?? "text" });
+  const api = mockLegacyPlatformApi({
+    response: { status: opts.status ?? 201, body: opts.response ?? CREATED },
+    network: opts.network,
+  });
+  const cliConfig = mockLegacyCliConfig({ workdir: tempRoot.current });
+  const telemetry = mockLegacyTelemetryStateTracked();
+  const layer = buildLegacyTestRuntime({
+    out,
+    api,
+    cliConfig,
+    telemetry: telemetry.layer,
+  });
+  return { layer, out, api, telemetry };
+}
+
+describe("legacy orgs create integration", () => {
+  it.live('prints "Created organization: <id>" then a Glamour table in text mode', () => {
+    const { layer, out } = setup();
+    return Effect.gen(function* () {
+      yield* legacyOrgsCreate({ name: "Acme" });
+      expect(out.stdoutText).toContain("Created organization: combined-fuchsia-lion");
+      expect(out.stdoutText).toContain("NAME");
+      expect(out.stdoutText).toContain("Acme");
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("sends POST /v1/organizations with { name } body", () => {
+    const { layer, api } = setup();
+    return Effect.gen(function* () {
+      yield* legacyOrgsCreate({ name: "Acme" });
+      expect(api.requests).toHaveLength(1);
+      expect(api.requests[0]?.method).toBe("POST");
+      expect(api.requests[0]?.url).toContain("/v1/organizations");
+      expect(api.requests[0]?.body).toEqual({ name: "Acme" });
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("emits Go-byte-exact preamble + indented JSON for --output json", () => {
+    const { layer, out } = setup({ goOutput: "json" });
+    return Effect.gen(function* () {
+      yield* legacyOrgsCreate({ name: "Acme" });
+      expect(out.stdoutText).toContain("Created organization: combined-fuchsia-lion\n");
+      expect(out.stdoutText).toContain('"name": "Acme"');
+      expect(out.stdoutText.endsWith("}\n")).toBe(true);
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("emits preamble + YAML object for --output yaml", () => {
+    const { layer, out } = setup({ goOutput: "yaml" });
+    return Effect.gen(function* () {
+      yield* legacyOrgsCreate({ name: "Acme" });
+      expect(out.stdoutText).toContain("Created organization: combined-fuchsia-lion\n");
+      expect(out.stdoutText).toContain("name: Acme");
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("emits preamble + TOML for --output toml", () => {
+    const { layer, out } = setup({ goOutput: "toml" });
+    return Effect.gen(function* () {
+      yield* legacyOrgsCreate({ name: "Acme" });
+      expect(out.stdoutText).toContain("Created organization: combined-fuchsia-lion\n");
+      expect(out.stdoutText).toContain('name = "Acme"');
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("emits preamble + env vars for --output env (create-only branch)", () => {
+    const { layer, out } = setup({ goOutput: "env" });
+    return Effect.gen(function* () {
+      yield* legacyOrgsCreate({ name: "Acme" });
+      expect(out.stdoutText).toContain("Created organization: combined-fuchsia-lion\n");
+      expect(out.stdoutText).toContain("NAME=");
+      expect(out.stdoutText).toContain("Acme");
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("emits a success event with org fields for --output-format=json", () => {
+    const { layer, out } = setup({ format: "json" });
+    return Effect.gen(function* () {
+      yield* legacyOrgsCreate({ name: "Acme" });
+      const success = out.messages.find((m) => m.type === "success");
+      expect(success).toBeDefined();
+      expect(success?.data).toMatchObject({ id: "combined-fuchsia-lion", name: "Acme" });
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("emits a success event for --output-format=stream-json", () => {
+    const { layer, out } = setup({ format: "stream-json" });
+    return Effect.gen(function* () {
+      yield* legacyOrgsCreate({ name: "Acme" });
+      expect(out.messages.find((m) => m.type === "success")).toBeDefined();
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("treats --output pretty as identical to text mode (preamble + table)", () => {
+    const { layer, out } = setup({ goOutput: "pretty" });
+    return Effect.gen(function* () {
+      yield* legacyOrgsCreate({ name: "Acme" });
+      expect(out.stdoutText).toContain("Created organization: combined-fuchsia-lion");
+      expect(out.stdoutText).toContain("NAME");
+      expect(out.stdoutText).toContain("Acme");
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("--output flag wins over --output-format", () => {
+    const { layer, out } = setup({ format: "json", goOutput: "yaml" });
+    return Effect.gen(function* () {
+      yield* legacyOrgsCreate({ name: "Acme" });
+      expect(out.stdoutText).toContain("name: Acme");
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("fails with LegacyOrgsCreateUnexpectedStatusError on HTTP 503", () => {
+    const { layer } = setup({ status: 503 });
+    return Effect.gen(function* () {
+      const exit = yield* Effect.exit(legacyOrgsCreate({ name: "Acme" }));
+      expect(Exit.isFailure(exit)).toBe(true);
+      if (Exit.isFailure(exit)) {
+        const json = JSON.stringify(exit.cause);
+        expect(json).toContain("LegacyOrgsCreateUnexpectedStatusError");
+        expect(json).toContain("unexpected create organization status 503");
+      }
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("fails with LegacyOrgsCreateNetworkError on transport failure", () => {
+    const { layer } = setup({ network: "fail" });
+    return Effect.gen(function* () {
+      const exit = yield* Effect.exit(legacyOrgsCreate({ name: "Acme" }));
+      expect(Exit.isFailure(exit)).toBe(true);
+      if (Exit.isFailure(exit)) {
+        const json = JSON.stringify(exit.cause);
+        expect(json).toContain("LegacyOrgsCreateNetworkError");
+        expect(json).toContain("failed to create organization");
+      }
+    }).pipe(Effect.provide(layer));
+  });
+
+  // Exercises the `creating?.fail() ?? Effect.void` undefined branch — when
+  // --output-format != "text", no spinner exists, so the `??` fallback fires.
+  it.live("propagates a transport failure when --output-format=json suppresses the spinner", () => {
+    const { layer } = setup({ format: "json", network: "fail" });
+    return Effect.gen(function* () {
+      const exit = yield* Effect.exit(legacyOrgsCreate({ name: "Acme" }));
+      expect(Exit.isFailure(exit)).toBe(true);
+      if (Exit.isFailure(exit)) {
+        const json = JSON.stringify(exit.cause);
+        expect(json).toContain("LegacyOrgsCreateNetworkError");
+      }
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("flushes telemetry state on success", () => {
+    const { layer, telemetry } = setupTracked();
+    return Effect.gen(function* () {
+      yield* legacyOrgsCreate({ name: "Acme" });
+      expect(telemetry.flushed).toBe(true);
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("flushes telemetry state on failure", () => {
+    const { layer, telemetry } = setupTracked({ status: 503 });
+    return Effect.gen(function* () {
+      yield* Effect.exit(legacyOrgsCreate({ name: "Acme" }));
+      expect(telemetry.flushed).toBe(true);
+    }).pipe(Effect.provide(layer));
+  });
+});
diff --git a/apps/cli/src/legacy/commands/orgs/list/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/orgs/list/SIDE_EFFECTS.md
index 22ea61f83f..922c2087ce 100644
--- a/apps/cli/src/legacy/commands/orgs/list/SIDE_EFFECTS.md
+++ b/apps/cli/src/legacy/commands/orgs/list/SIDE_EFFECTS.md
@@ -2,85 +2,100 @@
 
 ## Files Read
 
-| Path                       | Format                    | When                                                       |
-| -------------------------- | ------------------------- | ---------------------------------------------------------- |
-| `~/.supabase/access-token` | plain text (token string) | when `SUPABASE_ACCESS_TOKEN` unset and keyring unavailable |
+| Path                                      | Format                    | When                                                                                          |
+| ----------------------------------------- | ------------------------- | --------------------------------------------------------------------------------------------- |
+| keyring `"Supabase CLI"` / `<profile>`    | OS keychain               | when `SUPABASE_ACCESS_TOKEN` unset and keyring available; account = `LegacyCliConfig.profile` |
+| keyring `"Supabase CLI"` / `access-token` | OS keychain               | legacy-key fallback when the profile-keyed lookup misses                                      |
+| `~/.supabase/access-token`                | plain text (token string) | last-resort fallback after env + keyring miss                                                 |
 
 ## Files Written
 
-| Path | Format | When |
-| ---- | ------ | ---- |
-| —    | —      | —    |
+| Path                         | Format | When                                                        |
+| ---------------------------- | ------ | ----------------------------------------------------------- |
+| `~/.supabase/telemetry.json` | JSON   | always (in `Effect.ensuring`) at end of command — Go parity |
+
+`orgs list` is a user-level command — it does not resolve a `--project-ref`, so the legacy
+linked-project cache (`~/.supabase/<workdir-hash>/linked-project.json`) is never written.
 
 ## API Routes
 
-| Method | Path                | Auth         | Request body | Response (used fields)         |
-| ------ | ------------------- | ------------ | ------------ | ------------------------------ |
-| `GET`  | `/v1/organizations` | Bearer token | none         | `[{id: string, name: string}]` |
+| Method | Path                | Auth         | Request body | Response (used fields)                       |
+| ------ | ------------------- | ------------ | ------------ | -------------------------------------------- |
+| `GET`  | `/v1/organizations` | Bearer token | none         | `[{id: string, slug: string, name: string}]` |
 
 ## Environment Variables
 
-| Variable                | Purpose                                              | Required?                                               |
-| ----------------------- | ---------------------------------------------------- | ------------------------------------------------------- |
-| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `~/.supabase/access-token`) |
-| `SUPABASE_API_URL`      | override Management API base URL                     | no (defaults to `https://api.supabase.com`)             |
+| Variable                | Purpose                                                                                                                                                   | Required?                                               |
+| ----------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------- |
+| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup)                                                                                                      | no (falls back to keyring → `~/.supabase/access-token`) |
+| `SUPABASE_PROFILE`      | selects API base URL (`supabase`, `supabase-staging`, `supabase-local`), or a filesystem path to a YAML profile (Go parity — used by the cli-e2e harness) | no (defaults to `supabase`)                             |
 
 ## Exit Codes
 
-| Code | Condition                                             |
-| ---- | ----------------------------------------------------- |
-| `0`  | success — organizations printed to stdout             |
-| `1`  | authentication error — no valid token found           |
-| `1`  | API error — non-2xx response from `/v1/organizations` |
-| `1`  | network / connection failure                          |
+| Code | Condition                                                                   |
+| ---- | --------------------------------------------------------------------------- |
+| `0`  | success — organizations printed to stdout                                   |
+| `1`  | `LegacyPlatformAuthRequiredError` — no token in env/keyring/file            |
+| `1`  | `LegacyOrgsListUnexpectedStatusError` — non-2xx response from list endpoint |
+| `1`  | `LegacyOrgsListNetworkError` — transport-level network failure              |
+| `1`  | `LegacyOrgsEnvNotSupportedError` — `--output env` flag is rejected          |
+
+## Telemetry Events Fired
+
+| Event                  | When                                       | Notable properties / groups         |
+| ---------------------- | ------------------------------------------ | ----------------------------------- |
+| `cli_command_executed` | post-run, success or failure (via wrapper) | `exit_code`, `duration_ms`, `flags` |
+
+Matches `apps/cli-go/internal/orgs/list/`. Go does not fire any custom telemetry event for this
+command.
 
 ## Output
 
-### `--output-format text` (Go CLI compatible)
+The legacy `--output {pretty,json,yaml,toml,env}` flag (Go-compatible) and the new global
+`--output-format {text,json,stream-json}` flag are both honored. `--output` wins when both
+are supplied. `pretty` and `text` map to the same Glamour render.
 
-Prints a Markdown-style table to stdout with a header row and one row per organization.
-Column order: `ID`, `NAME`. Columns are separated by two spaces and left-aligned.
-No trailing newline after the last row (matches Go CLI behavior).
+### `--output pretty` (Go default) / `--output-format text`
 
-```
- ID                                    NAME
- xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx  My Org
- yyyyyyyy-yyyy-yyyy-yyyy-yyyyyyyyyyyy  Another Org
-```
+Prints a Glamour-styled markdown table with columns `ID`, `NAME`. Byte-matched against the
+Go CLI. The rendered table always ends with a trailing newline (Glamour appends one).
 
-### `--output-format json`
+### `--output json` (Go-compat)
 
-Single JSON array emitted to stdout on success. Each element contains the full
-organization object as returned by the Management API.
+Indented JSON of the `OrganizationResponseV1[]` array with alphabetical keys + trailing newline.
 
-```json
-[
-  { "id": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx", "name": "My Org" },
-  { "id": "yyyyyyyy-yyyy-yyyy-yyyy-yyyyyyyyyyyy", "name": "Another Org" }
-]
-```
+### `--output yaml`
 
-### `--output-format stream-json`
+YAML document of the organizations array.
+
+### `--output toml`
 
-One `result` event on success. No intermediate `log` events (the request is a single fast
-API call with no multi-step progress).
+TOML document wrapping the array as `[[organizations]]` (Go parity).
 
-```ndjson
-{"type":"result","data":[{"id":"xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx","name":"My Org"}]}
-```
+### `--output env`
 
-On failure, an `error` event is emitted instead:
+Fails with `LegacyOrgsEnvNotSupportedError("--output env flag is not supported")`. Matches
+`apps/cli-go/internal/orgs/list/list.go:32-33`.
 
-```ndjson
-{"type":"error","code":"ApiError","message":"…"}
-```
+### `--output-format json`
+
+Single JSON object via `Output.success` with `{organizations: [...]}` data.
+
+### `--output-format stream-json`
+
+One `result` NDJSON event with `{organizations: [...]}`.
 
 ## Notes
 
-- No `--project-ref` flag. `orgs list` is a user-level command — it lists all organizations
-  the authenticated user has access to, regardless of any linked project.
-- The result set is determined entirely by the access token's scope; no local config is read
-  beyond resolving the token itself.
-- The Go CLI also supports `--output toml` and `--output json` via its own flag. The
-  TypeScript port uses the global `--output-format` flag instead. The `toml` format is not
-  reproduced (not part of the compatibility contract for scripted workflows).
+- No `--project-ref` flag. The result set is determined entirely by the access token's scope.
+- Sends `User-Agent: SupabaseCLI/<version>` and Bearer auth.
+
+## Security Notes
+
+- API-supplied `id` and `name` strings are rendered to stdout without ANSI / control-character
+  sanitization. This is strict Go parity — the Go CLI uses `glamour` which has the same
+  pass-through behaviour. A malicious or compromised Management API could in principle return
+  org names containing terminal escape sequences. If sanitization is added later it should
+  land at the renderer (`legacy-glamour-table.ts`) so both shells inherit the fix.
+- Error response bodies embedded in `LegacyOrgsListUnexpectedStatusError` are sanitized by
+  `mapLegacyHttpError` (control chars stripped, capped at 1024 bytes).
diff --git a/apps/cli/src/legacy/commands/orgs/list/list.command.ts b/apps/cli/src/legacy/commands/orgs/list/list.command.ts
index 0d5c891c3c..f3f0d29b23 100644
--- a/apps/cli/src/legacy/commands/orgs/list/list.command.ts
+++ b/apps/cli/src/legacy/commands/orgs/list/list.command.ts
@@ -1,5 +1,9 @@
 import { Command } from "effect/unstable/cli";
 import type * as CliCommand from "effect/unstable/cli/Command";
+
+import { withJsonErrorHandling } from "../../../../shared/output/json-error-handling.ts";
+import { legacyManagementApiRuntimeLayer } from "../../../shared/legacy-management-api-runtime.layer.ts";
+import { withLegacyCommandInstrumentation } from "../../../telemetry/legacy-command-instrumentation.ts";
 import { legacyOrgsList } from "./list.handler.ts";
 
 const config = {};
@@ -8,5 +12,8 @@ export type LegacyOrgsListFlags = CliCommand.Command.Config.Infer<typeof config>
 export const legacyOrgsListCommand = Command.make("list", config).pipe(
   Command.withDescription("List all organizations the logged-in user belongs."),
   Command.withShortDescription("List all organizations"),
-  Command.withHandler((flags) => legacyOrgsList(flags)),
+  Command.withHandler((flags) =>
+    legacyOrgsList(flags).pipe(withLegacyCommandInstrumentation({ flags }), withJsonErrorHandling),
+  ),
+  Command.provide(legacyManagementApiRuntimeLayer(["orgs", "list"])),
 );
diff --git a/apps/cli/src/legacy/commands/orgs/list/list.handler.ts b/apps/cli/src/legacy/commands/orgs/list/list.handler.ts
index 470215e8dc..0cca870961 100644
--- a/apps/cli/src/legacy/commands/orgs/list/list.handler.ts
+++ b/apps/cli/src/legacy/commands/orgs/list/list.handler.ts
@@ -1,10 +1,77 @@
-import { Effect } from "effect";
-import { LegacyGoProxy } from "../../../../shared/legacy/go-proxy.service.ts";
+import type { V1ListAllOrganizationsOutput } from "@supabase/api/effect";
+import { Effect, Option } from "effect";
+
+import { LegacyPlatformApi } from "../../../auth/legacy-platform-api.service.ts";
+import { LegacyTelemetryState } from "../../../telemetry/legacy-telemetry-state.service.ts";
+import { LegacyOutputFlag } from "../../../../shared/legacy/global-flags.ts";
+import { Output } from "../../../../shared/output/output.service.ts";
+import { encodeGoJson, encodeToml, encodeYaml } from "../../../shared/legacy-go-output.encoders.ts";
+import { mapLegacyHttpError } from "../../../shared/legacy-http-errors.ts";
+import {
+  LegacyOrgsEnvNotSupportedError,
+  LegacyOrgsListNetworkError,
+  LegacyOrgsListUnexpectedStatusError,
+} from "../orgs.errors.ts";
+import { renderOrgsListTable } from "../orgs.format.ts";
 import type { LegacyOrgsListFlags } from "./list.command.ts";
 
+type Organizations = typeof V1ListAllOrganizationsOutput.Type;
+
+const mapListError = mapLegacyHttpError({
+  networkError: LegacyOrgsListNetworkError,
+  statusError: LegacyOrgsListUnexpectedStatusError,
+  networkMessage: (cause) => `failed to list organizations: ${cause}`,
+  statusMessage: (status, body) => `unexpected list organizations status ${status}: ${body}`,
+});
+
 export const legacyOrgsList = Effect.fn("legacy.orgs.list")(function* (
   _flags: LegacyOrgsListFlags,
 ) {
-  const proxy = yield* LegacyGoProxy;
-  yield* proxy.exec(["orgs", "list"]);
+  const output = yield* Output;
+  const goOutputFlag = yield* LegacyOutputFlag;
+  const api = yield* LegacyPlatformApi;
+  const telemetryState = yield* LegacyTelemetryState;
+
+  yield* Effect.gen(function* () {
+    // Spinner runs only in text mode — it would corrupt machine-readable
+    // stdout. The output-routing branches below dispatch on `goFmt`, but the
+    // spinner uses `output.format` because `--output pretty` keeps the format
+    // as "text" while requiring the table render; both paths need the spinner.
+    const fetching =
+      output.format === "text" ? yield* output.task("Fetching organizations...") : undefined;
+    const orgs: Organizations = yield* api.v1.listAllOrganizations().pipe(
+      Effect.tapError(() => fetching?.fail() ?? Effect.void),
+      Effect.catch(mapListError),
+    );
+    yield* fetching?.clear() ?? Effect.void;
+
+    const goFmt = Option.getOrUndefined(goOutputFlag);
+
+    if (goFmt === "env") {
+      return yield* new LegacyOrgsEnvNotSupportedError({
+        message: "--output env flag is not supported",
+      });
+    }
+    if (goFmt === "json") {
+      yield* output.raw(encodeGoJson(orgs));
+      return;
+    }
+    if (goFmt === "yaml") {
+      yield* output.raw(encodeYaml(orgs));
+      return;
+    }
+    if (goFmt === "toml") {
+      yield* output.raw(encodeToml({ organizations: orgs }) + "\n");
+      return;
+    }
+
+    // goFmt is undefined or "pretty" — defer to TS --output-format for
+    // JSON/stream-json, otherwise render the Glamour-styled table.
+    if (output.format === "json" || output.format === "stream-json") {
+      yield* output.success("", { organizations: orgs });
+      return;
+    }
+
+    yield* output.raw(renderOrgsListTable(orgs));
+  }).pipe(Effect.ensuring(telemetryState.flush));
 });
diff --git a/apps/cli/src/legacy/commands/orgs/list/list.integration.test.ts b/apps/cli/src/legacy/commands/orgs/list/list.integration.test.ts
new file mode 100644
index 0000000000..431aac47a1
--- /dev/null
+++ b/apps/cli/src/legacy/commands/orgs/list/list.integration.test.ts
@@ -0,0 +1,245 @@
+import type { V1ListAllOrganizationsOutput } from "@supabase/api/effect";
+import { describe, expect, it } from "@effect/vitest";
+import { Effect, Exit, Option } from "effect";
+
+import { mockOutput } from "../../../../../tests/helpers/mocks.ts";
+import {
+  buildLegacyTestRuntime,
+  mockLegacyCliConfig,
+  mockLegacyPlatformApi,
+  mockLegacyTelemetryStateTracked,
+  useLegacyTempWorkdir,
+} from "../../../../../tests/helpers/legacy-mocks.ts";
+import { legacyOrgsList } from "./list.handler.ts";
+
+type Organizations = typeof V1ListAllOrganizationsOutput.Type;
+
+const SAMPLE_ORG: Organizations[number] = {
+  id: "combined-fuchsia-lion",
+  slug: "combined-fuchsia-lion",
+  name: "Test Org",
+};
+
+const SAMPLE_ORG_PIPE: Organizations[number] = {
+  id: "calm-cobalt-emu",
+  slug: "calm-cobalt-emu",
+  name: "with|pipe",
+};
+
+const tempRoot = useLegacyTempWorkdir("supabase-orgs-list-int-");
+
+interface SetupOpts {
+  readonly format?: "text" | "json" | "stream-json";
+  readonly goOutput?: "env" | "pretty" | "json" | "toml" | "yaml";
+  readonly response?: Organizations;
+  readonly status?: number;
+  readonly network?: "fail";
+}
+
+function setup(opts: SetupOpts = {}) {
+  const out = mockOutput({ format: opts.format ?? "text" });
+  const api = mockLegacyPlatformApi({
+    response: { status: opts.status ?? 200, body: opts.response ?? [SAMPLE_ORG] },
+    network: opts.network,
+  });
+  const cliConfig = mockLegacyCliConfig({ workdir: tempRoot.current });
+  const layer = buildLegacyTestRuntime({
+    out,
+    api,
+    cliConfig,
+    goOutput: opts.goOutput === undefined ? Option.none() : Option.some(opts.goOutput),
+  });
+  return { layer, out, api };
+}
+
+function setupTracked(opts: SetupOpts = {}) {
+  const out = mockOutput({ format: opts.format ?? "text" });
+  const api = mockLegacyPlatformApi({
+    response: { status: opts.status ?? 200, body: opts.response ?? [SAMPLE_ORG] },
+    network: opts.network,
+  });
+  const cliConfig = mockLegacyCliConfig({ workdir: tempRoot.current });
+  const telemetry = mockLegacyTelemetryStateTracked();
+  const layer = buildLegacyTestRuntime({
+    out,
+    api,
+    cliConfig,
+    telemetry: telemetry.layer,
+  });
+  return { layer, out, api, telemetry };
+}
+
+describe("legacy orgs list integration", () => {
+  it.live("renders a Glamour table with ID and NAME columns in text mode", () => {
+    const { layer, out } = setup({ response: [SAMPLE_ORG] });
+    return Effect.gen(function* () {
+      yield* legacyOrgsList({});
+      expect(out.stdoutText).toContain("ID");
+      expect(out.stdoutText).toContain("NAME");
+      expect(out.stdoutText).toContain("combined-fuchsia-lion");
+      expect(out.stdoutText).toContain("Test Org");
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("renders an empty table when the API returns []", () => {
+    const { layer, out } = setup({ response: [] });
+    return Effect.gen(function* () {
+      yield* legacyOrgsList({});
+      expect(out.stdoutText).toContain("NAME");
+      expect(out.stdoutText).not.toContain("Test Org");
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("renders literal | characters in organization names (Go parity)", () => {
+    const { layer, out } = setup({ response: [SAMPLE_ORG_PIPE] });
+    return Effect.gen(function* () {
+      yield* legacyOrgsList({});
+      expect(out.stdoutText).toContain("with|pipe");
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("emits a success event with { organizations } for --output-format=json", () => {
+    const { layer, out } = setup({ format: "json", response: [SAMPLE_ORG] });
+    return Effect.gen(function* () {
+      yield* legacyOrgsList({});
+      const success = out.messages.find((m) => m.type === "success");
+      expect(success).toBeDefined();
+      expect(success?.data).toMatchObject({ organizations: [SAMPLE_ORG] });
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("emits a success event for --output-format=stream-json", () => {
+    const { layer, out } = setup({ format: "stream-json", response: [SAMPLE_ORG] });
+    return Effect.gen(function* () {
+      yield* legacyOrgsList({});
+      expect(out.messages.find((m) => m.type === "success")).toBeDefined();
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("emits Go-byte-exact indented JSON for --output json", () => {
+    const { layer, out } = setup({ goOutput: "json", response: [SAMPLE_ORG] });
+    return Effect.gen(function* () {
+      yield* legacyOrgsList({});
+      expect(out.stdoutText.startsWith("[\n  {\n")).toBe(true);
+      expect(out.stdoutText.endsWith("]\n")).toBe(true);
+      expect(out.stdoutText).toContain('"name": "Test Org"');
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("emits a YAML array for --output yaml", () => {
+    const { layer, out } = setup({ goOutput: "yaml", response: [SAMPLE_ORG] });
+    return Effect.gen(function* () {
+      yield* legacyOrgsList({});
+      expect(out.stdoutText).toContain("name: Test Org");
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("wraps result as { organizations = [...] } for --output toml", () => {
+    const { layer, out } = setup({ goOutput: "toml", response: [SAMPLE_ORG] });
+    return Effect.gen(function* () {
+      yield* legacyOrgsList({});
+      expect(out.stdoutText).toContain("[[organizations]]");
+      expect(out.stdoutText).toContain('name = "Test Org"');
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("fails with LegacyOrgsEnvNotSupportedError for --output env", () => {
+    const { layer } = setup({ goOutput: "env", response: [SAMPLE_ORG] });
+    return Effect.gen(function* () {
+      const exit = yield* Effect.exit(legacyOrgsList({}));
+      expect(Exit.isFailure(exit)).toBe(true);
+      if (Exit.isFailure(exit)) {
+        const json = JSON.stringify(exit.cause);
+        expect(json).toContain("LegacyOrgsEnvNotSupportedError");
+        expect(json).toContain("--output env flag is not supported");
+      }
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("treats --output pretty as identical to text mode (table render)", () => {
+    const { layer, out } = setup({ goOutput: "pretty", response: [SAMPLE_ORG] });
+    return Effect.gen(function* () {
+      yield* legacyOrgsList({});
+      expect(out.stdoutText).toContain("NAME");
+      expect(out.stdoutText).toContain("Test Org");
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("--output flag wins over --output-format", () => {
+    const { layer, out } = setup({
+      format: "json",
+      goOutput: "yaml",
+      response: [SAMPLE_ORG],
+    });
+    return Effect.gen(function* () {
+      yield* legacyOrgsList({});
+      expect(out.stdoutText).toContain("name: Test Org");
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("calls GET /v1/organizations with no path params", () => {
+    const { layer, api } = setup({ response: [SAMPLE_ORG] });
+    return Effect.gen(function* () {
+      yield* legacyOrgsList({});
+      expect(api.requests).toHaveLength(1);
+      expect(api.requests[0]?.method).toBe("GET");
+      expect(api.requests[0]?.url).toContain("/v1/organizations");
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("fails with LegacyOrgsListUnexpectedStatusError on HTTP 503", () => {
+    const { layer } = setup({ status: 503, response: [] });
+    return Effect.gen(function* () {
+      const exit = yield* Effect.exit(legacyOrgsList({}));
+      expect(Exit.isFailure(exit)).toBe(true);
+      if (Exit.isFailure(exit)) {
+        const json = JSON.stringify(exit.cause);
+        expect(json).toContain("LegacyOrgsListUnexpectedStatusError");
+        expect(json).toContain("unexpected list organizations status 503");
+      }
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("fails with LegacyOrgsListNetworkError on transport failure", () => {
+    const { layer } = setup({ network: "fail" });
+    return Effect.gen(function* () {
+      const exit = yield* Effect.exit(legacyOrgsList({}));
+      expect(Exit.isFailure(exit)).toBe(true);
+      if (Exit.isFailure(exit)) {
+        const json = JSON.stringify(exit.cause);
+        expect(json).toContain("LegacyOrgsListNetworkError");
+        expect(json).toContain("failed to list organizations");
+      }
+    }).pipe(Effect.provide(layer));
+  });
+
+  // Exercises the `fetching?.fail() ?? Effect.void` undefined branch — when
+  // --output-format != "text", no spinner exists, so the `??` fallback fires.
+  it.live("propagates a transport failure when --output-format=json suppresses the spinner", () => {
+    const { layer } = setup({ format: "json", network: "fail" });
+    return Effect.gen(function* () {
+      const exit = yield* Effect.exit(legacyOrgsList({}));
+      expect(Exit.isFailure(exit)).toBe(true);
+      if (Exit.isFailure(exit)) {
+        const json = JSON.stringify(exit.cause);
+        expect(json).toContain("LegacyOrgsListNetworkError");
+      }
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("flushes telemetry state on success", () => {
+    const { layer, telemetry } = setupTracked();
+    return Effect.gen(function* () {
+      yield* legacyOrgsList({});
+      expect(telemetry.flushed).toBe(true);
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("flushes telemetry state on failure", () => {
+    const { layer, telemetry } = setupTracked({ status: 503 });
+    return Effect.gen(function* () {
+      yield* Effect.exit(legacyOrgsList({}));
+      expect(telemetry.flushed).toBe(true);
+    }).pipe(Effect.provide(layer));
+  });
+});
diff --git a/apps/cli/src/legacy/commands/orgs/orgs.command.ts b/apps/cli/src/legacy/commands/orgs/orgs.command.ts
index 0224346157..94ab69aead 100644
--- a/apps/cli/src/legacy/commands/orgs/orgs.command.ts
+++ b/apps/cli/src/legacy/commands/orgs/orgs.command.ts
@@ -2,8 +2,11 @@ import { Command } from "effect/unstable/cli";
 import { legacyOrgsCreateCommand } from "./create/create.command.ts";
 import { legacyOrgsListCommand } from "./list/list.command.ts";
 
+// Description text matches Go's `cmd/orgs.go:13` exactly — cobra has no Long,
+// so the Short string is reused for both the subcommand summary and the
+// `supabase orgs --help` long description. No trailing period.
 export const legacyOrgsCommand = Command.make("orgs").pipe(
-  Command.withDescription("Manage Supabase organizations."),
-  Command.withShortDescription("Manage organizations"),
+  Command.withDescription("Manage Supabase organizations"),
+  Command.withShortDescription("Manage Supabase organizations"),
   Command.withSubcommands([legacyOrgsListCommand, legacyOrgsCreateCommand]),
 );
diff --git a/apps/cli/src/legacy/commands/orgs/orgs.errors.ts b/apps/cli/src/legacy/commands/orgs/orgs.errors.ts
new file mode 100644
index 0000000000..494060d003
--- /dev/null
+++ b/apps/cli/src/legacy/commands/orgs/orgs.errors.ts
@@ -0,0 +1,43 @@
+import { Data } from "effect";
+
+// ---------------------------------------------------------------------------
+// HTTP-bound errors — one (Network + UnexpectedStatus) pair per Go errorf site
+// under `apps/cli-go/internal/orgs/`. Templates byte-match Go's `errors.Errorf`.
+// ---------------------------------------------------------------------------
+
+export class LegacyOrgsListNetworkError extends Data.TaggedError("LegacyOrgsListNetworkError")<{
+  readonly message: string;
+}> {}
+
+export class LegacyOrgsListUnexpectedStatusError extends Data.TaggedError(
+  "LegacyOrgsListUnexpectedStatusError",
+)<{
+  readonly status: number;
+  readonly body: string;
+  readonly message: string;
+}> {}
+
+export class LegacyOrgsCreateNetworkError extends Data.TaggedError("LegacyOrgsCreateNetworkError")<{
+  readonly message: string;
+}> {}
+
+export class LegacyOrgsCreateUnexpectedStatusError extends Data.TaggedError(
+  "LegacyOrgsCreateUnexpectedStatusError",
+)<{
+  readonly status: number;
+  readonly body: string;
+  readonly message: string;
+}> {}
+
+// ---------------------------------------------------------------------------
+// Pure-path error — `orgs list --output env` is explicitly rejected by the Go
+// CLI (`apps/cli-go/internal/orgs/list/list.go:32-33`). `orgs create` does NOT
+// have an equivalent branch — the Go `EncodeOutput` env encoder happily
+// flattens the single object into `ID=… NAME=… SLUG=…`.
+// ---------------------------------------------------------------------------
+
+export class LegacyOrgsEnvNotSupportedError extends Data.TaggedError(
+  "LegacyOrgsEnvNotSupportedError",
+)<{
+  readonly message: string;
+}> {}
diff --git a/apps/cli/src/legacy/commands/orgs/orgs.format.ts b/apps/cli/src/legacy/commands/orgs/orgs.format.ts
new file mode 100644
index 0000000000..b8deef6172
--- /dev/null
+++ b/apps/cli/src/legacy/commands/orgs/orgs.format.ts
@@ -0,0 +1,30 @@
+import type { OrganizationResponseV1 } from "@supabase/api/effect";
+
+import { renderGlamourTable } from "../../output/legacy-glamour-table.ts";
+
+// ---------------------------------------------------------------------------
+// Pure formatter — no Effect / no service dependencies, kept unit-testable.
+// Reproduces Go's `orgs/list/list.go:ToMarkdown` + glamour pipeline.
+//
+// Go wraps each cell in backticks and escapes `|` as `\|` in the markdown
+// intermediate; glamour decodes the escape and strips the backticks. Our
+// `renderGlamourTable` lays out cells directly, so we pass raw values
+// (including any literal `|`) and the byte output matches the Go binary.
+//
+// Note (Go parity): API-supplied `id` / `name` strings are NOT stripped of
+// ANSI escape sequences or other terminal control bytes before rendering.
+// Go's `glamour` library has identical pass-through behaviour, and the legacy
+// shell's contract is strict 1:1 with the Go CLI — diverging here would mean
+// scripts grepping table cells see different bytes than they do today. If a
+// future security review decides to sanitize, it should land for both shells
+// at the renderer (`legacy-glamour-table.ts`), not per-command.
+// ---------------------------------------------------------------------------
+
+const HEADERS = ["ID", "NAME"] as const;
+
+type Organization = typeof OrganizationResponseV1.Type;
+
+export function renderOrgsListTable(orgs: ReadonlyArray<Organization>): string {
+  const rows = orgs.map((o) => [o.id, o.name]);
+  return renderGlamourTable(HEADERS, rows);
+}
diff --git a/apps/cli/src/legacy/commands/orgs/orgs.format.unit.test.ts b/apps/cli/src/legacy/commands/orgs/orgs.format.unit.test.ts
new file mode 100644
index 0000000000..2a24a7502c
--- /dev/null
+++ b/apps/cli/src/legacy/commands/orgs/orgs.format.unit.test.ts
@@ -0,0 +1,27 @@
+import { describe, expect, it } from "vitest";
+
+import { renderOrgsListTable } from "./orgs.format.ts";
+
+describe("renderOrgsListTable", () => {
+  it("renders the header row even when the organization list is empty", () => {
+    const out = renderOrgsListTable([]);
+    expect(out).toContain("ID");
+    expect(out).toContain("NAME");
+  });
+
+  it("renders one row per organization with id and name columns", () => {
+    const out = renderOrgsListTable([
+      { id: "combined-fuchsia-lion", slug: "combined-fuchsia-lion", name: "My Org" },
+      { id: "calm-cobalt-emu", slug: "calm-cobalt-emu", name: "Another Org" },
+    ]);
+    expect(out).toContain("combined-fuchsia-lion");
+    expect(out).toContain("My Org");
+    expect(out).toContain("calm-cobalt-emu");
+    expect(out).toContain("Another Org");
+  });
+
+  it("preserves literal `|` characters in organization names (Glamour does not double-escape)", () => {
+    const out = renderOrgsListTable([{ id: "id", slug: "id", name: "with|pipe" }]);
+    expect(out).toContain("with|pipe");
+  });
+});
diff --git a/apps/cli/src/legacy/commands/secrets/list/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/secrets/list/SIDE_EFFECTS.md
index 9fa7075ffd..a7a248607e 100644
--- a/apps/cli/src/legacy/commands/secrets/list/SIDE_EFFECTS.md
+++ b/apps/cli/src/legacy/commands/secrets/list/SIDE_EFFECTS.md
@@ -2,80 +2,93 @@
 
 ## Files Read
 
-| Path                       | Format                    | When                                                       |
-| -------------------------- | ------------------------- | ---------------------------------------------------------- |
-| `~/.supabase/access-token` | plain text (token string) | when `SUPABASE_ACCESS_TOKEN` unset and keyring unavailable |
+| Path                                      | Format                    | When                                                                                          |
+| ----------------------------------------- | ------------------------- | --------------------------------------------------------------------------------------------- |
+| `/proc/sys/kernel/osrelease` (Linux)      | plain text                | once on layer init — disables keyring on WSL (`WSL` / `Microsoft` substring match)            |
+| keyring `"Supabase CLI"` / `<profile>`    | OS keychain               | when `SUPABASE_ACCESS_TOKEN` unset and keyring available; account = `LegacyCliConfig.profile` |
+| keyring `"Supabase CLI"` / `access-token` | OS keychain               | legacy-key fallback when the profile-keyed lookup misses                                      |
+| `~/.supabase/access-token`                | plain text (token string) | last-resort fallback after env + keyring miss                                                 |
+| `<workdir>/supabase/.temp/project-ref`    | plain text                | when `--project-ref` and `SUPABASE_PROJECT_ID` are both unset                                 |
 
 ## Files Written
 
-| Path | Format | When |
-| ---- | ------ | ---- |
-| —    | —      | —    |
+| Path                                             | Format | When                                                                     |
+| ------------------------------------------------ | ------ | ------------------------------------------------------------------------ |
+| `~/.supabase/<workdir-hash>/linked-project.json` | JSON   | always (in `Effect.ensuring`) after `--project-ref` resolves — Go parity |
+| `~/.supabase/telemetry.json`                     | JSON   | always (in `Effect.ensuring`) at end of command — Go parity              |
 
 ## API Routes
 
-| Method | Path                         | Auth         | Request body | Response (used fields)              |
-| ------ | ---------------------------- | ------------ | ------------ | ----------------------------------- |
-| `GET`  | `/v1/projects/{ref}/secrets` | Bearer token | none         | `[{name, value}]` (value is digest) |
+| Method | Path                         | Auth         | Request body | Response (used fields)                              |
+| ------ | ---------------------------- | ------------ | ------------ | --------------------------------------------------- |
+| `GET`  | `/v1/projects/{ref}/secrets` | Bearer token | none         | `[{name, value, updated_at?}]` (value is digest)    |
+| `GET`  | `/v1/projects`               | Bearer token | none         | `[{id, ref, name, ...}]` — TTY-prompt fallback only |
 
 ## Environment Variables
 
-| Variable                | Purpose                                              | Required?                                               |
-| ----------------------- | ---------------------------------------------------- | ------------------------------------------------------- |
-| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `~/.supabase/access-token`) |
-| `SUPABASE_API_URL`      | override Management API base URL                     | no (defaults to `https://api.supabase.com`)             |
+| Variable                | Purpose                                                                                                                                                                                                                                                                                              | Required?                                                                  |
+| ----------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------- |
+| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup)                                                                                                                                                                                                                                                 | no (falls back to keyring → `~/.supabase/access-token`)                    |
+| `SUPABASE_PROFILE`      | selects API base URL: `supabase` → `api.supabase.com`, `supabase-staging` → `api.supabase.green`, `supabase-local` → `http://localhost:8080`. May alternatively be a filesystem path to a YAML profile with at least `api_url:` and optional `name:` (Go parity — used by the cli-e2e test harness). | no (defaults to `supabase`)                                                |
+| `SUPABASE_PROJECT_ID`   | project ref fallback when `--project-ref` is unset                                                                                                                                                                                                                                                   | no (also reads `<workdir>/supabase/.temp/project-ref` then prompts on TTY) |
+| `SUPABASE_WORKDIR`      | base directory for the `.temp/project-ref` lookup                                                                                                                                                                                                                                                    | no (walks up from CWD looking for `supabase/config.toml`)                  |
+| ~~`SUPABASE_API_URL`~~  | **not honored** — Go parity. Use `SUPABASE_PROFILE` to override the API base URL.                                                                                                                                                                                                                    | —                                                                          |
 
 ## Exit Codes
 
-| Code | Condition                                          |
-| ---- | -------------------------------------------------- |
-| `0`  | success — secrets printed to stdout                |
-| `1`  | authentication error — no valid token found        |
-| `1`  | API error — non-2xx response from secrets endpoint |
-| `1`  | network / connection failure                       |
+| Code | Condition                                                                                  |
+| ---- | ------------------------------------------------------------------------------------------ |
+| `0`  | success — secrets printed to stdout                                                        |
+| `1`  | `LegacyPlatformAuthRequiredError` — no token in env/keyring/file                           |
+| `1`  | `LegacyInvalidAccessTokenError` — token violates `^sbp_(oauth_)?[a-f0-9]{40}$`             |
+| `1`  | `LegacyProjectNotLinkedError` — `--project-ref` unset, env/file empty, and stdin not a TTY |
+| `1`  | `LegacyInvalidProjectRefError` — resolved ref violates `^[a-z]{20}$`                       |
+| `1`  | `LegacySecretsListUnexpectedStatusError` — non-2xx response from the secrets endpoint      |
+| `1`  | `LegacySecretsListNetworkError` — transport-level network failure                          |
+| `1`  | `LegacySecretsEnvNotSupportedError` — `--output env` flag is rejected                      |
+
+## Telemetry Events Fired
+
+| Event                  | When                                       | Notable properties / groups                                          |
+| ---------------------- | ------------------------------------------ | -------------------------------------------------------------------- |
+| `cli_command_executed` | post-run, success or failure (via wrapper) | `exit_code`, `duration_ms`, `flags` (`--project-ref` → `<redacted>`) |
+
+Matches `apps/cli-go/internal/secrets/list/`. Go does not fire any custom telemetry event for this command.
 
 ## Output
 
-### `--output-format text` (Go CLI compatible)
+The legacy `--output {pretty,json,yaml,toml,env}` flag (Go-compatible) and the new global `--output-format {text,json,stream-json}` flag are both honored. `--output` wins when both are supplied. `pretty` and `text` map to the same render path.
 
-Prints a Markdown-style table to stdout with a header row and one row per secret.
-Column order: `NAME`, `DIGEST`. Columns are separated by `|`.
+### `--output pretty` (Go default) / `--output-format text`
 
-```
-|NAME|DIGEST|
-|-|-|
-|`MY_SECRET`|`dummy-digest-value`|
-```
+Prints a Glamour-styled markdown table with columns `NAME` and `DIGEST`. The table is rendered byte-for-byte to match Go's `glamour.WithStandardStyle(styles.AsciiStyle)` output (verified against the Go binary fixture). Secrets are sorted alphabetically by `name`.
 
-### `--output-format json`
+### `--output json` (Go-compat)
 
-Single JSON array emitted to stdout on success. Each element contains the name and digest value.
+Indented JSON of the sorted `[{name, value, updated_at?}]` array, terminated by a newline. Field order is alphabetical (matches Go's struct declaration order for `SecretResponse`).
 
-```json
-[
-  {
-    "name": "MY_SECRET",
-    "value": "dummy-digest-value"
-  }
-]
-```
+### `--output yaml`
 
-### `--output-format stream-json`
+YAML document of the sorted secret array.
+
+### `--output toml`
 
-One `result` event on success.
+TOML document wrapping the sorted array as `[[secrets]]`. JSON shape is preserved; leaf order may differ from Go's `BurntSushi/toml` encoder.
 
-```ndjson
-{"type":"result","data":[{"name":"MY_SECRET","value":"dummy-digest-value"}]}
-```
+### `--output env`
 
-On failure, an `error` event is emitted instead:
+Fails immediately with `LegacySecretsEnvNotSupportedError("--output env flag is not supported")` — Go parity.
+
+### `--output-format json`
+
+Single JSON object emitted via `Output.success` with `{secrets: [...]}` as the `data` field.
+
+### `--output-format stream-json`
 
-```ndjson
-{"type":"error","code":"ApiError","message":"…"}
-```
+One `result` NDJSON event on success containing `{secrets: [...]}`.
 
 ## Notes
 
 - The `value` field returned by the API is a digest/hash of the secret, not the plaintext value.
-- Results are sorted alphabetically by name.
-- Requires `--project-ref` or a linked project (`.supabase/config.json`).
+- Results are sorted alphabetically by `name` before any encoding (Go `list.go:52-54`).
+- Sends `User-Agent: SupabaseCLI/<version>` and Bearer auth. No `X-Supabase-Command` headers — Go parity.
diff --git a/apps/cli/src/legacy/commands/secrets/list/list.command.ts b/apps/cli/src/legacy/commands/secrets/list/list.command.ts
index da810622fd..7ce4d0e59f 100644
--- a/apps/cli/src/legacy/commands/secrets/list/list.command.ts
+++ b/apps/cli/src/legacy/commands/secrets/list/list.command.ts
@@ -1,4 +1,9 @@
+import type * as CliCommand from "effect/unstable/cli/Command";
 import { Command, Flag } from "effect/unstable/cli";
+
+import { withJsonErrorHandling } from "../../../../shared/output/json-error-handling.ts";
+import { legacyManagementApiRuntimeLayer } from "../../../shared/legacy-management-api-runtime.layer.ts";
+import { withLegacyCommandInstrumentation } from "../../../telemetry/legacy-command-instrumentation.ts";
 import { legacySecretsList } from "./list.handler.ts";
 
 const config = {
@@ -6,7 +11,9 @@ const config = {
     Flag.withDescription("Project ref of the Supabase project."),
     Flag.optional,
   ),
-};
+} as const;
+
+export type LegacySecretsListFlags = CliCommand.Command.Config.Infer<typeof config>;
 
 export const legacySecretsListCommand = Command.make("list", config).pipe(
   Command.withDescription("List all secrets in the linked project."),
@@ -21,5 +28,11 @@ export const legacySecretsListCommand = Command.make("list", config).pipe(
       description: "List secrets for a specific project",
     },
   ]),
-  Command.withHandler((flags) => legacySecretsList(flags)),
+  Command.withHandler((flags) =>
+    legacySecretsList(flags).pipe(
+      withLegacyCommandInstrumentation({ flags }),
+      withJsonErrorHandling,
+    ),
+  ),
+  Command.provide(legacyManagementApiRuntimeLayer(["secrets", "list"])),
 );
diff --git a/apps/cli/src/legacy/commands/secrets/list/list.handler.ts b/apps/cli/src/legacy/commands/secrets/list/list.handler.ts
index 98c66391c1..335cf34de3 100644
--- a/apps/cli/src/legacy/commands/secrets/list/list.handler.ts
+++ b/apps/cli/src/legacy/commands/secrets/list/list.handler.ts
@@ -1,15 +1,86 @@
+import type { V1ListAllSecretsOutput } from "@supabase/api/effect";
 import { Effect, Option } from "effect";
-import { LegacyGoProxy } from "../../../../shared/legacy/go-proxy.service.ts";
 
-interface LegacySecretsListFlags {
-  readonly projectRef: Option.Option<string>;
+import { LegacyPlatformApi } from "../../../auth/legacy-platform-api.service.ts";
+import { LegacyProjectRefResolver } from "../../../config/legacy-project-ref.service.ts";
+import { LegacyLinkedProjectCache } from "../../../telemetry/legacy-linked-project-cache.service.ts";
+import { LegacyTelemetryState } from "../../../telemetry/legacy-telemetry-state.service.ts";
+import { LegacyOutputFlag } from "../../../../shared/legacy/global-flags.ts";
+import { Output } from "../../../../shared/output/output.service.ts";
+import { encodeGoJson, encodeToml, encodeYaml } from "../../../shared/legacy-go-output.encoders.ts";
+import { mapLegacyHttpError } from "../../../shared/legacy-http-errors.ts";
+import {
+  LegacySecretsEnvNotSupportedError,
+  LegacySecretsListNetworkError,
+  LegacySecretsListUnexpectedStatusError,
+} from "../secrets.errors.ts";
+import { renderSecretsListTable } from "../secrets.format.ts";
+import type { LegacySecretsListFlags } from "./list.command.ts";
+
+type Secrets = typeof V1ListAllSecretsOutput.Type;
+
+const mapListError = mapLegacyHttpError({
+  networkError: LegacySecretsListNetworkError,
+  statusError: LegacySecretsListUnexpectedStatusError,
+  networkMessage: (cause) => `failed to list secrets: ${cause}`,
+  statusMessage: (status, body) => `unexpected list secrets status ${status}: ${body}`,
+});
+
+function sortSecrets(secrets: Secrets): Secrets {
+  return [...secrets].sort((a, b) => (a.name < b.name ? -1 : a.name > b.name ? 1 : 0));
 }
 
 export const legacySecretsList = Effect.fn("legacy.secrets.list")(function* (
   flags: LegacySecretsListFlags,
 ) {
-  const proxy = yield* LegacyGoProxy;
-  const args: string[] = ["secrets", "list"];
-  if (Option.isSome(flags.projectRef)) args.push("--project-ref", flags.projectRef.value);
-  yield* proxy.exec(args);
+  const output = yield* Output;
+  const goOutputFlag = yield* LegacyOutputFlag;
+  const api = yield* LegacyPlatformApi;
+  const resolver = yield* LegacyProjectRefResolver;
+  const linkedProjectCache = yield* LegacyLinkedProjectCache;
+  const telemetryState = yield* LegacyTelemetryState;
+
+  const ref = yield* resolver.resolve(flags.projectRef);
+
+  // Mirror Go's PersistentPostRun: write the linked-project cache and persist
+  // the telemetry state file whether the main API call succeeds or fails.
+  yield* Effect.gen(function* () {
+    const fetching =
+      output.format === "text" ? yield* output.task("Fetching secrets...") : undefined;
+    const response = yield* api.v1.listAllSecrets({ ref }).pipe(
+      Effect.tapError(() => fetching?.fail() ?? Effect.void),
+      Effect.catch(mapListError),
+    );
+    yield* fetching?.clear() ?? Effect.void;
+
+    const sorted = sortSecrets(response);
+    const goFmt = Option.getOrUndefined(goOutputFlag);
+
+    if (goFmt === "env") {
+      return yield* new LegacySecretsEnvNotSupportedError({
+        message: "--output env flag is not supported",
+      });
+    }
+    if (goFmt === "json") {
+      yield* output.raw(encodeGoJson(sorted));
+      return;
+    }
+    if (goFmt === "yaml") {
+      yield* output.raw(encodeYaml(sorted));
+      return;
+    }
+    if (goFmt === "toml") {
+      yield* output.raw(encodeToml({ secrets: sorted }) + "\n");
+      return;
+    }
+
+    // goFmt is undefined or "pretty" — defer to TS --output-format for JSON/stream-json,
+    // otherwise render the Glamour-styled table (Go --output pretty parity).
+    if (output.format === "json" || output.format === "stream-json") {
+      yield* output.success("", { secrets: sorted });
+      return;
+    }
+
+    yield* output.raw(renderSecretsListTable(sorted));
+  }).pipe(Effect.ensuring(linkedProjectCache.cache(ref)), Effect.ensuring(telemetryState.flush));
 });
diff --git a/apps/cli/src/legacy/commands/secrets/list/list.integration.test.ts b/apps/cli/src/legacy/commands/secrets/list/list.integration.test.ts
new file mode 100644
index 0000000000..335e81431f
--- /dev/null
+++ b/apps/cli/src/legacy/commands/secrets/list/list.integration.test.ts
@@ -0,0 +1,260 @@
+import { type V1ListAllSecretsOutput } from "@supabase/api/effect";
+import { describe, expect, it } from "@effect/vitest";
+import { Effect, Exit, Option } from "effect";
+
+import { withJsonErrorHandling } from "../../../../shared/output/json-error-handling.ts";
+import { mockOutput } from "../../../../../tests/helpers/mocks.ts";
+import {
+  LEGACY_VALID_REF,
+  buildLegacyTestRuntime,
+  mockLegacyCliConfig,
+  mockLegacyPlatformApi,
+  useLegacyTempWorkdir,
+} from "../../../../../tests/helpers/legacy-mocks.ts";
+import { legacySecretsList } from "./list.handler.ts";
+
+// ---------------------------------------------------------------------------
+// Fixtures
+// ---------------------------------------------------------------------------
+
+type SecretsResponse = typeof V1ListAllSecretsOutput.Type;
+
+const SAMPLE_SECRETS: SecretsResponse = [
+  { name: "FOO", value: "digest-foo" },
+  { name: "BAR", value: "digest-bar" },
+];
+
+// ---------------------------------------------------------------------------
+// Setup
+// ---------------------------------------------------------------------------
+
+interface SetupOpts {
+  format?: "text" | "json" | "stream-json";
+  goOutput?: "env" | "pretty" | "json" | "toml" | "yaml";
+  response?: SecretsResponse;
+  status?: number;
+  network?: "fail";
+  projectId?: Option.Option<string>;
+}
+
+const tempRoot = useLegacyTempWorkdir("supabase-secrets-list-int-");
+
+function setup(opts: SetupOpts = {}) {
+  const out = mockOutput({ format: opts.format ?? "text" });
+  const api = mockLegacyPlatformApi({
+    response: { status: opts.status ?? 200, body: opts.response ?? [] },
+    network: opts.network,
+  });
+  const cliConfig = mockLegacyCliConfig({
+    workdir: tempRoot.current,
+    projectId: opts.projectId,
+  });
+  const layer = buildLegacyTestRuntime({
+    out,
+    api,
+    cliConfig,
+    goOutput: opts.goOutput === undefined ? Option.none() : Option.some(opts.goOutput),
+  });
+  return { layer, out, api };
+}
+
+// ---------------------------------------------------------------------------
+// Tests
+// ---------------------------------------------------------------------------
+
+describe("legacy secrets list integration", () => {
+  it.live("renders a Glamour ASCII table with NAME and DIGEST columns in text mode", () => {
+    const { layer, out } = setup({ response: SAMPLE_SECRETS });
+    return Effect.gen(function* () {
+      yield* legacySecretsList({ projectRef: Option.none() });
+      expect(out.stdoutText).toContain("NAME");
+      expect(out.stdoutText).toContain("DIGEST");
+      expect(out.stdoutText).toContain("BAR");
+      expect(out.stdoutText).toContain("FOO");
+      expect(out.stdoutText).toContain("digest-foo");
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("sorts secrets alphabetically by name regardless of API response order", () => {
+    const { layer, out } = setup({
+      response: [
+        { name: "ZED", value: "z-digest" },
+        { name: "ALPHA", value: "a-digest" },
+        { name: "MID", value: "m-digest" },
+      ],
+    });
+    return Effect.gen(function* () {
+      yield* legacySecretsList({ projectRef: Option.none() });
+      const alphaPos = out.stdoutText.indexOf("ALPHA");
+      const midPos = out.stdoutText.indexOf("MID");
+      const zedPos = out.stdoutText.indexOf("ZED");
+      expect(alphaPos).toBeGreaterThan(-1);
+      expect(midPos).toBeGreaterThan(alphaPos);
+      expect(zedPos).toBeGreaterThan(midPos);
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("renders literal `|` characters in secret names without escaping (Go parity)", () => {
+    const { layer, out } = setup({
+      response: [{ name: "with|pipe", value: "digest" }],
+    });
+    return Effect.gen(function* () {
+      yield* legacySecretsList({ projectRef: Option.none() });
+      // Go's pipeline: markdown `\|` → glamour decodes to literal `|`. Our
+      // renderer skips the markdown step and emits the literal pipe directly.
+      expect(out.stdoutText).toContain("with|pipe");
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("emits a success event with { secrets } for --output-format=json", () => {
+    const { layer, out } = setup({ format: "json", response: SAMPLE_SECRETS });
+    return Effect.gen(function* () {
+      yield* legacySecretsList({ projectRef: Option.none() });
+      const success = out.messages.find((m) => m.type === "success");
+      expect(success).toBeDefined();
+      expect(success?.data).toMatchObject({
+        secrets: [
+          { name: "BAR", value: "digest-bar" },
+          { name: "FOO", value: "digest-foo" },
+        ],
+      });
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("emits a success event for --output-format=stream-json", () => {
+    const { layer, out } = setup({ format: "stream-json", response: SAMPLE_SECRETS });
+    return Effect.gen(function* () {
+      yield* legacySecretsList({ projectRef: Option.none() });
+      const success = out.messages.find((m) => m.type === "success");
+      expect(success).toBeDefined();
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("emits Go-byte-exact indented JSON to stdout for --output json", () => {
+    const { layer, out } = setup({ goOutput: "json", response: SAMPLE_SECRETS });
+    return Effect.gen(function* () {
+      yield* legacySecretsList({ projectRef: Option.none() });
+      // Sorted (BAR before FOO) and alphabetical-key JSON; matches Go's struct
+      // declaration order for SecretResponse {Name, UpdatedAt, Value}.
+      expect(out.stdoutText).toBe(
+        `[
+  {
+    "name": "BAR",
+    "value": "digest-bar"
+  },
+  {
+    "name": "FOO",
+    "value": "digest-foo"
+  }
+]
+`,
+      );
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("emits a YAML array to stdout for --output yaml", () => {
+    const { layer, out } = setup({ goOutput: "yaml", response: SAMPLE_SECRETS });
+    return Effect.gen(function* () {
+      yield* legacySecretsList({ projectRef: Option.none() });
+      expect(out.stdoutText).toContain("- name: BAR");
+      expect(out.stdoutText).toContain("value: digest-bar");
+      expect(out.stdoutText).toContain("- name: FOO");
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("wraps the array as { secrets = [...] } for --output toml", () => {
+    const { layer, out } = setup({ goOutput: "toml", response: SAMPLE_SECRETS });
+    return Effect.gen(function* () {
+      yield* legacySecretsList({ projectRef: Option.none() });
+      expect(out.stdoutText).toContain("[[secrets]]");
+      expect(out.stdoutText).toContain('name = "BAR"');
+      expect(out.stdoutText).toContain('value = "digest-bar"');
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("fails with LegacySecretsEnvNotSupportedError for --output env", () => {
+    const { layer } = setup({ goOutput: "env", response: SAMPLE_SECRETS });
+    return Effect.gen(function* () {
+      const exit = yield* Effect.exit(legacySecretsList({ projectRef: Option.none() }));
+      expect(Exit.isFailure(exit)).toBe(true);
+      if (Exit.isFailure(exit)) {
+        const errJson = JSON.stringify(exit.cause);
+        expect(errJson).toContain("LegacySecretsEnvNotSupportedError");
+        expect(errJson).toContain("--output env flag is not supported");
+      }
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("treats --output pretty as identical to text mode (Glamour table)", () => {
+    const { layer, out } = setup({ goOutput: "pretty", response: SAMPLE_SECRETS });
+    return Effect.gen(function* () {
+      yield* legacySecretsList({ projectRef: Option.none() });
+      expect(out.stdoutText).toContain("DIGEST");
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("--output flag value wins over --output-format when both provided", () => {
+    const { layer, out } = setup({
+      format: "json",
+      goOutput: "yaml",
+      response: SAMPLE_SECRETS,
+    });
+    return Effect.gen(function* () {
+      yield* legacySecretsList({ projectRef: Option.none() });
+      expect(out.stdoutText).toContain("- name: BAR");
+      expect(out.stdoutText.startsWith("[")).toBe(false);
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("passes the resolved project ref into the listAllSecrets URL", () => {
+    const { layer, api } = setup({ response: SAMPLE_SECRETS });
+    return Effect.gen(function* () {
+      yield* legacySecretsList({ projectRef: Option.none() });
+      expect(api.requests).toHaveLength(1);
+      expect(api.requests[0]?.url).toContain(`/v1/projects/${LEGACY_VALID_REF}/secrets`);
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("uses --project-ref flag value over LegacyCliConfig.projectId env", () => {
+    const flagRef = "zzzzzzzzzzzzzzzzzzzz";
+    const { layer, api } = setup({ response: SAMPLE_SECRETS });
+    return Effect.gen(function* () {
+      yield* legacySecretsList({ projectRef: Option.some(flagRef) });
+      expect(api.requests[0]?.url).toContain(`/v1/projects/${flagRef}/`);
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("fails with LegacySecretsListUnexpectedStatusError on HTTP 503", () => {
+    const { layer } = setup({ status: 503, response: [] });
+    return Effect.gen(function* () {
+      const exit = yield* Effect.exit(legacySecretsList({ projectRef: Option.none() }));
+      expect(Exit.isFailure(exit)).toBe(true);
+      if (Exit.isFailure(exit)) {
+        const errJson = JSON.stringify(exit.cause);
+        expect(errJson).toContain("LegacySecretsListUnexpectedStatusError");
+        expect(errJson).toContain("unexpected list secrets status 503");
+      }
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("fails with LegacySecretsListNetworkError on transport failure", () => {
+    const { layer } = setup({ network: "fail" });
+    return Effect.gen(function* () {
+      const exit = yield* Effect.exit(legacySecretsList({ projectRef: Option.none() }));
+      expect(Exit.isFailure(exit)).toBe(true);
+      if (Exit.isFailure(exit)) {
+        const errJson = JSON.stringify(exit.cause);
+        expect(errJson).toContain("LegacySecretsListNetworkError");
+        expect(errJson).toContain("failed to list secrets");
+      }
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("withJsonErrorHandling emits a fail event in JSON mode on 503", () => {
+    const { layer, out } = setup({ format: "json", status: 503, response: [] });
+    return Effect.gen(function* () {
+      yield* legacySecretsList({ projectRef: Option.none() }).pipe(withJsonErrorHandling);
+      expect(out.messages.some((m) => m.type === "fail")).toBe(true);
+    }).pipe(Effect.provide(layer));
+  });
+});
diff --git a/apps/cli/src/legacy/commands/secrets/secrets.errors.ts b/apps/cli/src/legacy/commands/secrets/secrets.errors.ts
new file mode 100644
index 0000000000..7094cf2336
--- /dev/null
+++ b/apps/cli/src/legacy/commands/secrets/secrets.errors.ts
@@ -0,0 +1,90 @@
+import { Data } from "effect";
+
+// ---------------------------------------------------------------------------
+// HTTP-bound errors (network + unexpected-status pairs)
+// ---------------------------------------------------------------------------
+
+export class LegacySecretsListNetworkError extends Data.TaggedError(
+  "LegacySecretsListNetworkError",
+)<{
+  readonly message: string;
+}> {}
+
+export class LegacySecretsListUnexpectedStatusError extends Data.TaggedError(
+  "LegacySecretsListUnexpectedStatusError",
+)<{
+  readonly status: number;
+  readonly body: string;
+  readonly message: string;
+}> {}
+
+export class LegacySecretsSetNetworkError extends Data.TaggedError("LegacySecretsSetNetworkError")<{
+  readonly message: string;
+}> {}
+
+export class LegacySecretsSetUnexpectedStatusError extends Data.TaggedError(
+  "LegacySecretsSetUnexpectedStatusError",
+)<{
+  readonly status: number;
+  readonly body: string;
+  readonly message: string;
+}> {}
+
+export class LegacySecretsUnsetNetworkError extends Data.TaggedError(
+  "LegacySecretsUnsetNetworkError",
+)<{
+  readonly message: string;
+}> {}
+
+export class LegacySecretsUnsetUnexpectedStatusError extends Data.TaggedError(
+  "LegacySecretsUnsetUnexpectedStatusError",
+)<{
+  readonly status: number;
+  readonly body: string;
+  readonly message: string;
+}> {}
+
+// ---------------------------------------------------------------------------
+// Pure-path errors (validation, file I/O, user cancellation)
+// ---------------------------------------------------------------------------
+
+export class LegacySecretsEnvFileOpenError extends Data.TaggedError(
+  "LegacySecretsEnvFileOpenError",
+)<{
+  readonly message: string;
+}> {}
+
+export class LegacySecretsEnvFileParseError extends Data.TaggedError(
+  "LegacySecretsEnvFileParseError",
+)<{
+  readonly message: string;
+}> {}
+
+export class LegacyInvalidSecretPairError extends Data.TaggedError("LegacyInvalidSecretPairError")<{
+  readonly pair: string;
+  readonly message: string;
+}> {}
+
+export class LegacySecretsNoArgumentsError extends Data.TaggedError(
+  "LegacySecretsNoArgumentsError",
+)<{
+  readonly message: string;
+}> {}
+
+export class LegacySecretsEnvNotSupportedError extends Data.TaggedError(
+  "LegacySecretsEnvNotSupportedError",
+)<{
+  readonly message: string;
+}> {}
+
+export class LegacySecretsUnsetCancelledError extends Data.TaggedError(
+  "LegacySecretsUnsetCancelledError",
+)<{
+  readonly message: string;
+}> {}
+
+export class LegacySecretsConfigParseError extends Data.TaggedError(
+  "LegacySecretsConfigParseError",
+)<{
+  readonly message: string;
+}> {}
diff --git a/apps/cli/src/legacy/commands/secrets/secrets.format.ts b/apps/cli/src/legacy/commands/secrets/secrets.format.ts
new file mode 100644
index 0000000000..af6dab1ca1
--- /dev/null
+++ b/apps/cli/src/legacy/commands/secrets/secrets.format.ts
@@ -0,0 +1,25 @@
+import { renderGlamourTable } from "../../output/legacy-glamour-table.ts";
+
+const SECRETS_HEADERS = ["NAME", "DIGEST"] as const;
+
+/**
+ * Reproduces the byte output of Go's `secrets list` pretty mode:
+ *
+ *   1. Go builds a markdown table source where each cell content is wrapped in
+ *      backticks and any `|` in the name is markdown-escaped with `\|`.
+ *   2. Go pipes that through `glamour.RenderTable` (`AsciiStyle`).
+ *
+ * Glamour's renderer strips the backticks and converts the markdown-escaped
+ * `\|` back to a literal `|` in cell content before laying out columns. The
+ * net result is the cell content rendered as-is. `renderGlamourTable` skips
+ * the markdown intermediate step entirely and lays out columns directly, so
+ * we pass the raw name and digest with no escaping or wrapping. Verified
+ * byte-identical against `apps/cli-go` on `secrets list` with empty, single,
+ * and pipe-containing names.
+ */
+export function renderSecretsListTable(
+  secrets: ReadonlyArray<{ readonly name: string; readonly value: string }>,
+): string {
+  const rows = secrets.map((s) => [s.name, s.value]);
+  return renderGlamourTable(SECRETS_HEADERS, rows);
+}
diff --git a/apps/cli/src/legacy/commands/secrets/secrets.format.unit.test.ts b/apps/cli/src/legacy/commands/secrets/secrets.format.unit.test.ts
new file mode 100644
index 0000000000..2d4b586c01
--- /dev/null
+++ b/apps/cli/src/legacy/commands/secrets/secrets.format.unit.test.ts
@@ -0,0 +1,35 @@
+import { describe, expect, it } from "vitest";
+
+import { renderSecretsListTable } from "./secrets.format.ts";
+
+describe("renderSecretsListTable", () => {
+  it("produces a header-only Glamour table when there are no secrets", () => {
+    expect(renderSecretsListTable([])).toBe("\n  \n   NAME | DIGEST \n  ------|--------\n\n");
+  });
+
+  it("aligns NAME and DIGEST columns for a two-row input (Go byte-parity)", () => {
+    expect(
+      renderSecretsListTable([
+        { name: "MY_SECRET", value: "digest123" },
+        { name: "OTHER", value: "digest456" },
+      ]),
+    ).toBe(
+      "\n  \n   NAME      | DIGEST    \n" +
+        "  -----------|-----------\n" +
+        "   MY_SECRET | digest123 \n" +
+        "   OTHER     | digest456 \n\n",
+    );
+  });
+
+  it("passes literal `|` characters in names through without escaping", () => {
+    // Go writes `\|` in its markdown source; Glamour decodes it back to a
+    // literal pipe in the rendered cell. Going direct to the row renderer
+    // produces the same byte output (verified against the Go binary).
+    const out = renderSecretsListTable([{ name: "with|pipe", value: "digest456" }]);
+    expect(out).toBe(
+      "\n  \n   NAME      | DIGEST    \n" +
+        "  -----------|-----------\n" +
+        "   with|pipe | digest456 \n\n",
+    );
+  });
+});
diff --git a/apps/cli/src/legacy/commands/secrets/set/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/secrets/set/SIDE_EFFECTS.md
index 20e0d41af5..c99884485e 100644
--- a/apps/cli/src/legacy/commands/secrets/set/SIDE_EFFECTS.md
+++ b/apps/cli/src/legacy/commands/secrets/set/SIDE_EFFECTS.md
@@ -2,64 +2,87 @@
 
 ## Files Read
 
-| Path                       | Format                    | When                                                       |
-| -------------------------- | ------------------------- | ---------------------------------------------------------- |
-| `~/.supabase/access-token` | plain text (token string) | when `SUPABASE_ACCESS_TOKEN` unset and keyring unavailable |
-| `<env-file>`               | `.env` format             | when `--env-file` flag is provided                         |
+| Path                                      | Format                    | When                                                                                          |
+| ----------------------------------------- | ------------------------- | --------------------------------------------------------------------------------------------- |
+| `/proc/sys/kernel/osrelease` (Linux)      | plain text                | once on layer init — disables keyring on WSL (`WSL` / `Microsoft` substring match)            |
+| keyring `"Supabase CLI"` / `<profile>`    | OS keychain               | when `SUPABASE_ACCESS_TOKEN` unset and keyring available; account = `LegacyCliConfig.profile` |
+| keyring `"Supabase CLI"` / `access-token` | OS keychain               | legacy-key fallback when the profile-keyed lookup misses                                      |
+| `~/.supabase/access-token`                | plain text (token string) | last-resort fallback after env + keyring miss                                                 |
+| `<workdir>/supabase/.temp/project-ref`    | plain text                | when `--project-ref` and `SUPABASE_PROJECT_ID` are both unset                                 |
+| `<workdir>/supabase/config.toml`          | TOML                      | always (for `[edge_runtime.secrets]`) — via `@supabase/config`'s `loadProjectConfig`          |
+| `<workdir>/.env`                          | dotenv                    | always — context for `env(VAR)` interpolation in `[edge_runtime.secrets]` values              |
+| `<workdir>/.env.local`                    | dotenv                    | always — overrides `.env` for `env(VAR)` interpolation context                                |
+| `<env-file>` (absolute or CWD-relative)   | dotenv                    | when `--env-file` flag is provided                                                            |
 
 ## Files Written
 
-| Path | Format | When |
-| ---- | ------ | ---- |
-| —    | —      | —    |
+| Path                                             | Format | When                                                                     |
+| ------------------------------------------------ | ------ | ------------------------------------------------------------------------ |
+| `~/.supabase/<workdir-hash>/linked-project.json` | JSON   | always (in `Effect.ensuring`) after `--project-ref` resolves — Go parity |
+| `~/.supabase/telemetry.json`                     | JSON   | always (in `Effect.ensuring`) at end of command — Go parity              |
 
 ## API Routes
 
-| Method | Path                         | Auth         | Request body                           | Response (used fields) |
-| ------ | ---------------------------- | ------------ | -------------------------------------- | ---------------------- |
-| `POST` | `/v1/projects/{ref}/secrets` | Bearer token | `[{name: string, value: string}, ...]` | none (201 expected)    |
+| Method | Path                         | Auth         | Request body                           | Response (used fields)   |
+| ------ | ---------------------------- | ------------ | -------------------------------------- | ------------------------ |
+| `POST` | `/v1/projects/{ref}/secrets` | Bearer token | `[{name: string, value: string}, ...]` | none (201 expected)      |
+| `GET`  | `/v1/projects`               | Bearer token | none                                   | TTY-prompt fallback only |
 
 ## Environment Variables
 
-| Variable                | Purpose                                              | Required?                                               |
-| ----------------------- | ---------------------------------------------------- | ------------------------------------------------------- |
-| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `~/.supabase/access-token`) |
-| `SUPABASE_API_URL`      | override Management API base URL                     | no (defaults to `https://api.supabase.com`)             |
+| Variable                | Purpose                                                                                                                                                                                                                                                                                              | Required?                                                                  |
+| ----------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------- |
+| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup)                                                                                                                                                                                                                                                 | no (falls back to keyring → `~/.supabase/access-token`)                    |
+| `SUPABASE_PROFILE`      | selects API base URL: `supabase` → `api.supabase.com`, `supabase-staging` → `api.supabase.green`, `supabase-local` → `http://localhost:8080`. May alternatively be a filesystem path to a YAML profile with at least `api_url:` and optional `name:` (Go parity — used by the cli-e2e test harness). | no (defaults to `supabase`)                                                |
+| `SUPABASE_PROJECT_ID`   | project ref fallback when `--project-ref` is unset                                                                                                                                                                                                                                                   | no (also reads `<workdir>/supabase/.temp/project-ref` then prompts on TTY) |
+| `SUPABASE_WORKDIR`      | base directory for the `.temp/project-ref` lookup                                                                                                                                                                                                                                                    | no (walks up from CWD looking for `supabase/config.toml`)                  |
+| `env(VAR)` references   | values matching `env(NAME)` in `[edge_runtime.secrets]` are resolved against the loaded env. Missing variables preserve the literal verbatim (Go parity).                                                                                                                                            | —                                                                          |
+| ~~`SUPABASE_API_URL`~~  | **not honored** — Go parity. Use `SUPABASE_PROFILE` to override the API base URL.                                                                                                                                                                                                                    | —                                                                          |
 
 ## Exit Codes
 
-| Code | Condition                                           |
-| ---- | --------------------------------------------------- |
-| `0`  | success — secrets set on the linked project         |
-| `1`  | no secrets provided (no args and no `--env-file`)   |
-| `1`  | malformed secret pair (must be `NAME=VALUE` format) |
-| `1`  | authentication error — no valid token found         |
-| `1`  | API error — non-2xx response from secrets endpoint  |
-| `1`  | network / connection failure                        |
+| Code | Condition                                                                                    |
+| ---- | -------------------------------------------------------------------------------------------- |
+| `0`  | success — secrets set on the linked project                                                  |
+| `1`  | `LegacyPlatformAuthRequiredError` — no token in env/keyring/file                             |
+| `1`  | `LegacyInvalidAccessTokenError` — token violates `^sbp_(oauth_)?[a-f0-9]{40}$`               |
+| `1`  | `LegacyProjectNotLinkedError` — `--project-ref` unset, env/file empty, and stdin not a TTY   |
+| `1`  | `LegacyInvalidProjectRefError` — resolved ref violates `^[a-z]{20}$`                         |
+| `1`  | `LegacySecretsNoArgumentsError` — no positional pairs and no entries from env-file or config |
+| `1`  | `LegacyInvalidSecretPairError` — positional argument missing `=`                             |
+| `1`  | `LegacySecretsEnvFileOpenError` — `--env-file` cannot be opened                              |
+| `1`  | `LegacySecretsEnvFileParseError` — `--env-file` cannot be parsed                             |
+| `1`  | `LegacySecretsConfigParseError` — `supabase/config.toml` cannot be parsed                    |
+| `1`  | `LegacySecretsSetUnexpectedStatusError` — non-2xx response from POST                         |
+| `1`  | `LegacySecretsSetNetworkError` — transport-level network failure                             |
+
+## Telemetry Events Fired
+
+| Event                  | When                                       | Notable properties / groups                                                         |
+| ---------------------- | ------------------------------------------ | ----------------------------------------------------------------------------------- |
+| `cli_command_executed` | post-run, success or failure (via wrapper) | `exit_code`, `duration_ms`, `flags` (`--project-ref` / `--env-file` → `<redacted>`) |
+
+Matches `apps/cli-go/internal/secrets/set/`. Go does not fire any custom telemetry event for this command.
 
 ## Output
 
-### `--output-format text` (Go CLI compatible)
+### `--output pretty` (Go default) / `--output-format text`
 
-Prints a confirmation message to stdout on success.
+Stdout: `Finished supabase secrets set.\n`. Stderr: one `Env name cannot start with SUPABASE_, skipping: <name>` line per filtered entry.
 
-```
-Finished supabase secrets set.
-```
-
-Skips secrets with names starting with `SUPABASE_` (writes warning to stderr).
+Go's `--output {json,yaml,toml,env}` flags all collapse to the same text-mode `Finished` message (Go `set.go:42` ignores `--output`).
 
 ### `--output-format json`
 
-Not applicable for this command (write operation).
+Single JSON object emitted via `Output.success` with `{project_ref, count}` as the `data` field.
 
 ### `--output-format stream-json`
 
-Not applicable for this command (write operation).
+One `result` NDJSON event on success containing `{project_ref, count}`.
 
 ## Notes
 
-- Accepts secrets as positional `NAME=VALUE` pairs or via `--env-file`.
-- Secrets with names starting with `SUPABASE_` are silently skipped.
-- Also reads from `config.toml` edge runtime secrets when available.
-- Requires `--project-ref` or a linked project (`.supabase/config.json`).
+- Source order for merging entries: `[edge_runtime.secrets]` from `config.toml` (only resolved entries — see below) → `--env-file` (overrides config) → CLI args (overrides env-file).
+- `SUPABASE_`-prefixed entries are skipped post-merge with a stderr warning.
+- `[edge_runtime.secrets]` from config.toml is read via `@supabase/config`'s `loadProjectConfig` + `resolveProjectSubtree`. Resolved secret values arrive wrapped in `Redacted<string>`; unresolved `env(VAR)` literals (env var unset) stay as plain strings and are filtered out at the handler — matches Go's `set.go:48-52` which filters by `len(secret.SHA256) > 0` (the SHA256 is empty when `DecryptSecretHookFunc` sees a still-literal `env(VAR)`).
+- Sends `User-Agent: SupabaseCLI/<version>` and Bearer auth. No `X-Supabase-Command` headers — Go parity.
diff --git a/apps/cli/src/legacy/commands/secrets/set/set.command.ts b/apps/cli/src/legacy/commands/secrets/set/set.command.ts
index 1befa7c28a..0b3b29c8c5 100644
--- a/apps/cli/src/legacy/commands/secrets/set/set.command.ts
+++ b/apps/cli/src/legacy/commands/secrets/set/set.command.ts
@@ -1,4 +1,9 @@
+import type * as CliCommand from "effect/unstable/cli/Command";
 import { Argument, Command, Flag } from "effect/unstable/cli";
+
+import { withJsonErrorHandling } from "../../../../shared/output/json-error-handling.ts";
+import { legacyManagementApiRuntimeLayer } from "../../../shared/legacy-management-api-runtime.layer.ts";
+import { withLegacyCommandInstrumentation } from "../../../telemetry/legacy-command-instrumentation.ts";
 import { legacySecretsSet } from "./set.handler.ts";
 
 const config = {
@@ -14,7 +19,9 @@ const config = {
     Argument.withDescription("Secret name=value pairs to set."),
     Argument.variadic(),
   ),
-};
+} as const;
+
+export type LegacySecretsSetFlags = CliCommand.Command.Config.Infer<typeof config>;
 
 export const legacySecretsSetCommand = Command.make("set", config).pipe(
   Command.withDescription("Set a secret(s) to the linked Supabase project."),
@@ -30,10 +37,10 @@ export const legacySecretsSetCommand = Command.make("set", config).pipe(
     },
   ]),
   Command.withHandler((flags) =>
-    legacySecretsSet({
-      projectRef: flags.projectRef,
-      envFile: flags.envFile,
-      secrets: flags.secrets.map(String),
-    }),
+    legacySecretsSet(flags).pipe(
+      withLegacyCommandInstrumentation({ flags }),
+      withJsonErrorHandling,
+    ),
   ),
+  Command.provide(legacyManagementApiRuntimeLayer(["secrets", "set"])),
 );
diff --git a/apps/cli/src/legacy/commands/secrets/set/set.handler.ts b/apps/cli/src/legacy/commands/secrets/set/set.handler.ts
index 85b77c2943..422f503070 100644
--- a/apps/cli/src/legacy/commands/secrets/set/set.handler.ts
+++ b/apps/cli/src/legacy/commands/secrets/set/set.handler.ts
@@ -1,19 +1,163 @@
-import { Effect, Option } from "effect";
-import { LegacyGoProxy } from "../../../../shared/legacy/go-proxy.service.ts";
+import { loadProjectConfig, loadProjectEnvironment, resolveProjectSubtree } from "@supabase/config";
+import { parse as parseDotenv } from "dotenv";
+import { Effect, FileSystem, Option, Path, Redacted } from "effect";
 
-interface LegacySecretsSetFlags {
-  readonly projectRef: Option.Option<string>;
-  readonly envFile: Option.Option<string>;
-  readonly secrets: ReadonlyArray<string>;
-}
+import { LegacyPlatformApi } from "../../../auth/legacy-platform-api.service.ts";
+import { LegacyProjectRefResolver } from "../../../config/legacy-project-ref.service.ts";
+import { LegacyLinkedProjectCache } from "../../../telemetry/legacy-linked-project-cache.service.ts";
+import { LegacyTelemetryState } from "../../../telemetry/legacy-telemetry-state.service.ts";
+import { Output } from "../../../../shared/output/output.service.ts";
+import { RuntimeInfo } from "../../../../shared/runtime/runtime-info.service.ts";
+import { mapLegacyHttpError } from "../../../shared/legacy-http-errors.ts";
+import {
+  LegacyInvalidSecretPairError,
+  LegacySecretsConfigParseError,
+  LegacySecretsEnvFileOpenError,
+  LegacySecretsEnvFileParseError,
+  LegacySecretsNoArgumentsError,
+  LegacySecretsSetNetworkError,
+  LegacySecretsSetUnexpectedStatusError,
+} from "../secrets.errors.ts";
+import type { LegacySecretsSetFlags } from "./set.command.ts";
+
+const mapSetError = mapLegacyHttpError({
+  networkError: LegacySecretsSetNetworkError,
+  statusError: LegacySecretsSetUnexpectedStatusError,
+  networkMessage: (cause) => `failed to set secrets: ${cause}`,
+  statusMessage: (_status, body) => `Unexpected error setting project secrets: ${body}`,
+});
 
 export const legacySecretsSet = Effect.fn("legacy.secrets.set")(function* (
   flags: LegacySecretsSetFlags,
 ) {
-  const proxy = yield* LegacyGoProxy;
-  const args: string[] = ["secrets", "set"];
-  if (Option.isSome(flags.projectRef)) args.push("--project-ref", flags.projectRef.value);
-  if (Option.isSome(flags.envFile)) args.push("--env-file", flags.envFile.value);
-  args.push(...flags.secrets);
-  yield* proxy.exec(args);
+  const output = yield* Output;
+  const api = yield* LegacyPlatformApi;
+  const resolver = yield* LegacyProjectRefResolver;
+  const linkedProjectCache = yield* LegacyLinkedProjectCache;
+  const telemetryState = yield* LegacyTelemetryState;
+  const runtimeInfo = yield* RuntimeInfo;
+  const fs = yield* FileSystem.FileSystem;
+  const path = yield* Path.Path;
+
+  const ref = yield* resolver.resolve(flags.projectRef);
+
+  yield* Effect.gen(function* () {
+    // Source 1: `[edge_runtime.secrets]` from `supabase/config.toml`.
+    //
+    // Only resolved secret values are sent — entries whose `env(VAR)` references
+    // are unresolved are skipped. This matches Go's `set.go:48-52`, which
+    // filters by `len(secret.SHA256) > 0`: the SHA256 is empty exactly when
+    // `DecryptSecretHookFunc` (`pkg/config/secret.go:98`) sees a still-literal
+    // `env(VAR)` and returns without hashing. In the TS path, `resolveProjectSubtree`
+    // wraps every resolved secret leaf in `Redacted<string>`; unresolved env()
+    // literals stay as plain strings, so `Redacted.isRedacted(...)` is the
+    // equivalent guard.
+    const merged = new Map<string, string>();
+    const loaded = yield* loadProjectConfig(runtimeInfo.cwd).pipe(
+      Effect.catchTag("ProjectConfigParseError", (cause) =>
+        Effect.fail(
+          new LegacySecretsConfigParseError({
+            message: `failed to parse supabase/config.toml: ${String(cause.cause)}`,
+          }),
+        ),
+      ),
+    );
+    if (loaded !== null) {
+      const projectEnv = yield* loadProjectEnvironment({
+        cwd: runtimeInfo.cwd,
+        baseEnv: process.env,
+      });
+      if (projectEnv !== null) {
+        const resolved = yield* resolveProjectSubtree(
+          loaded.config.edge_runtime,
+          projectEnv,
+          "edge_runtime",
+        );
+        for (const [name, value] of Object.entries(resolved.secrets ?? {})) {
+          if (Redacted.isRedacted(value)) {
+            merged.set(name, Redacted.value(value));
+          }
+        }
+      }
+    }
+
+    // Source 2: --env-file entries override config.
+    if (Option.isSome(flags.envFile)) {
+      const rawPath = flags.envFile.value;
+      const absolutePath = path.isAbsolute(rawPath) ? rawPath : path.join(runtimeInfo.cwd, rawPath);
+      const content = yield* fs.readFileString(absolutePath).pipe(
+        Effect.mapError(
+          (cause) =>
+            new LegacySecretsEnvFileOpenError({
+              message: `failed to open env file: ${String(cause)}`,
+            }),
+        ),
+      );
+      let parsed: Record<string, string>;
+      try {
+        parsed = parseDotenv(content);
+      } catch (cause) {
+        return yield* Effect.fail(
+          new LegacySecretsEnvFileParseError({
+            message: `failed to parse env file: ${String(cause)}`,
+          }),
+        );
+      }
+      for (const [name, value] of Object.entries(parsed)) {
+        merged.set(name, value);
+      }
+    }
+
+    // Source 3: positional NAME=VALUE pairs override env-file and config.
+    for (const pair of flags.secrets) {
+      const eqIdx = pair.indexOf("=");
+      if (eqIdx === -1) {
+        return yield* Effect.fail(
+          new LegacyInvalidSecretPairError({
+            pair,
+            message: `Invalid secret pair: ${pair}. Must be NAME=VALUE.`,
+          }),
+        );
+      }
+      merged.set(pair.slice(0, eqIdx), pair.slice(eqIdx + 1));
+    }
+
+    // Filter SUPABASE_-prefixed entries with stderr warning (Go `set.go:67-71`).
+    // The API rejects these names server-side anyway (`@supabase/api`'s schema
+    // also rejects them via regex), so the filter MUST happen client-side
+    // before any request is built — otherwise we'd surface a SchemaError instead.
+    const body: Array<{ name: string; value: string }> = [];
+    for (const [name, value] of merged) {
+      if (name.startsWith("SUPABASE_")) {
+        yield* output.raw(`Env name cannot start with SUPABASE_, skipping: ${name}\n`, "stderr");
+        continue;
+      }
+      body.push({ name, value });
+    }
+
+    if (body.length === 0) {
+      return yield* Effect.fail(
+        new LegacySecretsNoArgumentsError({
+          message: "No arguments found. Use --env-file to read from a .env file.",
+        }),
+      );
+    }
+
+    const setting = output.format === "text" ? yield* output.task("Setting secrets...") : undefined;
+    yield* api.v1.bulkCreateSecrets({ ref, body }).pipe(
+      Effect.tapError(() => setting?.fail() ?? Effect.void),
+      Effect.catch(mapSetError),
+    );
+    yield* setting?.clear() ?? Effect.void;
+
+    if (output.format === "json" || output.format === "stream-json") {
+      yield* output.success("Finished supabase secrets set.", {
+        project_ref: ref,
+        count: body.length,
+      });
+      return;
+    }
+
+    yield* output.raw("Finished supabase secrets set.\n");
+  }).pipe(Effect.ensuring(linkedProjectCache.cache(ref)), Effect.ensuring(telemetryState.flush));
 });
diff --git a/apps/cli/src/legacy/commands/secrets/set/set.integration.test.ts b/apps/cli/src/legacy/commands/secrets/set/set.integration.test.ts
new file mode 100644
index 0000000000..524ee4f3f7
--- /dev/null
+++ b/apps/cli/src/legacy/commands/secrets/set/set.integration.test.ts
@@ -0,0 +1,405 @@
+import { mkdirSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+
+import { describe, expect, it } from "@effect/vitest";
+import { Effect, Exit, Layer, Option } from "effect";
+
+import {
+  mockOutput,
+  mockRuntimeInfo,
+  processEnvLayer,
+} from "../../../../../tests/helpers/mocks.ts";
+import {
+  LEGACY_VALID_REF,
+  buildLegacyTestRuntime,
+  mockLegacyCliConfig,
+  mockLegacyPlatformApi,
+  useLegacyTempWorkdir,
+} from "../../../../../tests/helpers/legacy-mocks.ts";
+import { legacySecretsSet } from "./set.handler.ts";
+
+// ---------------------------------------------------------------------------
+// Setup
+// ---------------------------------------------------------------------------
+
+interface SetupOpts {
+  format?: "text" | "json" | "stream-json";
+  goOutput?: "pretty" | "json" | "yaml" | "toml" | "env";
+  status?: number;
+  network?: "fail";
+  env?: Record<string, string | undefined>;
+}
+
+const tempRoot = useLegacyTempWorkdir("supabase-secrets-set-int-");
+
+function setup(opts: SetupOpts = {}) {
+  const out = mockOutput({ format: opts.format ?? "text" });
+  const api = mockLegacyPlatformApi({
+    // POST `/v1/projects/{ref}/secrets` returns 201 with no body on success.
+    response: { status: opts.status ?? 201, body: null },
+    network: opts.network,
+  });
+  const cliConfig = mockLegacyCliConfig({ workdir: tempRoot.current });
+  const layer = Layer.mergeAll(
+    buildLegacyTestRuntime({
+      out,
+      api,
+      cliConfig,
+      goOutput: opts.goOutput === undefined ? Option.none() : Option.some(opts.goOutput),
+    }),
+    mockRuntimeInfo({ cwd: tempRoot.current }),
+    processEnvLayer(opts.env ?? {}),
+  );
+  return { layer, out, api };
+}
+
+function writeConfig(content: string) {
+  mkdirSync(join(tempRoot.current, "supabase"), { recursive: true });
+  writeFileSync(join(tempRoot.current, "supabase", "config.toml"), content);
+}
+
+function parsePostBody(body: unknown): Array<{ name: string; value: string }> {
+  // `mockLegacyPlatformApi` JSON-decodes the request body when it parses; this
+  // helper just narrows the type for the test assertions.
+  return body as Array<{ name: string; value: string }>;
+}
+
+// ---------------------------------------------------------------------------
+// Tests
+// ---------------------------------------------------------------------------
+
+describe("legacy secrets set integration", () => {
+  it.live("sets a single secret via CLI arg FOO=bar", () => {
+    const { layer, out, api } = setup();
+    return Effect.gen(function* () {
+      yield* legacySecretsSet({
+        projectRef: Option.none(),
+        envFile: Option.none(),
+        secrets: ["FOO=bar"],
+      });
+      expect(api.requests).toHaveLength(1);
+      expect(parsePostBody(api.requests[0]!.body)).toEqual([{ name: "FOO", value: "bar" }]);
+      expect(out.stdoutText).toBe("Finished supabase secrets set.\n");
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("sets multiple secrets via CLI args", () => {
+    const { layer, api } = setup();
+    return Effect.gen(function* () {
+      yield* legacySecretsSet({
+        projectRef: Option.none(),
+        envFile: Option.none(),
+        secrets: ["FOO=bar", "BAZ=qux"],
+      });
+      const body = parsePostBody(api.requests[0]!.body);
+      expect(body).toEqual(
+        expect.arrayContaining([
+          { name: "FOO", value: "bar" },
+          { name: "BAZ", value: "qux" },
+        ]),
+      );
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("sets secrets from --env-file with a relative path (joined to CWD)", () => {
+    writeFileSync(join(tempRoot.current, "myfile.env"), "FROM_FILE=fromvalue\n");
+    const { layer, api } = setup();
+    return Effect.gen(function* () {
+      yield* legacySecretsSet({
+        projectRef: Option.none(),
+        envFile: Option.some("myfile.env"),
+        secrets: [],
+      });
+      expect(parsePostBody(api.requests[0]!.body)).toEqual([
+        { name: "FROM_FILE", value: "fromvalue" },
+      ]);
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("sets secrets from --env-file with an absolute path", () => {
+    const abs = join(tempRoot.current, "absolute.env");
+    writeFileSync(abs, "ABS=value\n");
+    const { layer, api } = setup();
+    return Effect.gen(function* () {
+      yield* legacySecretsSet({
+        projectRef: Option.none(),
+        envFile: Option.some(abs),
+        secrets: [],
+      });
+      expect(parsePostBody(api.requests[0]!.body)).toEqual([{ name: "ABS", value: "value" }]);
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("CLI args override --env-file entries for the same key", () => {
+    writeFileSync(join(tempRoot.current, "override.env"), "FOO=from-file\n");
+    const { layer, api } = setup();
+    return Effect.gen(function* () {
+      yield* legacySecretsSet({
+        projectRef: Option.none(),
+        envFile: Option.some("override.env"),
+        secrets: ["FOO=from-arg"],
+      });
+      expect(parsePostBody(api.requests[0]!.body)).toEqual([{ name: "FOO", value: "from-arg" }]);
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live(
+    "merges entries from supabase/config.toml [edge_runtime.secrets] ahead of env-file and CLI args",
+    () => {
+      writeConfig(
+        `[edge_runtime.secrets]
+FROM_CONFIG = "config-value"
+SHARED = "config-shared"
+`,
+      );
+      writeFileSync(join(tempRoot.current, ".env-file"), "SHARED=envfile-shared\n");
+      const { layer, api } = setup();
+      return Effect.gen(function* () {
+        yield* legacySecretsSet({
+          projectRef: Option.none(),
+          envFile: Option.some(".env-file"),
+          secrets: ["SHARED=cli-shared"],
+        });
+        const body = parsePostBody(api.requests[0]!.body);
+        expect(body).toEqual(
+          expect.arrayContaining([
+            { name: "FROM_CONFIG", value: "config-value" },
+            { name: "SHARED", value: "cli-shared" },
+          ]),
+        );
+      }).pipe(Effect.provide(layer));
+    },
+  );
+
+  it.live("interpolates env(VAR) in config.toml secrets when the env var is defined", () => {
+    writeConfig(
+      `[edge_runtime.secrets]
+DB_URL = "env(MY_DB_URL)"
+`,
+    );
+    const { layer, api } = setup({ env: { MY_DB_URL: "postgres://x" } });
+    return Effect.gen(function* () {
+      yield* legacySecretsSet({
+        projectRef: Option.none(),
+        envFile: Option.none(),
+        secrets: [],
+      });
+      expect(parsePostBody(api.requests[0]!.body)).toEqual([
+        { name: "DB_URL", value: "postgres://x" },
+      ]);
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("skips secrets whose env() reference cannot be resolved (Go set.go:48-52 parity)", () => {
+    writeConfig(
+      `[edge_runtime.secrets]
+RESOLVED = "env(MY_DB_URL)"
+UNRESOLVED = "env(NOT_SET_ANYWHERE)"
+LITERAL = "plain-value"
+`,
+    );
+    const { layer, api } = setup({ env: { MY_DB_URL: "postgres://x" } });
+    return Effect.gen(function* () {
+      yield* legacySecretsSet({
+        projectRef: Option.none(),
+        envFile: Option.none(),
+        secrets: [],
+      });
+      const body = parsePostBody(api.requests[0]!.body);
+      expect(body).toEqual(
+        expect.arrayContaining([
+          { name: "RESOLVED", value: "postgres://x" },
+          { name: "LITERAL", value: "plain-value" },
+        ]),
+      );
+      expect(body.find((entry) => entry.name === "UNRESOLVED")).toBeUndefined();
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live(
+    "does not crash when config.toml has env(NUMERIC_PORT) on an unrelated numeric field (CLI-1489 regression guard)",
+    () => {
+      writeConfig(
+        `[analytics]
+port = "env(SUPABASE_ANALYTICS_PORT)"
+
+[edge_runtime.secrets]
+FOO = "literal-foo"
+`,
+      );
+      const { layer, api } = setup({ env: { SUPABASE_ANALYTICS_PORT: "54327" } });
+      return Effect.gen(function* () {
+        yield* legacySecretsSet({
+          projectRef: Option.none(),
+          envFile: Option.none(),
+          secrets: [],
+        });
+        expect(parsePostBody(api.requests[0]!.body)).toEqual([
+          { name: "FOO", value: "literal-foo" },
+        ]);
+      }).pipe(Effect.provide(layer));
+    },
+  );
+
+  it.live("skips SUPABASE_-prefixed entries with a stderr warning", () => {
+    const { layer, out, api } = setup();
+    return Effect.gen(function* () {
+      yield* legacySecretsSet({
+        projectRef: Option.none(),
+        envFile: Option.none(),
+        secrets: ["FOO=bar", "SUPABASE_BAD=x"],
+      });
+      const body = parsePostBody(api.requests[0]!.body);
+      expect(body).toEqual([{ name: "FOO", value: "bar" }]);
+      expect(out.stderrText).toContain(
+        "Env name cannot start with SUPABASE_, skipping: SUPABASE_BAD",
+      );
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live(
+    "fails with LegacySecretsNoArgumentsError when args and env-file produce zero non-SUPABASE_ entries",
+    () => {
+      const { layer, api } = setup();
+      return Effect.gen(function* () {
+        const exit = yield* Effect.exit(
+          legacySecretsSet({
+            projectRef: Option.none(),
+            envFile: Option.none(),
+            secrets: ["SUPABASE_ONLY=x"],
+          }),
+        );
+        expect(Exit.isFailure(exit)).toBe(true);
+        if (Exit.isFailure(exit)) {
+          expect(JSON.stringify(exit.cause)).toContain("LegacySecretsNoArgumentsError");
+        }
+        expect(api.requests).toHaveLength(0);
+      }).pipe(Effect.provide(layer));
+    },
+  );
+
+  it.live("fails with LegacyInvalidSecretPairError when an arg has no `=`", () => {
+    const { layer, api } = setup();
+    return Effect.gen(function* () {
+      const exit = yield* Effect.exit(
+        legacySecretsSet({
+          projectRef: Option.none(),
+          envFile: Option.none(),
+          secrets: ["NOTAPAIR"],
+        }),
+      );
+      expect(Exit.isFailure(exit)).toBe(true);
+      if (Exit.isFailure(exit)) {
+        const errJson = JSON.stringify(exit.cause);
+        expect(errJson).toContain("LegacyInvalidSecretPairError");
+        expect(errJson).toContain("Invalid secret pair: NOTAPAIR");
+      }
+      expect(api.requests).toHaveLength(0);
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("fails with LegacySecretsEnvFileOpenError when env-file does not exist", () => {
+    const { layer } = setup();
+    return Effect.gen(function* () {
+      const exit = yield* Effect.exit(
+        legacySecretsSet({
+          projectRef: Option.none(),
+          envFile: Option.some("does-not-exist.env"),
+          secrets: [],
+        }),
+      );
+      expect(Exit.isFailure(exit)).toBe(true);
+      if (Exit.isFailure(exit)) {
+        const errJson = JSON.stringify(exit.cause);
+        expect(errJson).toContain("LegacySecretsEnvFileOpenError");
+        expect(errJson).toContain("failed to open env file");
+      }
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("fails with LegacySecretsConfigParseError when config.toml is malformed", () => {
+    writeConfig("this is not valid = = toml [[[\n");
+    const { layer } = setup();
+    return Effect.gen(function* () {
+      const exit = yield* Effect.exit(
+        legacySecretsSet({
+          projectRef: Option.none(),
+          envFile: Option.none(),
+          secrets: ["FOO=bar"],
+        }),
+      );
+      expect(Exit.isFailure(exit)).toBe(true);
+      if (Exit.isFailure(exit)) {
+        expect(JSON.stringify(exit.cause)).toContain("LegacySecretsConfigParseError");
+      }
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("fails with LegacySecretsSetNetworkError on transport failure", () => {
+    const { layer } = setup({ network: "fail" });
+    return Effect.gen(function* () {
+      const exit = yield* Effect.exit(
+        legacySecretsSet({
+          projectRef: Option.none(),
+          envFile: Option.none(),
+          secrets: ["FOO=bar"],
+        }),
+      );
+      expect(Exit.isFailure(exit)).toBe(true);
+      if (Exit.isFailure(exit)) {
+        const errJson = JSON.stringify(exit.cause);
+        expect(errJson).toContain("LegacySecretsSetNetworkError");
+        expect(errJson).toContain("failed to set secrets");
+      }
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("fails with LegacySecretsSetUnexpectedStatusError on HTTP 500", () => {
+    const { layer } = setup({ status: 500 });
+    return Effect.gen(function* () {
+      const exit = yield* Effect.exit(
+        legacySecretsSet({
+          projectRef: Option.none(),
+          envFile: Option.none(),
+          secrets: ["FOO=bar"],
+        }),
+      );
+      expect(Exit.isFailure(exit)).toBe(true);
+      if (Exit.isFailure(exit)) {
+        const errJson = JSON.stringify(exit.cause);
+        expect(errJson).toContain("LegacySecretsSetUnexpectedStatusError");
+        expect(errJson).toContain("Unexpected error setting project secrets");
+      }
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("emits a success event with { project_ref, count } for --output-format=json", () => {
+    const { layer, out } = setup({ format: "json" });
+    return Effect.gen(function* () {
+      yield* legacySecretsSet({
+        projectRef: Option.none(),
+        envFile: Option.none(),
+        secrets: ["FOO=bar", "BAZ=qux"],
+      });
+      const success = out.messages.find((m) => m.type === "success");
+      expect(success).toBeDefined();
+      expect(success?.data).toEqual({ project_ref: LEGACY_VALID_REF, count: 2 });
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live(
+    "text mode prints `Finished supabase secrets set.\\n` regardless of --output value",
+    () => {
+      const { layer, out } = setup({ goOutput: "json" });
+      return Effect.gen(function* () {
+        yield* legacySecretsSet({
+          projectRef: Option.none(),
+          envFile: Option.none(),
+          secrets: ["FOO=bar"],
+        });
+        // Go ignores `--output` for `set` (set.go:42) — text-mode message lands regardless.
+        expect(out.stdoutText).toBe("Finished supabase secrets set.\n");
+      }).pipe(Effect.provide(layer));
+    },
+  );
+});
diff --git a/apps/cli/src/legacy/commands/secrets/unset/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/secrets/unset/SIDE_EFFECTS.md
index 446d8a4b4d..504a4d99f1 100644
--- a/apps/cli/src/legacy/commands/secrets/unset/SIDE_EFFECTS.md
+++ b/apps/cli/src/legacy/commands/secrets/unset/SIDE_EFFECTS.md
@@ -2,69 +2,82 @@
 
 ## Files Read
 
-| Path                       | Format                    | When                                                       |
-| -------------------------- | ------------------------- | ---------------------------------------------------------- |
-| `~/.supabase/access-token` | plain text (token string) | when `SUPABASE_ACCESS_TOKEN` unset and keyring unavailable |
+| Path                                      | Format                    | When                                                                                          |
+| ----------------------------------------- | ------------------------- | --------------------------------------------------------------------------------------------- |
+| `/proc/sys/kernel/osrelease` (Linux)      | plain text                | once on layer init — disables keyring on WSL (`WSL` / `Microsoft` substring match)            |
+| keyring `"Supabase CLI"` / `<profile>`    | OS keychain               | when `SUPABASE_ACCESS_TOKEN` unset and keyring available; account = `LegacyCliConfig.profile` |
+| keyring `"Supabase CLI"` / `access-token` | OS keychain               | legacy-key fallback when the profile-keyed lookup misses                                      |
+| `~/.supabase/access-token`                | plain text (token string) | last-resort fallback after env + keyring miss                                                 |
+| `<workdir>/supabase/.temp/project-ref`    | plain text                | when `--project-ref` and `SUPABASE_PROJECT_ID` are both unset                                 |
 
 ## Files Written
 
-| Path | Format | When |
-| ---- | ------ | ---- |
-| —    | —      | —    |
+| Path                                             | Format | When                                                                     |
+| ------------------------------------------------ | ------ | ------------------------------------------------------------------------ |
+| `~/.supabase/<workdir-hash>/linked-project.json` | JSON   | always (in `Effect.ensuring`) after `--project-ref` resolves — Go parity |
+| `~/.supabase/telemetry.json`                     | JSON   | always (in `Effect.ensuring`) at end of command — Go parity              |
 
 ## API Routes
 
-| Method   | Path                         | Auth         | Request body    | Response (used fields) |
-| -------- | ---------------------------- | ------------ | --------------- | ---------------------- |
-| `GET`    | `/v1/projects/{ref}/secrets` | Bearer token | none            | `[{name, value}]`      |
-| `DELETE` | `/v1/projects/{ref}/secrets` | Bearer token | `["NAME", ...]` | none (200 expected)    |
-
-Note: `GET` is only called when no secret names are passed as arguments (to fetch all non-SUPABASE\_ secrets).
+| Method   | Path                         | Auth         | Request body    | Response (used fields)                                        |
+| -------- | ---------------------------- | ------------ | --------------- | ------------------------------------------------------------- |
+| `GET`    | `/v1/projects/{ref}/secrets` | Bearer token | none            | `[{name}]` — empty-args path only, filters `SUPABASE_` prefix |
+| `DELETE` | `/v1/projects/{ref}/secrets` | Bearer token | `["NAME", ...]` | none (200 expected)                                           |
+| `GET`    | `/v1/projects`               | Bearer token | none            | TTY-prompt fallback only                                      |
 
 ## Environment Variables
 
-| Variable                | Purpose                                              | Required?                                               |
-| ----------------------- | ---------------------------------------------------- | ------------------------------------------------------- |
-| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `~/.supabase/access-token`) |
-| `SUPABASE_API_URL`      | override Management API base URL                     | no (defaults to `https://api.supabase.com`)             |
+| Variable                | Purpose                                                                                                                                                                                                                                                                                              | Required?                                                                  |
+| ----------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------- |
+| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup)                                                                                                                                                                                                                                                 | no (falls back to keyring → `~/.supabase/access-token`)                    |
+| `SUPABASE_PROFILE`      | selects API base URL: `supabase` → `api.supabase.com`, `supabase-staging` → `api.supabase.green`, `supabase-local` → `http://localhost:8080`. May alternatively be a filesystem path to a YAML profile with at least `api_url:` and optional `name:` (Go parity — used by the cli-e2e test harness). | no (defaults to `supabase`)                                                |
+| `SUPABASE_PROJECT_ID`   | project ref fallback when `--project-ref` is unset                                                                                                                                                                                                                                                   | no (also reads `<workdir>/supabase/.temp/project-ref` then prompts on TTY) |
+| `SUPABASE_WORKDIR`      | base directory for the `.temp/project-ref` lookup                                                                                                                                                                                                                                                    | no (walks up from CWD looking for `supabase/config.toml`)                  |
+| ~~`SUPABASE_API_URL`~~  | **not honored** — Go parity. Use `SUPABASE_PROFILE` to override the API base URL.                                                                                                                                                                                                                    | —                                                                          |
 
 ## Exit Codes
 
-| Code | Condition                                                          |
-| ---- | ------------------------------------------------------------------ |
-| `0`  | success — secrets unset from the linked project                    |
-| `0`  | no secrets to unset (all existing secrets have `SUPABASE_` prefix) |
-| `1`  | user declined the confirmation prompt                              |
-| `1`  | authentication error — no valid token found                        |
-| `1`  | API error — non-2xx response from secrets endpoint                 |
-| `1`  | network / connection failure                                       |
+| Code | Condition                                                                                  |
+| ---- | ------------------------------------------------------------------------------------------ |
+| `0`  | success — secrets unset from the linked project                                            |
+| `0`  | empty-args path resolved to zero non-`SUPABASE_` secrets (stderr no-op, no DELETE call)    |
+| `1`  | `LegacyPlatformAuthRequiredError` — no token in env/keyring/file                           |
+| `1`  | `LegacyInvalidAccessTokenError` — token violates `^sbp_(oauth_)?[a-f0-9]{40}$`             |
+| `1`  | `LegacyProjectNotLinkedError` — `--project-ref` unset, env/file empty, and stdin not a TTY |
+| `1`  | `LegacyInvalidProjectRefError` — resolved ref violates `^[a-z]{20}$`                       |
+| `1`  | `LegacySecretsListUnexpectedStatusError` — non-2xx response from GET (empty-args path)     |
+| `1`  | `LegacySecretsListNetworkError` — GET transport failure (empty-args path)                  |
+| `1`  | `LegacySecretsUnsetCancelledError` — user declined the confirmation prompt                 |
+| `1`  | `LegacySecretsUnsetUnexpectedStatusError` — non-2xx response from DELETE                   |
+| `1`  | `LegacySecretsUnsetNetworkError` — DELETE transport failure                                |
 
-## Output
+## Telemetry Events Fired
 
-### `--output-format text` (Go CLI compatible)
+| Event                  | When                                       | Notable properties / groups                                          |
+| ---------------------- | ------------------------------------------ | -------------------------------------------------------------------- |
+| `cli_command_executed` | post-run, success or failure (via wrapper) | `exit_code`, `duration_ms`, `flags` (`--project-ref` → `<redacted>`) |
 
-Prompts for confirmation before unsetting, then prints a confirmation message to stdout.
+Matches `apps/cli-go/internal/secrets/unset/`. Go does not fire any custom telemetry event for this command.
+
+## Output
 
-```
-Finished supabase secrets unset.
-```
+### `--output pretty` (Go default) / `--output-format text`
 
-If no secrets to unset, prints to stderr:
+Stdout: `Finished supabase secrets unset.\n`. Stderr: confirmation prompt label (when TTY without `--yes`) or `[Y/n] y` echo (with `--yes`) or the no-op message when empty-args resolves to no secrets.
 
-```
-You have not set any function secrets, nothing to do.
-```
+Go's `--output {json,yaml,toml,env}` flags all collapse to the same text-mode `Finished` message.
 
 ### `--output-format json`
 
-Not applicable for this command (write operation).
+Single JSON object emitted via `Output.success` with `{project_ref, count}` as the `data` field.
 
 ### `--output-format stream-json`
 
-Not applicable for this command (write operation).
+One `result` NDJSON event on success containing `{project_ref, count}`.
 
 ## Notes
 
-- When called without arguments, unsets all secrets that do not have a `SUPABASE_` prefix.
-- Requires interactive confirmation before deleting.
-- Requires `--project-ref` or a linked project (`.supabase/config.json`).
+- When called without arguments, fetches the full secret list and unsets all entries that do not have a `SUPABASE_` prefix.
+- `--yes` bypasses the confirmation prompt with a stderr label echo.
+- Non-TTY without `--yes` auto-confirms silently — matches Go's `PromptYesNo` (`apps/cli-go/internal/utils/console.go`), which defaults to true after a 100ms non-TTY read timeout.
+- Sends `User-Agent: SupabaseCLI/<version>` and Bearer auth. No `X-Supabase-Command` headers — Go parity.
diff --git a/apps/cli/src/legacy/commands/secrets/unset/unset.command.ts b/apps/cli/src/legacy/commands/secrets/unset/unset.command.ts
index 71163522a2..432e5ef8f1 100644
--- a/apps/cli/src/legacy/commands/secrets/unset/unset.command.ts
+++ b/apps/cli/src/legacy/commands/secrets/unset/unset.command.ts
@@ -1,4 +1,9 @@
+import type * as CliCommand from "effect/unstable/cli/Command";
 import { Argument, Command, Flag } from "effect/unstable/cli";
+
+import { withJsonErrorHandling } from "../../../../shared/output/json-error-handling.ts";
+import { legacyManagementApiRuntimeLayer } from "../../../shared/legacy-management-api-runtime.layer.ts";
+import { withLegacyCommandInstrumentation } from "../../../telemetry/legacy-command-instrumentation.ts";
 import { legacySecretsUnset } from "./unset.handler.ts";
 
 const config = {
@@ -10,7 +15,9 @@ const config = {
     Argument.withDescription("Secret names to unset."),
     Argument.variadic(),
   ),
-};
+} as const;
+
+export type LegacySecretsUnsetFlags = CliCommand.Command.Config.Infer<typeof config>;
 
 export const legacySecretsUnsetCommand = Command.make("unset", config).pipe(
   Command.withDescription("Unset a secret(s) from the linked Supabase project."),
@@ -26,9 +33,10 @@ export const legacySecretsUnsetCommand = Command.make("unset", config).pipe(
     },
   ]),
   Command.withHandler((flags) =>
-    legacySecretsUnset({
-      projectRef: flags.projectRef,
-      names: flags.names.map(String),
-    }),
+    legacySecretsUnset(flags).pipe(
+      withLegacyCommandInstrumentation({ flags }),
+      withJsonErrorHandling,
+    ),
   ),
+  Command.provide(legacyManagementApiRuntimeLayer(["secrets", "unset"])),
 );
diff --git a/apps/cli/src/legacy/commands/secrets/unset/unset.handler.ts b/apps/cli/src/legacy/commands/secrets/unset/unset.handler.ts
index fb5e641b3c..8e4af01978 100644
--- a/apps/cli/src/legacy/commands/secrets/unset/unset.handler.ts
+++ b/apps/cli/src/legacy/commands/secrets/unset/unset.handler.ts
@@ -1,17 +1,111 @@
-import { Effect, Option } from "effect";
-import { LegacyGoProxy } from "../../../../shared/legacy/go-proxy.service.ts";
+import type { V1ListAllSecretsOutput } from "@supabase/api/effect";
+import { Effect } from "effect";
 
-interface LegacySecretsUnsetFlags {
-  readonly projectRef: Option.Option<string>;
-  readonly names: ReadonlyArray<string>;
-}
+import { LegacyPlatformApi } from "../../../auth/legacy-platform-api.service.ts";
+import { LegacyProjectRefResolver } from "../../../config/legacy-project-ref.service.ts";
+import { LegacyLinkedProjectCache } from "../../../telemetry/legacy-linked-project-cache.service.ts";
+import { LegacyTelemetryState } from "../../../telemetry/legacy-telemetry-state.service.ts";
+import { LegacyYesFlag } from "../../../../shared/legacy/global-flags.ts";
+import { Output } from "../../../../shared/output/output.service.ts";
+import { Tty } from "../../../../shared/runtime/tty.service.ts";
+import { mapLegacyHttpError } from "../../../shared/legacy-http-errors.ts";
+import {
+  LegacySecretsListNetworkError,
+  LegacySecretsListUnexpectedStatusError,
+  LegacySecretsUnsetCancelledError,
+  LegacySecretsUnsetNetworkError,
+  LegacySecretsUnsetUnexpectedStatusError,
+} from "../secrets.errors.ts";
+import type { LegacySecretsUnsetFlags } from "./unset.command.ts";
+
+type Secrets = typeof V1ListAllSecretsOutput.Type;
+
+// The empty-args path lists secrets first, so it shares the LIST error pair
+// with the `list` handler. Templates match Go's `list.go:46-50` phrasing.
+const mapListErrorForUnset = mapLegacyHttpError({
+  networkError: LegacySecretsListNetworkError,
+  statusError: LegacySecretsListUnexpectedStatusError,
+  networkMessage: (cause) => `failed to list secrets: ${cause}`,
+  statusMessage: (status, body) => `unexpected list secrets status ${status}: ${body}`,
+});
+
+const mapUnsetError = mapLegacyHttpError({
+  networkError: LegacySecretsUnsetNetworkError,
+  statusError: LegacySecretsUnsetUnexpectedStatusError,
+  networkMessage: (cause) => `failed to delete secrets: ${cause}`,
+  statusMessage: (_status, body) => `Unexpected error unsetting project secrets: ${body}`,
+});
 
 export const legacySecretsUnset = Effect.fn("legacy.secrets.unset")(function* (
   flags: LegacySecretsUnsetFlags,
 ) {
-  const proxy = yield* LegacyGoProxy;
-  const args: string[] = ["secrets", "unset"];
-  if (Option.isSome(flags.projectRef)) args.push("--project-ref", flags.projectRef.value);
-  args.push(...flags.names);
-  yield* proxy.exec(args);
+  const output = yield* Output;
+  const api = yield* LegacyPlatformApi;
+  const resolver = yield* LegacyProjectRefResolver;
+  const linkedProjectCache = yield* LegacyLinkedProjectCache;
+  const telemetryState = yield* LegacyTelemetryState;
+  const yes = yield* LegacyYesFlag;
+  const tty = yield* Tty;
+
+  const ref = yield* resolver.resolve(flags.projectRef);
+
+  yield* Effect.gen(function* () {
+    let names: ReadonlyArray<string> = flags.names;
+
+    if (names.length === 0) {
+      // Go fetches the full list and filters out SUPABASE_-prefixed entries
+      // (`unset.go:21-26`). Reuse the LIST error pair here.
+      const all: Secrets = yield* api.v1
+        .listAllSecrets({ ref })
+        .pipe(Effect.catch(mapListErrorForUnset));
+      names = all.filter((s) => !s.name.startsWith("SUPABASE_")).map((s) => s.name);
+    }
+
+    if (names.length === 0) {
+      yield* output.raw("You have not set any function secrets, nothing to do.\n", "stderr");
+      return;
+    }
+
+    const label = `Do you want to unset these function secrets?\n • ${names.join("\n • ")}\n\n`;
+
+    let confirmed: boolean;
+    if (yes) {
+      // Match Go's confirm-by-flag UX byte-for-byte: `PromptYesNo` formats the
+      // line as `fmt.Sprintf("%s [%s] ", label, choices)` then `Fprintln` adds
+      // the `y` and trailing newline. The single space between `${label}` and
+      // `[Y/n]` is intentional — `console.go:69`.
+      yield* output.raw(`${label} [Y/n] y\n`, "stderr");
+      confirmed = true;
+    } else if (!tty.stdinIsTty) {
+      // Go's `PromptYesNo` defaults to true after a 100ms non-TTY read timeout
+      // (no stderr echo). Mirror that.
+      confirmed = true;
+    } else {
+      confirmed = yield* output.promptConfirm(label).pipe(Effect.orElseSucceed(() => false));
+    }
+
+    if (!confirmed) {
+      return yield* Effect.fail(
+        new LegacySecretsUnsetCancelledError({ message: "context canceled" }),
+      );
+    }
+
+    const unsetting =
+      output.format === "text" ? yield* output.task("Unsetting secrets...") : undefined;
+    yield* api.v1.bulkDeleteSecrets({ ref, body: names }).pipe(
+      Effect.tapError(() => unsetting?.fail() ?? Effect.void),
+      Effect.catch(mapUnsetError),
+    );
+    yield* unsetting?.clear() ?? Effect.void;
+
+    if (output.format === "json" || output.format === "stream-json") {
+      yield* output.success("Finished supabase secrets unset.", {
+        project_ref: ref,
+        count: names.length,
+      });
+      return;
+    }
+
+    yield* output.raw("Finished supabase secrets unset.\n");
+  }).pipe(Effect.ensuring(linkedProjectCache.cache(ref)), Effect.ensuring(telemetryState.flush));
 });
diff --git a/apps/cli/src/legacy/commands/secrets/unset/unset.integration.test.ts b/apps/cli/src/legacy/commands/secrets/unset/unset.integration.test.ts
new file mode 100644
index 0000000000..e30b74b5fe
--- /dev/null
+++ b/apps/cli/src/legacy/commands/secrets/unset/unset.integration.test.ts
@@ -0,0 +1,273 @@
+import { type V1ListAllSecretsOutput } from "@supabase/api/effect";
+import { describe, expect, it } from "@effect/vitest";
+import { Effect, Exit, Layer, Option } from "effect";
+
+import { LegacyYesFlag } from "../../../../shared/legacy/global-flags.ts";
+import { mockOutput, mockTty } from "../../../../../tests/helpers/mocks.ts";
+import {
+  LEGACY_VALID_REF,
+  buildLegacyTestRuntime,
+  legacyJsonResponse,
+  legacyTransportFailure,
+  mockLegacyCliConfig,
+  mockLegacyPlatformApi,
+  useLegacyTempWorkdir,
+} from "../../../../../tests/helpers/legacy-mocks.ts";
+import { legacySecretsUnset } from "./unset.handler.ts";
+
+// ---------------------------------------------------------------------------
+// Setup
+// ---------------------------------------------------------------------------
+
+type SecretsList = typeof V1ListAllSecretsOutput.Type;
+
+interface SetupOpts {
+  format?: "text" | "json" | "stream-json";
+  goOutput?: "pretty" | "json" | "yaml" | "toml" | "env";
+  yes?: boolean;
+  stdinIsTty?: boolean;
+  confirm?: boolean;
+  list?: SecretsList;
+  listStatus?: number;
+  listNetwork?: "fail";
+  deleteStatus?: number;
+  deleteNetwork?: "fail";
+}
+
+const tempRoot = useLegacyTempWorkdir("supabase-secrets-unset-int-");
+
+function setup(opts: SetupOpts = {}) {
+  const out = mockOutput({
+    format: opts.format ?? "text",
+    confirmLogout: opts.confirm,
+  });
+  // GET = list, DELETE = unset. Each branch supports its own status/network
+  // override via the `handler` escape hatch.
+  const api = mockLegacyPlatformApi({
+    handler: (request) => {
+      if (request.method === "GET") {
+        if (opts.listNetwork === "fail") {
+          return Effect.fail(legacyTransportFailure(request));
+        }
+        return Effect.succeed(legacyJsonResponse(request, opts.listStatus ?? 200, opts.list ?? []));
+      }
+      if (opts.deleteNetwork === "fail") {
+        return Effect.fail(legacyTransportFailure(request));
+      }
+      return Effect.succeed(legacyJsonResponse(request, opts.deleteStatus ?? 200, null));
+    },
+  });
+  const cliConfig = mockLegacyCliConfig({ workdir: tempRoot.current });
+  const layer = Layer.mergeAll(
+    buildLegacyTestRuntime({
+      out,
+      api,
+      cliConfig,
+      tty: mockTty({ stdinIsTty: opts.stdinIsTty ?? false, stdoutIsTty: false }),
+      goOutput: opts.goOutput === undefined ? Option.none() : Option.some(opts.goOutput),
+    }),
+    Layer.succeed(LegacyYesFlag, opts.yes ?? false),
+  );
+  return { layer, out, api };
+}
+
+function parseDeleteBody(body: unknown): string[] {
+  return body as string[];
+}
+
+// ---------------------------------------------------------------------------
+// Tests
+// ---------------------------------------------------------------------------
+
+describe("legacy secrets unset integration", () => {
+  it.live("unsets a single secret given explicitly (with --yes)", () => {
+    const { layer, out, api } = setup({ yes: true });
+    return Effect.gen(function* () {
+      yield* legacySecretsUnset({ projectRef: Option.none(), names: ["FOO"] });
+      // No GET call: names came from args.
+      expect(api.requests.filter((r) => r.method === "GET")).toHaveLength(0);
+      const deletes = api.requests.filter((r) => r.method === "DELETE");
+      expect(deletes).toHaveLength(1);
+      expect(parseDeleteBody(deletes[0]!.body)).toEqual(["FOO"]);
+      expect(out.stdoutText).toBe("Finished supabase secrets unset.\n");
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("unsets multiple secrets given explicitly", () => {
+    const { layer, api } = setup({ yes: true });
+    return Effect.gen(function* () {
+      yield* legacySecretsUnset({
+        projectRef: Option.none(),
+        names: ["FOO", "BAR"],
+      });
+      const deletes = api.requests.filter((r) => r.method === "DELETE");
+      expect(parseDeleteBody(deletes[0]!.body)).toEqual(["FOO", "BAR"]);
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("empty-args path lists secrets and DELETEs the non-SUPABASE_ subset", () => {
+    const { layer, api } = setup({
+      yes: true,
+      list: [
+        { name: "FOO", value: "d1" },
+        { name: "SUPABASE_AUTH_TOKEN", value: "d2" },
+        { name: "BAR", value: "d3" },
+      ],
+    });
+    return Effect.gen(function* () {
+      yield* legacySecretsUnset({ projectRef: Option.none(), names: [] });
+      const gets = api.requests.filter((r) => r.method === "GET");
+      const deletes = api.requests.filter((r) => r.method === "DELETE");
+      expect(gets).toHaveLength(1);
+      expect(parseDeleteBody(deletes[0]!.body)).toEqual(["FOO", "BAR"]);
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("empty-args path with all-SUPABASE_ secrets writes stderr no-op and exits 0", () => {
+    const { layer, out, api } = setup({
+      yes: true,
+      list: [{ name: "SUPABASE_ONLY", value: "d" }],
+    });
+    return Effect.gen(function* () {
+      yield* legacySecretsUnset({ projectRef: Option.none(), names: [] });
+      expect(out.stderrText).toContain("You have not set any function secrets, nothing to do.");
+      expect(api.requests.filter((r) => r.method === "DELETE")).toHaveLength(0);
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("empty-args path with empty server list writes the stderr no-op and exits 0", () => {
+    const { layer, out, api } = setup({ yes: true, list: [] });
+    return Effect.gen(function* () {
+      yield* legacySecretsUnset({ projectRef: Option.none(), names: [] });
+      expect(out.stderrText).toContain("You have not set any function secrets, nothing to do.");
+      expect(api.requests.filter((r) => r.method === "DELETE")).toHaveLength(0);
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("--yes bypasses the prompt and echoes [Y/n] y to stderr", () => {
+    const { layer, out } = setup({ yes: true });
+    return Effect.gen(function* () {
+      yield* legacySecretsUnset({ projectRef: Option.none(), names: ["FOO"] });
+      expect(out.stderrText).toContain("Do you want to unset these function secrets?");
+      expect(out.stderrText).toContain(" • FOO");
+      expect(out.stderrText).toContain("[Y/n] y");
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("non-TTY without --yes auto-confirms silently (Go parity)", () => {
+    const { layer, out, api } = setup({ yes: false, stdinIsTty: false });
+    return Effect.gen(function* () {
+      yield* legacySecretsUnset({ projectRef: Option.none(), names: ["FOO"] });
+      // Go's PromptYesNo defaults to true after 100ms non-TTY read timeout — no stderr echo.
+      expect(out.stderrText).not.toContain("[Y/n]");
+      expect(api.requests.filter((r) => r.method === "DELETE")).toHaveLength(1);
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("TTY without --yes prompts via output.promptConfirm and proceeds on accept", () => {
+    const { layer, api } = setup({ yes: false, stdinIsTty: true, confirm: true });
+    return Effect.gen(function* () {
+      yield* legacySecretsUnset({ projectRef: Option.none(), names: ["FOO"] });
+      expect(api.requests.filter((r) => r.method === "DELETE")).toHaveLength(1);
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("TTY without --yes fails with LegacySecretsUnsetCancelledError on decline", () => {
+    const { layer, api } = setup({ yes: false, stdinIsTty: true, confirm: false });
+    return Effect.gen(function* () {
+      const exit = yield* Effect.exit(
+        legacySecretsUnset({ projectRef: Option.none(), names: ["FOO"] }),
+      );
+      expect(Exit.isFailure(exit)).toBe(true);
+      if (Exit.isFailure(exit)) {
+        expect(JSON.stringify(exit.cause)).toContain("LegacySecretsUnsetCancelledError");
+      }
+      expect(api.requests.filter((r) => r.method === "DELETE")).toHaveLength(0);
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("fails with LegacySecretsListNetworkError on GET failure (empty-args path)", () => {
+    const { layer } = setup({ yes: true, listNetwork: "fail" });
+    return Effect.gen(function* () {
+      const exit = yield* Effect.exit(legacySecretsUnset({ projectRef: Option.none(), names: [] }));
+      expect(Exit.isFailure(exit)).toBe(true);
+      if (Exit.isFailure(exit)) {
+        expect(JSON.stringify(exit.cause)).toContain("LegacySecretsListNetworkError");
+      }
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("fails with LegacySecretsListUnexpectedStatusError on GET 503 (empty-args path)", () => {
+    const { layer } = setup({ yes: true, listStatus: 503 });
+    return Effect.gen(function* () {
+      const exit = yield* Effect.exit(legacySecretsUnset({ projectRef: Option.none(), names: [] }));
+      expect(Exit.isFailure(exit)).toBe(true);
+      if (Exit.isFailure(exit)) {
+        expect(JSON.stringify(exit.cause)).toContain("LegacySecretsListUnexpectedStatusError");
+      }
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("fails with LegacySecretsUnsetNetworkError on DELETE transport failure", () => {
+    const { layer } = setup({ yes: true, deleteNetwork: "fail" });
+    return Effect.gen(function* () {
+      const exit = yield* Effect.exit(
+        legacySecretsUnset({ projectRef: Option.none(), names: ["FOO"] }),
+      );
+      expect(Exit.isFailure(exit)).toBe(true);
+      if (Exit.isFailure(exit)) {
+        const errJson = JSON.stringify(exit.cause);
+        expect(errJson).toContain("LegacySecretsUnsetNetworkError");
+        expect(errJson).toContain("failed to delete secrets");
+      }
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("fails with LegacySecretsUnsetUnexpectedStatusError on DELETE 500", () => {
+    const { layer } = setup({ yes: true, deleteStatus: 500 });
+    return Effect.gen(function* () {
+      const exit = yield* Effect.exit(
+        legacySecretsUnset({ projectRef: Option.none(), names: ["FOO"] }),
+      );
+      expect(Exit.isFailure(exit)).toBe(true);
+      if (Exit.isFailure(exit)) {
+        const errJson = JSON.stringify(exit.cause);
+        expect(errJson).toContain("LegacySecretsUnsetUnexpectedStatusError");
+        expect(errJson).toContain("Unexpected error unsetting project secrets");
+      }
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("emits a success event with { project_ref, count } for --output-format=json", () => {
+    const { layer, out } = setup({ yes: true, format: "json" });
+    return Effect.gen(function* () {
+      yield* legacySecretsUnset({
+        projectRef: Option.none(),
+        names: ["FOO", "BAR"],
+      });
+      const success = out.messages.find((m) => m.type === "success");
+      expect(success).toBeDefined();
+      expect(success?.data).toEqual({ project_ref: LEGACY_VALID_REF, count: 2 });
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("emits a success event for --output-format=stream-json", () => {
+    const { layer, out } = setup({ yes: true, format: "stream-json" });
+    return Effect.gen(function* () {
+      yield* legacySecretsUnset({ projectRef: Option.none(), names: ["FOO"] });
+      const success = out.messages.find((m) => m.type === "success");
+      expect(success).toBeDefined();
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live(
+    "text mode prints `Finished supabase secrets unset.\\n` regardless of --output value",
+    () => {
+      const { layer, out } = setup({ yes: true, goOutput: "json" });
+      return Effect.gen(function* () {
+        yield* legacySecretsUnset({ projectRef: Option.none(), names: ["FOO"] });
+        expect(out.stdoutText).toBe("Finished supabase secrets unset.\n");
+      }).pipe(Effect.provide(layer));
+    },
+  );
+});
diff --git a/apps/cli/src/legacy/commands/ssl-enforcement/get/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/ssl-enforcement/get/SIDE_EFFECTS.md
index 1ef02ea97a..d06a2d9671 100644
--- a/apps/cli/src/legacy/commands/ssl-enforcement/get/SIDE_EFFECTS.md
+++ b/apps/cli/src/legacy/commands/ssl-enforcement/get/SIDE_EFFECTS.md
@@ -2,56 +2,101 @@
 
 ## Files Read
 
-| Path                       | Format                    | When                                                       |
-| -------------------------- | ------------------------- | ---------------------------------------------------------- |
-| `~/.supabase/access-token` | plain text (token string) | when `SUPABASE_ACCESS_TOKEN` unset and keyring unavailable |
+| Path                                   | Format                    | When                                                          |
+| -------------------------------------- | ------------------------- | ------------------------------------------------------------- |
+| `~/.supabase/access-token`             | plain text (token string) | when `SUPABASE_ACCESS_TOKEN` unset and keyring unavailable    |
+| `<workdir>/supabase/.temp/project-ref` | plain text (project ref)  | when `--project-ref` flag and `PROJECT_ID` env are both unset |
 
 ## Files Written
 
-| Path | Format | When |
-| ---- | ------ | ---- |
-| —    | —      | —    |
+| Path                                             | Format | When                                                                          |
+| ------------------------------------------------ | ------ | ----------------------------------------------------------------------------- |
+| `~/.supabase/<workdir-hash>/linked-project.json` | JSON   | always (after ref resolution), via `Effect.ensuring` — on success and failure |
+| `~/.supabase/telemetry.json`                     | JSON   | always, via `Effect.ensuring` — on success and failure                        |
 
 ## API Routes
 
-| Method | Path                                        | Auth         | Request body | Response (used fields)         |
-| ------ | ------------------------------------------- | ------------ | ------------ | ------------------------------ |
-| `GET`  | `/v1/projects/{ref}/config/ssl-enforcement` | Bearer token | none         | `{enforced, override_enabled}` |
+| Method | Path                                 | Auth         | Request body | Response (used fields)                                               |
+| ------ | ------------------------------------ | ------------ | ------------ | -------------------------------------------------------------------- |
+| `GET`  | `/v1/projects/{ref}/ssl-enforcement` | Bearer token | none         | `{currentConfig: {database: boolean}, appliedSuccessfully: boolean}` |
 
 ## Environment Variables
 
-| Variable                | Purpose                                              | Required?                                               |
-| ----------------------- | ---------------------------------------------------- | ------------------------------------------------------- |
-| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `~/.supabase/access-token`) |
-| `SUPABASE_API_URL`      | override Management API base URL                     | no (defaults to `https://api.supabase.com`)             |
+| Variable                | Purpose                                              | Required?                                                |
+| ----------------------- | ---------------------------------------------------- | -------------------------------------------------------- |
+| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `~/.supabase/access-token`)  |
+| `SUPABASE_API_URL`      | override Management API base URL                     | no (defaults to `https://api.supabase.com`)              |
+| `PROJECT_ID`            | project ref fallback when `--project-ref` is unset   | no (falls back to `supabase/.temp/project-ref` → prompt) |
 
 ## Exit Codes
 
-| Code | Condition                                                  |
-| ---- | ---------------------------------------------------------- |
-| `0`  | success — SSL enforcement config printed to stdout         |
-| `1`  | authentication error — no valid token found                |
-| `1`  | API error — non-2xx response from SSL enforcement endpoint |
-| `1`  | network / connection failure                               |
+| Code | Condition                                                                               |
+| ---- | --------------------------------------------------------------------------------------- |
+| `0`  | success — SSL enforcement status printed to stdout                                      |
+| `1`  | project ref unresolved (`LegacyProjectNotLinkedError` / `LegacyInvalidProjectRefError`) |
+| `1`  | API non-200 (`LegacySslEnforcementGetUnexpectedStatusError`)                            |
+| `1`  | transport failure (`LegacySslEnforcementGetNetworkError`)                               |
+
+## Telemetry Events Fired
+
+| Event                  | When                                       | Notable properties / groups                                          |
+| ---------------------- | ------------------------------------------ | -------------------------------------------------------------------- |
+| `cli_command_executed` | post-run, success or failure (via wrapper) | `exit_code`, `duration_ms`, `flags` (`--project-ref` → `<redacted>`) |
+
+Matches `apps/cli-go/internal/sslenforcement/get/`. Go does not fire any custom telemetry event for this command.
 
 ## Output
 
-### `--output-format text` (Go CLI compatible)
+### `--output-format text` (default) — Go CLI compatible
+
+Single status line to stdout:
+
+```
+SSL is being enforced.
+```
+
+or
+
+```
+SSL is *NOT* being enforced.
+```
+
+The "_NOT_" form is emitted when `currentConfig.database` is `false` **or** when
+`appliedSuccessfully` is `false` (i.e. the requested config has not yet propagated).
+
+### Go `--output {json,yaml,toml,env}`
+
+Byte-identical to the Go CLI's encoders (`apps/cli-go/internal/utils/output.go`).
 
-Prints SSL enforcement configuration to stdout.
+- `json` — alphabetical struct-field order with trailing newline.
+- `yaml` — `stringifyYaml(response)`.
+- `toml` — `stringifyToml(response)` with trailing newline.
+- `env` — Viper-flattened SCREAMING_SNAKE_CASE keys (e.g.
+  `APPLIEDSUCCESSFULLY="true"\nCURRENTCONFIG_DATABASE="true"\n`).
+
+### Go `--output pretty`
+
+Same as `text` mode (Go's default).
 
 ### `--output-format json`
 
-Single JSON object emitted to stdout on success.
+The full response object emitted as the `success` event payload:
+
+```json
+{ "currentConfig": { "database": true }, "appliedSuccessfully": true }
+```
 
 ### `--output-format stream-json`
 
-One `result` event on success.
+One `result` event:
 
 ```ndjson
-{"type":"result","data":{...}}
+{"type":"result","data":{"currentConfig":{"database":true},"appliedSuccessfully":true}}
 ```
 
 ## Notes
 
-- Requires `--project-ref` or a linked project (`.supabase/config.json`).
+- The Go `--output` flag wins over the TS `--output-format` flag when both are provided.
+- `linked-project.json` is written **after** the project ref is resolved, regardless of
+  whether the subsequent API call succeeds (mirrors Go's `PersistentPostRun`).
+- `telemetry.json` is written on every invocation, including failures.
diff --git a/apps/cli/src/legacy/commands/ssl-enforcement/get/get.command.ts b/apps/cli/src/legacy/commands/ssl-enforcement/get/get.command.ts
index b7706f47bc..2b402215de 100644
--- a/apps/cli/src/legacy/commands/ssl-enforcement/get/get.command.ts
+++ b/apps/cli/src/legacy/commands/ssl-enforcement/get/get.command.ts
@@ -1,5 +1,9 @@
 import { Command, Flag } from "effect/unstable/cli";
 import type * as CliCommand from "effect/unstable/cli/Command";
+
+import { withJsonErrorHandling } from "../../../../shared/output/json-error-handling.ts";
+import { legacyManagementApiRuntimeLayer } from "../../../shared/legacy-management-api-runtime.layer.ts";
+import { withLegacyCommandInstrumentation } from "../../../telemetry/legacy-command-instrumentation.ts";
 import { legacySslEnforcementGet } from "./get.handler.ts";
 
 const config = {
@@ -7,12 +11,18 @@ const config = {
     Flag.withDescription("Project ref of the Supabase project."),
     Flag.optional,
   ),
-};
+} as const;
 
 export type LegacySslEnforcementGetFlags = CliCommand.Command.Config.Infer<typeof config>;
 
 export const legacySslEnforcementGetCommand = Command.make("get", config).pipe(
   Command.withDescription("Get the current SSL enforcement configuration."),
   Command.withShortDescription("Get SSL enforcement configuration"),
-  Command.withHandler((flags) => legacySslEnforcementGet(flags)),
+  Command.withHandler((flags) =>
+    legacySslEnforcementGet(flags).pipe(
+      withLegacyCommandInstrumentation({ flags }),
+      withJsonErrorHandling,
+    ),
+  ),
+  Command.provide(legacyManagementApiRuntimeLayer(["ssl-enforcement", "get"])),
 );
diff --git a/apps/cli/src/legacy/commands/ssl-enforcement/get/get.handler.ts b/apps/cli/src/legacy/commands/ssl-enforcement/get/get.handler.ts
index 986cc427a0..c3891ad572 100644
--- a/apps/cli/src/legacy/commands/ssl-enforcement/get/get.handler.ts
+++ b/apps/cli/src/legacy/commands/ssl-enforcement/get/get.handler.ts
@@ -1,12 +1,87 @@
 import { Effect, Option } from "effect";
-import { LegacyGoProxy } from "../../../../shared/legacy/go-proxy.service.ts";
+
+import { LegacyPlatformApi } from "../../../auth/legacy-platform-api.service.ts";
+import { LegacyProjectRefResolver } from "../../../config/legacy-project-ref.service.ts";
+import { LegacyLinkedProjectCache } from "../../../telemetry/legacy-linked-project-cache.service.ts";
+import { LegacyTelemetryState } from "../../../telemetry/legacy-telemetry-state.service.ts";
+import { LegacyOutputFlag } from "../../../../shared/legacy/global-flags.ts";
+import { Output } from "../../../../shared/output/output.service.ts";
+import {
+  encodeEnv,
+  encodeGoJson,
+  encodeToml,
+  encodeYaml,
+} from "../../../shared/legacy-go-output.encoders.ts";
+import { mapLegacyHttpError } from "../../../shared/legacy-http-errors.ts";
+import {
+  LegacySslEnforcementGetNetworkError,
+  LegacySslEnforcementGetUnexpectedStatusError,
+} from "../ssl-enforcement.errors.ts";
+import { printSslStatus } from "../ssl-enforcement.format.ts";
 import type { LegacySslEnforcementGetFlags } from "./get.command.ts";
 
+// Templates lifted verbatim from `apps/cli-go/internal/ssl_enforcement/get/get.go:17,19`.
+const mapGetError = mapLegacyHttpError({
+  networkError: LegacySslEnforcementGetNetworkError,
+  statusError: LegacySslEnforcementGetUnexpectedStatusError,
+  networkMessage: (cause) => `failed to retrieve SSL enforcement config: ${cause}`,
+  statusMessage: (status, body) => `unexpected SSL enforcement status ${status}: ${body}`,
+});
+
 export const legacySslEnforcementGet = Effect.fn("legacy.ssl-enforcement.get")(function* (
   flags: LegacySslEnforcementGetFlags,
 ) {
-  const proxy = yield* LegacyGoProxy;
-  const args: string[] = ["ssl-enforcement", "get"];
-  if (Option.isSome(flags.projectRef)) args.push("--project-ref", flags.projectRef.value);
-  yield* proxy.exec(args);
+  const output = yield* Output;
+  const goOutputFlag = yield* LegacyOutputFlag;
+  const api = yield* LegacyPlatformApi;
+  const resolver = yield* LegacyProjectRefResolver;
+  const linkedProjectCache = yield* LegacyLinkedProjectCache;
+  const telemetryState = yield* LegacyTelemetryState;
+
+  // Mirror Go's PersistentPostRun (`apps/cli-go/cmd/root.go:176`): telemetry must flush
+  // whether ref resolution, the API call, or output emission fails. `linkedProjectCache.cache`
+  // requires a resolved ref, so it wraps the inner sub-effect only.
+  yield* Effect.gen(function* () {
+    const ref = yield* resolver.resolve(flags.projectRef);
+
+    yield* Effect.gen(function* () {
+      const fetching =
+        output.format === "text"
+          ? yield* output.task("Fetching SSL enforcement config...")
+          : undefined;
+      const response = yield* api.v1.getSslEnforcementConfig({ ref }).pipe(
+        Effect.tapError(() => fetching?.fail() ?? Effect.void),
+        Effect.catch(mapGetError),
+      );
+      yield* fetching?.clear() ?? Effect.void;
+
+      const goFmt = Option.getOrUndefined(goOutputFlag);
+
+      if (goFmt === "json") {
+        yield* output.raw(encodeGoJson(response));
+        return;
+      }
+      if (goFmt === "yaml") {
+        yield* output.raw(encodeYaml(response));
+        return;
+      }
+      if (goFmt === "toml") {
+        yield* output.raw(encodeToml(response) + "\n");
+        return;
+      }
+      if (goFmt === "env") {
+        yield* output.raw(encodeEnv(response) + "\n");
+        return;
+      }
+
+      // goFmt is undefined or "pretty" — defer to TS --output-format for JSON/stream-json,
+      // otherwise print the Go text-mode status line (Go --output pretty parity).
+      if (output.format === "json" || output.format === "stream-json") {
+        yield* output.success("", response);
+        return;
+      }
+
+      yield* output.raw(printSslStatus(response));
+    }).pipe(Effect.ensuring(linkedProjectCache.cache(ref)));
+  }).pipe(Effect.ensuring(telemetryState.flush));
 });
diff --git a/apps/cli/src/legacy/commands/ssl-enforcement/get/get.integration.test.ts b/apps/cli/src/legacy/commands/ssl-enforcement/get/get.integration.test.ts
new file mode 100644
index 0000000000..986fdbb71b
--- /dev/null
+++ b/apps/cli/src/legacy/commands/ssl-enforcement/get/get.integration.test.ts
@@ -0,0 +1,363 @@
+import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+
+import { type V1GetSslEnforcementConfigOutput } from "@supabase/api/effect";
+import { describe, expect, it } from "@effect/vitest";
+import { Effect, Exit, Option } from "effect";
+
+import { withJsonErrorHandling } from "../../../../shared/output/json-error-handling.ts";
+import { mockOutput, mockTty } from "../../../../../tests/helpers/mocks.ts";
+import {
+  LEGACY_VALID_REF,
+  buildLegacyTestRuntime,
+  mockLegacyCliConfig,
+  mockLegacyLinkedProjectCacheTracked,
+  mockLegacyPlatformApi,
+  mockLegacyTelemetryStateTracked,
+  useLegacyTempWorkdir,
+} from "../../../../../tests/helpers/legacy-mocks.ts";
+import { legacySslEnforcementGet } from "./get.handler.ts";
+
+// ---------------------------------------------------------------------------
+// Fixtures
+// ---------------------------------------------------------------------------
+
+const SSL_ENFORCED: typeof V1GetSslEnforcementConfigOutput.Type = {
+  currentConfig: { database: true },
+  appliedSuccessfully: true,
+};
+
+const SSL_NOT_ENFORCED: typeof V1GetSslEnforcementConfigOutput.Type = {
+  currentConfig: { database: false },
+  appliedSuccessfully: false,
+};
+
+const SSL_DESIRED_BUT_NOT_APPLIED: typeof V1GetSslEnforcementConfigOutput.Type = {
+  currentConfig: { database: true },
+  appliedSuccessfully: false,
+};
+
+// ---------------------------------------------------------------------------
+// Setup
+// ---------------------------------------------------------------------------
+
+interface SetupOpts {
+  format?: "text" | "json" | "stream-json";
+  goOutput?: "env" | "pretty" | "json" | "toml" | "yaml";
+  response?: typeof V1GetSslEnforcementConfigOutput.Type;
+  status?: number;
+  network?: "fail";
+  stdinIsTty?: boolean;
+  apiUrl?: string;
+  userAgent?: string;
+}
+
+const tempRoot = useLegacyTempWorkdir("supabase-ssl-enforcement-get-int-");
+
+function setup(opts: SetupOpts = {}) {
+  const out = mockOutput({ format: opts.format ?? "text" });
+  const api = mockLegacyPlatformApi({
+    response: { status: opts.status ?? 200, body: opts.response ?? SSL_ENFORCED },
+    network: opts.network,
+    apiUrl: opts.apiUrl,
+    userAgent: opts.userAgent,
+  });
+  const cliConfig = mockLegacyCliConfig({
+    workdir: tempRoot.current,
+    apiUrl: opts.apiUrl,
+    userAgent: opts.userAgent,
+  });
+  const layer = buildLegacyTestRuntime({
+    out,
+    api,
+    cliConfig,
+    tty: mockTty({ stdinIsTty: opts.stdinIsTty ?? false, stdoutIsTty: false }),
+    goOutput: opts.goOutput === undefined ? Option.none() : Option.some(opts.goOutput),
+  });
+  return { layer, out, api };
+}
+
+// ---------------------------------------------------------------------------
+// Tests
+// ---------------------------------------------------------------------------
+
+describe("legacy ssl-enforcement get integration", () => {
+  it.live('prints "SSL is being enforced." when database=true and appliedSuccessfully=true', () => {
+    const { layer, out } = setup({ response: SSL_ENFORCED });
+    return Effect.gen(function* () {
+      yield* legacySslEnforcementGet({ projectRef: Option.none() });
+      expect(out.stdoutText).toBe("SSL is being enforced.\n");
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live('prints "SSL is *NOT* being enforced." when database=false', () => {
+    const { layer, out } = setup({ response: SSL_NOT_ENFORCED });
+    return Effect.gen(function* () {
+      yield* legacySslEnforcementGet({ projectRef: Option.none() });
+      expect(out.stdoutText).toBe("SSL is *NOT* being enforced.\n");
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live(
+    'prints "SSL is *NOT* being enforced." when database=true but appliedSuccessfully=false',
+    () => {
+      const { layer, out } = setup({ response: SSL_DESIRED_BUT_NOT_APPLIED });
+      return Effect.gen(function* () {
+        yield* legacySslEnforcementGet({ projectRef: Option.none() });
+        expect(out.stdoutText).toBe("SSL is *NOT* being enforced.\n");
+      }).pipe(Effect.provide(layer));
+    },
+  );
+
+  it.live("emits Go-compatible env output for --output env (exact bytes)", () => {
+    const { layer, out } = setup({ goOutput: "env", response: SSL_ENFORCED });
+    return Effect.gen(function* () {
+      yield* legacySslEnforcementGet({ projectRef: Option.none() });
+      expect(out.stdoutText).toBe('APPLIEDSUCCESSFULLY="true"\nCURRENTCONFIG_DATABASE="true"\n');
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("emits Go-compatible indented JSON for --output json (exact bytes)", () => {
+    const { layer, out } = setup({ goOutput: "json", response: SSL_ENFORCED });
+    return Effect.gen(function* () {
+      yield* legacySslEnforcementGet({ projectRef: Option.none() });
+      expect(out.stdoutText).toBe(
+        `{
+  "appliedSuccessfully": true,
+  "currentConfig": {
+    "database": true
+  }
+}
+`,
+      );
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("emits YAML for --output yaml", () => {
+    const { layer, out } = setup({ goOutput: "yaml", response: SSL_ENFORCED });
+    return Effect.gen(function* () {
+      yield* legacySslEnforcementGet({ projectRef: Option.none() });
+      expect(out.stdoutText).toContain("appliedSuccessfully: true");
+      expect(out.stdoutText).toContain("database: true");
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("emits TOML for --output toml", () => {
+    const { layer, out } = setup({ goOutput: "toml", response: SSL_ENFORCED });
+    return Effect.gen(function* () {
+      yield* legacySslEnforcementGet({ projectRef: Option.none() });
+      expect(out.stdoutText).toContain("appliedSuccessfully = true");
+      expect(out.stdoutText).toContain("[currentConfig]");
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("treats --output pretty as identical to text mode", () => {
+    const { layer, out } = setup({ goOutput: "pretty", response: SSL_ENFORCED });
+    return Effect.gen(function* () {
+      yield* legacySslEnforcementGet({ projectRef: Option.none() });
+      expect(out.stdoutText).toBe("SSL is being enforced.\n");
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("emits a JSON success event when --output-format=json", () => {
+    const { layer, out } = setup({ format: "json", response: SSL_ENFORCED });
+    return Effect.gen(function* () {
+      yield* legacySslEnforcementGet({ projectRef: Option.none() });
+      const success = out.messages.find((m) => m.type === "success");
+      expect(success).toBeDefined();
+      expect(success?.data).toMatchObject({
+        currentConfig: { database: true },
+        appliedSuccessfully: true,
+      });
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("emits a result event for --output-format=stream-json", () => {
+    const { layer, out } = setup({ format: "stream-json", response: SSL_ENFORCED });
+    return Effect.gen(function* () {
+      yield* legacySslEnforcementGet({ projectRef: Option.none() });
+      const success = out.messages.find((m) => m.type === "success");
+      expect(success).toBeDefined();
+      expect(success?.data).toMatchObject({ currentConfig: { database: true } });
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("--output (Go) wins over --output-format (TS) when both provided", () => {
+    const { layer, out } = setup({ format: "json", goOutput: "yaml", response: SSL_ENFORCED });
+    return Effect.gen(function* () {
+      yield* legacySslEnforcementGet({ projectRef: Option.none() });
+      expect(out.stdoutText).toContain("appliedSuccessfully: true");
+      expect(out.stdoutText.startsWith("{")).toBe(false);
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("passes the resolved project ref into the getSslEnforcementConfig URL", () => {
+    const { layer, api } = setup({ response: SSL_ENFORCED });
+    return Effect.gen(function* () {
+      yield* legacySslEnforcementGet({ projectRef: Option.none() });
+      expect(api.requests).toHaveLength(1);
+      expect(api.requests[0]?.url).toContain(`/v1/projects/${LEGACY_VALID_REF}/ssl-enforcement`);
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("uses --project-ref flag value over LegacyCliConfig.projectId", () => {
+    const flagRef = "zzzzzzzzzzzzzzzzzzzz";
+    const { layer, api } = setup({ response: SSL_ENFORCED });
+    return Effect.gen(function* () {
+      yield* legacySslEnforcementGet({ projectRef: Option.some(flagRef) });
+      expect(api.requests[0]?.url).toContain(`/v1/projects/${flagRef}/`);
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("reads supabase/.temp/project-ref when env and flag are unset", () => {
+    // This test owns its own workdir because it writes a project-ref file
+    // before the layer is constructed (the resolver reads from
+    // <workdir>/supabase/.temp/project-ref on layer-effect resolution).
+    const localTempRoot = mkdtempSync(join(tmpdir(), "supabase-ssl-get-int-fileref-"));
+    const fileRef = "filerefabcdefghijklm";
+    mkdirSync(join(localTempRoot, "supabase", ".temp"), { recursive: true });
+    writeFileSync(join(localTempRoot, "supabase", ".temp", "project-ref"), fileRef);
+
+    const out = mockOutput({ format: "text" });
+    const api = mockLegacyPlatformApi({ response: { status: 200, body: SSL_ENFORCED } });
+    const cliConfig = mockLegacyCliConfig({
+      workdir: localTempRoot,
+      projectId: Option.none(),
+    });
+    const layer = buildLegacyTestRuntime({ out, api, cliConfig });
+
+    return Effect.gen(function* () {
+      yield* legacySslEnforcementGet({ projectRef: Option.none() });
+      expect(api.requests[0]?.url).toContain(`/v1/projects/${fileRef}/`);
+    }).pipe(
+      Effect.provide(layer),
+      Effect.ensuring(Effect.sync(() => rmSync(localTempRoot, { recursive: true, force: true }))),
+    );
+  });
+
+  it.live("fails with LegacyProjectNotLinkedError when no ref source matches off-TTY", () => {
+    const localTempRoot = mkdtempSync(join(tmpdir(), "supabase-ssl-get-int-no-ref-"));
+    const out = mockOutput({ format: "text" });
+    const api = mockLegacyPlatformApi({ response: { status: 200, body: SSL_ENFORCED } });
+    const cliConfig = mockLegacyCliConfig({
+      workdir: localTempRoot,
+      projectId: Option.none(),
+    });
+    const layer = buildLegacyTestRuntime({ out, api, cliConfig });
+
+    return Effect.gen(function* () {
+      const exit = yield* Effect.exit(
+        legacySslEnforcementGet({ projectRef: Option.none() }).pipe(Effect.provide(layer)),
+      );
+      expect(Exit.isFailure(exit)).toBe(true);
+      if (Exit.isFailure(exit)) {
+        expect(JSON.stringify(exit.cause)).toContain("LegacyProjectNotLinkedError");
+      }
+    }).pipe(
+      Effect.ensuring(Effect.sync(() => rmSync(localTempRoot, { recursive: true, force: true }))),
+    );
+  });
+
+  it.live("fails with LegacyInvalidProjectRefError when the resolved ref is malformed", () => {
+    const { layer } = setup({ response: SSL_ENFORCED });
+    return Effect.gen(function* () {
+      const exit = yield* Effect.exit(
+        legacySslEnforcementGet({ projectRef: Option.some("BADREF") }),
+      );
+      expect(Exit.isFailure(exit)).toBe(true);
+      if (Exit.isFailure(exit)) {
+        expect(JSON.stringify(exit.cause)).toContain("LegacyInvalidProjectRefError");
+      }
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("fails with LegacySslEnforcementGetUnexpectedStatusError on HTTP 503", () => {
+    const { layer } = setup({ status: 503, response: SSL_ENFORCED });
+    return Effect.gen(function* () {
+      const exit = yield* Effect.exit(legacySslEnforcementGet({ projectRef: Option.none() }));
+      expect(Exit.isFailure(exit)).toBe(true);
+      if (Exit.isFailure(exit)) {
+        const errorJson = JSON.stringify(exit.cause);
+        expect(errorJson).toContain("LegacySslEnforcementGetUnexpectedStatusError");
+        expect(errorJson).toContain("unexpected SSL enforcement status 503");
+      }
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("fails with LegacySslEnforcementGetNetworkError on transport failure", () => {
+    const { layer } = setup({ network: "fail" });
+    return Effect.gen(function* () {
+      const exit = yield* Effect.exit(legacySslEnforcementGet({ projectRef: Option.none() }));
+      expect(Exit.isFailure(exit)).toBe(true);
+      if (Exit.isFailure(exit)) {
+        const errorJson = JSON.stringify(exit.cause);
+        expect(errorJson).toContain("LegacySslEnforcementGetNetworkError");
+        expect(errorJson).toContain("failed to retrieve SSL enforcement config");
+      }
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("emits a fail event when withJsonErrorHandling wraps a JSON-mode error", () => {
+    const { layer, out } = setup({ format: "json", status: 503, response: SSL_ENFORCED });
+    return Effect.gen(function* () {
+      yield* legacySslEnforcementGet({ projectRef: Option.none() }).pipe(withJsonErrorHandling);
+      expect(out.messages.some((m) => m.type === "fail")).toBe(true);
+    }).pipe(Effect.provide(layer));
+  });
+
+  // -------------------------------------------------------------------------
+  // PersistentPostRun parity — telemetry + linked-project cache scoping
+  // -------------------------------------------------------------------------
+
+  it.live("flushes telemetry and writes linked-project cache on success", () => {
+    const telemetry = mockLegacyTelemetryStateTracked();
+    const cache = mockLegacyLinkedProjectCacheTracked();
+    const out = mockOutput({ format: "text" });
+    const api = mockLegacyPlatformApi({ response: { status: 200, body: SSL_ENFORCED } });
+    const cliConfig = mockLegacyCliConfig({ workdir: tempRoot.current });
+    const layer = buildLegacyTestRuntime({
+      out,
+      api,
+      cliConfig,
+      telemetry: telemetry.layer,
+      linkedProjectCache: cache.layer,
+    });
+    return Effect.gen(function* () {
+      yield* legacySslEnforcementGet({ projectRef: Option.none() });
+      expect(telemetry.flushed).toBe(true);
+      expect(cache.cached).toBe(true);
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("flushes telemetry even when ref resolution fails (no cache write)", () => {
+    // Pre-PersistentPostRun-fix regression guard: telemetry must flush whether or not the
+    // resolver succeeds. The linked-project cache only writes after a ref is resolved.
+    const localTempRoot = mkdtempSync(join(tmpdir(), "supabase-ssl-get-int-postrun-"));
+    const telemetry = mockLegacyTelemetryStateTracked();
+    const cache = mockLegacyLinkedProjectCacheTracked();
+    const out = mockOutput({ format: "text" });
+    const api = mockLegacyPlatformApi({ response: { status: 200, body: SSL_ENFORCED } });
+    const cliConfig = mockLegacyCliConfig({
+      workdir: localTempRoot,
+      projectId: Option.none(),
+    });
+    const layer = buildLegacyTestRuntime({
+      out,
+      api,
+      cliConfig,
+      telemetry: telemetry.layer,
+      linkedProjectCache: cache.layer,
+    });
+    return Effect.gen(function* () {
+      const exit = yield* Effect.exit(
+        legacySslEnforcementGet({ projectRef: Option.none() }).pipe(Effect.provide(layer)),
+      );
+      expect(Exit.isFailure(exit)).toBe(true);
+      expect(telemetry.flushed).toBe(true);
+      expect(cache.cached).toBe(false);
+    }).pipe(
+      Effect.ensuring(Effect.sync(() => rmSync(localTempRoot, { recursive: true, force: true }))),
+    );
+  });
+});
diff --git a/apps/cli/src/legacy/commands/ssl-enforcement/ssl-enforcement.errors.ts b/apps/cli/src/legacy/commands/ssl-enforcement/ssl-enforcement.errors.ts
new file mode 100644
index 0000000000..0ff460b5a1
--- /dev/null
+++ b/apps/cli/src/legacy/commands/ssl-enforcement/ssl-enforcement.errors.ts
@@ -0,0 +1,56 @@
+import { Data } from "effect";
+
+export class LegacySslEnforcementGetNetworkError extends Data.TaggedError(
+  "LegacySslEnforcementGetNetworkError",
+)<{
+  readonly message: string;
+}> {}
+
+export class LegacySslEnforcementGetUnexpectedStatusError extends Data.TaggedError(
+  "LegacySslEnforcementGetUnexpectedStatusError",
+)<{
+  readonly status: number;
+  readonly body: string;
+  readonly message: string;
+}> {}
+
+export class LegacySslEnforcementUpdateNetworkError extends Data.TaggedError(
+  "LegacySslEnforcementUpdateNetworkError",
+)<{
+  readonly message: string;
+}> {}
+
+export class LegacySslEnforcementUpdateUnexpectedStatusError extends Data.TaggedError(
+  "LegacySslEnforcementUpdateUnexpectedStatusError",
+)<{
+  readonly status: number;
+  readonly body: string;
+  readonly message: string;
+}> {}
+
+// Verbatim Go string from `apps/cli-go/internal/ssl_enforcement/update/update.go:27`.
+export class LegacySslEnforcementNoEnableDisableFlagError extends Data.TaggedError(
+  "LegacySslEnforcementNoEnableDisableFlagError",
+)<{
+  readonly message: string;
+}> {
+  constructor() {
+    super({ message: "enable/disable not specified" });
+  }
+}
+
+// Verbatim cobra string for parity with Go's `MarkFlagsMutuallyExclusive`
+// (`apps/cli-go/cmd/sslEnforcement.go:46`). Effect CLI has no built-in
+// equivalent, so we enforce it at handler entry.
+export class LegacySslEnforcementMutuallyExclusiveFlagsError extends Data.TaggedError(
+  "LegacySslEnforcementMutuallyExclusiveFlagsError",
+)<{
+  readonly message: string;
+}> {
+  constructor() {
+    super({
+      message:
+        "if any flags in the group [enable-db-ssl-enforcement disable-db-ssl-enforcement] are set none of the others can be",
+    });
+  }
+}
diff --git a/apps/cli/src/legacy/commands/ssl-enforcement/ssl-enforcement.format.ts b/apps/cli/src/legacy/commands/ssl-enforcement/ssl-enforcement.format.ts
new file mode 100644
index 0000000000..177bb6f91d
--- /dev/null
+++ b/apps/cli/src/legacy/commands/ssl-enforcement/ssl-enforcement.format.ts
@@ -0,0 +1,20 @@
+// Structural shape matches both `V1GetSslEnforcementConfigOutput.Type` and
+// `V1UpdateSslEnforcementConfigOutput.Type` — Go's `update.Run` delegates to
+// `get.PrintSSLStatus` after a successful PUT (`update.go:26`), and the two
+// response schemas are byte-identical. Keeping the parameter type local
+// decouples this formatter from the generated API types and survives any
+// future divergence between the two schemas.
+interface SslEnforcementStatus {
+  readonly currentConfig: { readonly database: boolean };
+  readonly appliedSuccessfully: boolean;
+}
+
+/**
+ * Reproduces `PrintSSLStatus` from `apps/cli-go/internal/ssl_enforcement/get/get.go:27-34`.
+ */
+export function printSslStatus(response: SslEnforcementStatus): string {
+  if (response.currentConfig.database && response.appliedSuccessfully) {
+    return "SSL is being enforced.\n";
+  }
+  return "SSL is *NOT* being enforced.\n";
+}
diff --git a/apps/cli/src/legacy/commands/ssl-enforcement/update/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/ssl-enforcement/update/SIDE_EFFECTS.md
index fcc56d0d17..f6caab93da 100644
--- a/apps/cli/src/legacy/commands/ssl-enforcement/update/SIDE_EFFECTS.md
+++ b/apps/cli/src/legacy/commands/ssl-enforcement/update/SIDE_EFFECTS.md
@@ -2,59 +2,99 @@
 
 ## Files Read
 
-| Path                       | Format                    | When                                                       |
-| -------------------------- | ------------------------- | ---------------------------------------------------------- |
-| `~/.supabase/access-token` | plain text (token string) | when `SUPABASE_ACCESS_TOKEN` unset and keyring unavailable |
+| Path                                   | Format                    | When                                                          |
+| -------------------------------------- | ------------------------- | ------------------------------------------------------------- |
+| `~/.supabase/access-token`             | plain text (token string) | when `SUPABASE_ACCESS_TOKEN` unset and keyring unavailable    |
+| `<workdir>/supabase/.temp/project-ref` | plain text (project ref)  | when `--project-ref` flag and `PROJECT_ID` env are both unset |
 
 ## Files Written
 
-| Path | Format | When |
-| ---- | ------ | ---- |
-| —    | —      | —    |
+| Path                                             | Format | When                                                                                      |
+| ------------------------------------------------ | ------ | ----------------------------------------------------------------------------------------- |
+| `~/.supabase/<workdir-hash>/linked-project.json` | JSON   | after the project ref is resolved (only if flag validation passes), via `Effect.ensuring` |
+| `~/.supabase/telemetry.json`                     | JSON   | always, via `Effect.ensuring` — including flag-validation failures                        |
 
 ## API Routes
 
-| Method | Path                                        | Auth         | Request body          | Response (used fields)         |
-| ------ | ------------------------------------------- | ------------ | --------------------- | ------------------------------ |
-| `PUT`  | `/v1/projects/{ref}/config/ssl-enforcement` | Bearer token | `{enforced: boolean}` | `{enforced, override_enabled}` |
+| Method | Path                                 | Auth         | Request body                             | Response (used fields)                                               |
+| ------ | ------------------------------------ | ------------ | ---------------------------------------- | -------------------------------------------------------------------- |
+| `PUT`  | `/v1/projects/{ref}/ssl-enforcement` | Bearer token | `{requestedConfig: {database: boolean}}` | `{currentConfig: {database: boolean}, appliedSuccessfully: boolean}` |
 
 ## Environment Variables
 
-| Variable                | Purpose                                              | Required?                                               |
-| ----------------------- | ---------------------------------------------------- | ------------------------------------------------------- |
-| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `~/.supabase/access-token`) |
-| `SUPABASE_API_URL`      | override Management API base URL                     | no (defaults to `https://api.supabase.com`)             |
+| Variable                | Purpose                                              | Required?                                                |
+| ----------------------- | ---------------------------------------------------- | -------------------------------------------------------- |
+| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `~/.supabase/access-token`)  |
+| `SUPABASE_API_URL`      | override Management API base URL                     | no (defaults to `https://api.supabase.com`)              |
+| `PROJECT_ID`            | project ref fallback when `--project-ref` is unset   | no (falls back to `supabase/.temp/project-ref` → prompt) |
 
 ## Exit Codes
 
-| Code | Condition                                                                              |
-| ---- | -------------------------------------------------------------------------------------- |
-| `0`  | success — SSL enforcement config updated                                               |
-| `1`  | authentication error — no valid token found                                            |
-| `1`  | neither `--enable-db-ssl-enforcement` nor `--disable-db-ssl-enforcement` was specified |
-| `1`  | API error — non-2xx response from SSL enforcement endpoint                             |
-| `1`  | network / connection failure                                                           |
+| Code | Condition                                                                                                                     |
+| ---- | ----------------------------------------------------------------------------------------------------------------------------- |
+| `0`  | success — SSL enforcement status (post-update) printed to stdout                                                              |
+| `1`  | neither `--enable-db-ssl-enforcement` nor `--disable-db-ssl-enforcement` set (`LegacySslEnforcementNoEnableDisableFlagError`) |
+| `1`  | both `--enable-db-ssl-enforcement` and `--disable-db-ssl-enforcement` set (`LegacySslEnforcementMutuallyExclusiveFlagsError`) |
+| `1`  | project ref unresolved (`LegacyProjectNotLinkedError` / `LegacyInvalidProjectRefError`)                                       |
+| `1`  | API non-200 (`LegacySslEnforcementUpdateUnexpectedStatusError`)                                                               |
+| `1`  | transport failure (`LegacySslEnforcementUpdateNetworkError`)                                                                  |
+
+## Telemetry Events Fired
+
+| Event                  | When                                       | Notable properties / groups                                                                                                                                |
+| ---------------------- | ------------------------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `cli_command_executed` | post-run, success or failure (via wrapper) | `exit_code`, `duration_ms`, `flags` (`--project-ref` → `<redacted>`; `--enable-db-ssl-enforcement` / `--disable-db-ssl-enforcement` booleans pass through) |
+
+Matches `apps/cli-go/internal/sslenforcement/update/`. Go does not fire any custom telemetry event for this command.
 
 ## Output
 
-### `--output-format text` (Go CLI compatible)
+### `--output-format text` (default) — Go CLI compatible
+
+Same status-line shape as `get` (Go's `update.Run` delegates to `get.PrintSSLStatus`):
+
+```
+SSL is being enforced.
+```
+
+or
 
-Prints updated SSL enforcement configuration to stdout.
+```
+SSL is *NOT* being enforced.
+```
+
+### Go `--output {json,yaml,toml,env}`
+
+Byte-identical to the Go CLI's encoders (`apps/cli-go/internal/utils/output.go`).
+
+### Go `--output pretty`
+
+Same as `text` mode.
 
 ### `--output-format json`
 
-Single JSON object emitted to stdout on success.
+The full response object emitted as the `success` event payload:
+
+```json
+{ "currentConfig": { "database": true }, "appliedSuccessfully": true }
+```
 
 ### `--output-format stream-json`
 
-One `result` event on success.
+One `result` event:
 
 ```ndjson
-{"type":"result","data":{...}}
+{"type":"result","data":{"currentConfig":{"database":true},"appliedSuccessfully":true}}
 ```
 
 ## Notes
 
-- Flags `--enable-db-ssl-enforcement` and `--disable-db-ssl-enforcement` are mutually exclusive.
-- Exactly one of the two flags must be specified.
-- Requires `--project-ref` or a linked project (`.supabase/config.json`).
+- `--enable-db-ssl-enforcement` and `--disable-db-ssl-enforcement` are mutually exclusive,
+  enforced at handler entry (Effect CLI has no equivalent of cobra's
+  `MarkFlagsMutuallyExclusive`). The Go binary uses the cobra helper directly.
+- The request body always carries `database: <enableDbSslEnforcement>`; passing
+  `--disable-db-ssl-enforcement` is the user-facing way to send `database: false`.
+- `linked-project.json` is **not** written if flag validation fails (no ref is
+  resolved). `telemetry.json` is written regardless, matching Go's
+  `PersistentPostRun` semantics.
+- The Go `--output` flag wins over the TS `--output-format` flag when both are provided.
diff --git a/apps/cli/src/legacy/commands/ssl-enforcement/update/update.command.ts b/apps/cli/src/legacy/commands/ssl-enforcement/update/update.command.ts
index 009d51dc5f..c7a907223c 100644
--- a/apps/cli/src/legacy/commands/ssl-enforcement/update/update.command.ts
+++ b/apps/cli/src/legacy/commands/ssl-enforcement/update/update.command.ts
@@ -1,5 +1,9 @@
 import { Command, Flag } from "effect/unstable/cli";
 import type * as CliCommand from "effect/unstable/cli/Command";
+
+import { withJsonErrorHandling } from "../../../../shared/output/json-error-handling.ts";
+import { legacyManagementApiRuntimeLayer } from "../../../shared/legacy-management-api-runtime.layer.ts";
+import { withLegacyCommandInstrumentation } from "../../../telemetry/legacy-command-instrumentation.ts";
 import { legacySslEnforcementUpdate } from "./update.handler.ts";
 
 const config = {
@@ -24,5 +28,11 @@ export type LegacySslEnforcementUpdateFlags = CliCommand.Command.Config.Infer<ty
 export const legacySslEnforcementUpdateCommand = Command.make("update", config).pipe(
   Command.withDescription("Update SSL enforcement configuration."),
   Command.withShortDescription("Update SSL enforcement configuration"),
-  Command.withHandler((flags) => legacySslEnforcementUpdate(flags)),
+  Command.withHandler((flags) =>
+    legacySslEnforcementUpdate(flags).pipe(
+      withLegacyCommandInstrumentation({ flags }),
+      withJsonErrorHandling,
+    ),
+  ),
+  Command.provide(legacyManagementApiRuntimeLayer(["ssl-enforcement", "update"])),
 );
diff --git a/apps/cli/src/legacy/commands/ssl-enforcement/update/update.handler.ts b/apps/cli/src/legacy/commands/ssl-enforcement/update/update.handler.ts
index 3afa028c07..615429cc08 100644
--- a/apps/cli/src/legacy/commands/ssl-enforcement/update/update.handler.ts
+++ b/apps/cli/src/legacy/commands/ssl-enforcement/update/update.handler.ts
@@ -1,14 +1,102 @@
 import { Effect, Option } from "effect";
-import { LegacyGoProxy } from "../../../../shared/legacy/go-proxy.service.ts";
+
+import { LegacyPlatformApi } from "../../../auth/legacy-platform-api.service.ts";
+import { LegacyProjectRefResolver } from "../../../config/legacy-project-ref.service.ts";
+import { LegacyLinkedProjectCache } from "../../../telemetry/legacy-linked-project-cache.service.ts";
+import { LegacyTelemetryState } from "../../../telemetry/legacy-telemetry-state.service.ts";
+import { LegacyOutputFlag } from "../../../../shared/legacy/global-flags.ts";
+import { Output } from "../../../../shared/output/output.service.ts";
+import {
+  encodeEnv,
+  encodeGoJson,
+  encodeToml,
+  encodeYaml,
+} from "../../../shared/legacy-go-output.encoders.ts";
+import { mapLegacyHttpError } from "../../../shared/legacy-http-errors.ts";
+import {
+  LegacySslEnforcementMutuallyExclusiveFlagsError,
+  LegacySslEnforcementNoEnableDisableFlagError,
+  LegacySslEnforcementUpdateNetworkError,
+  LegacySslEnforcementUpdateUnexpectedStatusError,
+} from "../ssl-enforcement.errors.ts";
+import { printSslStatus } from "../ssl-enforcement.format.ts";
 import type { LegacySslEnforcementUpdateFlags } from "./update.command.ts";
 
+// Templates lifted verbatim from `apps/cli-go/internal/ssl_enforcement/update/update.go:19,21`.
+// (Lowercase `ssl` in the network message is intentional Go fidelity.)
+const mapUpdateError = mapLegacyHttpError({
+  networkError: LegacySslEnforcementUpdateNetworkError,
+  statusError: LegacySslEnforcementUpdateUnexpectedStatusError,
+  networkMessage: (cause) => `failed to update ssl enforcement: ${cause}`,
+  statusMessage: (status, body) => `unexpected update SSL status ${status}: ${body}`,
+});
+
 export const legacySslEnforcementUpdate = Effect.fn("legacy.ssl-enforcement.update")(function* (
   flags: LegacySslEnforcementUpdateFlags,
 ) {
-  const proxy = yield* LegacyGoProxy;
-  const args: string[] = ["ssl-enforcement", "update"];
-  if (Option.isSome(flags.projectRef)) args.push("--project-ref", flags.projectRef.value);
-  if (flags.enableDbSslEnforcement) args.push("--enable-db-ssl-enforcement");
-  if (flags.disableDbSslEnforcement) args.push("--disable-db-ssl-enforcement");
-  yield* proxy.exec(args);
+  const output = yield* Output;
+  const goOutputFlag = yield* LegacyOutputFlag;
+  const api = yield* LegacyPlatformApi;
+  const resolver = yield* LegacyProjectRefResolver;
+  const linkedProjectCache = yield* LegacyLinkedProjectCache;
+  const telemetryState = yield* LegacyTelemetryState;
+
+  // Telemetry flushes on every invocation, including validation failures — matches Go's
+  // PersistentPostRun semantics. The linked-project cache write happens only after the ref
+  // has been resolved (it requires `ref` as input), so it wraps the inner sub-effect.
+  yield* Effect.gen(function* () {
+    if (flags.enableDbSslEnforcement && flags.disableDbSslEnforcement) {
+      return yield* new LegacySslEnforcementMutuallyExclusiveFlagsError();
+    }
+    if (!flags.enableDbSslEnforcement && !flags.disableDbSslEnforcement) {
+      return yield* new LegacySslEnforcementNoEnableDisableFlagError();
+    }
+
+    const ref = yield* resolver.resolve(flags.projectRef);
+
+    yield* Effect.gen(function* () {
+      const updating =
+        output.format === "text"
+          ? yield* output.task("Updating SSL enforcement config...")
+          : undefined;
+      // Go only sends the `enforceDbSsl` boolean (`update.go:16`); `--disable-db-ssl-enforcement`
+      // is the user-facing way to send `database: false`.
+      const response = yield* api.v1
+        .updateSslEnforcementConfig({
+          ref,
+          requestedConfig: { database: flags.enableDbSslEnforcement },
+        })
+        .pipe(
+          Effect.tapError(() => updating?.fail() ?? Effect.void),
+          Effect.catch(mapUpdateError),
+        );
+      yield* updating?.clear() ?? Effect.void;
+
+      const goFmt = Option.getOrUndefined(goOutputFlag);
+
+      if (goFmt === "json") {
+        yield* output.raw(encodeGoJson(response));
+        return;
+      }
+      if (goFmt === "yaml") {
+        yield* output.raw(encodeYaml(response));
+        return;
+      }
+      if (goFmt === "toml") {
+        yield* output.raw(encodeToml(response) + "\n");
+        return;
+      }
+      if (goFmt === "env") {
+        yield* output.raw(encodeEnv(response) + "\n");
+        return;
+      }
+
+      if (output.format === "json" || output.format === "stream-json") {
+        yield* output.success("", response);
+        return;
+      }
+
+      yield* output.raw(printSslStatus(response));
+    }).pipe(Effect.ensuring(linkedProjectCache.cache(ref)));
+  }).pipe(Effect.ensuring(telemetryState.flush));
 });
diff --git a/apps/cli/src/legacy/commands/ssl-enforcement/update/update.integration.test.ts b/apps/cli/src/legacy/commands/ssl-enforcement/update/update.integration.test.ts
new file mode 100644
index 0000000000..e5aa6b4f32
--- /dev/null
+++ b/apps/cli/src/legacy/commands/ssl-enforcement/update/update.integration.test.ts
@@ -0,0 +1,527 @@
+import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+
+import { type V1GetSslEnforcementConfigOutput } from "@supabase/api/effect";
+import { describe, expect, it } from "@effect/vitest";
+import { Effect, Exit, Option } from "effect";
+
+import { withJsonErrorHandling } from "../../../../shared/output/json-error-handling.ts";
+import { mockOutput } from "../../../../../tests/helpers/mocks.ts";
+import {
+  LEGACY_VALID_REF,
+  buildLegacyTestRuntime,
+  mockLegacyCliConfig,
+  mockLegacyLinkedProjectCacheTracked,
+  mockLegacyPlatformApi,
+  mockLegacyTelemetryStateTracked,
+  useLegacyTempWorkdir,
+} from "../../../../../tests/helpers/legacy-mocks.ts";
+import { legacySslEnforcementUpdate } from "./update.handler.ts";
+
+// ---------------------------------------------------------------------------
+// Fixtures
+// ---------------------------------------------------------------------------
+
+const SSL_ENFORCED: typeof V1GetSslEnforcementConfigOutput.Type = {
+  currentConfig: { database: true },
+  appliedSuccessfully: true,
+};
+
+const SSL_NOT_ENFORCED: typeof V1GetSslEnforcementConfigOutput.Type = {
+  currentConfig: { database: false },
+  appliedSuccessfully: false,
+};
+
+const SSL_DESIRED_BUT_NOT_APPLIED: typeof V1GetSslEnforcementConfigOutput.Type = {
+  currentConfig: { database: true },
+  appliedSuccessfully: false,
+};
+
+// ---------------------------------------------------------------------------
+// Setup
+// ---------------------------------------------------------------------------
+
+interface SetupOpts {
+  format?: "text" | "json" | "stream-json";
+  goOutput?: "env" | "pretty" | "json" | "toml" | "yaml";
+  response?: typeof V1GetSslEnforcementConfigOutput.Type;
+  status?: number;
+  network?: "fail";
+}
+
+const tempRoot = useLegacyTempWorkdir("supabase-ssl-enforcement-update-int-");
+
+function setup(opts: SetupOpts = {}) {
+  const out = mockOutput({ format: opts.format ?? "text" });
+  const api = mockLegacyPlatformApi({
+    response: { status: opts.status ?? 200, body: opts.response ?? SSL_ENFORCED },
+    network: opts.network,
+  });
+  const cliConfig = mockLegacyCliConfig({ workdir: tempRoot.current });
+  const layer = buildLegacyTestRuntime({
+    out,
+    api,
+    cliConfig,
+    goOutput: opts.goOutput === undefined ? Option.none() : Option.some(opts.goOutput),
+  });
+  return { layer, out, api };
+}
+
+function setupTracked(opts: SetupOpts = {}) {
+  const out = mockOutput({ format: opts.format ?? "text" });
+  const api = mockLegacyPlatformApi({
+    response: { status: opts.status ?? 200, body: opts.response ?? SSL_ENFORCED },
+    network: opts.network,
+  });
+  const cliConfig = mockLegacyCliConfig({ workdir: tempRoot.current });
+  const telemetry = mockLegacyTelemetryStateTracked();
+  const cache = mockLegacyLinkedProjectCacheTracked();
+  const layer = buildLegacyTestRuntime({
+    out,
+    api,
+    cliConfig,
+    telemetry: telemetry.layer,
+    linkedProjectCache: cache.layer,
+  });
+  return { layer, out, api, telemetry, cache };
+}
+
+// ---------------------------------------------------------------------------
+// Tests
+// ---------------------------------------------------------------------------
+
+describe("legacy ssl-enforcement update integration", () => {
+  // -------------------------------------------------------------------------
+  // Flag validation
+  // -------------------------------------------------------------------------
+
+  it.live(
+    "fails with LegacySslEnforcementNoEnableDisableFlagError when neither flag is set",
+    () => {
+      const { layer } = setup();
+      return Effect.gen(function* () {
+        const exit = yield* Effect.exit(
+          legacySslEnforcementUpdate({
+            projectRef: Option.none(),
+            enableDbSslEnforcement: false,
+            disableDbSslEnforcement: false,
+          }),
+        );
+        expect(Exit.isFailure(exit)).toBe(true);
+        if (Exit.isFailure(exit)) {
+          const errorJson = JSON.stringify(exit.cause);
+          expect(errorJson).toContain("LegacySslEnforcementNoEnableDisableFlagError");
+          expect(errorJson).toContain("enable/disable not specified");
+        }
+      }).pipe(Effect.provide(layer));
+    },
+  );
+
+  it.live(
+    "fails with LegacySslEnforcementMutuallyExclusiveFlagsError when both flags are set",
+    () => {
+      const { layer } = setup();
+      return Effect.gen(function* () {
+        const exit = yield* Effect.exit(
+          legacySslEnforcementUpdate({
+            projectRef: Option.none(),
+            enableDbSslEnforcement: true,
+            disableDbSslEnforcement: true,
+          }),
+        );
+        expect(Exit.isFailure(exit)).toBe(true);
+        if (Exit.isFailure(exit)) {
+          const errorJson = JSON.stringify(exit.cause);
+          expect(errorJson).toContain("LegacySslEnforcementMutuallyExclusiveFlagsError");
+          expect(errorJson).toContain(
+            "if any flags in the group [enable-db-ssl-enforcement disable-db-ssl-enforcement] are set",
+          );
+        }
+      }).pipe(Effect.provide(layer));
+    },
+  );
+
+  it.live("does not call the API when flag validation fails", () => {
+    const { layer, api } = setup();
+    return Effect.gen(function* () {
+      yield* Effect.exit(
+        legacySslEnforcementUpdate({
+          projectRef: Option.none(),
+          enableDbSslEnforcement: false,
+          disableDbSslEnforcement: false,
+        }),
+      );
+      expect(api.requests).toHaveLength(0);
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("writes telemetry but NOT linked-project cache when validation fails", () => {
+    const { layer, telemetry, cache } = setupTracked();
+    return Effect.gen(function* () {
+      yield* Effect.exit(
+        legacySslEnforcementUpdate({
+          projectRef: Option.none(),
+          enableDbSslEnforcement: false,
+          disableDbSslEnforcement: false,
+        }),
+      );
+      expect(telemetry.flushed).toBe(true);
+      expect(cache.cached).toBe(false);
+    }).pipe(Effect.provide(layer));
+  });
+
+  // -------------------------------------------------------------------------
+  // Request body
+  // -------------------------------------------------------------------------
+
+  it.live("sends requestedConfig.database = true when --enable-db-ssl-enforcement is set", () => {
+    const { layer, api } = setup({ response: SSL_ENFORCED });
+    return Effect.gen(function* () {
+      yield* legacySslEnforcementUpdate({
+        projectRef: Option.none(),
+        enableDbSslEnforcement: true,
+        disableDbSslEnforcement: false,
+      });
+      expect(api.requests).toHaveLength(1);
+      expect(api.requests[0]?.body).toMatchObject({
+        requestedConfig: { database: true },
+      });
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("sends requestedConfig.database = false when --disable-db-ssl-enforcement is set", () => {
+    const { layer, api } = setup({ response: SSL_NOT_ENFORCED });
+    return Effect.gen(function* () {
+      yield* legacySslEnforcementUpdate({
+        projectRef: Option.none(),
+        enableDbSslEnforcement: false,
+        disableDbSslEnforcement: true,
+      });
+      expect(api.requests).toHaveLength(1);
+      expect(api.requests[0]?.body).toMatchObject({
+        requestedConfig: { database: false },
+      });
+    }).pipe(Effect.provide(layer));
+  });
+
+  // -------------------------------------------------------------------------
+  // Text output modes (mirroring get scenarios with enable flag)
+  // -------------------------------------------------------------------------
+
+  it.live('prints "SSL is being enforced." when database=true and appliedSuccessfully=true', () => {
+    const { layer, out } = setup({ response: SSL_ENFORCED });
+    return Effect.gen(function* () {
+      yield* legacySslEnforcementUpdate({
+        projectRef: Option.none(),
+        enableDbSslEnforcement: true,
+        disableDbSslEnforcement: false,
+      });
+      expect(out.stdoutText).toBe("SSL is being enforced.\n");
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live('prints "SSL is *NOT* being enforced." when database=false', () => {
+    const { layer, out } = setup({ response: SSL_NOT_ENFORCED });
+    return Effect.gen(function* () {
+      yield* legacySslEnforcementUpdate({
+        projectRef: Option.none(),
+        enableDbSslEnforcement: false,
+        disableDbSslEnforcement: true,
+      });
+      expect(out.stdoutText).toBe("SSL is *NOT* being enforced.\n");
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live(
+    'prints "SSL is *NOT* being enforced." when database=true but appliedSuccessfully=false',
+    () => {
+      const { layer, out } = setup({ response: SSL_DESIRED_BUT_NOT_APPLIED });
+      return Effect.gen(function* () {
+        yield* legacySslEnforcementUpdate({
+          projectRef: Option.none(),
+          enableDbSslEnforcement: true,
+          disableDbSslEnforcement: false,
+        });
+        expect(out.stdoutText).toBe("SSL is *NOT* being enforced.\n");
+      }).pipe(Effect.provide(layer));
+    },
+  );
+
+  // -------------------------------------------------------------------------
+  // Go output encoders
+  // -------------------------------------------------------------------------
+
+  it.live("emits Go-compatible env output for --output env (exact bytes)", () => {
+    const { layer, out } = setup({ goOutput: "env", response: SSL_ENFORCED });
+    return Effect.gen(function* () {
+      yield* legacySslEnforcementUpdate({
+        projectRef: Option.none(),
+        enableDbSslEnforcement: true,
+        disableDbSslEnforcement: false,
+      });
+      expect(out.stdoutText).toBe('APPLIEDSUCCESSFULLY="true"\nCURRENTCONFIG_DATABASE="true"\n');
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("emits Go-compatible indented JSON for --output json (exact bytes)", () => {
+    const { layer, out } = setup({ goOutput: "json", response: SSL_ENFORCED });
+    return Effect.gen(function* () {
+      yield* legacySslEnforcementUpdate({
+        projectRef: Option.none(),
+        enableDbSslEnforcement: true,
+        disableDbSslEnforcement: false,
+      });
+      expect(out.stdoutText).toBe(
+        `{
+  "appliedSuccessfully": true,
+  "currentConfig": {
+    "database": true
+  }
+}
+`,
+      );
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("emits YAML for --output yaml", () => {
+    const { layer, out } = setup({ goOutput: "yaml", response: SSL_ENFORCED });
+    return Effect.gen(function* () {
+      yield* legacySslEnforcementUpdate({
+        projectRef: Option.none(),
+        enableDbSslEnforcement: true,
+        disableDbSslEnforcement: false,
+      });
+      expect(out.stdoutText).toContain("appliedSuccessfully: true");
+      expect(out.stdoutText).toContain("database: true");
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("emits TOML for --output toml", () => {
+    const { layer, out } = setup({ goOutput: "toml", response: SSL_ENFORCED });
+    return Effect.gen(function* () {
+      yield* legacySslEnforcementUpdate({
+        projectRef: Option.none(),
+        enableDbSslEnforcement: true,
+        disableDbSslEnforcement: false,
+      });
+      expect(out.stdoutText).toContain("appliedSuccessfully = true");
+      expect(out.stdoutText).toContain("[currentConfig]");
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("treats --output pretty as identical to text mode", () => {
+    const { layer, out } = setup({ goOutput: "pretty", response: SSL_ENFORCED });
+    return Effect.gen(function* () {
+      yield* legacySslEnforcementUpdate({
+        projectRef: Option.none(),
+        enableDbSslEnforcement: true,
+        disableDbSslEnforcement: false,
+      });
+      expect(out.stdoutText).toBe("SSL is being enforced.\n");
+    }).pipe(Effect.provide(layer));
+  });
+
+  // -------------------------------------------------------------------------
+  // TS output-format modes
+  // -------------------------------------------------------------------------
+
+  it.live("emits a JSON success event when --output-format=json", () => {
+    const { layer, out } = setup({ format: "json", response: SSL_ENFORCED });
+    return Effect.gen(function* () {
+      yield* legacySslEnforcementUpdate({
+        projectRef: Option.none(),
+        enableDbSslEnforcement: true,
+        disableDbSslEnforcement: false,
+      });
+      const success = out.messages.find((m) => m.type === "success");
+      expect(success).toBeDefined();
+      expect(success?.data).toMatchObject({
+        currentConfig: { database: true },
+        appliedSuccessfully: true,
+      });
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("emits a result event for --output-format=stream-json", () => {
+    const { layer, out } = setup({ format: "stream-json", response: SSL_ENFORCED });
+    return Effect.gen(function* () {
+      yield* legacySslEnforcementUpdate({
+        projectRef: Option.none(),
+        enableDbSslEnforcement: true,
+        disableDbSslEnforcement: false,
+      });
+      const success = out.messages.find((m) => m.type === "success");
+      expect(success).toBeDefined();
+      expect(success?.data).toMatchObject({ currentConfig: { database: true } });
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("--output (Go) wins over --output-format (TS) when both provided", () => {
+    const { layer, out } = setup({ format: "json", goOutput: "yaml", response: SSL_ENFORCED });
+    return Effect.gen(function* () {
+      yield* legacySslEnforcementUpdate({
+        projectRef: Option.none(),
+        enableDbSslEnforcement: true,
+        disableDbSslEnforcement: false,
+      });
+      expect(out.stdoutText).toContain("appliedSuccessfully: true");
+      expect(out.stdoutText.startsWith("{")).toBe(false);
+    }).pipe(Effect.provide(layer));
+  });
+
+  // -------------------------------------------------------------------------
+  // Project ref resolution
+  // -------------------------------------------------------------------------
+
+  it.live("passes the resolved project ref into the updateSslEnforcementConfig URL", () => {
+    const { layer, api } = setup({ response: SSL_ENFORCED });
+    return Effect.gen(function* () {
+      yield* legacySslEnforcementUpdate({
+        projectRef: Option.none(),
+        enableDbSslEnforcement: true,
+        disableDbSslEnforcement: false,
+      });
+      expect(api.requests).toHaveLength(1);
+      expect(api.requests[0]?.url).toContain(`/v1/projects/${LEGACY_VALID_REF}/ssl-enforcement`);
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("uses --project-ref flag value over LegacyCliConfig.projectId", () => {
+    const flagRef = "zzzzzzzzzzzzzzzzzzzz";
+    const { layer, api } = setup({ response: SSL_ENFORCED });
+    return Effect.gen(function* () {
+      yield* legacySslEnforcementUpdate({
+        projectRef: Option.some(flagRef),
+        enableDbSslEnforcement: true,
+        disableDbSslEnforcement: false,
+      });
+      expect(api.requests[0]?.url).toContain(`/v1/projects/${flagRef}/`);
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("reads supabase/.temp/project-ref when env and flag are unset", () => {
+    const localTempRoot = mkdtempSync(join(tmpdir(), "supabase-ssl-update-int-fileref-"));
+    const fileRef = "filerefabcdefghijklm";
+    mkdirSync(join(localTempRoot, "supabase", ".temp"), { recursive: true });
+    writeFileSync(join(localTempRoot, "supabase", ".temp", "project-ref"), fileRef);
+
+    const out = mockOutput({ format: "text" });
+    const api = mockLegacyPlatformApi({ response: { status: 200, body: SSL_ENFORCED } });
+    const cliConfig = mockLegacyCliConfig({
+      workdir: localTempRoot,
+      projectId: Option.none(),
+    });
+    const layer = buildLegacyTestRuntime({ out, api, cliConfig });
+
+    return Effect.gen(function* () {
+      yield* legacySslEnforcementUpdate({
+        projectRef: Option.none(),
+        enableDbSslEnforcement: true,
+        disableDbSslEnforcement: false,
+      });
+      expect(api.requests[0]?.url).toContain(`/v1/projects/${fileRef}/`);
+    }).pipe(
+      Effect.provide(layer),
+      Effect.ensuring(Effect.sync(() => rmSync(localTempRoot, { recursive: true, force: true }))),
+    );
+  });
+
+  it.live("fails with LegacyProjectNotLinkedError when no ref source matches off-TTY", () => {
+    const localTempRoot = mkdtempSync(join(tmpdir(), "supabase-ssl-update-int-no-ref-"));
+    const out = mockOutput({ format: "text" });
+    const api = mockLegacyPlatformApi({ response: { status: 200, body: SSL_ENFORCED } });
+    const cliConfig = mockLegacyCliConfig({
+      workdir: localTempRoot,
+      projectId: Option.none(),
+    });
+    const layer = buildLegacyTestRuntime({ out, api, cliConfig });
+
+    return Effect.gen(function* () {
+      const exit = yield* Effect.exit(
+        legacySslEnforcementUpdate({
+          projectRef: Option.none(),
+          enableDbSslEnforcement: true,
+          disableDbSslEnforcement: false,
+        }).pipe(Effect.provide(layer)),
+      );
+      expect(Exit.isFailure(exit)).toBe(true);
+      if (Exit.isFailure(exit)) {
+        expect(JSON.stringify(exit.cause)).toContain("LegacyProjectNotLinkedError");
+      }
+    }).pipe(
+      Effect.ensuring(Effect.sync(() => rmSync(localTempRoot, { recursive: true, force: true }))),
+    );
+  });
+
+  it.live("fails with LegacyInvalidProjectRefError when the resolved ref is malformed", () => {
+    const { layer } = setup({ response: SSL_ENFORCED });
+    return Effect.gen(function* () {
+      const exit = yield* Effect.exit(
+        legacySslEnforcementUpdate({
+          projectRef: Option.some("BADREF"),
+          enableDbSslEnforcement: true,
+          disableDbSslEnforcement: false,
+        }),
+      );
+      expect(Exit.isFailure(exit)).toBe(true);
+      if (Exit.isFailure(exit)) {
+        expect(JSON.stringify(exit.cause)).toContain("LegacyInvalidProjectRefError");
+      }
+    }).pipe(Effect.provide(layer));
+  });
+
+  // -------------------------------------------------------------------------
+  // Error cases
+  // -------------------------------------------------------------------------
+
+  it.live("fails with LegacySslEnforcementUpdateUnexpectedStatusError on HTTP 503", () => {
+    const { layer } = setup({ status: 503, response: SSL_ENFORCED });
+    return Effect.gen(function* () {
+      const exit = yield* Effect.exit(
+        legacySslEnforcementUpdate({
+          projectRef: Option.none(),
+          enableDbSslEnforcement: true,
+          disableDbSslEnforcement: false,
+        }),
+      );
+      expect(Exit.isFailure(exit)).toBe(true);
+      if (Exit.isFailure(exit)) {
+        const errorJson = JSON.stringify(exit.cause);
+        expect(errorJson).toContain("LegacySslEnforcementUpdateUnexpectedStatusError");
+        expect(errorJson).toContain("unexpected update SSL status 503");
+      }
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("fails with LegacySslEnforcementUpdateNetworkError on transport failure", () => {
+    const { layer } = setup({ network: "fail" });
+    return Effect.gen(function* () {
+      const exit = yield* Effect.exit(
+        legacySslEnforcementUpdate({
+          projectRef: Option.none(),
+          enableDbSslEnforcement: true,
+          disableDbSslEnforcement: false,
+        }),
+      );
+      expect(Exit.isFailure(exit)).toBe(true);
+      if (Exit.isFailure(exit)) {
+        const errorJson = JSON.stringify(exit.cause);
+        expect(errorJson).toContain("LegacySslEnforcementUpdateNetworkError");
+        expect(errorJson).toContain("failed to update ssl enforcement");
+      }
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("emits a fail event when withJsonErrorHandling wraps a JSON-mode error", () => {
+    const { layer, out } = setup({ format: "json", status: 503, response: SSL_ENFORCED });
+    return Effect.gen(function* () {
+      yield* legacySslEnforcementUpdate({
+        projectRef: Option.none(),
+        enableDbSslEnforcement: true,
+        disableDbSslEnforcement: false,
+      }).pipe(withJsonErrorHandling);
+      expect(out.messages.some((m) => m.type === "fail")).toBe(true);
+    }).pipe(Effect.provide(layer));
+  });
+});
diff --git a/apps/cli/src/legacy/commands/sso/add/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/sso/add/SIDE_EFFECTS.md
index c39e576dfa..350a2d34c9 100644
--- a/apps/cli/src/legacy/commands/sso/add/SIDE_EFFECTS.md
+++ b/apps/cli/src/legacy/commands/sso/add/SIDE_EFFECTS.md
@@ -2,44 +2,84 @@
 
 ## Files Read
 
-| Path                       | Format                    | When                                                       |
-| -------------------------- | ------------------------- | ---------------------------------------------------------- |
-| `~/.supabase/access-token` | plain text (token string) | when `SUPABASE_ACCESS_TOKEN` unset and keyring unavailable |
-| `<metadata-file>`          | XML                       | when `--metadata-file` flag is provided                    |
-| `<attribute-mapping-file>` | JSON                      | when `--attribute-mapping-file` flag is provided           |
+| Path                                           | Format                    | When                                                                                          |
+| ---------------------------------------------- | ------------------------- | --------------------------------------------------------------------------------------------- |
+| keyring `"Supabase CLI"` / `<profile>`         | OS keychain               | when `SUPABASE_ACCESS_TOKEN` unset and keyring available; account = `LegacyCliConfig.profile` |
+| keyring `"Supabase CLI"` / `access-token`      | OS keychain               | legacy-key fallback when the profile-keyed lookup misses                                      |
+| `~/.supabase/access-token`                     | plain text (token string) | last-resort fallback after env + keyring miss                                                 |
+| `<workdir>/supabase/.temp/linked-project.json` | JSON                      | always — `linkedProjectCache` reads to decide whether to write                                |
+| `<metadata-file>`                              | XML (UTF-8)               | when `--metadata-file` is provided                                                            |
+| `<attribute-mapping-file>`                     | JSON                      | when `--attribute-mapping-file` is provided                                                   |
 
 ## Files Written
 
-| Path | Format | When |
-| ---- | ------ | ---- |
-| —    | —      | —    |
+| Path                                           | Format | When                                                                |
+| ---------------------------------------------- | ------ | ------------------------------------------------------------------- |
+| `~/.supabase/telemetry.json`                   | JSON   | always (`Effect.ensuring(telemetryState.flush)`)                    |
+| `<workdir>/supabase/.temp/linked-project.json` | JSON   | best-effort after `--project-ref` resolves (Go `PersistentPostRun`) |
 
 ## API Routes
 
-| Method | Path                                           | Auth         | Request body                                                                     | Response (used fields)                        |
-| ------ | ---------------------------------------------- | ------------ | -------------------------------------------------------------------------------- | --------------------------------------------- |
-| `POST` | `/v1/projects/{ref}/config/auth/sso/providers` | Bearer token | `{type, metadata_url, metadata_xml, domains, attribute_mapping, name_id_format}` | `{id, saml, domains, created_at, updated_at}` |
+| Method | Path                                           | Auth         | Request body                                                                          | Response (used fields)                                             |
+| ------ | ---------------------------------------------- | ------------ | ------------------------------------------------------------------------------------- | ------------------------------------------------------------------ |
+| `POST` | `/v1/projects/{ref}/config/auth/sso/providers` | Bearer token | `{type, metadata_xml?, metadata_url?, domains?, attribute_mapping?, name_id_format?}` | `{id, saml?, domains?, created_at?, updated_at?}` (parsed loosely) |
+| `GET`  | `<metadata-url>`                               | none         | `Accept: application/xml`, 10s timeout                                                | XML body (UTF-8) — validation when `--skip-url-validation` not set |
+| `GET`  | `/v1/projects/{ref}`                           | Bearer token | none                                                                                  | `{organization_slug}` — upgrade-gate side-call on 4xx              |
+| `GET`  | `/v1/organizations/{slug}/entitlements`        | Bearer token | none                                                                                  | `{entitlements[].feature.key, .hasAccess}` — upgrade-gate          |
+
+Bypasses the typed Management API client for the POST so user-supplied keys inside
+`attribute_mapping.keys.<x>` (e.g. `default`) are preserved verbatim — Go encodes the
+same shape via an inline anonymous struct with `Default *any`.
 
 ## Environment Variables
 
 | Variable                | Purpose                                              | Required?                                               |
 | ----------------------- | ---------------------------------------------------- | ------------------------------------------------------- |
 | `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `~/.supabase/access-token`) |
-| `SUPABASE_API_URL`      | override Management API base URL                     | no (defaults to `https://api.supabase.com`)             |
+| `SUPABASE_PROFILE`      | profile selector (built-in name or YAML file path)   | no (defaults to `supabase`)                             |
 
 ## Exit Codes
 
-| Code | Condition                                            |
-| ---- | ---------------------------------------------------- |
-| `0`  | success — provider created and details printed       |
-| `1`  | authentication error — no valid token found          |
-| `1`  | API error — non-2xx response from providers endpoint |
-| `1`  | validation error — invalid metadata URL or XML       |
-| `1`  | network / connection failure                         |
+| Code | Condition                                                                                                            |
+| ---- | -------------------------------------------------------------------------------------------------------------------- |
+| `0`  | success                                                                                                              |
+| `1`  | `LegacySsoMutexFlagError` — `--metadata-file` and `--metadata-url` both set                                          |
+| `1`  | `LegacySsoAddMetadataFileError` — metadata file unreadable, non-UTF-8, or metadata URL invalid/unreachable/non-UTF-8 |
+| `1`  | `LegacySsoAddAttributeMappingFileError` — JSON file unreadable or malformed                                          |
+| `1`  | `LegacySsoAddSamlDisabledError` — 404 from POST                                                                      |
+| `1`  | `LegacySsoAddUnexpectedStatusError` — other non-2xx                                                                  |
+| `1`  | `LegacySsoAddNetworkError` — transport-level failure                                                                 |
+
+## Telemetry Events Fired
+
+| Event                   | When                                                 | Notable properties                                                     |
+| ----------------------- | ---------------------------------------------------- | ---------------------------------------------------------------------- |
+| `cli_command_executed`  | post-run, success or failure (via wrapper)           | `exit_code`, `duration_ms`, `flags` (`--project-ref` allowed verbatim) |
+| `cli_upgrade_suggested` | 4xx response **and** `auth.saml_2` entitlement gated | `feature_key: "auth.saml_2"`, `org_slug`                               |
+
+## Output
+
+### `--output-format text` / Go `--output pretty`
+
+Glamour-styled property/value markdown table plus optional `## Attribute Mapping` and `## SAML 2.0 Metadata XML` sections (heading + fenced code block).
+
+### `--output json` / `--output yaml` / `--output toml`
+
+Response verbatim (Go-compatible alphabetised keys for JSON).
+
+### `--output env`
+
+No output (matches Go's `create.go:94`).
+
+### `--output-format json` / `stream-json`
+
+Single `success` event with the parsed response as data.
 
 ## Notes
 
-- `--type saml` is required (currently the only supported type).
+- `--type saml` is **required** (Go's `MarkFlagRequired("type")`).
 - `--metadata-file` and `--metadata-url` are mutually exclusive.
-- `--skip-url-validation` skips local DNS/HTTP validation of the metadata URL before sending to the API.
-- Requires `--project-ref` or a linked project (`.supabase/config.json`).
+- `--skip-url-validation` skips the HTTPS-only + 10s GET + UTF-8 body validation against the metadata URL.
+- Metadata URL validation error message: `only HTTPS Metadata URLs are supported Use --skip-url-validation to suppress this error` (no trailing period — matches Go's `create.go:47`; differs from `sso update`'s variant).
+- The `## Attribute Mapping` / `## SAML 2.0 Metadata XML` sections are emitted as plain markdown (heading + fence). Visual styling of the headings does not match Go's Glamour-rendered output; the XML body inside the fence is byte-parity via `formatSsoMetadataXml`.
+- **Missing `--type` parser error**: the error message itself matches Go Cobra's `Error: required flag(s) "type" not set` verbatim (mapped in `shared/output/normalize-error.ts`). Effect CLI's parser however dumps the full help block to stdout _before_ the error, while Go Cobra shows usage only on explicit `--help`. The error string is parity; the surrounding help dump is an Effect CLI behavior that would require forking the CLI parser to suppress.
diff --git a/apps/cli/src/legacy/commands/sso/add/add.command.ts b/apps/cli/src/legacy/commands/sso/add/add.command.ts
index ebcf876392..190a6ed155 100644
--- a/apps/cli/src/legacy/commands/sso/add/add.command.ts
+++ b/apps/cli/src/legacy/commands/sso/add/add.command.ts
@@ -1,5 +1,9 @@
 import { Command, Flag } from "effect/unstable/cli";
 import type * as CliCommand from "effect/unstable/cli/Command";
+
+import { withJsonErrorHandling } from "../../../../shared/output/json-error-handling.ts";
+import { legacyManagementApiRuntimeLayer } from "../../../shared/legacy-management-api-runtime.layer.ts";
+import { withLegacyCommandInstrumentation } from "../../../telemetry/legacy-command-instrumentation.ts";
 import { legacySsoAdd } from "./add.handler.ts";
 
 const NAME_ID_FORMATS = [
@@ -14,10 +18,11 @@ const config = {
     Flag.withDescription("Project ref of the Supabase project."),
     Flag.optional,
   ),
+  // Required per Go's `MarkFlagRequired("type")` in `cmd/sso.go:65` — leave
+  // off `Flag.optional` so the CLI parser enforces presence at parse time.
   type: Flag.choice("type", ["saml"] as const).pipe(
     Flag.withAlias("t"),
     Flag.withDescription("Type of identity provider (according to supported protocol)."),
-    Flag.optional,
   ),
   domains: Flag.string("domains").pipe(
     Flag.atLeast(0),
@@ -40,7 +45,7 @@ const config = {
   ),
   skipUrlValidation: Flag.boolean("skip-url-validation").pipe(
     Flag.withDescription(
-      "Whether local validation of the SAML 2.0 Metadata URL should not be performed.",
+      "Skip local validation of the SAML 2.0 Metadata URL (HTTPS requirement, live GET probe, and UTF-8 body decode). Use in air-gapped CI where the IDP is not reachable from the build agent.",
     ),
   ),
   attributeMappingFile: Flag.string("attribute-mapping-file").pipe(
@@ -70,5 +75,11 @@ export const legacySsoAddCommand = Command.make("add", config).pipe(
       description: "Add a new SAML SSO provider",
     },
   ]),
-  Command.withHandler((flags) => legacySsoAdd(flags)),
+  Command.withHandler((flags) =>
+    legacySsoAdd(flags).pipe(
+      withLegacyCommandInstrumentation({ flags, safeFlags: ["project-ref"] }),
+      withJsonErrorHandling,
+    ),
+  ),
+  Command.provide(legacyManagementApiRuntimeLayer(["sso", "add"])),
 );
diff --git a/apps/cli/src/legacy/commands/sso/add/add.handler.ts b/apps/cli/src/legacy/commands/sso/add/add.handler.ts
index 523ff68bf6..e1951e7b6c 100644
--- a/apps/cli/src/legacy/commands/sso/add/add.handler.ts
+++ b/apps/cli/src/legacy/commands/sso/add/add.handler.ts
@@ -1,18 +1,195 @@
 import { Effect, Option } from "effect";
-import { LegacyGoProxy } from "../../../../shared/legacy/go-proxy.service.ts";
+import * as HttpClient from "effect/unstable/http/HttpClient";
+import * as HttpClientRequest from "effect/unstable/http/HttpClientRequest";
+
+import { LegacyCliConfig } from "../../../config/legacy-cli-config.service.ts";
+import { LegacyProjectRefResolver } from "../../../config/legacy-project-ref.service.ts";
+import { LegacyOutputFlag } from "../../../../shared/legacy/global-flags.ts";
+import { Output } from "../../../../shared/output/output.service.ts";
+import {
+  encodeGoJson,
+  encodeGoStructJsonBody,
+  encodeToml,
+  encodeYaml,
+} from "../../../shared/legacy-go-output.encoders.ts";
+import { sanitizeLegacyErrorBody } from "../../../shared/legacy-http-errors.ts";
+import { resolveLegacyAccessToken } from "../../../shared/legacy-resolve-token.ts";
+import { LegacyLinkedProjectCache } from "../../../telemetry/legacy-linked-project-cache.service.ts";
+import { LegacyTelemetryState } from "../../../telemetry/legacy-telemetry-state.service.ts";
+import { legacySuggestUpgrade } from "../../../shared/legacy-upgrade-suggest.ts";
+import {
+  LegacySsoAddAttributeMappingFileError,
+  LegacySsoAddMetadataFileError,
+  LegacySsoAddNetworkError,
+  LegacySsoAddSamlDisabledError,
+  LegacySsoAddUnexpectedStatusError,
+  LegacySsoMutexFlagError,
+} from "../sso.errors.ts";
+import { renderSingleProvider, toLegacySsoProviderView } from "../sso.format.ts";
+import { validateMetadataUrl } from "../sso.metadata-url.ts";
+import { readAttributeMappingFile, readMetadataFile } from "../sso.saml.ts";
 import type { LegacySsoAddFlags } from "./add.command.ts";
 
+const SAML_DISABLED_MESSAGE =
+  "SAML 2.0 support is not enabled for this project. Please enable it through the dashboard";
+
+const readMetadata = readMetadataFile({
+  openError: (args) => new LegacySsoAddMetadataFileError(args),
+  nonUtf8Error: (args) => new LegacySsoAddMetadataFileError({ message: args.message }),
+});
+
+const readAttributeMapping = readAttributeMappingFile({
+  openError: (args) => new LegacySsoAddAttributeMappingFileError(args),
+});
+
 export const legacySsoAdd = Effect.fn("legacy.sso.add")(function* (flags: LegacySsoAddFlags) {
-  const proxy = yield* LegacyGoProxy;
-  const args: string[] = ["sso", "add"];
-  if (Option.isSome(flags.projectRef)) args.push("--project-ref", flags.projectRef.value);
-  if (Option.isSome(flags.type)) args.push("--type", flags.type.value);
-  for (const domain of flags.domains) args.push("--domains", domain);
-  if (Option.isSome(flags.metadataFile)) args.push("--metadata-file", flags.metadataFile.value);
-  if (Option.isSome(flags.metadataUrl)) args.push("--metadata-url", flags.metadataUrl.value);
-  if (flags.skipUrlValidation) args.push("--skip-url-validation");
-  if (Option.isSome(flags.attributeMappingFile))
-    args.push("--attribute-mapping-file", flags.attributeMappingFile.value);
-  if (Option.isSome(flags.nameIdFormat)) args.push("--name-id-format", flags.nameIdFormat.value);
-  yield* proxy.exec(args);
+  const output = yield* Output;
+  const goOutputFlag = yield* LegacyOutputFlag;
+  const httpClient = yield* HttpClient.HttpClient;
+  const cliConfig = yield* LegacyCliConfig;
+  const resolver = yield* LegacyProjectRefResolver;
+  const linkedProjectCache = yield* LegacyLinkedProjectCache;
+  const telemetryState = yield* LegacyTelemetryState;
+
+  yield* Effect.gen(function* () {
+    if (Option.isSome(flags.metadataFile) && Option.isSome(flags.metadataUrl)) {
+      return yield* Effect.fail(
+        new LegacySsoMutexFlagError({
+          message: "only one of --metadata-file or --metadata-url may be set",
+        }),
+      );
+    }
+
+    const ref = yield* resolver.resolve(flags.projectRef);
+
+    yield* Effect.gen(function* () {
+      // Permissive request body. We POST as raw JSON to preserve any
+      // user-supplied keys inside `attribute_mapping.keys.<x>` (notably the
+      // `default` field that Go encodes via an inline anonymous struct and
+      // that the generated `V1CreateASsoProviderInput` schema omits).
+      const body: Record<string, unknown> = {
+        type: flags.type,
+      };
+
+      if (Option.isSome(flags.metadataFile)) {
+        const xml = yield* readMetadata(flags.metadataFile.value);
+        body["metadata_xml"] = xml;
+      } else if (Option.isSome(flags.metadataUrl)) {
+        if (!flags.skipUrlValidation) {
+          yield* validateMetadataUrl(flags.metadataUrl.value).pipe(
+            // Note: Go suffixes with no trailing period (matches `create.go:47`).
+            Effect.mapError(
+              (cause) =>
+                new LegacySsoAddMetadataFileError({
+                  message: `${cause.message} Use --skip-url-validation to suppress this error`,
+                }),
+            ),
+          );
+        }
+        body["metadata_url"] = flags.metadataUrl.value;
+      }
+
+      if (Option.isSome(flags.attributeMappingFile)) {
+        const mapping = yield* readAttributeMapping(flags.attributeMappingFile.value);
+        body["attribute_mapping"] = mapping;
+      }
+
+      if (flags.domains.length > 0) {
+        body["domains"] = [...flags.domains];
+      }
+
+      if (Option.isSome(flags.nameIdFormat)) {
+        body["name_id_format"] = flags.nameIdFormat.value;
+      }
+
+      const creating =
+        output.format === "text" ? yield* output.task("Adding SSO provider...") : undefined;
+
+      const tokenOpt = yield* resolveLegacyAccessToken;
+
+      // Use `HttpClientRequest.bearerToken(Redacted)` rather than unwrapping the
+      // redacted token into a plain string ourselves — this preserves the
+      // redaction marker on the Authorization header so that any future debug
+      // serialisation of the request stays opaque about the bearer token value.
+      const request = HttpClientRequest.post(
+        `${cliConfig.apiUrl}/v1/projects/${ref}/config/auth/sso/providers`,
+      ).pipe(
+        Option.isSome(tokenOpt) ? HttpClientRequest.bearerToken(tokenOpt.value) : (req) => req,
+        HttpClientRequest.setHeader("User-Agent", cliConfig.userAgent),
+        // Body keys serialised in Go-struct order (alphabetical) so the
+        // cli-e2e replay server's string-compare body match succeeds.
+        HttpClientRequest.bodyText(encodeGoStructJsonBody(body), "application/json"),
+      );
+
+      const response = yield* httpClient.execute(request).pipe(
+        Effect.tapError(() => creating?.fail() ?? Effect.void),
+        Effect.mapError(
+          (cause) =>
+            new LegacySsoAddNetworkError({
+              message: `failed to create sso provider: ${String(cause)}`,
+            }),
+        ),
+      );
+
+      if (response.status !== 201) {
+        const rawBody = yield* response.text.pipe(Effect.orElseSucceed(() => ""));
+        // Apply the same cap + control-character sanitisation the typed-client error
+        // mapper uses (`mapLegacyHttpError`) so error output stays bounded and
+        // shell-safe — the raw-HTTP path must not skip these defences.
+        const bodyText = sanitizeLegacyErrorBody(rawBody);
+        yield* legacySuggestUpgrade({
+          projectRef: ref,
+          featureKey: "auth.saml_2",
+          statusCode: response.status,
+        });
+        yield* creating?.fail() ?? Effect.void;
+        if (response.status === 404) {
+          return yield* Effect.fail(
+            new LegacySsoAddSamlDisabledError({ message: SAML_DISABLED_MESSAGE }),
+          );
+        }
+        return yield* Effect.fail(
+          new LegacySsoAddUnexpectedStatusError({
+            status: response.status,
+            body: bodyText,
+            message: `Unexpected error adding identity provider: ${bodyText}`,
+          }),
+        );
+      }
+
+      const parsedJson = yield* response.json.pipe(Effect.orElseSucceed((): unknown => ({})));
+      yield* creating?.clear() ?? Effect.void;
+
+      const goFmt = Option.getOrUndefined(goOutputFlag);
+
+      if (goFmt === "json") {
+        yield* output.raw(encodeGoJson(parsedJson));
+        return;
+      }
+      if (goFmt === "yaml") {
+        yield* output.raw(encodeYaml(parsedJson));
+        return;
+      }
+      if (goFmt === "toml") {
+        yield* output.raw(encodeToml(parsedJson) + "\n");
+        return;
+      }
+      if (goFmt === "env") {
+        // Go's `create.go:94-96` returns nil for env — emit nothing.
+        return;
+      }
+
+      if (output.format === "json" || output.format === "stream-json") {
+        yield* output.success(
+          "",
+          parsedJson !== null && typeof parsedJson === "object"
+            ? (parsedJson as Record<string, unknown>)
+            : { value: parsedJson },
+        );
+        return;
+      }
+
+      yield* output.raw(renderSingleProvider(toLegacySsoProviderView(parsedJson)));
+    }).pipe(Effect.ensuring(linkedProjectCache.cache(ref)));
+  }).pipe(Effect.ensuring(telemetryState.flush));
 });
diff --git a/apps/cli/src/legacy/commands/sso/add/add.integration.test.ts b/apps/cli/src/legacy/commands/sso/add/add.integration.test.ts
new file mode 100644
index 0000000000..5ee8f835cd
--- /dev/null
+++ b/apps/cli/src/legacy/commands/sso/add/add.integration.test.ts
@@ -0,0 +1,466 @@
+import { writeFileSync } from "node:fs";
+import { join } from "node:path";
+
+import { describe, expect, it } from "@effect/vitest";
+import { Effect, Exit, Option } from "effect";
+import * as HttpClientResponse from "effect/unstable/http/HttpClientResponse";
+
+import { mockAnalytics, mockOutput } from "../../../../../tests/helpers/mocks.ts";
+import {
+  buildLegacyTestRuntime,
+  LEGACY_VALID_REF,
+  mockLegacyCliConfig,
+  mockLegacyLinkedProjectCacheTracked,
+  mockLegacyPlatformApi,
+  mockLegacyTelemetryStateTracked,
+  useLegacyTempWorkdir,
+} from "../../../../../tests/helpers/legacy-mocks.ts";
+import { EventUpgradeSuggested } from "../../../../shared/telemetry/event-catalog.ts";
+import { legacySsoAdd } from "./add.handler.ts";
+
+const RESPONSE_PROVIDER = {
+  id: "b5ae62f9-ef1d-4f11-a02b-731c8bbb11e8",
+  saml: {
+    id: "saml-1",
+    entity_id: "https://example.com",
+    attribute_mapping: { keys: { a: { name: "xyz", default: 3 } } },
+  },
+  domains: [{ id: "d1", domain: "example.com" }],
+};
+
+const tempRoot = useLegacyTempWorkdir("supabase-sso-add-int-");
+
+interface SetupOpts {
+  format?: "text" | "json" | "stream-json";
+  goOutput?: "env" | "pretty" | "json" | "toml" | "yaml";
+  status?: number;
+  body?: unknown;
+  network?: "fail";
+  upgradeGate?: "gated" | "notGated";
+  // Metadata-URL fetch responses keyed by URL prefix.
+  metadataUrlResponse?: { status: number; body: string };
+}
+
+function jsonResponse(
+  request: Parameters<typeof HttpClientResponse.fromWeb>[0],
+  status: number,
+  body: unknown,
+) {
+  return HttpClientResponse.fromWeb(
+    request,
+    new Response(JSON.stringify(body), {
+      status,
+      headers: { "content-type": "application/json" },
+    }),
+  );
+}
+
+function textResponse(
+  request: Parameters<typeof HttpClientResponse.fromWeb>[0],
+  status: number,
+  body: string,
+) {
+  return HttpClientResponse.fromWeb(
+    request,
+    new Response(body, {
+      status,
+      headers: { "content-type": "application/xml" },
+    }),
+  );
+}
+
+function setup(opts: SetupOpts = {}) {
+  const out = mockOutput({ format: opts.format ?? "text" });
+  const analytics = mockAnalytics();
+  const telemetry = mockLegacyTelemetryStateTracked();
+  const cache = mockLegacyLinkedProjectCacheTracked();
+
+  const status = opts.status ?? 201;
+  const body = opts.body ?? RESPONSE_PROVIDER;
+  const gate = opts.upgradeGate;
+  const metadataUrlResponse = opts.metadataUrlResponse;
+
+  const api = mockLegacyPlatformApi({
+    network: opts.network,
+    handler: (request) => {
+      const url = request.url;
+      if (url.includes("/config/auth/sso/providers") && request.method === "POST") {
+        return Effect.succeed(jsonResponse(request, status, body));
+      }
+      if (metadataUrlResponse !== undefined && url.startsWith("https://idp.example.com")) {
+        return Effect.succeed(
+          textResponse(request, metadataUrlResponse.status, metadataUrlResponse.body),
+        );
+      }
+      if (url.endsWith(`/v1/projects/${LEGACY_VALID_REF}`)) {
+        if (gate === undefined) return Effect.succeed(jsonResponse(request, 404, {}));
+        return Effect.succeed(
+          jsonResponse(request, 200, {
+            id: LEGACY_VALID_REF,
+            ref: LEGACY_VALID_REF,
+            organization_id: "org-id",
+            organization_slug: "acme",
+            name: "Test",
+            region: "us-east-1",
+            created_at: "2023-01-01T00:00:00Z",
+            status: "ACTIVE_HEALTHY",
+            database: {
+              host: "db.example.com",
+              version: "15",
+              postgres_engine: "15",
+              release_channel: "ga",
+            },
+          }),
+        );
+      }
+      if (url.includes("/v1/organizations/acme/entitlements")) {
+        return Effect.succeed(
+          jsonResponse(request, 200, {
+            entitlements: [
+              {
+                feature: { key: "auth.saml_2", type: "boolean" },
+                hasAccess: gate === "notGated",
+                type: "boolean",
+                config: { enabled: false },
+              },
+            ],
+          }),
+        );
+      }
+      return Effect.succeed(jsonResponse(request, 404, {}));
+    },
+  });
+
+  const cliConfig = mockLegacyCliConfig({ workdir: tempRoot.current });
+  const layer = buildLegacyTestRuntime({
+    out,
+    api: { layer: api.layer, httpClientLayer: api.httpClientLayer },
+    cliConfig,
+    telemetry: telemetry.layer,
+    linkedProjectCache: cache.layer,
+    analytics,
+    goOutput: opts.goOutput === undefined ? Option.none() : Option.some(opts.goOutput),
+  });
+
+  return { layer, out, api, analytics, telemetry, cache };
+}
+
+const defaultFlags = {
+  projectRef: Option.none<string>(),
+  type: "saml" as const,
+  domains: [] as ReadonlyArray<string>,
+  metadataFile: Option.none<string>(),
+  metadataUrl: Option.none<string>(),
+  skipUrlValidation: false,
+  attributeMappingFile: Option.none<string>(),
+  nameIdFormat: Option.none<
+    | "urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"
+    | "urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified"
+    | "urn:oasis:names:tc:SAML:2.0:nameid-format:persistent"
+    | "urn:oasis:names:tc:SAML:2.0:nameid-format:transient"
+  >(),
+};
+
+describe("legacy sso add integration", () => {
+  it.live("POSTs to /v1/projects/{ref}/config/auth/sso/providers with type=saml", () => {
+    const { layer, api } = setup();
+    return Effect.gen(function* () {
+      yield* legacySsoAdd(defaultFlags);
+      const req = api.requests.find((r) => r.method === "POST");
+      expect(req).toBeDefined();
+      expect(req?.url).toContain(`/v1/projects/${LEGACY_VALID_REF}/config/auth/sso/providers`);
+      expect((req?.body as { type?: string })?.type).toBe("saml");
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("fails with mutex-flag error when both metadata flags set", () => {
+    const { layer } = setup();
+    return Effect.gen(function* () {
+      const exit = yield* Effect.exit(
+        legacySsoAdd({
+          ...defaultFlags,
+          metadataFile: Option.some("/tmp/missing.xml"),
+          metadataUrl: Option.some("https://idp.example.com/m"),
+        }),
+      );
+      expect(Exit.isFailure(exit)).toBe(true);
+      if (Exit.isFailure(exit)) {
+        expect(JSON.stringify(exit.cause)).toContain("LegacySsoMutexFlagError");
+      }
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("reads metadata file and sends as metadata_xml", () => {
+    const path = join(tempRoot.current, "good.xml");
+    writeFileSync(path, '<?xml version="1.0"?><md/>');
+    const { layer, api } = setup();
+    return Effect.gen(function* () {
+      yield* legacySsoAdd({ ...defaultFlags, metadataFile: Option.some(path) });
+      const req = api.requests.find((r) => r.method === "POST");
+      expect((req?.body as { metadata_xml?: string })?.metadata_xml).toContain("<md/>");
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("rejects non-UTF8 metadata file", () => {
+    const path = join(tempRoot.current, "bad.xml");
+    writeFileSync(path, Buffer.from([0xff, 0xfe, 0xfd]));
+    const { layer } = setup();
+    return Effect.gen(function* () {
+      const exit = yield* Effect.exit(
+        legacySsoAdd({ ...defaultFlags, metadataFile: Option.some(path) }),
+      );
+      expect(Exit.isFailure(exit)).toBe(true);
+      if (Exit.isFailure(exit)) {
+        expect(JSON.stringify(exit.cause)).toContain("LegacySsoAddMetadataFileError");
+      }
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("sends metadata_url verbatim when --skip-url-validation", () => {
+    const { layer, api } = setup();
+    return Effect.gen(function* () {
+      yield* legacySsoAdd({
+        ...defaultFlags,
+        metadataUrl: Option.some("https://idp.example.com/m"),
+        skipUrlValidation: true,
+      });
+      const req = api.requests.find((r) => r.method === "POST");
+      expect((req?.body as { metadata_url?: string })?.metadata_url).toBe(
+        "https://idp.example.com/m",
+      );
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("validates HTTPS metadata URL when not skipped — success path", () => {
+    const { layer, api } = setup({
+      metadataUrlResponse: { status: 200, body: '<?xml version="1.0"?><md/>' },
+    });
+    return Effect.gen(function* () {
+      yield* legacySsoAdd({
+        ...defaultFlags,
+        metadataUrl: Option.some("https://idp.example.com/m"),
+        skipUrlValidation: false,
+      });
+      const req = api.requests.find((r) => r.method === "POST");
+      expect((req?.body as { metadata_url?: string })?.metadata_url).toBe(
+        "https://idp.example.com/m",
+      );
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("rejects non-HTTPS metadata URL with Go-format message", () => {
+    const { layer } = setup();
+    return Effect.gen(function* () {
+      const exit = yield* Effect.exit(
+        legacySsoAdd({
+          ...defaultFlags,
+          metadataUrl: Option.some("http://idp.example.com/m"),
+          skipUrlValidation: false,
+        }),
+      );
+      expect(Exit.isFailure(exit)).toBe(true);
+      if (Exit.isFailure(exit)) {
+        const dump = JSON.stringify(exit.cause);
+        expect(dump).toContain("only HTTPS Metadata URLs are supported");
+        expect(dump).toContain("Use --skip-url-validation to suppress this error");
+      }
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("reads attribute mapping JSON and preserves user-defined `default` field", () => {
+    const path = join(tempRoot.current, "mapping.json");
+    writeFileSync(path, JSON.stringify({ keys: { a: { default: 3 } } }));
+    const { layer, api } = setup();
+    return Effect.gen(function* () {
+      yield* legacySsoAdd({ ...defaultFlags, attributeMappingFile: Option.some(path) });
+      const req = api.requests.find((r) => r.method === "POST");
+      const mapping = (req?.body as { attribute_mapping?: { keys: { a: { default: number } } } })
+        ?.attribute_mapping;
+      expect(mapping?.keys.a.default).toBe(3);
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("sends domains array verbatim", () => {
+    const { layer, api } = setup();
+    return Effect.gen(function* () {
+      yield* legacySsoAdd({ ...defaultFlags, domains: ["a.com", "b.com"] });
+      const req = api.requests.find((r) => r.method === "POST");
+      expect((req?.body as { domains?: string[] })?.domains).toEqual(["a.com", "b.com"]);
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("renders single-provider markdown in text mode", () => {
+    const { layer, out } = setup();
+    return Effect.gen(function* () {
+      yield* legacySsoAdd(defaultFlags);
+      expect(out.stdoutText).toContain("IDENTITY PROVIDER ID");
+      expect(out.stdoutText).toContain(RESPONSE_PROVIDER.id);
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("Go --output=env returns no output", () => {
+    const { layer, out } = setup({ goOutput: "env" });
+    return Effect.gen(function* () {
+      yield* legacySsoAdd(defaultFlags);
+      expect(out.stdoutText).toBe("");
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("Go --output=json encodes response verbatim", () => {
+    const { layer, out } = setup({ goOutput: "json" });
+    return Effect.gen(function* () {
+      yield* legacySsoAdd(defaultFlags);
+      expect(out.stdoutText).toContain(RESPONSE_PROVIDER.id);
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("TS --output-format=json emits success", () => {
+    const { layer, out } = setup({ format: "json" });
+    return Effect.gen(function* () {
+      yield* legacySsoAdd(defaultFlags);
+      expect(out.messages.some((m) => m.type === "success")).toBe(true);
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("reports SAML-disabled error on 404", () => {
+    const { layer } = setup({ status: 404, body: {} });
+    return Effect.gen(function* () {
+      const exit = yield* Effect.exit(legacySsoAdd(defaultFlags));
+      expect(Exit.isFailure(exit)).toBe(true);
+      if (Exit.isFailure(exit)) {
+        expect(JSON.stringify(exit.cause)).toContain("LegacySsoAddSamlDisabledError");
+      }
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("fires cli_upgrade_suggested on 404 when entitlement is gated", () => {
+    const { layer, analytics } = setup({ status: 404, body: {}, upgradeGate: "gated" });
+    return Effect.gen(function* () {
+      yield* Effect.exit(legacySsoAdd(defaultFlags));
+      expect(analytics.captured.some((c) => c.event === EventUpgradeSuggested)).toBe(true);
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("reports unexpected-status error on 500", () => {
+    const { layer } = setup({ status: 500, body: { error: "boom" } });
+    return Effect.gen(function* () {
+      const exit = yield* Effect.exit(legacySsoAdd(defaultFlags));
+      expect(Exit.isFailure(exit)).toBe(true);
+      if (Exit.isFailure(exit)) {
+        const dump = JSON.stringify(exit.cause);
+        expect(dump).toContain("LegacySsoAddUnexpectedStatusError");
+        expect(dump).toContain("Unexpected error adding identity provider");
+      }
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("flushes telemetry + linked-project cache on success and failure", () => {
+    const { layer, telemetry, cache } = setup({ status: 500, body: {} });
+    return Effect.gen(function* () {
+      yield* Effect.exit(legacySsoAdd(defaultFlags));
+      expect(telemetry.flushed).toBe(true);
+      expect(cache.cached).toBe(true);
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("Go --output=yaml encodes response verbatim", () => {
+    const { layer, out } = setup({ goOutput: "yaml" });
+    return Effect.gen(function* () {
+      yield* legacySsoAdd(defaultFlags);
+      expect(out.stdoutText).toContain(RESPONSE_PROVIDER.id);
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("Go --output=toml encodes response verbatim", () => {
+    const { layer, out } = setup({ goOutput: "toml" });
+    return Effect.gen(function* () {
+      yield* legacySsoAdd(defaultFlags);
+      expect(out.stdoutText).toContain(RESPONSE_PROVIDER.id);
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("preserves attribute_mapping `default` field in POST body", () => {
+    const path = join(tempRoot.current, "mapping.json");
+    writeFileSync(path, JSON.stringify({ keys: { a: { default: 42 } } }));
+    const { layer, api } = setup();
+    return Effect.gen(function* () {
+      yield* legacySsoAdd({ ...defaultFlags, attributeMappingFile: Option.some(path) });
+      const req = api.requests.find((r) => r.method === "POST");
+      const mapping = (req?.body as { attribute_mapping?: { keys: { a: { default: number } } } })
+        ?.attribute_mapping;
+      expect(mapping?.keys.a.default).toBe(42);
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("metadata URL fetch failure surfaces as add metadata file error", () => {
+    const { layer } = setup({ metadataUrlResponse: { status: 503, body: "<x/>" } });
+    return Effect.gen(function* () {
+      const exit = yield* Effect.exit(
+        legacySsoAdd({
+          ...defaultFlags,
+          metadataUrl: Option.some("https://idp.example.com/m"),
+          skipUrlValidation: false,
+        }),
+      );
+      expect(Exit.isFailure(exit)).toBe(true);
+      if (Exit.isFailure(exit)) {
+        const dump = JSON.stringify(exit.cause);
+        expect(dump).toContain("LegacySsoAddMetadataFileError");
+        // Per Go's `create.go:47`: error tail is `… Use --skip-url-validation to suppress this error`
+        // (no trailing period).
+        expect(dump).toContain("Use --skip-url-validation to suppress this error");
+      }
+    }).pipe(Effect.provide(layer));
+  });
+
+  // Non-UTF-8 body coverage lives in `sso.saml.unit.test.ts` — the test runtime
+  // here passes the response body through `Response`'s constructor which always
+  // emits valid UTF-8 bytes regardless of the input string, so a byte-level
+  // invalid sequence cannot be expressed without bypassing the Response API.
+
+  it.live("malformed metadata URL surfaces invalid URI error", () => {
+    const { layer } = setup();
+    return Effect.gen(function* () {
+      const exit = yield* Effect.exit(
+        legacySsoAdd({
+          ...defaultFlags,
+          metadataUrl: Option.some("::::not a url::::"),
+          skipUrlValidation: false,
+        }),
+      );
+      expect(Exit.isFailure(exit)).toBe(true);
+      if (Exit.isFailure(exit)) {
+        expect(JSON.stringify(exit.cause)).toContain("LegacySsoAddMetadataFileError");
+      }
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("nameIdFormat is forwarded in the request body when provided", () => {
+    const { layer, api } = setup();
+    return Effect.gen(function* () {
+      yield* legacySsoAdd({
+        ...defaultFlags,
+        nameIdFormat: Option.some("urn:oasis:names:tc:SAML:2.0:nameid-format:persistent"),
+      });
+      const req = api.requests.find((r) => r.method === "POST");
+      expect((req?.body as { name_id_format?: string })?.name_id_format).toBe(
+        "urn:oasis:names:tc:SAML:2.0:nameid-format:persistent",
+      );
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("attribute mapping parse failure surfaces a tagged error", () => {
+    const path = join(tempRoot.current, "malformed.json");
+    writeFileSync(path, "{not json}");
+    const { layer } = setup();
+    return Effect.gen(function* () {
+      const exit = yield* Effect.exit(
+        legacySsoAdd({ ...defaultFlags, attributeMappingFile: Option.some(path) }),
+      );
+      expect(Exit.isFailure(exit)).toBe(true);
+      if (Exit.isFailure(exit)) {
+        expect(JSON.stringify(exit.cause)).toContain("LegacySsoAddAttributeMappingFileError");
+      }
+    }).pipe(Effect.provide(layer));
+  });
+});
diff --git a/apps/cli/src/legacy/commands/sso/info/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/sso/info/SIDE_EFFECTS.md
index 8685ac785c..9f53e45af8 100644
--- a/apps/cli/src/legacy/commands/sso/info/SIDE_EFFECTS.md
+++ b/apps/cli/src/legacy/commands/sso/info/SIDE_EFFECTS.md
@@ -2,40 +2,67 @@
 
 ## Files Read
 
-| Path                       | Format                    | When                                                       |
-| -------------------------- | ------------------------- | ---------------------------------------------------------- |
-| `~/.supabase/access-token` | plain text (token string) | when `SUPABASE_ACCESS_TOKEN` unset and keyring unavailable |
+| Path                                           | Format | When                                                           |
+| ---------------------------------------------- | ------ | -------------------------------------------------------------- |
+| `<workdir>/supabase/.temp/linked-project.json` | JSON   | always — `linkedProjectCache` reads to decide whether to write |
+
+`info` makes **no** API call, so no access-token lookup occurs.
 
 ## Files Written
 
-| Path | Format | When |
-| ---- | ------ | ---- |
-| —    | —      | —    |
+| Path                                           | Format | When                                                                |
+| ---------------------------------------------- | ------ | ------------------------------------------------------------------- |
+| `~/.supabase/telemetry.json`                   | JSON   | always (`Effect.ensuring(telemetryState.flush)`)                    |
+| `<workdir>/supabase/.temp/linked-project.json` | JSON   | best-effort after `--project-ref` resolves (Go `PersistentPostRun`) |
 
 ## API Routes
 
-| Method | Path                                                                  | Auth         | Request body | Response (used fields)                    |
-| ------ | --------------------------------------------------------------------- | ------------ | ------------ | ----------------------------------------- |
-| `GET`  | `/v1/projects/{ref}/config/auth/sso/providers/{provider_id}/metadata` | Bearer token | none         | SSO SAML service provider metadata fields |
+`info` derives all three URLs locally from the project ref. No Management API
+calls are made.
 
 ## Environment Variables
 
-| Variable                | Purpose                                              | Required?                                               |
-| ----------------------- | ---------------------------------------------------- | ------------------------------------------------------- |
-| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `~/.supabase/access-token`) |
-| `SUPABASE_API_URL`      | override Management API base URL                     | no (defaults to `https://api.supabase.com`)             |
+| Variable           | Purpose                                            | Required?                   |
+| ------------------ | -------------------------------------------------- | --------------------------- |
+| `SUPABASE_PROFILE` | profile selector (built-in name or YAML file path) | no (defaults to `supabase`) |
 
 ## Exit Codes
 
-| Code | Condition                                           |
-| ---- | --------------------------------------------------- |
-| `0`  | success — SSO settings printed to stdout            |
-| `1`  | authentication error — no valid token found         |
-| `1`  | API error — non-2xx response from metadata endpoint |
-| `1`  | network / connection failure                        |
+| Code | Condition                                                        |
+| ---- | ---------------------------------------------------------------- |
+| `0`  | success                                                          |
+| `1`  | `LegacyInvalidProjectRefError` — ref doesn't match `^[a-z]{20}$` |
+| `1`  | `LegacyProjectNotLinkedError` — no ref source available          |
+
+## Telemetry Events Fired
+
+| Event                  | When                                       | Notable properties                                                     |
+| ---------------------- | ------------------------------------------ | ---------------------------------------------------------------------- |
+| `cli_command_executed` | post-run, success or failure (via wrapper) | `exit_code`, `duration_ms`, `flags` (`--project-ref` allowed verbatim) |
+
+## Output
+
+The payload is `{acs_url, entity_id, relay_state}` where each URL is derived from
+the project ref: `https://<ref>.supabase.co/auth/v1/sso/saml/{acs,metadata}` and
+`https://<ref>.supabase.co`.
+
+### `--output-format text` / Go `--output pretty`
+
+Glamour-styled 3-row property/value markdown table.
+
+### `--output json` / `--output yaml` / `--output toml`
+
+Encoded payload (Go-compatible alphabetised keys for JSON).
+
+### `--output env`
+
+`ACS_URL="…"`, `ENTITY_ID="…"`, `RELAY_STATE="…"` lines, alphabetised by key.
+
+### `--output-format json` / `stream-json`
+
+Single `success` event with the payload as data.
 
 ## Notes
 
-- Returns the SAML service provider metadata required to register the project with an identity provider.
-- Includes entity ID, ACS URL, and metadata XML.
-- Requires `--project-ref` or a linked project (`.supabase/config.json`).
+- All three URLs are deterministic functions of the project ref.
+- Go's markdown source at `render.go:170` includes a trailing space in the `Single sign-on URL (ACS URL) ` label, but Glamour collapses it when computing column widths. Our flat ASCII renderer would double it up against the cell padding, so the label is emitted without the trailing space to match Go's rendered output (which the cli-e2e parity harness compares against).
diff --git a/apps/cli/src/legacy/commands/sso/info/info.command.ts b/apps/cli/src/legacy/commands/sso/info/info.command.ts
index 729d66a809..fc72eab2df 100644
--- a/apps/cli/src/legacy/commands/sso/info/info.command.ts
+++ b/apps/cli/src/legacy/commands/sso/info/info.command.ts
@@ -1,5 +1,9 @@
 import { Command, Flag } from "effect/unstable/cli";
 import type * as CliCommand from "effect/unstable/cli/Command";
+
+import { withJsonErrorHandling } from "../../../../shared/output/json-error-handling.ts";
+import { legacyManagementApiRuntimeLayer } from "../../../shared/legacy-management-api-runtime.layer.ts";
+import { withLegacyCommandInstrumentation } from "../../../telemetry/legacy-command-instrumentation.ts";
 import { legacySsoInfo } from "./info.handler.ts";
 
 const config = {
@@ -21,5 +25,11 @@ export const legacySsoInfoCommand = Command.make("info", config).pipe(
       description: "Get SSO info for a project",
     },
   ]),
-  Command.withHandler((flags) => legacySsoInfo(flags)),
+  Command.withHandler((flags) =>
+    legacySsoInfo(flags).pipe(
+      withLegacyCommandInstrumentation({ flags, safeFlags: ["project-ref"] }),
+      withJsonErrorHandling,
+    ),
+  ),
+  Command.provide(legacyManagementApiRuntimeLayer(["sso", "info"])),
 );
diff --git a/apps/cli/src/legacy/commands/sso/info/info.handler.ts b/apps/cli/src/legacy/commands/sso/info/info.handler.ts
index a7215a65e8..41b4079a63 100644
--- a/apps/cli/src/legacy/commands/sso/info/info.handler.ts
+++ b/apps/cli/src/legacy/commands/sso/info/info.handler.ts
@@ -1,10 +1,56 @@
 import { Effect, Option } from "effect";
-import { LegacyGoProxy } from "../../../../shared/legacy/go-proxy.service.ts";
+
+import { LegacyProjectRefResolver } from "../../../config/legacy-project-ref.service.ts";
+import { LegacyOutputFlag } from "../../../../shared/legacy/global-flags.ts";
+import { Output } from "../../../../shared/output/output.service.ts";
+import {
+  encodeEnv,
+  encodeGoJson,
+  encodeToml,
+  encodeYaml,
+} from "../../../shared/legacy-go-output.encoders.ts";
+import { LegacyLinkedProjectCache } from "../../../telemetry/legacy-linked-project-cache.service.ts";
+import { LegacyTelemetryState } from "../../../telemetry/legacy-telemetry-state.service.ts";
+import { buildInfoPayload, renderInfoMarkdown } from "../sso.format.ts";
 import type { LegacySsoInfoFlags } from "./info.command.ts";
 
 export const legacySsoInfo = Effect.fn("legacy.sso.info")(function* (flags: LegacySsoInfoFlags) {
-  const proxy = yield* LegacyGoProxy;
-  const args: string[] = ["sso", "info"];
-  if (Option.isSome(flags.projectRef)) args.push("--project-ref", flags.projectRef.value);
-  yield* proxy.exec(args);
+  const output = yield* Output;
+  const goOutputFlag = yield* LegacyOutputFlag;
+  const resolver = yield* LegacyProjectRefResolver;
+  const linkedProjectCache = yield* LegacyLinkedProjectCache;
+  const telemetryState = yield* LegacyTelemetryState;
+
+  yield* Effect.gen(function* () {
+    const ref = yield* resolver.resolve(flags.projectRef);
+
+    yield* Effect.gen(function* () {
+      const payload = buildInfoPayload(ref);
+      const goFmt = Option.getOrUndefined(goOutputFlag);
+
+      if (goFmt === "env") {
+        yield* output.raw(encodeEnv(payload) + "\n");
+        return;
+      }
+      if (goFmt === "json") {
+        yield* output.raw(encodeGoJson(payload));
+        return;
+      }
+      if (goFmt === "yaml") {
+        yield* output.raw(encodeYaml(payload));
+        return;
+      }
+      if (goFmt === "toml") {
+        yield* output.raw(encodeToml(payload) + "\n");
+        return;
+      }
+
+      if (output.format === "json" || output.format === "stream-json") {
+        yield* output.success("", { ...payload });
+        return;
+      }
+
+      yield* output.raw(renderInfoMarkdown(ref));
+    }).pipe(Effect.ensuring(linkedProjectCache.cache(ref)));
+  }).pipe(Effect.ensuring(telemetryState.flush));
 });
diff --git a/apps/cli/src/legacy/commands/sso/info/info.integration.test.ts b/apps/cli/src/legacy/commands/sso/info/info.integration.test.ts
new file mode 100644
index 0000000000..6a7addd4b4
--- /dev/null
+++ b/apps/cli/src/legacy/commands/sso/info/info.integration.test.ts
@@ -0,0 +1,160 @@
+import { describe, expect, it } from "@effect/vitest";
+import { Effect, Option } from "effect";
+
+import { mockAnalytics, mockOutput } from "../../../../../tests/helpers/mocks.ts";
+import {
+  buildLegacyTestRuntime,
+  LEGACY_VALID_REF,
+  mockLegacyCliConfig,
+  mockLegacyLinkedProjectCacheTracked,
+  mockLegacyPlatformApi,
+  mockLegacyTelemetryStateTracked,
+  useLegacyTempWorkdir,
+} from "../../../../../tests/helpers/legacy-mocks.ts";
+import { legacySsoInfo } from "./info.handler.ts";
+
+const tempRoot = useLegacyTempWorkdir("supabase-sso-info-int-");
+
+interface SetupOpts {
+  format?: "text" | "json" | "stream-json";
+  goOutput?: "env" | "pretty" | "json" | "toml" | "yaml";
+}
+
+function setup(opts: SetupOpts = {}) {
+  const out = mockOutput({ format: opts.format ?? "text" });
+  const analytics = mockAnalytics();
+  const telemetry = mockLegacyTelemetryStateTracked();
+  const cache = mockLegacyLinkedProjectCacheTracked();
+  const api = mockLegacyPlatformApi();
+  const cliConfig = mockLegacyCliConfig({ workdir: tempRoot.current });
+
+  const layer = buildLegacyTestRuntime({
+    out,
+    api,
+    cliConfig,
+    telemetry: telemetry.layer,
+    linkedProjectCache: cache.layer,
+    analytics,
+    goOutput: opts.goOutput === undefined ? Option.none() : Option.some(opts.goOutput),
+  });
+
+  return { layer, out, api, analytics, telemetry, cache };
+}
+
+const expectedAcsUrl = `https://${LEGACY_VALID_REF}.supabase.co/auth/v1/sso/saml/acs`;
+const expectedEntityId = `https://${LEGACY_VALID_REF}.supabase.co/auth/v1/sso/saml/metadata`;
+const expectedRelayState = `https://${LEGACY_VALID_REF}.supabase.co`;
+
+describe("legacy sso info integration", () => {
+  it.live("renders a 3-row markdown table in text mode", () => {
+    const { layer, out } = setup();
+    return Effect.gen(function* () {
+      yield* legacySsoInfo({ projectRef: Option.none() });
+      expect(out.stdoutText).toContain("Single sign-on URL (ACS URL)");
+      expect(out.stdoutText).toContain("Audience URI (SP Entity ID)");
+      expect(out.stdoutText).toContain("Default Relay State");
+      expect(out.stdoutText).toContain(expectedAcsUrl);
+      expect(out.stdoutText).toContain(expectedEntityId);
+      expect(out.stdoutText).toContain(expectedRelayState);
+    }).pipe(Effect.provide(layer));
+  });
+
+  // Parity guard for cli-e2e: Go's Glamour renders the ACS URL row as
+  // `Single sign-on URL (ACS URL) | https://…` (single space before the
+  // column separator). An earlier "byte-parity" attempt to preserve the
+  // trailing space in Go's markdown source produced two spaces against our
+  // flat renderer's padding and broke the parity harness. Pin the exact
+  // byte sequence so it can't drift back.
+  it.live("emits exactly one space between the ACS URL label and the column separator", () => {
+    const { layer, out } = setup();
+    return Effect.gen(function* () {
+      yield* legacySsoInfo({ projectRef: Option.none() });
+      expect(out.stdoutText).toContain(`Single sign-on URL (ACS URL) | ${expectedAcsUrl}`);
+      expect(out.stdoutText).not.toContain("Single sign-on URL (ACS URL)  |");
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("TS --output-format=json emits a structured payload", () => {
+    const { layer, out } = setup({ format: "json" });
+    return Effect.gen(function* () {
+      yield* legacySsoInfo({ projectRef: Option.none() });
+      const success = out.messages.find((m) => m.type === "success");
+      expect(success).toBeDefined();
+      expect(success?.data).toEqual({
+        acs_url: expectedAcsUrl,
+        entity_id: expectedEntityId,
+        relay_state: expectedRelayState,
+      });
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("Go --output=env emits ACS_URL / ENTITY_ID / RELAY_STATE alphabetized", () => {
+    const { layer, out } = setup({ goOutput: "env" });
+    return Effect.gen(function* () {
+      yield* legacySsoInfo({ projectRef: Option.none() });
+      expect(out.stdoutText).toContain("ACS_URL=");
+      expect(out.stdoutText).toContain("ENTITY_ID=");
+      expect(out.stdoutText).toContain("RELAY_STATE=");
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("Go --output=json sorts keys alphabetically and includes all three", () => {
+    const { layer, out } = setup({ goOutput: "json" });
+    return Effect.gen(function* () {
+      yield* legacySsoInfo({ projectRef: Option.none() });
+      expect(out.stdoutText).toContain('"acs_url"');
+      expect(out.stdoutText).toContain('"entity_id"');
+      expect(out.stdoutText).toContain('"relay_state"');
+      // Keys are alphabetized — acs_url should appear before entity_id.
+      const acsIndex = out.stdoutText.indexOf("acs_url");
+      const entityIndex = out.stdoutText.indexOf("entity_id");
+      expect(acsIndex).toBeLessThan(entityIndex);
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("Go --output=yaml emits the three keys", () => {
+    const { layer, out } = setup({ goOutput: "yaml" });
+    return Effect.gen(function* () {
+      yield* legacySsoInfo({ projectRef: Option.none() });
+      expect(out.stdoutText).toContain("acs_url:");
+      expect(out.stdoutText).toContain("entity_id:");
+      expect(out.stdoutText).toContain("relay_state:");
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("Go --output=toml emits the three keys", () => {
+    const { layer, out } = setup({ goOutput: "toml" });
+    return Effect.gen(function* () {
+      yield* legacySsoInfo({ projectRef: Option.none() });
+      expect(out.stdoutText).toContain("acs_url");
+      expect(out.stdoutText).toContain("entity_id");
+      expect(out.stdoutText).toContain("relay_state");
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("URLs derive from --project-ref flag value when set", () => {
+    const flagRef = "zzzzzzzzzzzzzzzzzzzz";
+    const { layer, out } = setup();
+    return Effect.gen(function* () {
+      yield* legacySsoInfo({ projectRef: Option.some(flagRef) });
+      expect(out.stdoutText).toContain(`https://${flagRef}.supabase.co`);
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("flushes telemetry + linked-project cache on success", () => {
+    const { layer, telemetry, cache } = setup();
+    return Effect.gen(function* () {
+      yield* legacySsoInfo({ projectRef: Option.none() });
+      expect(telemetry.flushed).toBe(true);
+      expect(cache.cached).toBe(true);
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("does NOT make any API call", () => {
+    const { layer, api } = setup();
+    return Effect.gen(function* () {
+      yield* legacySsoInfo({ projectRef: Option.none() });
+      expect(api.requests).toHaveLength(0);
+    }).pipe(Effect.provide(layer));
+  });
+});
diff --git a/apps/cli/src/legacy/commands/sso/list/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/sso/list/SIDE_EFFECTS.md
index f35bd25a7b..4648596fd8 100644
--- a/apps/cli/src/legacy/commands/sso/list/SIDE_EFFECTS.md
+++ b/apps/cli/src/legacy/commands/sso/list/SIDE_EFFECTS.md
@@ -2,40 +2,70 @@
 
 ## Files Read
 
-| Path                       | Format                    | When                                                       |
-| -------------------------- | ------------------------- | ---------------------------------------------------------- |
-| `~/.supabase/access-token` | plain text (token string) | when `SUPABASE_ACCESS_TOKEN` unset and keyring unavailable |
+| Path                                           | Format                    | When                                                                                          |
+| ---------------------------------------------- | ------------------------- | --------------------------------------------------------------------------------------------- |
+| keyring `"Supabase CLI"` / `<profile>`         | OS keychain               | when `SUPABASE_ACCESS_TOKEN` unset and keyring available; account = `LegacyCliConfig.profile` |
+| keyring `"Supabase CLI"` / `access-token`      | OS keychain               | legacy-key fallback when the profile-keyed lookup misses                                      |
+| `~/.supabase/access-token`                     | plain text (token string) | last-resort fallback after env + keyring miss                                                 |
+| `<workdir>/supabase/.temp/linked-project.json` | JSON                      | always — `linkedProjectCache` reads to decide whether to write                                |
 
 ## Files Written
 
-| Path | Format | When |
-| ---- | ------ | ---- |
-| —    | —      | —    |
+| Path                                           | Format | When                                                                |
+| ---------------------------------------------- | ------ | ------------------------------------------------------------------- |
+| `~/.supabase/telemetry.json`                   | JSON   | always (`Effect.ensuring(telemetryState.flush)`)                    |
+| `<workdir>/supabase/.temp/linked-project.json` | JSON   | best-effort after `--project-ref` resolves (Go `PersistentPostRun`) |
 
 ## API Routes
 
-| Method | Path                                           | Auth         | Request body | Response (used fields)                                   |
-| ------ | ---------------------------------------------- | ------------ | ------------ | -------------------------------------------------------- |
-| `GET`  | `/v1/projects/{ref}/config/auth/sso/providers` | Bearer token | none         | `{items: [{id, saml, domains, created_at, updated_at}]}` |
+| Method | Path                                           | Auth         | Request body | Response (used fields)                                                     |
+| ------ | ---------------------------------------------- | ------------ | ------------ | -------------------------------------------------------------------------- |
+| `GET`  | `/v1/projects/{ref}/config/auth/sso/providers` | Bearer token | none         | `{items: [{id, saml?, domains?, created_at?, updated_at?}]}`               |
+| `GET`  | `/v1/projects/{ref}`                           | Bearer token | none         | `{organization_slug}` — upgrade-gate side-call on 4xx                      |
+| `GET`  | `/v1/organizations/{slug}/entitlements`        | Bearer token | none         | `{entitlements[].feature.key, .hasAccess}` — upgrade-gate side-call on 4xx |
 
 ## Environment Variables
 
 | Variable                | Purpose                                              | Required?                                               |
 | ----------------------- | ---------------------------------------------------- | ------------------------------------------------------- |
 | `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `~/.supabase/access-token`) |
-| `SUPABASE_API_URL`      | override Management API base URL                     | no (defaults to `https://api.supabase.com`)             |
+| `SUPABASE_PROFILE`      | profile selector (built-in name or YAML file path)   | no (defaults to `supabase`)                             |
 
 ## Exit Codes
 
-| Code | Condition                                              |
-| ---- | ------------------------------------------------------ |
-| `0`  | success — providers printed to stdout                  |
-| `1`  | authentication error — no valid token found            |
-| `1`  | API error — 404 means SAML not enabled for the project |
-| `1`  | API error — non-2xx response from providers endpoint   |
-| `1`  | network / connection failure                           |
+| Code | Condition                                                 |
+| ---- | --------------------------------------------------------- |
+| `0`  | success                                                   |
+| `1`  | `LegacySsoListSamlDisabledError` — 404 from list endpoint |
+| `1`  | `LegacySsoListUnexpectedStatusError` — other non-2xx      |
+| `1`  | `LegacySsoListNetworkError` — transport-level failure     |
+
+## Telemetry Events Fired
+
+| Event                   | When                                                 | Notable properties                                                     |
+| ----------------------- | ---------------------------------------------------- | ---------------------------------------------------------------------- |
+| `cli_command_executed`  | post-run, success or failure (via wrapper)           | `exit_code`, `duration_ms`, `flags` (`--project-ref` allowed verbatim) |
+| `cli_upgrade_suggested` | 4xx response **and** `auth.saml_2` entitlement gated | `feature_key: "auth.saml_2"`, `org_slug`                               |
+
+## Output
+
+### `--output-format text` / Go `--output pretty`
+
+Glamour-styled ASCII table with columns `TYPE`, `IDENTITY PROVIDER ID`, `DOMAINS`, `` SAML 2.0 `EntityID` ``, `CREATED AT (UTC)`, `UPDATED AT (UTC)`.
+
+### `--output json` / `--output yaml` / `--output toml`
+
+Encoded `{providers: items}` (Go-compatible alphabetised keys for JSON).
+
+### `--output env`
+
+Single `PROVIDERS=""` line — Go's viper does not descend into slices.
+
+### `--output-format json` / `stream-json`
+
+Single `success` event with `{providers: items}` as data.
 
 ## Notes
 
-- Returns 404 with a descriptive message when SAML 2.0 is not enabled for the project.
-- Requires `--project-ref` or a linked project (`.supabase/config.json`).
+- The `SAML 2.0 EntityID` header label is rendered as plain text; Go's markdown source writes `` SAML 2.0 `EntityID` `` and Glamour strips the inline-code backticks. Our flat ASCII renderer drops them at the source for byte parity with Glamour's output.
+- Upgrade-gate side calls only fire on 4xx (matches Go's `plan_gate.go:29`).
diff --git a/apps/cli/src/legacy/commands/sso/list/list.command.ts b/apps/cli/src/legacy/commands/sso/list/list.command.ts
index 185e61e6ac..624888e5aa 100644
--- a/apps/cli/src/legacy/commands/sso/list/list.command.ts
+++ b/apps/cli/src/legacy/commands/sso/list/list.command.ts
@@ -1,5 +1,9 @@
 import { Command, Flag } from "effect/unstable/cli";
 import type * as CliCommand from "effect/unstable/cli/Command";
+
+import { withJsonErrorHandling } from "../../../../shared/output/json-error-handling.ts";
+import { legacyManagementApiRuntimeLayer } from "../../../shared/legacy-management-api-runtime.layer.ts";
+import { withLegacyCommandInstrumentation } from "../../../telemetry/legacy-command-instrumentation.ts";
 import { legacySsoList } from "./list.handler.ts";
 
 const config = {
@@ -19,5 +23,11 @@ export const legacySsoListCommand = Command.make("list", config).pipe(
       description: "List all SSO providers for a project",
     },
   ]),
-  Command.withHandler((flags) => legacySsoList(flags)),
+  Command.withHandler((flags) =>
+    legacySsoList(flags).pipe(
+      withLegacyCommandInstrumentation({ flags, safeFlags: ["project-ref"] }),
+      withJsonErrorHandling,
+    ),
+  ),
+  Command.provide(legacyManagementApiRuntimeLayer(["sso", "list"])),
 );
diff --git a/apps/cli/src/legacy/commands/sso/list/list.handler.ts b/apps/cli/src/legacy/commands/sso/list/list.handler.ts
index 076578a825..408e43d23b 100644
--- a/apps/cli/src/legacy/commands/sso/list/list.handler.ts
+++ b/apps/cli/src/legacy/commands/sso/list/list.handler.ts
@@ -1,10 +1,102 @@
+import type { SupabaseApiError } from "@supabase/api/effect";
 import { Effect, Option } from "effect";
-import { LegacyGoProxy } from "../../../../shared/legacy/go-proxy.service.ts";
+
+import { LegacyPlatformApi } from "../../../auth/legacy-platform-api.service.ts";
+import { LegacyProjectRefResolver } from "../../../config/legacy-project-ref.service.ts";
+import { LegacyOutputFlag } from "../../../../shared/legacy/global-flags.ts";
+import { Output } from "../../../../shared/output/output.service.ts";
+import {
+  encodeEnv,
+  encodeGoJson,
+  encodeToml,
+  encodeYaml,
+} from "../../../shared/legacy-go-output.encoders.ts";
+import { mapLegacyHttpError } from "../../../shared/legacy-http-errors.ts";
+import { LegacyLinkedProjectCache } from "../../../telemetry/legacy-linked-project-cache.service.ts";
+import { LegacyTelemetryState } from "../../../telemetry/legacy-telemetry-state.service.ts";
+import { legacySuggestUpgrade } from "../../../shared/legacy-upgrade-suggest.ts";
+import {
+  LegacySsoListNetworkError,
+  LegacySsoListSamlDisabledError,
+  LegacySsoListUnexpectedStatusError,
+} from "../sso.errors.ts";
+import { renderListProviders } from "../sso.format.ts";
 import type { LegacySsoListFlags } from "./list.command.ts";
 
+const SAML_DISABLED_MESSAGE =
+  "Looks like SAML 2.0 support is not enabled for this project. Please use the dashboard to enable it.";
+
+const mapStatusOrNetwork = mapLegacyHttpError({
+  networkError: LegacySsoListNetworkError,
+  statusError: LegacySsoListUnexpectedStatusError,
+  networkMessage: (cause) => `failed to list sso providers: ${cause}`,
+  statusMessage: (_status, body) => `unexpected error listing identity providers: ${body}`,
+});
+
+const handleListError = (ref: string, cause: SupabaseApiError) =>
+  Effect.gen(function* () {
+    const mapped = yield* Effect.flip(mapStatusOrNetwork(cause));
+    if (mapped._tag === "LegacySsoListUnexpectedStatusError") {
+      yield* legacySuggestUpgrade({
+        projectRef: ref,
+        featureKey: "auth.saml_2",
+        statusCode: mapped.status,
+      });
+      if (mapped.status === 404) {
+        return yield* Effect.fail(
+          new LegacySsoListSamlDisabledError({ message: SAML_DISABLED_MESSAGE }),
+        );
+      }
+    }
+    return yield* Effect.fail(mapped);
+  });
+
 export const legacySsoList = Effect.fn("legacy.sso.list")(function* (flags: LegacySsoListFlags) {
-  const proxy = yield* LegacyGoProxy;
-  const args: string[] = ["sso", "list"];
-  if (Option.isSome(flags.projectRef)) args.push("--project-ref", flags.projectRef.value);
-  yield* proxy.exec(args);
+  const output = yield* Output;
+  const goOutputFlag = yield* LegacyOutputFlag;
+  const api = yield* LegacyPlatformApi;
+  const resolver = yield* LegacyProjectRefResolver;
+  const linkedProjectCache = yield* LegacyLinkedProjectCache;
+  const telemetryState = yield* LegacyTelemetryState;
+
+  yield* Effect.gen(function* () {
+    const ref = yield* resolver.resolve(flags.projectRef);
+
+    yield* Effect.gen(function* () {
+      const fetching =
+        output.format === "text" ? yield* output.task("Fetching SSO providers...") : undefined;
+      const response = yield* api.v1.listAllSsoProvider({ ref }).pipe(
+        Effect.tapError(() => fetching?.fail() ?? Effect.void),
+        Effect.catch((cause) => handleListError(ref, cause)),
+      );
+      yield* fetching?.clear() ?? Effect.void;
+
+      const goFmt = Option.getOrUndefined(goOutputFlag);
+      const payload = { providers: response.items };
+
+      if (goFmt === "json") {
+        yield* output.raw(encodeGoJson(payload));
+        return;
+      }
+      if (goFmt === "yaml") {
+        yield* output.raw(encodeYaml(payload));
+        return;
+      }
+      if (goFmt === "toml") {
+        yield* output.raw(encodeToml(payload) + "\n");
+        return;
+      }
+      if (goFmt === "env") {
+        yield* output.raw(encodeEnv(payload) + "\n");
+        return;
+      }
+
+      if (output.format === "json" || output.format === "stream-json") {
+        yield* output.success("", payload);
+        return;
+      }
+
+      yield* output.raw(renderListProviders(response.items));
+    }).pipe(Effect.ensuring(linkedProjectCache.cache(ref)));
+  }).pipe(Effect.ensuring(telemetryState.flush));
 });
diff --git a/apps/cli/src/legacy/commands/sso/list/list.integration.test.ts b/apps/cli/src/legacy/commands/sso/list/list.integration.test.ts
new file mode 100644
index 0000000000..2959f8da6e
--- /dev/null
+++ b/apps/cli/src/legacy/commands/sso/list/list.integration.test.ts
@@ -0,0 +1,323 @@
+import { describe, expect, it } from "@effect/vitest";
+import { Effect, Exit, Option } from "effect";
+import * as HttpClientResponse from "effect/unstable/http/HttpClientResponse";
+
+import { mockAnalytics, mockOutput } from "../../../../../tests/helpers/mocks.ts";
+import {
+  buildLegacyTestRuntime,
+  LEGACY_VALID_REF,
+  mockLegacyCliConfig,
+  mockLegacyLinkedProjectCacheTracked,
+  mockLegacyPlatformApi,
+  mockLegacyTelemetryStateTracked,
+  useLegacyTempWorkdir,
+} from "../../../../../tests/helpers/legacy-mocks.ts";
+import { withJsonErrorHandling } from "../../../../shared/output/json-error-handling.ts";
+import { EventUpgradeSuggested } from "../../../../shared/telemetry/event-catalog.ts";
+import { legacySsoList } from "./list.handler.ts";
+
+const PROVIDER_ITEM = {
+  id: "0b0d48f6-878b-4190-88d7-2ca33ed800bc",
+  saml: {
+    id: "8682fcf4-4056-455c-bd93-f33295604929",
+    entity_id: "https://example.com",
+    metadata_url: "https://example.com",
+    metadata_xml: '<?xml version="2.0"?>',
+    attribute_mapping: { keys: { a: { name: "xyz", default: 3 } } },
+  },
+  domains: [
+    {
+      id: "9484591c-a203-4500-bea7-d0aaa845e2f5",
+      domain: "example.com",
+      created_at: "2023-03-28T13:50:14.464Z",
+      updated_at: "2023-03-28T13:50:14.464Z",
+    },
+  ],
+  created_at: "2023-03-28T13:50:14.464Z",
+  updated_at: "2023-03-28T13:50:14.464Z",
+};
+
+const tempRoot = useLegacyTempWorkdir("supabase-sso-list-int-");
+
+interface SetupOpts {
+  format?: "text" | "json" | "stream-json";
+  goOutput?: "env" | "pretty" | "json" | "toml" | "yaml";
+  status?: number;
+  body?: unknown;
+  network?: "fail";
+  // Configures the upgrade-gate side-call branches:
+  //   "gated"     → entitlement says auth.saml_2 has_access=false
+  //   "notGated"  → entitlement says auth.saml_2 has_access=true
+  //   undefined   → no extra handlers wired; project lookup 404s
+  upgradeGate?: "gated" | "notGated";
+}
+
+function jsonResponse(
+  request: Parameters<typeof HttpClientResponse.fromWeb>[0],
+  status: number,
+  body: unknown,
+) {
+  return HttpClientResponse.fromWeb(
+    request,
+    new Response(JSON.stringify(body), {
+      status,
+      headers: { "content-type": "application/json" },
+    }),
+  );
+}
+
+function setup(opts: SetupOpts = {}) {
+  const out = mockOutput({ format: opts.format ?? "text" });
+  const analytics = mockAnalytics();
+  const telemetry = mockLegacyTelemetryStateTracked();
+  const cache = mockLegacyLinkedProjectCacheTracked();
+
+  const status = opts.status ?? 200;
+  const body = opts.body ?? { items: [PROVIDER_ITEM] };
+  const gate = opts.upgradeGate;
+
+  const api = mockLegacyPlatformApi({
+    network: opts.network,
+    handler: (request) => {
+      const url = request.url;
+      if (url.includes("/config/auth/sso/providers")) {
+        return Effect.succeed(jsonResponse(request, status, body));
+      }
+      if (url.endsWith(`/v1/projects/${LEGACY_VALID_REF}`)) {
+        if (gate === undefined) {
+          return Effect.succeed(jsonResponse(request, 404, {}));
+        }
+        return Effect.succeed(
+          jsonResponse(request, 200, {
+            id: LEGACY_VALID_REF,
+            ref: LEGACY_VALID_REF,
+            organization_id: "org-id",
+            organization_slug: "acme",
+            name: "Test",
+            region: "us-east-1",
+            created_at: "2023-01-01T00:00:00Z",
+            status: "ACTIVE_HEALTHY",
+            database: {
+              host: "db.example.com",
+              version: "15",
+              postgres_engine: "15",
+              release_channel: "ga",
+            },
+          }),
+        );
+      }
+      if (url.includes("/v1/organizations/acme/entitlements")) {
+        return Effect.succeed(
+          jsonResponse(request, 200, {
+            entitlements: [
+              {
+                feature: { key: "auth.saml_2", type: "boolean" },
+                hasAccess: gate === "notGated",
+                type: "boolean",
+                config: { enabled: false },
+              },
+            ],
+          }),
+        );
+      }
+      return Effect.succeed(jsonResponse(request, 404, {}));
+    },
+  });
+
+  const cliConfig = mockLegacyCliConfig({ workdir: tempRoot.current });
+  const layer = buildLegacyTestRuntime({
+    out,
+    api,
+    cliConfig,
+    telemetry: telemetry.layer,
+    linkedProjectCache: cache.layer,
+    analytics,
+    goOutput: opts.goOutput === undefined ? Option.none() : Option.some(opts.goOutput),
+  });
+
+  return { layer, out, api, analytics, telemetry, cache };
+}
+
+describe("legacy sso list integration", () => {
+  it.live("renders an ASCII table in text mode", () => {
+    const { layer, out } = setup();
+    return Effect.gen(function* () {
+      yield* legacySsoList({ projectRef: Option.none() });
+      expect(out.stdoutText).toContain("TYPE");
+      expect(out.stdoutText).toContain("IDENTITY PROVIDER ID");
+      expect(out.stdoutText).toContain("0b0d48f6-878b-4190-88d7-2ca33ed800bc");
+      expect(out.stdoutText).toContain("example.com");
+      expect(out.stdoutText).toContain("2023-03-28 13:50:14");
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("emits a success payload via --output-format=json", () => {
+    const { layer, out } = setup({ format: "json" });
+    return Effect.gen(function* () {
+      yield* legacySsoList({ projectRef: Option.none() });
+      const success = out.messages.find((m) => m.type === "success");
+      expect(success).toBeDefined();
+      expect((success?.data as { providers: ReadonlyArray<unknown> })?.providers).toHaveLength(1);
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("emits a result event via --output-format=stream-json", () => {
+    const { layer, out } = setup({ format: "stream-json" });
+    return Effect.gen(function* () {
+      yield* legacySsoList({ projectRef: Option.none() });
+      expect(out.messages.some((m) => m.type === "success")).toBe(true);
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("Go --output=json wraps response in `{providers: …}`", () => {
+    const { layer, out } = setup({ goOutput: "json" });
+    return Effect.gen(function* () {
+      yield* legacySsoList({ projectRef: Option.none() });
+      expect(out.stdoutText.startsWith("{")).toBe(true);
+      expect(out.stdoutText).toContain('"providers"');
+      expect(out.stdoutText).toContain("0b0d48f6-878b-4190-88d7-2ca33ed800bc");
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("Go --output=yaml emits providers key", () => {
+    const { layer, out } = setup({ goOutput: "yaml" });
+    return Effect.gen(function* () {
+      yield* legacySsoList({ projectRef: Option.none() });
+      expect(out.stdoutText).toContain("providers:");
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("Go --output=toml emits provider data", () => {
+    const { layer, out } = setup({ goOutput: "toml" });
+    return Effect.gen(function* () {
+      yield* legacySsoList({ projectRef: Option.none() });
+      expect(out.stdoutText.length).toBeGreaterThan(0);
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("Go --output=env emits a flat PROVIDERS= entry", () => {
+    const { layer, out } = setup({ goOutput: "env" });
+    return Effect.gen(function* () {
+      yield* legacySsoList({ projectRef: Option.none() });
+      expect(out.stdoutText).toContain("PROVIDERS=");
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("Go --output=pretty falls through to text rendering", () => {
+    const { layer, out } = setup({ goOutput: "pretty" });
+    return Effect.gen(function* () {
+      yield* legacySsoList({ projectRef: Option.none() });
+      expect(out.stdoutText).toContain("IDENTITY PROVIDER ID");
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("Go --output wins over TS --output-format when both set", () => {
+    const { layer, out } = setup({ format: "json", goOutput: "yaml" });
+    return Effect.gen(function* () {
+      yield* legacySsoList({ projectRef: Option.none() });
+      expect(out.stdoutText.startsWith("{")).toBe(false);
+      expect(out.stdoutText).toContain("providers:");
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("reports SAML-disabled error on 404", () => {
+    const { layer } = setup({ status: 404, body: {} });
+    return Effect.gen(function* () {
+      const exit = yield* Effect.exit(legacySsoList({ projectRef: Option.none() }));
+      expect(Exit.isFailure(exit)).toBe(true);
+      if (Exit.isFailure(exit)) {
+        const dump = JSON.stringify(exit.cause);
+        expect(dump).toContain("LegacySsoListSamlDisabledError");
+        expect(dump).toContain("Looks like SAML 2.0 support is not enabled");
+      }
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("fires cli_upgrade_suggested on 404 when entitlement is gated", () => {
+    const { layer, analytics } = setup({ status: 404, body: {}, upgradeGate: "gated" });
+    return Effect.gen(function* () {
+      yield* Effect.exit(legacySsoList({ projectRef: Option.none() }));
+      expect(analytics.captured.some((c) => c.event === EventUpgradeSuggested)).toBe(true);
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("does NOT fire cli_upgrade_suggested when entitlement is not gated", () => {
+    const { layer, analytics } = setup({ status: 404, body: {}, upgradeGate: "notGated" });
+    return Effect.gen(function* () {
+      yield* Effect.exit(legacySsoList({ projectRef: Option.none() }));
+      expect(analytics.captured.some((c) => c.event === EventUpgradeSuggested)).toBe(false);
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("reports unexpected-status error on 500", () => {
+    const { layer } = setup({ status: 500, body: { error: "boom" } });
+    return Effect.gen(function* () {
+      const exit = yield* Effect.exit(legacySsoList({ projectRef: Option.none() }));
+      expect(Exit.isFailure(exit)).toBe(true);
+      if (Exit.isFailure(exit)) {
+        const dump = JSON.stringify(exit.cause);
+        expect(dump).toContain("LegacySsoListUnexpectedStatusError");
+        expect(dump).toContain("unexpected error listing identity providers");
+      }
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("reports network error on transport failure", () => {
+    const { layer } = setup({ network: "fail" });
+    return Effect.gen(function* () {
+      const exit = yield* Effect.exit(legacySsoList({ projectRef: Option.none() }));
+      expect(Exit.isFailure(exit)).toBe(true);
+      if (Exit.isFailure(exit)) {
+        const dump = JSON.stringify(exit.cause);
+        expect(dump).toContain("LegacySsoListNetworkError");
+        expect(dump).toContain("failed to list sso providers");
+      }
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("uses --project-ref flag value over resolver default", () => {
+    const flagRef = "zzzzzzzzzzzzzzzzzzzz";
+    const { layer, api } = setup();
+    return Effect.gen(function* () {
+      yield* legacySsoList({ projectRef: Option.some(flagRef) });
+      const ssoRequest = api.requests.find((r) =>
+        r.url.includes(`/v1/projects/${flagRef}/config/auth/sso/providers`),
+      );
+      expect(ssoRequest).toBeDefined();
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("hits GET /v1/projects/{ref}/config/auth/sso/providers", () => {
+    const { layer, api } = setup();
+    return Effect.gen(function* () {
+      yield* legacySsoList({ projectRef: Option.none() });
+      const ssoRequest = api.requests.find((r) => r.url.endsWith(`/config/auth/sso/providers`));
+      expect(ssoRequest?.method).toBe("GET");
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("flushes telemetry + linked-project cache on success", () => {
+    const { layer, telemetry, cache } = setup();
+    return Effect.gen(function* () {
+      yield* legacySsoList({ projectRef: Option.none() });
+      expect(telemetry.flushed).toBe(true);
+      expect(cache.cached).toBe(true);
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("flushes telemetry even on API failure", () => {
+    const { layer, telemetry } = setup({ status: 500, body: {} });
+    return Effect.gen(function* () {
+      yield* Effect.exit(legacySsoList({ projectRef: Option.none() }));
+      expect(telemetry.flushed).toBe(true);
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("emits a fail event when withJsonErrorHandling wraps a JSON-mode error", () => {
+    const { layer, out } = setup({ format: "json", status: 500, body: {} });
+    return Effect.gen(function* () {
+      yield* legacySsoList({ projectRef: Option.none() }).pipe(withJsonErrorHandling);
+      expect(out.messages.some((m) => m.type === "fail")).toBe(true);
+    }).pipe(Effect.provide(layer));
+  });
+});
diff --git a/apps/cli/src/legacy/commands/sso/remove/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/sso/remove/SIDE_EFFECTS.md
index 6d9dd814fa..34bcb32e3c 100644
--- a/apps/cli/src/legacy/commands/sso/remove/SIDE_EFFECTS.md
+++ b/apps/cli/src/legacy/commands/sso/remove/SIDE_EFFECTS.md
@@ -2,42 +2,71 @@
 
 ## Files Read
 
-| Path                       | Format                    | When                                                       |
-| -------------------------- | ------------------------- | ---------------------------------------------------------- |
-| `~/.supabase/access-token` | plain text (token string) | when `SUPABASE_ACCESS_TOKEN` unset and keyring unavailable |
+| Path                                           | Format                    | When                                                                                          |
+| ---------------------------------------------- | ------------------------- | --------------------------------------------------------------------------------------------- |
+| keyring `"Supabase CLI"` / `<profile>`         | OS keychain               | when `SUPABASE_ACCESS_TOKEN` unset and keyring available; account = `LegacyCliConfig.profile` |
+| keyring `"Supabase CLI"` / `access-token`      | OS keychain               | legacy-key fallback when the profile-keyed lookup misses                                      |
+| `~/.supabase/access-token`                     | plain text (token string) | last-resort fallback after env + keyring miss                                                 |
+| `<workdir>/supabase/.temp/linked-project.json` | JSON                      | always — `linkedProjectCache` reads to decide whether to write                                |
 
 ## Files Written
 
-| Path | Format | When |
-| ---- | ------ | ---- |
-| —    | —      | —    |
+| Path                                           | Format | When                                                                |
+| ---------------------------------------------- | ------ | ------------------------------------------------------------------- |
+| `~/.supabase/telemetry.json`                   | JSON   | always (`Effect.ensuring(telemetryState.flush)`)                    |
+| `<workdir>/supabase/.temp/linked-project.json` | JSON   | best-effort after `--project-ref` resolves (Go `PersistentPostRun`) |
 
 ## API Routes
 
-| Method   | Path                                                         | Auth         | Request body | Response (used fields)                        |
-| -------- | ------------------------------------------------------------ | ------------ | ------------ | --------------------------------------------- |
-| `DELETE` | `/v1/projects/{ref}/config/auth/sso/providers/{provider_id}` | Bearer token | none         | `{id, saml, domains, created_at, updated_at}` |
+| Method   | Path                                                         | Auth         | Request body | Response (used fields)                                    |
+| -------- | ------------------------------------------------------------ | ------------ | ------------ | --------------------------------------------------------- |
+| `DELETE` | `/v1/projects/{ref}/config/auth/sso/providers/{provider_id}` | Bearer token | none         | `{id, saml?, domains?, created_at?, updated_at?}`         |
+| `GET`    | `/v1/projects/{ref}`                                         | Bearer token | none         | `{organization_slug}` — upgrade-gate side-call on 4xx     |
+| `GET`    | `/v1/organizations/{slug}/entitlements`                      | Bearer token | none         | `{entitlements[].feature.key, .hasAccess}` — upgrade-gate |
 
 ## Environment Variables
 
 | Variable                | Purpose                                              | Required?                                               |
 | ----------------------- | ---------------------------------------------------- | ------------------------------------------------------- |
 | `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `~/.supabase/access-token`) |
-| `SUPABASE_API_URL`      | override Management API base URL                     | no (defaults to `https://api.supabase.com`)             |
+| `SUPABASE_PROFILE`      | profile selector (built-in name or YAML file path)   | no (defaults to `supabase`)                             |
 
 ## Exit Codes
 
-| Code | Condition                                            |
-| ---- | ---------------------------------------------------- |
-| `0`  | success — provider removed and details printed       |
-| `1`  | authentication error — no valid token found          |
-| `1`  | API error — 404 means provider ID does not exist     |
-| `1`  | API error — non-2xx response from providers endpoint |
-| `1`  | validation error — provider ID is not a valid UUID   |
-| `1`  | network / connection failure                         |
+| Code | Condition                                                         |
+| ---- | ----------------------------------------------------------------- |
+| `0`  | success                                                           |
+| `1`  | `LegacySsoInvalidUuidError` — provider ID is not a canonical UUID |
+| `1`  | `LegacySsoRemoveNotFoundError` — 404 from delete endpoint         |
+| `1`  | `LegacySsoRemoveUnexpectedStatusError` — other non-2xx            |
+| `1`  | `LegacySsoRemoveNetworkError` — transport-level failure           |
+
+## Telemetry Events Fired
+
+| Event                   | When                                                 | Notable properties                                                     |
+| ----------------------- | ---------------------------------------------------- | ---------------------------------------------------------------------- |
+| `cli_command_executed`  | post-run, success or failure (via wrapper)           | `exit_code`, `duration_ms`, `flags` (`--project-ref` allowed verbatim) |
+| `cli_upgrade_suggested` | 4xx response **and** `auth.saml_2` entitlement gated | `feature_key: "auth.saml_2"`, `org_slug`                               |
+
+## Output
+
+### `--output-format text` / Go `--output pretty`
+
+Glamour-styled property/value markdown table showing the removed provider's details (Go behaviour).
+
+### `--output json` / `--output yaml` / `--output toml`
+
+Response verbatim (Go-compatible alphabetised keys for JSON).
+
+### `--output env`
+
+No output (matches Go's `remove.go:39`).
+
+### `--output-format json` / `stream-json`
+
+Single `success` event with the removed provider's details as data.
 
 ## Notes
 
-- The `<provider-id>` argument must be a valid UUID.
 - Removing a provider will prevent existing SSO users from logging in.
-- Requires `--project-ref` or a linked project (`.supabase/config.json`).
+- The `<provider-id>` argument must be a valid UUID; UUIDs are accepted case-insensitively (matches Go's `uuid.Parse`).
diff --git a/apps/cli/src/legacy/commands/sso/remove/remove.command.ts b/apps/cli/src/legacy/commands/sso/remove/remove.command.ts
index d1b472c440..12a41251cf 100644
--- a/apps/cli/src/legacy/commands/sso/remove/remove.command.ts
+++ b/apps/cli/src/legacy/commands/sso/remove/remove.command.ts
@@ -1,5 +1,9 @@
 import { Argument, Command, Flag } from "effect/unstable/cli";
 import type * as CliCommand from "effect/unstable/cli/Command";
+
+import { withJsonErrorHandling } from "../../../../shared/output/json-error-handling.ts";
+import { legacyManagementApiRuntimeLayer } from "../../../shared/legacy-management-api-runtime.layer.ts";
+import { withLegacyCommandInstrumentation } from "../../../telemetry/legacy-command-instrumentation.ts";
 import { legacySsoRemove } from "./remove.handler.ts";
 
 const config = {
@@ -15,7 +19,7 @@ export type LegacySsoRemoveFlags = CliCommand.Command.Config.Infer<typeof config
 
 export const legacySsoRemoveCommand = Command.make("remove", config).pipe(
   Command.withDescription(
-    "Remove a connection to an already added SSO identity provider. Removing the provider will prevent existing users from logging in.",
+    "Remove a connection to an already added SSO identity provider. Removing the provider will prevent existing users from logging in. Please treat this command with care.",
   ),
   Command.withShortDescription("Remove an existing SSO identity provider"),
   Command.withExamples([
@@ -25,5 +29,11 @@ export const legacySsoRemoveCommand = Command.make("remove", config).pipe(
       description: "Remove an SSO provider by ID",
     },
   ]),
-  Command.withHandler((flags) => legacySsoRemove(flags)),
+  Command.withHandler((flags) =>
+    legacySsoRemove(flags).pipe(
+      withLegacyCommandInstrumentation({ flags, safeFlags: ["project-ref"] }),
+      withJsonErrorHandling,
+    ),
+  ),
+  Command.provide(legacyManagementApiRuntimeLayer(["sso", "remove"])),
 );
diff --git a/apps/cli/src/legacy/commands/sso/remove/remove.handler.ts b/apps/cli/src/legacy/commands/sso/remove/remove.handler.ts
index 296f66c4f9..c3a35f0ef3 100644
--- a/apps/cli/src/legacy/commands/sso/remove/remove.handler.ts
+++ b/apps/cli/src/legacy/commands/sso/remove/remove.handler.ts
@@ -1,13 +1,100 @@
-import { Effect, Option } from "effect";
-import { LegacyGoProxy } from "../../../../shared/legacy/go-proxy.service.ts";
+import type { SupabaseApiError } from "@supabase/api/effect";
+import { Effect, Option, Result } from "effect";
+
+import { LegacyPlatformApi } from "../../../auth/legacy-platform-api.service.ts";
+import { LegacyProjectRefResolver } from "../../../config/legacy-project-ref.service.ts";
+import { LegacyOutputFlag } from "../../../../shared/legacy/global-flags.ts";
+import { Output } from "../../../../shared/output/output.service.ts";
+import { encodeGoJson, encodeToml, encodeYaml } from "../../../shared/legacy-go-output.encoders.ts";
+import { mapLegacyHttpError } from "../../../shared/legacy-http-errors.ts";
+import { LegacyLinkedProjectCache } from "../../../telemetry/legacy-linked-project-cache.service.ts";
+import { LegacyTelemetryState } from "../../../telemetry/legacy-telemetry-state.service.ts";
+import { legacySuggestUpgrade } from "../../../shared/legacy-upgrade-suggest.ts";
+import {
+  LegacySsoRemoveNetworkError,
+  LegacySsoRemoveNotFoundError,
+  LegacySsoRemoveUnexpectedStatusError,
+} from "../sso.errors.ts";
+import { renderSingleProvider, validateUuid } from "../sso.format.ts";
 import type { LegacySsoRemoveFlags } from "./remove.command.ts";
 
+const mapStatusOrNetwork = mapLegacyHttpError({
+  networkError: LegacySsoRemoveNetworkError,
+  statusError: LegacySsoRemoveUnexpectedStatusError,
+  networkMessage: (cause) => `failed to remove sso provider: ${cause}`,
+  statusMessage: (_status, body) => `Unexpected error removing identity provider: ${body}`,
+});
+
+const handleRemoveError = (ref: string, providerId: string, cause: SupabaseApiError) =>
+  Effect.gen(function* () {
+    const mapped = yield* Effect.flip(mapStatusOrNetwork(cause));
+    if (mapped._tag === "LegacySsoRemoveUnexpectedStatusError") {
+      yield* legacySuggestUpgrade({
+        projectRef: ref,
+        featureKey: "auth.saml_2",
+        statusCode: mapped.status,
+      });
+      if (mapped.status === 404) {
+        return yield* Effect.fail(
+          new LegacySsoRemoveNotFoundError({
+            message: `An identity provider with ID ${JSON.stringify(providerId)} could not be found.`,
+          }),
+        );
+      }
+    }
+    return yield* Effect.fail(mapped);
+  });
+
 export const legacySsoRemove = Effect.fn("legacy.sso.remove")(function* (
   flags: LegacySsoRemoveFlags,
 ) {
-  const proxy = yield* LegacyGoProxy;
-  const args: string[] = ["sso", "remove"];
-  if (Option.isSome(flags.projectRef)) args.push("--project-ref", flags.projectRef.value);
-  args.push(flags.providerId);
-  yield* proxy.exec(args);
+  const output = yield* Output;
+  const goOutputFlag = yield* LegacyOutputFlag;
+  const api = yield* LegacyPlatformApi;
+  const resolver = yield* LegacyProjectRefResolver;
+  const linkedProjectCache = yield* LegacyLinkedProjectCache;
+  const telemetryState = yield* LegacyTelemetryState;
+
+  yield* Effect.gen(function* () {
+    const providerId = yield* validateUuid(flags.providerId).pipe(
+      Result.match({ onFailure: Effect.fail, onSuccess: Effect.succeed }),
+    );
+
+    const ref = yield* resolver.resolve(flags.projectRef);
+
+    yield* Effect.gen(function* () {
+      const removing =
+        output.format === "text" ? yield* output.task("Removing SSO provider...") : undefined;
+      const response = yield* api.v1.deleteASsoProvider({ ref, provider_id: providerId }).pipe(
+        Effect.tapError(() => removing?.fail() ?? Effect.void),
+        Effect.catch((cause) => handleRemoveError(ref, providerId, cause)),
+      );
+      yield* removing?.clear() ?? Effect.void;
+
+      const goFmt = Option.getOrUndefined(goOutputFlag);
+
+      if (goFmt === "json") {
+        yield* output.raw(encodeGoJson(response));
+        return;
+      }
+      if (goFmt === "yaml") {
+        yield* output.raw(encodeYaml(response));
+        return;
+      }
+      if (goFmt === "toml") {
+        yield* output.raw(encodeToml(response) + "\n");
+        return;
+      }
+      if (goFmt === "env") {
+        return;
+      }
+
+      if (output.format === "json" || output.format === "stream-json") {
+        yield* output.success("", { ...response });
+        return;
+      }
+
+      yield* output.raw(renderSingleProvider(response));
+    }).pipe(Effect.ensuring(linkedProjectCache.cache(ref)));
+  }).pipe(Effect.ensuring(telemetryState.flush));
 });
diff --git a/apps/cli/src/legacy/commands/sso/remove/remove.integration.test.ts b/apps/cli/src/legacy/commands/sso/remove/remove.integration.test.ts
new file mode 100644
index 0000000000..f9453efa84
--- /dev/null
+++ b/apps/cli/src/legacy/commands/sso/remove/remove.integration.test.ts
@@ -0,0 +1,230 @@
+import { describe, expect, it } from "@effect/vitest";
+import { Effect, Exit, Option } from "effect";
+import * as HttpClientResponse from "effect/unstable/http/HttpClientResponse";
+
+import { mockAnalytics, mockOutput } from "../../../../../tests/helpers/mocks.ts";
+import {
+  buildLegacyTestRuntime,
+  LEGACY_VALID_REF,
+  mockLegacyCliConfig,
+  mockLegacyLinkedProjectCacheTracked,
+  mockLegacyPlatformApi,
+  mockLegacyTelemetryStateTracked,
+  useLegacyTempWorkdir,
+} from "../../../../../tests/helpers/legacy-mocks.ts";
+import { EventUpgradeSuggested } from "../../../../shared/telemetry/event-catalog.ts";
+import { legacySsoRemove } from "./remove.handler.ts";
+
+const VALID_PROVIDER_ID = "b5ae62f9-ef1d-4f11-a02b-731c8bbb11e8";
+
+const PROVIDER = {
+  id: VALID_PROVIDER_ID,
+  saml: { id: "x", entity_id: "https://example.com" },
+  domains: [{ id: "d1", domain: "example.com" }],
+};
+
+const tempRoot = useLegacyTempWorkdir("supabase-sso-remove-int-");
+
+interface SetupOpts {
+  format?: "text" | "json" | "stream-json";
+  goOutput?: "env" | "pretty" | "json" | "toml" | "yaml";
+  status?: number;
+  body?: unknown;
+  network?: "fail";
+  upgradeGate?: "gated" | "notGated";
+}
+
+function jsonResponse(
+  request: Parameters<typeof HttpClientResponse.fromWeb>[0],
+  status: number,
+  body: unknown,
+) {
+  return HttpClientResponse.fromWeb(
+    request,
+    new Response(JSON.stringify(body), {
+      status,
+      headers: { "content-type": "application/json" },
+    }),
+  );
+}
+
+function setup(opts: SetupOpts = {}) {
+  const out = mockOutput({ format: opts.format ?? "text" });
+  const analytics = mockAnalytics();
+  const telemetry = mockLegacyTelemetryStateTracked();
+  const cache = mockLegacyLinkedProjectCacheTracked();
+
+  const status = opts.status ?? 200;
+  const body = opts.body ?? PROVIDER;
+  const gate = opts.upgradeGate;
+
+  const api = mockLegacyPlatformApi({
+    network: opts.network,
+    handler: (request) => {
+      const url = request.url;
+      if (url.includes("/config/auth/sso/providers/") && request.method === "DELETE") {
+        return Effect.succeed(jsonResponse(request, status, body));
+      }
+      if (url.endsWith(`/v1/projects/${LEGACY_VALID_REF}`)) {
+        if (gate === undefined) return Effect.succeed(jsonResponse(request, 404, {}));
+        return Effect.succeed(
+          jsonResponse(request, 200, {
+            id: LEGACY_VALID_REF,
+            ref: LEGACY_VALID_REF,
+            organization_id: "org-id",
+            organization_slug: "acme",
+            name: "Test",
+            region: "us-east-1",
+            created_at: "2023-01-01T00:00:00Z",
+            status: "ACTIVE_HEALTHY",
+            database: {
+              host: "db.example.com",
+              version: "15",
+              postgres_engine: "15",
+              release_channel: "ga",
+            },
+          }),
+        );
+      }
+      if (url.includes("/v1/organizations/acme/entitlements")) {
+        return Effect.succeed(
+          jsonResponse(request, 200, {
+            entitlements: [
+              {
+                feature: { key: "auth.saml_2", type: "boolean" },
+                hasAccess: gate === "notGated",
+                type: "boolean",
+                config: { enabled: false },
+              },
+            ],
+          }),
+        );
+      }
+      return Effect.succeed(jsonResponse(request, 404, {}));
+    },
+  });
+
+  const cliConfig = mockLegacyCliConfig({ workdir: tempRoot.current });
+  const layer = buildLegacyTestRuntime({
+    out,
+    api,
+    cliConfig,
+    telemetry: telemetry.layer,
+    linkedProjectCache: cache.layer,
+    analytics,
+    goOutput: opts.goOutput === undefined ? Option.none() : Option.some(opts.goOutput),
+  });
+
+  return { layer, out, api, analytics, telemetry, cache };
+}
+
+describe("legacy sso remove integration", () => {
+  it.live("rejects bad UUID", () => {
+    const { layer } = setup();
+    return Effect.gen(function* () {
+      const exit = yield* Effect.exit(
+        legacySsoRemove({ projectRef: Option.none(), providerId: "not-a-uuid" }),
+      );
+      expect(Exit.isFailure(exit)).toBe(true);
+      if (Exit.isFailure(exit)) {
+        expect(JSON.stringify(exit.cause)).toContain("LegacySsoInvalidUuidError");
+      }
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("DELETEs the correct path and renders provider in text mode", () => {
+    const { layer, out, api } = setup();
+    return Effect.gen(function* () {
+      yield* legacySsoRemove({ projectRef: Option.none(), providerId: VALID_PROVIDER_ID });
+      const req = api.requests.find((r) => r.method === "DELETE");
+      expect(req?.url).toContain(
+        `/v1/projects/${LEGACY_VALID_REF}/config/auth/sso/providers/${VALID_PROVIDER_ID}`,
+      );
+      expect(out.stdoutText).toContain(VALID_PROVIDER_ID);
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("fails with NotFound on 404", () => {
+    const { layer } = setup({ status: 404, body: {} });
+    return Effect.gen(function* () {
+      const exit = yield* Effect.exit(
+        legacySsoRemove({ projectRef: Option.none(), providerId: VALID_PROVIDER_ID }),
+      );
+      expect(Exit.isFailure(exit)).toBe(true);
+      if (Exit.isFailure(exit)) {
+        expect(JSON.stringify(exit.cause)).toContain("LegacySsoRemoveNotFoundError");
+      }
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("fails with Unexpected on 500", () => {
+    const { layer } = setup({ status: 500, body: { error: "boom" } });
+    return Effect.gen(function* () {
+      const exit = yield* Effect.exit(
+        legacySsoRemove({ projectRef: Option.none(), providerId: VALID_PROVIDER_ID }),
+      );
+      expect(Exit.isFailure(exit)).toBe(true);
+      if (Exit.isFailure(exit)) {
+        const dump = JSON.stringify(exit.cause);
+        expect(dump).toContain("LegacySsoRemoveUnexpectedStatusError");
+        expect(dump).toContain("Unexpected error removing identity provider");
+      }
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("fires cli_upgrade_suggested when gated on 4xx", () => {
+    const { layer, analytics } = setup({ status: 404, body: {}, upgradeGate: "gated" });
+    return Effect.gen(function* () {
+      yield* Effect.exit(
+        legacySsoRemove({ projectRef: Option.none(), providerId: VALID_PROVIDER_ID }),
+      );
+      expect(analytics.captured.some((c) => c.event === EventUpgradeSuggested)).toBe(true);
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("Go --output=env emits nothing", () => {
+    const { layer, out } = setup({ goOutput: "env" });
+    return Effect.gen(function* () {
+      yield* legacySsoRemove({ projectRef: Option.none(), providerId: VALID_PROVIDER_ID });
+      expect(out.stdoutText).toBe("");
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("Go --output=json encodes response verbatim", () => {
+    const { layer, out } = setup({ goOutput: "json" });
+    return Effect.gen(function* () {
+      yield* legacySsoRemove({ projectRef: Option.none(), providerId: VALID_PROVIDER_ID });
+      expect(out.stdoutText).toContain(VALID_PROVIDER_ID);
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("TS --output-format=json emits success", () => {
+    const { layer, out } = setup({ format: "json" });
+    return Effect.gen(function* () {
+      yield* legacySsoRemove({ projectRef: Option.none(), providerId: VALID_PROVIDER_ID });
+      expect(out.messages.some((m) => m.type === "success")).toBe(true);
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("flushes telemetry + linked-project cache on success", () => {
+    const { layer, telemetry, cache } = setup();
+    return Effect.gen(function* () {
+      yield* legacySsoRemove({ projectRef: Option.none(), providerId: VALID_PROVIDER_ID });
+      expect(telemetry.flushed).toBe(true);
+      expect(cache.cached).toBe(true);
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("fails with network error on transport failure", () => {
+    const { layer } = setup({ network: "fail" });
+    return Effect.gen(function* () {
+      const exit = yield* Effect.exit(
+        legacySsoRemove({ projectRef: Option.none(), providerId: VALID_PROVIDER_ID }),
+      );
+      expect(Exit.isFailure(exit)).toBe(true);
+      if (Exit.isFailure(exit)) {
+        expect(JSON.stringify(exit.cause)).toContain("LegacySsoRemoveNetworkError");
+      }
+    }).pipe(Effect.provide(layer));
+  });
+});
diff --git a/apps/cli/src/legacy/commands/sso/show/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/sso/show/SIDE_EFFECTS.md
index 690d06e468..ea25d6e730 100644
--- a/apps/cli/src/legacy/commands/sso/show/SIDE_EFFECTS.md
+++ b/apps/cli/src/legacy/commands/sso/show/SIDE_EFFECTS.md
@@ -2,42 +2,77 @@
 
 ## Files Read
 
-| Path                       | Format                    | When                                                       |
-| -------------------------- | ------------------------- | ---------------------------------------------------------- |
-| `~/.supabase/access-token` | plain text (token string) | when `SUPABASE_ACCESS_TOKEN` unset and keyring unavailable |
+| Path                                           | Format                    | When                                                                                          |
+| ---------------------------------------------- | ------------------------- | --------------------------------------------------------------------------------------------- |
+| keyring `"Supabase CLI"` / `<profile>`         | OS keychain               | when `SUPABASE_ACCESS_TOKEN` unset and keyring available; account = `LegacyCliConfig.profile` |
+| keyring `"Supabase CLI"` / `access-token`      | OS keychain               | legacy-key fallback when the profile-keyed lookup misses                                      |
+| `~/.supabase/access-token`                     | plain text (token string) | last-resort fallback after env + keyring miss                                                 |
+| `<workdir>/supabase/.temp/linked-project.json` | JSON                      | always — `linkedProjectCache` reads to decide whether to write                                |
 
 ## Files Written
 
-| Path | Format | When |
-| ---- | ------ | ---- |
-| —    | —      | —    |
+| Path                                           | Format | When                                                                |
+| ---------------------------------------------- | ------ | ------------------------------------------------------------------- |
+| `~/.supabase/telemetry.json`                   | JSON   | always (`Effect.ensuring(telemetryState.flush)`)                    |
+| `<workdir>/supabase/.temp/linked-project.json` | JSON   | best-effort after `--project-ref` resolves (Go `PersistentPostRun`) |
 
 ## API Routes
 
-| Method | Path                                                         | Auth         | Request body | Response (used fields)                        |
-| ------ | ------------------------------------------------------------ | ------------ | ------------ | --------------------------------------------- |
-| `GET`  | `/v1/projects/{ref}/config/auth/sso/providers/{provider_id}` | Bearer token | none         | `{id, saml, domains, created_at, updated_at}` |
+| Method | Path                                                         | Auth         | Request body | Response (used fields)                            |
+| ------ | ------------------------------------------------------------ | ------------ | ------------ | ------------------------------------------------- |
+| `GET`  | `/v1/projects/{ref}/config/auth/sso/providers/{provider_id}` | Bearer token | none         | `{id, saml?, domains?, created_at?, updated_at?}` |
+
+Note: Unlike `list`/`add`/`update`/`remove`, `show` does **not** make upgrade-gate
+side-calls — matches Go's `get.go`.
 
 ## Environment Variables
 
 | Variable                | Purpose                                              | Required?                                               |
 | ----------------------- | ---------------------------------------------------- | ------------------------------------------------------- |
 | `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `~/.supabase/access-token`) |
-| `SUPABASE_API_URL`      | override Management API base URL                     | no (defaults to `https://api.supabase.com`)             |
+| `SUPABASE_PROFILE`      | profile selector (built-in name or YAML file path)   | no (defaults to `supabase`)                             |
 
 ## Exit Codes
 
-| Code | Condition                                            |
-| ---- | ---------------------------------------------------- |
-| `0`  | success — provider details printed to stdout         |
-| `1`  | authentication error — no valid token found          |
-| `1`  | API error — 404 means provider ID does not exist     |
-| `1`  | API error — non-2xx response from providers endpoint |
-| `1`  | validation error — provider ID is not a valid UUID   |
-| `1`  | network / connection failure                         |
+| Code | Condition                                                         |
+| ---- | ----------------------------------------------------------------- |
+| `0`  | success                                                           |
+| `1`  | `LegacySsoInvalidUuidError` — provider ID is not a canonical UUID |
+| `1`  | `LegacySsoShowNotFoundError` — 404 from get endpoint              |
+| `1`  | `LegacySsoShowUnexpectedStatusError` — other non-2xx              |
+| `1`  | `LegacySsoShowEnvNotSupportedError` — `--output env` with show    |
+| `1`  | `LegacySsoShowNetworkError` — transport-level failure             |
+
+## Telemetry Events Fired
+
+| Event                  | When                                       | Notable properties                                                     |
+| ---------------------- | ------------------------------------------ | ---------------------------------------------------------------------- |
+| `cli_command_executed` | post-run, success or failure (via wrapper) | `exit_code`, `duration_ms`, `flags` (`--project-ref` allowed verbatim) |
+
+## Output
+
+### `--metadata`
+
+Raw `response.saml.metadata_xml` (or empty string) followed by a single newline. Ignores `--output`.
+
+### `--output-format text` / Go `--output pretty`
+
+Glamour-styled property/value markdown table plus optional `## Attribute Mapping` and `## SAML 2.0 Metadata XML` sections.
+
+### `--output json` / `--output yaml` / `--output toml`
+
+Response verbatim (Go-compatible alphabetised keys for JSON).
+
+### `--output env`
+
+**Not supported** — fails with `--output env flag is not supported` (matches Go's `utils.ErrEnvNotSupported` in `apps/cli-go/internal/utils/output.go:41` verbatim).
+
+### `--output-format json` / `stream-json`
+
+Single `success` event with the response as data.
 
 ## Notes
 
-- The `<provider-id>` argument must be a valid UUID.
-- With `--metadata`, outputs the raw SAML 2.0 Metadata XML document instead of the structured provider details.
-- Requires `--project-ref` or a linked project (`.supabase/config.json`).
+- The `<provider-id>` argument must be a valid UUID; invalid input produces `identity provider ID "<input>" is not a UUID`. UUIDs are accepted case-insensitively (matches Go's `uuid.Parse`).
+- `--metadata` short-circuits any `--output` selection.
+- The `## SAML 2.0 Metadata XML` fenced block is pretty-printed via a Go-xmlfmt-equivalent (`formatSsoMetadataXml` in `sso.format.ts`) — byte-parity with `xmlfmt.FormatXML(..., "  ", "  ")` at `apps/cli-go/internal/sso/internal/render/render.go:155`.
diff --git a/apps/cli/src/legacy/commands/sso/show/show.command.ts b/apps/cli/src/legacy/commands/sso/show/show.command.ts
index b5d1639392..2f12dc651a 100644
--- a/apps/cli/src/legacy/commands/sso/show/show.command.ts
+++ b/apps/cli/src/legacy/commands/sso/show/show.command.ts
@@ -1,5 +1,9 @@
 import { Argument, Command, Flag } from "effect/unstable/cli";
 import type * as CliCommand from "effect/unstable/cli/Command";
+
+import { withJsonErrorHandling } from "../../../../shared/output/json-error-handling.ts";
+import { legacyManagementApiRuntimeLayer } from "../../../shared/legacy-management-api-runtime.layer.ts";
+import { withLegacyCommandInstrumentation } from "../../../telemetry/legacy-command-instrumentation.ts";
 import { legacySsoShow } from "./show.handler.ts";
 
 const config = {
@@ -16,7 +20,7 @@ export type LegacySsoShowFlags = CliCommand.Command.Config.Infer<typeof config>;
 
 export const legacySsoShowCommand = Command.make("show", config).pipe(
   Command.withDescription(
-    "Provides the information about an established connection to an identity provider. You can use --metadata to obtain the raw SAML 2.0 Metadata XML document.",
+    "Provides the information about an established connection to an identity provider. You can use --metadata to obtain the raw SAML 2.0 Metadata XML document stored in your project's configuration.",
   ),
   Command.withShortDescription("Show information about an SSO identity provider"),
   Command.withExamples([
@@ -26,5 +30,11 @@ export const legacySsoShowCommand = Command.make("show", config).pipe(
       description: "Show SSO provider details",
     },
   ]),
-  Command.withHandler((flags) => legacySsoShow(flags)),
+  Command.withHandler((flags) =>
+    legacySsoShow(flags).pipe(
+      withLegacyCommandInstrumentation({ flags, safeFlags: ["project-ref"] }),
+      withJsonErrorHandling,
+    ),
+  ),
+  Command.provide(legacyManagementApiRuntimeLayer(["sso", "show"])),
 );
diff --git a/apps/cli/src/legacy/commands/sso/show/show.handler.ts b/apps/cli/src/legacy/commands/sso/show/show.handler.ts
index 519ad3a9a6..cd35e4495c 100644
--- a/apps/cli/src/legacy/commands/sso/show/show.handler.ts
+++ b/apps/cli/src/legacy/commands/sso/show/show.handler.ts
@@ -1,12 +1,105 @@
-import { Effect, Option } from "effect";
-import { LegacyGoProxy } from "../../../../shared/legacy/go-proxy.service.ts";
+import type { SupabaseApiError } from "@supabase/api/effect";
+import { Effect, Option, Result } from "effect";
+
+import { LegacyPlatformApi } from "../../../auth/legacy-platform-api.service.ts";
+import { LegacyProjectRefResolver } from "../../../config/legacy-project-ref.service.ts";
+import { LegacyOutputFlag } from "../../../../shared/legacy/global-flags.ts";
+import { Output } from "../../../../shared/output/output.service.ts";
+import { encodeGoJson, encodeToml, encodeYaml } from "../../../shared/legacy-go-output.encoders.ts";
+import { mapLegacyHttpError } from "../../../shared/legacy-http-errors.ts";
+import { LegacyLinkedProjectCache } from "../../../telemetry/legacy-linked-project-cache.service.ts";
+import { LegacyTelemetryState } from "../../../telemetry/legacy-telemetry-state.service.ts";
+import {
+  LegacySsoShowEnvNotSupportedError,
+  LegacySsoShowNetworkError,
+  LegacySsoShowNotFoundError,
+  LegacySsoShowUnexpectedStatusError,
+} from "../sso.errors.ts";
+import { renderSingleProvider, validateUuid } from "../sso.format.ts";
 import type { LegacySsoShowFlags } from "./show.command.ts";
 
+const mapStatusOrNetwork = mapLegacyHttpError({
+  networkError: LegacySsoShowNetworkError,
+  statusError: LegacySsoShowUnexpectedStatusError,
+  networkMessage: (cause) => `failed to get sso provider: ${cause}`,
+  statusMessage: (_status, body) => `Unexpected error fetching identity provider: ${body}`,
+});
+
+const handleShowError = (providerId: string, cause: SupabaseApiError) =>
+  Effect.gen(function* () {
+    const mapped = yield* Effect.flip(mapStatusOrNetwork(cause));
+    // Go's `get.go` does NOT call SuggestUpgradeOnError — `show` is intentionally
+    // omitted from the upgrade-suggestion paths (see plan §"Telemetry parity").
+    if (mapped._tag === "LegacySsoShowUnexpectedStatusError" && mapped.status === 404) {
+      return yield* Effect.fail(
+        new LegacySsoShowNotFoundError({
+          message: `An identity provider with ID ${JSON.stringify(providerId)} could not be found.`,
+        }),
+      );
+    }
+    return yield* Effect.fail(mapped);
+  });
+
 export const legacySsoShow = Effect.fn("legacy.sso.show")(function* (flags: LegacySsoShowFlags) {
-  const proxy = yield* LegacyGoProxy;
-  const args: string[] = ["sso", "show"];
-  if (Option.isSome(flags.projectRef)) args.push("--project-ref", flags.projectRef.value);
-  if (flags.metadata) args.push("--metadata");
-  args.push(flags.providerId);
-  yield* proxy.exec(args);
+  const output = yield* Output;
+  const goOutputFlag = yield* LegacyOutputFlag;
+  const api = yield* LegacyPlatformApi;
+  const resolver = yield* LegacyProjectRefResolver;
+  const linkedProjectCache = yield* LegacyLinkedProjectCache;
+  const telemetryState = yield* LegacyTelemetryState;
+
+  yield* Effect.gen(function* () {
+    const providerId = yield* validateUuid(flags.providerId).pipe(
+      Result.match({ onFailure: Effect.fail, onSuccess: Effect.succeed }),
+    );
+
+    const ref = yield* resolver.resolve(flags.projectRef);
+
+    yield* Effect.gen(function* () {
+      const fetching =
+        output.format === "text" ? yield* output.task("Fetching SSO provider...") : undefined;
+      const response = yield* api.v1.getASsoProvider({ ref, provider_id: providerId }).pipe(
+        Effect.tapError(() => fetching?.fail() ?? Effect.void),
+        Effect.catch((cause) => handleShowError(providerId, cause)),
+      );
+      yield* fetching?.clear() ?? Effect.void;
+
+      // `--metadata` short-circuits regardless of `--output` — Go's `get.go:33-36`.
+      if (flags.metadata) {
+        yield* output.raw((response.saml?.metadata_xml ?? "") + "\n");
+        return;
+      }
+
+      const goFmt = Option.getOrUndefined(goOutputFlag);
+
+      if (goFmt === "env") {
+        // Matches Go's `utils.ErrEnvNotSupported` verbatim
+        // (`apps/cli-go/internal/utils/output.go:41`).
+        return yield* Effect.fail(
+          new LegacySsoShowEnvNotSupportedError({
+            message: "--output env flag is not supported",
+          }),
+        );
+      }
+      if (goFmt === "json") {
+        yield* output.raw(encodeGoJson(response));
+        return;
+      }
+      if (goFmt === "yaml") {
+        yield* output.raw(encodeYaml(response));
+        return;
+      }
+      if (goFmt === "toml") {
+        yield* output.raw(encodeToml(response) + "\n");
+        return;
+      }
+
+      if (output.format === "json" || output.format === "stream-json") {
+        yield* output.success("", { ...response });
+        return;
+      }
+
+      yield* output.raw(renderSingleProvider(response));
+    }).pipe(Effect.ensuring(linkedProjectCache.cache(ref)));
+  }).pipe(Effect.ensuring(telemetryState.flush));
 });
diff --git a/apps/cli/src/legacy/commands/sso/show/show.integration.test.ts b/apps/cli/src/legacy/commands/sso/show/show.integration.test.ts
new file mode 100644
index 0000000000..fcaf74702f
--- /dev/null
+++ b/apps/cli/src/legacy/commands/sso/show/show.integration.test.ts
@@ -0,0 +1,305 @@
+import { describe, expect, it } from "@effect/vitest";
+import { Effect, Exit, Option } from "effect";
+
+import { mockAnalytics, mockOutput } from "../../../../../tests/helpers/mocks.ts";
+import {
+  buildLegacyTestRuntime,
+  LEGACY_VALID_REF,
+  mockLegacyCliConfig,
+  mockLegacyLinkedProjectCacheTracked,
+  mockLegacyPlatformApi,
+  mockLegacyTelemetryStateTracked,
+  useLegacyTempWorkdir,
+} from "../../../../../tests/helpers/legacy-mocks.ts";
+import { EventUpgradeSuggested } from "../../../../shared/telemetry/event-catalog.ts";
+import { legacySsoShow } from "./show.handler.ts";
+
+const VALID_PROVIDER_ID = "b5ae62f9-ef1d-4f11-a02b-731c8bbb11e8";
+
+const PROVIDER = {
+  id: VALID_PROVIDER_ID,
+  saml: {
+    id: "8682fcf4-4056-455c-bd93-f33295604929",
+    entity_id: "https://example.com",
+    metadata_url: "https://example.com",
+    metadata_xml: '<?xml version="2.0"?>',
+  },
+  domains: [{ id: "d1", domain: "example.com" }],
+  created_at: "2023-03-28T13:50:14.464Z",
+  updated_at: "2023-03-28T13:50:14.464Z",
+};
+
+const tempRoot = useLegacyTempWorkdir("supabase-sso-show-int-");
+
+interface SetupOpts {
+  format?: "text" | "json" | "stream-json";
+  goOutput?: "env" | "pretty" | "json" | "toml" | "yaml";
+  status?: number;
+  body?: unknown;
+  network?: "fail";
+}
+
+function setup(opts: SetupOpts = {}) {
+  const out = mockOutput({ format: opts.format ?? "text" });
+  const analytics = mockAnalytics();
+  const telemetry = mockLegacyTelemetryStateTracked();
+  const cache = mockLegacyLinkedProjectCacheTracked();
+
+  const api = mockLegacyPlatformApi({
+    network: opts.network,
+    response: { status: opts.status ?? 200, body: opts.body ?? PROVIDER },
+  });
+
+  const cliConfig = mockLegacyCliConfig({ workdir: tempRoot.current });
+  const layer = buildLegacyTestRuntime({
+    out,
+    api,
+    cliConfig,
+    telemetry: telemetry.layer,
+    linkedProjectCache: cache.layer,
+    analytics,
+    goOutput: opts.goOutput === undefined ? Option.none() : Option.some(opts.goOutput),
+  });
+
+  return { layer, out, api, analytics, telemetry, cache };
+}
+
+describe("legacy sso show integration", () => {
+  it.live("rejects bad UUID with Go-format message", () => {
+    const { layer } = setup();
+    return Effect.gen(function* () {
+      const exit = yield* Effect.exit(
+        legacySsoShow({
+          projectRef: Option.none(),
+          providerId: "not-a-uuid",
+          metadata: false,
+        }),
+      );
+      expect(Exit.isFailure(exit)).toBe(true);
+      if (Exit.isFailure(exit)) {
+        const dump = JSON.stringify(exit.cause);
+        expect(dump).toContain("LegacySsoInvalidUuidError");
+        expect(dump).toContain('identity provider ID \\"not-a-uuid\\" is not a UUID');
+      }
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("renders single-provider markdown for valid UUID + 200", () => {
+    const { layer, out } = setup();
+    return Effect.gen(function* () {
+      yield* legacySsoShow({
+        projectRef: Option.none(),
+        providerId: VALID_PROVIDER_ID,
+        metadata: false,
+      });
+      expect(out.stdoutText).toContain("IDENTITY PROVIDER ID");
+      expect(out.stdoutText).toContain(VALID_PROVIDER_ID);
+      expect(out.stdoutText).toContain("https://example.com");
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("fails with NotFound on 404", () => {
+    const { layer } = setup({ status: 404, body: {} });
+    return Effect.gen(function* () {
+      const exit = yield* Effect.exit(
+        legacySsoShow({
+          projectRef: Option.none(),
+          providerId: VALID_PROVIDER_ID,
+          metadata: false,
+        }),
+      );
+      expect(Exit.isFailure(exit)).toBe(true);
+      if (Exit.isFailure(exit)) {
+        const dump = JSON.stringify(exit.cause);
+        expect(dump).toContain("LegacySsoShowNotFoundError");
+        expect(dump).toContain("An identity provider with ID");
+        expect(dump).toContain("could not be found");
+      }
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("fails with Unexpected on 500", () => {
+    const { layer } = setup({ status: 500, body: { error: "boom" } });
+    return Effect.gen(function* () {
+      const exit = yield* Effect.exit(
+        legacySsoShow({
+          projectRef: Option.none(),
+          providerId: VALID_PROVIDER_ID,
+          metadata: false,
+        }),
+      );
+      expect(Exit.isFailure(exit)).toBe(true);
+      if (Exit.isFailure(exit)) {
+        const dump = JSON.stringify(exit.cause);
+        expect(dump).toContain("LegacySsoShowUnexpectedStatusError");
+        expect(dump).toContain("Unexpected error fetching identity provider");
+      }
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("fails with network error on transport failure", () => {
+    const { layer } = setup({ network: "fail" });
+    return Effect.gen(function* () {
+      const exit = yield* Effect.exit(
+        legacySsoShow({
+          projectRef: Option.none(),
+          providerId: VALID_PROVIDER_ID,
+          metadata: false,
+        }),
+      );
+      expect(Exit.isFailure(exit)).toBe(true);
+      if (Exit.isFailure(exit)) {
+        expect(JSON.stringify(exit.cause)).toContain("LegacySsoShowNetworkError");
+      }
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("Go --output=env returns env-not-supported error with Go-format message", () => {
+    const { layer } = setup({ goOutput: "env" });
+    return Effect.gen(function* () {
+      const exit = yield* Effect.exit(
+        legacySsoShow({
+          projectRef: Option.none(),
+          providerId: VALID_PROVIDER_ID,
+          metadata: false,
+        }),
+      );
+      expect(Exit.isFailure(exit)).toBe(true);
+      if (Exit.isFailure(exit)) {
+        const dump = JSON.stringify(exit.cause);
+        expect(dump).toContain("LegacySsoShowEnvNotSupportedError");
+        // Go's `utils.ErrEnvNotSupported` verbatim.
+        expect(dump).toContain("--output env flag is not supported");
+      }
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("Go --output=json encodes response", () => {
+    const { layer, out } = setup({ goOutput: "json" });
+    return Effect.gen(function* () {
+      yield* legacySsoShow({
+        projectRef: Option.none(),
+        providerId: VALID_PROVIDER_ID,
+        metadata: false,
+      });
+      expect(out.stdoutText.startsWith("{")).toBe(true);
+      expect(out.stdoutText).toContain(VALID_PROVIDER_ID);
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("Go --output=yaml encodes response", () => {
+    const { layer, out } = setup({ goOutput: "yaml" });
+    return Effect.gen(function* () {
+      yield* legacySsoShow({
+        projectRef: Option.none(),
+        providerId: VALID_PROVIDER_ID,
+        metadata: false,
+      });
+      expect(out.stdoutText).toContain(VALID_PROVIDER_ID);
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("Go --output=toml encodes response", () => {
+    const { layer, out } = setup({ goOutput: "toml" });
+    return Effect.gen(function* () {
+      yield* legacySsoShow({
+        projectRef: Option.none(),
+        providerId: VALID_PROVIDER_ID,
+        metadata: false,
+      });
+      expect(out.stdoutText).toContain(VALID_PROVIDER_ID);
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("TS --output-format=json emits success", () => {
+    const { layer, out } = setup({ format: "json" });
+    return Effect.gen(function* () {
+      yield* legacySsoShow({
+        projectRef: Option.none(),
+        providerId: VALID_PROVIDER_ID,
+        metadata: false,
+      });
+      const success = out.messages.find((m) => m.type === "success");
+      expect(success).toBeDefined();
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("Go --output=pretty matches text mode", () => {
+    const { layer, out } = setup({ goOutput: "pretty" });
+    return Effect.gen(function* () {
+      yield* legacySsoShow({
+        projectRef: Option.none(),
+        providerId: VALID_PROVIDER_ID,
+        metadata: false,
+      });
+      expect(out.stdoutText).toContain(VALID_PROVIDER_ID);
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("--metadata short-circuits and prints raw XML", () => {
+    const { layer, out } = setup();
+    return Effect.gen(function* () {
+      yield* legacySsoShow({
+        projectRef: Option.none(),
+        providerId: VALID_PROVIDER_ID,
+        metadata: true,
+      });
+      expect(out.stdoutText).toBe('<?xml version="2.0"?>\n');
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("--metadata prints empty string + newline when metadata_xml absent", () => {
+    const { layer, out } = setup({ body: { id: VALID_PROVIDER_ID } });
+    return Effect.gen(function* () {
+      yield* legacySsoShow({
+        projectRef: Option.none(),
+        providerId: VALID_PROVIDER_ID,
+        metadata: true,
+      });
+      expect(out.stdoutText).toBe("\n");
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("does NOT fire cli_upgrade_suggested on 404 (Go's `show` omits it)", () => {
+    const { layer, analytics } = setup({ status: 404, body: {} });
+    return Effect.gen(function* () {
+      yield* Effect.exit(
+        legacySsoShow({
+          projectRef: Option.none(),
+          providerId: VALID_PROVIDER_ID,
+          metadata: false,
+        }),
+      );
+      expect(analytics.captured.some((c) => c.event === EventUpgradeSuggested)).toBe(false);
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("flushes telemetry + linked-project cache on success", () => {
+    const { layer, telemetry, cache } = setup();
+    return Effect.gen(function* () {
+      yield* legacySsoShow({
+        projectRef: Option.none(),
+        providerId: VALID_PROVIDER_ID,
+        metadata: false,
+      });
+      expect(telemetry.flushed).toBe(true);
+      expect(cache.cached).toBe(true);
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("hits GET /v1/projects/{ref}/config/auth/sso/providers/{id}", () => {
+    const { layer, api } = setup();
+    return Effect.gen(function* () {
+      yield* legacySsoShow({
+        projectRef: Option.none(),
+        providerId: VALID_PROVIDER_ID,
+        metadata: false,
+      });
+      const req = api.requests.find((r) => r.url.includes(VALID_PROVIDER_ID));
+      expect(req?.method).toBe("GET");
+      expect(req?.url).toContain(
+        `/v1/projects/${LEGACY_VALID_REF}/config/auth/sso/providers/${VALID_PROVIDER_ID}`,
+      );
+    }).pipe(Effect.provide(layer));
+  });
+});
diff --git a/apps/cli/src/legacy/commands/sso/sso.e2e.test.ts b/apps/cli/src/legacy/commands/sso/sso.e2e.test.ts
new file mode 100644
index 0000000000..795b71200a
--- /dev/null
+++ b/apps/cli/src/legacy/commands/sso/sso.e2e.test.ts
@@ -0,0 +1,72 @@
+import { describe, expect, test } from "vitest";
+import { runSupabase } from "../../../../tests/helpers/cli.ts";
+
+const E2E_TIMEOUT_MS = 30_000;
+const TEST_PROJECT_REF = "abcdefghijklmnopqrst";
+const TEST_TOKEN = "sbp_" + "a".repeat(40);
+
+describe("supabase sso (legacy)", () => {
+  test(
+    "info --output-format=json emits derived URLs (no auth needed)",
+    { timeout: E2E_TIMEOUT_MS },
+    async () => {
+      const { exitCode, stdout } = await runSupabase(
+        ["sso", "info", "--project-ref", TEST_PROJECT_REF, "--output-format", "json"],
+        { entrypoint: "legacy", env: { SUPABASE_ACCESS_TOKEN: TEST_TOKEN } },
+      );
+      expect(exitCode).toBe(0);
+      expect(stdout).toContain(`https://${TEST_PROJECT_REF}.supabase.co/auth/v1/sso/saml/acs`);
+      expect(stdout).toContain(`https://${TEST_PROJECT_REF}.supabase.co/auth/v1/sso/saml/metadata`);
+      expect(stdout).toContain(`https://${TEST_PROJECT_REF}.supabase.co`);
+    },
+  );
+
+  test("info text mode prints all three URLs", { timeout: E2E_TIMEOUT_MS }, async () => {
+    const { exitCode, stdout } = await runSupabase(
+      ["sso", "info", "--project-ref", TEST_PROJECT_REF],
+      { entrypoint: "legacy", env: { SUPABASE_ACCESS_TOKEN: TEST_TOKEN } },
+    );
+    expect(exitCode).toBe(0);
+    expect(stdout).toContain(`https://${TEST_PROJECT_REF}.supabase.co/auth/v1/sso/saml/acs`);
+    expect(stdout).toContain(`https://${TEST_PROJECT_REF}.supabase.co/auth/v1/sso/saml/metadata`);
+  });
+
+  test(
+    "show with invalid UUID exits 1 with Go-format message",
+    { timeout: E2E_TIMEOUT_MS },
+    async () => {
+      const { exitCode, stdout, stderr } = await runSupabase(
+        ["sso", "show", "not-a-uuid", "--project-ref", TEST_PROJECT_REF],
+        { entrypoint: "legacy", env: { SUPABASE_ACCESS_TOKEN: TEST_TOKEN } },
+      );
+      expect(exitCode).toBe(1);
+      expect(`${stdout}${stderr}`).toContain(`identity provider ID "not-a-uuid" is not a UUID`);
+    },
+  );
+
+  test(
+    "remove with invalid UUID exits 1 with Go-format message",
+    { timeout: E2E_TIMEOUT_MS },
+    async () => {
+      const { exitCode, stdout, stderr } = await runSupabase(
+        ["sso", "remove", "not-a-uuid", "--project-ref", TEST_PROJECT_REF],
+        { entrypoint: "legacy", env: { SUPABASE_ACCESS_TOKEN: TEST_TOKEN } },
+      );
+      expect(exitCode).toBe(1);
+      expect(`${stdout}${stderr}`).toContain(`identity provider ID "not-a-uuid" is not a UUID`);
+    },
+  );
+
+  test(
+    "update with invalid UUID exits 1 with Go-format message",
+    { timeout: E2E_TIMEOUT_MS },
+    async () => {
+      const { exitCode, stdout, stderr } = await runSupabase(
+        ["sso", "update", "not-a-uuid", "--project-ref", TEST_PROJECT_REF],
+        { entrypoint: "legacy", env: { SUPABASE_ACCESS_TOKEN: TEST_TOKEN } },
+      );
+      expect(exitCode).toBe(1);
+      expect(`${stdout}${stderr}`).toContain(`identity provider ID "not-a-uuid" is not a UUID`);
+    },
+  );
+});
diff --git a/apps/cli/src/legacy/commands/sso/sso.errors.ts b/apps/cli/src/legacy/commands/sso/sso.errors.ts
new file mode 100644
index 0000000000..55630760c0
--- /dev/null
+++ b/apps/cli/src/legacy/commands/sso/sso.errors.ts
@@ -0,0 +1,152 @@
+import { Data } from "effect";
+
+// Shared across show / update / remove: Go's `uuid.Parse` failure.
+// Message intentionally diverges from Go's verbose `failed to parse provider ID: invalid UUID …`
+// — the legacy/sso port consolidates to a single short string `identity provider ID %q is not a UUID`
+// that's directly user-actionable and tested in e2e.
+export class LegacySsoInvalidUuidError extends Data.TaggedError("LegacySsoInvalidUuidError")<{
+  readonly providerId: string;
+  readonly message: string;
+}> {}
+
+// `sso list`
+export class LegacySsoListNetworkError extends Data.TaggedError("LegacySsoListNetworkError")<{
+  readonly message: string;
+}> {}
+
+export class LegacySsoListSamlDisabledError extends Data.TaggedError(
+  "LegacySsoListSamlDisabledError",
+)<{
+  readonly message: string;
+}> {}
+
+export class LegacySsoListUnexpectedStatusError extends Data.TaggedError(
+  "LegacySsoListUnexpectedStatusError",
+)<{
+  readonly status: number;
+  readonly body: string;
+  readonly message: string;
+}> {}
+
+// `sso add`
+export class LegacySsoAddNetworkError extends Data.TaggedError("LegacySsoAddNetworkError")<{
+  readonly message: string;
+}> {}
+
+export class LegacySsoAddSamlDisabledError extends Data.TaggedError(
+  "LegacySsoAddSamlDisabledError",
+)<{
+  readonly message: string;
+}> {}
+
+export class LegacySsoAddUnexpectedStatusError extends Data.TaggedError(
+  "LegacySsoAddUnexpectedStatusError",
+)<{
+  readonly status: number;
+  readonly body: string;
+  readonly message: string;
+}> {}
+
+export class LegacySsoAddMetadataFileError extends Data.TaggedError(
+  "LegacySsoAddMetadataFileError",
+)<{
+  readonly message: string;
+}> {}
+
+export class LegacySsoAddAttributeMappingFileError extends Data.TaggedError(
+  "LegacySsoAddAttributeMappingFileError",
+)<{
+  readonly message: string;
+}> {}
+
+export class LegacySsoMutexFlagError extends Data.TaggedError("LegacySsoMutexFlagError")<{
+  readonly message: string;
+}> {}
+
+// Shared across add + update — metadata URL validation.
+export class LegacySsoMetadataUrlInvalidError extends Data.TaggedError(
+  "LegacySsoMetadataUrlInvalidError",
+)<{
+  readonly message: string;
+}> {}
+
+export class LegacySsoMetadataUrlNetworkError extends Data.TaggedError(
+  "LegacySsoMetadataUrlNetworkError",
+)<{
+  readonly message: string;
+}> {}
+
+export class LegacySsoMetadataUrlNonUtf8Error extends Data.TaggedError(
+  "LegacySsoMetadataUrlNonUtf8Error",
+)<{
+  readonly message: string;
+}> {}
+
+// `sso show`
+export class LegacySsoShowNetworkError extends Data.TaggedError("LegacySsoShowNetworkError")<{
+  readonly message: string;
+}> {}
+
+export class LegacySsoShowNotFoundError extends Data.TaggedError("LegacySsoShowNotFoundError")<{
+  readonly message: string;
+}> {}
+
+export class LegacySsoShowUnexpectedStatusError extends Data.TaggedError(
+  "LegacySsoShowUnexpectedStatusError",
+)<{
+  readonly status: number;
+  readonly body: string;
+  readonly message: string;
+}> {}
+
+export class LegacySsoShowEnvNotSupportedError extends Data.TaggedError(
+  "LegacySsoShowEnvNotSupportedError",
+)<{
+  readonly message: string;
+}> {}
+
+// `sso update`
+export class LegacySsoUpdateNetworkError extends Data.TaggedError("LegacySsoUpdateNetworkError")<{
+  readonly message: string;
+}> {}
+
+export class LegacySsoUpdateNotFoundError extends Data.TaggedError("LegacySsoUpdateNotFoundError")<{
+  readonly message: string;
+}> {}
+
+export class LegacySsoUpdateUnexpectedStatusError extends Data.TaggedError(
+  "LegacySsoUpdateUnexpectedStatusError",
+)<{
+  readonly status: number;
+  readonly body: string;
+  readonly message: string;
+}> {}
+
+export class LegacySsoUpdateMetadataFileError extends Data.TaggedError(
+  "LegacySsoUpdateMetadataFileError",
+)<{
+  readonly message: string;
+}> {}
+
+export class LegacySsoUpdateAttributeMappingFileError extends Data.TaggedError(
+  "LegacySsoUpdateAttributeMappingFileError",
+)<{
+  readonly message: string;
+}> {}
+
+// `sso remove`
+export class LegacySsoRemoveNetworkError extends Data.TaggedError("LegacySsoRemoveNetworkError")<{
+  readonly message: string;
+}> {}
+
+export class LegacySsoRemoveNotFoundError extends Data.TaggedError("LegacySsoRemoveNotFoundError")<{
+  readonly message: string;
+}> {}
+
+export class LegacySsoRemoveUnexpectedStatusError extends Data.TaggedError(
+  "LegacySsoRemoveUnexpectedStatusError",
+)<{
+  readonly status: number;
+  readonly body: string;
+  readonly message: string;
+}> {}
diff --git a/apps/cli/src/legacy/commands/sso/sso.format.ts b/apps/cli/src/legacy/commands/sso/sso.format.ts
new file mode 100644
index 0000000000..107fe5f067
--- /dev/null
+++ b/apps/cli/src/legacy/commands/sso/sso.format.ts
@@ -0,0 +1,321 @@
+import { Result } from "effect";
+
+import { renderGlamourTable } from "../../output/legacy-glamour-table.ts";
+import { LegacySsoInvalidUuidError } from "./sso.errors.ts";
+
+// Go's `uuid.Parse` accepts both lower- and upper-case hex digits, and the
+// `cmd/sso.go` UUID guards (lines 79, 91, 123) use `utils.UUIDPattern` which is
+// declared as `[0-9a-f]` but matched against argv that's already been lowercased
+// by Cobra's argument handling. Mirroring the user-facing behaviour, we match
+// case-insensitively so callers passing `B5AE62F9-…` succeed.
+const UUID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+
+/**
+ * Permissive shape that covers both the typed-client output
+ * (`V1GetASsoProviderOutput` / list items) and arbitrary JSON returned by the
+ * raw POST/PUT path. `attribute_mapping` is left as `unknown` so we can render
+ * provider responses that carry user-defined keys (Go preserves these via its
+ * inline struct with `default *any`).
+ */
+export interface LegacySsoProviderView {
+  readonly id: string;
+  readonly saml?: {
+    readonly entity_id?: string;
+    readonly metadata_url?: string;
+    readonly metadata_xml?: string;
+    readonly name_id_format?: string;
+    readonly attribute_mapping?: unknown;
+  };
+  readonly domains?: ReadonlyArray<{ readonly domain?: string }>;
+  readonly created_at?: string;
+  readonly updated_at?: string;
+}
+
+/**
+ * Defensive extraction for the raw-HTTP add/update path. The response is
+ * untyped (we bypass the generated schema to preserve `attribute_mapping.keys.<x>.default`),
+ * so the formatter coerces an arbitrary object into the provider view shape
+ * without throwing on missing fields.
+ */
+export function toLegacySsoProviderView(value: unknown): LegacySsoProviderView {
+  if (typeof value !== "object" || value === null) {
+    return { id: "" };
+  }
+  const root = value as Record<string, unknown>;
+  const samlRaw = root["saml"];
+  const saml =
+    samlRaw !== undefined && typeof samlRaw === "object" && samlRaw !== null
+      ? (samlRaw as Record<string, unknown>)
+      : undefined;
+
+  const domainsRaw = root["domains"];
+  const domains = Array.isArray(domainsRaw)
+    ? domainsRaw
+        .filter((d): d is Record<string, unknown> => typeof d === "object" && d !== null)
+        .map((d) => ({ domain: typeof d["domain"] === "string" ? d["domain"] : undefined }))
+    : undefined;
+
+  return {
+    id: typeof root["id"] === "string" ? root["id"] : "",
+    saml:
+      saml === undefined
+        ? undefined
+        : {
+            entity_id: typeof saml["entity_id"] === "string" ? saml["entity_id"] : undefined,
+            metadata_url:
+              typeof saml["metadata_url"] === "string" ? saml["metadata_url"] : undefined,
+            metadata_xml:
+              typeof saml["metadata_xml"] === "string" ? saml["metadata_xml"] : undefined,
+            name_id_format:
+              typeof saml["name_id_format"] === "string" ? saml["name_id_format"] : undefined,
+            attribute_mapping: saml["attribute_mapping"],
+          },
+    domains,
+    created_at: typeof root["created_at"] === "string" ? root["created_at"] : undefined,
+    updated_at: typeof root["updated_at"] === "string" ? root["updated_at"] : undefined,
+  };
+}
+
+/**
+ * Validates a positional provider-id argument as a canonical UUID.
+ * Failure message uses Go's `%q` quoting (JSON.stringify wraps the raw input).
+ */
+export function validateUuid(input: string): Result.Result<string, LegacySsoInvalidUuidError> {
+  if (UUID_PATTERN.test(input)) {
+    return Result.succeed(input);
+  }
+  return Result.fail(
+    new LegacySsoInvalidUuidError({
+      providerId: input,
+      message: `identity provider ID ${JSON.stringify(input)} is not a UUID`,
+    }),
+  );
+}
+
+const pad2 = (n: number): string => String(n).padStart(2, "0");
+
+/**
+ * RFC3339 → `YYYY-MM-DD HH:MM:SS` (UTC, no timezone label).
+ * Mirrors Go's `utils.FormatTimestamp` (which composes `time.Parse(RFC3339, …)`
+ * with `FormatTime` → `t.UTC().Format("2006-01-02 15:04:05")`).
+ */
+export function formatSsoTimestamp(input?: string): string {
+  if (input === undefined || input === null) return "";
+  const date = new Date(input);
+  if (Number.isNaN(date.getTime())) return input;
+  return (
+    `${date.getUTCFullYear()}-${pad2(date.getUTCMonth() + 1)}-${pad2(date.getUTCDate())} ` +
+    `${pad2(date.getUTCHours())}:${pad2(date.getUTCMinutes())}:${pad2(date.getUTCSeconds())}`
+  );
+}
+
+export function formatProtocol(saml: LegacySsoProviderView["saml"]): string {
+  return saml === undefined ? "unknown" : "SAML 2.0";
+}
+
+export function formatDomains(domains: LegacySsoProviderView["domains"]): string {
+  if (domains === undefined) return "-";
+  const list = domains
+    .map((d) => d.domain)
+    .filter((d): d is string => typeof d === "string" && d.length > 0);
+  return list.length === 0 ? "-" : list.join(", ");
+}
+
+export function formatEntityId(saml: LegacySsoProviderView["saml"]): string {
+  if (saml === undefined) return "-";
+  return saml.entity_id !== undefined && saml.entity_id !== "" ? saml.entity_id : "-";
+}
+
+export function formatNameIdFormat(saml: LegacySsoProviderView["saml"]): string {
+  if (saml === undefined) return "-";
+  return saml.name_id_format !== undefined && saml.name_id_format !== ""
+    ? saml.name_id_format
+    : "-";
+}
+
+export function formatMetadataSource(saml: LegacySsoProviderView["saml"]): string {
+  if (saml === undefined) return "FILE";
+  return saml.metadata_url !== undefined && saml.metadata_url !== "" ? saml.metadata_url : "FILE";
+}
+
+// Tag matcher mirroring go-xmlfmt's `reg`: captures opening, closing, comment,
+// declaration, and self-closing tags. Non-greedy inner body so we don't span
+// across consecutive `<…>` clusters.
+const XMLFMT_TAG_RE = /<([/!]?)([^>]+?)(\/?)>/g;
+const XMLFMT_INTERTAG_SPACES_RE = />\s+</g;
+
+/**
+ * Pretty-prints an XML document by inserting newlines and indentation between
+ * tags. Behaviour-compatible port of `github.com/go-xmlfmt/xmlfmt@v1.1.3`
+ * `FormatXML(xml, prefix, indent)` (without the nested-tags-in-comments
+ * branch, which Go's SSO render never enables). Each tag boundary becomes
+ * `\n + prefix + indent.repeat(depth) + <tag>`; opening tags increment depth
+ * after emission, closing tags decrement before. Text content between
+ * adjacent open/close tags (e.g. `<b>text</b>`) is preserved inline so the
+ * close tag rides the same line.
+ *
+ * Used to match Go's `xmlfmt.FormatXML(metadata_xml, "  ", "  ")` call in
+ * `apps/cli-go/internal/sso/internal/render/render.go:155`.
+ */
+export function formatSsoMetadataXml(xml: string, prefix = "  ", indent = "  "): string {
+  // Collapse whitespace between adjacent tags so we control the layout.
+  const src = xml.replace(XMLFMT_INTERTAG_SPACES_RE, "><");
+
+  let depth = 0;
+  // Tracks whether the previous tag was a closing or self-closing tag.
+  // Used to decide whether a closing tag rides the same line as adjacent
+  // content (lastEndElem=false → inline close, e.g. `<b>text</b>`).
+  let lastEndElem = true;
+
+  const replaced = src.replace(XMLFMT_TAG_RE, (match) => {
+    if (match.startsWith("<?xml")) {
+      return "\n" + prefix + indent.repeat(depth) + match;
+    }
+    if (match.endsWith("/>")) {
+      lastEndElem = true;
+      return "\n" + prefix + indent.repeat(depth) + match;
+    }
+    if (match.startsWith("<!")) {
+      return "\n" + prefix + indent.repeat(depth) + match;
+    }
+    if (match.startsWith("</")) {
+      depth--;
+      if (lastEndElem) {
+        return "\n" + prefix + indent.repeat(depth) + match;
+      }
+      lastEndElem = true;
+      return match;
+    }
+    // Opening tag: emit at the current depth, then descend for children.
+    lastEndElem = false;
+    const result = "\n" + prefix + indent.repeat(depth) + match;
+    depth++;
+    return result;
+  });
+
+  return prefix + replaced;
+}
+
+// Go's markdown source writes the header as `SAML 2.0 \`EntityID\``; Glamour
+// renders the backticks as an inline-code span which is stripped to plain text
+// under AsciiStyle. `renderGlamourTable` is a flat ASCII renderer with no
+// markdown awareness, so we drop the backticks here at the source for byte
+// parity with Glamour's rendered output.
+const LIST_HEADERS = [
+  "TYPE",
+  "IDENTITY PROVIDER ID",
+  "DOMAINS",
+  "SAML 2.0 EntityID",
+  "CREATED AT (UTC)",
+  "UPDATED AT (UTC)",
+] as const;
+
+/**
+ * Renders the list table.
+ */
+export function renderListProviders(items: ReadonlyArray<LegacySsoProviderView>): string {
+  const rows = items.map(
+    (item) =>
+      [
+        formatProtocol(item.saml),
+        item.id,
+        formatDomains(item.domains),
+        formatEntityId(item.saml),
+        formatSsoTimestamp(item.created_at),
+        formatSsoTimestamp(item.updated_at),
+      ] as const,
+  );
+  return renderGlamourTable(LIST_HEADERS, rows);
+}
+
+/**
+ * Renders the single-provider view: property/value table plus optional
+ * `## Attribute Mapping` (JSON-indented) and `## SAML 2.0 Metadata XML`
+ * sections.
+ *
+ * The optional sections are emitted as plain markdown (heading + fenced code
+ * block); we don't run them through Glamour, so visual styling will differ
+ * from Go. Tests assert on substring presence (`toContain`) rather than full
+ * byte equality. Documented in each subcommand's `SIDE_EFFECTS.md`.
+ */
+export function renderSingleProvider(provider: LegacySsoProviderView): string {
+  const rows: Array<readonly [string, string]> = [
+    ["IDENTITY PROVIDER ID", provider.id],
+    ["TYPE", formatProtocol(provider.saml)],
+    ["DOMAINS", formatDomains(provider.domains)],
+  ];
+  if (provider.saml !== undefined) {
+    rows.push(["SAML 2.0 METADATA", formatMetadataSource(provider.saml)]);
+    // Backticks stripped — see LIST_HEADERS comment above.
+    rows.push(["SAML 2.0 EntityID", formatEntityId(provider.saml)]);
+    rows.push(["NAMEID FORMAT", formatNameIdFormat(provider.saml)]);
+  }
+  rows.push(["CREATED AT (UTC)", formatSsoTimestamp(provider.created_at)]);
+  // Go's `render.go:140-143` uses `provider.CreatedAt` for both rows.
+  // Replicating the upstream byte-for-byte; documented in SIDE_EFFECTS.
+  rows.push(["UPDATED AT (UTC)", formatSsoTimestamp(provider.created_at)]);
+
+  const table = renderGlamourTable(["PROPERTY", "VALUE"], rows);
+
+  const sections: string[] = [table];
+
+  if (
+    provider.saml?.attribute_mapping !== undefined &&
+    hasAtLeastOneKey(provider.saml.attribute_mapping)
+  ) {
+    sections.push("## Attribute Mapping\n");
+    sections.push("```json\n");
+    sections.push(JSON.stringify(provider.saml.attribute_mapping, null, 2) + "\n");
+    sections.push("```\n");
+  }
+
+  if (provider.saml?.metadata_xml !== undefined && provider.saml.metadata_xml.length > 0) {
+    sections.push("## SAML 2.0 Metadata XML\n");
+    sections.push("```xml\n");
+    // Go's `render.go:155` pretty-prints via `xmlfmt.FormatXML(..., "  ", "  ")`.
+    sections.push(formatSsoMetadataXml(provider.saml.metadata_xml, "  ", "  ") + "\n");
+    sections.push("```\n");
+  }
+
+  return sections.join("");
+}
+
+function hasAtLeastOneKey(value: unknown): boolean {
+  if (typeof value !== "object" || value === null) return false;
+  const keys = (value as { keys?: unknown }).keys;
+  if (typeof keys !== "object" || keys === null) return false;
+  return Object.keys(keys).length > 0;
+}
+
+export interface LegacySsoInfoPayload {
+  readonly acs_url: string;
+  readonly entity_id: string;
+  readonly relay_state: string;
+}
+
+export function buildInfoPayload(ref: string): LegacySsoInfoPayload {
+  return {
+    acs_url: `https://${ref}.supabase.co/auth/v1/sso/saml/acs`,
+    entity_id: `https://${ref}.supabase.co/auth/v1/sso/saml/metadata`,
+    relay_state: `https://${ref}.supabase.co`,
+  };
+}
+
+export function renderInfoMarkdown(ref: string): string {
+  const payload = buildInfoPayload(ref);
+  return renderGlamourTable(
+    ["PROPERTY", "VALUE"],
+    [
+      // The Go markdown source at `render.go:170` includes a trailing space
+      // ("Single sign-on URL (ACS URL) "), but Glamour collapses it when
+      // computing column widths so the rendered output has a single space
+      // between the label and the column separator. Our flat ASCII renderer
+      // would preserve the trailing space and double it up against the cell
+      // padding — so we drop it here. The cli-e2e parity harness compares
+      // against Go's rendered output (not the markdown source).
+      ["Single sign-on URL (ACS URL)", payload.acs_url],
+      ["Audience URI (SP Entity ID)", payload.entity_id],
+      ["Default Relay State", payload.relay_state],
+    ],
+  );
+}
diff --git a/apps/cli/src/legacy/commands/sso/sso.format.unit.test.ts b/apps/cli/src/legacy/commands/sso/sso.format.unit.test.ts
new file mode 100644
index 0000000000..578bec16ba
--- /dev/null
+++ b/apps/cli/src/legacy/commands/sso/sso.format.unit.test.ts
@@ -0,0 +1,253 @@
+import { describe, expect, it } from "vitest";
+import { Result } from "effect";
+
+import {
+  buildInfoPayload,
+  formatDomains,
+  formatEntityId,
+  formatMetadataSource,
+  formatNameIdFormat,
+  formatProtocol,
+  formatSsoMetadataXml,
+  formatSsoTimestamp,
+  renderInfoMarkdown,
+  renderListProviders,
+  renderSingleProvider,
+  toLegacySsoProviderView,
+  validateUuid,
+} from "./sso.format.ts";
+
+describe("formatSsoTimestamp", () => {
+  it("formats RFC3339 input as Go's `YYYY-MM-DD HH:MM:SS` (UTC, no suffix)", () => {
+    expect(formatSsoTimestamp("2023-03-28T13:50:14.464Z")).toBe("2023-03-28 13:50:14");
+  });
+
+  it("returns an empty string for undefined input", () => {
+    expect(formatSsoTimestamp(undefined)).toBe("");
+  });
+
+  it("returns the original string when the input is unparseable", () => {
+    expect(formatSsoTimestamp("not-a-date")).toBe("not-a-date");
+  });
+});
+
+describe("formatProtocol", () => {
+  it("returns `SAML 2.0` when saml metadata is present", () => {
+    expect(formatProtocol({ entity_id: "x" })).toBe("SAML 2.0");
+  });
+
+  it("returns `unknown` when saml metadata is absent", () => {
+    expect(formatProtocol(undefined)).toBe("unknown");
+  });
+});
+
+describe("formatDomains", () => {
+  it("joins multiple domains with `, `", () => {
+    expect(formatDomains([{ domain: "example.com" }, { domain: "other.com" }])).toBe(
+      "example.com, other.com",
+    );
+  });
+
+  it("returns `-` for an empty list", () => {
+    expect(formatDomains([])).toBe("-");
+  });
+
+  it("returns `-` for undefined domains", () => {
+    expect(formatDomains(undefined)).toBe("-");
+  });
+
+  it("filters out missing domain fields", () => {
+    expect(formatDomains([{ domain: "example.com" }, { domain: undefined }])).toBe("example.com");
+  });
+});
+
+describe("formatEntityId / formatNameIdFormat / formatMetadataSource fallbacks", () => {
+  it("formatEntityId returns `-` when saml or entity_id is missing", () => {
+    expect(formatEntityId(undefined)).toBe("-");
+    expect(formatEntityId({ entity_id: "" })).toBe("-");
+  });
+
+  it("formatNameIdFormat returns `-` when saml or name_id_format is missing", () => {
+    expect(formatNameIdFormat(undefined)).toBe("-");
+    expect(formatNameIdFormat({ entity_id: "x", name_id_format: "" })).toBe("-");
+  });
+
+  it("formatMetadataSource returns `FILE` when metadata_url is absent", () => {
+    expect(formatMetadataSource(undefined)).toBe("FILE");
+    expect(formatMetadataSource({ entity_id: "x" })).toBe("FILE");
+    expect(formatMetadataSource({ entity_id: "x", metadata_url: "https://example.com" })).toBe(
+      "https://example.com",
+    );
+  });
+});
+
+describe("validateUuid", () => {
+  it("accepts canonical lowercase UUIDs", () => {
+    const result = validateUuid("b5ae62f9-ef1d-4f11-a02b-731c8bbb11e8");
+    expect(Result.isSuccess(result)).toBe(true);
+  });
+
+  it("accepts uppercase UUIDs (matches Go's `uuid.Parse` case-insensitivity)", () => {
+    const result = validateUuid("B5AE62F9-EF1D-4F11-A02B-731C8BBB11E8");
+    expect(Result.isSuccess(result)).toBe(true);
+  });
+
+  it("accepts mixed-case UUIDs", () => {
+    const result = validateUuid("B5ae62F9-eF1d-4F11-a02B-731C8bbb11E8");
+    expect(Result.isSuccess(result)).toBe(true);
+  });
+
+  it("rejects non-UUIDs with a Go-compatible message", () => {
+    const result = validateUuid("not-a-uuid");
+    expect(Result.isFailure(result)).toBe(true);
+    if (Result.isFailure(result)) {
+      expect(result.failure.message).toBe(`identity provider ID "not-a-uuid" is not a UUID`);
+    }
+  });
+});
+
+describe("renderListProviders / renderSingleProvider markdown surface", () => {
+  it("renders a list with header + data rows", () => {
+    const out = renderListProviders([
+      {
+        id: "0b0d48f6-878b-4190-88d7-2ca33ed800bc",
+        saml: { entity_id: "https://example.com" },
+        domains: [{ domain: "example.com" }],
+        created_at: "2023-03-28T13:50:14.464Z",
+        updated_at: "2023-03-28T13:50:14.464Z",
+      },
+    ]);
+    expect(out).toContain("TYPE");
+    expect(out).toContain("IDENTITY PROVIDER ID");
+    expect(out).toContain("0b0d48f6-878b-4190-88d7-2ca33ed800bc");
+    expect(out).toContain("example.com");
+    expect(out).toContain("2023-03-28 13:50:14");
+  });
+
+  it("renders a single provider with table + optional attribute mapping section", () => {
+    const out = renderSingleProvider({
+      id: "0b0d48f6-878b-4190-88d7-2ca33ed800bc",
+      saml: {
+        entity_id: "https://example.com",
+        attribute_mapping: { keys: { a: { name: "xyz" } } },
+        metadata_xml: '<?xml version="2.0"?>',
+      },
+      domains: [{ domain: "example.com" }],
+      created_at: "2023-03-28T13:50:14.464Z",
+    });
+    expect(out).toContain("IDENTITY PROVIDER ID");
+    expect(out).toContain("0b0d48f6-878b-4190-88d7-2ca33ed800bc");
+    expect(out).toContain("## Attribute Mapping");
+    expect(out).toContain("```json");
+    expect(out).toContain("## SAML 2.0 Metadata XML");
+    expect(out).toContain("```xml");
+  });
+
+  it("renders a single provider WITHOUT optional sections when none present", () => {
+    const out = renderSingleProvider({
+      id: "abc",
+      created_at: "2023-03-28T13:50:14.464Z",
+    });
+    expect(out).not.toContain("## Attribute Mapping");
+    expect(out).not.toContain("## SAML 2.0 Metadata XML");
+  });
+
+  // PARITY GUARD — do not "fix" this:
+  // Go's `apps/cli-go/internal/sso/internal/render/render.go:140-143` populates
+  // the `UPDATED AT (UTC)` row with `provider.CreatedAt`, not `provider.UpdatedAt`
+  // — almost certainly a Go-side bug, but the legacy shell is a strict 1:1 port.
+  // If you find yourself reaching to change line 194 of sso.format.ts because
+  // "obviously UPDATED AT should use updated_at", this test will fail. Update
+  // Go first, then this test, then the renderer — in that order.
+  it("intentionally renders UPDATED AT using created_at (Go-bug parity guard)", () => {
+    const out = renderSingleProvider({
+      id: "abc",
+      created_at: "2023-01-01T00:00:00Z",
+      updated_at: "2099-12-31T23:59:59Z",
+    });
+    // CREATED row uses created_at:
+    expect(out).toContain("CREATED AT (UTC)");
+    expect(out).toContain("2023-01-01 00:00:00");
+    // UPDATED row uses created_at (the bug), not updated_at:
+    expect(out).not.toContain("2099-12-31 23:59:59");
+  });
+});
+
+describe("buildInfoPayload + renderInfoMarkdown", () => {
+  it("derives three URLs from the project ref", () => {
+    const payload = buildInfoPayload("abcdefghijklmnopqrst");
+    expect(payload).toEqual({
+      acs_url: "https://abcdefghijklmnopqrst.supabase.co/auth/v1/sso/saml/acs",
+      entity_id: "https://abcdefghijklmnopqrst.supabase.co/auth/v1/sso/saml/metadata",
+      relay_state: "https://abcdefghijklmnopqrst.supabase.co",
+    });
+  });
+
+  it("renderInfoMarkdown interpolates ref into the three labels", () => {
+    const out = renderInfoMarkdown("abcdefghijklmnopqrst");
+    expect(out).toContain("Single sign-on URL (ACS URL)");
+    expect(out).toContain("https://abcdefghijklmnopqrst.supabase.co/auth/v1/sso/saml/acs");
+    expect(out).toContain("https://abcdefghijklmnopqrst.supabase.co/auth/v1/sso/saml/metadata");
+    expect(out).toContain("https://abcdefghijklmnopqrst.supabase.co");
+  });
+});
+
+describe("formatSsoMetadataXml (xmlfmt parity port)", () => {
+  it("indents nested tags by depth × indent", () => {
+    // Reference output captured by running go-xmlfmt v1.1.3
+    // `FormatXML("<a><b><c/></b></a>", "  ", "  ")`.
+    const out = formatSsoMetadataXml("<a><b><c/></b></a>", "  ", "  ");
+    expect(out).toBe("  \n  <a>\n    <b>\n      <c/>\n    </b>\n  </a>");
+  });
+
+  it("keeps close-tags inline with content (e.g. <b>text</b>)", () => {
+    // Reference: go-xmlfmt's `lastEndElem` flag suppresses the newline before
+    // a closing tag whose preceding sibling was an opening tag with text.
+    const out = formatSsoMetadataXml("<a><b>text</b></a>", "  ", "  ");
+    expect(out).toBe("  \n  <a>\n    <b>text</b>\n  </a>");
+  });
+
+  it("handles the <?xml ?> declaration without descending", () => {
+    const out = formatSsoMetadataXml(`<?xml version="1.0"?><a/>`, "  ", "  ");
+    expect(out).toBe(`  \n  <?xml version="1.0"?>\n  <a/>`);
+  });
+
+  it("collapses whitespace between adjacent tags", () => {
+    const out = formatSsoMetadataXml("<a>\n  <b/>\n</a>", "  ", "  ");
+    expect(out).toBe("  \n  <a>\n    <b/>\n  </a>");
+  });
+
+  it("matches go-xmlfmt v1.1.3 byte-for-byte on a realistic SAML fragment", () => {
+    const saml =
+      '<EntityDescriptor xmlns="urn:oasis:names:tc:SAML:2.0:metadata" entityID="https://example.com">' +
+      '<IDPSSODescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">' +
+      '<SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://example.com/sso"/>' +
+      "</IDPSSODescriptor>" +
+      "</EntityDescriptor>";
+    // Verified against `xmlfmt.FormatXML(saml, "  ", "  ")` in a Go program
+    // using `github.com/go-xmlfmt/xmlfmt@v1.1.3`.
+    const expected =
+      "  \n" +
+      '  <EntityDescriptor xmlns="urn:oasis:names:tc:SAML:2.0:metadata" entityID="https://example.com">\n' +
+      '    <IDPSSODescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">\n' +
+      '      <SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://example.com/sso"/>\n' +
+      "    </IDPSSODescriptor>\n" +
+      "  </EntityDescriptor>";
+    expect(formatSsoMetadataXml(saml, "  ", "  ")).toBe(expected);
+  });
+});
+
+describe("toLegacySsoProviderView coercion", () => {
+  it("returns an empty view for non-object inputs", () => {
+    expect(toLegacySsoProviderView(null).id).toBe("");
+    expect(toLegacySsoProviderView("string").id).toBe("");
+  });
+
+  it("preserves arbitrary attribute_mapping data (incl. user keys)", () => {
+    const view = toLegacySsoProviderView({
+      id: "abc",
+      saml: { attribute_mapping: { keys: { a: { default: 3 } } } },
+    });
+    expect(view.saml?.attribute_mapping).toEqual({ keys: { a: { default: 3 } } });
+  });
+});
diff --git a/apps/cli/src/legacy/commands/sso/sso.metadata-url.ts b/apps/cli/src/legacy/commands/sso/sso.metadata-url.ts
new file mode 100644
index 0000000000..e257002bf4
--- /dev/null
+++ b/apps/cli/src/legacy/commands/sso/sso.metadata-url.ts
@@ -0,0 +1,122 @@
+import { Duration, Effect } from "effect";
+import * as FetchHttpClient from "effect/unstable/http/FetchHttpClient";
+import * as HttpClient from "effect/unstable/http/HttpClient";
+import * as HttpClientRequest from "effect/unstable/http/HttpClientRequest";
+
+import {
+  LegacySsoMetadataUrlInvalidError,
+  LegacySsoMetadataUrlNetworkError,
+  LegacySsoMetadataUrlNonUtf8Error,
+} from "./sso.errors.ts";
+import { validateMetadataXmlBytes } from "./sso.saml.ts";
+
+const METADATA_URL_TIMEOUT = Duration.seconds(10);
+
+// Bound the body buffered into memory so a hostile or malformed metadata URL
+// cannot exhaust the CLI process. 5 MiB is well above any plausible SAML 2.0
+// IDP metadata document (real-world examples are typically 4–40 KiB).
+const METADATA_URL_MAX_BYTES = 5 * 1024 * 1024;
+
+/**
+ * Validates a SAML 2.0 metadata URL by issuing a 10-second GET with
+ * `Accept: application/xml`, requiring HTTPS, refusing redirects, capping
+ * the response body, and decoding it as strict UTF-8.
+ *
+ * Mirrors Go's `saml.ValidateMetadataURL`
+ * (`apps/cli-go/internal/sso/internal/saml/files.go:62-93`) with two
+ * defence-in-depth hardenings over the Go original:
+ *   1. **No redirects** — the underlying `fetch` is configured with
+ *      `redirect: "error"` so a 3xx hop from the user's HTTPS URL to
+ *      `http://169.254.169.254/`, `http://10.x`, or other private/metadata
+ *      endpoints cannot bypass the HTTPS guard.
+ *   2. **Body size cap** — refuses to buffer more than 5 MiB so a
+ *      malicious or buggy endpoint cannot OOM the CLI.
+ *
+ * Callers add their own ` Use --skip-url-validation to suppress this
+ * error[.]` suffix — the trailing punctuation differs between Go's `create`
+ * (no period) and `update` (period).
+ */
+export const validateMetadataUrl = (
+  metadataUrl: string,
+): Effect.Effect<
+  void,
+  | LegacySsoMetadataUrlInvalidError
+  | LegacySsoMetadataUrlNetworkError
+  | LegacySsoMetadataUrlNonUtf8Error,
+  HttpClient.HttpClient
+> =>
+  Effect.gen(function* () {
+    const parsed = yield* Effect.try({
+      try: () => new URL(metadataUrl),
+      catch: (cause) =>
+        new LegacySsoMetadataUrlInvalidError({
+          message: `failed to parse metadata uri: ${String(cause)}`,
+        }),
+    });
+
+    // Go uses `strings.EqualFold(scheme, "https")`; URL.protocol is already
+    // lowercased so direct compare is safe.
+    if (parsed.protocol !== "https:") {
+      return yield* Effect.fail(
+        new LegacySsoMetadataUrlInvalidError({
+          message: "only HTTPS Metadata URLs are supported",
+        }),
+      );
+    }
+
+    const httpClient = yield* HttpClient.HttpClient;
+    const request = HttpClientRequest.get(metadataUrl).pipe(
+      HttpClientRequest.setHeader("Accept", "application/xml"),
+    );
+
+    const response = yield* httpClient.execute(request).pipe(
+      // Refuse redirects so the HTTPS-only guard above can't be sidestepped via 3xx → http://internal/.
+      Effect.provideService(FetchHttpClient.RequestInit, { redirect: "error" }),
+      Effect.timeout(METADATA_URL_TIMEOUT),
+      Effect.catchTag("TimeoutError", () =>
+        Effect.fail(
+          new LegacySsoMetadataUrlNetworkError({
+            message: "failed to fetch metadata url: timeout",
+          }),
+        ),
+      ),
+      Effect.catchTag("HttpClientError", (cause) =>
+        Effect.fail(
+          new LegacySsoMetadataUrlNetworkError({
+            message: `failed to fetch metadata url: ${String(cause)}`,
+          }),
+        ),
+      ),
+    );
+
+    if (response.status !== 200) {
+      return yield* Effect.fail(
+        new LegacySsoMetadataUrlNetworkError({
+          message: `unexpected metadata url status: ${response.status}`,
+        }),
+      );
+    }
+
+    const arrayBuffer = yield* response.arrayBuffer.pipe(
+      Effect.mapError(
+        (cause) =>
+          new LegacySsoMetadataUrlNetworkError({
+            message: `failed to read http response: ${String(cause)}`,
+          }),
+      ),
+    );
+
+    if (arrayBuffer.byteLength > METADATA_URL_MAX_BYTES) {
+      return yield* Effect.fail(
+        new LegacySsoMetadataUrlNetworkError({
+          message: `metadata url response exceeds maximum allowed size (${METADATA_URL_MAX_BYTES} bytes)`,
+        }),
+      );
+    }
+
+    yield* validateMetadataXmlBytes(
+      new Uint8Array(arrayBuffer),
+      metadataUrl,
+      (args) => new LegacySsoMetadataUrlNonUtf8Error({ message: args.message }),
+    );
+  });
diff --git a/apps/cli/src/legacy/commands/sso/sso.saml.ts b/apps/cli/src/legacy/commands/sso/sso.saml.ts
new file mode 100644
index 0000000000..972bb253a3
--- /dev/null
+++ b/apps/cli/src/legacy/commands/sso/sso.saml.ts
@@ -0,0 +1,84 @@
+import { Effect, FileSystem } from "effect";
+
+/**
+ * Validates that raw bytes decode as strict UTF-8. Mirrors Go's
+ * `unicode/utf8.Valid(data)` check inside `saml.ValidateMetadata`. Using
+ * `TextDecoder("utf-8", { fatal: true })` makes any malformed surrogate or
+ * unexpected continuation byte throw, matching Go's strict semantics.
+ *
+ * The `source` argument is the path or URL the bytes came from; it's
+ * embedded in the rendered error message so users can locate the bad file.
+ */
+export function validateMetadataXmlBytes<E>(
+  bytes: Uint8Array,
+  source: string,
+  nonUtf8Error: (args: { readonly source: string; readonly message: string }) => E,
+): Effect.Effect<void, E> {
+  return Effect.try({
+    try: () => new TextDecoder("utf-8", { fatal: true }).decode(bytes),
+    catch: () => undefined,
+  }).pipe(
+    Effect.mapError(() =>
+      // Verbatim Go message from `saml/files.go:55-57`.
+      nonUtf8Error({
+        source,
+        message: `SAML Metadata XML at ${JSON.stringify(source)} is not UTF-8 encoded`,
+      }),
+    ),
+    Effect.asVoid,
+  );
+}
+
+/**
+ * Reads a SAML 2.0 metadata XML file and validates UTF-8 encoding.
+ * Subcommands inject their own open-error / non-UTF-8 error classes so
+ * each handler returns errors in its own tagged-error family
+ * (matches Go, which raises `failed to open metadata file:` / etc.).
+ */
+export const readMetadataFile =
+  <Eopen, Eutf>(factory: {
+    readonly openError: (args: { readonly message: string }) => Eopen;
+    readonly nonUtf8Error: (args: { readonly source: string; readonly message: string }) => Eutf;
+  }) =>
+  (path: string): Effect.Effect<string, Eopen | Eutf, FileSystem.FileSystem> =>
+    Effect.gen(function* () {
+      const fs = yield* FileSystem.FileSystem;
+      // Go uses afero `fsys.Open(path)` + `io.ReadAll(file)`; collapsed to a
+      // single error branch here (any open / read failure surfaces as
+      // `failed to open metadata file:` to match the externally observable
+      // string for the common case — missing file).
+      const bytes = yield* fs
+        .readFile(path)
+        .pipe(
+          Effect.mapError((cause) =>
+            factory.openError({ message: `failed to open metadata file: ${String(cause)}` }),
+          ),
+        );
+      yield* validateMetadataXmlBytes(bytes, path, factory.nonUtf8Error);
+      return new TextDecoder("utf-8").decode(bytes);
+    });
+
+/**
+ * Reads an attribute mapping JSON file. Returns the parsed value as
+ * `unknown` so the raw POST/PUT payload preserves user-defined keys like
+ * `default` that aren't in the generated `attribute_mapping` schema.
+ */
+export const readAttributeMappingFile =
+  <E>(factory: { readonly openError: (args: { readonly message: string }) => E }) =>
+  (path: string): Effect.Effect<unknown, E, FileSystem.FileSystem> =>
+    Effect.gen(function* () {
+      const fs = yield* FileSystem.FileSystem;
+      const content = yield* fs
+        .readFileString(path)
+        .pipe(
+          Effect.mapError((cause) =>
+            factory.openError({ message: `failed to open attribute mapping: ${String(cause)}` }),
+          ),
+        );
+      const parsed = yield* Effect.try({
+        try: () => JSON.parse(content) as unknown,
+        catch: (cause) =>
+          factory.openError({ message: `failed to parse attribute mapping: ${String(cause)}` }),
+      });
+      return parsed;
+    });
diff --git a/apps/cli/src/legacy/commands/sso/sso.saml.unit.test.ts b/apps/cli/src/legacy/commands/sso/sso.saml.unit.test.ts
new file mode 100644
index 0000000000..64c97d7800
--- /dev/null
+++ b/apps/cli/src/legacy/commands/sso/sso.saml.unit.test.ts
@@ -0,0 +1,126 @@
+import { writeFileSync } from "node:fs";
+import { join } from "node:path";
+
+import { describe, expect, it } from "@effect/vitest";
+import { BunServices } from "@effect/platform-bun";
+import { Data, Effect, Exit } from "effect";
+
+import { useLegacyTempWorkdir } from "../../../../tests/helpers/legacy-mocks.ts";
+import {
+  readAttributeMappingFile,
+  readMetadataFile,
+  validateMetadataXmlBytes,
+} from "./sso.saml.ts";
+
+class TestOpenError extends Data.TaggedError("TestOpenError")<{ readonly message: string }> {}
+class TestNonUtf8Error extends Data.TaggedError("TestNonUtf8Error")<{
+  readonly source: string;
+  readonly message: string;
+}> {}
+
+const readMetadata = readMetadataFile({
+  openError: (args) => new TestOpenError(args),
+  nonUtf8Error: (args) => new TestNonUtf8Error(args),
+});
+
+const readAttrMapping = readAttributeMappingFile({
+  openError: (args) => new TestOpenError(args),
+});
+
+const tempRoot = useLegacyTempWorkdir("sso-saml-unit-");
+
+describe("readMetadataFile", () => {
+  it.live("returns the file content on UTF-8 XML", () => {
+    const path = join(tempRoot.current, "good.xml");
+    writeFileSync(path, '<?xml version="1.0"?><md/>');
+    return Effect.gen(function* () {
+      const out = yield* readMetadata(path);
+      expect(out).toBe('<?xml version="1.0"?><md/>');
+    }).pipe(Effect.provide(BunServices.layer));
+  });
+
+  it.live("fails with TestOpenError on missing file", () => {
+    const path = join(tempRoot.current, "missing.xml");
+    return Effect.gen(function* () {
+      const exit = yield* Effect.exit(readMetadata(path));
+      expect(Exit.isFailure(exit)).toBe(true);
+      if (Exit.isFailure(exit)) {
+        expect(JSON.stringify(exit.cause)).toContain("TestOpenError");
+      }
+    }).pipe(Effect.provide(BunServices.layer));
+  });
+
+  it.live("fails with TestNonUtf8Error on invalid UTF-8 bytes", () => {
+    const path = join(tempRoot.current, "bad.xml");
+    writeFileSync(path, Buffer.from([0xff, 0xfe, 0xfd]));
+    return Effect.gen(function* () {
+      const exit = yield* Effect.exit(readMetadata(path));
+      expect(Exit.isFailure(exit)).toBe(true);
+      if (Exit.isFailure(exit)) {
+        const dump = JSON.stringify(exit.cause);
+        expect(dump).toContain("TestNonUtf8Error");
+        expect(dump).toContain("is not UTF-8 encoded");
+      }
+    }).pipe(Effect.provide(BunServices.layer));
+  });
+});
+
+describe("readAttributeMappingFile", () => {
+  it.live("parses JSON and preserves user-defined keys (e.g. `default: 3`)", () => {
+    const path = join(tempRoot.current, "mapping.json");
+    writeFileSync(path, JSON.stringify({ keys: { a: { name: "xyz", default: 3 } } }));
+    return Effect.gen(function* () {
+      const parsed = yield* readAttrMapping(path);
+      const root = parsed as { keys: { a: { default: number } } };
+      expect(root.keys.a.default).toBe(3);
+    }).pipe(Effect.provide(BunServices.layer));
+  });
+
+  it.live("fails with TestOpenError on malformed JSON", () => {
+    const path = join(tempRoot.current, "bad.json");
+    writeFileSync(path, "{not json}");
+    return Effect.gen(function* () {
+      const exit = yield* Effect.exit(readAttrMapping(path));
+      expect(Exit.isFailure(exit)).toBe(true);
+    }).pipe(Effect.provide(BunServices.layer));
+  });
+
+  it.live("fails with TestOpenError on missing file", () => {
+    const path = join(tempRoot.current, "nonexistent.json");
+    return Effect.gen(function* () {
+      const exit = yield* Effect.exit(readAttrMapping(path));
+      expect(Exit.isFailure(exit)).toBe(true);
+      if (Exit.isFailure(exit)) {
+        const dump = JSON.stringify(exit.cause);
+        expect(dump).toContain("TestOpenError");
+        expect(dump).toContain("failed to open attribute mapping");
+      }
+    }).pipe(Effect.provide(BunServices.layer));
+  });
+});
+
+describe("validateMetadataXmlBytes", () => {
+  it.live("rejects 0xFF / 0xFE byte sequence as non-UTF-8", () => {
+    return Effect.gen(function* () {
+      const exit = yield* Effect.exit(
+        validateMetadataXmlBytes(
+          new Uint8Array([0xff, 0xfe]),
+          "test",
+          (args) => new TestNonUtf8Error(args),
+        ),
+      );
+      expect(Exit.isFailure(exit)).toBe(true);
+    });
+  });
+
+  it.live("accepts a UTF-8 byte sequence", () => {
+    return Effect.gen(function* () {
+      const result = yield* validateMetadataXmlBytes(
+        new TextEncoder().encode("<xml/>"),
+        "test",
+        (args) => new TestNonUtf8Error(args),
+      );
+      expect(result).toBeUndefined();
+    });
+  });
+});
diff --git a/apps/cli/src/legacy/commands/sso/update/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/sso/update/SIDE_EFFECTS.md
index ce296ab5a6..961ea33239 100644
--- a/apps/cli/src/legacy/commands/sso/update/SIDE_EFFECTS.md
+++ b/apps/cli/src/legacy/commands/sso/update/SIDE_EFFECTS.md
@@ -2,49 +2,87 @@
 
 ## Files Read
 
-| Path                       | Format                    | When                                                       |
-| -------------------------- | ------------------------- | ---------------------------------------------------------- |
-| `~/.supabase/access-token` | plain text (token string) | when `SUPABASE_ACCESS_TOKEN` unset and keyring unavailable |
-| `<metadata-file>`          | XML                       | when `--metadata-file` flag is provided                    |
-| `<attribute-mapping-file>` | JSON                      | when `--attribute-mapping-file` flag is provided           |
+| Path                                           | Format                    | When                                                                                          |
+| ---------------------------------------------- | ------------------------- | --------------------------------------------------------------------------------------------- |
+| keyring `"Supabase CLI"` / `<profile>`         | OS keychain               | when `SUPABASE_ACCESS_TOKEN` unset and keyring available; account = `LegacyCliConfig.profile` |
+| keyring `"Supabase CLI"` / `access-token`      | OS keychain               | legacy-key fallback when the profile-keyed lookup misses                                      |
+| `~/.supabase/access-token`                     | plain text (token string) | last-resort fallback after env + keyring miss                                                 |
+| `<workdir>/supabase/.temp/linked-project.json` | JSON                      | always — `linkedProjectCache` reads to decide whether to write                                |
+| `<metadata-file>`                              | XML (UTF-8)               | when `--metadata-file` is provided                                                            |
+| `<attribute-mapping-file>`                     | JSON                      | when `--attribute-mapping-file` is provided                                                   |
 
 ## Files Written
 
-| Path | Format | When |
-| ---- | ------ | ---- |
-| —    | —      | —    |
+| Path                                           | Format | When                                                                |
+| ---------------------------------------------- | ------ | ------------------------------------------------------------------- |
+| `~/.supabase/telemetry.json`                   | JSON   | always (`Effect.ensuring(telemetryState.flush)`)                    |
+| `<workdir>/supabase/.temp/linked-project.json` | JSON   | best-effort after `--project-ref` resolves (Go `PersistentPostRun`) |
 
 ## API Routes
 
-| Method | Path                                                         | Auth         | Request body                                                                                            | Response (used fields)                        |
-| ------ | ------------------------------------------------------------ | ------------ | ------------------------------------------------------------------------------------------------------- | --------------------------------------------- |
-| `GET`  | `/v1/projects/{ref}/config/auth/sso/providers/{provider_id}` | Bearer token | none                                                                                                    | `{id, saml, domains, created_at, updated_at}` |
-| `PUT`  | `/v1/projects/{ref}/config/auth/sso/providers/{provider_id}` | Bearer token | `{metadata_url, metadata_xml, domains, add_domains, remove_domains, attribute_mapping, name_id_format}` | `{id, saml, domains, created_at, updated_at}` |
+| Method | Path                                                         | Auth         | Request body                                                                    | Response (used fields)                                             |
+| ------ | ------------------------------------------------------------ | ------------ | ------------------------------------------------------------------------------- | ------------------------------------------------------------------ |
+| `GET`  | `/v1/projects/{ref}/config/auth/sso/providers/{provider_id}` | Bearer token | none                                                                            | `{id, saml?, domains?, created_at?, updated_at?}`                  |
+| `PUT`  | `/v1/projects/{ref}/config/auth/sso/providers/{provider_id}` | Bearer token | `{metadata_xml?, metadata_url?, domains?, attribute_mapping?, name_id_format?}` | `{id, saml?, domains?, ...}` (parsed loosely)                      |
+| `GET`  | `<metadata-url>`                                             | none         | `Accept: application/xml`, 10s timeout                                          | XML body (UTF-8) — validation when `--skip-url-validation` not set |
+| `GET`  | `/v1/projects/{ref}`                                         | Bearer token | none                                                                            | `{organization_slug}` — upgrade-gate side-call on 4xx              |
+| `GET`  | `/v1/organizations/{slug}/entitlements`                      | Bearer token | none                                                                            | `{entitlements[].feature.key, .hasAccess}` — upgrade-gate          |
+
+Bypasses the typed Management API client for the PUT so user-supplied keys inside
+`attribute_mapping.keys.<x>` (e.g. `default`) are preserved verbatim. The initial
+GET still uses the typed client.
 
 ## Environment Variables
 
 | Variable                | Purpose                                              | Required?                                               |
 | ----------------------- | ---------------------------------------------------- | ------------------------------------------------------- |
 | `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `~/.supabase/access-token`) |
-| `SUPABASE_API_URL`      | override Management API base URL                     | no (defaults to `https://api.supabase.com`)             |
+| `SUPABASE_PROFILE`      | profile selector (built-in name or YAML file path)   | no (defaults to `supabase`)                             |
 
 ## Exit Codes
 
-| Code | Condition                                            |
-| ---- | ---------------------------------------------------- |
-| `0`  | success — provider updated and details printed       |
-| `1`  | authentication error — no valid token found          |
-| `1`  | API error — 404 means provider ID does not exist     |
-| `1`  | API error — non-2xx response from providers endpoint |
-| `1`  | validation error — provider ID is not a valid UUID   |
-| `1`  | network / connection failure                         |
+| Code | Condition                                                                                                                            |
+| ---- | ------------------------------------------------------------------------------------------------------------------------------------ |
+| `0`  | success                                                                                                                              |
+| `1`  | `LegacySsoInvalidUuidError` — provider ID is not a canonical UUID                                                                    |
+| `1`  | `LegacySsoMutexFlagError` — flag combinations: `--domains` with `--add/--remove-domains`, or `--metadata-file` with `--metadata-url` |
+| `1`  | `LegacySsoUpdateMetadataFileError` — metadata file unreadable, non-UTF-8, or metadata URL invalid/unreachable/non-UTF-8              |
+| `1`  | `LegacySsoUpdateAttributeMappingFileError` — JSON file unreadable or malformed                                                       |
+| `1`  | `LegacySsoUpdateNotFoundError` — 404 from GET                                                                                        |
+| `1`  | `LegacySsoUpdateUnexpectedStatusError` — non-2xx from GET or PUT                                                                     |
+| `1`  | `LegacySsoUpdateNetworkError` — transport-level failure                                                                              |
+
+## Telemetry Events Fired
+
+| Event                   | When                                                 | Notable properties                                                     |
+| ----------------------- | ---------------------------------------------------- | ---------------------------------------------------------------------- |
+| `cli_command_executed`  | post-run, success or failure (via wrapper)           | `exit_code`, `duration_ms`, `flags` (`--project-ref` allowed verbatim) |
+| `cli_upgrade_suggested` | 4xx response **and** `auth.saml_2` entitlement gated | `feature_key: "auth.saml_2"`, `org_slug`                               |
+
+## Output
+
+### `--output-format text` / Go `--output pretty`
+
+Glamour-styled property/value markdown table plus optional `## Attribute Mapping` and `## SAML 2.0 Metadata XML` sections (heading + fenced code block).
+
+### `--output json` / `--output yaml` / `--output toml`
+
+Response verbatim (Go-compatible alphabetised keys for JSON).
+
+### `--output env`
+
+No output (matches Go's `update.go:139`).
+
+### `--output-format json` / `stream-json`
+
+Single `success` event with the parsed response as data.
 
 ## Notes
 
-- The `<provider-id>` argument must be a valid UUID.
-- First performs a GET to retrieve existing provider state, then issues a PUT with merged domains.
-- `--domains` replaces all existing domains.
-- `--add-domains` and `--remove-domains` are relative to the existing domain list.
 - `--domains` is mutually exclusive with `--add-domains` and `--remove-domains`.
 - `--metadata-file` and `--metadata-url` are mutually exclusive.
-- Requires `--project-ref` or a linked project (`.supabase/config.json`).
+- Always performs the GET pre-check (matches Go's `update.go:42`), regardless of whether `--add-domains` / `--remove-domains` are used.
+- Domain merge: removals are applied first, then additions. Go uses a `map[string]bool` so the resulting order is **unordered**; consumers must sort if comparing.
+- Metadata URL validation error message: `only HTTPS Metadata URLs are supported Use --skip-url-validation to suppress this error.` (single trailing period — matches Go's `update.go:69`, which wraps with `%w Use --skip-url-validation to suppress this error.`; differs from `sso add`'s variant which omits the trailing period).
+- The `## Attribute Mapping` / `## SAML 2.0 Metadata XML` sections are emitted as plain markdown (heading + fence). Visual styling of the headings does not match Go's Glamour-rendered output; the table portion and the XML body inside the fence are byte-parity (see `formatSsoMetadataXml`).
+- **PUT failure message reuses the GET error string**: a non-2xx PUT response produces `unexpected error fetching identity provider: <body>` — note "fetching" not "updating". This matches Go's `update.go:133` verbatim.
diff --git a/apps/cli/src/legacy/commands/sso/update/update.command.ts b/apps/cli/src/legacy/commands/sso/update/update.command.ts
index 8b9110ed00..05d838f2f3 100644
--- a/apps/cli/src/legacy/commands/sso/update/update.command.ts
+++ b/apps/cli/src/legacy/commands/sso/update/update.command.ts
@@ -1,5 +1,9 @@
 import { Argument, Command, Flag } from "effect/unstable/cli";
 import type * as CliCommand from "effect/unstable/cli/Command";
+
+import { withJsonErrorHandling } from "../../../../shared/output/json-error-handling.ts";
+import { legacyManagementApiRuntimeLayer } from "../../../shared/legacy-management-api-runtime.layer.ts";
+import { withLegacyCommandInstrumentation } from "../../../telemetry/legacy-command-instrumentation.ts";
 import { legacySsoUpdate } from "./update.handler.ts";
 
 const NAME_ID_FORMATS = [
@@ -47,7 +51,7 @@ const config = {
   ),
   skipUrlValidation: Flag.boolean("skip-url-validation").pipe(
     Flag.withDescription(
-      "Whether local validation of the SAML 2.0 Metadata URL should not be performed.",
+      "Skip local validation of the SAML 2.0 Metadata URL (HTTPS requirement, live GET probe, and UTF-8 body decode). Use in air-gapped CI where the IDP is not reachable from the build agent.",
     ),
   ),
   attributeMappingFile: Flag.string("attribute-mapping-file").pipe(
@@ -69,8 +73,11 @@ const config = {
 export type LegacySsoUpdateFlags = CliCommand.Command.Config.Infer<typeof config>;
 
 export const legacySsoUpdateCommand = Command.make("update", config).pipe(
+  // Mirrors Go's long description verbatim, including the `of a already added`
+  // grammar slip in `apps/cli-go/cmd/sso.go`. Strict 1:1 port — file a Go-side
+  // fix upstream rather than diverging here.
   Command.withDescription(
-    "Update the configuration settings of an already added SSO identity provider.",
+    "Update the configuration settings of a already added SSO identity provider.",
   ),
   Command.withShortDescription("Update information about an SSO identity provider"),
   Command.withExamples([
@@ -80,5 +87,11 @@ export const legacySsoUpdateCommand = Command.make("update", config).pipe(
       description: "Update an SSO provider's domains",
     },
   ]),
-  Command.withHandler((flags) => legacySsoUpdate(flags)),
+  Command.withHandler((flags) =>
+    legacySsoUpdate(flags).pipe(
+      withLegacyCommandInstrumentation({ flags, safeFlags: ["project-ref"] }),
+      withJsonErrorHandling,
+    ),
+  ),
+  Command.provide(legacyManagementApiRuntimeLayer(["sso", "update"])),
 );
diff --git a/apps/cli/src/legacy/commands/sso/update/update.handler.ts b/apps/cli/src/legacy/commands/sso/update/update.handler.ts
index 0c017ce6fa..ca86765455 100644
--- a/apps/cli/src/legacy/commands/sso/update/update.handler.ts
+++ b/apps/cli/src/legacy/commands/sso/update/update.handler.ts
@@ -1,22 +1,262 @@
-import { Effect, Option } from "effect";
-import { LegacyGoProxy } from "../../../../shared/legacy/go-proxy.service.ts";
+import type { SupabaseApiError } from "@supabase/api/effect";
+import { Effect, Option, Result } from "effect";
+import * as HttpClient from "effect/unstable/http/HttpClient";
+import * as HttpClientRequest from "effect/unstable/http/HttpClientRequest";
+
+import { LegacyPlatformApi } from "../../../auth/legacy-platform-api.service.ts";
+import { LegacyCliConfig } from "../../../config/legacy-cli-config.service.ts";
+import { LegacyProjectRefResolver } from "../../../config/legacy-project-ref.service.ts";
+import { LegacyOutputFlag } from "../../../../shared/legacy/global-flags.ts";
+import { Output } from "../../../../shared/output/output.service.ts";
+import {
+  encodeGoJson,
+  encodeGoStructJsonBody,
+  encodeToml,
+  encodeYaml,
+} from "../../../shared/legacy-go-output.encoders.ts";
+import { mapLegacyHttpError, sanitizeLegacyErrorBody } from "../../../shared/legacy-http-errors.ts";
+import { resolveLegacyAccessToken } from "../../../shared/legacy-resolve-token.ts";
+import { LegacyLinkedProjectCache } from "../../../telemetry/legacy-linked-project-cache.service.ts";
+import { LegacyTelemetryState } from "../../../telemetry/legacy-telemetry-state.service.ts";
+import { legacySuggestUpgrade } from "../../../shared/legacy-upgrade-suggest.ts";
+import {
+  LegacySsoMutexFlagError,
+  LegacySsoUpdateAttributeMappingFileError,
+  LegacySsoUpdateMetadataFileError,
+  LegacySsoUpdateNetworkError,
+  LegacySsoUpdateNotFoundError,
+  LegacySsoUpdateUnexpectedStatusError,
+} from "../sso.errors.ts";
+import { renderSingleProvider, toLegacySsoProviderView, validateUuid } from "../sso.format.ts";
+import { validateMetadataUrl } from "../sso.metadata-url.ts";
+import { readAttributeMappingFile, readMetadataFile } from "../sso.saml.ts";
 import type { LegacySsoUpdateFlags } from "./update.command.ts";
 
+const readMetadata = readMetadataFile({
+  openError: (args) => new LegacySsoUpdateMetadataFileError(args),
+  nonUtf8Error: (args) => new LegacySsoUpdateMetadataFileError({ message: args.message }),
+});
+
+const readAttributeMapping = readAttributeMappingFile({
+  openError: (args) => new LegacySsoUpdateAttributeMappingFileError(args),
+});
+
+const mapGetStatusOrNetwork = mapLegacyHttpError({
+  networkError: LegacySsoUpdateNetworkError,
+  statusError: LegacySsoUpdateUnexpectedStatusError,
+  networkMessage: (cause) => `failed to get sso provider: ${cause}`,
+  statusMessage: (_status, body) => `unexpected error fetching identity provider: ${body}`,
+});
+
+const handleGetError = (ref: string, providerId: string, cause: SupabaseApiError) =>
+  Effect.gen(function* () {
+    const mapped = yield* Effect.flip(mapGetStatusOrNetwork(cause));
+    if (mapped._tag === "LegacySsoUpdateUnexpectedStatusError") {
+      yield* legacySuggestUpgrade({
+        projectRef: ref,
+        featureKey: "auth.saml_2",
+        statusCode: mapped.status,
+      });
+      if (mapped.status === 404) {
+        return yield* Effect.fail(
+          new LegacySsoUpdateNotFoundError({
+            message: `An identity provider with ID ${JSON.stringify(providerId)} could not be found.`,
+          }),
+        );
+      }
+    }
+    return yield* Effect.fail(mapped);
+  });
+
+interface ExistingDomainItem {
+  readonly domain?: string;
+}
+
+function mergeDomains(
+  existing: ReadonlyArray<ExistingDomainItem> | undefined,
+  add: ReadonlyArray<string>,
+  remove: ReadonlyArray<string>,
+): ReadonlyArray<string> {
+  // Mirrors Go's `update.go:93-117` — seed from current domains, apply
+  // removals, then add new entries. Go uses a `map[string]bool`, so iteration
+  // order is unspecified; integration tests sort before asserting.
+  const set = new Set<string>();
+  if (existing !== undefined) {
+    for (const item of existing) {
+      if (typeof item.domain === "string" && item.domain.length > 0) {
+        set.add(item.domain);
+      }
+    }
+  }
+  for (const removeDomain of remove) set.delete(removeDomain);
+  for (const addDomain of add) set.add(addDomain);
+  return Array.from(set);
+}
+
 export const legacySsoUpdate = Effect.fn("legacy.sso.update")(function* (
   flags: LegacySsoUpdateFlags,
 ) {
-  const proxy = yield* LegacyGoProxy;
-  const args: string[] = ["sso", "update"];
-  if (Option.isSome(flags.projectRef)) args.push("--project-ref", flags.projectRef.value);
-  for (const domain of flags.domains) args.push("--domains", domain);
-  for (const domain of flags.addDomains) args.push("--add-domains", domain);
-  for (const domain of flags.removeDomains) args.push("--remove-domains", domain);
-  if (Option.isSome(flags.metadataFile)) args.push("--metadata-file", flags.metadataFile.value);
-  if (Option.isSome(flags.metadataUrl)) args.push("--metadata-url", flags.metadataUrl.value);
-  if (flags.skipUrlValidation) args.push("--skip-url-validation");
-  if (Option.isSome(flags.attributeMappingFile))
-    args.push("--attribute-mapping-file", flags.attributeMappingFile.value);
-  if (Option.isSome(flags.nameIdFormat)) args.push("--name-id-format", flags.nameIdFormat.value);
-  args.push(flags.providerId);
-  yield* proxy.exec(args);
+  const output = yield* Output;
+  const goOutputFlag = yield* LegacyOutputFlag;
+  const api = yield* LegacyPlatformApi;
+  const httpClient = yield* HttpClient.HttpClient;
+  const cliConfig = yield* LegacyCliConfig;
+  const resolver = yield* LegacyProjectRefResolver;
+  const linkedProjectCache = yield* LegacyLinkedProjectCache;
+  const telemetryState = yield* LegacyTelemetryState;
+
+  yield* Effect.gen(function* () {
+    const providerId = yield* validateUuid(flags.providerId).pipe(
+      Result.match({ onFailure: Effect.fail, onSuccess: Effect.succeed }),
+    );
+
+    if (flags.domains.length > 0 && flags.addDomains.length > 0) {
+      return yield* Effect.fail(
+        new LegacySsoMutexFlagError({
+          message: "only one of --domains or --add-domains may be set",
+        }),
+      );
+    }
+    if (flags.domains.length > 0 && flags.removeDomains.length > 0) {
+      return yield* Effect.fail(
+        new LegacySsoMutexFlagError({
+          message: "only one of --domains or --remove-domains may be set",
+        }),
+      );
+    }
+    if (Option.isSome(flags.metadataFile) && Option.isSome(flags.metadataUrl)) {
+      return yield* Effect.fail(
+        new LegacySsoMutexFlagError({
+          message: "only one of --metadata-file or --metadata-url may be set",
+        }),
+      );
+    }
+
+    const ref = yield* resolver.resolve(flags.projectRef);
+
+    yield* Effect.gen(function* () {
+      const fetching =
+        output.format === "text" ? yield* output.task("Updating SSO provider...") : undefined;
+
+      // Go's `update.go:42` always GETs first, regardless of which flags are set.
+      const existing = yield* api.v1.getASsoProvider({ ref, provider_id: providerId }).pipe(
+        Effect.tapError(() => fetching?.fail() ?? Effect.void),
+        Effect.catch((cause) => handleGetError(ref, providerId, cause)),
+      );
+
+      const body: Record<string, unknown> = {};
+
+      if (Option.isSome(flags.metadataFile)) {
+        const xml = yield* readMetadata(flags.metadataFile.value);
+        body["metadata_xml"] = xml;
+      } else if (Option.isSome(flags.metadataUrl)) {
+        if (!flags.skipUrlValidation) {
+          yield* validateMetadataUrl(flags.metadataUrl.value).pipe(
+            // Go's `update.go:69` wraps the cause with `%w Use --skip-url-validation to
+            // suppress this error.` — note the single space between cause and `Use` and
+            // the trailing period. Go's `create.go:47` uses the same format minus the
+            // trailing period; `sso add` mirrors that.
+            Effect.mapError(
+              (cause) =>
+                new LegacySsoUpdateMetadataFileError({
+                  message: `${cause.message} Use --skip-url-validation to suppress this error.`,
+                }),
+            ),
+          );
+        }
+        body["metadata_url"] = flags.metadataUrl.value;
+      }
+
+      if (Option.isSome(flags.attributeMappingFile)) {
+        const mapping = yield* readAttributeMapping(flags.attributeMappingFile.value);
+        body["attribute_mapping"] = mapping;
+      }
+
+      if (flags.domains.length > 0) {
+        body["domains"] = [...flags.domains];
+      } else if (flags.addDomains.length > 0 || flags.removeDomains.length > 0) {
+        body["domains"] = mergeDomains(existing.domains, flags.addDomains, flags.removeDomains);
+      }
+
+      if (Option.isSome(flags.nameIdFormat)) {
+        body["name_id_format"] = flags.nameIdFormat.value;
+      }
+
+      const tokenOpt = yield* resolveLegacyAccessToken;
+
+      // See `add.handler.ts` for the rationale behind `bearerToken(Redacted)`.
+      const request = HttpClientRequest.put(
+        `${cliConfig.apiUrl}/v1/projects/${ref}/config/auth/sso/providers/${providerId}`,
+      ).pipe(
+        Option.isSome(tokenOpt) ? HttpClientRequest.bearerToken(tokenOpt.value) : (req) => req,
+        HttpClientRequest.setHeader("User-Agent", cliConfig.userAgent),
+        // See `add.handler.ts` — Go-struct key order required for cli-e2e parity.
+        HttpClientRequest.bodyText(encodeGoStructJsonBody(body), "application/json"),
+      );
+
+      const response = yield* httpClient.execute(request).pipe(
+        Effect.tapError(() => fetching?.fail() ?? Effect.void),
+        Effect.mapError(
+          (cause) =>
+            new LegacySsoUpdateNetworkError({
+              message: `failed to update sso provider: ${String(cause)}`,
+            }),
+        ),
+      );
+
+      if (response.status !== 200) {
+        const rawBody = yield* response.text.pipe(Effect.orElseSucceed(() => ""));
+        // Cap + sanitise to match `mapLegacyHttpError`'s defences — see add handler
+        // for the rationale; the raw-HTTP path must not bypass these.
+        const bodyText = sanitizeLegacyErrorBody(rawBody);
+        yield* legacySuggestUpgrade({
+          projectRef: ref,
+          featureKey: "auth.saml_2",
+          statusCode: response.status,
+        });
+        yield* fetching?.fail() ?? Effect.void;
+        return yield* Effect.fail(
+          // Go reuses the GET error message even for PUT (see `update.go:133`).
+          new LegacySsoUpdateUnexpectedStatusError({
+            status: response.status,
+            body: bodyText,
+            message: `unexpected error fetching identity provider: ${bodyText}`,
+          }),
+        );
+      }
+
+      const parsedJson = yield* response.json.pipe(Effect.orElseSucceed((): unknown => ({})));
+      yield* fetching?.clear() ?? Effect.void;
+
+      const goFmt = Option.getOrUndefined(goOutputFlag);
+
+      if (goFmt === "json") {
+        yield* output.raw(encodeGoJson(parsedJson));
+        return;
+      }
+      if (goFmt === "yaml") {
+        yield* output.raw(encodeYaml(parsedJson));
+        return;
+      }
+      if (goFmt === "toml") {
+        yield* output.raw(encodeToml(parsedJson) + "\n");
+        return;
+      }
+      if (goFmt === "env") {
+        return;
+      }
+
+      if (output.format === "json" || output.format === "stream-json") {
+        yield* output.success(
+          "",
+          parsedJson !== null && typeof parsedJson === "object"
+            ? (parsedJson as Record<string, unknown>)
+            : { value: parsedJson },
+        );
+        return;
+      }
+
+      yield* output.raw(renderSingleProvider(toLegacySsoProviderView(parsedJson)));
+    }).pipe(Effect.ensuring(linkedProjectCache.cache(ref)));
+  }).pipe(Effect.ensuring(telemetryState.flush));
 });
diff --git a/apps/cli/src/legacy/commands/sso/update/update.integration.test.ts b/apps/cli/src/legacy/commands/sso/update/update.integration.test.ts
new file mode 100644
index 0000000000..c1060092cb
--- /dev/null
+++ b/apps/cli/src/legacy/commands/sso/update/update.integration.test.ts
@@ -0,0 +1,440 @@
+import { writeFileSync } from "node:fs";
+import { join } from "node:path";
+
+import { describe, expect, it } from "@effect/vitest";
+import { Effect, Exit, Option } from "effect";
+import * as HttpClientResponse from "effect/unstable/http/HttpClientResponse";
+
+import { mockAnalytics, mockOutput } from "../../../../../tests/helpers/mocks.ts";
+import {
+  buildLegacyTestRuntime,
+  LEGACY_VALID_REF,
+  mockLegacyCliConfig,
+  mockLegacyLinkedProjectCacheTracked,
+  mockLegacyPlatformApi,
+  mockLegacyTelemetryStateTracked,
+  useLegacyTempWorkdir,
+} from "../../../../../tests/helpers/legacy-mocks.ts";
+import { EventUpgradeSuggested } from "../../../../shared/telemetry/event-catalog.ts";
+import { legacySsoUpdate } from "./update.handler.ts";
+
+const VALID_PROVIDER_ID = "b5ae62f9-ef1d-4f11-a02b-731c8bbb11e8";
+
+const EXISTING_PROVIDER = {
+  id: VALID_PROVIDER_ID,
+  saml: { id: "saml-1", entity_id: "https://example.com" },
+  domains: [
+    { id: "d1", domain: "old1.com" },
+    { id: "d2", domain: "old2.com" },
+  ],
+};
+
+const RESPONSE_PROVIDER = {
+  id: VALID_PROVIDER_ID,
+  saml: { id: "saml-1", entity_id: "https://example.com" },
+  domains: [{ id: "d3", domain: "new.com" }],
+};
+
+const tempRoot = useLegacyTempWorkdir("supabase-sso-update-int-");
+
+interface SetupOpts {
+  format?: "text" | "json" | "stream-json";
+  goOutput?: "env" | "pretty" | "json" | "toml" | "yaml";
+  getStatus?: number;
+  getBody?: unknown;
+  putStatus?: number;
+  putBody?: unknown;
+  upgradeGate?: "gated" | "notGated";
+}
+
+function jsonResponse(
+  request: Parameters<typeof HttpClientResponse.fromWeb>[0],
+  status: number,
+  body: unknown,
+) {
+  return HttpClientResponse.fromWeb(
+    request,
+    new Response(JSON.stringify(body), {
+      status,
+      headers: { "content-type": "application/json" },
+    }),
+  );
+}
+
+function setup(opts: SetupOpts = {}) {
+  const out = mockOutput({ format: opts.format ?? "text" });
+  const analytics = mockAnalytics();
+  const telemetry = mockLegacyTelemetryStateTracked();
+  const cache = mockLegacyLinkedProjectCacheTracked();
+
+  const gate = opts.upgradeGate;
+  const getStatus = opts.getStatus ?? 200;
+  const getBody = opts.getBody ?? EXISTING_PROVIDER;
+  const putStatus = opts.putStatus ?? 200;
+  const putBody = opts.putBody ?? RESPONSE_PROVIDER;
+
+  const api = mockLegacyPlatformApi({
+    handler: (request) => {
+      const url = request.url;
+      if (url.includes("/config/auth/sso/providers/")) {
+        if (request.method === "GET")
+          return Effect.succeed(jsonResponse(request, getStatus, getBody));
+        if (request.method === "PUT")
+          return Effect.succeed(jsonResponse(request, putStatus, putBody));
+      }
+      if (url.endsWith(`/v1/projects/${LEGACY_VALID_REF}`)) {
+        if (gate === undefined) return Effect.succeed(jsonResponse(request, 404, {}));
+        return Effect.succeed(
+          jsonResponse(request, 200, {
+            id: LEGACY_VALID_REF,
+            ref: LEGACY_VALID_REF,
+            organization_id: "org-id",
+            organization_slug: "acme",
+            name: "Test",
+            region: "us-east-1",
+            created_at: "2023-01-01T00:00:00Z",
+            status: "ACTIVE_HEALTHY",
+            database: {
+              host: "db.example.com",
+              version: "15",
+              postgres_engine: "15",
+              release_channel: "ga",
+            },
+          }),
+        );
+      }
+      if (url.includes("/v1/organizations/acme/entitlements")) {
+        return Effect.succeed(
+          jsonResponse(request, 200, {
+            entitlements: [
+              {
+                feature: { key: "auth.saml_2", type: "boolean" },
+                hasAccess: gate === "notGated",
+                type: "boolean",
+                config: { enabled: false },
+              },
+            ],
+          }),
+        );
+      }
+      return Effect.succeed(jsonResponse(request, 404, {}));
+    },
+  });
+
+  const cliConfig = mockLegacyCliConfig({ workdir: tempRoot.current });
+  const layer = buildLegacyTestRuntime({
+    out,
+    api: { layer: api.layer, httpClientLayer: api.httpClientLayer },
+    cliConfig,
+    telemetry: telemetry.layer,
+    linkedProjectCache: cache.layer,
+    analytics,
+    goOutput: opts.goOutput === undefined ? Option.none() : Option.some(opts.goOutput),
+  });
+
+  return { layer, out, api, analytics, telemetry, cache };
+}
+
+const defaultFlags = {
+  projectRef: Option.none<string>(),
+  domains: [] as ReadonlyArray<string>,
+  addDomains: [] as ReadonlyArray<string>,
+  removeDomains: [] as ReadonlyArray<string>,
+  metadataFile: Option.none<string>(),
+  metadataUrl: Option.none<string>(),
+  skipUrlValidation: false,
+  attributeMappingFile: Option.none<string>(),
+  nameIdFormat: Option.none<
+    | "urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"
+    | "urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified"
+    | "urn:oasis:names:tc:SAML:2.0:nameid-format:persistent"
+    | "urn:oasis:names:tc:SAML:2.0:nameid-format:transient"
+  >(),
+  providerId: VALID_PROVIDER_ID,
+};
+
+describe("legacy sso update integration", () => {
+  it.live("rejects bad UUID", () => {
+    const { layer } = setup();
+    return Effect.gen(function* () {
+      const exit = yield* Effect.exit(
+        legacySsoUpdate({ ...defaultFlags, providerId: "not-a-uuid" }),
+      );
+      expect(Exit.isFailure(exit)).toBe(true);
+      if (Exit.isFailure(exit)) {
+        expect(JSON.stringify(exit.cause)).toContain("LegacySsoInvalidUuidError");
+      }
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("always GETs before PUTting", () => {
+    const { layer, api } = setup();
+    return Effect.gen(function* () {
+      yield* legacySsoUpdate(defaultFlags);
+      const methods = api.requests.map((r) => r.method);
+      expect(methods.indexOf("GET")).toBeLessThan(methods.indexOf("PUT"));
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("GET 404 → NotFound error", () => {
+    const { layer } = setup({ getStatus: 404, getBody: {} });
+    return Effect.gen(function* () {
+      const exit = yield* Effect.exit(legacySsoUpdate(defaultFlags));
+      expect(Exit.isFailure(exit)).toBe(true);
+      if (Exit.isFailure(exit)) {
+        expect(JSON.stringify(exit.cause)).toContain("LegacySsoUpdateNotFoundError");
+      }
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("GET 500 → unexpected-status error", () => {
+    const { layer } = setup({ getStatus: 500, getBody: { error: "boom" } });
+    return Effect.gen(function* () {
+      const exit = yield* Effect.exit(legacySsoUpdate(defaultFlags));
+      expect(Exit.isFailure(exit)).toBe(true);
+      if (Exit.isFailure(exit)) {
+        const dump = JSON.stringify(exit.cause);
+        expect(dump).toContain("LegacySsoUpdateUnexpectedStatusError");
+        expect(dump).toContain("unexpected error fetching identity provider");
+      }
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("mutex check: --domains + --add-domains fails", () => {
+    const { layer } = setup();
+    return Effect.gen(function* () {
+      const exit = yield* Effect.exit(
+        legacySsoUpdate({ ...defaultFlags, domains: ["a.com"], addDomains: ["b.com"] }),
+      );
+      expect(Exit.isFailure(exit)).toBe(true);
+      if (Exit.isFailure(exit)) {
+        expect(JSON.stringify(exit.cause)).toContain("LegacySsoMutexFlagError");
+      }
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("mutex check: --domains + --remove-domains fails", () => {
+    const { layer } = setup();
+    return Effect.gen(function* () {
+      const exit = yield* Effect.exit(
+        legacySsoUpdate({ ...defaultFlags, domains: ["a.com"], removeDomains: ["b.com"] }),
+      );
+      expect(Exit.isFailure(exit)).toBe(true);
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("mutex check: --metadata-file + --metadata-url fails", () => {
+    const { layer } = setup();
+    return Effect.gen(function* () {
+      const exit = yield* Effect.exit(
+        legacySsoUpdate({
+          ...defaultFlags,
+          metadataFile: Option.some("/tmp/x.xml"),
+          metadataUrl: Option.some("https://idp.example.com/m"),
+        }),
+      );
+      expect(Exit.isFailure(exit)).toBe(true);
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("--domains replaces domains verbatim", () => {
+    const { layer, api } = setup();
+    return Effect.gen(function* () {
+      yield* legacySsoUpdate({ ...defaultFlags, domains: ["new.com"] });
+      const putReq = api.requests.find((r) => r.method === "PUT");
+      expect((putReq?.body as { domains?: string[] })?.domains).toEqual(["new.com"]);
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("--add-domains merges with existing GET domains", () => {
+    const { layer, api } = setup();
+    return Effect.gen(function* () {
+      yield* legacySsoUpdate({ ...defaultFlags, addDomains: ["new.com"] });
+      const putReq = api.requests.find((r) => r.method === "PUT");
+      const domains = (putReq?.body as { domains: string[] })?.domains;
+      // Go map iteration is unordered — sort before asserting.
+      expect([...domains].sort()).toEqual(["new.com", "old1.com", "old2.com"]);
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("--remove-domains strips from existing GET domains", () => {
+    const { layer, api } = setup();
+    return Effect.gen(function* () {
+      yield* legacySsoUpdate({ ...defaultFlags, removeDomains: ["old1.com"] });
+      const putReq = api.requests.find((r) => r.method === "PUT");
+      const domains = (putReq?.body as { domains: string[] })?.domains;
+      expect([...domains].sort()).toEqual(["old2.com"]);
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("no domain flag set → body.domains omitted", () => {
+    const { layer, api } = setup();
+    return Effect.gen(function* () {
+      yield* legacySsoUpdate(defaultFlags);
+      const putReq = api.requests.find((r) => r.method === "PUT");
+      expect((putReq?.body as { domains?: string[] })?.domains).toBeUndefined();
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("reads metadata file and sends as metadata_xml on PUT", () => {
+    const path = join(tempRoot.current, "good.xml");
+    writeFileSync(path, '<?xml version="1.0"?><md/>');
+    const { layer, api } = setup();
+    return Effect.gen(function* () {
+      yield* legacySsoUpdate({ ...defaultFlags, metadataFile: Option.some(path) });
+      const putReq = api.requests.find((r) => r.method === "PUT");
+      expect((putReq?.body as { metadata_xml?: string })?.metadata_xml).toContain("<md/>");
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("preserves attribute_mapping `default` field in PUT body", () => {
+    const path = join(tempRoot.current, "map.json");
+    writeFileSync(path, JSON.stringify({ keys: { a: { default: 3 } } }));
+    const { layer, api } = setup();
+    return Effect.gen(function* () {
+      yield* legacySsoUpdate({ ...defaultFlags, attributeMappingFile: Option.some(path) });
+      const putReq = api.requests.find((r) => r.method === "PUT");
+      const mapping = (putReq?.body as { attribute_mapping?: { keys: { a: { default: number } } } })
+        ?.attribute_mapping;
+      expect(mapping?.keys.a.default).toBe(3);
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("PUT 200 → renders single-provider markdown in text mode", () => {
+    const { layer, out } = setup();
+    return Effect.gen(function* () {
+      yield* legacySsoUpdate(defaultFlags);
+      expect(out.stdoutText).toContain(VALID_PROVIDER_ID);
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("PUT 4xx + gated entitlement → unexpected error + cli_upgrade_suggested", () => {
+    // legacySuggestUpgrade fires only on 4xx (matches Go's `plan_gate.go:29`).
+    const { layer, analytics } = setup({
+      putStatus: 403,
+      putBody: { error: "forbidden" },
+      upgradeGate: "gated",
+    });
+    return Effect.gen(function* () {
+      const exit = yield* Effect.exit(legacySsoUpdate(defaultFlags));
+      expect(Exit.isFailure(exit)).toBe(true);
+      if (Exit.isFailure(exit)) {
+        expect(JSON.stringify(exit.cause)).toContain("LegacySsoUpdateUnexpectedStatusError");
+      }
+      expect(analytics.captured.some((c) => c.event === EventUpgradeSuggested)).toBe(true);
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("Go --output=env emits nothing", () => {
+    const { layer, out } = setup({ goOutput: "env" });
+    return Effect.gen(function* () {
+      yield* legacySsoUpdate(defaultFlags);
+      expect(out.stdoutText).toBe("");
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("Go --output=json encodes response verbatim", () => {
+    const { layer, out } = setup({ goOutput: "json" });
+    return Effect.gen(function* () {
+      yield* legacySsoUpdate(defaultFlags);
+      expect(out.stdoutText).toContain(VALID_PROVIDER_ID);
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("TS --output-format=json emits success", () => {
+    const { layer, out } = setup({ format: "json" });
+    return Effect.gen(function* () {
+      yield* legacySsoUpdate(defaultFlags);
+      expect(out.messages.some((m) => m.type === "success")).toBe(true);
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("flushes telemetry even on GET failure", () => {
+    const { layer, telemetry } = setup({ getStatus: 500, getBody: {} });
+    return Effect.gen(function* () {
+      yield* Effect.exit(legacySsoUpdate(defaultFlags));
+      expect(telemetry.flushed).toBe(true);
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("Go --output=yaml encodes response verbatim", () => {
+    const { layer, out } = setup({ goOutput: "yaml" });
+    return Effect.gen(function* () {
+      yield* legacySsoUpdate(defaultFlags);
+      expect(out.stdoutText).toContain(VALID_PROVIDER_ID);
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("Go --output=toml encodes response verbatim", () => {
+    const { layer, out } = setup({ goOutput: "toml" });
+    return Effect.gen(function* () {
+      yield* legacySsoUpdate(defaultFlags);
+      expect(out.stdoutText).toContain(VALID_PROVIDER_ID);
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("nameIdFormat is forwarded in PUT body when provided", () => {
+    const { layer, api } = setup();
+    return Effect.gen(function* () {
+      yield* legacySsoUpdate({
+        ...defaultFlags,
+        nameIdFormat: Option.some("urn:oasis:names:tc:SAML:2.0:nameid-format:persistent"),
+      });
+      const putReq = api.requests.find((r) => r.method === "PUT");
+      expect((putReq?.body as { name_id_format?: string })?.name_id_format).toBe(
+        "urn:oasis:names:tc:SAML:2.0:nameid-format:persistent",
+      );
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("malformed metadata URL surfaces as update metadata file error", () => {
+    const { layer } = setup();
+    return Effect.gen(function* () {
+      const exit = yield* Effect.exit(
+        legacySsoUpdate({
+          ...defaultFlags,
+          metadataUrl: Option.some("::::not a url::::"),
+          skipUrlValidation: false,
+        }),
+      );
+      expect(Exit.isFailure(exit)).toBe(true);
+      if (Exit.isFailure(exit)) {
+        const dump = JSON.stringify(exit.cause);
+        expect(dump).toContain("LegacySsoUpdateMetadataFileError");
+        // Per Go's `update.go:69`: error tail is `… Use --skip-url-validation to suppress this error.`
+        // (trailing period).
+        expect(dump).toContain("Use --skip-url-validation to suppress this error.");
+      }
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("malformed attribute-mapping JSON surfaces a tagged error", () => {
+    const path = join(tempRoot.current, "malformed.json");
+    writeFileSync(path, "{not json}");
+    const { layer } = setup();
+    return Effect.gen(function* () {
+      const exit = yield* Effect.exit(
+        legacySsoUpdate({ ...defaultFlags, attributeMappingFile: Option.some(path) }),
+      );
+      expect(Exit.isFailure(exit)).toBe(true);
+      if (Exit.isFailure(exit)) {
+        expect(JSON.stringify(exit.cause)).toContain("LegacySsoUpdateAttributeMappingFileError");
+      }
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("--add-domains + --remove-domains combined apply remove then add", () => {
+    const { layer, api } = setup();
+    return Effect.gen(function* () {
+      yield* legacySsoUpdate({
+        ...defaultFlags,
+        addDomains: ["new.com"],
+        removeDomains: ["old1.com"],
+      });
+      const putReq = api.requests.find((r) => r.method === "PUT");
+      const domains = (putReq?.body as { domains: string[] })?.domains;
+      // Go uses map iteration → unordered; sort before asserting.
+      expect([...domains].sort()).toEqual(["new.com", "old2.com"]);
+    }).pipe(Effect.provide(layer));
+  });
+});
diff --git a/apps/cli/src/legacy/config/legacy-cli-config.layer.ts b/apps/cli/src/legacy/config/legacy-cli-config.layer.ts
new file mode 100644
index 0000000000..3046a1367e
--- /dev/null
+++ b/apps/cli/src/legacy/config/legacy-cli-config.layer.ts
@@ -0,0 +1,154 @@
+import { Effect, FileSystem, Layer, Option, Path, Redacted } from "effect";
+import { parse as parseYaml } from "yaml";
+import { CLI_VERSION } from "../../shared/cli/version.ts";
+import { LegacyProfileFlag, LegacyWorkdirFlag } from "../../shared/legacy/global-flags.ts";
+import { RuntimeInfo } from "../../shared/runtime/runtime-info.service.ts";
+import { LegacyCliConfig, type LegacyProfileName } from "./legacy-cli-config.service.ts";
+
+interface ResolvedProfile {
+  readonly name: string;
+  readonly apiUrl: string;
+}
+
+const BUILTIN_PROFILES: Record<LegacyProfileName, ResolvedProfile> = {
+  supabase: { name: "supabase", apiUrl: "https://api.supabase.com" },
+  "supabase-staging": { name: "supabase-staging", apiUrl: "https://api.supabase.green" },
+  "supabase-local": { name: "supabase-local", apiUrl: "http://localhost:8080" },
+};
+
+function isBuiltinProfileName(value: string): value is LegacyProfileName {
+  return value in BUILTIN_PROFILES;
+}
+
+function safeParseYaml(text: string): { name?: unknown; api_url?: unknown } | undefined {
+  try {
+    const value = parseYaml(text);
+    return value !== null && typeof value === "object"
+      ? (value as { name?: unknown; api_url?: unknown })
+      : undefined;
+  } catch {
+    return undefined;
+  }
+}
+
+/**
+ * Resolves the profile that produces the API URL. Mirrors Go's `LoadProfile`
+ * (`apps/cli-go/internal/utils/profile.go:96-118`):
+ *
+ * 1. If the token matches a built-in profile name, use that.
+ * 2. Otherwise treat the token as a path to a YAML config file with `api_url:`.
+ * 3. Fall back to the `supabase` built-in if the file is missing or malformed.
+ *
+ * The cli-e2e harness depends on (2) — it writes a per-test YAML profile and
+ * sets `SUPABASE_PROFILE=<that-path>` so both the Go and ts-legacy binaries
+ * route requests to the local replay server.
+ */
+function resolveProfile(
+  flagValue: string,
+  envValue: string | undefined,
+  fs: FileSystem.FileSystem,
+): Effect.Effect<ResolvedProfile> {
+  return Effect.gen(function* () {
+    const token = flagValue !== "supabase" ? flagValue : (envValue ?? "supabase");
+
+    if (isBuiltinProfileName(token)) {
+      return BUILTIN_PROFILES[token];
+    }
+
+    const content = yield* fs.readFileString(token).pipe(Effect.option);
+    if (Option.isNone(content)) return BUILTIN_PROFILES.supabase;
+
+    const parsed = safeParseYaml(content.value);
+    if (parsed === undefined || typeof parsed.api_url !== "string") {
+      return BUILTIN_PROFILES.supabase;
+    }
+    return {
+      name: typeof parsed.name === "string" ? parsed.name : "supabase",
+      apiUrl: parsed.api_url,
+    };
+  });
+}
+
+function resolveWorkdir(
+  flagValue: Option.Option<string>,
+  envValue: string | undefined,
+  cwd: string,
+  configTomlExists: (path: string) => Effect.Effect<boolean>,
+  path: Path.Path,
+): Effect.Effect<string> {
+  return Effect.gen(function* () {
+    if (Option.isSome(flagValue) && flagValue.value.length > 0) {
+      return flagValue.value;
+    }
+    if (envValue !== undefined && envValue.length > 0) {
+      return envValue;
+    }
+    let current = cwd;
+    // Walk up until we hit a directory containing supabase/config.toml or the FS root.
+    while (true) {
+      const candidate = path.join(current, "supabase", "config.toml");
+      if (yield* configTomlExists(candidate)) {
+        return current;
+      }
+      const parent = path.dirname(current);
+      if (parent === current) {
+        return cwd;
+      }
+      current = parent;
+    }
+  });
+}
+
+export const legacyCliConfigLayer = Layer.unwrap(
+  Effect.gen(function* () {
+    const profileFlag = yield* LegacyProfileFlag;
+    const workdirFlag = yield* LegacyWorkdirFlag;
+
+    return Layer.effect(
+      LegacyCliConfig,
+      Effect.gen(function* () {
+        const fs = yield* FileSystem.FileSystem;
+        const path = yield* Path.Path;
+        const runtimeInfo = yield* RuntimeInfo;
+        const env = process.env;
+
+        const { name: profile, apiUrl } = yield* resolveProfile(
+          profileFlag,
+          env["SUPABASE_PROFILE"],
+          fs,
+        );
+
+        const rawAccessToken = env["SUPABASE_ACCESS_TOKEN"];
+        const accessToken =
+          rawAccessToken === undefined || rawAccessToken.length === 0
+            ? Option.none<Redacted.Redacted<string>>()
+            : Option.some(Redacted.make(rawAccessToken, { label: "SUPABASE_ACCESS_TOKEN" }));
+
+        const rawProjectId = env["SUPABASE_PROJECT_ID"];
+        const projectId =
+          rawProjectId === undefined || rawProjectId.length === 0
+            ? Option.none<string>()
+            : Option.some(rawProjectId);
+
+        const workdir = yield* resolveWorkdir(
+          workdirFlag,
+          env["SUPABASE_WORKDIR"],
+          runtimeInfo.cwd,
+          (filePath) => fs.exists(filePath).pipe(Effect.orElseSucceed(() => false)),
+          path,
+        );
+
+        const userAgent = `SupabaseCLI/${CLI_VERSION}`;
+
+        return LegacyCliConfig.of({
+          profile,
+          apiUrl,
+          accessToken,
+          projectId,
+          workdir,
+          userAgent,
+        });
+      }),
+    );
+  }),
+);
diff --git a/apps/cli/src/legacy/config/legacy-cli-config.layer.unit.test.ts b/apps/cli/src/legacy/config/legacy-cli-config.layer.unit.test.ts
new file mode 100644
index 0000000000..7c311d8c5a
--- /dev/null
+++ b/apps/cli/src/legacy/config/legacy-cli-config.layer.unit.test.ts
@@ -0,0 +1,205 @@
+import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+
+import { describe, expect, it } from "@effect/vitest";
+import { BunServices } from "@effect/platform-bun";
+import { Effect, Layer, Option, Redacted } from "effect";
+import { afterEach, beforeEach } from "vitest";
+
+import { LegacyProfileFlag, LegacyWorkdirFlag } from "../../shared/legacy/global-flags.ts";
+import { mockRuntimeInfo, processEnvLayer } from "../../../tests/helpers/mocks.ts";
+import { legacyCliConfigLayer } from "./legacy-cli-config.layer.ts";
+import { LegacyCliConfig } from "./legacy-cli-config.service.ts";
+
+function makeLayer(opts: {
+  profileFlag?: string;
+  workdirFlag?: Option.Option<string>;
+  env?: Record<string, string | undefined>;
+  cwd?: string;
+}) {
+  const profileFlag = opts.profileFlag ?? "supabase";
+  const workdirFlag = opts.workdirFlag ?? Option.none<string>();
+  return legacyCliConfigLayer.pipe(
+    Layer.provide(Layer.succeed(LegacyProfileFlag, profileFlag)),
+    Layer.provide(Layer.succeed(LegacyWorkdirFlag, workdirFlag)),
+    Layer.provide(mockRuntimeInfo({ cwd: opts.cwd ?? "/test/cwd" })),
+    Layer.provide(BunServices.layer),
+    Layer.provide(processEnvLayer(opts.env ?? {})),
+  );
+}
+
+let tempRoot: string;
+
+beforeEach(() => {
+  tempRoot = mkdtempSync(join(tmpdir(), "supabase-legacy-cli-config-"));
+});
+
+afterEach(() => {
+  rmSync(tempRoot, { recursive: true, force: true });
+});
+
+describe("legacyCliConfigLayer", () => {
+  it.effect("defaults to supabase profile and api.supabase.com when no flags or env", () =>
+    Effect.gen(function* () {
+      const config = yield* LegacyCliConfig;
+      expect(config.profile).toBe("supabase");
+      expect(config.apiUrl).toBe("https://api.supabase.com");
+    }).pipe(Effect.provide(makeLayer({ cwd: tempRoot }))),
+  );
+
+  it.effect("uses SUPABASE_PROFILE env when the flag is left at default", () =>
+    Effect.gen(function* () {
+      const config = yield* LegacyCliConfig;
+      expect(config.profile).toBe("supabase-staging");
+      expect(config.apiUrl).toBe("https://api.supabase.green");
+    }).pipe(
+      Effect.provide(makeLayer({ env: { SUPABASE_PROFILE: "supabase-staging" }, cwd: tempRoot })),
+    ),
+  );
+
+  it.effect("uses supabase-local profile and localhost API URL", () =>
+    Effect.gen(function* () {
+      const config = yield* LegacyCliConfig;
+      expect(config.apiUrl).toBe("http://localhost:8080");
+    }).pipe(Effect.provide(makeLayer({ profileFlag: "supabase-local", cwd: tempRoot }))),
+  );
+
+  it.effect(
+    "falls back to supabase profile when SUPABASE_PROFILE is neither a known name nor a readable file",
+    () =>
+      Effect.gen(function* () {
+        const config = yield* LegacyCliConfig;
+        expect(config.profile).toBe("supabase");
+        expect(config.apiUrl).toBe("https://api.supabase.com");
+      }).pipe(
+        Effect.provide(makeLayer({ env: { SUPABASE_PROFILE: "rogue-profile" }, cwd: tempRoot })),
+      ),
+  );
+
+  it.effect("loads api_url and name from a YAML profile file (Go-parity dual semantics)", () => {
+    const profilePath = join(tempRoot, "profile.yaml");
+    writeFileSync(
+      profilePath,
+      ["name: cli-e2e", 'api_url: "http://127.0.0.1:9999"', "project_host: localhost"].join("\n"),
+    );
+    return Effect.gen(function* () {
+      const config = yield* LegacyCliConfig;
+      expect(config.profile).toBe("cli-e2e");
+      expect(config.apiUrl).toBe("http://127.0.0.1:9999");
+    }).pipe(Effect.provide(makeLayer({ env: { SUPABASE_PROFILE: profilePath }, cwd: tempRoot })));
+  });
+
+  it.effect(
+    "falls back to supabase profile when SUPABASE_PROFILE points to a non-existent file",
+    () =>
+      Effect.gen(function* () {
+        const config = yield* LegacyCliConfig;
+        expect(config.profile).toBe("supabase");
+        expect(config.apiUrl).toBe("https://api.supabase.com");
+      }).pipe(
+        Effect.provide(
+          makeLayer({
+            env: { SUPABASE_PROFILE: join(tempRoot, "missing.yaml") },
+            cwd: tempRoot,
+          }),
+        ),
+      ),
+  );
+
+  it.effect("falls back to supabase profile when SUPABASE_PROFILE points to malformed YAML", () => {
+    const profilePath = join(tempRoot, "broken.yaml");
+    writeFileSync(profilePath, "::: not yaml :::\n[unbalanced");
+    return Effect.gen(function* () {
+      const config = yield* LegacyCliConfig;
+      expect(config.profile).toBe("supabase");
+      expect(config.apiUrl).toBe("https://api.supabase.com");
+    }).pipe(Effect.provide(makeLayer({ env: { SUPABASE_PROFILE: profilePath }, cwd: tempRoot })));
+  });
+
+  it.effect("ignores SUPABASE_API_URL — Go parity", () =>
+    Effect.gen(function* () {
+      const config = yield* LegacyCliConfig;
+      expect(config.apiUrl).toBe("https://api.supabase.com");
+    }).pipe(
+      Effect.provide(
+        makeLayer({ env: { SUPABASE_API_URL: "https://nope.example.com" }, cwd: tempRoot }),
+      ),
+    ),
+  );
+
+  it.effect("captures SUPABASE_ACCESS_TOKEN as a Redacted value", () =>
+    Effect.gen(function* () {
+      const config = yield* LegacyCliConfig;
+      expect(Option.isSome(config.accessToken)).toBe(true);
+      if (Option.isSome(config.accessToken)) {
+        expect(Redacted.value(config.accessToken.value)).toBe("sbp_test");
+      }
+    }).pipe(
+      Effect.provide(makeLayer({ env: { SUPABASE_ACCESS_TOKEN: "sbp_test" }, cwd: tempRoot })),
+    ),
+  );
+
+  it.effect("captures SUPABASE_PROJECT_ID env", () =>
+    Effect.gen(function* () {
+      const config = yield* LegacyCliConfig;
+      expect(Option.getOrUndefined(config.projectId)).toBe("myrefabcdefghijklmno");
+    }).pipe(
+      Effect.provide(
+        makeLayer({ env: { SUPABASE_PROJECT_ID: "myrefabcdefghijklmno" }, cwd: tempRoot }),
+      ),
+    ),
+  );
+
+  it.effect("prefers --workdir flag over env and walk-up", () =>
+    Effect.gen(function* () {
+      const config = yield* LegacyCliConfig;
+      expect(config.workdir).toBe("/flag/workdir");
+    }).pipe(
+      Effect.provide(
+        makeLayer({
+          workdirFlag: Option.some("/flag/workdir"),
+          env: { SUPABASE_WORKDIR: "/env/workdir" },
+          cwd: tempRoot,
+        }),
+      ),
+    ),
+  );
+
+  it.effect("uses SUPABASE_WORKDIR env when flag is unset", () =>
+    Effect.gen(function* () {
+      const config = yield* LegacyCliConfig;
+      expect(config.workdir).toBe("/env/workdir");
+    }).pipe(
+      Effect.provide(makeLayer({ env: { SUPABASE_WORKDIR: "/env/workdir" }, cwd: tempRoot })),
+    ),
+  );
+
+  it.effect("walks up from CWD looking for supabase/config.toml", () => {
+    const projectRoot = join(tempRoot, "project");
+    const nested = join(projectRoot, "deep", "child");
+    mkdirSync(join(projectRoot, "supabase"), { recursive: true });
+    mkdirSync(nested, { recursive: true });
+    writeFileSync(join(projectRoot, "supabase", "config.toml"), 'project_id = "x"\n');
+
+    return Effect.gen(function* () {
+      const config = yield* LegacyCliConfig;
+      expect(config.workdir).toBe(projectRoot);
+    }).pipe(Effect.provide(makeLayer({ cwd: nested })));
+  });
+
+  it.effect("falls back to CWD when no supabase/config.toml found", () =>
+    Effect.gen(function* () {
+      const config = yield* LegacyCliConfig;
+      expect(config.workdir).toBe(tempRoot);
+    }).pipe(Effect.provide(makeLayer({ cwd: tempRoot }))),
+  );
+
+  it.effect("populates userAgent from CLI_VERSION", () =>
+    Effect.gen(function* () {
+      const config = yield* LegacyCliConfig;
+      // The sentinel `0.0.0-dev` value applies when SUPABASE_CLI_VERSION is unset (tests).
+      expect(config.userAgent).toMatch(/^SupabaseCLI\//);
+    }).pipe(Effect.provide(makeLayer({ cwd: tempRoot }))),
+  );
+});
diff --git a/apps/cli/src/legacy/config/legacy-cli-config.service.ts b/apps/cli/src/legacy/config/legacy-cli-config.service.ts
new file mode 100644
index 0000000000..166edbcce7
--- /dev/null
+++ b/apps/cli/src/legacy/config/legacy-cli-config.service.ts
@@ -0,0 +1,24 @@
+import type { Option, Redacted } from "effect";
+import { Context } from "effect";
+
+/**
+ * Built-in profile names with hard-coded API URLs (matches Go's `allProfiles`).
+ *
+ * `LegacyCliConfig.profile` is typed as `string` (not this union) because Go also
+ * supports YAML profile files where `name:` is arbitrary user input. See
+ * `legacy-cli-config.layer.ts` for the resolution semantics.
+ */
+export type LegacyProfileName = "supabase" | "supabase-staging" | "supabase-local";
+
+interface LegacyCliConfigShape {
+  readonly profile: string;
+  readonly apiUrl: string;
+  readonly accessToken: Option.Option<Redacted.Redacted<string>>;
+  readonly projectId: Option.Option<string>;
+  readonly workdir: string;
+  readonly userAgent: string;
+}
+
+export class LegacyCliConfig extends Context.Service<LegacyCliConfig, LegacyCliConfigShape>()(
+  "supabase/legacy/CliConfig",
+) {}
diff --git a/apps/cli/src/legacy/config/legacy-project-ref.errors.ts b/apps/cli/src/legacy/config/legacy-project-ref.errors.ts
new file mode 100644
index 0000000000..9b672d3251
--- /dev/null
+++ b/apps/cli/src/legacy/config/legacy-project-ref.errors.ts
@@ -0,0 +1,10 @@
+import { Data } from "effect";
+
+export class LegacyProjectNotLinkedError extends Data.TaggedError("LegacyProjectNotLinkedError")<{
+  readonly message: string;
+}> {}
+
+export class LegacyInvalidProjectRefError extends Data.TaggedError("LegacyInvalidProjectRefError")<{
+  readonly ref: string;
+  readonly message: string;
+}> {}
diff --git a/apps/cli/src/legacy/config/legacy-project-ref.layer.ts b/apps/cli/src/legacy/config/legacy-project-ref.layer.ts
new file mode 100644
index 0000000000..f729eb13d9
--- /dev/null
+++ b/apps/cli/src/legacy/config/legacy-project-ref.layer.ts
@@ -0,0 +1,100 @@
+import { Effect, FileSystem, Layer, Option, Path } from "effect";
+
+import { LegacyPlatformApi } from "../auth/legacy-platform-api.service.ts";
+import { Output } from "../../shared/output/output.service.ts";
+import { Tty } from "../../shared/runtime/tty.service.ts";
+import { LegacyCliConfig } from "./legacy-cli-config.service.ts";
+import {
+  LegacyInvalidProjectRefError,
+  LegacyProjectNotLinkedError,
+} from "./legacy-project-ref.errors.ts";
+import {
+  INVALID_PROJECT_REF_MESSAGE,
+  LegacyProjectRefResolver,
+  PROJECT_NOT_LINKED_MESSAGE,
+  PROJECT_REF_PATTERN,
+} from "./legacy-project-ref.service.ts";
+
+function assertValid(ref: string): Effect.Effect<string, LegacyInvalidProjectRefError> {
+  if (PROJECT_REF_PATTERN.test(ref)) {
+    return Effect.succeed(ref);
+  }
+  return Effect.fail(
+    new LegacyInvalidProjectRefError({ ref, message: INVALID_PROJECT_REF_MESSAGE }),
+  );
+}
+
+export const legacyProjectRefLayer = Layer.effect(
+  LegacyProjectRefResolver,
+  Effect.gen(function* () {
+    const fs = yield* FileSystem.FileSystem;
+    const path = yield* Path.Path;
+    const cliConfig = yield* LegacyCliConfig;
+    const tty = yield* Tty;
+    const output = yield* Output;
+    const api = yield* LegacyPlatformApi;
+
+    const refPath = path.join(cliConfig.workdir, "supabase", ".temp", "project-ref");
+
+    const readRefFile = Effect.gen(function* () {
+      const exists = yield* fs.exists(refPath).pipe(Effect.orElseSucceed(() => false));
+      if (!exists) return Option.none<string>();
+      const content = yield* fs.readFileString(refPath).pipe(Effect.orElseSucceed(() => ""));
+      const trimmed = content.trim();
+      return trimmed.length === 0 ? Option.none<string>() : Option.some(trimmed);
+    });
+
+    const promptForProjectRef = Effect.gen(function* () {
+      const projects = yield* api.v1.listAllProjects().pipe(
+        Effect.mapError(
+          (cause) =>
+            new LegacyProjectNotLinkedError({
+              message: `${PROJECT_NOT_LINKED_MESSAGE}\n  Reason: failed to retrieve projects: ${String(
+                cause,
+              )}`,
+            }),
+        ),
+      );
+      const options = projects.map((project) => ({
+        value: project.id,
+        label: project.id,
+        hint: `name: ${project.name}, org: ${project.organization_slug}, region: ${project.region}`,
+      }));
+      const chosen = yield* output.promptSelect("Select a project:", options).pipe(
+        Effect.mapError(
+          (cause) =>
+            new LegacyProjectNotLinkedError({
+              message: `${PROJECT_NOT_LINKED_MESSAGE}\n  Reason: ${cause.detail}`,
+            }),
+        ),
+      );
+      // Go writes "Selected project: <ref>" to stderr (project_ref.go:50). In text mode
+      // `output.info` lands on stderr; in json/stream-json modes it is a no-op.
+      yield* output.info(`Selected project: ${chosen}`);
+      return chosen;
+    });
+
+    return LegacyProjectRefResolver.of({
+      resolve: (flagValue) =>
+        Effect.gen(function* () {
+          if (Option.isSome(flagValue) && flagValue.value.length > 0) {
+            return yield* assertValid(flagValue.value);
+          }
+          if (Option.isSome(cliConfig.projectId)) {
+            return yield* assertValid(cliConfig.projectId.value);
+          }
+          const fileValue = yield* readRefFile;
+          if (Option.isSome(fileValue)) {
+            return yield* assertValid(fileValue.value);
+          }
+          if (tty.stdinIsTty && output.interactive) {
+            const chosen = yield* promptForProjectRef;
+            return yield* assertValid(chosen);
+          }
+          return yield* Effect.fail(
+            new LegacyProjectNotLinkedError({ message: PROJECT_NOT_LINKED_MESSAGE }),
+          );
+        }),
+    });
+  }),
+);
diff --git a/apps/cli/src/legacy/config/legacy-project-ref.layer.unit.test.ts b/apps/cli/src/legacy/config/legacy-project-ref.layer.unit.test.ts
new file mode 100644
index 0000000000..5bbef78478
--- /dev/null
+++ b/apps/cli/src/legacy/config/legacy-project-ref.layer.unit.test.ts
@@ -0,0 +1,228 @@
+import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+
+import type { ApiClient } from "@supabase/api/effect";
+import { describe, expect, it } from "@effect/vitest";
+import { BunServices } from "@effect/platform-bun";
+import { Effect, Exit, Layer, Option } from "effect";
+import { afterEach, beforeEach } from "vitest";
+
+import { LegacyPlatformApi } from "../auth/legacy-platform-api.service.ts";
+import { mockOutput, mockTty } from "../../../tests/helpers/mocks.ts";
+import { LegacyCliConfig } from "./legacy-cli-config.service.ts";
+import { LegacyProjectRefResolver } from "./legacy-project-ref.service.ts";
+import { legacyProjectRefLayer } from "./legacy-project-ref.layer.ts";
+
+const VALID_REF = "abcdefghijklmnopqrst";
+const ANOTHER_REF = "qrstuvwxyzabcdefghij";
+
+function mockCliConfig(opts: { workdir: string; projectId?: string }) {
+  return Layer.succeed(LegacyCliConfig, {
+    profile: "supabase",
+    apiUrl: "https://api.supabase.com",
+    accessToken: Option.none(),
+    projectId: opts.projectId === undefined ? Option.none() : Option.some(opts.projectId),
+    workdir: opts.workdir,
+    userAgent: "SupabaseCLI/0.0.0-dev",
+  });
+}
+
+function mockPlatformApi(
+  projects: ReadonlyArray<{
+    id: string;
+    name: string;
+    organization_slug: string;
+    region: string;
+  }>,
+) {
+  const api = {
+    v1: {
+      listAllProjects: () => Effect.succeed(projects),
+    },
+  } as unknown as ApiClient;
+  return Layer.succeed(LegacyPlatformApi, api);
+}
+
+function makeLayer(opts: {
+  workdir: string;
+  projectId?: string;
+  stdinIsTty?: boolean;
+  format?: "text" | "json" | "stream-json";
+  projects?: ReadonlyArray<{
+    id: string;
+    name: string;
+    organization_slug: string;
+    region: string;
+  }>;
+  promptSelectResponses?: ReadonlyArray<string>;
+}) {
+  const out = mockOutput({
+    format: opts.format ?? "text",
+    promptSelectResponses: opts.promptSelectResponses,
+  });
+  const layer = legacyProjectRefLayer.pipe(
+    Layer.provide(mockCliConfig(opts)),
+    Layer.provide(mockTty({ stdinIsTty: opts.stdinIsTty ?? false, stdoutIsTty: false })),
+    Layer.provide(out.layer),
+    Layer.provide(mockPlatformApi(opts.projects ?? [])),
+    Layer.provide(BunServices.layer),
+  );
+  return { layer, out };
+}
+
+let tempRoot: string;
+
+beforeEach(() => {
+  tempRoot = mkdtempSync(join(tmpdir(), "supabase-legacy-project-ref-"));
+});
+
+afterEach(() => {
+  rmSync(tempRoot, { recursive: true, force: true });
+});
+
+function writeRefFile(workdir: string, content: string) {
+  const tempDir = join(workdir, "supabase", ".temp");
+  mkdirSync(tempDir, { recursive: true });
+  writeFileSync(join(tempDir, "project-ref"), content);
+}
+
+describe("legacyProjectRefLayer", () => {
+  it.effect("prefers --project-ref flag over env and file", () => {
+    writeRefFile(tempRoot, ANOTHER_REF);
+    const { layer } = makeLayer({ workdir: tempRoot, projectId: ANOTHER_REF });
+    return Effect.gen(function* () {
+      const { resolve } = yield* LegacyProjectRefResolver;
+      const ref = yield* resolve(Option.some(VALID_REF));
+      expect(ref).toBe(VALID_REF);
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.effect("uses SUPABASE_PROJECT_ID when flag is unset", () => {
+    writeRefFile(tempRoot, ANOTHER_REF);
+    const { layer } = makeLayer({ workdir: tempRoot, projectId: VALID_REF });
+    return Effect.gen(function* () {
+      const { resolve } = yield* LegacyProjectRefResolver;
+      const ref = yield* resolve(Option.none());
+      expect(ref).toBe(VALID_REF);
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.effect("reads <workdir>/supabase/.temp/project-ref when env and flag are unset", () => {
+    writeRefFile(tempRoot, VALID_REF);
+    const { layer } = makeLayer({ workdir: tempRoot });
+    return Effect.gen(function* () {
+      const { resolve } = yield* LegacyProjectRefResolver;
+      const ref = yield* resolve(Option.none());
+      expect(ref).toBe(VALID_REF);
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.effect("trims whitespace from the temp/project-ref file content", () => {
+    writeRefFile(tempRoot, `  ${VALID_REF}\n\n`);
+    const { layer } = makeLayer({ workdir: tempRoot });
+    return Effect.gen(function* () {
+      const { resolve } = yield* LegacyProjectRefResolver;
+      const ref = yield* resolve(Option.none());
+      expect(ref).toBe(VALID_REF);
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.effect("prompts via Output.promptSelect when on a TTY with no other source", () => {
+    const projects = [
+      { id: VALID_REF, name: "alpha", organization_slug: "acme", region: "us-east-1" },
+      { id: ANOTHER_REF, name: "beta", organization_slug: "acme", region: "eu-west-1" },
+    ];
+    const { layer, out } = makeLayer({
+      workdir: tempRoot,
+      stdinIsTty: true,
+      projects,
+      promptSelectResponses: [ANOTHER_REF],
+    });
+    return Effect.gen(function* () {
+      const { resolve } = yield* LegacyProjectRefResolver;
+      const ref = yield* resolve(Option.none());
+      expect(ref).toBe(ANOTHER_REF);
+      const call = out.promptSelectCalls[0];
+      expect(call?.message).toBe("Select a project:");
+      expect(call?.options[0]).toEqual({
+        value: VALID_REF,
+        label: VALID_REF,
+        hint: "name: alpha, org: acme, region: us-east-1",
+      });
+      // "Selected project: ..." is emitted via output.info (-> stderr in text mode).
+      const infos = out.messages.filter((m) => m.type === "info").map((m) => m.message);
+      expect(infos).toContain(`Selected project: ${ANOTHER_REF}`);
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.effect("does not persist the selected ref to the temp file (Go parity)", () => {
+    const projects = [
+      { id: VALID_REF, name: "alpha", organization_slug: "acme", region: "us-east-1" },
+    ];
+    const refPath = join(tempRoot, "supabase", ".temp", "project-ref");
+    const { layer } = makeLayer({
+      workdir: tempRoot,
+      stdinIsTty: true,
+      projects,
+      promptSelectResponses: [VALID_REF],
+    });
+    return Effect.gen(function* () {
+      const { resolve } = yield* LegacyProjectRefResolver;
+      yield* resolve(Option.none());
+      // The resolver must not write the file — only `supabase link` does.
+      const exists = yield* Effect.tryPromise({
+        try: () => import("node:fs").then((m) => m.existsSync(refPath)),
+        catch: () => false,
+      });
+      expect(exists).toBe(false);
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.effect("fails with LegacyProjectNotLinkedError on non-TTY with no source", () => {
+    const { layer } = makeLayer({ workdir: tempRoot });
+    return Effect.gen(function* () {
+      const { resolve } = yield* LegacyProjectRefResolver;
+      const exit = yield* Effect.exit(resolve(Option.none()));
+      expect(Exit.isFailure(exit)).toBe(true);
+      if (Exit.isFailure(exit)) {
+        const errorJson = JSON.stringify(exit.cause);
+        expect(errorJson).toContain("LegacyProjectNotLinkedError");
+        expect(errorJson).toContain("supabase link");
+      }
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.effect("fails with LegacyInvalidProjectRefError when the resolved ref is malformed", () => {
+    const { layer } = makeLayer({ workdir: tempRoot, projectId: "not-a-valid-ref" });
+    return Effect.gen(function* () {
+      const { resolve } = yield* LegacyProjectRefResolver;
+      const exit = yield* Effect.exit(resolve(Option.none()));
+      expect(Exit.isFailure(exit)).toBe(true);
+      if (Exit.isFailure(exit)) {
+        const errorJson = JSON.stringify(exit.cause);
+        expect(errorJson).toContain("LegacyInvalidProjectRefError");
+        expect(errorJson).toContain("Invalid project ref format");
+      }
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.effect("rejects invalid ref from --project-ref flag", () => {
+    const { layer } = makeLayer({ workdir: tempRoot });
+    return Effect.gen(function* () {
+      const { resolve } = yield* LegacyProjectRefResolver;
+      const exit = yield* Effect.exit(resolve(Option.some("BADREF")));
+      expect(Exit.isFailure(exit)).toBe(true);
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.effect("rejects invalid ref from temp/project-ref file", () => {
+    writeRefFile(tempRoot, "BADREF");
+    const { layer } = makeLayer({ workdir: tempRoot });
+    return Effect.gen(function* () {
+      const { resolve } = yield* LegacyProjectRefResolver;
+      const exit = yield* Effect.exit(resolve(Option.none()));
+      expect(Exit.isFailure(exit)).toBe(true);
+    }).pipe(Effect.provide(layer));
+  });
+});
diff --git a/apps/cli/src/legacy/config/legacy-project-ref.service.ts b/apps/cli/src/legacy/config/legacy-project-ref.service.ts
new file mode 100644
index 0000000000..647233038e
--- /dev/null
+++ b/apps/cli/src/legacy/config/legacy-project-ref.service.ts
@@ -0,0 +1,25 @@
+import type { Effect, Option } from "effect";
+import { Context } from "effect";
+
+import type {
+  LegacyInvalidProjectRefError,
+  LegacyProjectNotLinkedError,
+} from "./legacy-project-ref.errors.ts";
+
+interface LegacyProjectRefResolverShape {
+  readonly resolve: (
+    flagValue: Option.Option<string>,
+  ) => Effect.Effect<string, LegacyProjectNotLinkedError | LegacyInvalidProjectRefError, never>;
+}
+
+export class LegacyProjectRefResolver extends Context.Service<
+  LegacyProjectRefResolver,
+  LegacyProjectRefResolverShape
+>()("supabase/legacy/ProjectRefResolver") {}
+
+export const PROJECT_REF_PATTERN = /^[a-z]{20}$/;
+
+export const PROJECT_NOT_LINKED_MESSAGE = "Cannot find project ref. Have you run `supabase link`?";
+
+export const INVALID_PROJECT_REF_MESSAGE =
+  "Invalid project ref format. Must be like `abcdefghijklmnopqrst`.";
diff --git a/apps/cli/src/legacy/output/legacy-glamour-table.ts b/apps/cli/src/legacy/output/legacy-glamour-table.ts
new file mode 100644
index 0000000000..7c8d6cf42d
--- /dev/null
+++ b/apps/cli/src/legacy/output/legacy-glamour-table.ts
@@ -0,0 +1,45 @@
+/**
+ * renderGlamourTable - Reproduces the byte output of Go's `glamour.RenderTable`
+ * using `styles.AsciiStyle` for the markdown tables the Go CLI emits (see
+ * `apps/cli-go/internal/utils/output.go:109-122`).
+ *
+ * Output shape (each line terminated by "\n"):
+ *
+ *   <blank line>
+ *   <2-space prefix><nothing>            <- decorative empty line Glamour emits
+ *      <space><header-cell><space>|<space><header-cell><space>|...<space>
+ *   <2-space prefix><dashes>|<dashes>|...<dashes>
+ *      <space><data-cell><space>|<space>...<space>
+ *   ...
+ *   <blank line>
+ *
+ * Each cell is padded to the column width: max(len(header), max(len(row[i]))).
+ * The padded cell is wrapped with " ... " (one space either side), so the cell
+ * width in the output is colWidth + 2. The separator row uses dashes of the
+ * same width, joined by "|".
+ */
+export function renderGlamourTable(
+  headers: ReadonlyArray<string>,
+  rows: ReadonlyArray<ReadonlyArray<string>>,
+): string {
+  const widths = headers.map((header, columnIndex) =>
+    Math.max(header.length, ...rows.map((row) => (row[columnIndex] ?? "").length)),
+  );
+
+  const renderRow = (cells: ReadonlyArray<string>): string =>
+    "  " +
+    cells.map((cell, columnIndex) => " " + cell.padEnd(widths[columnIndex] ?? 0) + " ").join("|");
+
+  const separator = "  " + widths.map((width) => "-".repeat(width + 2)).join("|");
+
+  const lines: string[] = [];
+  lines.push("");
+  lines.push("  ");
+  lines.push(renderRow(headers));
+  lines.push(separator);
+  for (const row of rows) {
+    lines.push(renderRow(row));
+  }
+  lines.push("");
+  return lines.join("\n") + "\n";
+}
diff --git a/apps/cli/src/legacy/output/legacy-glamour-table.unit.test.ts b/apps/cli/src/legacy/output/legacy-glamour-table.unit.test.ts
new file mode 100644
index 0000000000..90b3701c04
--- /dev/null
+++ b/apps/cli/src/legacy/output/legacy-glamour-table.unit.test.ts
@@ -0,0 +1,43 @@
+import { describe, expect, it } from "vitest";
+
+import { renderGlamourTable } from "./legacy-glamour-table.ts";
+
+describe("renderGlamourTable", () => {
+  // Byte-for-byte parity with the Go fixture in
+  // apps/cli-go/internal/backups/list/list_test.go (TestListBackup/lists PITR backup).
+  it("matches the Go PITR-backup table fixture", () => {
+    const out = renderGlamourTable(
+      ["REGION", "WALG", "PITR", "EARLIEST TIMESTAMP", "LATEST TIMESTAMP"],
+      [["Southeast Asia (Singapore)", "true", "true", "0", "0"]],
+    );
+
+    const expected =
+      "\n" +
+      "  \n" +
+      "   REGION                     | WALG | PITR | EARLIEST TIMESTAMP | LATEST TIMESTAMP \n" +
+      "  ----------------------------|------|------|--------------------|------------------\n" +
+      "   Southeast Asia (Singapore) | true | true | 0                  | 0                \n" +
+      "\n";
+
+    expect(out).toBe(expected);
+  });
+
+  // Byte-for-byte parity with the Go fixture in
+  // apps/cli-go/internal/backups/list/list_test.go (TestListBackup/lists WALG backup).
+  it("matches the Go logical-backup table fixture", () => {
+    const out = renderGlamourTable(
+      ["REGION", "BACKUP TYPE", "STATUS", "CREATED AT (UTC)"],
+      [["Southeast Asia (Singapore)", "PHYSICAL", "COMPLETED", "2026-02-08 16:44:07"]],
+    );
+
+    const expected =
+      "\n" +
+      "  \n" +
+      "   REGION                     | BACKUP TYPE | STATUS    | CREATED AT (UTC)    \n" +
+      "  ----------------------------|-------------|-----------|---------------------\n" +
+      "   Southeast Asia (Singapore) | PHYSICAL    | COMPLETED | 2026-02-08 16:44:07 \n" +
+      "\n";
+
+    expect(out).toBe(expected);
+  });
+});
diff --git a/apps/cli/src/legacy/shared/legacy-go-output.encoders.ts b/apps/cli/src/legacy/shared/legacy-go-output.encoders.ts
new file mode 100644
index 0000000000..8b5038dcfe
--- /dev/null
+++ b/apps/cli/src/legacy/shared/legacy-go-output.encoders.ts
@@ -0,0 +1,168 @@
+import { stringify as stringifyToml } from "smol-toml";
+import { stringify as stringifyYaml } from "yaml";
+
+/**
+ * Reproduces Go's `encoding/json` output:
+ *   - Top-level and nested struct fields serialize in alphabetical key order.
+ *   - Trailing newline (matches `encoding/json` MarshalIndent + fmt.Println).
+ *
+ * The optional `nullForEmptyArrays` option mirrors Go's `null` serialization for nil
+ * slices: when the schema decodes both `null` and `[]` to `[]` upstream, the caller can
+ * list array keys that should re-substitute `null` for empty arrays so the JSON bytes
+ * match Go's output. Used by `backups list` to preserve its PITR-only `"backups": null`
+ * shape. Most commands don't need this option.
+ */
+export function encodeGoJson<T>(
+  value: T,
+  options?: { readonly nullForEmptyArrays?: ReadonlyArray<string> },
+): string {
+  let source: unknown = value;
+  const nullKeys = options?.nullForEmptyArrays;
+  if (
+    nullKeys !== undefined &&
+    value !== null &&
+    typeof value === "object" &&
+    !Array.isArray(value)
+  ) {
+    const record = value as Record<string, unknown>;
+    const patched: Record<string, unknown> = { ...record };
+    for (const key of nullKeys) {
+      const v = record[key];
+      if (Array.isArray(v) && v.length === 0) {
+        patched[key] = null;
+      }
+    }
+    source = patched;
+  }
+  return JSON.stringify(sortKeysDeep(source), null, 2) + "\n";
+}
+
+function sortKeysDeep(value: unknown): unknown {
+  if (Array.isArray(value)) return value.map(sortKeysDeep);
+  if (value === null || typeof value !== "object") return value;
+  const sorted: Record<string, unknown> = {};
+  for (const key of Object.keys(value as Record<string, unknown>).sort()) {
+    sorted[key] = sortKeysDeep((value as Record<string, unknown>)[key]);
+  }
+  return sorted;
+}
+
+/**
+ * Serialize an outbound API request body the way Go's `json.Marshal` would
+ * for a struct: keys sorted alphabetically (the `@supabase/api`-generated
+ * structs declare fields alphabetically, and `json.Marshal` serializes in
+ * field-declaration order), no indentation, no trailing newline.
+ *
+ * Use this on the raw-HTTP code path in `sso add` / `sso update` (and future
+ * handlers that bypass the typed client). The cli-e2e replay server compares
+ * recorded request bodies via `JSON.stringify`-based string equality, so
+ * key-order parity is required for parity tests to pass.
+ *
+ * `encodeGoJson` is the parallel for human-facing `--output json` output
+ * (indented + trailing `\n`).
+ */
+export function encodeGoStructJsonBody(value: unknown): string {
+  return JSON.stringify(sortKeysDeep(value));
+}
+
+export function encodeYaml(value: unknown): string {
+  return stringifyYaml(value);
+}
+
+export function encodeToml(value: unknown): string {
+  // smol-toml refuses top-level non-object values; wrap if needed.
+  if (typeof value !== "object" || value === null || Array.isArray(value)) {
+    return stringifyToml({ value });
+  }
+  return stringifyToml(value as Record<string, unknown>);
+}
+
+/**
+ * Reproduces Go's `utils.ToEnvMap` + `godotenv.Marshal` byte shape for the
+ * Supabase CLI's `--output env` mode (see `apps/cli-go/internal/utils/output.go:86-107`).
+ *
+ *   - Viper's `AllKeys()` descends into nested maps using dotted paths; the loop
+ *     then `strings.ToUpper(strings.ReplaceAll(k, ".", "_"))` produces SCREAMING_SNAKE_CASE keys.
+ *   - Viper does **not** descend into slices. An array value lands as a single
+ *     leaf whose `GetString` rendering is the empty string — so e.g.
+ *     `{backups: [{...}, {...}]}` becomes one `BACKUPS=""` entry, not indexed leaves.
+ *   - Integer-parseable values are emitted unquoted (`KEY=123`), matching
+ *     `godotenv.Marshal`'s `strconv.Atoi` branch. Everything else is double-quoted
+ *     with `"` / `\\` escaped, matching the `fmt.Sprintf("%q", ...)` branch.
+ *   - Lines are sorted lexicographically by key, then joined with `\n`.
+ */
+export function encodeEnv(value: unknown): string {
+  const flat = flatten(value);
+  const lines: string[] = [];
+  const keys = Object.keys(flat).sort();
+  for (const key of keys) {
+    lines.push(`${key}=${formatEnvValue(flat[key] ?? "")}`);
+  }
+  return lines.join("\n");
+}
+
+function flatten(
+  value: unknown,
+  prefix = "",
+  out: Record<string, string> = {},
+): Record<string, string> {
+  if (value === null || value === undefined) {
+    if (prefix.length > 0) out[toEnvKey(prefix)] = "";
+    return out;
+  }
+  if (Array.isArray(value)) {
+    // Go's viper does not descend into slices — the entire array collapses to a
+    // single empty-string leaf at the array's parent key.
+    if (prefix.length > 0) out[toEnvKey(prefix)] = "";
+    return out;
+  }
+  if (typeof value === "object") {
+    // Go's viper.AllKeys() omits empty nested maps entirely (unlike empty
+    // slices, which leave a single empty-string leaf). Match that — recurse
+    // into populated maps; emit nothing for `{}`.
+    for (const [key, child] of Object.entries(value as Record<string, unknown>)) {
+      flatten(child, prefix.length === 0 ? key : `${prefix}.${key}`, out);
+    }
+    return out;
+  }
+  if (prefix.length > 0) {
+    out[toEnvKey(prefix)] = stringifyScalar(value);
+  }
+  return out;
+}
+
+function toEnvKey(key: string): string {
+  return key.replaceAll(".", "_").toUpperCase();
+}
+
+function stringifyScalar(value: unknown): string {
+  if (typeof value === "boolean") return value ? "true" : "false";
+  if (typeof value === "number") return Number.isFinite(value) ? String(value) : "";
+  return String(value);
+}
+
+// strconv.Atoi accepts an optional +/- sign followed by base-10 digits. Match
+// that surface so integer values flow through Go's unquoted `%d` branch.
+const INTEGER_PATTERN = /^[+-]?\d+$/;
+
+function formatEnvValue(value: string): string {
+  if (INTEGER_PATTERN.test(value)) {
+    const parsed = Number(value);
+    // Mirror godotenv's `%d` formatting (round-trip through int — drops a leading
+    // `+` and any leading zeros, matching Go's strconv.Atoi + fmt.Sprintf("%d").
+    if (Number.isSafeInteger(parsed)) {
+      return String(parsed);
+    }
+  }
+  // Match Go's `fmt.Sprintf("%q", ...)` escaping: backslash, double-quote, and the
+  // common C-style control characters \n / \r / \t. Without the control-character
+  // escapes a multi-line string value could become multiple KEY=VALUE assignments
+  // when a downstream shell `eval`s or `source`s the output.
+  const escaped = value
+    .replaceAll("\\", "\\\\")
+    .replaceAll('"', '\\"')
+    .replaceAll("\n", "\\n")
+    .replaceAll("\r", "\\r")
+    .replaceAll("\t", "\\t");
+  return `"${escaped}"`;
+}
diff --git a/apps/cli/src/legacy/shared/legacy-go-output.encoders.unit.test.ts b/apps/cli/src/legacy/shared/legacy-go-output.encoders.unit.test.ts
new file mode 100644
index 0000000000..9b245558ea
--- /dev/null
+++ b/apps/cli/src/legacy/shared/legacy-go-output.encoders.unit.test.ts
@@ -0,0 +1,228 @@
+import { V1ListAllBackupsOutput } from "@supabase/api/effect";
+import { describe, expect, it } from "vitest";
+
+import { encodeEnv, encodeGoJson, encodeToml, encodeYaml } from "./legacy-go-output.encoders.ts";
+
+// These encoders are type-generic. We keep one fixture shaped like the backups
+// response because the `nullForEmptyArrays` option (and the Go-parity byte
+// assertions that exercise it) were extracted from the backups port. The
+// encoder itself has no backups coupling — see the `{ items, name }` fixtures
+// below for plain-object coverage of the option path.
+const SAMPLE_RESPONSE: typeof V1ListAllBackupsOutput.Type = {
+  region: "ap-southeast-1",
+  walg_enabled: true,
+  pitr_enabled: true,
+  backups: [
+    {
+      id: 1,
+      is_physical_backup: true,
+      status: "COMPLETED",
+      inserted_at: "2026-02-08T16:44:07Z",
+    },
+  ],
+  physical_backup_data: {
+    earliest_physical_backup_date_unix: 1700000000,
+    latest_physical_backup_date_unix: 1700001000,
+  },
+};
+
+describe("encodeGoJson", () => {
+  it("emits Go's alphabetical struct-field order and trailing newline for a populated response", () => {
+    const out = encodeGoJson(SAMPLE_RESPONSE, { nullForEmptyArrays: ["backups"] });
+    expect(out).toBe(
+      `{
+  "backups": [
+    {
+      "id": 1,
+      "inserted_at": "2026-02-08T16:44:07Z",
+      "is_physical_backup": true,
+      "status": "COMPLETED"
+    }
+  ],
+  "physical_backup_data": {
+    "earliest_physical_backup_date_unix": 1700000000,
+    "latest_physical_backup_date_unix": 1700001000
+  },
+  "pitr_enabled": true,
+  "region": "ap-southeast-1",
+  "walg_enabled": true
+}
+`,
+    );
+  });
+
+  it("emits backups: null and an empty physical_backup_data object for a PITR-only response", () => {
+    // Matches Go's `apps/cli-go/internal/backups/list/list_test.go` "encodes json output" fixture
+    // — empty backups slice serializes as null, omitempty physical_backup_data fields drop out.
+    const out = encodeGoJson(
+      {
+        region: "ap-southeast-1",
+        walg_enabled: false,
+        pitr_enabled: false,
+        backups: [],
+        physical_backup_data: {},
+      },
+      { nullForEmptyArrays: ["backups"] },
+    );
+    expect(out).toBe(
+      `{
+  "backups": null,
+  "physical_backup_data": {},
+  "pitr_enabled": false,
+  "region": "ap-southeast-1",
+  "walg_enabled": false
+}
+`,
+    );
+  });
+
+  it("leaves arrays intact when nullForEmptyArrays is not provided", () => {
+    // Default behaviour for commands (e.g. ssl-enforcement) that have no nil-slice rewrite.
+    const out = encodeGoJson({ items: [], name: "x" });
+    expect(out).toBe(
+      `{
+  "items": [],
+  "name": "x"
+}
+`,
+    );
+  });
+
+  it("does not substitute null for non-empty arrays even when listed in nullForEmptyArrays", () => {
+    const out = encodeGoJson({ items: [1, 2], name: "x" }, { nullForEmptyArrays: ["items"] });
+    expect(out).toBe(
+      `{
+  "items": [
+    1,
+    2
+  ],
+  "name": "x"
+}
+`,
+    );
+  });
+});
+
+describe("encodeYaml", () => {
+  it("renders nested objects as YAML", () => {
+    const out = encodeYaml(SAMPLE_RESPONSE);
+    expect(out).toContain("region: ap-southeast-1");
+    expect(out).toContain("walg_enabled: true");
+    expect(out).toContain("status: COMPLETED");
+    expect(out).toContain("earliest_physical_backup_date_unix: 1700000000");
+  });
+});
+
+describe("encodeToml", () => {
+  it("renders a TOML document for the response", () => {
+    const out = encodeToml(SAMPLE_RESPONSE);
+    expect(out).toContain('region = "ap-southeast-1"');
+    expect(out).toContain("walg_enabled = true");
+    expect(out).toContain("[physical_backup_data]");
+    expect(out).toContain("earliest_physical_backup_date_unix = 1700000000");
+  });
+});
+
+describe("encodeEnv", () => {
+  it("quotes string values and flattens nested fields to uppercased dotted keys", () => {
+    const out = encodeEnv(SAMPLE_RESPONSE);
+    const lines = out.split("\n");
+    expect(lines).toContain('REGION="ap-southeast-1"');
+    // Booleans are stringified to "true"/"false" — not integers under strconv.Atoi,
+    // so godotenv quotes them.
+    expect(lines).toContain('WALG_ENABLED="true"');
+    expect(lines).toContain('PITR_ENABLED="true"');
+  });
+
+  it("emits integer-parseable values unquoted (matches godotenv strconv.Atoi branch)", () => {
+    const out = encodeEnv(SAMPLE_RESPONSE);
+    const lines = out.split("\n");
+    expect(lines).toContain("PHYSICAL_BACKUP_DATA_EARLIEST_PHYSICAL_BACKUP_DATE_UNIX=1700000000");
+    expect(lines).toContain("PHYSICAL_BACKUP_DATA_LATEST_PHYSICAL_BACKUP_DATE_UNIX=1700001000");
+  });
+
+  it("collapses arrays to a single empty leaf (Go viper does not descend into slices)", () => {
+    // Go output for `backups: [{...}]` is `BACKUPS=""`, not `BACKUPS_0_STATUS=...`
+    // — viper.AllKeys() stops at slice boundaries and GetString of a slice is "".
+    const out = encodeEnv(SAMPLE_RESPONSE);
+    const lines = out.split("\n");
+    expect(lines).toContain('BACKUPS=""');
+    expect(lines.some((line) => line.startsWith("BACKUPS_0_"))).toBe(false);
+  });
+
+  it("matches Go's full env output for the sample backup response", () => {
+    // Verified byte-for-byte against `apps/cli-go` invoking utils.EncodeOutput("env", ...).
+    expect(encodeEnv(SAMPLE_RESPONSE)).toBe(
+      [
+        'BACKUPS=""',
+        "PHYSICAL_BACKUP_DATA_EARLIEST_PHYSICAL_BACKUP_DATE_UNIX=1700000000",
+        "PHYSICAL_BACKUP_DATA_LATEST_PHYSICAL_BACKUP_DATE_UNIX=1700001000",
+        'PITR_ENABLED="true"',
+        'REGION="ap-southeast-1"',
+        'WALG_ENABLED="true"',
+      ].join("\n"),
+    );
+  });
+
+  it("escapes embedded backslashes and double quotes", () => {
+    const out = encodeEnv({ message: 'with "quotes" and \\backslash' });
+    expect(out).toBe('MESSAGE="with \\"quotes\\" and \\\\backslash"');
+  });
+
+  it("escapes embedded newlines, carriage returns, and tabs (Go %q parity)", () => {
+    // Without this, a multi-line string value would render as multiple lines in
+    // env output and be interpreted as separate KEY=VALUE assignments by a shell
+    // that `eval`s or `source`s the output.
+    const out = encodeEnv({ description: "line one\nline two\rwith\ttab" });
+    expect(out).toBe('DESCRIPTION="line one\\nline two\\rwith\\ttab"');
+  });
+
+  it("sorts keys deterministically and emits numeric leafs without quotes", () => {
+    const out = encodeEnv({ z: 1, a: 2, m: 3 });
+    expect(out.split("\n")).toEqual(["A=2", "M=3", "Z=1"]);
+  });
+
+  it("omits empty nested maps entirely (Go viper parity)", () => {
+    // Go output for `{physical_backup_data: {}}` is empty — viper.AllKeys()
+    // does not surface a key for a map with no children. Contrast with empty
+    // arrays, which Go DOES surface as `KEY=""`.
+    expect(encodeEnv({ physical_backup_data: {} })).toBe("");
+  });
+
+  it("matches Go for the PITR-only response shape with empty physical_backup_data", () => {
+    // Verified byte-for-byte against `apps/cli-go` invoking utils.EncodeOutput("env", ...)
+    // with a JSON-decoded V1BackupsResponse whose physical_backup_data is `{}`.
+    expect(
+      encodeEnv({
+        region: "ap-southeast-1",
+        walg_enabled: true,
+        pitr_enabled: true,
+        backups: [],
+        physical_backup_data: {},
+      }),
+    ).toBe(
+      ['BACKUPS=""', 'PITR_ENABLED="true"', 'REGION="ap-southeast-1"', 'WALG_ENABLED="true"'].join(
+        "\n",
+      ),
+    );
+  });
+
+  it("emits an empty-string value for an explicit null leaf", () => {
+    // Go: viper does surface a nil leaf as `KEY=""` (it still has a key path).
+    expect(encodeEnv({ physical_backup_data: { earliest_physical_backup_date_unix: null } })).toBe(
+      'PHYSICAL_BACKUP_DATA_EARLIEST_PHYSICAL_BACKUP_DATE_UNIX=""',
+    );
+  });
+
+  it("treats non-integer numeric strings as strings (quoted)", () => {
+    const out = encodeEnv({ ratio: "3.14", empty: "" });
+    const lines = out.split("\n");
+    expect(lines).toContain('RATIO="3.14"');
+    expect(lines).toContain('EMPTY=""');
+  });
+
+  it("handles negative integers unquoted", () => {
+    const out = encodeEnv({ offset: -42 });
+    expect(out).toBe("OFFSET=-42");
+  });
+});
diff --git a/apps/cli/src/legacy/shared/legacy-http-errors.ts b/apps/cli/src/legacy/shared/legacy-http-errors.ts
new file mode 100644
index 0000000000..ca2196f903
--- /dev/null
+++ b/apps/cli/src/legacy/shared/legacy-http-errors.ts
@@ -0,0 +1,100 @@
+import type { SupabaseApiError } from "@supabase/api/effect";
+import { Effect } from "effect";
+import * as HttpClientError from "effect/unstable/http/HttpClientError";
+
+// HttpClientError reasons that indicate the server returned an actual response (vs a transport
+// failure). Anything in this set surfaces as an `UnexpectedStatusError`; everything else maps
+// to a `NetworkError`.
+const RESPONSE_ERROR_TAGS: ReadonlySet<HttpClientError.HttpClientErrorReason["_tag"]> = new Set([
+  "StatusCodeError",
+  "DecodeError",
+  "EmptyBodyError",
+]);
+
+// Caps the response body that gets embedded in error structures. The Management API is
+// trusted, but capping prevents oversized error envelopes from flooding `--output-format json`
+// and avoids forwarding arbitrary bytes verbatim if the trust boundary ever changes.
+const MAX_BODY_LEN = 1024;
+
+/**
+ * Truncate + sanitize a response body for inclusion in an error message.
+ * Mirrors the policy applied by `mapLegacyHttpError` so handlers that bypass
+ * the typed client (e.g. `sso add` and `sso update` raw-HTTP POST/PUT) can
+ * share the same defence-in-depth.
+ */
+export function sanitizeLegacyErrorBody(input: string): string {
+  const capped = input.length > MAX_BODY_LEN ? input.slice(0, MAX_BODY_LEN) : input;
+  return sanitizeErrorBody(capped);
+}
+
+// Strip ASCII control characters from the response body before embedding it in an error
+// message. The Management API is trusted, but defence-in-depth: a body containing `\r\n`
+// could fracture a structured log line, and `\x00` could truncate output in shells that
+// treat NUL as EOS. Tab is preserved so JSON whitespace round-trips visually intact.
+function sanitizeErrorBody(input: string): string {
+  // Strip ASCII control chars except \t (0x09), \n (0x0a), \r (0x0d) and DEL (0x7f).
+  // Then also strip CR — we keep \n and \t because they appear in legitimate JSON
+  // pretty-printing and shouldn't visually corrupt single-line stderr output.
+  let out = "";
+  for (let i = 0; i < input.length; i++) {
+    const code = input.charCodeAt(i);
+    const isLowCtrl = code < 0x20 && code !== 0x09 && code !== 0x0a;
+    const isDel = code === 0x7f;
+    const isCr = code === 0x0d;
+    if (isLowCtrl || isDel || isCr) continue;
+    out += input[i];
+  }
+  return out;
+}
+
+type NetworkErrorFactory<E> = new (args: { readonly message: string }) => E;
+
+type StatusErrorFactory<E> = new (args: {
+  readonly status: number;
+  readonly body: string;
+  readonly message: string;
+}) => E;
+
+/**
+ * Build an error mapper that classifies a `SupabaseApiError` into either a typed network
+ * error or a typed unexpected-status error. Pulled out of individual command families so
+ * they share the dispatch logic, the body truncation, and the `RESPONSE_ERROR_TAGS` policy.
+ *
+ * `networkMessage` and `statusMessage` are templates: they build the human-readable error
+ * string with the same exact phrasing the Go CLI uses, so Go-parity status messages and
+ * existing error-message assertions continue to hold.
+ */
+export function mapLegacyHttpError<N, S>(opts: {
+  readonly networkError: NetworkErrorFactory<N>;
+  readonly statusError: StatusErrorFactory<S>;
+  readonly networkMessage: (cause: string) => string;
+  readonly statusMessage: (status: number, body: string) => string;
+}): (cause: SupabaseApiError) => Effect.Effect<never, N | S> {
+  return (cause) =>
+    Effect.gen(function* () {
+      if (HttpClientError.isHttpClientError(cause)) {
+        if (RESPONSE_ERROR_TAGS.has(cause.reason._tag) && cause.response !== undefined) {
+          const status = cause.response.status;
+          const rawBody = yield* cause.response.text.pipe(
+            Effect.orElseSucceed(() => cause.reason.description ?? ""),
+          );
+          const body = sanitizeLegacyErrorBody(rawBody);
+          return yield* Effect.fail(
+            new opts.statusError({
+              status,
+              body,
+              message: opts.statusMessage(status, body),
+            }),
+          );
+        }
+        const description = cause.reason.description ?? cause.reason._tag;
+        return yield* Effect.fail(
+          new opts.networkError({ message: opts.networkMessage(description) }),
+        );
+      }
+      // SchemaError or HttpBodyError — treat as transport-level network error.
+      return yield* Effect.fail(
+        new opts.networkError({ message: opts.networkMessage(String(cause)) }),
+      );
+    });
+}
diff --git a/apps/cli/src/legacy/shared/legacy-management-api-runtime.layer.ts b/apps/cli/src/legacy/shared/legacy-management-api-runtime.layer.ts
new file mode 100644
index 0000000000..f115f26148
--- /dev/null
+++ b/apps/cli/src/legacy/shared/legacy-management-api-runtime.layer.ts
@@ -0,0 +1,121 @@
+import { Layer } from "effect";
+import type * as HttpClient from "effect/unstable/http/HttpClient";
+
+import { LegacyCredentials } from "../auth/legacy-credentials.service.ts";
+import { legacyCredentialsLayer } from "../auth/legacy-credentials.layer.ts";
+import { legacyHttpClientLayer } from "../auth/legacy-http-debug.layer.ts";
+import { LegacyPlatformApi } from "../auth/legacy-platform-api.service.ts";
+import { legacyPlatformApiLayer } from "../auth/legacy-platform-api.layer.ts";
+import { LegacyCliConfig } from "../config/legacy-cli-config.service.ts";
+import { legacyCliConfigLayer } from "../config/legacy-cli-config.layer.ts";
+import { LegacyProjectRefResolver } from "../config/legacy-project-ref.service.ts";
+import { legacyProjectRefLayer } from "../config/legacy-project-ref.layer.ts";
+import { LegacyLinkedProjectCache } from "../telemetry/legacy-linked-project-cache.service.ts";
+import { legacyLinkedProjectCacheLayer } from "../telemetry/legacy-linked-project-cache.layer.ts";
+import { LegacyTelemetryState } from "../telemetry/legacy-telemetry-state.service.ts";
+import { legacyTelemetryStateLayer } from "../telemetry/legacy-telemetry-state.layer.ts";
+import { CommandRuntime } from "../../shared/runtime/command-runtime.service.ts";
+import { commandRuntimeLayer } from "../../shared/runtime/command-runtime.layer.ts";
+
+// Shared platform-API stack used by every Management-API legacy subcommand.
+// `legacyHttpClientLayer` wraps the default fetch transport with a debug logger when `--debug` is set.
+const legacyPlatformApiStack = legacyPlatformApiLayer.pipe(
+  Layer.provide(legacyCredentialsLayer),
+  Layer.provide(legacyCliConfigLayer),
+  Layer.provide(legacyHttpClientLayer),
+);
+
+/**
+ * Composes the runtime layer for a Management-API-style `supabase <command> <subcommand>`
+ * invocation.
+ *
+ * `legacyCliConfigLayer` must be piped to both `legacyPlatformApiStack` and
+ * `legacyProjectRefLayer`. `Layer.provide` satisfies a requirement on the target layer;
+ * it does not expose the provided service to siblings of a `Layer.mergeAll(...)`. The
+ * project-ref layer reads `LegacyCliConfig` directly for workdir/projectId resolution,
+ * so without an explicit provide here the bundled runtime panics with
+ * `Service not found: supabase/legacy/CliConfig`. Handlers that yield `LegacyCliConfig`
+ * directly (e.g. `branches get`, `legacySuggestUpgrade`) also need the service exposed
+ * at the top level of the merged layer, hence the bare `legacyCliConfigLayer` entry
+ * below.
+ *
+ * `legacyHttpClientLayer` and `LegacyCredentials` are exposed at the top level so
+ * handlers / helpers that bypass the typed Management API client can read them
+ * directly:
+ *   - `sso add` / `sso update` POST/PUT raw JSON to preserve arbitrary
+ *     `attribute_mapping.keys.<x>.default` fields the typed input schema omits.
+ *   - `legacySuggestUpgrade` GETs `/v1/projects/{ref}` and `/v1/organizations/{slug}/entitlements`
+ *     directly because the typed `V1GetProjectOutput` decode rejects the
+ *     `__PROJECT_REF__` placeholder cli-e2e replay fixtures embed in response bodies
+ *     (`ref: isMinLength(20)` fails on the 15-char placeholder).
+ *
+ * Layers are memoised by reference, so the merge + provide combos reuse the same
+ * instance instead of building two debug-logging wrappers / two keyring readers.
+ *
+ * @param subcommand - command path segments after `supabase`, e.g. `["backups", "list"]`.
+ */
+export function legacyManagementApiRuntimeLayer(subcommand: ReadonlyArray<string>) {
+  // Memoise the credentials layer so the top-level surface and the linked-project
+  // cache pipeline share one keyring/file lookup. Same rationale applies to the
+  // HTTP client + CLI config layers below.
+  const credentials = legacyCredentialsLayer.pipe(Layer.provide(legacyCliConfigLayer));
+  const built = Layer.mergeAll(
+    legacyPlatformApiStack,
+    legacyHttpClientLayer,
+    credentials,
+    legacyCliConfigLayer,
+    legacyProjectRefLayer.pipe(
+      Layer.provide(legacyPlatformApiStack),
+      Layer.provide(legacyCliConfigLayer),
+    ),
+    legacyLinkedProjectCacheLayer.pipe(
+      Layer.provide(credentials),
+      Layer.provide(legacyCliConfigLayer),
+      Layer.provide(legacyHttpClientLayer),
+    ),
+    legacyTelemetryStateLayer,
+    commandRuntimeLayer([...subcommand]),
+  );
+
+  // Compile-time guarantee that the merged layer exposes every service a
+  // Management-API legacy handler is allowed to yield from its top-level
+  // `Effect.fn` body. If a future handler yields a service NOT in this union,
+  // either:
+  //   (a) the new service belongs in the runtime layer — add it to the merge
+  //       above AND to `LegacyManagementApiServices` below, or
+  //   (b) the service comes from the surrounding root layer (`Output`,
+  //       `LegacyOutputFlag`, `Analytics`, `Stdio`, `Tty`, …) and is therefore
+  //       already provided via `runCli` / `cliProgramFor` — no change here.
+  //
+  // The assertion uses `unknown` for E and R so that the assertion ONLY fires
+  // for missing exposed services; changes to the layer's internal error /
+  // requirement channels do not perturb this check. cli-e2e parity tests
+  // surface missing-service runtime panics, but the same class of bug is now
+  // caught at compile time.
+  const _serviceCoverageCheck: Layer.Layer<LegacyManagementApiServices, unknown, unknown> = built;
+  void _serviceCoverageCheck;
+
+  return built;
+}
+
+/**
+ * Services that every Management-API legacy handler is allowed to yield
+ * directly from its top-level `Effect.fn` body. Adding a new `yield* X` in a
+ * handler without adding `X` here is a **compile error**, surfacing what was
+ * previously a runtime `Service not found: …` panic that only the cli-e2e
+ * parity suite caught.
+ *
+ * `Output`, `LegacyOutputFlag`, `Analytics`, `Stdio`, `Tty`, `ProcessControl`,
+ * and `RuntimeInfo` are intentionally NOT listed — they're root-level services
+ * provided by `runCli` / the shared `cliProgramFor`, not by this command-level
+ * runtime layer.
+ */
+export type LegacyManagementApiServices =
+  | LegacyPlatformApi
+  | HttpClient.HttpClient
+  | LegacyCredentials
+  | LegacyCliConfig
+  | LegacyProjectRefResolver
+  | LegacyLinkedProjectCache
+  | LegacyTelemetryState
+  | CommandRuntime;
diff --git a/apps/cli/src/legacy/shared/legacy-profile.ts b/apps/cli/src/legacy/shared/legacy-profile.ts
new file mode 100644
index 0000000000..d36d5047b2
--- /dev/null
+++ b/apps/cli/src/legacy/shared/legacy-profile.ts
@@ -0,0 +1,42 @@
+/**
+ * Built-in profile → environment endpoints. Mirrors the `allProfiles` table
+ * in `apps/cli-go/internal/utils/profile.go:30-91`. Both `project_host` (used
+ * to build `SUPABASE_URL = https://<ref>.<host>` for `branches get`) and
+ * `dashboard_url` (used by `legacySuggestUpgrade` to build the billing URL)
+ * live here so we have a single source of truth.
+ *
+ * YAML-mode profiles do not currently carry `project_host` or `dashboard_url`
+ * in the TS port; they fall back to the production endpoints, matching Go's
+ * behavior when an external profile YAML omits those keys.
+ */
+
+interface LegacyProfileEndpoints {
+  readonly projectHost: string;
+  readonly dashboardUrl: string;
+}
+
+const BUILT_IN: Readonly<Record<string, LegacyProfileEndpoints>> = {
+  supabase: { projectHost: "supabase.co", dashboardUrl: "https://supabase.com/dashboard" },
+  "supabase-staging": {
+    projectHost: "supabase.red",
+    dashboardUrl: "https://supabase.green/dashboard",
+  },
+  "supabase-local": {
+    projectHost: "supabase.red",
+    dashboardUrl: "http://localhost:8082",
+  },
+};
+
+const DEFAULT_ENDPOINTS: LegacyProfileEndpoints = BUILT_IN.supabase!;
+
+export function legacyProjectHost(profile: string): string {
+  return (BUILT_IN[profile] ?? DEFAULT_ENDPOINTS).projectHost;
+}
+
+export function legacyDashboardUrl(profile: string): string {
+  return (BUILT_IN[profile] ?? DEFAULT_ENDPOINTS).dashboardUrl;
+}
+
+export function legacyBillingUrl(profile: string, orgSlug: string): string {
+  return `${legacyDashboardUrl(profile)}/org/${orgSlug}/billing`;
+}
diff --git a/apps/cli/src/legacy/shared/legacy-profile.unit.test.ts b/apps/cli/src/legacy/shared/legacy-profile.unit.test.ts
new file mode 100644
index 0000000000..d240d6a200
--- /dev/null
+++ b/apps/cli/src/legacy/shared/legacy-profile.unit.test.ts
@@ -0,0 +1,38 @@
+import { describe, expect, it } from "vitest";
+
+import { legacyBillingUrl, legacyDashboardUrl, legacyProjectHost } from "./legacy-profile.ts";
+
+describe("legacyProjectHost", () => {
+  it("maps built-in profile names to the Go project_host", () => {
+    expect(legacyProjectHost("supabase")).toBe("supabase.co");
+    expect(legacyProjectHost("supabase-staging")).toBe("supabase.red");
+    expect(legacyProjectHost("supabase-local")).toBe("supabase.red");
+  });
+
+  it("falls back to supabase.co for unknown / YAML-mode profiles", () => {
+    expect(legacyProjectHost("custom-profile")).toBe("supabase.co");
+  });
+});
+
+describe("legacyDashboardUrl", () => {
+  it("maps built-in profile names to the Go dashboard_url", () => {
+    expect(legacyDashboardUrl("supabase")).toBe("https://supabase.com/dashboard");
+    expect(legacyDashboardUrl("supabase-staging")).toBe("https://supabase.green/dashboard");
+    expect(legacyDashboardUrl("supabase-local")).toBe("http://localhost:8082");
+  });
+
+  it("falls back to the production dashboard for unknown profiles", () => {
+    expect(legacyDashboardUrl("custom-profile")).toBe("https://supabase.com/dashboard");
+  });
+});
+
+describe("legacyBillingUrl", () => {
+  it("composes the dashboard URL with /org/<slug>/billing", () => {
+    expect(legacyBillingUrl("supabase", "acme")).toBe(
+      "https://supabase.com/dashboard/org/acme/billing",
+    );
+    expect(legacyBillingUrl("supabase-staging", "acme")).toBe(
+      "https://supabase.green/dashboard/org/acme/billing",
+    );
+  });
+});
diff --git a/apps/cli/src/legacy/shared/legacy-resolve-token.ts b/apps/cli/src/legacy/shared/legacy-resolve-token.ts
new file mode 100644
index 0000000000..2bd11d242f
--- /dev/null
+++ b/apps/cli/src/legacy/shared/legacy-resolve-token.ts
@@ -0,0 +1,35 @@
+import { Effect, Option, Redacted } from "effect";
+
+import { LegacyCredentials } from "../auth/legacy-credentials.service.ts";
+import { LegacyCliConfig } from "../config/legacy-cli-config.service.ts";
+
+/**
+ * Resolves the Management API access token, preferring an env-set value on
+ * `LegacyCliConfig.accessToken` over the keyring / file-backed credentials
+ * service.
+ *
+ * Returns `None` if no token is available. Callers that POST/PUT via the raw
+ * `HttpClient.HttpClient` use this to build an `Authorization: Bearer` header
+ * — typed-API-client callers don't need this because the API layer reads the
+ * token at layer-construction time. Shared between `sso add`, `sso update`,
+ * and any future raw-HTTP handlers that need the same fallback order.
+ *
+ * `Effect.catch` on the credentials lookup absorbs the validation error
+ * (`LegacyInvalidAccessTokenError`) into `None`. Handlers that need a token
+ * present should treat a `None` result as a hard failure; the typed API
+ * client's auth pipeline surfaces token-validation errors itself.
+ */
+export const resolveLegacyAccessToken: Effect.Effect<
+  Option.Option<Redacted.Redacted<string>>,
+  never,
+  LegacyCliConfig | LegacyCredentials
+> = Effect.gen(function* () {
+  const cliConfig = yield* LegacyCliConfig;
+  if (Option.isSome(cliConfig.accessToken)) {
+    return cliConfig.accessToken;
+  }
+  const credentials = yield* LegacyCredentials;
+  return yield* credentials.getAccessToken.pipe(
+    Effect.catch(() => Effect.succeed(Option.none<Redacted.Redacted<string>>())),
+  );
+});
diff --git a/apps/cli/src/legacy/shared/legacy-upgrade-suggest.ts b/apps/cli/src/legacy/shared/legacy-upgrade-suggest.ts
new file mode 100644
index 0000000000..d0d8d3e1f9
--- /dev/null
+++ b/apps/cli/src/legacy/shared/legacy-upgrade-suggest.ts
@@ -0,0 +1,124 @@
+import { styleText } from "node:util";
+
+import { Effect, Option } from "effect";
+import * as HttpClient from "effect/unstable/http/HttpClient";
+import * as HttpClientRequest from "effect/unstable/http/HttpClientRequest";
+
+import { LegacyCliConfig } from "../config/legacy-cli-config.service.ts";
+import { resolveLegacyAccessToken } from "./legacy-resolve-token.ts";
+import { Analytics } from "../../shared/telemetry/analytics.service.ts";
+import {
+  EventUpgradeSuggested,
+  PropFeatureKey,
+  PropOrgSlug,
+} from "../../shared/telemetry/event-catalog.ts";
+import { Output } from "../../shared/output/output.service.ts";
+import { legacyBillingUrl } from "./legacy-profile.ts";
+
+function readString(obj: unknown, key: string): string {
+  if (typeof obj === "object" && obj !== null && key in obj) {
+    const value = (obj as Record<string, unknown>)[key];
+    return typeof value === "string" ? value : "";
+  }
+  return "";
+}
+
+/**
+ * Reproduces `apps/cli-go/internal/utils/plan_gate.go:SuggestUpgradeOnError`:
+ *
+ *   - Skip non-4xx statuses (2xx / 5xx).
+ *   - GET `/v1/projects/{ref}` → `organization_slug`.
+ *   - GET `/v1/organizations/{slug}/entitlements` → look for the requested feature
+ *     key with `hasAccess: false`.
+ *   - On gated: write the billing-link suggestion to stderr (text mode only,
+ *     matches Go's `CmdSuggestion` print) **and** fire the `cli_upgrade_suggested`
+ *     telemetry event with `{feature_key, org_slug}` properties.
+ *
+ * Never fails the caller; lookup errors swallow into a no-op suggestion.
+ *
+ * Bypasses the typed Management API client to GET `/v1/projects/{ref}` and
+ * `/v1/organizations/{slug}/entitlements` directly via `HttpClient`. The
+ * generated `V1GetProjectOutput` schema enforces `ref: isMinLength(20)`, which
+ * the cli-e2e replay fixtures cannot satisfy (they embed the literal 15-char
+ * `__PROJECT_REF__` placeholder in response bodies). Strict decode would fail
+ * silently inside `Effect.option`, the entitlements GET would be skipped, and
+ * parity with Go's request log would break. Same workaround used by
+ * `legacy-linked-project-cache.layer.ts`.
+ */
+export const legacySuggestUpgrade = Effect.fnUntraced(function* (opts: {
+  readonly projectRef: string;
+  readonly featureKey: string;
+  readonly statusCode: number;
+}) {
+  if (opts.statusCode < 400 || opts.statusCode >= 500) {
+    return;
+  }
+
+  const output = yield* Output;
+  const analytics = yield* Analytics;
+  const cliConfig = yield* LegacyCliConfig;
+  const httpClient = yield* HttpClient.HttpClient;
+
+  const tokenOpt = yield* resolveLegacyAccessToken;
+  const authHeader: (
+    req: HttpClientRequest.HttpClientRequest,
+  ) => HttpClientRequest.HttpClientRequest = Option.isSome(tokenOpt)
+    ? HttpClientRequest.bearerToken(tokenOpt.value)
+    : (req) => req;
+
+  const projectReq = HttpClientRequest.get(
+    `${cliConfig.apiUrl}/v1/projects/${opts.projectRef}`,
+  ).pipe(authHeader, HttpClientRequest.setHeader("User-Agent", cliConfig.userAgent));
+  const projectResp = yield* httpClient.execute(projectReq).pipe(Effect.option);
+  if (projectResp._tag === "None" || projectResp.value.status !== 200) {
+    return;
+  }
+  const projectBody = yield* projectResp.value.json.pipe(Effect.option);
+  if (projectBody._tag === "None") {
+    return;
+  }
+  const orgSlug = readString(projectBody.value, "organization_slug");
+  if (orgSlug.length === 0) {
+    return;
+  }
+
+  const entReq = HttpClientRequest.get(
+    `${cliConfig.apiUrl}/v1/organizations/${orgSlug}/entitlements`,
+  ).pipe(authHeader, HttpClientRequest.setHeader("User-Agent", cliConfig.userAgent));
+  const entResp = yield* httpClient.execute(entReq).pipe(Effect.option);
+  if (entResp._tag === "None" || entResp.value.status !== 200) {
+    return;
+  }
+  const entBody = yield* entResp.value.json.pipe(Effect.option);
+  if (entBody._tag === "None") {
+    return;
+  }
+  const entitlements = (entBody.value as { entitlements?: unknown }).entitlements;
+  if (!Array.isArray(entitlements)) {
+    return;
+  }
+
+  const gated = entitlements.some((entry: unknown) => {
+    if (typeof entry !== "object" || entry === null) return false;
+    const feature = (entry as { feature?: unknown }).feature;
+    if (typeof feature !== "object" || feature === null) return false;
+    const key = (feature as { key?: unknown }).key;
+    const hasAccess = (entry as { hasAccess?: unknown }).hasAccess;
+    return key === opts.featureKey && hasAccess === false;
+  });
+  if (!gated) {
+    return;
+  }
+
+  const url = legacyBillingUrl(cliConfig.profile, orgSlug);
+  const suggestion = `Your organization does not have access to this feature. Upgrade your plan: ${styleText("bold", url)}`;
+
+  if (output.format === "text") {
+    yield* output.raw(suggestion + "\n", "stderr");
+  }
+
+  yield* analytics.capture(EventUpgradeSuggested, {
+    [PropFeatureKey]: opts.featureKey,
+    [PropOrgSlug]: orgSlug,
+  });
+});
diff --git a/apps/cli/src/legacy/shared/legacy-upgrade-suggest.unit.test.ts b/apps/cli/src/legacy/shared/legacy-upgrade-suggest.unit.test.ts
new file mode 100644
index 0000000000..1ae3f1862e
--- /dev/null
+++ b/apps/cli/src/legacy/shared/legacy-upgrade-suggest.unit.test.ts
@@ -0,0 +1,213 @@
+import { describe, expect, it } from "@effect/vitest";
+import { Effect } from "effect";
+
+import { mockAnalytics, mockOutput } from "../../../tests/helpers/mocks.ts";
+import {
+  LEGACY_VALID_REF,
+  buildLegacyTestRuntime,
+  legacyJsonResponse,
+  mockLegacyCliConfig,
+  mockLegacyPlatformApi,
+  useLegacyTempWorkdir,
+} from "../../../tests/helpers/legacy-mocks.ts";
+import { legacySuggestUpgrade } from "./legacy-upgrade-suggest.ts";
+
+const ORG_SLUG = "test-org";
+
+function projectResponse(slug: string = ORG_SLUG) {
+  return {
+    id: LEGACY_VALID_REF,
+    ref: LEGACY_VALID_REF,
+    organization_id: "org-123",
+    organization_slug: slug,
+    name: "Test Project",
+    region: "us-east-1",
+    created_at: "2026-01-01T00:00:00Z",
+    status: "ACTIVE_HEALTHY",
+    database: {
+      host: "db.example.com",
+      version: "15",
+      postgres_engine: "15",
+      release_channel: "ga",
+    },
+  };
+}
+
+function entitlementResponse(opts: { readonly featureKey: string; readonly hasAccess: boolean }) {
+  return {
+    entitlements: [
+      {
+        feature: { key: opts.featureKey, type: "boolean" as const },
+        hasAccess: opts.hasAccess,
+        type: "boolean" as const,
+        config: { enabled: !opts.hasAccess },
+      },
+    ],
+  };
+}
+
+const tempRoot = useLegacyTempWorkdir("supabase-upgrade-suggest-");
+
+interface SetupOpts {
+  readonly format?: "text" | "json";
+  readonly projectStatus?: number;
+  readonly entitlementsStatus?: number;
+  readonly entitlementFeatureKey?: string;
+  readonly entitlementHasAccess?: boolean;
+}
+
+function setup(opts: SetupOpts = {}) {
+  const projectStatus = opts.projectStatus ?? 200;
+  const entitlementsStatus = opts.entitlementsStatus ?? 200;
+
+  const out = mockOutput({ format: opts.format ?? "text" });
+  const analytics = mockAnalytics();
+  const cliConfig = mockLegacyCliConfig({ workdir: tempRoot.current });
+
+  const api = mockLegacyPlatformApi({
+    handler: (request) =>
+      Effect.sync(() => {
+        if (request.url.endsWith(`/v1/projects/${LEGACY_VALID_REF}`)) {
+          return legacyJsonResponse(
+            request,
+            projectStatus,
+            projectStatus === 200 ? projectResponse() : { error: "err" },
+          );
+        }
+        if (request.url.includes("/entitlements")) {
+          return legacyJsonResponse(
+            request,
+            entitlementsStatus,
+            entitlementsStatus === 200
+              ? entitlementResponse({
+                  featureKey: opts.entitlementFeatureKey ?? "branching_limit",
+                  hasAccess: opts.entitlementHasAccess ?? false,
+                })
+              : { error: "err" },
+          );
+        }
+        return legacyJsonResponse(request, 200, null);
+      }),
+  });
+
+  const layer = buildLegacyTestRuntime({
+    out,
+    api,
+    cliConfig,
+    analytics,
+  });
+
+  return { layer, out, analytics, api };
+}
+
+describe("legacySuggestUpgrade", () => {
+  it.live("skips when status < 400 (success path)", () => {
+    const { layer, out, analytics } = setup();
+    return Effect.gen(function* () {
+      yield* legacySuggestUpgrade({
+        projectRef: LEGACY_VALID_REF,
+        featureKey: "branching_limit",
+        statusCode: 200,
+      });
+      expect(analytics.captured).toHaveLength(0);
+      expect(out.stderrText).toBe("");
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("skips when status >= 500 (server error)", () => {
+    const { layer, out, analytics } = setup();
+    return Effect.gen(function* () {
+      yield* legacySuggestUpgrade({
+        projectRef: LEGACY_VALID_REF,
+        featureKey: "branching_limit",
+        statusCode: 503,
+      });
+      expect(analytics.captured).toHaveLength(0);
+      expect(out.stderrText).toBe("");
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("skips when getProject fails", () => {
+    const { layer, analytics, out } = setup({ projectStatus: 500 });
+    return Effect.gen(function* () {
+      yield* legacySuggestUpgrade({
+        projectRef: LEGACY_VALID_REF,
+        featureKey: "branching_limit",
+        statusCode: 402,
+      });
+      expect(analytics.captured).toHaveLength(0);
+      expect(out.stderrText).toBe("");
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("skips when getEntitlements fails", () => {
+    const { layer, analytics, out } = setup({ entitlementsStatus: 500 });
+    return Effect.gen(function* () {
+      yield* legacySuggestUpgrade({
+        projectRef: LEGACY_VALID_REF,
+        featureKey: "branching_limit",
+        statusCode: 402,
+      });
+      expect(analytics.captured).toHaveLength(0);
+      expect(out.stderrText).toBe("");
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("skips when entitlement feature key does not match", () => {
+    const { layer, analytics, out } = setup({ entitlementFeatureKey: "vanity_subdomain" });
+    return Effect.gen(function* () {
+      yield* legacySuggestUpgrade({
+        projectRef: LEGACY_VALID_REF,
+        featureKey: "branching_limit",
+        statusCode: 402,
+      });
+      expect(analytics.captured).toHaveLength(0);
+      expect(out.stderrText).toBe("");
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("skips when entitlement has access (not gated)", () => {
+    const { layer, analytics, out } = setup({ entitlementHasAccess: true });
+    return Effect.gen(function* () {
+      yield* legacySuggestUpgrade({
+        projectRef: LEGACY_VALID_REF,
+        featureKey: "branching_limit",
+        statusCode: 402,
+      });
+      expect(analytics.captured).toHaveLength(0);
+      expect(out.stderrText).toBe("");
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("fires cli_upgrade_suggested with {feature_key, org_slug} when gated", () => {
+    const { layer, analytics, out } = setup();
+    return Effect.gen(function* () {
+      yield* legacySuggestUpgrade({
+        projectRef: LEGACY_VALID_REF,
+        featureKey: "branching_limit",
+        statusCode: 402,
+      });
+      expect(analytics.captured).toEqual([
+        {
+          event: "cli_upgrade_suggested",
+          properties: { feature_key: "branching_limit", org_slug: ORG_SLUG },
+        },
+      ]);
+      expect(out.stderrText).toContain("Upgrade your plan:");
+      expect(out.stderrText).toContain("/org/test-org/billing");
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("does not write to stderr in non-text output mode", () => {
+    const { layer, analytics, out } = setup({ format: "json" });
+    return Effect.gen(function* () {
+      yield* legacySuggestUpgrade({
+        projectRef: LEGACY_VALID_REF,
+        featureKey: "branching_limit",
+        statusCode: 402,
+      });
+      expect(analytics.captured).toHaveLength(1);
+      expect(out.stderrText).toBe("");
+    }).pipe(Effect.provide(layer));
+  });
+});
diff --git a/apps/cli/src/legacy/telemetry/legacy-analytics.layer.ts b/apps/cli/src/legacy/telemetry/legacy-analytics.layer.ts
new file mode 100644
index 0000000000..adc324a7e5
--- /dev/null
+++ b/apps/cli/src/legacy/telemetry/legacy-analytics.layer.ts
@@ -0,0 +1,246 @@
+import { Effect, FileSystem, Layer, Option, Path } from "effect";
+import { PostHog } from "posthog-node";
+import { aiToolLayer } from "../../shared/telemetry/ai-tool.layer.ts";
+import { AiTool } from "../../shared/telemetry/ai-tool.service.ts";
+import {
+  CurrentAnalyticsContext,
+  type AnalyticsContext,
+} from "../../shared/telemetry/analytics-context.ts";
+import { Analytics } from "../../shared/telemetry/analytics.service.ts";
+import {
+  EnvSignalPresenceKeys,
+  EnvSignalValueKeys,
+  GroupOrganization,
+  GroupProject,
+  MaxEnvSignalValueLength,
+  PropArch,
+  PropCliVersion,
+  PropDeviceId,
+  PropEnvSignals,
+  PropIsAgent,
+  PropIsCi,
+  PropIsFirstRun,
+  PropIsTty,
+  PropOs,
+  PropPlatform,
+  PropSchemaVersion,
+  PropSessionId,
+} from "../../shared/telemetry/event-catalog.ts";
+import { posthogConfig } from "../../shared/telemetry/posthog-config.ts";
+import { telemetryRuntimeLayer } from "../../shared/telemetry/runtime.layer.ts";
+import { TelemetryRuntime } from "../../shared/telemetry/runtime.service.ts";
+
+interface LinkedProjectCacheValue {
+  readonly ref: string;
+  readonly name: string;
+  readonly organization_id: string;
+  readonly organization_slug: string;
+}
+
+function stripUndefined(properties: Record<string, unknown>): Record<string, unknown> {
+  return Object.fromEntries(Object.entries(properties).filter(([, value]) => value !== undefined));
+}
+
+function contextProperties(context: AnalyticsContext): Record<string, unknown> {
+  return stripUndefined({
+    command_run_id: context.command_run_id,
+    command: context.command,
+    flags: context.flags,
+  });
+}
+
+function resolveGroups(
+  context: AnalyticsContext,
+  linkedProject: Option.Option<LinkedProjectCacheValue>,
+): { organization: string; project: string } | undefined {
+  if (context.groups?.organization !== undefined && context.groups.project !== undefined) {
+    return {
+      organization: context.groups.organization,
+      project: context.groups.project,
+    };
+  }
+
+  return Option.match(linkedProject, {
+    onNone: () => undefined,
+    onSome: (linked) => ({
+      organization: linked.organization_slug,
+      project: linked.ref,
+    }),
+  });
+}
+
+// Mirrors apps/cli-go/cmd/root_analytics.go:149-165 envSignals().
+export function collectEnvSignals(): Record<string, true | string> | undefined {
+  const signals: Record<string, true | string> = {};
+
+  for (const key of EnvSignalPresenceKeys) {
+    const raw = process.env[key];
+    if (raw === undefined) continue;
+    if (raw.trim().length === 0) continue;
+    signals[key] = true;
+  }
+
+  for (const key of EnvSignalValueKeys) {
+    const raw = process.env[key];
+    if (raw === undefined) continue;
+    const trimmed = raw.trim();
+    if (trimmed.length === 0) continue;
+    signals[key] =
+      trimmed.length > MaxEnvSignalValueLength
+        ? trimmed.slice(0, MaxEnvSignalValueLength)
+        : trimmed;
+  }
+
+  return Object.keys(signals).length === 0 ? undefined : signals;
+}
+
+// Mirrors apps/cli-go/internal/telemetry/project.go:40 LoadLinkedProject(fsys).
+// Best-effort: any error returns None. Resolves workdir from `SUPABASE_WORKDIR`
+// env or `process.cwd()`. The `--workdir` flag value is not accessible at
+// root scope where the analytics layer is constructed (Effect CLI's global
+// flag services are only available inside Command.runWith). When `--workdir` is
+// set but the user invokes from outside that directory, the linked-project
+// cache lookup misses and the event loses group attribution — matches Go's
+// behaviour when the user runs without first `cd`-ing into the project.
+function makeLoadLinkedProject(
+  fs: FileSystem.FileSystem,
+  path: Path.Path,
+): Effect.Effect<Option.Option<LinkedProjectCacheValue>> {
+  const workdir = process.env.SUPABASE_WORKDIR ?? process.cwd();
+  const cachePath = path.join(workdir, "supabase", ".temp", "linked-project.json");
+  return Effect.gen(function* () {
+    const exists = yield* fs.exists(cachePath).pipe(Effect.orElseSucceed(() => false));
+    if (!exists) return Option.none<LinkedProjectCacheValue>();
+
+    const content = yield* fs.readFileString(cachePath).pipe(Effect.option);
+    if (Option.isNone(content)) return Option.none<LinkedProjectCacheValue>();
+
+    try {
+      const parsed = JSON.parse(content.value) as Partial<LinkedProjectCacheValue>;
+      if (typeof parsed.ref !== "string" || typeof parsed.organization_slug !== "string") {
+        return Option.none<LinkedProjectCacheValue>();
+      }
+      return Option.some<LinkedProjectCacheValue>({
+        ref: parsed.ref,
+        name: typeof parsed.name === "string" ? parsed.name : "",
+        organization_id: typeof parsed.organization_id === "string" ? parsed.organization_id : "",
+        organization_slug: parsed.organization_slug,
+      });
+    } catch {
+      return Option.none<LinkedProjectCacheValue>();
+    }
+  }).pipe(Effect.catch(() => Effect.succeed(Option.none<LinkedProjectCacheValue>())));
+}
+
+export const legacyAnalyticsLayer = Layer.effect(
+  Analytics,
+  Effect.gen(function* () {
+    const runtime = yield* TelemetryRuntime;
+    const aiTool = yield* AiTool;
+    const fs = yield* FileSystem.FileSystem;
+    const path = yield* Path.Path;
+
+    if (runtime.consent !== "granted") {
+      return Analytics.of({
+        capture: () => Effect.void,
+        identify: () => Effect.void,
+        alias: () => Effect.void,
+        groupIdentify: () => Effect.void,
+      });
+    }
+
+    const client = new PostHog(posthogConfig.key, {
+      host: posthogConfig.host,
+      flushAt: 1,
+      flushInterval: 0,
+    });
+    yield* Effect.addFinalizer(() =>
+      Effect.promise(() => client._shutdown(5_000)).pipe(Effect.ignore),
+    );
+
+    const loadLinkedProject = makeLoadLinkedProject(fs, path);
+
+    const isAgent = Option.isSome(aiTool.name) || runtime.isCi;
+    const envSignals = collectEnvSignals();
+
+    const baseProperties = stripUndefined({
+      [PropPlatform]: "cli",
+      [PropSchemaVersion]: 1,
+      [PropDeviceId]: runtime.deviceId,
+      [PropSessionId]: runtime.sessionId,
+      [PropIsFirstRun]: runtime.isFirstRun,
+      [PropIsTty]: runtime.isTty,
+      [PropIsCi]: runtime.isCi,
+      [PropIsAgent]: isAgent,
+      [PropOs]: runtime.os,
+      [PropArch]: runtime.arch,
+      [PropCliVersion]: runtime.cliVersion,
+      [PropEnvSignals]: envSignals,
+    });
+
+    const capture = (event: string, properties: Record<string, unknown> = {}) =>
+      Effect.gen(function* () {
+        const context = yield* CurrentAnalyticsContext;
+        const linkedProject = yield* loadLinkedProject;
+        const groups = resolveGroups(context, linkedProject);
+
+        client.capture({
+          event,
+          distinctId: context.distinct_id ?? runtime.distinctId ?? runtime.deviceId,
+          ...(groups === undefined
+            ? {}
+            : {
+                groups: {
+                  [GroupOrganization]: groups.organization,
+                  [GroupProject]: groups.project,
+                },
+              }),
+          properties: {
+            ...baseProperties,
+            ...contextProperties(context),
+            ...stripUndefined(properties),
+          },
+        });
+      });
+
+    const identify = (distinctId: string, properties: Record<string, unknown> = {}) =>
+      Effect.sync(() => {
+        client.identify({
+          distinctId,
+          properties: stripUndefined({
+            cli_version: runtime.cliVersion,
+            os: runtime.os,
+            arch: runtime.arch,
+            ...properties,
+          }),
+        });
+      });
+
+    const alias = (distinctId: string, aliasValue: string) =>
+      Effect.sync(() => {
+        client.alias({ distinctId, alias: aliasValue });
+      });
+
+    const groupIdentify = (
+      groupType: string,
+      groupKey: string,
+      properties: Record<string, unknown> = {},
+    ) =>
+      Effect.gen(function* () {
+        const context = yield* CurrentAnalyticsContext;
+        client.groupIdentify({
+          groupType,
+          groupKey,
+          distinctId: context.distinct_id ?? runtime.distinctId ?? runtime.deviceId,
+          properties: stripUndefined(properties),
+        });
+      });
+
+    return Analytics.of({
+      capture,
+      identify,
+      alias,
+      groupIdentify,
+    });
+  }),
+).pipe(Layer.provide(telemetryRuntimeLayer), Layer.provide(aiToolLayer));
diff --git a/apps/cli/src/legacy/telemetry/legacy-analytics.layer.unit.test.ts b/apps/cli/src/legacy/telemetry/legacy-analytics.layer.unit.test.ts
new file mode 100644
index 0000000000..61f3b6e932
--- /dev/null
+++ b/apps/cli/src/legacy/telemetry/legacy-analytics.layer.unit.test.ts
@@ -0,0 +1,89 @@
+import { afterEach, beforeEach, describe, expect, it } from "vitest";
+import {
+  EnvSignalPresenceKeys,
+  EnvSignalValueKeys,
+  MaxEnvSignalValueLength,
+} from "../../shared/telemetry/event-catalog.ts";
+import { collectEnvSignals } from "./legacy-analytics.layer.ts";
+
+const RESET_KEYS = [...EnvSignalPresenceKeys, ...EnvSignalValueKeys];
+
+function snapshotEnv() {
+  const original: Record<string, string | undefined> = {};
+  for (const key of RESET_KEYS) {
+    original[key] = process.env[key];
+    delete process.env[key];
+  }
+  return original;
+}
+
+function restoreEnv(original: Record<string, string | undefined>) {
+  for (const [key, value] of Object.entries(original)) {
+    if (value === undefined) {
+      delete process.env[key];
+    } else {
+      process.env[key] = value;
+    }
+  }
+}
+
+describe("collectEnvSignals", () => {
+  let original: Record<string, string | undefined>;
+
+  beforeEach(() => {
+    original = snapshotEnv();
+  });
+
+  afterEach(() => {
+    restoreEnv(original);
+  });
+
+  it("returns undefined when no relevant env vars are set", () => {
+    expect(collectEnvSignals()).toBeUndefined();
+  });
+
+  it("records presence keys as boolean `true`", () => {
+    process.env.CI = "1";
+    process.env.CLAUDECODE = "true";
+
+    const signals = collectEnvSignals();
+    expect(signals).toEqual({
+      CI: true,
+      CLAUDECODE: true,
+    });
+  });
+
+  it("records value keys as trimmed strings", () => {
+    process.env.AI_AGENT = "  claude-code  ";
+    process.env.TERM = "xterm-256color";
+
+    const signals = collectEnvSignals();
+    expect(signals).toEqual({
+      AI_AGENT: "claude-code",
+      TERM: "xterm-256color",
+    });
+  });
+
+  it("caps value-key strings at MaxEnvSignalValueLength chars", () => {
+    const long = "a".repeat(MaxEnvSignalValueLength + 50);
+    process.env.AI_AGENT = long;
+
+    const signals = collectEnvSignals();
+    const aiAgent = signals?.AI_AGENT;
+    expect(aiAgent).toBe("a".repeat(MaxEnvSignalValueLength));
+    expect(typeof aiAgent === "string" ? aiAgent.length : -1).toBe(MaxEnvSignalValueLength);
+  });
+
+  it("skips presence keys with empty/whitespace-only values", () => {
+    process.env.CI = "";
+    process.env.GITHUB_ACTIONS = "   ";
+
+    expect(collectEnvSignals()).toBeUndefined();
+  });
+
+  it("skips value keys with empty/whitespace-only values", () => {
+    process.env.AI_AGENT = "   ";
+
+    expect(collectEnvSignals()).toBeUndefined();
+  });
+});
diff --git a/apps/cli/src/legacy/telemetry/legacy-command-instrumentation.ts b/apps/cli/src/legacy/telemetry/legacy-command-instrumentation.ts
new file mode 100644
index 0000000000..b89fb45906
--- /dev/null
+++ b/apps/cli/src/legacy/telemetry/legacy-command-instrumentation.ts
@@ -0,0 +1,161 @@
+import { Clock, Effect, Exit, Option, Stdio } from "effect";
+import {
+  CommandRuntime,
+  getCommandRuntimeCommand,
+  getCommandRuntimeSpanName,
+} from "../../shared/runtime/command-runtime.service.ts";
+import { withAnalyticsContext } from "../../shared/telemetry/analytics-context.ts";
+import { Analytics } from "../../shared/telemetry/analytics.service.ts";
+import {
+  EventCommandExecuted,
+  PropDurationMs,
+  PropExitCode,
+} from "../../shared/telemetry/event-catalog.ts";
+
+interface LegacyCommandInstrumentationOptions<Flags extends Record<string, unknown> = never> {
+  readonly analytics?: boolean;
+  readonly flags?: Flags;
+  // Flag names (kebab-case) whose values are safe to log verbatim, mirroring
+  // Go's `markFlagTelemetrySafe` annotation in cmd/root_analytics.go. Boolean
+  // flag values are always passed through, matching Go's isBooleanFlag branch.
+  readonly safeFlags?: ReadonlyArray<string>;
+}
+
+const REDACTED_VALUE = "<redacted>";
+
+function toCliFlagName(key: string): string {
+  return key.replace(/[A-Z]/g, (char) => `-${char.toLowerCase()}`);
+}
+
+function extractChangedFlagNames(args: ReadonlyArray<string>): ReadonlyArray<string> {
+  const used = new Set<string>();
+
+  for (let index = 0; index < args.length; index++) {
+    const arg = args[index];
+    if (arg === undefined || !arg.startsWith("--")) continue;
+
+    const raw = arg.slice(2);
+    const [flagName] = raw.split("=", 2);
+    if (flagName === undefined || flagName.length === 0) continue;
+
+    used.add(flagName);
+  }
+
+  // Match Go's sort.Slice(...flag.Name < flag.Name) in changedFlags().
+  return [...used].sort((left, right) => left.localeCompare(right));
+}
+
+function normalizeFlagValue(value: unknown): unknown | undefined {
+  if (value === undefined) return undefined;
+  if (!Option.isOption(value)) return value;
+  if (Option.isNone(value)) return undefined;
+  return normalizeFlagValue(value.value);
+}
+
+function buildFlagsMap<Flags extends Record<string, unknown>>(
+  flags: Flags | undefined,
+  safeFlagSet: ReadonlySet<string>,
+  changedFlagNames: ReadonlyArray<string>,
+): Record<string, unknown> | undefined {
+  if (changedFlagNames.length === 0) return undefined;
+
+  const result: Record<string, unknown> = {};
+  const handlerFlagsByCliName = new Map<string, unknown>();
+  if (flags !== undefined) {
+    for (const [key, value] of Object.entries(flags)) {
+      handlerFlagsByCliName.set(toCliFlagName(key), value);
+    }
+  }
+
+  for (const cliName of changedFlagNames) {
+    const rawValue = handlerFlagsByCliName.get(cliName);
+    const value = normalizeFlagValue(rawValue);
+
+    if (safeFlagSet.has(cliName) || typeof value === "boolean") {
+      result[cliName] = value ?? REDACTED_VALUE;
+      continue;
+    }
+
+    result[cliName] = REDACTED_VALUE;
+  }
+
+  return result;
+}
+
+function withLegacyCommandTracingImplementation() {
+  return <A, E, R>(self: Effect.Effect<A, E, R>) =>
+    Effect.gen(function* () {
+      const commandRuntime = yield* CommandRuntime;
+      const command = getCommandRuntimeCommand(commandRuntime);
+
+      return yield* Effect.gen(function* () {
+        yield* Effect.annotateCurrentSpan({
+          command_run_id: commandRuntime.commandRunId,
+          command,
+        });
+        return yield* self;
+      }).pipe(Effect.withSpan(getCommandRuntimeSpanName(commandRuntime)));
+    });
+}
+
+function withLegacyCommandAnalyticsImplementation<Flags extends Record<string, unknown>>(
+  options?: LegacyCommandInstrumentationOptions<Flags>,
+) {
+  const safeFlagSet = new Set(options?.safeFlags ?? []);
+  return <A, E, R>(self: Effect.Effect<A, E, R>) =>
+    Effect.gen(function* () {
+      const commandRuntime = yield* CommandRuntime;
+      const command = getCommandRuntimeCommand(commandRuntime);
+
+      return yield* Effect.gen(function* () {
+        yield* Effect.annotateCurrentSpan({
+          command_run_id: commandRuntime.commandRunId,
+          command,
+        });
+
+        const analytics = yield* Analytics;
+        const stdio = yield* Stdio.Stdio;
+        const args = yield* stdio.args;
+        const startedAt = yield* Clock.currentTimeMillis;
+        const changedFlagNames = extractChangedFlagNames(args);
+        const flags = buildFlagsMap(options?.flags, safeFlagSet, changedFlagNames);
+        const analyticsContext = {
+          command_run_id: commandRuntime.commandRunId,
+          command,
+          flags,
+        } as const;
+
+        const exit = yield* self.pipe(withAnalyticsContext(analyticsContext), Effect.exit);
+        const finishedAt = yield* Clock.currentTimeMillis;
+
+        yield* analytics
+          .capture(EventCommandExecuted, {
+            [PropExitCode]: Exit.isSuccess(exit) ? 0 : 1,
+            [PropDurationMs]: finishedAt - startedAt,
+          })
+          .pipe(withAnalyticsContext(analyticsContext));
+
+        if (Exit.isFailure(exit)) {
+          return yield* Effect.failCause(exit.cause);
+        }
+        return exit.value;
+      }).pipe(Effect.withSpan(getCommandRuntimeSpanName(commandRuntime)));
+    });
+}
+
+export function withLegacyCommandInstrumentation(): <A, E, R>(
+  self: Effect.Effect<A, E, R>,
+) => Effect.Effect<A, E, R | Analytics | CommandRuntime | Stdio.Stdio>;
+export function withLegacyCommandInstrumentation<Flags extends Record<string, unknown>>(
+  options: LegacyCommandInstrumentationOptions<Flags>,
+): <A, E, R>(
+  self: Effect.Effect<A, E, R>,
+) => Effect.Effect<A, E, R | Analytics | CommandRuntime | Stdio.Stdio>;
+export function withLegacyCommandInstrumentation<Flags extends Record<string, unknown>>(
+  options?: LegacyCommandInstrumentationOptions<Flags>,
+) {
+  if (options?.analytics === false) {
+    return withLegacyCommandTracingImplementation();
+  }
+  return withLegacyCommandAnalyticsImplementation(options);
+}
diff --git a/apps/cli/src/legacy/telemetry/legacy-command-instrumentation.unit.test.ts b/apps/cli/src/legacy/telemetry/legacy-command-instrumentation.unit.test.ts
new file mode 100644
index 0000000000..52c002f60c
--- /dev/null
+++ b/apps/cli/src/legacy/telemetry/legacy-command-instrumentation.unit.test.ts
@@ -0,0 +1,261 @@
+import { describe, expect, it } from "@effect/vitest";
+import { Effect, Layer, Option, Stdio } from "effect";
+import { commandRuntimeLayer } from "../../shared/runtime/command-runtime.layer.ts";
+import { CurrentAnalyticsContext } from "../../shared/telemetry/analytics-context.ts";
+import { Analytics } from "../../shared/telemetry/analytics.service.ts";
+import { withLegacyCommandInstrumentation } from "./legacy-command-instrumentation.ts";
+
+function mockContextualAnalytics() {
+  const captured: Array<{
+    event: string;
+    properties: Record<string, unknown>;
+  }> = [];
+
+  const layer = Layer.succeed(
+    Analytics,
+    Analytics.of({
+      capture: (event: string, properties: Record<string, unknown> = {}) =>
+        Effect.gen(function* () {
+          const context = yield* CurrentAnalyticsContext;
+          captured.push({
+            event,
+            properties: {
+              ...context,
+              ...properties,
+            },
+          });
+        }),
+      identify: () => Effect.void,
+      alias: () => Effect.void,
+      groupIdentify: () => Effect.void,
+    }),
+  );
+
+  return { layer, captured };
+}
+
+describe("withLegacyCommandInstrumentation", () => {
+  it.live("annotates the command span and emits cli_command_executed", () => {
+    const analytics = mockContextualAnalytics();
+
+    return Effect.gen(function* () {
+      const span = yield* Effect.currentSpan;
+      expect(span.name).toBe("command.backups.list");
+      expect(span.attributes.get("command")).toBe("backups list");
+      expect(typeof span.attributes.get("command_run_id")).toBe("string");
+    }).pipe(
+      withLegacyCommandInstrumentation(),
+      Effect.provide(analytics.layer),
+      Effect.provide(
+        Stdio.layerTest({
+          args: Effect.succeed(["backups", "list"]),
+        }),
+      ),
+      Effect.provide(commandRuntimeLayer(["backups", "list"])),
+      Effect.tap(() =>
+        Effect.sync(() => {
+          expect(analytics.captured).toHaveLength(1);
+          const event = analytics.captured[0];
+          expect(event?.event).toBe("cli_command_executed");
+          expect(event?.properties.command).toBe("backups list");
+          expect(event?.properties.exit_code).toBe(0);
+          expect(typeof event?.properties.duration_ms).toBe("number");
+        }),
+      ),
+    );
+  });
+
+  it.live("emits a single `flags` map (no `flags_used`/`flag_values`)", () => {
+    const analytics = mockContextualAnalytics();
+
+    return Effect.void.pipe(
+      withLegacyCommandInstrumentation({
+        flags: { projectRef: Option.some("abcdefghijklmnopqrst") },
+      }),
+      Effect.provide(analytics.layer),
+      Effect.provide(
+        Stdio.layerTest({
+          args: Effect.succeed(["secrets", "list", "--project-ref", "abcdefghijklmnopqrst"]),
+        }),
+      ),
+      Effect.provide(commandRuntimeLayer(["secrets", "list"])),
+      Effect.tap(() =>
+        Effect.sync(() => {
+          expect(analytics.captured).toHaveLength(1);
+          const event = analytics.captured[0];
+          expect(event?.properties.flags).toEqual({ "project-ref": "<redacted>" });
+          expect(event?.properties).not.toHaveProperty("flags_used");
+          expect(event?.properties).not.toHaveProperty("flag_values");
+        }),
+      ),
+    );
+  });
+
+  it.live("redacts unsafe string flag values", () => {
+    const analytics = mockContextualAnalytics();
+
+    return Effect.void.pipe(
+      withLegacyCommandInstrumentation({
+        flags: { envFile: Option.some("/path/to/.env") },
+      }),
+      Effect.provide(analytics.layer),
+      Effect.provide(
+        Stdio.layerTest({
+          args: Effect.succeed(["secrets", "set", "--env-file=/path/to/.env"]),
+        }),
+      ),
+      Effect.provide(commandRuntimeLayer(["secrets", "set"])),
+      Effect.tap(() =>
+        Effect.sync(() => {
+          const event = analytics.captured[0];
+          expect(event?.properties.flags).toEqual({ "env-file": "<redacted>" });
+        }),
+      ),
+    );
+  });
+
+  it.live("passes boolean flag values through verbatim", () => {
+    const analytics = mockContextualAnalytics();
+
+    return Effect.void.pipe(
+      withLegacyCommandInstrumentation({
+        flags: {
+          enableDbSslEnforcement: true,
+          disableDbSslEnforcement: false,
+        },
+      }),
+      Effect.provide(analytics.layer),
+      Effect.provide(
+        Stdio.layerTest({
+          args: Effect.succeed([
+            "ssl-enforcement",
+            "update",
+            "--enable-db-ssl-enforcement",
+            "--disable-db-ssl-enforcement",
+          ]),
+        }),
+      ),
+      Effect.provide(commandRuntimeLayer(["ssl-enforcement", "update"])),
+      Effect.tap(() =>
+        Effect.sync(() => {
+          const event = analytics.captured[0];
+          expect(event?.properties.flags).toEqual({
+            "disable-db-ssl-enforcement": false,
+            "enable-db-ssl-enforcement": true,
+          });
+        }),
+      ),
+    );
+  });
+
+  it.live("passes safeFlags values through verbatim", () => {
+    const analytics = mockContextualAnalytics();
+
+    return Effect.void.pipe(
+      withLegacyCommandInstrumentation({
+        flags: { projectRef: Option.some("abcdefghijklmnopqrst") },
+        safeFlags: ["project-ref"],
+      }),
+      Effect.provide(analytics.layer),
+      Effect.provide(
+        Stdio.layerTest({
+          args: Effect.succeed(["link", "--project-ref", "abcdefghijklmnopqrst"]),
+        }),
+      ),
+      Effect.provide(commandRuntimeLayer(["link"])),
+      Effect.tap(() =>
+        Effect.sync(() => {
+          const event = analytics.captured[0];
+          expect(event?.properties.flags).toEqual({
+            "project-ref": "abcdefghijklmnopqrst",
+          });
+        }),
+      ),
+    );
+  });
+
+  it.live("omits the `flags` property when no flags changed", () => {
+    const analytics = mockContextualAnalytics();
+
+    return Effect.void.pipe(
+      withLegacyCommandInstrumentation({ flags: {} }),
+      Effect.provide(analytics.layer),
+      Effect.provide(Stdio.layerTest({ args: Effect.succeed(["backups", "list"]) })),
+      Effect.provide(commandRuntimeLayer(["backups", "list"])),
+      Effect.tap(() =>
+        Effect.sync(() => {
+          const event = analytics.captured[0];
+          expect(event?.properties.flags).toBeUndefined();
+        }),
+      ),
+    );
+  });
+
+  it.live("captures failed commands with exit_code=1", () => {
+    const analytics = mockContextualAnalytics();
+
+    return withLegacyCommandInstrumentation()(Effect.fail(new Error("boom"))).pipe(
+      Effect.provide(analytics.layer),
+      Effect.provide(Stdio.layerTest({ args: Effect.succeed(["backups", "list"]) })),
+      Effect.provide(commandRuntimeLayer(["backups", "list"])),
+      Effect.exit,
+      Effect.tap(() =>
+        Effect.sync(() => {
+          expect(analytics.captured).toHaveLength(1);
+          expect(analytics.captured[0]?.properties.exit_code).toBe(1);
+        }),
+      ),
+      Effect.asVoid,
+    );
+  });
+
+  it.live("skips analytics capture when analytics are disabled", () => {
+    const analytics = mockContextualAnalytics();
+
+    return Effect.sync(() => "ok").pipe(
+      withLegacyCommandInstrumentation({ analytics: false }),
+      Effect.provide(analytics.layer),
+      Effect.provide(Stdio.layerTest({ args: Effect.succeed(["telemetry", "enable"]) })),
+      Effect.provide(commandRuntimeLayer(["telemetry", "enable"])),
+      Effect.tap(() =>
+        Effect.sync(() => {
+          expect(analytics.captured).toEqual([]);
+        }),
+      ),
+    );
+  });
+
+  it.live("sorts flag names alphabetically to match Go", () => {
+    const analytics = mockContextualAnalytics();
+
+    return Effect.void.pipe(
+      withLegacyCommandInstrumentation({
+        flags: {
+          projectRef: Option.some("abcdefghijklmnopqrst"),
+          timestamp: Option.some(1707407047),
+        },
+      }),
+      Effect.provide(analytics.layer),
+      Effect.provide(
+        Stdio.layerTest({
+          args: Effect.succeed([
+            "backups",
+            "restore",
+            "--timestamp=1707407047",
+            "--project-ref",
+            "abcdefghijklmnopqrst",
+          ]),
+        }),
+      ),
+      Effect.provide(commandRuntimeLayer(["backups", "restore"])),
+      Effect.tap(() =>
+        Effect.sync(() => {
+          const event = analytics.captured[0];
+          const flags = event?.properties.flags as Record<string, unknown>;
+          // Keys should be insertion-ordered alphabetically.
+          expect(Object.keys(flags)).toEqual(["project-ref", "timestamp"]);
+        }),
+      ),
+    );
+  });
+});
diff --git a/apps/cli/src/legacy/telemetry/legacy-linked-project-cache.layer.ts b/apps/cli/src/legacy/telemetry/legacy-linked-project-cache.layer.ts
new file mode 100644
index 0000000000..4b0de6378c
--- /dev/null
+++ b/apps/cli/src/legacy/telemetry/legacy-linked-project-cache.layer.ts
@@ -0,0 +1,81 @@
+import { Effect, FileSystem, Layer, Option, Path, Redacted } from "effect";
+import * as HttpClient from "effect/unstable/http/HttpClient";
+import * as HttpClientRequest from "effect/unstable/http/HttpClientRequest";
+
+import { LegacyCredentials } from "../auth/legacy-credentials.service.ts";
+import { LegacyCliConfig } from "../config/legacy-cli-config.service.ts";
+import { LegacyLinkedProjectCache } from "./legacy-linked-project-cache.service.ts";
+
+function readString(obj: unknown, key: string): string {
+  if (typeof obj === "object" && obj !== null && key in obj) {
+    const value = (obj as Record<string, unknown>)[key];
+    return typeof value === "string" ? value : "";
+  }
+  return "";
+}
+
+/**
+ * Writes `<workdir>/supabase/.temp/linked-project.json` after a `--project-ref`
+ * has been resolved. Mirrors Go's `ensureProjectGroupsCached`
+ * (`apps/cli-go/cmd/root.go:213-234`):
+ *
+ *  - No write if the cache already exists (`supabase link` is authoritative).
+ *  - Best-effort: any API / filesystem / parse error is swallowed.
+ *  - Body shape matches `LinkedProject` from
+ *    `apps/cli-go/internal/telemetry/project.go:15-20`.
+ *
+ * Bypasses `LegacyPlatformApi`'s strict schema decode by calling the API
+ * directly with `HttpClient`. The generated `V1ProjectWithDatabaseResponse`
+ * schema enforces a 20-char project-ref length that the cli-e2e replay
+ * fixtures (which store `__PROJECT_REF__` placeholders) cannot satisfy.
+ * The cache only needs four string fields and doesn't validate them.
+ */
+export const legacyLinkedProjectCacheLayer = Layer.effect(
+  LegacyLinkedProjectCache,
+  Effect.gen(function* () {
+    const httpClient = yield* HttpClient.HttpClient;
+    const cliConfig = yield* LegacyCliConfig;
+    const credentials = yield* LegacyCredentials;
+    const fs = yield* FileSystem.FileSystem;
+    const path = yield* Path.Path;
+
+    return LegacyLinkedProjectCache.of({
+      cache: (ref: string) =>
+        Effect.gen(function* () {
+          const cachePath = path.join(
+            cliConfig.workdir,
+            "supabase",
+            ".temp",
+            "linked-project.json",
+          );
+          const exists = yield* fs.exists(cachePath).pipe(Effect.orElseSucceed(() => false));
+          if (exists) return;
+
+          // Resolve token: env wins over keyring/file lookup (Go-parity).
+          const tokenOpt = Option.isSome(cliConfig.accessToken)
+            ? cliConfig.accessToken
+            : yield* credentials.getAccessToken;
+          if (Option.isNone(tokenOpt)) return;
+          const token = Redacted.value(tokenOpt.value);
+
+          const request = HttpClientRequest.get(`${cliConfig.apiUrl}/v1/projects/${ref}`).pipe(
+            HttpClientRequest.setHeader("Authorization", `Bearer ${token}`),
+            HttpClientRequest.setHeader("User-Agent", cliConfig.userAgent),
+          );
+          const response = yield* httpClient.execute(request);
+          if (response.status !== 200) return;
+          const body = yield* response.json;
+
+          const linked = {
+            ref: readString(body, "ref"),
+            name: readString(body, "name"),
+            organization_id: readString(body, "organization_id"),
+            organization_slug: readString(body, "organization_slug"),
+          };
+
+          yield* fs.makeDirectory(path.dirname(cachePath), { recursive: true });
+          yield* fs.writeFileString(cachePath, JSON.stringify(linked));
+        }).pipe(Effect.ignore),
+    });
+  }),
+);
diff --git a/apps/cli/src/legacy/telemetry/legacy-linked-project-cache.service.ts b/apps/cli/src/legacy/telemetry/legacy-linked-project-cache.service.ts
new file mode 100644
index 0000000000..eacfaca6c9
--- /dev/null
+++ b/apps/cli/src/legacy/telemetry/legacy-linked-project-cache.service.ts
@@ -0,0 +1,19 @@
+import type { Effect } from "effect";
+import { Context } from "effect";
+
+interface LegacyLinkedProjectCacheShape {
+  /**
+   * Fire-and-forget: fetches the project metadata from the Management API and
+   * writes `<workdir>/supabase/.temp/linked-project.json` if no cache exists yet.
+   *
+   * Best-effort. Never fails the calling effect — auth errors, network errors,
+   * and write errors are all swallowed (matches Go's `ensureProjectGroupsCached`
+   * which logs to debug and returns).
+   */
+  readonly cache: (ref: string) => Effect.Effect<void>;
+}
+
+export class LegacyLinkedProjectCache extends Context.Service<
+  LegacyLinkedProjectCache,
+  LegacyLinkedProjectCacheShape
+>()("supabase/legacy/LinkedProjectCache") {}
diff --git a/apps/cli/src/legacy/telemetry/legacy-telemetry-state.layer.ts b/apps/cli/src/legacy/telemetry/legacy-telemetry-state.layer.ts
new file mode 100644
index 0000000000..057fbfba5d
--- /dev/null
+++ b/apps/cli/src/legacy/telemetry/legacy-telemetry-state.layer.ts
@@ -0,0 +1,117 @@
+import { Effect, FileSystem, Layer, Path } from "effect";
+import { homedir } from "node:os";
+
+import { LegacyTelemetryState } from "./legacy-telemetry-state.service.ts";
+
+interface State {
+  readonly enabled: boolean;
+  readonly device_id: string;
+  readonly session_id: string;
+  readonly session_last_active: string;
+  readonly distinct_id?: string;
+  readonly schema_version: number;
+}
+
+const SCHEMA_VERSION = 1;
+const SESSION_ROTATION_MS = 30 * 60 * 1000;
+
+function telemetryPath(env: Record<string, string | undefined>, pathSvc: Path.Path): string {
+  const supabaseHome = env["SUPABASE_HOME"]?.trim();
+  if (supabaseHome !== undefined && supabaseHome.length > 0) {
+    return pathSvc.join(supabaseHome, "telemetry.json");
+  }
+  return pathSvc.join(homedir(), ".supabase", "telemetry.json");
+}
+
+function isStringField(value: unknown, key: string): boolean {
+  if (typeof value !== "object" || value === null) return false;
+  const field = (value as Record<string, unknown>)[key];
+  return typeof field === "string" && field.length > 0;
+}
+
+interface PriorState {
+  enabled?: boolean;
+  device_id?: string;
+  session_id?: string;
+  session_last_active?: string;
+  distinct_id?: string;
+}
+
+function readExistingState(text: string): PriorState | undefined {
+  try {
+    const parsed = JSON.parse(text);
+    if (typeof parsed !== "object" || parsed === null) return undefined;
+    const record = parsed as Record<string, unknown>;
+    const out: PriorState = {};
+    if (typeof record.enabled === "boolean") out.enabled = record.enabled;
+    if (isStringField(parsed, "device_id")) out.device_id = record.device_id as string;
+    if (isStringField(parsed, "session_id")) out.session_id = record.session_id as string;
+    if (isStringField(parsed, "session_last_active")) {
+      out.session_last_active = record.session_last_active as string;
+    }
+    if (isStringField(parsed, "distinct_id")) out.distinct_id = record.distinct_id as string;
+    return out;
+  } catch {
+    return undefined;
+  }
+}
+
+/**
+ * Writes `<SUPABASE_HOME or ~/.supabase>/telemetry.json` on every command run.
+ * Mirrors Go's `LoadOrCreateState` (`apps/cli-go/internal/telemetry/state.go:74-98`):
+ *
+ *  - Reuses an existing `device_id` if the file is present.
+ *  - Rotates `session_id` if `session_last_active` is older than 30 minutes.
+ *  - Always sets `enabled: true` on a fresh state (matches Go — the field is
+ *    only flipped to `false` if the user has run `supabase telemetry disable`,
+ *    in which case the prior value is preserved). The
+ *    `SUPABASE_TELEMETRY_DISABLED` / `DO_NOT_TRACK` env vars suppress event
+ *    delivery, not state-file writes.
+ *  - Always writes — Go persists the state file even when telemetry is
+ *    disabled; only event delivery is suppressed.
+ *
+ * Best-effort: filesystem or JSON parse errors are swallowed.
+ */
+export const legacyTelemetryStateLayer = Layer.effect(
+  LegacyTelemetryState,
+  Effect.gen(function* () {
+    const fs = yield* FileSystem.FileSystem;
+    const pathSvc = yield* Path.Path;
+    const env = process.env;
+
+    return LegacyTelemetryState.of({
+      flush: Effect.gen(function* () {
+        const filePath = telemetryPath(env, pathSvc);
+
+        const existing = yield* fs.readFileString(filePath).pipe(
+          Effect.option,
+          Effect.map((opt) => (opt._tag === "Some" ? opt.value : undefined)),
+        );
+        const prior = existing !== undefined ? readExistingState(existing) : undefined;
+
+        const now = new Date();
+        const nowIso = now.toISOString();
+
+        const priorActive =
+          prior?.session_last_active !== undefined
+            ? new Date(prior.session_last_active).getTime()
+            : 0;
+        const expired =
+          !Number.isFinite(priorActive) || now.getTime() - priorActive > SESSION_ROTATION_MS;
+
+        const state: State = {
+          enabled: prior?.enabled ?? true,
+          device_id: prior?.device_id ?? crypto.randomUUID(),
+          session_id:
+            !expired && prior?.session_id !== undefined ? prior.session_id : crypto.randomUUID(),
+          session_last_active: nowIso,
+          ...(prior?.distinct_id !== undefined ? { distinct_id: prior.distinct_id } : {}),
+          schema_version: SCHEMA_VERSION,
+        };
+
+        yield* fs.makeDirectory(pathSvc.dirname(filePath), { recursive: true });
+        yield* fs.writeFileString(filePath, JSON.stringify(state));
+      }).pipe(Effect.ignore),
+    });
+  }),
+);
diff --git a/apps/cli/src/legacy/telemetry/legacy-telemetry-state.service.ts b/apps/cli/src/legacy/telemetry/legacy-telemetry-state.service.ts
new file mode 100644
index 0000000000..c39e094487
--- /dev/null
+++ b/apps/cli/src/legacy/telemetry/legacy-telemetry-state.service.ts
@@ -0,0 +1,17 @@
+import type { Effect } from "effect";
+import { Context } from "effect";
+
+interface LegacyTelemetryStateShape {
+  /**
+   * Persists the legacy telemetry state to disk (matches Go's
+   * `LoadOrCreateState` in `apps/cli-go/internal/telemetry/state.go:74-98`).
+   *
+   * Best-effort: any filesystem error is swallowed.
+   */
+  readonly flush: Effect.Effect<void>;
+}
+
+export class LegacyTelemetryState extends Context.Service<
+  LegacyTelemetryState,
+  LegacyTelemetryStateShape
+>()("supabase/legacy/TelemetryState") {}
diff --git a/apps/cli/src/next/cli/main.ts b/apps/cli/src/next/cli/main.ts
index 094e450178..5f30a56071 100644
--- a/apps/cli/src/next/cli/main.ts
+++ b/apps/cli/src/next/cli/main.ts
@@ -1,5 +1,6 @@
 #!/usr/bin/env bun
 import { runCli } from "../../shared/cli/run.ts";
+import { analyticsLayer } from "../../shared/telemetry/analytics.layer.ts";
 import { nextRoot } from "./root.ts";
 
-await runCli(nextRoot);
+await runCli(nextRoot, { analyticsLayer });
diff --git a/apps/cli/src/next/commands/branches/create/create.handler.ts b/apps/cli/src/next/commands/branches/create/create.handler.ts
index b246895f22..c0b0062463 100644
--- a/apps/cli/src/next/commands/branches/create/create.handler.ts
+++ b/apps/cli/src/next/commands/branches/create/create.handler.ts
@@ -1,4 +1,4 @@
-import { Effect, FileSystem, Option, Path } from "effect";
+import { Effect, Option } from "effect";
 import { PlatformApi } from "../../../auth/platform-api.service.ts";
 import {
   ProjectLinkState,
@@ -7,41 +7,10 @@ import {
 import { Output } from "../../../../shared/output/output.service.ts";
 import { formatTableRow, outputTable } from "../../../../shared/output/table.ts";
 import { formatUtcDate, formatUtcTime } from "../../../../shared/output/time.ts";
-import { RuntimeInfo } from "../../../../shared/runtime/runtime-info.service.ts";
+import { detectGitBranch } from "../../../../shared/git/git-branch.ts";
 import type { CreateFlags } from "./create.command.ts";
 import { BranchAlreadyExistsError, NoBranchNameError } from "../errors.ts";
 
-const detectGitBranch: Effect.Effect<
-  Option.Option<string>,
-  never,
-  RuntimeInfo | FileSystem.FileSystem | Path.Path
-> = Effect.gen(function* () {
-  const githubHeadRef = process.env.GITHUB_HEAD_REF;
-  if (githubHeadRef) {
-    return Option.some(githubHeadRef);
-  }
-
-  const runtimeInfo = yield* RuntimeInfo;
-  const fs = yield* FileSystem.FileSystem;
-  const path = yield* Path.Path;
-
-  let dir = path.resolve(runtimeInfo.cwd);
-  const root = path.parse(dir).root;
-
-  while (true) {
-    const headPath = path.join(dir, ".git", "HEAD");
-    const content = yield* fs.readFileString(headPath).pipe(Effect.option);
-    if (Option.isSome(content)) {
-      const match = content.value.trim().match(/^ref: refs\/heads\/(.+)$/);
-      return match?.[1] !== undefined ? Option.some(match[1]) : Option.none<string>();
-    }
-    if (dir === root) {
-      return Option.none<string>();
-    }
-    dir = path.dirname(dir);
-  }
-});
-
 const resolveBranchName = Effect.fnUntraced(function* (nameOpt: Option.Option<string>) {
   if (Option.isSome(nameOpt)) {
     return { branchName: nameOpt.value, gitBranch: Option.none<string>() };
diff --git a/apps/cli/src/next/commands/functions/dev/functions-dev-runtime.unit.test.ts b/apps/cli/src/next/commands/functions/dev/functions-dev-runtime.unit.test.ts
index 151b541d39..ae53560c6b 100644
--- a/apps/cli/src/next/commands/functions/dev/functions-dev-runtime.unit.test.ts
+++ b/apps/cli/src/next/commands/functions/dev/functions-dev-runtime.unit.test.ts
@@ -1,73 +1,101 @@
 import { describe, expect, it } from "@effect/vitest";
-import { BunServices } from "@effect/platform-bun";
-import { Duration, Effect, Layer, Stream } from "effect";
-import { mkdtempSync } from "node:fs";
-import { mkdir, rm, writeFile } from "node:fs/promises";
-import { tmpdir } from "node:os";
+import { Duration, Effect, Fiber, Layer, Queue, Stream } from "effect";
 import { join } from "node:path";
-import { parcelFileWatcherLayer } from "../../../../shared/runtime/parcel-file-watcher.layer.ts";
+import {
+  FileWatcher,
+  type FileWatchEvent,
+} from "../../../../shared/runtime/file-watcher.service.ts";
 import { watchPaths } from "./functions-dev-runtime.ts";
 
-function makeTempProject(): string {
-  return mkdtempSync(join(tmpdir(), "supabase-functions-dev-watch-"));
+function makeFakeFileWatcher() {
+  const queues = new Map<string, Queue.Enqueue<ReadonlyArray<FileWatchEvent>>>();
+
+  const layer = Layer.succeed(
+    FileWatcher,
+    FileWatcher.of({
+      watch: (path) =>
+        Stream.callback<ReadonlyArray<FileWatchEvent>>((queue) =>
+          Effect.sync(() => {
+            queues.set(path, queue);
+          }),
+        ),
+    }),
+  );
+
+  const awaitWatch = Effect.fnUntraced(function* (expectedPath: string) {
+    for (let attempt = 0; attempt < 50; attempt++) {
+      if (queues.has(expectedPath)) {
+        return;
+      }
+      yield* Effect.sleep("1 millis");
+    }
+    throw new Error(`No watcher registered for ${expectedPath}`);
+  });
+
+  const emit = (path: string, events: ReadonlyArray<FileWatchEvent>) =>
+    Effect.sync(() => {
+      const queue = queues.get(path);
+      if (queue === undefined) {
+        throw new Error(`No watcher registered for ${path}`);
+      }
+      Queue.offerUnsafe(queue, events);
+    });
+
+  return { awaitWatch, emit, layer };
 }
 
 describe("functions dev runtime", () => {
   it.live("emits when the supabase functions directory appears after dev starts", () => {
-    const cwd = makeTempProject();
+    const cwd = "/tmp/supabase-functions-dev-watch";
 
     return Effect.gen(function* () {
+      const watcher = makeFakeFileWatcher();
       let emitted = false;
 
-      yield* Effect.forkChild(
-        Effect.gen(function* () {
-          yield* Effect.sleep(Duration.millis(50));
-          yield* Effect.tryPromise(() =>
-            mkdir(join(cwd, "supabase", "functions"), { recursive: true }),
-          );
-        }),
-      );
-
-      yield* watchPaths([{ path: cwd, names: ["supabase"] }]).pipe(
+      const fiber = yield* watchPaths([{ path: cwd, names: ["supabase"] }]).pipe(
         Stream.take(1),
         Stream.runForEach(() =>
           Effect.sync(() => {
             emitted = true;
           }),
         ),
-        Effect.timeout(Duration.seconds(5)),
+        Effect.timeout(Duration.seconds(1)),
+        Effect.provide(watcher.layer),
+        Effect.forkChild({ startImmediately: true }),
       );
 
+      yield* watcher.awaitWatch(cwd);
+      yield* watcher.emit(cwd, [{ path: join(cwd, "supabase", "functions"), type: "create" }]);
+      yield* Fiber.join(fiber);
+
       expect(emitted).toBe(true);
-    }).pipe(
-      Effect.ensuring(Effect.tryPromise(() => rm(cwd, { recursive: true, force: true }))),
-      Effect.provide(Layer.mergeAll(BunServices.layer, parcelFileWatcherLayer)),
-    );
+    });
   });
 
   it.live("marks config json changes as project config changes", () => {
-    const cwd = makeTempProject();
+    const cwd = "/tmp/supabase-functions-dev-watch";
+    const supabaseDir = join(cwd, "supabase");
 
     return Effect.gen(function* () {
-      yield* Effect.tryPromise(() => mkdir(join(cwd, "supabase"), { recursive: true }));
+      const watcher = makeFakeFileWatcher();
 
-      yield* Effect.forkChild(
-        Effect.gen(function* () {
-          yield* Effect.sleep(Duration.millis(50));
-          yield* Effect.tryPromise(() =>
-            writeFile(join(cwd, "supabase", "config.json"), JSON.stringify({ functions: {} })),
-          );
-        }),
+      const fiber = yield* watchPaths([
+        { path: supabaseDir, names: ["functions", "config.toml", "config.json"] },
+      ]).pipe(
+        Stream.take(1),
+        Stream.runCollect,
+        Effect.timeout(Duration.seconds(1)),
+        Effect.provide(watcher.layer),
+        Effect.forkChild({ startImmediately: true }),
       );
 
-      const changes = yield* watchPaths([
-        { path: join(cwd, "supabase"), names: ["functions", "config.toml", "config.json"] },
-      ]).pipe(Stream.take(1), Stream.runCollect, Effect.timeout(Duration.seconds(5)));
+      yield* watcher.awaitWatch(supabaseDir);
+      yield* watcher.emit(supabaseDir, [
+        { path: join(supabaseDir, "config.json"), type: "create" },
+      ]);
+      const changes = yield* Fiber.join(fiber);
 
       expect(changes.at(0)?.touchesProjectConfig).toBe(true);
-    }).pipe(
-      Effect.ensuring(Effect.tryPromise(() => rm(cwd, { recursive: true, force: true }))),
-      Effect.provide(Layer.mergeAll(BunServices.layer, parcelFileWatcherLayer)),
-    );
+    });
   });
 });
diff --git a/apps/cli/src/next/commands/platform/platform-examples.ts b/apps/cli/src/next/commands/platform/platform-examples.ts
index 53f21f1ad2..edb501f071 100644
--- a/apps/cli/src/next/commands/platform/platform-examples.ts
+++ b/apps/cli/src/next/commands/platform/platform-examples.ts
@@ -14,7 +14,10 @@ const PARAM_PLACEHOLDERS: Record<string, string | boolean | number> = {
   ref: "project-ref",
   slug: "my-function",
   function_slug: "my-function",
-  branch_id_or_ref: "branch-ref",
+  // 20-letter project ref. The oneOf union for this field accepts either a
+  // project ref (`^[a-z]{20}$`) or an RFC 4122 UUID — a plain placeholder
+  // like "branch-ref" would now be rejected by the schema.
+  branch_id_or_ref: "abcdefghijklmnopqrst",
   id: "resource-id",
   name: "example-name",
 };
diff --git a/apps/cli/src/next/commands/platform/platform-examples.unit.test.ts b/apps/cli/src/next/commands/platform/platform-examples.unit.test.ts
index 4d95bbb8a5..e22c36db1c 100644
--- a/apps/cli/src/next/commands/platform/platform-examples.unit.test.ts
+++ b/apps/cli/src/next/commands/platform/platform-examples.unit.test.ts
@@ -110,7 +110,7 @@ describe("platform example generation", () => {
       expect.objectContaining({
         description: "Pass the required path, query, or header input with `--params`.",
         command:
-          'supabase api request /v1/branches/{branch_id_or_ref} --method DELETE --params \'{"branch_id_or_ref":"branch-ref"}\'',
+          'supabase api request /v1/branches/{branch_id_or_ref} --method DELETE --params \'{"branch_id_or_ref":"abcdefghijklmnopqrst"}\'',
       }),
     ]);
   });
diff --git a/apps/cli/src/next/commands/platform/platform-input.unit.test.ts b/apps/cli/src/next/commands/platform/platform-input.unit.test.ts
index 4d63cfd0dd..4dfcfe038c 100644
--- a/apps/cli/src/next/commands/platform/platform-input.unit.test.ts
+++ b/apps/cli/src/next/commands/platform/platform-input.unit.test.ts
@@ -124,13 +124,16 @@ describe("platform input", () => {
 
   it.effect("accepts string-only union params in dry-run mode", () =>
     Effect.gen(function* () {
+      // Must satisfy one of the oneOf branches (20-letter project ref or
+      // RFC 4122 UUID). A bare "foo" used to slip through when the UUID branch
+      // had no pattern check; the @supabase/api schema patch closed that gap.
       const decoded = yield* decodePlatformInput(
         deleteBranchDescriptor,
         deleteBranchDescriptor.inputSchema,
-        { branch_id_or_ref: "foo" },
+        { branch_id_or_ref: "abcdefghijklmnopqrst" },
       );
 
-      expect(decoded).toEqual({ branch_id_or_ref: "foo" });
+      expect(decoded).toEqual({ branch_id_or_ref: "abcdefghijklmnopqrst" });
     }),
   );
 
@@ -370,11 +373,15 @@ describe("platform input", () => {
       promptText: (message, options) =>
         Effect.sync(() => {
           prompts.push(message);
-          const validationError = options?.validate?.("branch-ref");
+          // Use a 20-letter project ref so the value satisfies the
+          // `branch_id_or_ref` oneOf union. The plain "branch-ref"
+          // placeholder used to pass when the UUID branch was unconstrained;
+          // the schema fix tightened that.
+          const validationError = options?.validate?.("abcdefghijklmnopqrst");
           if (validationError !== undefined) {
             throw new Error(`Unexpected validation error: ${validationError}`);
           }
-          return "branch-ref";
+          return "abcdefghijklmnopqrst";
         }),
       promptPassword: () => Effect.succeed(""),
       promptConfirm: () => Effect.succeed(true),
@@ -390,12 +397,13 @@ describe("platform input", () => {
         }),
       success: () => Effect.void,
       fail: () => Effect.void,
+      raw: () => Effect.void,
     });
 
     return Effect.gen(function* () {
       const completed = yield* promptForMissingPlatformFields(deleteBranchDescriptor, {});
       expect(completed).toEqual({
-        branch_id_or_ref: "branch-ref",
+        branch_id_or_ref: "abcdefghijklmnopqrst",
       });
       expect(prompts).toEqual(["Branch Id Or Ref"]);
     }).pipe(Effect.provide(out), Effect.provide(mockStdin(true)));
diff --git a/apps/cli/src/next/commands/platform/platform-schema-introspection.ts b/apps/cli/src/next/commands/platform/platform-schema-introspection.ts
index 438cc81c5d..ea934d9a39 100644
--- a/apps/cli/src/next/commands/platform/platform-schema-introspection.ts
+++ b/apps/cli/src/next/commands/platform/platform-schema-introspection.ts
@@ -21,7 +21,9 @@ function humanizeFieldName(name: string): string {
 }
 
 function isSensitiveField(name: string): boolean {
-  return /(pass(word)?|secret|token|jwt|private[_-]?key|db[_-]?pass)/i.test(name);
+  return /(pass(word)?|secret|token|jwt|private[_-]?key|api[_-]?key|access[_-]?key|root[_-]?key|db[_-]?pass)/i.test(
+    name,
+  );
 }
 
 function enumValuesFor(schema: PlatformOpenApiSchema): ReadonlyArray<string> | undefined {
@@ -77,8 +79,10 @@ function stringOnlyUnionMetadataFor(
         variant,
       ): variant is
         | { readonly kind: "string" }
-        | { readonly kind: "enum"; readonly enumValues: ReadonlyArray<string> } =>
-        variant !== undefined,
+        | {
+            readonly kind: "enum";
+            readonly enumValues: ReadonlyArray<string>;
+          } => variant !== undefined,
     );
 
   if (variantMetadata.length !== variants.length) {
diff --git a/apps/cli/src/next/commands/platform/platform-schema.integration.test.ts b/apps/cli/src/next/commands/platform/platform-schema.integration.test.ts
index 8b43cbe208..bce09cb550 100644
--- a/apps/cli/src/next/commands/platform/platform-schema.integration.test.ts
+++ b/apps/cli/src/next/commands/platform/platform-schema.integration.test.ts
@@ -38,8 +38,7 @@ describe("api schema payload", () => {
       route: "/v1/projects",
       method: "GET",
       summary: "List all projects",
-      description:
-        "Returns a list of all projects you've previously created.\n\nUse `/v1/organizations/{slug}/projects` instead when possible to get more precise results and pagination support.",
+      description: "Returns a list of all projects you've previously created.",
     });
   });
 
@@ -251,7 +250,9 @@ describe("api schema payload", () => {
       },
       examples: expect.arrayContaining([
         expect.objectContaining({
-          command: expect.stringContaining('--params \'{"branch_id_or_ref":"branch-ref"}\''),
+          command: expect.stringContaining(
+            '--params \'{"branch_id_or_ref":"abcdefghijklmnopqrst"}\'',
+          ),
         }),
       ]),
     });
diff --git a/apps/cli/src/next/commands/start/start.command.ts b/apps/cli/src/next/commands/start/start.command.ts
index 82bd6fd2d5..fb68c97727 100644
--- a/apps/cli/src/next/commands/start/start.command.ts
+++ b/apps/cli/src/next/commands/start/start.command.ts
@@ -1,4 +1,5 @@
 import { Effect, Layer, Option, Context } from "effect";
+import { loadProjectConfig } from "@supabase/config";
 import {
   DEFAULT_MANAGED_STACK_NAME,
   StateManager,
@@ -150,10 +151,20 @@ export const startCommand = Command.make("start", flags).pipe(
           onSome: (metadata) => metadata.services,
         }),
       );
-      const stackConfig = withServiceVersions(
+      // The flag is tri-state in config.toml: unset / true / false. Today, unset and true both
+      // preserve the long-standing local behaviour of auto-exposing new entities in `public`.
+      // The implicit default flips to false on 2026-05-30 to match the new cloud default, and
+      // the field is removed in 2026-10-30.
+      const loadedProjectConfig = yield* loadProjectConfig(projectHome.projectRoot);
+      const autoExposeNewTables = loadedProjectConfig?.config.api.auto_expose_new_tables ?? true;
+      const baseStackConfig = withServiceVersions(
         toStartStackConfig(flags.exclude, flags.mode),
         serviceVersionContext.runtimeVersions,
       );
+      const stackConfig = {
+        ...baseStackConfig,
+        postgres: { ...baseStackConfig.postgres, autoExposeNewTables },
+      };
       const resolvedConfig = yield* Effect.promise(() =>
         resolveDaemonConfig({
           cacheRoot: cliConfig.supabaseHome,
diff --git a/apps/cli/src/shared/cli/hidden-flag.ts b/apps/cli/src/shared/cli/hidden-flag.ts
index 2641242f67..ba0d4f7636 100644
--- a/apps/cli/src/shared/cli/hidden-flag.ts
+++ b/apps/cli/src/shared/cli/hidden-flag.ts
@@ -13,12 +13,6 @@ export const LegacyHiddenFlags: Context.Reference<ReadonlySet<string>> = Context
   defaultValue: () => new Set<string>(),
 });
 
-export const LegacyHiddenSubcommands: Context.Reference<ReadonlySet<string>> = Context.Reference<
-  ReadonlySet<string>
->("supabase/legacy/LegacyHiddenSubcommands", {
-  defaultValue: () => new Set<string>(),
-});
-
 const hiddenFlagNames = new WeakMap<object, ReadonlyArray<string>>();
 
 const collectSingleNames = (param: Param.Param<Param.ParamKind, unknown>): Array<string> => {
@@ -76,36 +70,14 @@ export const withHiddenFromConfig =
     return Command.annotate(cmd, LegacyHiddenFlags, hidden);
   };
 
-export const withHiddenSubcommands =
-  (names: ReadonlyArray<string>) =>
-  <Name extends string, Input, ContextInput, E, R>(
-    cmd: Command.Command<Name, Input, ContextInput, E, R>,
-  ): Command.Command<Name, Input, ContextInput, E, R> =>
-    Command.annotate(cmd, LegacyHiddenSubcommands, new Set(names));
-
 export const stripHiddenFlagsFromHelpDoc = (doc: HelpDoc.HelpDoc): HelpDoc.HelpDoc => {
   const hiddenFlags = Context.get(doc.annotations, LegacyHiddenFlags);
-  const hiddenSubcommands = Context.get(doc.annotations, LegacyHiddenSubcommands);
-  if (hiddenFlags.size === 0 && hiddenSubcommands.size === 0) return doc;
+  if (hiddenFlags.size === 0) return doc;
   const filteredFlags = doc.flags.filter((flag) => !hiddenFlags.has(flag.name));
   const filteredGlobalFlags = doc.globalFlags?.filter((flag) => !hiddenFlags.has(flag.name));
-  const filteredSubcommands = doc.subcommands?.flatMap((group) => {
-    const commands = group.commands.filter((command) => !hiddenSubcommands.has(command.name));
-    if (commands.length === 0) return [];
-    return [
-      {
-        ...group,
-        commands: commands as unknown as readonly [
-          HelpDoc.SubcommandDoc,
-          ...Array<HelpDoc.SubcommandDoc>,
-        ],
-      },
-    ];
-  });
   return {
     ...doc,
     flags: filteredFlags,
-    ...(filteredSubcommands !== undefined && { subcommands: filteredSubcommands }),
     ...(filteredGlobalFlags !== undefined && { globalFlags: filteredGlobalFlags }),
   };
 };
diff --git a/apps/cli/src/shared/cli/hidden-flag.unit.test.ts b/apps/cli/src/shared/cli/hidden-flag.unit.test.ts
index 356cd980f4..e70a6bd656 100644
--- a/apps/cli/src/shared/cli/hidden-flag.unit.test.ts
+++ b/apps/cli/src/shared/cli/hidden-flag.unit.test.ts
@@ -1,13 +1,15 @@
-import { Context, Option } from "effect";
-import { Command, Flag, type HelpDoc } from "effect/unstable/cli";
+import { Context, Effect, Layer, Option } from "effect";
+import { CliOutput, Command, Flag, type HelpDoc } from "effect/unstable/cli";
 import { describe, expect, it } from "vitest";
+import { legacyBranchesCommand } from "../../legacy/commands/branches/branches.command.ts";
+import { legacyDbCommand } from "../../legacy/commands/db/db.command.ts";
+import { LegacyGoProxy } from "../legacy/go-proxy.service.ts";
+import { textCliOutputFormatter } from "../output/text-formatter.ts";
 import {
   LegacyHiddenFlags,
-  LegacyHiddenSubcommands,
   stripHiddenFlagsFromHelpDoc,
   withHidden,
   withHiddenFromConfig,
-  withHiddenSubcommands,
 } from "./hidden-flag.ts";
 
 const flagDoc = (name: string): HelpDoc.FlagDoc => ({
@@ -35,15 +37,6 @@ const helpDocWithHidden = (
     annotations: Context.make(LegacyHiddenFlags, new Set(hidden)),
   });
 
-const helpDocWithHiddenSubcommands = (
-  hidden: ReadonlyArray<string>,
-  overrides: Partial<HelpDoc.HelpDoc>,
-): HelpDoc.HelpDoc =>
-  helpDoc({
-    ...overrides,
-    annotations: Context.make(LegacyHiddenSubcommands, new Set(hidden)),
-  });
-
 // Reach into the internal command shape to obtain the help doc the formatter
 // would render. Effect builds this from `Command.annotations`, which is the
 // contract `withHiddenFromConfig` relies on.
@@ -54,6 +47,22 @@ const buildHelpDoc = <Name extends string, Input, ContextInput, E, R>(
   cmd: Command.Command<Name, Input, ContextInput, E, R>,
 ): HelpDoc.HelpDoc => (cmd as unknown as CommandImpl).buildHelpDoc([]);
 
+function mockLegacyGoProxy() {
+  const calls: Array<ReadonlyArray<string>> = [];
+  const layer = Layer.succeed(LegacyGoProxy, {
+    exec: (args) =>
+      Effect.sync(() => {
+        calls.push([...args]);
+      }),
+  });
+
+  return { layer, calls };
+}
+
+const legacyTestRoot = Command.make("supabase").pipe(
+  Command.withSubcommands([legacyBranchesCommand, legacyDbCommand]),
+);
+
 describe("withHidden", () => {
   it("returns the same flag instance", () => {
     const flag = Flag.boolean("legacy-bundle");
@@ -121,15 +130,6 @@ describe("withHiddenFromConfig", () => {
   });
 });
 
-describe("withHiddenSubcommands", () => {
-  it("adds hidden subcommand annotations to the command help doc", () => {
-    const cmd = Command.make("demo").pipe(withHiddenSubcommands(["legacy"]));
-    const annotated = Context.get(buildHelpDoc(cmd).annotations, LegacyHiddenSubcommands);
-
-    expect([...annotated]).toEqual(["legacy"]);
-  });
-});
-
 describe("stripHiddenFlagsFromHelpDoc", () => {
   it("returns the doc unchanged when annotations are empty", () => {
     const doc = helpDoc({ flags: [flagDoc("foo")] });
@@ -154,26 +154,60 @@ describe("stripHiddenFlagsFromHelpDoc", () => {
     expect(stripped.globalFlags).toBeUndefined();
     expect(stripped.flags.map((f) => f.name)).toEqual(["bar"]);
   });
+});
 
-  it("filters hidden subcommands by the doc's annotation", () => {
-    const doc = helpDocWithHiddenSubcommands(["legacy"], {
-      subcommands: [
-        {
-          group: undefined,
-          commands: [
-            {
-              name: "visible",
-              alias: undefined,
-              shortDescription: "visible",
-              description: "visible",
-            },
-            { name: "legacy", alias: undefined, shortDescription: "legacy", description: "legacy" },
-          ],
-        },
-      ],
-    });
+describe("legacy hidden subcommands", () => {
+  it("omits hidden branch and db subcommands from help docs", () => {
+    const branchesHelp = buildHelpDoc(legacyBranchesCommand);
+    expect(branchesHelp.subcommands?.[0]?.commands.map((command) => command.name)).toEqual([
+      "list",
+      "create",
+      "get",
+      "update",
+      "pause",
+      "unpause",
+      "delete",
+    ]);
 
-    const stripped = stripHiddenFlagsFromHelpDoc(doc);
-    expect(stripped.subcommands?.[0]?.commands.map((command) => command.name)).toEqual(["visible"]);
+    const dbHelp = buildHelpDoc(legacyDbCommand);
+    expect(dbHelp.subcommands?.[0]?.commands.map((command) => command.name)).toEqual([
+      "diff",
+      "dump",
+      "push",
+      "pull",
+      "reset",
+      "lint",
+      "start",
+      "query",
+      "advisors",
+      "schema",
+    ]);
+  });
+
+  it("still executes hidden subcommands by exact name", async () => {
+    // `branches disable` was a hidden proxy before the native port (CLI-1289).
+    // It is now a native handler — `branches/disable/disable.integration.test.ts`
+    // covers its execution path. The other three remain Go proxies, so this
+    // test continues to verify the hidden-by-name dispatch via `LegacyGoProxy`.
+    const proxy = mockLegacyGoProxy();
+    await Effect.runPromise(
+      Effect.gen(function* () {
+        yield* Command.runWith(legacyTestRoot, { version: "0.0.0-test" })(["db", "test"]);
+        yield* Command.runWith(legacyTestRoot, { version: "0.0.0-test" })(["db", "branch", "list"]);
+        yield* Command.runWith(legacyTestRoot, { version: "0.0.0-test" })([
+          "db",
+          "remote",
+          "changes",
+        ]);
+      }).pipe(
+        Effect.provide(Layer.mergeAll(proxy.layer, CliOutput.layer(textCliOutputFormatter()))),
+      ) as Effect.Effect<void>,
+    );
+
+    expect(proxy.calls).toEqual([
+      ["db", "test"],
+      ["db", "branch", "list"],
+      ["db", "remote", "changes"],
+    ]);
   });
 });
diff --git a/apps/cli/src/shared/cli/run.ts b/apps/cli/src/shared/cli/run.ts
index 177d7dd038..633bcb48ce 100644
--- a/apps/cli/src/shared/cli/run.ts
+++ b/apps/cli/src/shared/cli/run.ts
@@ -21,7 +21,7 @@ import { runtimeInfoLayer } from "../runtime/runtime-info.layer.ts";
 import { ttyLayer } from "../runtime/tty.layer.ts";
 import { CommandRuntime } from "../runtime/command-runtime.service.ts";
 import { ProcessControl } from "../runtime/process-control.service.ts";
-import { analyticsLayer } from "../telemetry/analytics.layer.ts";
+import type { Analytics } from "../telemetry/analytics.service.ts";
 import { telemetryRuntimeLayer } from "../telemetry/runtime.layer.ts";
 import { tracingLayer } from "../telemetry/tracing.layer.ts";
 
@@ -65,7 +65,17 @@ function projectHomeLayerFor(runtimeLayer: Layer.Layer<never>) {
   );
 }
 
-function cliProgramFor(rootCommand: Command.Command.Any, args: ReadonlyArray<string>) {
+type AnyAnalyticsLayer = Layer.Layer<Analytics, never, any>;
+
+export interface RunCliOptions {
+  readonly analyticsLayer: AnyAnalyticsLayer;
+}
+
+function cliProgramFor(
+  rootCommand: Command.Command.Any,
+  args: ReadonlyArray<string>,
+  options: RunCliOptions,
+) {
   const runtimeLayer = Layer.mergeAll(processControlLayer, runtimeInfoLayer, ttyLayer);
   const fallbackCommandLayer = Layer.mergeAll(
     // Root command env inference currently leaks some subcommand-provided services.
@@ -92,7 +102,7 @@ function cliProgramFor(rootCommand: Command.Command.Any, args: ReadonlyArray<str
   );
   return Command.runWith(rootCommand, { version: CLI_VERSION })(args).pipe(
     Effect.provide(formatterLayerFor(args)),
-    Effect.provide(analyticsLayer),
+    Effect.provide(options.analyticsLayer),
     Effect.provide(tracingLayer),
     Effect.provide(telemetryRuntimeLayer),
     Effect.provide(cliConfigLayerFor(runtimeLayer)),
@@ -106,7 +116,7 @@ function cliProgramFor(rootCommand: Command.Command.Any, args: ReadonlyArray<str
   );
 }
 
-export async function runCli(rootCommand: Command.Command.Any) {
+export async function runCli(rootCommand: Command.Command.Any, options: RunCliOptions) {
   const args = await Effect.runPromise(
     Effect.gen(function* () {
       const stdio = yield* Stdio.Stdio;
@@ -115,7 +125,7 @@ export async function runCli(rootCommand: Command.Command.Any) {
   );
 
   const useGlobalSignalInterrupt = !args.includes("start");
-  const cliProgram = cliProgramFor(rootCommand, args);
+  const cliProgram = cliProgramFor(rootCommand, args, options);
 
   const signalAwareProgram = Effect.scoped(
     Effect.gen(function* () {
diff --git a/apps/cli/src/shared/git/git-branch.ts b/apps/cli/src/shared/git/git-branch.ts
new file mode 100644
index 0000000000..6091e1be31
--- /dev/null
+++ b/apps/cli/src/shared/git/git-branch.ts
@@ -0,0 +1,45 @@
+import { Effect, FileSystem, Option, Path } from "effect";
+
+import { RuntimeInfo } from "../runtime/runtime-info.service.ts";
+
+/**
+ * Reproduces `apps/cli-go/internal/utils/git.go:GetGitBranchOrDefault`:
+ *
+ * 1. `$GITHUB_HEAD_REF` wins when set (CI pull-request workflows).
+ * 2. Otherwise walk from CWD up to the filesystem root reading `.git/HEAD`
+ *    and parsing `ref: refs/heads/<name>`.
+ *
+ * Returns `Option.none()` when no git repository is detected. Callers may
+ * substitute their own default (e.g. Go's `GetGitBranch` defaults to "main";
+ * `branches create` defaults to the empty string so the prompt is skipped).
+ */
+export const detectGitBranch: Effect.Effect<
+  Option.Option<string>,
+  never,
+  RuntimeInfo | FileSystem.FileSystem | Path.Path
+> = Effect.gen(function* () {
+  const githubHeadRef = process.env["GITHUB_HEAD_REF"];
+  if (githubHeadRef !== undefined && githubHeadRef.length > 0) {
+    return Option.some(githubHeadRef);
+  }
+
+  const runtimeInfo = yield* RuntimeInfo;
+  const fs = yield* FileSystem.FileSystem;
+  const path = yield* Path.Path;
+
+  let dir = path.resolve(runtimeInfo.cwd);
+  const root = path.parse(dir).root;
+
+  while (true) {
+    const headPath = path.join(dir, ".git", "HEAD");
+    const content = yield* fs.readFileString(headPath).pipe(Effect.option);
+    if (Option.isSome(content)) {
+      const match = content.value.trim().match(/^ref: refs\/heads\/(.+)$/);
+      return match?.[1] !== undefined ? Option.some(match[1]) : Option.none<string>();
+    }
+    if (dir === root) {
+      return Option.none<string>();
+    }
+    dir = path.dirname(dir);
+  }
+});
diff --git a/apps/cli/src/shared/git/git-branch.unit.test.ts b/apps/cli/src/shared/git/git-branch.unit.test.ts
new file mode 100644
index 0000000000..3b32a35660
--- /dev/null
+++ b/apps/cli/src/shared/git/git-branch.unit.test.ts
@@ -0,0 +1,113 @@
+import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+
+import { BunServices } from "@effect/platform-bun";
+import { describe, expect, it } from "@effect/vitest";
+import { Effect, Layer, Option } from "effect";
+
+import { RuntimeInfo } from "../runtime/runtime-info.service.ts";
+import { detectGitBranch } from "./git-branch.ts";
+
+function withCwd(cwd: string) {
+  return Layer.mergeAll(
+    BunServices.layer,
+    Layer.succeed(RuntimeInfo, {
+      cwd,
+      platform: process.platform,
+      arch: process.arch,
+      homeDir: tmpdir(),
+      execPath: process.execPath,
+      pid: process.pid,
+    }),
+  );
+}
+
+describe("detectGitBranch", () => {
+  let original: string | undefined;
+
+  it.live("returns $GITHUB_HEAD_REF when set", () => {
+    original = process.env["GITHUB_HEAD_REF"];
+    process.env["GITHUB_HEAD_REF"] = "ci-branch";
+    return Effect.gen(function* () {
+      const got = yield* detectGitBranch;
+      try {
+        expect(Option.isSome(got)).toBe(true);
+        if (Option.isSome(got)) expect(got.value).toBe("ci-branch");
+      } finally {
+        if (original === undefined) delete process.env["GITHUB_HEAD_REF"];
+        else process.env["GITHUB_HEAD_REF"] = original;
+      }
+    }).pipe(Effect.provide(withCwd(tmpdir())));
+  });
+
+  it.live("parses ref: refs/heads/<name> from .git/HEAD in CWD", () => {
+    const original2 = process.env["GITHUB_HEAD_REF"];
+    delete process.env["GITHUB_HEAD_REF"];
+    const root = mkdtempSync(join(tmpdir(), "git-branch-"));
+    mkdirSync(join(root, ".git"));
+    writeFileSync(join(root, ".git", "HEAD"), "ref: refs/heads/feature-x\n");
+    return Effect.gen(function* () {
+      const got = yield* detectGitBranch;
+      try {
+        expect(Option.isSome(got)).toBe(true);
+        if (Option.isSome(got)) expect(got.value).toBe("feature-x");
+      } finally {
+        rmSync(root, { recursive: true, force: true });
+        if (original2 !== undefined) process.env["GITHUB_HEAD_REF"] = original2;
+      }
+    }).pipe(Effect.provide(withCwd(root)));
+  });
+
+  it.live("walks up parent directories until .git/HEAD is found", () => {
+    const original3 = process.env["GITHUB_HEAD_REF"];
+    delete process.env["GITHUB_HEAD_REF"];
+    const root = mkdtempSync(join(tmpdir(), "git-branch-walk-"));
+    const nested = join(root, "a", "b", "c");
+    mkdirSync(nested, { recursive: true });
+    mkdirSync(join(root, ".git"));
+    writeFileSync(join(root, ".git", "HEAD"), "ref: refs/heads/main\n");
+    return Effect.gen(function* () {
+      const got = yield* detectGitBranch;
+      try {
+        expect(Option.isSome(got)).toBe(true);
+        if (Option.isSome(got)) expect(got.value).toBe("main");
+      } finally {
+        rmSync(root, { recursive: true, force: true });
+        if (original3 !== undefined) process.env["GITHUB_HEAD_REF"] = original3;
+      }
+    }).pipe(Effect.provide(withCwd(nested)));
+  });
+
+  it.live("returns none when no .git/HEAD is ever found", () => {
+    const original4 = process.env["GITHUB_HEAD_REF"];
+    delete process.env["GITHUB_HEAD_REF"];
+    const root = mkdtempSync(join(tmpdir(), "git-branch-empty-"));
+    return Effect.gen(function* () {
+      const got = yield* detectGitBranch;
+      try {
+        expect(Option.isNone(got)).toBe(true);
+      } finally {
+        rmSync(root, { recursive: true, force: true });
+        if (original4 !== undefined) process.env["GITHUB_HEAD_REF"] = original4;
+      }
+    }).pipe(Effect.provide(withCwd(root)));
+  });
+
+  it.live("returns none when .git/HEAD points at a detached commit (no ref: line)", () => {
+    const original5 = process.env["GITHUB_HEAD_REF"];
+    delete process.env["GITHUB_HEAD_REF"];
+    const root = mkdtempSync(join(tmpdir(), "git-branch-detached-"));
+    mkdirSync(join(root, ".git"));
+    writeFileSync(join(root, ".git", "HEAD"), "deadbeef\n");
+    return Effect.gen(function* () {
+      const got = yield* detectGitBranch;
+      try {
+        expect(Option.isNone(got)).toBe(true);
+      } finally {
+        rmSync(root, { recursive: true, force: true });
+        if (original5 !== undefined) process.env["GITHUB_HEAD_REF"] = original5;
+      }
+    }).pipe(Effect.provide(withCwd(root)));
+  });
+});
diff --git a/apps/cli/src/shared/legacy/go-proxy.layer.ts b/apps/cli/src/shared/legacy/go-proxy.layer.ts
index eb12c5125f..f7f86f08e1 100644
--- a/apps/cli/src/shared/legacy/go-proxy.layer.ts
+++ b/apps/cli/src/shared/legacy/go-proxy.layer.ts
@@ -36,7 +36,7 @@ export type BinaryResolution =
   | { readonly found: string }
   | { readonly notFound: ReadonlyArray<string> };
 
-function resolveBinary(): BinaryResolution {
+export function resolveBinary(): BinaryResolution {
   const tried: string[] = [];
 
   const envBin = process.env["SUPABASE_GO_BINARY"];
diff --git a/apps/cli/src/shared/output/json-error-handling.unit.test.ts b/apps/cli/src/shared/output/json-error-handling.unit.test.ts
index 73ca62355d..a6e7ca02ed 100644
--- a/apps/cli/src/shared/output/json-error-handling.unit.test.ts
+++ b/apps/cli/src/shared/output/json-error-handling.unit.test.ts
@@ -75,6 +75,7 @@ function mockOutput(format: "text" | "json" | "stream-json" = "text") {
       promptSelect: (_message, options) => Effect.succeed(options[0]!.value),
       promptMultiSelect: (_message, options) =>
         Effect.succeed(options.map((option) => option.value)),
+      raw: (_text: string, _stream?: "stdout" | "stderr") => Effect.void,
     }),
     get failCalls() {
       return failCalls;
diff --git a/apps/cli/src/shared/output/normalize-error.ts b/apps/cli/src/shared/output/normalize-error.ts
index 0bdc193721..a143b414b3 100644
--- a/apps/cli/src/shared/output/normalize-error.ts
+++ b/apps/cli/src/shared/output/normalize-error.ts
@@ -61,6 +61,37 @@ const mappedError = (error: ErrorRecord): NormalizedCliError | undefined => {
         message: readString(error, "message") ?? "Failed to start the Supabase daemon.",
         suggestion: "Check local resources and try `supabase start` again.",
       };
+    case "MissingOption": {
+      // Mirror Go Cobra's `required flag(s) "X" not set` wording. Effect CLI's
+      // default `Missing required flag: --X` differs and would break scripts
+      // that parse the Go CLI's stderr. We still cannot suppress Effect CLI's
+      // pre-error help dump (Cobra doesn't show it on parse error) — that
+      // would require a forked CLI parser. Match what we can.
+      const option = readString(error, "option");
+      return {
+        code: tag,
+        message: option
+          ? `Error: required flag(s) "${option}" not set`
+          : "Error: required flag(s) not set",
+      };
+    }
+    case "ShowHelp": {
+      // Effect CLI wraps parse errors in a ShowHelp envelope (`CliError.ts`)
+      // whose `errors` array holds the underlying causes. If exactly one of
+      // those is a known recoverable type with a Go-parity mapping, unwrap
+      // and surface that instead of the generic "Help requested" envelope
+      // message — otherwise the user sees a useless top-line above the real
+      // problem.
+      const errors = error["errors"];
+      if (Array.isArray(errors) && errors.length === 1) {
+        const inner = errors[0];
+        if (isErrorRecord(inner)) {
+          const innerMapped = mappedError(inner);
+          if (innerMapped) return innerMapped;
+        }
+      }
+      return undefined;
+    }
   }
 };
 
diff --git a/apps/cli/src/shared/output/normalize-error.unit.test.ts b/apps/cli/src/shared/output/normalize-error.unit.test.ts
index 1da14d8428..1eba0f07f6 100644
--- a/apps/cli/src/shared/output/normalize-error.unit.test.ts
+++ b/apps/cli/src/shared/output/normalize-error.unit.test.ts
@@ -34,6 +34,51 @@ describe("normalizeCliError", () => {
     });
   });
 
+  test("MissingOption renders Go Cobra's `required flag(s) X not set` wording", () => {
+    const error = { _tag: "MissingOption", option: "type" };
+    expect(normalizeCliError(error)).toEqual({
+      code: "MissingOption",
+      message: `Error: required flag(s) "type" not set`,
+    });
+  });
+
+  test("MissingOption with missing `option` field falls back to bare wording", () => {
+    const error = { _tag: "MissingOption" };
+    expect(normalizeCliError(error)).toEqual({
+      code: "MissingOption",
+      message: "Error: required flag(s) not set",
+    });
+  });
+
+  test("ShowHelp envelope unwraps a single MissingOption to Cobra wording", () => {
+    // Effect CLI raises `ShowHelp` containing the parse error in its `errors`
+    // array. We unwrap to surface the actionable message instead of "Help requested".
+    const error = {
+      _tag: "ShowHelp",
+      commandPath: ["sso", "add"],
+      errors: [{ _tag: "MissingOption", option: "type" }],
+    };
+    expect(normalizeCliError(error)).toEqual({
+      code: "MissingOption",
+      message: `Error: required flag(s) "type" not set`,
+    });
+  });
+
+  test("ShowHelp with multiple errors does not unwrap (falls back to generic)", () => {
+    const error = {
+      _tag: "ShowHelp",
+      commandPath: ["sso", "add"],
+      errors: [
+        { _tag: "MissingOption", option: "type" },
+        { _tag: "MissingOption", option: "project-ref" },
+      ],
+    };
+    // Should fall through to generic — message comes from ShowHelp itself,
+    // which doesn't include one in our test fixture.
+    const result = normalizeCliError(error);
+    expect(result.code).toBe("ShowHelp");
+  });
+
   test("normalizes a cause via its first failure", () => {
     const normalized = normalizeCause(Cause.fail({ _tag: "NoRunningStackError", cwd: "/tmp" }));
 
diff --git a/apps/cli/src/shared/output/output.layer.ts b/apps/cli/src/shared/output/output.layer.ts
index 88a46a2213..1b16c86ed7 100644
--- a/apps/cli/src/shared/output/output.layer.ts
+++ b/apps/cli/src/shared/output/output.layer.ts
@@ -330,15 +330,30 @@ export const textOutputLayer = Layer.effect(
         }),
       success: (message: string) => Effect.sync(() => log.success(message)),
       fail: (err: { code: string; message: string; detail?: string; suggestion?: string }) =>
-        Effect.gen(function* () {
-          yield* Effect.sync(() => log.error(styleText("red", err.message)));
-          const detail = err.detail;
-          if (detail) {
-            yield* Effect.sync(() => log.message(styleText("gray", detail)));
+        Effect.sync(() => {
+          // Matches Go's `recoverAndExit` (apps/cli-go/cmd/root.go:300-303): a
+          // red-styled message on stderr, optionally followed by a suggestion.
+          // Bypasses clack's `log.error` framing (`│` guide + `■` icon) so the
+          // output byte-matches the Go CLI for parity tests.
+          process.stderr.write(styleText("red", err.message) + "\n");
+          if (err.detail !== undefined && err.detail !== err.message) {
+            process.stderr.write(styleText("gray", err.detail) + "\n");
           }
-          const suggestion = err.suggestion;
-          if (suggestion) {
-            yield* Effect.sync(() => outro(suggestion));
+          if (err.suggestion !== undefined) {
+            process.stderr.write(err.suggestion + "\n");
+          } else if (!process.argv.includes("--debug")) {
+            // Go's `utils.SuggestDebugFlag` (apps/cli-go/internal/utils/misc.go:41).
+            process.stderr.write(
+              "Try rerunning the command with --debug to troubleshoot the error.\n",
+            );
+          }
+        }),
+      raw: (text: string, stream: "stdout" | "stderr" = "stdout") =>
+        Effect.sync(() => {
+          if (stream === "stderr") {
+            process.stderr.write(text);
+          } else {
+            process.stdout.write(text);
           }
         }),
     });
@@ -408,6 +423,8 @@ export const jsonOutputLayer = Layer.effect(
         writeStdout(JSON.stringify({ ...data, message }) + "\n"),
       fail: (err: { code: string; message: string; detail?: string; suggestion?: string }) =>
         writeStdout(JSON.stringify({ _tag: "Error", error: err }) + "\n"),
+      raw: (text: string, stream: "stdout" | "stderr" = "stdout") =>
+        stream === "stderr" ? writeStderr(text) : writeStdout(text),
     });
   }),
 );
@@ -420,6 +437,8 @@ export const streamJsonOutputLayer = Layer.effect(
 
     const writeStdout = (s: string) =>
       Stream.make(s).pipe(Stream.run(stdio.stdout()), Effect.orDie);
+    const writeStderr = (s: string) =>
+      Stream.make(s).pipe(Stream.run(stdio.stderr()), Effect.orDie);
     const emitLog = (level: "info" | "warn" | "success" | "error", message: string) => {
       const event: StreamEvent = {
         type: "log",
@@ -502,6 +521,8 @@ export const streamJsonOutputLayer = Layer.effect(
         };
         return writeStdout(JSON.stringify(event) + "\n");
       },
+      raw: (text: string, stream: "stdout" | "stderr" = "stdout") =>
+        stream === "stderr" ? writeStderr(text) : writeStdout(text),
     });
   }),
 );
diff --git a/apps/cli/src/shared/output/output.layer.unit.test.ts b/apps/cli/src/shared/output/output.layer.unit.test.ts
index 0e2b7b18a7..7592e67897 100644
--- a/apps/cli/src/shared/output/output.layer.unit.test.ts
+++ b/apps/cli/src/shared/output/output.layer.unit.test.ts
@@ -168,8 +168,14 @@ describe("Output", () => {
       }).pipe(Effect.provide(layer)),
     );
 
-    it.effect("fail renders an error, gray context, and closing suggestion", () =>
-      Effect.gen(function* () {
+    it.effect("fail writes Go-byte-identical red message + suggestion to stderr", () => {
+      const writes: string[] = [];
+      const originalWrite = process.stderr.write.bind(process.stderr);
+      process.stderr.write = ((chunk: string | Uint8Array) => {
+        writes.push(typeof chunk === "string" ? chunk : new TextDecoder().decode(chunk));
+        return true;
+      }) as typeof process.stderr.write;
+      return Effect.gen(function* () {
         const out = yield* Output;
         yield* out.fail({
           code: "E_TEST",
@@ -177,11 +183,72 @@ describe("Output", () => {
           detail: "extra detail",
           suggestion: "try again",
         });
-        expect(mockClack.log.error).toHaveBeenCalledWith("\x1B[31mtest error\x1B[39m");
-        expect(mockClack.log.message).toHaveBeenCalledWith("\x1B[90mextra detail\x1B[39m");
-        expect(mockClack.outro).toHaveBeenCalledWith("try again");
-      }).pipe(Effect.provide(layer)),
-    );
+        expect(writes).toEqual([
+          "\x1B[31mtest error\x1B[39m\n",
+          "\x1B[90mextra detail\x1B[39m\n",
+          "try again\n",
+        ]);
+      }).pipe(
+        Effect.provide(layer),
+        Effect.ensuring(
+          Effect.sync(() => {
+            process.stderr.write = originalWrite;
+          }),
+        ),
+      );
+    });
+
+    it.effect("fail falls back to the --debug suggestion when caller provides none", () => {
+      const writes: string[] = [];
+      const originalWrite = process.stderr.write.bind(process.stderr);
+      const originalArgv = process.argv;
+      process.stderr.write = ((chunk: string | Uint8Array) => {
+        writes.push(typeof chunk === "string" ? chunk : new TextDecoder().decode(chunk));
+        return true;
+      }) as typeof process.stderr.write;
+      // Strip --debug from argv so the fallback fires.
+      process.argv = originalArgv.filter((arg) => arg !== "--debug");
+      return Effect.gen(function* () {
+        const out = yield* Output;
+        yield* out.fail({ code: "E_TEST", message: "boom" });
+        expect(writes).toEqual([
+          "\x1B[31mboom\x1B[39m\n",
+          "Try rerunning the command with --debug to troubleshoot the error.\n",
+        ]);
+      }).pipe(
+        Effect.provide(layer),
+        Effect.ensuring(
+          Effect.sync(() => {
+            process.stderr.write = originalWrite;
+            process.argv = originalArgv;
+          }),
+        ),
+      );
+    });
+
+    it.effect("fail omits the --debug suggestion when --debug is set", () => {
+      const writes: string[] = [];
+      const originalWrite = process.stderr.write.bind(process.stderr);
+      const originalArgv = process.argv;
+      process.stderr.write = ((chunk: string | Uint8Array) => {
+        writes.push(typeof chunk === "string" ? chunk : new TextDecoder().decode(chunk));
+        return true;
+      }) as typeof process.stderr.write;
+      process.argv = [...originalArgv, "--debug"];
+      return Effect.gen(function* () {
+        const out = yield* Output;
+        yield* out.fail({ code: "E_TEST", message: "boom" });
+        expect(writes).toEqual(["\x1B[31mboom\x1B[39m\n"]);
+      }).pipe(
+        Effect.provide(layer),
+        Effect.ensuring(
+          Effect.sync(() => {
+            process.stderr.write = originalWrite;
+            process.argv = originalArgv;
+          }),
+        ),
+      );
+    });
 
     it.effect("promptText passes validate callback to clack", () => {
       mockClack.text.mockImplementation(
diff --git a/apps/cli/src/shared/output/output.service.ts b/apps/cli/src/shared/output/output.service.ts
index d3b5cd4eb2..5f394b6188 100644
--- a/apps/cli/src/shared/output/output.service.ts
+++ b/apps/cli/src/shared/output/output.service.ts
@@ -74,6 +74,14 @@ interface OutputShape {
     readonly detail?: string;
     readonly suggestion?: string;
   }) => Effect.Effect<void>;
+  /**
+   * Writes a raw chunk to stdout or stderr without framing.
+   *
+   * Reserved for byte-exact parity output (legacy Go-format encoders, Glamour-styled tables)
+   * where structured framing would change the bytes on the wire. Routes through the active
+   * output layer so tests can capture it without monkey-patching `process.stdout` / `process.stderr`.
+   */
+  readonly raw: (text: string, stream?: "stdout" | "stderr") => Effect.Effect<void>;
 }
 
 /**
diff --git a/apps/cli/src/shared/telemetry/analytics-context.ts b/apps/cli/src/shared/telemetry/analytics-context.ts
index 6e67db070c..f7851e4e13 100644
--- a/apps/cli/src/shared/telemetry/analytics-context.ts
+++ b/apps/cli/src/shared/telemetry/analytics-context.ts
@@ -3,8 +3,11 @@ import { Effect, Context } from "effect";
 export type AnalyticsContext = {
   readonly command_run_id?: string;
   readonly command?: string;
+  // next/ shell shape — separate `flags_used` (names) and `flag_values` (allowlist).
   readonly flags_used?: ReadonlyArray<string>;
   readonly flag_values?: Record<string, unknown>;
+  // legacy/ shell shape — single `flags` map mirroring Go's redaction.
+  readonly flags?: Record<string, unknown>;
   readonly distinct_id?: string;
   readonly groups?: {
     readonly organization?: string;
diff --git a/apps/cli/src/shared/telemetry/event-catalog.ts b/apps/cli/src/shared/telemetry/event-catalog.ts
new file mode 100644
index 0000000000..f85f44e2bd
--- /dev/null
+++ b/apps/cli/src/shared/telemetry/event-catalog.ts
@@ -0,0 +1,91 @@
+// CLI telemetry catalog. Mirrors apps/cli-go/internal/telemetry/events.go
+// 1:1 so legacy/ ports send byte-identical PostHog payloads. When the Go
+// catalog changes, update this file in the same PR.
+
+export const EventCommandExecuted = "cli_command_executed";
+export const EventProjectLinked = "cli_project_linked";
+export const EventLoginCompleted = "cli_login_completed";
+export const EventStackStarted = "cli_stack_started";
+export const EventUpgradeSuggested = "cli_upgrade_suggested";
+
+export const PropFeatureKey = "feature_key";
+export const PropOrgSlug = "org_slug";
+
+export const PropPlatform = "platform";
+export const PropSchemaVersion = "schema_version";
+export const PropDeviceId = "device_id";
+export const PropSessionId = "$session_id";
+export const PropIsFirstRun = "is_first_run";
+export const PropIsTty = "is_tty";
+export const PropIsCi = "is_ci";
+export const PropIsAgent = "is_agent";
+export const PropOs = "os";
+export const PropArch = "arch";
+export const PropCliVersion = "cli_version";
+export const PropEnvSignals = "env_signals";
+export const PropCommandRunId = "command_run_id";
+export const PropCommand = "command";
+export const PropFlags = "flags";
+export const PropExitCode = "exit_code";
+export const PropDurationMs = "duration_ms";
+
+export const GroupOrganization = "organization";
+export const GroupProject = "project";
+
+export const MaxEnvSignalValueLength = 80;
+
+// Env vars whose presence (any non-empty value) is recorded as `true` in env_signals.
+// Order matches apps/cli-go/internal/telemetry/events.go:126-167.
+export const EnvSignalPresenceKeys: ReadonlyArray<string> = [
+  // AI tools signals
+  "CURSOR_AGENT",
+  "CURSOR_TRACE_ID",
+  "GEMINI_CLI",
+  "CODEX_SANDBOX",
+  "CODEX_CI",
+  "CODEX_THREAD_ID",
+  "ANTIGRAVITY_AGENT",
+  "AUGMENT_AGENT",
+  "OPENCODE_CLIENT",
+  "CLAUDECODE",
+  "CLAUDE_CODE",
+  "REPL_ID",
+  "COPILOT_MODEL",
+  "COPILOT_ALLOW_ALL",
+  "COPILOT_GITHUB_TOKEN",
+  // CI signals
+  "CI",
+  "GITHUB_ACTIONS",
+  "BUILDKITE",
+  "TF_BUILD",
+  "JENKINS_URL",
+  "GITLAB_CI",
+  // Extra signals
+  "GITHUB_TOKEN",
+  "GITHUB_HEAD_REF",
+  "BITBUCKET_CLONE_DIR",
+  // Supabase environment signals
+  "SUPABASE_ACCESS_TOKEN",
+  "SUPABASE_HOME",
+  "SYSTEMROOT",
+  "SUPABASE_SSL_DEBUG",
+  "SUPABASE_CA_SKIP_VERIFY",
+  "SSL_CERT_FILE",
+  "SSL_CERT_DIR",
+  "NPM_CONFIG_REGISTRY",
+  "SUPABASE_SERVICE_ROLE_KEY",
+  "SUPABASE_PROJECT_ID",
+  "SUPABASE_POSTGRES_URL",
+  "SUPABASE_ENV",
+];
+
+// Env vars whose trimmed values are recorded in env_signals, capped at
+// MaxEnvSignalValueLength chars. Order matches events.go:171-178.
+export const EnvSignalValueKeys: ReadonlyArray<string> = [
+  "AI_AGENT",
+  "CURSOR_EXTENSION_HOST_ROLE",
+  "TERM",
+  "TERM_PROGRAM",
+  "TERM_PROGRAM_VERSION",
+  "TERM_COLOR_MODE",
+];
diff --git a/apps/cli/src/shared/telemetry/posthog-config.ts b/apps/cli/src/shared/telemetry/posthog-config.ts
new file mode 100644
index 0000000000..5b7ef1b8d0
--- /dev/null
+++ b/apps/cli/src/shared/telemetry/posthog-config.ts
@@ -0,0 +1,14 @@
+// PostHog connection config shared by both shells' analytics layers.
+// Defaults match apps/cli-go/internal/utils/misc.go PostHogAPIKey / PostHogEndpoint
+// (set via Go's -ldflags at build time, hard-coded here for the TS build).
+
+const DEFAULT_HOST = "https://eu.i.posthog.com";
+const DEFAULT_KEY = "phc_ihjC3EeB2wXCt87yccX5idgIgeZsub7WG0XR5hGFhJz";
+
+export const posthogConfig: {
+  readonly host: string;
+  readonly key: string;
+} = {
+  host: process.env.SUPABASE_TELEMETRY_POSTHOG_HOST ?? DEFAULT_HOST,
+  key: process.env.SUPABASE_TELEMETRY_POSTHOG_KEY ?? DEFAULT_KEY,
+};
diff --git a/apps/cli/tests/helpers/legacy-mocks.ts b/apps/cli/tests/helpers/legacy-mocks.ts
new file mode 100644
index 0000000000..88ac993331
--- /dev/null
+++ b/apps/cli/tests/helpers/legacy-mocks.ts
@@ -0,0 +1,463 @@
+import { mkdtempSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+
+import { BunServices } from "@effect/platform-bun";
+import { type ApiClient, makeApiClient, type SupabaseApiConfigError } from "@supabase/api/effect";
+import { Effect, Layer, Option, Redacted } from "effect";
+import * as HttpClient from "effect/unstable/http/HttpClient";
+import * as HttpClientError from "effect/unstable/http/HttpClientError";
+import * as HttpClientResponse from "effect/unstable/http/HttpClientResponse";
+import * as HttpClientRequestModule from "effect/unstable/http/HttpClientRequest";
+import type * as HttpClientRequest from "effect/unstable/http/HttpClientRequest";
+import { afterEach, beforeEach } from "vitest";
+
+import { LegacyCredentials } from "../../src/legacy/auth/legacy-credentials.service.ts";
+import { LegacyPlatformApi } from "../../src/legacy/auth/legacy-platform-api.service.ts";
+import { LegacyCliConfig } from "../../src/legacy/config/legacy-cli-config.service.ts";
+import { legacyProjectRefLayer } from "../../src/legacy/config/legacy-project-ref.layer.ts";
+import { LegacyLinkedProjectCache } from "../../src/legacy/telemetry/legacy-linked-project-cache.service.ts";
+import { LegacyTelemetryState } from "../../src/legacy/telemetry/legacy-telemetry-state.service.ts";
+import { LegacyOutputFlag } from "../../src/shared/legacy/global-flags.ts";
+import type { Output } from "../../src/shared/output/output.service.ts";
+import type { ProcessControl } from "../../src/shared/runtime/process-control.service.ts";
+import type { RuntimeInfo } from "../../src/shared/runtime/runtime-info.service.ts";
+import type { Tty } from "../../src/shared/runtime/tty.service.ts";
+import { Analytics } from "../../src/shared/telemetry/analytics.service.ts";
+import { mockAnalytics, mockProcessControl, mockRuntimeInfo, mockTty } from "./mocks.ts";
+
+// ---------------------------------------------------------------------------
+// Constants — Go-parity test fixtures used across every native-port integration
+// test. Centralized so a change to the project-ref schema (e.g. updated length)
+// only needs to update one constant.
+// ---------------------------------------------------------------------------
+
+export const LEGACY_VALID_REF = "abcdefghijklmnopqrst";
+export const LEGACY_VALID_TOKEN = "sbp_" + "a".repeat(40);
+export const LEGACY_DEFAULT_API_URL = "https://api.supabase.com";
+export const LEGACY_DEFAULT_USER_AGENT = "SupabaseCLI/0.0.0-dev";
+
+// ---------------------------------------------------------------------------
+// No-op layers — drop-in for tests that don't assert on telemetry / cache state.
+// ---------------------------------------------------------------------------
+
+export const mockLegacyLinkedProjectCacheLayer = Layer.succeed(LegacyLinkedProjectCache, {
+  cache: () => Effect.void,
+});
+
+export const mockLegacyTelemetryStateLayer = Layer.succeed(LegacyTelemetryState, {
+  flush: Effect.void,
+});
+
+// Default LegacyCredentials mock. `mockLegacyCliConfig` defaults to an env-set
+// access token, so handlers never hit the credentials fallback in tests — but
+// the service still needs to be in the layer to satisfy the required-services
+// signature. Save/delete die to surface accidental writes inside read-only
+// handlers.
+export const mockLegacyCredentialsLayer = Layer.succeed(LegacyCredentials, {
+  getAccessToken: Effect.sync(() => Option.none()),
+  saveAccessToken: () => Effect.die("unexpected legacy credentials write in test"),
+  deleteAccessToken: Effect.die("unexpected legacy credentials delete in test"),
+});
+
+// ---------------------------------------------------------------------------
+// State-tracking factories — for PersistentPostRun-parity assertions
+// (telemetry must flush, linked-project cache fires after ref resolution).
+// Shape matches the inline helpers the 9 native-port tests used pre-extraction.
+// ---------------------------------------------------------------------------
+
+export function mockLegacyTelemetryStateTracked(): {
+  readonly layer: Layer.Layer<LegacyTelemetryState>;
+  readonly flushed: boolean;
+} {
+  let flushed = false;
+  const layer = Layer.succeed(LegacyTelemetryState, {
+    get flush() {
+      return Effect.sync(() => {
+        flushed = true;
+      });
+    },
+  });
+  return {
+    layer,
+    get flushed() {
+      return flushed;
+    },
+  };
+}
+
+export function mockLegacyLinkedProjectCacheTracked(): {
+  readonly layer: Layer.Layer<LegacyLinkedProjectCache>;
+  readonly cached: boolean;
+} {
+  let cached = false;
+  const layer = Layer.succeed(LegacyLinkedProjectCache, {
+    cache: (_ref: string) =>
+      Effect.sync(() => {
+        cached = true;
+      }),
+  });
+  return {
+    layer,
+    get cached() {
+      return cached;
+    },
+  };
+}
+
+// ---------------------------------------------------------------------------
+// CLI config factory — defaults match the common case (linked project, valid
+// access token, supabase.com API URL). Tests override individual fields when
+// they need to exercise alternative resolution paths.
+// ---------------------------------------------------------------------------
+
+export function mockLegacyCliConfig(opts: {
+  readonly workdir: string;
+  readonly profile?: string;
+  readonly apiUrl?: string;
+  readonly accessToken?: Option.Option<Redacted.Redacted<string>>;
+  readonly projectId?: Option.Option<string>;
+  readonly userAgent?: string;
+}): Layer.Layer<LegacyCliConfig> {
+  return Layer.succeed(LegacyCliConfig, {
+    profile: opts.profile ?? "supabase",
+    apiUrl: opts.apiUrl ?? LEGACY_DEFAULT_API_URL,
+    accessToken: opts.accessToken ?? Option.some(Redacted.make(LEGACY_VALID_TOKEN)),
+    projectId: opts.projectId ?? Option.some(LEGACY_VALID_REF),
+    workdir: opts.workdir,
+    userAgent: opts.userAgent ?? LEGACY_DEFAULT_USER_AGENT,
+  });
+}
+
+// ---------------------------------------------------------------------------
+// HTTP transport primitives — exported as low-level building blocks for tests
+// that need a custom `handler` in `mockLegacyPlatformApi`.
+// ---------------------------------------------------------------------------
+
+export function legacyJsonResponse(
+  request: HttpClientRequest.HttpClientRequest,
+  status: number,
+  body: unknown,
+): HttpClientResponse.HttpClientResponse {
+  return HttpClientResponse.fromWeb(
+    request,
+    new Response(JSON.stringify(body), {
+      status,
+      headers: { "content-type": "application/json" },
+    }),
+  );
+}
+
+export function legacyTransportFailure(
+  request: HttpClientRequest.HttpClientRequest,
+  description = "ECONNREFUSED",
+): HttpClientError.HttpClientError {
+  return new HttpClientError.HttpClientError({
+    reason: new HttpClientError.TransportError({ request, description }),
+  });
+}
+
+/**
+ * Builds a real `HttpClientError` with a `StatusCodeError` reason for the
+ * given status code. Useful for the direct-service mock when the handler under
+ * test branches on `HttpClientError.isHttpClientError(cause)` + `cause.response.status`.
+ */
+export function legacyStatusCodeFailure(status: number): HttpClientError.HttpClientError {
+  const request = HttpClientRequestModule.get("https://api.supabase.com/mock");
+  const response = HttpClientResponse.fromWeb(
+    request,
+    new Response("", { status, headers: { "content-type": "application/json" } }),
+  );
+  return new HttpClientError.HttpClientError({
+    reason: new HttpClientError.StatusCodeError({ request, response }),
+  });
+}
+
+function legacyHttpClientLayer(
+  handler: (
+    request: HttpClientRequest.HttpClientRequest,
+  ) => Effect.Effect<HttpClientResponse.HttpClientResponse, HttpClientError.HttpClientError>,
+): Layer.Layer<HttpClient.HttpClient> {
+  return Layer.succeed(
+    HttpClient.HttpClient,
+    HttpClient.make((request) => handler(request)),
+  );
+}
+
+// ---------------------------------------------------------------------------
+// Platform API factory — hybrid surface.
+//
+// Precedence (high → low): `network: "fail"` > `handler` > `byMethod` > `response`.
+// `body` is JSON-decoded when the Uint8Array body parses; otherwise the raw
+// decoded string is stored. Falsy bodies (no request body) record `undefined`.
+// ---------------------------------------------------------------------------
+
+export type LegacyHttpMethod = "GET" | "POST" | "PATCH" | "PUT" | "DELETE";
+
+export interface LegacyRecordedRequest {
+  readonly url: string;
+  readonly method: string;
+  readonly headers: Readonly<Record<string, string | undefined>>;
+  readonly body?: unknown;
+}
+
+export interface LegacyApiResponse {
+  readonly status: number;
+  readonly body: unknown;
+}
+
+export type LegacyApiHandler = (
+  request: HttpClientRequest.HttpClientRequest,
+  recorded: LegacyRecordedRequest,
+) => Effect.Effect<HttpClientResponse.HttpClientResponse, HttpClientError.HttpClientError>;
+
+export interface MockLegacyPlatformApiOpts {
+  readonly response?: LegacyApiResponse;
+  readonly byMethod?: Partial<Record<LegacyHttpMethod, LegacyApiResponse>>;
+  readonly handler?: LegacyApiHandler;
+  readonly network?: "fail";
+  readonly apiUrl?: string;
+  readonly userAgent?: string;
+  readonly accessToken?: string;
+}
+
+export interface MockLegacyPlatformApiResult {
+  // `SupabaseApiConfigError` is the build-time validation error from `makeApiClient`;
+  // it never actually triggers with the defaults this factory supplies, but the
+  // type leaks through the Layer.effect signature.
+  readonly layer: Layer.Layer<LegacyPlatformApi, SupabaseApiConfigError>;
+  // Same recording handler exposed as a standalone HttpClient layer so legacy
+  // handlers that bypass the typed client (e.g. sso add/update preserving
+  // arbitrary attribute_mapping keys) can hit `httpClient.execute(req)` while
+  // still recording requests into the shared `requests` array.
+  readonly httpClientLayer: Layer.Layer<HttpClient.HttpClient>;
+  readonly requests: ReadonlyArray<LegacyRecordedRequest>;
+}
+
+export function mockLegacyPlatformApi(
+  opts: MockLegacyPlatformApiOpts = {},
+): MockLegacyPlatformApiResult {
+  const requests: LegacyRecordedRequest[] = [];
+
+  const handler = (request: HttpClientRequest.HttpClientRequest) =>
+    Effect.gen(function* () {
+      let body: unknown = undefined;
+      if (request.body._tag === "Uint8Array") {
+        const decoded = new TextDecoder().decode(request.body.body);
+        try {
+          body = JSON.parse(decoded);
+        } catch {
+          body = decoded;
+        }
+      }
+      const recorded: LegacyRecordedRequest = {
+        url: request.url,
+        method: request.method,
+        headers: request.headers,
+        body,
+      };
+      requests.push(recorded);
+
+      if (opts.network === "fail") {
+        return yield* Effect.fail(legacyTransportFailure(request));
+      }
+      if (opts.handler !== undefined) {
+        return yield* opts.handler(request, recorded);
+      }
+      const methodResponse = opts.byMethod?.[request.method as LegacyHttpMethod];
+      if (methodResponse !== undefined) {
+        return legacyJsonResponse(request, methodResponse.status, methodResponse.body);
+      }
+      if (opts.response !== undefined) {
+        return legacyJsonResponse(request, opts.response.status, opts.response.body);
+      }
+      // No response configured — emit a 200 with an empty body. Most tests
+      // configure at least one response shape; this default keeps unconfigured
+      // calls from hanging.
+      return legacyJsonResponse(request, 200, null);
+    });
+
+  const httpClientLayer = legacyHttpClientLayer(handler);
+
+  const layer = Layer.effect(
+    LegacyPlatformApi,
+    makeApiClient({
+      baseUrl: opts.apiUrl ?? LEGACY_DEFAULT_API_URL,
+      accessToken: opts.accessToken ?? LEGACY_VALID_TOKEN,
+      userAgent: opts.userAgent ?? LEGACY_DEFAULT_USER_AGENT,
+    }),
+  ).pipe(Layer.provide(httpClientLayer));
+
+  return { layer, httpClientLayer, requests };
+}
+
+// ---------------------------------------------------------------------------
+// Direct-service mock for LegacyPlatformApi.
+//
+// Bypasses the real API client's input/output schema validation by providing
+// `LegacyPlatformApi` via `Layer.succeed` directly. Use this when:
+//
+//   - the API schema is too strict for the test scenario (e.g. the
+//     `branch_id_or_ref` oneOf union rejects 20-letter project refs because
+//     the UUID branch has no actual UUID pattern check), AND
+//   - the handler logic under test does not depend on the byte-exact wire
+//     format of requests/responses.
+//
+// The recorded `requests` array tracks `{ method, input }` for every call.
+// Methods not present in `v1Stubs` die at call time so missing wiring shows
+// up loud and clear instead of silently returning undefined.
+// ---------------------------------------------------------------------------
+
+type V1Stubs = Partial<{
+  readonly [K in keyof ApiClient["v1"]]: (
+    input: Parameters<ApiClient["v1"][K]>[0],
+  ) => Effect.Effect<unknown, unknown>;
+}>;
+
+export interface MockLegacyPlatformApiServiceOpts {
+  readonly v1?: V1Stubs;
+}
+
+export interface MockLegacyPlatformApiServiceResult {
+  readonly layer: Layer.Layer<LegacyPlatformApi>;
+  readonly requests: ReadonlyArray<{ readonly method: string; readonly input: unknown }>;
+}
+
+export function mockLegacyPlatformApiService(
+  opts: MockLegacyPlatformApiServiceOpts = {},
+): MockLegacyPlatformApiServiceResult {
+  const requests: Array<{ method: string; input: unknown }> = [];
+  const stubs = opts.v1 ?? {};
+
+  const v1Proxy = new Proxy({} as ApiClient["v1"], {
+    get(_target, prop: string) {
+      return (input: unknown) =>
+        Effect.gen(function* () {
+          requests.push({ method: prop, input });
+          const stub = (stubs as Record<string, unknown>)[prop] as
+            | ((i: unknown) => Effect.Effect<unknown, unknown>)
+            | undefined;
+          if (stub === undefined) {
+            return yield* Effect.die(`Unmocked LegacyPlatformApi.v1.${prop}`);
+          }
+          return yield* stub(input);
+        });
+    },
+  });
+
+  const layer = Layer.succeed(LegacyPlatformApi, { v1: v1Proxy } as ApiClient);
+
+  return { layer, requests };
+}
+
+// ---------------------------------------------------------------------------
+// Temp workdir lifecycle — calls vitest beforeEach/afterEach internally, so
+// the helper must be invoked at module scope (or inside the surrounding
+// `describe`). Accessing `.current` outside a test throws.
+// ---------------------------------------------------------------------------
+
+export function useLegacyTempWorkdir(prefix = "supabase-legacy-test-"): {
+  readonly current: string;
+} {
+  let root: string | undefined;
+  beforeEach(() => {
+    root = mkdtempSync(join(tmpdir(), prefix));
+  });
+  afterEach(() => {
+    if (root !== undefined) {
+      rmSync(root, { recursive: true, force: true });
+      root = undefined;
+    }
+  });
+  return {
+    get current() {
+      if (root === undefined) {
+        throw new Error(
+          "useLegacyTempWorkdir().current accessed outside an active test — call it inside it.live(...) or it(...)",
+        );
+      }
+      return root;
+    },
+  };
+}
+
+// ---------------------------------------------------------------------------
+// Runtime composition — bundles the entire Layer.mergeAll(...) graph that
+// every native-port integration test re-builds, including the easy-to-mis-wire
+// `legacyProjectRefLayer.pipe(Layer.provide(...))` subgraph
+// (legacy CLAUDE.md item 5: "Layer.provide does not share to siblings inside
+// Layer.mergeAll" — centralising the subgraph here removes a recurring footgun).
+// ---------------------------------------------------------------------------
+
+type GoOutputValue = "env" | "pretty" | "json" | "toml" | "yaml";
+
+// ---------------------------------------------------------------------------
+// Analytics mock lives in `./mocks.ts` (`mockAnalytics`) — same shape we used
+// to ship in a `mockLegacyAnalytics` helper here. Use `mockAnalytics()` from
+// the shared mocks module directly.
+
+export interface BuildLegacyTestRuntimeOpts {
+  readonly out: { readonly layer: Layer.Layer<Output> };
+  // `Layer.Layer<LegacyPlatformApi, SupabaseApiConfigError>` from
+  // `mockLegacyPlatformApi`; the error channel never fires in practice but
+  // its presence here keeps callers from needing an `as` cast.
+  readonly api: {
+    readonly layer: Layer.Layer<LegacyPlatformApi, SupabaseApiConfigError>;
+    readonly httpClientLayer?: Layer.Layer<HttpClient.HttpClient>;
+  };
+  readonly cliConfig: Layer.Layer<LegacyCliConfig>;
+  readonly tty?: Layer.Layer<Tty>;
+  readonly processControl?: { readonly layer: Layer.Layer<ProcessControl> };
+  readonly runtimeInfo?: Layer.Layer<RuntimeInfo>;
+  readonly telemetry?: Layer.Layer<LegacyTelemetryState>;
+  readonly linkedProjectCache?: Layer.Layer<LegacyLinkedProjectCache>;
+  readonly analytics?: { readonly layer: Layer.Layer<Analytics> };
+  readonly goOutput?: Option.Option<GoOutputValue>;
+}
+
+export function buildLegacyTestRuntime(opts: BuildLegacyTestRuntimeOpts) {
+  const tty = opts.tty ?? mockTty({ stdinIsTty: false, stdoutIsTty: false });
+  const processControl = (opts.processControl ?? mockProcessControl()).layer;
+  const runtimeInfo = opts.runtimeInfo ?? mockRuntimeInfo();
+  const telemetry = opts.telemetry ?? mockLegacyTelemetryStateLayer;
+  const linkedProjectCache = opts.linkedProjectCache ?? mockLegacyLinkedProjectCacheLayer;
+  const analytics = (opts.analytics ?? mockAnalytics()).layer;
+  const goOutput = opts.goOutput ?? Option.none<GoOutputValue>();
+  const httpClient = opts.api.httpClientLayer;
+
+  // When the caller doesn't expose an HttpClient layer, use a stub that fails
+  // loudly if any code path tries to consume it. Always wiring HttpClient at
+  // the top level keeps the layer's exported services stable for type-checking
+  // (otherwise the conditional branch confuses TS-side inference).
+  const noopHttpClient = Layer.succeed(
+    HttpClient.HttpClient,
+    HttpClient.make(() =>
+      Effect.die(
+        "unexpected HttpClient.execute() in legacy test runtime — pass api.httpClientLayer",
+      ),
+    ),
+  );
+
+  return Layer.mergeAll(
+    opts.out.layer,
+    opts.api.layer,
+    opts.cliConfig,
+    tty,
+    processControl,
+    runtimeInfo,
+    legacyProjectRefLayer.pipe(
+      Layer.provide(opts.api.layer),
+      Layer.provide(opts.cliConfig),
+      Layer.provide(tty),
+      Layer.provide(opts.out.layer),
+      Layer.provide(BunServices.layer),
+    ),
+    BunServices.layer,
+    Layer.succeed(LegacyOutputFlag, goOutput),
+    linkedProjectCache,
+    telemetry,
+    analytics,
+    mockLegacyCredentialsLayer,
+    httpClient ?? noopHttpClient,
+  );
+}
diff --git a/apps/cli/tests/helpers/mocks.ts b/apps/cli/tests/helpers/mocks.ts
index d5ab3253da..aeb12f0083 100644
--- a/apps/cli/tests/helpers/mocks.ts
+++ b/apps/cli/tests/helpers/mocks.ts
@@ -229,6 +229,7 @@ export function mockOutput(
   const messages: OutputMessage[] = [];
   const progressEvents: ProgressEvent[] = [];
   const events: OutputEvent[] = [];
+  const rawChunks: Array<{ text: string; stream: "stdout" | "stderr" }> = [];
   const promptSelectCalls: Array<{
     message: string;
     options: ReadonlyArray<{
@@ -378,11 +379,28 @@ export function mockOutput(
         }),
       promptMultiSelect: (_message, options) =>
         Effect.succeed(options.map((option) => option.value)),
+      raw: (text: string, stream: "stdout" | "stderr" = "stdout") =>
+        Effect.sync(() => {
+          rawChunks.push({ text, stream });
+        }),
     }),
     messages,
     progressEvents,
     events,
     promptSelectCalls,
+    rawChunks,
+    get stdoutText() {
+      return rawChunks
+        .filter((c) => c.stream === "stdout")
+        .map((c) => c.text)
+        .join("");
+    },
+    get stderrText() {
+      return rawChunks
+        .filter((c) => c.stream === "stderr")
+        .map((c) => c.text)
+        .join("");
+    },
   };
 }
 
diff --git a/apps/docs/package.json b/apps/docs/package.json
index f671e01e4c..9876ccba09 100644
--- a/apps/docs/package.json
+++ b/apps/docs/package.json
@@ -8,17 +8,17 @@
     "build": "bun run generate && next build"
   },
   "dependencies": {
-    "fumadocs-core": "^16.8.11",
-    "fumadocs-mdx": "^15.0.6",
-    "fumadocs-ui": "^16.8.11",
+    "fumadocs-core": "^16.9.1",
+    "fumadocs-mdx": "^15.0.9",
+    "fumadocs-ui": "^16.9.1",
     "next": "^16.2.6",
     "react": "^19.2.6",
     "react-dom": "^19.2.6"
   },
   "devDependencies": {
     "@types/mdx": "^2.0.13",
-    "@types/node": "^25.8.0",
-    "@types/react": "^19.1.8",
+    "@types/node": "^25.9.1",
+    "@types/react": "^19.2.15",
     "@types/react-dom": "^19.1.6",
     "typescript": "^6.0.3"
   },
diff --git a/package.json b/package.json
index a3b42f3cbe..11e61aadf1 100644
--- a/package.json
+++ b/package.json
@@ -17,6 +17,6 @@
     "@swc-node/register": "catalog:",
     "@swc/core": "catalog:",
     "nx": "catalog:",
-    "verdaccio": "^6.7.1"
+    "verdaccio": "^6.7.2"
   }
 }
diff --git a/packages/api/scripts/generate.ts b/packages/api/scripts/generate.ts
index 7020a539a7..73191f99f6 100644
--- a/packages/api/scripts/generate.ts
+++ b/packages/api/scripts/generate.ts
@@ -204,11 +204,41 @@ function identifier(value: string): string {
   return camel[0] ? camel[0].toUpperCase() + camel.slice(1) : camel;
 }
 
-function sanitizeOpenApiSchema(schema: OpenApiSchema): OpenApiSchema {
+// OpenAPI 3.0 treats `format: "uuid"` as a hint, not validation. Without a
+// concrete `pattern`, the resulting Effect schema's UUID branch has no check,
+// so a 20-letter project ref matches both branches of `oneOf [project-ref, uuid]`
+// unions (e.g. `branch_id_or_ref`) and validation fails at "Expected exactly one
+// member to match". Add the canonical RFC 4122 pattern so the branches become
+// mutually exclusive. Mirrored by an inline patch in `contracts.ts` (search
+// "Patched: OpenAPI's `format: \"uuid\"`") that survives ad-hoc edits between
+// regenerations.
+const UUID_PATTERN =
+  "^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$";
+
+// Keys that we want to strip from a schema node because they describe
+// documentation / example values rather than the value's shape. JSON Schema's
+// `default` is a primitive (or array/object) literal used for documentation —
+// not part of the type contract — so we drop it during sanitization to keep
+// the generated Effect schema lean.
+const SCHEMA_METADATA_KEYS = new Set(["default", "example", "examples"]);
+
+// Recurses into a schema. The `inPropertiesMap` flag tracks whether the current
+// object is the value of a JSON Schema `properties: {...}` map — in that
+// context, keys are user-defined property NAMES (which may legitimately be
+// literally `"default"`, `"example"`, etc.) and we must NOT strip them.
+//
+// Without this distinction, an OpenAPI schema like
+//   { properties: { default: { oneOf: [...] } } }
+// would have the `default` field silently dropped during generation, producing
+// a TypeScript schema that omits the property. This bit the SAML SSO
+// attribute-mapping codegen (each key has `name?`, `names?`, `array?`, and
+// `default?: any` per OpenAPI spec; the `default?: any` field was silently
+// stripped because of this).
+function sanitizeOpenApiSchema(schema: OpenApiSchema, inPropertiesMap = false): OpenApiSchema {
   const sanitized: OpenApiSchema = {};
 
   for (const [key, rawValue] of Object.entries(schema)) {
-    if (key === "default" || key === "example" || key === "examples") {
+    if (!inPropertiesMap && SCHEMA_METADATA_KEYS.has(key)) {
       continue;
     }
 
@@ -220,13 +250,25 @@ function sanitizeOpenApiSchema(schema: OpenApiSchema): OpenApiSchema {
     }
 
     if (isRecord(rawValue)) {
-      sanitized[key] = sanitizeOpenApiSchema(rawValue);
+      // The immediate children of `properties: {...}` are property-name keys
+      // mapping to schemas; recurse with `inPropertiesMap=true` so the
+      // metadata-stripping logic skips that level.
+      const recurseInPropertiesMap = !inPropertiesMap && key === "properties";
+      sanitized[key] = sanitizeOpenApiSchema(rawValue, recurseInPropertiesMap);
       continue;
     }
 
     sanitized[key] = rawValue;
   }
 
+  if (
+    sanitized.type === "string" &&
+    sanitized.format === "uuid" &&
+    sanitized.pattern === undefined
+  ) {
+    sanitized.pattern = UUID_PATTERN;
+  }
+
   return sanitized;
 }
 
diff --git a/packages/api/src/generated/contracts.ts b/packages/api/src/generated/contracts.ts
index 19cd2765f1..1115e96073 100644
--- a/packages/api/src/generated/contracts.ts
+++ b/packages/api/src/generated/contracts.ts
@@ -2,7 +2,11 @@ import * as Schema from "effect/Schema";
 
 // non-recursive definitions
 export const BranchResponse = Schema.Struct({
-  id: Schema.String.annotate({ format: "uuid" }),
+  id: Schema.String.annotate({ format: "uuid" }).check(
+    Schema.isPattern(
+      new RegExp("^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$"),
+    ),
+  ),
   name: Schema.String,
   project_ref: Schema.String,
   parent_project_ref: Schema.String,
@@ -22,7 +26,9 @@ export const BranchResponse = Schema.Struct({
     "MIGRATIONS_FAILED",
     "FUNCTIONS_DEPLOYED",
     "FUNCTIONS_FAILED",
-  ]),
+  ]).annotate({
+    description: "This field is deprecated. List action runs to get branch status instead.",
+  }),
   created_at: Schema.String.annotate({ format: "date-time" }),
   updated_at: Schema.String.annotate({ format: "date-time" }),
   review_requested_at: Schema.optionalKey(Schema.String.annotate({ format: "date-time" })),
@@ -154,7 +160,11 @@ export const V1ServiceHealthResponse = Schema.Struct({
   error: Schema.optionalKey(Schema.String),
 });
 export const ThirdPartyAuth = Schema.Struct({
-  id: Schema.String.annotate({ format: "uuid" }),
+  id: Schema.String.annotate({ format: "uuid" }).check(
+    Schema.isPattern(
+      new RegExp("^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$"),
+    ),
+  ),
   type: Schema.String,
   oidc_issuer_url: Schema.optionalKey(Schema.Union([Schema.String, Schema.Null])),
   jwks_url: Schema.optionalKey(Schema.Union([Schema.String, Schema.Null])),
@@ -323,7 +333,11 @@ export const V1AuthorizeJitAccessInput = Schema.Struct({
   rhost: Schema.String.check(Schema.isMinLength(1)),
 });
 export const V1AuthorizeJitAccessOutput = Schema.Struct({
-  user_id: Schema.String.annotate({ format: "uuid" }),
+  user_id: Schema.String.annotate({ format: "uuid" }).check(
+    Schema.isPattern(
+      new RegExp("^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$"),
+    ),
+  ),
   user_role: Schema.Struct({
     role: Schema.String.check(Schema.isMinLength(1)),
     expires_at: Schema.optionalKey(Schema.Number.check(Schema.isFinite())),
@@ -333,10 +347,15 @@ export const V1AuthorizeJitAccessOutput = Schema.Struct({
         allowed_cidrs_v6: Schema.optionalKey(Schema.Array(Schema.Struct({ cidr: Schema.String }))),
       }),
     ),
+    branches_only: Schema.optionalKey(Schema.Boolean),
   }),
 });
 export const V1AuthorizeUserInput = Schema.Struct({
-  client_id: Schema.String.annotate({ format: "uuid" }),
+  client_id: Schema.String.annotate({ format: "uuid" }).check(
+    Schema.isPattern(
+      new RegExp("^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$"),
+    ),
+  ),
   response_type: Schema.Literals(["code", "token", "id_token token"]),
   redirect_uri: Schema.String,
   scope: Schema.optionalKey(Schema.String),
@@ -486,7 +505,11 @@ export const V1CreateABranchInput = Schema.Struct({
   ),
 });
 export const V1CreateABranchOutput = Schema.Struct({
-  id: Schema.String.annotate({ format: "uuid" }),
+  id: Schema.String.annotate({ format: "uuid" }).check(
+    Schema.isPattern(
+      new RegExp("^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$"),
+    ),
+  ),
   name: Schema.String,
   project_ref: Schema.String,
   parent_project_ref: Schema.String,
@@ -506,7 +529,9 @@ export const V1CreateABranchOutput = Schema.Struct({
     "MIGRATIONS_FAILED",
     "FUNCTIONS_DEPLOYED",
     "FUNCTIONS_FAILED",
-  ]),
+  ]).annotate({
+    description: "This field is deprecated. List action runs to get branch status instead.",
+  }),
   created_at: Schema.String.annotate({ format: "date-time" }),
   updated_at: Schema.String.annotate({ format: "date-time" }),
   review_requested_at: Schema.optionalKey(Schema.String.annotate({ format: "date-time" })),
@@ -729,6 +754,17 @@ export const V1CreateASsoProviderInput = Schema.Struct({
         Schema.Struct({
           name: Schema.optionalKey(Schema.String),
           names: Schema.optionalKey(Schema.Array(Schema.String)),
+          default: Schema.optionalKey(
+            Schema.Union(
+              [
+                Schema.Struct({}),
+                Schema.Number.check(Schema.isFinite()),
+                Schema.String,
+                Schema.Boolean,
+              ],
+              { mode: "oneOf" },
+            ),
+          ),
           array: Schema.optionalKey(Schema.Boolean),
         }),
       ),
@@ -758,6 +794,17 @@ export const V1CreateASsoProviderOutput = Schema.Struct({
             Schema.Struct({
               name: Schema.optionalKey(Schema.String),
               names: Schema.optionalKey(Schema.Array(Schema.String)),
+              default: Schema.optionalKey(
+                Schema.Union(
+                  [
+                    Schema.Struct({}),
+                    Schema.Number.check(Schema.isFinite()),
+                    Schema.String,
+                    Schema.Boolean,
+                  ],
+                  { mode: "oneOf" },
+                ),
+              ),
               array: Schema.optionalKey(Schema.Boolean),
             }),
           ),
@@ -802,7 +849,11 @@ export const V1CreateLegacySigningKeyInput = Schema.Struct({
     .check(Schema.isPattern(new RegExp("^[a-z]+$"))),
 });
 export const V1CreateLegacySigningKeyOutput = Schema.Struct({
-  id: Schema.String.annotate({ format: "uuid" }),
+  id: Schema.String.annotate({ format: "uuid" }).check(
+    Schema.isPattern(
+      new RegExp("^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$"),
+    ),
+  ),
   algorithm: Schema.Literals(["EdDSA", "ES256", "RS256", "HS256"]),
   status: Schema.Literals(["in_use", "previously_used", "revoked", "standby"]),
   public_jwk: Schema.optionalKey(Schema.Union([Schema.Unknown, Schema.Null])),
@@ -865,7 +916,11 @@ export const V1CreateProjectClaimTokenOutput = Schema.Struct({
   token_alias: Schema.String,
   expires_at: Schema.String,
   created_at: Schema.String,
-  created_by: Schema.String.annotate({ format: "uuid" }),
+  created_by: Schema.String.annotate({ format: "uuid" }).check(
+    Schema.isPattern(
+      new RegExp("^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$"),
+    ),
+  ),
 });
 export const V1CreateProjectSigningKeyInput = Schema.Struct({
   ref: Schema.String.check(Schema.isMinLength(20))
@@ -877,7 +932,15 @@ export const V1CreateProjectSigningKeyInput = Schema.Struct({
     Schema.Union(
       [
         Schema.Struct({
-          kid: Schema.optionalKey(Schema.String.annotate({ format: "uuid" })),
+          kid: Schema.optionalKey(
+            Schema.String.annotate({ format: "uuid" }).check(
+              Schema.isPattern(
+                new RegExp(
+                  "^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$",
+                ),
+              ),
+            ),
+          ),
           use: Schema.optionalKey(Schema.Literal("sig")),
           key_ops: Schema.optionalKey(
             Schema.Array(Schema.Literals(["sign", "verify"]))
@@ -897,7 +960,15 @@ export const V1CreateProjectSigningKeyInput = Schema.Struct({
           qi: Schema.String,
         }),
         Schema.Struct({
-          kid: Schema.optionalKey(Schema.String.annotate({ format: "uuid" })),
+          kid: Schema.optionalKey(
+            Schema.String.annotate({ format: "uuid" }).check(
+              Schema.isPattern(
+                new RegExp(
+                  "^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$",
+                ),
+              ),
+            ),
+          ),
           use: Schema.optionalKey(Schema.Literal("sig")),
           key_ops: Schema.optionalKey(
             Schema.Array(Schema.Literals(["sign", "verify"]))
@@ -913,7 +984,15 @@ export const V1CreateProjectSigningKeyInput = Schema.Struct({
           d: Schema.String,
         }),
         Schema.Struct({
-          kid: Schema.optionalKey(Schema.String.annotate({ format: "uuid" })),
+          kid: Schema.optionalKey(
+            Schema.String.annotate({ format: "uuid" }).check(
+              Schema.isPattern(
+                new RegExp(
+                  "^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$",
+                ),
+              ),
+            ),
+          ),
           use: Schema.optionalKey(Schema.Literal("sig")),
           key_ops: Schema.optionalKey(
             Schema.Array(Schema.Literals(["sign", "verify"]))
@@ -928,7 +1007,15 @@ export const V1CreateProjectSigningKeyInput = Schema.Struct({
           d: Schema.String,
         }),
         Schema.Struct({
-          kid: Schema.optionalKey(Schema.String.annotate({ format: "uuid" })),
+          kid: Schema.optionalKey(
+            Schema.String.annotate({ format: "uuid" }).check(
+              Schema.isPattern(
+                new RegExp(
+                  "^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$",
+                ),
+              ),
+            ),
+          ),
           use: Schema.optionalKey(Schema.Literal("sig")),
           key_ops: Schema.optionalKey(
             Schema.Array(Schema.Literals(["sign", "verify"]))
@@ -946,7 +1033,11 @@ export const V1CreateProjectSigningKeyInput = Schema.Struct({
   ),
 });
 export const V1CreateProjectSigningKeyOutput = Schema.Struct({
-  id: Schema.String.annotate({ format: "uuid" }),
+  id: Schema.String.annotate({ format: "uuid" }).check(
+    Schema.isPattern(
+      new RegExp("^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$"),
+    ),
+  ),
   algorithm: Schema.Literals(["EdDSA", "ES256", "RS256", "HS256"]),
   status: Schema.Literals(["in_use", "previously_used", "revoked", "standby"]),
   public_jwk: Schema.optionalKey(Schema.Union([Schema.Unknown, Schema.Null])),
@@ -962,7 +1053,11 @@ export const V1CreateProjectTpaIntegrationInput = Schema.Struct({
   custom_jwks: Schema.optionalKey(Schema.Unknown),
 });
 export const V1CreateProjectTpaIntegrationOutput = Schema.Struct({
-  id: Schema.String.annotate({ format: "uuid" }),
+  id: Schema.String.annotate({ format: "uuid" }).check(
+    Schema.isPattern(
+      new RegExp("^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$"),
+    ),
+  ),
   type: Schema.String,
   oidc_issuer_url: Schema.optionalKey(Schema.Union([Schema.String, Schema.Null])),
   jwks_url: Schema.optionalKey(Schema.Union([Schema.String, Schema.Null])),
@@ -992,6 +1087,7 @@ export const V1DeleteHostnameConfigInput = Schema.Struct({
   ref: Schema.String.check(Schema.isMinLength(20))
     .check(Schema.isMaxLength(20))
     .check(Schema.isPattern(new RegExp("^[a-z]+$"))),
+  remove_addon: Schema.optionalKey(Schema.Boolean),
 });
 export const V1DeleteABranchInput = Schema.Struct({
   branch_id_or_ref: Schema.Union(
@@ -1000,7 +1096,13 @@ export const V1DeleteABranchInput = Schema.Struct({
         .check(Schema.isMinLength(20))
         .check(Schema.isMaxLength(20))
         .check(Schema.isPattern(new RegExp("^[a-z]+$"))),
-      Schema.String.annotate({ format: "uuid" }),
+      Schema.String.annotate({ format: "uuid" }).check(
+        Schema.isPattern(
+          new RegExp(
+            "^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$",
+          ),
+        ),
+      ),
     ],
     { mode: "oneOf" },
   ),
@@ -1027,7 +1129,11 @@ export const V1DeleteASsoProviderInput = Schema.Struct({
   ref: Schema.String.check(Schema.isMinLength(20))
     .check(Schema.isMaxLength(20))
     .check(Schema.isPattern(new RegExp("^[a-z]+$"))),
-  provider_id: Schema.String.annotate({ format: "uuid" }),
+  provider_id: Schema.String.annotate({ format: "uuid" }).check(
+    Schema.isPattern(
+      new RegExp("^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$"),
+    ),
+  ),
 });
 export const V1DeleteASsoProviderOutput = Schema.Struct({
   id: Schema.String,
@@ -1044,6 +1150,17 @@ export const V1DeleteASsoProviderOutput = Schema.Struct({
             Schema.Struct({
               name: Schema.optionalKey(Schema.String),
               names: Schema.optionalKey(Schema.Array(Schema.String)),
+              default: Schema.optionalKey(
+                Schema.Union(
+                  [
+                    Schema.Struct({}),
+                    Schema.Number.check(Schema.isFinite()),
+                    Schema.String,
+                    Schema.Boolean,
+                  ],
+                  { mode: "oneOf" },
+                ),
+              ),
               array: Schema.optionalKey(Schema.Boolean),
             }),
           ),
@@ -1076,7 +1193,11 @@ export const V1DeleteJitAccessInput = Schema.Struct({
   ref: Schema.String.check(Schema.isMinLength(20))
     .check(Schema.isMaxLength(20))
     .check(Schema.isPattern(new RegExp("^[a-z]+$"))),
-  user_id: Schema.String.annotate({ format: "uuid" }),
+  user_id: Schema.String.annotate({ format: "uuid" }).check(
+    Schema.isPattern(
+      new RegExp("^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$"),
+    ),
+  ),
 });
 export const V1DeleteLoginRolesInput = Schema.Struct({
   ref: Schema.String.check(Schema.isMinLength(20))
@@ -1102,7 +1223,11 @@ export const V1DeleteProjectApiKeyInput = Schema.Struct({
   ref: Schema.String.check(Schema.isMinLength(20))
     .check(Schema.isMaxLength(20))
     .check(Schema.isPattern(new RegExp("^[a-z]+$"))),
-  id: Schema.String.annotate({ format: "uuid" }),
+  id: Schema.String.annotate({ format: "uuid" }).check(
+    Schema.isPattern(
+      new RegExp("^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$"),
+    ),
+  ),
   reveal: Schema.optionalKey(Schema.Boolean),
   was_compromised: Schema.optionalKey(Schema.Boolean),
   reason: Schema.optionalKey(Schema.String),
@@ -1135,10 +1260,18 @@ export const V1DeleteProjectTpaIntegrationInput = Schema.Struct({
   ref: Schema.String.check(Schema.isMinLength(20))
     .check(Schema.isMaxLength(20))
     .check(Schema.isPattern(new RegExp("^[a-z]+$"))),
-  tpa_id: Schema.String.annotate({ format: "uuid" }),
+  tpa_id: Schema.String.annotate({ format: "uuid" }).check(
+    Schema.isPattern(
+      new RegExp("^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$"),
+    ),
+  ),
 });
 export const V1DeleteProjectTpaIntegrationOutput = Schema.Struct({
-  id: Schema.String.annotate({ format: "uuid" }),
+  id: Schema.String.annotate({ format: "uuid" }).check(
+    Schema.isPattern(
+      new RegExp("^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$"),
+    ),
+  ),
   type: Schema.String,
   oidc_issuer_url: Schema.optionalKey(Schema.Union([Schema.String, Schema.Null])),
   jwks_url: Schema.optionalKey(Schema.Union([Schema.String, Schema.Null])),
@@ -1188,7 +1321,13 @@ export const V1DiffABranchInput = Schema.Struct({
         .check(Schema.isMinLength(20))
         .check(Schema.isMaxLength(20))
         .check(Schema.isPattern(new RegExp("^[a-z]+$"))),
-      Schema.String.annotate({ format: "uuid" }),
+      Schema.String.annotate({ format: "uuid" }).check(
+        Schema.isPattern(
+          new RegExp(
+            "^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$",
+          ),
+        ),
+      ),
     ],
     { mode: "oneOf" },
   ),
@@ -1214,7 +1353,15 @@ export const V1EnableDatabaseWebhookInput = Schema.Struct({
 export const V1ExchangeOauthTokenInput = Schema.Struct({
   body: Schema.Struct({
     grant_type: Schema.optionalKey(Schema.Literals(["authorization_code", "refresh_token"])),
-    client_id: Schema.optionalKey(Schema.String.annotate({ format: "uuid" })),
+    client_id: Schema.optionalKey(
+      Schema.String.annotate({ format: "uuid" }).check(
+        Schema.isPattern(
+          new RegExp(
+            "^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$",
+          ),
+        ),
+      ),
+    ),
     client_secret: Schema.optionalKey(Schema.String),
     code: Schema.optionalKey(Schema.String),
     code_verifier: Schema.optionalKey(Schema.String),
@@ -1249,7 +1396,11 @@ export const V1GetABranchInput = Schema.Struct({
   name: Schema.String,
 });
 export const V1GetABranchOutput = Schema.Struct({
-  id: Schema.String.annotate({ format: "uuid" }),
+  id: Schema.String.annotate({ format: "uuid" }).check(
+    Schema.isPattern(
+      new RegExp("^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$"),
+    ),
+  ),
   name: Schema.String,
   project_ref: Schema.String,
   parent_project_ref: Schema.String,
@@ -1269,7 +1420,9 @@ export const V1GetABranchOutput = Schema.Struct({
     "MIGRATIONS_FAILED",
     "FUNCTIONS_DEPLOYED",
     "FUNCTIONS_FAILED",
-  ]),
+  ]).annotate({
+    description: "This field is deprecated. List action runs to get branch status instead.",
+  }),
   created_at: Schema.String.annotate({ format: "date-time" }),
   updated_at: Schema.String.annotate({ format: "date-time" }),
   review_requested_at: Schema.optionalKey(Schema.String.annotate({ format: "date-time" })),
@@ -1303,7 +1456,13 @@ export const V1GetABranchConfigInput = Schema.Struct({
         .check(Schema.isMinLength(20))
         .check(Schema.isMaxLength(20))
         .check(Schema.isPattern(new RegExp("^[a-z]+$"))),
-      Schema.String.annotate({ format: "uuid" }),
+      Schema.String.annotate({ format: "uuid" }).check(
+        Schema.isPattern(
+          new RegExp(
+            "^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$",
+          ),
+        ),
+      ),
     ],
     { mode: "oneOf" },
   ),
@@ -1377,7 +1536,13 @@ export const V1GetAMigrationOutput = Schema.Struct({
   created_by: Schema.optionalKey(Schema.String),
   idempotency_key: Schema.optionalKey(Schema.String),
 });
-export const V1GetASnippetInput = Schema.Struct({ id: Schema.String.annotate({ format: "uuid" }) });
+export const V1GetASnippetInput = Schema.Struct({
+  id: Schema.String.annotate({ format: "uuid" }).check(
+    Schema.isPattern(
+      new RegExp("^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$"),
+    ),
+  ),
+});
 export const V1GetASnippetOutput = Schema.Struct({
   id: Schema.String,
   inserted_at: Schema.String,
@@ -1407,7 +1572,11 @@ export const V1GetASsoProviderInput = Schema.Struct({
   ref: Schema.String.check(Schema.isMinLength(20))
     .check(Schema.isMaxLength(20))
     .check(Schema.isPattern(new RegExp("^[a-z]+$"))),
-  provider_id: Schema.String.annotate({ format: "uuid" }),
+  provider_id: Schema.String.annotate({ format: "uuid" }).check(
+    Schema.isPattern(
+      new RegExp("^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$"),
+    ),
+  ),
 });
 export const V1GetASsoProviderOutput = Schema.Struct({
   id: Schema.String,
@@ -1424,6 +1593,17 @@ export const V1GetASsoProviderOutput = Schema.Struct({
             Schema.Struct({
               name: Schema.optionalKey(Schema.String),
               names: Schema.optionalKey(Schema.Array(Schema.String)),
+              default: Schema.optionalKey(
+                Schema.Union(
+                  [
+                    Schema.Struct({}),
+                    Schema.Number.check(Schema.isFinite()),
+                    Schema.String,
+                    Schema.Boolean,
+                  ],
+                  { mode: "oneOf" },
+                ),
+              ),
               array: Schema.optionalKey(Schema.Boolean),
             }),
           ),
@@ -1801,6 +1981,10 @@ export const V1GetAuthServiceConfigOutput = Schema.Struct({
   mfa_phone_verify_enabled: Schema.Union([Schema.Boolean, Schema.Null]),
   mfa_web_authn_enroll_enabled: Schema.Union([Schema.Boolean, Schema.Null]),
   mfa_web_authn_verify_enabled: Schema.Union([Schema.Boolean, Schema.Null]),
+  passkey_enabled: Schema.Boolean,
+  webauthn_rp_display_name: Schema.Union([Schema.String, Schema.Null]),
+  webauthn_rp_id: Schema.Union([Schema.String, Schema.Null]),
+  webauthn_rp_origins: Schema.Union([Schema.String, Schema.Null]),
   mfa_phone_otp_length: Schema.Number.check(Schema.isInt()),
   mfa_phone_template: Schema.Union([Schema.String, Schema.Null]),
   mfa_phone_max_frequency: Schema.Union([Schema.Number.check(Schema.isInt()), Schema.Null]),
@@ -1987,6 +2171,20 @@ export const V1GetAvailableRegionsOutput = Schema.Struct({
     ),
   }),
 });
+export const V1GetBackupScheduleInput = Schema.Struct({
+  ref: Schema.String.check(Schema.isMinLength(20))
+    .check(Schema.isMaxLength(20))
+    .check(Schema.isPattern(new RegExp("^[a-z]+$"))),
+});
+export const V1GetBackupScheduleOutput = Schema.Struct({
+  schedule_for: Schema.String.annotate({
+    description: "Time of day to schedule daily backups, in UTC. Format: HH:MM:SS.",
+  }),
+  updated_at: Schema.String.annotate({
+    description: "Timestamp of when the backup schedule was last updated.",
+    format: "date-time",
+  }),
+});
 export const V1GetDatabaseDiskInput = Schema.Struct({
   ref: Schema.String.check(Schema.isMinLength(20))
     .check(Schema.isMaxLength(20))
@@ -2100,7 +2298,11 @@ export const V1GetJitAccessInput = Schema.Struct({
     .check(Schema.isPattern(new RegExp("^[a-z]+$"))),
 });
 export const V1GetJitAccessOutput = Schema.Struct({
-  user_id: Schema.String.annotate({ format: "uuid" }),
+  user_id: Schema.String.annotate({ format: "uuid" }).check(
+    Schema.isPattern(
+      new RegExp("^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$"),
+    ),
+  ),
   user_roles: Schema.Array(
     Schema.Struct({
       role: Schema.String.check(Schema.isMinLength(1)),
@@ -2113,6 +2315,7 @@ export const V1GetJitAccessOutput = Schema.Struct({
           ),
         }),
       ),
+      branches_only: Schema.optionalKey(Schema.Boolean),
     }),
   ),
 });
@@ -2121,30 +2324,34 @@ export const V1GetJitAccessConfigInput = Schema.Struct({
     .check(Schema.isMaxLength(20))
     .check(Schema.isPattern(new RegExp("^[a-z]+$"))),
 });
-export const V1GetJitAccessConfigOutput = Schema.Struct({
-  user_id: Schema.String.annotate({ format: "uuid" }),
-  user_roles: Schema.Array(
+export const V1GetJitAccessConfigOutput = Schema.Union(
+  [
     Schema.Struct({
-      role: Schema.String.check(Schema.isMinLength(1)),
-      expires_at: Schema.optionalKey(Schema.Number.check(Schema.isFinite())),
-      allowed_networks: Schema.optionalKey(
-        Schema.Struct({
-          allowed_cidrs: Schema.optionalKey(Schema.Array(Schema.Struct({ cidr: Schema.String }))),
-          allowed_cidrs_v6: Schema.optionalKey(
-            Schema.Array(Schema.Struct({ cidr: Schema.String })),
-          ),
-        }),
-      ),
+      state: Schema.Literals(["enabled", "disabled"]),
+      appliedSuccessfully: Schema.optionalKey(Schema.Boolean),
     }),
-  ),
-});
+    Schema.Struct({
+      state: Schema.Literal("unavailable"),
+      unavailableReason: Schema.Literals([
+        "manual_migration_required",
+        "postgres_upgrade_required",
+        "temporarily_unavailable",
+      ]),
+    }),
+  ],
+  { mode: "oneOf" },
+);
 export const V1GetLegacySigningKeyInput = Schema.Struct({
   ref: Schema.String.check(Schema.isMinLength(20))
     .check(Schema.isMaxLength(20))
     .check(Schema.isPattern(new RegExp("^[a-z]+$"))),
 });
 export const V1GetLegacySigningKeyOutput = Schema.Struct({
-  id: Schema.String.annotate({ format: "uuid" }),
+  id: Schema.String.annotate({ format: "uuid" }).check(
+    Schema.isPattern(
+      new RegExp("^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$"),
+    ),
+  ),
   algorithm: Schema.Literals(["EdDSA", "ES256", "RS256", "HS256"]),
   status: Schema.Literals(["in_use", "previously_used", "revoked", "standby"]),
   public_jwk: Schema.optionalKey(Schema.Union([Schema.Unknown, Schema.Null])),
@@ -2200,6 +2407,7 @@ export const V1GetOrganizationEntitlementsOutput = Schema.Struct({
           "security.audit_logs_days",
           "security.questionnaire",
           "security.soc2_report",
+          "security.iso27001_certificate",
           "security.private_link",
           "security.enforce_mfa",
           "log.retention_days",
@@ -2208,6 +2416,7 @@ export const V1GetOrganizationEntitlementsOutput = Schema.Struct({
           "ipv4",
           "pitr.available_variants",
           "log_drains",
+          "audit_log_drains",
           "branching_limit",
           "branching_persistent",
           "auth.mfa_phone",
@@ -2222,8 +2431,10 @@ export const V1GetOrganizationEntitlementsOutput = Schema.Struct({
           "auth.advanced_auth_settings",
           "auth.performance_settings",
           "auth.password_hibp",
+          "auth.custom_oauth.max_providers",
           "backup.retention_days",
           "backup.restore_to_new_project",
+          "backup.schedule",
           "function.max_count",
           "function.size_limit_mb",
           "realtime.max_concurrent_users",
@@ -2285,7 +2496,11 @@ export const V1GetOrganizationProjectClaimOutput = Schema.Struct({
   }),
   expires_at: Schema.String,
   created_at: Schema.String,
-  created_by: Schema.String.annotate({ format: "uuid" }),
+  created_by: Schema.String.annotate({ format: "uuid" }).check(
+    Schema.isPattern(
+      new RegExp("^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$"),
+    ),
+  ),
 });
 export const V1GetPerformanceAdvisorsInput = Schema.Struct({
   ref: Schema.String.check(Schema.isMinLength(20))
@@ -2508,10 +2723,17 @@ export const V1GetPostgresUpgradeEligibilityOutput = Schema.Struct({
           type: Schema.Literal("active_replication_slot"),
           slot_name: Schema.String,
         }),
+        Schema.Struct({ type: Schema.Literal("x86_architecture") }),
+        Schema.Struct({ type: Schema.Literal("project_hibernating") }),
       ],
       { mode: "oneOf" },
     ),
   ),
+  warnings: Schema.Array(
+    Schema.Union([Schema.Struct({ type: Schema.Literal("pg_graphql_introspection_change") })], {
+      mode: "oneOf",
+    }),
+  ),
 });
 export const V1GetPostgresUpgradeStatusInput = Schema.Struct({
   ref: Schema.String.check(Schema.isMinLength(20))
@@ -2626,7 +2848,11 @@ export const V1GetProjectApiKeyInput = Schema.Struct({
   ref: Schema.String.check(Schema.isMinLength(20))
     .check(Schema.isMaxLength(20))
     .check(Schema.isPattern(new RegExp("^[a-z]+$"))),
-  id: Schema.String.annotate({ format: "uuid" }),
+  id: Schema.String.annotate({ format: "uuid" }).check(
+    Schema.isPattern(
+      new RegExp("^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$"),
+    ),
+  ),
   reveal: Schema.optionalKey(Schema.Boolean),
 });
 export const V1GetProjectApiKeyOutput = Schema.Struct({
@@ -2664,7 +2890,11 @@ export const V1GetProjectClaimTokenOutput = Schema.Struct({
   token_alias: Schema.String,
   expires_at: Schema.String,
   created_at: Schema.String,
-  created_by: Schema.String.annotate({ format: "uuid" }),
+  created_by: Schema.String.annotate({ format: "uuid" }).check(
+    Schema.isPattern(
+      new RegExp("^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$"),
+    ),
+  ),
 });
 export const V1GetProjectDiskAutoscaleConfigInput = Schema.Struct({
   ref: Schema.String.check(Schema.isMinLength(20))
@@ -2782,13 +3012,21 @@ export const V1GetProjectPgbouncerConfigOutput = Schema.Struct({
   reserve_pool_size: Schema.optionalKey(Schema.Number.check(Schema.isInt())),
 });
 export const V1GetProjectSigningKeyInput = Schema.Struct({
-  id: Schema.String.annotate({ format: "uuid" }),
+  id: Schema.String.annotate({ format: "uuid" }).check(
+    Schema.isPattern(
+      new RegExp("^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$"),
+    ),
+  ),
   ref: Schema.String.check(Schema.isMinLength(20))
     .check(Schema.isMaxLength(20))
     .check(Schema.isPattern(new RegExp("^[a-z]+$"))),
 });
 export const V1GetProjectSigningKeyOutput = Schema.Struct({
-  id: Schema.String.annotate({ format: "uuid" }),
+  id: Schema.String.annotate({ format: "uuid" }).check(
+    Schema.isPattern(
+      new RegExp("^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$"),
+    ),
+  ),
   algorithm: Schema.Literals(["EdDSA", "ES256", "RS256", "HS256"]),
   status: Schema.Literals(["in_use", "previously_used", "revoked", "standby"]),
   public_jwk: Schema.optionalKey(Schema.Union([Schema.Unknown, Schema.Null])),
@@ -2803,7 +3041,13 @@ export const V1GetProjectSigningKeysInput = Schema.Struct({
 export const V1GetProjectSigningKeysOutput = Schema.Struct({
   keys: Schema.Array(
     Schema.Struct({
-      id: Schema.String.annotate({ format: "uuid" }),
+      id: Schema.String.annotate({ format: "uuid" }).check(
+        Schema.isPattern(
+          new RegExp(
+            "^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$",
+          ),
+        ),
+      ),
       algorithm: Schema.Literals(["EdDSA", "ES256", "RS256", "HS256"]),
       status: Schema.Literals(["in_use", "previously_used", "revoked", "standby"]),
       public_jwk: Schema.optionalKey(Schema.Union([Schema.Unknown, Schema.Null])),
@@ -2816,10 +3060,18 @@ export const V1GetProjectTpaIntegrationInput = Schema.Struct({
   ref: Schema.String.check(Schema.isMinLength(20))
     .check(Schema.isMaxLength(20))
     .check(Schema.isPattern(new RegExp("^[a-z]+$"))),
-  tpa_id: Schema.String.annotate({ format: "uuid" }),
+  tpa_id: Schema.String.annotate({ format: "uuid" }).check(
+    Schema.isPattern(
+      new RegExp("^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$"),
+    ),
+  ),
 });
 export const V1GetProjectTpaIntegrationOutput = Schema.Struct({
-  id: Schema.String.annotate({ format: "uuid" }),
+  id: Schema.String.annotate({ format: "uuid" }).check(
+    Schema.isPattern(
+      new RegExp("^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$"),
+    ),
+  ),
   type: Schema.String,
   oidc_issuer_url: Schema.optionalKey(Schema.Union([Schema.String, Schema.Null])),
   jwks_url: Schema.optionalKey(Schema.Union([Schema.String, Schema.Null])),
@@ -3192,6 +3444,7 @@ export const V1ListAllBackupsOutput = Schema.Struct({
   pitr_enabled: Schema.Boolean,
   backups: Schema.Array(
     Schema.Struct({
+      id: Schema.Number.check(Schema.isInt()),
       is_physical_backup: Schema.Boolean,
       status: Schema.Literals([
         "COMPLETED",
@@ -3313,6 +3566,17 @@ export const V1ListAllSsoProviderOutput = Schema.Struct({
                 Schema.Struct({
                   name: Schema.optionalKey(Schema.String),
                   names: Schema.optionalKey(Schema.Array(Schema.String)),
+                  default: Schema.optionalKey(
+                    Schema.Union(
+                      [
+                        Schema.Struct({}),
+                        Schema.Number.check(Schema.isFinite()),
+                        Schema.String,
+                        Schema.Boolean,
+                      ],
+                      { mode: "oneOf" },
+                    ),
+                  ),
                   array: Schema.optionalKey(Schema.Boolean),
                 }),
               ),
@@ -3365,7 +3629,13 @@ export const V1ListJitAccessInput = Schema.Struct({
 export const V1ListJitAccessOutput = Schema.Struct({
   items: Schema.Array(
     Schema.Struct({
-      user_id: Schema.String.annotate({ format: "uuid" }),
+      user_id: Schema.String.annotate({ format: "uuid" }).check(
+        Schema.isPattern(
+          new RegExp(
+            "^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$",
+          ),
+        ),
+      ),
       user_roles: Schema.Array(
         Schema.Struct({
           role: Schema.String.check(Schema.isMinLength(1)),
@@ -3380,6 +3650,7 @@ export const V1ListJitAccessOutput = Schema.Struct({
               ),
             }),
           ),
+          branches_only: Schema.optionalKey(Schema.Boolean),
         }),
       ),
     }),
@@ -3535,7 +3806,13 @@ export const V1MergeABranchInput = Schema.Struct({
         .check(Schema.isMinLength(20))
         .check(Schema.isMaxLength(20))
         .check(Schema.isPattern(new RegExp("^[a-z]+$"))),
-      Schema.String.annotate({ format: "uuid" }),
+      Schema.String.annotate({ format: "uuid" }).check(
+        Schema.isPattern(
+          new RegExp(
+            "^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$",
+          ),
+        ),
+      ),
     ],
     { mode: "oneOf" },
   ),
@@ -3572,7 +3849,11 @@ export const V1OauthAuthorizeProjectClaimInput = Schema.Struct({
   project_ref: Schema.String.check(Schema.isMinLength(20))
     .check(Schema.isMaxLength(20))
     .check(Schema.isPattern(new RegExp("^[a-z]+$"))),
-  client_id: Schema.String.annotate({ format: "uuid" }),
+  client_id: Schema.String.annotate({ format: "uuid" }).check(
+    Schema.isPattern(
+      new RegExp("^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$"),
+    ),
+  ),
   response_type: Schema.Literals(["code", "token", "id_token token"]),
   redirect_uri: Schema.String,
   state: Schema.optionalKey(Schema.String),
@@ -3643,7 +3924,13 @@ export const V1PushABranchInput = Schema.Struct({
         .check(Schema.isMinLength(20))
         .check(Schema.isMaxLength(20))
         .check(Schema.isPattern(new RegExp("^[a-z]+$"))),
-      Schema.String.annotate({ format: "uuid" }),
+      Schema.String.annotate({ format: "uuid" }).check(
+        Schema.isPattern(
+          new RegExp(
+            "^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$",
+          ),
+        ),
+      ),
     ],
     { mode: "oneOf" },
   ),
@@ -3700,13 +3987,21 @@ export const V1RemoveProjectAddonInput = Schema.Struct({
   ),
 });
 export const V1RemoveProjectSigningKeyInput = Schema.Struct({
-  id: Schema.String.annotate({ format: "uuid" }),
+  id: Schema.String.annotate({ format: "uuid" }).check(
+    Schema.isPattern(
+      new RegExp("^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$"),
+    ),
+  ),
   ref: Schema.String.check(Schema.isMinLength(20))
     .check(Schema.isMaxLength(20))
     .check(Schema.isPattern(new RegExp("^[a-z]+$"))),
 });
 export const V1RemoveProjectSigningKeyOutput = Schema.Struct({
-  id: Schema.String.annotate({ format: "uuid" }),
+  id: Schema.String.annotate({ format: "uuid" }).check(
+    Schema.isPattern(
+      new RegExp("^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$"),
+    ),
+  ),
   algorithm: Schema.Literals(["EdDSA", "ES256", "RS256", "HS256"]),
   status: Schema.Literals(["in_use", "previously_used", "revoked", "standby"]),
   public_jwk: Schema.optionalKey(Schema.Union([Schema.Unknown, Schema.Null])),
@@ -3720,7 +4015,13 @@ export const V1ResetABranchInput = Schema.Struct({
         .check(Schema.isMinLength(20))
         .check(Schema.isMaxLength(20))
         .check(Schema.isPattern(new RegExp("^[a-z]+$"))),
-      Schema.String.annotate({ format: "uuid" }),
+      Schema.String.annotate({ format: "uuid" }).check(
+        Schema.isPattern(
+          new RegExp(
+            "^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$",
+          ),
+        ),
+      ),
     ],
     { mode: "oneOf" },
   ),
@@ -3737,7 +4038,13 @@ export const V1RestoreABranchInput = Schema.Struct({
         .check(Schema.isMinLength(20))
         .check(Schema.isMaxLength(20))
         .check(Schema.isPattern(new RegExp("^[a-z]+$"))),
-      Schema.String.annotate({ format: "uuid" }),
+      Schema.String.annotate({ format: "uuid" }).check(
+        Schema.isPattern(
+          new RegExp(
+            "^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$",
+          ),
+        ),
+      ),
     ],
     { mode: "oneOf" },
   ),
@@ -3750,6 +4057,12 @@ export const V1RestoreAProjectInput = Schema.Struct({
     .check(Schema.isMaxLength(20))
     .check(Schema.isPattern(new RegExp("^[a-z]+$"))),
 });
+export const V1RestorePhysicalBackupInput = Schema.Struct({
+  ref: Schema.String.check(Schema.isMinLength(20))
+    .check(Schema.isMaxLength(20))
+    .check(Schema.isPattern(new RegExp("^[a-z]+$"))),
+  id: Schema.Number.check(Schema.isInt()),
+});
 export const V1RestorePitrBackupInput = Schema.Struct({
   ref: Schema.String.check(Schema.isMinLength(20))
     .check(Schema.isMaxLength(20))
@@ -3759,7 +4072,11 @@ export const V1RestorePitrBackupInput = Schema.Struct({
     .check(Schema.isGreaterThanOrEqualTo(0)),
 });
 export const V1RevokeTokenInput = Schema.Struct({
-  client_id: Schema.String.annotate({ format: "uuid" }),
+  client_id: Schema.String.annotate({ format: "uuid" }).check(
+    Schema.isPattern(
+      new RegExp("^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$"),
+    ),
+  ),
   client_secret: Schema.String,
   refresh_token: Schema.String,
 });
@@ -3820,7 +4137,13 @@ export const V1UpdateABranchConfigInput = Schema.Struct({
         .check(Schema.isMinLength(20))
         .check(Schema.isMaxLength(20))
         .check(Schema.isPattern(new RegExp("^[a-z]+$"))),
-      Schema.String.annotate({ format: "uuid" }),
+      Schema.String.annotate({ format: "uuid" }).check(
+        Schema.isPattern(
+          new RegExp(
+            "^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$",
+          ),
+        ),
+      ),
     ],
     { mode: "oneOf" },
   ),
@@ -3852,7 +4175,11 @@ export const V1UpdateABranchConfigInput = Schema.Struct({
   ),
 });
 export const V1UpdateABranchConfigOutput = Schema.Struct({
-  id: Schema.String.annotate({ format: "uuid" }),
+  id: Schema.String.annotate({ format: "uuid" }).check(
+    Schema.isPattern(
+      new RegExp("^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$"),
+    ),
+  ),
   name: Schema.String,
   project_ref: Schema.String,
   parent_project_ref: Schema.String,
@@ -3872,7 +4199,9 @@ export const V1UpdateABranchConfigOutput = Schema.Struct({
     "MIGRATIONS_FAILED",
     "FUNCTIONS_DEPLOYED",
     "FUNCTIONS_FAILED",
-  ]),
+  ]).annotate({
+    description: "This field is deprecated. List action runs to get branch status instead.",
+  }),
   created_at: Schema.String.annotate({ format: "date-time" }),
   updated_at: Schema.String.annotate({ format: "date-time" }),
   review_requested_at: Schema.optionalKey(Schema.String.annotate({ format: "date-time" })),
@@ -3942,7 +4271,11 @@ export const V1UpdateASsoProviderInput = Schema.Struct({
   ref: Schema.String.check(Schema.isMinLength(20))
     .check(Schema.isMaxLength(20))
     .check(Schema.isPattern(new RegExp("^[a-z]+$"))),
-  provider_id: Schema.String.annotate({ format: "uuid" }),
+  provider_id: Schema.String.annotate({ format: "uuid" }).check(
+    Schema.isPattern(
+      new RegExp("^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$"),
+    ),
+  ),
   metadata_xml: Schema.optionalKey(Schema.String),
   metadata_url: Schema.optionalKey(Schema.String),
   domains: Schema.optionalKey(Schema.Array(Schema.String)),
@@ -3953,6 +4286,17 @@ export const V1UpdateASsoProviderInput = Schema.Struct({
         Schema.Struct({
           name: Schema.optionalKey(Schema.String),
           names: Schema.optionalKey(Schema.Array(Schema.String)),
+          default: Schema.optionalKey(
+            Schema.Union(
+              [
+                Schema.Struct({}),
+                Schema.Number.check(Schema.isFinite()),
+                Schema.String,
+                Schema.Boolean,
+              ],
+              { mode: "oneOf" },
+            ),
+          ),
           array: Schema.optionalKey(Schema.Boolean),
         }),
       ),
@@ -3982,6 +4326,17 @@ export const V1UpdateASsoProviderOutput = Schema.Struct({
             Schema.Struct({
               name: Schema.optionalKey(Schema.String),
               names: Schema.optionalKey(Schema.Array(Schema.String)),
+              default: Schema.optionalKey(
+                Schema.Union(
+                  [
+                    Schema.Struct({}),
+                    Schema.Number.check(Schema.isFinite()),
+                    Schema.String,
+                    Schema.Boolean,
+                  ],
+                  { mode: "oneOf" },
+                ),
+              ),
               array: Schema.optionalKey(Schema.Boolean),
             }),
           ),
@@ -4493,6 +4848,10 @@ export const V1UpdateAuthServiceConfigInput = Schema.Struct({
   mfa_totp_verify_enabled: Schema.optionalKey(Schema.Union([Schema.Boolean, Schema.Null])),
   mfa_web_authn_enroll_enabled: Schema.optionalKey(Schema.Union([Schema.Boolean, Schema.Null])),
   mfa_web_authn_verify_enabled: Schema.optionalKey(Schema.Union([Schema.Boolean, Schema.Null])),
+  passkey_enabled: Schema.optionalKey(Schema.Boolean),
+  webauthn_rp_display_name: Schema.optionalKey(Schema.Union([Schema.String, Schema.Null])),
+  webauthn_rp_id: Schema.optionalKey(Schema.Union([Schema.String, Schema.Null])),
+  webauthn_rp_origins: Schema.optionalKey(Schema.Union([Schema.String, Schema.Null])),
   mfa_phone_enroll_enabled: Schema.optionalKey(Schema.Union([Schema.Boolean, Schema.Null])),
   mfa_phone_verify_enabled: Schema.optionalKey(Schema.Union([Schema.Boolean, Schema.Null])),
   mfa_phone_max_frequency: Schema.optionalKey(
@@ -4703,6 +5062,10 @@ export const V1UpdateAuthServiceConfigOutput = Schema.Struct({
   mfa_phone_verify_enabled: Schema.Union([Schema.Boolean, Schema.Null]),
   mfa_web_authn_enroll_enabled: Schema.Union([Schema.Boolean, Schema.Null]),
   mfa_web_authn_verify_enabled: Schema.Union([Schema.Boolean, Schema.Null]),
+  passkey_enabled: Schema.Boolean,
+  webauthn_rp_display_name: Schema.Union([Schema.String, Schema.Null]),
+  webauthn_rp_id: Schema.Union([Schema.String, Schema.Null]),
+  webauthn_rp_origins: Schema.Union([Schema.String, Schema.Null]),
   mfa_phone_otp_length: Schema.Number.check(Schema.isInt()),
   mfa_phone_template: Schema.Union([Schema.String, Schema.Null]),
   mfa_phone_max_frequency: Schema.Union([Schema.Number.check(Schema.isInt()), Schema.Null]),
@@ -4788,6 +5151,23 @@ export const V1UpdateAuthServiceConfigOutput = Schema.Struct({
   custom_oauth_enabled: Schema.Boolean,
   custom_oauth_max_providers: Schema.Number.check(Schema.isInt()),
 });
+export const V1UpdateBackupScheduleInput = Schema.Struct({
+  ref: Schema.String.check(Schema.isMinLength(20))
+    .check(Schema.isMaxLength(20))
+    .check(Schema.isPattern(new RegExp("^[a-z]+$"))),
+  schedule_for: Schema.String.annotate({
+    description: "Time of day to schedule daily backups, in UTC. Format: HH:MM:SS.",
+  }),
+});
+export const V1UpdateBackupScheduleOutput = Schema.Struct({
+  schedule_for: Schema.String.annotate({
+    description: "Time of day to schedule daily backups, in UTC. Format: HH:MM:SS.",
+  }),
+  updated_at: Schema.String.annotate({
+    description: "Timestamp of when the backup schedule was last updated.",
+    format: "date-time",
+  }),
+});
 export const V1UpdateDatabasePasswordInput = Schema.Struct({
   ref: Schema.String.check(Schema.isMinLength(20))
     .check(Schema.isMaxLength(20))
@@ -4841,7 +5221,13 @@ export const V1UpdateJitAccessInput = Schema.Struct({
   ref: Schema.String.check(Schema.isMinLength(20))
     .check(Schema.isMaxLength(20))
     .check(Schema.isPattern(new RegExp("^[a-z]+$"))),
-  user_id: Schema.String.annotate({ format: "uuid" }).check(Schema.isMinLength(1)),
+  user_id: Schema.String.annotate({ format: "uuid" })
+    .check(Schema.isMinLength(1))
+    .check(
+      Schema.isPattern(
+        new RegExp("^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$"),
+      ),
+    ),
   roles: Schema.Array(
     Schema.Struct({
       role: Schema.String.check(Schema.isMinLength(1)),
@@ -4854,11 +5240,16 @@ export const V1UpdateJitAccessInput = Schema.Struct({
           ),
         }),
       ),
+      branches_only: Schema.optionalKey(Schema.Boolean),
     }),
   ),
 });
 export const V1UpdateJitAccessOutput = Schema.Struct({
-  user_id: Schema.String.annotate({ format: "uuid" }),
+  user_id: Schema.String.annotate({ format: "uuid" }).check(
+    Schema.isPattern(
+      new RegExp("^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$"),
+    ),
+  ),
   user_roles: Schema.Array(
     Schema.Struct({
       role: Schema.String.check(Schema.isMinLength(1)),
@@ -4871,6 +5262,7 @@ export const V1UpdateJitAccessOutput = Schema.Struct({
           ),
         }),
       ),
+      branches_only: Schema.optionalKey(Schema.Boolean),
     }),
   ),
 });
@@ -4878,25 +5270,25 @@ export const V1UpdateJitAccessConfigInput = Schema.Struct({
   ref: Schema.String.check(Schema.isMinLength(20))
     .check(Schema.isMaxLength(20))
     .check(Schema.isPattern(new RegExp("^[a-z]+$"))),
-  state: Schema.Literals(["enabled", "disabled", "unavailable"]),
+  state: Schema.Literals(["enabled", "disabled"]),
 });
-export const V1UpdateJitAccessConfigOutput = Schema.Struct({
-  user_id: Schema.String.annotate({ format: "uuid" }),
-  user_roles: Schema.Array(
+export const V1UpdateJitAccessConfigOutput = Schema.Union(
+  [
     Schema.Struct({
-      role: Schema.String.check(Schema.isMinLength(1)),
-      expires_at: Schema.optionalKey(Schema.Number.check(Schema.isFinite())),
-      allowed_networks: Schema.optionalKey(
-        Schema.Struct({
-          allowed_cidrs: Schema.optionalKey(Schema.Array(Schema.Struct({ cidr: Schema.String }))),
-          allowed_cidrs_v6: Schema.optionalKey(
-            Schema.Array(Schema.Struct({ cidr: Schema.String })),
-          ),
-        }),
-      ),
+      state: Schema.Literals(["enabled", "disabled"]),
+      appliedSuccessfully: Schema.optionalKey(Schema.Boolean),
     }),
-  ),
-});
+    Schema.Struct({
+      state: Schema.Literal("unavailable"),
+      unavailableReason: Schema.Literals([
+        "manual_migration_required",
+        "postgres_upgrade_required",
+        "temporarily_unavailable",
+      ]),
+    }),
+  ],
+  { mode: "oneOf" },
+);
 export const V1UpdateNetworkRestrictionsInput = Schema.Struct({
   ref: Schema.String.check(Schema.isMinLength(20))
     .check(Schema.isMaxLength(20))
@@ -5114,7 +5506,11 @@ export const V1UpdateProjectApiKeyInput = Schema.Struct({
   ref: Schema.String.check(Schema.isMinLength(20))
     .check(Schema.isMaxLength(20))
     .check(Schema.isPattern(new RegExp("^[a-z]+$"))),
-  id: Schema.String.annotate({ format: "uuid" }),
+  id: Schema.String.annotate({ format: "uuid" }).check(
+    Schema.isPattern(
+      new RegExp("^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$"),
+    ),
+  ),
   reveal: Schema.optionalKey(Schema.Boolean),
   name: Schema.optionalKey(
     Schema.String.check(Schema.isMinLength(4))
@@ -5153,14 +5549,22 @@ export const V1UpdateProjectLegacyApiKeysInput = Schema.Struct({
 });
 export const V1UpdateProjectLegacyApiKeysOutput = Schema.Struct({ enabled: Schema.Boolean });
 export const V1UpdateProjectSigningKeyInput = Schema.Struct({
-  id: Schema.String.annotate({ format: "uuid" }),
+  id: Schema.String.annotate({ format: "uuid" }).check(
+    Schema.isPattern(
+      new RegExp("^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$"),
+    ),
+  ),
   ref: Schema.String.check(Schema.isMinLength(20))
     .check(Schema.isMaxLength(20))
     .check(Schema.isPattern(new RegExp("^[a-z]+$"))),
   status: Schema.Literals(["in_use", "previously_used", "revoked", "standby"]),
 });
 export const V1UpdateProjectSigningKeyOutput = Schema.Struct({
-  id: Schema.String.annotate({ format: "uuid" }),
+  id: Schema.String.annotate({ format: "uuid" }).check(
+    Schema.isPattern(
+      new RegExp("^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$"),
+    ),
+  ),
   algorithm: Schema.Literals(["EdDSA", "ES256", "RS256", "HS256"]),
   status: Schema.Literals(["in_use", "previously_used", "revoked", "standby"]),
   public_jwk: Schema.optionalKey(Schema.Union([Schema.Unknown, Schema.Null])),
@@ -5370,6 +5774,7 @@ export const V1ReadOnlyQueryOutput = Schema.Void;
 export const V1RemoveAReadReplicaOutput = Schema.Void;
 export const V1RemoveProjectAddonOutput = Schema.Void;
 export const V1RestoreAProjectOutput = Schema.Void;
+export const V1RestorePhysicalBackupOutput = Schema.Void;
 export const V1RestorePitrBackupOutput = Schema.Void;
 export const V1RevokeTokenOutput = Schema.Void;
 export const V1RollbackMigrationsOutput = Schema.Void;
@@ -5439,6 +5844,7 @@ export const openApiOperationIdMap = {
   "v1-get-an-organization": "v1GetAnOrganization",
   "v1-get-auth-service-config": "v1GetAuthServiceConfig",
   "v1-get-available-regions": "v1GetAvailableRegions",
+  "v1-get-backup-schedule": "v1GetBackupSchedule",
   "v1-get-database-disk": "v1GetDatabaseDisk",
   "v1-get-database-metadata": "v1GetDatabaseMetadata",
   "v1-get-database-openapi": "v1GetDatabaseOpenapi",
@@ -5512,6 +5918,7 @@ export const openApiOperationIdMap = {
   "v1-reset-a-branch": "v1ResetABranch",
   "v1-restore-a-branch": "v1RestoreABranch",
   "v1-restore-a-project": "v1RestoreAProject",
+  "v1-restore-physical-backup": "v1RestorePhysicalBackup",
   "v1-restore-pitr-backup": "v1RestorePitrBackup",
   "v1-revoke-token": "v1RevokeToken",
   "v1-rollback-migrations": "v1RollbackMigrations",
@@ -5525,6 +5932,7 @@ export const openApiOperationIdMap = {
   "v1-update-a-sso-provider": "v1UpdateASsoProvider",
   "v1-update-action-run-status": "v1UpdateActionRunStatus",
   "v1-update-auth-service-config": "v1UpdateAuthServiceConfig",
+  "v1-update-backup-schedule": "v1UpdateBackupSchedule",
   "v1-update-database-password": "v1UpdateDatabasePassword",
   "v1-update-hostname-config": "v1UpdateHostnameConfig",
   "v1-update-jit-access": "v1UpdateJitAccess",
@@ -5975,7 +6383,7 @@ export const operationDefinitions = {
     method: "DELETE",
     path: "/v1/projects/{ref}/custom-hostname",
     pathParams: ["ref"],
-    queryParams: [],
+    queryParams: ["remove_addon"],
     headerParams: [],
     requestBody: { kind: "none" },
     response: { kind: "void" },
@@ -6378,6 +6786,19 @@ export const operationDefinitions = {
     inputSchema: V1GetAvailableRegionsInput,
     outputSchema: V1GetAvailableRegionsOutput,
   },
+  v1GetBackupSchedule: {
+    id: "v1GetBackupSchedule",
+    description: "Gets the backup schedule for a project",
+    method: "GET",
+    path: "/v1/projects/{ref}/database/backups/schedule",
+    pathParams: ["ref"],
+    queryParams: [],
+    headerParams: [],
+    requestBody: { kind: "none" },
+    response: { kind: "json" },
+    inputSchema: V1GetBackupScheduleInput,
+    outputSchema: V1GetBackupScheduleOutput,
+  },
   v1GetDatabaseDisk: {
     id: "v1GetDatabaseDisk",
     description: "Get database disk attributes",
@@ -6460,7 +6881,7 @@ export const operationDefinitions = {
   },
   v1GetJitAccessConfig: {
     id: "v1GetJitAccessConfig",
-    description: "[Beta] Get project's just-in-time access configuration.",
+    description: "[Beta] Get project's temporary access configuration.",
     method: "GET",
     path: "/v1/projects/{ref}/jit-access",
     pathParams: ["ref"],
@@ -7026,8 +7447,7 @@ export const operationDefinitions = {
   },
   v1ListAllProjects: {
     id: "v1ListAllProjects",
-    description:
-      "Returns a list of all projects you've previously created.\n\nUse `/v1/organizations/{slug}/projects` instead when possible to get more precise results and pagination support.",
+    description: "Returns a list of all projects you've previously created.",
     method: "GET",
     path: "/v1/projects",
     pathParams: [],
@@ -7350,6 +7770,19 @@ export const operationDefinitions = {
     inputSchema: V1RestoreAProjectInput,
     outputSchema: V1RestoreAProjectOutput,
   },
+  v1RestorePhysicalBackup: {
+    id: "v1RestorePhysicalBackup",
+    description: "Restores a physical backup for a database",
+    method: "POST",
+    path: "/v1/projects/{ref}/database/backups/restore",
+    pathParams: ["ref"],
+    queryParams: [],
+    headerParams: [],
+    requestBody: { kind: "json", contentType: "application/json", fields: ["id"] },
+    response: { kind: "void" },
+    inputSchema: V1RestorePhysicalBackupInput,
+    outputSchema: V1RestorePhysicalBackupOutput,
+  },
   v1RestorePitrBackup: {
     id: "v1RestorePitrBackup",
     description: "Restores a PITR backup for a database",
@@ -7777,6 +8210,10 @@ export const operationDefinitions = {
         "mfa_totp_verify_enabled",
         "mfa_web_authn_enroll_enabled",
         "mfa_web_authn_verify_enabled",
+        "passkey_enabled",
+        "webauthn_rp_display_name",
+        "webauthn_rp_id",
+        "webauthn_rp_origins",
         "mfa_phone_enroll_enabled",
         "mfa_phone_verify_enabled",
         "mfa_phone_max_frequency",
@@ -7794,6 +8231,20 @@ export const operationDefinitions = {
     inputSchema: V1UpdateAuthServiceConfigInput,
     outputSchema: V1UpdateAuthServiceConfigOutput,
   },
+  v1UpdateBackupSchedule: {
+    id: "v1UpdateBackupSchedule",
+    description:
+      "Sets the time at which the daily backup runs. The change takes effect on the next backup window that includes the new time. If the new time has already passed for today, the first backup at the new time will occur the following day. It can only be updated 3 times per 24 hours.",
+    method: "PATCH",
+    path: "/v1/projects/{ref}/database/backups/schedule",
+    pathParams: ["ref"],
+    queryParams: [],
+    headerParams: [],
+    requestBody: { kind: "json", contentType: "application/json", fields: ["schedule_for"] },
+    response: { kind: "json" },
+    inputSchema: V1UpdateBackupScheduleInput,
+    outputSchema: V1UpdateBackupScheduleOutput,
+  },
   v1UpdateDatabasePassword: {
     id: "v1UpdateDatabasePassword",
     description: "Updates the database password",
@@ -7835,7 +8286,7 @@ export const operationDefinitions = {
   },
   v1UpdateJitAccessConfig: {
     id: "v1UpdateJitAccessConfig",
-    description: "[Beta] Update project's just-in-time access configuration.",
+    description: "[Beta] Update project's temporary access configuration.",
     method: "PUT",
     path: "/v1/projects/{ref}/jit-access",
     pathParams: ["ref"],
diff --git a/packages/api/src/generated/effect-client.ts b/packages/api/src/generated/effect-client.ts
index ae7e498356..4c2fe4600d 100644
--- a/packages/api/src/generated/effect-client.ts
+++ b/packages/api/src/generated/effect-client.ts
@@ -790,6 +790,20 @@ export const versionedEffectOperations = {
           input,
         );
       }),
+    getBackupSchedule: (
+      input: typeof operationDefinitions.v1GetBackupSchedule.inputSchema.Type,
+    ): Effect.Effect<
+      typeof operationDefinitions.v1GetBackupSchedule.outputSchema.Type,
+      SupabaseApiError,
+      SupabaseApiClient
+    > =>
+      Effect.gen(function* () {
+        const client = yield* SupabaseApiClient;
+        return yield* client.execute<"v1GetBackupSchedule">(
+          operationDefinitions.v1GetBackupSchedule,
+          input,
+        );
+      }),
     getDatabaseDisk: (
       input: typeof operationDefinitions.v1GetDatabaseDisk.inputSchema.Type,
     ): Effect.Effect<
@@ -1788,6 +1802,20 @@ export const versionedEffectOperations = {
           input,
         );
       }),
+    restorePhysicalBackup: (
+      input: typeof operationDefinitions.v1RestorePhysicalBackup.inputSchema.Type,
+    ): Effect.Effect<
+      typeof operationDefinitions.v1RestorePhysicalBackup.outputSchema.Type,
+      SupabaseApiError,
+      SupabaseApiClient
+    > =>
+      Effect.gen(function* () {
+        const client = yield* SupabaseApiClient;
+        return yield* client.execute<"v1RestorePhysicalBackup">(
+          operationDefinitions.v1RestorePhysicalBackup,
+          input,
+        );
+      }),
     restorePitrBackup: (
       input: typeof operationDefinitions.v1RestorePitrBackup.inputSchema.Type,
     ): Effect.Effect<
@@ -1961,6 +1989,20 @@ export const versionedEffectOperations = {
           input,
         );
       }),
+    updateBackupSchedule: (
+      input: typeof operationDefinitions.v1UpdateBackupSchedule.inputSchema.Type,
+    ): Effect.Effect<
+      typeof operationDefinitions.v1UpdateBackupSchedule.outputSchema.Type,
+      SupabaseApiError,
+      SupabaseApiClient
+    > =>
+      Effect.gen(function* () {
+        const client = yield* SupabaseApiClient;
+        return yield* client.execute<"v1UpdateBackupSchedule">(
+          operationDefinitions.v1UpdateBackupSchedule,
+          input,
+        );
+      }),
     updateDatabasePassword: (
       input: typeof operationDefinitions.v1UpdateDatabasePassword.inputSchema.Type,
     ): Effect.Effect<
@@ -2453,6 +2495,10 @@ export function executeApiClientOperation(
       return Schema.decodeUnknownEffect(operationDefinitions.v1GetAvailableRegions.inputSchema)(
         input,
       ).pipe(Effect.flatMap((decoded) => api.v1.getAvailableRegions(decoded)));
+    case "v1GetBackupSchedule":
+      return Schema.decodeUnknownEffect(operationDefinitions.v1GetBackupSchedule.inputSchema)(
+        input,
+      ).pipe(Effect.flatMap((decoded) => api.v1.getBackupSchedule(decoded)));
     case "v1GetDatabaseDisk":
       return Schema.decodeUnknownEffect(operationDefinitions.v1GetDatabaseDisk.inputSchema)(
         input,
@@ -2745,6 +2791,10 @@ export function executeApiClientOperation(
       return Schema.decodeUnknownEffect(operationDefinitions.v1RestoreAProject.inputSchema)(
         input,
       ).pipe(Effect.flatMap((decoded) => api.v1.restoreAProject(decoded)));
+    case "v1RestorePhysicalBackup":
+      return Schema.decodeUnknownEffect(operationDefinitions.v1RestorePhysicalBackup.inputSchema)(
+        input,
+      ).pipe(Effect.flatMap((decoded) => api.v1.restorePhysicalBackup(decoded)));
     case "v1RestorePitrBackup":
       return Schema.decodeUnknownEffect(operationDefinitions.v1RestorePitrBackup.inputSchema)(
         input,
@@ -2797,6 +2847,10 @@ export function executeApiClientOperation(
       return Schema.decodeUnknownEffect(operationDefinitions.v1UpdateAuthServiceConfig.inputSchema)(
         input,
       ).pipe(Effect.flatMap((decoded) => api.v1.updateAuthServiceConfig(decoded)));
+    case "v1UpdateBackupSchedule":
+      return Schema.decodeUnknownEffect(operationDefinitions.v1UpdateBackupSchedule.inputSchema)(
+        input,
+      ).pipe(Effect.flatMap((decoded) => api.v1.updateBackupSchedule(decoded)));
     case "v1UpdateDatabasePassword":
       return Schema.decodeUnknownEffect(operationDefinitions.v1UpdateDatabasePassword.inputSchema)(
         input,
diff --git a/packages/api/src/generated/openapi.json b/packages/api/src/generated/openapi.json
index ef0825e9d8..9ddc8fced0 100644
--- a/packages/api/src/generated/openapi.json
+++ b/packages/api/src/generated/openapi.json
@@ -617,7 +617,7 @@
     },
     "/v1/projects": {
       "get": {
-        "description": "Returns a list of all projects you've previously created.\n\nUse `/v1/organizations/{slug}/projects` instead when possible to get more precise results and pagination support.",
+        "description": "Returns a list of all projects you've previously created.",
         "operationId": "v1-list-all-projects",
         "parameters": [],
         "responses": {
@@ -633,6 +633,15 @@
                 }
               }
             }
+          },
+          "401": {
+            "description": "Unauthorized"
+          },
+          "403": {
+            "description": "Forbidden action"
+          },
+          "429": {
+            "description": "Rate limit exceeded"
           }
         },
         "security": [
@@ -677,6 +686,15 @@
                 }
               }
             }
+          },
+          "401": {
+            "description": "Unauthorized"
+          },
+          "403": {
+            "description": "Forbidden action"
+          },
+          "429": {
+            "description": "Rate limit exceeded"
           }
         },
         "security": [
@@ -803,6 +821,15 @@
               }
             }
           },
+          "401": {
+            "description": "Unauthorized"
+          },
+          "403": {
+            "description": "Forbidden action"
+          },
+          "429": {
+            "description": "Rate limit exceeded"
+          },
           "500": {
             "description": "Unexpected error listing organizations"
           }
@@ -850,6 +877,15 @@
               }
             }
           },
+          "401": {
+            "description": "Unauthorized"
+          },
+          "403": {
+            "description": "Forbidden action"
+          },
+          "429": {
+            "description": "Rate limit exceeded"
+          },
           "500": {
             "description": "Unexpected error creating an organization"
           }
@@ -1136,6 +1172,15 @@
         "responses": {
           "204": {
             "description": ""
+          },
+          "401": {
+            "description": "Unauthorized"
+          },
+          "403": {
+            "description": "Forbidden action"
+          },
+          "429": {
+            "description": "Rate limit exceeded"
           }
         },
         "security": [
@@ -1216,6 +1261,15 @@
               }
             }
           },
+          "401": {
+            "description": "Unauthorized"
+          },
+          "403": {
+            "description": "Forbidden action"
+          },
+          "429": {
+            "description": "Rate limit exceeded"
+          },
           "500": {
             "description": "Failed to list user's SQL snippets"
           }
@@ -1266,6 +1320,15 @@
               }
             }
           },
+          "401": {
+            "description": "Unauthorized"
+          },
+          "403": {
+            "description": "Forbidden action"
+          },
+          "429": {
+            "description": "Rate limit exceeded"
+          },
           "500": {
             "description": "Failed to retrieve SQL snippet"
           }
@@ -2261,15 +2324,6 @@
               }
             }
           },
-          "401": {
-            "description": "Unauthorized"
-          },
-          "403": {
-            "description": "Forbidden action"
-          },
-          "429": {
-            "description": "Rate limit exceeded"
-          },
           "500": {
             "description": "Failed to retrieve database branches"
           }
@@ -2335,15 +2389,6 @@
               }
             }
           },
-          "401": {
-            "description": "Unauthorized"
-          },
-          "403": {
-            "description": "Forbidden action"
-          },
-          "429": {
-            "description": "Rate limit exceeded"
-          },
           "500": {
             "description": "Failed to create database branch"
           }
@@ -2464,15 +2509,6 @@
               }
             }
           },
-          "401": {
-            "description": "Unauthorized"
-          },
-          "403": {
-            "description": "Forbidden action"
-          },
-          "429": {
-            "description": "Rate limit exceeded"
-          },
           "500": {
             "description": "Failed to fetch database branch"
           }
@@ -2576,6 +2612,16 @@
               "example": "abcdefghijklmnopqrst",
               "type": "string"
             }
+          },
+          {
+            "name": "remove_addon",
+            "required": false,
+            "in": "query",
+            "description": "If true, also removes the custom domain add-on from the project subscription.",
+            "schema": {
+              "default": "false",
+              "type": "boolean"
+            }
           }
         ],
         "responses": {
@@ -2835,7 +2881,7 @@
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/JitAccessResponse"
+                  "$ref": "#/components/schemas/JitStateResponse"
                 }
               }
             }
@@ -2850,7 +2896,7 @@
             "description": "Rate limit exceeded"
           },
           "500": {
-            "description": "Failed to retrieve project's JIT access config"
+            "description": "Failed to retrieve project's temporary access configuration."
           }
         },
         "security": [
@@ -2861,7 +2907,7 @@
             "fga_permissions": ["project_admin_read"]
           }
         ],
-        "summary": "[Beta] Get project's just-in-time access configuration.",
+        "summary": "[Beta] Get project's temporary access configuration.",
         "tags": ["Database"],
         "x-badges": [
           {
@@ -2905,7 +2951,7 @@
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/JitAccessResponse"
+                  "$ref": "#/components/schemas/JitStateResponse"
                 }
               }
             }
@@ -2920,7 +2966,7 @@
             "description": "Rate limit exceeded"
           },
           "500": {
-            "description": "Failed to update project's just-in-time access configuration."
+            "description": "Failed to update project's temporary access configuration."
           }
         },
         "security": [
@@ -2931,7 +2977,7 @@
             "fga_permissions": ["project_admin_write"]
           }
         ],
-        "summary": "[Beta] Update project's just-in-time access configuration.",
+        "summary": "[Beta] Update project's temporary access configuration.",
         "tags": ["Database"],
         "x-badges": [
           {
@@ -10316,9 +10362,9 @@
         "x-oauth-scope": "database:read"
       }
     },
-    "/v1/projects/{ref}/database/backups/undo": {
+    "/v1/projects/{ref}/database/backups/restore": {
       "post": {
-        "operationId": "v1-undo",
+        "operationId": "v1-restore-physical-backup",
         "parameters": [
           {
             "name": "ref",
@@ -10339,7 +10385,7 @@
           "content": {
             "application/json": {
               "schema": {
-                "$ref": "#/components/schemas/V1UndoBody"
+                "$ref": "#/components/schemas/V1RestoreBackupBody"
               }
             }
           }
@@ -10366,7 +10412,7 @@
             "fga_permissions": ["backups_write"]
           }
         ],
-        "summary": "Initiates an undo to a given restore point",
+        "summary": "Restores a physical backup for a database",
         "tags": ["Database"],
         "x-badges": [
           {
@@ -10379,19 +10425,20 @@
         "x-oauth-scope": "database:write"
       }
     },
-    "/v1/organizations/{slug}/entitlements": {
+    "/v1/projects/{ref}/database/backups/schedule": {
       "get": {
-        "description": "Returns the entitlements available to the organization based on their plan and any overrides.",
-        "operationId": "v1-get-organization-entitlements",
+        "operationId": "v1-get-backup-schedule",
         "parameters": [
           {
-            "name": "slug",
+            "name": "ref",
             "required": true,
             "in": "path",
-            "description": "Organization slug",
+            "description": "Project ref",
             "schema": {
-              "pattern": "^[\\w-]+$",
-              "example": "tsrqponmlkjihgfedcba",
+              "minLength": 20,
+              "maxLength": 20,
+              "pattern": "^[a-z]+$",
+              "example": "abcdefghijklmnopqrst",
               "type": "string"
             }
           }
@@ -10402,7 +10449,7 @@
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/V1ListEntitlementsResponse"
+                  "$ref": "#/components/schemas/V1BackupScheduleResponse"
                 }
               }
             }
@@ -10410,11 +10457,20 @@
           "401": {
             "description": "Unauthorized"
           },
+          "402": {
+            "description": "Feature requires a higher plan"
+          },
           "403": {
             "description": "Forbidden action"
           },
+          "404": {
+            "description": "Project or backup schedule not found"
+          },
           "429": {
             "description": "Rate limit exceeded"
+          },
+          "500": {
+            "description": "Failed to retrieve backup schedule"
           }
         },
         "security": [
@@ -10422,50 +10478,79 @@
             "bearer": []
           },
           {
-            "fga_permissions": ["organization_projects_read"]
+            "fga_permissions": ["backups_read"]
           }
         ],
-        "summary": "Get entitlements for an organization",
-        "tags": ["Organizations"],
+        "summary": "Gets the backup schedule for a project",
+        "tags": ["Database"],
         "x-badges": [
           {
-            "name": "OAuth scope: organizations:read",
+            "name": "OAuth scope: database:read",
             "position": "after"
           }
         ],
-        "x-endpoint-owners": ["billing"],
-        "x-oauth-scope": "organizations:read"
-      }
-    },
-    "/v1/organizations/{slug}/members": {
-      "get": {
-        "operationId": "v1-list-organization-members",
+        "x-endpoint-owners": ["infra"],
+        "x-oauth-scope": "database:read"
+      },
+      "patch": {
+        "description": "Sets the time at which the daily backup runs. The change takes effect on the next backup window that includes the new time. If the new time has already passed for today, the first backup at the new time will occur the following day. It can only be updated 3 times per 24 hours.",
+        "operationId": "v1-update-backup-schedule",
         "parameters": [
           {
-            "name": "slug",
+            "name": "ref",
             "required": true,
             "in": "path",
-            "description": "Organization slug",
+            "description": "Project ref",
             "schema": {
-              "pattern": "^[\\w-]+$",
-              "example": "tsrqponmlkjihgfedcba",
+              "minLength": 20,
+              "maxLength": 20,
+              "pattern": "^[a-z]+$",
+              "example": "abcdefghijklmnopqrst",
               "type": "string"
             }
           }
         ],
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/V1UpdateBackupScheduleBody"
+              }
+            }
+          }
+        },
         "responses": {
           "200": {
             "description": "",
             "content": {
               "application/json": {
                 "schema": {
-                  "type": "array",
-                  "items": {
-                    "$ref": "#/components/schemas/V1OrganizationMemberResponse"
-                  }
+                  "$ref": "#/components/schemas/V1BackupScheduleResponse"
                 }
               }
             }
+          },
+          "400": {
+            "description": "Invalid schedule_for format"
+          },
+          "401": {
+            "description": "Unauthorized"
+          },
+          "402": {
+            "description": "Feature requires a higher plan"
+          },
+          "403": {
+            "description": "Forbidden action"
+          },
+          "404": {
+            "description": "Project or backup schedule not found"
+          },
+          "429": {
+            "description": "Rate limit exceeded"
+          },
+          "500": {
+            "description": "Failed to update backup schedule"
           }
         },
         "security": [
@@ -10473,47 +10558,52 @@
             "bearer": []
           },
           {
-            "fga_permissions": ["members_read"]
+            "fga_permissions": ["backups_write"]
           }
         ],
-        "summary": "List members of an organization",
-        "tags": ["Organizations"],
+        "summary": "Updates the backup schedule time for a project",
+        "tags": ["Database"],
         "x-badges": [
           {
-            "name": "OAuth scope: organizations:read",
+            "name": "OAuth scope: database:write",
             "position": "after"
           }
         ],
-        "x-endpoint-owners": ["management-api"],
-        "x-oauth-scope": "organizations:read"
+        "x-endpoint-owners": ["infra"],
+        "x-oauth-scope": "database:write"
       }
     },
-    "/v1/organizations/{slug}": {
-      "get": {
-        "operationId": "v1-get-an-organization",
+    "/v1/projects/{ref}/database/backups/undo": {
+      "post": {
+        "operationId": "v1-undo",
         "parameters": [
           {
-            "name": "slug",
+            "name": "ref",
             "required": true,
             "in": "path",
-            "description": "Organization slug",
+            "description": "Project ref",
             "schema": {
-              "pattern": "^[\\w-]+$",
-              "example": "tsrqponmlkjihgfedcba",
+              "minLength": 20,
+              "maxLength": 20,
+              "pattern": "^[a-z]+$",
+              "example": "abcdefghijklmnopqrst",
               "type": "string"
             }
           }
         ],
-        "responses": {
-          "200": {
-            "description": "",
-            "content": {
-              "application/json": {
-                "schema": {
-                  "$ref": "#/components/schemas/V1OrganizationSlugResponse"
-                }
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/V1UndoBody"
               }
             }
+          }
+        },
+        "responses": {
+          "201": {
+            "description": ""
           },
           "401": {
             "description": "Unauthorized"
@@ -10530,24 +10620,26 @@
             "bearer": []
           },
           {
-            "fga_permissions": ["organization_admin_read"]
+            "fga_permissions": ["backups_write"]
           }
         ],
-        "summary": "Gets information about the organization",
-        "tags": ["Organizations"],
+        "summary": "Initiates an undo to a given restore point",
+        "tags": ["Database"],
         "x-badges": [
           {
-            "name": "OAuth scope: organizations:read",
+            "name": "OAuth scope: database:write",
             "position": "after"
           }
         ],
-        "x-endpoint-owners": ["management-api"],
-        "x-oauth-scope": "organizations:read"
+        "x-endpoint-owners": ["infra"],
+        "x-internal": true,
+        "x-oauth-scope": "database:write"
       }
     },
-    "/v1/organizations/{slug}/project-claim/{token}": {
+    "/v1/organizations/{slug}/entitlements": {
       "get": {
-        "operationId": "v1-get-organization-project-claim",
+        "description": "Returns the entitlements available to the organization based on their plan and any overrides.",
+        "operationId": "v1-get-organization-entitlements",
         "parameters": [
           {
             "name": "slug",
@@ -10559,15 +10651,6 @@
               "example": "tsrqponmlkjihgfedcba",
               "type": "string"
             }
-          },
-          {
-            "name": "token",
-            "required": true,
-            "in": "path",
-            "schema": {
-              "example": "0123456789abcdef0123456789abcdef01234567",
-              "type": "string"
-            }
           }
         ],
         "responses": {
@@ -10576,7 +10659,7 @@
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/OrganizationProjectClaimResponse"
+                  "$ref": "#/components/schemas/V1ListEntitlementsResponse"
                 }
               }
             }
@@ -10596,7 +10679,181 @@
             "bearer": []
           },
           {
-            "fga_permissions": ["organization_admin_write"]
+            "fga_permissions": ["organization_admin_read"]
+          }
+        ],
+        "summary": "Get entitlements for an organization",
+        "tags": ["Organizations"],
+        "x-badges": [
+          {
+            "name": "OAuth scope: organizations:read",
+            "position": "after"
+          }
+        ],
+        "x-endpoint-owners": ["billing"],
+        "x-oauth-scope": "organizations:read"
+      }
+    },
+    "/v1/organizations/{slug}/members": {
+      "get": {
+        "operationId": "v1-list-organization-members",
+        "parameters": [
+          {
+            "name": "slug",
+            "required": true,
+            "in": "path",
+            "description": "Organization slug",
+            "schema": {
+              "pattern": "^[\\w-]+$",
+              "example": "tsrqponmlkjihgfedcba",
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "array",
+                  "items": {
+                    "$ref": "#/components/schemas/V1OrganizationMemberResponse"
+                  }
+                }
+              }
+            }
+          }
+        },
+        "security": [
+          {
+            "bearer": []
+          },
+          {
+            "fga_permissions": ["members_read"]
+          }
+        ],
+        "summary": "List members of an organization",
+        "tags": ["Organizations"],
+        "x-badges": [
+          {
+            "name": "OAuth scope: organizations:read",
+            "position": "after"
+          }
+        ],
+        "x-endpoint-owners": ["management-api"],
+        "x-oauth-scope": "organizations:read"
+      }
+    },
+    "/v1/organizations/{slug}": {
+      "get": {
+        "operationId": "v1-get-an-organization",
+        "parameters": [
+          {
+            "name": "slug",
+            "required": true,
+            "in": "path",
+            "description": "Organization slug",
+            "schema": {
+              "pattern": "^[\\w-]+$",
+              "example": "tsrqponmlkjihgfedcba",
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/V1OrganizationSlugResponse"
+                }
+              }
+            }
+          },
+          "401": {
+            "description": "Unauthorized"
+          },
+          "403": {
+            "description": "Forbidden action"
+          },
+          "429": {
+            "description": "Rate limit exceeded"
+          }
+        },
+        "security": [
+          {
+            "bearer": []
+          },
+          {
+            "fga_permissions": ["organization_admin_read"]
+          }
+        ],
+        "summary": "Gets information about the organization",
+        "tags": ["Organizations"],
+        "x-badges": [
+          {
+            "name": "OAuth scope: organizations:read",
+            "position": "after"
+          }
+        ],
+        "x-endpoint-owners": ["management-api"],
+        "x-oauth-scope": "organizations:read"
+      }
+    },
+    "/v1/organizations/{slug}/project-claim/{token}": {
+      "get": {
+        "operationId": "v1-get-organization-project-claim",
+        "parameters": [
+          {
+            "name": "slug",
+            "required": true,
+            "in": "path",
+            "description": "Organization slug",
+            "schema": {
+              "pattern": "^[\\w-]+$",
+              "example": "tsrqponmlkjihgfedcba",
+              "type": "string"
+            }
+          },
+          {
+            "name": "token",
+            "required": true,
+            "in": "path",
+            "schema": {
+              "example": "0123456789abcdef0123456789abcdef01234567",
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/OrganizationProjectClaimResponse"
+                }
+              }
+            }
+          },
+          "401": {
+            "description": "Unauthorized"
+          },
+          "403": {
+            "description": "Forbidden action"
+          },
+          "429": {
+            "description": "Rate limit exceeded"
+          }
+        },
+        "security": [
+          {
+            "bearer": []
+          },
+          {
+            "fga_permissions": ["organization_admin_write"]
           }
         ],
         "summary": "Gets project details for the specified organization and claim token",
@@ -10741,6 +10998,15 @@
               }
             }
           },
+          "401": {
+            "description": "Unauthorized"
+          },
+          "403": {
+            "description": "Forbidden action"
+          },
+          "429": {
+            "description": "Rate limit exceeded"
+          },
           "500": {
             "description": "Failed to retrieve projects"
           }
@@ -10755,7 +11021,14 @@
         ],
         "summary": "Gets all projects for the given organization",
         "tags": ["Projects"],
-        "x-endpoint-owners": ["management-api"]
+        "x-badges": [
+          {
+            "name": "OAuth scope: projects:read",
+            "position": "after"
+          }
+        ],
+        "x-endpoint-owners": ["management-api"],
+        "x-oauth-scope": "projects:read"
       }
     }
   },
@@ -10912,7 +11185,9 @@
               "MIGRATIONS_FAILED",
               "FUNCTIONS_DEPLOYED",
               "FUNCTIONS_FAILED"
-            ]
+            ],
+            "description": "This field is deprecated. List action runs to get branch status instead.",
+            "deprecated": true
           },
           "created_at": {
             "type": "string",
@@ -11015,126 +11290,6 @@
         },
         "required": ["message"]
       },
-      "V1ListProjectsPaginatedResponse": {
-        "type": "object",
-        "properties": {
-          "projects": {
-            "type": "array",
-            "items": {
-              "type": "object",
-              "properties": {
-                "id": {
-                  "type": "number"
-                },
-                "cloud_provider": {
-                  "type": "string"
-                },
-                "inserted_at": {
-                  "type": "string",
-                  "nullable": true
-                },
-                "name": {
-                  "type": "string"
-                },
-                "organization_id": {
-                  "type": "number"
-                },
-                "organization_slug": {
-                  "type": "string"
-                },
-                "ref": {
-                  "type": "string"
-                },
-                "region": {
-                  "type": "string"
-                },
-                "status": {
-                  "type": "string"
-                },
-                "subscription_id": {
-                  "type": "string",
-                  "nullable": true
-                },
-                "is_branch_enabled": {
-                  "type": "boolean"
-                },
-                "is_physical_backups_enabled": {
-                  "type": "boolean",
-                  "nullable": true
-                },
-                "preview_branch_refs": {
-                  "type": "array",
-                  "items": {
-                    "type": "string"
-                  }
-                },
-                "disk_volume_size_gb": {
-                  "type": "number"
-                },
-                "infra_compute_size": {
-                  "type": "string",
-                  "enum": [
-                    "pico",
-                    "nano",
-                    "micro",
-                    "small",
-                    "medium",
-                    "large",
-                    "xlarge",
-                    "2xlarge",
-                    "4xlarge",
-                    "8xlarge",
-                    "12xlarge",
-                    "16xlarge",
-                    "24xlarge",
-                    "24xlarge_optimized_memory",
-                    "24xlarge_optimized_cpu",
-                    "24xlarge_high_memory",
-                    "48xlarge",
-                    "48xlarge_optimized_memory",
-                    "48xlarge_optimized_cpu",
-                    "48xlarge_high_memory"
-                  ]
-                }
-              },
-              "required": [
-                "id",
-                "cloud_provider",
-                "inserted_at",
-                "name",
-                "organization_id",
-                "organization_slug",
-                "ref",
-                "region",
-                "status",
-                "subscription_id",
-                "is_branch_enabled",
-                "is_physical_backups_enabled",
-                "preview_branch_refs"
-              ]
-            }
-          },
-          "pagination": {
-            "type": "object",
-            "properties": {
-              "count": {
-                "type": "number",
-                "description": "Total number of projects. Use this to calculate the total number of pages."
-              },
-              "limit": {
-                "type": "number",
-                "description": "Maximum number of projects per page (actual number may be less)"
-              },
-              "offset": {
-                "type": "number",
-                "description": "Number of projects skipped in this response"
-              }
-            },
-            "required": ["count", "limit", "offset"]
-          }
-        },
-        "required": ["projects", "pagination"]
-      },
       "V1ProjectWithDatabaseResponse": {
         "type": "object",
         "properties": {
@@ -12450,67 +12605,50 @@
           "custom_hostname": "docs.example.com"
         }
       },
-      "JitAccessResponse": {
-        "type": "object",
-        "properties": {
-          "user_id": {
-            "type": "string",
-            "format": "uuid"
+      "JitStateResponse": {
+        "discriminator": {
+          "propertyName": "state"
+        },
+        "oneOf": [
+          {
+            "type": "object",
+            "properties": {
+              "state": {
+                "type": "string",
+                "enum": ["enabled", "disabled"]
+              },
+              "appliedSuccessfully": {
+                "type": "boolean"
+              }
+            },
+            "required": ["state"]
           },
-          "user_roles": {
-            "type": "array",
-            "items": {
-              "type": "object",
-              "properties": {
-                "role": {
-                  "type": "string",
-                  "minLength": 1
-                },
-                "expires_at": {
-                  "type": "number"
-                },
-                "allowed_networks": {
-                  "type": "object",
-                  "properties": {
-                    "allowed_cidrs": {
-                      "type": "array",
-                      "items": {
-                        "type": "object",
-                        "properties": {
-                          "cidr": {
-                            "type": "string"
-                          }
-                        },
-                        "required": ["cidr"]
-                      }
-                    },
-                    "allowed_cidrs_v6": {
-                      "type": "array",
-                      "items": {
-                        "type": "object",
-                        "properties": {
-                          "cidr": {
-                            "type": "string"
-                          }
-                        },
-                        "required": ["cidr"]
-                      }
-                    }
-                  }
-                }
+          {
+            "type": "object",
+            "properties": {
+              "state": {
+                "type": "string",
+                "enum": ["unavailable"]
               },
-              "required": ["role"]
-            }
+              "unavailableReason": {
+                "type": "string",
+                "enum": [
+                  "manual_migration_required",
+                  "postgres_upgrade_required",
+                  "temporarily_unavailable"
+                ]
+              }
+            },
+            "required": ["state", "unavailableReason"]
           }
-        },
-        "required": ["user_id", "user_roles"]
+        ]
       },
       "JitAccessRequestRequest": {
         "type": "object",
         "properties": {
           "state": {
             "type": "string",
-            "enum": ["enabled", "disabled", "unavailable"]
+            "enum": ["enabled", "disabled"]
           }
         },
         "required": ["state"],
@@ -13270,6 +13408,46 @@
                     }
                   },
                   "required": ["type", "slot_name"]
+                },
+                {
+                  "type": "object",
+                  "properties": {
+                    "type": {
+                      "type": "string",
+                      "enum": ["x86_architecture"]
+                    }
+                  },
+                  "required": ["type"]
+                },
+                {
+                  "type": "object",
+                  "properties": {
+                    "type": {
+                      "type": "string",
+                      "enum": ["project_hibernating"]
+                    }
+                  },
+                  "required": ["type"]
+                }
+              ]
+            }
+          },
+          "warnings": {
+            "type": "array",
+            "items": {
+              "discriminator": {
+                "propertyName": "type"
+              },
+              "oneOf": [
+                {
+                  "type": "object",
+                  "properties": {
+                    "type": {
+                      "type": "string",
+                      "enum": ["pg_graphql_introspection_change"]
+                    }
+                  },
+                  "required": ["type"]
                 }
               ]
             }
@@ -13286,7 +13464,8 @@
           "objects_to_be_dropped",
           "unsupported_extensions",
           "user_defined_objects_in_internal_schemas",
-          "validation_errors"
+          "validation_errors",
+          "warnings"
         ]
       },
       "DatabaseUpgradeStatusResponse": {
@@ -14462,6 +14641,21 @@
             "type": "boolean",
             "nullable": true
           },
+          "passkey_enabled": {
+            "type": "boolean"
+          },
+          "webauthn_rp_display_name": {
+            "type": "string",
+            "nullable": true
+          },
+          "webauthn_rp_id": {
+            "type": "string",
+            "nullable": true
+          },
+          "webauthn_rp_origins": {
+            "type": "string",
+            "nullable": true
+          },
           "mfa_phone_otp_length": {
             "type": "integer"
           },
@@ -14902,6 +15096,10 @@
           "mfa_phone_verify_enabled",
           "mfa_web_authn_enroll_enabled",
           "mfa_web_authn_verify_enabled",
+          "passkey_enabled",
+          "webauthn_rp_display_name",
+          "webauthn_rp_id",
+          "webauthn_rp_origins",
           "mfa_phone_otp_length",
           "mfa_phone_template",
           "mfa_phone_max_frequency",
@@ -15899,6 +16097,21 @@
             "type": "boolean",
             "nullable": true
           },
+          "passkey_enabled": {
+            "type": "boolean"
+          },
+          "webauthn_rp_display_name": {
+            "type": "string",
+            "nullable": true
+          },
+          "webauthn_rp_id": {
+            "type": "string",
+            "nullable": true
+          },
+          "webauthn_rp_origins": {
+            "type": "string",
+            "nullable": true
+          },
           "mfa_phone_enroll_enabled": {
             "type": "boolean",
             "nullable": true
@@ -16907,6 +17120,64 @@
         },
         "required": ["message"]
       },
+      "JitAccessResponse": {
+        "type": "object",
+        "properties": {
+          "user_id": {
+            "type": "string",
+            "format": "uuid"
+          },
+          "user_roles": {
+            "type": "array",
+            "items": {
+              "type": "object",
+              "properties": {
+                "role": {
+                  "type": "string",
+                  "minLength": 1
+                },
+                "expires_at": {
+                  "type": "number"
+                },
+                "allowed_networks": {
+                  "type": "object",
+                  "properties": {
+                    "allowed_cidrs": {
+                      "type": "array",
+                      "items": {
+                        "type": "object",
+                        "properties": {
+                          "cidr": {
+                            "type": "string"
+                          }
+                        },
+                        "required": ["cidr"]
+                      }
+                    },
+                    "allowed_cidrs_v6": {
+                      "type": "array",
+                      "items": {
+                        "type": "object",
+                        "properties": {
+                          "cidr": {
+                            "type": "string"
+                          }
+                        },
+                        "required": ["cidr"]
+                      }
+                    }
+                  }
+                },
+                "branches_only": {
+                  "type": "boolean"
+                }
+              },
+              "required": ["role"]
+            }
+          }
+        },
+        "required": ["user_id", "user_roles"]
+      },
       "AuthorizeJitAccessBody": {
         "type": "object",
         "properties": {
@@ -16970,6 +17241,9 @@
                     }
                   }
                 }
+              },
+              "branches_only": {
+                "type": "boolean"
               }
             },
             "required": ["role"]
@@ -17029,6 +17303,9 @@
                             }
                           }
                         }
+                      },
+                      "branches_only": {
+                        "type": "boolean"
                       }
                     },
                     "required": ["role"]
@@ -17089,6 +17366,9 @@
                       }
                     }
                   }
+                },
+                "branches_only": {
+                  "type": "boolean"
                 }
               },
               "required": ["role"]
@@ -17108,7 +17388,8 @@
                     "cidr": "203.0.113.0/24"
                   }
                 ]
-              }
+              },
+              "branches_only": false
             }
           ]
         }
@@ -19063,6 +19344,9 @@
             "items": {
               "type": "object",
               "properties": {
+                "id": {
+                  "type": "integer"
+                },
                 "is_physical_backup": {
                   "type": "boolean"
                 },
@@ -19074,7 +19358,7 @@
                   "type": "string"
                 }
               },
-              "required": ["is_physical_backup", "status", "inserted_at"]
+              "required": ["id", "is_physical_backup", "status", "inserted_at"]
             }
           },
           "physical_backup_data": {
@@ -19136,6 +19420,49 @@
         },
         "required": ["name", "status", "completed_on"]
       },
+      "V1RestoreBackupBody": {
+        "type": "object",
+        "properties": {
+          "id": {
+            "type": "integer"
+          }
+        },
+        "required": ["id"],
+        "example": {
+          "id": 12345
+        }
+      },
+      "V1BackupScheduleResponse": {
+        "type": "object",
+        "properties": {
+          "schedule_for": {
+            "type": "string",
+            "description": "Time of day to schedule daily backups, in UTC. Format: HH:MM:SS.",
+            "example": "04:00:00"
+          },
+          "updated_at": {
+            "type": "string",
+            "format": "date-time",
+            "description": "Timestamp of when the backup schedule was last updated.",
+            "example": "2026-05-04T14:40:44+00:00"
+          }
+        },
+        "required": ["schedule_for", "updated_at"]
+      },
+      "V1UpdateBackupScheduleBody": {
+        "type": "object",
+        "properties": {
+          "schedule_for": {
+            "type": "string",
+            "description": "Time of day to schedule daily backups, in UTC. Format: HH:MM:SS.",
+            "example": "04:00:00"
+          }
+        },
+        "required": ["schedule_for"],
+        "example": {
+          "schedule_for": "04:00:00"
+        }
+      },
       "V1UndoBody": {
         "type": "object",
         "properties": {
@@ -19177,6 +19504,7 @@
                         "security.audit_logs_days",
                         "security.questionnaire",
                         "security.soc2_report",
+                        "security.iso27001_certificate",
                         "security.private_link",
                         "security.enforce_mfa",
                         "log.retention_days",
@@ -19185,6 +19513,7 @@
                         "ipv4",
                         "pitr.available_variants",
                         "log_drains",
+                        "audit_log_drains",
                         "branching_limit",
                         "branching_persistent",
                         "auth.mfa_phone",
@@ -19199,8 +19528,10 @@
                         "auth.advanced_auth_settings",
                         "auth.performance_settings",
                         "auth.password_hibp",
+                        "auth.custom_oauth.max_providers",
                         "backup.retention_days",
                         "backup.restore_to_new_project",
+                        "backup.schedule",
                         "function.max_count",
                         "function.size_limit_mb",
                         "realtime.max_concurrent_users",
diff --git a/packages/api/src/internal/client.unit.test.ts b/packages/api/src/internal/client.unit.test.ts
index d814ae4351..c8472ba23e 100644
--- a/packages/api/src/internal/client.unit.test.ts
+++ b/packages/api/src/internal/client.unit.test.ts
@@ -451,7 +451,11 @@ describe("makeSupabaseApiClient", () => {
       makeSupabaseApiClient(config).pipe(
         Effect.flatMap((client) =>
           client.execute<"v1DiffABranch">(operationDefinitions.v1DiffABranch, {
-            branch_id_or_ref: "branch-ref",
+            // 20-letter project ref. Used to be "branch-ref" but the UUID
+            // branch of the oneOf union now has an actual pattern check, so
+            // free-form strings like "branch-ref" no longer match either
+            // branch.
+            branch_id_or_ref: "abcdefghijklmnopqrst",
           }),
         ),
         Effect.provide(
diff --git a/packages/cli-test-helpers/src/harness.ts b/packages/cli-test-helpers/src/harness.ts
index 112b39f824..2a19abadf9 100644
--- a/packages/cli-test-helpers/src/harness.ts
+++ b/packages/cli-test-helpers/src/harness.ts
@@ -121,12 +121,15 @@ export async function exec(
     ...opts?.env,
   };
 
-  // The Go CLI (and the ts-legacy CLI which shells out to Go) uses a profile
-  // system rather than SUPABASE_API_URL. Write a temporary profile file
-  // pointing to the replay server. SUPABASE_PROFILE is picked up by Go's viper
-  // (prefix SUPABASE_ + AutomaticEnv). For ts-legacy, the profile file is
-  // inherited by the Go subprocess because it spawns with extendEnv: true.
-  // ts-next reads SUPABASE_API_URL directly, so it doesn't need a profile file.
+  // The Go CLI uses a profile system rather than SUPABASE_API_URL. Write a
+  // temporary profile file pointing to the replay server.
+  // - Go's viper reads SUPABASE_PROFILE as a config file path (prefix
+  //   SUPABASE_ + AutomaticEnv) when the value isn't a built-in profile name.
+  // - The ts-legacy CLI mirrors this dual semantics in `LegacyCliConfig`
+  //   (built-in name first, YAML file path second) for any natively-ported
+  //   command; proxy-wrapped commands still shell out to Go which reads the
+  //   same file directly.
+  // - ts-next reads SUPABASE_API_URL directly, so it doesn't need a profile file.
   let profilePath: string | undefined;
   if (harness.target === "go" || harness.target === "ts-legacy") {
     profilePath = join(tmpdir(), `cli-e2e-profile-${randomUUID()}.yaml`);
diff --git a/packages/cli-test-helpers/src/normalize.ts b/packages/cli-test-helpers/src/normalize.ts
index 5fa42d0ebe..6fafaf3cec 100644
--- a/packages/cli-test-helpers/src/normalize.ts
+++ b/packages/cli-test-helpers/src/normalize.ts
@@ -71,6 +71,13 @@ export function normalize(output: string): string {
       )
       // 12. Go goroutine stack trace blocks (goroutine N [state]:\n...)
       .replace(/^goroutine \d+ \[.*?\]:(?:\n[^\n]+)*/gm, "<STACK_TRACE>")
+      // 12b. github.com/go-errors/errors stack frames. The Go CLI prints these in
+      //      dev builds (`utils.Version == ""`) before the actual error message:
+      //          <PATH> (0xADDR)
+      //          \t<funcName>: <source-snippet>
+      //      The TS port intentionally doesn't reconstruct these — strip the
+      //      frame block plus the trailing blank line so parity comparisons ignore them.
+      .replace(/(?:^<PATH> \(0xADDR\)\n\t[^\n]+\n)+\n?/gm, "")
       // 13. Node/Bun stack trace lines (one or more consecutive "    at …" lines)
       .replace(/(?:^[ \t]+at [^\n]+\n?)+/gm, "<STACK_TRACE>\n")
       // 14. File reference line numbers (file.ts:123 or file.ts:123:45)
diff --git a/packages/config/src/api.ts b/packages/config/src/api.ts
index 9f7f5de7ab..fc169044f0 100644
--- a/packages/config/src/api.ts
+++ b/packages/config/src/api.ts
@@ -56,6 +56,14 @@ export const api = Schema.Struct({
     tags,
     links,
   }).pipe(Schema.withDecodingDefaultKey(Effect.succeed(defaultMaxRows))),
+  auto_expose_new_tables: Schema.optionalKey(
+    Schema.Boolean.annotate({
+      description:
+        "Controls whether newly-created tables, views, sequences and functions in the `public` schema by `postgres` are reachable through the Data API roles (`anon`, `authenticated`, `service_role`) without explicit GRANTs. Leave unset today to keep long-standing local behaviour. The implicit default flips to `false` on 2026-05-30 to match the new cloud default, and the field is removed in 2026-10-30 once the always-revoked behaviour is permanent. Set to `false` to opt in early; set to `true` to lock in today's behaviour through the deprecation window.",
+      tags,
+      links,
+    }),
+  ),
   tls: Schema.Struct({
     enabled: Schema.Boolean.annotate({
       default: defaultTlsEnabled,
diff --git a/packages/config/src/errors.ts b/packages/config/src/errors.ts
index f1b6b5ea53..1cc1c4da1f 100644
--- a/packages/config/src/errors.ts
+++ b/packages/config/src/errors.ts
@@ -12,11 +12,6 @@ export class ProjectEnvParseError extends Data.TaggedError("ProjectEnvParseError
   readonly line: number;
 }> {}
 
-export class MissingProjectEnvVarError extends Data.TaggedError("MissingProjectEnvVarError")<{
-  readonly configPath: string;
-  readonly envName: string;
-}> {}
-
 export class MissingProjectConfigValueError extends Data.TaggedError(
   "MissingProjectConfigValueError",
 )<{
diff --git a/packages/config/src/index.ts b/packages/config/src/index.ts
index aca28d8be7..788b00813a 100644
--- a/packages/config/src/index.ts
+++ b/packages/config/src/index.ts
@@ -1,7 +1,6 @@
 export { ProjectConfigSchema, type ProjectConfig, type ProjectConfigJson } from "./base.ts";
 export {
   MissingProjectConfigValueError,
-  MissingProjectEnvVarError,
   ProjectConfigParseError,
   ProjectEnvParseError,
 } from "./errors.ts";
diff --git a/packages/config/src/io.ts b/packages/config/src/io.ts
index 07fbfb8834..b981a4bd80 100644
--- a/packages/config/src/io.ts
+++ b/packages/config/src/io.ts
@@ -2,7 +2,9 @@ import { Effect, FileSystem, Path, Schema } from "effect";
 import * as SmolToml from "smol-toml";
 import { ProjectConfigSchema, type ProjectConfig } from "./base.ts";
 import { ProjectConfigParseError } from "./errors.ts";
+import { interpolateEnvReferencesAgainstSchema } from "./lib/env.ts";
 import { findProjectPaths } from "./paths.ts";
+import { loadProjectEnvironment } from "./project.ts";
 
 const projectConfigSchemaKey = "$schema";
 
@@ -203,18 +205,37 @@ function encodeProjectConfigToTomlDocument(
   return `${SmolToml.stringify(toConfigDocument(config, schemaRef))}\n`;
 }
 
-export const loadProjectConfigFile = Effect.fnUntraced(function* (path: string) {
+export const loadProjectConfigFile = Effect.fnUntraced(function* (filePath: string) {
   const fs = yield* FileSystem.FileSystem;
-  const format = path.endsWith(".json") ? "json" : "toml";
-  const content = yield* fs.readFileString(path);
+  const path = yield* Path.Path;
+  const format = filePath.endsWith(".json") ? "json" : "toml";
+  const content = yield* fs.readFileString(filePath);
   const document = yield* Effect.try({
     try: () => parseProjectConfigDocument(content, format),
-    catch: (cause) => new ProjectConfigParseError({ path, format, cause }),
+    catch: (cause) => new ProjectConfigParseError({ path: filePath, format, cause }),
+  });
+
+  // Substitute `env(VAR)` references against `.env`/`.env.local`/ambient env
+  // before schema decode. Required for numeric/boolean fields, which would
+  // otherwise crash the strict decoder with `Expected number` (CLI-1489).
+  // The config file lives at `<projectRoot>/supabase/config.{toml,json}`, so
+  // walking two directories up gives us the project root that
+  // `loadProjectEnvironment` expects.
+  const projectRoot = path.dirname(path.dirname(filePath));
+  const projectEnv = yield* loadProjectEnvironment({
+    cwd: projectRoot,
+    baseEnv: process.env,
   });
-  const config = yield* parseProjectConfig(document, format, path);
+  const interpolated = interpolateEnvReferencesAgainstSchema(
+    document,
+    projectEnv?.values ?? {},
+    ProjectConfigSchema,
+  );
+
+  const config = yield* parseProjectConfig(interpolated, format, filePath);
 
   return {
-    path,
+    path: filePath,
     format,
     config,
     schemaRef: getSchemaRef(document),
diff --git a/packages/config/src/io.unit.test.ts b/packages/config/src/io.unit.test.ts
index 4b934885c5..e3154e9e05 100644
--- a/packages/config/src/io.unit.test.ts
+++ b/packages/config/src/io.unit.test.ts
@@ -675,4 +675,141 @@ major_version = 16
     expect(schemaString).toContain("env");
     expect(schemaString).not.toContain("versions");
   });
+
+  test("resolves env() on numeric port fields (CLI-1489)", async () => {
+    const cwd = makeTempProject();
+
+    try {
+      await mkdir(join(cwd, "supabase"), { recursive: true });
+      await writeFile(
+        join(cwd, "supabase", "config.toml"),
+        `project_id = "ref_123"
+
+[api]
+port = "env(SUPABASE_API_PORT)"
+
+[db]
+port = "env(SUPABASE_DB_PORT)"
+
+[analytics]
+port = "env(SUPABASE_ANALYTICS_PORT)"
+`,
+      );
+      await writeFile(
+        join(cwd, "supabase", ".env"),
+        "SUPABASE_API_PORT=54321\nSUPABASE_DB_PORT=54322\nSUPABASE_ANALYTICS_PORT=54327\n",
+      );
+
+      const loaded = await runConfigEffect(loadProjectConfig(cwd));
+
+      expect(loaded).not.toBeNull();
+      expect(loaded!.config.api.port).toBe(54321);
+      expect(loaded!.config.db.port).toBe(54322);
+      expect(loaded!.config.analytics.port).toBe(54327);
+    } finally {
+      await rm(cwd, { recursive: true, force: true });
+    }
+  });
+
+  test("resolves env() on boolean fields", async () => {
+    const cwd = makeTempProject();
+
+    try {
+      await mkdir(join(cwd, "supabase"), { recursive: true });
+      await writeFile(
+        join(cwd, "supabase", "config.toml"),
+        `project_id = "ref_123"
+
+[analytics]
+enabled = "env(SUPABASE_ANALYTICS_ENABLED)"
+`,
+      );
+      await writeFile(join(cwd, "supabase", ".env"), "SUPABASE_ANALYTICS_ENABLED=false\n");
+
+      const loaded = await runConfigEffect(loadProjectConfig(cwd));
+      expect(loaded!.config.analytics.enabled).toBe(false);
+    } finally {
+      await rm(cwd, { recursive: true, force: true });
+    }
+  });
+
+  test("preserves env() literals on string fields when the var is unset (Go parity)", async () => {
+    const cwd = makeTempProject();
+
+    try {
+      await mkdir(join(cwd, "supabase"), { recursive: true });
+      await writeFile(
+        join(cwd, "supabase", "config.toml"),
+        `project_id = "ref_123"
+
+[auth]
+jwt_secret = "env(MISSING_SECRET)"
+`,
+      );
+
+      const loaded = await runConfigEffect(loadProjectConfig(cwd));
+      expect(loaded!.config.auth.jwt_secret).toBe("env(MISSING_SECRET)");
+    } finally {
+      await rm(cwd, { recursive: true, force: true });
+    }
+  });
+
+  test("fails to decode a numeric field when env var is unset", async () => {
+    const cwd = makeTempProject();
+
+    try {
+      await mkdir(join(cwd, "supabase"), { recursive: true });
+      await writeFile(
+        join(cwd, "supabase", "config.toml"),
+        `project_id = "ref_123"
+
+[analytics]
+port = "env(MISSING_PORT)"
+`,
+      );
+
+      const exit = await Effect.runPromiseExit(
+        loadProjectConfig(cwd).pipe(Effect.provide(BunServices.layer)),
+      );
+
+      expect(Exit.isFailure(exit)).toBe(true);
+      if (Exit.isFailure(exit)) {
+        const failure = Cause.findErrorOption(exit.cause);
+        expect(Option.isSome(failure)).toBe(true);
+        if (Option.isSome(failure)) {
+          expect((failure.value as { _tag: string })._tag).toBe("ProjectConfigParseError");
+        }
+      }
+    } finally {
+      await rm(cwd, { recursive: true, force: true });
+    }
+  });
+
+  test("falls back to ambient process.env when .env is missing", async () => {
+    const cwd = makeTempProject();
+    const previous = process.env.SUPABASE_DB_PORT_TEST;
+    process.env.SUPABASE_DB_PORT_TEST = "55555";
+
+    try {
+      await mkdir(join(cwd, "supabase"), { recursive: true });
+      await writeFile(
+        join(cwd, "supabase", "config.toml"),
+        `project_id = "ref_123"
+
+[db]
+port = "env(SUPABASE_DB_PORT_TEST)"
+`,
+      );
+
+      const loaded = await runConfigEffect(loadProjectConfig(cwd));
+      expect(loaded!.config.db.port).toBe(55555);
+    } finally {
+      if (previous === undefined) {
+        delete process.env.SUPABASE_DB_PORT_TEST;
+      } else {
+        process.env.SUPABASE_DB_PORT_TEST = previous;
+      }
+      await rm(cwd, { recursive: true, force: true });
+    }
+  });
 });
diff --git a/packages/config/src/lib/env.ts b/packages/config/src/lib/env.ts
index 0339142f31..bd16819293 100644
--- a/packages/config/src/lib/env.ts
+++ b/packages/config/src/lib/env.ts
@@ -1,4 +1,4 @@
-import { Schema } from "effect";
+import { Schema, SchemaAST } from "effect";
 
 export const ENV_PATTERN = "^env\\([A-Z_][A-Z0-9_]*\\)$";
 export const ENV_CAPTURE_REGEX = /^env\(([A-Z_][A-Z0-9_]*)\)$/;
@@ -12,10 +12,16 @@ interface EnvAnnotations extends Schema.Annotations.Documentation<string> {
   readonly secret?: true;
 }
 
+// Marker annotation: this field requires the `env(VAR)` literal form and is
+// resolved post-decode via `resolveProjectValue` / `resolveProjectSubtree`.
+// The pre-decode walker honors this and leaves the literal untouched.
+const X_ENV_DEFERRED = "x-env-deferred" as const;
+
 export const env = (annotations?: EnvAnnotations) => {
   const { secret, ...rest } = annotations ?? {};
   return Schema.String.check(Schema.isPattern(envRegex)).annotate({
     ...rest,
+    [X_ENV_DEFERRED]: true,
     ...(secret ? { "x-secret": true } : {}),
   });
 };
@@ -27,3 +33,228 @@ export const secret = (annotations?: SecretAnnotations) =>
     ...annotations,
     "x-secret": true,
   });
+
+// ---------------------------------------------------------------------------
+// Pre-decode env() interpolation with schema-aware type coercion
+// ---------------------------------------------------------------------------
+//
+// TOML/JSON parsers turn `port = "env(SUPABASE_ANALYTICS_PORT)"` into a string
+// at `analytics.port`, but the schema declares `port: Schema.Number`. Without
+// pre-decode handling the strict decoder rejects the string and crashes
+// `supabase db start` (CLI-1489).
+//
+// `interpolateEnvReferencesAgainstSchema` walks the parsed document and the
+// schema AST in parallel:
+//   - For string leaves matching `env(VAR)`: substitute `env[VAR]` if set, or
+//     preserve the literal verbatim if unset (matches Go's
+//     `apps/cli-go/pkg/config/decode_hooks.go:14-21`).
+//   - After substitution, if the schema at that path expects Number or Boolean
+//     and the value is still a string, coerce it. This mirrors Go's
+//     mapstructure chain where `LoadEnvHook` returns a string and subsequent
+//     hooks convert it to the target type.
+//   - Coercion is only attempted on strings produced by env() substitution.
+//     Pre-existing string literals at non-string paths are left untouched —
+//     they'll surface as schema errors at decode time with their original
+//     value, preserving error clarity.
+
+type ExpectedType = "number" | "boolean" | "string" | "unknown";
+
+// Unwrap Suspend (lazy AST refs from recursive schemas). Other transformation
+// wrappers expose the target type via `.ast` directly, so no additional
+// unwrapping is needed at this layer.
+function unwrapAst(ast: SchemaAST.AST): SchemaAST.AST {
+  if (ast._tag === "Suspend") {
+    return unwrapAst(ast.thunk());
+  }
+  return ast;
+}
+
+function leafExpectedType(ast: SchemaAST.AST): ExpectedType {
+  const node = unwrapAst(ast);
+  switch (node._tag) {
+    case "Number":
+      return "number";
+    case "Boolean":
+      return "boolean";
+    case "String":
+      return "string";
+    case "Union": {
+      // Walk Union branches in declared order; first concrete primitive wins.
+      // For unions like `Schema.Union(Schema.Number, Schema.Null)` this picks
+      // the meaningful side. If the union mixes Number and String we err on
+      // the side of the first match — the schema decode will still validate
+      // membership after coercion.
+      for (const variant of node.types) {
+        const t = leafExpectedType(variant);
+        if (t !== "unknown") {
+          return t;
+        }
+      }
+      return "unknown";
+    }
+    default:
+      return "unknown";
+  }
+}
+
+function descendAst(ast: SchemaAST.AST, segment: string): SchemaAST.AST | null {
+  const node = unwrapAst(ast);
+
+  if (node._tag === "Objects") {
+    const ps = node.propertySignatures.find((p) => p.name === segment);
+    if (ps !== undefined) {
+      return ps.type;
+    }
+    // Record-like sections (e.g. `[edge_runtime.secrets]`, `[remotes.<name>]`)
+    // express their value shape via index signatures.
+    if (node.indexSignatures.length > 0) {
+      return node.indexSignatures[0]!.type;
+    }
+    return null;
+  }
+
+  if (node._tag === "Arrays") {
+    const index = Number.parseInt(segment, 10);
+    if (Number.isInteger(index)) {
+      if (index >= 0 && index < node.elements.length) {
+        return node.elements[index]!;
+      }
+      if (node.rest.length > 0) {
+        return node.rest[0]!;
+      }
+    }
+    return null;
+  }
+
+  if (node._tag === "Union") {
+    // Pick the first branch whose descent succeeds.
+    for (const variant of node.types) {
+      const next = descendAst(variant, segment);
+      if (next !== null) {
+        return next;
+      }
+    }
+    return null;
+  }
+
+  return null;
+}
+
+function coerceLeaf(value: unknown, expected: ExpectedType): unknown {
+  if (typeof value !== "string") {
+    return value;
+  }
+  if (expected === "number") {
+    const trimmed = value.trim();
+    if (trimmed === "") {
+      return value;
+    }
+    const n = Number(trimmed);
+    if (Number.isFinite(n)) {
+      return n;
+    }
+    return value;
+  }
+  if (expected === "boolean") {
+    if (value === "true") return true;
+    if (value === "false") return false;
+    return value;
+  }
+  return value;
+}
+
+function substituteEnvLeaf(value: string, env: Readonly<Record<string, string>>): string {
+  const match = ENV_CAPTURE_REGEX.exec(value);
+  if (match === null) {
+    return value;
+  }
+  const envName = match[1];
+  if (envName === undefined || !Object.prototype.hasOwnProperty.call(env, envName)) {
+    return value;
+  }
+  return env[envName] ?? value;
+}
+
+function isDeferredEnvField(ast: SchemaAST.AST): boolean {
+  const node = unwrapAst(ast);
+  if (node.annotations?.[X_ENV_DEFERRED] === true) {
+    return true;
+  }
+  // The env() helper threads its annotation through `.check(isPattern(...))`,
+  // which attaches the metadata to the Filter rather than the base AST.
+  for (const check of node.checks ?? []) {
+    if (
+      (check as { annotations?: Record<string, unknown> }).annotations?.[X_ENV_DEFERRED] === true
+    ) {
+      return true;
+    }
+  }
+  return false;
+}
+
+function walk(
+  document: unknown,
+  env: Readonly<Record<string, string>>,
+  ast: SchemaAST.AST | null,
+): unknown {
+  if (Array.isArray(document)) {
+    return document.map((item, index) => {
+      const child = ast === null ? null : descendAst(ast, String(index));
+      return walk(item, env, child);
+    });
+  }
+
+  if (typeof document === "object" && document !== null) {
+    const result: Record<string, unknown> = {};
+    for (const [key, value] of Object.entries(document)) {
+      const child = ast === null ? null : descendAst(ast, key);
+      result[key] = walk(value, env, child);
+    }
+    return result;
+  }
+
+  if (typeof document === "string") {
+    // Fields declared with the `env()` helper require the literal `env(VAR)`
+    // form for post-decode resolution. Skip substitution there so the schema
+    // pattern check still matches.
+    if (ast !== null && isDeferredEnvField(ast)) {
+      return document;
+    }
+    // Substitute env() then coerce based on the schema's expected type at this
+    // path. Only the substituted form is fed to coercion — literal strings at
+    // non-string paths are left untouched so the decoder can report them with
+    // their original value.
+    const substituted = substituteEnvLeaf(document, env);
+    if (substituted === document) {
+      return document;
+    }
+    if (ast === null) {
+      return substituted;
+    }
+    return coerceLeaf(substituted, leafExpectedType(ast));
+  }
+
+  return document;
+}
+
+/**
+ * Pre-decode env() substitution + schema-aware coercion.
+ *
+ * Walks the raw parsed document and the schema AST in parallel. For every
+ * string leaf matching `env(VAR)`:
+ *   1. Substitutes `env[VAR]` if set, else preserves the literal verbatim
+ *      (Go-parity with `apps/cli-go/pkg/config/decode_hooks.go:14-21`).
+ *   2. If the schema at that path expects Number or Boolean, coerces the
+ *      substituted string to the expected primitive — mirroring Go's
+ *      mapstructure chain where `LoadEnvHook` returns a string that the next
+ *      hook converts to the target type.
+ *
+ * Returns a new structure; does not mutate the input.
+ */
+export function interpolateEnvReferencesAgainstSchema(
+  document: unknown,
+  env: Readonly<Record<string, string>>,
+  schema: { readonly ast: SchemaAST.AST },
+): unknown {
+  return walk(document, env, schema.ast);
+}
diff --git a/packages/config/src/project.ts b/packages/config/src/project.ts
index 7db85b782f..68953f2b1b 100644
--- a/packages/config/src/project.ts
+++ b/packages/config/src/project.ts
@@ -1,6 +1,6 @@
 import { Effect, FileSystem, Redacted } from "effect";
 import { ProjectConfigSchema } from "./base.ts";
-import { MissingProjectEnvVarError, ProjectEnvParseError } from "./errors.ts";
+import { ProjectEnvParseError } from "./errors.ts";
 import { ENV_CAPTURE_REGEX, isEnvReference } from "./lib/env.ts";
 import { findProjectPaths, type ProjectPaths } from "./paths.ts";
 
@@ -216,11 +216,7 @@ function isSecretPath(path: ReadonlyArray<string>): boolean {
   return secretPathPatterns.some((pattern) => matchesPathPattern(pattern, path));
 }
 
-function interpolateLeafValue(
-  value: string,
-  env: Readonly<Record<string, string>>,
-  configPath: ReadonlyArray<string>,
-): string {
+function interpolateLeafValue(value: string, env: Readonly<Record<string, string>>): string {
   const match = envReferencePattern.exec(value);
   const envName = match?.[1];
 
@@ -228,11 +224,10 @@ function interpolateLeafValue(
     return value;
   }
 
+  // Preserve the literal `env(VAR)` verbatim when VAR is unset. Matches Go's
+  // `apps/cli-go/pkg/config/decode_hooks.go:14-21` (LoadEnvHook).
   if (!Object.prototype.hasOwnProperty.call(env, envName)) {
-    throw new MissingProjectEnvVarError({
-      configPath: configPath.join("."),
-      envName,
-    });
+    return value;
   }
 
   return env[envName] ?? value;
@@ -246,27 +241,23 @@ function toPathSegments(path: string): ReadonlyArray<string> {
   return path.split(".").filter((segment) => segment.length > 0);
 }
 
-function interpolateValue(
-  value: unknown,
-  env: Readonly<Record<string, string>>,
-  path: ReadonlyArray<string> = [],
-): unknown {
+function interpolateValue(value: unknown, env: Readonly<Record<string, string>>): unknown {
   if (Array.isArray(value)) {
-    return value.map((item, index) => interpolateValue(item, env, [...path, String(index)]));
+    return value.map((item) => interpolateValue(item, env));
   }
 
   if (typeof value === "object" && value !== null) {
     const result: Record<string, unknown> = {};
 
     for (const [key, child] of Object.entries(value)) {
-      result[key] = interpolateValue(child, env, [...path, key]);
+      result[key] = interpolateValue(child, env);
     }
 
     return result;
   }
 
   if (typeof value === "string") {
-    return interpolateLeafValue(value, env, path);
+    return interpolateLeafValue(value, env);
   }
 
   return value;
@@ -298,34 +289,37 @@ function resolveProjectValueAtPath(
   value: unknown,
   projectEnv: ProjectEnvironment,
   path: ReadonlyArray<string>,
-): Effect.Effect<unknown, MissingProjectEnvVarError> {
-  try {
-    const interpolated = interpolateValue(value, projectEnv.values, path);
-    return Effect.succeed(redactValue(interpolated, path));
-  } catch (error) {
-    if (error instanceof MissingProjectEnvVarError) {
-      return Effect.fail(error);
-    }
-    throw error;
-  }
+): unknown {
+  const interpolated = interpolateValue(value, projectEnv.values);
+  return redactValue(interpolated, path);
 }
 
 export function resolveProjectValue<T>(
   value: T,
   projectEnv: ProjectEnvironment,
   configPath: string,
-): Effect.Effect<ResolvedProjectValue<T>, MissingProjectEnvVarError> {
-  return Effect.suspend(() =>
-    resolveProjectValueAtPath(value, projectEnv, toPathSegments(configPath)),
-  ).pipe(Effect.map((resolved) => resolved as ResolvedProjectValue<T>));
+): Effect.Effect<ResolvedProjectValue<T>> {
+  return Effect.sync(
+    () =>
+      resolveProjectValueAtPath(
+        value,
+        projectEnv,
+        toPathSegments(configPath),
+      ) as ResolvedProjectValue<T>,
+  );
 }
 
 export function resolveProjectSubtree<T>(
   value: T,
   projectEnv: ProjectEnvironment,
   pathPrefix: string,
-): Effect.Effect<ResolvedProjectValue<T>, MissingProjectEnvVarError> {
-  return Effect.suspend(() =>
-    resolveProjectValueAtPath(value, projectEnv, toPathSegments(pathPrefix)),
-  ).pipe(Effect.map((resolved) => resolved as ResolvedProjectValue<T>));
+): Effect.Effect<ResolvedProjectValue<T>> {
+  return Effect.sync(
+    () =>
+      resolveProjectValueAtPath(
+        value,
+        projectEnv,
+        toPathSegments(pathPrefix),
+      ) as ResolvedProjectValue<T>,
+  );
 }
diff --git a/packages/config/src/project.unit.test.ts b/packages/config/src/project.unit.test.ts
index a0b4ffbddb..de22a465fe 100644
--- a/packages/config/src/project.unit.test.ts
+++ b/packages/config/src/project.unit.test.ts
@@ -107,6 +107,37 @@ describe("project discovery and lazy env resolution", () => {
     }
   });
 
+  test("leaves [api].auto_expose_new_tables unset by default and round-trips an explicit value", async () => {
+    const cwd = makeTempProject();
+    const projectRoot = join(cwd, "repo");
+
+    try {
+      await mkdir(join(projectRoot, "supabase"), { recursive: true });
+      await writeFile(join(projectRoot, "supabase", "config.toml"), `project_id = "ref_123"\n`);
+
+      const defaultLoaded = await runConfigEffect(loadProjectConfig(projectRoot));
+      // Field is intentionally optional today so the implicit default can flip on 2026-05-30
+      // without losing track of users who explicitly opted in either direction.
+      expect(defaultLoaded!.config.api.auto_expose_new_tables).toBeUndefined();
+
+      await writeFile(
+        join(projectRoot, "supabase", "config.toml"),
+        `project_id = "ref_123"\n\n[api]\nauto_expose_new_tables = false\n`,
+      );
+      const explicitFalse = await runConfigEffect(loadProjectConfig(projectRoot));
+      expect(explicitFalse!.config.api.auto_expose_new_tables).toBe(false);
+
+      await writeFile(
+        join(projectRoot, "supabase", "config.toml"),
+        `project_id = "ref_123"\n\n[api]\nauto_expose_new_tables = true\n`,
+      );
+      const explicitTrue = await runConfigEffect(loadProjectConfig(projectRoot));
+      expect(explicitTrue!.config.api.auto_expose_new_tables).toBe(true);
+    } finally {
+      await rm(cwd, { recursive: true, force: true });
+    }
+  });
+
   test("loads raw config without resolving explicit env() references", async () => {
     const cwd = makeTempProject();
     const projectRoot = join(cwd, "repo");
@@ -220,7 +251,7 @@ jwt_secret = "env(PREVIEW_JWT_SECRET)"
     }
   });
 
-  test("resolveProjectValue fails when an explicit env() reference is missing", async () => {
+  test("resolveProjectValue preserves env() literal when the env var is missing (Go parity)", async () => {
     const cwd = makeTempProject();
     const projectRoot = join(cwd, "repo");
 
@@ -238,21 +269,20 @@ jwt_secret = "env(MISSING_SECRET)"
       const loaded = await runConfigEffect(loadProjectConfig(projectRoot));
       const projectEnv = await runConfigEffect(loadProjectEnvironment({ cwd: projectRoot }));
 
-      await expect(
-        runConfigEffect(
-          resolveProjectValue(loaded!.config.auth.jwt_secret, projectEnv!, "auth.jwt_secret"),
-        ),
-      ).rejects.toMatchObject({
-        _tag: "MissingProjectEnvVarError",
-        configPath: "auth.jwt_secret",
-        envName: "MISSING_SECRET",
-      });
+      const resolved = await runConfigEffect(
+        resolveProjectValue(loaded!.config.auth.jwt_secret, projectEnv!, "auth.jwt_secret"),
+      );
+
+      // Secret paths are normally redacted, but unresolved env() literals pass
+      // through as plain strings so callers can see the missing reference.
+      expect(Redacted.isRedacted(resolved)).toBe(false);
+      expect(resolved).toBe("env(MISSING_SECRET)");
     } finally {
       await rm(cwd, { recursive: true, force: true });
     }
   });
 
-  test("resolveProjectSubtree fails when the selected subtree contains a missing env()", async () => {
+  test("resolveProjectSubtree preserves env() literals nested inside the selected subtree", async () => {
     const cwd = makeTempProject();
     const projectRoot = join(cwd, "repo");
 
@@ -271,15 +301,11 @@ auth_token = "env(MISSING_SECRET)"
       const loaded = await runConfigEffect(loadProjectConfig(projectRoot));
       const projectEnv = await runConfigEffect(loadProjectEnvironment({ cwd: projectRoot }));
 
-      await expect(
-        runConfigEffect(
-          resolveProjectSubtree(loaded!.config.auth.sms.twilio, projectEnv!, "auth.sms.twilio"),
-        ),
-      ).rejects.toMatchObject({
-        _tag: "MissingProjectEnvVarError",
-        configPath: "auth.sms.twilio.auth_token",
-        envName: "MISSING_SECRET",
-      });
+      const resolved = await runConfigEffect(
+        resolveProjectSubtree(loaded!.config.auth.sms.twilio, projectEnv!, "auth.sms.twilio"),
+      );
+
+      expect(resolved.auth_token).toBe("env(MISSING_SECRET)");
     } finally {
       await rm(cwd, { recursive: true, force: true });
     }
diff --git a/packages/stack/package.json b/packages/stack/package.json
index b17d585ccb..20b1c50bb9 100644
--- a/packages/stack/package.json
+++ b/packages/stack/package.json
@@ -27,7 +27,7 @@
   },
   "devDependencies": {
     "@effect/vitest": "catalog:",
-    "@supabase/supabase-js": "^2.105.4",
+    "@supabase/supabase-js": "^2.106.2",
     "@tsconfig/bun": "catalog:",
     "@types/bun": "catalog:",
     "@typescript/native-preview": "catalog:",
diff --git a/packages/stack/src/Stack.unit.test.ts b/packages/stack/src/Stack.unit.test.ts
index d3f4d491f3..c278268953 100644
--- a/packages/stack/src/Stack.unit.test.ts
+++ b/packages/stack/src/Stack.unit.test.ts
@@ -57,6 +57,7 @@ const defaultConfig: ResolvedStackConfig = {
     port: 54322,
     dataDir: "/tmp/supabase/data",
     version: DEFAULT_VERSIONS.postgres,
+    autoExposeNewTables: true,
   },
   postgrest: {
     port: 54323,
diff --git a/packages/stack/src/StackBuilder.ts b/packages/stack/src/StackBuilder.ts
index d85ca7e8f5..504f8d57d6 100644
--- a/packages/stack/src/StackBuilder.ts
+++ b/packages/stack/src/StackBuilder.ts
@@ -39,6 +39,14 @@ export interface PostgresConfig {
   readonly port?: number;
   readonly dataDir?: string;
   readonly version?: string;
+  /**
+   * When true (default), the bundled initial schema GRANTs that expose new tables, views,
+   * sequences, and functions in `public` to the Data API roles (`anon`, `authenticated`,
+   * `service_role`) are kept in place. When false, those default privileges are revoked so the
+   * local stack matches the new cloud default and requires explicit GRANTs to surface entities
+   * through the Data API.
+   */
+  readonly autoExposeNewTables?: boolean;
 }
 
 export interface PostgrestConfig {
@@ -160,6 +168,7 @@ export interface ResolvedPostgresConfig {
   readonly port: number;
   readonly dataDir: string;
   readonly version: string;
+  readonly autoExposeNewTables: boolean;
 }
 
 export interface ResolvedPostgrestConfig {
@@ -569,6 +578,7 @@ export class StackBuilder extends Context.Service<
             ...makePostgresInitService({
               postgresDir: postgresResolution.path,
               dbPort: config.dbPort,
+              autoExposeNewTables: config.postgres.autoExposeNewTables,
             }),
             enabled: true,
           });
diff --git a/packages/stack/src/StackBuilder.unit.test.ts b/packages/stack/src/StackBuilder.unit.test.ts
index 81673564fa..953fd7c01a 100644
--- a/packages/stack/src/StackBuilder.unit.test.ts
+++ b/packages/stack/src/StackBuilder.unit.test.ts
@@ -56,6 +56,7 @@ const baseConfig: ResolvedStackConfig = {
     port: 5432,
     dataDir: "/tmp/pg-data",
     version: DEFAULT_VERSIONS.postgres,
+    autoExposeNewTables: true,
   },
   postgrest: {
     port: 3001,
diff --git a/packages/stack/src/StackLifecycleCoordinator.ts b/packages/stack/src/StackLifecycleCoordinator.ts
index f2e21ec86f..0a8ba5bee1 100644
--- a/packages/stack/src/StackLifecycleCoordinator.ts
+++ b/packages/stack/src/StackLifecycleCoordinator.ts
@@ -340,7 +340,15 @@ export class StackLifecycleCoordinator extends Context.Service<
               prepared,
             );
 
-            yield* metadataPersistence.persistCleanupTargets(cleanupTargets);
+            yield* metadataPersistence.persistCleanupTargets(cleanupTargets).pipe(
+              Effect.mapError(
+                (cause) =>
+                  new StackBuildError({
+                    detail: "Failed to persist stack cleanup metadata",
+                    cause,
+                  }),
+              ),
+            );
 
             const orchLayer = Orchestrator.layer(graph).pipe(
               Layer.provide(Layer.succeed(LogBuffer, logBuffer)),
diff --git a/packages/stack/src/StackMetadataPersistence.ts b/packages/stack/src/StackMetadataPersistence.ts
index 10ec0e8df2..2c5921331d 100644
--- a/packages/stack/src/StackMetadataPersistence.ts
+++ b/packages/stack/src/StackMetadataPersistence.ts
@@ -1,11 +1,19 @@
 import { Effect, Layer, Context } from "effect";
 import type { CleanupTargets } from "./CleanupTargets.ts";
-import { StateManager } from "./StateManager.ts";
+import {
+  StateManager,
+  type InvalidStackMetadataError,
+  type UnsupportedStackMetadataVersionError,
+} from "./StateManager.ts";
+
+type PersistCleanupTargetsError = InvalidStackMetadataError | UnsupportedStackMetadataVersionError;
 
 export class StackMetadataPersistence extends Context.Service<
   StackMetadataPersistence,
   {
-    readonly persistCleanupTargets: (cleanupTargets: CleanupTargets) => Effect.Effect<void>;
+    readonly persistCleanupTargets: (
+      cleanupTargets: CleanupTargets,
+    ) => Effect.Effect<void, PersistCleanupTargetsError>;
   }
 >()("stack/StackMetadataPersistence") {
   static noop: Layer.Layer<StackMetadataPersistence> = Layer.succeed(this, {
diff --git a/packages/stack/src/createStack.ts b/packages/stack/src/createStack.ts
index e05a95fa68..0684ac867b 100644
--- a/packages/stack/src/createStack.ts
+++ b/packages/stack/src/createStack.ts
@@ -559,6 +559,7 @@ export async function resolveConfig(
       port: ports.dbPort,
       dataDir: postgresDataDir,
       version: postgresInput.version ?? DEFAULT_VERSIONS.postgres,
+      autoExposeNewTables: postgresInput.autoExposeNewTables ?? true,
     },
     postgrest: resolvePostgrestConfig(postgrestInput, config.postgrest, ports),
     auth: resolveAuthConfig(authInput, config.auth, ports, ports.apiPort),
diff --git a/packages/stack/src/services/postgres-init.ts b/packages/stack/src/services/postgres-init.ts
index 3921df1dbc..694951230d 100644
--- a/packages/stack/src/services/postgres-init.ts
+++ b/packages/stack/src/services/postgres-init.ts
@@ -3,8 +3,28 @@ import type { ServiceDef } from "@supabase/process-compose";
 interface PostgresInitOptions {
   readonly postgresDir: string;
   readonly dbPort: number;
+  /**
+   * When false, append the SQL that Studio runs at cloud project creation to revoke the default
+   * Data API privileges on the `public` schema so newly-created entities require explicit GRANTs.
+   */
+  readonly autoExposeNewTables: boolean;
 }
 
+/**
+ * SQL that matches what Studio runs at cloud project creation when "Default privileges for new
+ * entities" is off. Revokes the default GRANTs installed by the bundled initial schema so new
+ * tables/sequences/functions in `public` owned by `postgres` are not reachable via the Data API
+ * roles without explicit GRANTs.
+ */
+export const REVOKE_DEFAULT_DATA_API_PRIVILEGES_SQL = `
+alter default privileges for role postgres in schema public
+  revoke select, insert, update, delete on tables from anon, authenticated, service_role;
+alter default privileges for role postgres in schema public
+  revoke usage, select on sequences from anon, authenticated, service_role;
+alter default privileges for role postgres in schema public
+  revoke execute on functions from anon, authenticated, service_role;
+`.trim();
+
 export const makePostgresInitService = (opts: PostgresInitOptions): ServiceDef => {
   const pgBinDir = `${opts.postgresDir}/bin`;
   const pgLibDir = `${opts.postgresDir}/lib`;
@@ -13,6 +33,16 @@ export const makePostgresInitService = (opts: PostgresInitOptions): ServiceDef =
   const psql = `${pgBinDir}/psql -h 127.0.0.1 -p ${opts.dbPort}`;
   const psqlOpts = `-v ON_ERROR_STOP=1 --no-password --no-psqlrc`;
 
+  const revokeStep = opts.autoExposeNewTables
+    ? ""
+    : `
+  # Revoke default privileges for the Data API roles on schema public so new tables
+  # require explicit GRANTs. Mirrors Studio's behaviour at cloud project creation.
+  ${psql} ${psqlOpts} -U postgres -d postgres <<'EOSQL'
+${REVOKE_DEFAULT_DATA_API_PRIVILEGES_SQL}
+EOSQL
+`;
+
   // Replaces calling migrate.sh (which spawns ~57 separate psql processes) with
   // chained -f flags that run all SQL files in a single psql session, cutting
   // postgres-init time from ~5s to ~1s.
@@ -61,7 +91,7 @@ EOSQL
 
   # Reset stats (non-fatal, matches migrate.sh)
   ${psql} ${psqlOpts} -U supabase_admin -d postgres -c 'SELECT extensions.pg_stat_statements_reset(); SELECT pg_stat_reset();' || true
-fi
+${revokeStep}fi
 
 # Backfill schemas/databases used by docker-backed auxiliary services.
 ${psql} ${psqlOpts} -U postgres -d postgres <<'EOSQL'
diff --git a/packages/stack/src/services/services.unit.test.ts b/packages/stack/src/services/services.unit.test.ts
index a2b65700bf..6ddb1354c7 100644
--- a/packages/stack/src/services/services.unit.test.ts
+++ b/packages/stack/src/services/services.unit.test.ts
@@ -7,7 +7,10 @@ import { makeAuthServiceNative, makeAuthServiceDocker } from "./auth.ts";
 import { makeEdgeRuntimeServiceDocker, makeEdgeRuntimeServiceNative } from "./edge-runtime.ts";
 import { makeImgproxyServiceDocker } from "./imgproxy.ts";
 import { makeMailpitServiceDocker } from "./mailpit.ts";
-import { makePostgresInitService } from "./postgres-init.ts";
+import {
+  makePostgresInitService,
+  REVOKE_DEFAULT_DATA_API_PRIVILEGES_SQL,
+} from "./postgres-init.ts";
 import { makePostgresService, makePostgresServiceDocker } from "./postgres.ts";
 import { makePostgrestService } from "./postgrest.ts";
 import { makePoolerServiceDocker, poolerContainerPorts } from "./pooler.ts";
@@ -370,6 +373,7 @@ describe("makePostgresInitService", () => {
     const def = makePostgresInitService({
       postgresDir: POSTGRES_BIN_PATH,
       dbPort: DB_PORT,
+      autoExposeNewTables: true,
     });
 
     expect(def.name).toBe("postgres-init");
@@ -387,6 +391,7 @@ describe("makePostgresInitService", () => {
     const def = makePostgresInitService({
       postgresDir: POSTGRES_BIN_PATH,
       dbPort: DB_PORT,
+      autoExposeNewTables: true,
     });
     const script = def.args?.[1] as string;
     expect(script).not.toContain("set -e");
@@ -396,6 +401,7 @@ describe("makePostgresInitService", () => {
     const def = makePostgresInitService({
       postgresDir: "/cache/postgres/17/darwin-arm64",
       dbPort: DB_PORT,
+      autoExposeNewTables: true,
     });
     const script = def.args?.[1] as string;
     expect(script).toContain("authenticator");
@@ -406,6 +412,7 @@ describe("makePostgresInitService", () => {
     const def = makePostgresInitService({
       postgresDir: "/cache/postgres/17/darwin-arm64",
       dbPort: DB_PORT,
+      autoExposeNewTables: true,
     });
     const script = def.args?.[1] as string;
 
@@ -420,6 +427,7 @@ describe("makePostgresInitService", () => {
     const def = makePostgresInitService({
       postgresDir: "/cache/postgres/17/darwin-arm64",
       dbPort: DB_PORT,
+      autoExposeNewTables: true,
     });
     const script = def.args?.[1] as string;
     expect(script).not.toMatch(/sh .+migrate\.sh/);
@@ -427,6 +435,34 @@ describe("makePostgresInitService", () => {
     expect(script).toContain("init-scripts/*.sql");
     expect(script).toContain("migrations/*.sql");
   });
+
+  it("does not revoke default Data API privileges when autoExposeNewTables is true", () => {
+    const def = makePostgresInitService({
+      postgresDir: POSTGRES_BIN_PATH,
+      dbPort: DB_PORT,
+      autoExposeNewTables: true,
+    });
+    const script = def.args?.[1] as string;
+    expect(script).not.toContain("alter default privileges");
+    expect(script).not.toContain("revoke select, insert, update, delete on tables");
+  });
+
+  it("revokes default Data API privileges on `public` when autoExposeNewTables is false", () => {
+    const def = makePostgresInitService({
+      postgresDir: POSTGRES_BIN_PATH,
+      dbPort: DB_PORT,
+      autoExposeNewTables: false,
+    });
+    const script = def.args?.[1] as string;
+    expect(script).toContain(REVOKE_DEFAULT_DATA_API_PRIVILEGES_SQL);
+    expect(script).toContain(
+      "revoke select, insert, update, delete on tables from anon, authenticated, service_role",
+    );
+    expect(script).toContain(
+      "revoke usage, select on sequences from anon, authenticated, service_role",
+    );
+    expect(script).toContain("revoke execute on functions from anon, authenticated, service_role");
+  });
 });
 
 describe("docker-backed auxiliary services", () => {
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index da3dd252eb..3e408d7ab9 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -7,26 +7,26 @@ settings:
 catalogs:
   default:
     '@effect/atom-react':
-      specifier: 4.0.0-beta.67
-      version: 4.0.0-beta.67
+      specifier: 4.0.0-beta.74
+      version: 4.0.0-beta.74
     '@effect/platform-bun':
-      specifier: 4.0.0-beta.67
-      version: 4.0.0-beta.67
+      specifier: 4.0.0-beta.74
+      version: 4.0.0-beta.74
     '@effect/platform-node':
-      specifier: 4.0.0-beta.67
-      version: 4.0.0-beta.67
+      specifier: 4.0.0-beta.74
+      version: 4.0.0-beta.74
     '@effect/vitest':
-      specifier: ^4.0.0-beta.43
-      version: 4.0.0-beta.43
+      specifier: ^4.0.0-beta.74
+      version: 4.0.0-beta.74
     '@nx/devkit':
-      specifier: ^22.7.2
-      version: 22.7.2
+      specifier: ^22.7.5
+      version: 22.7.5
     '@swc-node/register':
       specifier: ^1.10.9
       version: 1.11.1
     '@swc/core':
-      specifier: ^1.15.33
-      version: 1.15.33
+      specifier: ^1.15.40
+      version: 1.15.40
     '@tsconfig/bun':
       specifier: ^1.0.10
       version: 1.0.10
@@ -34,32 +34,32 @@ catalogs:
       specifier: ^1.3.14
       version: 1.3.14
     '@typescript/native-preview':
-      specifier: 7.0.0-dev.20260518.1
-      version: 7.0.0-dev.20260518.1
+      specifier: 7.0.0-dev.20260527.2
+      version: 7.0.0-dev.20260527.2
     '@vitest/coverage-istanbul':
-      specifier: ^4.1.6
-      version: 4.1.6
+      specifier: ^4.1.7
+      version: 4.1.7
     effect:
-      specifier: 4.0.0-beta.67
-      version: 4.0.0-beta.67
+      specifier: 4.0.0-beta.74
+      version: 4.0.0-beta.74
     knip:
-      specifier: ^6.14.1
-      version: 6.14.1
+      specifier: ^6.14.2
+      version: 6.14.2
     nx:
-      specifier: ^22.7.2
-      version: 22.7.2
+      specifier: ^22.7.5
+      version: 22.7.5
     oxfmt:
-      specifier: ^0.50.0
-      version: 0.50.0
+      specifier: ^0.52.0
+      version: 0.52.0
     oxlint:
-      specifier: ^1.65.0
-      version: 1.65.0
+      specifier: ^1.67.0
+      version: 1.67.0
     oxlint-tsgolint:
       specifier: ^0.23.0
       version: 0.23.0
     vitest:
-      specifier: ^4.1.6
-      version: 4.1.6
+      specifier: ^4.1.7
+      version: 4.1.7
 
 importers:
 
@@ -67,16 +67,16 @@ importers:
     devDependencies:
       '@swc-node/register':
         specifier: 'catalog:'
-        version: 1.11.1(@emnapi/core@1.10.0)(@emnapi/runtime@1.10.0)(@swc/core@1.15.33)(@swc/types@0.1.26)(typescript@6.0.3)
+        version: 1.11.1(@emnapi/core@1.10.0)(@emnapi/runtime@1.10.0)(@swc/core@1.15.40)(@swc/types@0.1.26)(typescript@6.0.3)
       '@swc/core':
         specifier: 'catalog:'
-        version: 1.15.33
+        version: 1.15.40
       nx:
         specifier: 'catalog:'
-        version: 22.7.2(@swc-node/register@1.11.1(@emnapi/core@1.10.0)(@emnapi/runtime@1.10.0)(@swc/core@1.15.33)(@swc/types@0.1.26)(typescript@6.0.3))(@swc/core@1.15.33)
+        version: 22.7.5(@swc-node/register@1.11.1(@emnapi/core@1.10.0)(@emnapi/runtime@1.10.0)(@swc/core@1.15.40)(@swc/types@0.1.26)(typescript@6.0.3))(@swc/core@1.15.40)
       verdaccio:
-        specifier: ^6.7.1
-        version: 6.7.1(typanion@3.14.0)
+        specifier: ^6.7.2
+        version: 6.7.2(typanion@3.14.0)
 
   apps/cli:
     devDependencies:
@@ -85,13 +85,13 @@ importers:
         version: 1.4.0
       '@effect/atom-react':
         specifier: 'catalog:'
-        version: 4.0.0-beta.67(effect@4.0.0-beta.67)(react@19.2.6)(scheduler@0.27.0)
+        version: 4.0.0-beta.74(effect@4.0.0-beta.74)(react@19.2.6)(scheduler@0.27.0)
       '@effect/platform-bun':
         specifier: 'catalog:'
-        version: 4.0.0-beta.67(effect@4.0.0-beta.67)
+        version: 4.0.0-beta.74(effect@4.0.0-beta.74)
       '@effect/vitest':
         specifier: 'catalog:'
-        version: 4.0.0-beta.43(effect@4.0.0-beta.67)(vitest@4.1.6)
+        version: 4.0.0-beta.74(effect@4.0.0-beta.74)(vitest@4.1.7)
       '@napi-rs/keyring':
         specifier: ^1.3.0
         version: 1.3.0
@@ -117,41 +117,44 @@ importers:
         specifier: 'catalog:'
         version: 1.3.14
       '@types/react':
-        specifier: ^19.2.14
-        version: 19.2.14
+        specifier: ^19.2.15
+        version: 19.2.15
       '@typescript/native-preview':
         specifier: 'catalog:'
-        version: 7.0.0-dev.20260518.1
+        version: 7.0.0-dev.20260527.2
       '@vercel/detect-agent':
         specifier: ^1.2.3
         version: 1.2.3
       '@vitest/coverage-istanbul':
         specifier: 'catalog:'
-        version: 4.1.6(vitest@4.1.6)
+        version: 4.1.7(vitest@4.1.7)
+      dotenv:
+        specifier: ^17.4.2
+        version: 17.4.2
       effect:
         specifier: 'catalog:'
-        version: 4.0.0-beta.67
+        version: 4.0.0-beta.74
       ink:
-        specifier: ^7.0.3
-        version: 7.0.3(@types/react@19.2.14)(react-devtools-core@7.0.1)(react@19.2.6)
+        specifier: ^7.0.4
+        version: 7.0.4(@types/react@19.2.15)(react-devtools-core@7.0.1)(react@19.2.6)
       ink-spinner:
         specifier: ^5.0.0
-        version: 5.0.0(ink@7.0.3(@types/react@19.2.14)(react-devtools-core@7.0.1)(react@19.2.6))(react@19.2.6)
+        version: 5.0.0(ink@7.0.4(@types/react@19.2.15)(react-devtools-core@7.0.1)(react@19.2.6))(react@19.2.6)
       knip:
         specifier: 'catalog:'
-        version: 6.14.1(@emnapi/core@1.10.0)(@emnapi/runtime@1.10.0)
+        version: 6.14.2(@emnapi/core@1.10.0)(@emnapi/runtime@1.10.0)
       oxfmt:
         specifier: 'catalog:'
-        version: 0.50.0
+        version: 0.52.0
       oxlint:
         specifier: 'catalog:'
-        version: 1.65.0(oxlint-tsgolint@0.23.0)
+        version: 1.67.0(oxlint-tsgolint@0.23.0)
       oxlint-tsgolint:
         specifier: 'catalog:'
         version: 0.23.0
       posthog-node:
-        specifier: ^5.34.3
-        version: 5.34.3
+        specifier: ^5.35.5
+        version: 5.35.5
       react:
         specifier: ^19.2.6
         version: 19.2.6
@@ -159,11 +162,17 @@ importers:
         specifier: ^7.0.1
         version: 7.0.1
       semantic-release:
-        specifier: ^24.2.9
-        version: 24.2.9(typescript@6.0.3)
+        specifier: ^25.0.3
+        version: 25.0.3(typescript@6.0.3)
+      smol-toml:
+        specifier: ^1.6.1
+        version: 1.6.1
       vitest:
         specifier: 'catalog:'
-        version: 4.1.6(@types/node@25.8.0)(@vitest/coverage-istanbul@4.1.6)(vite@8.0.2(@emnapi/core@1.10.0)(@emnapi/runtime@1.10.0)(@types/node@25.8.0)(esbuild@0.27.4)(jiti@2.7.0)(yaml@2.9.0))
+        version: 4.1.7(@types/node@25.9.1)(@vitest/coverage-istanbul@4.1.7)(vite@8.0.2(@emnapi/core@1.10.0)(@emnapi/runtime@1.10.0)(@types/node@25.9.1)(esbuild@0.27.4)(jiti@2.7.0)(yaml@2.9.0))
+      yaml:
+        specifier: ^2.9.0
+        version: 2.9.0
     optionalDependencies:
       '@supabase/cli-darwin-arm64':
         specifier: workspace:*
@@ -204,37 +213,37 @@ importers:
         version: 1.3.14
       '@typescript/native-preview':
         specifier: 'catalog:'
-        version: 7.0.0-dev.20260518.1
+        version: 7.0.0-dev.20260527.2
       '@vitest/coverage-istanbul':
         specifier: 'catalog:'
-        version: 4.1.6(vitest@4.1.6)
+        version: 4.1.7(vitest@4.1.7)
       knip:
         specifier: 'catalog:'
-        version: 6.14.1(@emnapi/core@1.10.0)(@emnapi/runtime@1.10.0)
+        version: 6.14.2(@emnapi/core@1.10.0)(@emnapi/runtime@1.10.0)
       oxfmt:
         specifier: 'catalog:'
-        version: 0.50.0
+        version: 0.52.0
       oxlint:
         specifier: 'catalog:'
-        version: 1.65.0(oxlint-tsgolint@0.23.0)
+        version: 1.67.0(oxlint-tsgolint@0.23.0)
       oxlint-tsgolint:
         specifier: 'catalog:'
         version: 0.23.0
       vitest:
         specifier: 'catalog:'
-        version: 4.1.6(@types/node@25.8.0)(@vitest/coverage-istanbul@4.1.6)(vite@8.0.2(@emnapi/core@1.10.0)(@emnapi/runtime@1.10.0)(@types/node@25.8.0)(esbuild@0.27.4)(jiti@2.7.0)(yaml@2.9.0))
+        version: 4.1.7(@types/node@25.9.1)(@vitest/coverage-istanbul@4.1.7)(vite@8.0.2(@emnapi/core@1.10.0)(@emnapi/runtime@1.10.0)(@types/node@25.9.1)(esbuild@0.27.4)(jiti@2.7.0)(yaml@2.9.0))
 
   apps/docs:
     dependencies:
       fumadocs-core:
-        specifier: ^16.8.11
-        version: 16.8.11(@mdx-js/mdx@3.1.1)(@types/estree-jsx@1.0.5)(@types/hast@3.0.4)(@types/mdast@4.0.4)(@types/react@19.2.14)(lucide-react@1.16.0(react@19.2.6))(next@16.2.6(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)(zod@4.4.3)
+        specifier: ^16.9.1
+        version: 16.9.1(@mdx-js/mdx@3.1.1)(@types/estree-jsx@1.0.5)(@types/hast@3.0.4)(@types/mdast@4.0.4)(@types/react@19.2.15)(lucide-react@1.16.0(react@19.2.6))(next@16.2.6(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)(zod@4.4.3)
       fumadocs-mdx:
-        specifier: ^15.0.6
-        version: 15.0.6(@types/mdast@4.0.4)(@types/mdx@2.0.13)(@types/react@19.2.14)(fumadocs-core@16.8.11(@mdx-js/mdx@3.1.1)(@types/estree-jsx@1.0.5)(@types/hast@3.0.4)(@types/mdast@4.0.4)(@types/react@19.2.14)(lucide-react@1.16.0(react@19.2.6))(next@16.2.6(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)(zod@4.4.3))(next@16.2.6(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react@19.2.6)(vite@8.0.2(@emnapi/core@1.10.0)(@emnapi/runtime@1.10.0)(@types/node@25.8.0)(esbuild@0.27.4)(jiti@2.7.0)(yaml@2.9.0))
+        specifier: ^15.0.9
+        version: 15.0.9(@types/mdast@4.0.4)(@types/mdx@2.0.13)(@types/react@19.2.15)(fumadocs-core@16.9.1(@mdx-js/mdx@3.1.1)(@types/estree-jsx@1.0.5)(@types/hast@3.0.4)(@types/mdast@4.0.4)(@types/react@19.2.15)(lucide-react@1.16.0(react@19.2.6))(next@16.2.6(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)(zod@4.4.3))(next@16.2.6(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react@19.2.6)(vite@8.0.2(@emnapi/core@1.10.0)(@emnapi/runtime@1.10.0)(@types/node@25.9.1)(esbuild@0.27.4)(jiti@2.7.0)(yaml@2.9.0))
       fumadocs-ui:
-        specifier: ^16.8.11
-        version: 16.8.11(@types/mdx@2.0.13)(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(fumadocs-core@16.8.11(@mdx-js/mdx@3.1.1)(@types/estree-jsx@1.0.5)(@types/hast@3.0.4)(@types/mdast@4.0.4)(@types/react@19.2.14)(lucide-react@1.16.0(react@19.2.6))(next@16.2.6(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)(zod@4.4.3))(next@16.2.6(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+        specifier: ^16.9.1
+        version: 16.9.1(@types/mdx@2.0.13)(@types/react-dom@19.2.3(@types/react@19.2.15))(@types/react@19.2.15)(fumadocs-core@16.9.1(@mdx-js/mdx@3.1.1)(@types/estree-jsx@1.0.5)(@types/hast@3.0.4)(@types/mdast@4.0.4)(@types/react@19.2.15)(lucide-react@1.16.0(react@19.2.6))(next@16.2.6(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)(zod@4.4.3))(next@16.2.6(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
       next:
         specifier: ^16.2.6
         version: 16.2.6(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
@@ -249,14 +258,14 @@ importers:
         specifier: ^2.0.13
         version: 2.0.13
       '@types/node':
-        specifier: ^25.8.0
-        version: 25.8.0
+        specifier: ^25.9.1
+        version: 25.9.1
       '@types/react':
-        specifier: ^19.1.8
-        version: 19.2.14
+        specifier: ^19.2.15
+        version: 19.2.15
       '@types/react-dom':
         specifier: ^19.1.6
-        version: 19.2.3(@types/react@19.2.14)
+        version: 19.2.3(@types/react@19.2.15)
       typescript:
         specifier: ^6.0.3
         version: 6.0.3
@@ -265,13 +274,13 @@ importers:
     dependencies:
       '@effect/platform-bun':
         specifier: 'catalog:'
-        version: 4.0.0-beta.67(effect@4.0.0-beta.67)
+        version: 4.0.0-beta.74(effect@4.0.0-beta.74)
       '@effect/platform-node':
         specifier: 'catalog:'
-        version: 4.0.0-beta.67(effect@4.0.0-beta.67)(ioredis@5.10.1)
+        version: 4.0.0-beta.74(effect@4.0.0-beta.74)(ioredis@5.10.1)
       effect:
         specifier: 'catalog:'
-        version: 4.0.0-beta.67
+        version: 4.0.0-beta.74
       undici:
         specifier: ^8.3.0
         version: 8.3.0
@@ -284,25 +293,25 @@ importers:
         version: 1.3.14
       '@typescript/native-preview':
         specifier: 'catalog:'
-        version: 7.0.0-dev.20260518.1
+        version: 7.0.0-dev.20260527.2
       '@vitest/coverage-istanbul':
         specifier: 'catalog:'
-        version: 4.1.6(vitest@4.1.6)
+        version: 4.1.7(vitest@4.1.7)
       knip:
         specifier: 'catalog:'
-        version: 6.14.1(@emnapi/core@1.10.0)(@emnapi/runtime@1.10.0)
+        version: 6.14.2(@emnapi/core@1.10.0)(@emnapi/runtime@1.10.0)
       oxfmt:
         specifier: 'catalog:'
-        version: 0.50.0
+        version: 0.52.0
       oxlint:
         specifier: 'catalog:'
-        version: 1.65.0(oxlint-tsgolint@0.23.0)
+        version: 1.67.0(oxlint-tsgolint@0.23.0)
       oxlint-tsgolint:
         specifier: 'catalog:'
         version: 0.23.0
       vitest:
         specifier: 'catalog:'
-        version: 4.1.6(@types/node@25.8.0)(@vitest/coverage-istanbul@4.1.6)(vite@8.0.2(@emnapi/core@1.10.0)(@emnapi/runtime@1.10.0)(@types/node@25.8.0)(esbuild@0.27.4)(jiti@2.7.0)(yaml@2.9.0))
+        version: 4.1.7(@types/node@25.9.1)(@vitest/coverage-istanbul@4.1.7)(vite@8.0.2(@emnapi/core@1.10.0)(@emnapi/runtime@1.10.0)(@types/node@25.9.1)(esbuild@0.27.4)(jiti@2.7.0)(yaml@2.9.0))
 
   packages/cli-darwin-arm64: {}
 
@@ -326,25 +335,25 @@ importers:
         version: 1.3.14
       '@typescript/native-preview':
         specifier: 'catalog:'
-        version: 7.0.0-dev.20260518.1
+        version: 7.0.0-dev.20260527.2
       '@vitest/coverage-istanbul':
         specifier: 'catalog:'
-        version: 4.1.6(vitest@4.1.6)
+        version: 4.1.7(vitest@4.1.7)
       knip:
         specifier: 'catalog:'
-        version: 6.14.1(@emnapi/core@1.10.0)(@emnapi/runtime@1.10.0)
+        version: 6.14.2(@emnapi/core@1.10.0)(@emnapi/runtime@1.10.0)
       oxfmt:
         specifier: 'catalog:'
-        version: 0.50.0
+        version: 0.52.0
       oxlint:
         specifier: 'catalog:'
-        version: 1.65.0(oxlint-tsgolint@0.23.0)
+        version: 1.67.0(oxlint-tsgolint@0.23.0)
       oxlint-tsgolint:
         specifier: 'catalog:'
         version: 0.23.0
       vitest:
         specifier: 'catalog:'
-        version: 4.1.6(@types/node@25.8.0)(@vitest/coverage-istanbul@4.1.6)(vite@8.0.2(@emnapi/core@1.10.0)(@emnapi/runtime@1.10.0)(@types/node@25.8.0)(esbuild@0.27.4)(jiti@2.7.0)(yaml@2.9.0))
+        version: 4.1.7(@types/node@25.9.1)(@vitest/coverage-istanbul@4.1.7)(vite@8.0.2(@emnapi/core@1.10.0)(@emnapi/runtime@1.10.0)(@types/node@25.9.1)(esbuild@0.27.4)(jiti@2.7.0)(yaml@2.9.0))
 
   packages/cli-windows-arm64: {}
 
@@ -354,16 +363,16 @@ importers:
     dependencies:
       '@effect/platform-bun':
         specifier: 'catalog:'
-        version: 4.0.0-beta.67(effect@4.0.0-beta.67)
+        version: 4.0.0-beta.74(effect@4.0.0-beta.74)
       '@effect/platform-node':
         specifier: 'catalog:'
-        version: 4.0.0-beta.67(effect@4.0.0-beta.67)(ioredis@5.10.1)
+        version: 4.0.0-beta.74(effect@4.0.0-beta.74)(ioredis@5.10.1)
       dedent:
         specifier: ^1.7.2
         version: 1.7.2
       effect:
         specifier: 'catalog:'
-        version: 4.0.0-beta.67
+        version: 4.0.0-beta.74
       smol-toml:
         specifier: ^1.6.1
         version: 1.6.1
@@ -376,38 +385,38 @@ importers:
         version: 1.3.14
       '@typescript/native-preview':
         specifier: 'catalog:'
-        version: 7.0.0-dev.20260518.1
+        version: 7.0.0-dev.20260527.2
       '@vitest/coverage-istanbul':
         specifier: 'catalog:'
-        version: 4.1.6(vitest@4.1.6)
+        version: 4.1.7(vitest@4.1.7)
       knip:
         specifier: 'catalog:'
-        version: 6.14.1(@emnapi/core@1.10.0)(@emnapi/runtime@1.10.0)
+        version: 6.14.2(@emnapi/core@1.10.0)(@emnapi/runtime@1.10.0)
       oxfmt:
         specifier: 'catalog:'
-        version: 0.50.0
+        version: 0.52.0
       oxlint:
         specifier: 'catalog:'
-        version: 1.65.0(oxlint-tsgolint@0.23.0)
+        version: 1.67.0(oxlint-tsgolint@0.23.0)
       oxlint-tsgolint:
         specifier: 'catalog:'
         version: 0.23.0
       vitest:
         specifier: 'catalog:'
-        version: 4.1.6(@types/node@25.8.0)(@vitest/coverage-istanbul@4.1.6)(vite@8.0.2(@emnapi/core@1.10.0)(@emnapi/runtime@1.10.0)(@types/node@25.8.0)(esbuild@0.27.4)(jiti@2.7.0)(yaml@2.9.0))
+        version: 4.1.7(@types/node@25.9.1)(@vitest/coverage-istanbul@4.1.7)(vite@8.0.2(@emnapi/core@1.10.0)(@emnapi/runtime@1.10.0)(@types/node@25.9.1)(esbuild@0.27.4)(jiti@2.7.0)(yaml@2.9.0))
 
   packages/process-compose:
     dependencies:
       '@effect/platform-bun':
         specifier: 'catalog:'
-        version: 4.0.0-beta.67(effect@4.0.0-beta.67)
+        version: 4.0.0-beta.74(effect@4.0.0-beta.74)
       effect:
         specifier: 'catalog:'
-        version: 4.0.0-beta.67
+        version: 4.0.0-beta.74
     devDependencies:
       '@effect/vitest':
         specifier: 'catalog:'
-        version: 4.0.0-beta.43(effect@4.0.0-beta.67)(vitest@4.1.6)
+        version: 4.0.0-beta.74(effect@4.0.0-beta.74)(vitest@4.1.7)
       '@tsconfig/bun':
         specifier: 'catalog:'
         version: 1.0.10
@@ -416,34 +425,34 @@ importers:
         version: 1.3.14
       '@typescript/native-preview':
         specifier: 'catalog:'
-        version: 7.0.0-dev.20260518.1
+        version: 7.0.0-dev.20260527.2
       '@vitest/coverage-istanbul':
         specifier: 'catalog:'
-        version: 4.1.6(vitest@4.1.6)
+        version: 4.1.7(vitest@4.1.7)
       knip:
         specifier: 'catalog:'
-        version: 6.14.1(@emnapi/core@1.10.0)(@emnapi/runtime@1.10.0)
+        version: 6.14.2(@emnapi/core@1.10.0)(@emnapi/runtime@1.10.0)
       oxfmt:
         specifier: 'catalog:'
-        version: 0.50.0
+        version: 0.52.0
       oxlint:
         specifier: 'catalog:'
-        version: 1.65.0(oxlint-tsgolint@0.23.0)
+        version: 1.67.0(oxlint-tsgolint@0.23.0)
       oxlint-tsgolint:
         specifier: 'catalog:'
         version: 0.23.0
       vitest:
         specifier: 'catalog:'
-        version: 4.1.6(@types/node@25.8.0)(@vitest/coverage-istanbul@4.1.6)(vite@8.0.2(@emnapi/core@1.10.0)(@emnapi/runtime@1.10.0)(@types/node@25.8.0)(esbuild@0.27.4)(jiti@2.7.0)(yaml@2.9.0))
+        version: 4.1.7(@types/node@25.9.1)(@vitest/coverage-istanbul@4.1.7)(vite@8.0.2(@emnapi/core@1.10.0)(@emnapi/runtime@1.10.0)(@types/node@25.9.1)(esbuild@0.27.4)(jiti@2.7.0)(yaml@2.9.0))
 
   packages/stack:
     dependencies:
       '@effect/platform-bun':
         specifier: 'catalog:'
-        version: 4.0.0-beta.67(effect@4.0.0-beta.67)
+        version: 4.0.0-beta.74(effect@4.0.0-beta.74)
       '@effect/platform-node':
         specifier: 'catalog:'
-        version: 4.0.0-beta.67(effect@4.0.0-beta.67)(ioredis@5.10.1)
+        version: 4.0.0-beta.74(effect@4.0.0-beta.74)(ioredis@5.10.1)
       '@supabase/config':
         specifier: workspace:*
         version: link:../config
@@ -452,14 +461,14 @@ importers:
         version: link:../process-compose
       effect:
         specifier: 'catalog:'
-        version: 4.0.0-beta.67
+        version: 4.0.0-beta.74
     devDependencies:
       '@effect/vitest':
         specifier: 'catalog:'
-        version: 4.0.0-beta.43(effect@4.0.0-beta.67)(vitest@4.1.6)
+        version: 4.0.0-beta.74(effect@4.0.0-beta.74)(vitest@4.1.7)
       '@supabase/supabase-js':
-        specifier: ^2.105.4
-        version: 2.105.4
+        specifier: ^2.106.2
+        version: 2.106.2
       '@tsconfig/bun':
         specifier: 'catalog:'
         version: 1.0.10
@@ -468,43 +477,55 @@ importers:
         version: 1.3.14
       '@typescript/native-preview':
         specifier: 'catalog:'
-        version: 7.0.0-dev.20260518.1
+        version: 7.0.0-dev.20260527.2
       '@vitest/coverage-istanbul':
         specifier: 'catalog:'
-        version: 4.1.6(vitest@4.1.6)
+        version: 4.1.7(vitest@4.1.7)
       knip:
         specifier: 'catalog:'
-        version: 6.14.1(@emnapi/core@1.10.0)(@emnapi/runtime@1.10.0)
+        version: 6.14.2(@emnapi/core@1.10.0)(@emnapi/runtime@1.10.0)
       oxfmt:
         specifier: 'catalog:'
-        version: 0.50.0
+        version: 0.52.0
       oxlint:
         specifier: 'catalog:'
-        version: 1.65.0(oxlint-tsgolint@0.23.0)
+        version: 1.67.0(oxlint-tsgolint@0.23.0)
       oxlint-tsgolint:
         specifier: 'catalog:'
         version: 0.23.0
       vitest:
         specifier: 'catalog:'
-        version: 4.1.6(@types/node@25.8.0)(@vitest/coverage-istanbul@4.1.6)(vite@8.0.2(@emnapi/core@1.10.0)(@emnapi/runtime@1.10.0)(@types/node@25.8.0)(esbuild@0.27.4)(jiti@2.7.0)(yaml@2.9.0))
+        version: 4.1.7(@types/node@25.9.1)(@vitest/coverage-istanbul@4.1.7)(vite@8.0.2(@emnapi/core@1.10.0)(@emnapi/runtime@1.10.0)(@types/node@25.9.1)(esbuild@0.27.4)(jiti@2.7.0)(yaml@2.9.0))
 
   tools/nx-plugins:
     dependencies:
       '@nx/devkit':
         specifier: 'catalog:'
-        version: 22.7.2(nx@22.7.2(@swc-node/register@1.11.1(@emnapi/core@1.10.0)(@emnapi/runtime@1.10.0)(@swc/core@1.15.33)(@swc/types@0.1.26)(typescript@6.0.3))(@swc/core@1.15.33))
+        version: 22.7.5(nx@22.7.5(@swc-node/register@1.11.1(@emnapi/core@1.10.0)(@emnapi/runtime@1.10.0)(@swc/core@1.15.40)(@swc/types@0.1.26)(typescript@6.0.3))(@swc/core@1.15.40))
       vitest:
         specifier: 'catalog:'
-        version: 4.1.6(@types/node@25.8.0)(@vitest/coverage-istanbul@4.1.6)(vite@8.0.2(@emnapi/core@1.10.0)(@emnapi/runtime@1.10.0)(@types/node@25.8.0)(esbuild@0.27.4)(jiti@2.7.0)(yaml@2.9.0))
+        version: 4.1.7(@types/node@25.9.1)(@vitest/coverage-istanbul@4.1.7)(vite@8.0.2(@emnapi/core@1.10.0)(@emnapi/runtime@1.10.0)(@types/node@25.9.1)(esbuild@0.27.4)(jiti@2.7.0)(yaml@2.9.0))
 
 packages:
 
+  '@actions/core@3.0.1':
+    resolution: {integrity: sha512-a6d/Nwahm9fliVGRhdhofo40HjHQasUPusmc7vBfyky+7Z+P2A1J68zyFVaNcEclc/Se+eO595oAr5nwEIoIUA==}
+
+  '@actions/exec@3.0.0':
+    resolution: {integrity: sha512-6xH/puSoNBXb72VPlZVm7vQ+svQpFyA96qdDBvhB8eNZOE8LtPf9L4oAsfzK/crCL8YZ+19fKYVnM63Sl+Xzlw==}
+
+  '@actions/http-client@4.0.1':
+    resolution: {integrity: sha512-+Nvd1ImaOZBSoPbsUtEhv+1z99H12xzncCkz0a3RuehINE81FZSe2QTj3uvAPTcJX/SCzUQHQ0D1GrPMbrPitg==}
+
+  '@actions/io@3.0.2':
+    resolution: {integrity: sha512-nRBchcMM+QK1pdjO7/idu86rbJI5YHUKCvKs0KxnSYbVe3F51UfGxuZX4Qy/fWlp6l7gWFwIkrOzN+oUK03kfw==}
+
   '@alcalzone/ansi-tokenize@0.3.0':
     resolution: {integrity: sha512-p+CMKJ93HFmLkjXKlXiVGlMQEuRb6H0MokBSwUsX+S6BRX8eV5naFZpQJFfJHjRZY0Hmnqy1/r6UWl3x+19zYA==}
     engines: {node: '>=18'}
 
-  '@babel/code-frame@7.29.0':
-    resolution: {integrity: sha512-9NhCeYjq9+3uxgdtp20LSiJXJvN0FeCtNGpJxuMFZ1Kv3cWUNb6DOhJwUvcVCzKGR66cw4njwM6hrJLqgOwbcw==}
+  '@babel/code-frame@7.29.7':
+    resolution: {integrity: sha512-Aup7aUOfpbAUg2ROOJN6Iw5f9DMBlzu0mIkm/malLQFN/YQgO48wCj0Kxa3sEHJvPVFg7siR+qRInwXd2qhQKw==}
     engines: {node: '>=6.9.0'}
 
   '@babel/compat-data@7.29.0':
@@ -541,8 +562,8 @@ packages:
     resolution: {integrity: sha512-qMlSxKbpRlAridDExk92nSobyDdpPijUq2DW6oDnUqd0iOGxmQjyqhMIihI9+zv4LPyZdRje2cavWPbCbWm3eA==}
     engines: {node: '>=6.9.0'}
 
-  '@babel/helper-validator-identifier@7.28.5':
-    resolution: {integrity: sha512-qSs4ifwzKJSV39ucNjsvc6WVHs6b7S03sOh2OcHF9UHfVPqWWALUsNUVzhSBiItjRZoLHx7nIarVjqKVusUZ1Q==}
+  '@babel/helper-validator-identifier@7.29.7':
+    resolution: {integrity: sha512-qehxGkRj55h/ff8EMaJ+cYhyaKlHIxqYDn682wQD7RNp9UujOQsHog2uS0r2vzr4pW+sXf90NeeayjcNaX3fFg==}
     engines: {node: '>=6.9.0'}
 
   '@babel/helper-validator-option@7.27.1':
@@ -586,35 +607,35 @@ packages:
     resolution: {integrity: sha512-hauBrOdvu08vOsagkZ/Aju5XuiZx6ldsLfByg1htFeldhex+PeMrYauANzFsMJeAA0+dyPLbDoX2OYuvVoLDkQ==}
     engines: {node: '>= 6'}
 
-  '@effect/atom-react@4.0.0-beta.67':
-    resolution: {integrity: sha512-8GNRkz3pfiG+jNbbZo8/pQN4TSQEFRNazVEsMshmBlIaWkA1+/EwniiHEnfEqPvl40/wFt4/AXuSFMY8UK9eYg==}
+  '@effect/atom-react@4.0.0-beta.74':
+    resolution: {integrity: sha512-ZuBSclpU6z4w21n7nfaYn/ou10rAnSmuT9zQPUDz8d2gm617c9I5rlF5TfqZNLhRslLyx9NzvObz+avNToxsIA==}
     peerDependencies:
-      effect: ^4.0.0-beta.67
+      effect: ^4.0.0-beta.74
       react: ^19.2.4
       scheduler: '*'
 
-  '@effect/platform-bun@4.0.0-beta.67':
-    resolution: {integrity: sha512-QLmAWufQ5Jnvruqf0YibTFN7ShGMqufELtwTUyXIOmYn3XRZa3/KMbraOIeSBFQA+qhrfHeQsvcDZ9wmQedENQ==}
+  '@effect/platform-bun@4.0.0-beta.74':
+    resolution: {integrity: sha512-HPozsTKom3v8uGITYX+blua0wVSk/I7ak802FoX13t4zWhHfprT8I/A8VBO4SxmcDYb/izABtHBXBgEmp612MA==}
     peerDependencies:
-      effect: ^4.0.0-beta.67
+      effect: ^4.0.0-beta.74
 
-  '@effect/platform-node-shared@4.0.0-beta.67':
-    resolution: {integrity: sha512-h7KyCoD5AMhD4ec0hY3FKuguo1Wsec2B79poifn5+Vd+c1I8pX7urh8cLaIwkrABp2shUQNYEYUAFocSND8LVQ==}
+  '@effect/platform-node-shared@4.0.0-beta.74':
+    resolution: {integrity: sha512-C6C2hXixNcZXLaFF2u7B/FtOsqpdY7luaPuiGFBJza0P7EnYDkwaT3kB6lv7l/qctmkADc24qOsSCWIKRbC4jg==}
     engines: {node: '>=18.0.0'}
     peerDependencies:
-      effect: ^4.0.0-beta.67
+      effect: ^4.0.0-beta.74
 
-  '@effect/platform-node@4.0.0-beta.67':
-    resolution: {integrity: sha512-GbfCE88/jMDlryiCzJg6NdmK2JxrQjN34iLyKFmUXqqSC64GVJyBCx1tpZkvhwQlQelWkcuDvm45kuq8hyuUMw==}
+  '@effect/platform-node@4.0.0-beta.74':
+    resolution: {integrity: sha512-/W16mKqxvhWINLjufzc0log1sl57exXQfwd+em398/zKCbmU3S7snXTDMN6w0ju2TtgK35qrsoGBXEochij6Sg==}
     engines: {node: '>=18.0.0'}
     peerDependencies:
-      effect: ^4.0.0-beta.67
+      effect: ^4.0.0-beta.74
       ioredis: ^5.7.0
 
-  '@effect/vitest@4.0.0-beta.43':
-    resolution: {integrity: sha512-XN2LAwiUWPqbV2jrsYYRjrVydQ8MIgwr83MVImtUaOQco4vk43+8OHlXQMRN/u2HnGK29KT+O2yTMMBdk2Q6Sw==}
+  '@effect/vitest@4.0.0-beta.74':
+    resolution: {integrity: sha512-+SFcjtbboJdWA+cP7JFW7Gp1PL7vj7uqvBnh9xY7JFU8VMsrHN5mblsqE7l7+ZFGpJvBGLgjGrhfe8QZ7f5vgg==}
     peerDependencies:
-      effect: ^4.0.0-beta.43
+      effect: ^4.0.0-beta.74
       vitest: ^3.0.0 || ^4.0.0
 
   '@emnapi/core@1.10.0':
@@ -1343,62 +1364,62 @@ packages:
     resolution: {integrity: sha512-oGB+UxlgWcgQkgwo8GcEGwemoTFt3FIO9ababBmaGwXIoBKZ+GTy0pP185beGg7Llih/NSHSV2XAs1lnznocSg==}
     engines: {node: '>= 8'}
 
-  '@nx/devkit@22.7.2':
-    resolution: {integrity: sha512-oE2SFUxQeZm/EmFABHpWQ4Pi0fBKbJbXKGPvdFaHoMumRxhqBhuBVf/ap5kYFg8Y9bK/zHJkpsEbGyiyRrhvog==}
+  '@nx/devkit@22.7.5':
+    resolution: {integrity: sha512-/63ziS7kdHXYTLLhwWBu9hFwoFFT8xf+PkcQjsNdPqc5JmkYkSew0cE/vp5ORgBpGLWWnFPJgmfqjbJoO2C7jA==}
     peerDependencies:
       nx: '>= 21 <= 23 || ^22.0.0-0'
 
-  '@nx/nx-darwin-arm64@22.7.2':
-    resolution: {integrity: sha512-hu+x/IOzx+18imkFwSdtXnvB6d21qcXvc4bCqcbA9BQcUnvTnw0/11SLoasvDqy/9KLKHDWJAIPttcBkbArWVA==}
+  '@nx/nx-darwin-arm64@22.7.5':
+    resolution: {integrity: sha512-eoPtwx0qZqvRUD+VVOHm150AlSYwYoPxkDHBBGqKCn5nzPspb0lLWw8q83crM/L1M928YgK0WmGf3C++7eqsTA==}
     cpu: [arm64]
     os: [darwin]
 
-  '@nx/nx-darwin-x64@22.7.2':
-    resolution: {integrity: sha512-M4QPs4rjzZN51V7qiKUjJU7hLYtv/h0I/aGUedCQQZibbbDTl45sQlgBQlV/viw2dOw3K5+RxDxtMNFxAbhxQA==}
+  '@nx/nx-darwin-x64@22.7.5':
+    resolution: {integrity: sha512-VLOn/ZoEn3HfjSj+yIHLCM56/el79r+9I28CkZNHaSXJQWZ3edSkcgcfYjVxCurpN2VEwDQHLBeFCH8M+lQ7wQ==}
     cpu: [x64]
     os: [darwin]
 
-  '@nx/nx-freebsd-x64@22.7.2':
-    resolution: {integrity: sha512-tdC2mBQ/ON9qvTs72aL3XVN7B5wd7UsiRJ/qwC2bk/PIpD0vo5c3EwxFyYXfTD60jnlV+CTFxhSVmu8S1pVsfw==}
+  '@nx/nx-freebsd-x64@22.7.5':
+    resolution: {integrity: sha512-LEVer/E2xfGvK9Go+imMQoEninOoq/38Z2bhV1SD3AThXrp1xaLFVkW5jQ6juebeVkAeztEoMLFlr576egS0vw==}
     cpu: [x64]
     os: [freebsd]
 
-  '@nx/nx-linux-arm-gnueabihf@22.7.2':
-    resolution: {integrity: sha512-bBHIC9xZ8L12BWkwMKbRi7+oV4UH1v1Yy8PsIvRfjS7GzYNlOAUMkJxywjF2msnkp8M8Rn29MEvzllZjdyaR7Q==}
+  '@nx/nx-linux-arm-gnueabihf@22.7.5':
+    resolution: {integrity: sha512-NP27EFGpmFJM6RL1Ey/AFJ7gA2xuqtIHaw6jjSNGvfrnZRUNaway30GrVaGGeODf0DsvAty/unqoBMPy6kDHbw==}
     cpu: [arm]
     os: [linux]
 
-  '@nx/nx-linux-arm64-gnu@22.7.2':
-    resolution: {integrity: sha512-MBYG58VUTmLW4S2RlYmXJiV6P0P1lkiZXtiaulZOXmP5uCSXiqMgK47k56hq9GTbtW1SpyGgh02lkNdCYTbmLw==}
+  '@nx/nx-linux-arm64-gnu@22.7.5':
+    resolution: {integrity: sha512-QLnkJl3HkHsPfpLiNiAiMfpfAeFpic0U1diAxF8RqChOkCpQ7ulvyBVgE1UrQxvhd+gFQ3ed5RNDxtCRw8nTiw==}
     cpu: [arm64]
     os: [linux]
     libc: [glibc]
 
-  '@nx/nx-linux-arm64-musl@22.7.2':
-    resolution: {integrity: sha512-Wf4VBSJt5gEGdzX6uzZoITEYB/Y3TxjvPNT11NKfRU/m63b8/D8jCeRmr7cBTaMUlNmdH3Lf3G1PuPNGoEZ0Mg==}
+  '@nx/nx-linux-arm64-musl@22.7.5':
+    resolution: {integrity: sha512-cEP6KmwBgnb38+jTTaibWCjwXcHmigqhTfy0tN1be7WZr6bHxbqNLsXqKRN70PSNA3HouZcxw1cdRL8tqbPBBA==}
     cpu: [arm64]
     os: [linux]
     libc: [musl]
 
-  '@nx/nx-linux-x64-gnu@22.7.2':
-    resolution: {integrity: sha512-v3AQyfCkv9k+AWT2hy8hAGaCmFYf+G/bt4KAqnWhmXPWNhxrv9FhvTUcjpY+MY+6v7sKdhJv/3eDvtlLd9FOLg==}
+  '@nx/nx-linux-x64-gnu@22.7.5':
+    resolution: {integrity: sha512-tbaX1tZCSpGifDNBfDdEZAMxVF3Yg4bhFP/bm1needc0diqb+Zflc0u5tM5/6BWDMITQDwenJVsNiQ8ZdtJURA==}
     cpu: [x64]
     os: [linux]
     libc: [glibc]
 
-  '@nx/nx-linux-x64-musl@22.7.2':
-    resolution: {integrity: sha512-3SMfMB7ynr8wGGTZP+/ZV7FqkCsOg1Raoka+4EtIPX66bEcBycg8FVg81DbyV+IzuKk3N+8Hl2IeY1W2btPypw==}
+  '@nx/nx-linux-x64-musl@22.7.5':
+    resolution: {integrity: sha512-H0M7csOZIgPT822LqjxSXzf4MXRND15vIkAQe3F3Jlr3Si8LC3tzbL52aVcRfgb8MF/xOB5U47mSwxWt1M2bPQ==}
     cpu: [x64]
     os: [linux]
     libc: [musl]
 
-  '@nx/nx-win32-arm64-msvc@22.7.2':
-    resolution: {integrity: sha512-eTFTTF1JUKXu+PNOGd7KAdqyWyfvFKO/wpqHoq9fjnbjXgCdCg1PaRxHIxA1WT5HFj1iHS6Or+GC1zA1KNt0Sw==}
+  '@nx/nx-win32-arm64-msvc@22.7.5':
+    resolution: {integrity: sha512-JTcZch9YAnDL1gbhqePz3DZ4x7iYemLn1yJzrjbbXAmXju2eiiJiZvJJHbV06+SP9HKXDT8RjTKuAWTdVxnHug==}
     cpu: [arm64]
     os: [win32]
 
-  '@nx/nx-win32-x64-msvc@22.7.2':
-    resolution: {integrity: sha512-fbVAiJ7RKSanUXrL67Z6as7BY1akznRqo71ACmrxLvLicG3UsmATbHKGp0zULoe3jBm+rNrIrLk+quZn5q0wUg==}
+  '@nx/nx-win32-x64-msvc@22.7.5':
+    resolution: {integrity: sha512-ngcMyHdBJ9FSz2nHdbZ7gtJlFq0O2b05sPAsVMkZ18CKzdaA1qrBDJfsMO49hPCny505eiT766+CkKdaCDl5kA==}
     cpu: [x64]
     os: [win32]
 
@@ -1418,14 +1439,11 @@ packages:
     resolution: {integrity: sha512-grAEuupr/C1rALFnXTv6ZQhFuL1D8G5y8CN04RgrO4FIPMrtm+mcZzFG7dcBm+nq+1ppNixu+Jd78aeJOYxlGA==}
     engines: {node: '>= 20'}
 
-  '@octokit/openapi-types@26.0.0':
-    resolution: {integrity: sha512-7AtcfKtpo77j7Ts73b4OWhOZHTKo/gGY8bB3bNBQz4H+GRSWqx2yvj8TXRsbdTE0eRmYmXOEY66jM7mJ7LzfsA==}
-
   '@octokit/openapi-types@27.0.0':
     resolution: {integrity: sha512-whrdktVs1h6gtR+09+QsNk2+FO+49j6ga1c55YZudfEG+oKJVvJLQi3zkOm5JjiUXAagWK2tI2kTGKJ2Ys7MGA==}
 
-  '@octokit/plugin-paginate-rest@13.2.1':
-    resolution: {integrity: sha512-Tj4PkZyIL6eBMYcG/76QGsedF0+dWVeLhYprTmuFVVxzDW7PQh23tM0TP0z+1MvSkxB29YFZwnUX+cXfTiSdyw==}
+  '@octokit/plugin-paginate-rest@14.0.0':
+    resolution: {integrity: sha512-fNVRE7ufJiAA3XUrha2omTA39M6IXIc6GIZLvlbsm8QOQCYvpq/LkMNGyFlB1d8hTDzsAXa3OKtybdMAYsV/fw==}
     engines: {node: '>= 20'}
     peerDependencies:
       '@octokit/core': '>=6'
@@ -1446,13 +1464,10 @@ packages:
     resolution: {integrity: sha512-KMQIfq5sOPpkQYajXHwnhjCC0slzCNScLHs9JafXc4RAJI+9f+jNDlBNaIMTvazOPLgb4BnlhGJOTbnN0wIjPw==}
     engines: {node: '>= 20'}
 
-  '@octokit/request@10.0.9':
-    resolution: {integrity: sha512-o8Bi3f608eyM+7BmBiUWxFsdjLb3/ym1cQek5LZOv9KkZcxRrHCPhhRzm6xjO6HVZ85ItD6+sTsjxo821SVa/A==}
+  '@octokit/request@10.0.10':
+    resolution: {integrity: sha512-KxNC2pTqqhszMNrf12ZRd4PonRgyJdsM4F/jySiddQK+DsRcfBtUvqn8t7UsyZhnRJHvX46OohDt5N3VqIWC2w==}
     engines: {node: '>= 20'}
 
-  '@octokit/types@15.0.2':
-    resolution: {integrity: sha512-rR+5VRjhYSer7sC51krfCctQhVTmjyUMAaShfPB8mscVa8tSoLyon3coxQmXu0ahJoLVWl8dSGD/3OGZlFV44Q==}
-
   '@octokit/types@16.0.0':
     resolution: {integrity: sha512-sKq+9r1Mm4efXW1FCk7hFSeJo4QKreL/tTbR0rz/qx/r1Oa2VV83LTA/H/MuCOX7uCIJmQVRKBcbmWoySjAnSg==}
 
@@ -1701,124 +1716,124 @@ packages:
     cpu: [x64]
     os: [win32]
 
-  '@oxfmt/binding-android-arm-eabi@0.50.0':
-    resolution: {integrity: sha512-ICXQVKrDvsWUtfx6EiVJxfWrajKTwTfRV8vz2XiMkxZeuCKJLgD4YAj6dE3BWvpqDlkVkie4VSTAtMUWO9LDXg==}
+  '@oxfmt/binding-android-arm-eabi@0.52.0':
+    resolution: {integrity: sha512-17EMSJnQ9g+upVHrAUYDMfH5lvRKQ9Nvg8WtEoH72oDr1VpWz+7/o3tD97U1EToen2YAQ/68JmtDYkQUi20dfQ==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm]
     os: [android]
 
-  '@oxfmt/binding-android-arm64@0.50.0':
-    resolution: {integrity: sha512-quwjLQFkuW6OwLHeDeIXsTzOmipQFQbqsYN9HLk2B5I01IlAQZHP1UiLIg0O7pP+dUgPD2AD7SCYA3gs6NH5/g==}
+  '@oxfmt/binding-android-arm64@0.52.0':
+    resolution: {integrity: sha512-A2G1IdwGEW2lLJkIxcvuirRH1CzSl/e0NX11zTlW1gvxJThfwbI/BEoaKrTNpm7M2FchvIf6guvIQU7d5iz+OQ==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm64]
     os: [android]
 
-  '@oxfmt/binding-darwin-arm64@0.50.0':
-    resolution: {integrity: sha512-ikU5umElcMi78/TNI334wtjr5WZ5F4nWa1aIDseAKKGL0W3ygxeYKkrIJ0fggWa8MOon66BmG3xCqmX1m9YAOw==}
+  '@oxfmt/binding-darwin-arm64@0.52.0':
+    resolution: {integrity: sha512-f9+bLvOYxy7NttCLFTvQ7afmqDOWY4wIP9xdvfj5trQ1qj6f2UFAGwZESlfsMjvJNTyRpXfIlOanCI9FOvoeQA==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm64]
     os: [darwin]
 
-  '@oxfmt/binding-darwin-x64@0.50.0':
-    resolution: {integrity: sha512-WT4MOYG4mv9IXrH0m60vHsJh+rRMPSOKTQmwDpwmgQ+DuW/i5dU4pqc0HDO5uclO5vjz5IFX5z/taW86LSVe/g==}
+  '@oxfmt/binding-darwin-x64@0.52.0':
+    resolution: {integrity: sha512-YSTB9sJ5nnQd/Q0ddHkgof0ZCHPAnWZT1IW2SJ8omz7CP7KluJhO1fNHrpqdxCtpztJwSs4hY1uAee35wKxxaw==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [x64]
     os: [darwin]
 
-  '@oxfmt/binding-freebsd-x64@0.50.0':
-    resolution: {integrity: sha512-gH0rycVXqV4juWkvLs2uPMtTyppDc7qEUVzXAxnQ7FpcSZNXqKowUgtjH8q67ngj416r8+4NnAlyR/D35zwwhQ==}
+  '@oxfmt/binding-freebsd-x64@0.52.0':
+    resolution: {integrity: sha512-NIrRNTTPCs4UbmVs0bxLSCDlLCtIRMJIXklNKaXa5Oj2/K1UIMBvgE8+uPVo01Io3N9HF0+GAX+aAHjUgZS7vA==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [x64]
     os: [freebsd]
 
-  '@oxfmt/binding-linux-arm-gnueabihf@0.50.0':
-    resolution: {integrity: sha512-wL/k+o0hiTeRvi/gPzeC1L/yTHTXIeHDKWU09s2zTBmv7ma59wTm+fADNSGYxhJQDxyavQbwTf1QpW3Zj924tQ==}
+  '@oxfmt/binding-linux-arm-gnueabihf@0.52.0':
+    resolution: {integrity: sha512-JXUCde8mn3GpgQouz2PXUokgy/uT1QrRJBL2s983VWcSQp62wTFYiNXgTKdeo1Jgbr0IgUnKKvzIk/YBlj/nVQ==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm]
     os: [linux]
 
-  '@oxfmt/binding-linux-arm-musleabihf@0.50.0':
-    resolution: {integrity: sha512-Y59FKqoUM3Gf00E395b4ixfWyJGwO2GzaZawF5MZoVWcb3f6CkWUXyao0jyOvoIxDMzMybcVRuXyG7ih/Nxweg==}
+  '@oxfmt/binding-linux-arm-musleabihf@0.52.0':
+    resolution: {integrity: sha512-psbUXaRZ+V8DaXz10Qf7LSHtdtdKAmC8fxXgeU608jjzrmWK4quamZMOpl6sf+dikoFHA85uE93Q0BqxrCdQrQ==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm]
     os: [linux]
 
-  '@oxfmt/binding-linux-arm64-gnu@0.50.0':
-    resolution: {integrity: sha512-OvXbfTjMignXWyJXg/NOFsiy996vFe8wb9tkxJaUq8ylq0XrzJg3ttavC5Tcmm6F8/GUs2r3XFJWWu9q/27uYw==}
+  '@oxfmt/binding-linux-arm64-gnu@0.52.0':
+    resolution: {integrity: sha512-Jw7MgWUU9lcLCcy82updISP3EthTlfvAwR6gWNxPzqly7+fLvOi2gHQE9xXQjpqaVLm/8P+gOzlv9ODuoVlaaw==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm64]
     os: [linux]
     libc: [glibc]
 
-  '@oxfmt/binding-linux-arm64-musl@0.50.0':
-    resolution: {integrity: sha512-rqmvHZm7vMa3NLYa0khwkhReCmp9tqKnF23TFZ7S5cYJLvIE4b0k8famWE7kO897/DXznJe675n5SohFBggbxA==}
+  '@oxfmt/binding-linux-arm64-musl@0.52.0':
+    resolution: {integrity: sha512-wZg6bLjDvh2KibyI3QFUYo8GTXneIFsd0JvehtvJiUmQ8WRPERgxd/VM4ctWb86U5FT1FkqgS8/wZKVB+AZScg==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm64]
     os: [linux]
     libc: [musl]
 
-  '@oxfmt/binding-linux-ppc64-gnu@0.50.0':
-    resolution: {integrity: sha512-49bAdYbMSde42tzPDtuHnBWzOgmoS0PT9THCjvMnDVYMQYiHzPc2Mv5rkpBHVQOXM+PHfafJlxgK0anXSWBVvw==}
+  '@oxfmt/binding-linux-ppc64-gnu@0.52.0':
+    resolution: {integrity: sha512-IngE8uxhNvxcMrLjZNDo9xNLY7rEK33AKnaMd2B46he1e/mz2CfcW6If/U1wUjdRZddm1QzQaciqZkuMkdh1FA==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [ppc64]
     os: [linux]
     libc: [glibc]
 
-  '@oxfmt/binding-linux-riscv64-gnu@0.50.0':
-    resolution: {integrity: sha512-VFT25/6kckkIM62KeWB2bi+xCEmC/zC+DcMaIpEfaio8ulkGDLSiTz11TyK0eqgTl3x5OklYEGDWohvAgOr8Bw==}
+  '@oxfmt/binding-linux-riscv64-gnu@0.52.0':
+    resolution: {integrity: sha512-H3+DdFMv/efN3Efmhsv18jDrpiWWqKG7wsfAlQBqAt6z/E2Bx+TwEj2Nowe51CPOWB8/mFBC2dAMSgVFLvvowA==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [riscv64]
     os: [linux]
     libc: [glibc]
 
-  '@oxfmt/binding-linux-riscv64-musl@0.50.0':
-    resolution: {integrity: sha512-BBJMuNy6jjkXjUUINF5UTQqb/nvjmtJad43Gp7bab0AAURAdthhJvduR7rHpWInpWYiaMzYsdrmURNcrmpxdZA==}
+  '@oxfmt/binding-linux-riscv64-musl@0.52.0':
+    resolution: {integrity: sha512-zji+1kb7lJKohSDjzC1IsS+K/cKRs1hdVf0ZH0VbdbiakmtLvN9twBoXo/k8VdjFax7kfo+DyPxS7vv52br1aw==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [riscv64]
     os: [linux]
     libc: [musl]
 
-  '@oxfmt/binding-linux-s390x-gnu@0.50.0':
-    resolution: {integrity: sha512-Xd4y+yjAYHKmryXhyUUwbyRD01iKfcvI74iE01L6p4F8SwjhZQXDshK+T8PcrPZLiFqH263P5xqJk94amjkjzQ==}
+  '@oxfmt/binding-linux-s390x-gnu@0.52.0':
+    resolution: {integrity: sha512-hcLBYedpCy7ToUvvBidWk7+11Yhg1oAZ4+6hKPic/mQI6NaqXJSXMps5nFlwUuX2ewhtLZZDPg63TI042qGKBg==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [s390x]
     os: [linux]
     libc: [glibc]
 
-  '@oxfmt/binding-linux-x64-gnu@0.50.0':
-    resolution: {integrity: sha512-Qp96rYJru7l++7mk4R+eh8qq9GFfFAMdmoN6VGoRHI8AA1XMnUIzH4u+zOcKZZwY+irHdsaBldDearwB4nOH7A==}
+  '@oxfmt/binding-linux-x64-gnu@0.52.0':
+    resolution: {integrity: sha512-IDO2loXK2OtTOhSPchU9MW25mWL2QCDGdJbjN8MXKZVS80qXe5gMTwQWu/gMJ3juoBHbkuUZNB2N1LHzNT7DoA==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [x64]
     os: [linux]
     libc: [glibc]
 
-  '@oxfmt/binding-linux-x64-musl@0.50.0':
-    resolution: {integrity: sha512-5XLGp+yd5w2Key5LMqJO+X3XVsJKgeeUKljy32+MBF/J/JZ5m8WHl6dI5eOQOr3ixopxPiXIyDAxn3slI3UXiQ==}
+  '@oxfmt/binding-linux-x64-musl@0.52.0':
+    resolution: {integrity: sha512-mAV2Hjn0SatJ+KoAzKUC3eJhdJ8wv+3m1KyuS0dTsbF0c5weq+QrCt/DRZZM+uj/XiKzCDEUKYsBF30e2qkcyw==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [x64]
     os: [linux]
     libc: [musl]
 
-  '@oxfmt/binding-openharmony-arm64@0.50.0':
-    resolution: {integrity: sha512-QAxwzh7+GHugCD7WuERolVs8TKQwXNIAZXAHHTecbKVc9oWBkWzOiLauQuezXS57tVcof5zhi1IjZ8tOV0htTg==}
+  '@oxfmt/binding-openharmony-arm64@0.52.0':
+    resolution: {integrity: sha512-vd4npaUIwChxp7XzkqmepBWTT9YMcSe/NBApVGPC30/lLyOVaV3dvma1SKo03t8O73BPRAG7EyJzGlN5cJM5hQ==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm64]
     os: [openharmony]
 
-  '@oxfmt/binding-win32-arm64-msvc@0.50.0':
-    resolution: {integrity: sha512-3nKN/kqClm9iCFWTwtJ9UpR5SGyExp5l3nw6uIiBt+3XitQtszin+vjHrL7JHfDksZ7Svigdaow2zqz/IKCfqw==}
+  '@oxfmt/binding-win32-arm64-msvc@0.52.0':
+    resolution: {integrity: sha512-k2sz6gWQdMfh5HPpIS+Bw/0UEV/kaK2xuqJRrWL233sEHx9WLlsmvlPFM4HUNThkYbSN0U0vPW7LVKZWDS8hPQ==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm64]
     os: [win32]
 
-  '@oxfmt/binding-win32-ia32-msvc@0.50.0':
-    resolution: {integrity: sha512-3r6XZ8+X6qlLbXaPW2NygfiAWSpKbkE36pAVzS83mY+cYY+pSMalJ+qnCgkr92tr+Iqv988XKQ1CpARTg9ITbQ==}
+  '@oxfmt/binding-win32-ia32-msvc@0.52.0':
+    resolution: {integrity: sha512-rhke69GTcArodLHpjMTfNnvjTEBryDeZcUCKK/VjXDMtfTULl6QRh0ymX5/hbCUv2WjYm9h/QbW++q2vE15gWQ==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [ia32]
     os: [win32]
 
-  '@oxfmt/binding-win32-x64-msvc@0.50.0':
-    resolution: {integrity: sha512-BSE8D8KsvquMG9vU+Qt4qGuoOcZ36rxU5S6ZkHNguj+MlWkXWCBETnno3yJ9CfWvfCrbmieaN9LK6hdcdHNZ/w==}
+  '@oxfmt/binding-win32-x64-msvc@0.52.0':
+    resolution: {integrity: sha512-q5xL7oeXkZdEtNZWBdvehJcmt+GRu9l2bK40yJs1jJXlqq+r0Hygb1rTjq+FM2o/2xyt4cufH6KRplHp3Jjsvw==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [x64]
     os: [win32]
@@ -1853,124 +1868,124 @@ packages:
     cpu: [x64]
     os: [win32]
 
-  '@oxlint/binding-android-arm-eabi@1.65.0':
-    resolution: {integrity: sha512-jDVaGNURT5pEA9qcabh6WusIoBNybOMMDPCx+EFt+gxo6rVvoUf0+73Xy5x81+ZrxU+ewk5uRBYifjy5pgkcnA==}
+  '@oxlint/binding-android-arm-eabi@1.67.0':
+    resolution: {integrity: sha512-VrSi571rDv1N8HaEDM+DEX8nmT0y9jJo8tzzW13vsOWTx59xQczCIJx68n2zWOXRT5YKZsOZXp4qkHN/10x4mw==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm]
     os: [android]
 
-  '@oxlint/binding-android-arm64@1.65.0':
-    resolution: {integrity: sha512-v0z80IWNA7c9RhUydq9YprBxCVZrQ6Ixls2tdxUC1F/1FFqSfa7xTX+EJf0mj6+BKRg2zWXqWfcbJUnETlLlIw==}
+  '@oxlint/binding-android-arm64@1.67.0':
+    resolution: {integrity: sha512-l6+NdYxMoRohix5r5bbigW16LPicceCwGcQ6LKKuE1kUdjgFfQolJjrJsQYPFetIs78Gxj/G/f5TEGoTCwj9nQ==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm64]
     os: [android]
 
-  '@oxlint/binding-darwin-arm64@1.65.0':
-    resolution: {integrity: sha512-pL/mG/5gMzBwp1gdc5+Cwi87F9j3XRnPxHGyVj5Zd+dCEV5YkKt0L70PB3EGmEEHxgn4H+jnMS3xLuXs6mZW/Q==}
+  '@oxlint/binding-darwin-arm64@1.67.0':
+    resolution: {integrity: sha512-jOzXxS1AxFxhImLIRbtGIMrEwaXcgMw3gR57WB1cRk8ai+vpr6726kxXqVvlNsrXtJ/FrmOm8RxlC0m8SW24Qg==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm64]
     os: [darwin]
 
-  '@oxlint/binding-darwin-x64@1.65.0':
-    resolution: {integrity: sha512-jVTneaeuHtqTrKYnhrdH1buhnSorinvpy1sv43ayclfWx/e/DfdRWv+h1fopJcHQbYr5WMcZMmDvnfEBkPZ+1A==}
+  '@oxlint/binding-darwin-x64@1.67.0':
+    resolution: {integrity: sha512-3DFAVY94OqjIZHXIPz37yGRSWwOFTAqChQ64/M69GYLawzP0KiwdhDNfqdKKYT0bTR/DNxmMnQsj3ns+8+X/Lg==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [x64]
     os: [darwin]
 
-  '@oxlint/binding-freebsd-x64@1.65.0':
-    resolution: {integrity: sha512-8lJQ7B6RloYDUhwVdbSpwT2eKsCN5KP1Scn18ly1tytCuhXhbs0nkfKHT4jWWZBJqmynWuzd+78bF7wILrj6pw==}
+  '@oxlint/binding-freebsd-x64@1.67.0':
+    resolution: {integrity: sha512-e4dDKZuLu8TR9DEBssWSDahlPgZBwojTTHZUvnjBRJfJJbpxYCjfjKfi0Z1+CSLMiJBwI2yCDtRM1XJQaARjmg==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [x64]
     os: [freebsd]
 
-  '@oxlint/binding-linux-arm-gnueabihf@1.65.0':
-    resolution: {integrity: sha512-EgmZY+DeWhLLEnNl70/49j3ltA8I6X9kxMfexupWi2Vwfp6RonGsBaHtGoedLolaU37ne7eDUgoxa3CFB95GZA==}
+  '@oxlint/binding-linux-arm-gnueabihf@1.67.0':
+    resolution: {integrity: sha512-BKytFdcQzbITV3xlnzDUDTEDtbUMCCiC4EaNTDZ4FyT8gdNvBC4gfiLucXp/sQl0XU3p7syTlorUWVVVBZab2g==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm]
     os: [linux]
 
-  '@oxlint/binding-linux-arm-musleabihf@1.65.0':
-    resolution: {integrity: sha512-OJMWmAYRVBCPPxnYr3j5sXRwHPh1bAuMlTStGco1Z8q3HkvSH4h+A10E9MiRNYmLhUuli5a2P5wmfj8cagiF5Q==}
+  '@oxlint/binding-linux-arm-musleabihf@1.67.0':
+    resolution: {integrity: sha512-XYAv0esBDX7BpTzRDjVX2Vdj+zndd8ll2dFQiaeQ6zTZr7A8GRDTN7fH3FP3jU+O0vCDx85oH/EtG7BzPgAXuw==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm]
     os: [linux]
 
-  '@oxlint/binding-linux-arm64-gnu@1.65.0':
-    resolution: {integrity: sha512-D8uNi50LsYKgS0vGARZDRx05TBZeSxAVdLGddSEqQLSU7xsiqdImHPEw55xq8sKA5rCc/4au/5uS7FQALWdLCg==}
+  '@oxlint/binding-linux-arm64-gnu@1.67.0':
+    resolution: {integrity: sha512-zizRMjA0i6u/2B0evgda04iycu+MoNuf1pBy6Eh+1CjC5wMEG7qN5zdDKTCvFc0KSYSDM9QTG3gjZHirgtQuKg==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm64]
     os: [linux]
     libc: [glibc]
 
-  '@oxlint/binding-linux-arm64-musl@1.65.0':
-    resolution: {integrity: sha512-IpbA8QGbwFehQhO+YaHwmoI81f93xvywpspf8HrdPCWOIeKwYfM1dhVhO4YKfZewTRRQEPY/JFjTOXTgkwhKrA==}
+  '@oxlint/binding-linux-arm64-musl@1.67.0':
+    resolution: {integrity: sha512-zB/Tf6sUjmmvvbva9Gj3JTJ8rJ9t4I8/U0o6vSRtd0DRIsIuyegBwJAzhSUFQHdMijIRJkW0exs/yBhpw2S20w==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm64]
     os: [linux]
     libc: [musl]
 
-  '@oxlint/binding-linux-ppc64-gnu@1.65.0':
-    resolution: {integrity: sha512-ZSe8HgaZdgyHSv2+/pTG68z10+OarB18CkFKQOhRs3lmmP/p2vuigedK2e9d0ztoG2DU/duJzhxXBSjy/492HQ==}
+  '@oxlint/binding-linux-ppc64-gnu@1.67.0':
+    resolution: {integrity: sha512-kgU40Gt74CK0TCsF51KZymkIwN9U0BajKsMijB52zPqOeZU9NAHkA/NSQkZDHEaCakx42DxhXkODiAqf2b4Gug==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [ppc64]
     os: [linux]
     libc: [glibc]
 
-  '@oxlint/binding-linux-riscv64-gnu@1.65.0':
-    resolution: {integrity: sha512-DcTERf++v6HyPHukKAr0JFTRqB+YeDEvqzRgNDMaz7jITPf+tlJIwRxodlAqoXMYhNVEZhXdQM5RAAYH8/oPuw==}
+  '@oxlint/binding-linux-riscv64-gnu@1.67.0':
+    resolution: {integrity: sha512-tOYhkk/iaG9aD3FvGpBFd1Lrw0x0RaVoJBxjUkfNzS50rC5NS5BteNCwgr8A2zCdADrIIoze6D7u6U5Ic++/iQ==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [riscv64]
     os: [linux]
     libc: [glibc]
 
-  '@oxlint/binding-linux-riscv64-musl@1.65.0':
-    resolution: {integrity: sha512-xjhMwuFJwRh40NOBzol4gM5gqAa0xPCJU+GQLM6BydV8TbfkIA7JeyCFNhyfbE9Q/5EWcKYTx62R0cRcjP7DAA==}
+  '@oxlint/binding-linux-riscv64-musl@1.67.0':
+    resolution: {integrity: sha512-sEtywrPb+0b+tHYl1SDCrw903fiC4eyKoNqzP3v+f2JT3Xcv4NEYG+P8rj+eEnX7IWhqV/xj8/JmcmVj21CXaA==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [riscv64]
     os: [linux]
     libc: [musl]
 
-  '@oxlint/binding-linux-s390x-gnu@1.65.0':
-    resolution: {integrity: sha512-lrWSXb8JzboPWYBG6Kunt/eemvjo2oCFXktShsm3yMToY7HjzKLjxh7CljSvGnnZH9oohNFHOKc9xYpGKCPm6w==}
+  '@oxlint/binding-linux-s390x-gnu@1.67.0':
+    resolution: {integrity: sha512-BvR8Moa0zCLxroOx4vZaZN9nUfwAUpSTwjZdxZyKy4bv3PrzrXrxKR/ZQ0L9wNSvlPhnMJeZfa3q5w6ZCTuN6Q==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [s390x]
     os: [linux]
     libc: [glibc]
 
-  '@oxlint/binding-linux-x64-gnu@1.65.0':
-    resolution: {integrity: sha512-A7xfghw250m4a1sPV+q44Mow2G5bhiC9FBvhAuIhJS6QovWnqzuL5AFQPEuwOB+PM4DhABkqxVa3Iwe3Y/nFlQ==}
+  '@oxlint/binding-linux-x64-gnu@1.67.0':
+    resolution: {integrity: sha512-mm2cxM6fksOpq6l0uFws8BUGKAR4dNa/cZCn37Npq7PFbhD5HDJqWfnoIvTaeRKMy5XdS2tO0MA0qbHDrnXAAA==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [x64]
     os: [linux]
     libc: [glibc]
 
-  '@oxlint/binding-linux-x64-musl@1.65.0':
-    resolution: {integrity: sha512-reqOun1+pWO3fW6cv7bsa8hHG0TN3t/82qPdaoJo90FwugXiMjKhZMChmH5Z01cFNRHmxN4+543Fy8478cM/iA==}
+  '@oxlint/binding-linux-x64-musl@1.67.0':
+    resolution: {integrity: sha512-WmbMuLapKyDlobMkXAaAL0Y+Uczh4LETfIfQsUpbId4Ip8Ai82/jqeYTOoUCkuuhBFapgqP253+d83tLKOksJg==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [x64]
     os: [linux]
     libc: [musl]
 
-  '@oxlint/binding-openharmony-arm64@1.65.0':
-    resolution: {integrity: sha512-KQpqOb/juDBO0xyloDkVDhOVxDUgAfZ2OAAVq99TJScJDzT319xry1QzB9LQohV9QGnA7p6m/XATZkMXc84lwA==}
+  '@oxlint/binding-openharmony-arm64@1.67.0':
+    resolution: {integrity: sha512-9g/PqxYJelzzTAOR5Y+RiRqdeydhEuXv2KxNeFcAKQ7UsvnWSY1OP4MsuPMbTO2Pf70tz7mFhl1j13H3fyh+8g==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm64]
     os: [openharmony]
 
-  '@oxlint/binding-win32-arm64-msvc@1.65.0':
-    resolution: {integrity: sha512-xfqcOc3nJFeAd1kDY4T9d3XeJIhr00twaaW0kOAzGPyUHkruXtNJv6zz1Ra9fRtSek5VpW2Yoj5AcwPIlT0ZiQ==}
+  '@oxlint/binding-win32-arm64-msvc@1.67.0':
+    resolution: {integrity: sha512-2VhwE6Gatb0vJGnN0TBuQMbKCOiZlSQ/zJvVWYLK4a9d4iDiJOen/yVQkGpmsJ90MuH66fzi0kEKI0jRQMDxGA==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm64]
     os: [win32]
 
-  '@oxlint/binding-win32-ia32-msvc@1.65.0':
-    resolution: {integrity: sha512-JV+pXm45p8sdgs3c7LOPAohW23optCNZETFOXUcjn6cS4PYZhEU/RI54Z5dHdMudab3nw7T48PZILthM+Q0COQ==}
+  '@oxlint/binding-win32-ia32-msvc@1.67.0':
+    resolution: {integrity: sha512-EQ3VExXfeM1InbE5+JjufhZZTWy+kHUwgt3yZR7gQ47Je/mE0WspQPan0OJznh493L5anM210YNJtH1PXjTSFg==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [ia32]
     os: [win32]
 
-  '@oxlint/binding-win32-x64-msvc@1.65.0':
-    resolution: {integrity: sha512-D7L/oBbskLss21bYrRbFuIs81AiSQV+wRzwck54dOkHIlq2qu1xjLz8u6jCqGH8Fltk8bB5DLBpVhE7v/fA8XQ==}
+  '@oxlint/binding-win32-x64-msvc@1.67.0':
+    resolution: {integrity: sha512-bw24y+/1MHS4QDkons3YyHkPT9uCMoLHHgQhb+mb8NOjTYwub1CZ+K9Ngr8aO5DMrDrkqHwTzlTwFP2vS8Y/ZQ==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [x64]
     os: [win32]
@@ -2078,11 +2093,11 @@ packages:
     resolution: {integrity: sha512-h104Kh26rR8tm+a3Qkc5S4VLYint3FE48as7+/5oCEcKR2idC/pF1G6AhIXKI+eHPJa/3J9i5z0Al47IeGHPkA==}
     engines: {node: '>=12'}
 
-  '@posthog/core@1.29.3':
-    resolution: {integrity: sha512-OvJSAzqVfZx+L7D874q56FVRTxOIsFBVB3wSB/Uny+DhmfNRGDi1rpZAruEmQYl9WQlQJb1q6JXGAC+rxVXjPA==}
+  '@posthog/core@1.29.12':
+    resolution: {integrity: sha512-r/2RUa4zbN0XdBp6d+Yk8Jw1rPWXHxyXIgSm/wJf9yDLIouZbH0Pdkgbc1RIuhwL6BIHCFrOqK5jy8TFKTI6iw==}
 
-  '@posthog/types@1.374.0':
-    resolution: {integrity: sha512-qouREpHIxsBS3Gc6a5gZvg6/ykK+4TJAs4wYTUIH/emH1HQfaaLrWzGoEm+/OPwlNxHzw4tQn9OOyxsmr9NF2g==}
+  '@posthog/types@1.376.3':
+    resolution: {integrity: sha512-w21lBoz3/ZGw7BZT7t2lJq1mpJwMvWpZijW7vEwBFNAQlq0KfKf2mj5KKUYZMXM1GdIQ0jHnn931uXPB1Ae60w==}
 
   '@radix-ui/number@1.1.1':
     resolution: {integrity: sha512-MkKCwxlXTgz6CFoJx3pCwn07GKp36+aZyu/u2Ln2VrA5DcdyCZkASEDBTd8x5whTQQL5CiYf4prXKLcgQdv29g==}
@@ -2560,15 +2575,15 @@ packages:
     resolution: {integrity: sha512-mgdxrHTLOjOddRVYIYDo0fR3/v61GNN1YGkfbrjuIKg/uMgCd+Qzo3UAXJ+woLQQpos4pl5Esuw5A7AoNlzjUQ==}
     engines: {node: '>=18'}
 
-  '@semantic-release/github@11.0.6':
-    resolution: {integrity: sha512-ctDzdSMrT3H+pwKBPdyCPty6Y47X8dSrjd3aPZ5KKIKKWTwZBE9De8GtsH3TyAlw3Uyo2stegMx6rJMXKpJwJA==}
-    engines: {node: '>=20.8.1'}
+  '@semantic-release/github@12.0.8':
+    resolution: {integrity: sha512-tej5AAgK5X9wHRoDmYhecMXEHEkFeGOY1XsEblKxu8pIQwahzf1STYyr7iPU6Lpbg6C5I3N2w/ocXrBo+L7jhw==}
+    engines: {node: ^22.14.0 || >= 24.10.0}
     peerDependencies:
       semantic-release: '>=24.1.0'
 
-  '@semantic-release/npm@12.0.2':
-    resolution: {integrity: sha512-+M9/Lb35IgnlUO6OSJ40Ie+hUsZLuph2fqXC/qrKn0fMvUU/jiCjpoL6zEm69vzcmaZJ8yNKtMBEKHWN49WBbQ==}
-    engines: {node: '>=20.8.1'}
+  '@semantic-release/npm@13.1.5':
+    resolution: {integrity: sha512-Hq5UxzoatN3LHiq2rTsWS54nCdqJHlsssGERCo8WlvdfFA9LoN0vO+OuKVSjtNapIc/S8C2LBj206wKLHg62mg==}
+    engines: {node: ^22.14.0 || >= 24.10.0}
     peerDependencies:
       semantic-release: '>=20.1.0'
 
@@ -2578,32 +2593,32 @@ packages:
     peerDependencies:
       semantic-release: '>=20.1.0'
 
-  '@shikijs/core@4.0.2':
-    resolution: {integrity: sha512-hxT0YF4ExEqB8G/qFdtJvpmHXBYJ2lWW7qTHDarVkIudPFE6iCIrqdgWxGn5s+ppkGXI0aEGlibI0PAyzP3zlw==}
+  '@shikijs/core@4.1.0':
+    resolution: {integrity: sha512-jLJtSJeuFffqX6/inRE1zqU5aFv2hrszvYgq3OjbAgFRZiWv7abKMDdQzYxuSDfmUPQozZvI/kuy6VMTvnvqTQ==}
     engines: {node: '>=20'}
 
-  '@shikijs/engine-javascript@4.0.2':
-    resolution: {integrity: sha512-7PW0Nm49DcoUIQEXlJhNNBHyoGMjalRETTCcjMqEaMoJRLljy1Bi/EGV3/qLBgLKQejdspiiYuHGQW6dX94Nag==}
+  '@shikijs/engine-javascript@4.1.0':
+    resolution: {integrity: sha512-YquhawCUgaBfhsS72e2Y/dI59gCBNPHu3fEO/tvLaXrTssxZrY5ddjtNLTwndrMgPo8b3IscE+xoICDzpTmlFQ==}
     engines: {node: '>=20'}
 
-  '@shikijs/engine-oniguruma@4.0.2':
-    resolution: {integrity: sha512-UpCB9Y2sUKlS9z8juFSKz7ZtysmeXCgnRF0dlhXBkmQnek7lAToPte8DkxmEYGNTMii72zU/lyXiCB6StuZeJg==}
+  '@shikijs/engine-oniguruma@4.1.0':
+    resolution: {integrity: sha512-axLpjVs45YBvvINa+dJF+NPW+KtFkNXsFr4SDw2BMj9GdeMnGxVB9PQb2xXlJYovslt/nz6giedAyOANkfc7hg==}
     engines: {node: '>=20'}
 
-  '@shikijs/langs@4.0.2':
-    resolution: {integrity: sha512-KaXby5dvoeuZzN0rYQiPMjFoUrz4hgwIE+D6Du9owcHcl6/g16/yT5BQxSW5cGt2MZBz6Hl0YuRqf12omRfUUg==}
+  '@shikijs/langs@4.1.0':
+    resolution: {integrity: sha512-nwOMruEkbgdZfQ/b8CgpNBVOpvG1k0N5tbmgiFeqsan401+x3ILqlzZJowSla4Agmq4hG2Uf2wh5jLTEhR8VSg==}
     engines: {node: '>=20'}
 
-  '@shikijs/primitive@4.0.2':
-    resolution: {integrity: sha512-M6UMPrSa3fN5ayeJwFVl9qWofl273wtK1VG8ySDZ1mQBfhCpdd8nEx7nPZ/tk7k+TYcpqBZzj/AnwxT9lO+HJw==}
+  '@shikijs/primitive@4.1.0':
+    resolution: {integrity: sha512-zx2/2Uwj2q9X3KSyYREEhXO23xBw5WUhP4orK2lE4r+t9JGITmEe0JH+wPmJhqHpOT2bRRs6lAL945+LDvOAGw==}
     engines: {node: '>=20'}
 
-  '@shikijs/themes@4.0.2':
-    resolution: {integrity: sha512-mjCafwt8lJJaVSsQvNVrJumbnnj1RI8jbUKrPKgE6E3OvQKxnuRoBaYC51H4IGHePsGN/QtALglWBU7DoKDFnA==}
+  '@shikijs/themes@4.1.0':
+    resolution: {integrity: sha512-emCcTnUM7yO2wltYbaxm+yLvcCI4+h8XBKc4KmJ7EZUXoSGjcCHifkI//R4OFit9ewpg7H2/9tjOuXrT2v/Knw==}
     engines: {node: '>=20'}
 
-  '@shikijs/types@4.0.2':
-    resolution: {integrity: sha512-qzbeRooUTPnLE+sHD/Z8DStmaDgnbbc/pMrU203950aRqjX/6AFHeDYT+j00y2lPdz0ywJKx7o/7qnqTivtlXg==}
+  '@shikijs/types@4.1.0':
+    resolution: {integrity: sha512-3EQWX54fMpniOrDblzAhiwiJwpiTMW6+B9DWyUd9ska483tbayFYuw47UxwuPknI31bKnySfVQ/QW+jFL4rFdA==}
     engines: {node: '>=20'}
 
   '@shikijs/vscode-textmate@10.0.2':
@@ -2624,31 +2639,31 @@ packages:
   '@standard-schema/spec@1.1.0':
     resolution: {integrity: sha512-l2aFy5jALhniG5HgqrD6jXLi/rUWrKvqN/qJx6yoJsgKhblVd+iqqU4RCXavm/jPityDo5TCvKMnpjKnOriy0w==}
 
-  '@supabase/auth-js@2.105.4':
-    resolution: {integrity: sha512-Ejfa37M5xoIwoxVebxRahnwubPo8g22qkXQ4p50+N9MIvU9UZoN+A8dwVPtczzGf8oV/YXN80ZPxK4aWXuSN/A==}
+  '@supabase/auth-js@2.106.2':
+    resolution: {integrity: sha512-VcAjUErkHkhC5Jaf+g/G1qbkQrFh8edaCdHa7pxJmHUjkWKjT7UnYCtPA89XV0N0GIYRkEqJZw5V62CtOxTmBQ==}
     engines: {node: '>=20.0.0'}
 
-  '@supabase/functions-js@2.105.4':
-    resolution: {integrity: sha512-JVNKbBft3Qkja+WlGaE026AJ2AH9K0UTsxsfvEIHgd4zFrBor4BYRCrYFrv9IDsvVqkF72wKDsODJl5GY/C4tA==}
+  '@supabase/functions-js@2.106.2':
+    resolution: {integrity: sha512-oRnr0QrL8H+zTO1YyQ1QjiHZU/957jvubbxSJTUm2XLAgzoGGV9Tahfyd+uvLsBLRVmXLtpU3oyCjdQIvkGMOA==}
     engines: {node: '>=20.0.0'}
 
   '@supabase/phoenix@0.4.2':
     resolution: {integrity: sha512-YSAGnmDAfuleFCVt3CeurQZAhxRfXWeZIIkwp7NhYzQ1UwW6ePSnzsFAiUm/mbCkfoCf70QQHKW/K6RKh52a4A==}
 
-  '@supabase/postgrest-js@2.105.4':
-    resolution: {integrity: sha512-SppIyLo/kTwIlz1qpv2HN1EQqBg0GVktrDDFsXygYROha3MgVn4rT7p5EjFHFqXQm2rdRGb/BI7bc+jr10m91w==}
+  '@supabase/postgrest-js@2.106.2':
+    resolution: {integrity: sha512-tDOzyPgp9pIRMR2x6C9+uDSJrnXSzxLtt3d7nC+Lrsy3jnJDHYfdQC/xcRyhJE/TOBJ0heSqRKR3UmejDjZxsw==}
     engines: {node: '>=20.0.0'}
 
-  '@supabase/realtime-js@2.105.4':
-    resolution: {integrity: sha512-6ov6c59+8D9h7q4M4Gy/uDJlC0Akxl9/714Y+6vJ+Sijuc16TS/p5DwhfRCLNcIhNiej1gEt+CQUwsjiPt4PxQ==}
+  '@supabase/realtime-js@2.106.2':
+    resolution: {integrity: sha512-LdRGT7DNhyZkPjubUv5bSdAZ0jSEX8wTHvx7htj7+K59TOZRvz4TuQK7tL2RWxyIZVeFMRluL04SzWS61rKnUA==}
     engines: {node: '>=20.0.0'}
 
-  '@supabase/storage-js@2.105.4':
-    resolution: {integrity: sha512-Jx+pzMP1Whjof2PWHoVBUA75/p7PQE9CqKBzn1oXVyJDOggMLSH2OzVWwsXYaxEpdC1K/KltwmOX44nL3LHl9g==}
+  '@supabase/storage-js@2.106.2':
+    resolution: {integrity: sha512-xgKCSYuev1YarV+iVqr+zlfgSyremnJtn8T0NCT8L4XmMv1CLtESc0Q6kNp8+mKWdX/8ND0nzm7OMKx08kwNAw==}
     engines: {node: '>=20.0.0'}
 
-  '@supabase/supabase-js@2.105.4':
-    resolution: {integrity: sha512-cEnx+k49knU+qdIP7rXwR6fqEXPHZs+74xFK1R0S8MgQ7v9tbePVdGxvO03n3bPympMdJWVLadARBfU4TgNHCQ==}
+  '@supabase/supabase-js@2.106.2':
+    resolution: {integrity: sha512-2/RZ/1fmJx/MRSEDG2Xk8+J4JVk5clM9V0uSI6kUTrcS32KA89DtqI5RUOC9r6mzY3WBC9qexLjssIHjbLyVJA==}
     engines: {node: '>=20.0.0'}
 
   '@swc-node/core@1.14.1':
@@ -2667,86 +2682,86 @@ packages:
   '@swc-node/sourcemap-support@0.6.1':
     resolution: {integrity: sha512-ovltDVH5QpdHXZkW138vG4+dgcNsxfwxHVoV6BtmTbz2KKl1A8ZSlbdtxzzfNjCjbpayda8Us9eMtcHobm38dA==}
 
-  '@swc/core-darwin-arm64@1.15.33':
-    resolution: {integrity: sha512-N+L0uXhuO7FIfzqwgxmzv0zIpV0qEp8wPX3QQs2p4atjMoywup2JTeDlXPw+z9pWJGCae3JjM+tZ6myclI+2gA==}
+  '@swc/core-darwin-arm64@1.15.40':
+    resolution: {integrity: sha512-PaYyclfmQ++77D8ityYvmmVzHv9aG8ROwt2GfG6/ccloy4Hgf80qtOnzb9VYvPsUT7Ty1uhuDRhv3XYpf62qhQ==}
     engines: {node: '>=10'}
     cpu: [arm64]
     os: [darwin]
 
-  '@swc/core-darwin-x64@1.15.33':
-    resolution: {integrity: sha512-/Il4QHSOhV4FekbsDtkrNmKbsX26oSysvgrRswa/RYOHXAkwXDbB4jaeKq6PsJLSPkzJ2KzQ061gtBnk0vNHfA==}
+  '@swc/core-darwin-x64@1.15.40':
+    resolution: {integrity: sha512-HbbPzvfLBUXjIB1Ezks+//lNUjmLjfyd63XSwprJgrZaXYdm70kohXPJUWdqKZozolFxbPaO+xtBaiUp6BoueA==}
     engines: {node: '>=10'}
     cpu: [x64]
     os: [darwin]
 
-  '@swc/core-linux-arm-gnueabihf@1.15.33':
-    resolution: {integrity: sha512-C64hBnBxq4viOPQ8hlx+2lJ23bzZBGnjw7ryALmS+0Q3zHmwO8lw1/DArLENw4Q18/0w5wdEO1k3m1wWNtKGqQ==}
+  '@swc/core-linux-arm-gnueabihf@1.15.40':
+    resolution: {integrity: sha512-SlRZsCjOCPR2LvFs0Ri/Xrx/5o5TCt8vl4gW6mX1hEZOG0a625RxzRHpHdAQNGykmAN/7IeaFAJG+QnNmxlHcA==}
     engines: {node: '>=10'}
     cpu: [arm]
     os: [linux]
 
-  '@swc/core-linux-arm64-gnu@1.15.33':
-    resolution: {integrity: sha512-TRJfnJbX3jqpxRDRoieMzRiCBS5jOmXNb3iQXmcgjFEHKLnAgK1RZRU8Cq1MsPqO4jAJp/ld1G4O3fXuxv85uw==}
+  '@swc/core-linux-arm64-gnu@1.15.40':
+    resolution: {integrity: sha512-Q8byxJt2fh8CR3EUX6snBpy47AoBVm+In/+Z3rjDHMjC38ZvR9/gtUUNCT0tfrn4EdVsO8/QPi59nxrxvqxvBQ==}
     engines: {node: '>=10'}
     cpu: [arm64]
     os: [linux]
     libc: [glibc]
 
-  '@swc/core-linux-arm64-musl@1.15.33':
-    resolution: {integrity: sha512-il7tYM+CpUNzieQbwAjFT1P8zqAhmGWNAGhQZBnxurXZ0aNn+5nqYFTEUKNZl7QibtT0uQXzTZrNGHCIj6Y1Og==}
+  '@swc/core-linux-arm64-musl@1.15.40':
+    resolution: {integrity: sha512-4z0MgHU+7M0pZDqBN1El7mFXDI1SBwinfcUkAyA4v8QrhOIUOZltySt2aStQLZGrdXVXM4Y4ylfiTC04ED+MoQ==}
     engines: {node: '>=10'}
     cpu: [arm64]
     os: [linux]
     libc: [musl]
 
-  '@swc/core-linux-ppc64-gnu@1.15.33':
-    resolution: {integrity: sha512-ZtNBwN0Z7CFj9Il0FcPaKdjgP7URyKu/3RfH46vq+0paOBqLj4NYldD6Qo//Duif/7IOtAraUfDOmp0PLAufog==}
+  '@swc/core-linux-ppc64-gnu@1.15.40':
+    resolution: {integrity: sha512-fLI4iUgeSZu0eRWUXwe6YzPFx9gHbFiPkl8Rp3mJfP8OpNR3nTQCGPvHdDh9xniW7mVvgMY4ni7A4VzqI1KrpA==}
     engines: {node: '>=10'}
     cpu: [ppc64]
     os: [linux]
     libc: [glibc]
 
-  '@swc/core-linux-s390x-gnu@1.15.33':
-    resolution: {integrity: sha512-De1IyajoOmhOYYjw/lx66bKlyDpHZTueqwpDrWgf5O7T6d1ODeJJO9/OqMBmrBQc5C+dNnlmIufHsp4QVCWufA==}
+  '@swc/core-linux-s390x-gnu@1.15.40':
+    resolution: {integrity: sha512-YqeKMAb7d4nQSGMJQ454IlaCENpzcDqhvBE9+CPfdnYpnUXxd+BSrB6Xk0YjW8UyoEhUj4p6quATCxbsp6J3jg==}
     engines: {node: '>=10'}
     cpu: [s390x]
     os: [linux]
     libc: [glibc]
 
-  '@swc/core-linux-x64-gnu@1.15.33':
-    resolution: {integrity: sha512-mGTH0YxmUN+x6vRN/I6NOk5X0ogNktkwPnJ94IMvR7QjhRDwL0O8RXEDhyUM0YtwWrryBOqaJQBX4zruxEPRGw==}
+  '@swc/core-linux-x64-gnu@1.15.40':
+    resolution: {integrity: sha512-7HOuS1iGcme/j/TuL1TfmmLGiMQrjv/GmjyZeydl00FKPtpGXEldwqfI56xgd1YzrzoB2svWjxbGGyQ0TEASxg==}
     engines: {node: '>=10'}
     cpu: [x64]
     os: [linux]
     libc: [glibc]
 
-  '@swc/core-linux-x64-musl@1.15.33':
-    resolution: {integrity: sha512-hj628ZkSEJf6zMf5VMbYrG2O6QqyTIp2qwY6VlCjvIa9lAEZ5c2lfPblCLVGYubTeLJDxadLB/CxqQYOQABeEQ==}
+  '@swc/core-linux-x64-musl@1.15.40':
+    resolution: {integrity: sha512-h4kZYHc7dpc9P9u4brRJaS8Pl7tPVHAeiLSzw7T5RfIJgAoSdaCMKzI/2Uay9gFhaw8uyCDl0L5q37r0EpAfIA==}
     engines: {node: '>=10'}
     cpu: [x64]
     os: [linux]
     libc: [musl]
 
-  '@swc/core-win32-arm64-msvc@1.15.33':
-    resolution: {integrity: sha512-GV2oohtN2/5+KSccl86VULu3aT+LrISC8uzgSq0FRnikpD+Zwc+sBlXmoKQ+Db6jI57ITUOIB8jRkdGMABC29g==}
+  '@swc/core-win32-arm64-msvc@1.15.40':
+    resolution: {integrity: sha512-+mQgKZXSj6mV38Zh05QaxSjUDmGP/R2JWlXZTDLSPkDzHU6p3GxN9eeSf5dfyDVU86946fmCvSzyl/ucImx8+A==}
     engines: {node: '>=10'}
     cpu: [arm64]
     os: [win32]
 
-  '@swc/core-win32-ia32-msvc@1.15.33':
-    resolution: {integrity: sha512-gtyvzSNR8DHKfFEA2uqb8Ld1myqi6uEg2jyeUq3ikn5ytYs7H8RpZYC8mdy4NXr8hfcdJfCLXPlYaqqfBXpoEQ==}
+  '@swc/core-win32-ia32-msvc@1.15.40':
+    resolution: {integrity: sha512-yvwdPLGd25mcj/mNatjNQ0lZujtQD6psH3v9PNmMb+fSzjbNG8KIDxjFWrcV+fsFVLOkyOmdJsFmX7NAFjVyPw==}
     engines: {node: '>=10'}
     cpu: [ia32]
     os: [win32]
 
-  '@swc/core-win32-x64-msvc@1.15.33':
-    resolution: {integrity: sha512-d6fRqQSkJI+kmMEBWaDQ7TMl8+YjLYbwRUPZQ9DY0ORBJeTzOrG0twvfvlZ2xgw6jA0ScQKgfBm4vHLSLl5Hqg==}
+  '@swc/core-win32-x64-msvc@1.15.40':
+    resolution: {integrity: sha512-OXtKsLU1bVtInzzDEAY2sYiF/rl4tvAnLLLpuMp3HzAOQZ5A+i69AKDhA1YLQTaMAqO3vzyYNVAYVRMPtSYD4w==}
     engines: {node: '>=10'}
     cpu: [x64]
     os: [win32]
 
-  '@swc/core@1.15.33':
-    resolution: {integrity: sha512-jOlwnFV2xhuuZeAUILGFULeR6vDPfijEJ57evfocwznQldLU3w2cZ9bSDryY9ip+AsM3r1NJKzf47V2NXebkeQ==}
+  '@swc/core@1.15.40':
+    resolution: {integrity: sha512-2kwzJikRvgtNAG7MwVZY2vEzZjTxKIq5jXOihuSV/8U+Hej8Va22t65aKnJZs3P+NwojZvR8Mf8kyM7O+V8sQg==}
     engines: {node: '>=10'}
     peerDependencies:
       '@swc/helpers': '>=0.5.17'
@@ -2770,8 +2785,8 @@ packages:
   '@tsconfig/bun@1.0.10':
     resolution: {integrity: sha512-5AV5YknQjNyoYzZ/8NG0dawqew/wH+x7ANiCfCIn29qo0cdbd1EryvFD1k5NSZWLBMOI/fGqMIaxi58GPIP9Cg==}
 
-  '@tybys/wasm-util@0.10.1':
-    resolution: {integrity: sha512-9tTaPJLSiejZKx+Bmog4uSubteqTvFrVrURwkmHixBo0G4seD0zUxp98E1DzUBJxLQ3NPwXrGKDiVjwx/DpPsg==}
+  '@tybys/wasm-util@0.10.2':
+    resolution: {integrity: sha512-RoBvJ2X0wuKlWFIjrwffGw1IqZHKQqzIchKaadZZfnNpsAYp2mM0h36JtPCjNDAHGgYez/15uMBpfGwchhiMgg==}
 
   '@tybys/wasm-util@0.9.0':
     resolution: {integrity: sha512-6+7nlbMVX/PVDCwaIQ8nTOPveOcFLSt8GcXdx8hD0bt39uWxYT88uXzqTd4fTvqta7oeUJqudepapKNt2DYJFw==}
@@ -2791,8 +2806,8 @@ packages:
   '@types/estree-jsx@1.0.5':
     resolution: {integrity: sha512-52CcUVNFyfb1A2ALocQw/Dd1BQFNmSdkuC3BkZ6iqhdMfQz7JWOFRuJFloOzjk+6WijU56m9oKXFAXc7o3Towg==}
 
-  '@types/estree@1.0.8':
-    resolution: {integrity: sha512-dWHzHa2WqEXI/O1E9OjrocMTKJl2mSrEolh1Iomrv6U+JuNwaHXsXx9bLu5gG7BUWFIN0skIQJQ/L1rIex4X6w==}
+  '@types/estree@1.0.9':
+    resolution: {integrity: sha512-GhdPgy1el4/ImP05X05Uw4cw2/M93BCUmnEvWZNStlCzEKME4Fkk+YpoA5OiHNQmoS7Cafb8Xa3Pya8m1Qrzeg==}
 
   '@types/hast@3.0.4':
     resolution: {integrity: sha512-WPs+bbQw5aCj+x6laNGWLH3wviHtoCv/P3+otBhbOhJgG8qtpdAMlTCxLtsTWA7LH1Oh/bFCHsBn0TPS5m30EQ==}
@@ -2806,8 +2821,8 @@ packages:
   '@types/ms@2.1.0':
     resolution: {integrity: sha512-GsCCIZDE/p3i96vtEqx+7dBUGXrc7zeSK3wwPHIaRThS+9OhWIXRqzs4d6k1SVU8g91DrNRWxWUGhp5KXQb2VA==}
 
-  '@types/node@25.8.0':
-    resolution: {integrity: sha512-TCFSk8IZh+iLX1xtksoBVtdmgL+1IX0fC9BeU4QqFSuNdN/K+HUlhqOzEmSYYpZUVsLYcPqc9KX+60iDuninSQ==}
+  '@types/node@25.9.1':
+    resolution: {integrity: sha512-xfrlY7UD5rMJk3ZVJP8BNzS28J36YJg+xp+LPXV1TdWxr8uMH5A860QNxYDGQe/ylDSgjxE52Q9VnO7p75tJxg==}
 
   '@types/normalize-package-data@2.4.4':
     resolution: {integrity: sha512-37i+OaWTh9qeK4LSHPsyRC7NahnGotNuZvjLSgcPzblpHB3rrCJxAOgI5gCdKm7coonsaX1Of0ILiTcnZjbfxA==}
@@ -2817,8 +2832,8 @@ packages:
     peerDependencies:
       '@types/react': ^19.2.0
 
-  '@types/react@19.2.14':
-    resolution: {integrity: sha512-ilcTH/UniCkMdtexkoCN0bI7pMcJDvmQFPvuPvmEaYA/NSfFTAgdUSLAoVjaRJm7+6PvcM+q1zYOwS4wTYMF9w==}
+  '@types/react@19.2.15':
+    resolution: {integrity: sha512-eRwcGNHve+E8qtEQSSRl6urh+rFop4v8gm6O8rGv25CodbvFdLjA1vVQ1KkiFE0w0UPOnb8tDiFKL5lp0rtY5Q==}
 
   '@types/responselike@1.0.0':
     resolution: {integrity: sha512-85Y2BjiufFzaMIlvJDvTTB8Fxl2xfLo4HgmHzVBz08w4wDePCTjYw66PdrolO0kzli3yam/YCgRufyo1DdQVTA==}
@@ -2832,154 +2847,145 @@ packages:
   '@types/ws@8.18.1':
     resolution: {integrity: sha512-ThVF6DCVhA8kUGy+aazFQ4kXQ7E1Ty7A3ypFOe0IcJV8O/M511G99AW24irKrW56Wt44yG9+ij8FaqoBGkuBXg==}
 
-  '@typescript/native-preview-darwin-arm64@7.0.0-dev.20260518.1':
-    resolution: {integrity: sha512-5n6xnR8jsDjrjHkf30hVVzby/cTusPrc0f6S3hQLrTdACC9JejsrHMHV1rRu55gSAIZhhBY0pqvG3/VKB9J0tA==}
+  '@typescript/native-preview-darwin-arm64@7.0.0-dev.20260527.2':
+    resolution: {integrity: sha512-3LqSu4DlxkEfeC/Z/29QMCJn5jjkDtXI7LYuxfmjdmAatS6umDKqm8J17fnP/7fyrZUMBTIYRwSDpChGV3G1ew==}
     engines: {node: '>=16.20.0'}
     cpu: [arm64]
     os: [darwin]
 
-  '@typescript/native-preview-darwin-x64@7.0.0-dev.20260518.1':
-    resolution: {integrity: sha512-zO1lq7F6QskMZOfyQGpvnJF+DtbWtraMF/1srgtu86Yoc3MvRAnidX3R5S6l10d+r153WL0T4A8aMfZNhv2SAQ==}
+  '@typescript/native-preview-darwin-x64@7.0.0-dev.20260527.2':
+    resolution: {integrity: sha512-H4+sxE9qaBbLF83wMdWE0FsgfK0Pom+/O+/oxqyGzhVkDJlNt3vfpgQZMit48/Gm44AacGfBggJ9Dhbi3aeSFw==}
     engines: {node: '>=16.20.0'}
     cpu: [x64]
     os: [darwin]
 
-  '@typescript/native-preview-linux-arm64@7.0.0-dev.20260518.1':
-    resolution: {integrity: sha512-V/nLg3BtptWuRJnFUM2wACfZqtkqwC461eb07VabOWTkTEP+ouB7bUWapx6sbb023FiUIk3C3BPK5icjDM7GxA==}
+  '@typescript/native-preview-linux-arm64@7.0.0-dev.20260527.2':
+    resolution: {integrity: sha512-BGUDMjC2Z3TTdZRkGGwhBLelkP5UYgO2rbep8aF4dS3fu7T5lFPPrnfS6EgqJgie+cF5Fsev7xEq8wWyBDM+lg==}
     engines: {node: '>=16.20.0'}
     cpu: [arm64]
     os: [linux]
 
-  '@typescript/native-preview-linux-arm@7.0.0-dev.20260518.1':
-    resolution: {integrity: sha512-u2XUYrpqqBoYa+sb80pNURIy7OqIj1sBNecJb3+cGVxKdeBOMT2p7yPlg6ozuZnurAeUSuGwMWt5eekG0QRYVQ==}
+  '@typescript/native-preview-linux-arm@7.0.0-dev.20260527.2':
+    resolution: {integrity: sha512-6I9Cv9ozwfS9zB9vRQDPIYseLX3artEO9jl3yVgLj4ishwlSF4cWAbIsjl5IztPaEgHv8coej/6tX1D0uaBzXg==}
     engines: {node: '>=16.20.0'}
     cpu: [arm]
     os: [linux]
 
-  '@typescript/native-preview-linux-x64@7.0.0-dev.20260518.1':
-    resolution: {integrity: sha512-NpG2X1kViy7YRpw54GTanHuoH/hwLywuVvFDnoAitR7zDCGJ7OP2YMyCLMrVJX+aCjz4NPrYqROf9OfdwRyNIw==}
+  '@typescript/native-preview-linux-x64@7.0.0-dev.20260527.2':
+    resolution: {integrity: sha512-vpazOu+ozlxBo8U57YJMzsOPuxAV8H7fu36KJ8ea8At/D8pdGmOAy5TuB+9OBQV9JDe0OXJMy2kmbhOpmkTAmA==}
     engines: {node: '>=16.20.0'}
     cpu: [x64]
     os: [linux]
 
-  '@typescript/native-preview-win32-arm64@7.0.0-dev.20260518.1':
-    resolution: {integrity: sha512-Y7NTZd5yD/FxQLVxQdlK9MdXEsVQFgSOMu24p32kHthFJeVT81TYeMCr6qg0dKWCgOHGEcZtgN3jdmBz0OdaTg==}
+  '@typescript/native-preview-win32-arm64@7.0.0-dev.20260527.2':
+    resolution: {integrity: sha512-DBFnFE3V6AITkPO1K1VxXf3yEZKjU2FwtXlNwRqhzDu0rrL2SsJHOSrBDX+OacTxQFzZMxFcpiuhV8jHZALPEg==}
     engines: {node: '>=16.20.0'}
     cpu: [arm64]
     os: [win32]
 
-  '@typescript/native-preview-win32-x64@7.0.0-dev.20260518.1':
-    resolution: {integrity: sha512-bFtq+ynOjZ3zqJSSm0wMFxlstXHoxGhT+dXnj5HihmuGGjrRM5PoNbPZVnpJ4xqAwvx8KHWZchZnpAr+yPgekA==}
+  '@typescript/native-preview-win32-x64@7.0.0-dev.20260527.2':
+    resolution: {integrity: sha512-1tBlErMvQgcMqqYwsx4tytupcjCJcOUXD3vBn1Wb/kAvus1FzWQAFE0fcKBvLfcqLQfTiiEwKKEtbLjGmakqqg==}
     engines: {node: '>=16.20.0'}
     cpu: [x64]
     os: [win32]
 
-  '@typescript/native-preview@7.0.0-dev.20260518.1':
-    resolution: {integrity: sha512-aJq3XQBPkL91U0YWPQ4WUzFpfzLmfwWt5tmtzdXaIiPZisqFVeG/uw+2b4e/uL/YhPAQt9OHG0UEIGLNfoiFwA==}
+  '@typescript/native-preview@7.0.0-dev.20260527.2':
+    resolution: {integrity: sha512-piqkDwikVeizCFqA1lcwI5F4wOAtBdxuliWe77ApBNRyBPPvfCJB+u/HYi9/8t5nd0sWvFs6/qt/AzJ1CCoykQ==}
     engines: {node: '>=16.20.0'}
     hasBin: true
 
-  '@ungap/structured-clone@1.3.0':
-    resolution: {integrity: sha512-WmoN8qaIAo7WTYWbAZuG8PYEhn5fkz7dZrqTBZ7dtt//lL2Gwms1IcnQ5yHqjDfX8Ft5j4YzDM23f87zBfDe9g==}
-    deprecated: Potential CWE-502 - Update to 1.3.1 or higher
+  '@ungap/structured-clone@1.3.1':
+    resolution: {integrity: sha512-mUFwbeTqrVgDQxFveS+df2yfap6iuP20NAKAsBt5jDEoOTDew+zwLAOilHCeQJOVSvmgCX4ogqIrA0mnyr08yQ==}
 
   '@vercel/detect-agent@1.2.3':
     resolution: {integrity: sha512-VYNCgUc0nOmC4WJmWw9GkrKdfr8Zl4/rxhC5SvgacBgxiW9W/9NRttUoHHXV8xdII3MaRgkZZVX8Ikzc/Jmjag==}
     engines: {node: '>=14'}
 
-  '@verdaccio/auth@8.0.1':
-    resolution: {integrity: sha512-jq3bg0YyU5GciWMRjS22OUuVvpoV+ftlAuF49K9ctFN0PYlrJipIPu4aMd3OC4dfYaC210QEApdSM2q49/VsJg==}
+  '@verdaccio/auth@8.0.2':
+    resolution: {integrity: sha512-Qw5DhIIzNsM1ORbrnYDKQ2iA1ACWZkjWtxXrYFh577at9+H9QR45m3mMokcRVr3t2UBNFEmMb5cGTrReFa5Dzw==}
     engines: {node: '>=18'}
 
-  '@verdaccio/config@8.1.0':
-    resolution: {integrity: sha512-wMTffzodvyLa/Ob/Zd6SFRhyKQpTzBRPypvYwqLouLO+AMpUoZQ6KN197r8Xt+vclVa7ysUnGqscnKx94l2Rpg==}
+  '@verdaccio/config@8.1.1':
+    resolution: {integrity: sha512-N9nS1AAME02iuhC2B3v67NnKQp2MkUoN5uUQ2JoS2seWQ6Bjs8dnkWfh4B9N5QTVjUQx4ETYOb3M+UqUJDJT8A==}
     engines: {node: '>=18'}
 
-  '@verdaccio/core@8.0.0-next-8.29':
-    resolution: {integrity: sha512-ztsNbnHMGqpOJlC3x/Jz7+0Xzrul+UIQQAFsTFHO3pET8nyZWkh/1TH50olz0pZ/OS87O/+7mk04TK9hHD/eFQ==}
+  '@verdaccio/core@8.1.1':
+    resolution: {integrity: sha512-IIgi8PucT67ymIwxwzc+5CGQF97xAPWlqb7M2nidfIpPtlghPjURDP6xHDcBLuE57adZKcklO24kr6zFSQa7cg==}
     engines: {node: '>=18'}
 
-  '@verdaccio/core@8.1.0':
-    resolution: {integrity: sha512-rGJy2dnwVwx6QvQqh1YEfyjigX/pyKjMAqO+d6uDYGoBw8Y25sMmJqwuaZx8GTvC3HigcteZBHjkOxFiBgoNLQ==}
+  '@verdaccio/file-locking@13.0.1':
+    resolution: {integrity: sha512-SZ9uxnQKppiM+/67xTaaBP4AZ/Q+weUB22ci1gF861icYWhWFu3njA3ofYig/4yNqkYRVEKVAIwnH97BaBEYbg==}
     engines: {node: '>=18'}
 
-  '@verdaccio/file-locking@10.3.3':
-    resolution: {integrity: sha512-AT1v+1AZ7fJeyXYz35B57TTMPWctydrvdH6/Ct7p3akZeSKYJ9rQBjvdO0McxkFqpl6VAzlQVjq8ihLTPFQ4fA==}
-    engines: {node: '>=12'}
-
-  '@verdaccio/file-locking@13.0.0':
-    resolution: {integrity: sha512-wC7HzhKDC+5PDZqCmh5griU9O/PnxS0pKHDRUAKHvcaoWANPUP8PR3ONmZ9prJUIHRPexX+jQn3ATqF5ZetJcA==}
-    engines: {node: '>=18'}
-
-  '@verdaccio/hooks@8.0.1':
-    resolution: {integrity: sha512-nqxwncwA4BRP+JGhXx4qfgOa3vTUh4kc+m/9VB2b+SF2AF05z8ViqcqnWT+ZMKx5p0rAGvVUfrIQ/lcBCEWlQw==}
+  '@verdaccio/hooks@8.0.2':
+    resolution: {integrity: sha512-lneKTW6MDo28+hHqkIin08ruAafTvMake2TYUMdXWp+ah1YFI9XVzj6eo/rKHUB6sC4NxrBVajsGo1NX0OCE+A==}
     engines: {node: '>=18'}
 
-  '@verdaccio/loaders@8.0.1':
-    resolution: {integrity: sha512-RxOvAJMXSSMhNLuLYZwKXLKeK4LaznXL/+AYmW3HTHM+Ki6aJKJsmYIBzUmIoLz7aY9nYtYnPCR9ArE64e7nEw==}
+  '@verdaccio/loaders@8.0.2':
+    resolution: {integrity: sha512-Hm2xa47EXPI+Rnl3a0oTvEa1OIngze36YDHXNvHEhN35emID9iqJk1BoD5rA4Y2AdR9Jy34wRqzdqcwg9+ftSA==}
     engines: {node: '>=18'}
 
-  '@verdaccio/local-storage-legacy@11.3.1':
-    resolution: {integrity: sha512-KV66waxc03K1Lne1FfdhmURcULJQ4YdXY5qjAPZEwplRX1lCLx18pyvyRi3/98Cmt7VkIw0qA4DCXMTtwNkdIg==}
+  '@verdaccio/local-storage-legacy@11.3.3':
+    resolution: {integrity: sha512-F+cXs0Hy8tQsA6aE0hy0FaimgPfhqmetKbepOOZkstNlzOAhCzhue414VQaswKBJ/ylrmSgXP45HZjst+JNyjA==}
     engines: {node: '>=18'}
 
-  '@verdaccio/logger-commons@8.0.1':
-    resolution: {integrity: sha512-qp/wWSDKINtORtyU8RbMyswgt2AUNNH4oo7a76b/dndGDeoVMiuPZgGWbh0idHKVqyhYT8d2zRV4sUrgDV6cSQ==}
+  '@verdaccio/logger-commons@8.0.2':
+    resolution: {integrity: sha512-PzR1+0tVWzDc6aQsPCi6LVywWTXD0bp61f97On8ia4Ihms6ahP9MZzF86Mub6laBw4mBsBo45EBFaqQfotvUoA==}
     engines: {node: '>=18'}
 
-  '@verdaccio/logger-prettify@8.0.0':
-    resolution: {integrity: sha512-Yfz8Nd4vgxdCk3CrV+vWMigsPmpsFDYy6PNKSnNrPchO+cfXxdqoBtYSS+LqeXI22gVtQ1JsduGSd8O8mLtIfg==}
+  '@verdaccio/logger-prettify@8.0.1':
+    resolution: {integrity: sha512-49a5LTi90TxjQPBk7rZUf0qCorAjOopq7uQzGRro6dOEFmyaZ/K2sNiOuRFJzVuC8C8jL/zPlJiln1vm5HsAMA==}
     engines: {node: '>=18'}
 
-  '@verdaccio/logger@8.0.1':
-    resolution: {integrity: sha512-O0HV+olvcYGCGLolvH3Lm0WnWA+vCGFT5jM4yWos9oXFScrMs5X7P5iTPRzpWL0BbUlL+ygsPrB/CiPEvl4YNQ==}
+  '@verdaccio/logger@8.0.2':
+    resolution: {integrity: sha512-yxCVJP9Inr6qfdsDaOUCWWj0g0SzLY6J+62QkBafZLqIqng8IfI1NRe/6n2O3AH+YPThbqxhgaAJQ5MJTvBxOw==}
     engines: {node: '>=18'}
 
-  '@verdaccio/middleware@8.0.1':
-    resolution: {integrity: sha512-li1oQh30HHPi0wg4fF+1cKiYPdZPe35iTNuJZzKMIt8gPj4nCMVJ2Lfvj+n77LP+0BzqXmFfuLQuu4GmPcI/vQ==}
+  '@verdaccio/middleware@8.0.2':
+    resolution: {integrity: sha512-CmSoXI1/5lfH25NP3Q7ic9TEUSn6gENqauU00EhYZ/RAk/jYyPCkokSJBi9RhsAsOjOUry4yM4c3vgxLdO8Iwg==}
     engines: {node: '>=18'}
 
-  '@verdaccio/package-filter@13.0.1':
-    resolution: {integrity: sha512-sIEtylJyaZ7etQXe3S5jlxdfGLugpm7FekXk24KoJPSOcSxRP+5ZUpEuJAtCUbywg5i8oaTVxdLY4Fq/aJfVqA==}
+  '@verdaccio/package-filter@13.0.2':
+    resolution: {integrity: sha512-y9X52mCpP9AKoAB6W/ymYS5XscBNOT7HdSfYIy3BMpNJxD4+rwMO/SwKn3uAY+2RaMAgU1N7NBUmPtQAYFGhww==}
     engines: {node: '>=18'}
 
-  '@verdaccio/search-indexer@8.0.0':
-    resolution: {integrity: sha512-Wqz8HsUeUFfcCPTN90XrhNd82Pjp5wXb2r/Tk5G3PuxRMSx1oVT6wzMOuTcmeuyAJkxKIo0ZhnlSIrvrYoQIdQ==}
+  '@verdaccio/search-indexer@8.0.2':
+    resolution: {integrity: sha512-Pd2vGmb69pMuZj+WyiUMcbPU9H9Zfm0xHy0p2jDhb4PfT0rnoGgM0a7GxlmywsRuIM5obm4OCUZdhw0N8BnwYw==}
     engines: {node: '>=18'}
 
-  '@verdaccio/signature@8.0.1':
-    resolution: {integrity: sha512-m/pU1DBF4NTjG3Wn4TUWOFcQvGorTT2M+sUhzrJITAfsVv1/TbbOVLuuIMob6Wv5OB0QFaa86nbTfHmAtVai+Q==}
+  '@verdaccio/signature@8.0.2':
+    resolution: {integrity: sha512-0vmv3D2SmyJsLoN0e+O+wvjYdUxu/cxsCSRbchmK3m1dFxrGNyxEdQkdBAKDyOr2sQit5xM0XSwHRIqYrmr8Lw==}
     engines: {node: '>=18'}
 
-  '@verdaccio/streams@10.2.3':
-    resolution: {integrity: sha512-rDXAMZNIpAO5n/bz2xewrIy9RdL1jCYL4SF8A7NGv5GU6Bcx/rJk3/BqsVP29rfIKZWvdgS5uNVer1QpDe0skg==}
+  '@verdaccio/streams@10.2.5':
+    resolution: {integrity: sha512-nVnTYeMJ7h131Nkv2svqZCfL5aDkJbwUvQd4OGXssbJJR5BfB2PzNq8TD45lEXIBW3EMMMFs7mVY789ds9soIA==}
     engines: {node: '>=12', npm: '>=5'}
 
-  '@verdaccio/tarball@13.0.1':
-    resolution: {integrity: sha512-5iWelTXHopMoNGQdX2BTD8QVueNAaHXbI8W6TaV95HFeTuocNwYCW5zm2BullCjBE5uT0P/uqMIk8Uwf5VLK4A==}
+  '@verdaccio/tarball@13.0.2':
+    resolution: {integrity: sha512-LQHoAlp7yk5Tlhv+uHWJKtExwbMDBvwTvoAsdWMq4sRjCrdJSz8KTfWEBrb0EayxEwPr0LmI0ce8mIriId9Zow==}
     engines: {node: '>=18'}
 
   '@verdaccio/ui-theme@9.0.0-next-9.14':
     resolution: {integrity: sha512-0PQW6PV+sHsQdV3gnHQqAcDcVGfT75vHq1TfIeEN2QY5KuEkvli8e5vut+sTe89p+GOTahHKgTMOcL0O3BvsgA==}
 
-  '@verdaccio/url@13.0.1':
-    resolution: {integrity: sha512-vZfhn7yAPHWOQA8t3QVubMLYCmYD6PNrP9BDebzvWHbSMcx+9ouNO52KNYM6RkTepSsq0sm5f//Bwt1HUPXpuw==}
+  '@verdaccio/url@13.0.2':
+    resolution: {integrity: sha512-dXVBJETBV5Q/jz7R/fTQxnzsTjgnDBEh2v8aOKtngwBEf7YkgzU7LrtyzkGmyRzXUvS5ZSAXWrBAKQ4DEIZ/6w==}
     engines: {node: '>=18'}
 
-  '@verdaccio/utils@8.1.1':
-    resolution: {integrity: sha512-yfaiOIbI/aLF0BDZd3naeswG3z69fTRh00svq5SLEUCbreqyFOcelbzTgOjcO4M9pddJWi2/mK+TgdJQZ3MbPg==}
+  '@verdaccio/utils@8.1.2':
+    resolution: {integrity: sha512-LTV6/Kcr8pS//iDjDitfYi1bp0AlKBUuvNoHAbI8tMnj0PLOUtRWJxId5FwuE+z3oNBeDLeOWPoXVtqKjl277Q==}
     engines: {node: '>=18'}
 
-  '@vitest/coverage-istanbul@4.1.6':
-    resolution: {integrity: sha512-lOt/VDh+sihAx3OUxCE5CC0qZfAhIzE3Dxw75NJ3P0C6ruUgT9b/jZKECE1ctpbxSVic9OkLdXz5UEX39ks4Sw==}
+  '@vitest/coverage-istanbul@4.1.7':
+    resolution: {integrity: sha512-EbruXy+E9MJk+y7sFzriYfoI4JP2Ow+SyWDkewFOWFjzrbQBHlEgi6dGE7pxge8Z+W+7oJOxAVVb6mQHKCCZlw==}
     peerDependencies:
-      vitest: 4.1.6
+      vitest: 4.1.7
 
-  '@vitest/expect@4.1.6':
-    resolution: {integrity: sha512-7EHDquPthALSV0jhhjgEW8FXaviMx7rSqu8W6oqCoAuOhKov814P99QDV1pxMA3QPv21YudvJngIhjrNI4opLg==}
+  '@vitest/expect@4.1.7':
+    resolution: {integrity: sha512-1R+tw0ortHEbZDGMymm+pN7/AFQ/RkFFdtd7EN+VBpynKmLbP8A3rpEXdshBJ7+8hQ9zBJh/i1s0yKNtxAnU7w==}
 
-  '@vitest/mocker@4.1.6':
-    resolution: {integrity: sha512-MCFc63czMjEInOlcY2cpQCvCN+KgbAn+60xu9cMgP4sKaLC5JNAKw7JH8QdAnoAC88hW1IiSNZ+GgVXlN1UcMQ==}
+  '@vitest/mocker@4.1.7':
+    resolution: {integrity: sha512-vY7nuamKgfvpA1Koa3oYIw/k7D6kZnpGyNMZW8loow2bsBYla1TFdqTaXncWdRn4pgwNs+90RhnXhJScDwQeJA==}
     peerDependencies:
       msw: ^2.4.9
       vite: ^6.0.0 || ^7.0.0 || ^8.0.0
@@ -2989,20 +2995,20 @@ packages:
       vite:
         optional: true
 
-  '@vitest/pretty-format@4.1.6':
-    resolution: {integrity: sha512-h5SxD/IzNhZYnrSZRsUZQIC+vD0GY8cUvq0iwsmkFKixRCKLLWqCXa/FIQ4S1R+sI+PGoojkHsdNrbZiM9Qpgw==}
+  '@vitest/pretty-format@4.1.7':
+    resolution: {integrity: sha512-umgCarTOYQWIaDMvGDRZij+6b9oVeLIyJzfN+AS88e0ZOU3QTgNNSTtjQOpcvWr3np1N0j4WgZj+sb3oYBDscw==}
 
-  '@vitest/runner@4.1.6':
-    resolution: {integrity: sha512-nOPCmn2+yD0ZNmKdsXGv/UxMMWbMuKeD6GyYncNwdkYDxpQvrPSKYj2rWuDjC2Y4b6w6hjip5dBKFzEUuZe3vA==}
+  '@vitest/runner@4.1.7':
+    resolution: {integrity: sha512-BapjmAQ2aI78WdMEfeUWivnfVzB+VPGwWRQcJE0OUq7qEeEcBsCSf+0T5iREBNE5nBb4wA5Ya0W6IA+sghdEFw==}
 
-  '@vitest/snapshot@4.1.6':
-    resolution: {integrity: sha512-YhsdE6xAVfTDmzjxL2ZDUvjj+ZsgyOKe+TdQzqkD72wIOmHka8NuGQ6NpTNZv9D2Z63fbwWKJPeVpEw4EQgYxw==}
+  '@vitest/snapshot@4.1.7':
+    resolution: {integrity: sha512-ZacLzja+TmJeZ1h14xW2FB/WpeimUD3haBXQPyJqxvo8jQTmfeA8zv58mtjN2C7EHXZDYVcVYdYmAxjkWVvKCw==}
 
-  '@vitest/spy@4.1.6':
-    resolution: {integrity: sha512-JFKxMx6udhwKh/Ldo270e17QX710vgunMkuPAvXjHSvC6oqLWAHhVhjg/I71q0u0CBSErIODV1Kjv0FQNSWjdg==}
+  '@vitest/spy@4.1.7':
+    resolution: {integrity: sha512-kbkI5LMWakyuTIvs6fUJ5qdIVb1XVKsYJAT4OJ938cHMROYMSfmoQdZy0aaAnjbbc8F61vkoTqz/Az+/HiIu5Q==}
 
-  '@vitest/utils@4.1.6':
-    resolution: {integrity: sha512-FxIY+U81R3LGKCxaHHFRQ5+g6/iRgGLmeHWdp2Amj4ljQRrEIWHmZyDfDYBRZlpyqA7qKxtS9DD1dhk8RnRIVQ==}
+  '@vitest/utils@4.1.7':
+    resolution: {integrity: sha512-T532WBu791cBxJlCl6SO+J14l81DQx6uQHm1bQbmCDY7nqlEIgkza/UFnSBNaUtSf41unldDFjdOBYEQC4b5Hw==}
 
   '@yarnpkg/lockfile@1.1.0':
     resolution: {integrity: sha512-GpSwvyXOcOOlV70vbnzjj4fW5xW/FdUF6nQEt1ENy7m4ZCczi1+/buVUPAqmGfqznsORNFzUMjctTIp8a9tuCQ==}
@@ -3037,17 +3043,14 @@ packages:
     resolution: {integrity: sha512-RZNwNclF7+MS/8bDg70amg32dyeZGZxiDuQmZxKLAlQjr3jGyLx+4Kkk58UO7D2QdgFIQCovuSuZESne6RG6XQ==}
     engines: {node: '>= 6.0.0'}
 
-  agent-base@7.1.4:
-    resolution: {integrity: sha512-MnA+YT8fwfJPgBx3m60MNqakm30XOkyIoH1y6huTQvC0PwZG7ki8NacLBcrPbNoo8vEZy7Jpuk7+jMO+CUovTQ==}
-    engines: {node: '>= 14'}
+  agent-base@9.0.0:
+    resolution: {integrity: sha512-TQf59BsZnytt8GdJKLPfUZ54g/iaUL2OWDSFCCvMOhsHduDQxO8xC4PNeyIkVcA5KwL2phPSv0douC0fgWzmnA==}
+    engines: {node: '>= 20'}
 
   aggregate-error@5.0.0:
     resolution: {integrity: sha512-gOsf2YwSlleG6IjRYG2A7k0HmBMEo6qVNk9Bp/EaLgAJT5ngH6PXbqa4ItvnEwCm/velL5jAnQgsHsWnjhGmvw==}
     engines: {node: '>=18'}
 
-  ajv@8.17.1:
-    resolution: {integrity: sha512-B/gBuNg5SiMTrPkC+A2+cW0RszwxYmn6VYxB/inlBStS5nx6xHIt/ehKRhIMhqusl7a8LjQoZnjCs5vhwxOQ1g==}
-
   ajv@8.18.0:
     resolution: {integrity: sha512-PlXPeEWMXMZ7sPYOHqmDyCJzcfNrUr3fGNKtezX14ykXOEIvyK81d+qydx89KY5O71FKMPaQ2vBfBFI5NHR63A==}
 
@@ -3144,8 +3147,8 @@ packages:
   axios@1.16.0:
     resolution: {integrity: sha512-6hp5CwvTPlN2A31g5dxnwAX0orzM7pmCRDLnZSX772mv8WDqICwFjowHuPs04Mc8deIld1+ejhtaMn5vp6b+1w==}
 
-  b4a@1.8.0:
-    resolution: {integrity: sha512-qRuSmNSkGQaHwNbM7J78Wwy+ghLEYF1zNrSeMxj4Kgw6y33O3mXcQ6Ie9fRvfU/YnxWkOchPXbaLb73TkIsfdg==}
+  b4a@1.8.1:
+    resolution: {integrity: sha512-aiqre1Nr0B/6DgE2N5vwTc+2/oQZ4Wh1t4NznYY4E00y8LCt6NqdRv81so00oo27D8MVKTpUa/MwUUtBLXCoDw==}
     peerDependencies:
       react-native-b4a: '*'
     peerDependenciesMeta:
@@ -3162,12 +3165,8 @@ packages:
     resolution: {integrity: sha512-1pHv8LX9CpKut1Zp4EXey7Z8OfH11ONNH6Dhi2WDUt31VVZFXZzKwXcysBgqSumFCmR+0dqjMK5v5JiFHzi0+g==}
     engines: {node: 20 || >=22}
 
-  balanced-match@4.0.4:
-    resolution: {integrity: sha512-BLrgEcRTwX2o6gGxGOCNyMvGSp35YofuYzw9h1IMTRmKqttAZZVU67bdb9Pr2vUHA8+j3i2tJfjO6C6+4myGTA==}
-    engines: {node: 18 || 20 || >=22}
-
-  bare-events@2.8.2:
-    resolution: {integrity: sha512-riJjyv1/mHLIPX4RwiK+oW9/4c3TEUeORHKefKAKnZ5kyslbN+HXowtbaVEqt4IMUB7OXlfixcs6gsFeo/jhiQ==}
+  bare-events@2.8.3:
+    resolution: {integrity: sha512-HdUm8EMQBLaJvGUdidNNbqpA1kYkwNcb+MYxkxCLAPJGQzlv9J0C24h8V65Z4c5GLd/JEALDvpFCQgpLJqc0zw==}
     peerDependencies:
       bare-abort-controller: '*'
     peerDependenciesMeta:
@@ -3194,18 +3193,18 @@ packages:
   bl@4.1.0:
     resolution: {integrity: sha512-1W07cM9gS6DcLperZfFSj+bWLtaPGSOHWhPiGzXmvVJbRLdG82sH/Kn8EtW1VqWVA54AKf2h5k5BbnIbwF3h6w==}
 
-  body-parser@1.20.4:
-    resolution: {integrity: sha512-ZTgYYLMOXY9qKU/57FAo8F+HA2dGX7bqGc71txDRC1rS4frdFI5R7NhluHxH6M0YItAP0sHB4uqAOcYKxO6uGA==}
+  body-parser@1.20.5:
+    resolution: {integrity: sha512-3grm+/2tUOvu2cjJkvsIxrv/wVpfXQW4PsQHYm7yk4vfpu7Ekl6nEsYBoJUL6qDwZUx8wUhQ8tR2qz+ad9c9OA==}
     engines: {node: '>= 0.8', npm: 1.2.8000 || >= 1.4.16}
 
   bottleneck@2.19.5:
     resolution: {integrity: sha512-VHiNCbI1lKdl44tGrhNfU3lup0Tj/ZBMJB5/2ZbNXRCPuRCO7ed2mgcK4r17y+KB2EfuYuRaVlwNbAeaWGSpbw==}
 
-  brace-expansion@2.1.0:
-    resolution: {integrity: sha512-TN1kCZAgdgweJhWWpgKYrQaMNHcDULHkWwQIspdtjV4Y5aurRdZpjAqn6yX3FPqTA9ngHCc4hJxMAMgGfve85w==}
+  brace-expansion@2.1.1:
+    resolution: {integrity: sha512-WR1cURNjuvBLMZBMbqM0UoE+WAfdUcEV1ccD8PVBVOI+Z3ND4+SZbN8RsfT2bMuG1qwz5RFvPukSZm5fF2D5eA==}
 
-  brace-expansion@5.0.5:
-    resolution: {integrity: sha512-VZznLgtwhn+Mact9tfiwx64fA9erHH/MCXEUfB/0bX/6Fz6ny5EGTXYltMocqg4xFAQZtnO3DHWWXi8RiuN7cQ==}
+  brace-expansion@5.0.6:
+    resolution: {integrity: sha512-kLpxurY4Z4r9sgMsyG0Z9uzsBlgiU/EFKhj/h91/8yHu0edo7XuixOIH3VcJ8kkxs6/jPzoI6U9Vj3WqbMQ94g==}
     engines: {node: 18 || 20 || >=22}
 
   braces@3.0.3:
@@ -3359,6 +3358,10 @@ packages:
     resolution: {integrity: sha512-BSeNnyus75C4//NQ9gQt1/csTXyo/8Sb+afLAkzAptFuMsod9HFokGNudZpi/oQV73hnVK+sR+5PVRMd+Dr7YQ==}
     engines: {node: '>=12'}
 
+  cliui@9.0.1:
+    resolution: {integrity: sha512-k7ndgKhwoQveBL+/1tqGJYNz097I7WOvwbmmU2AR5+magtbjPWQTS1C5vzGkBC8Ym8UWRzfKUzUUqFLypY4Q+w==}
+    engines: {node: '>=20'}
+
   clone-response@1.0.3:
     resolution: {integrity: sha512-ROoL94jJH2dUVML2Y/5PEDNaSHgeOdSDicUyS7izcF63G6sTc/FTjLub4b8Il9S8S0beOfYt0TaA5qvFK+w0wA==}
 
@@ -3599,6 +3602,10 @@ packages:
     resolution: {integrity: sha512-47qPchRCykZC03FhkYAhrvwU4xDBFIj1QPqaarj6mdM/hgUzfPHcpkHJOn3mJAufFeeAxAzeGsr5X0M4k6fLZQ==}
     engines: {node: '>=12'}
 
+  dotenv@17.4.2:
+    resolution: {integrity: sha512-nI4U3TottKAcAD9LLud4Cb7b2QztQMUEfHbvhTH09bqXTxnSie8WnjPALV/WMCrJZ6UV/qHJ6L03OqO3LcdYZw==}
+    engines: {node: '>=12'}
+
   dunder-proto@1.0.1:
     resolution: {integrity: sha512-KIN/nDJBQRcXw0MLVhZE9iQHmG68qAVIBg9CqmUYjmQIhgij9U5MFvrqkUL5FbtyyzZuOeOt0zdeRe4UY7ct+A==}
     engines: {node: '>= 0.4'}
@@ -3618,8 +3625,8 @@ packages:
   ee-first@1.1.1:
     resolution: {integrity: sha512-WMwm9LhRUo+WUaRN+vRuETqG89IgZphVSNkdFgeb6sS/E4OrDIN7t48CAewSHXc6C8lefD8KKfr5vY61brQlow==}
 
-  effect@4.0.0-beta.67:
-    resolution: {integrity: sha512-cQ1pVkbmB45VnFffQcmXuIuAT6b+t74JPKeJRqv6qT6MhilYQbLccrBu//jrxtlWpILfIzz09+s1QQrhOFmFKQ==}
+  effect@4.0.0-beta.74:
+    resolution: {integrity: sha512-Yx+Kh12U+i2FmjwEfKs+ePFmpMd43RPD1oGqc/VraSS9bYzvF0Ff3PojwEFEVEewp8xc92Uxu28gTspU4qyvHA==}
 
   ejs@5.0.1:
     resolution: {integrity: sha512-COqBPFMxuPTPspXl2DkVYaDS3HtrD1GpzOGkNTJ1IYkifq/r9h8SVEFrjA3D9/VJGOEoMQcrlhpntcSUrM8k6A==}
@@ -3629,6 +3636,9 @@ packages:
   electron-to-chromium@1.5.343:
     resolution: {integrity: sha512-YHnQ3MXI08icvL9ZKnEBy05F2EQ8ob01UaMOuMbM8l+4UcAq6MPPbBTJBbsBUg3H8JeZNt+O4fjsoWth3p6IFg==}
 
+  emoji-regex@10.6.0:
+    resolution: {integrity: sha512-toUI84YS5YmxW219erniWD0CIVOo46xGKColeNQRgOzDorgBi1v4D71/OFzgD9GO2UGKIv1C3Sp8DAn0+j5w7A==}
+
   emoji-regex@8.0.0:
     resolution: {integrity: sha512-MSjYzcWNOA0ewAHpz0MxpYFvwg6yjy1NG3xteoqz644VCo/RPgnr1/GGt+ic3iJTzQ8Eu3TdM14SawnVUmGE6A==}
 
@@ -3689,8 +3699,8 @@ packages:
     resolution: {integrity: sha512-j6vWzfrGVfyXxge+O0x5sh6cvxAog0a/4Rdd2K36zCMV5eJ+/+tOAngRO8cODMNWbVRdVlmGZQL2YS3yR8bIUA==}
     engines: {node: '>= 0.4'}
 
-  es-toolkit@1.46.0:
-    resolution: {integrity: sha512-IToJ6ct9OLl5zz6WsC/1vZEwfSZ7Myil+ygl5Tf30Xjn9AEkzNB4kqp2G7VUJKF1DtTx/ra5M5KLlXvzOg51BA==}
+  es-toolkit@1.47.0:
+    resolution: {integrity: sha512-n1GuoD0WEQZMBk5tttoZSqwgyLx01oqa5XsBmCHwPyNe1S9jPBEmtR2pSgp2kJuWE3ciFZ6yRHmY4pM4C3OOkw==}
 
   esast-util-from-estree@2.0.0:
     resolution: {integrity: sha512-4CyanoAudUSBAn5K13H4JhsMH6L9ZP7XbLVe/dKybkxMO7eDyLsT8UHl9TRNrU2Gr9nz+FovfSIjuXWJ81uVwQ==}
@@ -3796,9 +3806,6 @@ packages:
     resolution: {integrity: sha512-GOJ158CUMnN6cSahsv4+ExARvIDuzzinFjkp0E9WtiBa5zcVeLozVkWaE4IzFcc+Y48Wp1EDlUZsXRyAztQcSg==}
     engines: {node: '>=12.17.0'}
 
-  fast-content-type-parse@3.0.0:
-    resolution: {integrity: sha512-ZvLdcY8P+N8mGQJahJV5G4U88CSvT1rP8ApL6uETe88MBXrBHAkZlSEySdUlyztF7ccb+Znos3TFqaepHxdhBg==}
-
   fast-deep-equal@3.1.3:
     resolution: {integrity: sha512-f3qQ9oQy9j2AhBe/H9VC91wLmKBCCU/gDOnKNAYG5hswO7BLKj09Hc5HYNz9cGI++xlpDCIgDaitVs03ATR84Q==}
 
@@ -3815,8 +3822,8 @@ packages:
   fast-string-width@3.0.2:
     resolution: {integrity: sha512-gX8LrtNEI5hq8DVUfRQMbr5lpaS4nMIWV+7XEbXk2b8kiQIizgnlr12B4dA3ZEx3308ze0O4Q1R+cHts8kyUJg==}
 
-  fast-uri@3.1.0:
-    resolution: {integrity: sha512-iPeeDKJSWf4IEOasVVrknXpaBV0IApz/gp7S2bb7Z4Lljbl2MGJRqInZiUrQwV16cpzw/D3S5j5Julj/gT52AA==}
+  fast-uri@3.1.2:
+    resolution: {integrity: sha512-rVjf7ArG3LTk+FS6Yw81V1DLuZl1bRbNrev6Tmd/9RaroeeRRJhAt7jg/6YFxbvAQXUCavSoZhPPj6oOx+5KjQ==}
 
   fast-wrap-ansi@0.2.0:
     resolution: {integrity: sha512-rLV8JHxTyhVmFYhBJuMujcrHqOT2cnO5Zxj37qROj23CP39GXubJRBUFF0z8KFK77Uc0SukZUf7JZhsVEQ6n8w==}
@@ -3903,8 +3910,8 @@ packages:
     resolution: {integrity: sha512-buRG0fpBtRHSTCOASe6hD258tEubFoRLb4ZNA6NxMVHNw2gOcwHo9wyablzMzOA5z9xA9L1KNjk/Nt6MT9aYow==}
     engines: {node: '>= 0.6'}
 
-  framer-motion@12.38.0:
-    resolution: {integrity: sha512-rFYkY/pigbcswl1XQSb7q424kSTQ8q6eAC+YUsSKooHQYuLdzdHjrt6uxUC+PRAO++q5IS7+TamgIw1AphxR+g==}
+  framer-motion@12.40.0:
+    resolution: {integrity: sha512-uaBd3qC1v3KQqBEjwTUd183K6PbS+j0yR9w9VmEOLWA/tnUcSn8Xa3uck7t4dgpDoUss8xQTcj8W2L07lrnLFg==}
     peerDependencies:
       '@emotion/is-prop-valid': '*'
       react: ^18.0.0 || ^19.0.0
@@ -3933,8 +3940,8 @@ packages:
     engines: {node: ^8.16.0 || ^10.6.0 || >=11.0.0}
     os: [darwin]
 
-  fumadocs-core@16.8.11:
-    resolution: {integrity: sha512-HphKuDwPXgVsmRd82Bu5VHZZ8b7uR4ewgCUbUewhElNKIJXDPuyt7ju6LTQbD0E0Sos/cAN5k40Ym1agOirquA==}
+  fumadocs-core@16.9.1:
+    resolution: {integrity: sha512-8VW4aD1iG5SrCChRq84QpNyjKY69i5WfUFFgtx/LSUuX1RewWb0qps7DhKLSjOWraemhZatzsZ7iceivJmYRTg==}
     peerDependencies:
       '@mdx-js/mdx': '*'
       '@mixedbread/sdk': 0.x.x
@@ -3992,8 +3999,8 @@ packages:
       zod:
         optional: true
 
-  fumadocs-mdx@15.0.6:
-    resolution: {integrity: sha512-4xODBBfy0/3/N7RQCcZPHdrpAeduwEcYEQC2aFiQlTZHCa/PMms0NOJNaaJgG+cg0G/b3ugqaiKifKE+z2Ndug==}
+  fumadocs-mdx@15.0.9:
+    resolution: {integrity: sha512-ulKFGcx1r5Irk3Cu7h8M/DH66xba9evdOftURBbnASXWwJIIIahAp7s8oQdDuXtvkzjfv4/M/LpkTxrhkiS2JQ==}
     hasBin: true
     peerDependencies:
       '@types/mdast': '*'
@@ -4023,13 +4030,13 @@ packages:
       vite:
         optional: true
 
-  fumadocs-ui@16.8.11:
-    resolution: {integrity: sha512-+yQVy1/wPLuw6X7plmz8fiuQu/xJd8pCEApUoUXaB14Ts658GC+1bXuz97yDFslL0uLrA6y2yAaaMdztNlLeeQ==}
+  fumadocs-ui@16.9.1:
+    resolution: {integrity: sha512-2A8wO/RuoV0eOgabKMlcjBEPQKynbE4wkxoTfAj/E6bYCid/zY3DG+hhSI1Ssen5ws/73mFPacIEBsWhdAAsnw==}
     peerDependencies:
       '@takumi-rs/image-response': '*'
       '@types/mdx': '*'
       '@types/react': '*'
-      fumadocs-core: 16.8.11
+      fumadocs-core: 16.9.1
       next: 16.x.x
       react: ^19.2.0
       react-dom: ^19.2.0
@@ -4050,6 +4057,10 @@ packages:
     resolution: {integrity: sha512-939eZS4gJ3htTHAldmyyuzlrD58P03fHG49v2JfFXbV6OhvZKRC9j2yAtdHw/zrp2zXHuv05zMIy40F0ge7spA==}
     engines: {node: '>=18'}
 
+  fuse.js@7.3.0:
+    resolution: {integrity: sha512-plz8RVjfcDedTGfVngWH1jmJvBvAwi1v2jecfDerbEnMcmOYUEEwKFTHbNoCiYyzaK2Ws8lABkTCcRSqCY1q4w==}
+    engines: {node: '>=10'}
+
   gensync@1.0.0-beta.2:
     resolution: {integrity: sha512-3hN7NaskYvMDLQY55gnW3NQ+mesEAepTqlg+VEbj7zzqEMBVNhzcGYYeqFo/TlYz6eQiFcp1HcsCZO+nGgS8zg==}
     engines: {node: '>=6.9.0'}
@@ -4058,8 +4069,8 @@ packages:
     resolution: {integrity: sha512-DyFP3BM/3YHTQOCUL/w0OZHR0lpKeGrxotcHWcqNEdnltqFwXVfhEBQ94eIo34AfQpo0rGki4cyIiftY06h2Fg==}
     engines: {node: 6.* || 8.* || >= 10.*}
 
-  get-east-asian-width@1.5.0:
-    resolution: {integrity: sha512-CQ+bEO+Tva/qlmw24dCejulK5pMzVnUOFOijVogd3KQs07HnRIgp8TGipvCCRT06xeYEbpbgwaCxglFyiuIcmA==}
+  get-east-asian-width@1.6.0:
+    resolution: {integrity: sha512-QRbvDIbx6YklUe6RxeTeleMR0yv3cYH6PsPZHcnVn7xv7zO1BHN8r0XETu8n6Ye3Q+ahtSarc3WgtNWmehIBfA==}
     engines: {node: '>=18'}
 
   get-intrinsic@1.3.0:
@@ -4153,10 +4164,6 @@ packages:
     resolution: {integrity: sha512-0hJU9SCPvmMzIBdZFqNPXWa6dqh7WdH0cII9y+CyS8rG3nL48Bclra9HmKhVVUHyPWNH5Y7xDwAB7bfgSjkUMQ==}
     engines: {node: '>= 0.4'}
 
-  hasown@2.0.3:
-    resolution: {integrity: sha512-ej4AhfhfL2Q2zpMmLo7U1Uv9+PyhIZpgQLGT1F9miIGmiCJIoCgSmczFdrc97mWT4kVY72KA+WnnhJ5pghSvSg==}
-    engines: {node: '>= 0.4'}
-
   hast-util-from-parse5@8.0.3:
     resolution: {integrity: sha512-3kxEVkEKt0zvcZ3hCRYI8rqrgwtlIOFMWkbclACvjlDw8Li9S2hk/d51OI0nr/gIpdMHNepwgOKqZ/sy0Clpyg==}
 
@@ -4195,9 +4202,9 @@ packages:
     resolution: {integrity: sha512-puUZAUKT5m8Zzvs72XWy3HtvVbTWljRE66cP60bxJzAqf2DgICo7lYTY2IHUmLnNpjYvw5bvmoHvPc0QO2a62w==}
     engines: {node: ^16.14.0 || >=18.0.0}
 
-  hosted-git-info@8.1.0:
-    resolution: {integrity: sha512-Rw/B2DNQaPBICNXEm8balFz9a6WpZrkCGpcWFpy7nCj+NyhSdqXipmfvtmWt9xGfp0wZnBxB+iVpLmQMYt47Tw==}
-    engines: {node: ^18.17.0 || >=20.5.0}
+  hosted-git-info@9.0.3:
+    resolution: {integrity: sha512-Hc+ghLoSt6QaYZUv0WBiIvmMDZuZZ7oaDvdH8MbfOO4lOsxdXLEvuC6ePoGs9H1X9oCLyq6+NVN0MKqD+ydxyg==}
+    engines: {node: ^20.17.0 || >=22.9.0}
 
   html-escaper@2.0.2:
     resolution: {integrity: sha512-H2iMtd0I4Mt5eYiapRdIDjp+XzelXQ0tFE4JS7YFwFevXXMmOp9myNrUvCg0D6ws8iqkRPBfKHgbwig1SmlLfg==}
@@ -4208,17 +4215,13 @@ packages:
   http-cache-semantics@4.2.0:
     resolution: {integrity: sha512-dTxcvPXqPvXBQpq5dUr6mEMJX4oIEFv6bwom3FDwKRDsuIjjJGANqhBuoAn9c1RQJIdAKav33ED65E2ys+87QQ==}
 
-  http-errors@2.0.0:
-    resolution: {integrity: sha512-FtwrG/euBzaEjYeRqOgly7G0qviiXoJWnvEH2Z1plBdXgbyjv34pHTSb9zoeHMyDy33+DWy5Wt9Wo+TURtOYSQ==}
-    engines: {node: '>= 0.8'}
-
   http-errors@2.0.1:
     resolution: {integrity: sha512-4FbRdAX+bSdmo4AUFuS0WNiPz8NgFt+r8ThgNWmlrjQjt1Q7ZR9+zTlce2859x4KSXrwIsaeTqDoKQmtP8pLmQ==}
     engines: {node: '>= 0.8'}
 
-  http-proxy-agent@7.0.2:
-    resolution: {integrity: sha512-T1gkAiYYDWYx3V5Bmyu7HcfcvL7mUrTWiM6yOfa3PIphViJ/gFPbvidQ+veqSOHci/PxBcDabeUNCzpOODJZig==}
-    engines: {node: '>= 14'}
+  http-proxy-agent@9.0.0:
+    resolution: {integrity: sha512-FcF8VhXYLQcxWCnt/cCpT2apKsRDUGeVEeMqGu4HSTu29U8Yw0TLOjdYIlDsYk3IkUh+taX4IDWpPcCqKDhCjA==}
+    engines: {node: '>= 20'}
 
   http-signature@1.4.0:
     resolution: {integrity: sha512-G5akfn7eKbpDN+8nPS/cb57YeA1jLTVxjpCj7tmm3QKPdyDy7T+qSC40e9ptydSWvkwjSXw1VbkpyEm39ukeAg==}
@@ -4235,9 +4238,9 @@ packages:
     resolution: {integrity: sha512-dFcAjpTQFgoLMzC2VwU+C/CbS7uRL0lWmxDITmqm7C+7F0Odmj6s9l6alZc6AELXhrnggM2CeWSXHGOdX2YtwA==}
     engines: {node: '>= 6'}
 
-  https-proxy-agent@7.0.6:
-    resolution: {integrity: sha512-vK9P5/iUfdl95AI+JVyUuIcVtd4ofvtrOr3HNtM2yxC9bnMbEdp3x01OhQNnjb8IJYi38VlTE3mBXwcfvywuSw==}
-    engines: {node: '>= 14'}
+  https-proxy-agent@9.0.0:
+    resolution: {integrity: sha512-/MVmHp58WkOypgFhCLk4fzpPcFQvTJ/e6LBI7irpIO2HfxUbpmYoHF+KzipzJpxxzJu7aJNWQ0xojJ/dzV2G5g==}
+    engines: {node: '>= 20'}
 
   human-signals@5.0.0:
     resolution: {integrity: sha512-AXcZb6vzzrFAUE61HnN4mpLqd/cSIwNQjtNWR0euPm6y0iqx3G4gOXaIDdtdDwZmhwe82LA6+zinmW4UBWVePQ==}
@@ -4302,8 +4305,8 @@ packages:
       ink: '>=4.0.0'
       react: '>=18.0.0'
 
-  ink@7.0.3:
-    resolution: {integrity: sha512-5kxHkIj9+RuqCU3zyvP4qvYWNOSHP2TW/SHayHGHOmk87KwfVcZwvJGemi9ch+ci2gXUqerK/Eh2DGEDt5q45g==}
+  ink@7.0.4:
+    resolution: {integrity: sha512-4wsM/gMKOT2ZANNTJibI6I9IcwBfobqv/CgaDcwvOaCREZIQxo3iGQS7qPHa2hmA67NYltZWCMtBDELB/mcbJQ==}
     engines: {node: '>=22'}
     peerDependencies:
       '@types/react': '>=19.2.0'
@@ -4517,8 +4520,8 @@ packages:
   keyv@4.5.4:
     resolution: {integrity: sha512-oxVHkHR/EJf2CNXnWxRLW6mg7JyCCUcG0DtEGmL2ctUo1PNTin1PUil+r/+4r5MpVgC/fn1kjsx7mjSujKqIpw==}
 
-  knip@6.14.1:
-    resolution: {integrity: sha512-SN3Ly0ixzj5CQkY/rc4OPHpWrCC0XRIIjgdP76G9Cni5k72ur5jBYOyvJuF5oPTM14v8eHcMUgPbElHa+lnR0g==}
+  knip@6.14.2:
+    resolution: {integrity: sha512-Vg3JhIINjZew1I7qAFI4UHemW1mc4azP/BxJvsq9eGDfxpGO7oVCuD/bsWkog9TO/ZwwJeAeOMFZ1kd9jnY9+Q==}
     engines: {node: ^20.19.0 || >=22.12.0}
     hasBin: true
 
@@ -4677,6 +4680,10 @@ packages:
   lru-cache@10.4.3:
     resolution: {integrity: sha512-JNAzZcXrCt42VGLuYz0zfAzDfAvJWW6AfYlDBQyDV5DClI2m5sAmK+OIO7s59XfsRsWHp02jAJrRadPRGTt6SQ==}
 
+  lru-cache@11.5.0:
+    resolution: {integrity: sha512-5YgH9UJd7wVb9hIouI2adWpgqrrICkt070Dnj8EUY1+B4B2P9eRLPAkAAo6NICA7CEhOIeBHl46u9zSNpNu7zA==}
+    engines: {node: 20 || >=22}
+
   lru-cache@5.1.1:
     resolution: {integrity: sha512-KpNARQA3Iwv+jTA0utUVVbrh+Jlrr1Fv0e56GGzAFOXN7dk/FviaDW8LHmK52DlcH4WP2n6gI8vN1aesBFgo9w==}
 
@@ -4951,10 +4958,6 @@ packages:
     resolution: {integrity: sha512-MULkVLfKGYDFYejP07QOurDLLQpcjk7Fw+7jXS2R2czRQzR56yHRveU5NDJEOviH+hETZKSkIk5c+T23GjFUMg==}
     engines: {node: 18 || 20 || >=22}
 
-  minimatch@7.4.6:
-    resolution: {integrity: sha512-sBz8G/YjVniEz6lKPNpKxXwazJe4c19fEfV2GDMX6AjFz+MX9uDWIZW8XreVhkFW3fkIdTv/gxWr/Kks5FFAVw==}
-    engines: {node: '>=10'}
-
   minimatch@7.4.9:
     resolution: {integrity: sha512-Brg/fp/iAVDOQoHxkuN5bEYhyQlZhxddI78yWsCbeEwTHXQjlNLtiJDUsp1GIptVqMI7/gkJMz4vVAc01mpoBw==}
     engines: {node: '>=10'}
@@ -4967,14 +4970,14 @@ packages:
     engines: {node: '>=10'}
     hasBin: true
 
-  motion-dom@12.38.0:
-    resolution: {integrity: sha512-pdkHLD8QYRp8VfiNLb8xIBJis1byQ9gPT3Jnh2jqfFtAsWUA3dEepDlsWe/xMpO8McV+VdpKVcp+E+TGJEtOoA==}
+  motion-dom@12.40.0:
+    resolution: {integrity: sha512-HxU3ZaBwNPVQUBQf1xxgq+7JrPNZvjLVxgbpEZL7RrWJnsxOf0/OM+yrHG9ogLQ31Do/r57Oz2gQWPK+6q62mg==}
 
-  motion-utils@12.36.0:
-    resolution: {integrity: sha512-eHWisygbiwVvf6PZ1vhaHCLamvkSbPIeAYxWUuL3a2PD/TROgE7FvfHWTIH4vMl798QLfMw15nRqIaRDXTlYRg==}
+  motion-utils@12.39.0:
+    resolution: {integrity: sha512-8nadJAJjTtqRkmRF36FoJTrywK9nnFmnPwnSMyxaOCU7GDjN9RTMJIxx9De8ErM+vpPhMccr/6fo5WciyQLnMQ==}
 
-  motion@12.38.0:
-    resolution: {integrity: sha512-uYfXzeHlgThchzwz5Te47dlv5JOUC7OB4rjJ/7XTUgtBZD8CchMN8qEJ4ZVsUmTyYA44zjV0fBwsiktRuFnn+w==}
+  motion@12.40.0:
+    resolution: {integrity: sha512-yjrHUrBFW6kQvjJwRsoiPSAhC5tRwRqNGJWmiJ4CrGnbKp0V88AdzkhBmDoqIsIPfarOe0Uddd37Xq43/gIocA==}
     peerDependencies:
       '@emotion/is-prop-valid': '*'
       react: ^18.0.0 || ^19.0.0
@@ -5084,13 +5087,17 @@ packages:
     resolution: {integrity: sha512-V6gygoYb/5EmNI+MEGrWkC+e6+Rr7mTmfHrxDbLzxQogBkgzo76rkok0Am6thgSF7Mv2nLOajAJj5vDJZEFn7g==}
     engines: {node: ^16.14.0 || >=18.0.0}
 
+  normalize-package-data@8.0.0:
+    resolution: {integrity: sha512-RWk+PI433eESQ7ounYxIp67CYuVsS1uYSonX3kA6ps/3LWfjVQa/ptEg6Y3T6uAMq1mWpX9PQ+qx+QaHpsc7gQ==}
+    engines: {node: ^20.17.0 || >=22.9.0}
+
   normalize-url@6.1.0:
     resolution: {integrity: sha512-DlL+XwOy3NxAQ8xuC0okPgK46iuVNAK01YN7RueYBqqFeGsBjV9XmCAzAdgt+667bCl5kPh9EqKKDwnaPG1I7A==}
     engines: {node: '>=10'}
 
-  normalize-url@8.1.1:
-    resolution: {integrity: sha512-JYc0DPlpGWB40kH5g07gGTrYuMqV653k3uBKY6uITPWds3M0ov3GaWGp9lbE3Bzngx8+XkfzgvASb9vk9JDFXQ==}
-    engines: {node: '>=14.16'}
+  normalize-url@9.0.1:
+    resolution: {integrity: sha512-ARftfC5HdUNu9jJeL8pHj8debUIHA2b91FizCoMzY4lG6dDX13jdvTK0TBe24IBDRf2HvJSzzwEPvmbkQWHRSg==}
+    engines: {node: '>=20'}
 
   npm-run-path@4.0.1:
     resolution: {integrity: sha512-S48WzZW777zhNIrn7gxOlISNAqi9ZC/uQFnRdbeIHhZhCA6UqpkOT8T1G7BvfdgP4Er8gF4sUbaS0i7QvIfCWw==}
@@ -5104,9 +5111,9 @@ packages:
     resolution: {integrity: sha512-9qny7Z9DsQU8Ou39ERsPU4OZQlSTP47ShQzuKZ6PRXpYLtIFgl/DEBYEXKlvcEa+9tHVcK8CF81Y2V72qaZhWA==}
     engines: {node: '>=18'}
 
-  npm@10.9.8:
-    resolution: {integrity: sha512-fYwb6ODSmHkqrJQQaCxY3M2lPf/mpgC7ik0HSzzIwG5CGtabRp4bNqikatvCoT42b5INQSqudVH0R7yVmC9hVg==}
-    engines: {node: ^18.17.0 || >=20.5.0}
+  npm@11.15.0:
+    resolution: {integrity: sha512-+k0tk7lRnpMUPnC7kTuU/yrV/mnFoPhJQ75VfLtZ6fwbzOVXaPsTE/Il9Pn1DHi482byMyqkHv/XsQ76mNjXLw==}
+    engines: {node: ^20.17.0 || >=22.9.0}
     hasBin: true
     bundledDependencies:
       - '@isaacs/string-locale-compare'
@@ -5114,6 +5121,7 @@ packages:
       - '@npmcli/config'
       - '@npmcli/fs'
       - '@npmcli/map-workspaces'
+      - '@npmcli/metavuln-calculator'
       - '@npmcli/package-json'
       - '@npmcli/promise-spawn'
       - '@npmcli/redact'
@@ -5124,7 +5132,6 @@ packages:
       - cacache
       - chalk
       - ci-info
-      - cli-columns
       - fastest-levenshtein
       - fs-minipass
       - glob
@@ -5138,7 +5145,6 @@ packages:
       - libnpmdiff
       - libnpmexec
       - libnpmfund
-      - libnpmhook
       - libnpmorg
       - libnpmpack
       - libnpmpublish
@@ -5152,7 +5158,6 @@ packages:
       - ms
       - node-gyp
       - nopt
-      - normalize-package-data
       - npm-audit-report
       - npm-install-checks
       - npm-package-arg
@@ -5176,10 +5181,9 @@ packages:
       - treeverse
       - validate-npm-package-name
       - which
-      - write-file-atomic
 
-  nx@22.7.2:
-    resolution: {integrity: sha512-Gh7gGO1t/TvgbKuVJMYWbxUwZC+E+PuRRVUeoOeVe82yEvBNl40EKiVHIbbi6GID0s9Zwzflo07UrKGLoDSVGw==}
+  nx@22.7.5:
+    resolution: {integrity: sha512-zoxsJabb33jl1QYnalDn0bicryrEBgSzdKp90d7VGGv/jDgzKrcLg/hw2ZxeYiOjWPIT/o8QNT9G9vTs4dv3AQ==}
     hasBin: true
     peerDependencies:
       '@swc-node/register': ^1.11.1
@@ -5245,29 +5249,35 @@ packages:
   oxc-resolver@11.19.1:
     resolution: {integrity: sha512-qE/CIg/spwrTBFt5aKmwe3ifeDdLfA2NESN30E42X/lII5ClF8V7Wt6WIJhcGZjp0/Q+nQ+9vgxGk//xZNX2hg==}
 
-  oxfmt@0.50.0:
-    resolution: {integrity: sha512-owwjTnhfM5aCOJhYeqDvk7iM504OeYFZpdRU7cxx7xtZMo4uVpjlryTUon+Cf76CugsvnqA32e6rC73pr1hXaw==}
+  oxfmt@0.52.0:
+    resolution: {integrity: sha512-nJlYM35F64zTDMecCNhoHNkf+D/eHv7xcjj9XDSj+bFAVtN93m7v8DQMdHd6nDG6Akf/kEYYHmDUBs2Dz27Sug==}
     engines: {node: ^20.19.0 || >=22.12.0}
     hasBin: true
     peerDependencies:
       svelte: ^5.0.0
+      vite-plus: '*'
     peerDependenciesMeta:
       svelte:
         optional: true
+      vite-plus:
+        optional: true
 
   oxlint-tsgolint@0.23.0:
     resolution: {integrity: sha512-3mBv3CoPbh8dFbzfDGIWa2ytZjn2v+3EX4aKRXjIhsoGFzG8GCjfRirz3rwZf1wYbZzsNLTSgpw8VjQuWdp/jA==}
     hasBin: true
 
-  oxlint@1.65.0:
-    resolution: {integrity: sha512-ChUuE3Q7XnAbscvT4XLMsH7HFJmLgLVv9lu+RRgFL5wSXnDqUOzTp5IS8qWDBGd/ZDSzQ2tbX8fjAmijlGLC7A==}
+  oxlint@1.67.0:
+    resolution: {integrity: sha512-blwwaHPdoH8piQ5/z0KHeoHFR7FZgl12WluKJfu4qFLPkZl6mK04PkLE45Fw1NxfBRSlh40Gu7MkxHUw++ociQ==}
     engines: {node: ^20.19.0 || >=22.12.0}
     hasBin: true
     peerDependencies:
       oxlint-tsgolint: '>=0.22.1'
+      vite-plus: '*'
     peerDependenciesMeta:
       oxlint-tsgolint:
         optional: true
+      vite-plus:
+        optional: true
 
   p-cancelable@2.1.1:
     resolution: {integrity: sha512-BZOr3nRQHOntUjTrH8+Lh54smKHoHyur8We1V8DSMVrl5A2malOOwuJRnKRDjSnkoeBh4at6BwEnb5I7Jl31wg==}
@@ -5423,12 +5433,12 @@ packages:
     resolution: {integrity: sha512-PS08Iboia9mts/2ygV3eLpY5ghnUcfLV/EXTOW1E2qYxJKGGBUtNjN76FYHnMs36RmARn41bC0AZmn+rR0OVpQ==}
     engines: {node: ^10 || ^12 || >=14}
 
-  postcss@8.5.14:
-    resolution: {integrity: sha512-SoSL4+OSEtR99LHFZQiJLkT59C5B1amGO1NzTwj7TT1qCUgUO6hxOvzkOYxD+vMrXBM3XJIKzokoERdqQq/Zmg==}
+  postcss@8.5.15:
+    resolution: {integrity: sha512-FfR8sjd4em2T6fb3I2MwAJU7HWVMr9zba+enmQeeWFfCbm+UOC/0X4DS8XtpUTMwWMGbjKYP7xjfNekzyGmB3A==}
     engines: {node: ^10 || ^12 || >=14}
 
-  posthog-node@5.34.3:
-    resolution: {integrity: sha512-f3TJEF4qBBzeJEv60kjVCgXsaWQVlUe7PFjf3xiaNw14GURoXjj+Z7iOUMeTerhWkTtrEgPBcfEjs5sJgSmnFw==}
+  posthog-node@5.35.5:
+    resolution: {integrity: sha512-zPLpjK0uAxVTVmV2TH/hNAq0JN0vUjZdJ8KOBErQS58lIJRHTkMMofNmpolkGq9pijpFITcpLsMYMsFMWvjBmg==}
     engines: {node: ^20.20.0 || >=22.22.0}
     peerDependencies:
       rxjs: ^7.0.0
@@ -5483,6 +5493,10 @@ packages:
     resolution: {integrity: sha512-V/yCWTTF7VJ9hIh18Ugr2zhJMP01MY7c5kh4J870L7imm6/DIzBsNLTXzMwUA3yZ5b/KBqLx8Kp3uRvd7xSe3Q==}
     engines: {node: '>=0.6'}
 
+  qs@6.15.2:
+    resolution: {integrity: sha512-Rzq0KEyX/w/tEybncDgdkZrJgVUsUMk3xjh3t5bv3S1HTAtg+uOYt72+ZfwiQwKdysThkTBdL/rTi6HDmX9Ddw==}
+    engines: {node: '>=0.6'}
+
   queue-microtask@1.2.3:
     resolution: {integrity: sha512-NuaNSa6flKT5JaSYQzJok04JzTL1CA6aGhv5rfLW3PgqA+M2ChpZQnAC8h8i4ZFkBS8X5RqkDBHA7r4hej3K9A==}
 
@@ -5557,6 +5571,14 @@ packages:
     resolution: {integrity: sha512-MbgfoNPANMdb4oRBNg5eqLbB2t2r+o5Ua1pNt8BqGp4I0FJZhuVSOj3PaBPni4azWuSzEdNn2evevzVmEk1ohQ==}
     engines: {node: '>=18'}
 
+  read-package-up@12.0.0:
+    resolution: {integrity: sha512-Q5hMVBYur/eQNWDdbF4/Wqqr9Bjvtrw2kjGxxBbKLbx8bVCL8gcArjTy8zDUuLGQicftpMuU0riQNcAsbtOVsw==}
+    engines: {node: '>=20'}
+
+  read-pkg@10.1.0:
+    resolution: {integrity: sha512-I8g2lArQiP78ll51UeMZojewtYgIRCKCWqZEgOO8c/uefTI+XDXvCSXu3+YNUaTNvZzobrL5+SqHjBrByRRTdg==}
+    engines: {node: '>=20'}
+
   read-pkg@9.0.1:
     resolution: {integrity: sha512-9viLL4/n1BJUCT1NXVTdS1jtm80yDEgR5T4yCelII49Mbj0v1rZdKqj7zCiYdbB0CuCgdrvHcNogAKTFPBocFA==}
     engines: {node: '>=18'}
@@ -5710,16 +5732,11 @@ packages:
   scroll-into-view-if-needed@3.1.0:
     resolution: {integrity: sha512-49oNpRjWRvnU8NyGVmUaYG4jtTkNonFZI86MmGRDqBphEK2EXT9gdEUoQPZhuBM8yWHxCWbobltqYO5M4XrUvQ==}
 
-  semantic-release@24.2.9:
-    resolution: {integrity: sha512-phCkJ6pjDi9ANdhuF5ElS10GGdAKY6R1Pvt9lT3SFhOwM4T7QZE7MLpBDbNruUx/Q3gFD92/UOFringGipRqZA==}
-    engines: {node: '>=20.8.1'}
+  semantic-release@25.0.3:
+    resolution: {integrity: sha512-WRgl5GcypwramYX4HV+eQGzUbD7UUbljVmS+5G1uMwX/wLgYuJAxGeerXJDMO2xshng4+FXqCgyB5QfClV6WjA==}
+    engines: {node: ^22.14.0 || >= 24.10.0}
     hasBin: true
 
-  semver-diff@5.0.0:
-    resolution: {integrity: sha512-0HbGtOm+S7T6NGQ/pxJSJipJvc4DK3FcRVMRkhsIwJDJ4Jcz5DQC1cPPzB5GhzyHjwttW878HaWQq46CkL3cqg==}
-    engines: {node: '>=12'}
-    deprecated: Deprecated as the semver package now supports this built-in.
-
   semver-regex@4.0.5:
     resolution: {integrity: sha512-hunMQrEy1T6Jr2uEVjrAIqjwWcQTgOAcIM52C8MY1EZSD3DDNft04XzvYKPqjED65bNVVko0YI38nYeEHCX3yw==}
     engines: {node: '>=12'}
@@ -5728,11 +5745,6 @@ packages:
     resolution: {integrity: sha512-BR7VvDCVHO+q2xBEWskxS6DJE1qRnb7DxzUrogb71CWoSficBxYsiAGd+Kl0mmq/MprG9yArRkyrQxTO6XjMzA==}
     hasBin: true
 
-  semver@7.7.3:
-    resolution: {integrity: sha512-SdsKMrI9TdgjdweUSR9MweHA4EJ8YxHn8DFaDisvhVlUOe4BF1tLD7GAj0lIqWVl+dPb/rExr0Btby5loQm20Q==}
-    engines: {node: '>=10'}
-    hasBin: true
-
   semver@7.7.4:
     resolution: {integrity: sha512-vFKC2IEtQnVhpT78h1Yp8wzwrf8CM+MzKMHGJZfBtzhZNycRFnXsHk6E5TxIkkMsgNS7mdX3AGB7x2QM2di4lA==}
     engines: {node: '>=10'}
@@ -5743,6 +5755,11 @@ packages:
     engines: {node: '>=10'}
     hasBin: true
 
+  semver@7.8.1:
+    resolution: {integrity: sha512-rkVq3IXh+4FDGch+KwzX3aV9W3kO54GyEgpvBzSyctDA6Xtd7RJQV1xmXbeQp5v7+VzLOfVqiutSE6GICgPFvg==}
+    engines: {node: '>=10'}
+    hasBin: true
+
   send@0.19.2:
     resolution: {integrity: sha512-VMbMxbDeehAxpOtWJXlcUS5E8iXh6QmN+BkRX1GARS3wRaXEEgzCcB10gTQazO42tpNIya8xIyNx8fll1OFPrg==}
     engines: {node: '>= 0.8.0'}
@@ -5770,8 +5787,8 @@ packages:
     resolution: {integrity: sha512-ObmnIF4hXNg1BqhnHmgbDETF8dLPCggZWBjkQfhZpbszZnYur5DUljTcCHii5LC3J5E0yeO/1LIMyH+UvHQgyw==}
     engines: {node: '>= 0.4'}
 
-  shiki@4.0.2:
-    resolution: {integrity: sha512-eAVKTMedR5ckPo4xne/PjYQYrU3qx78gtJZ+sHlXEg5IHhhoQhMfZVzetTYuaJS0L2Ef3AcCRzCHV8T0WI6nIQ==}
+  shiki@4.1.0:
+    resolution: {integrity: sha512-l/ABZPUR5v70jI10EzqfMS/I96vjSGv2y0ihUV+WYFzv0EfvW4s54m0Lg8wCrrL+2IkwBzFTuxkZjPf8b2NX9Q==}
     engines: {node: '>=20'}
 
   side-channel-list@1.0.1:
@@ -5884,10 +5901,6 @@ packages:
   standard-as-callback@2.1.0:
     resolution: {integrity: sha512-qoRRSyROncaz1z0mvYqIE4lCd9p2R90i6GxW3uZv5ucSu8tU7B5HXUP1gG8pVZsYNVaXjk8ClXHPttLyxAL48A==}
 
-  statuses@2.0.1:
-    resolution: {integrity: sha512-RwNA9Z/7PrK06rYLIzFMlaF+l73iwpzsqRIFgbMLbTcLD6cOao82TaWefPXQvB2fOC4AjuYSEndS7N/mTCbkdQ==}
-    engines: {node: '>= 0.8'}
-
   statuses@2.0.2:
     resolution: {integrity: sha512-DvEy55V3DB7uknRo+4iOGT5fP1slR8wQohVdknigZPMpMstaKJQWhwiYBACJE3Ul2pTnATihhBYnRhZQHGBiRw==}
     engines: {node: '>= 0.8'}
@@ -5911,8 +5924,12 @@ packages:
     resolution: {integrity: sha512-wKyQRQpjJ0sIp62ErSZdGsjMJWsap5oRNihHhu6G7JVO/9jIB6UyevL+tXuOqrng8j/cxKTWyWUwvSTriiZz/g==}
     engines: {node: '>=8'}
 
-  string-width@8.2.0:
-    resolution: {integrity: sha512-6hJPQ8N0V0P3SNmP6h2J99RLuzrWz2gvT7VnK5tKvrNqJoyS9W4/Fb8mo31UiPvy00z7DQXkP2hnKBVav76thw==}
+  string-width@7.2.0:
+    resolution: {integrity: sha512-tsaTIkKW9b4N+AEj+SVA+WhJzV7/zMhcSu78mLKWSk7cXMOSHsBKFWUs0fWwq8QyK3MgJBQRX6Gbi4kYbdvGkQ==}
+    engines: {node: '>=18'}
+
+  string-width@8.2.1:
+    resolution: {integrity: sha512-IIaP0g3iy9Cyy18w3M9YcaDudujEAVHKt3a3QJg1+sr/oX96TbaGUubG0hJyCjCBThFH+tFpcIyoUHUn1ogaLA==}
     engines: {node: '>=20'}
 
   string_decoder@1.1.1:
@@ -6039,12 +6056,8 @@ packages:
   tinybench@2.9.0:
     resolution: {integrity: sha512-0+DUvqWMValLmha6lr4kD8iAMK1HzV0/aKnCtWb9v9641TnP/MFb7Pc2bxoxQjTXAErryXVgUOfv2YqNllqGeg==}
 
-  tinyexec@1.1.1:
-    resolution: {integrity: sha512-VKS/ZaQhhkKFMANmAOhhXVoIfBXblQxGX1myCQ2faQrfmobMftXeJPcZGp0gS07ocvGJWDLZGyOZDadDBqYIJg==}
-    engines: {node: '>=18'}
-
-  tinyexec@1.1.2:
-    resolution: {integrity: sha512-dAqSqE/RabpBKI8+h26GfLq6Vb3JVXs30XYQjdMjaj/c2tS8IYYMbIzP599KtRj7c57/wYApb3QjgRgXmrCukA==}
+  tinyexec@1.2.2:
+    resolution: {integrity: sha512-M/Q0B2cp4K7kynaT/vnED1j8TlLY+Pp7C6Wl2bl/7u/F0mUVwdyOpwomQb8JpYLitHUssAJRmLZdMCGsrx7i+g==}
     engines: {node: '>=18'}
 
   tinyglobby@0.2.16:
@@ -6066,8 +6079,8 @@ packages:
     resolution: {integrity: sha512-WMi/OQ2axVTf/ykqCQgXiIct+mSQDFdH2fkwhPwgEwvJ1kSzZRiinb0zF2Xb8u4+OqPChmyI6MEu4EezNJz+FQ==}
     hasBin: true
 
-  tmp@0.2.4:
-    resolution: {integrity: sha512-UdiSoX6ypifLmrfQ/XfiawN6hkjSBpCjhKxxZcWlUUmoXLaCKQU0bx4HF/tdDK2uzRuchf1txGvrWBzYREssoQ==}
+  tmp@0.2.6:
+    resolution: {integrity: sha512-5sJPdPjfI5Kx+qbrDesxkglRBxW//g7hCsqspEjwkewGvBMGIKMOTKzLt1hFVJzyadba3lDUN20O9qhvbQUSTA==}
     engines: {node: '>=14.14'}
 
   to-regex-range@5.0.1:
@@ -6116,6 +6129,10 @@ packages:
   tunnel-agent@0.6.0:
     resolution: {integrity: sha512-McnNiV1l8RYeY8tBgEpuodCC1mLUdbSN+CYBL7kJsJNInOP8UjDDEwdk6Mw60vdLLrr5NHKZhMAOSrR2NZuQ+w==}
 
+  tunnel@0.0.6:
+    resolution: {integrity: sha512-1h/Lnq9yajKY2PEbBadPXj3VxsDDu844OnaAo52UVmIzIvwwtBPIuNvkjuzBlTWpfJyUbG3ez0KSBibQkj4ojg==}
+    engines: {node: '>=0.6.11 <=0.7.0 || >=0.7.3'}
+
   tweetnacl@0.14.5:
     resolution: {integrity: sha512-KXXFFdAbFXY4geFIwoyNK+f5Z1b7swfXABfL7HXCmoIWMKU3dmS26672A4EeQtDzLKy7SXmfBu51JolvEKwtGA==}
 
@@ -6159,6 +6176,14 @@ packages:
   undici-types@7.24.6:
     resolution: {integrity: sha512-WRNW+sJgj5OBN4/0JpHFqtqzhpbnV0GuB+OozA9gCL7a993SmU+1JBZCzLNxYsbMfIeDL+lTsphD5jN5N+n0zg==}
 
+  undici@6.26.0:
+    resolution: {integrity: sha512-4yqz8a3n5HmGTlsbADNtr/dJlhkh/55Rq798G6ibiULcXbDtaLpTl1pvdqcbFfeoj3iSi52lePFM7h9H21cw/A==}
+    engines: {node: '>=18.17'}
+
+  undici@7.26.0:
+    resolution: {integrity: sha512-3O9Tf67pGhgOv9jM35AbhkXAKi13f3oy3aE4CSgr+TckGeY+/iu97ZXN+J7DpHPzLbVApFd1IFhcnBjREYXYcg==}
+    engines: {node: '>=20.18.1'}
+
   undici@8.3.0:
     resolution: {integrity: sha512-TkUDgb6tl7KOGZ+7e8E3d2FYgUQgF6z5YypqjWmixVQSQERFcVrVg0ySADm2LVLRh5ljAaHTCR5Fmz3Q34rB7Q==}
     engines: {node: '>=22.19.0'}
@@ -6175,6 +6200,10 @@ packages:
     resolution: {integrity: sha512-+QBBXBCvifc56fsbuxZQ6Sic3wqqc3WWaqxs58gvJrcOuN83HGTCwz3oS5phzU9LthRNE9VrJCFCLUgHeeFnfA==}
     engines: {node: '>=18'}
 
+  unicorn-magic@0.4.0:
+    resolution: {integrity: sha512-wH590V9VNgYH9g3lH9wWjTrUoKsjLF6sGLjhR4sH1LWpLmCOH0Zf7PukhDA8BiS7KHe4oPNkcTHqYkj7SOGUOw==}
+    engines: {node: '>=20'}
+
   unified@11.0.5:
     resolution: {integrity: sha512-xKvGhPWw3k84Qjh8bI3ZeJjqnyadK+GEFtazSfZv/rKeTkTjOJho6mFqh2SM96iIcZokxiOpg78GazTSg8+KHA==}
 
@@ -6277,16 +6306,16 @@ packages:
     resolution: {integrity: sha512-BNGbWLfd0eUPabhkXUVm0j8uuvREyTh5ovRa/dyow/BqAbZJyC+5fU+IzQOzmAKzYqYRAISoRhdQr3eIZ/PXqg==}
     engines: {node: '>= 0.8'}
 
-  verdaccio-audit@13.0.1:
-    resolution: {integrity: sha512-0QErO6UFP9fMzj9r6usQ/j76MHV7YZVmJGC7MwjCqkH7EefCWaGOehI49a8IrQFCngQSSANL3k9n9kq5VTTVFw==}
+  verdaccio-audit@13.0.2:
+    resolution: {integrity: sha512-J2aq4b0Q6qj/3o+r8dBPCmKNj37x+8BjSZOEoH85zjR3kihiVYQgJ1+2UxKCJpLj4Z/04SekB1p+zTBiViyoMw==}
     engines: {node: '>=18'}
 
-  verdaccio-htpasswd@13.0.1:
-    resolution: {integrity: sha512-UmIrE7mzqaHLis641NodftulFdQkwPGwSod5bCFnKNelPItL7Su0ojamX3OQudQLdjBeBAjralavvZhDtWPvDQ==}
+  verdaccio-htpasswd@13.0.2:
+    resolution: {integrity: sha512-ObyN409utfLKQ4QdGAYyXOprVaOYz0tDvhi0WpK7U71QvL/LOjeXWleDFRJHeaEMTNNdrzPhtC/9kcpfnztabg==}
     engines: {node: '>=18'}
 
-  verdaccio@6.7.1:
-    resolution: {integrity: sha512-Injtk1p/iv9JKN7qOuDrGSqxduwTG/yz2Hn4V4OzQ6LEO18Ex8tvc+EKCNX7VVegxr411PQ8zehuy7Xv8RJWlw==}
+  verdaccio@6.7.2:
+    resolution: {integrity: sha512-o9YQonYX94RxVKQncxcUbsPtLTV26IgDSPQTbcw6rFrtQ6zb7Fx75vTNBps2O7xStMtwROblGwnLlHF7akm0jQ==}
     engines: {node: '>=20'}
     hasBin: true
 
@@ -6346,20 +6375,20 @@ packages:
       yaml:
         optional: true
 
-  vitest@4.1.6:
-    resolution: {integrity: sha512-6lvjbS3p9b4CrdCmguzbh2/4uoXhGE2q71R4OX5sqF9R1bo9Xd6fGrMAfvp5wnCzlBnFVdCOp6onuTQVbo8iUQ==}
+  vitest@4.1.7:
+    resolution: {integrity: sha512-flYyaFd2CgoCoU+0UKt3pxksgC+S02iTDN0n3LtqaMeXsI9SBcdNujc2k0DeFLzUn/0k538yNjOSdwgCqcrwJA==}
     engines: {node: ^20.0.0 || ^22.0.0 || >=24.0.0}
     hasBin: true
     peerDependencies:
       '@edge-runtime/vm': '*'
       '@opentelemetry/api': ^1.9.0
       '@types/node': ^20.0.0 || ^22.0.0 || >=24.0.0
-      '@vitest/browser-playwright': 4.1.6
-      '@vitest/browser-preview': 4.1.6
-      '@vitest/browser-webdriverio': 4.1.6
-      '@vitest/coverage-istanbul': 4.1.6
-      '@vitest/coverage-v8': 4.1.6
-      '@vitest/ui': 4.1.6
+      '@vitest/browser-playwright': 4.1.7
+      '@vitest/browser-preview': 4.1.7
+      '@vitest/browser-webdriverio': 4.1.7
+      '@vitest/coverage-istanbul': 4.1.7
+      '@vitest/coverage-v8': 4.1.7
+      '@vitest/ui': 4.1.7
       happy-dom: '*'
       jsdom: '*'
       vite: ^6.0.0 || ^7.0.0 || ^8.0.0
@@ -6431,6 +6460,10 @@ packages:
     resolution: {integrity: sha512-YVGIj2kamLSTxw6NsZjoBxfSwsn0ycdesmc4p+Q21c5zPuZ1pl+NfxVdxPtdHvmNVOQ6XSYG4AUtyt/Fi7D16Q==}
     engines: {node: '>=10'}
 
+  wrap-ansi@9.0.2:
+    resolution: {integrity: sha512-42AtmgqjV+X1VpdOfyTGOYRi0/zsoLqtXQckTmqTeybT+BDIbM/Guxo7x3pE2vtpr1ok6xRqM9OpBe+Jyoqyww==}
+    engines: {node: '>=18'}
+
   wrappy@1.0.2:
     resolution: {integrity: sha512-l4Sp/DRseor9wL6EvV2+TuQn63dMkPjZ/sp9XkghTEbV9KlPS1xUsZ3u7/IQO4wxtcFB4bgpQPRcR3QCvezPcQ==}
 
@@ -6446,8 +6479,8 @@ packages:
       utf-8-validate:
         optional: true
 
-  ws@8.20.0:
-    resolution: {integrity: sha512-sAt8BhgNbzCtgGbt2OxmpuryO63ZoDk/sqaB/znQm94T4fCEsy/yV+7CdC1kJhOU9lboAEU7R3kquuycDoibVA==}
+  ws@8.21.0:
+    resolution: {integrity: sha512-Vsp28b7DRcimFQvrqu2Wek3z1iYxDCWqHYB8Qsnk/S4RfaCQzPGPyBNuVjJV3cd6UiKtUtp6sNM77gWvzcCH+g==}
     engines: {node: '>=10.0.0'}
     peerDependencies:
       bufferutil: ^4.0.1
@@ -6469,11 +6502,6 @@ packages:
   yallist@3.1.1:
     resolution: {integrity: sha512-a4UGQaWPH59mOXUYnAG2ewncQS4i4F43Tv3JoAM+s2VDAmS9NsK8GpDMLrCHPksFT7h3K6TOoUNn2pb7RoXx4g==}
 
-  yaml@2.8.0:
-    resolution: {integrity: sha512-4lLa/EcQCB0cJkyts+FpIRx5G/llPxfP6VQU5KByHEhLxY3IJCH0f0Hy1MHI8sClTvsIb8qwRJ6R/ZdlDJ/leQ==}
-    engines: {node: '>= 14.6'}
-    hasBin: true
-
   yaml@2.9.0:
     resolution: {integrity: sha512-2AvhNX3mb8zd6Zy7INTtSpl1F15HW6Wnqj0srWlkKLcpYl/gMIMJiyuGq2KeI2YFxUPjdlB+3Lc10seMLtL4cA==}
     engines: {node: '>= 14.6'}
@@ -6487,6 +6515,10 @@ packages:
     resolution: {integrity: sha512-tVpsJW7DdjecAiFpbIB1e3qxIQsE6NoPc5/eTdrbbIC4h0LVsWhnoa3g+m2HclBIujHzsxZ4VJVA+GUuc2/LBw==}
     engines: {node: '>=12'}
 
+  yargs-parser@22.0.0:
+    resolution: {integrity: sha512-rwu/ClNdSMpkSrUb+d6BRsSkLUq1fmfsY6TOpYzTwvwkg1/NRG85KBy3kq++A8LKQwX6lsu+aWad+2khvuXrqw==}
+    engines: {node: ^20.19.0 || ^22.12.0 || >=23}
+
   yargs@16.2.0:
     resolution: {integrity: sha512-D1mvvtDG0L5ft/jGWkLpG1+m0eQxOfaBvTNELraWj22wSVUMWxZUvYgJYcKh6jGGIkJFhH4IZPQhR4TKpc8mBw==}
     engines: {node: '>=10'}
@@ -6495,6 +6527,10 @@ packages:
     resolution: {integrity: sha512-7dSzzRQ++CKnNI/krKnYRV7JKKPUXMEh61soaHKg9mrWEhzFWhFnxPxGl+69cD1Ou63C13NUPCnmIcrvqCuM6w==}
     engines: {node: '>=12'}
 
+  yargs@18.0.0:
+    resolution: {integrity: sha512-4UEqdc2RYGHZc7Doyqkrqiln3p9X2DZVxaGbwhn2pi7MrRagKaOcIKe8L3OxYcbhXLgLFUS3zAYuQjKBQgmuNg==}
+    engines: {node: ^20.19.0 || ^22.12.0 || >=23}
+
   yoctocolors@2.1.2:
     resolution: {integrity: sha512-CzhO+pFNo8ajLM2d2IW/R93ipy99LWjtwblvC1RsoSUMZgyLbYFr221TnSNT7GjGdYui6P459mw9JH/g/zW2ug==}
     engines: {node: '>=18'}
@@ -6502,9 +6538,6 @@ packages:
   yoga-layout@3.2.1:
     resolution: {integrity: sha512-0LPOt3AxKqMdFBZA3HBAt/t/8vIKq7VaQYbuA8WxCgung+p9TVyKRYdpvCb80HcdTN2NkbIKbhNwKUfm3tQywQ==}
 
-  zod@4.3.6:
-    resolution: {integrity: sha512-rftlrkhHZOcjDwkGlnUtZZkvaPHCsDATp4pGpuOOMDaTdDDXF91wuVDJoWoPsKX/3YPQ5fHuF3STjcYyKr+Qhg==}
-
   zod@4.4.3:
     resolution: {integrity: sha512-ytENFjIJFl2UwYglde2jchW2Hwm4GJFLDiSXWdTrJQBIN9Fcyp7n4DhxJEiWNAJMV1/BqWfW/kkg71UDcHJyTQ==}
 
@@ -6513,14 +6546,30 @@ packages:
 
 snapshots:
 
+  '@actions/core@3.0.1':
+    dependencies:
+      '@actions/exec': 3.0.0
+      '@actions/http-client': 4.0.1
+
+  '@actions/exec@3.0.0':
+    dependencies:
+      '@actions/io': 3.0.2
+
+  '@actions/http-client@4.0.1':
+    dependencies:
+      tunnel: 0.0.6
+      undici: 6.26.0
+
+  '@actions/io@3.0.2': {}
+
   '@alcalzone/ansi-tokenize@0.3.0':
     dependencies:
       ansi-styles: 6.2.3
       is-fullwidth-code-point: 5.1.0
 
-  '@babel/code-frame@7.29.0':
+  '@babel/code-frame@7.29.7':
     dependencies:
-      '@babel/helper-validator-identifier': 7.28.5
+      '@babel/helper-validator-identifier': 7.29.7
       js-tokens: 4.0.0
       picocolors: 1.1.1
 
@@ -6528,7 +6577,7 @@ snapshots:
 
   '@babel/core@7.29.0':
     dependencies:
-      '@babel/code-frame': 7.29.0
+      '@babel/code-frame': 7.29.7
       '@babel/generator': 7.29.1
       '@babel/helper-compilation-targets': 7.28.6
       '@babel/helper-module-transforms': 7.28.6(@babel/core@7.29.0)
@@ -6575,14 +6624,14 @@ snapshots:
     dependencies:
       '@babel/core': 7.29.0
       '@babel/helper-module-imports': 7.28.6
-      '@babel/helper-validator-identifier': 7.28.5
+      '@babel/helper-validator-identifier': 7.29.7
       '@babel/traverse': 7.29.0
     transitivePeerDependencies:
       - supports-color
 
   '@babel/helper-string-parser@7.27.1': {}
 
-  '@babel/helper-validator-identifier@7.28.5': {}
+  '@babel/helper-validator-identifier@7.29.7': {}
 
   '@babel/helper-validator-option@7.27.1': {}
 
@@ -6597,13 +6646,13 @@ snapshots:
 
   '@babel/template@7.28.6':
     dependencies:
-      '@babel/code-frame': 7.29.0
+      '@babel/code-frame': 7.29.7
       '@babel/parser': 7.29.2
       '@babel/types': 7.29.0
 
   '@babel/traverse@7.29.0':
     dependencies:
-      '@babel/code-frame': 7.29.0
+      '@babel/code-frame': 7.29.7
       '@babel/generator': 7.29.1
       '@babel/helper-globals': 7.28.0
       '@babel/parser': 7.29.2
@@ -6616,7 +6665,7 @@ snapshots:
   '@babel/types@7.29.0':
     dependencies:
       '@babel/helper-string-parser': 7.27.1
-      '@babel/helper-validator-identifier': 7.28.5
+      '@babel/helper-validator-identifier': 7.29.7
 
   '@clack/core@1.3.1':
     dependencies:
@@ -6654,33 +6703,33 @@ snapshots:
       tunnel-agent: 0.6.0
       uuid: 8.3.2
 
-  '@effect/atom-react@4.0.0-beta.67(effect@4.0.0-beta.67)(react@19.2.6)(scheduler@0.27.0)':
+  '@effect/atom-react@4.0.0-beta.74(effect@4.0.0-beta.74)(react@19.2.6)(scheduler@0.27.0)':
     dependencies:
-      effect: 4.0.0-beta.67
+      effect: 4.0.0-beta.74
       react: 19.2.6
       scheduler: 0.27.0
 
-  '@effect/platform-bun@4.0.0-beta.67(effect@4.0.0-beta.67)':
+  '@effect/platform-bun@4.0.0-beta.74(effect@4.0.0-beta.74)':
     dependencies:
-      '@effect/platform-node-shared': 4.0.0-beta.67(effect@4.0.0-beta.67)
-      effect: 4.0.0-beta.67
+      '@effect/platform-node-shared': 4.0.0-beta.74(effect@4.0.0-beta.74)
+      effect: 4.0.0-beta.74
     transitivePeerDependencies:
       - bufferutil
       - utf-8-validate
 
-  '@effect/platform-node-shared@4.0.0-beta.67(effect@4.0.0-beta.67)':
+  '@effect/platform-node-shared@4.0.0-beta.74(effect@4.0.0-beta.74)':
     dependencies:
       '@types/ws': 8.18.1
-      effect: 4.0.0-beta.67
-      ws: 8.20.0
+      effect: 4.0.0-beta.74
+      ws: 8.21.0
     transitivePeerDependencies:
       - bufferutil
       - utf-8-validate
 
-  '@effect/platform-node@4.0.0-beta.67(effect@4.0.0-beta.67)(ioredis@5.10.1)':
+  '@effect/platform-node@4.0.0-beta.74(effect@4.0.0-beta.74)(ioredis@5.10.1)':
     dependencies:
-      '@effect/platform-node-shared': 4.0.0-beta.67(effect@4.0.0-beta.67)
-      effect: 4.0.0-beta.67
+      '@effect/platform-node-shared': 4.0.0-beta.74(effect@4.0.0-beta.74)
+      effect: 4.0.0-beta.74
       ioredis: 5.10.1
       mime: 4.1.0
       undici: 8.3.0
@@ -6688,15 +6737,16 @@ snapshots:
       - bufferutil
       - utf-8-validate
 
-  '@effect/vitest@4.0.0-beta.43(effect@4.0.0-beta.67)(vitest@4.1.6)':
+  '@effect/vitest@4.0.0-beta.74(effect@4.0.0-beta.74)(vitest@4.1.7)':
     dependencies:
-      effect: 4.0.0-beta.67
-      vitest: 4.1.6(@types/node@25.8.0)(@vitest/coverage-istanbul@4.1.6)(vite@8.0.2(@emnapi/core@1.10.0)(@emnapi/runtime@1.10.0)(@types/node@25.8.0)(esbuild@0.27.4)(jiti@2.7.0)(yaml@2.9.0))
+      effect: 4.0.0-beta.74
+      vitest: 4.1.7(@types/node@25.9.1)(@vitest/coverage-istanbul@4.1.7)(vite@8.0.2(@emnapi/core@1.10.0)(@emnapi/runtime@1.10.0)(@types/node@25.9.1)(esbuild@0.27.4)(jiti@2.7.0)(yaml@2.9.0))
 
   '@emnapi/core@1.10.0':
     dependencies:
       '@emnapi/wasi-threads': 1.2.1
       tslib: 2.8.1
+    optional: true
 
   '@emnapi/core@1.4.5':
     dependencies:
@@ -6706,6 +6756,7 @@ snapshots:
   '@emnapi/runtime@1.10.0':
     dependencies:
       tslib: 2.8.1
+    optional: true
 
   '@emnapi/runtime@1.4.5':
     dependencies:
@@ -6718,6 +6769,7 @@ snapshots:
   '@emnapi/wasi-threads@1.2.1':
     dependencies:
       tslib: 2.8.1
+    optional: true
 
   '@esbuild/aix-ppc64@0.27.4':
     optional: true
@@ -7018,7 +7070,7 @@ snapshots:
 
   '@mdx-js/mdx@3.1.1':
     dependencies:
-      '@types/estree': 1.0.8
+      '@types/estree': 1.0.9
       '@types/estree-jsx': 1.0.5
       '@types/hast': 3.0.4
       '@types/mdx': 2.0.13
@@ -7117,15 +7169,15 @@ snapshots:
 
   '@napi-rs/wasm-runtime@0.2.4':
     dependencies:
-      '@emnapi/core': 1.10.0
-      '@emnapi/runtime': 1.10.0
+      '@emnapi/core': 1.4.5
+      '@emnapi/runtime': 1.4.5
       '@tybys/wasm-util': 0.9.0
 
   '@napi-rs/wasm-runtime@1.1.4(@emnapi/core@1.10.0)(@emnapi/runtime@1.10.0)':
     dependencies:
       '@emnapi/core': 1.10.0
       '@emnapi/runtime': 1.10.0
-      '@tybys/wasm-util': 0.10.1
+      '@tybys/wasm-util': 0.10.2
     optional: true
 
   '@next/env@16.2.6': {}
@@ -7166,45 +7218,45 @@ snapshots:
       '@nodelib/fs.scandir': 2.1.5
       fastq: 1.20.1
 
-  '@nx/devkit@22.7.2(nx@22.7.2(@swc-node/register@1.11.1(@emnapi/core@1.10.0)(@emnapi/runtime@1.10.0)(@swc/core@1.15.33)(@swc/types@0.1.26)(typescript@6.0.3))(@swc/core@1.15.33))':
+  '@nx/devkit@22.7.5(nx@22.7.5(@swc-node/register@1.11.1(@emnapi/core@1.10.0)(@emnapi/runtime@1.10.0)(@swc/core@1.15.40)(@swc/types@0.1.26)(typescript@6.0.3))(@swc/core@1.15.40))':
     dependencies:
       '@zkochan/js-yaml': 0.0.7
       ejs: 5.0.1
       enquirer: 2.3.6
       minimatch: 10.2.5
-      nx: 22.7.2(@swc-node/register@1.11.1(@emnapi/core@1.10.0)(@emnapi/runtime@1.10.0)(@swc/core@1.15.33)(@swc/types@0.1.26)(typescript@6.0.3))(@swc/core@1.15.33)
-      semver: 7.7.4
+      nx: 22.7.5(@swc-node/register@1.11.1(@emnapi/core@1.10.0)(@emnapi/runtime@1.10.0)(@swc/core@1.15.40)(@swc/types@0.1.26)(typescript@6.0.3))(@swc/core@1.15.40)
+      semver: 7.8.1
       tslib: 2.8.1
       yargs-parser: 21.1.1
 
-  '@nx/nx-darwin-arm64@22.7.2':
+  '@nx/nx-darwin-arm64@22.7.5':
     optional: true
 
-  '@nx/nx-darwin-x64@22.7.2':
+  '@nx/nx-darwin-x64@22.7.5':
     optional: true
 
-  '@nx/nx-freebsd-x64@22.7.2':
+  '@nx/nx-freebsd-x64@22.7.5':
     optional: true
 
-  '@nx/nx-linux-arm-gnueabihf@22.7.2':
+  '@nx/nx-linux-arm-gnueabihf@22.7.5':
     optional: true
 
-  '@nx/nx-linux-arm64-gnu@22.7.2':
+  '@nx/nx-linux-arm64-gnu@22.7.5':
     optional: true
 
-  '@nx/nx-linux-arm64-musl@22.7.2':
+  '@nx/nx-linux-arm64-musl@22.7.5':
     optional: true
 
-  '@nx/nx-linux-x64-gnu@22.7.2':
+  '@nx/nx-linux-x64-gnu@22.7.5':
     optional: true
 
-  '@nx/nx-linux-x64-musl@22.7.2':
+  '@nx/nx-linux-x64-musl@22.7.5':
     optional: true
 
-  '@nx/nx-win32-arm64-msvc@22.7.2':
+  '@nx/nx-win32-arm64-msvc@22.7.5':
     optional: true
 
-  '@nx/nx-win32-x64-msvc@22.7.2':
+  '@nx/nx-win32-x64-msvc@22.7.5':
     optional: true
 
   '@octokit/auth-token@6.0.0': {}
@@ -7213,7 +7265,7 @@ snapshots:
     dependencies:
       '@octokit/auth-token': 6.0.0
       '@octokit/graphql': 9.0.3
-      '@octokit/request': 10.0.9
+      '@octokit/request': 10.0.10
       '@octokit/request-error': 7.1.0
       '@octokit/types': 16.0.0
       before-after-hook: 4.0.0
@@ -7226,18 +7278,16 @@ snapshots:
 
   '@octokit/graphql@9.0.3':
     dependencies:
-      '@octokit/request': 10.0.9
+      '@octokit/request': 10.0.10
       '@octokit/types': 16.0.0
       universal-user-agent: 7.0.3
 
-  '@octokit/openapi-types@26.0.0': {}
-
   '@octokit/openapi-types@27.0.0': {}
 
-  '@octokit/plugin-paginate-rest@13.2.1(@octokit/core@7.0.6)':
+  '@octokit/plugin-paginate-rest@14.0.0(@octokit/core@7.0.6)':
     dependencies:
       '@octokit/core': 7.0.6
-      '@octokit/types': 15.0.2
+      '@octokit/types': 16.0.0
 
   '@octokit/plugin-retry@8.1.0(@octokit/core@7.0.6)':
     dependencies:
@@ -7256,20 +7306,15 @@ snapshots:
     dependencies:
       '@octokit/types': 16.0.0
 
-  '@octokit/request@10.0.9':
+  '@octokit/request@10.0.10':
     dependencies:
       '@octokit/endpoint': 11.0.3
       '@octokit/request-error': 7.1.0
       '@octokit/types': 16.0.0
       content-type: 2.0.0
-      fast-content-type-parse: 3.0.0
       json-with-bigint: 3.5.8
       universal-user-agent: 7.0.3
 
-  '@octokit/types@15.0.2':
-    dependencies:
-      '@octokit/openapi-types': 26.0.0
-
   '@octokit/types@16.0.0':
     dependencies:
       '@octokit/openapi-types': 27.0.0
@@ -7409,61 +7454,61 @@ snapshots:
   '@oxc-resolver/binding-win32-x64-msvc@11.19.1':
     optional: true
 
-  '@oxfmt/binding-android-arm-eabi@0.50.0':
+  '@oxfmt/binding-android-arm-eabi@0.52.0':
     optional: true
 
-  '@oxfmt/binding-android-arm64@0.50.0':
+  '@oxfmt/binding-android-arm64@0.52.0':
     optional: true
 
-  '@oxfmt/binding-darwin-arm64@0.50.0':
+  '@oxfmt/binding-darwin-arm64@0.52.0':
     optional: true
 
-  '@oxfmt/binding-darwin-x64@0.50.0':
+  '@oxfmt/binding-darwin-x64@0.52.0':
     optional: true
 
-  '@oxfmt/binding-freebsd-x64@0.50.0':
+  '@oxfmt/binding-freebsd-x64@0.52.0':
     optional: true
 
-  '@oxfmt/binding-linux-arm-gnueabihf@0.50.0':
+  '@oxfmt/binding-linux-arm-gnueabihf@0.52.0':
     optional: true
 
-  '@oxfmt/binding-linux-arm-musleabihf@0.50.0':
+  '@oxfmt/binding-linux-arm-musleabihf@0.52.0':
     optional: true
 
-  '@oxfmt/binding-linux-arm64-gnu@0.50.0':
+  '@oxfmt/binding-linux-arm64-gnu@0.52.0':
     optional: true
 
-  '@oxfmt/binding-linux-arm64-musl@0.50.0':
+  '@oxfmt/binding-linux-arm64-musl@0.52.0':
     optional: true
 
-  '@oxfmt/binding-linux-ppc64-gnu@0.50.0':
+  '@oxfmt/binding-linux-ppc64-gnu@0.52.0':
     optional: true
 
-  '@oxfmt/binding-linux-riscv64-gnu@0.50.0':
+  '@oxfmt/binding-linux-riscv64-gnu@0.52.0':
     optional: true
 
-  '@oxfmt/binding-linux-riscv64-musl@0.50.0':
+  '@oxfmt/binding-linux-riscv64-musl@0.52.0':
     optional: true
 
-  '@oxfmt/binding-linux-s390x-gnu@0.50.0':
+  '@oxfmt/binding-linux-s390x-gnu@0.52.0':
     optional: true
 
-  '@oxfmt/binding-linux-x64-gnu@0.50.0':
+  '@oxfmt/binding-linux-x64-gnu@0.52.0':
     optional: true
 
-  '@oxfmt/binding-linux-x64-musl@0.50.0':
+  '@oxfmt/binding-linux-x64-musl@0.52.0':
     optional: true
 
-  '@oxfmt/binding-openharmony-arm64@0.50.0':
+  '@oxfmt/binding-openharmony-arm64@0.52.0':
     optional: true
 
-  '@oxfmt/binding-win32-arm64-msvc@0.50.0':
+  '@oxfmt/binding-win32-arm64-msvc@0.52.0':
     optional: true
 
-  '@oxfmt/binding-win32-ia32-msvc@0.50.0':
+  '@oxfmt/binding-win32-ia32-msvc@0.52.0':
     optional: true
 
-  '@oxfmt/binding-win32-x64-msvc@0.50.0':
+  '@oxfmt/binding-win32-x64-msvc@0.52.0':
     optional: true
 
   '@oxlint-tsgolint/darwin-arm64@0.23.0':
@@ -7484,61 +7529,61 @@ snapshots:
   '@oxlint-tsgolint/win32-x64@0.23.0':
     optional: true
 
-  '@oxlint/binding-android-arm-eabi@1.65.0':
+  '@oxlint/binding-android-arm-eabi@1.67.0':
     optional: true
 
-  '@oxlint/binding-android-arm64@1.65.0':
+  '@oxlint/binding-android-arm64@1.67.0':
     optional: true
 
-  '@oxlint/binding-darwin-arm64@1.65.0':
+  '@oxlint/binding-darwin-arm64@1.67.0':
     optional: true
 
-  '@oxlint/binding-darwin-x64@1.65.0':
+  '@oxlint/binding-darwin-x64@1.67.0':
     optional: true
 
-  '@oxlint/binding-freebsd-x64@1.65.0':
+  '@oxlint/binding-freebsd-x64@1.67.0':
     optional: true
 
-  '@oxlint/binding-linux-arm-gnueabihf@1.65.0':
+  '@oxlint/binding-linux-arm-gnueabihf@1.67.0':
     optional: true
 
-  '@oxlint/binding-linux-arm-musleabihf@1.65.0':
+  '@oxlint/binding-linux-arm-musleabihf@1.67.0':
     optional: true
 
-  '@oxlint/binding-linux-arm64-gnu@1.65.0':
+  '@oxlint/binding-linux-arm64-gnu@1.67.0':
     optional: true
 
-  '@oxlint/binding-linux-arm64-musl@1.65.0':
+  '@oxlint/binding-linux-arm64-musl@1.67.0':
     optional: true
 
-  '@oxlint/binding-linux-ppc64-gnu@1.65.0':
+  '@oxlint/binding-linux-ppc64-gnu@1.67.0':
     optional: true
 
-  '@oxlint/binding-linux-riscv64-gnu@1.65.0':
+  '@oxlint/binding-linux-riscv64-gnu@1.67.0':
     optional: true
 
-  '@oxlint/binding-linux-riscv64-musl@1.65.0':
+  '@oxlint/binding-linux-riscv64-musl@1.67.0':
     optional: true
 
-  '@oxlint/binding-linux-s390x-gnu@1.65.0':
+  '@oxlint/binding-linux-s390x-gnu@1.67.0':
     optional: true
 
-  '@oxlint/binding-linux-x64-gnu@1.65.0':
+  '@oxlint/binding-linux-x64-gnu@1.67.0':
     optional: true
 
-  '@oxlint/binding-linux-x64-musl@1.65.0':
+  '@oxlint/binding-linux-x64-musl@1.67.0':
     optional: true
 
-  '@oxlint/binding-openharmony-arm64@1.65.0':
+  '@oxlint/binding-openharmony-arm64@1.67.0':
     optional: true
 
-  '@oxlint/binding-win32-arm64-msvc@1.65.0':
+  '@oxlint/binding-win32-arm64-msvc@1.67.0':
     optional: true
 
-  '@oxlint/binding-win32-ia32-msvc@1.65.0':
+  '@oxlint/binding-win32-ia32-msvc@1.67.0':
     optional: true
 
-  '@oxlint/binding-win32-x64-msvc@1.65.0':
+  '@oxlint/binding-win32-x64-msvc@1.67.0':
     optional: true
 
   '@parcel/watcher-android-arm64@2.5.6':
@@ -7615,365 +7660,365 @@ snapshots:
       '@pnpm/network.ca-file': 1.0.2
       config-chain: 1.1.13
 
-  '@posthog/core@1.29.3':
+  '@posthog/core@1.29.12':
     dependencies:
-      '@posthog/types': 1.374.0
+      '@posthog/types': 1.376.3
 
-  '@posthog/types@1.374.0': {}
+  '@posthog/types@1.376.3': {}
 
   '@radix-ui/number@1.1.1': {}
 
   '@radix-ui/primitive@1.1.3': {}
 
-  '@radix-ui/react-accordion@1.2.12(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@radix-ui/react-accordion@1.2.12(@types/react-dom@19.2.3(@types/react@19.2.15))(@types/react@19.2.15)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
     dependencies:
       '@radix-ui/primitive': 1.1.3
-      '@radix-ui/react-collapsible': 1.1.12(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@radix-ui/react-collection': 1.1.7(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.2.14)(react@19.2.6)
-      '@radix-ui/react-context': 1.1.2(@types/react@19.2.14)(react@19.2.6)
-      '@radix-ui/react-direction': 1.1.1(@types/react@19.2.14)(react@19.2.6)
-      '@radix-ui/react-id': 1.1.1(@types/react@19.2.14)(react@19.2.6)
-      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@radix-ui/react-use-controllable-state': 1.2.2(@types/react@19.2.14)(react@19.2.6)
+      '@radix-ui/react-collapsible': 1.1.12(@types/react-dom@19.2.3(@types/react@19.2.15))(@types/react@19.2.15)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+      '@radix-ui/react-collection': 1.1.7(@types/react-dom@19.2.3(@types/react@19.2.15))(@types/react@19.2.15)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.2.15)(react@19.2.6)
+      '@radix-ui/react-context': 1.1.2(@types/react@19.2.15)(react@19.2.6)
+      '@radix-ui/react-direction': 1.1.1(@types/react@19.2.15)(react@19.2.6)
+      '@radix-ui/react-id': 1.1.1(@types/react@19.2.15)(react@19.2.6)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.3(@types/react@19.2.15))(@types/react@19.2.15)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+      '@radix-ui/react-use-controllable-state': 1.2.2(@types/react@19.2.15)(react@19.2.6)
       react: 19.2.6
       react-dom: 19.2.6(react@19.2.6)
     optionalDependencies:
-      '@types/react': 19.2.14
-      '@types/react-dom': 19.2.3(@types/react@19.2.14)
+      '@types/react': 19.2.15
+      '@types/react-dom': 19.2.3(@types/react@19.2.15)
 
-  '@radix-ui/react-arrow@1.1.7(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@radix-ui/react-arrow@1.1.7(@types/react-dom@19.2.3(@types/react@19.2.15))(@types/react@19.2.15)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
     dependencies:
-      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.3(@types/react@19.2.15))(@types/react@19.2.15)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
       react: 19.2.6
       react-dom: 19.2.6(react@19.2.6)
     optionalDependencies:
-      '@types/react': 19.2.14
-      '@types/react-dom': 19.2.3(@types/react@19.2.14)
+      '@types/react': 19.2.15
+      '@types/react-dom': 19.2.3(@types/react@19.2.15)
 
-  '@radix-ui/react-collapsible@1.1.12(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@radix-ui/react-collapsible@1.1.12(@types/react-dom@19.2.3(@types/react@19.2.15))(@types/react@19.2.15)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
     dependencies:
       '@radix-ui/primitive': 1.1.3
-      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.2.14)(react@19.2.6)
-      '@radix-ui/react-context': 1.1.2(@types/react@19.2.14)(react@19.2.6)
-      '@radix-ui/react-id': 1.1.1(@types/react@19.2.14)(react@19.2.6)
-      '@radix-ui/react-presence': 1.1.5(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@radix-ui/react-use-controllable-state': 1.2.2(@types/react@19.2.14)(react@19.2.6)
-      '@radix-ui/react-use-layout-effect': 1.1.1(@types/react@19.2.14)(react@19.2.6)
+      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.2.15)(react@19.2.6)
+      '@radix-ui/react-context': 1.1.2(@types/react@19.2.15)(react@19.2.6)
+      '@radix-ui/react-id': 1.1.1(@types/react@19.2.15)(react@19.2.6)
+      '@radix-ui/react-presence': 1.1.5(@types/react-dom@19.2.3(@types/react@19.2.15))(@types/react@19.2.15)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.3(@types/react@19.2.15))(@types/react@19.2.15)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+      '@radix-ui/react-use-controllable-state': 1.2.2(@types/react@19.2.15)(react@19.2.6)
+      '@radix-ui/react-use-layout-effect': 1.1.1(@types/react@19.2.15)(react@19.2.6)
       react: 19.2.6
       react-dom: 19.2.6(react@19.2.6)
     optionalDependencies:
-      '@types/react': 19.2.14
-      '@types/react-dom': 19.2.3(@types/react@19.2.14)
+      '@types/react': 19.2.15
+      '@types/react-dom': 19.2.3(@types/react@19.2.15)
 
-  '@radix-ui/react-collection@1.1.7(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@radix-ui/react-collection@1.1.7(@types/react-dom@19.2.3(@types/react@19.2.15))(@types/react@19.2.15)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
     dependencies:
-      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.2.14)(react@19.2.6)
-      '@radix-ui/react-context': 1.1.2(@types/react@19.2.14)(react@19.2.6)
-      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@radix-ui/react-slot': 1.2.3(@types/react@19.2.14)(react@19.2.6)
+      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.2.15)(react@19.2.6)
+      '@radix-ui/react-context': 1.1.2(@types/react@19.2.15)(react@19.2.6)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.3(@types/react@19.2.15))(@types/react@19.2.15)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+      '@radix-ui/react-slot': 1.2.3(@types/react@19.2.15)(react@19.2.6)
       react: 19.2.6
       react-dom: 19.2.6(react@19.2.6)
     optionalDependencies:
-      '@types/react': 19.2.14
-      '@types/react-dom': 19.2.3(@types/react@19.2.14)
+      '@types/react': 19.2.15
+      '@types/react-dom': 19.2.3(@types/react@19.2.15)
 
-  '@radix-ui/react-compose-refs@1.1.2(@types/react@19.2.14)(react@19.2.6)':
+  '@radix-ui/react-compose-refs@1.1.2(@types/react@19.2.15)(react@19.2.6)':
     dependencies:
       react: 19.2.6
     optionalDependencies:
-      '@types/react': 19.2.14
+      '@types/react': 19.2.15
 
-  '@radix-ui/react-context@1.1.2(@types/react@19.2.14)(react@19.2.6)':
+  '@radix-ui/react-context@1.1.2(@types/react@19.2.15)(react@19.2.6)':
     dependencies:
       react: 19.2.6
     optionalDependencies:
-      '@types/react': 19.2.14
+      '@types/react': 19.2.15
 
-  '@radix-ui/react-dialog@1.1.15(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@radix-ui/react-dialog@1.1.15(@types/react-dom@19.2.3(@types/react@19.2.15))(@types/react@19.2.15)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
     dependencies:
       '@radix-ui/primitive': 1.1.3
-      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.2.14)(react@19.2.6)
-      '@radix-ui/react-context': 1.1.2(@types/react@19.2.14)(react@19.2.6)
-      '@radix-ui/react-dismissable-layer': 1.1.11(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@radix-ui/react-focus-guards': 1.1.3(@types/react@19.2.14)(react@19.2.6)
-      '@radix-ui/react-focus-scope': 1.1.7(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@radix-ui/react-id': 1.1.1(@types/react@19.2.14)(react@19.2.6)
-      '@radix-ui/react-portal': 1.1.9(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@radix-ui/react-presence': 1.1.5(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@radix-ui/react-slot': 1.2.3(@types/react@19.2.14)(react@19.2.6)
-      '@radix-ui/react-use-controllable-state': 1.2.2(@types/react@19.2.14)(react@19.2.6)
+      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.2.15)(react@19.2.6)
+      '@radix-ui/react-context': 1.1.2(@types/react@19.2.15)(react@19.2.6)
+      '@radix-ui/react-dismissable-layer': 1.1.11(@types/react-dom@19.2.3(@types/react@19.2.15))(@types/react@19.2.15)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+      '@radix-ui/react-focus-guards': 1.1.3(@types/react@19.2.15)(react@19.2.6)
+      '@radix-ui/react-focus-scope': 1.1.7(@types/react-dom@19.2.3(@types/react@19.2.15))(@types/react@19.2.15)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+      '@radix-ui/react-id': 1.1.1(@types/react@19.2.15)(react@19.2.6)
+      '@radix-ui/react-portal': 1.1.9(@types/react-dom@19.2.3(@types/react@19.2.15))(@types/react@19.2.15)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+      '@radix-ui/react-presence': 1.1.5(@types/react-dom@19.2.3(@types/react@19.2.15))(@types/react@19.2.15)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.3(@types/react@19.2.15))(@types/react@19.2.15)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+      '@radix-ui/react-slot': 1.2.3(@types/react@19.2.15)(react@19.2.6)
+      '@radix-ui/react-use-controllable-state': 1.2.2(@types/react@19.2.15)(react@19.2.6)
       aria-hidden: 1.2.6
       react: 19.2.6
       react-dom: 19.2.6(react@19.2.6)
-      react-remove-scroll: 2.7.2(@types/react@19.2.14)(react@19.2.6)
+      react-remove-scroll: 2.7.2(@types/react@19.2.15)(react@19.2.6)
     optionalDependencies:
-      '@types/react': 19.2.14
-      '@types/react-dom': 19.2.3(@types/react@19.2.14)
+      '@types/react': 19.2.15
+      '@types/react-dom': 19.2.3(@types/react@19.2.15)
 
-  '@radix-ui/react-direction@1.1.1(@types/react@19.2.14)(react@19.2.6)':
+  '@radix-ui/react-direction@1.1.1(@types/react@19.2.15)(react@19.2.6)':
     dependencies:
       react: 19.2.6
     optionalDependencies:
-      '@types/react': 19.2.14
+      '@types/react': 19.2.15
 
-  '@radix-ui/react-dismissable-layer@1.1.11(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@radix-ui/react-dismissable-layer@1.1.11(@types/react-dom@19.2.3(@types/react@19.2.15))(@types/react@19.2.15)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
     dependencies:
       '@radix-ui/primitive': 1.1.3
-      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.2.14)(react@19.2.6)
-      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@radix-ui/react-use-callback-ref': 1.1.1(@types/react@19.2.14)(react@19.2.6)
-      '@radix-ui/react-use-escape-keydown': 1.1.1(@types/react@19.2.14)(react@19.2.6)
+      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.2.15)(react@19.2.6)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.3(@types/react@19.2.15))(@types/react@19.2.15)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+      '@radix-ui/react-use-callback-ref': 1.1.1(@types/react@19.2.15)(react@19.2.6)
+      '@radix-ui/react-use-escape-keydown': 1.1.1(@types/react@19.2.15)(react@19.2.6)
       react: 19.2.6
       react-dom: 19.2.6(react@19.2.6)
     optionalDependencies:
-      '@types/react': 19.2.14
-      '@types/react-dom': 19.2.3(@types/react@19.2.14)
+      '@types/react': 19.2.15
+      '@types/react-dom': 19.2.3(@types/react@19.2.15)
 
-  '@radix-ui/react-focus-guards@1.1.3(@types/react@19.2.14)(react@19.2.6)':
+  '@radix-ui/react-focus-guards@1.1.3(@types/react@19.2.15)(react@19.2.6)':
     dependencies:
       react: 19.2.6
     optionalDependencies:
-      '@types/react': 19.2.14
+      '@types/react': 19.2.15
 
-  '@radix-ui/react-focus-scope@1.1.7(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@radix-ui/react-focus-scope@1.1.7(@types/react-dom@19.2.3(@types/react@19.2.15))(@types/react@19.2.15)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
     dependencies:
-      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.2.14)(react@19.2.6)
-      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@radix-ui/react-use-callback-ref': 1.1.1(@types/react@19.2.14)(react@19.2.6)
+      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.2.15)(react@19.2.6)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.3(@types/react@19.2.15))(@types/react@19.2.15)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+      '@radix-ui/react-use-callback-ref': 1.1.1(@types/react@19.2.15)(react@19.2.6)
       react: 19.2.6
       react-dom: 19.2.6(react@19.2.6)
     optionalDependencies:
-      '@types/react': 19.2.14
-      '@types/react-dom': 19.2.3(@types/react@19.2.14)
+      '@types/react': 19.2.15
+      '@types/react-dom': 19.2.3(@types/react@19.2.15)
 
-  '@radix-ui/react-id@1.1.1(@types/react@19.2.14)(react@19.2.6)':
+  '@radix-ui/react-id@1.1.1(@types/react@19.2.15)(react@19.2.6)':
     dependencies:
-      '@radix-ui/react-use-layout-effect': 1.1.1(@types/react@19.2.14)(react@19.2.6)
+      '@radix-ui/react-use-layout-effect': 1.1.1(@types/react@19.2.15)(react@19.2.6)
       react: 19.2.6
     optionalDependencies:
-      '@types/react': 19.2.14
+      '@types/react': 19.2.15
 
-  '@radix-ui/react-navigation-menu@1.2.14(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@radix-ui/react-navigation-menu@1.2.14(@types/react-dom@19.2.3(@types/react@19.2.15))(@types/react@19.2.15)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
     dependencies:
       '@radix-ui/primitive': 1.1.3
-      '@radix-ui/react-collection': 1.1.7(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.2.14)(react@19.2.6)
-      '@radix-ui/react-context': 1.1.2(@types/react@19.2.14)(react@19.2.6)
-      '@radix-ui/react-direction': 1.1.1(@types/react@19.2.14)(react@19.2.6)
-      '@radix-ui/react-dismissable-layer': 1.1.11(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@radix-ui/react-id': 1.1.1(@types/react@19.2.14)(react@19.2.6)
-      '@radix-ui/react-presence': 1.1.5(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@radix-ui/react-use-callback-ref': 1.1.1(@types/react@19.2.14)(react@19.2.6)
-      '@radix-ui/react-use-controllable-state': 1.2.2(@types/react@19.2.14)(react@19.2.6)
-      '@radix-ui/react-use-layout-effect': 1.1.1(@types/react@19.2.14)(react@19.2.6)
-      '@radix-ui/react-use-previous': 1.1.1(@types/react@19.2.14)(react@19.2.6)
-      '@radix-ui/react-visually-hidden': 1.2.3(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+      '@radix-ui/react-collection': 1.1.7(@types/react-dom@19.2.3(@types/react@19.2.15))(@types/react@19.2.15)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.2.15)(react@19.2.6)
+      '@radix-ui/react-context': 1.1.2(@types/react@19.2.15)(react@19.2.6)
+      '@radix-ui/react-direction': 1.1.1(@types/react@19.2.15)(react@19.2.6)
+      '@radix-ui/react-dismissable-layer': 1.1.11(@types/react-dom@19.2.3(@types/react@19.2.15))(@types/react@19.2.15)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+      '@radix-ui/react-id': 1.1.1(@types/react@19.2.15)(react@19.2.6)
+      '@radix-ui/react-presence': 1.1.5(@types/react-dom@19.2.3(@types/react@19.2.15))(@types/react@19.2.15)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.3(@types/react@19.2.15))(@types/react@19.2.15)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+      '@radix-ui/react-use-callback-ref': 1.1.1(@types/react@19.2.15)(react@19.2.6)
+      '@radix-ui/react-use-controllable-state': 1.2.2(@types/react@19.2.15)(react@19.2.6)
+      '@radix-ui/react-use-layout-effect': 1.1.1(@types/react@19.2.15)(react@19.2.6)
+      '@radix-ui/react-use-previous': 1.1.1(@types/react@19.2.15)(react@19.2.6)
+      '@radix-ui/react-visually-hidden': 1.2.3(@types/react-dom@19.2.3(@types/react@19.2.15))(@types/react@19.2.15)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
       react: 19.2.6
       react-dom: 19.2.6(react@19.2.6)
     optionalDependencies:
-      '@types/react': 19.2.14
-      '@types/react-dom': 19.2.3(@types/react@19.2.14)
+      '@types/react': 19.2.15
+      '@types/react-dom': 19.2.3(@types/react@19.2.15)
 
-  '@radix-ui/react-popover@1.1.15(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@radix-ui/react-popover@1.1.15(@types/react-dom@19.2.3(@types/react@19.2.15))(@types/react@19.2.15)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
     dependencies:
       '@radix-ui/primitive': 1.1.3
-      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.2.14)(react@19.2.6)
-      '@radix-ui/react-context': 1.1.2(@types/react@19.2.14)(react@19.2.6)
-      '@radix-ui/react-dismissable-layer': 1.1.11(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@radix-ui/react-focus-guards': 1.1.3(@types/react@19.2.14)(react@19.2.6)
-      '@radix-ui/react-focus-scope': 1.1.7(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@radix-ui/react-id': 1.1.1(@types/react@19.2.14)(react@19.2.6)
-      '@radix-ui/react-popper': 1.2.8(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@radix-ui/react-portal': 1.1.9(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@radix-ui/react-presence': 1.1.5(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@radix-ui/react-slot': 1.2.3(@types/react@19.2.14)(react@19.2.6)
-      '@radix-ui/react-use-controllable-state': 1.2.2(@types/react@19.2.14)(react@19.2.6)
+      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.2.15)(react@19.2.6)
+      '@radix-ui/react-context': 1.1.2(@types/react@19.2.15)(react@19.2.6)
+      '@radix-ui/react-dismissable-layer': 1.1.11(@types/react-dom@19.2.3(@types/react@19.2.15))(@types/react@19.2.15)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+      '@radix-ui/react-focus-guards': 1.1.3(@types/react@19.2.15)(react@19.2.6)
+      '@radix-ui/react-focus-scope': 1.1.7(@types/react-dom@19.2.3(@types/react@19.2.15))(@types/react@19.2.15)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+      '@radix-ui/react-id': 1.1.1(@types/react@19.2.15)(react@19.2.6)
+      '@radix-ui/react-popper': 1.2.8(@types/react-dom@19.2.3(@types/react@19.2.15))(@types/react@19.2.15)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+      '@radix-ui/react-portal': 1.1.9(@types/react-dom@19.2.3(@types/react@19.2.15))(@types/react@19.2.15)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+      '@radix-ui/react-presence': 1.1.5(@types/react-dom@19.2.3(@types/react@19.2.15))(@types/react@19.2.15)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.3(@types/react@19.2.15))(@types/react@19.2.15)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+      '@radix-ui/react-slot': 1.2.3(@types/react@19.2.15)(react@19.2.6)
+      '@radix-ui/react-use-controllable-state': 1.2.2(@types/react@19.2.15)(react@19.2.6)
       aria-hidden: 1.2.6
       react: 19.2.6
       react-dom: 19.2.6(react@19.2.6)
-      react-remove-scroll: 2.7.2(@types/react@19.2.14)(react@19.2.6)
+      react-remove-scroll: 2.7.2(@types/react@19.2.15)(react@19.2.6)
     optionalDependencies:
-      '@types/react': 19.2.14
-      '@types/react-dom': 19.2.3(@types/react@19.2.14)
+      '@types/react': 19.2.15
+      '@types/react-dom': 19.2.3(@types/react@19.2.15)
 
-  '@radix-ui/react-popper@1.2.8(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@radix-ui/react-popper@1.2.8(@types/react-dom@19.2.3(@types/react@19.2.15))(@types/react@19.2.15)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
     dependencies:
       '@floating-ui/react-dom': 2.1.8(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@radix-ui/react-arrow': 1.1.7(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.2.14)(react@19.2.6)
-      '@radix-ui/react-context': 1.1.2(@types/react@19.2.14)(react@19.2.6)
-      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@radix-ui/react-use-callback-ref': 1.1.1(@types/react@19.2.14)(react@19.2.6)
-      '@radix-ui/react-use-layout-effect': 1.1.1(@types/react@19.2.14)(react@19.2.6)
-      '@radix-ui/react-use-rect': 1.1.1(@types/react@19.2.14)(react@19.2.6)
-      '@radix-ui/react-use-size': 1.1.1(@types/react@19.2.14)(react@19.2.6)
+      '@radix-ui/react-arrow': 1.1.7(@types/react-dom@19.2.3(@types/react@19.2.15))(@types/react@19.2.15)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.2.15)(react@19.2.6)
+      '@radix-ui/react-context': 1.1.2(@types/react@19.2.15)(react@19.2.6)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.3(@types/react@19.2.15))(@types/react@19.2.15)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+      '@radix-ui/react-use-callback-ref': 1.1.1(@types/react@19.2.15)(react@19.2.6)
+      '@radix-ui/react-use-layout-effect': 1.1.1(@types/react@19.2.15)(react@19.2.6)
+      '@radix-ui/react-use-rect': 1.1.1(@types/react@19.2.15)(react@19.2.6)
+      '@radix-ui/react-use-size': 1.1.1(@types/react@19.2.15)(react@19.2.6)
       '@radix-ui/rect': 1.1.1
       react: 19.2.6
       react-dom: 19.2.6(react@19.2.6)
     optionalDependencies:
-      '@types/react': 19.2.14
-      '@types/react-dom': 19.2.3(@types/react@19.2.14)
+      '@types/react': 19.2.15
+      '@types/react-dom': 19.2.3(@types/react@19.2.15)
 
-  '@radix-ui/react-portal@1.1.9(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@radix-ui/react-portal@1.1.9(@types/react-dom@19.2.3(@types/react@19.2.15))(@types/react@19.2.15)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
     dependencies:
-      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@radix-ui/react-use-layout-effect': 1.1.1(@types/react@19.2.14)(react@19.2.6)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.3(@types/react@19.2.15))(@types/react@19.2.15)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+      '@radix-ui/react-use-layout-effect': 1.1.1(@types/react@19.2.15)(react@19.2.6)
       react: 19.2.6
       react-dom: 19.2.6(react@19.2.6)
     optionalDependencies:
-      '@types/react': 19.2.14
-      '@types/react-dom': 19.2.3(@types/react@19.2.14)
+      '@types/react': 19.2.15
+      '@types/react-dom': 19.2.3(@types/react@19.2.15)
 
-  '@radix-ui/react-presence@1.1.5(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@radix-ui/react-presence@1.1.5(@types/react-dom@19.2.3(@types/react@19.2.15))(@types/react@19.2.15)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
     dependencies:
-      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.2.14)(react@19.2.6)
-      '@radix-ui/react-use-layout-effect': 1.1.1(@types/react@19.2.14)(react@19.2.6)
+      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.2.15)(react@19.2.6)
+      '@radix-ui/react-use-layout-effect': 1.1.1(@types/react@19.2.15)(react@19.2.6)
       react: 19.2.6
       react-dom: 19.2.6(react@19.2.6)
     optionalDependencies:
-      '@types/react': 19.2.14
-      '@types/react-dom': 19.2.3(@types/react@19.2.14)
+      '@types/react': 19.2.15
+      '@types/react-dom': 19.2.3(@types/react@19.2.15)
 
-  '@radix-ui/react-primitive@2.1.3(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@radix-ui/react-primitive@2.1.3(@types/react-dom@19.2.3(@types/react@19.2.15))(@types/react@19.2.15)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
     dependencies:
-      '@radix-ui/react-slot': 1.2.3(@types/react@19.2.14)(react@19.2.6)
+      '@radix-ui/react-slot': 1.2.3(@types/react@19.2.15)(react@19.2.6)
       react: 19.2.6
       react-dom: 19.2.6(react@19.2.6)
     optionalDependencies:
-      '@types/react': 19.2.14
-      '@types/react-dom': 19.2.3(@types/react@19.2.14)
+      '@types/react': 19.2.15
+      '@types/react-dom': 19.2.3(@types/react@19.2.15)
 
-  '@radix-ui/react-roving-focus@1.1.11(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@radix-ui/react-roving-focus@1.1.11(@types/react-dom@19.2.3(@types/react@19.2.15))(@types/react@19.2.15)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
     dependencies:
       '@radix-ui/primitive': 1.1.3
-      '@radix-ui/react-collection': 1.1.7(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.2.14)(react@19.2.6)
-      '@radix-ui/react-context': 1.1.2(@types/react@19.2.14)(react@19.2.6)
-      '@radix-ui/react-direction': 1.1.1(@types/react@19.2.14)(react@19.2.6)
-      '@radix-ui/react-id': 1.1.1(@types/react@19.2.14)(react@19.2.6)
-      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@radix-ui/react-use-callback-ref': 1.1.1(@types/react@19.2.14)(react@19.2.6)
-      '@radix-ui/react-use-controllable-state': 1.2.2(@types/react@19.2.14)(react@19.2.6)
+      '@radix-ui/react-collection': 1.1.7(@types/react-dom@19.2.3(@types/react@19.2.15))(@types/react@19.2.15)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.2.15)(react@19.2.6)
+      '@radix-ui/react-context': 1.1.2(@types/react@19.2.15)(react@19.2.6)
+      '@radix-ui/react-direction': 1.1.1(@types/react@19.2.15)(react@19.2.6)
+      '@radix-ui/react-id': 1.1.1(@types/react@19.2.15)(react@19.2.6)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.3(@types/react@19.2.15))(@types/react@19.2.15)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+      '@radix-ui/react-use-callback-ref': 1.1.1(@types/react@19.2.15)(react@19.2.6)
+      '@radix-ui/react-use-controllable-state': 1.2.2(@types/react@19.2.15)(react@19.2.6)
       react: 19.2.6
       react-dom: 19.2.6(react@19.2.6)
     optionalDependencies:
-      '@types/react': 19.2.14
-      '@types/react-dom': 19.2.3(@types/react@19.2.14)
+      '@types/react': 19.2.15
+      '@types/react-dom': 19.2.3(@types/react@19.2.15)
 
-  '@radix-ui/react-scroll-area@1.2.10(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@radix-ui/react-scroll-area@1.2.10(@types/react-dom@19.2.3(@types/react@19.2.15))(@types/react@19.2.15)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
     dependencies:
       '@radix-ui/number': 1.1.1
       '@radix-ui/primitive': 1.1.3
-      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.2.14)(react@19.2.6)
-      '@radix-ui/react-context': 1.1.2(@types/react@19.2.14)(react@19.2.6)
-      '@radix-ui/react-direction': 1.1.1(@types/react@19.2.14)(react@19.2.6)
-      '@radix-ui/react-presence': 1.1.5(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@radix-ui/react-use-callback-ref': 1.1.1(@types/react@19.2.14)(react@19.2.6)
-      '@radix-ui/react-use-layout-effect': 1.1.1(@types/react@19.2.14)(react@19.2.6)
+      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.2.15)(react@19.2.6)
+      '@radix-ui/react-context': 1.1.2(@types/react@19.2.15)(react@19.2.6)
+      '@radix-ui/react-direction': 1.1.1(@types/react@19.2.15)(react@19.2.6)
+      '@radix-ui/react-presence': 1.1.5(@types/react-dom@19.2.3(@types/react@19.2.15))(@types/react@19.2.15)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.3(@types/react@19.2.15))(@types/react@19.2.15)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+      '@radix-ui/react-use-callback-ref': 1.1.1(@types/react@19.2.15)(react@19.2.6)
+      '@radix-ui/react-use-layout-effect': 1.1.1(@types/react@19.2.15)(react@19.2.6)
       react: 19.2.6
       react-dom: 19.2.6(react@19.2.6)
     optionalDependencies:
-      '@types/react': 19.2.14
-      '@types/react-dom': 19.2.3(@types/react@19.2.14)
+      '@types/react': 19.2.15
+      '@types/react-dom': 19.2.3(@types/react@19.2.15)
 
-  '@radix-ui/react-slot@1.2.3(@types/react@19.2.14)(react@19.2.6)':
+  '@radix-ui/react-slot@1.2.3(@types/react@19.2.15)(react@19.2.6)':
     dependencies:
-      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.2.14)(react@19.2.6)
+      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.2.15)(react@19.2.6)
       react: 19.2.6
     optionalDependencies:
-      '@types/react': 19.2.14
+      '@types/react': 19.2.15
 
-  '@radix-ui/react-slot@1.2.4(@types/react@19.2.14)(react@19.2.6)':
+  '@radix-ui/react-slot@1.2.4(@types/react@19.2.15)(react@19.2.6)':
     dependencies:
-      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.2.14)(react@19.2.6)
+      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.2.15)(react@19.2.6)
       react: 19.2.6
     optionalDependencies:
-      '@types/react': 19.2.14
+      '@types/react': 19.2.15
 
-  '@radix-ui/react-tabs@1.1.13(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@radix-ui/react-tabs@1.1.13(@types/react-dom@19.2.3(@types/react@19.2.15))(@types/react@19.2.15)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
     dependencies:
       '@radix-ui/primitive': 1.1.3
-      '@radix-ui/react-context': 1.1.2(@types/react@19.2.14)(react@19.2.6)
-      '@radix-ui/react-direction': 1.1.1(@types/react@19.2.14)(react@19.2.6)
-      '@radix-ui/react-id': 1.1.1(@types/react@19.2.14)(react@19.2.6)
-      '@radix-ui/react-presence': 1.1.5(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@radix-ui/react-roving-focus': 1.1.11(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@radix-ui/react-use-controllable-state': 1.2.2(@types/react@19.2.14)(react@19.2.6)
+      '@radix-ui/react-context': 1.1.2(@types/react@19.2.15)(react@19.2.6)
+      '@radix-ui/react-direction': 1.1.1(@types/react@19.2.15)(react@19.2.6)
+      '@radix-ui/react-id': 1.1.1(@types/react@19.2.15)(react@19.2.6)
+      '@radix-ui/react-presence': 1.1.5(@types/react-dom@19.2.3(@types/react@19.2.15))(@types/react@19.2.15)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.3(@types/react@19.2.15))(@types/react@19.2.15)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+      '@radix-ui/react-roving-focus': 1.1.11(@types/react-dom@19.2.3(@types/react@19.2.15))(@types/react@19.2.15)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+      '@radix-ui/react-use-controllable-state': 1.2.2(@types/react@19.2.15)(react@19.2.6)
       react: 19.2.6
       react-dom: 19.2.6(react@19.2.6)
     optionalDependencies:
-      '@types/react': 19.2.14
-      '@types/react-dom': 19.2.3(@types/react@19.2.14)
+      '@types/react': 19.2.15
+      '@types/react-dom': 19.2.3(@types/react@19.2.15)
 
-  '@radix-ui/react-use-callback-ref@1.1.1(@types/react@19.2.14)(react@19.2.6)':
+  '@radix-ui/react-use-callback-ref@1.1.1(@types/react@19.2.15)(react@19.2.6)':
     dependencies:
       react: 19.2.6
     optionalDependencies:
-      '@types/react': 19.2.14
+      '@types/react': 19.2.15
 
-  '@radix-ui/react-use-controllable-state@1.2.2(@types/react@19.2.14)(react@19.2.6)':
+  '@radix-ui/react-use-controllable-state@1.2.2(@types/react@19.2.15)(react@19.2.6)':
     dependencies:
-      '@radix-ui/react-use-effect-event': 0.0.2(@types/react@19.2.14)(react@19.2.6)
-      '@radix-ui/react-use-layout-effect': 1.1.1(@types/react@19.2.14)(react@19.2.6)
+      '@radix-ui/react-use-effect-event': 0.0.2(@types/react@19.2.15)(react@19.2.6)
+      '@radix-ui/react-use-layout-effect': 1.1.1(@types/react@19.2.15)(react@19.2.6)
       react: 19.2.6
     optionalDependencies:
-      '@types/react': 19.2.14
+      '@types/react': 19.2.15
 
-  '@radix-ui/react-use-effect-event@0.0.2(@types/react@19.2.14)(react@19.2.6)':
+  '@radix-ui/react-use-effect-event@0.0.2(@types/react@19.2.15)(react@19.2.6)':
     dependencies:
-      '@radix-ui/react-use-layout-effect': 1.1.1(@types/react@19.2.14)(react@19.2.6)
+      '@radix-ui/react-use-layout-effect': 1.1.1(@types/react@19.2.15)(react@19.2.6)
       react: 19.2.6
     optionalDependencies:
-      '@types/react': 19.2.14
+      '@types/react': 19.2.15
 
-  '@radix-ui/react-use-escape-keydown@1.1.1(@types/react@19.2.14)(react@19.2.6)':
+  '@radix-ui/react-use-escape-keydown@1.1.1(@types/react@19.2.15)(react@19.2.6)':
     dependencies:
-      '@radix-ui/react-use-callback-ref': 1.1.1(@types/react@19.2.14)(react@19.2.6)
+      '@radix-ui/react-use-callback-ref': 1.1.1(@types/react@19.2.15)(react@19.2.6)
       react: 19.2.6
     optionalDependencies:
-      '@types/react': 19.2.14
+      '@types/react': 19.2.15
 
-  '@radix-ui/react-use-layout-effect@1.1.1(@types/react@19.2.14)(react@19.2.6)':
+  '@radix-ui/react-use-layout-effect@1.1.1(@types/react@19.2.15)(react@19.2.6)':
     dependencies:
       react: 19.2.6
     optionalDependencies:
-      '@types/react': 19.2.14
+      '@types/react': 19.2.15
 
-  '@radix-ui/react-use-previous@1.1.1(@types/react@19.2.14)(react@19.2.6)':
+  '@radix-ui/react-use-previous@1.1.1(@types/react@19.2.15)(react@19.2.6)':
     dependencies:
       react: 19.2.6
     optionalDependencies:
-      '@types/react': 19.2.14
+      '@types/react': 19.2.15
 
-  '@radix-ui/react-use-rect@1.1.1(@types/react@19.2.14)(react@19.2.6)':
+  '@radix-ui/react-use-rect@1.1.1(@types/react@19.2.15)(react@19.2.6)':
     dependencies:
       '@radix-ui/rect': 1.1.1
       react: 19.2.6
     optionalDependencies:
-      '@types/react': 19.2.14
+      '@types/react': 19.2.15
 
-  '@radix-ui/react-use-size@1.1.1(@types/react@19.2.14)(react@19.2.6)':
+  '@radix-ui/react-use-size@1.1.1(@types/react@19.2.15)(react@19.2.6)':
     dependencies:
-      '@radix-ui/react-use-layout-effect': 1.1.1(@types/react@19.2.14)(react@19.2.6)
+      '@radix-ui/react-use-layout-effect': 1.1.1(@types/react@19.2.15)(react@19.2.6)
       react: 19.2.6
     optionalDependencies:
-      '@types/react': 19.2.14
+      '@types/react': 19.2.15
 
-  '@radix-ui/react-visually-hidden@1.2.3(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@radix-ui/react-visually-hidden@1.2.3(@types/react-dom@19.2.3(@types/react@19.2.15))(@types/react@19.2.15)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
     dependencies:
-      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.3(@types/react@19.2.15))(@types/react@19.2.15)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
       react: 19.2.6
       react-dom: 19.2.6(react@19.2.6)
     optionalDependencies:
-      '@types/react': 19.2.14
-      '@types/react-dom': 19.2.3(@types/react@19.2.14)
+      '@types/react': 19.2.15
+      '@types/react-dom': 19.2.3(@types/react@19.2.15)
 
   '@radix-ui/rect@1.1.1': {}
 
@@ -8031,7 +8076,7 @@ snapshots:
 
   '@sec-ant/readable-stream@0.4.1': {}
 
-  '@semantic-release/commit-analyzer@13.0.1(semantic-release@24.2.9(typescript@6.0.3))':
+  '@semantic-release/commit-analyzer@13.0.1(semantic-release@25.0.3(typescript@6.0.3))':
     dependencies:
       conventional-changelog-angular: 8.3.1
       conventional-changelog-writer: 8.4.0
@@ -8041,52 +8086,55 @@ snapshots:
       import-from-esm: 2.0.0
       lodash-es: 4.18.1
       micromatch: 4.0.8
-      semantic-release: 24.2.9(typescript@6.0.3)
+      semantic-release: 25.0.3(typescript@6.0.3)
     transitivePeerDependencies:
       - supports-color
 
   '@semantic-release/error@4.0.0': {}
 
-  '@semantic-release/github@11.0.6(semantic-release@24.2.9(typescript@6.0.3))':
+  '@semantic-release/github@12.0.8(semantic-release@25.0.3(typescript@6.0.3))':
     dependencies:
       '@octokit/core': 7.0.6
-      '@octokit/plugin-paginate-rest': 13.2.1(@octokit/core@7.0.6)
+      '@octokit/plugin-paginate-rest': 14.0.0(@octokit/core@7.0.6)
       '@octokit/plugin-retry': 8.1.0(@octokit/core@7.0.6)
       '@octokit/plugin-throttling': 11.0.3(@octokit/core@7.0.6)
       '@semantic-release/error': 4.0.0
       aggregate-error: 5.0.0
       debug: 4.4.3
       dir-glob: 3.0.1
-      http-proxy-agent: 7.0.2
-      https-proxy-agent: 7.0.6
+      http-proxy-agent: 9.0.0
+      https-proxy-agent: 9.0.0
       issue-parser: 7.0.2
       lodash-es: 4.18.1
       mime: 4.1.0
       p-filter: 4.1.0
-      semantic-release: 24.2.9(typescript@6.0.3)
+      semantic-release: 25.0.3(typescript@6.0.3)
       tinyglobby: 0.2.16
+      undici: 7.26.0
       url-join: 5.0.0
     transitivePeerDependencies:
       - supports-color
 
-  '@semantic-release/npm@12.0.2(semantic-release@24.2.9(typescript@6.0.3))':
+  '@semantic-release/npm@13.1.5(semantic-release@25.0.3(typescript@6.0.3))':
     dependencies:
+      '@actions/core': 3.0.1
       '@semantic-release/error': 4.0.0
       aggregate-error: 5.0.0
+      env-ci: 11.2.0
       execa: 9.6.1
       fs-extra: 11.3.5
       lodash-es: 4.18.1
       nerf-dart: 1.0.0
-      normalize-url: 8.1.1
-      npm: 10.9.8
+      normalize-url: 9.0.1
+      npm: 11.15.0
       rc: 1.2.8
-      read-pkg: 9.0.1
+      read-pkg: 10.1.0
       registry-auth-token: 5.1.1
-      semantic-release: 24.2.9(typescript@6.0.3)
-      semver: 7.8.0
+      semantic-release: 25.0.3(typescript@6.0.3)
+      semver: 7.8.1
       tempy: 3.2.0
 
-  '@semantic-release/release-notes-generator@14.1.1(semantic-release@24.2.9(typescript@6.0.3))':
+  '@semantic-release/release-notes-generator@14.1.1(semantic-release@25.0.3(typescript@6.0.3))':
     dependencies:
       conventional-changelog-angular: 8.3.1
       conventional-changelog-writer: 8.4.0
@@ -8096,44 +8144,44 @@ snapshots:
       import-from-esm: 2.0.0
       lodash-es: 4.18.1
       read-package-up: 11.0.0
-      semantic-release: 24.2.9(typescript@6.0.3)
+      semantic-release: 25.0.3(typescript@6.0.3)
     transitivePeerDependencies:
       - supports-color
 
-  '@shikijs/core@4.0.2':
+  '@shikijs/core@4.1.0':
     dependencies:
-      '@shikijs/primitive': 4.0.2
-      '@shikijs/types': 4.0.2
+      '@shikijs/primitive': 4.1.0
+      '@shikijs/types': 4.1.0
       '@shikijs/vscode-textmate': 10.0.2
       '@types/hast': 3.0.4
       hast-util-to-html: 9.0.5
 
-  '@shikijs/engine-javascript@4.0.2':
+  '@shikijs/engine-javascript@4.1.0':
     dependencies:
-      '@shikijs/types': 4.0.2
+      '@shikijs/types': 4.1.0
       '@shikijs/vscode-textmate': 10.0.2
       oniguruma-to-es: 4.3.6
 
-  '@shikijs/engine-oniguruma@4.0.2':
+  '@shikijs/engine-oniguruma@4.1.0':
     dependencies:
-      '@shikijs/types': 4.0.2
+      '@shikijs/types': 4.1.0
       '@shikijs/vscode-textmate': 10.0.2
 
-  '@shikijs/langs@4.0.2':
+  '@shikijs/langs@4.1.0':
     dependencies:
-      '@shikijs/types': 4.0.2
+      '@shikijs/types': 4.1.0
 
-  '@shikijs/primitive@4.0.2':
+  '@shikijs/primitive@4.1.0':
     dependencies:
-      '@shikijs/types': 4.0.2
+      '@shikijs/types': 4.1.0
       '@shikijs/vscode-textmate': 10.0.2
       '@types/hast': 3.0.4
 
-  '@shikijs/themes@4.0.2':
+  '@shikijs/themes@4.1.0':
     dependencies:
-      '@shikijs/types': 4.0.2
+      '@shikijs/types': 4.1.0
 
-  '@shikijs/types@4.0.2':
+  '@shikijs/types@4.1.0':
     dependencies:
       '@shikijs/vscode-textmate': 10.0.2
       '@types/hast': 3.0.4
@@ -8148,48 +8196,48 @@ snapshots:
 
   '@standard-schema/spec@1.1.0': {}
 
-  '@supabase/auth-js@2.105.4':
+  '@supabase/auth-js@2.106.2':
     dependencies:
       tslib: 2.8.1
 
-  '@supabase/functions-js@2.105.4':
+  '@supabase/functions-js@2.106.2':
     dependencies:
       tslib: 2.8.1
 
   '@supabase/phoenix@0.4.2': {}
 
-  '@supabase/postgrest-js@2.105.4':
+  '@supabase/postgrest-js@2.106.2':
     dependencies:
       tslib: 2.8.1
 
-  '@supabase/realtime-js@2.105.4':
+  '@supabase/realtime-js@2.106.2':
     dependencies:
       '@supabase/phoenix': 0.4.2
       tslib: 2.8.1
 
-  '@supabase/storage-js@2.105.4':
+  '@supabase/storage-js@2.106.2':
     dependencies:
       iceberg-js: 0.8.1
       tslib: 2.8.1
 
-  '@supabase/supabase-js@2.105.4':
+  '@supabase/supabase-js@2.106.2':
     dependencies:
-      '@supabase/auth-js': 2.105.4
-      '@supabase/functions-js': 2.105.4
-      '@supabase/postgrest-js': 2.105.4
-      '@supabase/realtime-js': 2.105.4
-      '@supabase/storage-js': 2.105.4
+      '@supabase/auth-js': 2.106.2
+      '@supabase/functions-js': 2.106.2
+      '@supabase/postgrest-js': 2.106.2
+      '@supabase/realtime-js': 2.106.2
+      '@supabase/storage-js': 2.106.2
 
-  '@swc-node/core@1.14.1(@swc/core@1.15.33)(@swc/types@0.1.26)':
+  '@swc-node/core@1.14.1(@swc/core@1.15.40)(@swc/types@0.1.26)':
     dependencies:
-      '@swc/core': 1.15.33
+      '@swc/core': 1.15.40
       '@swc/types': 0.1.26
 
-  '@swc-node/register@1.11.1(@emnapi/core@1.10.0)(@emnapi/runtime@1.10.0)(@swc/core@1.15.33)(@swc/types@0.1.26)(typescript@6.0.3)':
+  '@swc-node/register@1.11.1(@emnapi/core@1.10.0)(@emnapi/runtime@1.10.0)(@swc/core@1.15.40)(@swc/types@0.1.26)(typescript@6.0.3)':
     dependencies:
-      '@swc-node/core': 1.14.1(@swc/core@1.15.33)(@swc/types@0.1.26)
+      '@swc-node/core': 1.14.1(@swc/core@1.15.40)(@swc/types@0.1.26)
       '@swc-node/sourcemap-support': 0.6.1
-      '@swc/core': 1.15.33
+      '@swc/core': 1.15.40
       colorette: 2.0.20
       debug: 4.4.3
       oxc-resolver: 11.19.1(@emnapi/core@1.10.0)(@emnapi/runtime@1.10.0)
@@ -8207,59 +8255,59 @@ snapshots:
       source-map-support: 0.5.21
       tslib: 2.8.1
 
-  '@swc/core-darwin-arm64@1.15.33':
+  '@swc/core-darwin-arm64@1.15.40':
     optional: true
 
-  '@swc/core-darwin-x64@1.15.33':
+  '@swc/core-darwin-x64@1.15.40':
     optional: true
 
-  '@swc/core-linux-arm-gnueabihf@1.15.33':
+  '@swc/core-linux-arm-gnueabihf@1.15.40':
     optional: true
 
-  '@swc/core-linux-arm64-gnu@1.15.33':
+  '@swc/core-linux-arm64-gnu@1.15.40':
     optional: true
 
-  '@swc/core-linux-arm64-musl@1.15.33':
+  '@swc/core-linux-arm64-musl@1.15.40':
     optional: true
 
-  '@swc/core-linux-ppc64-gnu@1.15.33':
+  '@swc/core-linux-ppc64-gnu@1.15.40':
     optional: true
 
-  '@swc/core-linux-s390x-gnu@1.15.33':
+  '@swc/core-linux-s390x-gnu@1.15.40':
     optional: true
 
-  '@swc/core-linux-x64-gnu@1.15.33':
+  '@swc/core-linux-x64-gnu@1.15.40':
     optional: true
 
-  '@swc/core-linux-x64-musl@1.15.33':
+  '@swc/core-linux-x64-musl@1.15.40':
     optional: true
 
-  '@swc/core-win32-arm64-msvc@1.15.33':
+  '@swc/core-win32-arm64-msvc@1.15.40':
     optional: true
 
-  '@swc/core-win32-ia32-msvc@1.15.33':
+  '@swc/core-win32-ia32-msvc@1.15.40':
     optional: true
 
-  '@swc/core-win32-x64-msvc@1.15.33':
+  '@swc/core-win32-x64-msvc@1.15.40':
     optional: true
 
-  '@swc/core@1.15.33':
+  '@swc/core@1.15.40':
     dependencies:
       '@swc/counter': 0.1.3
       '@swc/types': 0.1.26
     optionalDependencies:
-      '@swc/core-darwin-arm64': 1.15.33
-      '@swc/core-darwin-x64': 1.15.33
-      '@swc/core-linux-arm-gnueabihf': 1.15.33
-      '@swc/core-linux-arm64-gnu': 1.15.33
-      '@swc/core-linux-arm64-musl': 1.15.33
-      '@swc/core-linux-ppc64-gnu': 1.15.33
-      '@swc/core-linux-s390x-gnu': 1.15.33
-      '@swc/core-linux-x64-gnu': 1.15.33
-      '@swc/core-linux-x64-musl': 1.15.33
-      '@swc/core-win32-arm64-msvc': 1.15.33
-      '@swc/core-win32-ia32-msvc': 1.15.33
-      '@swc/core-win32-x64-msvc': 1.15.33
+      '@swc/core-darwin-arm64': 1.15.40
+      '@swc/core-darwin-x64': 1.15.40
+      '@swc/core-linux-arm-gnueabihf': 1.15.40
+      '@swc/core-linux-arm64-gnu': 1.15.40
+      '@swc/core-linux-arm64-musl': 1.15.40
+      '@swc/core-linux-ppc64-gnu': 1.15.40
+      '@swc/core-linux-s390x-gnu': 1.15.40
+      '@swc/core-linux-x64-gnu': 1.15.40
+      '@swc/core-linux-x64-musl': 1.15.40
+      '@swc/core-win32-arm64-msvc': 1.15.40
+      '@swc/core-win32-ia32-msvc': 1.15.40
+      '@swc/core-win32-x64-msvc': 1.15.40
 
   '@swc/counter@0.1.3': {}
 
@@ -8277,7 +8325,7 @@ snapshots:
 
   '@tsconfig/bun@1.0.10': {}
 
-  '@tybys/wasm-util@0.10.1':
+  '@tybys/wasm-util@0.10.2':
     dependencies:
       tslib: 2.8.1
     optional: true
@@ -8303,9 +8351,9 @@ snapshots:
 
   '@types/estree-jsx@1.0.5':
     dependencies:
-      '@types/estree': 1.0.8
+      '@types/estree': 1.0.9
 
-  '@types/estree@1.0.8': {}
+  '@types/estree@1.0.9': {}
 
   '@types/hast@3.0.4':
     dependencies:
@@ -8319,23 +8367,23 @@ snapshots:
 
   '@types/ms@2.1.0': {}
 
-  '@types/node@25.8.0':
+  '@types/node@25.9.1':
     dependencies:
       undici-types: 7.24.6
 
   '@types/normalize-package-data@2.4.4': {}
 
-  '@types/react-dom@19.2.3(@types/react@19.2.14)':
+  '@types/react-dom@19.2.3(@types/react@19.2.15)':
     dependencies:
-      '@types/react': 19.2.14
+      '@types/react': 19.2.15
 
-  '@types/react@19.2.14':
+  '@types/react@19.2.15':
     dependencies:
       csstype: 3.2.3
 
   '@types/responselike@1.0.0':
     dependencies:
-      '@types/node': 25.8.0
+      '@types/node': 25.9.1
 
   '@types/unist@2.0.11': {}
 
@@ -8343,74 +8391,65 @@ snapshots:
 
   '@types/ws@8.18.1':
     dependencies:
-      '@types/node': 25.8.0
+      '@types/node': 25.9.1
 
-  '@typescript/native-preview-darwin-arm64@7.0.0-dev.20260518.1':
+  '@typescript/native-preview-darwin-arm64@7.0.0-dev.20260527.2':
     optional: true
 
-  '@typescript/native-preview-darwin-x64@7.0.0-dev.20260518.1':
+  '@typescript/native-preview-darwin-x64@7.0.0-dev.20260527.2':
     optional: true
 
-  '@typescript/native-preview-linux-arm64@7.0.0-dev.20260518.1':
+  '@typescript/native-preview-linux-arm64@7.0.0-dev.20260527.2':
     optional: true
 
-  '@typescript/native-preview-linux-arm@7.0.0-dev.20260518.1':
+  '@typescript/native-preview-linux-arm@7.0.0-dev.20260527.2':
     optional: true
 
-  '@typescript/native-preview-linux-x64@7.0.0-dev.20260518.1':
+  '@typescript/native-preview-linux-x64@7.0.0-dev.20260527.2':
     optional: true
 
-  '@typescript/native-preview-win32-arm64@7.0.0-dev.20260518.1':
+  '@typescript/native-preview-win32-arm64@7.0.0-dev.20260527.2':
     optional: true
 
-  '@typescript/native-preview-win32-x64@7.0.0-dev.20260518.1':
+  '@typescript/native-preview-win32-x64@7.0.0-dev.20260527.2':
     optional: true
 
-  '@typescript/native-preview@7.0.0-dev.20260518.1':
+  '@typescript/native-preview@7.0.0-dev.20260527.2':
     optionalDependencies:
-      '@typescript/native-preview-darwin-arm64': 7.0.0-dev.20260518.1
-      '@typescript/native-preview-darwin-x64': 7.0.0-dev.20260518.1
-      '@typescript/native-preview-linux-arm': 7.0.0-dev.20260518.1
-      '@typescript/native-preview-linux-arm64': 7.0.0-dev.20260518.1
-      '@typescript/native-preview-linux-x64': 7.0.0-dev.20260518.1
-      '@typescript/native-preview-win32-arm64': 7.0.0-dev.20260518.1
-      '@typescript/native-preview-win32-x64': 7.0.0-dev.20260518.1
+      '@typescript/native-preview-darwin-arm64': 7.0.0-dev.20260527.2
+      '@typescript/native-preview-darwin-x64': 7.0.0-dev.20260527.2
+      '@typescript/native-preview-linux-arm': 7.0.0-dev.20260527.2
+      '@typescript/native-preview-linux-arm64': 7.0.0-dev.20260527.2
+      '@typescript/native-preview-linux-x64': 7.0.0-dev.20260527.2
+      '@typescript/native-preview-win32-arm64': 7.0.0-dev.20260527.2
+      '@typescript/native-preview-win32-x64': 7.0.0-dev.20260527.2
 
-  '@ungap/structured-clone@1.3.0': {}
+  '@ungap/structured-clone@1.3.1': {}
 
   '@vercel/detect-agent@1.2.3': {}
 
-  '@verdaccio/auth@8.0.1':
+  '@verdaccio/auth@8.0.2':
     dependencies:
-      '@verdaccio/config': 8.1.0
-      '@verdaccio/core': 8.1.0
-      '@verdaccio/loaders': 8.0.1
-      '@verdaccio/signature': 8.0.1
+      '@verdaccio/config': 8.1.1
+      '@verdaccio/core': 8.1.1
+      '@verdaccio/loaders': 8.0.2
+      '@verdaccio/signature': 8.0.2
       debug: 4.4.3
       lodash: 4.18.1
-      verdaccio-htpasswd: 13.0.1
+      verdaccio-htpasswd: 13.0.2
     transitivePeerDependencies:
       - supports-color
 
-  '@verdaccio/config@8.1.0':
+  '@verdaccio/config@8.1.1':
     dependencies:
-      '@verdaccio/core': 8.1.0
+      '@verdaccio/core': 8.1.1
       debug: 4.4.3
       js-yaml: 4.1.1
       lodash: 4.18.1
     transitivePeerDependencies:
       - supports-color
 
-  '@verdaccio/core@8.0.0-next-8.29':
-    dependencies:
-      ajv: 8.17.1
-      http-errors: 2.0.0
-      http-status-codes: 2.3.0
-      minimatch: 7.4.6
-      process-warning: 1.0.0
-      semver: 7.7.3
-
-  '@verdaccio/core@8.1.0':
+  '@verdaccio/core@8.1.1':
     dependencies:
       ajv: 8.18.0
       http-errors: 2.0.1
@@ -8419,37 +8458,33 @@ snapshots:
       process-warning: 1.0.0
       semver: 7.7.4
 
-  '@verdaccio/file-locking@10.3.3':
+  '@verdaccio/file-locking@13.0.1':
     dependencies:
       lockfile: 1.0.4
 
-  '@verdaccio/file-locking@13.0.0':
+  '@verdaccio/hooks@8.0.2':
     dependencies:
-      lockfile: 1.0.4
-
-  '@verdaccio/hooks@8.0.1':
-    dependencies:
-      '@verdaccio/core': 8.1.0
-      '@verdaccio/logger': 8.0.1
+      '@verdaccio/core': 8.1.1
+      '@verdaccio/logger': 8.0.2
       debug: 4.4.3
       got-cjs: 12.5.4
       handlebars: 4.7.9
     transitivePeerDependencies:
       - supports-color
 
-  '@verdaccio/loaders@8.0.1':
+  '@verdaccio/loaders@8.0.2':
     dependencies:
-      '@verdaccio/core': 8.1.0
+      '@verdaccio/core': 8.1.1
       debug: 4.4.3
       lodash: 4.18.1
     transitivePeerDependencies:
       - supports-color
 
-  '@verdaccio/local-storage-legacy@11.3.1':
+  '@verdaccio/local-storage-legacy@11.3.3':
     dependencies:
-      '@verdaccio/core': 8.0.0-next-8.29
-      '@verdaccio/file-locking': 10.3.3
-      '@verdaccio/streams': 10.2.3
+      '@verdaccio/core': 8.1.1
+      '@verdaccio/file-locking': 13.0.1
+      '@verdaccio/streams': 10.2.5
       debug: 4.4.3
       globby: 11.1.0
       lodash: 4.18.1
@@ -8459,16 +8494,16 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
-  '@verdaccio/logger-commons@8.0.1':
+  '@verdaccio/logger-commons@8.0.2':
     dependencies:
-      '@verdaccio/core': 8.1.0
-      '@verdaccio/logger-prettify': 8.0.0
+      '@verdaccio/core': 8.1.1
+      '@verdaccio/logger-prettify': 8.0.1
       colorette: 2.0.20
       debug: 4.4.3
     transitivePeerDependencies:
       - supports-color
 
-  '@verdaccio/logger-prettify@8.0.0':
+  '@verdaccio/logger-prettify@8.0.1':
     dependencies:
       colorette: 2.0.20
       dayjs: 1.11.18
@@ -8477,18 +8512,18 @@ snapshots:
       pino-abstract-transport: 1.2.0
       sonic-boom: 3.8.1
 
-  '@verdaccio/logger@8.0.1':
+  '@verdaccio/logger@8.0.2':
     dependencies:
-      '@verdaccio/logger-commons': 8.0.1
+      '@verdaccio/logger-commons': 8.0.2
       pino: 9.14.0
     transitivePeerDependencies:
       - supports-color
 
-  '@verdaccio/middleware@8.0.1':
+  '@verdaccio/middleware@8.0.2':
     dependencies:
-      '@verdaccio/config': 8.1.0
-      '@verdaccio/core': 8.1.0
-      '@verdaccio/url': 13.0.1
+      '@verdaccio/config': 8.1.1
+      '@verdaccio/core': 8.1.1
+      '@verdaccio/url': 13.0.2
       debug: 4.4.3
       express: 4.22.1
       express-rate-limit: 5.5.1
@@ -8497,31 +8532,36 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
-  '@verdaccio/package-filter@13.0.1':
+  '@verdaccio/package-filter@13.0.2':
     dependencies:
-      '@verdaccio/core': 8.1.0
+      '@verdaccio/core': 8.1.1
       debug: 4.4.3
       semver: 7.7.4
     transitivePeerDependencies:
       - supports-color
 
-  '@verdaccio/search-indexer@8.0.0': {}
+  '@verdaccio/search-indexer@8.0.2':
+    dependencies:
+      debug: 4.4.3
+      fuse.js: 7.3.0
+    transitivePeerDependencies:
+      - supports-color
 
-  '@verdaccio/signature@8.0.1':
+  '@verdaccio/signature@8.0.2':
     dependencies:
-      '@verdaccio/config': 8.1.0
-      '@verdaccio/core': 8.1.0
+      '@verdaccio/config': 8.1.1
+      '@verdaccio/core': 8.1.1
       debug: 4.4.3
       jsonwebtoken: 9.0.3
     transitivePeerDependencies:
       - supports-color
 
-  '@verdaccio/streams@10.2.3': {}
+  '@verdaccio/streams@10.2.5': {}
 
-  '@verdaccio/tarball@13.0.1':
+  '@verdaccio/tarball@13.0.2':
     dependencies:
-      '@verdaccio/core': 8.1.0
-      '@verdaccio/url': 13.0.1
+      '@verdaccio/core': 8.1.1
+      '@verdaccio/url': 13.0.2
       debug: 4.4.3
       gunzip-maybe: 1.4.2
       tar-stream: 3.1.7
@@ -8536,21 +8576,21 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
-  '@verdaccio/url@13.0.1':
+  '@verdaccio/url@13.0.2':
     dependencies:
-      '@verdaccio/core': 8.1.0
+      '@verdaccio/core': 8.1.1
       debug: 4.4.3
       validator: 13.15.26
     transitivePeerDependencies:
       - supports-color
 
-  '@verdaccio/utils@8.1.1':
+  '@verdaccio/utils@8.1.2':
     dependencies:
-      '@verdaccio/core': 8.1.0
+      '@verdaccio/core': 8.1.1
       lodash: 4.18.1
       minimatch: 7.4.9
 
-  '@vitest/coverage-istanbul@4.1.6(vitest@4.1.6)':
+  '@vitest/coverage-istanbul@4.1.7(vitest@4.1.7)':
     dependencies:
       '@babel/core': 7.29.0
       '@istanbuljs/schema': 0.1.6
@@ -8562,48 +8602,48 @@ snapshots:
       magicast: 0.5.2
       obug: 2.1.1
       tinyrainbow: 3.1.0
-      vitest: 4.1.6(@types/node@25.8.0)(@vitest/coverage-istanbul@4.1.6)(vite@8.0.2(@emnapi/core@1.10.0)(@emnapi/runtime@1.10.0)(@types/node@25.8.0)(esbuild@0.27.4)(jiti@2.7.0)(yaml@2.9.0))
+      vitest: 4.1.7(@types/node@25.9.1)(@vitest/coverage-istanbul@4.1.7)(vite@8.0.2(@emnapi/core@1.10.0)(@emnapi/runtime@1.10.0)(@types/node@25.9.1)(esbuild@0.27.4)(jiti@2.7.0)(yaml@2.9.0))
     transitivePeerDependencies:
       - supports-color
 
-  '@vitest/expect@4.1.6':
+  '@vitest/expect@4.1.7':
     dependencies:
       '@standard-schema/spec': 1.1.0
       '@types/chai': 5.2.3
-      '@vitest/spy': 4.1.6
-      '@vitest/utils': 4.1.6
+      '@vitest/spy': 4.1.7
+      '@vitest/utils': 4.1.7
       chai: 6.2.2
       tinyrainbow: 3.1.0
 
-  '@vitest/mocker@4.1.6(vite@8.0.2(@emnapi/core@1.10.0)(@emnapi/runtime@1.10.0)(@types/node@25.8.0)(esbuild@0.27.4)(jiti@2.7.0)(yaml@2.9.0))':
+  '@vitest/mocker@4.1.7(vite@8.0.2(@emnapi/core@1.10.0)(@emnapi/runtime@1.10.0)(@types/node@25.9.1)(esbuild@0.27.4)(jiti@2.7.0)(yaml@2.9.0))':
     dependencies:
-      '@vitest/spy': 4.1.6
+      '@vitest/spy': 4.1.7
       estree-walker: 3.0.3
       magic-string: 0.30.21
     optionalDependencies:
-      vite: 8.0.2(@emnapi/core@1.10.0)(@emnapi/runtime@1.10.0)(@types/node@25.8.0)(esbuild@0.27.4)(jiti@2.7.0)(yaml@2.9.0)
+      vite: 8.0.2(@emnapi/core@1.10.0)(@emnapi/runtime@1.10.0)(@types/node@25.9.1)(esbuild@0.27.4)(jiti@2.7.0)(yaml@2.9.0)
 
-  '@vitest/pretty-format@4.1.6':
+  '@vitest/pretty-format@4.1.7':
     dependencies:
       tinyrainbow: 3.1.0
 
-  '@vitest/runner@4.1.6':
+  '@vitest/runner@4.1.7':
     dependencies:
-      '@vitest/utils': 4.1.6
+      '@vitest/utils': 4.1.7
       pathe: 2.0.3
 
-  '@vitest/snapshot@4.1.6':
+  '@vitest/snapshot@4.1.7':
     dependencies:
-      '@vitest/pretty-format': 4.1.6
-      '@vitest/utils': 4.1.6
+      '@vitest/pretty-format': 4.1.7
+      '@vitest/utils': 4.1.7
       magic-string: 0.30.21
       pathe: 2.0.3
 
-  '@vitest/spy@4.1.6': {}
+  '@vitest/spy@4.1.7': {}
 
-  '@vitest/utils@4.1.6':
+  '@vitest/utils@4.1.7':
     dependencies:
-      '@vitest/pretty-format': 4.1.6
+      '@vitest/pretty-format': 4.1.7
       convert-source-map: 2.0.0
       tinyrainbow: 3.1.0
 
@@ -8639,24 +8679,17 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
-  agent-base@7.1.4: {}
+  agent-base@9.0.0: {}
 
   aggregate-error@5.0.0:
     dependencies:
       clean-stack: 5.3.0
       indent-string: 5.0.0
 
-  ajv@8.17.1:
-    dependencies:
-      fast-deep-equal: 3.1.3
-      fast-uri: 3.1.0
-      json-schema-traverse: 1.0.0
-      require-from-string: 2.0.2
-
   ajv@8.18.0:
     dependencies:
       fast-deep-equal: 3.1.3
-      fast-uri: 3.1.0
+      fast-uri: 3.1.2
       json-schema-traverse: 1.0.0
       require-from-string: 2.0.2
 
@@ -8728,7 +8761,7 @@ snapshots:
     transitivePeerDependencies:
       - debug
 
-  b4a@1.8.0: {}
+  b4a@1.8.1: {}
 
   bail@2.0.2: {}
 
@@ -8736,9 +8769,7 @@ snapshots:
 
   balanced-match@4.0.3: {}
 
-  balanced-match@4.0.4: {}
-
-  bare-events@2.8.2: {}
+  bare-events@2.8.3: {}
 
   base64-js@1.5.1: {}
 
@@ -8758,7 +8789,7 @@ snapshots:
       inherits: 2.0.4
       readable-stream: 3.6.2
 
-  body-parser@1.20.4:
+  body-parser@1.20.5:
     dependencies:
       bytes: 3.1.2
       content-type: 1.0.5
@@ -8768,7 +8799,7 @@ snapshots:
       http-errors: 2.0.1
       iconv-lite: 0.4.24
       on-finished: 2.4.1
-      qs: 6.14.2
+      qs: 6.15.2
       raw-body: 2.5.3
       type-is: 1.6.18
       unpipe: 1.0.0
@@ -8777,13 +8808,13 @@ snapshots:
 
   bottleneck@2.19.5: {}
 
-  brace-expansion@2.1.0:
+  brace-expansion@2.1.1:
     dependencies:
       balanced-match: 1.0.2
 
-  brace-expansion@5.0.5:
+  brace-expansion@5.0.6:
     dependencies:
-      balanced-match: 4.0.4
+      balanced-match: 4.0.3
 
   braces@3.0.3:
     dependencies:
@@ -8817,7 +8848,7 @@ snapshots:
 
   bun-types@1.3.14:
     dependencies:
-      '@types/node': 25.8.0
+      '@types/node': 25.9.1
 
   bytes@3.1.2: {}
 
@@ -8920,7 +8951,7 @@ snapshots:
   cli-truncate@6.0.0:
     dependencies:
       slice-ansi: 9.0.0
-      string-width: 8.2.0
+      string-width: 8.2.1
 
   client-only@0.0.1: {}
 
@@ -8940,6 +8971,12 @@ snapshots:
       strip-ansi: 6.0.1
       wrap-ansi: 7.0.0
 
+  cliui@9.0.1:
+    dependencies:
+      string-width: 7.2.0
+      strip-ansi: 7.2.0
+      wrap-ansi: 9.0.2
+
   clone-response@1.0.3:
     dependencies:
       mimic-response: 1.0.1
@@ -9022,7 +9059,7 @@ snapshots:
       conventional-commits-filter: 5.0.0
       handlebars: 4.7.9
       meow: 13.2.0
-      semver: 7.8.0
+      semver: 7.8.1
 
   conventional-commits-filter@5.0.0: {}
 
@@ -9137,6 +9174,8 @@ snapshots:
 
   dotenv@16.4.7: {}
 
+  dotenv@17.4.2: {}
+
   dunder-proto@1.0.1:
     dependencies:
       call-bind-apply-helpers: 1.0.2
@@ -9165,7 +9204,7 @@ snapshots:
 
   ee-first@1.1.1: {}
 
-  effect@4.0.0-beta.67:
+  effect@4.0.0-beta.74:
     dependencies:
       '@standard-schema/spec': 1.1.0
       fast-check: 4.8.0
@@ -9182,6 +9221,8 @@ snapshots:
 
   electron-to-chromium@1.5.343: {}
 
+  emoji-regex@10.6.0: {}
+
   emoji-regex@8.0.0: {}
 
   emojilib@2.4.0: {}
@@ -9228,9 +9269,9 @@ snapshots:
       es-errors: 1.3.0
       get-intrinsic: 1.3.0
       has-tostringtag: 1.0.2
-      hasown: 2.0.3
+      hasown: 2.0.2
 
-  es-toolkit@1.46.0: {}
+  es-toolkit@1.47.0: {}
 
   esast-util-from-estree@2.0.0:
     dependencies:
@@ -9317,7 +9358,7 @@ snapshots:
 
   estree-util-attach-comments@3.0.0:
     dependencies:
-      '@types/estree': 1.0.8
+      '@types/estree': 1.0.9
 
   estree-util-build-jsx@3.0.1:
     dependencies:
@@ -9330,7 +9371,7 @@ snapshots:
 
   estree-util-scope@1.0.0:
     dependencies:
-      '@types/estree': 1.0.8
+      '@types/estree': 1.0.9
       devlop: 1.1.0
 
   estree-util-to-js@2.0.0:
@@ -9341,7 +9382,7 @@ snapshots:
 
   estree-util-value-to-estree@3.5.0:
     dependencies:
-      '@types/estree': 1.0.8
+      '@types/estree': 1.0.9
 
   estree-util-visit@2.0.0:
     dependencies:
@@ -9350,7 +9391,7 @@ snapshots:
 
   estree-walker@3.0.3:
     dependencies:
-      '@types/estree': 1.0.8
+      '@types/estree': 1.0.9
 
   etag@1.8.1: {}
 
@@ -9358,7 +9399,7 @@ snapshots:
 
   events-universal@1.0.1:
     dependencies:
-      bare-events: 2.8.2
+      bare-events: 2.8.3
     transitivePeerDependencies:
       - bare-abort-controller
 
@@ -9399,7 +9440,7 @@ snapshots:
     dependencies:
       accepts: 1.3.8
       array-flatten: 1.1.1
-      body-parser: 1.20.4
+      body-parser: 1.20.5
       content-disposition: 0.5.4
       content-type: 1.0.5
       cookie: 0.7.2
@@ -9439,8 +9480,6 @@ snapshots:
     dependencies:
       pure-rand: 8.3.0
 
-  fast-content-type-parse@3.0.0: {}
-
   fast-deep-equal@3.1.3: {}
 
   fast-fifo@1.3.2: {}
@@ -9459,7 +9498,7 @@ snapshots:
     dependencies:
       fast-string-truncated-width: 3.0.3
 
-  fast-uri@3.1.0: {}
+  fast-uri@3.1.2: {}
 
   fast-wrap-ansi@0.2.0:
     dependencies:
@@ -9531,7 +9570,7 @@ snapshots:
       asynckit: 0.4.0
       combined-stream: 1.0.8
       es-set-tostringtag: 2.1.0
-      hasown: 2.0.3
+      hasown: 2.0.2
       mime-types: 2.1.35
 
   formatly@0.3.0:
@@ -9540,10 +9579,10 @@ snapshots:
 
   forwarded@0.2.0: {}
 
-  framer-motion@12.38.0(react-dom@19.2.6(react@19.2.6))(react@19.2.6):
+  framer-motion@12.40.0(react-dom@19.2.6(react@19.2.6))(react@19.2.6):
     dependencies:
-      motion-dom: 12.38.0
-      motion-utils: 12.36.0
+      motion-dom: 12.40.0
+      motion-utils: 12.39.0
       tslib: 2.8.1
     optionalDependencies:
       react: 19.2.6
@@ -9562,7 +9601,7 @@ snapshots:
   fsevents@2.3.3:
     optional: true
 
-  fumadocs-core@16.8.11(@mdx-js/mdx@3.1.1)(@types/estree-jsx@1.0.5)(@types/hast@3.0.4)(@types/mdast@4.0.4)(@types/react@19.2.14)(lucide-react@1.16.0(react@19.2.6))(next@16.2.6(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)(zod@4.4.3):
+  fumadocs-core@16.9.1(@mdx-js/mdx@3.1.1)(@types/estree-jsx@1.0.5)(@types/hast@3.0.4)(@types/mdast@4.0.4)(@types/react@19.2.15)(lucide-react@1.16.0(react@19.2.6))(next@16.2.6(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)(zod@4.4.3):
     dependencies:
       '@orama/orama': 3.1.18
       estree-util-value-to-estree: 3.5.0
@@ -9576,7 +9615,7 @@ snapshots:
       remark-gfm: 4.0.1
       remark-rehype: 11.1.2
       scroll-into-view-if-needed: 3.1.0
-      shiki: 4.0.2
+      shiki: 4.1.0
       tinyglobby: 0.2.16
       unified: 11.0.5
       unist-util-visit: 5.1.0
@@ -9586,7 +9625,7 @@ snapshots:
       '@types/estree-jsx': 1.0.5
       '@types/hast': 3.0.4
       '@types/mdast': 4.0.4
-      '@types/react': 19.2.14
+      '@types/react': 19.2.15
       lucide-react: 1.16.0(react@19.2.6)
       next: 16.2.6(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
       react: 19.2.6
@@ -9595,19 +9634,19 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
-  fumadocs-mdx@15.0.6(@types/mdast@4.0.4)(@types/mdx@2.0.13)(@types/react@19.2.14)(fumadocs-core@16.8.11(@mdx-js/mdx@3.1.1)(@types/estree-jsx@1.0.5)(@types/hast@3.0.4)(@types/mdast@4.0.4)(@types/react@19.2.14)(lucide-react@1.16.0(react@19.2.6))(next@16.2.6(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)(zod@4.4.3))(next@16.2.6(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react@19.2.6)(vite@8.0.2(@emnapi/core@1.10.0)(@emnapi/runtime@1.10.0)(@types/node@25.8.0)(esbuild@0.27.4)(jiti@2.7.0)(yaml@2.9.0)):
+  fumadocs-mdx@15.0.9(@types/mdast@4.0.4)(@types/mdx@2.0.13)(@types/react@19.2.15)(fumadocs-core@16.9.1(@mdx-js/mdx@3.1.1)(@types/estree-jsx@1.0.5)(@types/hast@3.0.4)(@types/mdast@4.0.4)(@types/react@19.2.15)(lucide-react@1.16.0(react@19.2.6))(next@16.2.6(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)(zod@4.4.3))(next@16.2.6(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react@19.2.6)(vite@8.0.2(@emnapi/core@1.10.0)(@emnapi/runtime@1.10.0)(@types/node@25.9.1)(esbuild@0.27.4)(jiti@2.7.0)(yaml@2.9.0)):
     dependencies:
       '@mdx-js/mdx': 3.1.1
       '@standard-schema/spec': 1.1.0
       chokidar: 5.0.0
       esbuild: 0.28.0
       estree-util-value-to-estree: 3.5.0
-      fumadocs-core: 16.8.11(@mdx-js/mdx@3.1.1)(@types/estree-jsx@1.0.5)(@types/hast@3.0.4)(@types/mdast@4.0.4)(@types/react@19.2.14)(lucide-react@1.16.0(react@19.2.6))(next@16.2.6(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)(zod@4.4.3)
+      fumadocs-core: 16.9.1(@mdx-js/mdx@3.1.1)(@types/estree-jsx@1.0.5)(@types/hast@3.0.4)(@types/mdast@4.0.4)(@types/react@19.2.15)(lucide-react@1.16.0(react@19.2.6))(next@16.2.6(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)(zod@4.4.3)
       js-yaml: 4.1.1
       mdast-util-mdx: 3.0.0
       picocolors: 1.1.1
       picomatch: 4.0.4
-      tinyexec: 1.1.2
+      tinyexec: 1.2.2
       tinyglobby: 0.2.16
       unified: 11.0.5
       unist-util-remove-position: 5.0.0
@@ -9617,42 +9656,42 @@ snapshots:
     optionalDependencies:
       '@types/mdast': 4.0.4
       '@types/mdx': 2.0.13
-      '@types/react': 19.2.14
+      '@types/react': 19.2.15
       next: 16.2.6(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
       react: 19.2.6
-      vite: 8.0.2(@emnapi/core@1.10.0)(@emnapi/runtime@1.10.0)(@types/node@25.8.0)(esbuild@0.27.4)(jiti@2.7.0)(yaml@2.9.0)
+      vite: 8.0.2(@emnapi/core@1.10.0)(@emnapi/runtime@1.10.0)(@types/node@25.9.1)(esbuild@0.27.4)(jiti@2.7.0)(yaml@2.9.0)
     transitivePeerDependencies:
       - supports-color
 
-  fumadocs-ui@16.8.11(@types/mdx@2.0.13)(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(fumadocs-core@16.8.11(@mdx-js/mdx@3.1.1)(@types/estree-jsx@1.0.5)(@types/hast@3.0.4)(@types/mdast@4.0.4)(@types/react@19.2.14)(lucide-react@1.16.0(react@19.2.6))(next@16.2.6(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)(zod@4.4.3))(next@16.2.6(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6):
+  fumadocs-ui@16.9.1(@types/mdx@2.0.13)(@types/react-dom@19.2.3(@types/react@19.2.15))(@types/react@19.2.15)(fumadocs-core@16.9.1(@mdx-js/mdx@3.1.1)(@types/estree-jsx@1.0.5)(@types/hast@3.0.4)(@types/mdast@4.0.4)(@types/react@19.2.15)(lucide-react@1.16.0(react@19.2.6))(next@16.2.6(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)(zod@4.4.3))(next@16.2.6(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6):
     dependencies:
       '@fumadocs/tailwind': 0.0.5
-      '@radix-ui/react-accordion': 1.2.12(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@radix-ui/react-collapsible': 1.1.12(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@radix-ui/react-dialog': 1.1.15(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@radix-ui/react-direction': 1.1.1(@types/react@19.2.14)(react@19.2.6)
-      '@radix-ui/react-navigation-menu': 1.2.14(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@radix-ui/react-popover': 1.1.15(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@radix-ui/react-presence': 1.1.5(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@radix-ui/react-scroll-area': 1.2.10(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@radix-ui/react-slot': 1.2.4(@types/react@19.2.14)(react@19.2.6)
-      '@radix-ui/react-tabs': 1.1.13(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+      '@radix-ui/react-accordion': 1.2.12(@types/react-dom@19.2.3(@types/react@19.2.15))(@types/react@19.2.15)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+      '@radix-ui/react-collapsible': 1.1.12(@types/react-dom@19.2.3(@types/react@19.2.15))(@types/react@19.2.15)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+      '@radix-ui/react-dialog': 1.1.15(@types/react-dom@19.2.3(@types/react@19.2.15))(@types/react@19.2.15)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+      '@radix-ui/react-direction': 1.1.1(@types/react@19.2.15)(react@19.2.6)
+      '@radix-ui/react-navigation-menu': 1.2.14(@types/react-dom@19.2.3(@types/react@19.2.15))(@types/react@19.2.15)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+      '@radix-ui/react-popover': 1.1.15(@types/react-dom@19.2.3(@types/react@19.2.15))(@types/react@19.2.15)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+      '@radix-ui/react-presence': 1.1.5(@types/react-dom@19.2.3(@types/react@19.2.15))(@types/react@19.2.15)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+      '@radix-ui/react-scroll-area': 1.2.10(@types/react-dom@19.2.3(@types/react@19.2.15))(@types/react@19.2.15)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+      '@radix-ui/react-slot': 1.2.4(@types/react@19.2.15)(react@19.2.6)
+      '@radix-ui/react-tabs': 1.1.13(@types/react-dom@19.2.3(@types/react@19.2.15))(@types/react@19.2.15)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
       class-variance-authority: 0.7.1
-      fumadocs-core: 16.8.11(@mdx-js/mdx@3.1.1)(@types/estree-jsx@1.0.5)(@types/hast@3.0.4)(@types/mdast@4.0.4)(@types/react@19.2.14)(lucide-react@1.16.0(react@19.2.6))(next@16.2.6(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)(zod@4.4.3)
+      fumadocs-core: 16.9.1(@mdx-js/mdx@3.1.1)(@types/estree-jsx@1.0.5)(@types/hast@3.0.4)(@types/mdast@4.0.4)(@types/react@19.2.15)(lucide-react@1.16.0(react@19.2.6))(next@16.2.6(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)(zod@4.4.3)
       lucide-react: 1.16.0(react@19.2.6)
-      motion: 12.38.0(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+      motion: 12.40.0(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
       next-themes: 0.4.6(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
       react: 19.2.6
       react-dom: 19.2.6(react@19.2.6)
-      react-remove-scroll: 2.7.2(@types/react@19.2.14)(react@19.2.6)
+      react-remove-scroll: 2.7.2(@types/react@19.2.15)(react@19.2.6)
       rehype-raw: 7.0.0
       scroll-into-view-if-needed: 3.1.0
-      shiki: 4.0.2
+      shiki: 4.1.0
       tailwind-merge: 3.6.0
       unist-util-visit: 5.1.0
     optionalDependencies:
       '@types/mdx': 2.0.13
-      '@types/react': 19.2.14
+      '@types/react': 19.2.15
       next: 16.2.6(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
     transitivePeerDependencies:
       - '@emotion/is-prop-valid'
@@ -9664,11 +9703,13 @@ snapshots:
 
   function-timeout@1.0.2: {}
 
+  fuse.js@7.3.0: {}
+
   gensync@1.0.0-beta.2: {}
 
   get-caller-file@2.0.5: {}
 
-  get-east-asian-width@1.5.0: {}
+  get-east-asian-width@1.6.0: {}
 
   get-intrinsic@1.3.0:
     dependencies:
@@ -9680,7 +9721,7 @@ snapshots:
       get-proto: 1.0.1
       gopd: 1.2.0
       has-symbols: 1.1.0
-      hasown: 2.0.3
+      hasown: 2.0.2
       math-intrinsics: 1.1.0
 
   get-nonce@1.0.1: {}
@@ -9788,10 +9829,6 @@ snapshots:
     dependencies:
       function-bind: 1.1.2
 
-  hasown@2.0.3:
-    dependencies:
-      function-bind: 1.1.2
-
   hast-util-from-parse5@8.0.3:
     dependencies:
       '@types/hast': 3.0.4
@@ -9811,7 +9848,7 @@ snapshots:
     dependencies:
       '@types/hast': 3.0.4
       '@types/unist': 3.0.3
-      '@ungap/structured-clone': 1.3.0
+      '@ungap/structured-clone': 1.3.1
       hast-util-from-parse5: 8.0.3
       hast-util-to-parse5: 8.0.1
       html-void-elements: 3.0.0
@@ -9825,7 +9862,7 @@ snapshots:
 
   hast-util-to-estree@3.1.3:
     dependencies:
-      '@types/estree': 1.0.8
+      '@types/estree': 1.0.9
       '@types/estree-jsx': 1.0.5
       '@types/hast': 3.0.4
       comma-separated-tokens: 2.0.3
@@ -9860,7 +9897,7 @@ snapshots:
 
   hast-util-to-jsx-runtime@2.3.6:
     dependencies:
-      '@types/estree': 1.0.8
+      '@types/estree': 1.0.9
       '@types/hast': 3.0.4
       '@types/unist': 3.0.3
       comma-separated-tokens: 2.0.3
@@ -9908,9 +9945,9 @@ snapshots:
     dependencies:
       lru-cache: 10.4.3
 
-  hosted-git-info@8.1.0:
+  hosted-git-info@9.0.3:
     dependencies:
-      lru-cache: 10.4.3
+      lru-cache: 11.5.0
 
   html-escaper@2.0.2: {}
 
@@ -9918,14 +9955,6 @@ snapshots:
 
   http-cache-semantics@4.2.0: {}
 
-  http-errors@2.0.0:
-    dependencies:
-      depd: 2.0.0
-      inherits: 2.0.4
-      setprototypeof: 1.2.0
-      statuses: 2.0.1
-      toidentifier: 1.0.1
-
   http-errors@2.0.1:
     dependencies:
       depd: 2.0.0
@@ -9934,9 +9963,9 @@ snapshots:
       statuses: 2.0.2
       toidentifier: 1.0.1
 
-  http-proxy-agent@7.0.2:
+  http-proxy-agent@9.0.0:
     dependencies:
-      agent-base: 7.1.4
+      agent-base: 9.0.0
       debug: 4.4.3
     transitivePeerDependencies:
       - supports-color
@@ -9961,9 +9990,9 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
-  https-proxy-agent@7.0.6:
+  https-proxy-agent@9.0.0:
     dependencies:
-      agent-base: 7.1.4
+      agent-base: 9.0.0
       debug: 4.4.3
     transitivePeerDependencies:
       - supports-color
@@ -10008,13 +10037,13 @@ snapshots:
 
   ini@7.0.0: {}
 
-  ink-spinner@5.0.0(ink@7.0.3(@types/react@19.2.14)(react-devtools-core@7.0.1)(react@19.2.6))(react@19.2.6):
+  ink-spinner@5.0.0(ink@7.0.4(@types/react@19.2.15)(react-devtools-core@7.0.1)(react@19.2.6))(react@19.2.6):
     dependencies:
       cli-spinners: 2.9.2
-      ink: 7.0.3(@types/react@19.2.14)(react-devtools-core@7.0.1)(react@19.2.6)
+      ink: 7.0.4(@types/react@19.2.15)(react-devtools-core@7.0.1)(react@19.2.6)
       react: 19.2.6
 
-  ink@7.0.3(@types/react@19.2.14)(react-devtools-core@7.0.1)(react@19.2.6):
+  ink@7.0.4(@types/react@19.2.15)(react-devtools-core@7.0.1)(react@19.2.6):
     dependencies:
       '@alcalzone/ansi-tokenize': 0.3.0
       ansi-escapes: 7.3.0
@@ -10025,7 +10054,7 @@ snapshots:
       cli-cursor: 4.0.0
       cli-truncate: 6.0.0
       code-excerpt: 4.0.0
-      es-toolkit: 1.46.0
+      es-toolkit: 1.47.0
       indent-string: 5.0.0
       is-in-ci: 2.0.0
       patch-console: 2.0.0
@@ -10035,15 +10064,15 @@ snapshots:
       signal-exit: 3.0.7
       slice-ansi: 9.0.0
       stack-utils: 2.0.6
-      string-width: 8.2.0
+      string-width: 8.2.1
       terminal-size: 4.0.1
       type-fest: 5.6.0
       widest-line: 6.0.0
       wrap-ansi: 10.0.0
-      ws: 8.20.0
+      ws: 8.21.0
       yoga-layout: 3.2.1
     optionalDependencies:
-      '@types/react': 19.2.14
+      '@types/react': 19.2.15
       react-devtools-core: 7.0.1
     transitivePeerDependencies:
       - bufferutil
@@ -10088,7 +10117,7 @@ snapshots:
 
   is-fullwidth-code-point@5.1.0:
     dependencies:
-      get-east-asian-width: 1.5.0
+      get-east-asian-width: 1.6.0
 
   is-glob@4.0.3:
     dependencies:
@@ -10226,7 +10255,7 @@ snapshots:
     dependencies:
       json-buffer: 3.0.1
 
-  knip@6.14.1(@emnapi/core@1.10.0)(@emnapi/runtime@1.10.0):
+  knip@6.14.2(@emnapi/core@1.10.0)(@emnapi/runtime@1.10.0):
     dependencies:
       fdir: 6.5.0(picomatch@4.0.4)
       formatly: 0.3.0
@@ -10241,7 +10270,7 @@ snapshots:
       tinyglobby: 0.2.16
       unbash: 3.0.0
       yaml: 2.9.0
-      zod: 4.3.6
+      zod: 4.4.3
     transitivePeerDependencies:
       - '@emnapi/core'
       - '@emnapi/runtime'
@@ -10364,6 +10393,8 @@ snapshots:
 
   lru-cache@10.4.3: {}
 
+  lru-cache@11.5.0: {}
+
   lru-cache@5.1.1:
     dependencies:
       yallist: 3.1.1
@@ -10392,7 +10423,7 @@ snapshots:
 
   make-dir@4.0.0:
     dependencies:
-      semver: 7.8.0
+      semver: 7.8.1
 
   markdown-extensions@2.0.0: {}
 
@@ -10552,7 +10583,7 @@ snapshots:
     dependencies:
       '@types/hast': 3.0.4
       '@types/mdast': 4.0.4
-      '@ungap/structured-clone': 1.3.0
+      '@ungap/structured-clone': 1.3.1
       devlop: 1.1.0
       micromark-util-sanitize-uri: 2.0.1
       trim-lines: 3.0.1
@@ -10667,7 +10698,7 @@ snapshots:
 
   micromark-extension-mdx-expression@3.0.1:
     dependencies:
-      '@types/estree': 1.0.8
+      '@types/estree': 1.0.9
       devlop: 1.1.0
       micromark-factory-mdx-expression: 2.0.3
       micromark-factory-space: 2.0.1
@@ -10678,7 +10709,7 @@ snapshots:
 
   micromark-extension-mdx-jsx@3.0.2:
     dependencies:
-      '@types/estree': 1.0.8
+      '@types/estree': 1.0.9
       devlop: 1.1.0
       estree-util-is-identifier-name: 3.0.0
       micromark-factory-mdx-expression: 2.0.3
@@ -10695,7 +10726,7 @@ snapshots:
 
   micromark-extension-mdxjs-esm@3.0.0:
     dependencies:
-      '@types/estree': 1.0.8
+      '@types/estree': 1.0.9
       devlop: 1.1.0
       micromark-core-commonmark: 2.0.3
       micromark-util-character: 2.1.1
@@ -10731,7 +10762,7 @@ snapshots:
 
   micromark-factory-mdx-expression@2.0.3:
     dependencies:
-      '@types/estree': 1.0.8
+      '@types/estree': 1.0.9
       devlop: 1.1.0
       micromark-factory-space: 2.0.1
       micromark-util-character: 2.1.1
@@ -10795,7 +10826,7 @@ snapshots:
 
   micromark-util-events-to-acorn@2.0.3:
     dependencies:
-      '@types/estree': 1.0.8
+      '@types/estree': 1.0.9
       '@types/unist': 3.0.3
       devlop: 1.1.0
       estree-util-visit: 2.0.0
@@ -10881,29 +10912,25 @@ snapshots:
 
   minimatch@10.2.5:
     dependencies:
-      brace-expansion: 5.0.5
-
-  minimatch@7.4.6:
-    dependencies:
-      brace-expansion: 2.1.0
+      brace-expansion: 5.0.6
 
   minimatch@7.4.9:
     dependencies:
-      brace-expansion: 2.1.0
+      brace-expansion: 2.1.1
 
   minimist@1.2.8: {}
 
   mkdirp@1.0.4: {}
 
-  motion-dom@12.38.0:
+  motion-dom@12.40.0:
     dependencies:
-      motion-utils: 12.36.0
+      motion-utils: 12.39.0
 
-  motion-utils@12.36.0: {}
+  motion-utils@12.39.0: {}
 
-  motion@12.38.0(react-dom@19.2.6(react@19.2.6))(react@19.2.6):
+  motion@12.40.0(react-dom@19.2.6(react@19.2.6))(react@19.2.6):
     dependencies:
-      framer-motion: 12.38.0(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+      framer-motion: 12.40.0(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
       tslib: 2.8.1
     optionalDependencies:
       react: 19.2.6
@@ -11001,12 +11028,18 @@ snapshots:
   normalize-package-data@6.0.2:
     dependencies:
       hosted-git-info: 7.0.2
-      semver: 7.8.0
+      semver: 7.8.1
+      validate-npm-package-license: 3.0.4
+
+  normalize-package-data@8.0.0:
+    dependencies:
+      hosted-git-info: 9.0.3
+      semver: 7.8.1
       validate-npm-package-license: 3.0.4
 
   normalize-url@6.1.0: {}
 
-  normalize-url@8.1.1: {}
+  normalize-url@9.0.1: {}
 
   npm-run-path@4.0.1:
     dependencies:
@@ -11021,9 +11054,9 @@ snapshots:
       path-key: 4.0.0
       unicorn-magic: 0.3.0
 
-  npm@10.9.8: {}
+  npm@11.15.0: {}
 
-  nx@22.7.2(@swc-node/register@1.11.1(@emnapi/core@1.10.0)(@emnapi/runtime@1.10.0)(@swc/core@1.15.33)(@swc/types@0.1.26)(typescript@6.0.3))(@swc/core@1.15.33):
+  nx@22.7.5(@swc-node/register@1.11.1(@emnapi/core@1.10.0)(@emnapi/runtime@1.10.0)(@swc/core@1.15.40)(@swc/types@0.1.26)(typescript@6.0.3))(@swc/core@1.15.40):
     dependencies:
       '@emnapi/core': 1.4.5
       '@emnapi/runtime': 1.4.5
@@ -11042,7 +11075,7 @@ snapshots:
       balanced-match: 4.0.3
       base64-js: 1.5.1
       bl: 4.1.0
-      brace-expansion: 5.0.5
+      brace-expansion: 5.0.6
       buffer: 5.7.1
       call-bind-apply-helpers: 1.0.2
       chalk: 4.1.2
@@ -11123,7 +11156,7 @@ snapshots:
       strip-bom: 3.0.0
       supports-color: 7.2.0
       tar-stream: 2.2.0
-      tmp: 0.2.4
+      tmp: 0.2.6
       tree-kill: 1.2.2
       tsconfig-paths: 4.2.0
       tslib: 2.8.1
@@ -11132,22 +11165,22 @@ snapshots:
       wrap-ansi: 7.0.0
       wrappy: 1.0.2
       y18n: 5.0.8
-      yaml: 2.8.0
+      yaml: 2.9.0
       yargs: 17.7.2
       yargs-parser: 21.1.1
     optionalDependencies:
-      '@nx/nx-darwin-arm64': 22.7.2
-      '@nx/nx-darwin-x64': 22.7.2
-      '@nx/nx-freebsd-x64': 22.7.2
-      '@nx/nx-linux-arm-gnueabihf': 22.7.2
-      '@nx/nx-linux-arm64-gnu': 22.7.2
-      '@nx/nx-linux-arm64-musl': 22.7.2
-      '@nx/nx-linux-x64-gnu': 22.7.2
-      '@nx/nx-linux-x64-musl': 22.7.2
-      '@nx/nx-win32-arm64-msvc': 22.7.2
-      '@nx/nx-win32-x64-msvc': 22.7.2
-      '@swc-node/register': 1.11.1(@emnapi/core@1.10.0)(@emnapi/runtime@1.10.0)(@swc/core@1.15.33)(@swc/types@0.1.26)(typescript@6.0.3)
-      '@swc/core': 1.15.33
+      '@nx/nx-darwin-arm64': 22.7.5
+      '@nx/nx-darwin-x64': 22.7.5
+      '@nx/nx-freebsd-x64': 22.7.5
+      '@nx/nx-linux-arm-gnueabihf': 22.7.5
+      '@nx/nx-linux-arm64-gnu': 22.7.5
+      '@nx/nx-linux-arm64-musl': 22.7.5
+      '@nx/nx-linux-x64-gnu': 22.7.5
+      '@nx/nx-linux-x64-musl': 22.7.5
+      '@nx/nx-win32-arm64-msvc': 22.7.5
+      '@nx/nx-win32-x64-msvc': 22.7.5
+      '@swc-node/register': 1.11.1(@emnapi/core@1.10.0)(@emnapi/runtime@1.10.0)(@swc/core@1.15.40)(@swc/types@0.1.26)(typescript@6.0.3)
+      '@swc/core': 1.15.40
     transitivePeerDependencies:
       - debug
 
@@ -11196,7 +11229,7 @@ snapshots:
       bl: 4.1.0
       chalk: 4.1.2
       cli-cursor: 3.1.0
-      cli-spinners: 2.9.2
+      cli-spinners: 2.6.1
       is-interactive: 1.0.0
       log-symbols: 4.1.0
       strip-ansi: 6.0.1
@@ -11253,29 +11286,29 @@ snapshots:
       - '@emnapi/core'
       - '@emnapi/runtime'
 
-  oxfmt@0.50.0:
+  oxfmt@0.52.0:
     dependencies:
       tinypool: 2.1.0
     optionalDependencies:
-      '@oxfmt/binding-android-arm-eabi': 0.50.0
-      '@oxfmt/binding-android-arm64': 0.50.0
-      '@oxfmt/binding-darwin-arm64': 0.50.0
-      '@oxfmt/binding-darwin-x64': 0.50.0
-      '@oxfmt/binding-freebsd-x64': 0.50.0
-      '@oxfmt/binding-linux-arm-gnueabihf': 0.50.0
-      '@oxfmt/binding-linux-arm-musleabihf': 0.50.0
-      '@oxfmt/binding-linux-arm64-gnu': 0.50.0
-      '@oxfmt/binding-linux-arm64-musl': 0.50.0
-      '@oxfmt/binding-linux-ppc64-gnu': 0.50.0
-      '@oxfmt/binding-linux-riscv64-gnu': 0.50.0
-      '@oxfmt/binding-linux-riscv64-musl': 0.50.0
-      '@oxfmt/binding-linux-s390x-gnu': 0.50.0
-      '@oxfmt/binding-linux-x64-gnu': 0.50.0
-      '@oxfmt/binding-linux-x64-musl': 0.50.0
-      '@oxfmt/binding-openharmony-arm64': 0.50.0
-      '@oxfmt/binding-win32-arm64-msvc': 0.50.0
-      '@oxfmt/binding-win32-ia32-msvc': 0.50.0
-      '@oxfmt/binding-win32-x64-msvc': 0.50.0
+      '@oxfmt/binding-android-arm-eabi': 0.52.0
+      '@oxfmt/binding-android-arm64': 0.52.0
+      '@oxfmt/binding-darwin-arm64': 0.52.0
+      '@oxfmt/binding-darwin-x64': 0.52.0
+      '@oxfmt/binding-freebsd-x64': 0.52.0
+      '@oxfmt/binding-linux-arm-gnueabihf': 0.52.0
+      '@oxfmt/binding-linux-arm-musleabihf': 0.52.0
+      '@oxfmt/binding-linux-arm64-gnu': 0.52.0
+      '@oxfmt/binding-linux-arm64-musl': 0.52.0
+      '@oxfmt/binding-linux-ppc64-gnu': 0.52.0
+      '@oxfmt/binding-linux-riscv64-gnu': 0.52.0
+      '@oxfmt/binding-linux-riscv64-musl': 0.52.0
+      '@oxfmt/binding-linux-s390x-gnu': 0.52.0
+      '@oxfmt/binding-linux-x64-gnu': 0.52.0
+      '@oxfmt/binding-linux-x64-musl': 0.52.0
+      '@oxfmt/binding-openharmony-arm64': 0.52.0
+      '@oxfmt/binding-win32-arm64-msvc': 0.52.0
+      '@oxfmt/binding-win32-ia32-msvc': 0.52.0
+      '@oxfmt/binding-win32-x64-msvc': 0.52.0
 
   oxlint-tsgolint@0.23.0:
     optionalDependencies:
@@ -11286,27 +11319,27 @@ snapshots:
       '@oxlint-tsgolint/win32-arm64': 0.23.0
       '@oxlint-tsgolint/win32-x64': 0.23.0
 
-  oxlint@1.65.0(oxlint-tsgolint@0.23.0):
+  oxlint@1.67.0(oxlint-tsgolint@0.23.0):
     optionalDependencies:
-      '@oxlint/binding-android-arm-eabi': 1.65.0
-      '@oxlint/binding-android-arm64': 1.65.0
-      '@oxlint/binding-darwin-arm64': 1.65.0
-      '@oxlint/binding-darwin-x64': 1.65.0
-      '@oxlint/binding-freebsd-x64': 1.65.0
-      '@oxlint/binding-linux-arm-gnueabihf': 1.65.0
-      '@oxlint/binding-linux-arm-musleabihf': 1.65.0
-      '@oxlint/binding-linux-arm64-gnu': 1.65.0
-      '@oxlint/binding-linux-arm64-musl': 1.65.0
-      '@oxlint/binding-linux-ppc64-gnu': 1.65.0
-      '@oxlint/binding-linux-riscv64-gnu': 1.65.0
-      '@oxlint/binding-linux-riscv64-musl': 1.65.0
-      '@oxlint/binding-linux-s390x-gnu': 1.65.0
-      '@oxlint/binding-linux-x64-gnu': 1.65.0
-      '@oxlint/binding-linux-x64-musl': 1.65.0
-      '@oxlint/binding-openharmony-arm64': 1.65.0
-      '@oxlint/binding-win32-arm64-msvc': 1.65.0
-      '@oxlint/binding-win32-ia32-msvc': 1.65.0
-      '@oxlint/binding-win32-x64-msvc': 1.65.0
+      '@oxlint/binding-android-arm-eabi': 1.67.0
+      '@oxlint/binding-android-arm64': 1.67.0
+      '@oxlint/binding-darwin-arm64': 1.67.0
+      '@oxlint/binding-darwin-x64': 1.67.0
+      '@oxlint/binding-freebsd-x64': 1.67.0
+      '@oxlint/binding-linux-arm-gnueabihf': 1.67.0
+      '@oxlint/binding-linux-arm-musleabihf': 1.67.0
+      '@oxlint/binding-linux-arm64-gnu': 1.67.0
+      '@oxlint/binding-linux-arm64-musl': 1.67.0
+      '@oxlint/binding-linux-ppc64-gnu': 1.67.0
+      '@oxlint/binding-linux-riscv64-gnu': 1.67.0
+      '@oxlint/binding-linux-riscv64-musl': 1.67.0
+      '@oxlint/binding-linux-s390x-gnu': 1.67.0
+      '@oxlint/binding-linux-x64-gnu': 1.67.0
+      '@oxlint/binding-linux-x64-musl': 1.67.0
+      '@oxlint/binding-openharmony-arm64': 1.67.0
+      '@oxlint/binding-win32-arm64-msvc': 1.67.0
+      '@oxlint/binding-win32-ia32-msvc': 1.67.0
+      '@oxlint/binding-win32-x64-msvc': 1.67.0
       oxlint-tsgolint: 0.23.0
 
   p-cancelable@2.1.1: {}
@@ -11360,14 +11393,14 @@ snapshots:
 
   parse-json@5.2.0:
     dependencies:
-      '@babel/code-frame': 7.29.0
+      '@babel/code-frame': 7.29.7
       error-ex: 1.3.4
       json-parse-even-better-errors: 2.3.1
       lines-and-columns: 1.2.4
 
   parse-json@8.3.0:
     dependencies:
-      '@babel/code-frame': 7.29.0
+      '@babel/code-frame': 7.29.7
       index-to-position: 1.2.0
       type-fest: 4.41.0
 
@@ -11455,15 +11488,15 @@ snapshots:
       picocolors: 1.1.1
       source-map-js: 1.2.1
 
-  postcss@8.5.14:
+  postcss@8.5.15:
     dependencies:
       nanoid: 3.3.12
       picocolors: 1.1.1
       source-map-js: 1.2.1
 
-  posthog-node@5.34.3:
+  posthog-node@5.35.5:
     dependencies:
-      '@posthog/core': 1.29.3
+      '@posthog/core': 1.29.12
 
   pretty-ms@9.3.0:
     dependencies:
@@ -11510,6 +11543,10 @@ snapshots:
     dependencies:
       side-channel: 1.1.0
 
+  qs@6.15.2:
+    dependencies:
+      side-channel: 1.1.0
+
   queue-microtask@1.2.3: {}
 
   quick-format-unescaped@4.0.4: {}
@@ -11550,32 +11587,32 @@ snapshots:
       react: 19.2.6
       scheduler: 0.27.0
 
-  react-remove-scroll-bar@2.3.8(@types/react@19.2.14)(react@19.2.6):
+  react-remove-scroll-bar@2.3.8(@types/react@19.2.15)(react@19.2.6):
     dependencies:
       react: 19.2.6
-      react-style-singleton: 2.2.3(@types/react@19.2.14)(react@19.2.6)
+      react-style-singleton: 2.2.3(@types/react@19.2.15)(react@19.2.6)
       tslib: 2.8.1
     optionalDependencies:
-      '@types/react': 19.2.14
+      '@types/react': 19.2.15
 
-  react-remove-scroll@2.7.2(@types/react@19.2.14)(react@19.2.6):
+  react-remove-scroll@2.7.2(@types/react@19.2.15)(react@19.2.6):
     dependencies:
       react: 19.2.6
-      react-remove-scroll-bar: 2.3.8(@types/react@19.2.14)(react@19.2.6)
-      react-style-singleton: 2.2.3(@types/react@19.2.14)(react@19.2.6)
+      react-remove-scroll-bar: 2.3.8(@types/react@19.2.15)(react@19.2.6)
+      react-style-singleton: 2.2.3(@types/react@19.2.15)(react@19.2.6)
       tslib: 2.8.1
-      use-callback-ref: 1.3.3(@types/react@19.2.14)(react@19.2.6)
-      use-sidecar: 1.1.3(@types/react@19.2.14)(react@19.2.6)
+      use-callback-ref: 1.3.3(@types/react@19.2.15)(react@19.2.6)
+      use-sidecar: 1.1.3(@types/react@19.2.15)(react@19.2.6)
     optionalDependencies:
-      '@types/react': 19.2.14
+      '@types/react': 19.2.15
 
-  react-style-singleton@2.2.3(@types/react@19.2.14)(react@19.2.6):
+  react-style-singleton@2.2.3(@types/react@19.2.15)(react@19.2.6):
     dependencies:
       get-nonce: 1.0.1
       react: 19.2.6
       tslib: 2.8.1
     optionalDependencies:
-      '@types/react': 19.2.14
+      '@types/react': 19.2.15
 
   react@19.2.6: {}
 
@@ -11585,6 +11622,20 @@ snapshots:
       read-pkg: 9.0.1
       type-fest: 4.41.0
 
+  read-package-up@12.0.0:
+    dependencies:
+      find-up-simple: 1.0.1
+      read-pkg: 10.1.0
+      type-fest: 5.6.0
+
+  read-pkg@10.1.0:
+    dependencies:
+      '@types/normalize-package-data': 2.4.4
+      normalize-package-data: 8.0.0
+      parse-json: 8.3.0
+      type-fest: 5.6.0
+      unicorn-magic: 0.4.0
+
   read-pkg@9.0.1:
     dependencies:
       '@types/normalize-package-data': 2.4.4
@@ -11623,7 +11674,7 @@ snapshots:
 
   recma-build-jsx@1.0.0:
     dependencies:
-      '@types/estree': 1.0.8
+      '@types/estree': 1.0.9
       estree-util-build-jsx: 3.0.1
       vfile: 6.0.3
 
@@ -11638,14 +11689,14 @@ snapshots:
 
   recma-parse@1.0.0:
     dependencies:
-      '@types/estree': 1.0.8
+      '@types/estree': 1.0.9
       esast-util-from-js: 2.0.1
       unified: 11.0.5
       vfile: 6.0.3
 
   recma-stringify@1.0.0:
     dependencies:
-      '@types/estree': 1.0.8
+      '@types/estree': 1.0.9
       estree-util-to-js: 2.0.0
       unified: 11.0.5
       vfile: 6.0.3
@@ -11678,7 +11729,7 @@ snapshots:
 
   rehype-recma@1.0.0:
     dependencies:
-      '@types/estree': 1.0.8
+      '@types/estree': 1.0.9
       '@types/hast': 3.0.4
       hast-util-to-estree: 3.1.3
     transitivePeerDependencies:
@@ -11810,13 +11861,13 @@ snapshots:
     dependencies:
       compute-scroll-into-view: 3.1.1
 
-  semantic-release@24.2.9(typescript@6.0.3):
+  semantic-release@25.0.3(typescript@6.0.3):
     dependencies:
-      '@semantic-release/commit-analyzer': 13.0.1(semantic-release@24.2.9(typescript@6.0.3))
+      '@semantic-release/commit-analyzer': 13.0.1(semantic-release@25.0.3(typescript@6.0.3))
       '@semantic-release/error': 4.0.0
-      '@semantic-release/github': 11.0.6(semantic-release@24.2.9(typescript@6.0.3))
-      '@semantic-release/npm': 12.0.2(semantic-release@24.2.9(typescript@6.0.3))
-      '@semantic-release/release-notes-generator': 14.1.1(semantic-release@24.2.9(typescript@6.0.3))
+      '@semantic-release/github': 12.0.8(semantic-release@25.0.3(typescript@6.0.3))
+      '@semantic-release/npm': 13.1.5(semantic-release@25.0.3(typescript@6.0.3))
+      '@semantic-release/release-notes-generator': 14.1.1(semantic-release@25.0.3(typescript@6.0.3))
       aggregate-error: 5.0.0
       cosmiconfig: 9.0.1(typescript@6.0.3)
       debug: 4.4.3
@@ -11827,7 +11878,7 @@ snapshots:
       get-stream: 6.0.1
       git-log-parser: 1.2.1
       hook-std: 4.0.0
-      hosted-git-info: 8.1.0
+      hosted-git-info: 9.0.3
       import-from-esm: 2.0.0
       lodash-es: 4.18.1
       marked: 15.0.12
@@ -11835,30 +11886,25 @@ snapshots:
       micromatch: 4.0.8
       p-each-series: 3.0.0
       p-reduce: 3.0.0
-      read-package-up: 11.0.0
+      read-package-up: 12.0.0
       resolve-from: 5.0.0
-      semver: 7.8.0
-      semver-diff: 5.0.0
+      semver: 7.8.1
       signale: 1.4.0
-      yargs: 17.7.2
+      yargs: 18.0.0
     transitivePeerDependencies:
       - supports-color
       - typescript
 
-  semver-diff@5.0.0:
-    dependencies:
-      semver: 7.8.0
-
   semver-regex@4.0.5: {}
 
   semver@6.3.1: {}
 
-  semver@7.7.3: {}
-
   semver@7.7.4: {}
 
   semver@7.8.0: {}
 
+  semver@7.8.1: {}
+
   send@0.19.2:
     dependencies:
       debug: 2.6.9
@@ -11892,7 +11938,7 @@ snapshots:
     dependencies:
       '@img/colour': 1.1.0
       detect-libc: 2.1.2
-      semver: 7.8.0
+      semver: 7.8.1
     optionalDependencies:
       '@img/sharp-darwin-arm64': 0.34.5
       '@img/sharp-darwin-x64': 0.34.5
@@ -11928,14 +11974,14 @@ snapshots:
 
   shell-quote@1.8.3: {}
 
-  shiki@4.0.2:
+  shiki@4.1.0:
     dependencies:
-      '@shikijs/core': 4.0.2
-      '@shikijs/engine-javascript': 4.0.2
-      '@shikijs/engine-oniguruma': 4.0.2
-      '@shikijs/langs': 4.0.2
-      '@shikijs/themes': 4.0.2
-      '@shikijs/types': 4.0.2
+      '@shikijs/core': 4.1.0
+      '@shikijs/engine-javascript': 4.1.0
+      '@shikijs/engine-oniguruma': 4.1.0
+      '@shikijs/langs': 4.1.0
+      '@shikijs/themes': 4.1.0
+      '@shikijs/types': 4.1.0
       '@shikijs/vscode-textmate': 10.0.2
       '@types/hast': 3.0.4
 
@@ -12057,8 +12103,6 @@ snapshots:
 
   standard-as-callback@2.1.0: {}
 
-  statuses@2.0.1: {}
-
   statuses@2.0.2: {}
 
   std-env@4.1.0: {}
@@ -12089,9 +12133,15 @@ snapshots:
       is-fullwidth-code-point: 3.0.0
       strip-ansi: 6.0.1
 
-  string-width@8.2.0:
+  string-width@7.2.0:
+    dependencies:
+      emoji-regex: 10.6.0
+      get-east-asian-width: 1.6.0
+      strip-ansi: 7.2.0
+
+  string-width@8.2.1:
     dependencies:
-      get-east-asian-width: 1.5.0
+      get-east-asian-width: 1.6.0
       strip-ansi: 7.2.0
 
   string_decoder@1.1.1:
@@ -12171,7 +12221,7 @@ snapshots:
 
   tar-stream@3.1.7:
     dependencies:
-      b4a: 1.8.0
+      b4a: 1.8.1
       fast-fifo: 1.3.2
       streamx: 2.25.0
     transitivePeerDependencies:
@@ -12191,7 +12241,7 @@ snapshots:
 
   text-decoder@1.2.7:
     dependencies:
-      b4a: 1.8.0
+      b4a: 1.8.1
     transitivePeerDependencies:
       - react-native-b4a
 
@@ -12220,9 +12270,7 @@ snapshots:
 
   tinybench@2.9.0: {}
 
-  tinyexec@1.1.1: {}
-
-  tinyexec@1.1.2: {}
+  tinyexec@1.2.2: {}
 
   tinyglobby@0.2.16:
     dependencies:
@@ -12239,7 +12287,7 @@ snapshots:
     dependencies:
       tldts-core: 6.1.86
 
-  tmp@0.2.4: {}
+  tmp@0.2.6: {}
 
   to-regex-range@5.0.1:
     dependencies:
@@ -12279,6 +12327,8 @@ snapshots:
     dependencies:
       safe-buffer: 5.2.1
 
+  tunnel@0.0.6: {}
+
   tweetnacl@0.14.5: {}
 
   typanion@3.14.0: {}
@@ -12307,6 +12357,10 @@ snapshots:
 
   undici-types@7.24.6: {}
 
+  undici@6.26.0: {}
+
+  undici@7.26.0: {}
+
   undici@8.3.0: {}
 
   unicode-emoji-modifier-base@1.0.0: {}
@@ -12315,6 +12369,8 @@ snapshots:
 
   unicorn-magic@0.3.0: {}
 
+  unicorn-magic@0.4.0: {}
+
   unified@11.0.5:
     dependencies:
       '@types/unist': 3.0.3
@@ -12377,20 +12433,20 @@ snapshots:
 
   url-join@5.0.0: {}
 
-  use-callback-ref@1.3.3(@types/react@19.2.14)(react@19.2.6):
+  use-callback-ref@1.3.3(@types/react@19.2.15)(react@19.2.6):
     dependencies:
       react: 19.2.6
       tslib: 2.8.1
     optionalDependencies:
-      '@types/react': 19.2.14
+      '@types/react': 19.2.15
 
-  use-sidecar@1.1.3(@types/react@19.2.14)(react@19.2.6):
+  use-sidecar@1.1.3(@types/react@19.2.15)(react@19.2.6):
     dependencies:
       detect-node-es: 1.1.0
       react: 19.2.6
       tslib: 2.8.1
     optionalDependencies:
-      '@types/react': 19.2.14
+      '@types/react': 19.2.15
 
   utf8-byte-length@1.0.5: {}
 
@@ -12411,10 +12467,10 @@ snapshots:
 
   vary@1.1.2: {}
 
-  verdaccio-audit@13.0.1:
+  verdaccio-audit@13.0.2:
     dependencies:
-      '@verdaccio/config': 8.1.0
-      '@verdaccio/core': 8.1.0
+      '@verdaccio/config': 8.1.1
+      '@verdaccio/core': 8.1.1
       express: 4.22.1
       https-proxy-agent: 5.0.1
       node-fetch: 2.6.7
@@ -12422,10 +12478,10 @@ snapshots:
       - encoding
       - supports-color
 
-  verdaccio-htpasswd@13.0.1:
+  verdaccio-htpasswd@13.0.2:
     dependencies:
-      '@verdaccio/core': 8.1.0
-      '@verdaccio/file-locking': 13.0.0
+      '@verdaccio/core': 8.1.1
+      '@verdaccio/file-locking': 13.0.1
       apache-md5: 1.1.8
       bcryptjs: 2.4.3
       debug: 4.4.3
@@ -12434,25 +12490,25 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
-  verdaccio@6.7.1(typanion@3.14.0):
+  verdaccio@6.7.2(typanion@3.14.0):
     dependencies:
       '@cypress/request': 3.0.10
-      '@verdaccio/auth': 8.0.1
-      '@verdaccio/config': 8.1.0
-      '@verdaccio/core': 8.1.0
-      '@verdaccio/hooks': 8.0.1
-      '@verdaccio/loaders': 8.0.1
-      '@verdaccio/local-storage-legacy': 11.3.1
-      '@verdaccio/logger': 8.0.1
-      '@verdaccio/middleware': 8.0.1
-      '@verdaccio/package-filter': 13.0.1
-      '@verdaccio/search-indexer': 8.0.0
-      '@verdaccio/signature': 8.0.1
-      '@verdaccio/streams': 10.2.3
-      '@verdaccio/tarball': 13.0.1
+      '@verdaccio/auth': 8.0.2
+      '@verdaccio/config': 8.1.1
+      '@verdaccio/core': 8.1.1
+      '@verdaccio/hooks': 8.0.2
+      '@verdaccio/loaders': 8.0.2
+      '@verdaccio/local-storage-legacy': 11.3.3
+      '@verdaccio/logger': 8.0.2
+      '@verdaccio/middleware': 8.0.2
+      '@verdaccio/package-filter': 13.0.2
+      '@verdaccio/search-indexer': 8.0.2
+      '@verdaccio/signature': 8.0.2
+      '@verdaccio/streams': 10.2.5
+      '@verdaccio/tarball': 13.0.2
       '@verdaccio/ui-theme': 9.0.0-next-9.14
-      '@verdaccio/url': 13.0.1
-      '@verdaccio/utils': 8.1.1
+      '@verdaccio/url': 13.0.2
+      '@verdaccio/utils': 8.1.2
       JSONStream: 1.3.5
       async: 3.2.6
       clipanion: 4.0.0-rc.4(typanion@3.14.0)
@@ -12465,8 +12521,8 @@ snapshots:
       lru-cache: 7.18.3
       mime: 3.0.0
       semver: 7.8.0
-      verdaccio-audit: 13.0.1
-      verdaccio-htpasswd: 13.0.1
+      verdaccio-audit: 13.0.2
+      verdaccio-htpasswd: 13.0.2
     transitivePeerDependencies:
       - bare-abort-controller
       - encoding
@@ -12495,15 +12551,15 @@ snapshots:
       '@types/unist': 3.0.3
       vfile-message: 4.0.3
 
-  vite@8.0.2(@emnapi/core@1.10.0)(@emnapi/runtime@1.10.0)(@types/node@25.8.0)(esbuild@0.27.4)(jiti@2.7.0)(yaml@2.9.0):
+  vite@8.0.2(@emnapi/core@1.10.0)(@emnapi/runtime@1.10.0)(@types/node@25.9.1)(esbuild@0.27.4)(jiti@2.7.0)(yaml@2.9.0):
     dependencies:
       lightningcss: 1.32.0
       picomatch: 4.0.4
-      postcss: 8.5.14
+      postcss: 8.5.15
       rolldown: 1.0.0-rc.11(@emnapi/core@1.10.0)(@emnapi/runtime@1.10.0)
       tinyglobby: 0.2.16
     optionalDependencies:
-      '@types/node': 25.8.0
+      '@types/node': 25.9.1
       esbuild: 0.27.4
       fsevents: 2.3.3
       jiti: 2.7.0
@@ -12512,15 +12568,15 @@ snapshots:
       - '@emnapi/core'
       - '@emnapi/runtime'
 
-  vitest@4.1.6(@types/node@25.8.0)(@vitest/coverage-istanbul@4.1.6)(vite@8.0.2(@emnapi/core@1.10.0)(@emnapi/runtime@1.10.0)(@types/node@25.8.0)(esbuild@0.27.4)(jiti@2.7.0)(yaml@2.9.0)):
+  vitest@4.1.7(@types/node@25.9.1)(@vitest/coverage-istanbul@4.1.7)(vite@8.0.2(@emnapi/core@1.10.0)(@emnapi/runtime@1.10.0)(@types/node@25.9.1)(esbuild@0.27.4)(jiti@2.7.0)(yaml@2.9.0)):
     dependencies:
-      '@vitest/expect': 4.1.6
-      '@vitest/mocker': 4.1.6(vite@8.0.2(@emnapi/core@1.10.0)(@emnapi/runtime@1.10.0)(@types/node@25.8.0)(esbuild@0.27.4)(jiti@2.7.0)(yaml@2.9.0))
-      '@vitest/pretty-format': 4.1.6
-      '@vitest/runner': 4.1.6
-      '@vitest/snapshot': 4.1.6
-      '@vitest/spy': 4.1.6
-      '@vitest/utils': 4.1.6
+      '@vitest/expect': 4.1.7
+      '@vitest/mocker': 4.1.7(vite@8.0.2(@emnapi/core@1.10.0)(@emnapi/runtime@1.10.0)(@types/node@25.9.1)(esbuild@0.27.4)(jiti@2.7.0)(yaml@2.9.0))
+      '@vitest/pretty-format': 4.1.7
+      '@vitest/runner': 4.1.7
+      '@vitest/snapshot': 4.1.7
+      '@vitest/spy': 4.1.7
+      '@vitest/utils': 4.1.7
       es-module-lexer: 2.0.0
       expect-type: 1.3.0
       magic-string: 0.30.21
@@ -12529,14 +12585,14 @@ snapshots:
       picomatch: 4.0.4
       std-env: 4.1.0
       tinybench: 2.9.0
-      tinyexec: 1.1.1
+      tinyexec: 1.2.2
       tinyglobby: 0.2.16
       tinyrainbow: 3.1.0
-      vite: 8.0.2(@emnapi/core@1.10.0)(@emnapi/runtime@1.10.0)(@types/node@25.8.0)(esbuild@0.27.4)(jiti@2.7.0)(yaml@2.9.0)
+      vite: 8.0.2(@emnapi/core@1.10.0)(@emnapi/runtime@1.10.0)(@types/node@25.9.1)(esbuild@0.27.4)(jiti@2.7.0)(yaml@2.9.0)
       why-is-node-running: 2.3.0
     optionalDependencies:
-      '@types/node': 25.8.0
-      '@vitest/coverage-istanbul': 4.1.6(vitest@4.1.6)
+      '@types/node': 25.9.1
+      '@vitest/coverage-istanbul': 4.1.7(vitest@4.1.7)
     transitivePeerDependencies:
       - msw
 
@@ -12568,14 +12624,14 @@ snapshots:
 
   widest-line@6.0.0:
     dependencies:
-      string-width: 8.2.0
+      string-width: 8.2.1
 
   wordwrap@1.0.0: {}
 
   wrap-ansi@10.0.0:
     dependencies:
       ansi-styles: 6.2.3
-      string-width: 8.2.0
+      string-width: 8.2.1
       strip-ansi: 7.2.0
 
   wrap-ansi@7.0.0:
@@ -12584,11 +12640,17 @@ snapshots:
       string-width: 4.2.3
       strip-ansi: 6.0.1
 
+  wrap-ansi@9.0.2:
+    dependencies:
+      ansi-styles: 6.2.3
+      string-width: 7.2.0
+      strip-ansi: 7.2.0
+
   wrappy@1.0.2: {}
 
   ws@7.5.10: {}
 
-  ws@8.20.0: {}
+  ws@8.21.0: {}
 
   xtend@4.0.2: {}
 
@@ -12596,14 +12658,14 @@ snapshots:
 
   yallist@3.1.1: {}
 
-  yaml@2.8.0: {}
-
   yaml@2.9.0: {}
 
   yargs-parser@20.2.9: {}
 
   yargs-parser@21.1.1: {}
 
+  yargs-parser@22.0.0: {}
+
   yargs@16.2.0:
     dependencies:
       cliui: 7.0.4
@@ -12624,12 +12686,19 @@ snapshots:
       y18n: 5.0.8
       yargs-parser: 21.1.1
 
+  yargs@18.0.0:
+    dependencies:
+      cliui: 9.0.1
+      escalade: 3.2.0
+      get-caller-file: 2.0.5
+      string-width: 7.2.0
+      y18n: 5.0.8
+      yargs-parser: 22.0.0
+
   yoctocolors@2.1.2: {}
 
   yoga-layout@3.2.1: {}
 
-  zod@4.3.6: {}
-
   zod@4.4.3: {}
 
   zwitch@2.0.4: {}
diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml
index 62ecdae6dd..3b6a7b2aef 100644
--- a/pnpm-workspace.yaml
+++ b/pnpm-workspace.yaml
@@ -11,24 +11,24 @@ allowBuilds:
   sharp: true
 
 catalog:
-  "@effect/atom-react": "4.0.0-beta.67"
-  "@effect/platform-bun": "4.0.0-beta.67"
-  "@effect/platform-node": "4.0.0-beta.67"
-  "@effect/vitest": "^4.0.0-beta.43"
-  "@nx/devkit": "^22.7.2"
+  "@effect/atom-react": "4.0.0-beta.74"
+  "@effect/platform-bun": "4.0.0-beta.74"
+  "@effect/platform-node": "4.0.0-beta.74"
+  "@effect/vitest": "^4.0.0-beta.74"
+  "@nx/devkit": "^22.7.5"
   "@swc-node/register": "^1.10.9"
-  "@swc/core": "^1.15.33"
+  "@swc/core": "^1.15.40"
   "@tsconfig/bun": "^1.0.10"
   "@types/bun": "^1.3.14"
-  "@typescript/native-preview": "7.0.0-dev.20260518.1"
-  "@vitest/coverage-istanbul": "^4.1.6"
-  "effect": "4.0.0-beta.67"
-  "knip": "^6.14.1"
-  "nx": "^22.7.2"
-  "oxfmt": "^0.50.0"
-  "oxlint": "^1.65.0"
+  "@typescript/native-preview": "7.0.0-dev.20260527.2"
+  "@vitest/coverage-istanbul": "^4.1.7"
+  "effect": "4.0.0-beta.74"
+  "knip": "^6.14.2"
+  "nx": "^22.7.5"
+  "oxfmt": "^0.52.0"
+  "oxlint": "^1.67.0"
   "oxlint-tsgolint": "^0.23.0"
-  "vitest": "^4.1.6"
+  "vitest": "^4.1.7"
 
 supportedArchitectures:
   cpu:
diff --git a/tools/release/local-release.ts b/tools/release/local-release.ts
index 06ccfc596b..e3ad73590e 100644
--- a/tools/release/local-release.ts
+++ b/tools/release/local-release.ts
@@ -25,294 +25,278 @@ const tokenPath = path.join(root, "tmp", "verdaccio-token");
 
 // All seven platform packages that appear in optionalDependencies.
 const PLATFORM_PACKAGES = [
-	"cli-darwin-arm64",
-	"cli-darwin-x64",
-	"cli-linux-arm64",
-	"cli-linux-arm64-musl",
-	"cli-linux-x64",
-	"cli-linux-x64-musl",
-	"cli-windows-arm64",
-	"cli-windows-x64",
+  "cli-darwin-arm64",
+  "cli-darwin-x64",
+  "cli-linux-arm64",
+  "cli-linux-arm64-musl",
+  "cli-linux-x64",
+  "cli-linux-x64-musl",
+  "cli-windows-arm64",
+  "cli-windows-x64",
 ] as const;
 
 type PlatformInfo = {
-	bunTarget: string;
-	platformPkg: string;
-	ext: string;
-	goos: string;
-	goarch: string;
+  bunTarget: string;
+  platformPkg: string;
+  ext: string;
+  goos: string;
+  goarch: string;
 };
 
 const PLATFORM_MAP: Record<string, PlatformInfo> = {
-	"darwin-arm64": {
-		bunTarget: "bun-darwin-arm64",
-		platformPkg: "cli-darwin-arm64",
-		ext: "",
-		goos: "darwin",
-		goarch: "arm64",
-	},
-	"darwin-x64": {
-		bunTarget: "bun-darwin-x64",
-		platformPkg: "cli-darwin-x64",
-		ext: "",
-		goos: "darwin",
-		goarch: "amd64",
-	},
-	"linux-arm64": {
-		bunTarget: "bun-linux-arm64",
-		platformPkg: "cli-linux-arm64",
-		ext: "",
-		goos: "linux",
-		goarch: "arm64",
-	},
-	"linux-x64": {
-		bunTarget: "bun-linux-x64",
-		platformPkg: "cli-linux-x64",
-		ext: "",
-		goos: "linux",
-		goarch: "amd64",
-	},
-	"win32-x64": {
-		bunTarget: "bun-windows-x64",
-		platformPkg: "cli-windows-x64",
-		ext: ".exe",
-		goos: "windows",
-		goarch: "amd64",
-	},
-	"win32-arm64": {
-		bunTarget: "bun-windows-arm64",
-		platformPkg: "cli-windows-arm64",
-		ext: ".exe",
-		goos: "windows",
-		goarch: "arm64",
-	},
+  "darwin-arm64": {
+    bunTarget: "bun-darwin-arm64",
+    platformPkg: "cli-darwin-arm64",
+    ext: "",
+    goos: "darwin",
+    goarch: "arm64",
+  },
+  "darwin-x64": {
+    bunTarget: "bun-darwin-x64",
+    platformPkg: "cli-darwin-x64",
+    ext: "",
+    goos: "darwin",
+    goarch: "amd64",
+  },
+  "linux-arm64": {
+    bunTarget: "bun-linux-arm64",
+    platformPkg: "cli-linux-arm64",
+    ext: "",
+    goos: "linux",
+    goarch: "arm64",
+  },
+  "linux-x64": {
+    bunTarget: "bun-linux-x64-baseline",
+    platformPkg: "cli-linux-x64",
+    ext: "",
+    goos: "linux",
+    goarch: "amd64",
+  },
+  "win32-x64": {
+    bunTarget: "bun-windows-x64-baseline",
+    platformPkg: "cli-windows-x64",
+    ext: ".exe",
+    goos: "windows",
+    goarch: "amd64",
+  },
+  "win32-arm64": {
+    bunTarget: "bun-windows-arm64",
+    platformPkg: "cli-windows-arm64",
+    ext: ".exe",
+    goos: "windows",
+    goarch: "arm64",
+  },
 };
 
 function getPlatformInfo(): PlatformInfo {
-	const key = `${process.platform}-${process.arch}`;
-	const info = PLATFORM_MAP[key];
-	if (!info) {
-		console.error(`\nError: Unsupported platform: ${key}`);
-		console.error(
-			"Supported: darwin-arm64, darwin-x64, linux-arm64, linux-x64, win32-x64\n",
-		);
-		process.exit(1);
-	}
-	return info;
+  const key = `${process.platform}-${process.arch}`;
+  const info = PLATFORM_MAP[key];
+  if (!info) {
+    console.error(`\nError: Unsupported platform: ${key}`);
+    console.error("Supported: darwin-arm64, darwin-x64, linux-arm64, linux-x64, win32-x64\n");
+    process.exit(1);
+  }
+  return info;
 }
 
 function libcForBunTarget(target: string): "glibc" | "musl" | "" {
-	if (!target.startsWith("bun-linux-")) {
-		return "";
-	}
-	return target.endsWith("-musl") ? "musl" : "glibc";
+  if (!target.startsWith("bun-linux-")) {
+    return "";
+  }
+  return target.includes("-musl") ? "musl" : "glibc";
 }
 
 async function checkRegistry(): Promise<void> {
-	try {
-		const res = await fetch(`${REGISTRY}/-/ping`, {
-			signal: AbortSignal.timeout(3000),
-		});
-		if (!res.ok) throw new Error(`HTTP ${res.status}`);
-	} catch {
-		console.error(`\nError: Local registry not responding at ${REGISTRY}`);
-		console.error("Start it first with: pnpm local-registry\n");
-		process.exit(1);
-	}
+  try {
+    const res = await fetch(`${REGISTRY}/-/ping`, {
+      signal: AbortSignal.timeout(3000),
+    });
+    if (!res.ok) throw new Error(`HTTP ${res.status}`);
+  } catch {
+    console.error(`\nError: Local registry not responding at ${REGISTRY}`);
+    console.error("Start it first with: pnpm local-registry\n");
+    process.exit(1);
+  }
 }
 
 async function readToken(): Promise<string> {
-	try {
-		return (await Bun.file(tokenPath).text()).trim();
-	} catch {
-		console.error(`\nError: Auth token not found at ${tokenPath}`);
-		console.error(
-			"The local registry must be running before you release: pnpm local-registry\n",
-		);
-		process.exit(1);
-	}
+  try {
+    return (await Bun.file(tokenPath).text()).trim();
+  } catch {
+    console.error(`\nError: Auth token not found at ${tokenPath}`);
+    console.error("The local registry must be running before you release: pnpm local-registry\n");
+    process.exit(1);
+  }
 }
 
 async function checkGo(): Promise<void> {
-	try {
-		await $`go version`.quiet();
-	} catch {
-		console.error("\nError: `go` not found in PATH.");
-		console.error("Install Go from https://go.dev/dl/ to build the legacy shell.\n");
-		process.exit(1);
-	}
+  try {
+    await $`go version`.quiet();
+  } catch {
+    console.error("\nError: `go` not found in PATH.");
+    console.error("Install Go from https://go.dev/dl/ to build the legacy shell.\n");
+    process.exit(1);
+  }
 }
 
 async function checkGoSource(): Promise<string> {
-	const goSource = path.join(root, "apps", "cli-go");
-	const goMod = Bun.file(path.join(goSource, "go.mod"));
-	if (!(await goMod.exists())) {
-		console.error("\nError: Go CLI source not found at apps/cli-go");
-		console.error("Run: pnpm repos:install\n");
-		process.exit(1);
-	}
-	return goSource;
+  const goSource = path.join(root, "apps", "cli-go");
+  const goMod = Bun.file(path.join(goSource, "go.mod"));
+  if (!(await goMod.exists())) {
+    console.error("\nError: Go CLI source not found at apps/cli-go");
+    console.error("Run: pnpm repos:install\n");
+    process.exit(1);
+  }
+  return goSource;
 }
 
 async function main() {
-	const { values } = parseArgs({
-		options: {
-			legacy: { type: "boolean", default: false },
-			next: { type: "boolean", default: false },
-			version: { type: "string" },
-		},
-	});
-
-	if (!values.legacy && !values.next) {
-		console.error("Usage: pnpm cli-release --next | --legacy [--version <v>]");
-		process.exit(1);
-	}
-	if (values.legacy && values.next) {
-		console.error("Error: Specify either --next or --legacy, not both.");
-		process.exit(1);
-	}
-
-	const shell = values.legacy ? "legacy" : "next";
-	const version = values.version ?? `0.0.0-local.${Math.floor(Date.now() / 1000)}`;
-
-	await checkRegistry();
-	const token = await readToken();
-	const platform = getPlatformInfo();
-
-	let goSource: string | undefined;
-	if (shell === "legacy") {
-		await checkGo();
-		goSource = await checkGoSource();
-
-		if (process.platform === "linux") {
-			console.warn(
-				"Note: local-release builds the glibc variant only (cli-linux-*). " +
-					"The musl variant is skipped for local dev.\n",
-			);
-		}
-	}
-
-	// All build output goes into a system temp directory — never into the git repo.
-	const tmpDir = await mkdtemp(path.join(tmpdir(), "supabase-local-release-"));
-
-	try {
-		// Read once up front so log lines and the published package.json agree.
-		const cliPkgJson = await Bun.file(
-			path.join(root, "apps", "cli", "package.json"),
-		).json();
-		const umbrellaName: string = cliPkgJson.name;
-
-		console.log(
-			`\nBuilding ${umbrellaName}@${version} (${shell}, ${platform.platformPkg})...\n`,
-		);
-
-		// ── Build platform package ────────────────────────────────────────────
-
-		const tmpPlatformDir = path.join(tmpDir, platform.platformPkg);
-		const tmpPlatformBinDir = path.join(tmpPlatformDir, "bin");
-		await mkdir(tmpPlatformBinDir, { recursive: true });
-
-		const entrypoint = path.join(root, "apps", "cli", "src", shell, "main.ts");
-		const bunBinary = path.join(tmpPlatformBinDir, `supabase${platform.ext}`);
-		const libc = libcForBunTarget(platform.bunTarget);
-
-		console.log(`[1/${shell === "legacy" ? 3 : 2}] Compiling ${shell} CLI binary...`);
-		await $`bun build ${entrypoint} --compile --target=${platform.bunTarget} --define=SUPABASE_LIBC=${JSON.stringify(libc)} --outfile=${bunBinary}`;
-
-		if (shell === "legacy" && goSource) {
-			const goBinary = path.join(tmpPlatformBinDir, `supabase-go${platform.ext}`);
-			console.log(
-				`[2/3] Compiling Go CLI binary (${platform.goos}/${platform.goarch})...`,
-			);
-			// Run go build from within the Go source directory so Go can find
-			// the go.mod there. Passing an absolute path as a positional arg
-			// causes Go to resolve the module from CWD instead, which fails
-			// because the repo root has no go.mod.
-			await $`go build -trimpath -ldflags="-s -w" -o ${goBinary} .`
-				.cwd(goSource)
-				.env({
-					...process.env,
-					GOOS: platform.goos,
-					GOARCH: platform.goarch,
-					CGO_ENABLED: "0",
-				});
-		}
-
-		// ── Build umbrella package shim ───────────────────────────────────────
-
-		const tmpCliDir = path.join(tmpDir, "cli");
-		const tmpCliDistDir = path.join(tmpCliDir, "dist");
-		await mkdir(tmpCliDistDir, { recursive: true });
-
-		const shimSrc = path.join(root, "apps", "cli", "src", "shared", "cli", "bin.ts");
-		const shimOut = path.join(tmpCliDistDir, "supabase.js");
-		const shimStep = shell === "legacy" ? 3 : 2;
-		console.log(`[${shimStep}/${shimStep}] Building Node.js shim...`);
-		await $`bun build ${shimSrc} --outfile=${shimOut} --target=node`;
-
-		// ── Write package.json files ──────────────────────────────────────────
-
-		// Platform package: copy as-is, bump version.
-		const platformPkgJson = await Bun.file(
-			path.join(root, "packages", platform.platformPkg, "package.json"),
-		).json();
-		platformPkgJson.version = version;
-		await Bun.write(
-			path.join(tmpPlatformDir, "package.json"),
-			`${JSON.stringify(platformPkgJson, null, "\t")}\n`,
-		);
-
-		// Umbrella package: build a minimal package.json.
-		// The shim only uses Node built-ins — all @supabase/* and catalog: deps
-		// are bundled in the platform binary and must not appear in the published
-		// package.json (catalog: and workspace:* are invalid outside pnpm workspaces).
-		const resolvedOptionalDeps: Record<string, string> = {};
-		for (const pkg of PLATFORM_PACKAGES) {
-			resolvedOptionalDeps[`@supabase/${pkg}`] = version;
-		}
-
-		const publishPkgJson = {
-			name: cliPkgJson.name,
-			version,
-			type: cliPkgJson.type,
-			bin: cliPkgJson.bin,
-			files: cliPkgJson.files,
-			publishConfig: cliPkgJson.publishConfig,
-			optionalDependencies: resolvedOptionalDeps,
-		};
-		await Bun.write(
-			path.join(tmpCliDir, "package.json"),
-			`${JSON.stringify(publishPkgJson, null, "\t")}\n`,
-		);
-
-		// ── Write .npmrc with registry and auth token ─────────────────────────
-
-		const npmrc = [
-			`registry=${REGISTRY}`,
-			`//localhost:${PORT}/:_authToken=${token}`,
-			"",
-		].join("\n");
-		await Bun.write(path.join(tmpPlatformDir, ".npmrc"), npmrc);
-		await Bun.write(path.join(tmpCliDir, ".npmrc"), npmrc);
-
-		// ── Publish ───────────────────────────────────────────────────────────
-
-		console.log(
-			`\nPublishing @supabase/${platform.platformPkg}@${version} to local registry...`,
-		);
-		// Use bun publish for the platform binary package: pnpm normalises file
-		// modes in tarballs and strips the execute bit from files not in the
-		// package's `bin` field. bun publish preserves modes, matching production.
-		await $`bun publish --access public --tag local --registry ${REGISTRY} --no-git-checks`.cwd(
-			tmpPlatformDir,
-		);
-
-		console.log(`Publishing ${umbrellaName}@${version} to local registry...`);
-		await $`pnpm publish --access public --tag local --registry ${REGISTRY} --no-git-checks`.cwd(
-			tmpCliDir,
-		);
-
-		console.log(`
+  const { values } = parseArgs({
+    options: {
+      legacy: { type: "boolean", default: false },
+      next: { type: "boolean", default: false },
+      version: { type: "string" },
+    },
+  });
+
+  if (!values.legacy && !values.next) {
+    console.error("Usage: pnpm cli-release --next | --legacy [--version <v>]");
+    process.exit(1);
+  }
+  if (values.legacy && values.next) {
+    console.error("Error: Specify either --next or --legacy, not both.");
+    process.exit(1);
+  }
+
+  const shell = values.legacy ? "legacy" : "next";
+  const version = values.version ?? `0.0.0-local.${Math.floor(Date.now() / 1000)}`;
+
+  await checkRegistry();
+  const token = await readToken();
+  const platform = getPlatformInfo();
+
+  let goSource: string | undefined;
+  if (shell === "legacy") {
+    await checkGo();
+    goSource = await checkGoSource();
+
+    if (process.platform === "linux") {
+      console.warn(
+        "Note: local-release builds the glibc variant only (cli-linux-*). " +
+          "The musl variant is skipped for local dev.\n",
+      );
+    }
+  }
+
+  // All build output goes into a system temp directory — never into the git repo.
+  const tmpDir = await mkdtemp(path.join(tmpdir(), "supabase-local-release-"));
+
+  try {
+    // Read once up front so log lines and the published package.json agree.
+    const cliPkgJson = await Bun.file(path.join(root, "apps", "cli", "package.json")).json();
+    const umbrellaName: string = cliPkgJson.name;
+
+    console.log(`\nBuilding ${umbrellaName}@${version} (${shell}, ${platform.platformPkg})...\n`);
+
+    // ── Build platform package ────────────────────────────────────────────
+
+    const tmpPlatformDir = path.join(tmpDir, platform.platformPkg);
+    const tmpPlatformBinDir = path.join(tmpPlatformDir, "bin");
+    await mkdir(tmpPlatformBinDir, { recursive: true });
+
+    const entrypoint = path.join(root, "apps", "cli", "src", shell, "main.ts");
+    const bunBinary = path.join(tmpPlatformBinDir, `supabase${platform.ext}`);
+    const libc = libcForBunTarget(platform.bunTarget);
+
+    console.log(`[1/${shell === "legacy" ? 3 : 2}] Compiling ${shell} CLI binary...`);
+    await $`bun build ${entrypoint} --compile --target=${platform.bunTarget} --define=SUPABASE_LIBC=${JSON.stringify(libc)} --outfile=${bunBinary}`;
+
+    if (shell === "legacy" && goSource) {
+      const goBinary = path.join(tmpPlatformBinDir, `supabase-go${platform.ext}`);
+      console.log(`[2/3] Compiling Go CLI binary (${platform.goos}/${platform.goarch})...`);
+      // Run go build from within the Go source directory so Go can find
+      // the go.mod there. Passing an absolute path as a positional arg
+      // causes Go to resolve the module from CWD instead, which fails
+      // because the repo root has no go.mod.
+      await $`go build -trimpath -ldflags="-s -w" -o ${goBinary} .`.cwd(goSource).env({
+        ...process.env,
+        GOOS: platform.goos,
+        GOARCH: platform.goarch,
+        CGO_ENABLED: "0",
+      });
+    }
+
+    // ── Build umbrella package shim ───────────────────────────────────────
+
+    const tmpCliDir = path.join(tmpDir, "cli");
+    const tmpCliDistDir = path.join(tmpCliDir, "dist");
+    await mkdir(tmpCliDistDir, { recursive: true });
+
+    const shimSrc = path.join(root, "apps", "cli", "src", "shared", "cli", "bin.ts");
+    const shimOut = path.join(tmpCliDistDir, "supabase.js");
+    const shimStep = shell === "legacy" ? 3 : 2;
+    console.log(`[${shimStep}/${shimStep}] Building Node.js shim...`);
+    await $`bun build ${shimSrc} --outfile=${shimOut} --target=node`;
+
+    // ── Write package.json files ──────────────────────────────────────────
+
+    // Platform package: copy as-is, bump version.
+    const platformPkgJson = await Bun.file(
+      path.join(root, "packages", platform.platformPkg, "package.json"),
+    ).json();
+    platformPkgJson.version = version;
+    await Bun.write(
+      path.join(tmpPlatformDir, "package.json"),
+      `${JSON.stringify(platformPkgJson, null, "\t")}\n`,
+    );
+
+    // Umbrella package: build a minimal package.json.
+    // The shim only uses Node built-ins — all @supabase/* and catalog: deps
+    // are bundled in the platform binary and must not appear in the published
+    // package.json (catalog: and workspace:* are invalid outside pnpm workspaces).
+    const resolvedOptionalDeps: Record<string, string> = {};
+    for (const pkg of PLATFORM_PACKAGES) {
+      resolvedOptionalDeps[`@supabase/${pkg}`] = version;
+    }
+
+    const publishPkgJson = {
+      name: cliPkgJson.name,
+      version,
+      type: cliPkgJson.type,
+      bin: cliPkgJson.bin,
+      files: cliPkgJson.files,
+      publishConfig: cliPkgJson.publishConfig,
+      optionalDependencies: resolvedOptionalDeps,
+    };
+    await Bun.write(
+      path.join(tmpCliDir, "package.json"),
+      `${JSON.stringify(publishPkgJson, null, "\t")}\n`,
+    );
+
+    // ── Write .npmrc with registry and auth token ─────────────────────────
+
+    const npmrc = [`registry=${REGISTRY}`, `//localhost:${PORT}/:_authToken=${token}`, ""].join(
+      "\n",
+    );
+    await Bun.write(path.join(tmpPlatformDir, ".npmrc"), npmrc);
+    await Bun.write(path.join(tmpCliDir, ".npmrc"), npmrc);
+
+    // ── Publish ───────────────────────────────────────────────────────────
+
+    console.log(`\nPublishing @supabase/${platform.platformPkg}@${version} to local registry...`);
+    // Use bun publish for the platform binary package: pnpm normalises file
+    // modes in tarballs and strips the execute bit from files not in the
+    // package's `bin` field. bun publish preserves modes, matching production.
+    await $`bun publish --access public --tag local --registry ${REGISTRY} --no-git-checks`.cwd(
+      tmpPlatformDir,
+    );
+
+    console.log(`Publishing ${umbrellaName}@${version} to local registry...`);
+    await $`pnpm publish --access public --tag local --registry ${REGISTRY} --no-git-checks`.cwd(
+      tmpCliDir,
+    );
+
+    console.log(`
 ✓ Published ${umbrellaName}@${version}
 
 Test with npx:
@@ -322,10 +306,10 @@ Or install globally:
   npm install -g --registry ${REGISTRY} ${umbrellaName}@${version}
   supabase --version
 `);
-	} finally {
-		// Always remove the temp directory — even on failure.
-		await rm(tmpDir, { recursive: true, force: true });
-	}
+  } finally {
+    // Always remove the temp directory — even on failure.
+    await rm(tmpDir, { recursive: true, force: true });
+  }
 }
 
 await main();