fix(cli): port migration squash to native TS (CLI-1969)

apps/cli/src/legacy/commands/db/diff/diff.handler.ts

@@ -32,6 +32,7 @@ import {
   legacyCreateShadowDatabase,
   legacyMigrateShadowDatabase,
   legacyRemoveShadowDatabase,
+  legacyShadowRunInputFromLocalContainerInputs,
 } from "../../../shared/db-bootstrap/shadow-database.ts";
 import { LegacyLinkedProjectCache } from "../../../telemetry/legacy-linked-project-cache.service.ts";
 import { LegacyTelemetryState } from "../../../telemetry/legacy-telemetry-state.service.ts";
@@ -54,10 +55,7 @@ import {
   legacyIsPgDeltaDebugEnabled,
   legacyResolvePgDeltaProjectId,
 } from "../../../shared/legacy-pgdelta.ts";
-import {
-  legacyPrepareShadowSource,
-  legacyShadowRunInputFromLocalContainerInputs,
-} from "../shared/legacy-shadow-source.ts";
+import { legacyPrepareShadowSource } from "../shared/legacy-shadow-source.ts";
 import type { LegacyDbDiffFlags } from "./diff.command.ts";
 import { legacyClassifyExplicitRef, legacyUnknownTargetMessage } from "./diff.explicit.ts";
 import {

apps/cli/src/legacy/commands/db/diff/legacy-pgadmin-diff.ts

@@ -47,7 +47,7 @@ import { LEGACY_COMPOSE_PROJECT_LABEL } from "../../../shared/db-bootstrap/conta
 import { LEGACY_CLI_PROJECT_LABEL } from "../../../shared/legacy-docker-ids.ts";
 import { LegacyDockerRun } from "../../../shared/legacy-docker-run.service.ts";
 import { legacyTrimGoSpace } from "../shared/legacy-go-string.ts";
-import { LEGACY_INTERNAL_SCHEMAS } from "../shared/legacy-pg-dump.env.ts";
+import { LEGACY_INTERNAL_SCHEMAS } from "../../../shared/legacy-pg-dump.env.ts";
 import { LegacyDbDiffPgAdminError } from "./diff.errors.ts";
 
 /** Go's `config.Images.Differ` (`pkg/config/templates/Dockerfile:18`, `FROM … AS differ`). */

apps/cli/src/legacy/commands/db/dump/dump.handler.ts

@@ -32,14 +32,14 @@ import {
   legacyBuildRoleDumpEnv,
   legacyBuildSchemaDumpEnv,
   legacyExpandScript,
-} from "../shared/legacy-pg-dump.env.ts";
-import { legacyStreamPgDump } from "../shared/legacy-pg-dump.run.ts";
+} from "../../../shared/legacy-pg-dump.env.ts";
+import { legacyStreamPgDump } from "../../../shared/legacy-pg-dump.run.ts";
 import { legacyRunWithPoolerFallback } from "../shared/legacy-pooler-fallback.ts";
 import {
   legacyDumpDataScript,
   legacyDumpRoleScript,
   legacyDumpSchemaScript,
-} from "../shared/legacy-pg-dump.scripts.ts";
+} from "../../../shared/legacy-pg-dump.scripts.ts";
 
 /**
  * Mutually-exclusive flag groups, in cobra's check order (it sorts the joined
@@ -82,7 +82,8 @@ export const legacyDbDump = Effect.fn("legacy.db.dump")(function* (flags: Legacy
     // image), reverted when this scope closes. Go's `loadNestedEnv` `os.Setenv`s the
     // project `.env`; the pure `legacyLoadProjectEnv` no longer does that as a side
     // effect of `resolveDbPassword`, so `db dump` opts in explicitly here.
-    yield* legacyApplyProjectEnv(yield* legacyLoadProjectEnv(fs, path, cliConfig.workdir));
+    const projectEnv = yield* legacyLoadProjectEnv(fs, path, cliConfig.workdir);
+    yield* legacyApplyProjectEnv(projectEnv);
 
     // The grouped boolean flags are modelled as `Option` (presence = pflag `Changed`)
     // for the mutex/target checks; resolve their effective values here for the places
@@ -307,6 +308,7 @@ export const legacyDbDump = Effect.fn("legacy.db.dump")(function* (flags: Legacy
                       env,
                       onStdout: (chunk) =>
                         file.writeAll(chunk).pipe(Effect.mapError(toOpenFileError)),
+                      projectEnvValues: projectEnv,
                     });
                   }),
                 ),
@@ -320,6 +322,7 @@ export const legacyDbDump = Effect.fn("legacy.db.dump")(function* (flags: Legacy
             script: mode.script,
             env,
             onStdout: (chunk) => output.rawBytes(chunk),
+            projectEnvValues: projectEnv,
           });
 
     // 7b. Container-level IPv6 → IPv4-pooler retry (Go's `RunWithPoolerFallback`,

apps/cli/src/legacy/commands/db/dump/dump.integration.test.ts

@@ -526,6 +526,33 @@ describe("legacy db dump integration", () => {
     }).pipe(Effect.provide(layer));
   });
 
+  it.live(
+    "resolves the pg_dump network via SUPABASE_NETWORK_ID from supabase/.env when neither the flag nor the ambient env is set",
+    () => {
+      // Go's `dockerExec` sets host networking by default (dump.go:91-93), but
+      // `DockerStart` overrides it with `viper.GetString("network-id")` whenever that
+      // resolves non-empty (docker.go:379-380) — a value sourced only from
+      // `supabase/.env` (after `loadNestedEnv`'s `os.Setenv`) still wins over host.
+      const prev = process.env["SUPABASE_NETWORK_ID"];
+      delete process.env["SUPABASE_NETWORK_ID"];
+      mkdirSync(join(tmp.current, "supabase"), { recursive: true });
+      writeFileSync(join(tmp.current, "supabase", ".env"), "SUPABASE_NETWORK_ID=dotenv-net\n");
+      const { layer, docker } = setup({ isLocal: true, workdir: tmp.current });
+      return Effect.gen(function* () {
+        yield* legacyDbDump(flags({ local: Option.some(true) }));
+        expect(docker.lastOpts?.network).toEqual({ _tag: "named", name: "dotenv-net" });
+      }).pipe(
+        Effect.ensuring(
+          Effect.sync(() => {
+            if (prev === undefined) delete process.env["SUPABASE_NETWORK_ID"];
+            else process.env["SUPABASE_NETWORK_ID"] = prev;
+          }),
+        ),
+        Effect.provide(layer),
+      );
+    },
+  );
+
   it.live("defaults to the linked connection when neither --local nor --db-url is set", () => {
     const { layer, resolver } = setup({ conn: REMOTE_CONN, isLocal: false });
     return Effect.gen(function* () {

apps/cli/src/legacy/commands/db/pull/pull.handler.ts

@@ -44,6 +44,7 @@ import {
   legacyCreateShadowDatabase,
   legacyPrepareRawShadow,
   legacyRemoveShadowDatabase,
+  legacyShadowRunInputFromLocalContainerInputs,
 } from "../../../shared/db-bootstrap/shadow-database.ts";
 import { LegacyLinkedProjectCache } from "../../../telemetry/legacy-linked-project-cache.service.ts";
 import { LegacyTelemetryState } from "../../../telemetry/legacy-telemetry-state.service.ts";
@@ -59,14 +60,17 @@ import {
 } from "../../../shared/legacy-diff-engine.ts";
 import { legacyDiffMigra } from "../shared/legacy-migra.ts";
 import { legacyWritePgDeltaMigrations } from "../shared/legacy-pgdelta-migrations.write.ts";
-import { type LegacyDumpOptions, legacyBuildSchemaDumpEnv } from "../shared/legacy-pg-dump.env.ts";
-import { legacyStreamPgDump } from "../shared/legacy-pg-dump.run.ts";
+import {
+  type LegacyDumpOptions,
+  legacyBuildSchemaDumpEnv,
+} from "../../../shared/legacy-pg-dump.env.ts";
+import { legacyStreamPgDump } from "../../../shared/legacy-pg-dump.run.ts";
 import {
   legacyEmitPoolerFallbackWarning,
   legacyIsDirectLinkedHost,
   legacyRunWithPoolerFallback,
 } from "../shared/legacy-pooler-fallback.ts";
-import { legacyDumpSchemaScript } from "../shared/legacy-pg-dump.scripts.ts";
+import { legacyDumpSchemaScript } from "../../../shared/legacy-pg-dump.scripts.ts";
 import {
   legacyFormatMigrationTimestamp,
   legacyGetMigrationPath,
@@ -81,10 +85,7 @@ import {
   legacyResolvePgDeltaProjectId,
 } from "../../../shared/legacy-pgdelta.ts";
 import { legacySaveEmptyPgDeltaPullDebug } from "./pull.debug.ts";
-import {
-  legacyPrepareShadowSource,
-  legacyShadowRunInputFromLocalContainerInputs,
-} from "../shared/legacy-shadow-source.ts";
+import { legacyPrepareShadowSource } from "../shared/legacy-shadow-source.ts";
 import type { LegacyDbPullFlags } from "./pull.command.ts";
 import {
   LegacyDbPullDumpError,
@@ -690,6 +691,7 @@ export const legacyDbPull = Effect.fn("legacy.db.pull")(function* (flags: Legacy
                         image,
                         script: legacyDumpSchemaScript,
                         env: legacyBuildSchemaDumpEnv(target, dumpEnvOpt),
+                        projectEnvValues: projectEnv,
                         onStdout: (chunk) => {
                           if (chunk.length > 0) seedWroteBytes = true;
                           return file.writeAll(chunk).pipe(

apps/cli/src/legacy/commands/db/pull/pull.integration.test.ts

@@ -35,7 +35,10 @@ import type { OutputFormat } from "../../../../shared/output/types.ts";
 import { LegacyProjectRefResolver } from "../../../config/legacy-project-ref.service.ts";
 import { LegacyDbConfigResolver } from "../../../shared/legacy-db-config.service.ts";
 import { LegacyDbConnection } from "../../../shared/legacy-db-connection.service.ts";
-import { LegacyDockerRun } from "../../../shared/legacy-docker-run.service.ts";
+import {
+  LegacyDockerRun,
+  type LegacyDockerRunOpts,
+} from "../../../shared/legacy-docker-run.service.ts";
 import { LegacyEdgeRuntimeScriptError } from "../../../shared/legacy-edge-runtime-script.errors.ts";
 import {
   type LegacyEdgeRuntimeRunOpts,
@@ -148,7 +151,11 @@ function setup(workdir: string, opts: SetupOpts = {}) {
   // `runStream`; deliver the configured bytes to `onStdout` (as Go's StdCopy would),
   // then report the exit code + stderr. `dumpFailFirstWith` fails the first attempt
   // so the pooler retry runs.
-  const dumpCalls: Array<{ env: Readonly<Record<string, string>>; image: string }> = [];
+  const dumpCalls: Array<{
+    env: Readonly<Record<string, string>>;
+    image: string;
+    network: LegacyDockerRunOpts["network"];
+  }> = [];
   let dumpRunCount = 0;
   const docker = Layer.succeed(LegacyDockerRun, {
     run: () => Effect.die("run unused"),
@@ -165,7 +172,7 @@ function setup(workdir: string, opts: SetupOpts = {}) {
           return { exitCode: 0, stderr: "" };
         }
         dumpRunCount += 1;
-        dumpCalls.push({ env: runOpts.env, image: runOpts.image });
+        dumpCalls.push({ env: runOpts.env, image: runOpts.image, network: runOpts.network });
         if (opts.dumpFailFirstWith !== undefined && dumpRunCount === 1) {
           if (opts.dumpFailFirstPartialBytes !== undefined) {
             const partial = new TextEncoder().encode(opts.dumpFailFirstPartialBytes);
@@ -1256,6 +1263,39 @@ describe("legacy db pull", () => {
     },
   );
 
+  it.effect(
+    "resolves the pg_dump network via SUPABASE_NETWORK_ID from supabase/.env when neither the flag nor the ambient env is set",
+    () => {
+      // Go's `dockerExec` sets host networking by default (dump.go:91-93), but
+      // `DockerStart` overrides it with `viper.GetString("network-id")` whenever that
+      // resolves non-empty (docker.go:379-380) — a value sourced only from
+      // `supabase/.env` (after `loadNestedEnv`'s `os.Setenv`) still wins over host.
+      const prev = process.env["SUPABASE_NETWORK_ID"];
+      delete process.env["SUPABASE_NETWORK_ID"];
+      mkdirSync(join(tmp.current, "supabase"), { recursive: true });
+      writeFileSync(join(tmp.current, "supabase", ".env"), "SUPABASE_NETWORK_ID=dotenv-net\n");
+      const s = setup(tmp.current, {
+        remoteVersions: [], // no remote history → initial-migra pg_dump path
+        dumpStdout: "create table dumped ();\n",
+        edgeStdout: "",
+        yes: true,
+      });
+      return Effect.gen(function* () {
+        yield* legacyDbPull(flags());
+        expect(s.dumpCalls.length).toBeGreaterThanOrEqual(1);
+        expect(s.dumpCalls[0]?.network).toEqual({ _tag: "named", name: "dotenv-net" });
+      }).pipe(
+        Effect.ensuring(
+          Effect.sync(() => {
+            if (prev === undefined) delete process.env["SUPABASE_NETWORK_ID"];
+            else process.env["SUPABASE_NETWORK_ID"] = prev;
+          }),
+        ),
+        Effect.provide(s.layer),
+      );
+    },
+  );
+
   it.effect("an explicit --yes=false overrides SUPABASE_YES and honors the piped answer", () => {
     // Go binds `--yes` to viper, so an explicit `--yes=false` wins over the
     // SUPABASE_YES env (AutomaticEnv). `printf 'n\n' | SUPABASE_YES=1 supabase